commit 171e2a4a0d63ad7e050a182660d465438ebe03f1
Author: wehub-resource-sync <resource-sync@wehub.local>
Date:   Mon Jul 13 12:31:02 2026 +0800

    chore: import upstream snapshot with attribution

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..b9caf00
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,10 @@
+.git
+server/
+**/node_modules
+**/dist
+**/.next
+**/.turbo
+**/.cache
+**/coverage
+**/*.log
+
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..78454b3
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# These owners will be the default owners for everything in
+*       @tolaleng
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 0000000..2647363
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,15 @@
+# These are supported funding model platforms
+
+github: #[tolaleng]
+patreon: # Replace with a single Patreon username
+open_collective: #checkcle
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
+thanks_dev: # Replace with a single thanks.dev username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..a96ffec
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,94 @@
+name: 🐛 Bug Report
+description: Report a reproducible bug to help us improve.
+title: "[Bug]: "
+labels: [bug]
+assignees: []
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Thank you for taking the time to report a bug!**
+        Please complete the form below to help us reproduce and fix the issue more effectively.
+
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: |
+        Describe the environment where the issue occurred.
+        (e.g., OS, browser, Node.js version, Docker version, etc.)
+      placeholder: "Example: Ubuntu 22.04, Chrome 125, Node.js 20.3.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: |
+        A clear and concise description of the issue you encountered.
+      placeholder: "When I do X, Y happens instead of Z..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: |
+        Provide step-by-step instructions to reproduce the issue.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. Scroll down to '...'
+        4. See the error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What did you expect to happen?
+      placeholder: "The app should..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots or Videos
+      description: |
+        If applicable, add screenshots or screen recordings to help illustrate the issue.
+      placeholder: "Drag and drop or paste screenshots here."
+    validations:
+      required: false
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: |
+        If applicable, paste any relevant logs or error messages.
+        Please remove sensitive information before submitting.
+      render: shell
+      placeholder: |
+        ```
+        Error: Something went wrong
+            at index.js:123:45
+        ```
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Checklist
+      description: |
+        Please confirm the following before submitting:
+      options:
+        - label: I have searched existing issues to avoid creating duplicates.
+          required: true
+        - label: I have provided sufficient information to reproduce the issue.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..a49eab2
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1 @@
+blank_issues_enabled: true
\ No newline at end of file
diff --git a/.github/ISSUE_TEMPLATE/documentation.yml b/.github/ISSUE_TEMPLATE/documentation.yml
new file mode 100644
index 0000000..735acc2
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/documentation.yml
@@ -0,0 +1,49 @@
+name: 📝 Documentation Improvement
+description: Suggest improvements or report issues in documentation.
+title: "[Docs]: "
+labels: [documentation]
+assignees: []
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for helping improve our documentation!
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What part of the documentation needs improvement?
+      description: |
+        Describe the issue clearly.
+      placeholder: "The installation guide is missing steps for..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: location
+    attributes:
+      label: Location
+      description: |
+        Provide a link or path to the affected documentation.
+      placeholder: "https://github.com/operacle/checkcle/docs/INSTALL.md"
+    validations:
+      required: true
+
+  - type: textarea
+    id: suggestion
+    attributes:
+      label: Suggested Change
+      description: |
+        How would you improve it?
+      placeholder: "I suggest adding a section about..."
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: confirmation
+    attributes:
+      label: Checklist
+      options:
+        - label: I have searched existing issues for similar documentation problems.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..e70309e
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,60 @@
+name: 🚀 Feature Request
+description: Suggest an idea to improve this project.
+title: "[Feature]: "
+labels: [enhancement]
+assignees: []
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Thank you for suggesting a feature!**
+        Please fill out this form so we can better understand your idea.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Feature Description
+      description: A clear and concise description of the feature you’d like to see.
+      placeholder: "I would like to have..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: motivation
+    attributes:
+      label: Motivation
+      description: Please explain why this feature would be useful.
+      placeholder: "This feature would help because..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Have you considered any alternative solutions or workarounds?
+      placeholder: "I have tried..."
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Add any other context or screenshots about the feature request here.
+      placeholder: "Links to related issues or references..."
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      description: |
+        Before submitting, please confirm:
+      options:
+        - label: I have searched existing issues to make sure this feature hasn’t been requested yet.
+          required: true
+        - label: I have described the feature clearly and provided supporting details.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/question.yml b/.github/ISSUE_TEMPLATE/question.yml
new file mode 100644
index 0000000..f45e1e1
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/question.yml
@@ -0,0 +1,54 @@
+name: ❓ Ask for Help
+description: Ask a question or request guidance related to this project.
+title: "[Question]: "
+labels: [question]
+assignees: []
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Thanks for reaching out!**
+        Please provide as much detail as possible so we can better assist you.
+
+  - type: textarea
+    id: question
+    attributes:
+      label: What do you need help with?
+      description: Clearly describe your question or what you're trying to achieve.
+      placeholder: |
+        I am trying to do X, but I'm not sure how to...
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: |
+        Provide any relevant context, related issues, pull requests, or documentation links that could help us understand your question better.
+      placeholder: "Mention related issues, links to docs, or previous discussions..."
+    validations:
+      required: false
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment Details
+      description: |
+        If relevant, provide details about your environment (e.g., OS, browser, Node.js version).
+      placeholder: "Example: Windows 11, Node.js v20.3.0, Firefox 125"
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      description: |
+        Before submitting, please confirm the following:
+      options:
+        - label: I have searched existing issues and discussions for a solution.
+          required: true
+        - label: I have read the relevant documentation.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/security_issue.yml b/.github/ISSUE_TEMPLATE/security_issue.yml
new file mode 100644
index 0000000..31e140c
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/security_issue.yml
@@ -0,0 +1,51 @@
+name: 🛡️ Security Issue
+description: Report a potential security vulnerability.
+title: "[Security]: "
+labels: [security]
+assignees: []
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ⚠️ **IMPORTANT: Please do NOT disclose sensitive security details in this public issue.**
+
+        If you believe you have found a security vulnerability, **please report it privately** to help keep users safe.
+
+        📧 **Disclosure Process:**
+        - Email: [security@checkcle.io](mailto:security@checkcle.io)
+        - Or follow our [SECURITY.md](../../blob/main/SECURITY.md) policy.
+
+        You can use this issue only to let maintainers know that you have sent or will send a report.
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: |
+        Briefly describe the type of vulnerability you believe you have found (without including sensitive details).
+      placeholder: "Example: Possible SQL injection in the user login endpoint."
+    validations:
+      required: true
+
+  - type: textarea
+    id: contact
+    attributes:
+      label: Contact Information
+      description: |
+        Provide an email or other way for maintainers to contact you if we need clarification.
+      placeholder: "your.email@example.com"
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: confirmation
+    attributes:
+      label: Confirmation
+      description: |
+        Please confirm:
+      options:
+        - label: I will not share sensitive exploit details in this issue.
+          required: true
+        - label: I have sent or will send a full report to the private disclosure contact.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/translation_request.yml b/.github/ISSUE_TEMPLATE/translation_request.yml
new file mode 100644
index 0000000..a156fca
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/translation_request.yml
@@ -0,0 +1,38 @@
+name: 🌎 Translation Request
+description: Request a translation or report translation issues.
+title: "[Translation]: "
+labels: [translation]
+assignees: []
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Help us make this project accessible in more languages!
+
+  - type: input
+    id: language
+    attributes:
+      label: Language
+      description: What language is this about?
+      placeholder: "Example: Spanish"
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Details
+      description: |
+        Describe what you’d like to have translated or what issue you found.
+      placeholder: "Please translate the Getting Started guide..."
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: confirmation
+    attributes:
+      label: Checklist
+      options:
+        - label: I have searched existing issues for similar requests.
+          required: true
diff --git a/.github/workflows/build-frontend-image.yml.dev b/.github/workflows/build-frontend-image.yml.dev
new file mode 100644
index 0000000..93d3d4d
--- /dev/null
+++ b/.github/workflows/build-frontend-image.yml.dev
@@ -0,0 +1,59 @@
+name: Build and Publish Frontend Image
+
+on:
+  push:
+    branches: [ "develop", "feature/**" ]
+    paths:
+      - 'application/**'
+      - '.github/workflows/build-frontend-image.yml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    env:
+      IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/checkcle-frontend
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=sha
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: application
+          file: application/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: false
+
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e798e2d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,29 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+pocketbase.exe
+application/src/lib/pocketbase.ts
+server/pb_data/
+Dockerfile
+application/src/lib/pocketbase-prod.ts
diff --git a/.talismanrc b/.talismanrc
new file mode 100644
index 0000000..07486f7
--- /dev/null
+++ b/.talismanrc
@@ -0,0 +1,4 @@
+fileignoreconfig:
+- filename: application/package-lock.json
+  checksum: 3253a06ef27a634ec2b8a8fe9c156288b9fcf57024623c7ddc3d321f2568e498
+version: "1.0"
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..b0ca797
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,81 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders of the **CheckCle** project pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others’ private information, such as a physical or email address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all project spaces, and also applies when an individual is officially representing the project in public spaces. Examples include using an official project email address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project team at:
+
+📧 **Email:** [hello@checkcle.io](mailto:hello@checkcle.io)
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All project maintainers are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Project maintainers will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+**1. Correction**
+
+- *Community Impact:* Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+- *Consequence:* A private, written warning from project maintainers, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+**2. Warning**
+
+- *Community Impact:* A violation through a single incident or series of actions.
+- *Consequence:* A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+**3. Temporary Ban**
+
+- *Community Impact:* A serious violation of community standards, including sustained inappropriate behavior.
+- *Consequence:* A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+**4. Permanent Ban**
+
+- *Community Impact:* Demonstrating a pattern of violation of community standards, including sustained harassment, or showing no remorse after being warned.
+- *Consequence:* A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at:
+
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+
+For answers to common questions about this code of conduct, see:
+
+https://www.contributor-covenant.org/faq
+
+[homepage]: https://www.contributor-covenant.org
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..c493080
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,181 @@
+## 🌐 Select Language
+
+<table align="center">
+  <tr>
+    <td align="center">
+      <a href="CONTRIBUTING.md">
+        <img src="https://flagcdn.com/24x18/gb.png" alt="English" />  
+        <br/><strong>English</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="docs/CONTRIBUTING_km.md">
+        <img src="https://flagcdn.com/24x18/kh.png" alt="Khmer" />  
+        <br/><strong>ខ្មែរ</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="docs/CONTRIBUTING_ja.md">
+        <img src="https://flagcdn.com/24x18/jp.png" alt="Japanese" />  
+        <br/><strong>Japanese</strong>
+      </a>
+    </td>
+  </tr>
+</table>
+
+
+<p align="center">
+  Thank you to all our contributors, users, and supporters for making this project thrive.
+</p>
+
+<p align="center">
+  🚀 <strong>Stay tuned for more updates, features, and improvements.</strong>
+</p>
+
+# 🛠️ Contributing to CheckCle
+
+Thank you for your interest in contributing to **CheckCle** — the ultimate open-source platform for real-time full-stack monitoring. Whether you're here to report bugs, suggest features, improve documentation, or submit code, your contribution matters!
+
+We welcome all kinds of contributions, big or small. This guide will help you get started.
+
+---
+
+## 📌 Table of Contents
+- [Code of Conduct](#-code-of-conduct)
+- [Ways to Contribute](#-ways-to-contribute)
+- [Development Setup](#-development-setup)
+- [Pull Request Process](#-pull-request-process)
+- [Reporting Bugs & Issues](#-reporting-bugs--issues)
+- [Feature Requests](#-feature-requests)
+- [Community & Support](#-community--support)
+- [License](#-license)
+
+---
+
+## 📜 Code of Conduct
+
+We follow a [Code of Conduct](https://opensource.guide/code-of-conduct/) to foster an open and welcoming community. By participating, you agree to uphold these standards.
+
+---
+
+## 🤝 Ways to Contribute
+
+Here are some ways you can help improve CheckCle:
+
+- 🐞 **Report Bugs** – Found a glitch? Let us know by opening a [GitHub Issue](https://github.com/operacle/checkcle/issues).
+- 🌟 **Suggest Features** – Have an idea? Start a [Discussion](https://github.com/operacle/checkcle/discussions) or open a Feature Request issue.
+- 🛠 **Submit Pull Requests** – Improve the code, fix bugs, add features, or enhance the docs.
+- 📝 **Improve Documentation** – Even a typo fix helps!
+- 🌍 **Spread the Word** – Star ⭐ the repo, share it on socials, and invite others to contribute!
+
+---
+
+## 🧰 Development Setup
+
+Before contributing code, set up the project locally:
+
+### 1. Fork the Repository
+Click "Fork" on [GitHub](https://github.com/operacle/checkcle) to create your own copy.
+
+### 2. Clone Your Fork
+```bash
+git clone https://github.com/yourusername/checkcle.git
+cd checkcle
+```
+
+### 3. Install Dependencies
+Follow the instructions in the README or project docs to install required packages and run the local development server.
+
+### 4. Start Local Development
+```bash
+#Web Application
+cd application/ 
+npm install && npm run dev
+
+#Server Backend
+cd server
+./pocketbase serve --dir pb_data 
+
+If you're not using localhost, please run with this (./pocketbase serve --http=0.0.0.0:8090 --dir pb_data)
+```
+
+### 4. Start Service Check Operation
+
+```bash
+#Server Backend 
+Start Service Operation (Check Service for PING, HTTP, TCP, DNS)
+
+cd server/service-operation
+
+go run main.go (you do not need to change the .env while it's the localhost connection)
+```
+
+### 5. Start Distributed Regional Agent
+```bash
+#### 1. Fork the Repository
+Click "Fork" on [GitHub](https://github.com/operacle/Distributed-Regional-Monitoring) to create your own copy.
+
+#### 2. Clone Your Fork
+git clone https://github.com/yourusername/Distributed-Regional-Monitoring.git
+cd Distributed-Regional-Monitoring
+
+#### 3. Install Go Service (make sure you have installed the Go Service)
+
+Copy .env.example -> .env
+Change regional agent configuration in .env file
+and Run: go run main.go
+
+```
+---
+
+## ✅ Pull Request Process
+
+1. Ensure your code follows the existing style and naming conventions.
+2. Write clear, concise commit messages.
+3. Push your branch and open a Pull Request (PR) on the `develop` branch.
+4. Provide a meaningful PR description (what/why/how).
+5. Link related issues if applicable (e.g. `Closes #12`).
+6. Make sure all checks pass (e.g., linting, tests).
+
+We’ll review your PR, request changes if needed, and merge it once ready!
+
+---
+
+## 🐛 Reporting Bugs & Issues
+
+Please include as much information as possible:
+- A clear, descriptive title
+- Steps to reproduce
+- Expected vs actual behavior
+- Environment info (OS, browser, device, etc.)
+- Screenshots or logs if applicable
+
+Use the [Issue Tracker](https://github.com/operacle/checkcle/issues) to report.
+
+---
+
+## 💡 Feature Requests
+
+We’d love to hear your ideas! Open a [Discussion](https://github.com/operacle/checkcle/discussions) or Feature Request issue. Make sure it’s not already listed in the [Roadmap](https://github.com/operacle/checkcle#development-roadmap).
+
+---
+
+## 🌍 Community & Support
+
+Need help? Want to connect?
+
+- 💬 [Join our Discord](https://discord.gg/xs9gbubGwX)
+- 🗣 Start or join a [GitHub Discussion](https://github.com/operacle/checkcle/discussions)
+- 🐦 Follow us on [X (Twitter)](https://x.com/tl)
+
+---
+
+## 📜 License
+
+By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE).
+
+---
+
+## 🙏 Thank You
+
+We’re excited to build CheckCle together — a powerful monitoring platform **for the community, by the community**. Your support means the world! 💙
diff --git a/LICENSE.md b/LICENSE.md
new file mode 100644
index 0000000..3d3d1dc
--- /dev/null
+++ b/LICENSE.md
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Tola Leng
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the “Software”), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..cb16fe5
--- /dev/null
+++ b/README.md
@@ -0,0 +1,194 @@
+## 🌐 Select Language
+
+<table align="center">
+  <tr>
+    <td align="center">
+      <a href="README.md">
+        <img src="https://flagcdn.com/24x18/gb.png" alt="English" />  
+        <br/><strong>English</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="docs/README_km.md">
+        <img src="https://flagcdn.com/24x18/kh.png" alt="Khmer" />  
+        <br/><strong>ខ្មែរ</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="docs/README_ja.md">
+        <img src="https://flagcdn.com/24x18/jp.png" alt="Japanese" />  
+        <br/><strong>Japanese</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="docs/README_zhcn.md">
+        <img src="https://flagcdn.com/24x18/cn.png" alt="Chinese" />  
+        <br/><strong>Chinese</strong>
+      </a>
+    </td>
+  </tr>
+</table>
+
+<p align="center">
+  Thank you to all our contributors, users, and supporters for making this project thrive.
+</p>
+
+<p align="center">
+  🚀 <strong>Stay tuned for more updates, features, and improvements.</strong>
+</p>
+
+![CheckCle Platform](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/server-detail-page.png)
+
+# 🚀 What is CheckCle?
+
+CheckCle is an Open Source solution for seamless, real-time monitoring of full-stack systems, applications, and infrastructure. It provides developers, sysadmins, and DevOps teams with deep insights and actionable data across every layer of their environment—whether it's servers, applications, or services. With CheckCle, you gain visibility, control, and the ability to ensure optimal performance throughout your entire technology stack.
+
+## 🎯 Live Demo  
+👉 **Try it now:** [CheckCle Live Demo](https://demo.checkcle.io)
+    User: admin@example.com | Passwd: Admin123456
+
+## 🌟 Core Features
+### 📝 Roadmap : [DEVELOPMENT_ROADMAP](docs/DEVELOPMENT_ROADMAP.md) 
+
+### Uptime Services & Infrastructure Server Monitoring 
+- Monitor HTTP, DNS, and Ping protocols
+- Monitor TCP-based, API services (e.g., FTP, SMTP, HTTP)
+- Track detail uptime, response times, and performance issues
+- Distributed Regional Monitoring
+- Incident History (UP/DOWN/WARNING/PAUSE)
+- SSL & Domain Monitoring (Domain, Issuer, Expiration Date, Days Left, Status, Last Notified)
+- Infrastructure Server Monitoring, Supports Linux (🐧 Debian, Ubuntu, CentOS, Red Hat, etc.) and Windows (Beta). And Servers metrics like CPU, RAM, disk usage, and network activity) with an one-line installation angent script.
+- Schedule Maintenance & Incident Management
+- Operational Status / Public Status Pages
+- Notifications via email, Telegram, Discord, Slack, Matrix, and more
+- Reports & Analytics
+- Settings Panel (User Management, Data Retention, Multi-language, Themes (Dark & Light Mode), Notification and channels and alert templates).
+
+## #️⃣ Getting Started
+
+### Current Architecture Support
+* ✅ x86_64 PCs, laptops, servers (amd64)
+* ✅ Modern Raspberry Pi 3/4/5 with (64-bit OS), Apple Silicon Macs (arm64)
+
+### Install CheckCle using one of the following methods:
+
+1. Install with Docker Compose Configuration (Recommended)
+```bash 
+
+version: '3.9'
+
+services:
+  checkcle:
+    image: operacle/checkcle:latest
+    container_name: checkcle
+    restart: unless-stopped
+    ports:
+      - "8090:8090"  # Web Application
+    volumes:
+      - /opt/pb_data:/mnt/pb_data  # Host directory mapped to container path
+    ulimits:
+      nofile:
+        soft: 4096
+        hard: 8192
+
+```
+2. Install with docker run. Just copy ready docker run command below
+```bash 
+docker run -d \
+  --name checkcle \
+  --restart unless-stopped \
+  -p 8090:8090 \
+  -v /opt/pb_data:/mnt/pb_data \
+  --ulimit nofile=4096:8192 \
+  operacle/checkcle:latest
+
+```
+
+3. Admin Web Management
+
+    Default URL: http://0.0.0.0:8090
+    User: admin@example.com
+    Passwd: Admin123456
+    
+4. Follow the Quick Start Guide at https://docs.checkcle.io
+
+###
+![checkcle-collapse-black](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/uptime-1.4.png)
+![Service Detail Page](https://cdn.checkcle.io/images/uptime/uptime-regional-detail.png)
+![checkcle-server-instance](https://cdn.checkcle.io/images/server/server-list.png)
+![SSL Monitoring](https://cdn.checkcle.io/images/ssl-domain/ssl-list.png)
+![Notification System](https://cdn.checkcle.io/general/powerfull_notification.png)
+
+
+## 🌟 CheckCle for Communities?
+- **Built with Passion**: Created by an open-source enthusiast for the community
+- **Free & Open Source**: Completely free to use with no hidden costs
+- **Collaborate & Connect**: Meet like-minded people passionate about Open Source
+
+---
+
+## Sponsors
+Sponsorships will no longer be accepted. From now on, support will only be accepted in the form of ecosystem and community partnerships that provide infrastructure such as cloud servers, domains, or hosting credits.
+
+If you’re a tech company interested in supporting CheckCle, please contact the author directly at tolaleng@checkcle.io
+
+### 🤝 Ecosystem & Community Partner
+<div style="display: flex; align-items: center; gap: 10px;">
+  <a href="https://github.com/gitbookio">
+    <img src="https://avatars.githubusercontent.com/u/7111340?s=200&v=4" 
+         width="75" height="75" 
+         style="border-radius: 50%;" 
+         alt="GitBook Logo" />
+  </a>
+
+  <a href="https://www.cloudflare.com">
+    <img src="https://cdn.checkcle.io/images/sponsor/cloudflare-checkcle_logo.png" 
+         height="60" 
+         alt="Cloudflare Logo" />
+  </a>
+    <a href="https://m.do.co/c/0c27ef82475f">
+    <img src="https://cdn.checkcle.io/images/sponsor/digitalocean_checkcle.png" 
+         height="50" 
+         alt="DigitalOcean Logo" />
+  </a>
+  </a>
+    <a href="https://www.jetbrains.com/">
+    <img src="https://cdn.checkcle.io/images/sponsor/jetbrains.png" 
+         height="50" 
+         alt="Jetbrains Logo" />
+  </a>
+</div>
+
+---
+
+
+## 👥 Contributors
+Thank you for contributing and continuously making CheckCle better, you're awesome 🫶
+
+[![](https://contrib.rocks/image?repo=operacle/checkcle)](https://github.com/operacle/checkcle/graphs/contributors)
+
+---
+
+## 🤝 Ways to Contribute
+
+Here are some ways you can help improve CheckCle:
+
+- 🐞 **Report Bugs** – Found a glitch? Let us know by opening a [GitHub Issue](https://github.com/operacle/checkcle/issues).
+- 🌟 **Suggest Features** – Have an idea? Start a [Discussion](https://github.com/operacle/checkcle/discussions) or open a Feature Request issue.
+- 🛠 **Submit Pull Requests** – Improve the code, fix bugs, add features, or enhance the docs.
+- 📝 **Improve Documentation** – Even a typo fix helps!
+- 🌍 **Spread the Word** – Star ⭐ the [CheckCle](https://github.com/operacle/checkcle.git)  repo, share it on socials, and invite others to contribute!
+
+---
+
+## 🌍 Stay Connected
+- Website: [checkcle.io](https://checkcle.io)
+- Documentation: [docs.checkcle.io](https://docs.checkcle.io) | Big thanks to [GitBook](https://github.com/gitbookio) for sponsoring the OSS site plan for CheckCle!
+- Chat on Discord: Join our community [@discord](https://discord.gg/xs9gbubGwX)
+- Follow us on X: [@asqrm_io](https://x.com/asqrm_io)
+
+## 📜 License
+
+CheckCle is released under the MIT License.
+
+---
diff --git a/README.wehub.md b/README.wehub.md
new file mode 100644
index 0000000..4407281
--- /dev/null
+++ b/README.wehub.md
@@ -0,0 +1,7 @@
+# WeHub 来源说明
+
+- 原始项目：`operacle/checkcle`
+- 原始仓库：https://github.com/operacle/checkcle
+- 导入方式：上游默认分支的最新快照
+- 原作者、版权和许可证信息以原始仓库及本仓库 LICENSE 为准
+- 本文件仅用于记录来源，不代表 WeHub 是原项目作者
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..ba8204e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,81 @@
+# 🔐 Security Policy
+
+## 📦 Project: [checkcle](https://github.com/operacle/checkcle)
+
+**checkcle** is a self-hosted uptime and server monitoring tool built with TypeScript and Go.
+
+We care about the security and privacy of users running this project in production environments.
+
+---
+
+## 📣 Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in this project:
+
+- **DO NOT** open a public issue to report it.
+- Please report it responsibly via one of the following methods:
+
+### 🔐 Preferred: [Report a Vulnerability via GitHub](https://github.com/operacle/checkcle/security/advisories/new)
+
+- Use the GitHub security advisory form (private and secure).
+- Attach as much detail as possible:
+  - Description of the issue
+  - Affected version or commit hash
+  - Reproduction steps
+  - Impact and any potential mitigations
+  - Logs or screenshots (if available)
+
+### 📧 Alternatively: Contact the Maintainer
+- Email: `security@checkcle.io` 
+- Optionally include a PGP public key for encrypted messages
+
+We aim to respond within **3–5 business days**.
+
+---
+
+## ✅ Supported Versions
+
+We support the latest stable release of `checkcle`. Security patches may also be applied to recent versions at our discretion.
+
+| Version | Supported |
+|---------|-----------|
+| `develop` (latest) | ✅ Yes |
+| `main` (latest) | ✅ Yes |
+| Older versions | ⚠️ Best-effort |
+| Pre-release or forks | ❌ No |
+
+---
+
+## 🔍 Security Practices
+
+CheckCle follows these practices to improve overall security:
+
+- 🔎 Regular vulnerability scanning (npm audit for JavaScript dependencies, govulncheck for Go modules)
+- ⛓️ Dependency pinning (package-lock.json and Go modules)
+- ✅ Type-safe code in TypeScript and memory-safe design in Go
+- 🧪 Continuous testing and CI pipelines
+- 🔐 No data is stored or transmitted unless explicitly configured by the user
+- 🧑‍💻 All code contributions are reviewed before merging
+
+---
+
+## ⚠️ Known Security Limitations
+
+- Outbound HTTPS requests: CheckCle agents perform outbound HTTPS connections to send metric data to the backend server. Avoid deploying in untrusted or high-risk environments without appropriate network policies and monitoring.
+- The data may be lost upon system restarts or crashes. Always ensure that backup (pb_data) and recovery mechanisms are in place in production environments.
+
+---
+
+## 📄 License
+
+This project is released under the [MIT License](./LICENSE). Use at your own risk. The Creator and contributors are not liable for misuse, data loss, or operational impact resulting from use of the software.
+
+---
+
+## 🙌 Acknowledgements
+
+We appreciate responsible disclosures from the community. Your efforts help us make the open-source ecosystem safer for everyone.
+
+Thanks & Regards,
+
+— [Tola Leng](https://github.com/tolaleng)
diff --git a/application/.dockerignore b/application/.dockerignore
new file mode 100644
index 0000000..0bacb13
--- /dev/null
+++ b/application/.dockerignore
@@ -0,0 +1,6 @@
+.git
+node_modules
+dist
+.cache
+*.log
+
diff --git a/application/.gitignore b/application/.gitignore
new file mode 100644
index 0000000..a547bf3
--- /dev/null
+++ b/application/.gitignore
@@ -0,0 +1,24 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
diff --git a/application/bun.lockb b/application/bun.lockb
new file mode 100644
index 0000000..160304d
Binary files /dev/null and b/application/bun.lockb differ
diff --git a/application/components.json b/application/components.json
new file mode 100644
index 0000000..f29e3f1
--- /dev/null
+++ b/application/components.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "default",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "tailwind.config.ts",
+    "css": "src/index.css",
+    "baseColor": "slate",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  }
+}
\ No newline at end of file
diff --git a/application/eslint.config.js b/application/eslint.config.js
new file mode 100644
index 0000000..e67846f
--- /dev/null
+++ b/application/eslint.config.js
@@ -0,0 +1,29 @@
+import js from "@eslint/js";
+import globals from "globals";
+import reactHooks from "eslint-plugin-react-hooks";
+import reactRefresh from "eslint-plugin-react-refresh";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: ["dist"] },
+  {
+    extends: [js.configs.recommended, ...tseslint.configs.recommended],
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      ecmaVersion: 2020,
+      globals: globals.browser,
+    },
+    plugins: {
+      "react-hooks": reactHooks,
+      "react-refresh": reactRefresh,
+    },
+    rules: {
+      ...reactHooks.configs.recommended.rules,
+      "react-refresh/only-export-components": [
+        "warn",
+        { allowConstantExport: true },
+      ],
+      "@typescript-eslint/no-unused-vars": "off",
+    },
+  }
+);
diff --git a/application/index.html b/application/index.html
new file mode 100644
index 0000000..bf65603
--- /dev/null
+++ b/application/index.html
@@ -0,0 +1,25 @@
+
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>CheckCle</title>
+    <meta name="description" content="An open-source monitoring platform offering real-time insights into server and service health, incident management, and operational transparency." />
+    <meta name="author" content="Tola Leng" />
+
+    <meta property="og:title" content="checkcle-an-open-source" />
+    <meta property="og:description" content="An open-source monitoring platform offering real-time insights into server and service health, incident management, and operational transparency." />
+    <meta property="og:type" content="website" />
+    <meta property="og:image" content="https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/checkcle-black.png" />
+
+    <meta name="twitter:card" content="summary_large_image" />
+    <meta name="twitter:site" content="@checkcle_oss" />
+    <meta name="twitter:image" content="https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/checkcle-black.png" />
+  </head>
+
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
diff --git a/application/package-lock.json b/application/package-lock.json
new file mode 100644
index 0000000..d08ffa2
--- /dev/null
+++ b/application/package-lock.json
@@ -0,0 +1,6942 @@
+{
+  "name": "vite_react_shadcn_ts",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "vite_react_shadcn_ts",
+      "version": "0.0.0",
+      "dependencies": {
+        "@hookform/resolvers": "^3.9.0",
+        "@radix-ui/react-accordion": "^1.2.0",
+        "@radix-ui/react-alert-dialog": "^1.1.1",
+        "@radix-ui/react-aspect-ratio": "^1.1.0",
+        "@radix-ui/react-avatar": "^1.1.0",
+        "@radix-ui/react-checkbox": "^1.1.1",
+        "@radix-ui/react-collapsible": "^1.1.0",
+        "@radix-ui/react-context-menu": "^2.2.1",
+        "@radix-ui/react-dialog": "^1.1.2",
+        "@radix-ui/react-dropdown-menu": "^2.1.1",
+        "@radix-ui/react-hover-card": "^1.1.1",
+        "@radix-ui/react-label": "^2.1.0",
+        "@radix-ui/react-menubar": "^1.1.1",
+        "@radix-ui/react-navigation-menu": "^1.2.0",
+        "@radix-ui/react-popover": "^1.1.1",
+        "@radix-ui/react-progress": "^1.1.0",
+        "@radix-ui/react-radio-group": "^1.2.0",
+        "@radix-ui/react-scroll-area": "^1.1.0",
+        "@radix-ui/react-select": "^2.1.1",
+        "@radix-ui/react-separator": "^1.1.6",
+        "@radix-ui/react-slider": "^1.2.0",
+        "@radix-ui/react-slot": "^1.1.0",
+        "@radix-ui/react-switch": "^1.1.0",
+        "@radix-ui/react-tabs": "^1.1.0",
+        "@radix-ui/react-toast": "^1.2.1",
+        "@radix-ui/react-toggle": "^1.1.0",
+        "@radix-ui/react-toggle-group": "^1.1.0",
+        "@radix-ui/react-tooltip": "^1.1.4",
+        "@tanstack/react-query": "^5.56.2",
+        "class-variance-authority": "^0.7.1",
+        "clsx": "^2.1.1",
+        "cmdk": "^1.0.0",
+        "date-fns": "^3.6.0",
+        "embla-carousel-react": "^8.3.0",
+        "input-otp": "^1.2.4",
+        "jspdf": "^3.0.1",
+        "jspdf-autotable": "^5.0.2",
+        "lucide-react": "^0.462.0",
+        "next-themes": "^0.3.0",
+        "pocketbase": "^0.26.8",
+        "react": "^18.3.1",
+        "react-day-picker": "^8.10.1",
+        "react-dom": "^18.3.1",
+        "react-hook-form": "^7.53.0",
+        "react-resizable-panels": "^2.1.3",
+        "react-router-dom": "^6.26.2",
+        "recharts": "^2.12.7",
+        "sonner": "^1.5.0",
+        "tailwind-merge": "^2.5.2",
+        "tailwindcss-animate": "^1.0.7",
+        "vaul": "^0.9.3",
+        "zod": "^3.23.8"
+      },
+      "devDependencies": {
+        "@eslint/js": "^9.9.0",
+        "@tailwindcss/typography": "^0.5.15",
+        "@types/node": "^22.5.5",
+        "@types/react": "^18.3.3",
+        "@types/react-dom": "^18.3.0",
+        "@vitejs/plugin-react-swc": "^3.5.0",
+        "autoprefixer": "^10.4.20",
+        "eslint": "^9.9.0",
+        "eslint-plugin-react-hooks": "^5.1.0-rc.0",
+        "eslint-plugin-react-refresh": "^0.4.9",
+        "globals": "^15.9.0",
+        "postcss": "^8.4.47",
+        "tailwindcss": "^3.4.11",
+        "typescript": "^5.5.3",
+        "typescript-eslint": "^8.0.1",
+        "vite": "^5.4.1"
+      }
+    },
+    "node_modules/@alloc/quick-lru": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
+      "integrity": "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@babel/runtime": {
+      "version": "7.28.3",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.3.tgz",
+      "integrity": "sha512-9uIQ10o0WGdpP6GDhXcdOJPJuDgFtIDtN/9+ArJQ2NAfAmiuhTQdzkaTGR33v43GYS2UrSA0eX2pPPHoFVvpxA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.21.5.tgz",
+      "integrity": "sha512-1SDgH6ZSPTlggy1yI6+Dbkiz8xzpHJEVAlF/AM1tHPLsf5STom9rwtjE4hKAF20FfXXNTFqEYXyJNWh1GiZedQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.21.5.tgz",
+      "integrity": "sha512-vCPvzSjpPHEi1siZdlvAlsPxXl7WbOVUBBAowWug4rJHb68Ox8KualB+1ocNvT5fjv6wpkX6o/iEpbDrf68zcg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.21.5.tgz",
+      "integrity": "sha512-c0uX9VAUBQ7dTDCjq+wdyGLowMdtR/GoC2U5IYk/7D1H1JYC0qseD7+11iMP2mRLN9RcCMRcjC4YMclCzGwS/A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.21.5.tgz",
+      "integrity": "sha512-D7aPRUUNHRBwHxzxRvp856rjUHRFW1SdQATKXH2hqA0kAZb1hKmi02OpYRacl0TxIGz/ZmXWlbZgjwWYaCakTA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.21.5.tgz",
+      "integrity": "sha512-DwqXqZyuk5AiWWf3UfLiRDJ5EDd49zg6O9wclZ7kUMv2WRFr4HKjXp/5t8JZ11QbQfUS6/cRCKGwYhtNAY88kQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.21.5.tgz",
+      "integrity": "sha512-se/JjF8NlmKVG4kNIuyWMV/22ZaerB+qaSi5MdrXtd6R08kvs2qCN4C09miupktDitvh8jRFflwGFBQcxZRjbw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.21.5.tgz",
+      "integrity": "sha512-5JcRxxRDUJLX8JXp/wcBCy3pENnCgBR9bN6JsY4OmhfUtIHe3ZW0mawA7+RDAcMLrMIZaf03NlQiX9DGyB8h4g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.21.5.tgz",
+      "integrity": "sha512-J95kNBj1zkbMXtHVH29bBriQygMXqoVQOQYA+ISs0/2l3T9/kj42ow2mpqerRBxDJnmkUDCaQT/dfNXWX/ZZCQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.21.5.tgz",
+      "integrity": "sha512-bPb5AHZtbeNGjCKVZ9UGqGwo8EUu4cLq68E95A53KlxAPRmUyYv2D6F0uUI65XisGOL1hBP5mTronbgo+0bFcA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.21.5.tgz",
+      "integrity": "sha512-ibKvmyYzKsBeX8d8I7MH/TMfWDXBF3db4qM6sy+7re0YXya+K1cem3on9XgdT2EQGMu4hQyZhan7TeQ8XkGp4Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.21.5.tgz",
+      "integrity": "sha512-YvjXDqLRqPDl2dvRODYmmhz4rPeVKYvppfGYKSNGdyZkA01046pLWyRKKI3ax8fbJoK5QbxblURkwK/MWY18Tg==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.21.5.tgz",
+      "integrity": "sha512-uHf1BmMG8qEvzdrzAqg2SIG/02+4/DHB6a9Kbya0XDvwDEKCoC8ZRWI5JJvNdUjtciBGFQ5PuBlpEOXQj+JQSg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.21.5.tgz",
+      "integrity": "sha512-IajOmO+KJK23bj52dFSNCMsz1QP1DqM6cwLUv3W1QwyxkyIWecfafnI555fvSGqEKwjMXVLokcV5ygHW5b3Jbg==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.21.5.tgz",
+      "integrity": "sha512-1hHV/Z4OEfMwpLO8rp7CvlhBDnjsC3CttJXIhBi+5Aj5r+MBvy4egg7wCbe//hSsT+RvDAG7s81tAvpL2XAE4w==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.21.5.tgz",
+      "integrity": "sha512-2HdXDMd9GMgTGrPWnJzP2ALSokE/0O5HhTUvWIbD3YdjME8JwvSCnNGBnTThKGEB91OZhzrJ4qIIxk/SBmyDDA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.21.5.tgz",
+      "integrity": "sha512-zus5sxzqBJD3eXxwvjN1yQkRepANgxE9lgOW2qLnmr8ikMTphkjgXu1HR01K4FJg8h1kEEDAqDcZQtbrRnB41A==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.21.5.tgz",
+      "integrity": "sha512-1rYdTpyv03iycF1+BhzrzQJCdOuAOtaqHTWJZCWvijKD2N5Xu0TtVC8/+1faWqcP9iBCWOmjmhoH94dH82BxPQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.21.5.tgz",
+      "integrity": "sha512-Woi2MXzXjMULccIwMnLciyZH4nCIMpWQAs049KEeMvOcNADVxo0UBIQPfSmxB3CWKedngg7sWZdLvLczpe0tLg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.21.5.tgz",
+      "integrity": "sha512-HLNNw99xsvx12lFBUwoT8EVCsSvRNDVxNpjZ7bPn947b8gJPzeHWyNVhFsaerc0n3TsbOINvRP2byTZ5LKezow==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.21.5.tgz",
+      "integrity": "sha512-6+gjmFpfy0BHU5Tpptkuh8+uw3mnrvgs+dSPQXQOv3ekbordwnzTVEb4qnIvQcYXq6gzkyTnoZ9dZG+D4garKg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.21.5.tgz",
+      "integrity": "sha512-Z0gOTd75VvXqyq7nsl93zwahcTROgqvuAcYDUr+vOv8uHhNSKROyU961kgtCD1e95IqPKSQKH7tBTslnS3tA8A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.21.5.tgz",
+      "integrity": "sha512-SWXFF1CL2RVNMaVs+BBClwtfZSvDgtL//G/smwAc5oVK/UPu2Gu9tIaRgFmYFFKrmg3SyAjSrElf0TiJ1v8fYA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.21.5.tgz",
+      "integrity": "sha512-tQd/1efJuzPC6rCFwEvLtci/xNFcTZknmXs98FYDfGE4wP9ClFV98nyKrzJKVPMhdDnjzLhdUyMX4PsQAPjwIw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@eslint-community/eslint-utils": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.4.0.tgz",
+      "integrity": "sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eslint-visitor-keys": "^3.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+      }
+    },
+    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@eslint-community/regexpp": {
+      "version": "4.11.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.11.1.tgz",
+      "integrity": "sha512-m4DVN9ZqskZoLU5GlWZadwDnYo3vAEydiUayB9widCl9ffWx2IvPnp6n3on5rJmziJSw9Bv+Z3ChDVdMwXCY8Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@eslint/config-array": {
+      "version": "0.18.0",
+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.18.0.tgz",
+      "integrity": "sha512-fTxvnS1sRMu3+JjXwJG0j/i4RT9u4qJ+lqS/yCGap4lH4zZGzQ7tu+xZqQmcMZq5OBZDL4QRxQzRjkWcGt8IVw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/object-schema": "^2.1.4",
+        "debug": "^4.3.1",
+        "minimatch": "^3.1.2"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/core": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.7.0.tgz",
+      "integrity": "sha512-xp5Jirz5DyPYlPiKat8jaq0EmYvDXKKpzTbxXMpT9eqlRJkRKIz9AGMdlvYjih+im+QlhWrpvVjl8IPC/lHlUw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/eslintrc": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.1.0.tgz",
+      "integrity": "sha512-4Bfj15dVJdoy3RfZmmo86RK1Fwzn6SstsvK9JS+BaVKqC6QQQQyXekNaC+g+LKNgkQ+2VhGAzm6hO40AhMR3zQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^6.12.4",
+        "debug": "^4.3.2",
+        "espree": "^10.0.1",
+        "globals": "^14.0.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.1.0",
+        "minimatch": "^3.1.2",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/globals": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
+      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@eslint/js": {
+      "version": "9.13.0",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.13.0.tgz",
+      "integrity": "sha512-IFLyoY4d72Z5y/6o/BazFBezupzI/taV8sGumxTAVw3lXG9A6md1Dc34T9s1FoD/an9pJH8RHbAxsaEbBed9lA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/object-schema": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.4.tgz",
+      "integrity": "sha512-BsWiH1yFGjXXS2yvrf5LyuoSIIbPrGUWob917o+BTKuZ7qJdxX8aJLRxs1fS9n6r7vESrq1OUqb68dANcFXuQQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.2.3.tgz",
+      "integrity": "sha512-2b/g5hRmpbb1o4GnTZax9N9m0FXzz9OV42ZzI4rDDMDuHUqigAiQCEWChBWCY4ztAGVRjoWT19v0yMmc5/L5kA==",
+      "dev": true,
+      "dependencies": {
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@floating-ui/core": {
+      "version": "1.6.8",
+      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.6.8.tgz",
+      "integrity": "sha512-7XJ9cPU+yI2QeLS+FCSlqNFZJq8arvswefkZrYI1yQBbftw6FyrZOxYSh+9S7z7TpeWlRt9zJ5IhM1WIL334jA==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/utils": "^0.2.8"
+      }
+    },
+    "node_modules/@floating-ui/dom": {
+      "version": "1.6.11",
+      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.6.11.tgz",
+      "integrity": "sha512-qkMCxSR24v2vGkhYDo/UzxfJN3D4syqSjyuTFz6C7XcpU1pASPRieNI0Kj5VP3/503mOfYiGY891ugBX1GlABQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/core": "^1.6.0",
+        "@floating-ui/utils": "^0.2.8"
+      }
+    },
+    "node_modules/@floating-ui/react-dom": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.1.2.tgz",
+      "integrity": "sha512-06okr5cgPzMNBy+Ycse2A6udMi4bqwW/zgBF/rwjcNqWkyr82Mcg8b0vjX8OJpZFy/FKjJmw6wV7t44kK6kW7A==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/dom": "^1.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@floating-ui/utils": {
+      "version": "0.2.8",
+      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.8.tgz",
+      "integrity": "sha512-kym7SodPp8/wloecOpcmSnWJsK7M0E5Wg8UcFA+uO4B9s5d0ywXOEro/8HM9x0rW+TljRzul/14UYz3TleT3ig==",
+      "license": "MIT"
+    },
+    "node_modules/@hookform/resolvers": {
+      "version": "3.9.0",
+      "resolved": "https://registry.npmjs.org/@hookform/resolvers/-/resolvers-3.9.0.tgz",
+      "integrity": "sha512-bU0Gr4EepJ/EQsH/IwEzYLsT/PEj5C0ynLQ4m+GSHS+xKH4TfSelhluTgOaoc4kA5s7eCsQbM4wvZLzELmWzUg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react-hook-form": "^7.0.0"
+      }
+    },
+    "node_modules/@humanfs/core": {
+      "version": "0.19.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.0.tgz",
+      "integrity": "sha512-2cbWIHbZVEweE853g8jymffCA+NCMiuqeECeBBLm8dg2oFdjuGJhgN4UAbI+6v0CKbbhvtXA4qV8YR5Ji86nmw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/node": {
+      "version": "0.16.5",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.5.tgz",
+      "integrity": "sha512-KSPA4umqSG4LHYRodq31VDwKAvaTF4xmVlzM8Aeh4PlU1JQ3IG0wiA8C25d3RQ9nJyM3mBHyI53K06VVL/oFFg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/core": "^0.19.0",
+        "@humanwhocodes/retry": "^0.3.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanwhocodes/module-importer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.22"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@humanwhocodes/retry": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.3.1.tgz",
+      "integrity": "sha512-JBxkERygn7Bv/GbN5Rv8Ul6LVknS+5Bp6RgDC/O8gEBU/yeH5Ui5C/OlWrTb6qct7LjjfT6Re2NxB0ln0yYybA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.5.tgz",
+      "integrity": "sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/set-array": "^1.2.1",
+        "@jridgewell/sourcemap-codec": "^1.4.10",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/set-array": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.2.1.tgz",
+      "integrity": "sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.0.tgz",
+      "integrity": "sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.25",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.25.tgz",
+      "integrity": "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@radix-ui/number": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/number/-/number-1.1.0.tgz",
+      "integrity": "sha512-V3gRzhVNU1ldS5XhAPTom1fOIo4ccrjjJgmE+LI2h/WaFpHmx0MQApT+KZHnx8abG6Avtfcz4WoEciMnpFT3HQ==",
+      "license": "MIT"
+    },
+    "node_modules/@radix-ui/primitive": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.0.tgz",
+      "integrity": "sha512-4Z8dn6Upk0qk4P74xBhZ6Hd/w0mPEzOOLxy4xiPXOXqjF7jZS0VAKk7/x/H6FyY2zCkYJqePf1G5KmkmNJ4RBA==",
+      "license": "MIT"
+    },
+    "node_modules/@radix-ui/react-accordion": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-accordion/-/react-accordion-1.2.1.tgz",
+      "integrity": "sha512-bg/l7l5QzUjgsh8kjwDFommzAshnUsuVMV5NM56QVCm+7ZckYdd9P/ExR8xG/Oup0OajVxNLaHJ1tb8mXk+nzQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-collapsible": "1.1.1",
+        "@radix-ui/react-collection": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-alert-dialog": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-alert-dialog/-/react-alert-dialog-1.1.2.tgz",
+      "integrity": "sha512-eGSlLzPhKO+TErxkiGcCZGuvbVMnLA1MTnyBksGOeGRGkxHiiJUujsjmNTdWTm4iHVSRaUao9/4Ur671auMghQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-dialog": "1.1.2",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-slot": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-arrow": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.0.tgz",
+      "integrity": "sha512-FmlW1rCg7hBpEBwFbjHwCW6AmWLQM6g/v0Sn8XbP9NvmSZ2San1FpQeyPtufzOMSIx7Y4dzjlHoifhp+7NkZhw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.0.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-aspect-ratio": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-aspect-ratio/-/react-aspect-ratio-1.1.0.tgz",
+      "integrity": "sha512-dP87DM/Y7jFlPgUZTlhx6FF5CEzOiaxp2rBCKlaXlpH5Ip/9Fg5zZ9lDOQ5o/MOfUlf36eak14zoWYpgcgGoOg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.0.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-avatar": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-avatar/-/react-avatar-1.1.1.tgz",
+      "integrity": "sha512-eoOtThOmxeoizxpX6RiEsQZ2wj5r4+zoeqAwO0cBaFQGjJwIH3dIX0OCxNrCyrrdxG+vBweMETh3VziQG7c1kw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-checkbox": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-checkbox/-/react-checkbox-1.1.2.tgz",
+      "integrity": "sha512-/i0fl686zaJbDQLNKrkCbMyDm6FQMt4jg323k7HuqitoANm9sE23Ql8yOK3Wusk34HSLKDChhMux05FnP6KUkw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-use-previous": "1.1.0",
+        "@radix-ui/react-use-size": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-collapsible": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collapsible/-/react-collapsible-1.1.1.tgz",
+      "integrity": "sha512-1///SnrfQHJEofLokyczERxQbWfCGQlQ2XsCZMucVs6it+lq9iw4vXy+uDn1edlb58cOZOWSldnfPAYcT4O/Yg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-collection": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.0.tgz",
+      "integrity": "sha512-GZsZslMJEyo1VKm5L1ZJY8tGDxZNPAoUeQUIbKeJfoi7Q4kmig5AsgLMYYuyYbfjd8fBmFORAIwYAkXMnXZgZw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-slot": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-collection/node_modules/@radix-ui/react-context": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.0.tgz",
+      "integrity": "sha512-OKrckBy+sMEgYM/sMmqmErVn0kZqrHPJze+Ql3DzYsDDp0hl0L62nx/2122/Bvps1qz645jlcu2tD9lrRSdf8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-compose-refs": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.1.0.tgz",
+      "integrity": "sha512-b4inOtiaOnYf9KWyO3jAeeCG6FeyfY6ldiEPanbUjWd+xIk5wZeHa8yVwmrJ2vderhu/BQvzCrJI0lHd+wIiqw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-context": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.1.tgz",
+      "integrity": "sha512-UASk9zi+crv9WteK/NU4PLvOoL3OuE6BWVKNF6hPRBtYBDXQ2u5iu3O59zUlJiTVvkyuycnqrztsHVJwcK9K+Q==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-context-menu": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context-menu/-/react-context-menu-2.2.2.tgz",
+      "integrity": "sha512-99EatSTpW+hRYHt7m8wdDlLtkmTovEe8Z/hnxUPV+SKuuNL5HWNhQI4QSdjZqNSgXHay2z4M3Dym73j9p2Gx5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-menu": "2.1.2",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dialog": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.2.tgz",
+      "integrity": "sha512-Yj4dZtqa2o+kG61fzB0H2qUvmwBA2oyQroGLyNtBj1beo1khoQ3q1a2AO8rrQYjd8256CO9+N8L9tvsS+bnIyA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-dismissable-layer": "1.1.1",
+        "@radix-ui/react-focus-guards": "1.1.1",
+        "@radix-ui/react-focus-scope": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-portal": "1.1.2",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-slot": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "aria-hidden": "^1.1.1",
+        "react-remove-scroll": "2.6.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-direction": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.0.tgz",
+      "integrity": "sha512-BUuBvgThEiAXh2DWu93XsT+a3aWrGqolGlqqw5VU1kG7p/ZH2cuDlM1sRLNnY3QcBS69UIz2mcKhMxDsdewhjg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dismissable-layer": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.1.tgz",
+      "integrity": "sha512-QSxg29lfr/xcev6kSz7MAlmDnzbP1eI/Dwn3Tp1ip0KT5CUELsxkekFEMVBEoykI3oV39hKT4TKZzBNMbcTZYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-escape-keydown": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dropdown-menu": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.2.tgz",
+      "integrity": "sha512-GVZMR+eqK8/Kes0a36Qrv+i20bAPXSn8rCBTHx30w+3ECnR5o3xixAlqcVaYvLeyKUsm0aqyhWfmUcqufM8nYA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-menu": "2.1.2",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-guards": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.1.1.tgz",
+      "integrity": "sha512-pSIwfrT1a6sIoDASCSpFwOasEwKTZWDw/iBdtnqKO7v6FeOzYJ7U53cPzYFVR3geGGXgVHaH+CdngrrAzqUGxg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-scope": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.0.tgz",
+      "integrity": "sha512-200UD8zylvEyL8Bx+z76RJnASR2gRMuxlgFCPAe/Q/679a/r0eK3MBVYMb7vZODZcffZBdob1EGnky78xmVvcA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-hover-card": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-hover-card/-/react-hover-card-1.1.2.tgz",
+      "integrity": "sha512-Y5w0qGhysvmqsIy6nQxaPa6mXNKznfoGjOfBgzOjocLxr2XlSjqBMYQQL+FfyogsMuX+m8cZyQGYhJxvxUzO4w==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-dismissable-layer": "1.1.1",
+        "@radix-ui/react-popper": "1.2.0",
+        "@radix-ui/react-portal": "1.1.2",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-id": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-id/-/react-id-1.1.0.tgz",
+      "integrity": "sha512-EJUrI8yYh7WOjNOqpoJaf1jlFIH2LvtgAl+YcFqNCa+4hj64ZXmPkAKOFs/ukjz3byN6bdb/AVUqHkI8/uWWMA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-label": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-label/-/react-label-2.1.0.tgz",
+      "integrity": "sha512-peLblDlFw/ngk3UWq0VnYaOLy6agTZZ+MUO/WhVfm14vJGML+xH4FAl2XQGLqdefjNb7ApRg6Yn7U42ZhmYXdw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.0.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-menu": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menu/-/react-menu-2.1.2.tgz",
+      "integrity": "sha512-lZ0R4qR2Al6fZ4yCCZzu/ReTFrylHFxIqy7OezIpWF4bL0o9biKo0pFIvkaew3TyZ9Fy5gYVrR5zCGZBVbO1zg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-collection": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-dismissable-layer": "1.1.1",
+        "@radix-ui/react-focus-guards": "1.1.1",
+        "@radix-ui/react-focus-scope": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-popper": "1.2.0",
+        "@radix-ui/react-portal": "1.1.2",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-roving-focus": "1.1.0",
+        "@radix-ui/react-slot": "1.1.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "aria-hidden": "^1.1.1",
+        "react-remove-scroll": "2.6.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-menubar": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menubar/-/react-menubar-1.1.2.tgz",
+      "integrity": "sha512-cKmj5Gte7LVyuz+8gXinxZAZECQU+N7aq5pw7kUPpx3xjnDXDbsdzHtCCD2W72bwzy74AvrqdYnKYS42ueskUQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-collection": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-menu": "2.1.2",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-roving-focus": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-navigation-menu": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-navigation-menu/-/react-navigation-menu-1.2.1.tgz",
+      "integrity": "sha512-egDo0yJD2IK8L17gC82vptkvW1jLeni1VuqCyzY727dSJdk5cDjINomouLoNk8RVF7g2aNIfENKWL4UzeU9c8Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-collection": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-dismissable-layer": "1.1.1",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0",
+        "@radix-ui/react-use-previous": "1.1.0",
+        "@radix-ui/react-visually-hidden": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-popover": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popover/-/react-popover-1.1.2.tgz",
+      "integrity": "sha512-u2HRUyWW+lOiA2g0Le0tMmT55FGOEWHwPFt1EPfbLly7uXQExFo5duNKqG2DzmFXIdqOeNd+TpE8baHWJCyP9w==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-dismissable-layer": "1.1.1",
+        "@radix-ui/react-focus-guards": "1.1.1",
+        "@radix-ui/react-focus-scope": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-popper": "1.2.0",
+        "@radix-ui/react-portal": "1.1.2",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-slot": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "aria-hidden": "^1.1.1",
+        "react-remove-scroll": "2.6.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-popper": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popper/-/react-popper-1.2.0.tgz",
+      "integrity": "sha512-ZnRMshKF43aBxVWPWvbj21+7TQCvhuULWJ4gNIKYpRlQt5xGRhLx66tMp8pya2UkGHTSlhpXwmjqltDYHhw7Vg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/react-dom": "^2.0.0",
+        "@radix-ui/react-arrow": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0",
+        "@radix-ui/react-use-rect": "1.1.0",
+        "@radix-ui/react-use-size": "1.1.0",
+        "@radix-ui/rect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-popper/node_modules/@radix-ui/react-context": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.0.tgz",
+      "integrity": "sha512-OKrckBy+sMEgYM/sMmqmErVn0kZqrHPJze+Ql3DzYsDDp0hl0L62nx/2122/Bvps1qz645jlcu2tD9lrRSdf8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-portal": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.2.tgz",
+      "integrity": "sha512-WeDYLGPxJb/5EGBoedyJbT0MpoULmwnIPMJMSldkuiMsBAv7N1cRdsTWZWht9vpPOiN3qyiGAtbK2is47/uMFg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-presence": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.1.1.tgz",
+      "integrity": "sha512-IeFXVi4YS1K0wVZzXNrbaaUvIJ3qdY+/Ih4eHFhWA9SwGR9UDX7Ck8abvL57C4cv3wwMvUE0OG69Qc3NCcTe/A==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-primitive": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.0.0.tgz",
+      "integrity": "sha512-ZSpFm0/uHa8zTvKBDjLFWLo8dkr4MBsiDLz0g3gMUwqgLHz9rTaRRGYDgvZPtBJgYCBKXkS9fzmoySgr8CO6Cw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-slot": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-progress": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-progress/-/react-progress-1.1.0.tgz",
+      "integrity": "sha512-aSzvnYpP725CROcxAOEBVZZSIQVQdHgBr2QQFKySsaD14u8dNT0batuXI+AAGDdAHfXH8rbnHmjYFqVJ21KkRg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-context": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-progress/node_modules/@radix-ui/react-context": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.0.tgz",
+      "integrity": "sha512-OKrckBy+sMEgYM/sMmqmErVn0kZqrHPJze+Ql3DzYsDDp0hl0L62nx/2122/Bvps1qz645jlcu2tD9lrRSdf8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-radio-group": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-radio-group/-/react-radio-group-1.2.1.tgz",
+      "integrity": "sha512-kdbv54g4vfRjja9DNWPMxKvXblzqbpEC8kspEkZ6dVP7kQksGCn+iZHkcCz2nb00+lPdRvxrqy4WrvvV1cNqrQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-roving-focus": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-use-previous": "1.1.0",
+        "@radix-ui/react-use-size": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-roving-focus": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.0.tgz",
+      "integrity": "sha512-EA6AMGeq9AEeQDeSH0aZgG198qkfHSbvWTf1HvoDmOB5bBG/qTxjYMWUKMnYiV6J/iP/J8MEFSuB2zRU2n7ODA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-collection": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.0",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-roving-focus/node_modules/@radix-ui/react-context": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.0.tgz",
+      "integrity": "sha512-OKrckBy+sMEgYM/sMmqmErVn0kZqrHPJze+Ql3DzYsDDp0hl0L62nx/2122/Bvps1qz645jlcu2tD9lrRSdf8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-scroll-area": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-scroll-area/-/react-scroll-area-1.2.0.tgz",
+      "integrity": "sha512-q2jMBdsJ9zB7QG6ngQNzNwlvxLQqONyL58QbEGwuyRZZb/ARQwk3uQVbCF7GvQVOtV6EU/pDxAw3zRzJZI3rpQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/number": "1.1.0",
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-select": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-select/-/react-select-2.1.2.tgz",
+      "integrity": "sha512-rZJtWmorC7dFRi0owDmoijm6nSJH1tVw64QGiNIZ9PNLyBDtG+iAq+XGsya052At4BfarzY/Dhv9wrrUr6IMZA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/number": "1.1.0",
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-collection": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-dismissable-layer": "1.1.1",
+        "@radix-ui/react-focus-guards": "1.1.1",
+        "@radix-ui/react-focus-scope": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-popper": "1.2.0",
+        "@radix-ui/react-portal": "1.1.2",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-slot": "1.1.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0",
+        "@radix-ui/react-use-previous": "1.1.0",
+        "@radix-ui/react-visually-hidden": "1.1.0",
+        "aria-hidden": "^1.1.1",
+        "react-remove-scroll": "2.6.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-separator": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-separator/-/react-separator-1.1.7.tgz",
+      "integrity": "sha512-0HEb8R9E8A+jZjvmFCy/J4xhbXy3TV+9XSnGJ3KvTtjlIUy/YQ/p6UYZvi7YbeoeXdyU9+Y3scizK6hkY37baA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-separator/node_modules/@radix-ui/react-compose-refs": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.1.2.tgz",
+      "integrity": "sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-separator/node_modules/@radix-ui/react-primitive": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.3.tgz",
+      "integrity": "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-slot": "1.2.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-separator/node_modules/@radix-ui/react-slot": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.2.3.tgz",
+      "integrity": "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-slider": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slider/-/react-slider-1.2.1.tgz",
+      "integrity": "sha512-bEzQoDW0XP+h/oGbutF5VMWJPAl/UU8IJjr7h02SOHDIIIxq+cep8nItVNoBV+OMmahCdqdF38FTpmXoqQUGvw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/number": "1.1.0",
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-collection": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0",
+        "@radix-ui/react-use-previous": "1.1.0",
+        "@radix-ui/react-use-size": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-slot": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.1.0.tgz",
+      "integrity": "sha512-FUCf5XMfmW4dtYl69pdS4DbxKy8nj4M7SafBgPllysxmdachynNflAdp/gCsnYWNDnge6tI9onzMp5ARYc1KNw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-switch": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-switch/-/react-switch-1.1.1.tgz",
+      "integrity": "sha512-diPqDDoBcZPSicYoMWdWx+bCPuTRH4QSp9J+65IvtdS0Kuzt67bI6n32vCj8q6NZmYW/ah+2orOtMwcX5eQwIg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-use-previous": "1.1.0",
+        "@radix-ui/react-use-size": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-tabs": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-tabs/-/react-tabs-1.1.1.tgz",
+      "integrity": "sha512-3GBUDmP2DvzmtYLMsHmpA1GtR46ZDZ+OreXM/N+kkQJOPIgytFWWTfDQmBQKBvaFS0Vno0FktdbVzN28KGrMdw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-roving-focus": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-toast": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toast/-/react-toast-1.2.2.tgz",
+      "integrity": "sha512-Z6pqSzmAP/bFJoqMAston4eSNa+ud44NSZTiZUmUen+IOZ5nBY8kzuU5WDBVyFXPtcW6yUalOHsxM/BP6Sv8ww==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-collection": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-dismissable-layer": "1.1.1",
+        "@radix-ui/react-portal": "1.1.2",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-callback-ref": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-use-layout-effect": "1.1.0",
+        "@radix-ui/react-visually-hidden": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-toggle": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle/-/react-toggle-1.1.0.tgz",
+      "integrity": "sha512-gwoxaKZ0oJ4vIgzsfESBuSgJNdc0rv12VhHgcqN0TEJmmZixXG/2XpsLK8kzNWYcnaoRIEEQc0bEi3dIvdUpjw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-toggle-group": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-toggle-group/-/react-toggle-group-1.1.0.tgz",
+      "integrity": "sha512-PpTJV68dZU2oqqgq75Uzto5o/XfOVgkrJ9rulVmfTKxWp3HfUjHE6CP/WLRR4AzPX9HWxw7vFow2me85Yu+Naw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-context": "1.1.0",
+        "@radix-ui/react-direction": "1.1.0",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-roving-focus": "1.1.0",
+        "@radix-ui/react-toggle": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-toggle-group/node_modules/@radix-ui/react-context": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.1.0.tgz",
+      "integrity": "sha512-OKrckBy+sMEgYM/sMmqmErVn0kZqrHPJze+Ql3DzYsDDp0hl0L62nx/2122/Bvps1qz645jlcu2tD9lrRSdf8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-tooltip": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-tooltip/-/react-tooltip-1.1.4.tgz",
+      "integrity": "sha512-QpObUH/ZlpaO4YgHSaYzrLO2VuO+ZBFFgGzjMUPwtiYnAzzNNDPJeEGRrT7qNOrWm/Jr08M1vlp+vTHtnSQ0Uw==",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.0",
+        "@radix-ui/react-compose-refs": "1.1.0",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-dismissable-layer": "1.1.1",
+        "@radix-ui/react-id": "1.1.0",
+        "@radix-ui/react-popper": "1.2.0",
+        "@radix-ui/react-portal": "1.1.2",
+        "@radix-ui/react-presence": "1.1.1",
+        "@radix-ui/react-primitive": "2.0.0",
+        "@radix-ui/react-slot": "1.1.0",
+        "@radix-ui/react-use-controllable-state": "1.1.0",
+        "@radix-ui/react-visually-hidden": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-callback-ref": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.1.0.tgz",
+      "integrity": "sha512-CasTfvsy+frcFkbXtSJ2Zu9JHpN8TYKxkgJGWbjiZhFivxaeW7rMeZt7QELGVLaYVfFMsKHjb7Ak0nMEe+2Vfw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-controllable-state": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-controllable-state/-/react-use-controllable-state-1.1.0.tgz",
+      "integrity": "sha512-MtfMVJiSr2NjzS0Aa90NPTnvTSg6C/JLCV7ma0W6+OMV78vd8OyRpID+Ng9LxzsPbLeuBnWBA1Nq30AtBIDChw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-callback-ref": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-escape-keydown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-escape-keydown/-/react-use-escape-keydown-1.1.0.tgz",
+      "integrity": "sha512-L7vwWlR1kTTQ3oh7g1O0CBF3YCyyTj8NmhLR+phShpyA50HCfBFKVJTpshm9PzLiKmehsrQzTYTpX9HvmC9rhw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-callback-ref": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-layout-effect": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.0.tgz",
+      "integrity": "sha512-+FPE0rOdziWSrH9athwI1R0HDVbWlEhd+FR+aSDk4uWGmSJ9Z54sdZVDQPZAinJhJXwfT+qnj969mCsT2gfm5w==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-previous": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-previous/-/react-use-previous-1.1.0.tgz",
+      "integrity": "sha512-Z/e78qg2YFnnXcW88A4JmTtm4ADckLno6F7OXotmkQfeuCVaKuYzqAATPhVzl3delXE7CxIV8shofPn3jPc5Og==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-rect": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-rect/-/react-use-rect-1.1.0.tgz",
+      "integrity": "sha512-0Fmkebhr6PiseyZlYAOtLS+nb7jLmpqTrJyv61Pe68MKYW6OWdRE2kI70TaYY27u7H0lajqM3hSMMLFq18Z7nQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/rect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-size": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.1.0.tgz",
+      "integrity": "sha512-XW3/vWuIXHa+2Uwcc2ABSfcCledmXhhQPlGbfcRXbiUQI5Icjcg19BGCZVKKInYbvUCut/ufbbLLPFC5cbb1hw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-visually-hidden": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-visually-hidden/-/react-visually-hidden-1.1.0.tgz",
+      "integrity": "sha512-N8MDZqtgCgG5S3aV60INAB475osJousYpZ4cTJ2cFbMpdHS5Y6loLTH8LPtkj2QN0x93J30HT/M3qJXM0+lyeQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.0.0"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/rect": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@radix-ui/rect/-/rect-1.1.0.tgz",
+      "integrity": "sha512-A9+lCBZoaMJlVKcRBz2YByCG+Cp2t6nAnMnNba+XiWxnj6r4JUFqfsgwocMBZU9LPtdxC6wB56ySYpc7LQIoJg==",
+      "license": "MIT"
+    },
+    "node_modules/@remix-run/router": {
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.20.0.tgz",
+      "integrity": "sha512-mUnk8rPJBI9loFDZ+YzPGdeniYK+FTmRD1TMCz7ev2SNIozyKKpnGgsxO34u6Z4z/t0ITuu7voi/AshfsGsgFg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@rollup/rollup-android-arm-eabi": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.24.0.tgz",
+      "integrity": "sha512-Q6HJd7Y6xdB48x8ZNVDOqsbh2uByBhgK8PiQgPhwkIw/HC/YX5Ghq2mQY5sRMZWHb3VsFkWooUVOZHKr7DmDIA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-android-arm64": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.24.0.tgz",
+      "integrity": "sha512-ijLnS1qFId8xhKjT81uBHuuJp2lU4x2yxa4ctFPtG+MqEE6+C5f/+X/bStmxapgmwLwiL3ih122xv8kVARNAZA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-arm64": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.24.0.tgz",
+      "integrity": "sha512-bIv+X9xeSs1XCk6DVvkO+S/z8/2AMt/2lMqdQbMrmVpgFvXlmde9mLcbQpztXm1tajC3raFDqegsH18HQPMYtA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-x64": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.24.0.tgz",
+      "integrity": "sha512-X6/nOwoFN7RT2svEQWUsW/5C/fYMBe4fnLK9DQk4SX4mgVBiTA9h64kjUYPvGQ0F/9xwJ5U5UfTbl6BEjaQdBQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.24.0.tgz",
+      "integrity": "sha512-0KXvIJQMOImLCVCz9uvvdPgfyWo93aHHp8ui3FrtOP57svqrF/roSSR5pjqL2hcMp0ljeGlU4q9o/rQaAQ3AYA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.24.0.tgz",
+      "integrity": "sha512-it2BW6kKFVh8xk/BnHfakEeoLPv8STIISekpoF+nBgWM4d55CZKc7T4Dx1pEbTnYm/xEKMgy1MNtYuoA8RFIWw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-gnu": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.24.0.tgz",
+      "integrity": "sha512-i0xTLXjqap2eRfulFVlSnM5dEbTVque/3Pi4g2y7cxrs7+a9De42z4XxKLYJ7+OhE3IgxvfQM7vQc43bwTgPwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-musl": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.24.0.tgz",
+      "integrity": "sha512-9E6MKUJhDuDh604Qco5yP/3qn3y7SLXYuiC0Rpr89aMScS2UAmK1wHP2b7KAa1nSjWJc/f/Lc0Wl1L47qjiyQw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-powerpc64le-gnu": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-powerpc64le-gnu/-/rollup-linux-powerpc64le-gnu-4.24.0.tgz",
+      "integrity": "sha512-2XFFPJ2XMEiF5Zi2EBf4h73oR1V/lycirxZxHZNc93SqDN/IWhYYSYj8I9381ikUFXZrz2v7r2tOVk2NBwxrWw==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.24.0.tgz",
+      "integrity": "sha512-M3Dg4hlwuntUCdzU7KjYqbbd+BLq3JMAOhCKdBE3TcMGMZbKkDdJ5ivNdehOssMCIokNHFOsv7DO4rlEOfyKpg==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-s390x-gnu": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.24.0.tgz",
+      "integrity": "sha512-mjBaoo4ocxJppTorZVKWFpy1bfFj9FeCMJqzlMQGjpNPY9JwQi7OuS1axzNIk0nMX6jSgy6ZURDZ2w0QW6D56g==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-gnu": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.24.0.tgz",
+      "integrity": "sha512-ZXFk7M72R0YYFN5q13niV0B7G8/5dcQ9JDp8keJSfr3GoZeXEoMHP/HlvqROA3OMbMdfr19IjCeNAnPUG93b6A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-musl": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.24.0.tgz",
+      "integrity": "sha512-w1i+L7kAXZNdYl+vFvzSZy8Y1arS7vMgIy8wusXJzRrPyof5LAb02KGr1PD2EkRcl73kHulIID0M501lN+vobQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-arm64-msvc": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.24.0.tgz",
+      "integrity": "sha512-VXBrnPWgBpVDCVY6XF3LEW0pOU51KbaHhccHw6AS6vBWIC60eqsH19DAeeObl+g8nKAz04QFdl/Cefta0xQtUQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-ia32-msvc": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.24.0.tgz",
+      "integrity": "sha512-xrNcGDU0OxVcPTH/8n/ShH4UevZxKIO6HJFK0e15XItZP2UcaiLFd5kiX7hJnqCbSztUF8Qot+JWBC/QXRPYWQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-msvc": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.24.0.tgz",
+      "integrity": "sha512-fbMkAF7fufku0N2dE5TBXcNlg0pt0cJue4xBRE2Qc5Vqikxr4VCgKj/ht6SMdFcOacVA9rqF70APJ8RN/4vMJw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@swc/core": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.7.39.tgz",
+      "integrity": "sha512-jns6VFeOT49uoTKLWIEfiQqJAlyqldNAt80kAr8f7a5YjX0zgnG3RBiLMpksx4Ka4SlK4O6TJ/lumIM3Trp82g==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/counter": "^0.1.3",
+        "@swc/types": "^0.1.13"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/swc"
+      },
+      "optionalDependencies": {
+        "@swc/core-darwin-arm64": "1.7.39",
+        "@swc/core-darwin-x64": "1.7.39",
+        "@swc/core-linux-arm-gnueabihf": "1.7.39",
+        "@swc/core-linux-arm64-gnu": "1.7.39",
+        "@swc/core-linux-arm64-musl": "1.7.39",
+        "@swc/core-linux-x64-gnu": "1.7.39",
+        "@swc/core-linux-x64-musl": "1.7.39",
+        "@swc/core-win32-arm64-msvc": "1.7.39",
+        "@swc/core-win32-ia32-msvc": "1.7.39",
+        "@swc/core-win32-x64-msvc": "1.7.39"
+      },
+      "peerDependencies": {
+        "@swc/helpers": "*"
+      },
+      "peerDependenciesMeta": {
+        "@swc/helpers": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@swc/core-darwin-arm64": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.7.39.tgz",
+      "integrity": "sha512-o2nbEL6scMBMCTvY9OnbyVXtepLuNbdblV9oNJEFia5v5eGj9WMrnRQiylH3Wp/G2NYkW7V1/ZVW+kfvIeYe9A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-darwin-x64": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.7.39.tgz",
+      "integrity": "sha512-qMlv3XPgtPi/Fe11VhiPDHSLiYYk2dFYl747oGsHZPq+6tIdDQjIhijXPcsUHIXYDyG7lNpODPL8cP/X1sc9MA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-arm-gnueabihf": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.7.39.tgz",
+      "integrity": "sha512-NP+JIkBs1ZKnpa3Lk2W1kBJMwHfNOxCUJXuTa2ckjFsuZ8OUu2gwdeLFkTHbR43dxGwH5UzSmuGocXeMowra/Q==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-arm64-gnu": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.7.39.tgz",
+      "integrity": "sha512-cPc+/HehyHyHcvAsk3ML/9wYcpWVIWax3YBaA+ScecJpSE04l/oBHPfdqKUPslqZ+Gcw0OWnIBGJT/fBZW2ayw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-arm64-musl": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.7.39.tgz",
+      "integrity": "sha512-8RxgBC6ubFem66bk9XJ0vclu3exJ6eD7x7CwDhp5AD/tulZslTYXM7oNPjEtje3xxabXuj/bEUMNvHZhQRFdqA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-x64-gnu": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.7.39.tgz",
+      "integrity": "sha512-3gtCPEJuXLQEolo9xsXtuPDocmXQx12vewEyFFSMSjOfakuPOBmOQMa0sVL8Wwius8C1eZVeD1fgk0omMqeC+Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-x64-musl": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.7.39.tgz",
+      "integrity": "sha512-mg39pW5x/eqqpZDdtjZJxrUvQNSvJF4O8wCl37fbuFUqOtXs4TxsjZ0aolt876HXxxhsQl7rS+N4KioEMSgTZw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-win32-arm64-msvc": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.7.39.tgz",
+      "integrity": "sha512-NZwuS0mNJowH3e9bMttr7B1fB8bW5svW/yyySigv9qmV5VcQRNz1kMlCvrCLYRsa93JnARuiaBI6FazSeG8mpA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-win32-ia32-msvc": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.7.39.tgz",
+      "integrity": "sha512-qFmvv5UExbJPXhhvCVDBnjK5Duqxr048dlVB6ZCgGzbRxuarOlawCzzLK4N172230pzlAWGLgn9CWl3+N6zfHA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-win32-x64-msvc": {
+      "version": "1.7.39",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.7.39.tgz",
+      "integrity": "sha512-o+5IMqgOtj9+BEOp16atTfBgCogVak9svhBpwsbcJQp67bQbxGYhAPPDW/hZ2rpSSF7UdzbY9wudoX9G4trcuQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/counter": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@swc/counter/-/counter-0.1.3.tgz",
+      "integrity": "sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/@swc/types": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.13.tgz",
+      "integrity": "sha512-JL7eeCk6zWCbiYQg2xQSdLXQJl8Qoc9rXmG2cEKvHe3CKwMHwHGpfOb8frzNLmbycOo6I51qxnLnn9ESf4I20Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/counter": "^0.1.3"
+      }
+    },
+    "node_modules/@tailwindcss/typography": {
+      "version": "0.5.15",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/typography/-/typography-0.5.15.tgz",
+      "integrity": "sha512-AqhlCXl+8grUz8uqExv5OTtgpjuVIwFTSXTrh8y9/pw6q2ek7fJ+Y8ZEVw7EB2DCcuCOtEjf9w3+J3rzts01uA==",
+      "dev": true,
+      "dependencies": {
+        "lodash.castarray": "^4.4.0",
+        "lodash.isplainobject": "^4.0.6",
+        "lodash.merge": "^4.6.2",
+        "postcss-selector-parser": "6.0.10"
+      },
+      "peerDependencies": {
+        "tailwindcss": ">=3.0.0 || insiders || >=4.0.0-alpha.20"
+      }
+    },
+    "node_modules/@tailwindcss/typography/node_modules/postcss-selector-parser": {
+      "version": "6.0.10",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz",
+      "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==",
+      "dev": true,
+      "dependencies": {
+        "cssesc": "^3.0.0",
+        "util-deprecate": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/@tanstack/query-core": {
+      "version": "5.59.16",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.59.16.tgz",
+      "integrity": "sha512-crHn+G3ltqb5JG0oUv6q+PMz1m1YkjpASrXTU+sYWW9pLk0t2GybUHNRqYPZWhxgjPaVGC4yp92gSFEJgYEsPw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@tanstack/react-query": {
+      "version": "5.59.16",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.59.16.tgz",
+      "integrity": "sha512-MuyWheG47h6ERd4PKQ6V8gDyBu3ThNG22e1fRVwvq6ap3EqsFhyuxCAwhNP/03m/mLg+DAb0upgbPaX6VB+CkQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/query-core": "5.59.16"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": "^18 || ^19"
+      }
+    },
+    "node_modules/@types/d3-array": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.1.tgz",
+      "integrity": "sha512-Y2Jn2idRrLzUfAKV2LyRImR+y4oa2AntrgID95SHJxuMUrkNXmanDSed71sRNZysveJVt1hLLemQZIady0FpEg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-color": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
+      "integrity": "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-ease": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
+      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-interpolate": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
+      "integrity": "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-color": "*"
+      }
+    },
+    "node_modules/@types/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-P2dlU/q51fkOc/Gfl3Ul9kicV7l+ra934qBFXCFhrZMOL6du1TM0pm1ThYvENukyOn5h9v+yMJ9Fn5JK4QozrQ==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-scale": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.8.tgz",
+      "integrity": "sha512-gkK1VVTr5iNiYJ7vWDI+yUFFlszhNMtVeneJ6lUTKPjprsvLLI9/tgEGiXJOnlINJA8FyA88gfnQsHbybVZrYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-time": "*"
+      }
+    },
+    "node_modules/@types/d3-shape": {
+      "version": "3.1.6",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.1.6.tgz",
+      "integrity": "sha512-5KKk5aKGu2I+O6SONMYSNflgiP0WfZIQvVUMan50wHsLG1G94JlxEVnCpQARfTtzytuY0p/9PXXZb3I7giofIA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-path": "*"
+      }
+    },
+    "node_modules/@types/d3-time": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.3.tgz",
+      "integrity": "sha512-2p6olUZ4w3s+07q3Tm2dbiMZy5pCDfYwtLXXHUnVzXgQlZ/OyPtUz6OL382BkOuGlLXqfT+wqv8Fw2v8/0geBw==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-timer": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
+      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.6.tgz",
+      "integrity": "sha512-AYnb1nQyY49te+VRAVgmzfcgjYS91mY5P0TKUDCLEM+gNnA+3T6rWITXRLYCpahpqSQbN5cE+gHpnPyXjHWxcw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/json-schema": {
+      "version": "7.0.15",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
+      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "22.7.9",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.7.9.tgz",
+      "integrity": "sha512-jrTfRC7FM6nChvU7X2KqcrgquofrWLFDeYC1hKfwNWomVvrn7JIksqf344WN2X/y8xrgqBd2dJATZV4GbatBfg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.19.2"
+      }
+    },
+    "node_modules/@types/prop-types": {
+      "version": "15.7.13",
+      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.13.tgz",
+      "integrity": "sha512-hCZTSvwbzWGvhqxp/RqVqwU999pBf2vp7hzIjiYOsl8wqOmUxkQ6ddw1cV3l8811+kdUFus/q4d1Y3E3SyEifA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/raf": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/@types/raf/-/raf-3.4.3.tgz",
+      "integrity": "sha512-c4YAvMedbPZ5tEyxzQdMoOhhJ4RD3rngZIdwC2/qDN3d7JpEhB6fiBRKVY1lg5B7Wk+uPBjn5f39j1/2MY1oOw==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/@types/react": {
+      "version": "18.3.12",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.12.tgz",
+      "integrity": "sha512-D2wOSq/d6Agt28q7rSI3jhU7G6aiuzljDGZ2hTZHIkrTLUI+AF3WMeKkEZ9nN2fkBAlcktT6vcZjDFiIhMYEQw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/prop-types": "*",
+        "csstype": "^3.0.2"
+      }
+    },
+    "node_modules/@types/react-dom": {
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.1.tgz",
+      "integrity": "sha512-qW1Mfv8taImTthu4KoXgDfLuk4bydU6Q/TkADnDWWHwi4NX4BR+LWfTp2sVmTqRrsHvyDDTelgelxJ+SsejKKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/react": "*"
+      }
+    },
+    "node_modules/@types/trusted-types": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
+      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/@typescript-eslint/eslint-plugin": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.11.0.tgz",
+      "integrity": "sha512-KhGn2LjW1PJT2A/GfDpiyOfS4a8xHQv2myUagTM5+zsormOmBlYsnQ6pobJ8XxJmh6hnHwa2Mbe3fPrDJoDhbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/regexpp": "^4.10.0",
+        "@typescript-eslint/scope-manager": "8.11.0",
+        "@typescript-eslint/type-utils": "8.11.0",
+        "@typescript-eslint/utils": "8.11.0",
+        "@typescript-eslint/visitor-keys": "8.11.0",
+        "graphemer": "^1.4.0",
+        "ignore": "^5.3.1",
+        "natural-compare": "^1.4.0",
+        "ts-api-utils": "^1.3.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/parser": "^8.0.0 || ^8.0.0-alpha.0",
+        "eslint": "^8.57.0 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/parser": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.11.0.tgz",
+      "integrity": "sha512-lmt73NeHdy1Q/2ul295Qy3uninSqi6wQI18XwSpm8w0ZbQXUpjCAWP1Vlv/obudoBiIjJVjlztjQ+d/Md98Yxg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "8.11.0",
+        "@typescript-eslint/types": "8.11.0",
+        "@typescript-eslint/typescript-estree": "8.11.0",
+        "@typescript-eslint/visitor-keys": "8.11.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/scope-manager": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.11.0.tgz",
+      "integrity": "sha512-Uholz7tWhXmA4r6epo+vaeV7yjdKy5QFCERMjs1kMVsLRKIrSdM6o21W2He9ftp5PP6aWOVpD5zvrvuHZC0bMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.11.0",
+        "@typescript-eslint/visitor-keys": "8.11.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.11.0.tgz",
+      "integrity": "sha512-ItiMfJS6pQU0NIKAaybBKkuVzo6IdnAhPFZA/2Mba/uBjuPQPet/8+zh5GtLHwmuFRShZx+8lhIs7/QeDHflOg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/typescript-estree": "8.11.0",
+        "@typescript-eslint/utils": "8.11.0",
+        "debug": "^4.3.4",
+        "ts-api-utils": "^1.3.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/types": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.11.0.tgz",
+      "integrity": "sha512-tn6sNMHf6EBAYMvmPUaKaVeYvhUsrE6x+bXQTxjQRp360h1giATU0WvgeEys1spbvb5R+VpNOZ+XJmjD8wOUHw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.11.0.tgz",
+      "integrity": "sha512-yHC3s1z1RCHoCz5t06gf7jH24rr3vns08XXhfEqzYpd6Hll3z/3g23JRi0jM8A47UFKNc3u/y5KIMx8Ynbjohg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "@typescript-eslint/types": "8.11.0",
+        "@typescript-eslint/visitor-keys": "8.11.0",
+        "debug": "^4.3.4",
+        "fast-glob": "^3.3.2",
+        "is-glob": "^4.0.3",
+        "minimatch": "^9.0.4",
+        "semver": "^7.6.0",
+        "ts-api-utils": "^1.3.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
+      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
+      "version": "9.0.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
+      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/@typescript-eslint/utils": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.11.0.tgz",
+      "integrity": "sha512-CYiX6WZcbXNJV7UNB4PLDIBtSdRmRI/nb0FMyqHPTQD1rMjA0foPLaPUV39C/MxkTd/QKSeX+Gb34PPsDVC35g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.4.0",
+        "@typescript-eslint/scope-manager": "8.11.0",
+        "@typescript-eslint/types": "8.11.0",
+        "@typescript-eslint/typescript-estree": "8.11.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.11.0.tgz",
+      "integrity": "sha512-EaewX6lxSjRJnc+99+dqzTeoDZUfyrA52d2/HRrkI830kgovWsmIiTfmr0NZorzqic7ga+1bS60lRBUgR3n/Bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.11.0",
+        "eslint-visitor-keys": "^3.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@vitejs/plugin-react-swc": {
+      "version": "3.7.1",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react-swc/-/plugin-react-swc-3.7.1.tgz",
+      "integrity": "sha512-vgWOY0i1EROUK0Ctg1hwhtC3SdcDjZcdit4Ups4aPkDcB1jYhmo+RMYWY87cmXMhvtD5uf8lV89j2w16vkdSVg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@swc/core": "^1.7.26"
+      },
+      "peerDependencies": {
+        "vite": "^4 || ^5"
+      }
+    },
+    "node_modules/acorn": {
+      "version": "8.13.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.13.0.tgz",
+      "integrity": "sha512-8zSiw54Oxrdym50NlZ9sUusyO1Z1ZchgRLWRaK6c86XJFClyCgFKetdowBg5bKxyp/u+CDBJG4Mpp0m3HLZl9w==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "6.12.6",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.1.0.tgz",
+      "integrity": "sha512-7HSX4QQb4CspciLpVFwyRe79O3xsIZDDLER21kERQ71oaPodF8jL725AgJMFAYbooIqolJoRLuM81SpeUkpkvA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/any-promise": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
+      "integrity": "sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/anymatch": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
+      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/arg": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/arg/-/arg-5.0.2.tgz",
+      "integrity": "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true,
+      "license": "Python-2.0"
+    },
+    "node_modules/aria-hidden": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.4.tgz",
+      "integrity": "sha512-y+CcFFwelSXpLZk/7fMB2mUbGtX9lKycf1MWJ7CaTIERyitVlyQx6C+sxcROU2BAJ24OiZyK+8wj2i8AlBoS3A==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/atob": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/atob/-/atob-2.1.2.tgz",
+      "integrity": "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==",
+      "license": "(MIT OR Apache-2.0)",
+      "bin": {
+        "atob": "bin/atob.js"
+      },
+      "engines": {
+        "node": ">= 4.5.0"
+      }
+    },
+    "node_modules/autoprefixer": {
+      "version": "10.4.20",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.20.tgz",
+      "integrity": "sha512-XY25y5xSv/wEoqzDyXXME4AFfkZI0P23z6Fs3YgymDnKJkCGOnkL0iTxCa85UTqaSgfcqyf3UA6+c7wUvx/16g==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/autoprefixer"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "browserslist": "^4.23.3",
+        "caniuse-lite": "^1.0.30001646",
+        "fraction.js": "^4.3.7",
+        "normalize-range": "^0.1.2",
+        "picocolors": "^1.0.1",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "bin": {
+        "autoprefixer": "bin/autoprefixer"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/base64-arraybuffer": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz",
+      "integrity": "sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
+    "node_modules/binary-extensions": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
+      "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/browserslist": {
+      "version": "4.24.2",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.2.tgz",
+      "integrity": "sha512-ZIc+Q62revdMcqC6aChtW4jz3My3klmCO1fEmINZY/8J3EpBg5/A/D0AKmBveUh6pgoeycoMkVMko84tuYS+Gg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "caniuse-lite": "^1.0.30001669",
+        "electron-to-chromium": "^1.5.41",
+        "node-releases": "^2.0.18",
+        "update-browserslist-db": "^1.1.1"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
+    "node_modules/btoa": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/btoa/-/btoa-1.2.1.tgz",
+      "integrity": "sha512-SB4/MIGlsiVkMcHmT+pSmIPoNDoHg+7cMzmt3Uxt628MTz2487DKSqK/fuhFBrkuqrYv5UCEnACpF4dTFNKc/g==",
+      "license": "(MIT OR Apache-2.0)",
+      "bin": {
+        "btoa": "bin/btoa.js"
+      },
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/camelcase-css": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/camelcase-css/-/camelcase-css-2.0.1.tgz",
+      "integrity": "sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001669",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001669.tgz",
+      "integrity": "sha512-DlWzFDJqstqtIVx1zeSpIMLjunf5SmwOw0N2Ck/QSQdS8PLS4+9HrLaYei4w8BIAL7IB/UEDu889d8vhCTPA0w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
+    "node_modules/canvg": {
+      "version": "3.0.11",
+      "resolved": "https://registry.npmjs.org/canvg/-/canvg-3.0.11.tgz",
+      "integrity": "sha512-5ON+q7jCTgMp9cjpu4Jo6XbvfYwSB2Ow3kzHKfIyJfaCAOHLbdKPQqGKgfED/R5B+3TFFfe8pegYA+b423SRyA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@babel/runtime": "^7.12.5",
+        "@types/raf": "^3.4.0",
+        "core-js": "^3.8.3",
+        "raf": "^3.4.1",
+        "regenerator-runtime": "^0.13.7",
+        "rgbcolor": "^1.0.1",
+        "stackblur-canvas": "^2.0.0",
+        "svg-pathdata": "^6.0.3"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/chokidar": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
+      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "anymatch": "~3.1.2",
+        "braces": "~3.0.2",
+        "glob-parent": "~5.1.2",
+        "is-binary-path": "~2.1.0",
+        "is-glob": "~4.0.1",
+        "normalize-path": "~3.0.0",
+        "readdirp": "~3.6.0"
+      },
+      "engines": {
+        "node": ">= 8.10.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/chokidar/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/class-variance-authority": {
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
+      "integrity": "sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==",
+      "dependencies": {
+        "clsx": "^2.1.1"
+      },
+      "funding": {
+        "url": "https://polar.sh/cva"
+      }
+    },
+    "node_modules/clsx": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
+      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/cmdk": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/cmdk/-/cmdk-1.0.0.tgz",
+      "integrity": "sha512-gDzVf0a09TvoJ5jnuPvygTB77+XdOSwEmJ88L6XPFPlv7T3RxbP9jgenfylrAMD0+Le1aO0nVjQUzl2g+vjz5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-dialog": "1.0.5",
+        "@radix-ui/react-primitive": "1.0.3"
+      },
+      "peerDependencies": {
+        "react": "^18.0.0",
+        "react-dom": "^18.0.0"
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/primitive": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.0.1.tgz",
+      "integrity": "sha512-yQ8oGX2GVsEYMWGxcovu1uGWPCxV5BFfeeYxqPmuAzUyLT9qmaMXSAhXpb0WrspIeqYzdJpkh2vHModJPgRIaw==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10"
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-compose-refs": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.0.1.tgz",
+      "integrity": "sha512-fDSBgd44FKHa1FRMU59qBMPFcl2PZE+2nmqunj+BWFyYYjnhIDWL2ItDs3rrbJDQOtzt5nIebLCQc4QRfz6LJw==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-context": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.0.1.tgz",
+      "integrity": "sha512-ebbrdFoYTcuZ0v4wG5tedGnp9tzcV8awzsxYph7gXUyvnNLuTIcCk1q17JEbnVhXAKG9oX3KtchwiMIAYp9NLg==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-dialog": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.0.5.tgz",
+      "integrity": "sha512-GjWJX/AUpB703eEBanuBnIWdIXg6NvJFCXcNlSZk4xdszCdhrJgBoUd1cGk67vFO+WdA2pfI/plOpqz/5GUP6Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/primitive": "1.0.1",
+        "@radix-ui/react-compose-refs": "1.0.1",
+        "@radix-ui/react-context": "1.0.1",
+        "@radix-ui/react-dismissable-layer": "1.0.5",
+        "@radix-ui/react-focus-guards": "1.0.1",
+        "@radix-ui/react-focus-scope": "1.0.4",
+        "@radix-ui/react-id": "1.0.1",
+        "@radix-ui/react-portal": "1.0.4",
+        "@radix-ui/react-presence": "1.0.1",
+        "@radix-ui/react-primitive": "1.0.3",
+        "@radix-ui/react-slot": "1.0.2",
+        "@radix-ui/react-use-controllable-state": "1.0.1",
+        "aria-hidden": "^1.1.1",
+        "react-remove-scroll": "2.5.5"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-dismissable-layer": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.0.5.tgz",
+      "integrity": "sha512-aJeDjQhywg9LBu2t/At58hCvr7pEm0o2Ke1x33B+MhjNmmZ17sy4KImo0KPLgsnc/zN7GPdce8Cnn0SWvwZO7g==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/primitive": "1.0.1",
+        "@radix-ui/react-compose-refs": "1.0.1",
+        "@radix-ui/react-primitive": "1.0.3",
+        "@radix-ui/react-use-callback-ref": "1.0.1",
+        "@radix-ui/react-use-escape-keydown": "1.0.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-focus-guards": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.0.1.tgz",
+      "integrity": "sha512-Rect2dWbQ8waGzhMavsIbmSVCgYxkXLxxR3ZvCX79JOglzdEy4JXMb98lq4hPxUbLr77nP0UOGf4rcMU+s1pUA==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-focus-scope": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.0.4.tgz",
+      "integrity": "sha512-sL04Mgvf+FmyvZeYfNu1EPAaaxD+aw7cYeIB9L9Fvq8+urhltTRaEo5ysKOpHuKPclsZcSUMKlN05x4u+CINpA==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/react-compose-refs": "1.0.1",
+        "@radix-ui/react-primitive": "1.0.3",
+        "@radix-ui/react-use-callback-ref": "1.0.1"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-id": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-id/-/react-id-1.0.1.tgz",
+      "integrity": "sha512-tI7sT/kqYp8p96yGWY1OAnLHrqDgzHefRBKQ2YAkBS5ja7QLcZ9Z/uY7bEjPUatf8RomoXM8/1sMj1IJaE5UzQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/react-use-layout-effect": "1.0.1"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-portal": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.0.4.tgz",
+      "integrity": "sha512-Qki+C/EuGUVCQTOTD5vzJzJuMUlewbzuKyUy+/iHM2uwGiru9gZeBJtHAPKAEkB5KWGi9mP/CHKcY0wt1aW45Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/react-primitive": "1.0.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-presence": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.0.1.tgz",
+      "integrity": "sha512-UXLW4UAbIY5ZjcvzjfRFo5gxva8QirC9hF7wRE4U5gz+TP0DbRk+//qyuAQ1McDxBt1xNMBTaciFGvEmJvAZCg==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/react-compose-refs": "1.0.1",
+        "@radix-ui/react-use-layout-effect": "1.0.1"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-primitive": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-1.0.3.tgz",
+      "integrity": "sha512-yi58uVyoAcK/Nq1inRY56ZSjKypBNKTa/1mcL8qdl6oJeEaDbOldlzrGn7P6Q3Id5d+SYNGc5AJgc4vGhjs5+g==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/react-slot": "1.0.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-slot": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.0.2.tgz",
+      "integrity": "sha512-YeTpuq4deV+6DusvVUW4ivBgnkHwECUu0BiN43L5UCDFgdhsRUWAghhTF5MbvNTPzmiFOx90asDSUjWuCNapwg==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/react-compose-refs": "1.0.1"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-use-callback-ref": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.0.1.tgz",
+      "integrity": "sha512-D94LjX4Sp0xJFVaoQOd3OO9k7tpBYNOXdVhkltUbGv2Qb9OXdrg/CpsjlZv7ia14Sylv398LswWBVVu5nqKzAQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-use-controllable-state": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-controllable-state/-/react-use-controllable-state-1.0.1.tgz",
+      "integrity": "sha512-Svl5GY5FQeN758fWKrjM6Qb7asvXeiZltlT4U2gVfl8Gx5UAv2sMR0LWo8yhsIZh2oQ0eFdZ59aoOOMV7b47VA==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/react-use-callback-ref": "1.0.1"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-use-escape-keydown": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-escape-keydown/-/react-use-escape-keydown-1.0.3.tgz",
+      "integrity": "sha512-vyL82j40hcFicA+M4Ex7hVkB9vHgSse1ZWomAqV2Je3RleKGO5iM8KMOEtfoSB0PnIelMd2lATjTGMYqN5ylTg==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10",
+        "@radix-ui/react-use-callback-ref": "1.0.1"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/@radix-ui/react-use-layout-effect": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.0.1.tgz",
+      "integrity": "sha512-v/5RegiJWYdoCvMnITBkNNx6bCj20fiaJnWtRkU18yITptraXjffz5Qbn05uOiQnOvi+dbkznkoaMltz1GnszQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.13.10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/cmdk/node_modules/react-remove-scroll": {
+      "version": "2.5.5",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.5.5.tgz",
+      "integrity": "sha512-ImKhrzJJsyXJfBZ4bzu8Bwpka14c/fQt0k+cyFp/PBhTfyDnU5hjOtM4AG/0AMyy8oKzOTR0lDgJIM7pYXI0kw==",
+      "license": "MIT",
+      "dependencies": {
+        "react-remove-scroll-bar": "^2.3.3",
+        "react-style-singleton": "^2.2.1",
+        "tslib": "^2.1.0",
+        "use-callback-ref": "^1.3.0",
+        "use-sidecar": "^1.1.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/commander": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz",
+      "integrity": "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/core-js": {
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.45.0.tgz",
+      "integrity": "sha512-c2KZL9lP4DjkN3hk/an4pWn5b5ZefhRJnAc42n6LJ19kSnbeRbdQZE5dSeE2LBol1OwJD3X1BQvFTAsa8ReeDA==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/core-js"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/css-line-break": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/css-line-break/-/css-line-break-2.1.0.tgz",
+      "integrity": "sha512-FHcKFCZcAha3LwfVBhCQbW2nCNbkZXn7KVUJcsT5/P8YmfsVja0FMPJr0B903j/E69HUphKiV9iQArX8SDYA4w==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "utrie": "^1.0.2"
+      }
+    },
+    "node_modules/cssesc": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
+      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "cssesc": "bin/cssesc"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/csstype": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.3.tgz",
+      "integrity": "sha512-M1uQkMl8rQK/szD0LNhtqxIPLpimGm8sOBwU7lLnCpSbTyY3yeU1Vc7l4KT5zT4s/yOxHH5O7tIuuLOCnLADRw==",
+      "license": "MIT"
+    },
+    "node_modules/d3-array": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-color": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-ease": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-3.0.1.tgz",
+      "integrity": "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-format": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.0.tgz",
+      "integrity": "sha512-YyUI6AEuY/Wpt8KWLgZHsIU86atmikuoOmCfommt0LYHiQSPjvX2AcFc38PX0CBpr2RCyZhjex+NS/LPOv6YqA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-interpolate": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-color": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.10.0 - 3",
+        "d3-format": "1 - 3",
+        "d3-interpolate": "1.2.0 - 3",
+        "d3-time": "2.1.1 - 3",
+        "d3-time-format": "2 - 4"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-path": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time-format": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-time": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-timer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
+      "integrity": "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/date-fns": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-3.6.0.tgz",
+      "integrity": "sha512-fRHTG8g/Gif+kSh50gaGEdToemgfj74aRX3swtiouboip5JDLAyDE9F11nHMIcvOaXeOC6D7SpNhi7uFyB7Uww==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/kossnocorp"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.3.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.7.tgz",
+      "integrity": "sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decimal.js-light": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
+      "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
+      "license": "MIT"
+    },
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/detect-node-es": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz",
+      "integrity": "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==",
+      "license": "MIT"
+    },
+    "node_modules/didyoumean": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.2.tgz",
+      "integrity": "sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/dlv": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
+      "integrity": "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/dom-helpers": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/dom-helpers/-/dom-helpers-5.2.1.tgz",
+      "integrity": "sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.8.7",
+        "csstype": "^3.0.2"
+      }
+    },
+    "node_modules/dompurify": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.6.tgz",
+      "integrity": "sha512-/2GogDQlohXPZe6D6NOgQvXLPSYBqIWMnZ8zzOhn09REE4eyAzb+Hed3jhoM9OkuaJ8P6ZGTTVWQKAi8ieIzfQ==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optional": true,
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
+    },
+    "node_modules/eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.5.45",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.45.tgz",
+      "integrity": "sha512-vOzZS6uZwhhbkZbcRyiy99Wg+pYFV5hk+5YaECvx0+Z31NR3Tt5zS6dze2OepT6PCTzVzT0dIJItti+uAW5zmw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/embla-carousel": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/embla-carousel/-/embla-carousel-8.3.0.tgz",
+      "integrity": "sha512-Ve8dhI4w28qBqR8J+aMtv7rLK89r1ZA5HocwFz6uMB/i5EiC7bGI7y+AM80yAVUJw3qqaZYK7clmZMUR8kM3UA==",
+      "license": "MIT"
+    },
+    "node_modules/embla-carousel-react": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/embla-carousel-react/-/embla-carousel-react-8.3.0.tgz",
+      "integrity": "sha512-P1FlinFDcIvggcErRjNuVqnUR8anyo8vLMIH8Rthgofw7Nj8qTguCa2QjFAbzxAUTQTPNNjNL7yt0BGGinVdFw==",
+      "license": "MIT",
+      "dependencies": {
+        "embla-carousel": "8.3.0",
+        "embla-carousel-reactive-utils": "8.3.0"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.1 || ^18.0.0"
+      }
+    },
+    "node_modules/embla-carousel-reactive-utils": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/embla-carousel-reactive-utils/-/embla-carousel-reactive-utils-8.3.0.tgz",
+      "integrity": "sha512-EYdhhJ302SC4Lmkx8GRsp0sjUhEN4WyFXPOk0kGu9OXZSRMmcBlRgTvHcq8eKJE1bXWBsOi1T83B+BSSVZSmwQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "embla-carousel": "8.3.0"
+      }
+    },
+    "node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/esbuild": {
+      "version": "0.21.5",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.21.5.tgz",
+      "integrity": "sha512-mg3OPMV4hXywwpoDxu3Qda5xCKQi+vCTZq8S9J/EpkhB2HzKXq4SNFZE3+NK93JYxc8VMSep+lOUSC/RVKaBqw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.21.5",
+        "@esbuild/android-arm": "0.21.5",
+        "@esbuild/android-arm64": "0.21.5",
+        "@esbuild/android-x64": "0.21.5",
+        "@esbuild/darwin-arm64": "0.21.5",
+        "@esbuild/darwin-x64": "0.21.5",
+        "@esbuild/freebsd-arm64": "0.21.5",
+        "@esbuild/freebsd-x64": "0.21.5",
+        "@esbuild/linux-arm": "0.21.5",
+        "@esbuild/linux-arm64": "0.21.5",
+        "@esbuild/linux-ia32": "0.21.5",
+        "@esbuild/linux-loong64": "0.21.5",
+        "@esbuild/linux-mips64el": "0.21.5",
+        "@esbuild/linux-ppc64": "0.21.5",
+        "@esbuild/linux-riscv64": "0.21.5",
+        "@esbuild/linux-s390x": "0.21.5",
+        "@esbuild/linux-x64": "0.21.5",
+        "@esbuild/netbsd-x64": "0.21.5",
+        "@esbuild/openbsd-x64": "0.21.5",
+        "@esbuild/sunos-x64": "0.21.5",
+        "@esbuild/win32-arm64": "0.21.5",
+        "@esbuild/win32-ia32": "0.21.5",
+        "@esbuild/win32-x64": "0.21.5"
+      }
+    },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint": {
+      "version": "9.13.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.13.0.tgz",
+      "integrity": "sha512-EYZK6SX6zjFHST/HRytOdA/zE72Cq/bfw45LSyuwrdvcclb/gqV8RRQxywOBEWO2+WDpva6UZa4CcDeJKzUCFA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.2.0",
+        "@eslint-community/regexpp": "^4.11.0",
+        "@eslint/config-array": "^0.18.0",
+        "@eslint/core": "^0.7.0",
+        "@eslint/eslintrc": "^3.1.0",
+        "@eslint/js": "9.13.0",
+        "@eslint/plugin-kit": "^0.2.0",
+        "@humanfs/node": "^0.16.5",
+        "@humanwhocodes/module-importer": "^1.0.1",
+        "@humanwhocodes/retry": "^0.3.1",
+        "@types/estree": "^1.0.6",
+        "@types/json-schema": "^7.0.15",
+        "ajv": "^6.12.4",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.2",
+        "debug": "^4.3.2",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^8.1.0",
+        "eslint-visitor-keys": "^4.1.0",
+        "espree": "^10.2.0",
+        "esquery": "^1.5.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^8.0.0",
+        "find-up": "^5.0.0",
+        "glob-parent": "^6.0.2",
+        "ignore": "^5.2.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.1.2",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.3",
+        "text-table": "^0.2.0"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      },
+      "peerDependencies": {
+        "jiti": "*"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-plugin-react-hooks": {
+      "version": "5.1.0-rc-fb9a90fa48-20240614",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-5.1.0-rc-fb9a90fa48-20240614.tgz",
+      "integrity": "sha512-xsiRwaDNF5wWNC4ZHLut+x/YcAxksUd9Rizt7LaEn3bV8VyYRpXnRJQlLOfYaVy9esk4DFP4zPPnoNVjq5Gc0w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0"
+      }
+    },
+    "node_modules/eslint-plugin-react-refresh": {
+      "version": "0.4.14",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-react-refresh/-/eslint-plugin-react-refresh-0.4.14.tgz",
+      "integrity": "sha512-aXvzCTK7ZBv1e7fahFuR3Z/fyQQSIQ711yPgYRj+Oj64tyTgO4iQIDmYXDBqvSWQ/FA4OSCsXOStlF+noU0/NA==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "eslint": ">=7"
+      }
+    },
+    "node_modules/eslint-scope": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.1.0.tgz",
+      "integrity": "sha512-14dSvlhaVhKKsa9Fx1l8A17s7ah7Ef7wCakJ10LYk6+GYmP9yDti2oq2SEwcyndt6knfcZyhyxwY3i9yL78EQw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint-visitor-keys": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.1.0.tgz",
+      "integrity": "sha512-Q7lok0mqMUSf5a/AdAZkA5a/gHcO6snwQClVNNvFKCAVlxXucdU8pKydU5ZVZjBx5xr37vGbFFWtLQYreLzrZg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/espree": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-10.2.0.tgz",
+      "integrity": "sha512-upbkBJbckcCNBDBDXEbuhjbP68n+scUd3k/U2EkyM9nw+I/jPiL4cLF/Al06CF96wRltFda16sxDFrxsI1v0/g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "acorn": "^8.12.0",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^4.1.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/esquery": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.6.0.tgz",
+      "integrity": "sha512-ca9pw9fomFcKPvFLXhBKUK90ZvGibiGOvRJNbjljY7s7uq/5YO4BOzcYtJqExdx99rF6aAcnRxHmcUHcz6sQsg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/eventemitter3": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
+      "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==",
+      "license": "MIT"
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-equals": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/fast-equals/-/fast-equals-5.0.1.tgz",
+      "integrity": "sha512-WF1Wi8PwwSY7/6Kx0vKXtw8RwuSGoM1bvDaJbu7MxDlR1vovZjIAKrnzyrThgAjm6JDTu0fVgWXDlMGspodfoQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/fast-glob": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.2.tgz",
+      "integrity": "sha512-oX2ruAFQwf/Orj8m737Y5adxDQO0LAB7/S5MnxCdTNDd4p6BsyIVsv9JQsATbTSq8KHRpLwIHbVlUNatxd+1Ow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fast-glob/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fastq": {
+      "version": "1.17.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.17.1.tgz",
+      "integrity": "sha512-sRVD3lWVIXWg6By68ZN7vho9a1pQcN/WBFaAAsDDFzlJjvoGx0P8z7V1t72grFJfJhu3YPZBuu25f7Kaw2jN1w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "node_modules/fflate": {
+      "version": "0.8.2",
+      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.2.tgz",
+      "integrity": "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==",
+      "license": "MIT"
+    },
+    "node_modules/file-entry-cache": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
+      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "flat-cache": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/find-up": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^6.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/flat-cache": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
+      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "flatted": "^3.2.9",
+        "keyv": "^4.5.4"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/flatted": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.1.tgz",
+      "integrity": "sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/foreground-child": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.0.tgz",
+      "integrity": "sha512-Ld2g8rrAyMYFXBhEqMz8ZAHBi4J4uS1i/CxGMDnjyFWddMXLVcDp051DZfu+t7+ab7Wv6SMqpWmyFIj5UbfFvg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "cross-spawn": "^7.0.0",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/fraction.js": {
+      "version": "4.3.7",
+      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.3.7.tgz",
+      "integrity": "sha512-ZsDfxO51wGAXREY55a7la9LScWpwv9RxIrYABrlvOFBlH/ShPnrtsXeuUIfXKKOVicNxQ+o8JTbJvjS4M89yew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "type": "patreon",
+        "url": "https://github.com/sponsors/rawify"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-nonce": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-nonce/-/get-nonce-1.0.1.tgz",
+      "integrity": "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/glob": {
+      "version": "10.4.5",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.4.5.tgz",
+      "integrity": "sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^3.1.2",
+        "minimatch": "^9.0.4",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^1.11.1"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
+      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/glob/node_modules/minimatch": {
+      "version": "9.0.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
+      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/globals": {
+      "version": "15.11.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-15.11.0.tgz",
+      "integrity": "sha512-yeyNSjdbyVaWurlwCpcA6XNBrHTMIeDdj0/hnvX/OLJ9ekOXYbLsLinH/MucQyGvNnXhidTdNhTtJaffL2sMfw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/graphemer": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz",
+      "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/html2canvas": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/html2canvas/-/html2canvas-1.4.1.tgz",
+      "integrity": "sha512-fPU6BHNpsyIhr8yyMpTLLxAbkaK8ArIBcmZIRiBLiDhjeqvXolaEmDGmELFuX9I4xDcaKKcJl+TKZLqruBbmWA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "css-line-break": "^2.1.0",
+        "text-segmentation": "^1.0.3"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/import-fresh": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz",
+      "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "parent-module": "^1.0.0",
+        "resolve-from": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
+    "node_modules/input-otp": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/input-otp/-/input-otp-1.2.4.tgz",
+      "integrity": "sha512-md6rhmD+zmMnUh5crQNSQxq3keBRYvE3odbr4Qb9g2NWzQv9azi+t1a3X4TBTbh98fsGHgEEJlzbe1q860uGCA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0"
+      }
+    },
+    "node_modules/internmap": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/invariant": {
+      "version": "2.2.4",
+      "resolved": "https://registry.npmjs.org/invariant/-/invariant-2.2.4.tgz",
+      "integrity": "sha512-phJfQVBuaJM5raOpJjSfkiD6BpbCE4Ns//LaXl6wGYtUBY83nWS6Rf9tXm2e8VaK60JEjYldbPif/A2B1C2gNA==",
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.0.0"
+      }
+    },
+    "node_modules/is-binary-path": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "binary-extensions": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-core-module": {
+      "version": "2.15.1",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.15.1.tgz",
+      "integrity": "sha512-z0vtXSwucUJtANQWldhbtbt7BnL0vxiFjIdDLAatwhDYty2bad6s+rijD6Ri4YuYJubLzIJLUidCh09e1djEVQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/jackspeak": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
+      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/cliui": "^8.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      },
+      "optionalDependencies": {
+        "@pkgjs/parseargs": "^0.11.0"
+      }
+    },
+    "node_modules/jiti": {
+      "version": "1.21.6",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.6.tgz",
+      "integrity": "sha512-2yTgeWTWzMWkHu6Jp9NKgePDaYHbntiwvYuuJLbbN9vl7DC9DvXKOB2BC3ZZ92D3cvV/aflH0osDfwpHepQ53w==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jiti": "bin/jiti.js"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "license": "MIT"
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/json-buffer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
+      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/jspdf": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/jspdf/-/jspdf-3.0.1.tgz",
+      "integrity": "sha512-qaGIxqxetdoNnFQQXxTKUD9/Z7AloLaw94fFsOiJMxbfYdBbrBuhWmbzI8TVjrw7s3jBY1PFHofBKMV/wZPapg==",
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.26.7",
+        "atob": "^2.1.2",
+        "btoa": "^1.2.1",
+        "fflate": "^0.8.1"
+      },
+      "optionalDependencies": {
+        "canvg": "^3.0.11",
+        "core-js": "^3.6.0",
+        "dompurify": "^3.2.4",
+        "html2canvas": "^1.0.0-rc.5"
+      }
+    },
+    "node_modules/jspdf-autotable": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/jspdf-autotable/-/jspdf-autotable-5.0.2.tgz",
+      "integrity": "sha512-YNKeB7qmx3pxOLcNeoqAv3qTS7KuvVwkFe5AduCawpop3NOkBUtqDToxNc225MlNecxT4kP2Zy3z/y/yvGdXUQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "jspdf": "^2 || ^3"
+      }
+    },
+    "node_modules/keyv": {
+      "version": "4.5.4",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
+      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "json-buffer": "3.0.1"
+      }
+    },
+    "node_modules/levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/lilconfig": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
+      "integrity": "sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antonk52"
+      }
+    },
+    "node_modules/lines-and-columns": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
+      "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/locate-path": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.castarray": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/lodash.castarray/-/lodash.castarray-4.4.0.tgz",
+      "integrity": "sha512-aVx8ztPv7/2ULbArGJ2Y42bG1mEQ5mGjpdvrbJcJFU3TbYybe+QlLS4pst9zV52ymy2in1KpFPiZnAOATxD4+Q==",
+      "dev": true
+    },
+    "node_modules/lodash.isplainobject": {
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
+      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==",
+      "dev": true
+    },
+    "node_modules/lodash.merge": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/loose-envify": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
+      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
+      "license": "MIT",
+      "dependencies": {
+        "js-tokens": "^3.0.0 || ^4.0.0"
+      },
+      "bin": {
+        "loose-envify": "cli.js"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/lucide-react": {
+      "version": "0.462.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.462.0.tgz",
+      "integrity": "sha512-NTL7EbAao9IFtuSivSZgrAh4fZd09Lr+6MTkqIxuHaH2nnYiYIzXPo06cOxHg9wKLdj6LL8TByG4qpePqwgx/g==",
+      "peerDependencies": {
+        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0-rc"
+      }
+    },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "braces": "^3.0.3",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
+      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/mz": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
+      "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "any-promise": "^1.0.0",
+        "object-assign": "^4.0.1",
+        "thenify-all": "^1.0.0"
+      }
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.7",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.7.tgz",
+      "integrity": "sha512-eSRppjcPIatRIMC1U6UngP8XFcz8MQWGQdt1MTBQ7NaAmvXDfvNxbvWV3x2y6CdEUciCSsDHDQZbhYaB8QEo2g==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/next-themes": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/next-themes/-/next-themes-0.3.0.tgz",
+      "integrity": "sha512-/QHIrsYpd6Kfk7xakK4svpDI5mmXP0gfvCoJdGpZQ2TOrQZmsW0QxjaiLn8wbIKjtm4BTSqLoix4lxYYOnLJ/w==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.8 || ^17 || ^18",
+        "react-dom": "^16.8 || ^17 || ^18"
+      }
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.18.tgz",
+      "integrity": "sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/normalize-range": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz",
+      "integrity": "sha512-bdok/XvKII3nUpklnV6P2hxtMNrCboOjAcyBuQnWEhO665FwrSNRxU+AqpsyvO6LgGYPspN+lu5CLtw4jPRKNA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-hash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz",
+      "integrity": "sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/optionator": {
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
+    "node_modules/parent-module": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "callsites": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/path-scurry": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/performance-now": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/performance-now/-/performance-now-2.1.0.tgz",
+      "integrity": "sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/pify": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
+      "integrity": "sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/pirates": {
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.6.tgz",
+      "integrity": "sha512-saLsH7WeYYPiD25LDuLRRY/i+6HaPYr6G1OUlN39otzkSTxKnubR9RTxS3/Kk50s1g2JTgFwWQDQyplC5/SHZg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/pocketbase": {
+      "version": "0.26.8",
+      "resolved": "https://registry.npmjs.org/pocketbase/-/pocketbase-0.26.8.tgz",
+      "integrity": "sha512-aQ/ewvS7ncvAE8wxoW10iAZu6ElgbeFpBhKPnCfvRovNzm2gW8u/sQNPGN6vNgVEagz44kK//C61oKjfa+7Low==",
+      "license": "MIT"
+    },
+    "node_modules/postcss": {
+      "version": "8.4.47",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.47.tgz",
+      "integrity": "sha512-56rxCq7G/XfB4EkXq9Egn5GCqugWvDFjafDOThIdMBsI15iqPqR5r15TfSr1YPYeEI19YeaXMCbY6u88Y76GLQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.7",
+        "picocolors": "^1.1.0",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/postcss-import": {
+      "version": "15.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-import/-/postcss-import-15.1.0.tgz",
+      "integrity": "sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "postcss-value-parser": "^4.0.0",
+        "read-cache": "^1.0.0",
+        "resolve": "^1.1.7"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.0.0"
+      }
+    },
+    "node_modules/postcss-js": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/postcss-js/-/postcss-js-4.0.1.tgz",
+      "integrity": "sha512-dDLF8pEO191hJMtlHFPRa8xsizHaM82MLfNkUHdUtVEV3tgTp5oj+8qbEqYM57SLfc74KSbw//4SeJma2LRVIw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "camelcase-css": "^2.0.1"
+      },
+      "engines": {
+        "node": "^12 || ^14 || >= 16"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/postcss/"
+      },
+      "peerDependencies": {
+        "postcss": "^8.4.21"
+      }
+    },
+    "node_modules/postcss-load-config": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-4.0.2.tgz",
+      "integrity": "sha512-bSVhyJGL00wMVoPUzAVAnbEoWyqRxkjv64tUl427SKnPrENtq6hJwUojroMz2VB+Q1edmi4IfrAPpami5VVgMQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "lilconfig": "^3.0.0",
+        "yaml": "^2.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      },
+      "peerDependencies": {
+        "postcss": ">=8.0.9",
+        "ts-node": ">=9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "postcss": {
+          "optional": true
+        },
+        "ts-node": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/postcss-nested": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/postcss-nested/-/postcss-nested-6.2.0.tgz",
+      "integrity": "sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "postcss-selector-parser": "^6.1.1"
+      },
+      "engines": {
+        "node": ">=12.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.14"
+      }
+    },
+    "node_modules/postcss-selector-parser": {
+      "version": "6.1.2",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
+      "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cssesc": "^3.0.0",
+        "util-deprecate": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postcss-value-parser": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
+      "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/prop-types": {
+      "version": "15.8.1",
+      "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
+      "integrity": "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==",
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.4.0",
+        "object-assign": "^4.1.1",
+        "react-is": "^16.13.1"
+      }
+    },
+    "node_modules/prop-types/node_modules/react-is": {
+      "version": "16.13.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
+      "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==",
+      "license": "MIT"
+    },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/raf": {
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/raf/-/raf-3.4.1.tgz",
+      "integrity": "sha512-Sq4CW4QhwOHE8ucn6J34MqtZCeWFP2aQSmrlroYgqAV1PjStIhJXxYuTgUIfkEk7zTLjmIjLmU5q+fbD1NnOJA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "performance-now": "^2.1.0"
+      }
+    },
+    "node_modules/react": {
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
+      "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-day-picker": {
+      "version": "8.10.1",
+      "resolved": "https://registry.npmjs.org/react-day-picker/-/react-day-picker-8.10.1.tgz",
+      "integrity": "sha512-TMx7fNbhLk15eqcMt+7Z7S2KF7mfTId/XJDjKE8f+IUcFn0l08/kI4FiYTL/0yuOLmEcbR4Fwe3GJf/NiiMnPA==",
+      "license": "MIT",
+      "funding": {
+        "type": "individual",
+        "url": "https://github.com/sponsors/gpbl"
+      },
+      "peerDependencies": {
+        "date-fns": "^2.28.0 || ^3.0.0",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
+      "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.1.0",
+        "scheduler": "^0.23.2"
+      },
+      "peerDependencies": {
+        "react": "^18.3.1"
+      }
+    },
+    "node_modules/react-hook-form": {
+      "version": "7.53.1",
+      "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.53.1.tgz",
+      "integrity": "sha512-6aiQeBda4zjcuaugWvim9WsGqisoUk+etmFEsSUMm451/Ic8L/UAb7sRtMj3V+Hdzm6mMjU1VhiSzYUZeBm0Vg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/react-hook-form"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17 || ^18 || ^19"
+      }
+    },
+    "node_modules/react-is": {
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "license": "MIT"
+    },
+    "node_modules/react-remove-scroll": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.6.0.tgz",
+      "integrity": "sha512-I2U4JVEsQenxDAKaVa3VZ/JeJZe0/2DxPWL8Tj8yLKctQJQiZM52pn/GWFpSp8dftjM3pSAHVJZscAnC/y+ySQ==",
+      "license": "MIT",
+      "dependencies": {
+        "react-remove-scroll-bar": "^2.3.6",
+        "react-style-singleton": "^2.2.1",
+        "tslib": "^2.1.0",
+        "use-callback-ref": "^1.3.0",
+        "use-sidecar": "^1.1.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-remove-scroll-bar": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll-bar/-/react-remove-scroll-bar-2.3.6.tgz",
+      "integrity": "sha512-DtSYaao4mBmX+HDo5YWYdBWQwYIQQshUV/dVxFxK+KM26Wjwp1gZ6rv6OC3oujI6Bfu6Xyg3TwK533AQutsn/g==",
+      "license": "MIT",
+      "dependencies": {
+        "react-style-singleton": "^2.2.1",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-resizable-panels": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-2.1.5.tgz",
+      "integrity": "sha512-JMSe18rYupmx+dzYcdfWYZ93ZdxqQmLum3xWDVSUMI0UVwl9bB9gUaFmPbxYoO4G+m5sqgdXQCYQxnOysytfnw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.14.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc",
+        "react-dom": "^16.14.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      }
+    },
+    "node_modules/react-router": {
+      "version": "6.27.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.27.0.tgz",
+      "integrity": "sha512-YA+HGZXz4jaAkVoYBE98VQl+nVzI+cVI2Oj/06F5ZM+0u3TgedN9Y9kmMRo2mnkSK2nCpNQn0DVob4HCsY/WLw==",
+      "license": "MIT",
+      "dependencies": {
+        "@remix-run/router": "1.20.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8"
+      }
+    },
+    "node_modules/react-router-dom": {
+      "version": "6.27.0",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.27.0.tgz",
+      "integrity": "sha512-+bvtFWMC0DgAFrfKXKG9Fc+BcXWRUO1aJIihbB79xaeq0v5UzfvnM5houGUm1Y461WVRcgAQ+Clh5rdb1eCx4g==",
+      "license": "MIT",
+      "dependencies": {
+        "@remix-run/router": "1.20.0",
+        "react-router": "6.27.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8",
+        "react-dom": ">=16.8"
+      }
+    },
+    "node_modules/react-smooth": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/react-smooth/-/react-smooth-4.0.1.tgz",
+      "integrity": "sha512-OE4hm7XqR0jNOq3Qmk9mFLyd6p2+j6bvbPJ7qlB7+oo0eNcL2l7WQzG6MBnT3EXY6xzkLMUBec3AfewJdA0J8w==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-equals": "^5.0.1",
+        "prop-types": "^15.8.1",
+        "react-transition-group": "^4.4.5"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0",
+        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      }
+    },
+    "node_modules/react-style-singleton": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/react-style-singleton/-/react-style-singleton-2.2.1.tgz",
+      "integrity": "sha512-ZWj0fHEMyWkHzKYUr2Bs/4zU6XLmq9HsgBURm7g5pAVfyn49DgUiNgY2d4lXRlYSiCif9YBGpQleewkcqddc7g==",
+      "license": "MIT",
+      "dependencies": {
+        "get-nonce": "^1.0.0",
+        "invariant": "^2.2.4",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-transition-group": {
+      "version": "4.4.5",
+      "resolved": "https://registry.npmjs.org/react-transition-group/-/react-transition-group-4.4.5.tgz",
+      "integrity": "sha512-pZcd1MCJoiKiBR2NRxeCRg13uCXbydPnmB4EOeRrY7480qNWO8IIgQG6zlDkm6uRMsURXPuKq0GWtiM59a5Q6g==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@babel/runtime": "^7.5.5",
+        "dom-helpers": "^5.0.1",
+        "loose-envify": "^1.4.0",
+        "prop-types": "^15.6.2"
+      },
+      "peerDependencies": {
+        "react": ">=16.6.0",
+        "react-dom": ">=16.6.0"
+      }
+    },
+    "node_modules/read-cache": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/read-cache/-/read-cache-1.0.0.tgz",
+      "integrity": "sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "pify": "^2.3.0"
+      }
+    },
+    "node_modules/readdirp": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "picomatch": "^2.2.1"
+      },
+      "engines": {
+        "node": ">=8.10.0"
+      }
+    },
+    "node_modules/recharts": {
+      "version": "2.13.0",
+      "resolved": "https://registry.npmjs.org/recharts/-/recharts-2.13.0.tgz",
+      "integrity": "sha512-sbfxjWQ+oLWSZEWmvbq/DFVdeRLqqA6d0CDjKx2PkxVVdoXo16jvENCE+u/x7HxOO+/fwx//nYRwb8p8X6s/lQ==",
+      "license": "MIT",
+      "dependencies": {
+        "clsx": "^2.0.0",
+        "eventemitter3": "^4.0.1",
+        "lodash": "^4.17.21",
+        "react-is": "^18.3.1",
+        "react-smooth": "^4.0.0",
+        "recharts-scale": "^0.4.4",
+        "tiny-invariant": "^1.3.1",
+        "victory-vendor": "^36.6.8"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "peerDependencies": {
+        "react": "^16.0.0 || ^17.0.0 || ^18.0.0",
+        "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0"
+      }
+    },
+    "node_modules/recharts-scale": {
+      "version": "0.4.5",
+      "resolved": "https://registry.npmjs.org/recharts-scale/-/recharts-scale-0.4.5.tgz",
+      "integrity": "sha512-kivNFO+0OcUNu7jQquLXAxz1FIwZj8nrj+YkOKc5694NbjCvcT6aSZiIzNzd2Kul4o4rTto8QVR9lMNtxD4G1w==",
+      "license": "MIT",
+      "dependencies": {
+        "decimal.js-light": "^2.4.1"
+      }
+    },
+    "node_modules/regenerator-runtime": {
+      "version": "0.13.11",
+      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
+      "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/resolve": {
+      "version": "1.22.8",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.8.tgz",
+      "integrity": "sha512-oKWePCxqpd6FlLvGV1VU0x7bkPmmCNolxzjMf4NczoDnQcIWrAF+cPtZn5i6n+RfD2d9i0tzpKnG6Yk168yIyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-core-module": "^2.13.0",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      },
+      "bin": {
+        "resolve": "bin/resolve"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/resolve-from": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/reusify": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
+      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/rgbcolor": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/rgbcolor/-/rgbcolor-1.0.1.tgz",
+      "integrity": "sha512-9aZLIrhRaD97sgVhtJOW6ckOEh6/GnvQtdVNfdZ6s67+3/XwLS9lBcQYzEEhYVeUowN7pRzMLsyGhK2i/xvWbw==",
+      "license": "MIT OR SEE LICENSE IN FEEL-FREE.md",
+      "optional": true,
+      "engines": {
+        "node": ">= 0.8.15"
+      }
+    },
+    "node_modules/rollup": {
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.24.0.tgz",
+      "integrity": "sha512-DOmrlGSXNk1DM0ljiQA+i+o0rSLhtii1je5wgk60j49d1jHT5YYttBv1iWOnYSTG+fZZESUOSNiAl89SIet+Cg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "1.0.6"
+      },
+      "bin": {
+        "rollup": "dist/bin/rollup"
+      },
+      "engines": {
+        "node": ">=18.0.0",
+        "npm": ">=8.0.0"
+      },
+      "optionalDependencies": {
+        "@rollup/rollup-android-arm-eabi": "4.24.0",
+        "@rollup/rollup-android-arm64": "4.24.0",
+        "@rollup/rollup-darwin-arm64": "4.24.0",
+        "@rollup/rollup-darwin-x64": "4.24.0",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.24.0",
+        "@rollup/rollup-linux-arm-musleabihf": "4.24.0",
+        "@rollup/rollup-linux-arm64-gnu": "4.24.0",
+        "@rollup/rollup-linux-arm64-musl": "4.24.0",
+        "@rollup/rollup-linux-powerpc64le-gnu": "4.24.0",
+        "@rollup/rollup-linux-riscv64-gnu": "4.24.0",
+        "@rollup/rollup-linux-s390x-gnu": "4.24.0",
+        "@rollup/rollup-linux-x64-gnu": "4.24.0",
+        "@rollup/rollup-linux-x64-musl": "4.24.0",
+        "@rollup/rollup-win32-arm64-msvc": "4.24.0",
+        "@rollup/rollup-win32-ia32-msvc": "4.24.0",
+        "@rollup/rollup-win32-x64-msvc": "4.24.0",
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.23.2",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz",
+      "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==",
+      "license": "MIT",
+      "dependencies": {
+        "loose-envify": "^1.1.0"
+      }
+    },
+    "node_modules/semver": {
+      "version": "7.6.3",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
+      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/sonner": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/sonner/-/sonner-1.5.0.tgz",
+      "integrity": "sha512-FBjhG/gnnbN6FY0jaNnqZOMmB73R+5IiyYAw8yBj7L54ER7HB3fOSE5OFiQiE2iXWxeXKvg6fIP4LtVppHEdJA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^18.0.0",
+        "react-dom": "^18.0.0"
+      }
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/stackblur-canvas": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/stackblur-canvas/-/stackblur-canvas-2.7.0.tgz",
+      "integrity": "sha512-yf7OENo23AGJhBriGx0QivY5JP6Y1HbrrDI6WLt6C5auYZXlQrheoY8hD4ibekFKz1HOfE48Ww8kMWMnJD/zcQ==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=0.1.14"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eastasianwidth": "^0.2.0",
+        "emoji-regex": "^9.2.2",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/string-width-cjs": {
+      "name": "string-width",
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/string-width-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz",
+      "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
+    "node_modules/strip-ansi-cjs": {
+      "name": "strip-ansi",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/sucrase": {
+      "version": "3.35.0",
+      "resolved": "https://registry.npmjs.org/sucrase/-/sucrase-3.35.0.tgz",
+      "integrity": "sha512-8EbVDiu9iN/nESwxeSxDKe0dunta1GOlHufmSSXxMD2z2/tMZpDMpvXQGsc+ajGo8y2uYUmixaSRUc/QPoQ0GA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.2",
+        "commander": "^4.0.0",
+        "glob": "^10.3.10",
+        "lines-and-columns": "^1.1.6",
+        "mz": "^2.7.0",
+        "pirates": "^4.0.1",
+        "ts-interface-checker": "^0.1.9"
+      },
+      "bin": {
+        "sucrase": "bin/sucrase",
+        "sucrase-node": "bin/sucrase-node"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/supports-preserve-symlinks-flag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/svg-pathdata": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/svg-pathdata/-/svg-pathdata-6.0.3.tgz",
+      "integrity": "sha512-qsjeeq5YjBZ5eMdFuUa4ZosMLxgr5RZ+F+Y1OrDhuOCEInRMA3x74XdBtggJcj9kOeInz0WE+LgCPDkZFlBYJw==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/tailwind-merge": {
+      "version": "2.5.4",
+      "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-2.5.4.tgz",
+      "integrity": "sha512-0q8cfZHMu9nuYP/b5Shb7Y7Sh1B7Nnl5GqNr1U+n2p6+mybvRtayrQ+0042Z5byvTA8ihjlP8Odo8/VnHbZu4Q==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/dcastil"
+      }
+    },
+    "node_modules/tailwindcss": {
+      "version": "3.4.17",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.17.tgz",
+      "integrity": "sha512-w33E2aCvSDP0tW9RZuNXadXlkHXqFzSkQew/aIa2i/Sj8fThxwovwlXHSPXTbAHwEIhBFXAedUhP2tueAKP8Og==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@alloc/quick-lru": "^5.2.0",
+        "arg": "^5.0.2",
+        "chokidar": "^3.6.0",
+        "didyoumean": "^1.2.2",
+        "dlv": "^1.1.3",
+        "fast-glob": "^3.3.2",
+        "glob-parent": "^6.0.2",
+        "is-glob": "^4.0.3",
+        "jiti": "^1.21.6",
+        "lilconfig": "^3.1.3",
+        "micromatch": "^4.0.8",
+        "normalize-path": "^3.0.0",
+        "object-hash": "^3.0.0",
+        "picocolors": "^1.1.1",
+        "postcss": "^8.4.47",
+        "postcss-import": "^15.1.0",
+        "postcss-js": "^4.0.1",
+        "postcss-load-config": "^4.0.2",
+        "postcss-nested": "^6.2.0",
+        "postcss-selector-parser": "^6.1.2",
+        "resolve": "^1.22.8",
+        "sucrase": "^3.35.0"
+      },
+      "bin": {
+        "tailwind": "lib/cli.js",
+        "tailwindcss": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/tailwindcss-animate": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/tailwindcss-animate/-/tailwindcss-animate-1.0.7.tgz",
+      "integrity": "sha512-bl6mpH3T7I3UFxuvDEXLxy/VuFxBk5bbzplh7tXI68mwMokNYd1t9qPBHlnyTwfa4JGC4zP516I1hYYtQ/vspA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "tailwindcss": ">=3.0.0 || insiders"
+      }
+    },
+    "node_modules/text-segmentation": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/text-segmentation/-/text-segmentation-1.0.3.tgz",
+      "integrity": "sha512-iOiPUo/BGnZ6+54OsWxZidGCsdU8YbE4PSpdPinp7DeMtUJNJBoJ/ouUSTJjHkh1KntHaltHl/gDs2FC4i5+Nw==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "utrie": "^1.0.2"
+      }
+    },
+    "node_modules/text-table": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
+      "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/thenify": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz",
+      "integrity": "sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "any-promise": "^1.0.0"
+      }
+    },
+    "node_modules/thenify-all": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz",
+      "integrity": "sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "thenify": ">= 3.1.0 < 4"
+      },
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/tiny-invariant": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
+      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
+      "license": "MIT"
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/ts-api-utils": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-1.3.0.tgz",
+      "integrity": "sha512-UQMIo7pb8WRomKR1/+MFVLTroIvDVtMX3K6OUir8ynLyzB8Jeriont2bTAtmNPa1ekAgN7YPDyf6V+ygrdU+eQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.2.0"
+      }
+    },
+    "node_modules/ts-interface-checker": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/ts-interface-checker/-/ts-interface-checker-0.1.13.tgz",
+      "integrity": "sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/tslib": {
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.0.tgz",
+      "integrity": "sha512-jWVzBLplnCmoaTr13V9dYbiQ99wvZRd0vNWaDRg+aVYRcjDF3nDksxFDE/+fkXnKhpnUUkmx5pK/v8mCtLVqZA==",
+      "license": "0BSD"
+    },
+    "node_modules/type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.6.3.tgz",
+      "integrity": "sha512-hjcS1mhfuyi4WW8IWtjP7brDrG2cuDZukyrYrSauoXGNgx0S7zceP07adYkJycEr56BOUTNPzbInooiN3fn1qw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/typescript-eslint": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.11.0.tgz",
+      "integrity": "sha512-cBRGnW3FSlxaYwU8KfAewxFK5uzeOAp0l2KebIlPDOT5olVi65KDG/yjBooPBG0kGW/HLkoz1c/iuBFehcS3IA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/eslint-plugin": "8.11.0",
+        "@typescript-eslint/parser": "8.11.0",
+        "@typescript-eslint/utils": "8.11.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.19.8",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz",
+      "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/update-browserslist-db": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz",
+      "integrity": "sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "escalade": "^3.2.0",
+        "picocolors": "^1.1.0"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
+    "node_modules/uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "punycode": "^2.1.0"
+      }
+    },
+    "node_modules/use-callback-ref": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/use-callback-ref/-/use-callback-ref-1.3.2.tgz",
+      "integrity": "sha512-elOQwe6Q8gqZgDA8mrh44qRTQqpIHDcZ3hXTLjBe1i4ph8XpNJnO+aQf3NaG+lriLopI4HMx9VjQLfPQ6vhnoA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/use-sidecar": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/use-sidecar/-/use-sidecar-1.1.2.tgz",
+      "integrity": "sha512-epTbsLuzZ7lPClpz2TyryBfztm7m+28DlEv2ZCQ3MDr5ssiwyOwGH/e5F9CkfWjJ1t4clvI58yF822/GUkjjhw==",
+      "license": "MIT",
+      "dependencies": {
+        "detect-node-es": "^1.1.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "^16.9.0 || ^17.0.0 || ^18.0.0",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/utrie": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/utrie/-/utrie-1.0.2.tgz",
+      "integrity": "sha512-1MLa5ouZiOmQzUbjbu9VmjLzn1QLXBhwpUa7kdLUQK+KQ5KA9I1vk5U4YHe/X2Ch7PYnJfWuWT+VbuxbGwljhw==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "base64-arraybuffer": "^1.0.2"
+      }
+    },
+    "node_modules/vaul": {
+      "version": "0.9.9",
+      "resolved": "https://registry.npmjs.org/vaul/-/vaul-0.9.9.tgz",
+      "integrity": "sha512-7afKg48srluhZwIkaU+lgGtFCUsYBSGOl8vcc8N/M3YQlZFlynHD15AE+pwrYdc826o7nrIND4lL9Y6b9WWZZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-dialog": "^1.1.1"
+      },
+      "peerDependencies": {
+        "react": "^16.8 || ^17.0 || ^18.0",
+        "react-dom": "^16.8 || ^17.0 || ^18.0"
+      }
+    },
+    "node_modules/victory-vendor": {
+      "version": "36.9.2",
+      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-36.9.2.tgz",
+      "integrity": "sha512-PnpQQMuxlwYdocC8fIJqVXvkeViHYzotI+NJrCuav0ZYFoq912ZHBk3mCeuj+5/VpodOjPe1z0Fk2ihgzlXqjQ==",
+      "license": "MIT AND ISC",
+      "dependencies": {
+        "@types/d3-array": "^3.0.3",
+        "@types/d3-ease": "^3.0.0",
+        "@types/d3-interpolate": "^3.0.1",
+        "@types/d3-scale": "^4.0.2",
+        "@types/d3-shape": "^3.1.0",
+        "@types/d3-time": "^3.0.0",
+        "@types/d3-timer": "^3.0.0",
+        "d3-array": "^3.1.6",
+        "d3-ease": "^3.0.1",
+        "d3-interpolate": "^3.0.1",
+        "d3-scale": "^4.0.2",
+        "d3-shape": "^3.1.0",
+        "d3-time": "^3.0.0",
+        "d3-timer": "^3.0.1"
+      }
+    },
+    "node_modules/vite": {
+      "version": "5.4.10",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-5.4.10.tgz",
+      "integrity": "sha512-1hvaPshuPUtxeQ0hsVH3Mud0ZanOLwVTneA1EgbAM5LhaZEqyPWGRQ7BtaMvUrTDeEaC8pxtj6a6jku3x4z6SQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "^0.21.3",
+        "postcss": "^8.4.43",
+        "rollup": "^4.20.0"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^18.0.0 || >=20.0.0",
+        "less": "*",
+        "lightningcss": "^1.21.0",
+        "sass": "*",
+        "sass-embedded": "*",
+        "stylus": "*",
+        "sugarss": "*",
+        "terser": "^5.4.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "lightningcss": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrap-ansi": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^6.1.0",
+        "string-width": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs": {
+      "name": "wrap-ansi",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/ansi-styles": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
+      "integrity": "sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/yaml": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.6.0.tgz",
+      "integrity": "sha512-a6ae//JvKDEra2kdi1qzCyrJW/WZCgFi8ydDV+eXExl95t+5R+ijnqHJbz9tmMh8FUjx3iv2fCQ4dclAQlO2UQ==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/zod": {
+      "version": "3.23.8",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.23.8.tgz",
+      "integrity": "sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}
diff --git a/application/package.json b/application/package.json
new file mode 100644
index 0000000..deb0ea3
--- /dev/null
+++ b/application/package.json
@@ -0,0 +1,85 @@
+{
+  "name": "vite_react_shadcn_ts",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "build:dev": "vite build --mode development",
+    "lint": "eslint .",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@hookform/resolvers": "^3.9.0",
+    "@radix-ui/react-accordion": "^1.2.0",
+    "@radix-ui/react-alert-dialog": "^1.1.1",
+    "@radix-ui/react-aspect-ratio": "^1.1.0",
+    "@radix-ui/react-avatar": "^1.1.0",
+    "@radix-ui/react-checkbox": "^1.1.1",
+    "@radix-ui/react-collapsible": "^1.1.0",
+    "@radix-ui/react-context-menu": "^2.2.1",
+    "@radix-ui/react-dialog": "^1.1.2",
+    "@radix-ui/react-dropdown-menu": "^2.1.1",
+    "@radix-ui/react-hover-card": "^1.1.1",
+    "@radix-ui/react-label": "^2.1.0",
+    "@radix-ui/react-menubar": "^1.1.1",
+    "@radix-ui/react-navigation-menu": "^1.2.0",
+    "@radix-ui/react-popover": "^1.1.1",
+    "@radix-ui/react-progress": "^1.1.0",
+    "@radix-ui/react-radio-group": "^1.2.0",
+    "@radix-ui/react-scroll-area": "^1.1.0",
+    "@radix-ui/react-select": "^2.1.1",
+    "@radix-ui/react-separator": "^1.1.6",
+    "@radix-ui/react-slider": "^1.2.0",
+    "@radix-ui/react-slot": "^1.1.0",
+    "@radix-ui/react-switch": "^1.1.0",
+    "@radix-ui/react-tabs": "^1.1.0",
+    "@radix-ui/react-toast": "^1.2.1",
+    "@radix-ui/react-toggle": "^1.1.0",
+    "@radix-ui/react-toggle-group": "^1.1.0",
+    "@radix-ui/react-tooltip": "^1.1.4",
+    "@tanstack/react-query": "^5.56.2",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.0.0",
+    "date-fns": "^3.6.0",
+    "embla-carousel-react": "^8.3.0",
+    "input-otp": "^1.2.4",
+    "jspdf": "^3.0.1",
+    "jspdf-autotable": "^5.0.2",
+    "lucide-react": "^0.462.0",
+    "next-themes": "^0.3.0",
+    "pocketbase": "^0.26.8",
+    "react": "^18.3.1",
+    "react-day-picker": "^8.10.1",
+    "react-dom": "^18.3.1",
+    "react-hook-form": "^7.53.0",
+    "react-resizable-panels": "^2.1.3",
+    "react-router-dom": "^6.26.2",
+    "recharts": "^2.12.7",
+    "sonner": "^1.5.0",
+    "tailwind-merge": "^2.5.2",
+    "tailwindcss-animate": "^1.0.7",
+    "vaul": "^0.9.3",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.9.0",
+    "@tailwindcss/typography": "^0.5.15",
+    "@types/node": "^22.5.5",
+    "@types/react": "^18.3.3",
+    "@types/react-dom": "^18.3.0",
+    "@vitejs/plugin-react-swc": "^3.5.0",
+    "autoprefixer": "^10.4.20",
+    "eslint": "^9.9.0",
+    "eslint-plugin-react-hooks": "^5.1.0-rc.0",
+    "eslint-plugin-react-refresh": "^0.4.9",
+    "globals": "^15.9.0",
+    "postcss": "^8.4.47",
+    "tailwindcss": "^3.4.11",
+    "typescript": "^5.5.3",
+    "typescript-eslint": "^8.0.1",
+    "vite": "^5.4.1"
+  }
+}
diff --git a/application/postcss.config.js b/application/postcss.config.js
new file mode 100644
index 0000000..2e7af2b
--- /dev/null
+++ b/application/postcss.config.js
@@ -0,0 +1,6 @@
+export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+}
diff --git a/application/public/checkcle_logo.svg b/application/public/checkcle_logo.svg
new file mode 100644
index 0000000..d112473
--- /dev/null
+++ b/application/public/checkcle_logo.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1200" zoomAndPan="magnify" viewBox="0 0 900 299.999988" height="400" preserveAspectRatio="xMidYMid meet" version="1.2"><defs><clipPath id="a73e38c830"><path d="M 23 48.835938 L 208 48.835938 L 208 251.335938 L 23 251.335938 Z M 23 48.835938 "/></clipPath></defs><g id="dad1cb7747"><rect x="0" width="900" y="0" height="299.999988" style="fill:#ffffff;fill-opacity:1;stroke:none;"/><rect x="0" width="900" y="0" height="299.999988" style="fill:#02c37e;fill-opacity:1;stroke:none;"/><g style="fill:#f9fcff;fill-opacity:1;"><g transform="translate(208.551165, 198.418735)"><path style="stroke:none" d="M 4.640625 -49.578125 C 4.640625 -59.335938 6.753906 -68.046875 10.984375 -75.703125 C 15.210938 -83.359375 21.101562 -89.320312 28.65625 -93.59375 C 36.21875 -97.863281 44.785156 -100 54.359375 -100 C 66.097656 -100 76.144531 -96.898438 84.5 -90.703125 C 92.863281 -84.503906 98.453125 -76.050781 101.265625 -65.34375 L 74.78125 -65.34375 C 72.8125 -69.476562 70.019531 -72.625 66.40625 -74.78125 C 62.789062 -76.945312 58.679688 -78.03125 54.078125 -78.03125 C 46.660156 -78.03125 40.648438 -75.445312 36.046875 -70.28125 C 31.453125 -65.113281 29.15625 -58.210938 29.15625 -49.578125 C 29.15625 -40.941406 31.453125 -34.039062 36.046875 -28.875 C 40.648438 -23.707031 46.660156 -21.125 54.078125 -21.125 C 58.679688 -21.125 62.789062 -22.203125 66.40625 -24.359375 C 70.019531 -26.523438 72.8125 -29.671875 74.78125 -33.796875 L 101.265625 -33.796875 C 98.453125 -23.097656 92.863281 -14.671875 84.5 -8.515625 C 76.144531 -2.367188 66.097656 0.703125 54.359375 0.703125 C 44.785156 0.703125 36.21875 -1.429688 28.65625 -5.703125 C 21.101562 -9.972656 15.210938 -15.910156 10.984375 -23.515625 C 6.753906 -31.117188 4.640625 -39.804688 4.640625 -49.578125 Z M 4.640625 -49.578125 "/></g></g><g style="fill:#f9fcff;fill-opacity:1;"><g transform="translate(313.040801, 198.418735)"><path style="stroke:none" d="M 57.046875 -79.4375 C 66.054688 -79.4375 73.285156 -76.453125 78.734375 -70.484375 C 84.179688 -64.523438 86.90625 -56.335938 86.90625 -45.921875 L 86.90625 0 L 62.953125 0 L 62.953125 -42.671875 C 62.953125 -47.929688 61.585938 -52.015625 58.859375 -54.921875 C 56.140625 -57.835938 52.484375 -59.296875 47.890625 -59.296875 C 43.285156 -59.296875 39.617188 -57.835938 36.890625 -54.921875 C 34.171875 -52.015625 32.8125 -47.929688 32.8125 -42.671875 L 32.8125 0 L 8.734375 0 L 8.734375 -104.21875 L 32.8125 -104.21875 L 32.8125 -68.03125 C 35.257812 -71.5 38.59375 -74.265625 42.8125 -76.328125 C 47.039062 -78.398438 51.785156 -79.4375 57.046875 -79.4375 Z M 57.046875 -79.4375 "/></g></g><g style="fill:#f9fcff;fill-opacity:1;"><g transform="translate(405.138057, 198.418735)"><path style="stroke:none" d="M 82.8125 -40.5625 C 82.8125 -38.3125 82.671875 -35.960938 82.390625 -33.515625 L 27.890625 -33.515625 C 28.265625 -28.640625 29.835938 -24.910156 32.609375 -22.328125 C 35.378906 -19.742188 38.78125 -18.453125 42.8125 -18.453125 C 48.820312 -18.453125 53.003906 -20.988281 55.359375 -26.0625 L 80.984375 -26.0625 C 79.671875 -20.894531 77.300781 -16.242188 73.875 -12.109375 C 70.445312 -7.984375 66.148438 -4.742188 60.984375 -2.390625 C 55.816406 -0.046875 50.039062 1.125 43.65625 1.125 C 35.957031 1.125 29.101562 -0.515625 23.09375 -3.796875 C 17.082031 -7.085938 12.382812 -11.785156 9 -17.890625 C 5.625 -23.992188 3.9375 -31.128906 3.9375 -39.296875 C 3.9375 -47.460938 5.601562 -54.597656 8.9375 -60.703125 C 12.269531 -66.804688 16.941406 -71.5 22.953125 -74.78125 C 28.960938 -78.070312 35.863281 -79.71875 43.65625 -79.71875 C 51.257812 -79.71875 58.019531 -78.117188 63.9375 -74.921875 C 69.851562 -71.734375 74.476562 -67.179688 77.8125 -61.265625 C 81.144531 -55.347656 82.8125 -48.445312 82.8125 -40.5625 Z M 58.171875 -46.90625 C 58.171875 -51.03125 56.757812 -54.3125 53.9375 -56.75 C 51.125 -59.195312 47.601562 -60.421875 43.375 -60.421875 C 39.34375 -60.421875 35.941406 -59.242188 33.171875 -56.890625 C 30.398438 -54.546875 28.6875 -51.21875 28.03125 -46.90625 Z M 58.171875 -46.90625 "/></g></g><g style="fill:#f9fcff;fill-opacity:1;"><g transform="translate(489.0676, 198.418735)"><path style="stroke:none" d="M 3.9375 -39.296875 C 3.9375 -47.460938 5.601562 -54.597656 8.9375 -60.703125 C 12.269531 -66.804688 16.914062 -71.5 22.875 -74.78125 C 28.84375 -78.070312 35.675781 -79.71875 43.375 -79.71875 C 53.238281 -79.71875 61.476562 -77.132812 68.09375 -71.96875 C 74.71875 -66.800781 79.0625 -59.523438 81.125 -50.140625 L 55.5 -50.140625 C 53.332031 -56.148438 49.148438 -59.15625 42.953125 -59.15625 C 38.546875 -59.15625 35.023438 -57.441406 32.390625 -54.015625 C 29.765625 -50.585938 28.453125 -45.679688 28.453125 -39.296875 C 28.453125 -32.910156 29.765625 -28.003906 32.390625 -24.578125 C 35.023438 -21.148438 38.546875 -19.4375 42.953125 -19.4375 C 49.148438 -19.4375 53.332031 -22.441406 55.5 -28.453125 L 81.125 -28.453125 C 79.0625 -19.242188 74.695312 -12.007812 68.03125 -6.75 C 61.363281 -1.5 53.144531 1.125 43.375 1.125 C 35.675781 1.125 28.84375 -0.515625 22.875 -3.796875 C 16.914062 -7.085938 12.269531 -11.785156 8.9375 -17.890625 C 5.601562 -23.992188 3.9375 -31.128906 3.9375 -39.296875 Z M 3.9375 -39.296875 "/></g></g><g style="fill:#f9fcff;fill-opacity:1;"><g transform="translate(571.448077, 198.418735)"><path style="stroke:none" d="M 56.765625 0 L 32.8125 -32.953125 L 32.8125 0 L 8.734375 0 L 8.734375 -104.21875 L 32.8125 -104.21875 L 32.8125 -46.625 L 56.625 -78.59375 L 86.34375 -78.59375 L 53.65625 -39.15625 L 86.625 0 Z M 56.765625 0 "/></g></g><g style="fill:#f9fcff;fill-opacity:1;"><g transform="translate(655.659261, 198.418735)"><path style="stroke:none" d="M 4.640625 -49.578125 C 4.640625 -59.335938 6.753906 -68.046875 10.984375 -75.703125 C 15.210938 -83.359375 21.101562 -89.320312 28.65625 -93.59375 C 36.21875 -97.863281 44.785156 -100 54.359375 -100 C 66.097656 -100 76.144531 -96.898438 84.5 -90.703125 C 92.863281 -84.503906 98.453125 -76.050781 101.265625 -65.34375 L 74.78125 -65.34375 C 72.8125 -69.476562 70.019531 -72.625 66.40625 -74.78125 C 62.789062 -76.945312 58.679688 -78.03125 54.078125 -78.03125 C 46.660156 -78.03125 40.648438 -75.445312 36.046875 -70.28125 C 31.453125 -65.113281 29.15625 -58.210938 29.15625 -49.578125 C 29.15625 -40.941406 31.453125 -34.039062 36.046875 -28.875 C 40.648438 -23.707031 46.660156 -21.125 54.078125 -21.125 C 58.679688 -21.125 62.789062 -22.203125 66.40625 -24.359375 C 70.019531 -26.523438 72.8125 -29.671875 74.78125 -33.796875 L 101.265625 -33.796875 C 98.453125 -23.097656 92.863281 -14.671875 84.5 -8.515625 C 76.144531 -2.367188 66.097656 0.703125 54.359375 0.703125 C 44.785156 0.703125 36.21875 -1.429688 28.65625 -5.703125 C 21.101562 -9.972656 15.210938 -15.910156 10.984375 -23.515625 C 6.753906 -31.117188 4.640625 -39.804688 4.640625 -49.578125 Z M 4.640625 -49.578125 "/></g></g><g style="fill:#f9fcff;fill-opacity:1;"><g transform="translate(760.148897, 198.418735)"><path style="stroke:none" d="M 32.8125 -104.21875 L 32.8125 0 L 8.734375 0 L 8.734375 -104.21875 Z M 32.8125 -104.21875 "/></g></g><g style="fill:#f9fcff;fill-opacity:1;"><g transform="translate(798.874374, 198.418735)"><path style="stroke:none" d="M 82.8125 -40.5625 C 82.8125 -38.3125 82.671875 -35.960938 82.390625 -33.515625 L 27.890625 -33.515625 C 28.265625 -28.640625 29.835938 -24.910156 32.609375 -22.328125 C 35.378906 -19.742188 38.78125 -18.453125 42.8125 -18.453125 C 48.820312 -18.453125 53.003906 -20.988281 55.359375 -26.0625 L 80.984375 -26.0625 C 79.671875 -20.894531 77.300781 -16.242188 73.875 -12.109375 C 70.445312 -7.984375 66.148438 -4.742188 60.984375 -2.390625 C 55.816406 -0.046875 50.039062 1.125 43.65625 1.125 C 35.957031 1.125 29.101562 -0.515625 23.09375 -3.796875 C 17.082031 -7.085938 12.382812 -11.785156 9 -17.890625 C 5.625 -23.992188 3.9375 -31.128906 3.9375 -39.296875 C 3.9375 -47.460938 5.601562 -54.597656 8.9375 -60.703125 C 12.269531 -66.804688 16.941406 -71.5 22.953125 -74.78125 C 28.960938 -78.070312 35.863281 -79.71875 43.65625 -79.71875 C 51.257812 -79.71875 58.019531 -78.117188 63.9375 -74.921875 C 69.851562 -71.734375 74.476562 -67.179688 77.8125 -61.265625 C 81.144531 -55.347656 82.8125 -48.445312 82.8125 -40.5625 Z M 58.171875 -46.90625 C 58.171875 -51.03125 56.757812 -54.3125 53.9375 -56.75 C 51.125 -59.195312 47.601562 -60.421875 43.375 -60.421875 C 39.34375 -60.421875 35.941406 -59.242188 33.171875 -56.890625 C 30.398438 -54.546875 28.6875 -51.21875 28.03125 -46.90625 Z M 58.171875 -46.90625 "/></g></g><g clip-rule="nonzero" clip-path="url(#a73e38c830)"><path style=" stroke:none;fill-rule:nonzero;fill:#ffffff;fill-opacity:1;" d="M 194.664062 97.140625 C 186.671875 87.308594 176.753906 79.488281 164.914062 73.671875 C 153.070312 67.859375 140.246094 64.953125 126.441406 64.953125 C 114.429688 64.953125 103.101562 67.175781 92.457031 71.621094 C 81.855469 76.066406 72.578125 82.179688 64.671875 89.875 C 56.761719 97.613281 50.519531 106.589844 45.988281 116.847656 C 41.457031 127.109375 39.148438 138.050781 39.148438 149.679688 C 39.148438 161.304688 41.414062 172.25 45.988281 182.507812 C 50.519531 192.769531 56.761719 201.746094 64.671875 209.355469 C 72.578125 217.003906 81.855469 223.03125 92.5 227.480469 C 103.144531 231.925781 114.472656 234.148438 126.484375 234.148438 C 140.289062 234.148438 153.113281 231.242188 164.957031 225.425781 C 176.796875 219.613281 186.671875 211.789062 194.707031 201.957031 L 207.277344 211.789062 L 207.53125 211.789062 C 198.085938 223.800781 186.328125 233.378906 172.351562 240.472656 C 158.332031 247.613281 143.070312 251.160156 126.527344 251.160156 C 112.332031 251.160156 98.953125 248.46875 86.429688 243.125 C 73.859375 237.78125 62.917969 230.429688 53.554688 221.152344 C 44.195312 211.875 36.757812 201.105469 31.328125 188.835938 C 25.8125 176.652344 23.078125 163.613281 23.078125 149.765625 C 23.078125 135.957031 25.8125 122.875 31.285156 110.605469 C 36.757812 98.339844 44.152344 87.609375 53.511719 78.417969 C 62.875 69.226562 73.816406 62.003906 86.386719 56.746094 C 98.910156 51.488281 112.292969 48.835938 126.484375 48.835938 C 143.027344 48.835938 158.332031 52.300781 172.308594 59.222656 C 186.328125 66.148438 198.042969 75.511719 207.488281 87.308594 L 207.234375 87.566406 Z M 126.398438 95.515625 C 118.746094 95.515625 111.523438 96.929688 104.726562 99.75 C 97.886719 102.570312 91.941406 106.417969 86.855469 111.332031 C 81.769531 116.25 77.75 122.019531 74.84375 128.648438 C 71.9375 135.273438 70.484375 142.324219 70.484375 149.804688 C 70.484375 157.289062 71.9375 164.253906 74.84375 170.839844 C 77.75 177.378906 81.769531 183.105469 86.855469 188.023438 C 91.941406 192.9375 97.886719 196.785156 104.726562 199.609375 C 111.5625 202.429688 118.789062 203.839844 126.398438 203.839844 C 135.289062 203.839844 143.539062 201.957031 151.105469 198.238281 C 158.671875 194.519531 164.957031 189.5625 170.085938 183.363281 L 182.910156 193.195312 C 176.371094 201.402344 168.164062 207.902344 158.371094 212.6875 C 148.539062 217.519531 137.898438 219.914062 126.441406 219.914062 C 116.4375 219.914062 107.074219 218.074219 98.355469 214.441406 C 89.636719 210.808594 81.984375 205.804688 75.441406 199.4375 C 68.816406 193.152344 63.6875 185.671875 59.96875 177.121094 C 56.25 168.574219 54.367188 159.46875 54.367188 149.847656 C 54.367188 140.230469 56.25 131.125 59.96875 122.578125 C 63.6875 114.027344 68.859375 106.589844 75.398438 100.21875 C 81.941406 93.851562 89.59375 88.804688 98.3125 85.085938 C 107.03125 81.367188 116.394531 79.488281 126.398438 79.488281 C 137.855469 79.488281 148.5 81.878906 158.332031 86.710938 C 168.164062 91.542969 176.328125 98.039062 182.867188 106.203125 L 170.042969 116.292969 C 164.785156 109.921875 158.414062 104.878906 150.933594 101.160156 C 143.496094 97.398438 135.289062 95.515625 126.398438 95.515625 Z M 126.398438 95.515625 "/></g></g></svg>
\ No newline at end of file
diff --git a/application/public/favicon.ico b/application/public/favicon.ico
new file mode 100644
index 0000000..d5dfc62
Binary files /dev/null and b/application/public/favicon.ico differ
diff --git a/application/public/favicon_sidebar.ico b/application/public/favicon_sidebar.ico
new file mode 100644
index 0000000..074b8f9
Binary files /dev/null and b/application/public/favicon_sidebar.ico differ
diff --git a/application/public/placeholder.svg b/application/public/placeholder.svg
new file mode 100644
index 0000000..e763910
--- /dev/null
+++ b/application/public/placeholder.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="1200" fill="none"><rect width="1200" height="1200" fill="#EAEAEA" rx="3"/><g opacity=".5"><g opacity=".5"><path fill="#FAFAFA" d="M600.709 736.5c-75.454 0-136.621-61.167-136.621-136.62 0-75.454 61.167-136.621 136.621-136.621 75.453 0 136.62 61.167 136.62 136.621 0 75.453-61.167 136.62-136.62 136.62Z"/><path stroke="#C9C9C9" stroke-width="2.418" d="M600.709 736.5c-75.454 0-136.621-61.167-136.621-136.62 0-75.454 61.167-136.621 136.621-136.621 75.453 0 136.62 61.167 136.62 136.621 0 75.453-61.167 136.62-136.62 136.62Z"/></g><path stroke="url(#a)" stroke-width="2.418" d="M0-1.209h553.581" transform="scale(1 -1) rotate(45 1163.11 91.165)"/><path stroke="url(#b)" stroke-width="2.418" d="M404.846 598.671h391.726"/><path stroke="url(#c)" stroke-width="2.418" d="M599.5 795.742V404.017"/><path stroke="url(#d)" stroke-width="2.418" d="m795.717 796.597-391.441-391.44"/><path fill="#fff" d="M600.709 656.704c-31.384 0-56.825-25.441-56.825-56.824 0-31.384 25.441-56.825 56.825-56.825 31.383 0 56.824 25.441 56.824 56.825 0 31.383-25.441 56.824-56.824 56.824Z"/><g clip-path="url(#e)"><path fill="#666" fill-rule="evenodd" d="M616.426 586.58h-31.434v16.176l3.553-3.554.531-.531h9.068l.074-.074 8.463-8.463h2.565l7.18 7.181V586.58Zm-15.715 14.654 3.698 3.699 1.283 1.282-2.565 2.565-1.282-1.283-5.2-5.199h-6.066l-5.514 5.514-.073.073v2.876a2.418 2.418 0 0 0 2.418 2.418h26.598a2.418 2.418 0 0 0 2.418-2.418v-8.317l-8.463-8.463-7.181 7.181-.071.072Zm-19.347 5.442v4.085a6.045 6.045 0 0 0 6.046 6.045h26.598a6.044 6.044 0 0 0 6.045-6.045v-7.108l1.356-1.355-1.282-1.283-.074-.073v-17.989h-38.689v23.43l-.146.146.146.147Z" clip-rule="evenodd"/></g><path stroke="#C9C9C9" stroke-width="2.418" d="M600.709 656.704c-31.384 0-56.825-25.441-56.825-56.824 0-31.384 25.441-56.825 56.825-56.825 31.383 0 56.824 25.441 56.824 56.825 0 31.383-25.441 56.824-56.824 56.824Z"/></g><defs><linearGradient id="a" x1="554.061" x2="-.48" y1=".083" y2=".087" gradientUnits="userSpaceOnUse"><stop stop-color="#C9C9C9" stop-opacity="0"/><stop offset=".208" stop-color="#C9C9C9"/><stop offset=".792" stop-color="#C9C9C9"/><stop offset="1" stop-color="#C9C9C9" stop-opacity="0"/></linearGradient><linearGradient id="b" x1="796.912" x2="404.507" y1="599.963" y2="599.965" gradientUnits="userSpaceOnUse"><stop stop-color="#C9C9C9" stop-opacity="0"/><stop offset=".208" stop-color="#C9C9C9"/><stop offset=".792" stop-color="#C9C9C9"/><stop offset="1" stop-color="#C9C9C9" stop-opacity="0"/></linearGradient><linearGradient id="c" x1="600.792" x2="600.794" y1="403.677" y2="796.082" gradientUnits="userSpaceOnUse"><stop stop-color="#C9C9C9" stop-opacity="0"/><stop offset=".208" stop-color="#C9C9C9"/><stop offset=".792" stop-color="#C9C9C9"/><stop offset="1" stop-color="#C9C9C9" stop-opacity="0"/></linearGradient><linearGradient id="d" x1="404.85" x2="796.972" y1="403.903" y2="796.02" gradientUnits="userSpaceOnUse"><stop stop-color="#C9C9C9" stop-opacity="0"/><stop offset=".208" stop-color="#C9C9C9"/><stop offset=".792" stop-color="#C9C9C9"/><stop offset="1" stop-color="#C9C9C9" stop-opacity="0"/></linearGradient><clipPath id="e"><path fill="#fff" d="M581.364 580.535h38.689v38.689h-38.689z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/application/public/robots.txt b/application/public/robots.txt
new file mode 100644
index 0000000..6018e70
--- /dev/null
+++ b/application/public/robots.txt
@@ -0,0 +1,14 @@
+User-agent: Googlebot
+Allow: /
+
+User-agent: Bingbot
+Allow: /
+
+User-agent: Twitterbot
+Allow: /
+
+User-agent: facebookexternalhit
+Allow: /
+
+User-agent: *
+Allow: /
diff --git a/application/public/upload/data/pb_schema_latest.json b/application/public/upload/data/pb_schema_latest.json
new file mode 100644
index 0000000..dc623b4
--- /dev/null
+++ b/application/public/upload/data/pb_schema_latest.json
@@ -0,0 +1,5661 @@
+[
+    {
+        "id": "pbc_1938176441",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "alert_configurations",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "channel_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1104941267",
+                "max": 0,
+                "min": 0,
+                "name": "telegram_chat_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2654632018",
+                "max": 0,
+                "min": 0,
+                "name": "discord_webhook_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text904114323",
+                "max": 0,
+                "min": 0,
+                "name": "signal_number",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text709732016",
+                "max": 0,
+                "min": 0,
+                "name": "notify_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3787265959",
+                "max": 0,
+                "min": 0,
+                "name": "bot_token",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2946855043",
+                "max": 0,
+                "min": 0,
+                "name": "slack_webhook_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select887233555",
+                "maxSelect": 1,
+                "name": "notification_type",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "telegram",
+                    "signal",
+                    "discord",
+                    "slack",
+                    "webhook",
+                    "google_chat",
+                    "email",
+                    "ntfy",
+                    "pushover",
+                    "notifiarr",
+                    "gotify"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select1358543748",
+                "maxSelect": 1,
+                "name": "enabled",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "true",
+                    "false"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2962097998",
+                "max": 0,
+                "min": 0,
+                "name": "email_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3070882914",
+                "max": 0,
+                "min": 0,
+                "name": "email_sender_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2941943271",
+                "max": 0,
+                "min": 0,
+                "name": "smtp_port",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text393471132",
+                "max": 0,
+                "min": 0,
+                "name": "smtp_server",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2735050465",
+                "max": 0,
+                "min": 0,
+                "name": "google_chat_webhook_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1263996916",
+                "max": 0,
+                "min": 0,
+                "name": "signal_api_endpoint",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4212033756",
+                "max": 0,
+                "min": 0,
+                "name": "smtp_password",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text137129747",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3590941513",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_payload_template",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1654359675",
+                "max": 0,
+                "min": 0,
+                "name": "ntfy_endpoint",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2074277355",
+                "max": 0,
+                "min": 0,
+                "name": "api_token",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1636223522",
+                "max": 0,
+                "min": 0,
+                "name": "user_key",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3401535476",
+                "max": 0,
+                "min": 0,
+                "name": "server_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_2889059272",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "data_settings",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1569706847",
+                "max": null,
+                "min": null,
+                "name": "retention_days",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1419719274",
+                "max": null,
+                "min": null,
+                "name": "server_retention_days",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3508549248",
+                "max": null,
+                "min": null,
+                "name": "uptime_retention_days",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2800013036",
+                "max": 0,
+                "min": 0,
+                "name": "backup",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_285611395",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "dns_data",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2554192817",
+                "max": 0,
+                "min": 0,
+                "name": "query_type",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3731179111",
+                "max": 0,
+                "min": 0,
+                "name": "resolve_ip",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2323266619",
+                "max": 0,
+                "min": 0,
+                "name": "msg_size",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3069659470",
+                "max": 0,
+                "min": 0,
+                "name": "question",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3671935525",
+                "max": 0,
+                "min": 0,
+                "name": "answer",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1257859836",
+                "max": 0,
+                "min": 0,
+                "name": "authority",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2273667377",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_3168803865",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "docker_metrics",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "docker_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text933879452",
+                "max": 0,
+                "min": 0,
+                "name": "ram_total",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4038915663",
+                "max": 0,
+                "min": 0,
+                "name": "ram_used",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3302315167",
+                "max": 0,
+                "min": 0,
+                "name": "ram_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1461425251",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_cores",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2062996636",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_usage",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1525183142",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2583550350",
+                "max": 0,
+                "min": 0,
+                "name": "disk_total",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1976676007",
+                "max": 0,
+                "min": 0,
+                "name": "disk_used",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1102580855",
+                "max": 0,
+                "min": 0,
+                "name": "disk_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1936777896",
+                "max": null,
+                "min": null,
+                "name": "network_rx_bytes",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3038767919",
+                "max": null,
+                "min": null,
+                "name": "network_tx_bytes",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3452919696",
+                "max": null,
+                "min": null,
+                "name": "network_rx_speed",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number195057175",
+                "max": null,
+                "min": null,
+                "name": "network_tx_speed",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_583547467",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "dockers",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1069831160",
+                "max": 0,
+                "min": 0,
+                "name": "docker_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3847340049",
+                "max": 0,
+                "min": 0,
+                "name": "hostname",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text587191692",
+                "max": 0,
+                "min": 0,
+                "name": "ip_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063420466",
+                "max": 0,
+                "min": 0,
+                "name": "os_template",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1563400775",
+                "max": 0,
+                "min": 0,
+                "name": "uptime",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number933879452",
+                "max": null,
+                "min": null,
+                "name": "ram_total",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number4038915663",
+                "max": null,
+                "min": null,
+                "name": "ram_used",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1461425251",
+                "max": null,
+                "min": null,
+                "name": "cpu_cores",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number2062996636",
+                "max": null,
+                "min": null,
+                "name": "cpu_usage",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number2583550350",
+                "max": null,
+                "min": null,
+                "name": "disk_total",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1976676007",
+                "max": null,
+                "min": null,
+                "name": "disk_used",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "date3415181003",
+                "max": "",
+                "min": "",
+                "name": "last_checked",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2782324286",
+                "max": 0,
+                "min": 0,
+                "name": "timestamp",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_2189087560",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "incidents",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text724990059",
+                "max": 0,
+                "min": 0,
+                "name": "title",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2314121105",
+                "max": 0,
+                "min": 0,
+                "name": "assigned_users",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3210298530",
+                "max": 0,
+                "min": 0,
+                "name": "resolution_time",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text723782963",
+                "max": 0,
+                "min": 0,
+                "name": "affected_systems",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1210058505",
+                "max": 0,
+                "min": 0,
+                "name": "root_cause",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text178040949",
+                "max": 0,
+                "min": 0,
+                "name": "resolution_steps",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2767280054",
+                "max": 0,
+                "min": 0,
+                "name": "lessons_learned",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4053573849",
+                "max": 0,
+                "min": 0,
+                "name": "operational_status_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select2722347397",
+                "maxSelect": 1,
+                "name": "impact_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "investigating",
+                    "found_root_cause",
+                    "identified",
+                    "monitoring",
+                    "resolved"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "server_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1655102503",
+                "maxSelect": 1,
+                "name": "priority",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "low",
+                    "medium",
+                    "high",
+                    "critical"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select3288973319",
+                "maxSelect": 1,
+                "name": "impact",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "minor",
+                    "major",
+                    "critical",
+                    "none"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1738231158",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "maintenance",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text724990059",
+                "max": 0,
+                "min": 0,
+                "name": "title",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date1345189255",
+                "max": "",
+                "min": "",
+                "name": "start_time",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "date1096160257",
+                "max": "",
+                "min": "",
+                "name": "end_time",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3922189066",
+                "max": 0,
+                "min": 0,
+                "name": "affected",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3725765462",
+                "max": 0,
+                "min": 0,
+                "name": "created_by",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1348078739",
+                "max": 0,
+                "min": 0,
+                "name": "notify_subscribers",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1655102503",
+                "maxSelect": 1,
+                "name": "priority",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "low",
+                    "medium",
+                    "high",
+                    "critical"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "scheduled",
+                    "completed",
+                    "cancelled",
+                    "in_progress"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4053573849",
+                "max": 0,
+                "min": 0,
+                "name": "operational_status_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1542800728",
+                "maxSelect": 1,
+                "name": "field",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "minor",
+                    "major",
+                    "critical",
+                    "none"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3490420651",
+                "max": 0,
+                "min": 0,
+                "name": "assigned_users",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_3662317132",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "operational_page",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text724990059",
+                "max": 0,
+                "min": 0,
+                "name": "title",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1811784642",
+                "maxSelect": 1,
+                "name": "is_public",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "true",
+                    "false"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2560465762",
+                "max": 0,
+                "min": 0,
+                "name": "slug",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2541086472",
+                "max": 0,
+                "min": 0,
+                "name": "theme",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text156371623",
+                "max": 0,
+                "min": 0,
+                "name": "logo_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2466564623",
+                "max": 0,
+                "min": 0,
+                "name": "custom_domain",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3581369753",
+                "max": 0,
+                "min": 0,
+                "name": "custom_css",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1430013884",
+                "max": 0,
+                "min": 0,
+                "name": "page_style",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "operational",
+                    "degraded",
+                    "partial_outage",
+                    "major_outage",
+                    "maintenance"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1168766540",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "ping_data",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1341404999",
+                "max": 0,
+                "min": 0,
+                "name": "packet_loss",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text926446584",
+                "max": 0,
+                "min": 0,
+                "name": "latency",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2750318623",
+                "max": 0,
+                "min": 0,
+                "name": "max_rtt",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2645286934",
+                "max": 0,
+                "min": 0,
+                "name": "min_rtt",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text108668494",
+                "max": 0,
+                "min": 0,
+                "name": "packets_sent",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3848691274",
+                "max": 0,
+                "min": 0,
+                "name": "packets_recv",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2665772979",
+                "max": 0,
+                "min": 0,
+                "name": "avg_rtt",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text836103155",
+                "max": 0,
+                "min": 0,
+                "name": "rtts",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_171698555",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "regional_service",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1404634243",
+                "max": 0,
+                "min": 0,
+                "name": "agent_ip_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text704082790",
+                "max": 0,
+                "min": 0,
+                "name": "connection",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1597481275",
+                "max": 0,
+                "min": 0,
+                "name": "token",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1998570700",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "server_metrics",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "server_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text933879452",
+                "max": 0,
+                "min": 0,
+                "name": "ram_total",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4038915663",
+                "max": 0,
+                "min": 0,
+                "name": "ram_used",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3302315167",
+                "max": 0,
+                "min": 0,
+                "name": "ram_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1461425251",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_cores",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2062996636",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_usage",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1525183142",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2583550350",
+                "max": 0,
+                "min": 0,
+                "name": "disk_total",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1976676007",
+                "max": 0,
+                "min": 0,
+                "name": "disk_used",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1102580855",
+                "max": 0,
+                "min": 0,
+                "name": "disk_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1936777896",
+                "max": null,
+                "min": null,
+                "name": "network_rx_bytes",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3038767919",
+                "max": null,
+                "min": null,
+                "name": "network_tx_bytes",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3452919696",
+                "max": null,
+                "min": null,
+                "name": "network_rx_speed",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number195057175",
+                "max": null,
+                "min": null,
+                "name": "network_tx_speed",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text635908666",
+                "max": 0,
+                "min": 0,
+                "name": "agent_status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1907735298",
+                "max": 0,
+                "min": 0,
+                "name": "max_retries",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3065852031",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text772177811",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1965843930",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "server_notification_templates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2233324553",
+                "max": 0,
+                "min": 0,
+                "name": "ram_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3462525847",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3499937189",
+                "max": 0,
+                "min": 0,
+                "name": "disk_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3897838783",
+                "max": 0,
+                "min": 0,
+                "name": "network_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2761878292",
+                "max": 0,
+                "min": 0,
+                "name": "up_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3025025370",
+                "max": 0,
+                "min": 0,
+                "name": "down_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2718833336",
+                "max": 0,
+                "min": 0,
+                "name": "paused_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3489289583",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_temp_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2170408196",
+                "max": 0,
+                "min": 0,
+                "name": "disk_io_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4125531906",
+                "max": 0,
+                "min": 0,
+                "name": "placeholder",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1005957295",
+                "max": 0,
+                "min": 0,
+                "name": "warning_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text992877620",
+                "max": 0,
+                "min": 0,
+                "name": "restore_ram_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2334264704",
+                "max": 0,
+                "min": 0,
+                "name": "restore_cpu_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text808080362",
+                "max": 0,
+                "min": 0,
+                "name": "restore_disk_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2722458077",
+                "max": 0,
+                "min": 0,
+                "name": "restore_network_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text823542732",
+                "max": 0,
+                "min": 0,
+                "name": "restore_disk_io_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1526027363",
+                "max": 0,
+                "min": 0,
+                "name": "restore_cpu_temp_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1464856393",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "server_threshold_templates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2233324553",
+                "max": 0,
+                "min": 0,
+                "name": "ram_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3462525847",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3499937189",
+                "max": 0,
+                "min": 0,
+                "name": "disk_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3897838783",
+                "max": 0,
+                "min": 0,
+                "name": "network_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3837604842",
+                "max": 0,
+                "min": 0,
+                "name": "disk_io_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2623591511",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_temp_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_3738798621",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "servers",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "server_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3847340049",
+                "max": 0,
+                "min": 0,
+                "name": "hostname",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text587191692",
+                "max": 0,
+                "min": 0,
+                "name": "ip_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063420466",
+                "max": 0,
+                "min": 0,
+                "name": "os_type",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "up",
+                    "down",
+                    "warning",
+                    "paused"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1563400775",
+                "max": 0,
+                "min": 0,
+                "name": "uptime",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number933879452",
+                "max": null,
+                "min": null,
+                "name": "ram_total",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number4038915663",
+                "max": null,
+                "min": null,
+                "name": "ram_used",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1461425251",
+                "max": null,
+                "min": null,
+                "name": "cpu_cores",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number2062996636",
+                "max": null,
+                "min": null,
+                "name": "cpu_usage",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number2583550350",
+                "max": null,
+                "min": null,
+                "name": "disk_total",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1976676007",
+                "max": null,
+                "min": null,
+                "name": "disk_used",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "date3415181003",
+                "max": "",
+                "min": "",
+                "name": "last_checked",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4290167602",
+                "max": 0,
+                "min": 0,
+                "name": "server_token",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2782324286",
+                "max": 0,
+                "min": 0,
+                "name": "timestamp",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text704082790",
+                "max": 0,
+                "min": 0,
+                "name": "connection",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text635908666",
+                "max": 0,
+                "min": 0,
+                "name": "agent_status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3661988513",
+                "max": 0,
+                "min": 0,
+                "name": "system_info",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1936777896",
+                "max": 0,
+                "min": 0,
+                "name": "network_rx_bytes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3038767919",
+                "max": 0,
+                "min": 0,
+                "name": "network_tx_bytes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3452919696",
+                "max": 0,
+                "min": 0,
+                "name": "network_rx_speed",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text195057175",
+                "max": 0,
+                "min": 0,
+                "name": "network_tx_speed",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number4097339557",
+                "max": null,
+                "min": null,
+                "name": "check_interval",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "select4065722285",
+                "maxSelect": 1,
+                "name": "docker",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "true",
+                    "false"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1907735298",
+                "max": 0,
+                "min": 0,
+                "name": "max_retries",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1080317331",
+                "max": 0,
+                "min": 0,
+                "name": "threshold_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1553704459",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "bool3215432513",
+                "name": "notification_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "bool"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_763794515",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "service_group",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1572233440",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "service_notification_templates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2761878292",
+                "max": 0,
+                "min": 0,
+                "name": "up_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3025025370",
+                "max": 0,
+                "min": 0,
+                "name": "down_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3477829101",
+                "max": 0,
+                "min": 0,
+                "name": "maintenance_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text293022370",
+                "max": 0,
+                "min": 0,
+                "name": "incident_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3490715516",
+                "max": 0,
+                "min": 0,
+                "name": "resolved_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1005957295",
+                "max": 0,
+                "min": 0,
+                "name": "warning_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4125531906",
+                "max": 0,
+                "min": 0,
+                "name": "placeholder",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_863811952",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "services",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3475444733",
+                "max": 0,
+                "min": 0,
+                "name": "host",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1563400775",
+                "max": null,
+                "min": null,
+                "name": "uptime",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "date3415181003",
+                "max": "",
+                "min": "",
+                "name": "last_checked",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number1133600204",
+                "max": null,
+                "min": null,
+                "name": "port",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2812878347",
+                "max": 0,
+                "min": 0,
+                "name": "domain",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number3142844404",
+                "max": null,
+                "min": null,
+                "name": "heartbeat_interval",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1907735298",
+                "max": null,
+                "min": null,
+                "name": "max_retries",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1117643717",
+                "maxSelect": 1,
+                "name": "service_type",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "http",
+                    "tcp",
+                    "ping",
+                    "dns"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "up",
+                    "down",
+                    "warning",
+                    "paused"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4101391790",
+                "max": 0,
+                "min": 0,
+                "name": "url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select3434705756",
+                "maxSelect": 1,
+                "name": "alerts",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "muted",
+                    "unmuted"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "bool3215432513",
+                "name": "notification_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "bool"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1745692878",
+                "max": 0,
+                "min": 0,
+                "name": "regional_status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text318214333",
+                "max": 0,
+                "min": 0,
+                "name": "status_codes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2502838439",
+                "max": 0,
+                "min": 0,
+                "name": "keyword",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1841317061",
+                "max": 0,
+                "min": 0,
+                "name": "group_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1553704459",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_3575570325",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "services_metrics",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2422262506",
+                "max": 0,
+                "min": 0,
+                "name": "service_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3475444733",
+                "max": 0,
+                "min": 0,
+                "name": "host",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1563400775",
+                "max": null,
+                "min": null,
+                "name": "uptime",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "date3415181003",
+                "max": "",
+                "min": "",
+                "name": "last_checked",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number1133600204",
+                "max": null,
+                "min": null,
+                "name": "port",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2812878347",
+                "max": 0,
+                "min": 0,
+                "name": "domain",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number3142844404",
+                "max": null,
+                "min": null,
+                "name": "heartbeat_interval",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1907735298",
+                "max": null,
+                "min": null,
+                "name": "max_retries",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1117643717",
+                "maxSelect": 1,
+                "name": "service_type",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "http",
+                    "tcp",
+                    "ping",
+                    "dns"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "up",
+                    "down",
+                    "warning",
+                    "paused"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4101391790",
+                "max": 0,
+                "min": 0,
+                "name": "url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select4152017003",
+                "maxSelect": 1,
+                "name": "alerts",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "muted",
+                    "unmuted"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text318214333",
+                "max": 0,
+                "min": 0,
+                "name": "status_codes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1519612219",
+                "max": 0,
+                "min": 0,
+                "name": "keyword",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "region_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1404634243",
+                "max": 0,
+                "min": 0,
+                "name": "agent_ip_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1836745630",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "ssl_certificates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2812878347",
+                "max": 0,
+                "min": 0,
+                "name": "domain",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2910474005",
+                "max": 0,
+                "min": 0,
+                "name": "issuer_o",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2857577546",
+                "max": "",
+                "min": "",
+                "name": "last_notified",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number2281365985",
+                "max": null,
+                "min": null,
+                "name": "warning_threshold",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number219021052",
+                "max": null,
+                "min": null,
+                "name": "expiry_threshold",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3085370608",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2077745078",
+                "max": "",
+                "min": "",
+                "name": "valid_from",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number227839714",
+                "max": null,
+                "min": null,
+                "name": "serial_number",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2790380089",
+                "max": 0,
+                "min": 0,
+                "name": "issued_to",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date3449712486",
+                "max": "",
+                "min": "",
+                "name": "valid_till",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number1533826704",
+                "max": null,
+                "min": null,
+                "name": "validity_days",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number4007784154",
+                "max": null,
+                "min": null,
+                "name": "days_left",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number437829758",
+                "max": null,
+                "min": null,
+                "name": "valid_days_to_expire",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3452125334",
+                "max": 0,
+                "min": 0,
+                "name": "resolved_ip",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2712104570",
+                "max": 0,
+                "min": 0,
+                "name": "issuer_cn",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1754636037",
+                "max": 0,
+                "min": 0,
+                "name": "cert_alg",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1208359189",
+                "max": 0,
+                "min": 0,
+                "name": "cert_sans",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4097339557",
+                "max": 0,
+                "min": 0,
+                "name": "check_interval",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2784829323",
+                "max": "",
+                "min": "",
+                "name": "check_at",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1553704459",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1753185970",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "ssl_history",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2812878347",
+                "max": 0,
+                "min": 0,
+                "name": "cert_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1881225410",
+                "max": 0,
+                "min": 0,
+                "name": "days_before_expiry",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3062427817",
+                "max": 0,
+                "min": 0,
+                "name": "days_before_warning",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select3839288252",
+                "maxSelect": 1,
+                "name": "warning_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "sent",
+                    "pending",
+                    "failed"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select2670434693",
+                "maxSelect": 1,
+                "name": "expiry_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "sent",
+                    "pending",
+                    "failed"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select3824245652",
+                "maxSelect": 1,
+                "name": "critical_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "sent",
+                    "pending",
+                    "failed"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_351174173",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "ssl_notification_templates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2761878292",
+                "max": 0,
+                "min": 0,
+                "name": "expired",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3025025370",
+                "max": 0,
+                "min": 0,
+                "name": "exiring_soon",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1078893766",
+                "max": 0,
+                "min": 0,
+                "name": "warning",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "placeholder",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1636150439",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "status_page_components",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4053573849",
+                "max": 0,
+                "min": 0,
+                "name": "operational_status_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "server_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number4101605491",
+                "max": null,
+                "min": null,
+                "name": "display_order",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_2331916230",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "tcp_data",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1341404999",
+                "max": 0,
+                "min": 0,
+                "name": "connection",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text926446584",
+                "max": 0,
+                "min": 0,
+                "name": "latency",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2770808759",
+                "max": 0,
+                "min": 0,
+                "name": "port",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2273667377",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_67962705",
+        "listRule": "@request.auth.id != \"\"",
+        "viewRule": "@request.auth.id != \"\"",
+        "createRule": "@request.auth.id != \"\"",
+        "updateRule": "@request.auth.id != \"\"",
+        "deleteRule": "@request.auth.id != \"\"",
+        "name": "uptime_data",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1280981898",
+                "max": 0,
+                "min": 0,
+                "name": "packets",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text926446584",
+                "max": 0,
+                "min": 0,
+                "name": "latency",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text318214333",
+                "max": 0,
+                "min": 0,
+                "name": "status_codes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1519612219",
+                "max": 0,
+                "min": 0,
+                "name": "keyword",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2552627541",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    }
+]
diff --git a/application/public/upload/notification/discord.png b/application/public/upload/notification/discord.png
new file mode 100644
index 0000000..cb1b9bd
Binary files /dev/null and b/application/public/upload/notification/discord.png differ
diff --git a/application/public/upload/notification/email.png b/application/public/upload/notification/email.png
new file mode 100644
index 0000000..7b81629
Binary files /dev/null and b/application/public/upload/notification/email.png differ
diff --git a/application/public/upload/notification/google.png b/application/public/upload/notification/google.png
new file mode 100644
index 0000000..d4587ab
Binary files /dev/null and b/application/public/upload/notification/google.png differ
diff --git a/application/public/upload/notification/gotify.png b/application/public/upload/notification/gotify.png
new file mode 100644
index 0000000..105fc6c
Binary files /dev/null and b/application/public/upload/notification/gotify.png differ
diff --git a/application/public/upload/notification/matrix.png b/application/public/upload/notification/matrix.png
new file mode 100644
index 0000000..4321cb8
Binary files /dev/null and b/application/public/upload/notification/matrix.png differ
diff --git a/application/public/upload/notification/notifiarr.png b/application/public/upload/notification/notifiarr.png
new file mode 100644
index 0000000..ae4d12e
Binary files /dev/null and b/application/public/upload/notification/notifiarr.png differ
diff --git a/application/public/upload/notification/ntfy.png b/application/public/upload/notification/ntfy.png
new file mode 100644
index 0000000..ad57c98
Binary files /dev/null and b/application/public/upload/notification/ntfy.png differ
diff --git a/application/public/upload/notification/pushover.png b/application/public/upload/notification/pushover.png
new file mode 100644
index 0000000..8e7b04d
Binary files /dev/null and b/application/public/upload/notification/pushover.png differ
diff --git a/application/public/upload/notification/signal.png b/application/public/upload/notification/signal.png
new file mode 100644
index 0000000..ce4e34c
Binary files /dev/null and b/application/public/upload/notification/signal.png differ
diff --git a/application/public/upload/notification/slack.png b/application/public/upload/notification/slack.png
new file mode 100644
index 0000000..61f9b2e
Binary files /dev/null and b/application/public/upload/notification/slack.png differ
diff --git a/application/public/upload/notification/telegram.png b/application/public/upload/notification/telegram.png
new file mode 100644
index 0000000..083d088
Binary files /dev/null and b/application/public/upload/notification/telegram.png differ
diff --git a/application/public/upload/notification/webhook.png b/application/public/upload/notification/webhook.png
new file mode 100644
index 0000000..b69edea
Binary files /dev/null and b/application/public/upload/notification/webhook.png differ
diff --git a/application/public/upload/os/alpine.png b/application/public/upload/os/alpine.png
new file mode 100644
index 0000000..35884ac
Binary files /dev/null and b/application/public/upload/os/alpine.png differ
diff --git a/application/public/upload/os/arch.png b/application/public/upload/os/arch.png
new file mode 100644
index 0000000..8a69099
Binary files /dev/null and b/application/public/upload/os/arch.png differ
diff --git a/application/public/upload/os/centos.png b/application/public/upload/os/centos.png
new file mode 100644
index 0000000..a946ebc
Binary files /dev/null and b/application/public/upload/os/centos.png differ
diff --git a/application/public/upload/os/debian.png b/application/public/upload/os/debian.png
new file mode 100644
index 0000000..9b025dc
Binary files /dev/null and b/application/public/upload/os/debian.png differ
diff --git a/application/public/upload/os/linux.png b/application/public/upload/os/linux.png
new file mode 100644
index 0000000..8a69099
Binary files /dev/null and b/application/public/upload/os/linux.png differ
diff --git a/application/public/upload/os/rhel.png b/application/public/upload/os/rhel.png
new file mode 100644
index 0000000..5fd5e8b
Binary files /dev/null and b/application/public/upload/os/rhel.png differ
diff --git a/application/public/upload/os/ubuntu.png b/application/public/upload/os/ubuntu.png
new file mode 100644
index 0000000..fe086e2
Binary files /dev/null and b/application/public/upload/os/ubuntu.png differ
diff --git a/application/public/upload/os/windows.png b/application/public/upload/os/windows.png
new file mode 100644
index 0000000..cefd4ae
Binary files /dev/null and b/application/public/upload/os/windows.png differ
diff --git a/application/public/upload/profile/profile1.svg b/application/public/upload/profile/profile1.svg
new file mode 100644
index 0000000..aa0b9f7
--- /dev/null
+++ b/application/public/upload/profile/profile1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Fun Emoji Set</dc:title><dc:creator>Davis Uche</dc:creator><dc:source xsi:type="dcterms:URI">https://www.figma.com/community/file/968125295144990435</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/licenses/by/4.0/</dcterms:license><dc:rights>Remix of „Fun Emoji Set” (https://www.figma.com/community/file/968125295144990435) by „Davis Uche”, licensed under „CC BY 4.0” (https://creativecommons.org/licenses/by/4.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="200" height="200" rx="0" ry="0" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#f6d594" width="200" height="200" x="0" y="0" /><g transform="matrix(1.5625 0 0 1.5625 37.5 110.94)"><path d="M40.77 31C24.27 31 5.8 21.8 4 1.63A1.4 1.4 0 0 1 5.21.07a1.38 1.38 0 0 1 1.55 1.21c1.6 18.47 18.74 26.89 34 26.89 21.58 0 32.38-13.53 33.52-26.89A1.38 1.38 0 0 1 75.73 0 1.45 1.45 0 0 1 77 1.47C75.34 21.84 57.08 31 40.8 31h-.03Z" fill="#000"/></g><g transform="matrix(1.5625 0 0 1.5625 31.25 59.38)"><path d="M75.84 21.11c-2.9.04-5.72-.89-8.04-2.63a13.47 13.47 0 0 1-4.85-7.03 1.75 1.75 0 0 1 1.1-2.26 1.68 1.68 0 0 1 1.86.61c.14.2.24.4.3.64.6 2.11 1.87 3.97 3.61 5.28a9.84 9.84 0 0 0 6.04 1.98c2.17.01 4.29-.68 6.03-2a10.17 10.17 0 0 0 3.65-5.26c.15-.42.46-.75.85-.95a1.68 1.68 0 0 1 2.23.7c.21.38.27.83.17 1.26a13.48 13.48 0 0 1-4.87 7.04 13.17 13.17 0 0 1-8.08 2.62ZM13.84 21.11c-2.9.03-5.73-.9-8.06-2.65a13.54 13.54 0 0 1-4.85-7.05 1.78 1.78 0 0 1 .51-1.88 1.67 1.67 0 0 1 2.4.22c.15.17.25.38.32.6.62 2.1 1.9 3.96 3.64 5.28a9.93 9.93 0 0 0 6.02 2c2.18.03 4.3-.67 6.06-1.99a10.21 10.21 0 0 0 3.66-5.3 1.68 1.68 0 0 1 3.08-.25c.21.4.27.85.17 1.27a13.57 13.57 0 0 1-4.86 7.1 13.19 13.19 0 0 1-8.1 2.65Z" fill="#000"/></g></g></svg>
\ No newline at end of file
diff --git a/application/public/upload/profile/profile2.svg b/application/public/upload/profile/profile2.svg
new file mode 100644
index 0000000..f514232
--- /dev/null
+++ b/application/public/upload/profile/profile2.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Fun Emoji Set</dc:title><dc:creator>Davis Uche</dc:creator><dc:source xsi:type="dcterms:URI">https://www.figma.com/community/file/968125295144990435</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/licenses/by/4.0/</dcterms:license><dc:rights>Remix of „Fun Emoji Set” (https://www.figma.com/community/file/968125295144990435) by „Davis Uche”, licensed under „CC BY 4.0” (https://creativecommons.org/licenses/by/4.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="200" height="200" rx="0" ry="0" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#fcbc34" width="200" height="200" x="0" y="0" /><g transform="matrix(1.5625 0 0 1.5625 37.5 110.94)"><path d="M53.92 35a1.37 1.37 0 0 1-1.26-.83 15.26 15.26 0 0 1 15.67-22.03c3.71.52 7.1 2.39 9.53 5.26a1.48 1.48 0 0 1-1.15 2.09c-.3.04-.61-.02-.88-.17a12.52 12.52 0 0 0-16.54-2.35c-4.01 2.7-7.51 8.54-4.1 16.07a1.48 1.48 0 0 1-.76 1.83 1.3 1.3 0 0 1-.51.13Z" fill="#000"/></g><g transform="matrix(1.5625 0 0 1.5625 31.25 59.38)"><path d="M75.84 21.11c-2.9.04-5.72-.89-8.04-2.63a13.47 13.47 0 0 1-4.85-7.03 1.75 1.75 0 0 1 1.1-2.26 1.68 1.68 0 0 1 1.86.61c.14.2.24.4.3.64.6 2.11 1.87 3.97 3.61 5.28a9.84 9.84 0 0 0 6.04 1.98c2.17.01 4.29-.68 6.03-2a10.17 10.17 0 0 0 3.65-5.26c.15-.42.46-.75.85-.95a1.68 1.68 0 0 1 2.23.7c.21.38.27.83.17 1.26a13.48 13.48 0 0 1-4.87 7.04 13.17 13.17 0 0 1-8.08 2.62ZM13.84 21.11c-2.9.03-5.73-.9-8.06-2.65a13.54 13.54 0 0 1-4.85-7.05 1.78 1.78 0 0 1 .51-1.88 1.67 1.67 0 0 1 2.4.22c.15.17.25.38.32.6.62 2.1 1.9 3.96 3.64 5.28a9.93 9.93 0 0 0 6.02 2c2.18.03 4.3-.67 6.06-1.99a10.21 10.21 0 0 0 3.66-5.3 1.68 1.68 0 0 1 3.08-.25c.21.4.27.85.17 1.27a13.57 13.57 0 0 1-4.86 7.1 13.19 13.19 0 0 1-8.1 2.65Z" fill="#000"/></g></g></svg>
\ No newline at end of file
diff --git a/application/public/upload/profile/profile3.svg b/application/public/upload/profile/profile3.svg
new file mode 100644
index 0000000..37ebc61
--- /dev/null
+++ b/application/public/upload/profile/profile3.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Fun Emoji Set</dc:title><dc:creator>Davis Uche</dc:creator><dc:source xsi:type="dcterms:URI">https://www.figma.com/community/file/968125295144990435</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/licenses/by/4.0/</dcterms:license><dc:rights>Remix of „Fun Emoji Set” (https://www.figma.com/community/file/968125295144990435) by „Davis Uche”, licensed under „CC BY 4.0” (https://creativecommons.org/licenses/by/4.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="200" height="200" rx="0" ry="0" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#d84be5" width="200" height="200" x="0" y="0" /><g transform="matrix(1.5625 0 0 1.5625 37.5 110.94)"><path fill-rule="evenodd" clip-rule="evenodd" d="M4 4c10.24 32.68 61.73 31.31 72 0A167.66 167.66 0 0 1 4 4Z" fill="#2B1607"/><path d="M39.68 29h-.64c-17.41-.24-31.54-9.95-36-24.74a1.02 1.02 0 0 1 .2-.95.98.98 0 0 1 .91-.28 165.35 165.35 0 0 0 71.72 0 .91.91 0 0 1 .9.3 1.04 1.04 0 0 1 .19.97C71.93 19.37 57.36 29 39.68 29ZM5.33 5.3c4.73 13.13 17.76 21.54 33.7 21.77C55.6 27.3 69.29 18.8 74.56 5.3a167.24 167.24 0 0 1-69.22 0Z" fill="#000"/><g style="mix-blend-mode:soft-light" opacity=".4"><path d="M22.02 35.23c5.08 5.6 28.25 5.96 33.85 0a79.58 79.58 0 0 1-33.85 0Z" fill="#422715"/><path d="M22.02 35.23c5.08 5.6 28.25 5.96 33.85 0a79.58 79.58 0 0 1-33.85 0Z" stroke="#000" stroke-width="1.58" stroke-miterlimit="10"/></g><path fill-rule="evenodd" clip-rule="evenodd" d="M40.83 45H38.1c-2.67 0-5.24-1.06-7.13-2.94a10 10 0 0 1-2.96-7.1V19.54c0-1.9 2.8-3.94 4.88-3.46a29.03 29.03 0 0 0 13.26 0C48 15.7 51 17.62 51 19.53v15.44a9.98 9.98 0 0 1-6.28 9.29c-1.23.5-2.55.75-3.89.74Z" fill="url(#mouthTongueOut-a)"/><path fill-rule="evenodd" clip-rule="evenodd" d="M38.27 17c.95 3.75.33 13 1.13 13 .8 0 .53-9.01 1.37-13h-2.5Z" fill="#A00707"/><defs><linearGradient id="mouthTongueOut-a" x1="39.46" y1="45" x2="39.46" y2="16" gradientUnits="userSpaceOnUse"><stop stop-color="#EF0A0A"/><stop offset=".5" stop-color="#ED0A0A"/><stop offset=".67" stop-color="#E60A0A"/><stop offset=".8" stop-color="#DB0A0A"/><stop offset=".9" stop-color="#CA0A0A"/><stop offset=".99" stop-color="#B40A0A"/><stop offset="1" stop-color="#B10A0A"/></linearGradient></defs></g><g transform="matrix(1.5625 0 0 1.5625 31.25 59.38)"><path d="M75.76 21.94c-2.9.04-5.72-.89-8.04-2.63a13.47 13.47 0 0 1-4.85-7.03 1.75 1.75 0 0 1 .49-1.92 1.7 1.7 0 0 1 2.76.9c.6 2.12 1.88 3.98 3.62 5.29a9.84 9.84 0 0 0 6.04 1.98c2.17.01 4.29-.68 6.03-2a10.17 10.17 0 0 0 3.65-5.26c.15-.42.46-.75.85-.95a1.68 1.68 0 0 1 2.24.7c.21.38.27.83.17 1.26a13.48 13.48 0 0 1-4.87 7.04 13.17 13.17 0 0 1-8.08 2.62ZM13.76 21.94c-2.9.03-5.73-.9-8.06-2.65a13.54 13.54 0 0 1-4.85-7.06 1.78 1.78 0 0 1 .51-1.88 1.67 1.67 0 0 1 2.4.22c.15.17.25.38.32.6.62 2.1 1.9 3.96 3.64 5.28a9.93 9.93 0 0 0 6.02 2c2.18.03 4.3-.67 6.06-1.99a10.22 10.22 0 0 0 3.66-5.3 1.68 1.68 0 0 1 3.08-.25c.21.4.27.85.17 1.27a13.57 13.57 0 0 1-4.87 7.1 13.19 13.19 0 0 1-8.08 2.65Z" fill="#000"/></g></g></svg>
\ No newline at end of file
diff --git a/application/public/upload/profile/profile4.svg b/application/public/upload/profile/profile4.svg
new file mode 100644
index 0000000..4a475a2
--- /dev/null
+++ b/application/public/upload/profile/profile4.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Fun Emoji Set</dc:title><dc:creator>Davis Uche</dc:creator><dc:source xsi:type="dcterms:URI">https://www.figma.com/community/file/968125295144990435</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/licenses/by/4.0/</dcterms:license><dc:rights>Remix of „Fun Emoji Set” (https://www.figma.com/community/file/968125295144990435) by „Davis Uche”, licensed under „CC BY 4.0” (https://creativecommons.org/licenses/by/4.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="200" height="200" rx="0" ry="0" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#d9915b" width="200" height="200" x="0" y="0" /><g transform="matrix(1.5625 0 0 1.5625 37.5 110.94)"><path d="M40.3 36c-.35 0-.68-.15-.92-.4a1.43 1.43 0 0 1-.38-.98c0-.37.14-.72.38-.98s.57-.4.91-.4c3.77 0 5.99-1.38 6.1-3.75.1-2.73-2.52-6.05-6.22-6.43a1.26 1.26 0 0 1-.84-.49 1.5 1.5 0 0 1 .08-1.88c.23-.25.52-.4.84-.44 3.66-.25 6.11-3.25 6.04-5.82 0-2.3-2.3-3.67-5.96-3.67-.27-.1-.5-.28-.67-.53a1.53 1.53 0 0 1 0-1.71c.16-.25.4-.43.67-.53 6.17 0 8.45 3.28 8.55 6.35a8.98 8.98 0 0 1-1.23 4.26 8.22 8.22 0 0 1-3.06 3.02 8.91 8.91 0 0 1 3.18 3.3A9.7 9.7 0 0 1 49 29.48C48.84 32.7 46.48 36 40.3 36Z" fill="#000"/><g fill-rule="evenodd" clip-rule="evenodd"><path d="M107.8 10.27c-.09.5-.2.98-.36 1.46-2.88 10.4-16.3 16.3-23.8 19.9-6.09-6.32-17.4-17.25-15.4-28.6.25-1.51.78-2.96 1.58-4.25 3.97-6.6 13.73-7.44 19.41.96 9.68-6.95 20.37.34 18.57 10.53Z" fill="#CE0F0F"/><path opacity=".2" d="M107.8 10.27c-.09.5-.2.98-.36 1.46-4.52 8.33-15.82 13.3-22.4 16.5C78.87 21.98 67.61 11.1 69.6-.32c0-.29.12-.57.2-.85 3.96-6.58 13.73-7.43 19.4.97 9.7-7.01 20.39.28 18.6 10.47Z" fill="#fff"/></g></g><g transform="matrix(1.5625 0 0 1.5625 31.25 59.38)"><path d="M78.36 25.92h-6.6c-9.72 0-9.72.07-9.72-9.73v-3.3A13.04 13.04 0 0 1 75.06-.13 13.04 13.04 0 0 1 88.1 12.9v3.38c-.03 9.72-.03 9.65-9.73 9.65Z" fill="#000"/><path d="M70.69 9.52a2.28 2.28 0 1 0 0-4.57 2.28 2.28 0 0 0 0 4.57Z" fill="#fff"/><path opacity=".1" d="M74.92 18.31a5.31 5.31 0 1 0 0-10.62 5.31 5.31 0 0 0 0 10.62Z" fill="#fff"/><path d="M17.36 25.92h-6.6c-9.72 0-9.72.07-9.72-9.73v-3.3A13.04 13.04 0 0 1 14.06-.13 13.04 13.04 0 0 1 27.1 12.9v3.38c-.03 9.72-.03 9.65-9.73 9.65Z" fill="#000"/><path d="M9.8 9.53a2.29 2.29 0 1 0 0-4.57 2.29 2.29 0 0 0 0 4.57Z" fill="#fff"/><path opacity=".1" d="M14.03 18.35a5.32 5.32 0 1 0 0-10.65 5.32 5.32 0 0 0 0 10.65Z" fill="#fff"/></g></g></svg>
\ No newline at end of file
diff --git a/application/public/upload/profile/profile5.svg b/application/public/upload/profile/profile5.svg
new file mode 100644
index 0000000..5a257c8
--- /dev/null
+++ b/application/public/upload/profile/profile5.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Fun Emoji Set</dc:title><dc:creator>Davis Uche</dc:creator><dc:source xsi:type="dcterms:URI">https://www.figma.com/community/file/968125295144990435</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/licenses/by/4.0/</dcterms:license><dc:rights>Remix of „Fun Emoji Set” (https://www.figma.com/community/file/968125295144990435) by „Davis Uche”, licensed under „CC BY 4.0” (https://creativecommons.org/licenses/by/4.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="200" height="200" rx="0" ry="0" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#71cf62" width="200" height="200" x="0" y="0" /><g transform="matrix(1.5625 0 0 1.5625 37.5 110.94)"><path fill-rule="evenodd" clip-rule="evenodd" d="M21 29a19.88 19.88 0 0 1 39 0c-9.72-7.8-30.4-7.44-39 0Z" fill="#2B1607"/><path d="M20.58 29.54c-.1 0-.2-.03-.3-.09a.58.58 0 0 1-.24-.27.56.56 0 0 1-.02-.36c2.48-9.9 10.54-16.22 20.51-16.22 9.98 0 18.01 6.41 20.45 16.28.03.11.02.24-.02.35a.58.58 0 0 1-.23.27.62.62 0 0 1-.7 0c-9.4-7.44-30.24-7.44-39.1 0a.6.6 0 0 1-.35.04Zm19.74-6.8c7.07 0 14.22 1.6 19.11 4.77-1.15-3.98-3.62-7.5-7.03-10a19.88 19.88 0 0 0-11.83-3.82 19.94 19.94 0 0 0-11.82 3.8 19.02 19.02 0 0 0-7.06 9.97c4.58-3.14 11.6-4.71 18.63-4.71Z" fill="#000"/></g><g transform="matrix(1.5625 0 0 1.5625 31.25 59.38)"><path fill-rule="evenodd" clip-rule="evenodd" d="M-10.24 2.64c-4.65 4.43-2.22 27.02 7.48 32.71 3.24 1.9 15.66 3.74 21.17 1.63 10.32-3.94 16.86-18.34 16.86-25.23 0-5.08-9.94-10.86-18.17-11.8C9.1-1-6-1.39-10.24 2.64Z" fill="url(#eyesShades-a)"/><path fill-rule="evenodd" clip-rule="evenodd" d="M98.51 2.64c4.66 4.43 2.24 27.02-7.47 32.71-3.23 1.9-15.66 3.74-21.18 1.63C59.55 33.04 53 18.7 53 11.75 53 6.67 62.95.89 71.18-.05c7.97-.95 23.1-1.33 27.33 2.7Z" fill="url(#eyesShades-b)"/><path d="M109.83-2.7a.62.62 0 0 0-.48-.5c-8.12-1.39-30.47-2.95-42.45-.7A33.37 33.37 0 0 0 56.73-.04l-2.37 1.21A20.61 20.61 0 0 1 44.15 3.5c-3.55.12-7.08-.68-10.23-2.32l-2.37-1.2a33.23 33.23 0 0 0-10.17-3.89C9.4-6.1-12.93-4.59-21.07-3.2a.57.57 0 0 0-.47.5 33.81 33.81 0 0 0 0 9.3.6.6 0 0 0 .44.47s2.95.83 4.01 9.09c.84 6.53 4.21 22.03 17.7 24.5 3.63.6 7.3.92 11 .92 1.62.02 3.24-.07 4.85-.28 14.98-2.18 19.62-15.62 21.86-22.13.3-.86.55-1.58.78-2.16 1.48-3.55 2.64-3.93 5.06-3.93 1.9 0 3.58.3 5.05 3.93.22.58.49 1.32.78 2.16 2.23 6.46 6.89 19.9 21.84 22.13 5.3.5 10.62.28 15.85-.65 13.5-2.46 16.89-17.96 17.68-24.5 1.04-8.25 3.97-9.07 3.98-9.08a.6.6 0 0 0 .47-.47c.44-3.08.45-6.21.03-9.3Zm-9.87 18.58c-.77 6.71-3.66 15.7-9.21 18.96-3.08 1.81-15.26 3.66-20.64 1.6-10.25-3.92-16.52-18.2-16.52-24.7 0-4.42 9.08-10.22 17.69-11.22C74.88.1 78.48-.1 82.1-.1c6.8 0 13.54.8 16.03 3.17 1.78 1.71 2.52 6.86 1.83 12.8Zm-65.27-4.13c0 6.49-6.25 20.77-16.48 24.68-5.42 2.07-17.59.22-20.62-1.6-5.56-3.25-8.43-12.24-9.22-18.95-.69-5.9 0-11.1 1.86-12.8C-7.28.7-.54-.1 6.26-.1c3.61 0 7.22.2 10.81.62 8.55 1 17.62 6.77 17.62 11.23Z" fill="#000"/><defs><linearGradient id="eyesShades-a" x1="11.37" y1="37.92" x2="11.37" y2="-.68" gradientUnits="userSpaceOnUse"><stop offset=".32" stop-color="#121212"/><stop offset="1" stop-color="#474747"/></linearGradient><linearGradient id="eyesShades-b" x1="76.91" y1="-.68" x2="76.91" y2="37.92" gradientUnits="userSpaceOnUse"><stop stop-color="#474747"/><stop offset=".68" stop-color="#121212"/></linearGradient></defs></g></g></svg>
\ No newline at end of file
diff --git a/application/public/upload/profile/profile6.svg b/application/public/upload/profile/profile6.svg
new file mode 100644
index 0000000..c372ee0
--- /dev/null
+++ b/application/public/upload/profile/profile6.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Fun Emoji Set</dc:title><dc:creator>Davis Uche</dc:creator><dc:source xsi:type="dcterms:URI">https://www.figma.com/community/file/968125295144990435</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/licenses/by/4.0/</dcterms:license><dc:rights>Remix of „Fun Emoji Set” (https://www.figma.com/community/file/968125295144990435) by „Davis Uche”, licensed under „CC BY 4.0” (https://creativecommons.org/licenses/by/4.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="200" height="200" rx="0" ry="0" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#d84be5" width="200" height="200" x="0" y="0" /><g transform="matrix(1.5625 0 0 1.5625 37.5 110.94)"><path d="M25 24c4.5 3.87 25.04 4.13 30 0H25Z" fill="#000" style="mix-blend-mode:soft-light" opacity=".4"/><path d="M64.43 18.86h-48.5a1.47 1.47 0 1 1 0-2.79h48.5a1.47 1.47 0 1 1 0 2.8Z" fill="#000"/></g><g transform="matrix(1.5625 0 0 1.5625 31.25 59.38)"><path fill-rule="evenodd" clip-rule="evenodd" d="M-10.24 2.64c-4.65 4.43-2.22 27.02 7.48 32.71 3.24 1.9 15.66 3.74 21.17 1.63 10.32-3.94 16.86-18.34 16.86-25.23 0-5.08-9.94-10.86-18.17-11.8C9.1-1-6-1.39-10.24 2.64Z" fill="url(#eyesShades-a)"/><path fill-rule="evenodd" clip-rule="evenodd" d="M98.51 2.64c4.66 4.43 2.24 27.02-7.47 32.71-3.23 1.9-15.66 3.74-21.18 1.63C59.55 33.04 53 18.7 53 11.75 53 6.67 62.95.89 71.18-.05c7.97-.95 23.1-1.33 27.33 2.7Z" fill="url(#eyesShades-b)"/><path d="M109.83-2.7a.62.62 0 0 0-.48-.5c-8.12-1.39-30.47-2.95-42.45-.7A33.37 33.37 0 0 0 56.73-.04l-2.37 1.21A20.61 20.61 0 0 1 44.15 3.5c-3.55.12-7.08-.68-10.23-2.32l-2.37-1.2a33.23 33.23 0 0 0-10.17-3.89C9.4-6.1-12.93-4.59-21.07-3.2a.57.57 0 0 0-.47.5 33.81 33.81 0 0 0 0 9.3.6.6 0 0 0 .44.47s2.95.83 4.01 9.09c.84 6.53 4.21 22.03 17.7 24.5 3.63.6 7.3.92 11 .92 1.62.02 3.24-.07 4.85-.28 14.98-2.18 19.62-15.62 21.86-22.13.3-.86.55-1.58.78-2.16 1.48-3.55 2.64-3.93 5.06-3.93 1.9 0 3.58.3 5.05 3.93.22.58.49 1.32.78 2.16 2.23 6.46 6.89 19.9 21.84 22.13 5.3.5 10.62.28 15.85-.65 13.5-2.46 16.89-17.96 17.68-24.5 1.04-8.25 3.97-9.07 3.98-9.08a.6.6 0 0 0 .47-.47c.44-3.08.45-6.21.03-9.3Zm-9.87 18.58c-.77 6.71-3.66 15.7-9.21 18.96-3.08 1.81-15.26 3.66-20.64 1.6-10.25-3.92-16.52-18.2-16.52-24.7 0-4.42 9.08-10.22 17.69-11.22C74.88.1 78.48-.1 82.1-.1c6.8 0 13.54.8 16.03 3.17 1.78 1.71 2.52 6.86 1.83 12.8Zm-65.27-4.13c0 6.49-6.25 20.77-16.48 24.68-5.42 2.07-17.59.22-20.62-1.6-5.56-3.25-8.43-12.24-9.22-18.95-.69-5.9 0-11.1 1.86-12.8C-7.28.7-.54-.1 6.26-.1c3.61 0 7.22.2 10.81.62 8.55 1 17.62 6.77 17.62 11.23Z" fill="#000"/><defs><linearGradient id="eyesShades-a" x1="11.37" y1="37.92" x2="11.37" y2="-.68" gradientUnits="userSpaceOnUse"><stop offset=".32" stop-color="#121212"/><stop offset="1" stop-color="#474747"/></linearGradient><linearGradient id="eyesShades-b" x1="76.91" y1="-.68" x2="76.91" y2="37.92" gradientUnits="userSpaceOnUse"><stop stop-color="#474747"/><stop offset=".68" stop-color="#121212"/></linearGradient></defs></g></g></svg>
\ No newline at end of file
diff --git a/application/public/upload/profile/profile7.svg b/application/public/upload/profile/profile7.svg
new file mode 100644
index 0000000..4315075
--- /dev/null
+++ b/application/public/upload/profile/profile7.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Fun Emoji Set</dc:title><dc:creator>Davis Uche</dc:creator><dc:source xsi:type="dcterms:URI">https://www.figma.com/community/file/968125295144990435</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/licenses/by/4.0/</dcterms:license><dc:rights>Remix of „Fun Emoji Set” (https://www.figma.com/community/file/968125295144990435) by „Davis Uche”, licensed under „CC BY 4.0” (https://creativecommons.org/licenses/by/4.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="200" height="200" rx="0" ry="0" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#059ff2" width="200" height="200" x="0" y="0" /><g transform="matrix(1.5625 0 0 1.5625 37.5 110.94)"><path d="M75.08 12a1.37 1.37 0 0 1 1.26.83 15.26 15.26 0 0 1-15.67 22.03 15.2 15.2 0 0 1-9.53-5.26 1.48 1.48 0 0 1 1.15-2.09c.3-.04.61.02.88.17a12.52 12.52 0 0 0 16.54 2.35c4.01-2.7 7.51-8.54 4.1-16.07a1.48 1.48 0 0 1 .77-1.83c.16-.08.34-.12.51-.13Z" fill="#000"/></g><g transform="matrix(1.5625 0 0 1.5625 31.25 59.38)"><path d="M87.22 13.98c0-7.2-5.82-13.04-13-13.04s-13 5.84-13 13.04v3.92c0 7.2 5.82 13.04 13 13.04s13-5.83 13-13.04v-3.92Z" fill="#000"/><path d="M70 10.48a2.29 2.29 0 1 0 0-4.58 2.29 2.29 0 0 0 0 4.58Z" fill="#fff"/><path opacity=".1" d="M74.24 19.3a5.32 5.32 0 1 0 0-10.66 5.32 5.32 0 0 0 0 10.65Z" fill="#fff"/><path d="M26.22 13.98c0-7.2-5.82-13.04-13-13.04s-13 5.84-13 13.04v3.92c0 7.2 5.82 13.04 13 13.04s13-5.83 13-13.04v-3.92Z" fill="#000"/><path d="M9 10.48A2.29 2.29 0 1 0 9 5.9a2.29 2.29 0 0 0 0 4.58Z" fill="#fff"/><path opacity=".1" d="M13.24 19.3a5.32 5.32 0 1 0 0-10.66 5.32 5.32 0 0 0 0 10.65Z" fill="#fff"/><path d="M84.33-5.7H65.45C58.63-5.7 53.1-.2 53.1 6.6v18.8c0 6.79 5.52 12.3 12.34 12.3h18.88c6.81 0 12.34-5.51 12.34-12.3V6.6c0-6.8-5.53-12.3-12.34-12.3Z" fill="url(#eyesGlasses-a)"/><path d="M21.3-5.7H2.42C-4.4-5.7-9.92-.2-9.92 6.6v18.8c0 6.79 5.52 12.3 12.34 12.3H21.3c6.81 0 12.34-5.51 12.34-12.3V6.6c0-6.8-5.53-12.3-12.34-12.3Z" fill="url(#eyesGlasses-b)"/><g fill="#000"><path d="M21.06 40.12H2.18A14.83 14.83 0 0 1-8.2 35.81a14.71 14.71 0 0 1-4.33-10.34V6.6c.02-3.87 1.58-7.59 4.34-10.34A14.85 14.85 0 0 1 2.18-8.06h18.88c3.92.02 7.66 1.58 10.42 4.35 2.76 2.76 4.31 6.5 4.31 10.4v18.7A14.62 14.62 0 0 1 26.71 39c-1.79.74-3.7 1.12-5.65 1.12ZM2.18-3.26A9.96 9.96 0 0 0-7 2.83a9.85 9.85 0 0 0-.76 3.78v18.8a9.85 9.85 0 0 0 9.9 9.86h18.92a9.93 9.93 0 0 0 9.9-9.86V6.6a9.87 9.87 0 0 0-9.9-9.86H2.18ZM84.33 40.12H65.46a14.83 14.83 0 0 1-10.39-4.31 14.71 14.71 0 0 1-4.33-10.34V6.6c.02-3.87 1.58-7.59 4.34-10.34a14.85 14.85 0 0 1 10.38-4.32h18.87c3.9.03 7.65 1.59 10.41 4.35s4.31 6.5 4.32 10.4v18.7c0 3.9-1.56 7.64-4.32 10.4a14.83 14.83 0 0 1-10.41 4.33ZM65.46-3.26a9.93 9.93 0 0 0-9.9 9.87v18.8a9.85 9.85 0 0 0 9.9 9.86h18.87a9.93 9.93 0 0 0 9.9-9.86V6.6a9.85 9.85 0 0 0-9.9-9.86H65.46Z"/><path d="M53.1 10.64H33.4v4.89h19.7v-4.89Z"/></g><defs><linearGradient id="eyesGlasses-a" x1="2332.67" y1="1561.82" x2="3621.21" y2="1561.82" gradientUnits="userSpaceOnUse"><stop stop-color="#fff" stop-opacity=".3"/><stop offset=".5" stop-color="#969696" stop-opacity=".2"/><stop offset="1" stop-color="#fff" stop-opacity=".3"/></linearGradient><linearGradient id="eyesGlasses-b" x1="2269.64" y1="1561.82" x2="3558.18" y2="1561.82" gradientUnits="userSpaceOnUse"><stop stop-color="#fff" stop-opacity=".3"/><stop offset=".5" stop-color="#969696" stop-opacity=".2"/><stop offset="1" stop-color="#fff" stop-opacity=".3"/></linearGradient></defs></g></g></svg>
\ No newline at end of file
diff --git a/application/public/upload/profile/profile8.svg b/application/public/upload/profile/profile8.svg
new file mode 100644
index 0000000..a1a8e5e
--- /dev/null
+++ b/application/public/upload/profile/profile8.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" fill="none" shape-rendering="auto"><metadata xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/"><rdf:RDF><rdf:Description><dc:title>Fun Emoji Set</dc:title><dc:creator>Davis Uche</dc:creator><dc:source xsi:type="dcterms:URI">https://www.figma.com/community/file/968125295144990435</dc:source><dcterms:license xsi:type="dcterms:URI">https://creativecommons.org/licenses/by/4.0/</dcterms:license><dc:rights>Remix of „Fun Emoji Set” (https://www.figma.com/community/file/968125295144990435) by „Davis Uche”, licensed under „CC BY 4.0” (https://creativecommons.org/licenses/by/4.0/)</dc:rights></rdf:Description></rdf:RDF></metadata><mask id="viewboxMask"><rect width="200" height="200" rx="0" ry="0" x="0" y="0" fill="#fff" /></mask><g mask="url(#viewboxMask)"><rect fill="#f6d594" width="200" height="200" x="0" y="0" /><g transform="matrix(1.5625 0 0 1.5625 37.5 110.94)"><path fill-rule="evenodd" clip-rule="evenodd" d="M20 28c8-13 29-13 37 0-13-6-24-6-37 0Z" fill="#1E120B"/><path d="M19.37 29a.37.37 0 0 1-.16-.04.4.4 0 0 1-.13-.1.44.44 0 0 1 0-.5C22.76 21.9 30.28 18 38.7 18h.15c8.29 0 15.45 3.9 19.07 10.32a.48.48 0 0 1 0 .52.4.4 0 0 1-.22.13.39.39 0 0 1-.25-.03c-13.42-7.1-24.4-7.1-37.92 0l-.16.06Zm19.17-6.29a39.78 39.78 0 0 1 17.96 4.72c-3.73-5.4-10.27-8.61-17.61-8.64h-.12c-7.56 0-14.37 3.26-18.17 8.64a40.03 40.03 0 0 1 17.94-4.72Z" fill="#000"/><path d="M104.7-9.65 57.64 28.27a32.88 32.88 0 0 0-5.27-2.3 36.9 36.9 0 0 0-5.28-1.56c-1.23-.26-2.48-.5-3.75-.66l53.53-43.12a3.13 3.13 0 0 1 4.4.48l3.92 4.83c.3.37.52.82.61 1.3a3.12 3.12 0 0 1-1.1 3.11Z" fill="#E2E0E0" stroke="#777" stroke-width=".39" stroke-miterlimit="10"/><path opacity=".66" d="M105.8-12.76c-.2.43-.5.8-.88 1.1L56.25 27.56l-.3-.13a32.88 32.88 0 0 0-3.58-1.47 37.79 37.79 0 0 0-5.28-1.55c-1.23-.26-2.48-.5-3.75-.66l53.53-43.12a3.13 3.13 0 0 1 4.4.48l3.92 4.83c.3.37.52.82.61 1.3Z" fill="#fff"/><path d="M96.55-11.11a1.46 1.46 0 0 0-2.08-.22L49.4 24.97c1.14.32 2.25.69 3.37 1.1L96.4-9.03a1.47 1.47 0 0 0 .14-2.08Z" fill="#CECCCC"/><path d="M83.9-.92a1.46 1.46 0 0 0-2.13-.24L49.4 24.97c1.14.32 2.25.69 3.37 1.1l30.9-24.94a1.47 1.47 0 0 0 .24-2.05Z" fill="#EF5656"/><path d="M75.58 3.45a.36.36 0 0 1-.28-.13l-.73-.91a.35.35 0 0 1 0-.49.37.37 0 0 1 .5 0l.73.9a.37.37 0 0 1 0 .5.3.3 0 0 1-.22.14ZM63.17 13.45a.37.37 0 0 1-.28-.13l-.73-.9a.37.37 0 0 1 .32-.55c.09 0 .17.03.24.09l.73.9a.35.35 0 0 1 0 .5.32.32 0 0 1-.28.1ZM51.04 23.28a.34.34 0 0 1-.28-.13l-.73-.91a.35.35 0 0 1 0-.5.37.37 0 0 1 .5 0l.71.9a.35.35 0 0 1 0 .5.34.34 0 0 1-.2.14ZM69.5 8.35a.3.3 0 0 1-.27-.13L67.77 6.4a.36.36 0 0 1 .55-.44l1.47 1.82a.35.35 0 0 1 0 .5.44.44 0 0 1-.3.07ZM56.9 18.54a.37.37 0 0 1-.29-.13l-1.46-1.82a.37.37 0 0 1 0-.5.35.35 0 0 1 .5 0l1.46 1.82a.37.37 0 0 1 0 .5.44.44 0 0 1-.22.13Z" fill="#000"/></g><g transform="matrix(1.5625 0 0 1.5625 31.25 59.38)"><path d="M77.41 26.02h-6.59c-9.7 0-9.7.07-9.7-9.7v-4.09A12.2 12.2 0 0 1 73.32.03h1.6a12.2 12.2 0 0 1 12.2 12.2v4.16c-.03 9.7-.03 9.63-9.7 9.63Z" fill="#000"/><path d="M69.87 9.56a2.29 2.29 0 1 0 0-4.58 2.29 2.29 0 0 0 0 4.58Z" fill="#fff"/><path opacity=".1" d="M74.11 18.37a5.32 5.32 0 1 0 0-10.65 5.32 5.32 0 0 0 0 10.65Z" fill="#fff"/><path d="M1.82 19.02c-.17 0-.34-.03-.5-.09a1.68 1.68 0 0 1-1-.84 1.75 1.75 0 0 1-.13-1.32 13.54 13.54 0 0 1 4.86-7.1 13.1 13.1 0 0 1 8.07-2.65c2.9-.02 5.73.91 8.06 2.67a13.63 13.63 0 0 1 4.86 7.08c.13.44.09.91-.12 1.32a1.72 1.72 0 0 1-2.3.73 1.69 1.69 0 0 1-.84-1.03c-.62-2.13-1.9-4-3.66-5.32a9.92 9.92 0 0 0-6.06-2c-2.17-.01-4.28.7-6.02 2.02a10.26 10.26 0 0 0-3.64 5.3c-.1.35-.32.65-.6.87a1.7 1.7 0 0 1-.98.36Z" fill="#000"/></g></g></svg>
\ No newline at end of file
diff --git a/application/src/App.css b/application/src/App.css
new file mode 100644
index 0000000..b9d355d
--- /dev/null
+++ b/application/src/App.css
@@ -0,0 +1,42 @@
+#root {
+  max-width: 1280px;
+  margin: 0 auto;
+  padding: 2rem;
+  text-align: center;
+}
+
+.logo {
+  height: 6em;
+  padding: 1.5em;
+  will-change: filter;
+  transition: filter 300ms;
+}
+.logo:hover {
+  filter: drop-shadow(0 0 2em #646cffaa);
+}
+.logo.react:hover {
+  filter: drop-shadow(0 0 2em #61dafbaa);
+}
+
+@keyframes logo-spin {
+  from {
+    transform: rotate(0deg);
+  }
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+@media (prefers-reduced-motion: no-preference) {
+  a:nth-of-type(2) .logo {
+    animation: logo-spin infinite 20s linear;
+  }
+}
+
+.card {
+  padding: 2em;
+}
+
+.read-the-docs {
+  color: #888;
+}
diff --git a/application/src/App.tsx b/application/src/App.tsx
new file mode 100644
index 0000000..e7f1e0b
--- /dev/null
+++ b/application/src/App.tsx
@@ -0,0 +1,72 @@
+import React, { useState } from 'react';
+import { BrowserRouter, Routes, Route } from 'react-router-dom';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { Toaster } from '@/components/ui/sonner';
+
+import { ThemeProvider } from './contexts/ThemeContext';
+import { LanguageProvider } from './contexts/LanguageContext';
+import { SidebarProvider } from './contexts/SidebarContext';
+
+import Index from './pages/Index';
+import Login from './pages/Login';
+import Dashboard from './pages/Dashboard';
+import InstanceMonitoring from './pages/InstanceMonitoring';
+import ContainerMonitoring from './pages/ContainerMonitoring';
+import ServiceDetail from './pages/ServiceDetail';
+import SslDomain from './pages/SslDomain';
+import ScheduleIncident from './pages/ScheduleIncident';
+import OperationalPage from './pages/OperationalPage';
+import RegionalMonitoring from './pages/RegionalMonitoring';
+import Settings from './pages/Settings';
+import Profile from './pages/Profile';
+import NotFound from './pages/NotFound';
+import PublicStatusPage from './pages/PublicStatusPage';
+import { ProtectedRoute } from './components/auth/ProtectedRoute';
+import ServerDetail from './pages/ServerDetail';
+
+function App() {
+  const [queryClient] = useState(() => new QueryClient({
+    defaultOptions: {
+      queries: {
+        staleTime: 60 * 1000
+      }
+    }
+  }));
+
+  return (
+    <BrowserRouter>
+      <ThemeProvider>
+        <LanguageProvider>
+          <SidebarProvider>
+            <QueryClientProvider client={queryClient}>
+              <Toaster />
+              <Routes>
+                {/* Public routes */}
+                <Route path="/public/:slug" element={<PublicStatusPage />} />
+                
+                {/* Protected routes */}
+                <Route path="/login" element={<Login />} />
+                <Route path="/" element={<ProtectedRoute><Index /></ProtectedRoute>} />
+                <Route path="/dashboard" element={<ProtectedRoute><Dashboard /></ProtectedRoute>} />
+                <Route path="/instance-monitoring" element={<ProtectedRoute><InstanceMonitoring /></ProtectedRoute>} />
+                <Route path="/server-detail/:serverId" element={<ProtectedRoute><ServerDetail /></ProtectedRoute>} />
+                <Route path="/container-monitoring" element={<ProtectedRoute><ContainerMonitoring /></ProtectedRoute>} />
+                <Route path="/container-monitoring/:serverId" element={<ProtectedRoute><ContainerMonitoring /></ProtectedRoute>} />
+                <Route path="/service/:id" element={<ProtectedRoute><ServiceDetail /></ProtectedRoute>} />
+                <Route path="/ssl-domain" element={<ProtectedRoute><SslDomain /></ProtectedRoute>} />
+                <Route path="/schedule-incident" element={<ProtectedRoute><ScheduleIncident /></ProtectedRoute>} />
+                <Route path="/operational-page" element={<ProtectedRoute><OperationalPage /></ProtectedRoute>} />
+                <Route path="/regional-monitoring" element={<ProtectedRoute><RegionalMonitoring /></ProtectedRoute>} />
+                <Route path="/settings" element={<ProtectedRoute><Settings /></ProtectedRoute>} />
+                <Route path="/profile" element={<ProtectedRoute><Profile /></ProtectedRoute>} />
+                <Route path="*" element={<NotFound />} />
+              </Routes>
+            </QueryClientProvider>
+          </SidebarProvider>
+        </LanguageProvider>
+      </ThemeProvider>
+    </BrowserRouter>
+  );
+}
+
+export default App;
\ No newline at end of file
diff --git a/application/src/api/index.ts b/application/src/api/index.ts
new file mode 100644
index 0000000..1fa86b7
--- /dev/null
+++ b/application/src/api/index.ts
@@ -0,0 +1,86 @@
+
+// API routes handler
+import realtime from './realtime';
+import settingsApi from './settings';
+
+/**
+ * Simple API router for client-side application
+ */
+const api = {
+  /**
+   * Handle API requests
+   */
+  async handleRequest(path, method, body) {
+   // console.log(`API request: ${method} ${path}`, body);
+    
+    // Route to the appropriate handler
+    if (path === '/api/realtime') {
+    //  console.log("Routing to realtime handler");
+      return await realtime(body);
+    } else if (path === '/api/settings' || path.startsWith('/api/settings/')) {
+     // console.log("Routing to settings handler");
+      return await settingsApi(body, path);
+    }
+    
+    // Return 404 for unknown routes
+   // console.error(`Endpoint not found: ${path}`);
+    return {
+      status: 404,
+      json: {
+        ok: false,
+        error_code: 404,
+        description: "Endpoint not found"
+      }
+    };
+  }
+};
+
+// Mock fetch override for development
+const originalFetch = window.fetch;
+window.fetch = async (url, options = {}) => {
+  // Check if this is an API request to our mock endpoints
+  if (typeof url === 'string' && url.startsWith('/api/')) {
+   // console.log('Intercepting API request:', url, options);
+    
+    try {
+      let body = {};
+      
+      // Properly handle different body types
+      if (options.body) {
+        if (typeof options.body === 'string') {
+          body = JSON.parse(options.body);
+        } else {
+          // Handle ReadableStream or other BodyInit types
+          const bodyText = await new Response(options.body).text();
+          body = bodyText ? JSON.parse(bodyText) : {};
+        }
+      }
+      
+      const result = await api.handleRequest(url, options.method || 'GET', body);
+      
+      // Create a proper Response object
+      return new Response(JSON.stringify(result.json), {
+        status: result.status,
+        headers: {
+          'Content-Type': 'application/json',
+        },
+      });
+    } catch (error) {
+      console.error('Error in API handler:', error);
+      return new Response(JSON.stringify({
+        success: false,
+        message: 'Internal server error'
+      }), {
+        status: 500,
+        headers: {
+          'Content-Type': 'application/json',
+        },
+      });
+    }
+  }
+  
+  // For all other requests, use the original fetch
+  return originalFetch(url, options);
+};
+
+export default api;
\ No newline at end of file
diff --git a/application/src/api/realtime/index.ts b/application/src/api/realtime/index.ts
new file mode 100644
index 0000000..e114a68
--- /dev/null
+++ b/application/src/api/realtime/index.ts
@@ -0,0 +1,195 @@
+
+// This file handles realtime notifications in a client-side environment
+// In a production app, this would be a server-side endpoint
+
+//console.log("API Realtime endpoint loaded");
+
+// Simple implementation that simulates sending notifications
+export default async function handler(req) {
+  try {
+    console.log("Realtime API call received:", JSON.stringify({
+      ...req,
+      botToken: req?.botToken ? "[REDACTED]" : undefined
+    }, null, 2));
+    
+    // Make sure we're accessing the body correctly
+    const body = req || {};
+    const { type } = body;
+    
+    if (!type) {
+      console.error("Missing notification type parameter");
+      return {
+        status: 400,
+        json: {
+          ok: false,
+          error_code: 400,
+          description: "Missing notification type"
+        }
+      };
+    }
+    
+    // Handle Telegram notifications
+    if (type === "telegram") {
+      const { chatId, botToken, message } = body;
+      
+      console.log("Telegram notification request details:");
+      console.log("- Chat ID:", chatId);
+      console.log("- Bot token available:", !!botToken);
+      console.log("- Message length:", message?.length || 0);
+      
+      if (!chatId || !botToken || !message) {
+        console.error("Missing required parameters for Telegram notification", { 
+          hasChatId: !!chatId, 
+          hasBotToken: !!botToken, 
+          hasMessage: !!message 
+        });
+        
+        return {
+          status: 400,
+          json: {
+            ok: false,
+            error_code: 400,
+            description: "Missing required Telegram parameters"
+          }
+        };
+      }
+      
+      try {
+        console.log("Attempting to call real Telegram API");
+        const telegramApiUrl = `https://api.telegram.org/bot${botToken}/sendMessage`;
+        
+        console.log("Calling Telegram API:", telegramApiUrl.replace(botToken, "[REDACTED]"));
+        
+        const response = await fetch(telegramApiUrl, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({
+            chat_id: chatId,
+            text: message,
+            parse_mode: 'HTML'
+          }),
+        });
+        
+        if (!response.ok) {
+          const errorText = await response.text();
+          console.error(`Telegram API error (${response.status}):`, errorText);
+          
+          try {
+            // Try to parse error as JSON if possible
+            const errorJson = JSON.parse(errorText);
+            return {
+              status: response.status,
+              json: errorJson
+            };
+          } catch (e) {
+            // If parsing fails, return the raw error
+            return {
+              status: response.status,
+              json: {
+                ok: false,
+                error_code: response.status,
+                description: `Telegram API error: ${errorText}`
+              }
+            };
+          }
+        }
+        
+        const result = await response.json();
+        console.log("Telegram API response:", JSON.stringify(result, null, 2));
+        
+        if (!result.ok) {
+          console.error("Telegram API error:", result);
+          return {
+            status: response.status,
+            json: result
+          };
+        }
+        
+        console.log("Successfully sent message to Telegram!");
+        return {
+          status: 200,
+          json: {
+            ok: true,
+            result: result.result,
+            description: "Message sent successfully to Telegram"
+          }
+        };
+      } catch (error) {
+        console.error("Error calling Telegram API:", error);
+        
+        // Return detailed error information
+        return {
+          status: 500,
+          json: {
+            ok: false,
+            error_code: 500,
+            description: `Error sending Telegram message: ${error instanceof Error ? error.message : "Unknown error"}`
+          }
+        };
+      }
+    } 
+    // Handle Signal notifications
+    else if (type === "signal") {
+      const { signalNumber, message } = body;
+      
+      if (!signalNumber || !message) {
+        console.error("Missing required parameters for Signal notification", { 
+          hasSignalNumber: !!signalNumber, 
+          hasMessage: !!message 
+        });
+        
+        return {
+          status: 400,
+          json: {
+            ok: false,
+            error_code: 400,
+            description: "Missing required Signal parameters"
+          }
+        };
+      }
+      
+      // Simulate sending Signal message
+      console.log(`[SIMULATION] Sending Signal message to ${signalNumber}: ${message}`);
+      
+      // Simulate network delay
+      await new Promise(resolve => setTimeout(resolve, 500));
+      
+      // Return success response
+      return {
+        status: 200,
+        json: {
+          ok: true,
+          result: {
+            id: Math.floor(Math.random() * 10000),
+            timestamp: Date.now(),
+            delivered: true
+          },
+          description: "Signal message sent successfully (simulated)"
+        }
+      };
+    } else {
+      // Return error for unsupported notification type
+      console.error("Unsupported notification type:", type);
+      return {
+        status: 400,
+        json: {
+          ok: false,
+          error_code: 400,
+          description: `Unsupported notification type: ${type}`
+        }
+      };
+    }
+  } catch (error) {
+    console.error("Error in realtime handler:", error);
+    return {
+      status: 500,
+      json: {
+        ok: false,
+        error_code: 500,
+        description: error.message || "Internal server error"
+      }
+    };
+  }
+}
diff --git a/application/src/api/settings/actions/getSettings.ts b/application/src/api/settings/actions/getSettings.ts
new file mode 100644
index 0000000..bf83662
--- /dev/null
+++ b/application/src/api/settings/actions/getSettings.ts
@@ -0,0 +1,26 @@
+
+import { getAuthHeaders, getBaseUrl } from '../utils';
+import { SettingsApiResponse } from '../types';
+
+export const getSettings = async (): Promise<SettingsApiResponse> => {
+  try {
+    const response = await fetch(`${getBaseUrl()}/api/settings`, {
+      method: 'GET',
+      headers: getAuthHeaders(),
+    });
+
+    if (!response.ok) throw new Error(`HTTP error! status: ${response.status}`);
+
+    const settings = await response.json();
+    return {
+      status: 200,
+      json: { success: true, data: settings },
+    };
+  } catch (error) {
+    console.error('Error fetching settings:', error);
+    return {
+      status: 500,
+      json: { success: false, message: 'Failed to fetch settings' },
+    };
+  }
+};
\ No newline at end of file
diff --git a/application/src/api/settings/actions/sendTestEmail.ts b/application/src/api/settings/actions/sendTestEmail.ts
new file mode 100644
index 0000000..10200df
--- /dev/null
+++ b/application/src/api/settings/actions/sendTestEmail.ts
@@ -0,0 +1,204 @@
+
+import { getAuthHeaders, getBaseUrl, validateEmail } from '../utils';
+import { SettingsApiResponse } from '../types';
+
+const createEmailTemplate = (template: string, data: any): { subject: string; htmlBody: string } => {
+  let subject = 'Test Email from CheckCle';
+  let htmlBody = `
+    <html>
+      <body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333;">
+        <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+          <h2 style="color: #2563eb;">Test Email</h2>
+          <p>This is a test email from your monitoring system.</p>
+          <p>If you received this email, your SMTP configuration is working correctly.</p>
+          <hr style="border: none; border-top: 1px solid #eee; margin: 20px 0;">
+          <p style="font-size: 12px; color: #666;">
+            Sent from CheckCle Monitoring System<br>
+            Template: ${template}<br>
+            ${data.collection ? `Collection: ${data.collection}` : ''}
+          </p>
+        </div>
+      </body>
+    </html>
+  `;
+
+  switch (template) {
+    case 'verification':
+      subject = 'Email Verification Test - CheckCle';
+      htmlBody = `
+        <html>
+          <body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333;">
+            <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+              <h2 style="color: #10b981;">Email Verification Test</h2>
+              <p>This is a test of the email verification template.</p>
+              <p>If you received this email, your SMTP configuration is working correctly.</p>
+              <div style="background: #f3f4f6; padding: 15px; border-radius: 5px; margin: 20px 0;">
+                <p><strong>Template:</strong> Verification Email</p>
+                <p><strong>Collection:</strong> ${data.collection || '_superusers'}</p>
+              </div>
+              <hr style="border: none; border-top: 1px solid #eee; margin: 20px 0;">
+              <p style="font-size: 12px; color: #666;">Sent from CheckCle Monitoring System</p>
+            </div>
+          </body>
+        </html>
+      `;
+      break;
+    case 'password-reset':
+      subject = 'Password Reset Test - CheckCle';
+      htmlBody = `
+        <html>
+          <body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333;">
+            <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+              <h2 style="color: #f59e0b;">Password Reset Test</h2>
+              <p>This is a test of the password reset template.</p>
+              <p>If you received this email, your SMTP configuration is working correctly.</p>
+              <div style="background: #f3f4f6; padding: 15px; border-radius: 5px; margin: 20px 0;">
+                <p><strong>Template:</strong> Password Reset Email</p>
+                <p><strong>Collection:</strong> ${data.collection || '_superusers'}</p>
+              </div>
+              <hr style="border: none; border-top: 1px solid #eee; margin: 20px 0;">
+              <p style="font-size: 12px; color: #666;">Sent from CheckCle Monitoring System</p>
+            </div>
+          </body>
+        </html>
+      `;
+      break;
+    case 'email-change':
+      subject = 'Email Change Confirmation Test - CheckCle';
+      htmlBody = `
+        <html>
+          <body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333;">
+            <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+              <h2 style="color: #8b5cf6;">Email Change Confirmation Test</h2>
+              <p>This is a test of the email change confirmation template.</p>
+              <p>If you received this email, your SMTP configuration is working correctly.</p>
+              <div style="background: #f3f4f6; padding: 15px; border-radius: 5px; margin: 20px 0;">
+                <p><strong>Template:</strong> Email Change Confirmation</p>
+              </div>
+              <hr style="border: none; border-top: 1px solid #eee; margin: 20px 0;">
+              <p style="font-size: 12px; color: #666;">Sent from CheckCle Monitoring System</p>
+            </div>
+          </body>
+        </html>
+      `;
+      break;
+  }
+
+  return { subject, htmlBody };
+};
+
+export const sendTestEmail = async (data: any): Promise<SettingsApiResponse> => {
+  console.log('sendTestEmail function called with data:', data);
+
+  try {
+    // Validate required fields
+    if (!data || typeof data !== 'object') {
+      console.log('Invalid request data - not object');
+      return {
+        status: 200,
+        json: { success: false, message: 'Invalid request data' },
+      };
+    }
+
+    if (!data.email || typeof data.email !== 'string') {
+      console.log('Email address missing or invalid type');
+      return {
+        status: 200,
+        json: { success: false, message: 'Email address is required and must be a string' },
+      };
+    }
+
+    if (!validateEmail(data.email)) {
+      console.log('Invalid email format:', data.email);
+      return {
+        status: 200,
+        json: { success: false, message: 'Invalid email address format' },
+      };
+    }
+
+    console.log('Email validation passed for:', data.email);
+
+    const headers = getAuthHeaders();
+    const baseUrl = getBaseUrl();
+
+    // Get current SMTP settings first
+    console.log('Fetching SMTP settings from:', `${baseUrl}/api/settings`);
+    
+    const settingsResponse = await fetch(`${baseUrl}/api/settings`, {
+      method: 'GET',
+      headers,
+    });
+
+    if (!settingsResponse.ok) {
+      console.error('Failed to get SMTP settings, status:', settingsResponse.status);
+      return {
+        status: 200,
+        json: { success: false, message: 'Failed to get SMTP settings' },
+      };
+    }
+
+    const settingsData = await settingsResponse.json();
+    console.log('Retrieved settings data:', settingsData);
+    
+    const smtpSettings = settingsData?.smtp;
+
+    if (!smtpSettings || !smtpSettings.enabled) {
+      console.log('SMTP not enabled or missing');
+      return {
+        status: 200,
+        json: { success: false, message: 'SMTP is not enabled. Please enable and configure SMTP settings first.' },
+      };
+    }
+
+    if (!smtpSettings.host || !smtpSettings.username) {
+      console.log('SMTP configuration incomplete - missing host or username');
+      return {
+        status: 200,
+        json: { success: false, message: 'SMTP configuration is incomplete. Please check host and username.' },
+      };
+    }
+
+    if (!smtpSettings.password) {
+      console.log('SMTP password missing');
+      return {
+        status: 200,
+        json: { success: false, message: 'SMTP password is required for authentication. Please configure the SMTP password.' },
+      };
+    }
+
+    // Create test email content based on template
+    const template = data.template || 'basic';
+    const { subject, htmlBody } = createEmailTemplate(template, data);
+
+    console.log('Test email prepared successfully:', {
+      to: data.email,
+      subject: subject,
+      template: template,
+      smtpHost: smtpSettings.host,
+      smtpPort: smtpSettings.port || 587
+    });
+
+    // Simulate processing time
+    console.log('Simulating email send...');
+    await new Promise(resolve => setTimeout(resolve, 1000));
+    console.log('Email send simulation completed');
+
+    return {
+      status: 200,
+      json: {
+        success: true,
+        message: `Test email sent successfully to ${data.email}`,
+      },
+    };
+
+  } catch (error) {
+    console.error('Error in sendTestEmail function:', error);
+    return {
+      status: 200,
+      json: { 
+        success: false, 
+        message: error instanceof Error ? error.message : 'Failed to send test email. Please check your SMTP configuration.'
+      },
+    };
+  }
+};
\ No newline at end of file
diff --git a/application/src/api/settings/actions/testEmail.ts b/application/src/api/settings/actions/testEmail.ts
new file mode 100644
index 0000000..0557a86
--- /dev/null
+++ b/application/src/api/settings/actions/testEmail.ts
@@ -0,0 +1,238 @@
+import { getAuthHeaders, getBaseUrl, validateEmail } from '../utils';
+import { SettingsApiResponse } from '../types';
+
+const createEmailTemplate = (template: string, data: any): { subject: string; htmlBody: string } => {
+  let subject = 'Test Email from CheckCle';
+  let htmlBody = `
+    <html>
+      <body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333;">
+        <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+          <h2 style="color: #2563eb;">Test Email</h2>
+          <p>This is a test email from your monitoring system.</p>
+          <p>If you received this email, your SMTP configuration is working correctly.</p>
+          <hr style="border: none; border-top: 1px solid #eee; margin: 20px 0;">
+          <p style="font-size: 12px; color: #666;">
+            Sent from CheckCle Monitoring System<br>
+            Template: ${template}<br>
+            ${data.collection ? `Collection: ${data.collection}` : ''}
+          </p>
+        </div>
+      </body>
+    </html>
+  `;
+
+  switch (template) {
+    case 'verification':
+      subject = 'Email Verification Test - CheckCle';
+      htmlBody = `
+        <html>
+          <body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333;">
+            <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+              <h2 style="color: #10b981;">Email Verification Test</h2>
+              <p>This is a test of the email verification template.</p>
+              <p>If you received this email, your SMTP configuration is working correctly.</p>
+              <div style="background: #f3f4f6; padding: 15px; border-radius: 5px; margin: 20px 0;">
+                <p><strong>Template:</strong> Verification Email</p>
+                <p><strong>Collection:</strong> ${data.collection || '_superusers'}</p>
+              </div>
+              <hr style="border: none; border-top: 1px solid #eee; margin: 20px 0;">
+              <p style="font-size: 12px; color: #666;">Sent from CheckCle Monitoring System</p>
+            </div>
+          </body>
+        </html>
+      `;
+      break;
+    case 'password-reset':
+      subject = 'Password Reset Test - CheckCle';
+      htmlBody = `
+        <html>
+          <body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333;">
+            <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+              <h2 style="color: #f59e0b;">Password Reset Test</h2>
+              <p>This is a test of the password reset template.</p>
+              <p>If you received this email, your SMTP configuration is working correctly.</p>
+              <div style="background: #f3f4f6; padding: 15px; border-radius: 5px; margin: 20px 0;">
+                <p><strong>Template:</strong> Password Reset Email</p>
+                <p><strong>Collection:</strong> ${data.collection || '_superusers'}</p>
+              </div>
+              <hr style="border: none; border-top: 1px solid #eee; margin: 20px 0;">
+              <p style="font-size: 12px; color: #666;">Sent from CheckCle Monitoring System</p>
+            </div>
+          </body>
+        </html>
+      `;
+      break;
+    case 'email-change':
+      subject = 'Email Change Confirmation Test - CheckCle';
+      htmlBody = `
+        <html>
+          <body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333;">
+            <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+              <h2 style="color: #8b5cf6;">Email Change Confirmation Test</h2>
+              <p>This is a test of the email change confirmation template.</p>
+              <p>If you received this email, your SMTP configuration is working correctly.</p>
+              <div style="background: #f3f4f6; padding: 15px; border-radius: 5px; margin: 20px 0;">
+                <p><strong>Template:</strong> Email Change Confirmation</p>
+              </div>
+              <hr style="border: none; border-top: 1px solid #eee; margin: 20px 0;">
+              <p style="font-size: 12px; color: #666;">Sent from CheckCle Monitoring System</p>
+            </div>
+          </body>
+        </html>
+      `;
+      break;
+  }
+
+  return { subject, htmlBody };
+};
+
+export const testEmail = async (data: any): Promise<SettingsApiResponse> => {
+  console.log('testEmail function called with data:', data);
+
+  try {
+    // Validate required fields
+    if (!data || typeof data !== 'object') {
+      console.log('Invalid request data - not object');
+      return {
+        status: 200,
+        json: { success: false, message: 'Invalid request data' },
+      };
+    }
+
+    if (!data.email || typeof data.email !== 'string') {
+      console.log('Email address missing or invalid type');
+      return {
+        status: 200,
+        json: { success: false, message: 'Email address is required and must be a string' },
+      };
+    }
+
+    if (!validateEmail(data.email)) {
+      console.log('Invalid email format:', data.email);
+      return {
+        status: 200,
+        json: { success: false, message: 'Invalid email address format' },
+      };
+    }
+
+    console.log('Email validation passed for:', data.email);
+
+    const headers = getAuthHeaders();
+    const baseUrl = getBaseUrl();
+
+    // Get current SMTP settings first
+    console.log('Fetching SMTP settings from:', `${baseUrl}/api/settings`);
+    
+    const settingsResponse = await fetch(`${baseUrl}/api/settings`, {
+      method: 'GET',
+      headers,
+    });
+
+    if (!settingsResponse.ok) {
+      console.error('Failed to get SMTP settings, status:', settingsResponse.status);
+      return {
+        status: 200,
+        json: { success: false, message: 'Failed to get SMTP settings' },
+      };
+    }
+
+    const settingsData = await settingsResponse.json();
+    console.log('Retrieved settings data:', settingsData);
+    
+    const smtpSettings = settingsData?.smtp;
+
+    if (!smtpSettings || !smtpSettings.enabled) {
+      console.log('SMTP not enabled or missing');
+      return {
+        status: 200,
+        json: { success: false, message: 'SMTP is not enabled. Please enable and configure SMTP settings first.' },
+      };
+    }
+
+    if (!smtpSettings.host || !smtpSettings.username) {
+      console.log('SMTP configuration incomplete - missing host or username');
+      return {
+        status: 200,
+        json: { success: false, message: 'SMTP configuration is incomplete. Please check host and username.' },
+      };
+    }
+
+    // Create test email content based on template
+    const template = data.template || 'basic';
+    const { subject, htmlBody } = createEmailTemplate(template, data);
+
+    console.log('Test email prepared successfully:', {
+      to: data.email,
+      subject: subject,
+      template: template,
+      smtpHost: smtpSettings.host,
+      smtpPort: smtpSettings.port || 587
+    });
+
+    // Send actual email using the correct PocketBase API endpoint
+    console.log('Sending actual email via PocketBase...');
+    
+    // Fix the payload structure to match PocketBase API expectations
+    const emailPayload = {
+      email: data.email,  // Use 'email' instead of 'to'
+      template: template, // Add the template field
+      subject: subject,
+      html: htmlBody,
+    };
+
+    console.log('Email payload:', emailPayload);
+
+    const emailResponse = await fetch(`${baseUrl}/api/settings/test/email`, {
+      method: 'POST',
+      headers: {
+        ...headers,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(emailPayload),
+    });
+
+    if (!emailResponse.ok) {
+      console.error('Failed to send email, status:', emailResponse.status);
+      const errorText = await emailResponse.text();
+      console.error('Email send error response:', errorText);
+      return {
+        status: 200,
+        json: { success: false, message: 'Failed to send email. Please check your SMTP configuration.' },
+      };
+    }
+
+    // Handle 204 No Content response (successful but no body)
+    if (emailResponse.status === 204) {
+      console.log('Email sent successfully (204 No Content)');
+      return {
+        status: 200,
+        json: {
+          success: true,
+          message: `Test email sent successfully to ${data.email}`,
+        },
+      };
+    }
+
+    // For other successful responses, try to parse JSON
+    const emailResult = await emailResponse.json();
+    console.log('Email sent successfully:', emailResult);
+
+    return {
+      status: 200,
+      json: {
+        success: true,
+        message: `Test email sent successfully to ${data.email}`,
+      },
+    };
+
+  } catch (error) {
+    console.error('Error in testEmail function:', error);
+    return {
+      status: 200,
+      json: { 
+        success: false, 
+        message: error instanceof Error ? error.message : 'Failed to send test email. Please check your SMTP configuration.'
+      },
+    };
+  }
+};
\ No newline at end of file
diff --git a/application/src/api/settings/actions/testEmailConnection.ts b/application/src/api/settings/actions/testEmailConnection.ts
new file mode 100644
index 0000000..41b6876
--- /dev/null
+++ b/application/src/api/settings/actions/testEmailConnection.ts
@@ -0,0 +1,31 @@
+
+import { getAuthHeaders, getBaseUrl } from '../utils';
+import { SettingsApiResponse } from '../types';
+
+export const testEmailConnection = async (data: any): Promise<SettingsApiResponse> => {
+  try {
+    const response = await fetch(`${getBaseUrl()}/api/settings/test-email`, {
+      method: 'POST',
+      headers: getAuthHeaders(),
+      body: JSON.stringify(data),
+    });
+
+    if (!response.ok) throw new Error(`HTTP error! status: ${response.status}`);
+
+    const result = await response.json();
+    return {
+      status: 200,
+      json: {
+        success: result.success || false,
+        message:
+          result.message || (result.success ? 'Connection successful' : 'Connection failed'),
+      },
+    };
+  } catch (error) {
+    console.error('Error testing email connection:', error);
+    return {
+      status: 500,
+      json: { success: false, message: 'Failed to test email connection' },
+    };
+  }
+};
\ No newline at end of file
diff --git a/application/src/api/settings/actions/updateSettings.ts b/application/src/api/settings/actions/updateSettings.ts
new file mode 100644
index 0000000..0c88abc
--- /dev/null
+++ b/application/src/api/settings/actions/updateSettings.ts
@@ -0,0 +1,38 @@
+
+import { getAuthHeaders, getBaseUrl } from '../utils';
+import { SettingsApiResponse } from '../types';
+
+export const updateSettings = async (data: any): Promise<SettingsApiResponse> => {
+  try {
+    const headers = getAuthHeaders();
+    const baseUrl = getBaseUrl();
+
+    let response = await fetch(`${baseUrl}/api/settings`, {
+      method: 'PATCH',
+      headers,
+      body: JSON.stringify(data),
+    });
+
+    if (!response.ok && (response.status === 404 || response.status === 405)) {
+      response = await fetch(`${baseUrl}/api/settings`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(data),
+      });
+    }
+
+    if (!response.ok) throw new Error(`HTTP error! status: ${response.status}`);
+
+    const updatedSettings = await response.json();
+    return {
+      status: 200,
+      json: { success: true, data: updatedSettings },
+    };
+  } catch (error) {
+    console.error('Error updating settings:', error);
+    return {
+      status: 500,
+      json: { success: false, message: 'Failed to update settings' },
+    };
+  }
+};
\ No newline at end of file
diff --git a/application/src/api/settings/index.ts b/application/src/api/settings/index.ts
new file mode 100644
index 0000000..50d2b7d
--- /dev/null
+++ b/application/src/api/settings/index.ts
@@ -0,0 +1,42 @@
+
+import { getSettings } from './actions/getSettings';
+import { updateSettings } from './actions/updateSettings';
+import { testEmailConnection } from './actions/testEmailConnection';
+import { testEmail } from './actions/testEmail';
+
+/**
+ * Settings API handler
+ */
+const settingsApi = async (body: any, path?: string) => {
+ // console.log('Settings API called with path:', path, 'body:', body);
+  
+  // Handle test email endpoint specifically
+  if (path === '/api/settings/test/email') {
+    console.log('Handling test email request');
+    return await testEmail(body);
+  }
+  
+  // Handle regular settings API with action-based routing
+  const action = body?.action;
+ // console.log('Settings API called with action:', action, 'data:', body?.data);
+
+  switch (action) {
+    case 'getSettings':
+      return await getSettings();
+    
+    case 'updateSettings':
+      return await updateSettings(body.data);
+    
+    case 'testEmailConnection':
+      return await testEmailConnection(body.data);
+    
+    default:
+      console.error('Unknown action:', action);
+      return {
+        status: 400,
+        json: { success: false, message: 'Unknown action' },
+      };
+  }
+};
+
+export default settingsApi;
\ No newline at end of file
diff --git a/application/src/api/settings/types.ts b/application/src/api/settings/types.ts
new file mode 100644
index 0000000..01ef5f1
--- /dev/null
+++ b/application/src/api/settings/types.ts
@@ -0,0 +1,25 @@
+
+export interface SettingsApiRequest {
+  action: string;
+  data?: any;
+}
+
+export interface SettingsApiResponse {
+  status: number;
+  json: {
+    success: boolean;
+    data?: any;
+    message?: string;
+  };
+}
+
+export interface SmtpSettings {
+  enabled?: boolean;
+  host?: string;
+  port?: number;
+  username?: string;
+  password?: string;
+  authMethod?: string;
+  tls?: boolean;
+  localName?: string;
+}
\ No newline at end of file
diff --git a/application/src/api/settings/utils.ts b/application/src/api/settings/utils.ts
new file mode 100644
index 0000000..0039a1b
--- /dev/null
+++ b/application/src/api/settings/utils.ts
@@ -0,0 +1,24 @@
+
+import { pb, getCurrentEndpoint } from '@/lib/pocketbase';
+
+export const getAuthHeaders = (): Record<string, string> => {
+  const authToken = pb.authStore.token;
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+  };
+
+  if (authToken) {
+    headers['Authorization'] = `Bearer ${authToken}`;
+  }
+
+  return headers;
+};
+
+export const getBaseUrl = (): string => {
+  return getCurrentEndpoint();
+};
+
+export const validateEmail = (email: string): boolean => {
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  return emailRegex.test(email);
+};
\ No newline at end of file
diff --git a/application/src/components/ErrorBoundary.tsx b/application/src/components/ErrorBoundary.tsx
new file mode 100644
index 0000000..6a8ced8
--- /dev/null
+++ b/application/src/components/ErrorBoundary.tsx
@@ -0,0 +1,49 @@
+
+import React from 'react';
+
+interface ErrorBoundaryState {
+  hasError: boolean;
+  error?: Error;
+}
+
+interface ErrorBoundaryProps {
+  children: React.ReactNode;
+}
+
+export class ErrorBoundary extends React.Component<ErrorBoundaryProps, ErrorBoundaryState> {
+  constructor(props: ErrorBoundaryProps) {
+    super(props);
+    this.state = { hasError: false };
+  }
+
+  static getDerivedStateFromError(error: Error): ErrorBoundaryState {
+    return { hasError: true, error };
+  }
+
+  componentDidCatch(error: Error, errorInfo: React.ErrorInfo) {
+    console.error('ErrorBoundary caught an error:', error, errorInfo);
+  }
+
+  render() {
+    if (this.state.hasError) {
+      return (
+        <div className="min-h-screen flex items-center justify-center bg-background">
+          <div className="text-center p-6">
+            <h2 className="text-2xl font-bold text-destructive mb-4">Something went wrong</h2>
+            <p className="text-muted-foreground mb-4">
+              {this.state.error?.message || 'An unexpected error occurred'}
+            </p>
+            <button 
+              onClick={() => window.location.reload()}
+              className="px-4 py-2 bg-primary text-primary-foreground rounded-md hover:bg-primary/90"
+            >
+              Reload Page
+            </button>
+          </div>
+        </div>
+      );
+    }
+
+    return this.props.children;
+  }
+}
\ No newline at end of file
diff --git a/application/src/components/auth/ForgotPasswordDialog.tsx b/application/src/components/auth/ForgotPasswordDialog.tsx
new file mode 100644
index 0000000..1afad40
--- /dev/null
+++ b/application/src/components/auth/ForgotPasswordDialog.tsx
@@ -0,0 +1,259 @@
+import { useState } from 'react';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { toast } from '@/components/ui/use-toast';
+import { Mail, ArrowLeft } from 'lucide-react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { getCurrentEndpoint } from '@/lib/pocketbase';
+
+interface ForgotPasswordDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+export function ForgotPasswordDialog({ open, onOpenChange }: ForgotPasswordDialogProps) {
+  const [step, setStep] = useState<'request' | 'confirm'>('request');
+  const [email, setEmail] = useState('');
+  const [token, setToken] = useState('');
+  const [password, setPassword] = useState('');
+  const [passwordConfirm, setPasswordConfirm] = useState('');
+  const [loading, setLoading] = useState(false);
+  const { t } = useLanguage();
+
+  const handleRequestReset = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setLoading(true);
+
+    try {
+      const apiUrl = getCurrentEndpoint();
+      const response = await fetch(`${apiUrl}/api/collections/_superusers/request-password-reset`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ email }),
+      });
+
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        throw new Error(errorData.message || 'Failed to send reset email');
+      }
+      
+      toast({
+        title: "Reset Email Sent",
+        description: "Please check your email for password reset instructions.",
+      });
+      setStep('confirm');
+    } catch (error) {
+      console.error('Password reset request error:', error);
+      toast({
+        variant: "destructive",
+        title: "Reset Failed",
+        description: error instanceof Error ? error.message : "Failed to send reset email. Please try again.",
+      });
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleConfirmReset = async (e: React.FormEvent) => {
+    e.preventDefault();
+    
+    if (password !== passwordConfirm) {
+      toast({
+        variant: "destructive",
+        title: "Password Mismatch",
+        description: "Passwords do not match. Please try again.",
+      });
+      return;
+    }
+
+    if (password.length < 6) {
+      toast({
+        variant: "destructive",
+        title: "Password Too Short",
+        description: "Password must be at least 6 characters long.",
+      });
+      return;
+    }
+
+    setLoading(true);
+
+    try {
+      const apiUrl = getCurrentEndpoint();
+      const response = await fetch(`${apiUrl}/api/collections/_superusers/confirm-password-reset`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ 
+          token, 
+          password, 
+          passwordConfirm 
+        }),
+      });
+
+      if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        throw new Error(errorData.message || 'Failed to reset password');
+      }
+
+      toast({
+        title: "Password Reset Successful",
+        description: "Your password has been reset successfully. You can now log in with your new password.",
+      });
+      onOpenChange(false);
+      // Reset form state
+      setStep('request');
+      setEmail('');
+      setToken('');
+      setPassword('');
+      setPasswordConfirm('');
+    } catch (error) {
+      console.error('Password reset confirmation error:', error);
+      toast({
+        variant: "destructive",
+        title: "Reset Failed",
+        description: error instanceof Error ? error.message : "Failed to reset password. Please try again.",
+      });
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleClose = () => {
+    onOpenChange(false);
+    // Reset form state when closing
+    setStep('request');
+    setEmail('');
+    setToken('');
+    setPassword('');
+    setPasswordConfirm('');
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={handleClose}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle>
+            {step === 'request' ? 'Reset Password' : 'Confirm Password Reset'}
+          </DialogTitle>
+          <DialogDescription>
+            {step === 'request' 
+              ? 'Enter your email address and we\'ll send you a reset link.' 
+              : 'Enter the reset token from your email and your new password.'
+            }
+          </DialogDescription>
+        </DialogHeader>
+
+        {step === 'request' ? (
+          <form onSubmit={handleRequestReset} className="space-y-4">
+            <div className="space-y-2">
+              <label className="text-sm font-medium text-foreground" htmlFor="reset-email">
+                Email Address
+              </label>
+              <div className="relative">
+                <div className="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
+                  <Mail className="h-4 w-4 text-muted-foreground" />
+                </div>
+                <Input
+                  id="reset-email"
+                  placeholder="your.email@provider.com"
+                  type="email"
+                  value={email}
+                  onChange={(e) => setEmail(e.target.value)}
+                  required
+                  className="pl-10"
+                />
+              </div>
+            </div>
+            
+            <div className="flex gap-2">
+              <Button 
+                type="button" 
+                variant="outline" 
+                onClick={handleClose}
+                className="flex-1"
+              >
+                Cancel
+              </Button>
+              <Button 
+                type="submit" 
+                disabled={loading || !email}
+                className="flex-1 bg-emerald-500 hover:bg-emerald-600"
+              >
+                {loading ? 'Sending...' : 'Send Reset Email'}
+              </Button>
+            </div>
+          </form>
+        ) : (
+          <form onSubmit={handleConfirmReset} className="space-y-4">
+            <div className="space-y-2">
+              <label className="text-sm font-medium text-foreground" htmlFor="reset-token">
+                Reset Token
+              </label>
+              <Input
+                id="reset-token"
+                placeholder="Enter token from email"
+                type="text"
+                value={token}
+                onChange={(e) => setToken(e.target.value)}
+                required
+              />
+            </div>
+
+            <div className="space-y-2">
+              <label className="text-sm font-medium text-foreground" htmlFor="new-password">
+                New Password
+              </label>
+              <Input
+                id="new-password"
+                placeholder="••••••••••••"
+                type="password"
+                value={password}
+                onChange={(e) => setPassword(e.target.value)}
+                required
+                minLength={6}
+              />
+            </div>
+
+            <div className="space-y-2">
+              <label className="text-sm font-medium text-foreground" htmlFor="confirm-password">
+                Confirm Password
+              </label>
+              <Input
+                id="confirm-password"
+                placeholder="••••••••••••"
+                type="password"
+                value={passwordConfirm}
+                onChange={(e) => setPasswordConfirm(e.target.value)}
+                required
+                minLength={6}
+              />
+            </div>
+            
+            <div className="flex gap-2">
+              <Button 
+                type="button" 
+                variant="outline" 
+                onClick={() => setStep('request')}
+                className="flex-1"
+              >
+                <ArrowLeft className="h-4 w-4 mr-2" />
+                Back
+              </Button>
+              <Button 
+                type="submit" 
+                disabled={loading || !token || !password || !passwordConfirm}
+                className="flex-1 bg-emerald-500 hover:bg-emerald-600"
+              >
+                {loading ? 'Resetting...' : 'Reset Password'}
+              </Button>
+            </div>
+          </form>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/auth/ProtectedRoute.tsx b/application/src/components/auth/ProtectedRoute.tsx
new file mode 100644
index 0000000..22dad62
--- /dev/null
+++ b/application/src/components/auth/ProtectedRoute.tsx
@@ -0,0 +1,16 @@
+
+import { ReactNode } from 'react';
+import { Navigate } from 'react-router-dom';
+import { authService } from '@/services/authService';
+
+interface ProtectedRouteProps {
+  children: ReactNode;
+}
+
+export const ProtectedRoute = ({ children }: ProtectedRouteProps) => {
+  if (!authService.isAuthenticated()) {
+    return <Navigate to="/login" replace />;
+  }
+
+  return <>{children}</>;
+};
\ No newline at end of file
diff --git a/application/src/components/dashboard/DashboardContent.tsx b/application/src/components/dashboard/DashboardContent.tsx
new file mode 100644
index 0000000..64308b6
--- /dev/null
+++ b/application/src/components/dashboard/DashboardContent.tsx
@@ -0,0 +1,75 @@
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Plus } from "lucide-react";
+import { Service } from "@/services/serviceService";
+import { StatusCards } from "./StatusCards";
+import { ServiceFilters } from "./ServiceFilters";
+import { ServicesTable } from "./ServicesTable";
+import { AddServiceDialog } from "@/components/services/AddServiceDialog";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface DashboardContentProps {
+  services: Service[];
+  isLoading: boolean;
+  error: Error | null;
+}
+
+export const DashboardContent = ({ services, isLoading, error }: DashboardContentProps) => {
+  const { t } = useLanguage();
+  const [filter, setFilter] = useState<string>("all");
+  const [searchTerm, setSearchTerm] = useState<string>("");
+  const [isAddDialogOpen, setIsAddDialogOpen] = useState<boolean>(false);
+
+  // Filter services based on search term and type filter
+  const filteredServices = services.filter(service => {
+    const matchesSearch = service.name.toLowerCase().includes(searchTerm.toLowerCase()) || 
+                        (service.url && service.url.toLowerCase().includes(searchTerm.toLowerCase()));
+    const matchesFilter = filter === 'all' || service.type.toLowerCase() === filter.toLowerCase();
+    return matchesSearch && matchesFilter;
+  });
+
+  if (error) {
+    return (
+      <div className="flex flex-col items-center justify-center h-full gap-4 text-foreground">
+        <p>Error loading service data.</p>
+        <Button onClick={() => window.location.reload()}>{t('retry')}</Button>
+      </div>
+    );
+  }
+
+  return (
+    <main className="flex-1 flex flex-col overflow-auto bg-background p-6 pb-0">
+      <div className="flex flex-col flex-1">
+        <div className="flex justify-between items-center mb-6">
+          <h2 className="text-2xl font-bold text-foreground">{t('overview')}</h2>
+          <Button 
+            className="text-primary-foreground"
+            onClick={() => setIsAddDialogOpen(true)}
+          >
+            <Plus className="w-4 h-4 mr-2" /> {t('newService')}
+          </Button>
+        </div>
+        
+        <StatusCards services={services} />
+        
+        <ServiceFilters 
+          filter={filter}
+          setFilter={setFilter}
+          searchTerm={searchTerm}
+          setSearchTerm={setSearchTerm}
+          servicesCount={filteredServices.length}
+        />
+        
+        <div className="flex-1 flex flex-col pb-6">
+          <ServicesTable services={filteredServices} />
+        </div>
+      </div>
+
+      <AddServiceDialog 
+        open={isAddDialogOpen}
+        onOpenChange={setIsAddDialogOpen}
+      />
+    </main>
+  );
+};
diff --git a/application/src/components/dashboard/Header.tsx b/application/src/components/dashboard/Header.tsx
new file mode 100644
index 0000000..83c0b67
--- /dev/null
+++ b/application/src/components/dashboard/Header.tsx
@@ -0,0 +1,207 @@
+import { Button } from "@/components/ui/button";
+import { AuthUser } from "@/services/authService";
+import { useTheme } from "@/contexts/ThemeContext";
+import { 
+  Moon, PanelLeft, PanelLeftClose, Sun, Globe, FileText, 
+  Github, Twitter, MessageSquare, Bell, User, Settings, 
+  LogOut, Menu, X 
+} from "lucide-react";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { 
+  DropdownMenu, DropdownMenuContent, DropdownMenuItem, 
+  DropdownMenuTrigger, DropdownMenuSeparator 
+} from "@/components/ui/dropdown-menu";
+import { useEffect, useState } from "react";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { useNavigate } from "react-router-dom";
+import { useSystemSettings } from "@/hooks/useSystemSettings";
+import { useSidebar } from "@/contexts/SidebarContext";
+import { cn } from "@/lib/utils";
+
+interface HeaderProps {
+  currentUser: AuthUser | null;
+  onLogout: () => void;
+}
+
+export const Header = ({
+  currentUser,
+  onLogout,
+}: HeaderProps) => {
+  const { theme, toggleTheme } = useTheme();
+  const { language, setLanguage, t } = useLanguage();
+  const { sidebarCollapsed, toggleSidebar, isMobileOpen, toggleMobileMenu } = useSidebar();
+  const [greeting, setGreeting] = useState<string>("");
+  const { systemName } = useSystemSettings();
+  const navigate = useNavigate();
+
+  useEffect(() => {
+    const updateGreeting = () => {
+      const hour = new Date().getHours();
+      if (hour >= 5 && hour < 12) setGreeting(t("goodMorning"));
+      else if (hour >= 12 && hour < 18) setGreeting(t("goodAfternoon"));
+      else setGreeting(t("goodEvening"));
+    };
+    updateGreeting();
+  }, [language, t]);
+
+  const avatarUrl = currentUser?.avatar || '';
+
+  const openExternalLink = (url: string) => {
+    window.open(url, '_blank');
+  };
+
+  return (
+    <header className="relative bg-background border-b border-border px-4 lg:px-6 flex justify-between items-center h-16 shrink-0 z-30 overflow-hidden">
+      {/* Grid Pattern Overlay */}
+      <div className="absolute inset-0 z-0 pointer-events-none opacity-20">
+        <div 
+          className="w-full h-full"
+          style={{ 
+            backgroundImage: `linear-gradient(${theme === 'dark' ? '#ffffff10' : '#00000010'} 1px, transparent 1px), 
+                              linear-gradient(90deg, ${theme === 'dark' ? '#ffffff10' : '#00000010'} 1px, transparent 1px)`,
+            backgroundSize: '20px 20px'
+          }}
+        >
+          <div className="w-full h-full backdrop-blur-[1px]"></div>
+        </div>
+      </div>
+      
+      <div className="flex items-center gap-2 lg:gap-4 z-10">
+        {/* Mobile Toggle */}
+        <Button variant="ghost" size="icon" onClick={toggleMobileMenu} className="lg:hidden h-9 w-9">
+          {isMobileOpen ? <X className="h-5 w-5" /> : <Menu className="h-5 w-5" />}
+        </Button>
+
+        {/* Desktop Toggle */}
+        <Button variant="ghost" size="icon" onClick={toggleSidebar} className="hidden lg:flex h-9 w-9">
+          {sidebarCollapsed ? <PanelLeft className="h-5 w-5" /> : <PanelLeftClose className="h-5 w-5" />}
+        </Button>
+        
+        <div className="flex items-center">
+          <h1 className="text-sm lg:text-lg font-medium truncate max-w-[150px] lg:max-w-none">
+            {greeting}, {currentUser?.name || currentUser?.email?.split('@')[0] || 'User'} 👋 ✨
+          </h1>
+        </div>
+      </div>
+      
+      <div className="flex items-center space-x-1 lg:space-x-3 z-10">
+        {/* External Links - Hidden on small screens */}
+        <div className="hidden md:flex items-center space-x-1 mr-2">
+          <Button 
+            variant="outline" 
+            size="icon" 
+            className="rounded-full w-8 h-8 border-border"
+            onClick={() => openExternalLink('https://docs.checkcle.io')}
+            title={t("documentation")}
+          >
+            <FileText className="h-4 w-4" />
+          </Button>
+          <Button 
+            variant="outline" 
+            size="icon" 
+            className="rounded-full w-8 h-8 border-border"
+            onClick={() => openExternalLink('https://github.com/operacle/checkcle')}
+            title="GitHub"
+          >
+            <Github className="h-4 w-4" />
+          </Button>
+          <Button 
+            variant="outline" 
+            size="icon" 
+            className="rounded-full w-8 h-8 border-border"
+            onClick={() => openExternalLink('https://x.com/checkcle_oss')}
+            title="X (Twitter)"
+          >
+            <Twitter className="h-4 w-4" />
+          </Button>
+          <Button 
+            variant="outline" 
+            size="icon" 
+            className="rounded-full w-8 h-8 border-border"
+            onClick={() => openExternalLink('https://discord.gg/xs9gbubGwX')}
+            title="Discord"
+          >
+            <MessageSquare className="h-4 w-4" />
+          </Button>
+          <Button 
+            variant="outline" 
+            size="icon" 
+            className="rounded-full w-8 h-8 border-border"
+            title={t("notifications")}
+          >
+            <Bell className="w-4 h-4" />
+          </Button>
+        </div>
+
+        <Button variant="outline" size="icon" className="rounded-full w-8 h-8 border-border hidden sm:flex" onClick={toggleTheme}>
+          <span className="sr-only">Toggle theme</span>
+          {theme === 'dark' ? <Sun className="w-4 h-4" /> : <Moon className="w-4 h-4" />}
+        </Button>
+        
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <Button variant="outline" size="icon" className="rounded-full w-8 h-8 border-border">
+              <span className="sr-only">{t("language")}</span>
+              <Globe className="w-4 h-4" />
+            </Button>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end" className="w-40">
+            <DropdownMenuItem onClick={() => setLanguage("en")} className={language === "en" ? "bg-accent" : ""}>
+              {t("english")}
+            </DropdownMenuItem>
+            <DropdownMenuItem onClick={() => setLanguage("km")} className={language === "km" ? "bg-accent" : ""}>
+              {t("khmer")}
+            </DropdownMenuItem>
+            <DropdownMenuItem onClick={() => setLanguage("de")} className={language === "de" ? "bg-accent" : ""}>
+              {t("german")}
+            </DropdownMenuItem>
+            <DropdownMenuItem onClick={() => setLanguage("ko")} className={language === "ko" ? "bg-accent" : ""}>
+              {t("korean")}
+            </DropdownMenuItem>
+            <DropdownMenuItem onClick={() => setLanguage("ja")} className={language === "ja" ? "bg-accent" : ""}>
+              {t("japanese")}
+            </DropdownMenuItem>
+            <DropdownMenuItem onClick={() => setLanguage("zhcn")} className={language === "zhcn" ? "bg-accent" : ""}>
+              {t("simplifiedChinese")}
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+        
+        <div className="h-8 w-px bg-border mx-1 hidden sm:block" />
+
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <Avatar className="h-8 w-8 cursor-pointer border hover:ring-2 hover:ring-primary/20 transition-all">
+              {avatarUrl ? <AvatarImage src={avatarUrl} alt="User" /> : <AvatarFallback className="bg-primary/20 text-primary">{currentUser?.name?.[0] || 'U'}</AvatarFallback>}
+            </Avatar>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end" className="w-56">
+            <div className="flex items-center gap-3 p-2">
+              <Avatar className="h-10 w-10">
+                {avatarUrl ? <AvatarImage src={avatarUrl} alt="User" /> : <AvatarFallback className="bg-primary/20 text-primary">{currentUser?.name?.[0] || 'U'}</AvatarFallback>}
+              </Avatar>
+              <div className="flex flex-col space-y-0.5">
+                <span className="text-sm font-medium truncate">{currentUser?.name || 'User'}</span>
+                <span className="text-xs text-muted-foreground truncate">{currentUser?.email}</span>
+              </div>
+            </div>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem onClick={() => navigate("/profile")}>
+              <User className="mr-2 h-4 w-4" />
+              <span>{t("profile")}</span>
+            </DropdownMenuItem>
+            <DropdownMenuItem onClick={() => navigate("/settings")}>
+              <Settings className="mr-2 h-4 w-4" />
+              <span>{t("settings")}</span>
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem onClick={onLogout} className="text-red-500 focus:text-red-500">
+              <LogOut className="mr-2 h-4 w-4" />
+              <span>{t("logout")}</span>
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </div>
+    </header>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/dashboard/ServiceFilters.tsx b/application/src/components/dashboard/ServiceFilters.tsx
new file mode 100644
index 0000000..613fba4
--- /dev/null
+++ b/application/src/components/dashboard/ServiceFilters.tsx
@@ -0,0 +1,56 @@
+
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Select, SelectTrigger, SelectValue, SelectContent, SelectItem } from "@/components/ui/select";
+import { Plus } from "lucide-react";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServiceFiltersProps {
+  filter: string;
+  setFilter: (value: string) => void;
+  searchTerm: string;
+  setSearchTerm: (value: string) => void;
+  servicesCount: number;
+}
+
+export const ServiceFilters = ({ 
+  filter, 
+  setFilter, 
+  searchTerm, 
+  setSearchTerm,
+  servicesCount 
+}: ServiceFiltersProps) => {
+  const { t } = useLanguage();
+  return (
+    <div className="mb-6 flex justify-between items-center">
+      <div className="flex items-center">
+        <h3 className="text-xl font-semibold mr-2 text-foreground">{t('currentlyMonitoring')}</h3>
+        <span className="bg-secondary text-secondary-foreground px-2 py-0.5 rounded text-sm">
+          {servicesCount}
+        </span>
+      </div>
+      <div className="flex space-x-4">
+        <Select value={filter} onValueChange={setFilter}>
+          <SelectTrigger className="w-40 bg-card border-border">
+            <SelectValue placeholder={t('allTypes')} />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="all">{t('allTypes')}</SelectItem>
+            <SelectItem value="HTTP">HTTP</SelectItem>
+            <SelectItem value="PING">PING</SelectItem>
+            <SelectItem value="TCP">TCP</SelectItem>
+            <SelectItem value="DNS">DNS</SelectItem>
+          </SelectContent>
+        </Select>
+        <div className="relative">
+          <Input 
+            className="w-72 bg-card border-border" 
+            placeholder={t('search')}
+            value={searchTerm}
+            onChange={(e) => setSearchTerm(e.target.value)}
+          />
+        </div>
+      </div>
+    </div>
+  );
+};
diff --git a/application/src/components/dashboard/ServicesTable.tsx b/application/src/components/dashboard/ServicesTable.tsx
new file mode 100644
index 0000000..c47526e
--- /dev/null
+++ b/application/src/components/dashboard/ServicesTable.tsx
@@ -0,0 +1,15 @@
+
+import { Service } from "@/types/service.types";
+import { ServicesTableContainer } from "@/components/services/ServicesTableContainer";
+
+interface ServicesTableProps {
+  services: Service[];
+}
+
+export const ServicesTable = ({ services }: ServicesTableProps) => {
+  return (
+    <div className="flex-1 flex flex-col h-full">
+      <ServicesTableContainer services={services} />
+    </div>
+  );
+};
diff --git a/application/src/components/dashboard/Sidebar.tsx b/application/src/components/dashboard/Sidebar.tsx
new file mode 100644
index 0000000..4feec70
--- /dev/null
+++ b/application/src/components/dashboard/Sidebar.tsx
@@ -0,0 +1,44 @@
+import React from "react";
+import { useTheme } from "@/contexts/ThemeContext";
+import { SidebarHeader } from "./sidebar/SidebarHeader";
+import { MainNavigation } from "./sidebar/MainNavigation";
+import { SettingsPanel } from "./sidebar/SettingsPanel";
+import { useSidebar } from "@/contexts/SidebarContext";
+import { cn } from "@/lib/utils";
+
+export const Sidebar = () => {
+  const { theme } = useTheme();
+  const { sidebarCollapsed, isMobileOpen, toggleMobileMenu } = useSidebar();
+  
+  return (
+    <>
+      {/* Mobile Overlay */}
+      {isMobileOpen && (
+        <div 
+          className="fixed inset-0 bg-black/60 z-40 lg:hidden backdrop-blur-sm transition-opacity animate-in fade-in"
+          onClick={toggleMobileMenu}
+        />
+      )}
+
+      {/* Sidebar Container */}
+      <aside 
+        className={cn(
+          "fixed inset-y-0 left-0 z-50 lg:static lg:block transition-all duration-300 ease-in-out border-r flex flex-col h-full",
+          theme === 'dark' ? 'bg-[#121212] border-[#1e1e1e]' : 'bg-sidebar border-sidebar-border',
+          // Mobile state
+          isMobileOpen ? "translate-x-0 w-64" : "-translate-x-full lg:translate-x-0",
+          // Desktop state (collapsed/expanded)
+          !isMobileOpen && sidebarCollapsed ? "lg:w-16" : "lg:w-64"
+        )}
+      >
+        <SidebarHeader collapsed={!isMobileOpen && sidebarCollapsed} />
+        
+        <div className="flex-1 overflow-y-auto overflow-x-hidden custom-scrollbar">
+          <MainNavigation collapsed={!isMobileOpen && sidebarCollapsed} />
+        </div>
+
+        <SettingsPanel collapsed={!isMobileOpen && sidebarCollapsed} />
+      </aside>
+    </>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/dashboard/StatusCards.tsx b/application/src/components/dashboard/StatusCards.tsx
new file mode 100644
index 0000000..428f8c9
--- /dev/null
+++ b/application/src/components/dashboard/StatusCards.tsx
@@ -0,0 +1,155 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { ArrowUp, ArrowDown, Pause, AlertTriangle } from "lucide-react";
+import { Service } from "@/services/serviceService";
+import { useTheme } from "@/contexts/ThemeContext";
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface StatusCardsProps {
+  services: Service[];
+}
+
+export const StatusCards = ({ services }: StatusCardsProps) => {
+	const { t } = useLanguage();
+
+  // Count services by status
+  const upServices = services.filter(s => s.status === "up").length;
+  const downServices = services.filter(s => s.status === "down").length;
+  const pausedServices = services.filter(s => s.status === "paused").length;
+  const warningServices = services.filter(s => s.responseTime > 1000).length;
+  
+  // Get current theme to adjust card styles
+  const { theme } = useTheme();
+  
+  return (
+    <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-6 mb-8 w-full">
+      {/* Up Services Card */}
+      <Card 
+        className={`border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 ${
+          theme === 'dark' ? 'dark-card' : ''
+        } relative z-10`}
+        style={{
+          background: theme === 'dark' 
+            ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(102, 187, 106, 0.6) 100%)" 
+            : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #66bb6a 100%)"
+        }}
+      >
+        {/* Grid Pattern Overlay */}
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div className="w-full h-full" 
+            style={{ 
+              backgroundImage: `linear-gradient(#000 1px, transparent 1px), 
+                                linear-gradient(90deg, #fff 1px, transparent 1px)`,
+              backgroundSize: '20px 20px'
+            }}
+          ></div>
+        </div>
+        <CardHeader className="pb-2 relative z-10">
+          <CardTitle className="text-sm font-medium text-white">{t("upServices")}</CardTitle>
+        </CardHeader>
+        <CardContent className="flex items-center justify-between relative z-10">
+          <span className="text-5xl font-bold text-white">{upServices}</span>
+          <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+            <ArrowUp className="h-6 w-6 text-white" />
+          </div>
+        </CardContent>
+      </Card>
+      
+      {/* Down Services Card */}
+      <Card 
+        className={`border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 ${
+          theme === 'dark' ? 'dark-card' : ''
+        } relative z-10`}
+        style={{
+          background: theme === 'dark'
+            ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(239, 83, 80, 0.6) 100%)"
+            : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #ef5350 100%)"
+        }}
+      >
+        {/* Grid Pattern Overlay */}
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div className="w-full h-full" 
+            style={{ 
+              backgroundImage: `linear-gradient(#000 1px, transparent 1px), 
+                                linear-gradient(90deg, #fff 1px, transparent 1px)`,
+              backgroundSize: '20px 20px'
+            }}
+          ></div>
+        </div>
+        <CardHeader className="pb-2 relative z-10">
+          <CardTitle className="text-sm font-medium text-white">{t("downServices")}</CardTitle>
+        </CardHeader>
+        <CardContent className="flex items-center justify-between relative z-10">
+          <span className="text-5xl font-bold text-white">{downServices}</span>
+          <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+            <ArrowDown className="h-6 w-6 text-white" />
+          </div>
+        </CardContent>
+      </Card>
+      
+      {/* Paused Services Card */}
+      <Card 
+        className={`border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 ${
+          theme === 'dark' ? 'dark-card' : ''
+        } relative z-10`}
+        style={{
+          background: theme === 'dark'
+            ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(66, 165, 245, 0.6) 100%)"
+            : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #42a5f5 100%)"
+        }}
+      >
+        {/* Grid Pattern Overlay */}
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div className="w-full h-full" 
+            style={{ 
+              backgroundImage: `linear-gradient(#000 1px, transparent 1px), 
+                                linear-gradient(90deg, #fff 1px, transparent 1px)`,
+              backgroundSize: '20px 20px'
+            }}
+          ></div>
+        </div>
+        <CardHeader className="pb-2 relative z-10">
+          <CardTitle className="text-sm font-medium text-white">{t("pausedServices")}</CardTitle>
+        </CardHeader>
+        <CardContent className="flex items-center justify-between relative z-10">
+          <span className="text-5xl font-bold text-white">{pausedServices}</span>
+          <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+            <Pause className="h-6 w-6 text-white" />
+          </div>
+        </CardContent>
+      </Card>
+      
+      {/* Warning Services Card */}
+      <Card 
+        className={`border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 ${
+          theme === 'dark' ? 'dark-card' : ''
+        } relative z-10`}
+        style={{
+          background: theme === 'dark'
+            ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(255, 183, 77, 0.6) 100%)"
+            : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #ffb74d 100%)"
+        }}
+      >
+        {/* Grid Pattern Overlay */}
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div className="w-full h-full" 
+            style={{ 
+              backgroundImage: `linear-gradient(#000 1px, transparent 1px), 
+                                linear-gradient(90deg, #fff 1px, transparent 1px)`,
+              backgroundSize: '20px 20px'
+            }}
+          ></div>
+        </div>
+        <CardHeader className="pb-2 relative z-10">
+          <CardTitle className="text-sm font-medium text-white">{t("warningServices")}</CardTitle>
+        </CardHeader>
+        <CardContent className="flex items-center justify-between relative z-10">
+          <span className="text-5xl font-bold text-white">{warningServices}</span>
+          <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+            <AlertTriangle className="h-6 w-6 text-white" />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
diff --git a/application/src/components/dashboard/sidebar/MainNavigation.tsx b/application/src/components/dashboard/sidebar/MainNavigation.tsx
new file mode 100644
index 0000000..9b4e103
--- /dev/null
+++ b/application/src/components/dashboard/sidebar/MainNavigation.tsx
@@ -0,0 +1,27 @@
+
+import React from "react";
+import { MenuItem } from "./MenuItem";
+import { mainMenuItems } from "./navigationData";
+
+interface MainNavigationProps {
+  collapsed: boolean;
+}
+
+export const MainNavigation: React.FC<MainNavigationProps> = ({ collapsed }) => {
+  return (
+    <nav className="my-2 mx-1 py-1 px-1">
+      {mainMenuItems.map((item) => (
+        <MenuItem
+          key={item.id}
+          id={item.id}
+          path={item.path}
+          icon={item.icon}
+          translationKey={item.translationKey}
+          color={item.color}
+          hasNavigation={item.hasNavigation}
+          collapsed={collapsed}
+        />
+      ))}
+    </nav>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/dashboard/sidebar/MenuItem.tsx b/application/src/components/dashboard/sidebar/MenuItem.tsx
new file mode 100644
index 0000000..2bbf474
--- /dev/null
+++ b/application/src/components/dashboard/sidebar/MenuItem.tsx
@@ -0,0 +1,66 @@
+import React from "react";
+import { useLocation, useNavigate } from "react-router-dom";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { LucideIcon } from "lucide-react";
+import { cn } from "@/lib/utils";
+
+interface MenuItemProps {
+  id: string;
+  path: string | null;
+  icon: LucideIcon;
+  translationKey: string;
+  color: string;
+  hasNavigation: boolean;
+  collapsed: boolean;
+}
+
+export const MenuItem: React.FC<MenuItemProps> = ({
+  path,
+  icon: Icon,
+  translationKey,
+  color,
+  hasNavigation,
+  collapsed
+}) => {
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+  const location = useLocation();
+  const navigate = useNavigate();
+
+  const isActive = path && location.pathname === path;
+
+  const handleClick = (e: React.MouseEvent) => {
+    e.preventDefault();
+    if (hasNavigation && path) {
+      navigate(path);
+    }
+  };
+
+  return (
+    <div 
+      className={cn(
+        "group relative flex items-center mb-1 rounded-lg cursor-pointer transition-all duration-200",
+        collapsed ? "p-3 justify-center" : "p-2.5 px-4",
+        isActive 
+          ? (theme === 'dark' ? 'bg-zinc-800 text-white' : 'bg-primary/10 text-primary') 
+          : (theme === 'dark' ? 'text-zinc-400 hover:bg-zinc-800/50 hover:text-white' : 'text-zinc-600 hover:bg-zinc-100')
+      )}
+      onClick={handleClick}
+      title={collapsed ? t(translationKey) : ""}
+    >
+      <Icon className={cn("h-5 w-5 shrink-0 transition-colors", color, isActive ? "opacity-100" : "opacity-80 group-hover:opacity-100")} />
+      
+      {!collapsed && (
+        <span className="ml-3 font-medium tracking-wide text-sm truncate">
+          {t(translationKey)}
+        </span>
+      )}
+
+      {/* Small Indicator for active state */}
+      {isActive && !collapsed && (
+        <div className="absolute left-0 w-1 h-6 bg-primary rounded-r-full" />
+      )}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/dashboard/sidebar/SettingsPanel.tsx b/application/src/components/dashboard/sidebar/SettingsPanel.tsx
new file mode 100644
index 0000000..2e311c3
--- /dev/null
+++ b/application/src/components/dashboard/sidebar/SettingsPanel.tsx
@@ -0,0 +1,100 @@
+
+import React, { useState, useEffect } from "react";
+import { useLocation, useNavigate } from "react-router-dom";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { Settings, ChevronDown } from "lucide-react";
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
+import { ScrollArea } from "@/components/ui/scroll-area";
+import { settingsMenuItems } from "./navigationData";
+
+interface SettingsPanelProps {
+  collapsed: boolean;
+}
+
+export const SettingsPanel: React.FC<SettingsPanelProps> = ({ collapsed }) => {
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+  const location = useLocation();
+  const navigate = useNavigate();
+  const [activeSettingsItem, setActiveSettingsItem] = useState<string | null>("general");
+  const [settingsPanelOpen, setSettingsPanelOpen] = useState(false);
+
+  // Update active settings item based on URL
+  useEffect(() => {
+    if (location.pathname === '/settings') {
+      const params = new URLSearchParams(location.search);
+      const panel = params.get('panel');
+      if (panel) {
+        setActiveSettingsItem(panel);
+      }
+    }
+  }, [location]);
+
+  const handleSettingsItemClick = (item: string) => {
+    setActiveSettingsItem(item);
+  };
+
+  const handleMenuItemClick = (path: string, event: React.MouseEvent) => {
+    event.preventDefault();
+    event.stopPropagation();
+    // Use navigate instead of window.location to prevent full page reload
+    navigate(path, { replace: false });
+  };
+
+  const getMenuItemClasses = (isActive: boolean) => {
+    return `p-2 ${isActive ? theme === 'dark' ? 'bg-[#1a1a1a]' : 'bg-sidebar-accent' : `hover:${theme === 'dark' ? 'bg-[#1a1a1a]' : 'bg-sidebar-accent'}`} rounded-lg flex items-center`;
+  };
+
+  if (collapsed) {
+    const mainIconSize = "h-6 w-6";
+    return (
+      <div className={`border-t ${theme === 'dark' ? 'border-[#1e1e1e] bg-[#121212]' : 'border-sidebar-border bg-sidebar'} p-4 flex justify-center`}>
+        <div 
+          onClick={(e) => handleMenuItemClick('/settings', e)} 
+          className="cursor-pointer"
+        >
+          <Settings className={`${mainIconSize} text-purple-400`} />
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className={`flex-1 flex flex-col border-t ${theme === 'dark' ? 'border-[#1e1e1e] bg-[#121212]' : 'border-sidebar-border bg-sidebar'} p-4`}>
+      <Collapsible open={settingsPanelOpen} onOpenChange={setSettingsPanelOpen} className="w-full flex flex-col flex-1">
+        <CollapsibleTrigger className={`flex items-center justify-between w-full mb-4 px-2 py-2 rounded-lg ${theme === 'dark' ? 'hover:bg-[#1a1a1a]' : 'hover:bg-sidebar-accent'}`}>
+          <div className="flex items-center">
+            <span className="font-medium tracking-wide">{t("settingPanel")}</span>
+          </div>
+          <div className="flex items-center">
+            <Settings className="h-4 w-4 mr-1" />
+            <ChevronDown className={`h-4 w-4 transition-transform duration-200 ${settingsPanelOpen ? 'rotate-180' : ''}`} />
+          </div>
+        </CollapsibleTrigger>
+        
+        <CollapsibleContent className={`${theme === 'dark' ? 'bg-[#121212]' : 'bg-sidebar'} flex-1 flex flex-col`}>
+          <div className="max-h-[300px] overflow-y-auto custom-scrollbar relative pr-1">
+            <ScrollArea className="h-full">
+              <div className="space-y-2 pr-4">
+                {settingsMenuItems.map((item) => (
+                  <div 
+                    key={item.id}
+                    className={getMenuItemClasses(activeSettingsItem === item.id)} 
+                    onClick={(e) => {
+                      handleMenuItemClick(`/settings?panel=${item.id}`, e);
+                      handleSettingsItemClick(item.id);
+                    }}
+                  >
+                    <item.icon className="h-4 w-4 mr-2" />
+                    <span className="text-sm">{t(item.translationKey)}</span>
+                  </div>
+                ))}
+              </div>
+            </ScrollArea>
+          </div>
+        </CollapsibleContent>
+      </Collapsible>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/dashboard/sidebar/SidebarHeader.tsx b/application/src/components/dashboard/sidebar/SidebarHeader.tsx
new file mode 100644
index 0000000..0ebbe2b
--- /dev/null
+++ b/application/src/components/dashboard/sidebar/SidebarHeader.tsx
@@ -0,0 +1,24 @@
+
+import React from "react";
+import { useTheme } from "@/contexts/ThemeContext";
+
+interface SidebarHeaderProps {
+  collapsed: boolean;
+}
+
+export const SidebarHeader: React.FC<SidebarHeaderProps> = ({ collapsed }) => {
+  const { theme } = useTheme();
+
+  return (
+    <div className={`p-4 ${theme === 'dark' ? 'border-[#1e1e1e]' : 'border-sidebar-border'} border-b flex items-center ${collapsed ? 'justify-center' : ''}`}>
+      <div className="h-8 w-8 bg-gray-600 rounded flex items-center justify-center mr-2">
+        <img
+          src="/favicon_sidebar.ico"
+          alt="CheckCle"
+          className="h-6 w-6"
+        />
+      </div>
+      {!collapsed && <h1 className="text-xl font-semibold">CheckCle App</h1>}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/dashboard/sidebar/index.ts b/application/src/components/dashboard/sidebar/index.ts
new file mode 100644
index 0000000..ec3edb4
--- /dev/null
+++ b/application/src/components/dashboard/sidebar/index.ts
@@ -0,0 +1,6 @@
+
+export { SidebarHeader } from './SidebarHeader';
+export { MainNavigation } from './MainNavigation';
+export { MenuItem } from './MenuItem';
+export { SettingsPanel } from './SettingsPanel';
+export { mainMenuItems, settingsMenuItems } from './navigationData';
\ No newline at end of file
diff --git a/application/src/components/dashboard/sidebar/navigationData.ts b/application/src/components/dashboard/sidebar/navigationData.ts
new file mode 100644
index 0000000..3fd768a
--- /dev/null
+++ b/application/src/components/dashboard/sidebar/navigationData.ts
@@ -0,0 +1,94 @@
+
+import { Globe, Boxes, Layers, Calendar, BarChart2, LineChart, MapPin, Settings, User, Bell, Database, Info, BookOpen } from "lucide-react";
+
+export const mainMenuItems = [
+  {
+    id: 'uptime-monitoring',
+    path: '/dashboard',
+    icon: Globe,
+    translationKey: 'uptimeMonitoring',
+    color: 'text-purple-400',
+    hasNavigation: true
+  },
+  {
+    id: 'instance-monitoring',
+    path: '/instance-monitoring',
+    icon: Boxes,
+    translationKey: 'instanceMonitoring',
+    color: 'text-blue-400',
+    hasNavigation: true
+  },
+  {
+    id: 'ssl-domain',
+    path: '/ssl-domain',
+    icon: Layers,
+    translationKey: 'sslDomain',
+    color: 'text-cyan-400',
+    hasNavigation: true
+  },
+  {
+    id: 'schedule-incident',
+    path: '/schedule-incident',
+    icon: Calendar,
+    translationKey: 'scheduleIncident',
+    color: 'text-emerald-400',
+    hasNavigation: true
+  },
+  {
+    id: 'operational-page',
+    path: '/operational-page',
+    icon: BarChart2,
+    translationKey: 'operationalPage',
+    color: 'text-amber-400',
+    hasNavigation: true
+  },
+  {
+    id: 'regional-monitoring',
+    path: '/regional-monitoring',
+    icon: MapPin,
+    translationKey: 'regionalMonitoring',
+    color: 'text-indigo-400',
+    hasNavigation: true
+  },
+  {
+    id: 'reports',
+    path: null,
+    icon: LineChart,
+    translationKey: 'reports',
+    color: 'text-rose-400',
+    hasNavigation: false
+  }
+];
+
+export const settingsMenuItems = [
+  {
+    id: 'general',
+    icon: Settings,
+    translationKey: 'generalSettings'
+  },
+  {
+    id: 'users',
+    icon: User,
+    translationKey: 'userManagement'
+  },
+  {
+    id: 'notifications',
+    icon: Bell,
+    translationKey: 'notificationSettings'
+  },
+  {
+    id: 'templates',
+    icon: BookOpen,
+    translationKey: 'alertsTemplates'
+  },
+  {
+    id: 'data-retention',
+    icon: Database,
+    translationKey: 'dataRetention'
+  },
+  {
+    id: 'about',
+    icon: Info,
+    translationKey: 'aboutSystem'
+  }
+];
\ No newline at end of file
diff --git a/application/src/components/docker/DockerContainersTable.tsx b/application/src/components/docker/DockerContainersTable.tsx
new file mode 100644
index 0000000..45e4c5d
--- /dev/null
+++ b/application/src/components/docker/DockerContainersTable.tsx
@@ -0,0 +1,99 @@
+
+import { useState } from "react";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Table, TableBody } from "@/components/ui/table";
+import { DockerContainer } from "@/types/docker.types";
+import { DockerMetricsDialog } from "./DockerMetricsDialog";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { 
+  DockerTableSearch, 
+  DockerTableHeader, 
+  DockerTableRow, 
+  DockerEmptyState 
+} from "./table";
+
+interface DockerContainersTableProps {
+  containers: DockerContainer[];
+  isLoading: boolean;
+  onRefresh: () => void;
+}
+
+export const DockerContainersTable = ({ containers, isLoading, onRefresh }: DockerContainersTableProps) => {
+  const { t } = useLanguage();
+  const [searchTerm, setSearchTerm] = useState("");
+  const [selectedContainer, setSelectedContainer] = useState<DockerContainer | null>(null);
+  const [metricsDialogOpen, setMetricsDialogOpen] = useState(false);
+
+  const filteredContainers = containers.filter(container =>
+    container.name.toLowerCase().includes(searchTerm.toLowerCase()) ||
+    container.docker_id.toLowerCase().includes(searchTerm.toLowerCase()) ||
+    container.hostname.toLowerCase().includes(searchTerm.toLowerCase())
+  );
+
+  const handleContainerAction = (action: string, containerId: string, containerName: string) => {
+    console.log(`${action} action for container ${containerName} (${containerId})`);
+    // TODO: Implement container actions
+  };
+
+  const handleRowClick = (container: DockerContainer) => {
+    setSelectedContainer(container);
+    setMetricsDialogOpen(true);
+  };
+
+  const handleViewMetrics = (container: DockerContainer) => {
+    setSelectedContainer(container);
+    setMetricsDialogOpen(true);
+  };
+
+  return (
+    <>
+      <Card className="w-full bg-transparent border-0 shadow-none">
+        <CardHeader className="pb-4 px-0">
+          <div className="flex flex-col gap-4">
+            <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4">
+              <CardTitle className="text-lg sm:text-xl font-semibold">{t('dockerContainers', 'docker')}</CardTitle>
+              <DockerTableSearch
+                searchTerm={searchTerm}
+                onSearchChange={setSearchTerm}
+                onRefresh={onRefresh}
+                isLoading={isLoading}
+              />
+            </div>
+          </div>
+        </CardHeader>
+        <CardContent className="p-0">
+          <div className="overflow-x-auto">
+            <div className="min-w-full inline-block align-middle">
+              <div className="overflow-hidden border border-border rounded-lg shadow-sm">
+                <Table>
+                  <DockerTableHeader />
+                  <TableBody>
+                    {filteredContainers.length === 0 ? (
+                      <DockerEmptyState searchTerm={searchTerm} />
+                    ) : (
+                      filteredContainers.map((container) => (
+                        <DockerTableRow
+                          key={container.id}
+                          container={container}
+                          onRowClick={handleRowClick}
+                          onContainerAction={handleContainerAction}
+                          onViewMetrics={handleViewMetrics}
+                        />
+                      ))
+                    )}
+                  </TableBody>
+                </Table>
+              </div>
+            </div>
+          </div>
+        </CardContent>
+      </Card>
+
+      <DockerMetricsDialog
+        container={selectedContainer}
+        open={metricsDialogOpen}
+        onOpenChange={setMetricsDialogOpen}
+      />
+    </>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/DockerMetricsDialog.tsx b/application/src/components/docker/DockerMetricsDialog.tsx
new file mode 100644
index 0000000..970e6f6
--- /dev/null
+++ b/application/src/components/docker/DockerMetricsDialog.tsx
@@ -0,0 +1,697 @@
+import { useState, useEffect } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { ChartContainer, ChartTooltip, ChartTooltipContent } from "@/components/ui/chart";
+import { LineChart, Line, XAxis, YAxis, CartesianGrid, ResponsiveContainer, AreaChart, Area } from "recharts";
+import { DockerContainer, DockerMetrics } from "@/types/docker.types";
+import { dockerService } from "@/services/dockerService";
+import { Loader2, Cpu, HardDrive, Network, MemoryStick } from "lucide-react";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface DockerMetricsDialogProps {
+  container: DockerContainer | null;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+type TimeRange = '60m' | '1d' | '7d' | '1m' | '3m';
+
+const timeRangeOptions = [
+  { value: '60m' as TimeRange, label: 'minutes60', hours: 1 },
+  { value: '1d' as TimeRange, label: 'day1', hours: 24 },
+  { value: '7d' as TimeRange, label: 'days7', hours: 24 * 7 },
+  { value: '1m' as TimeRange, label: 'month1', hours: 24 * 30 },
+  { value: '3m' as TimeRange, label: 'months3', hours: 24 * 90 },
+];
+
+export const DockerMetricsDialog = ({ container, open, onOpenChange }: DockerMetricsDialogProps) => {
+  const [timeRange, setTimeRange] = useState<TimeRange>("1d");
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+
+  const {
+    data: metrics = [],
+    isLoading,
+    error
+  } = useQuery({
+    queryKey: ['docker-metrics', container?.docker_id, timeRange],
+    queryFn: () => container ? dockerService.getContainerMetrics(container.docker_id) : Promise.resolve([]),
+    enabled: !!container && open,
+    refetchInterval: 30000
+  });
+
+  const formatBytes = (bytes: number, decimals = 2) => {
+    if (bytes === 0) return '0 B';
+    const k = 1024;
+    const dm = decimals < 0 ? 0 : decimals;
+    const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    return parseFloat((bytes / Math.pow(k, i)).toFixed(dm)) + ' ' + sizes[i];
+  };
+
+  const parseValueWithUnit = (value: string | number): { numeric: number; unit: string; original: string } => {
+    if (typeof value === 'number') {
+      return { numeric: value, unit: 'B', original: value.toString() };
+    }
+    
+    const str = value.toString();
+    const match = str.match(/^([\d.]+)\s*([A-Za-z%]*)/);
+    if (match) {
+      const numeric = parseFloat(match[1]);
+      const unit = match[2] || '';
+      return { numeric, unit, original: str };
+    }
+    return { numeric: 0, unit: '', original: str };
+  };
+
+  const convertToBytes = (value: string | number): number => {
+    if (typeof value === 'number') return value;
+    
+    const parsed = parseValueWithUnit(value);
+    const multipliers: { [key: string]: number } = {
+      'B': 1,
+      'KB': 1024,
+      'MB': 1024 * 1024,
+      'GB': 1024 * 1024 * 1024,
+      'TB': 1024 * 1024 * 1024 * 1024
+    };
+    
+    const multiplier = multipliers[parsed.unit.toUpperCase()] || 1;
+    return parsed.numeric * multiplier;
+  };
+
+  const filterMetricsByTimeRange = (metrics: DockerMetrics[], timeRange: TimeRange): DockerMetrics[] => {
+    const now = new Date();
+    const selectedRange = timeRangeOptions.find(opt => opt.value === timeRange);
+    if (!selectedRange) return metrics;
+
+    const cutoffTime = new Date(now.getTime() - (selectedRange.hours * 60 * 60 * 1000));
+    
+    return metrics.filter(metric => {
+      const metricTime = new Date(metric.timestamp);
+      return metricTime >= cutoffTime;
+    });
+  };
+
+  const formatChartData = (metrics: DockerMetrics[]) => {
+    const filteredMetrics = filterMetricsByTimeRange(metrics, timeRange);
+    
+    return filteredMetrics.slice(0, 100).reverse().map((metric, index) => {
+      // Parse CPU usage
+      const cpuUsage = typeof metric.cpu_usage === 'string' ? 
+        parseFloat(metric.cpu_usage.replace('%', '')) : 
+        parseFloat(metric.cpu_usage) || 0;
+
+      // Parse memory values
+      const ramUsedBytes = convertToBytes(metric.ram_used);
+      const ramTotalBytes = convertToBytes(metric.ram_total);
+      const ramFreeBytes = convertToBytes(metric.ram_free);
+      const ramUsagePercent = ramTotalBytes > 0 ? (ramUsedBytes / ramTotalBytes) * 100 : 0;
+
+      // Parse disk values
+      const diskUsedBytes = convertToBytes(metric.disk_used);
+      const diskTotalBytes = convertToBytes(metric.disk_total);
+      const diskFreeBytes = convertToBytes(metric.disk_free);
+      const diskUsagePercent = diskTotalBytes > 0 ? (diskUsedBytes / diskTotalBytes) * 100 : 0;
+
+      // Network values
+      const networkRxBytes = metric.network_rx_bytes || 0;
+      const networkTxBytes = metric.network_tx_bytes || 0;
+      const networkRxSpeed = metric.network_rx_speed || 0;
+      const networkTxSpeed = metric.network_tx_speed || 0;
+
+      return {
+        timestamp: new Date(metric.timestamp).toLocaleTimeString('en-US', { 
+          hour: '2-digit', 
+          minute: '2-digit' 
+        }),
+        // CPU
+        cpuUsage: Math.round(cpuUsage * 100) / 100,
+        cpuCores: parseInt(metric.cpu_cores) || 0,
+        cpuFree: 100 - cpuUsage,
+        
+        // Memory
+        ramUsedBytes,
+        ramTotalBytes,
+        ramFreeBytes,
+        ramUsed: formatBytes(ramUsedBytes),
+        ramTotal: formatBytes(ramTotalBytes),
+        ramFree: formatBytes(ramFreeBytes),
+        ramUsagePercent: Math.round(ramUsagePercent * 100) / 100,
+        
+        // Disk
+        diskUsedBytes,
+        diskTotalBytes,
+        diskFreeBytes,
+        diskUsed: formatBytes(diskUsedBytes),
+        diskTotal: formatBytes(diskTotalBytes),
+        diskFree: formatBytes(diskFreeBytes),
+        diskUsagePercent: Math.round(diskUsagePercent * 100) / 100,
+        
+        // Network
+        networkRxBytes,
+        networkTxBytes,
+        networkRx: formatBytes(networkRxBytes),
+        networkTx: formatBytes(networkTxBytes),
+        networkRxSpeed: Math.round(networkRxSpeed * 100) / 100,
+        networkTxSpeed: Math.round(networkTxSpeed * 100) / 100,
+      };
+    });
+  };
+
+  const chartData = formatChartData(metrics);
+  const latestMetric = chartData[chartData.length - 1];
+
+  const chartConfig = {
+    cpuUsage: {
+      label: "CPU Usage (%)",
+      color: theme === 'dark' ? "#3b82f6" : "#2563eb",
+    },
+    ramUsagePercent: {
+      label: "RAM Usage (%)",
+      color: theme === 'dark' ? "#10b981" : "#059669",
+    },
+    diskUsagePercent: {
+      label: "Disk Usage (%)",
+      color: theme === 'dark' ? "#f59e0b" : "#d97706",
+    },
+    networkRx: {
+      label: "Network RX",
+      color: theme === 'dark' ? "#8b5cf6" : "#7c3aed",
+    },
+    networkTx: {
+      label: "Network TX",
+      color: theme === 'dark' ? "#ef4444" : "#dc2626",
+    },
+  };
+
+  const getGridColor = () => theme === 'dark' ? '#374151' : '#e5e7eb';
+  const getAxisColor = () => theme === 'dark' ? '#9ca3af' : '#6b7280';
+
+  const MetricCard = ({ title, used, total, free, percentage, icon: Icon, color }: {
+    title: string;
+    used: string;
+    total: string;
+    free: string;
+    percentage: number;
+    icon: any;
+    color: string;
+  }) => (
+    <div className="bg-muted/30 rounded-lg p-4 space-y-2">
+      <div className="flex items-center gap-2">
+        <Icon className="h-4 w-4" style={{ color }} />
+        <span className="text-sm font-medium">{title}</span>
+      </div>
+      <div className="space-y-1 text-xs">
+        <div className="flex justify-between">
+          <span className="text-muted-foreground">Used:</span>
+          <span className="font-mono">{used}</span>
+        </div>
+        <div className="flex justify-between">
+          <span className="text-muted-foreground">Free:</span>
+          <span className="font-mono">{free}</span>
+        </div>
+        <div className="flex justify-between">
+          <span className="text-muted-foreground">Total:</span>
+          <span className="font-mono">{total}</span>
+        </div>
+        <div className="flex justify-between">
+          <span className="text-muted-foreground">Usage:</span>
+          <span className="font-mono">{percentage.toFixed(1)}%</span>
+        </div>
+      </div>
+    </div>
+  );
+
+  if (!container) return null;
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-7xl max-h-[95vh] overflow-y-auto bg-background text-foreground">
+        <DialogHeader>
+          <DialogTitle className="flex items-center justify-between">
+              <div className="flex items-center gap-2">
+              <div className="h-8 w-8 rounded bg-primary/10 flex items-center justify-center">
+                <Cpu className="h-4 w-4 text-primary" />
+              </div>
+                {t('containerMetricsTitle', 'docker', { name: container.name })}
+            </div>
+            <div className="flex items-center gap-2">
+              <Select value={timeRange} onValueChange={(value: TimeRange) => setTimeRange(value)}>
+                <SelectTrigger className="w-[140px] h-8">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {timeRangeOptions.map((option) => (
+                    <SelectItem key={option.value} value={option.value}>
+                      {t(option.label, 'docker')}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+          </DialogTitle>
+          <p className="text-sm text-muted-foreground">
+            {t('dockerId', 'docker')}: {container.docker_id} • {container.hostname}
+          </p>
+        </DialogHeader>
+
+        {isLoading ? (
+          <div className="flex items-center justify-center h-96">
+            <Loader2 className="h-8 w-8 animate-spin" />
+            <span className="ml-2">{t('loadingMetrics', 'docker')}</span>
+          </div>
+        ) : error ? (
+          <div className="flex items-center justify-center h-96 text-muted-foreground">
+            <p>{t('errorLoadingMetrics', 'docker')}: {String((error as any)?.message ?? '')}</p>
+          </div>
+        ) : chartData.length === 0 ? (
+          <div className="flex items-center justify-center h-96 text-muted-foreground">
+            <p>{t('noMetricsAvailable', 'docker')}</p>
+          </div>
+        ) : (
+          <>
+            {/* Current Metrics Summary */}
+            {latestMetric && (
+              <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-4 mb-6">
+                <MetricCard
+                  title={t('cpu', 'docker')}
+                  used={`${latestMetric.cpuUsage}%`}
+                  total={`${latestMetric.cpuCores} cores`}
+                  free={`${(100 - latestMetric.cpuUsage).toFixed(1)}%`}
+                  percentage={latestMetric.cpuUsage}
+                  icon={Cpu}
+                  color={chartConfig.cpuUsage.color}
+                />
+                <MetricCard
+                  title={t('memoryTitle', 'docker')}
+                  used={latestMetric.ramUsed}
+                  total={latestMetric.ramTotal}
+                  free={latestMetric.ramFree}
+                  percentage={latestMetric.ramUsagePercent}
+                  icon={MemoryStick}
+                  color={chartConfig.ramUsagePercent.color}
+                />
+                <MetricCard
+                  title={t('diskTitle', 'docker')}
+                  used={latestMetric.diskUsed}
+                  total={latestMetric.diskTotal}
+                  free={latestMetric.diskFree}
+                  percentage={latestMetric.diskUsagePercent}
+                  icon={HardDrive}
+                  color={chartConfig.diskUsagePercent.color}
+                />
+                <MetricCard
+                  title={t('network', 'docker')}
+                  used={`RX: ${latestMetric.networkRx}`}
+                  total={`TX: ${latestMetric.networkTx}`}
+                  free={`${t('networkSpeedKbs', 'docker').replace('(KB/s)', '')}: ${latestMetric.networkRxSpeed} KB/s`}
+                  percentage={0}
+                  icon={Network}
+                  color={chartConfig.networkRx.color}
+                />
+              </div>
+            )}
+
+            <Tabs defaultValue="cpu" className="w-full">
+              <TabsList className="grid w-full grid-cols-4 bg-muted">
+                <TabsTrigger value="cpu" className="flex items-center gap-2 data-[state=active]:bg-background">
+                  <Cpu className="h-4 w-4" />
+                  {t('cpu', 'docker')}
+                </TabsTrigger>
+                <TabsTrigger value="memory" className="flex items-center gap-2 data-[state=active]:bg-background">
+                  <MemoryStick className="h-4 w-4" />
+                  {t('memoryTitle', 'docker')}
+                </TabsTrigger>
+                <TabsTrigger value="disk" className="flex items-center gap-2 data-[state=active]:bg-background">
+                  <HardDrive className="h-4 w-4" />
+                  {t('diskTitle', 'docker')}
+                </TabsTrigger>
+                <TabsTrigger value="network" className="flex items-center gap-2 data-[state=active]:bg-background">
+                  <Network className="h-4 w-4" />
+                  {t('network', 'docker')}
+                </TabsTrigger>
+              </TabsList>
+
+              <TabsContent value="cpu" className="space-y-4 mt-6">
+                <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                  <Card className="bg-card border-border">
+                    <CardHeader>
+                      <CardTitle className="text-foreground">{t('cpuUsagePct', 'docker')}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <ChartContainer config={chartConfig} className="h-80">
+                        <LineChart data={chartData}>
+                          <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} />
+                          <XAxis 
+                            dataKey="timestamp" 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <YAxis 
+                            domain={[0, 100]}
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <ChartTooltip 
+                            content={<ChartTooltipContent className="bg-popover border-border" />}
+                            cursor={{ stroke: getGridColor() }}
+                          />
+                          <Line 
+                            type="monotone" 
+                            dataKey="cpuUsage" 
+                            stroke={chartConfig.cpuUsage.color}
+                            strokeWidth={2}
+                            dot={{ r: 3, fill: chartConfig.cpuUsage.color }}
+                            name={t('cpuUsagePct', 'docker')}
+                          />
+                        </LineChart>
+                      </ChartContainer>
+                    </CardContent>
+                  </Card>
+
+                  <Card className="bg-card border-border">
+                    <CardHeader>
+                      <CardTitle className="text-foreground">{t('cpuUsageVsAvailable', 'docker')}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <ChartContainer config={chartConfig} className="h-80">
+                        <AreaChart data={chartData}>
+                          <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} />
+                          <XAxis 
+                            dataKey="timestamp" 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <YAxis 
+                            domain={[0, 100]}
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <ChartTooltip 
+                            content={<ChartTooltipContent className="bg-popover border-border" />}
+                            cursor={{ stroke: getGridColor() }}
+                          />
+                          <Area 
+                            type="monotone" 
+                            dataKey="cpuFree" 
+                            stackId="1"
+                            stroke={theme === 'dark' ? "#6b7280" : "#9ca3af"}
+                            fill={theme === 'dark' ? "#6b7280" : "#9ca3af"}
+                            fillOpacity={0.3}
+                            name={t('cpuAvailablePct', 'docker')}
+                          />
+                          <Area 
+                            type="monotone" 
+                            dataKey="cpuUsage" 
+                            stackId="1"
+                            stroke={chartConfig.cpuUsage.color}
+                            fill={chartConfig.cpuUsage.color}
+                            fillOpacity={0.6}
+                            name={t('cpuUsagePct', 'docker')}
+                          />
+                        </AreaChart>
+                      </ChartContainer>
+                    </CardContent>
+                  </Card>
+                </div>
+              </TabsContent>
+
+              <TabsContent value="memory" className="space-y-4 mt-6">
+                <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                  <Card className="bg-card border-border">
+                    <CardHeader>
+                      <CardTitle className="text-foreground">{t('ramUsagePct', 'docker')}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <ChartContainer config={chartConfig} className="h-80">
+                        <AreaChart data={chartData}>
+                          <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} />
+                          <XAxis 
+                            dataKey="timestamp" 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <YAxis 
+                            domain={[0, 100]}
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <ChartTooltip 
+                            content={<ChartTooltipContent className="bg-popover border-border" />}
+                            cursor={{ stroke: getGridColor() }}
+                          />
+                          <Area 
+                            type="monotone" 
+                            dataKey="ramUsagePercent" 
+                            stackId="1"
+                            stroke={chartConfig.ramUsagePercent.color}
+                            fill={chartConfig.ramUsagePercent.color}
+                            fillOpacity={0.6}
+                            name="RAM Usage (%)"
+                          />
+                        </AreaChart>
+                      </ChartContainer>
+                    </CardContent>
+                  </Card>
+
+                  <Card className="bg-card border-border">
+                    <CardHeader>
+                      <CardTitle className="text-foreground">{t('memoryUsageBytes', 'docker')}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <ChartContainer config={chartConfig} className="h-80">
+                        <AreaChart data={chartData}>
+                          <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} />
+                          <XAxis 
+                            dataKey="timestamp" 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <YAxis 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                            tickFormatter={(value) => formatBytes(value)}
+                          />
+                          <ChartTooltip 
+                            content={<ChartTooltipContent className="bg-popover border-border" />}
+                            cursor={{ stroke: getGridColor() }}
+                            formatter={(value, name) => [
+                              name === t('usedMemory', 'docker') ? formatBytes(Number(value)) : 
+                              name === t('totalMemory', 'docker') ? formatBytes(Number(value)) : value,
+                              name
+                            ]}
+                          />
+                          <Area 
+                            type="monotone" 
+                            dataKey="ramTotalBytes" 
+                            stackId="1"
+                            stroke={theme === 'dark' ? "#6b7280" : "#9ca3af"}
+                            fill={theme === 'dark' ? "#6b7280" : "#9ca3af"}
+                            fillOpacity={0.3}
+                            name={t('totalMemory', 'docker')}
+                          />
+                          <Area 
+                            type="monotone" 
+                            dataKey="ramUsedBytes" 
+                            stackId="1"
+                            stroke={chartConfig.ramUsagePercent.color}
+                            fill={chartConfig.ramUsagePercent.color}
+                            fillOpacity={0.6}
+                            name={t('usedMemory', 'docker')}
+                          />
+                        </AreaChart>
+                      </ChartContainer>
+                    </CardContent>
+                  </Card>
+                </div>
+              </TabsContent>
+
+              <TabsContent value="disk" className="space-y-4 mt-6">
+                <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                  <Card className="bg-card border-border">
+                    <CardHeader>
+                      <CardTitle className="text-foreground">{t('diskUsagePct', 'docker')}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <ChartContainer config={chartConfig} className="h-80">
+                        <AreaChart data={chartData}>
+                          <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} />
+                          <XAxis 
+                            dataKey="timestamp" 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <YAxis 
+                            domain={[0, 100]}
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <ChartTooltip 
+                            content={<ChartTooltipContent className="bg-popover border-border" />}
+                            cursor={{ stroke: getGridColor() }}
+                          />
+                          <Area 
+                            type="monotone" 
+                            dataKey="diskUsagePercent" 
+                            stackId="1"
+                            stroke={chartConfig.diskUsagePercent.color}
+                            fill={chartConfig.diskUsagePercent.color}
+                            fillOpacity={0.6}
+                            name={t('diskUsagePct', 'docker')}
+                          />
+                        </AreaChart>
+                      </ChartContainer>
+                    </CardContent>
+                  </Card>
+
+                  <Card className="bg-card border-border">
+                    <CardHeader>
+                      <CardTitle className="text-foreground">{t('diskUsageBytes', 'docker')}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <ChartContainer config={chartConfig} className="h-80">
+                        <AreaChart data={chartData}>
+                          <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} />
+                          <XAxis 
+                            dataKey="timestamp" 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <YAxis 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                            tickFormatter={(value) => formatBytes(value)}
+                          />
+                          <ChartTooltip 
+                            content={<ChartTooltipContent className="bg-popover border-border" />}
+                            cursor={{ stroke: getGridColor() }}
+                            formatter={(value, name) => [
+                              name === t('usedDisk', 'docker') ? formatBytes(Number(value)) : 
+                              name === t('totalDisk', 'docker') ? formatBytes(Number(value)) : value,
+                              name
+                            ]}
+                          />
+                          <Area 
+                            type="monotone" 
+                            dataKey="diskTotalBytes" 
+                            stackId="1"
+                            stroke={theme === 'dark' ? "#6b7280" : "#9ca3af"}
+                            fill={theme === 'dark' ? "#6b7280" : "#9ca3af"}
+                            fillOpacity={0.3}
+                            name={t('totalDisk', 'docker')}
+                          />
+                          <Area 
+                            type="monotone" 
+                            dataKey="diskUsedBytes" 
+                            stackId="1"
+                            stroke={chartConfig.diskUsagePercent.color}
+                            fill={chartConfig.diskUsagePercent.color}
+                            fillOpacity={0.6}
+                            name={t('usedDisk', 'docker')}
+                          />
+                        </AreaChart>
+                      </ChartContainer>
+                    </CardContent>
+                  </Card>
+                </div>
+              </TabsContent>
+
+              <TabsContent value="network" className="space-y-4 mt-6">
+                <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+                  <Card className="bg-card border-border">
+                    <CardHeader>
+                      <CardTitle className="text-foreground">{t('networkTraffic', 'docker')}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <ChartContainer config={chartConfig} className="h-64">
+                        <LineChart data={chartData}>
+                          <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} />
+                          <XAxis 
+                            dataKey="timestamp" 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <YAxis 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <ChartTooltip 
+                            content={<ChartTooltipContent className="bg-popover border-border" />}
+                            cursor={{ stroke: getGridColor() }}
+                          />
+                          <Line 
+                            type="monotone" 
+                            dataKey="networkRxBytes" 
+                            stroke={chartConfig.networkRx.color}
+                            strokeWidth={2}
+                            name={t('rxBytes', 'docker')}
+                            dot={{ r: 2 }}
+                          />
+                          <Line 
+                            type="monotone" 
+                            dataKey="networkTxBytes" 
+                            stroke={chartConfig.networkTx.color}
+                            strokeWidth={2}
+                            name={t('txBytes', 'docker')}
+                            dot={{ r: 2 }}
+                          />
+                        </LineChart>
+                      </ChartContainer>
+                    </CardContent>
+                  </Card>
+
+                  <Card className="bg-card border-border">
+                    <CardHeader>
+                      <CardTitle className="text-foreground">{t('networkSpeedKbs', 'docker')}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <ChartContainer config={chartConfig} className="h-64">
+                        <LineChart data={chartData}>
+                          <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} />
+                          <XAxis 
+                            dataKey="timestamp" 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <YAxis 
+                            tick={{ fontSize: 12, fill: getAxisColor() }}
+                            axisLine={{ stroke: getGridColor() }}
+                          />
+                          <ChartTooltip 
+                            content={<ChartTooltipContent className="bg-popover border-border" />}
+                            cursor={{ stroke: getGridColor() }}
+                          />
+                          <Line 
+                            type="monotone" 
+                            dataKey="networkRxSpeed" 
+                            stroke={chartConfig.networkRx.color}
+                            strokeWidth={2}
+                            name={t('rxSpeedKbs', 'docker')}
+                            dot={{ r: 2 }}
+                          />
+                          <Line 
+                            type="monotone" 
+                            dataKey="networkTxSpeed" 
+                            stroke={chartConfig.networkTx.color}
+                            strokeWidth={2}
+                            name={t('txSpeedKbs', 'docker')}
+                            dot={{ r: 2 }}
+                          />
+                        </LineChart>
+                      </ChartContainer>
+                    </CardContent>
+                  </Card>
+                </div>
+              </TabsContent>
+            </Tabs>
+          </>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/DockerStatsCards.tsx b/application/src/components/docker/DockerStatsCards.tsx
new file mode 100644
index 0000000..4453fe6
--- /dev/null
+++ b/application/src/components/docker/DockerStatsCards.tsx
@@ -0,0 +1,104 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { Container, Play, Square, AlertTriangle } from "lucide-react";
+import { DockerStats } from "@/types/docker.types";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface DockerStatsCardsProps {
+  stats: DockerStats;
+}
+
+export const DockerStatsCards = ({ stats }: DockerStatsCardsProps) => {
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+
+  const cards = [
+    {
+      title: t('totalContainers', 'docker'),
+      value: stats.total,
+      icon: Container,
+      color: "text-blue-600",
+      gradient: theme === 'dark' 
+        ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(59, 130, 246, 0.6) 100%)" 
+        : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #3b82f6 100%)"
+    },
+    {
+      title: t('running', 'docker'),
+      value: stats.running,
+      icon: Play,
+      color: "text-green-600",
+      gradient: theme === 'dark' 
+        ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(16, 185, 129, 0.6) 100%)" 
+        : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #10b981 100%)"
+    },
+    {
+      title: t('stopped', 'docker'),
+      value: stats.stopped,
+      icon: Square,
+      color: "text-gray-600",
+      gradient: theme === 'dark' 
+        ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(107, 114, 128, 0.6) 100%)" 
+        : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #6b7280 100%)"
+    },
+    {
+      title: t('warning', 'docker'),
+      value: stats.warning,
+      icon: AlertTriangle,
+      color: "text-amber-600",
+      gradient: theme === 'dark' 
+        ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(245, 158, 11, 0.6) 100%)" 
+        : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #f59e0b 100%)"
+    },
+  ];
+
+  return (
+    <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-4 lg:gap-6">
+      {cards.map((card) => {
+        const IconComponent = card.icon;
+        return (
+          <Card 
+            key={card.title} 
+            className="border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative"
+            style={{ background: card.gradient }}
+          >
+            {/* Grid Pattern Overlay */}
+            <div className="absolute inset-0 z-0 opacity-10">
+              <div 
+                className="w-full h-full" 
+                style={{ 
+                  backgroundImage: `linear-gradient(rgba(255,255,255,0.1) 1px, transparent 1px), 
+                                    linear-gradient(90deg, rgba(255,255,255,0.1) 1px, transparent 1px)`,
+                  backgroundSize: '20px 20px'
+                }}
+              />
+            </div>
+
+            <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2 relative z-10">
+              <CardTitle className="text-sm font-medium text-white/70">
+                {card.title}
+              </CardTitle>
+              <div className="p-2.5 rounded-xl bg-white/20 backdrop-blur-sm shadow-sm transition-all duration-300 group-hover:scale-110">
+                <IconComponent className="h-4 w-4 text-white" />
+              </div>
+            </CardHeader>
+            <CardContent className="relative z-10">
+              <div className="flex items-center justify-between">
+                <div className="text-2xl font-bold text-white">
+                  {card.value}
+                </div>
+                <Badge 
+                  variant="outline" 
+                  className="text-xs font-mono font-bold px-2 py-1 rounded-md bg-white/20 backdrop-blur-sm text-white border border-white/30"
+                >
+                  {t('containersLabel', 'docker')}
+                </Badge>
+              </div>
+            </CardContent>
+          </Card>
+        );
+      })}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/DockerStatusBadge.tsx b/application/src/components/docker/DockerStatusBadge.tsx
new file mode 100644
index 0000000..648d452
--- /dev/null
+++ b/application/src/components/docker/DockerStatusBadge.tsx
@@ -0,0 +1,50 @@
+
+import { Badge } from "@/components/ui/badge";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface DockerStatusBadgeProps {
+  status: 'running' | 'stopped' | 'warning';
+}
+
+export const DockerStatusBadge = ({ status }: DockerStatusBadgeProps) => {
+  const { t } = useLanguage();
+  const getStatusConfig = (status: string) => {
+    switch (status) {
+      case 'running':
+        return {
+          variant: 'default' as const,
+          className: 'bg-emerald-100 text-emerald-800 border-emerald-200 hover:bg-emerald-200',
+          label: t('running', 'docker')
+        };
+      case 'stopped':
+        return {
+          variant: 'secondary' as const,
+          className: 'bg-gray-100 text-gray-800 border-gray-200 hover:bg-gray-200',
+          label: t('stopped', 'docker')
+        };
+      case 'warning':
+        return {
+          variant: 'destructive' as const,
+          className: 'bg-amber-100 text-amber-800 border-amber-200 hover:bg-amber-200',
+          label: t('warning', 'docker')
+        };
+      default:
+        return {
+          variant: 'outline' as const,
+          className: 'bg-gray-100 text-gray-600 border-gray-200',
+          label: t('unknown', 'docker')
+        };
+    }
+  };
+
+  const config = getStatusConfig(status);
+
+  return (
+    <Badge 
+      variant={config.variant} 
+      className={`${config.className} font-medium text-xs px-2 py-1`}
+    >
+      {config.label}
+    </Badge>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/table/DockerEmptyState.tsx b/application/src/components/docker/table/DockerEmptyState.tsx
new file mode 100644
index 0000000..311f8f5
--- /dev/null
+++ b/application/src/components/docker/table/DockerEmptyState.tsx
@@ -0,0 +1,25 @@
+
+import { TableCell, TableRow } from "@/components/ui/table";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface DockerEmptyStateProps {
+  searchTerm: string;
+}
+
+export const DockerEmptyState = ({ searchTerm }: DockerEmptyStateProps) => {
+  const { t } = useLanguage();
+  return (
+    <TableRow>
+      <TableCell colSpan={8} className="text-center py-12 text-muted-foreground">
+        <div className="flex flex-col items-center gap-2">
+          <div className="text-lg font-medium">
+            {searchTerm ? t('noContainersFound', 'docker') : t('noContainersRunning', 'docker')}
+          </div>
+          <div className="text-sm">
+            {searchTerm ? t('tryAdjustSearch', 'docker') : t('startSomeContainers', 'docker')}
+          </div>
+        </div>
+      </TableCell>
+    </TableRow>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/table/DockerRowActions.tsx b/application/src/components/docker/table/DockerRowActions.tsx
new file mode 100644
index 0000000..997d742
--- /dev/null
+++ b/application/src/components/docker/table/DockerRowActions.tsx
@@ -0,0 +1,43 @@
+
+import { Button } from "@/components/ui/button";
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger, DropdownMenuSeparator } from "@/components/ui/dropdown-menu";
+import { MoreHorizontal, Eye, Play, Pause, Square, Trash2, BarChart3, RefreshCw } from "lucide-react";
+import { DockerContainer } from "@/types/docker.types";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface DockerRowActionsProps {
+  container: DockerContainer;
+  containerStatus: 'running' | 'stopped' | 'warning';
+  onContainerAction: (action: string, containerId: string, containerName: string) => void;
+  onViewMetrics: (container: DockerContainer) => void;
+}
+
+export const DockerRowActions = ({ container, containerStatus, onContainerAction, onViewMetrics }: DockerRowActionsProps) => {
+  const { t } = useLanguage();
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button variant="ghost" className="h-8 w-8 p-0 hover:bg-muted">
+          <span className="sr-only">{t('openMenu', 'docker')}</span>
+          <MoreHorizontal className="h-4 w-4" />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="w-48 bg-popover border-border shadow-md">
+        <DropdownMenuItem 
+          onClick={() => onViewMetrics(container)}
+          className="cursor-pointer hover:bg-muted"
+        >
+          <BarChart3 className="mr-2 h-4 w-4" />
+          {t('viewMetrics', 'docker')}
+        </DropdownMenuItem>
+        <DropdownMenuItem 
+          onClick={() => onContainerAction('view-detail', container.id, container.name)}
+          className="cursor-pointer hover:bg-muted"
+        >
+          <Eye className="mr-2 h-4 w-4" />
+          {t('viewDetails', 'docker')}
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/table/DockerTableHeader.tsx b/application/src/components/docker/table/DockerTableHeader.tsx
new file mode 100644
index 0000000..1e0355c
--- /dev/null
+++ b/application/src/components/docker/table/DockerTableHeader.tsx
@@ -0,0 +1,21 @@
+
+import { TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+export const DockerTableHeader = () => {
+  const { t } = useLanguage();
+  return (
+    <TableHeader>
+      <TableRow className="border-border bg-muted/30">
+        <TableHead className="min-w-[200px] font-semibold">{t('container', 'docker')}</TableHead>
+        <TableHead className="min-w-[100px] font-semibold">{t('status', 'docker')}</TableHead>
+        <TableHead className="min-w-[140px] font-semibold">{t('cpuUsage', 'docker')}</TableHead>
+        <TableHead className="min-w-[160px] font-semibold">{t('memory', 'docker')}</TableHead>
+        <TableHead className="min-w-[160px] font-semibold">{t('disk', 'docker')}</TableHead>
+        <TableHead className="min-w-[100px] font-semibold">{t('uptime', 'docker')}</TableHead>
+        <TableHead className="min-w-[160px] font-semibold">{t('lastChecked', 'docker')}</TableHead>
+        <TableHead className="min-w-[80px] text-center font-semibold">{t('actions', 'docker')}</TableHead>
+      </TableRow>
+    </TableHeader>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/table/DockerTableRow.tsx b/application/src/components/docker/table/DockerTableRow.tsx
new file mode 100644
index 0000000..119037a
--- /dev/null
+++ b/application/src/components/docker/table/DockerTableRow.tsx
@@ -0,0 +1,123 @@
+
+import { TableCell, TableRow } from "@/components/ui/table";
+import { Progress } from "@/components/ui/progress";
+import { DockerContainer } from "@/types/docker.types";
+import { DockerStatusBadge } from "../DockerStatusBadge";
+import { DockerRowActions } from "./DockerRowActions";
+import { dockerService } from "@/services/dockerService";
+
+interface DockerTableRowProps {
+  container: DockerContainer;
+  onRowClick: (container: DockerContainer) => void;
+  onContainerAction: (action: string, containerId: string, containerName: string) => void;
+  onViewMetrics: (container: DockerContainer) => void;
+}
+
+export const DockerTableRow = ({ container, onRowClick, onContainerAction, onViewMetrics }: DockerTableRowProps) => {
+  const cpuPercentage = container.cpu_usage;
+  const memoryPercentage = Math.round((container.ram_used / container.ram_total) * 100);
+  const diskPercentage = Math.round((container.disk_used / container.disk_total) * 100);
+  const containerStatus = dockerService.getStatusFromDockerStatus(container.status);
+
+  const formatPercentage = (used: number, total: number) => {
+    if (total === 0) return "0%";
+    return `${Math.round((used / total) * 100)}%`;
+  };
+
+  const getUsageColor = (percentage: number) => {
+    if (percentage >= 90) return "text-red-500";
+    if (percentage >= 70) return "text-amber-500";
+    return "text-emerald-500";
+  };
+
+  const getProgressColor = (percentage: number) => {
+    if (percentage >= 90) return "bg-red-500";
+    if (percentage >= 70) return "bg-amber-500";
+    return "bg-emerald-500";
+  };
+
+  return (
+    <TableRow 
+      className="hover:bg-muted/50 transition-colors border-border cursor-pointer"
+      onClick={() => onRowClick(container)}
+    >
+      <TableCell className="font-medium">
+        <div className="space-y-1">
+          <div className="font-semibold text-sm sm:text-base text-foreground">{container.name}</div>
+          <div className="text-xs sm:text-sm text-muted-foreground">
+            <div className="font-mono">{container.docker_id}</div>
+          </div>
+        </div>
+      </TableCell>
+      <TableCell>
+        <DockerStatusBadge status={containerStatus} />
+      </TableCell>
+      <TableCell>
+        <div className="space-y-2">
+          <div className="flex items-center justify-between gap-3">
+            <Progress 
+              value={cpuPercentage} 
+              className="flex-1 h-2 bg-muted/50"
+              indicatorClassName={getProgressColor(cpuPercentage)}
+            />
+            <span className={`font-semibold text-sm min-w-[40px] text-right ${getUsageColor(cpuPercentage)}`}>
+              {cpuPercentage}%
+            </span>
+          </div>
+        </div>
+      </TableCell>
+      <TableCell>
+        <div className="space-y-2">
+          <div className="flex items-center justify-between gap-3">
+            <Progress 
+              value={memoryPercentage} 
+              className="flex-1 h-2 bg-muted/50"
+              indicatorClassName={getProgressColor(memoryPercentage)}
+            />
+            <span className={`font-semibold text-sm min-w-[40px] text-right ${getUsageColor(memoryPercentage)}`}>
+              {formatPercentage(container.ram_used, container.ram_total)}
+            </span>
+          </div>
+          <div className="text-xs text-muted-foreground font-mono">
+            {dockerService.formatBytes(container.ram_used)} / {dockerService.formatBytes(container.ram_total)}
+          </div>
+        </div>
+      </TableCell>
+      <TableCell>
+        <div className="space-y-2">
+          <div className="flex items-center justify-between gap-3">
+            <Progress 
+              value={diskPercentage} 
+              className="flex-1 h-2 bg-muted/50"
+              indicatorClassName={getProgressColor(diskPercentage)}
+            />
+            <span className={`font-semibold text-sm min-w-[40px] text-right ${getUsageColor(diskPercentage)}`}>
+              {formatPercentage(container.disk_used, container.disk_total)}
+            </span>
+          </div>
+          <div className="text-xs text-muted-foreground font-mono">
+            {dockerService.formatBytes(container.disk_used)} / {dockerService.formatBytes(container.disk_total)}
+          </div>
+        </div>
+      </TableCell>
+      <TableCell>
+        <span className="text-xs sm:text-sm font-medium font-mono">
+          {dockerService.formatUptime(container.uptime)}
+        </span>
+      </TableCell>
+      <TableCell>
+        <span className="text-xs sm:text-sm text-muted-foreground">
+          {new Date(container.last_checked).toLocaleString()}
+        </span>
+      </TableCell>
+      <TableCell className="text-center" onClick={(e) => e.stopPropagation()}>
+        <DockerRowActions 
+          container={container}
+          containerStatus={containerStatus}
+          onContainerAction={onContainerAction}
+          onViewMetrics={onViewMetrics}
+        />
+      </TableCell>
+    </TableRow>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/table/DockerTableSearch.tsx b/application/src/components/docker/table/DockerTableSearch.tsx
new file mode 100644
index 0000000..f9b0cba
--- /dev/null
+++ b/application/src/components/docker/table/DockerTableSearch.tsx
@@ -0,0 +1,39 @@
+
+import { Input } from "@/components/ui/input";
+import { Button } from "@/components/ui/button";
+import { Search, RefreshCw } from "lucide-react";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface DockerTableSearchProps {
+  searchTerm: string;
+  onSearchChange: (value: string) => void;
+  onRefresh: () => void;
+  isLoading: boolean;
+}
+
+export const DockerTableSearch = ({ searchTerm, onSearchChange, onRefresh, isLoading }: DockerTableSearchProps) => {
+  const { t } = useLanguage();
+  return (
+    <div className="flex flex-col sm:flex-row gap-3 w-full sm:w-auto">
+      <div className="relative flex-1 sm:flex-initial">
+        <Search className="absolute left-3 top-1/2 transform -translate-y-1/2 text-muted-foreground h-4 w-4" />
+        <Input
+          placeholder={t('searchContainersPlaceholder', 'docker')}
+          value={searchTerm}
+          onChange={(e) => onSearchChange(e.target.value)}
+          className="pl-10 sm:w-64 bg-background border-border"
+        />
+      </div>
+      <Button
+        onClick={onRefresh}
+        disabled={isLoading}
+        variant="outline"
+        size="default"
+        className="w-full sm:w-auto bg-background border-border hover:bg-muted"
+      >
+        <RefreshCw className={`h-4 w-4 mr-2 ${isLoading ? 'animate-spin' : ''}`} />
+        <span className="sm:inline">{t('refresh', 'docker')}</span>
+      </Button>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/docker/table/index.ts b/application/src/components/docker/table/index.ts
new file mode 100644
index 0000000..559a629
--- /dev/null
+++ b/application/src/components/docker/table/index.ts
@@ -0,0 +1,6 @@
+
+export { DockerTableSearch } from './DockerTableSearch';
+export { DockerTableHeader } from './DockerTableHeader';
+export { DockerTableRow } from './DockerTableRow';
+export { DockerRowActions } from './DockerRowActions';
+export { DockerEmptyState } from './DockerEmptyState';
\ No newline at end of file
diff --git a/application/src/components/operational-page/ComponentsSelector.tsx b/application/src/components/operational-page/ComponentsSelector.tsx
new file mode 100644
index 0000000..25e3eb1
--- /dev/null
+++ b/application/src/components/operational-page/ComponentsSelector.tsx
@@ -0,0 +1,209 @@
+
+import { useState } from 'react';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import { Textarea } from '@/components/ui/textarea';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Badge } from '@/components/ui/badge';
+import { Plus, X, Server } from 'lucide-react';
+import { StatusPageComponentRecord } from '@/types/statusPageComponents.types';
+import { useQuery } from '@tanstack/react-query';
+import { serviceService } from '@/services/serviceService';
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ComponentsSelectorProps {
+  selectedComponents: Partial<StatusPageComponentRecord>[];
+  onComponentsChange: (components: Partial<StatusPageComponentRecord>[]) => void;
+  onComponentDelete?: (componentId: string) => void;
+}
+
+export const ComponentsSelector = ({ selectedComponents, onComponentsChange, onComponentDelete }: ComponentsSelectorProps) => {
+  const { t } = useLanguage();
+  const [showAddForm, setShowAddForm] = useState(false);
+  const [newComponent, setNewComponent] = useState({
+    name: '',
+    description: '',
+    service_id: '',
+    server_id: '',
+    display_order: selectedComponents.length + 1,
+  });
+
+  // Fetch uptime services for the dropdown
+  const { data: services = [] } = useQuery({
+    queryKey: ['services'],
+    queryFn: serviceService.getServices,
+  });
+
+  const addComponent = () => {
+    if (!newComponent.name.trim()) return;
+
+    const component: Partial<StatusPageComponentRecord> = {
+      ...newComponent,
+      operational_status_id: '', // Will be set when page is created
+    };
+
+    onComponentsChange([...selectedComponents, component]);
+    setNewComponent({
+      name: '',
+      description: '',
+      service_id: '',
+      server_id: '',
+      display_order: selectedComponents.length + 2,
+    });
+    setShowAddForm(false);
+  };
+
+  const removeComponent = async (index: number) => {
+    const component = selectedComponents[index];
+    
+    // If component has an ID, it exists in database and needs to be deleted
+    if (component.id && onComponentDelete) {
+      await onComponentDelete(component.id);
+    } else {
+      // For new components not yet saved, just remove from local state
+      const updated = selectedComponents.filter((_, i) => i !== index);
+      onComponentsChange(updated);
+    }
+  };
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2">
+          <Server className="h-5 w-5" />
+          {t('statusPageComponents')}
+        </CardTitle>
+        <CardDescription>
+          {t('addMonitoringComponentsDesc')}
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        {selectedComponents.length > 0 && (
+          <div className="space-y-2">
+            <Label>{t('selectedComponents')}</Label>
+            <div className="space-y-2">
+              {selectedComponents.map((component, index) => (
+                <div key={component.id || index} className="flex items-center justify-between p-3 border rounded-lg">
+                  <div className="flex-1">
+                    <div className="font-medium">{component.name}</div>
+                    {component.description && (
+                      <div className="text-sm text-muted-foreground">{component.description}</div>
+                    )}
+                    <div className="flex gap-2 mt-1">
+                      {component.service_id && (
+                        <Badge variant="secondary" className="text-xs">
+                          {t('service')}: {services.find(s => s.id === component.service_id)?.name || component.service_id}
+                        </Badge>
+                      )}
+                      {component.server_id && (
+                        <Badge variant="secondary" className="text-xs">
+                          {t('server')}: {component.server_id}
+                        </Badge>
+                      )}
+                    </div>
+                  </div>
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    onClick={() => removeComponent(index)}
+                  >
+                    <X className="h-4 w-4" />
+                  </Button>
+                </div>
+              ))}
+            </div>
+          </div>
+        )}
+
+        {!showAddForm ? (
+          <Button
+            variant="outline"
+            onClick={() => setShowAddForm(true)}
+            className="w-full"
+          >
+            <Plus className="h-4 w-4 mr-2" />
+            {t('addComponent')}
+          </Button>
+        ) : (
+          <div className="border rounded-lg p-4 space-y-4">
+            <div className="grid grid-cols-2 gap-4">
+              <div>
+                <Label htmlFor="component-name">{t('componentName')}</Label>
+                <Input
+                  id="component-name"
+                  placeholder={t('componentNamePlaceholder')}
+                  value={newComponent.name}
+                  onChange={(e) => setNewComponent({ ...newComponent, name: e.target.value })}
+                />
+              </div>
+              <div>
+                <Label htmlFor="display-order">{t('displayOrder')}</Label>
+                <Input
+                  id="display-order"
+                  type="number"
+                  value={newComponent.display_order}
+                  onChange={(e) => setNewComponent({ ...newComponent, display_order: parseInt(e.target.value) || 1 })}
+                />
+              </div>
+            </div>
+
+            <div>
+              <Label htmlFor="component-description">{t('descriptionOptional')}</Label>
+              <Textarea
+                id="component-description"
+                placeholder={t('descriptionPlaceholder')}
+                value={newComponent.description}
+                onChange={(e) => setNewComponent({ ...newComponent, description: e.target.value })}
+              />
+            </div>
+
+            <div className="grid grid-cols-2 gap-4">
+              <div>
+                <Label htmlFor="service-id">{t('uptimeServiceOptional')}</Label>
+                <Select onValueChange={(value) => setNewComponent({ ...newComponent, service_id: value })}>
+                  <SelectTrigger>
+                    <SelectValue placeholder={t('selectUptimeService')} />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {services.map((service) => (
+                      <SelectItem key={service.id} value={service.id}>
+                        <div className="flex items-center gap-2">
+                          <div className={`w-2 h-2 rounded-full ${
+                            service.status === 'up' ? 'bg-green-500' : 
+                            service.status === 'down' ? 'bg-red-500' : 
+                            'bg-yellow-500'
+                          }`} />
+                          {service.name}
+                        </div>
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </div>
+              <div>
+                <Label htmlFor="server-id">{t('serverIdOptional')}</Label>
+                <Input
+                  id="server-id"
+                  placeholder={t('serverIdPlaceholder')}
+                  value={newComponent.server_id}
+                  onChange={(e) => setNewComponent({ ...newComponent, server_id: e.target.value })}
+                />
+              </div>
+            </div>
+
+            <div className="flex gap-2">
+              <Button onClick={addComponent} disabled={!newComponent.name.trim()}>
+                {t('addComponent')}
+              </Button>
+              <Button variant="outline" onClick={() => setShowAddForm(false)}>
+                {t('cancel')}
+              </Button>
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/operational-page/CreateOperationalPageDialog.tsx b/application/src/components/operational-page/CreateOperationalPageDialog.tsx
new file mode 100644
index 0000000..f93ffca
--- /dev/null
+++ b/application/src/components/operational-page/CreateOperationalPageDialog.tsx
@@ -0,0 +1,280 @@
+import { useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle, DialogTrigger } from '@/components/ui/dialog';
+import { Button } from '@/components/ui/button';
+import { Form, FormControl, FormDescription, FormField, FormItem, FormLabel, FormMessage } from '@/components/ui/form';
+import { Input } from '@/components/ui/input';
+import { Textarea } from '@/components/ui/textarea';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Switch } from '@/components/ui/switch';
+import { useCreateOperationalPage } from '@/hooks/useOperationalPage';
+import { useCreateStatusPageComponent } from '@/hooks/useStatusPageComponents';
+import { ComponentsSelector } from './ComponentsSelector';
+import { Plus } from 'lucide-react';
+import { StatusPageComponentRecord } from '@/types/statusPageComponents.types';
+import { useLanguage } from "@/contexts/LanguageContext";
+
+const formSchema = z.object({
+  title: z.string().min(1, 'Title is required'),
+  description: z.string().min(1, 'Description is required'),
+  slug: z.string().min(1, 'Slug is required'),
+  theme: z.string().min(1, 'Theme is required'),
+  status: z.enum(['operational', 'degraded', 'maintenance', 'major_outage']),
+  is_public: z.boolean(),
+  logo_url: z.string().optional(),
+  custom_domain: z.string().optional(),
+  custom_css: z.string().optional(),
+  page_style: z.string().optional(),
+});
+
+type FormData = z.infer<typeof formSchema>;
+
+export const CreateOperationalPageDialog = () => {
+  const { t } = useLanguage();
+  const [open, setOpen] = useState(false);
+  const [selectedComponents, setSelectedComponents] = useState<Partial<StatusPageComponentRecord>[]>([]);
+  const createMutation = useCreateOperationalPage();
+  const createComponentMutation = useCreateStatusPageComponent();
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: {
+      title: '',
+      description: '',
+      slug: '',
+      theme: 'default',
+      status: 'operational',
+      is_public: true,
+      logo_url: '',
+      custom_domain: '',
+      custom_css: '',
+      page_style: '',
+    },
+  });
+
+  const onSubmit = async (data: FormData) => {
+    try {
+      const payload = {
+        title: data.title,
+        description: data.description,
+        slug: data.slug,
+        theme: data.theme,
+        status: data.status,
+        is_public: data.is_public ? 'true' : 'false',
+        logo_url: data.logo_url || '',
+        custom_domain: data.custom_domain || '',
+        custom_css: data.custom_css || '',
+        page_style: data.page_style || '',
+      };
+      
+     // console.log('Creating operational page with payload:', payload);
+      const createdPage = await createMutation.mutateAsync(payload);
+     // console.log('Created page:', createdPage);
+      
+      // Create components after page is created
+      if (selectedComponents.length > 0) {
+      //  console.log('Creating components for page:', createdPage.id);
+        for (const component of selectedComponents) {
+          const componentPayload = {
+            operational_status_id: createdPage.id,
+            name: component.name || '',
+            description: component.description || '',
+            service_id: component.service_id || '',
+            server_id: component.server_id || '',
+            display_order: component.display_order || 1,
+          };
+          
+        //  console.log('Creating component with payload:', componentPayload);
+          await createComponentMutation.mutateAsync(componentPayload);
+        }
+      }
+      
+      setOpen(false);
+      form.reset();
+      setSelectedComponents([]);
+    } catch (error) {
+     // console.error('Error creating operational page:', error);
+    }
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={setOpen}>
+      <DialogTrigger asChild>
+        <Button className="gap-2">
+          <Plus className="h-4 w-4" />
+          {t('createPage')}
+        </Button>
+      </DialogTrigger>
+      <DialogContent className="sm:max-w-[800px] max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>{t('createOperationalPage')}</DialogTitle>
+          <DialogDescription>
+            {t('createOperationalPageDesc')}
+          </DialogDescription>
+        </DialogHeader>
+
+        <Form {...form}>
+          <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-6">
+            <div className="grid grid-cols-2 gap-4">
+              <FormField
+                control={form.control}
+                name="title"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('title')}</FormLabel>
+                    <FormControl>
+                      <Input placeholder={t('myServiceStatusPlaceholder')} {...field} />
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name="slug"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('slug')}</FormLabel>
+                    <FormControl>
+                      <Input placeholder={t('myServiceStatusSlugPlaceholder')} {...field} />
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            </div>
+
+            <FormField
+              control={form.control}
+              name="description"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>{t('description')}</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder={t('operationalPageDescriptionPlaceholder')} 
+                      className="min-h-[80px]"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <div className="grid grid-cols-2 gap-4">
+              <FormField
+                control={form.control}
+                name="theme"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('theme')}</FormLabel>
+                    <Select onValueChange={field.onChange} defaultValue={field.value}>
+                      <FormControl>
+                        <SelectTrigger>
+                          <SelectValue placeholder={t('selectTheme')} />
+                        </SelectTrigger>
+                      </FormControl>
+                      <SelectContent>
+                        <SelectItem value="default">{t('themeDefault')}</SelectItem>
+                        <SelectItem value="dark">{t('themeDark')}</SelectItem>
+                        <SelectItem value="light">{t('themeLight')}</SelectItem>
+                      </SelectContent>
+                    </Select>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name="status"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('initialStatus')}</FormLabel>
+                    <Select onValueChange={field.onChange} defaultValue={field.value}>
+                      <FormControl>
+                        <SelectTrigger>
+                          <SelectValue placeholder={t('selectStatus')} />
+                        </SelectTrigger>
+                      </FormControl>
+                      <SelectContent>
+                        <SelectItem value="operational">{t('statusOperational')}</SelectItem>
+                        <SelectItem value="degraded">{t('statusDegraded')}</SelectItem>
+                        <SelectItem value="maintenance">{t('statusMaintenance')}</SelectItem>
+                        <SelectItem value="major_outage">{t('statusMajorOutage')}</SelectItem>
+                      </SelectContent>
+                    </Select>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            </div>
+
+            <FormField
+              control={form.control}
+              name="is_public"
+              render={({ field }) => (
+                <FormItem className="flex flex-row items-center justify-between rounded-lg border p-3 shadow-sm">
+                  <div className="space-y-0.5">
+                    <FormLabel>{t('publicPage')}</FormLabel>
+                    <FormDescription>
+                      {t('makePagePublic')}
+                    </FormDescription>
+                  </div>
+                  <FormControl>
+                    <Switch
+                      checked={field.value}
+                      onCheckedChange={field.onChange}
+                    />
+                  </FormControl>
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={form.control}
+              name="custom_domain"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>{t('customDomainOptional')}</FormLabel>
+                  <FormControl>
+                    <Input placeholder={t('customDomainPlaceholder')} {...field} />
+                  </FormControl>
+                  <FormDescription>
+                    {t('customDomainDescription')}
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <ComponentsSelector
+              selectedComponents={selectedComponents}
+              onComponentsChange={setSelectedComponents}
+            />
+
+            <div className="flex justify-end gap-2 pt-4">
+              <Button 
+                type="button" 
+                variant="outline" 
+                onClick={() => setOpen(false)}
+              >
+                {t('cancel')}
+              </Button>
+              <Button 
+                type="submit" 
+                disabled={createMutation.isPending || createComponentMutation.isPending}
+              >
+                {createMutation.isPending || createComponentMutation.isPending ? t('creating') : t('createPage')}
+              </Button>
+            </div>
+          </form>
+        </Form>
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/operational-page/EditOperationalPageDialog.tsx b/application/src/components/operational-page/EditOperationalPageDialog.tsx
new file mode 100644
index 0000000..82ac73d
--- /dev/null
+++ b/application/src/components/operational-page/EditOperationalPageDialog.tsx
@@ -0,0 +1,369 @@
+import { useState, useEffect, useMemo, useCallback } from 'react';
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { Button } from '@/components/ui/button';
+import { Form, FormControl, FormDescription, FormField, FormItem, FormLabel, FormMessage } from '@/components/ui/form';
+import { Input } from '@/components/ui/input';
+import { Textarea } from '@/components/ui/textarea';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Switch } from '@/components/ui/switch';
+import { useUpdateOperationalPage } from '@/hooks/useOperationalPage';
+import { useCreateStatusPageComponent, useStatusPageComponentsByOperationalId, useDeleteStatusPageComponent } from '@/hooks/useStatusPageComponents';
+import { ComponentsSelector } from './ComponentsSelector';
+import { OperationalPageRecord } from '@/types/operational.types';
+import { StatusPageComponentRecord } from '@/types/statusPageComponents.types';
+import { useLanguage } from "@/contexts/LanguageContext";
+
+const formSchema = z.object({
+  title: z.string().min(1, 'Title is required'),
+  description: z.string().min(1, 'Description is required'),
+  slug: z.string().min(1, 'Slug is required'),
+  theme: z.string().min(1, 'Theme is required'),
+  status: z.enum(['operational', 'degraded', 'maintenance', 'major_outage']),
+  is_public: z.boolean(),
+  logo_url: z.string().optional(),
+  custom_domain: z.string().optional(),
+  custom_css: z.string().optional(),
+  page_style: z.string().optional(),
+});
+
+type FormData = z.infer<typeof formSchema>;
+
+interface EditOperationalPageDialogProps {
+  page: OperationalPageRecord | null;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+export const EditOperationalPageDialog = ({ page, open, onOpenChange }: EditOperationalPageDialogProps) => {
+  const { t } = useLanguage();
+  const [selectedComponents, setSelectedComponents] = useState<Partial<StatusPageComponentRecord>[]>([]);
+  const [isFormSubmitting, setIsFormSubmitting] = useState(false);
+  const [componentsLoaded, setComponentsLoaded] = useState(false);
+  
+  const updateMutation = useUpdateOperationalPage();
+  const createComponentMutation = useCreateStatusPageComponent();
+  const deleteComponentMutation = useDeleteStatusPageComponent();
+  
+  // Fetch existing components for this operational page
+  const { data: components = [] } = useStatusPageComponentsByOperationalId(page?.id || '');
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: {
+      title: '',
+      description: '',
+      slug: '',
+      theme: 'default',
+      status: 'operational',
+      is_public: true,
+      logo_url: '',
+      custom_domain: '',
+      custom_css: '',
+      page_style: '',
+    },
+  });
+
+  // Memoize the form reset values to prevent unnecessary re-renders
+  const formValues = useMemo(() => {
+    if (!page) return null;
+    return {
+      title: page.title,
+      description: page.description,
+      slug: page.slug,
+      theme: page.theme,
+      status: page.status,
+      is_public: page.is_public === 'true',
+      logo_url: page.logo_url || '',
+      custom_domain: page.custom_domain || '',
+      custom_css: page.custom_css || '',
+      page_style: page.page_style || '',
+    };
+  }, [page?.id, page?.title, page?.description, page?.slug, page?.theme, page?.status, page?.is_public, page?.logo_url, page?.custom_domain, page?.custom_css, page?.page_style]);
+
+  // Reset form when page data changes
+  useEffect(() => {
+    if (formValues) {
+      form.reset(formValues);
+    }
+  }, [formValues, form]);
+
+  // Convert components to selector format and initialize state - only when dialog opens and components change
+  useEffect(() => {
+    if (!open || !page?.id || !components) {
+      return;
+    }
+
+    // Only update if components actually changed or haven't been loaded yet
+    const componentIds = components.map(c => c.id).sort().join(',');
+    const currentSelectedIds = selectedComponents.map(c => c.id).filter(Boolean).sort().join(',');
+    
+    if (componentIds !== currentSelectedIds || !componentsLoaded) {
+ //     console.log('Loading existing components:', components);
+      const existingComponentsForSelector = components.map(comp => ({
+        id: comp.id,
+        name: comp.name,
+        description: comp.description,
+        service_id: comp.service_id,
+        server_id: comp.server_id,
+        display_order: comp.display_order,
+        operational_status_id: comp.operational_status_id,
+      }));
+      
+      setSelectedComponents(existingComponentsForSelector);
+      setComponentsLoaded(true);
+    }
+  }, [open, page?.id, components, componentsLoaded, selectedComponents]);
+
+  // Reset state when dialog closes
+  useEffect(() => {
+    if (!open) {
+      setComponentsLoaded(false);
+      setSelectedComponents([]);
+    }
+  }, [open]);
+
+  const handleComponentDelete = useCallback(async (componentId: string) => {
+    try {
+   //   console.log('Deleting component:', componentId);
+      await deleteComponentMutation.mutateAsync(componentId);
+      
+      // Update local state to remove the deleted component
+      setSelectedComponents(prev => prev.filter(comp => comp.id !== componentId));
+    } catch (error) {
+   //   console.error('Error deleting component:', error);
+    }
+  }, [deleteComponentMutation]);
+
+  const onSubmit = async (data: FormData) => {
+    if (!page) return;
+
+    try {
+      setIsFormSubmitting(true);
+      
+      const payload = {
+        title: data.title,
+        description: data.description,
+        slug: data.slug,
+        theme: data.theme,
+        status: data.status,
+        is_public: data.is_public ? 'true' : 'false',
+        logo_url: data.logo_url || '',
+        custom_domain: data.custom_domain || '',
+        custom_css: data.custom_css || '',
+        page_style: data.page_style || '',
+      };
+      
+   //   console.log('Updating operational page with payload:', payload);
+      await updateMutation.mutateAsync({ id: page.id, data: payload });
+      
+      // Handle component changes
+      const currentComponentIds = components.map(c => c.id);
+      const newComponentsToCreate = selectedComponents.filter(comp => !comp.id);
+      const componentsToDelete = components.filter(comp => !selectedComponents.some(selected => selected.id === comp.id));
+
+      // Delete removed components
+      for (const component of componentsToDelete) {
+    //    console.log('Deleting component during save:', component.id);
+        await deleteComponentMutation.mutateAsync(component.id);
+      }
+
+      // Create new components
+      for (const component of newComponentsToCreate) {
+        const componentPayload = {
+          operational_status_id: page.id,
+          name: component.name || '',
+          description: component.description || '',
+          service_id: component.service_id || '',
+          server_id: component.server_id || '',
+          display_order: component.display_order || 1,
+        };
+        
+    //    console.log('Creating component with payload:', componentPayload);
+        await createComponentMutation.mutateAsync(componentPayload);
+      }
+      
+      onOpenChange(false);
+    } catch (error) {
+    //  console.error('Error updating operational page:', error);
+    } finally {
+      setIsFormSubmitting(false);
+    }
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[800px] max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>{t('editOperationalPage')}</DialogTitle>
+          <DialogDescription>
+            {t('updateYourOperationalPage')}
+          </DialogDescription>
+        </DialogHeader>
+
+        <Form {...form}>
+          <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-6">
+            <div className="grid grid-cols-2 gap-4">
+              <FormField
+                control={form.control}
+                name="title"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('title')}</FormLabel>
+                    <FormControl>
+                      <Input placeholder={t('myServiceStatusPlaceholder')} {...field} />
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name="slug"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('slug')}</FormLabel>
+                    <FormControl>
+                      <Input placeholder={t('myServiceStatusSlugPlaceholder')} {...field} />
+                    </FormControl>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            </div>
+
+            <FormField
+              control={form.control}
+              name="description"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>{t('description')}</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder={t('operationalPageDescriptionPlaceholder')} 
+                      className="min-h-[80px]"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <div className="grid grid-cols-2 gap-4">
+              <FormField
+                control={form.control}
+                name="theme"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('theme')}</FormLabel>
+                    <Select onValueChange={field.onChange} defaultValue={field.value}>
+                      <FormControl>
+                        <SelectTrigger>
+                          <SelectValue placeholder={t('selectTheme')} />
+                        </SelectTrigger>
+                      </FormControl>
+                      <SelectContent>
+                        <SelectItem value="default">{t('themeDefault')}</SelectItem>
+                        <SelectItem value="dark">{t('themeDark')}</SelectItem>
+                        <SelectItem value="light">{t('themeLight')}</SelectItem>
+                      </SelectContent>
+                    </Select>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+
+              <FormField
+                control={form.control}
+                name="status"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t('status')}</FormLabel>
+                    <Select onValueChange={field.onChange} defaultValue={field.value}>
+                      <FormControl>
+                        <SelectTrigger>
+                          <SelectValue placeholder={t('selectStatus')} />
+                        </SelectTrigger>
+                      </FormControl>
+                      <SelectContent>
+                        <SelectItem value="operational">{t('statusOperational')}</SelectItem>
+                        <SelectItem value="degraded">{t('statusDegraded')}</SelectItem>
+                        <SelectItem value="maintenance">{t('statusMaintenance')}</SelectItem>
+                        <SelectItem value="major_outage">{t('statusMajorOutage')}</SelectItem>
+                      </SelectContent>
+                    </Select>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            </div>
+
+            <FormField
+              control={form.control}
+              name="is_public"
+              render={({ field }) => (
+                <FormItem className="flex flex-row items-center justify-between rounded-lg border p-3 shadow-sm">
+                  <div className="space-y-0.5">
+                    <FormLabel>{t('publicPage')}</FormLabel>
+                    <FormDescription>
+                      {t('makePagePublic')}
+                    </FormDescription>
+                  </div>
+                  <FormControl>
+                    <Switch
+                      checked={field.value}
+                      onCheckedChange={field.onChange}
+                    />
+                  </FormControl>
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={form.control}
+              name="custom_domain"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>{t('customDomainOptional')}</FormLabel>
+                  <FormControl>
+                    <Input placeholder={t('customDomainPlaceholder')} {...field} />
+                  </FormControl>
+                  <FormDescription>
+                    {t('customDomainDescription')}
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <ComponentsSelector
+              selectedComponents={selectedComponents}
+              onComponentsChange={setSelectedComponents}
+              onComponentDelete={handleComponentDelete}
+            />
+
+            <div className="flex justify-end gap-2 pt-4">
+              <Button 
+                type="button" 
+                variant="outline" 
+                onClick={() => onOpenChange(false)}
+              >
+                {t('cancel')}
+              </Button>
+              <Button 
+                type="submit" 
+                disabled={isFormSubmitting || updateMutation.isPending || createComponentMutation.isPending}
+              >
+                {isFormSubmitting || updateMutation.isPending || createComponentMutation.isPending ? t('updating') : t('updatePage')}
+              </Button>
+            </div>
+          </form>
+        </Form>
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/operational-page/OperationalPageCard.tsx b/application/src/components/operational-page/OperationalPageCard.tsx
new file mode 100644
index 0000000..e982f6e
--- /dev/null
+++ b/application/src/components/operational-page/OperationalPageCard.tsx
@@ -0,0 +1,104 @@
+
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Button } from '@/components/ui/button';
+import { Badge } from '@/components/ui/badge';
+import { OperationalPageRecord } from '@/types/operational.types';
+import { StatusBadge } from './StatusBadge';
+import { Globe, ExternalLink, Eye, Settings, Trash2 } from 'lucide-react';
+import { format } from 'date-fns';
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface OperationalPageCardProps {
+  page: OperationalPageRecord;
+  onEdit?: (page: OperationalPageRecord) => void;
+  onView?: (page: OperationalPageRecord) => void;
+  onDelete?: (page: OperationalPageRecord) => void;
+}
+
+export const OperationalPageCard = ({ page, onEdit, onView, onDelete }: OperationalPageCardProps) => {
+  const { t } = useLanguage();
+
+  return (
+    <Card className="hover:shadow-lg transition-shadow duration-200">
+      <CardHeader className="pb-3">
+        <div className="flex items-start justify-between">
+          <div className="flex-1">
+            <CardTitle className="text-lg font-semibold mb-1">{page.title}</CardTitle>
+            <CardDescription className="text-sm text-muted-foreground">
+              {page.description}
+            </CardDescription>
+          </div>
+          <StatusBadge status={page.status} />
+        </div>
+      </CardHeader>
+      
+      <CardContent className="space-y-4">
+        <div className="grid grid-cols-2 gap-4 text-sm">
+          <div>
+            <span className="font-medium text-muted-foreground">{t('slug')}:</span>
+            <p className="mt-1">{page.slug}</p>
+          </div>
+          <div>
+            <span className="font-medium text-muted-foreground">{t('theme')}:</span>
+            <p className="mt-1 capitalize">{page.theme}</p>
+          </div>
+          <div>
+            <span className="font-medium text-muted-foreground">{t('public')}:</span>
+            <div className="mt-1">
+              <Badge variant={page.is_public === 'true' ? 'default' : 'secondary'}>
+                {page.is_public === 'true' ? t('yes') : t('no')}
+              </Badge>
+            </div>
+          </div>
+          <div>
+            <span className="font-medium text-muted-foreground">{t('updated')}:</span>
+            <p className="mt-1">{format(new Date(page.updated), 'MMM dd, yyyy')}</p>
+          </div>
+        </div>
+
+        {page.custom_domain && (
+          <div className="flex items-center gap-2 p-2 bg-muted rounded-md">
+            <Globe className="h-4 w-4 text-muted-foreground" />
+            <span className="text-sm font-medium">{page.custom_domain}</span>
+            <ExternalLink className="h-3 w-3 text-muted-foreground" />
+          </div>
+        )}
+
+        <div className="flex gap-2 pt-2">
+          {onView && (
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => onView(page)}
+              className="flex-1"
+            >
+              <Eye className="h-4 w-4 mr-2" />
+              {t('view')}
+            </Button>
+          )}
+          {onEdit && (
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => onEdit(page)}
+              className="flex-1"
+            >
+              <Settings className="h-4 w-4 mr-2" />
+              {t('edit')}
+            </Button>
+          )}
+          {onDelete && (
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => onDelete(page)}
+              className="text-red-600 hover:text-red-700 hover:bg-red-50"
+            >
+              <Trash2 className="h-4 w-4" />
+            </Button>
+          )}
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/operational-page/OperationalPageContent.tsx b/application/src/components/operational-page/OperationalPageContent.tsx
new file mode 100644
index 0000000..18db401
--- /dev/null
+++ b/application/src/components/operational-page/OperationalPageContent.tsx
@@ -0,0 +1,214 @@
+import { useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { useOperationalPages, useDeleteOperationalPage } from '@/hooks/useOperationalPage';
+import { CreateOperationalPageDialog } from './CreateOperationalPageDialog';
+import { EditOperationalPageDialog } from './EditOperationalPageDialog';
+import { OperationalPageCard } from './OperationalPageCard';
+import { Card, CardContent } from '@/components/ui/card';
+import { Button } from '@/components/ui/button';
+import { OperationalPageRecord } from '@/types/operational.types';
+import { Activity, Plus, RefreshCw } from 'lucide-react';
+import { Skeleton } from '@/components/ui/skeleton';
+import { useLanguage } from "@/contexts/LanguageContext";
+
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from '@/components/ui/alert-dialog';
+
+export const OperationalPageContent = () => {
+  const { t } = useLanguage();
+  const navigate = useNavigate();
+  const { data: pages, isLoading, error, refetch, isRefetching } = useOperationalPages();
+  const deleteMutation = useDeleteOperationalPage();
+  
+  const [editingPage, setEditingPage] = useState<OperationalPageRecord | null>(null);
+  const [editDialogOpen, setEditDialogOpen] = useState(false);
+  const [deleteDialogOpen, setDeleteDialogOpen] = useState(false);
+  const [pageToDelete, setPageToDelete] = useState<OperationalPageRecord | null>(null);
+
+  const handleEdit = (page: OperationalPageRecord) => {
+    setEditingPage(page);
+    setEditDialogOpen(true);
+  };
+
+  const handleView = (page: OperationalPageRecord) => {
+    if (page.custom_domain) {
+      window.open(`https://${page.custom_domain}`, '_blank');
+    } else {
+      // Navigate to the public status page route using the correct format
+      window.open(`/public/${page.slug}`, '_blank');
+    }
+  };
+
+  const handleDelete = (page: OperationalPageRecord) => {
+    setPageToDelete(page);
+    setDeleteDialogOpen(true);
+  };
+
+  const confirmDelete = async () => {
+    if (pageToDelete) {
+      try {
+        await deleteMutation.mutateAsync(pageToDelete.id);
+        setDeleteDialogOpen(false);
+        setPageToDelete(null);
+      } catch (error) {
+        console.error('Error deleting page:', error);
+      }
+    }
+  };
+
+  if (error) {
+    return (
+      <div className="container mx-auto px-4 py-8">
+        <div className="text-center">
+          <div className="mb-4">
+            <Activity className="h-12 w-12 text-muted-foreground mx-auto" />
+          </div>
+          <h3 className="text-lg font-semibold mb-2">{t('failedToLoadOperationalPages')}</h3>
+          <p className="text-muted-foreground mb-4">
+            {t('loadingoperationalPages')}
+          </p>
+          <Button onClick={() => refetch()} variant="outline">
+            <RefreshCw className="h-4 w-4 mr-2" />
+            {t('tryagain')}
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="container mx-auto px-4 py-8">
+      {/* Header */}
+      <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between mb-8">
+        <div>
+          <h1 className="text-3xl font-bold tracking-tight mb-2"> {t('operationalPages')}</h1>
+          <p className="text-muted-foreground">
+            {t('describeOperation')}
+          </p>
+        </div>
+        
+        <div className="flex items-center gap-2 mt-4 sm:mt-0">
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => refetch()}
+            disabled={isRefetching}
+          >
+            <RefreshCw className={`h-4 w-4 mr-2 ${isRefetching ? 'animate-spin' : ''}`} />
+            {t('refresh')}
+          </Button>
+          <CreateOperationalPageDialog />
+        </div>
+      </div>
+
+      {/* Loading State */}
+      {isLoading && (
+        <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
+          {[...Array(6)].map((_, i) => (
+            <Card key={i}>
+              <div className="p-6">
+                <Skeleton className="h-6 w-3/4 mb-2" />
+                <Skeleton className="h-4 w-full mb-4" />
+                <div className="space-y-2">
+                  <Skeleton className="h-4 w-1/2" />
+                  <Skeleton className="h-4 w-1/3" />
+                </div>
+                <div className="flex gap-2 mt-4">
+                  <Skeleton className="h-8 flex-1" />
+                  <Skeleton className="h-8 flex-1" />
+                </div>
+              </div>
+            </Card>
+          ))}
+        </div>
+      )}
+
+      {/* Empty State */}
+      {!isLoading && (!pages || pages.length === 0) && (
+        <Card className="p-12">
+          <CardContent className="text-center">
+            <div className="mb-4">
+              <Activity className="h-12 w-12 text-muted-foreground mx-auto" />
+            </div>
+            <h3 className="text-lg font-semibold mb-2">{t('noOperationalPagesFound')}</h3>
+            <p className="text-muted-foreground mb-6">
+              {t('createYourFirstOperationalPage')}
+            </p>
+            <CreateOperationalPageDialog />
+          </CardContent>
+        </Card>
+      )}
+
+      {/* Pages Grid */}
+      {!isLoading && pages && pages.length > 0 && (
+        <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
+          {pages.map((page) => (
+            <OperationalPageCard
+              key={page.id}
+              page={page}
+              onEdit={handleEdit}
+              onView={handleView}
+              onDelete={handleDelete}
+            />
+          ))}
+        </div>
+      )}
+
+      {/* Stats Footer */}
+      {!isLoading && pages && pages.length > 0 && (
+        <div className="mt-8 pt-6 border-t">
+          <div className="flex flex-wrap gap-6 text-sm text-muted-foreground">
+            <div>
+              <span className="font-medium">{t('totalPages')}:</span> {pages.length}
+            </div>
+            <div>
+              <span className="font-medium">{t('totalPages')}:</span>{' '}
+              {pages.filter(p => p.is_public === 'true').length}
+            </div>
+            <div>
+              <span className="font-medium">{t('operational')}:</span>{' '}
+              {pages.filter(p => p.status === 'operational').length}
+            </div>
+          </div>
+        </div>
+      )}
+
+      {/* Edit Dialog */}
+      <EditOperationalPageDialog
+        page={editingPage}
+        open={editDialogOpen}
+        onOpenChange={setEditDialogOpen}
+      />
+
+      {/* Delete Confirmation Dialog */}
+      <AlertDialog open={deleteDialogOpen} onOpenChange={setDeleteDialogOpen}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>{t('deleteOperationalPage')}</AlertDialogTitle>
+            <AlertDialogDescription>
+              {t('deleteOperationalPageConfirm').replace('{title}', pageToDelete?.title ?? '')}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>{t('cancel')}</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={confirmDelete}
+              className="bg-red-600 hover:bg-red-700"
+              disabled={deleteMutation.isPending}
+            >
+              {deleteMutation.isPending ? t('deleting') : t('delete')}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/operational-page/StatusBadge.tsx b/application/src/components/operational-page/StatusBadge.tsx
new file mode 100644
index 0000000..d101869
--- /dev/null
+++ b/application/src/components/operational-page/StatusBadge.tsx
@@ -0,0 +1,47 @@
+
+import { Badge } from '@/components/ui/badge';
+import { OperationalPageRecord } from '@/types/operational.types';
+
+interface StatusBadgeProps {
+  status: OperationalPageRecord['status'];
+}
+
+export const StatusBadge = ({ status }: StatusBadgeProps) => {
+  const getStatusConfig = (status: OperationalPageRecord['status']) => {
+    switch (status) {
+      case 'operational':
+        return {
+          label: 'Operational',
+          className: 'bg-green-100 text-green-800 hover:bg-green-200',
+        };
+      case 'degraded':
+        return {
+          label: 'Degraded Performance',
+          className: 'bg-yellow-100 text-yellow-800 hover:bg-yellow-200',
+        };
+      case 'maintenance':
+        return {
+          label: 'Under Maintenance',
+          className: 'bg-blue-100 text-blue-800 hover:bg-blue-200',
+        };
+      case 'major_outage':
+        return {
+          label: 'Major Outage',
+          className: 'bg-red-100 text-red-800 hover:bg-red-200',
+        };
+      default:
+        return {
+          label: 'Unknown',
+          className: 'bg-gray-100 text-gray-800 hover:bg-gray-200',
+        };
+    }
+  };
+
+  const config = getStatusConfig(status);
+
+  return (
+    <Badge className={config.className}>
+      {config.label}
+    </Badge>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/profile/ChangePasswordForm.tsx b/application/src/components/profile/ChangePasswordForm.tsx
new file mode 100644
index 0000000..5e84220
--- /dev/null
+++ b/application/src/components/profile/ChangePasswordForm.tsx
@@ -0,0 +1,229 @@
+import { useState } from "react";
+import { z } from "zod";
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { Button } from "@/components/ui/button";
+import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { useToast } from "@/hooks/use-toast";
+import { Eye, EyeOff } from "lucide-react";
+import { pb } from "@/lib/pocketbase";
+import { authService } from "@/services/authService";
+import { useNavigate } from "react-router-dom";
+
+// Password change form schema
+const passwordFormSchema = z.object({
+  currentPassword: z.string().min(1, "Current password is required"),
+  newPassword: z.string().min(8, "Password must be at least 8 characters"),
+  confirmPassword: z.string().min(8, "Confirm password is required"),
+}).refine((data) => data.newPassword === data.confirmPassword, {
+  message: "Passwords don't match",
+  path: ["confirmPassword"],
+});
+
+type PasswordFormValues = z.infer<typeof passwordFormSchema>;
+
+interface ChangePasswordFormProps {
+  userId: string;
+}
+
+export function ChangePasswordForm({ userId }: ChangePasswordFormProps) {
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [showCurrentPassword, setShowCurrentPassword] = useState(false);
+  const [showNewPassword, setShowNewPassword] = useState(false);
+  const [showConfirmPassword, setShowConfirmPassword] = useState(false);
+  
+  const { toast } = useToast();
+  const navigate = useNavigate();
+  
+  const form = useForm<PasswordFormValues>({
+    resolver: zodResolver(passwordFormSchema),
+    defaultValues: {
+      currentPassword: "",
+      newPassword: "",
+      confirmPassword: "",
+    },
+  });
+
+  // Function to determine which collection the user belongs to
+  const getUserCollection = async (userId: string): Promise<string> => {
+    try {
+      // First try to find the user in the regular users collection
+      await pb.collection('users').getOne(userId);
+      return 'users';
+    } catch (error) {
+      try {
+        // If not found, try the superadmin collection
+        await pb.collection('_superusers').getOne(userId);
+        return '_superusers';
+      } catch (error) {
+        throw new Error('User not found in any collection');
+      }
+    }
+  };
+
+  async function onSubmit(data: PasswordFormValues) {
+    setIsSubmitting(true);
+    
+    try {
+      console.log("Starting password change for user:", userId);
+      
+      // Determine which collection the user belongs to
+      const collection = await getUserCollection(userId);
+      console.log("User found in collection:", collection);
+      
+      // PocketBase requires the old password along with the new one
+      await pb.collection(collection).update(userId, {
+        oldPassword: data.currentPassword,
+        password: data.newPassword,
+        passwordConfirm: data.confirmPassword,
+      });
+
+      // Refresh auth data to ensure token remains valid
+      await authService.refreshUserData();
+      
+      toast({
+        title: "Password updated",
+        description: "Your password has been changed successfully. You will be logged out in 3 seconds for security.",
+      });
+      
+      // Reset the form
+      form.reset();
+      
+      // Auto logout after successful password change
+      setTimeout(() => {
+        console.log("Auto logout after password change");
+        authService.logout();
+        navigate("/login");
+      }, 3000);
+      
+    } catch (error) {
+      console.error("Password change error:", error);
+      
+      let errorMessage = "Failed to update password. Please try again.";
+      if (error instanceof Error) {
+        if (error.message.includes("Failed to authenticate")) {
+          errorMessage = "Current password is incorrect. Please try again.";
+        } else if (error.message.includes("User not found")) {
+          errorMessage = "User account not found. Please contact your administrator.";
+        } else {
+          errorMessage = error.message;
+        }
+      }
+      
+      toast({
+        title: "Password change failed",
+        description: errorMessage,
+        variant: "destructive",
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  }
+
+  return (
+    <Form {...form}>
+      <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-6">
+        <FormField
+          control={form.control}
+          name="currentPassword"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Current Password</FormLabel>
+              <FormControl>
+                <div className="relative">
+                  <Input
+                    type={showCurrentPassword ? "text" : "password"}
+                    placeholder="Your current password"
+                    {...field}
+                  />
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="icon"
+                    className="absolute right-1 top-1/2 -translate-y-1/2"
+                    onClick={() => setShowCurrentPassword(!showCurrentPassword)}
+                  >
+                    {showCurrentPassword ? <EyeOff className="h-4 w-4" /> : <Eye className="h-4 w-4" />}
+                    <span className="sr-only">
+                      {showCurrentPassword ? "Hide password" : "Show password"}
+                    </span>
+                  </Button>
+                </div>
+              </FormControl>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="newPassword"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>New Password</FormLabel>
+              <FormControl>
+                <div className="relative">
+                  <Input
+                    type={showNewPassword ? "text" : "password"}
+                    placeholder="New password"
+                    {...field}
+                  />
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="icon"
+                    className="absolute right-1 top-1/2 -translate-y-1/2"
+                    onClick={() => setShowNewPassword(!showNewPassword)}
+                  >
+                    {showNewPassword ? <EyeOff className="h-4 w-4" /> : <Eye className="h-4 w-4" />}
+                    <span className="sr-only">
+                      {showNewPassword ? "Hide password" : "Show password"}
+                    </span>
+                  </Button>
+                </div>
+              </FormControl>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="confirmPassword"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Confirm Password</FormLabel>
+              <FormControl>
+                <div className="relative">
+                  <Input
+                    type={showConfirmPassword ? "text" : "password"}
+                    placeholder="Confirm new password"
+                    {...field}
+                  />
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="icon"
+                    className="absolute right-1 top-1/2 -translate-y-1/2"
+                    onClick={() => setShowConfirmPassword(!showConfirmPassword)}
+                  >
+                    {showConfirmPassword ? <EyeOff className="h-4 w-4" /> : <Eye className="h-4 w-4" />}
+                    <span className="sr-only">
+                      {showConfirmPassword ? "Hide password" : "Show password"}
+                    </span>
+                  </Button>
+                </div>
+              </FormControl>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <Button type="submit" disabled={isSubmitting}>
+          {isSubmitting ? "Updating..." : "Change Password"}
+        </Button>
+      </form>
+    </Form>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/profile/ProfileContent.tsx b/application/src/components/profile/ProfileContent.tsx
new file mode 100644
index 0000000..f7c8c7d
--- /dev/null
+++ b/application/src/components/profile/ProfileContent.tsx
@@ -0,0 +1,82 @@
+
+import { useState, useEffect } from "react";
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "@/components/ui/card";
+import { User } from "@/services/userService";
+import { UserProfileDetails } from "./UserProfileDetails";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { ChangePasswordForm } from "./ChangePasswordForm";
+import { UpdateProfileForm } from "./UpdateProfileForm";
+
+interface ProfileContentProps {
+  currentUser: User | null;
+  onUserUpdated?: () => Promise<void>;
+}
+
+export function ProfileContent({ currentUser, onUserUpdated }: ProfileContentProps) {
+  const [activeTab, setActiveTab] = useState("details");
+
+  // When active tab changes, refresh user data if needed
+  useEffect(() => {
+    if (activeTab === "details" && onUserUpdated) {
+      onUserUpdated();
+    }
+  }, [activeTab, onUserUpdated]);
+
+  if (!currentUser) {
+    return (
+      <Card>
+        <CardHeader>
+          <CardTitle>User Profile</CardTitle>
+          <CardDescription>Your profile information could not be loaded</CardDescription>
+        </CardHeader>
+      </Card>
+    );
+  }
+  
+  return (
+    <div className="space-y-6">
+      <div className="flex justify-between items-center">
+        <h1 className="text-3xl font-bold">My Profile</h1>
+      </div>
+
+      <div className="grid grid-cols-1 md:grid-cols-3 gap-6">
+        {/* Left column - Profile summary card */}
+        <Card className="md:col-span-1">
+          <CardHeader>
+            <CardTitle>Profile Summary</CardTitle>
+          </CardHeader>
+          <CardContent>
+            <UserProfileDetails user={currentUser} />
+          </CardContent>
+        </Card>
+
+        {/* Right column - Profile tabs for edit and password change */}
+        <Card className="md:col-span-2">
+          <CardHeader>
+            <CardTitle>My Account</CardTitle>
+            <CardDescription>Manage your account settings</CardDescription>
+          </CardHeader>
+          <CardContent>
+            <Tabs value={activeTab} onValueChange={setActiveTab} className="w-full">
+              <TabsList className="grid grid-cols-2 w-full">
+                <TabsTrigger value="details">Profile Details</TabsTrigger>
+                <TabsTrigger value="security">Security</TabsTrigger>
+              </TabsList>
+              
+              <TabsContent value="details" className="pt-4">
+                <UpdateProfileForm user={currentUser} />
+              </TabsContent>
+              
+              <TabsContent value="security" className="pt-4">
+                <ChangePasswordForm userId={currentUser.id} />
+              </TabsContent>
+            </Tabs>
+          </CardContent>
+          <CardFooter className="text-sm text-muted-foreground">
+            Last updated: {new Date(currentUser.updated).toLocaleString()}
+          </CardFooter>
+        </Card>
+      </div>
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/profile/UpdateProfileForm.tsx b/application/src/components/profile/UpdateProfileForm.tsx
new file mode 100644
index 0000000..05ef7ff
--- /dev/null
+++ b/application/src/components/profile/UpdateProfileForm.tsx
@@ -0,0 +1,195 @@
+
+import { useState } from "react";
+import { z } from "zod";
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { User, userService } from "@/services/userService";
+import { Button } from "@/components/ui/button";
+import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { useToast } from "@/hooks/use-toast";
+import { authService } from "@/services/authService";
+import { AlertCircle, CheckCircle } from "lucide-react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { useNavigate } from "react-router-dom";
+
+// Profile update form schema
+const profileFormSchema = z.object({
+  full_name: z.string().min(2, {
+    message: "Name must be at least 2 characters.",
+  }),
+  username: z.string().min(3, {
+    message: "Username must be at least 3 characters.",
+  }),
+  email: z.string().email({
+    message: "Please enter a valid email address.",
+  }),
+});
+
+type ProfileFormValues = z.infer<typeof profileFormSchema>;
+
+interface UpdateProfileFormProps {
+  user: User;
+}
+
+export function UpdateProfileForm({ user }: UpdateProfileFormProps) {
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [updateError, setUpdateError] = useState<string | null>(null);
+  const [updateSuccess, setUpdateSuccess] = useState<string | null>(null);
+  const { toast } = useToast();
+  const navigate = useNavigate();
+  
+  // Initialize the form with current user data
+  const form = useForm<ProfileFormValues>({
+    resolver: zodResolver(profileFormSchema),
+    defaultValues: {
+      full_name: user.full_name || "",
+      username: user.username || "",
+      email: user.email || "",
+    },
+  });
+
+  async function onSubmit(data: ProfileFormValues) {
+    setIsSubmitting(true);
+    setUpdateError(null);
+    setUpdateSuccess(null);
+    
+    try {
+      console.log("Submitting profile update with data:", data);
+      
+      // Detect if email is being changed
+      const isEmailChanged = data.email !== user.email;
+      
+      // Create update payload with all fields
+      const updateData = {
+        full_name: data.full_name,
+        username: data.username,
+        // Only include email if it's changed
+        email: isEmailChanged ? data.email : undefined,
+        // Always set emailVisibility to true if email is changing
+        emailVisibility: isEmailChanged ? true : undefined
+      };
+      
+      console.log("Sending update payload:", updateData);
+      
+      // Update user data using the userService
+      await userService.updateUser(user.id, updateData);
+      
+      // If email was changed, show success message and auto-logout
+      if (isEmailChanged) {
+        setUpdateSuccess("Email changed successfully! You will be logged out for security reasons. Please log in again with your new email.");
+        
+        toast({
+          title: "Email changed successfully",
+          description: "You will be logged out for security reasons. Please log in again with your new email.",
+          variant: "default",
+        });
+        
+        // Auto-logout after 3 seconds
+        setTimeout(() => {
+          authService.logout();
+          navigate("/login");
+        }, 3000);
+      } else {
+        // Refresh user data in auth context for other field changes
+        await authService.refreshUserData();
+        
+        setUpdateSuccess("Your profile information has been updated successfully.");
+        toast({
+          title: "Profile updated",
+          description: "Your profile information has been updated successfully.",
+        });
+      }
+    } catch (error) {
+      console.error("Profile update error:", error);
+      
+      let errorMessage = "Failed to update profile. Please try again.";
+      if (error instanceof Error) {
+        errorMessage = error.message;
+      }
+      
+      setUpdateError(errorMessage);
+      
+      toast({
+        title: "Update failed",
+        description: errorMessage,
+        variant: "destructive",
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  }
+
+  return (
+    <Form {...form}>
+      <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-6">
+        {updateError && (
+          <Alert variant="destructive">
+            <AlertCircle className="h-4 w-4" />
+            <AlertDescription>{updateError}</AlertDescription>
+          </Alert>
+        )}
+        
+        {updateSuccess && (
+          <Alert className="bg-green-50 border-green-200 text-green-800">
+            <CheckCircle className="h-4 w-4 text-green-600" />
+            <AlertDescription>
+              {updateSuccess}
+            </AlertDescription>
+          </Alert>
+        )}
+
+        <FormField
+          control={form.control}
+          name="full_name"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Full Name</FormLabel>
+              <FormControl>
+                <Input placeholder="Your full name" {...field} />
+              </FormControl>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="username"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Username</FormLabel>
+              <FormControl>
+                <Input placeholder="Username" {...field} />
+              </FormControl>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="email"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Email</FormLabel>
+              <FormControl>
+                <Input type="email" placeholder="your.email@example.com" {...field} />
+              </FormControl>
+              <FormMessage />
+              {field.value !== user.email && (
+                <p className="text-xs text-muted-foreground mt-1">
+                  Changing your email will log you out for security reasons. You will need to log in again with your new email.
+                </p>
+              )}
+            </FormItem>
+          )}
+        />
+
+        <Button type="submit" disabled={isSubmitting}>
+          {isSubmitting ? "Saving..." : "Save Changes"}
+        </Button>
+      </form>
+    </Form>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/profile/UserProfileDetails.tsx b/application/src/components/profile/UserProfileDetails.tsx
new file mode 100644
index 0000000..be9465d
--- /dev/null
+++ b/application/src/components/profile/UserProfileDetails.tsx
@@ -0,0 +1,78 @@
+
+import { User } from "@/services/userService";
+import { Avatar, AvatarImage, AvatarFallback } from "@/components/ui/avatar";
+import { Badge } from "@/components/ui/badge";
+import { Mail, User as UserIcon } from "lucide-react";
+
+interface UserProfileDetailsProps {
+  user: User;
+}
+
+export function UserProfileDetails({ user }: UserProfileDetailsProps) {
+  // Format dates
+  const createdDate = new Date(user.created).toLocaleDateString();
+  
+  // Get avatar or initials
+  const getInitials = () => {
+    if (user.full_name) {
+      return user.full_name.split(' ')
+        .map(name => name[0])
+        .join('')
+        .toUpperCase();
+    }
+    return user.username[0].toUpperCase();
+  };
+
+  // Determine if the user is active based on the status field
+  const isActive = user.status === "Active";
+
+  return (
+    <div className="flex flex-col items-center space-y-4">
+      <Avatar className="h-32 w-32">
+        {user.avatar ? (
+          <AvatarImage src={user.avatar} alt={user.full_name || user.username} />
+        ) : (
+          <AvatarFallback className="text-3xl bg-primary/20 text-primary">
+            {getInitials()}
+          </AvatarFallback>
+        )}
+      </Avatar>
+
+      <div className="space-y-1 text-center">
+        <h2 className="text-xl font-bold">{user.full_name || user.username}</h2>
+        <div className="flex items-center justify-center text-sm text-muted-foreground gap-1">
+          <Mail className="h-3 w-3" />
+          <span>{user.email}</span>
+        </div>
+        <div className="flex items-center justify-center text-sm text-muted-foreground gap-1">
+          <UserIcon className="h-3 w-3" />
+          <span>@{user.username}</span>
+        </div>
+      </div>
+
+      <div className="w-full pt-2">
+        <div className="flex flex-wrap justify-center gap-2 pt-2">
+          {user.role && (
+            <Badge variant="secondary" className="px-2 py-1">
+              {user.role}
+            </Badge>
+          )}
+          <Badge variant={isActive ? "default" : "outline"} className="px-2 py-1">
+            {user.status || (isActive ? "Active" : "Inactive")}
+          </Badge>
+          {user.verified && (
+            <Badge className="bg-green-600 hover:bg-green-700 px-2 py-1">
+              Verified
+            </Badge>
+          )}
+        </div>
+
+        <div className="border-t border-border mt-4 pt-4">
+          <p className="text-sm text-muted-foreground">
+            Member since: {createdDate}
+          </p>
+        </div>
+      </div>
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/public/ComponentsStatusSection.tsx b/application/src/components/public/ComponentsStatusSection.tsx
new file mode 100644
index 0000000..0c063c6
--- /dev/null
+++ b/application/src/components/public/ComponentsStatusSection.tsx
@@ -0,0 +1,210 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card';
+import { Badge } from '@/components/ui/badge';
+import { Server, CheckCircle, XCircle, AlertTriangle, Pause, Clock } from 'lucide-react';
+import { StatusPageComponentRecord } from '@/types/statusPageComponents.types';
+import { Service, UptimeData } from '@/types/service.types';
+import { UptimeHistoryRenderer } from './UptimeHistoryRenderer';
+import { format } from 'date-fns';
+
+interface ComponentsStatusSectionProps {
+  components: StatusPageComponentRecord[];
+  services: Service[];
+  uptimeData: Record<string, UptimeData[]>;
+}
+
+export const ComponentsStatusSection = ({ components, services, uptimeData }: ComponentsStatusSectionProps) => {
+  const getServiceForComponent = (component: StatusPageComponentRecord) => {
+    return services.find(service => service.id === component.service_id);
+  };
+
+  const getComponentStatus = (component: StatusPageComponentRecord) => {
+    const service = getServiceForComponent(component);
+    return service?.status || 'unknown';
+  };
+
+  const getUptimePercentage = (serviceId: string) => {
+    const history = uptimeData[serviceId] || [];
+    if (history.length === 0) return 100;
+    
+    const upCount = history.filter(record => record.status === 'up').length;
+    return Math.round((upCount / history.length) * 100 * 100) / 100;
+  };
+
+  const getStatusIcon = (status: string) => {
+    switch (status) {
+      case 'up':
+        return <CheckCircle className="h-5 w-5 text-green-500" />;
+      case 'down':
+        return <XCircle className="h-5 w-5 text-red-500" />;
+      case 'warning':
+        return <AlertTriangle className="h-5 w-5 text-yellow-500" />;
+      case 'paused':
+        return <Pause className="h-5 w-5 text-gray-500" />;
+      default:
+        return <Server className="h-5 w-5 text-muted-foreground" />;
+    }
+  };
+
+  const getStatusBadge = (status: string) => {
+    switch (status) {
+      case 'up':
+        return (
+          <Badge className="bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200 border-green-200 dark:border-green-800">
+            <CheckCircle className="h-3 w-3 mr-1" />
+            Operational
+          </Badge>
+        );
+      case 'down':
+        return (
+          <Badge className="bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200 border-red-200 dark:border-red-800">
+            <XCircle className="h-3 w-3 mr-1" />
+            Down
+          </Badge>
+        );
+      case 'warning':
+        return (
+          <Badge className="bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-200 border-yellow-200 dark:border-yellow-800">
+            <AlertTriangle className="h-3 w-3 mr-1" />
+            Degraded
+          </Badge>
+        );
+      case 'paused':
+        return (
+          <Badge className="bg-gray-100 text-gray-800 dark:bg-gray-900 dark:text-gray-200 border-gray-200 dark:border-gray-800">
+            <Pause className="h-3 w-3 mr-1" />
+            Maintenance
+          </Badge>
+        );
+      default:
+        return (
+          <Badge className="bg-gray-100 text-gray-800 dark:bg-gray-900 dark:text-gray-200">
+            Unknown
+          </Badge>
+        );
+    }
+  };
+
+  const getStatusDotColor = (status: string) => {
+    switch (status) {
+      case 'up':
+        return 'bg-green-500';
+      case 'down':
+        return 'bg-red-500';
+      case 'warning':
+        return 'bg-yellow-500';
+      default:
+        return 'bg-gray-500';
+    }
+  };
+
+  if (components.length === 0) {
+    return (
+      <Card className="mb-8 bg-card border-border">
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2 text-card-foreground">
+            <Server className="h-5 w-5" />
+            System Components
+          </CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="space-y-4">
+            {[
+              { name: 'API Services', description: 'Core API endpoints and services', status: 'up' },
+              { name: 'Database', description: 'Primary database systems', status: 'up' },
+              { name: 'Authentication', description: 'User authentication services', status: 'up' },
+              { name: 'File Storage', description: 'Media and file hosting', status: 'up' }
+            ].map((component, index) => (
+              <div key={index} className="flex items-center justify-between p-4 rounded-lg border border-border bg-background/50 hover:bg-background/80 transition-colors">
+                <div className="flex items-center gap-3">
+                  {getStatusIcon(component.status)}
+                  <div>
+                    <h3 className="font-medium text-foreground">{component.name}</h3>
+                    <p className="text-sm text-muted-foreground">{component.description}</p>
+                    <div className="flex items-center gap-2 mt-1">
+                      <span className="text-xs text-green-600 dark:text-green-400 font-medium">99.9% uptime</span>
+                      <span className="text-xs text-muted-foreground">•</span>
+                      <span className="text-xs text-muted-foreground">100ms response</span>
+                    </div>
+                  </div>
+                </div>
+                {getStatusBadge(component.status)}
+              </div>
+            ))}
+          </div>
+        </CardContent>
+      </Card>
+    );
+  }
+
+  return (
+    <Card className="mb-8 bg-card border-border">
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2 text-card-foreground">
+          <Server className="h-5 w-5" />
+          System Components
+        </CardTitle>
+        <p className="text-sm text-muted-foreground">
+          Real-time status of all monitored components
+        </p>
+      </CardHeader>
+      <CardContent>
+        <div className="space-y-6">
+          {components
+            .sort((a, b) => a.display_order - b.display_order)
+            .map((component) => {
+              const service = getServiceForComponent(component);
+              const status = getComponentStatus(component);
+              const uptime = service?.id ? getUptimePercentage(component.service_id) : 100;
+              
+              return (
+                <div key={component.id} className="space-y-4">
+                  <div className="flex items-center justify-between p-5 rounded-lg border border-border bg-background/50 hover:bg-background/80 transition-all duration-200">
+                    <div className="flex items-center gap-4">
+                      {getStatusIcon(status)}
+                      <div className="flex-1">
+                        <div className="flex items-center gap-2 mb-1">
+                          <h3 className="font-semibold text-foreground text-lg">{component.name}</h3>
+                          {service?.responseTime && service.responseTime > 0 && (
+                            <div className="flex items-center gap-1 text-xs text-muted-foreground bg-muted px-2 py-1 rounded">
+                              <Clock className="h-3 w-3" />
+                              {service.responseTime}ms
+                            </div>
+                          )}
+                        </div>
+                        {component.description && (
+                          <p className="text-sm text-muted-foreground mb-2">{component.description}</p>
+                        )}
+                        <div className="flex items-center gap-4 text-xs text-muted-foreground">
+                          <div className="flex items-center gap-2">
+                            <div className={`h-2 w-2 rounded-full ${getStatusDotColor(status)}`}></div>
+                            <span className="font-medium">{uptime}% uptime (90 days)</span>
+                          </div>
+                          {service?.lastChecked && (
+                            <span>Last checked: {format(new Date(service.lastChecked), 'HH:mm:ss')}</span>
+                          )}
+                        </div>
+                      </div>
+                    </div>
+                    <div className="flex flex-col items-end gap-2">
+                      {getStatusBadge(status)}
+                    </div>
+                  </div>
+                  
+                  {component.service_id && (
+                    <div className="ml-9">
+                      <div className="text-xs text-muted-foreground mb-2">90-day uptime history</div>
+                      <UptimeHistoryRenderer 
+                        serviceId={component.service_id} 
+                        uptimeData={uptimeData} 
+                      />
+                    </div>
+                  )}
+                </div>
+              );
+            })}
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/public/CurrentStatusSection.tsx b/application/src/components/public/CurrentStatusSection.tsx
new file mode 100644
index 0000000..d93f5fd
--- /dev/null
+++ b/application/src/components/public/CurrentStatusSection.tsx
@@ -0,0 +1,160 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card';
+import { Shield, Clock, CheckCircle, AlertTriangle, XCircle, Wrench } from 'lucide-react';
+import { format } from 'date-fns';
+import { OperationalPageRecord } from '@/types/operational.types';
+import { StatusPageComponentRecord } from '@/types/statusPageComponents.types';
+import { Service } from '@/types/service.types';
+import { useLanguage } from '@/contexts/LanguageContext';
+
+interface CurrentStatusSectionProps {
+  page: OperationalPageRecord;
+  components: StatusPageComponentRecord[];
+  services: Service[];
+}
+
+const getActualStatus = (components: StatusPageComponentRecord[], services: Service[]) => {
+  if (components.length === 0) {
+    return 'operational'; // Default if no components
+  }
+
+  let hasDown = false;
+  let hasDegraded = false;
+  let hasMaintenance = false;
+
+  components.forEach(component => {
+    const service = services.find(s => s.id === component.service_id);
+    if (service) {
+      switch (service.status) {
+        case 'down':
+          hasDown = true;
+          break;
+        case 'warning':
+          hasDegraded = true;
+          break;
+        case 'paused':
+          hasMaintenance = true;
+          break;
+      }
+    }
+  });
+
+  // Priority: down > degraded > maintenance > operational
+  if (hasDown) return 'major_outage';
+  if (hasDegraded) return 'degraded';
+  if (hasMaintenance) return 'maintenance';
+  return 'operational';
+};
+
+const getStatusMessage = (status: OperationalPageRecord['status'], t: (k: string, m?: string) => string) => {
+  switch (status) {
+    case 'operational':
+      return t('allOperational', 'public');
+    case 'degraded':
+      return t('degradedPerformance', 'public');
+    case 'maintenance':
+      return t('underMaintenance', 'public');
+    case 'major_outage':
+      return t('majorOutage', 'public');
+    default:
+      return t('statusUnknown', 'public');
+  }
+};
+
+const getStatusColor = (status: OperationalPageRecord['status']) => {
+  switch (status) {
+    case 'operational':
+      return 'text-green-600 dark:text-green-400';
+    case 'degraded':
+      return 'text-yellow-600 dark:text-yellow-400';
+    case 'maintenance':
+      return 'text-blue-600 dark:text-blue-400';
+    case 'major_outage':
+      return 'text-red-600 dark:text-red-400';
+    default:
+      return 'text-muted-foreground';
+  }
+};
+
+const getStatusIcon = (status: OperationalPageRecord['status']) => {
+  switch (status) {
+    case 'operational':
+      return <CheckCircle className="h-6 w-6 text-green-500" />;
+    case 'degraded':
+      return <AlertTriangle className="h-6 w-6 text-yellow-500" />;
+    case 'maintenance':
+      return <Wrench className="h-6 w-6 text-blue-500" />;
+    case 'major_outage':
+      return <XCircle className="h-6 w-6 text-red-500" />;
+    default:
+      return <Shield className="h-6 w-6 text-muted-foreground" />;
+  }
+};
+
+const getStatusBackground = (status: OperationalPageRecord['status']) => {
+  switch (status) {
+    case 'operational':
+      return 'bg-green-50 dark:bg-green-900/20 border-green-200 dark:border-green-800';
+    case 'degraded':
+      return 'bg-yellow-50 dark:bg-yellow-900/20 border-yellow-200 dark:border-yellow-800';
+    case 'maintenance':
+      return 'bg-blue-50 dark:bg-blue-900/20 border-blue-200 dark:border-blue-800';
+    case 'major_outage':
+      return 'bg-red-50 dark:bg-red-900/20 border-red-200 dark:border-red-800';
+    default:
+      return 'bg-gray-50 dark:bg-gray-900/20 border-gray-200 dark:border-gray-800';
+  }
+};
+
+export const CurrentStatusSection = ({ page, components, services }: CurrentStatusSectionProps) => {
+  const { t } = useLanguage();
+  const actualStatus = getActualStatus(components, services);
+  const displayStatus = actualStatus; // Use actual status for real-time accuracy
+  
+  return (
+    <Card className={`mb-8 border-2 ${getStatusBackground(displayStatus)}`}>
+      <CardHeader>
+        <CardTitle className="flex items-center gap-3 text-card-foreground text-xl">
+          <Shield className="h-6 w-6" />
+          {t('systemStatus', 'public')}
+        </CardTitle>
+      </CardHeader>
+      <CardContent className="space-y-6">
+        <div className={`flex items-center justify-between p-6 rounded-lg border-2 ${getStatusBackground(displayStatus)}`}>
+          <div className="flex items-center gap-4">
+            {getStatusIcon(displayStatus)}
+            <div>
+              <h3 className={`text-2xl font-bold ${getStatusColor(displayStatus)}`}>
+                {getStatusMessage(displayStatus, t)}
+              </h3>
+              <p className="text-sm text-muted-foreground mt-1">
+                {t('autoUpdatedByHealth', 'public')}
+              </p>
+            </div>
+          </div>
+          <div className={`px-4 py-2 rounded-full text-sm font-medium ${
+            displayStatus === 'operational' ? 'bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200' :
+            displayStatus === 'degraded' ? 'bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-200' :
+            displayStatus === 'maintenance' ? 'bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-200' :
+            'bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200'
+          }`}>
+            {displayStatus === 'operational' ? t('allOperational', 'public') :
+             displayStatus === 'degraded' ? t('degradedPerformance', 'public') :
+             displayStatus === 'maintenance' ? t('underMaintenance', 'public') : t('majorOutage', 'public')}
+          </div>
+        </div>
+        
+        <div className="flex items-center justify-between text-sm text-muted-foreground border-t pt-4">
+          <div className="flex items-center gap-2">
+            <Clock className="h-4 w-4" />
+            <span>{t('lastUpdatedAt', 'public', { time: format(new Date(), 'MMM dd, yyyy HH:mm') })}</span>
+          </div>
+          <div className="flex items-center gap-2">
+            <div className="h-2 w-2 bg-green-500 rounded-full animate-pulse"></div>
+            <span>{t('liveStatusMonitoring', 'public')}</span>
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/public/OverallUptimeSection.tsx b/application/src/components/public/OverallUptimeSection.tsx
new file mode 100644
index 0000000..2cf8f6c
--- /dev/null
+++ b/application/src/components/public/OverallUptimeSection.tsx
@@ -0,0 +1,197 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card';
+import { Badge } from '@/components/ui/badge';
+import { TrendingUp, Calendar, BarChart3 } from 'lucide-react';
+import { UptimeData } from '@/types/service.types';
+import { UptimeHistoryRenderer } from './UptimeHistoryRenderer';
+
+interface OverallUptimeSectionProps {
+  uptimeData: Record<string, UptimeData[]>;
+}
+
+export const OverallUptimeSection = ({ uptimeData }: OverallUptimeSectionProps) => {
+  const getOverallUptime = () => {
+    const allHistories = Object.values(uptimeData);
+    if (allHistories.length === 0) return 99.9;
+    
+    let totalRecords = 0;
+    let upRecords = 0;
+    
+    allHistories.forEach(history => {
+      totalRecords += history.length;
+      upRecords += history.filter(record => record.status === 'up').length;
+    });
+    
+    if (totalRecords === 0) return 99.9;
+    return Math.round((upRecords / totalRecords) * 100 * 100) / 100;
+  };
+
+  const getUptimeTrend = () => {
+    const uptime = getOverallUptime();
+    if (uptime >= 99.9) return 'excellent';
+    if (uptime >= 99.5) return 'good';
+    if (uptime >= 95) return 'fair';
+    return 'poor';
+  };
+
+  const getIncidentCount = () => {
+    const allHistories = Object.values(uptimeData);
+    let incidents = 0;
+    
+    allHistories.forEach(history => {
+      let wasDown = false;
+      history.forEach(record => {
+        if (record.status === 'down' && !wasDown) {
+          incidents++;
+          wasDown = true;
+        } else if (record.status === 'up') {
+          wasDown = false;
+        }
+      });
+    });
+    
+    return incidents;
+  };
+
+  const getBadgeClassName = (trend: string) => {
+    switch (trend) {
+      case 'excellent':
+        return 'bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200';
+      case 'good':
+        return 'bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-200';
+      case 'fair':
+        return 'bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-200';
+      default:
+        return 'bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200';
+    }
+  };
+
+  const getTrendText = (trend: string) => {
+    switch (trend) {
+      case 'excellent':
+        return 'Excellent';
+      case 'good':
+        return 'Good';
+      case 'fair':
+        return 'Fair';
+      default:
+        return 'Needs Improvement';
+    }
+  };
+
+  const getStatusMessage = (uptime: number) => {
+    if (uptime >= 99.9) {
+      return "All systems are performing excellently with minimal downtime.";
+    } else if (uptime >= 99.5) {
+      return "Systems are performing well with occasional minor issues.";
+    } else if (uptime >= 95) {
+      return "We're working to improve system reliability and reduce incidents.";
+    } else {
+      return "We apologize for recent service disruptions and are actively working on improvements.";
+    }
+  };
+
+  const overallUptime = getOverallUptime();
+  const trend = getUptimeTrend();
+  const incidentCount = getIncidentCount();
+
+  return (
+    <Card className="mb-8 bg-card border-border">
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2 text-card-foreground">
+          <BarChart3 className="h-5 w-5" />
+          Performance Metrics (Last 90 Days)
+        </CardTitle>
+        <p className="text-sm text-muted-foreground">
+          Historical performance and reliability statistics
+        </p>
+      </CardHeader>
+      <CardContent className="space-y-6">
+        <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+          <div className="p-4 rounded-lg bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800">
+            <div className="flex items-center justify-between mb-2">
+              <div className="flex items-center gap-2">
+                <TrendingUp className="h-4 w-4 text-green-600 dark:text-green-400" />
+                <span className="text-sm font-medium text-green-700 dark:text-green-300">Overall Uptime</span>
+              </div>
+              <Badge className={getBadgeClassName(trend)}>
+                {getTrendText(trend)}
+              </Badge>
+            </div>
+            <div className="text-3xl font-bold text-green-600 dark:text-green-400">{overallUptime}%</div>
+            <div className="text-xs text-green-700 dark:text-green-300 mt-1">
+              Target: 99.9%
+            </div>
+          </div>
+
+          <div className="p-4 rounded-lg bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800">
+            <div className="flex items-center gap-2 mb-2">
+              <Calendar className="h-4 w-4 text-blue-600 dark:text-blue-400" />
+              <span className="text-sm font-medium text-blue-700 dark:text-blue-300">Incidents</span>
+            </div>
+            <div className="text-3xl font-bold text-blue-600 dark:text-blue-400">{incidentCount}</div>
+            <div className="text-xs text-blue-700 dark:text-blue-300 mt-1">
+              Last 90 days
+            </div>
+          </div>
+
+          <div className="p-4 rounded-lg bg-purple-50 dark:bg-purple-900/20 border border-purple-200 dark:border-purple-800">
+            <div className="flex items-center gap-2 mb-2">
+              <BarChart3 className="h-4 w-4 text-purple-600 dark:text-purple-400" />
+              <span className="text-sm font-medium text-purple-700 dark:text-purple-300">Avg Response</span>
+            </div>
+            <div className="text-3xl font-bold text-purple-600 dark:text-purple-400">100ms</div>
+            <div className="text-xs text-purple-700 dark:text-purple-300 mt-1">
+              Response time
+            </div>
+          </div>
+        </div>
+
+        <div className="space-y-3">
+          <div className="flex items-center justify-between">
+            <h4 className="text-sm font-medium text-foreground">Uptime History</h4>
+            <div className="flex items-center gap-4 text-xs text-muted-foreground">
+              <div className="flex items-center gap-2">
+                <div className="h-3 w-3 bg-green-500 rounded"></div>
+                <span>Operational</span>
+              </div>
+              <div className="flex items-center gap-2">
+                <div className="h-3 w-3 bg-yellow-500 rounded"></div>
+                <span>Degraded</span>
+              </div>
+              <div className="flex items-center gap-2">
+                <div className="h-3 w-3 bg-red-500 rounded"></div>
+                <span>Down</span>
+              </div>
+            </div>
+          </div>
+          
+          <div className="p-4 bg-background/50 rounded-lg border">
+            {Object.keys(uptimeData).length > 0 ? (
+              <UptimeHistoryRenderer serviceId={Object.keys(uptimeData)[0]} uptimeData={uptimeData} />
+            ) : (
+              <div className="flex justify-center items-center h-12 text-muted-foreground">
+                <div className="flex gap-1">
+                  {Array.from({ length: 90 }, (_, i) => (
+                    <div key={i} className="h-8 w-1 bg-green-500 rounded-sm"></div>
+                  ))}
+                </div>
+              </div>
+            )}
+          </div>
+          
+          <div className="flex justify-between text-xs text-muted-foreground">
+            <span>90 days ago</span>
+            <span>Today</span>
+          </div>
+        </div>
+
+        <div className="p-4 bg-muted/50 rounded-lg border">
+          <div className="text-sm text-muted-foreground text-center">
+            {getStatusMessage(overallUptime)}
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/public/PublicStatusPage.tsx b/application/src/components/public/PublicStatusPage.tsx
new file mode 100644
index 0000000..a9ba99b
--- /dev/null
+++ b/application/src/components/public/PublicStatusPage.tsx
@@ -0,0 +1,131 @@
+
+import { useState, useEffect } from 'react';
+import { useParams } from 'react-router-dom';
+import { Button } from '@/components/ui/button';
+import { RefreshCw, AlertCircle } from 'lucide-react';
+import { usePublicStatusPageData } from './hooks/usePublicStatusPageData';
+import { StatusPageHeader } from './StatusPageHeader';
+import { CurrentStatusSection } from './CurrentStatusSection';
+import { ComponentsStatusSection } from './ComponentsStatusSection';
+import { OverallUptimeSection } from './OverallUptimeSection';
+import { PublicStatusPageFooter } from './PublicStatusPageFooter';
+import { useLanguage } from '@/contexts/LanguageContext';
+
+export const PublicStatusPage = () => {
+  const { t } = useLanguage();
+  const { slug } = useParams<{ slug: string }>();
+//  console.log('PublicStatusPage - slug from params:', slug);
+  
+  const { page, components, services, uptimeData, loading, error } = usePublicStatusPageData(slug);
+  const [lastUpdated, setLastUpdated] = useState(new Date());
+
+  // Auto-refresh every 30 seconds
+  useEffect(() => {
+    const interval = setInterval(() => {
+      setLastUpdated(new Date());
+      // The usePublicStatusPageData hook handles data refetching
+    }, 30000);
+
+    return () => clearInterval(interval);
+  }, []);
+
+  // Apply theme to document
+  useEffect(() => {
+    if (page) {
+      const root = document.documentElement;
+      
+      // Remove any existing theme classes
+      root.classList.remove('dark', 'light');
+      
+      // Apply the selected theme
+      if (page.theme === 'dark') {
+        root.classList.add('dark');
+      } else if (page.theme === 'light') {
+        root.classList.add('light');
+      }
+      // For 'default' theme, don't add any class (uses system preference)
+    }
+    
+    // Cleanup on unmount
+    return () => {
+      const root = document.documentElement;
+      root.classList.remove('dark', 'light');
+    };
+  }, [page?.theme]);
+
+ // console.log('PublicStatusPage state:', { loading, error, page: !!page, components: components.length, services: services.length });
+
+  if (loading) {
+    return (
+      <div className="min-h-screen bg-background flex items-center justify-center">
+        <div className="text-center space-y-4">
+          <div className="animate-spin rounded-full h-12 w-12 border-b-2 border-primary mx-auto"></div>
+          <div className="space-y-2">
+            <p className="text-lg font-medium text-foreground">{t('loadingStatusPage', 'public')}</p>
+            <p className="text-sm text-muted-foreground">{t('fetchingRealtimeStatus', 'public')}</p>
+            <p className="text-xs text-muted-foreground">{t('slugLabel', 'public')}: {slug || 'No slug provided'}</p>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
+  if (error || !page) {
+    return (
+      <div className="min-h-screen bg-background flex items-center justify-center">
+        <div className="text-center space-y-6 max-w-md">
+          <div className="mx-auto h-16 w-16 bg-red-100 dark:bg-red-900/20 rounded-full flex items-center justify-center">
+            <AlertCircle className="h-8 w-8 text-red-600 dark:text-red-400" />
+          </div>
+          <div className="space-y-2">
+            <h1 className="text-2xl font-bold text-foreground">{t('statusPageNotFound', 'public')}</h1>
+            <p className="text-muted-foreground">
+              {error || t('notFoundDescription', 'public')}
+            </p>
+            <p className="text-xs text-muted-foreground">{t('slugLabel', 'public')}: {slug || 'No slug provided'}</p>
+          </div>
+          <div className="flex gap-3 justify-center">
+            <Button onClick={() => window.history.back()} variant="outline">
+              {t('goBack', 'public')}
+            </Button>
+            <Button onClick={() => window.location.reload()} className="gap-2">
+              <RefreshCw className="h-4 w-4" />
+              {t('retry', 'public')}
+            </Button>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="min-h-screen bg-background text-foreground">
+      {/* Header */}
+      <StatusPageHeader page={page} />
+
+      {/* Main Content */}
+      <main className="max-w-4xl mx-auto px-4 py-8">
+        {/* Current Status */}
+        <CurrentStatusSection page={page} components={components} services={services} />
+
+        {/* Components Status */}
+        <ComponentsStatusSection 
+          components={components} 
+          services={services} 
+          uptimeData={uptimeData} 
+        />
+
+        {/* Overall Uptime History */}
+        <OverallUptimeSection uptimeData={uptimeData} />
+
+        {/* Footer */}
+        <PublicStatusPageFooter page={page} />
+      </main>
+
+      {/* Custom CSS */}
+      {page.custom_css && (
+        <style dangerouslySetInnerHTML={{ __html: page.custom_css }} />
+      )}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/public/PublicStatusPageFooter.tsx b/application/src/components/public/PublicStatusPageFooter.tsx
new file mode 100644
index 0000000..785bb8a
--- /dev/null
+++ b/application/src/components/public/PublicStatusPageFooter.tsx
@@ -0,0 +1,86 @@
+
+import { OperationalPageRecord } from '@/types/operational.types';
+import { format } from 'date-fns';
+import { Clock, Shield, Zap, RefreshCw } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+
+interface PublicStatusPageFooterProps {
+  page: OperationalPageRecord;
+}
+
+export const PublicStatusPageFooter = ({ page }: PublicStatusPageFooterProps) => {
+  const handleRefresh = () => {
+    window.location.reload();
+  };
+
+  return (
+    <footer className="mt-12 pt-8 border-t border-border">
+      <div className="space-y-6">
+        {/* Status Information */}
+        <div className="grid grid-cols-1 md:grid-cols-3 gap-6 p-6 bg-muted/30 rounded-lg border">
+          <div className="flex items-center gap-3">
+            <div className="h-10 w-10 bg-green-500/10 rounded-lg flex items-center justify-center">
+              <Shield className="h-5 w-5 text-green-600 dark:text-green-400" />
+            </div>
+            <div>
+              <div className="font-medium text-foreground">Real-time Monitoring</div>
+              <div className="text-sm text-muted-foreground">24/7 automated checks</div>
+            </div>
+          </div>
+          
+          <div className="flex items-center gap-3">
+            <div className="h-10 w-10 bg-blue-500/10 rounded-lg flex items-center justify-center">
+              <Zap className="h-5 w-5 text-blue-600 dark:text-blue-400" />
+            </div>
+            <div>
+              <div className="font-medium text-foreground">Instant Updates</div>
+              <div className="text-sm text-muted-foreground">Status changes in real-time</div>
+            </div>
+          </div>
+          
+          <div className="flex items-center gap-3">
+            <div className="h-10 w-10 bg-purple-500/10 rounded-lg flex items-center justify-center">
+              <Clock className="h-5 w-5 text-purple-600 dark:text-purple-400" />
+            </div>
+            <div>
+              <div className="font-medium text-foreground">Historical Data</div>
+              <div className="text-sm text-muted-foreground">90-day performance history</div>
+            </div>
+          </div>
+        </div>
+
+        {/* Actions */}
+        <div className="flex items-center justify-between">
+          <div className="flex items-center gap-4 text-sm text-muted-foreground">
+            <div className="flex items-center gap-2">
+              <Clock className="h-4 w-4" />
+              <span>Last updated: {format(new Date(), 'MMM dd, yyyy HH:mm:ss')} UTC</span>
+            </div>
+            <div className="flex items-center gap-2">
+              <div className="h-2 w-2 bg-green-500 rounded-full animate-pulse"></div>
+              <span>Monitoring active</span>
+            </div>
+          </div>
+          
+          <Button variant="outline" size="sm" onClick={handleRefresh} className="gap-2">
+            <RefreshCw className="h-4 w-4" />
+            Refresh Status
+          </Button>
+        </div>
+
+        {/* Disclaimer */}
+        <div className="text-center text-xs text-muted-foreground p-4 bg-muted/20 rounded-lg">
+          <p>
+            This status page provides real-time information about our systems and services. 
+            Historical data reflects the last 90 days of monitoring. For support inquiries, please contact our team.
+          </p>
+          {page.custom_domain && (
+            <p className="mt-2">
+              Powered by automated monitoring • Status page for {page.title}
+            </p>
+          )}
+        </div>
+      </div>
+    </footer>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/public/StatusPageHeader.tsx b/application/src/components/public/StatusPageHeader.tsx
new file mode 100644
index 0000000..76d758c
--- /dev/null
+++ b/application/src/components/public/StatusPageHeader.tsx
@@ -0,0 +1,71 @@
+
+import { OperationalPageRecord } from '@/types/operational.types';
+import { Shield, Globe, ExternalLink } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+
+interface StatusPageHeaderProps {
+  page: OperationalPageRecord;
+}
+
+export const StatusPageHeader = ({ page }: StatusPageHeaderProps) => {
+  return (
+    <header className="bg-background border-b border-border">
+      <div className="max-w-4xl mx-auto px-4 py-8">
+        <div className="flex items-center justify-between">
+          <div className="flex items-center gap-4">
+            {page.logo_url ? (
+              <img 
+                src={page.logo_url} 
+                alt={`${page.title} logo`}
+                className="h-12 w-12 rounded-lg object-cover"
+              />
+            ) : (
+              <div className="h-12 w-12 bg-primary/10 rounded-lg flex items-center justify-center">
+                <Shield className="h-6 w-6 text-primary" />
+              </div>
+            )}
+            <div>
+              <h1 className="text-3xl font-bold text-foreground">{page.title}</h1>
+              <p className="text-muted-foreground mt-1">{page.description}</p>
+            </div>
+          </div>
+          
+          <div className="flex items-center gap-3">
+            {page.custom_domain && (
+              <Button variant="outline" size="sm" asChild>
+                <a 
+                  href={`https://${page.custom_domain}`}
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="flex items-center gap-2"
+                >
+                  <Globe className="h-4 w-4" />
+                  Visit Site
+                  <ExternalLink className="h-3 w-3" />
+                </a>
+              </Button>
+            )}
+            
+            <div className="text-right text-sm text-muted-foreground">
+              <div className="flex items-center gap-1">
+                <div className="h-2 w-2 bg-green-500 rounded-full animate-pulse"></div>
+                <span className="font-medium">Live Status</span>
+              </div>
+              <div className="text-xs">
+                Auto-updated every 30s
+              </div>
+            </div>
+          </div>
+        </div>
+        
+        {/* Breadcrumb */}
+        <div className="mt-6 flex items-center gap-2 text-sm text-muted-foreground">
+          <Shield className="h-4 w-4" />
+          <span>Status Page</span>
+          <span>•</span>
+          <span className="text-foreground font-medium">{page.title}</span>
+        </div>
+      </div>
+    </header>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/public/UptimeHistoryRenderer.tsx b/application/src/components/public/UptimeHistoryRenderer.tsx
new file mode 100644
index 0000000..8980fa1
--- /dev/null
+++ b/application/src/components/public/UptimeHistoryRenderer.tsx
@@ -0,0 +1,182 @@
+import { TooltipProvider, Tooltip, TooltipTrigger, TooltipContent } from '@/components/ui/tooltip';
+import { format } from 'date-fns';
+import { UptimeData } from '@/types/service.types';
+
+interface UptimeHistoryRendererProps {
+  serviceId: string;
+  uptimeData: Record<string, UptimeData[]>;
+}
+
+export const UptimeHistoryRenderer = ({ serviceId, uptimeData }: UptimeHistoryRendererProps) => {
+  const renderUptimeHistory = (serviceId: string) => {
+    const history = uptimeData[serviceId] || [];
+    
+    // Generate array for the last 90 days
+    const days = Array.from({ length: 90 }, (_, i) => {
+      const daysSinceToday = 90 - i - 1;
+      const date = new Date();
+      date.setDate(date.getDate() - daysSinceToday);
+      date.setHours(0, 0, 0, 0); // Set to start of day for comparison
+      return date;
+    });
+
+    if (history.length === 0) {
+      // Generate mock data if no real data - showing mostly operational with some realistic incidents
+      return days.map((date, i) => {
+        // Simulate some realistic patterns - mostly up with occasional incidents
+        const isUp = Math.random() > 0.02; // 98% uptime simulation
+        const responseTime = isUp ? Math.floor(Math.random() * 200) + 50 : 0;
+        
+        return (
+          <TooltipProvider key={i}>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <div
+                  className={`h-8 w-1 rounded-sm cursor-pointer ${
+                    isUp ? 'bg-green-500 hover:bg-green-600' : 'bg-red-500 hover:bg-red-600'
+                  }`}
+                />
+              </TooltipTrigger>
+              <TooltipContent>
+                <div className="text-sm">
+                  <div className="font-medium">{format(date, 'MMM dd, yyyy')}</div>
+                  <div className="text-muted-foreground">
+                    Status: {isUp ? 'Operational' : 'Incident - Down'}
+                  </div>
+                  {isUp && (
+                    <div className="text-muted-foreground">
+                      Response: {responseTime}ms
+                    </div>
+                  )}
+                  {!isUp && (
+                    <div className="text-muted-foreground text-red-400">
+                      Service outage detected
+                    </div>
+                  )}
+                </div>
+              </TooltipContent>
+            </Tooltip>
+          </TooltipProvider>
+        );
+      });
+    }
+
+    // Create a map of dates to status records for efficient lookup and incident tracking
+    const dateToRecordMap = new Map();
+    const incidentsByDate = new Map();
+    
+    history.forEach(record => {
+      const recordDate = new Date(record.timestamp);
+      recordDate.setHours(0, 0, 0, 0); // Normalize to start of day
+      const dateKey = recordDate.toDateString();
+      
+      // Track incidents for this date
+      if (!incidentsByDate.has(dateKey)) {
+        incidentsByDate.set(dateKey, []);
+      }
+      incidentsByDate.get(dateKey).push(record);
+      
+      // Keep the latest record for each day (or aggregate if needed)
+      if (!dateToRecordMap.has(dateKey) || 
+          new Date(record.timestamp) > new Date(dateToRecordMap.get(dateKey).timestamp)) {
+        dateToRecordMap.set(dateKey, record);
+      }
+    });
+
+    // Use real uptime data mapped to the correct days with incident details
+    return days.map((date, i) => {
+      const dateKey = date.toDateString();
+      const record = dateToRecordMap.get(dateKey);
+      const incidents = incidentsByDate.get(dateKey) || [];
+      
+      // Calculate uptime percentage for the day
+      const uptimePercentage = incidents.length > 0 ? 
+        Math.round((incidents.filter(inc => inc.status === 'up').length / incidents.length) * 100) : 100;
+      
+      // Determine color based on actual status and incident history
+      const getStatusColor = (status: string, incidents: UptimeData[]) => {
+        const downIncidents = incidents.filter(inc => inc.status === 'down').length;
+        const warningIncidents = incidents.filter(inc => inc.status === 'warning').length;
+        
+        if (downIncidents > 0) return 'bg-red-500 hover:bg-red-600';
+        if (warningIncidents > 0) return 'bg-yellow-500 hover:bg-yellow-600';
+        
+        switch (status) {
+          case 'up':
+            return 'bg-green-500 hover:bg-green-600';
+          case 'down':
+            return 'bg-red-500 hover:bg-red-600';
+          case 'paused':
+            return 'bg-gray-400 hover:bg-gray-500';
+          case 'warning':
+            return 'bg-yellow-500 hover:bg-yellow-600';
+          default:
+            return 'bg-gray-300 hover:bg-gray-400 dark:bg-gray-600 dark:hover:bg-gray-500';
+        }
+      };
+
+      const statusColor = record ? getStatusColor(record.status, incidents) : 'bg-gray-300 dark:bg-gray-600';
+      const statusText = record ? 
+        record.status === 'up' ? (incidents.some(inc => inc.status === 'down') ? 'Recovered' : 'Operational') :
+        record.status === 'down' ? 'Incident - Down' :
+        record.status === 'paused' ? 'Paused' :
+        record.status === 'warning' ? 'Incident - Degraded' : 'Unknown'
+        : 'No Data';
+      
+      return (
+        <TooltipProvider key={i}>
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <div
+                className={`h-8 w-1 rounded-sm cursor-pointer ${statusColor}`}
+              />
+            </TooltipTrigger>
+            <TooltipContent>
+              <div className="text-sm">
+                <div className="font-medium">
+                  {format(date, 'MMM dd, yyyy')}
+                </div>
+                <div className="text-muted-foreground">
+                  Status: {statusText}
+                </div>
+                {incidents.length > 0 && (
+                  <div className="text-muted-foreground">
+                    Uptime: {uptimePercentage}% ({incidents.length} checks)
+                  </div>
+                )}
+                {incidents.filter(inc => inc.status === 'down').length > 0 && (
+                  <div className="text-red-400 text-xs">
+                    {incidents.filter(inc => inc.status === 'down').length} incident(s) detected
+                  </div>
+                )}
+                {record && record.status === 'up' && record.responseTime > 0 && (
+                  <div className="text-muted-foreground">
+                    Response: {record.responseTime}ms
+                  </div>
+                )}
+                {record && (
+                  <div className="text-muted-foreground">
+                    Last Check: {format(new Date(record.timestamp), 'HH:mm')}
+                  </div>
+                )}
+              </div>
+            </TooltipContent>
+          </Tooltip>
+        </TooltipProvider>
+      );
+    });
+  };
+
+  return (
+    <div className="ml-8 p-3 bg-background/30 rounded-lg border border-border/50">
+      <div className="text-sm font-medium text-foreground mb-2">90-day uptime history</div>
+      <div className="flex items-center gap-1 mb-2">
+        {renderUptimeHistory(serviceId)}
+      </div>
+      <div className="flex justify-between text-xs text-muted-foreground">
+        <span>90 days ago</span>
+        <span>Today</span>
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/public/hooks/usePublicStatusPageData.ts b/application/src/components/public/hooks/usePublicStatusPageData.ts
new file mode 100644
index 0000000..a92e85b
--- /dev/null
+++ b/application/src/components/public/hooks/usePublicStatusPageData.ts
@@ -0,0 +1,110 @@
+
+import { useState, useEffect } from 'react';
+import { OperationalPageRecord } from '@/types/operational.types';
+import { StatusPageComponentRecord } from '@/types/statusPageComponents.types';
+import { Service, UptimeData } from '@/types/service.types';
+import { operationalPageService } from '@/services/operationalPageService';
+import { statusPageComponentsService } from '@/services/statusPageComponentsService';
+import { serviceService } from '@/services/serviceService';
+import { uptimeService } from '@/services/uptimeService';
+
+export const usePublicStatusPageData = (slug: string | undefined) => {
+  const [page, setPage] = useState<OperationalPageRecord | null>(null);
+  const [components, setComponents] = useState<StatusPageComponentRecord[]>([]);
+  const [services, setServices] = useState<Service[]>([]);
+  const [uptimeData, setUptimeData] = useState<Record<string, UptimeData[]>>({});
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    const fetchPublicPage = async () => {
+      if (!slug) {
+      //  console.log('No slug provided');
+        setError('No status page slug provided');
+        setLoading(false);
+        return;
+      }
+      
+      try {
+       // console.log('Fetching public status page for slug:', slug);
+        setLoading(true);
+        setError(null);
+        
+        // Fetch operational page
+      //  console.log('Fetching operational pages...');
+        const pages = await operationalPageService.getOperationalPages();
+      //  console.log('All pages:', pages);
+        
+        const foundPage = pages.find(p => p.slug === slug && p.is_public === 'true');
+      //  console.log('Found page:', foundPage);
+        
+        if (!foundPage) {
+       //   console.log('Page not found or not public');
+          setError('Status page not found or not public');
+          setLoading(false);
+          return;
+        }
+        
+        setPage(foundPage);
+       // console.log('Page set successfully');
+        
+        // Fetch components for this page
+       // console.log('Fetching components for page:', foundPage.id);
+        const pageComponents = await statusPageComponentsService.getStatusPageComponentsByOperationalId(foundPage.id);
+       // console.log('Components found:', pageComponents);
+        setComponents(pageComponents);
+        
+        // Fetch all services
+      //  console.log('Fetching all services...');
+        const allServices = await serviceService.getServices();
+      //  console.log('Services found:', allServices);
+        setServices(allServices);
+        
+        // Fetch uptime data for each component that has a service
+      //  console.log('Fetching uptime data...');
+        const uptimePromises = pageComponents
+          .filter(component => component.service_id)
+          .map(async (component) => {
+            try {
+            //  console.log('Fetching uptime for service:', component.service_id);
+              const endDate = new Date();
+              const startDate = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000); // Last 90 days
+              const history = await uptimeService.getUptimeHistory(component.service_id, 2000, startDate, endDate);
+            //  console.log(`Uptime history for ${component.service_id}:`, history.length, 'records');
+              return { serviceId: component.service_id, history };
+            } catch (error) {
+            //  console.error(`Error fetching uptime for service ${component.service_id}:`, error);
+              return { serviceId: component.service_id, history: [] };
+            }
+          });
+        
+        const uptimeResults = await Promise.all(uptimePromises);
+        const uptimeMap: Record<string, UptimeData[]> = {};
+        uptimeResults.forEach(result => {
+          uptimeMap[result.serviceId] = result.history;
+        });
+        setUptimeData(uptimeMap);
+       // console.log('Uptime data set successfully');
+        
+       // console.log('All data fetched successfully');
+        
+      } catch (err) {
+       // console.error('Error fetching public page:', err);
+        setError(`Failed to load status page: ${err}`);
+      } finally {
+        setLoading(false);
+      }
+    };
+
+    fetchPublicPage();
+  }, [slug]);
+
+  return {
+    page,
+    components,
+    services,
+    uptimeData,
+    loading,
+    error
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/regional-monitoring/AddRegionalAgentDialog.tsx b/application/src/components/regional-monitoring/AddRegionalAgentDialog.tsx
new file mode 100644
index 0000000..281679d
--- /dev/null
+++ b/application/src/components/regional-monitoring/AddRegionalAgentDialog.tsx
@@ -0,0 +1,139 @@
+import React, { useState, useEffect } from "react";
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { useToast } from "@/hooks/use-toast";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { getCurrentEndpoint } from "@/lib/pocketbase";
+import { RegionalAgentConfigForm } from "./RegionalAgentConfigForm";
+import { RegionalOneClickTab } from "./RegionalOneClickTab";
+import { RegionalManualTab } from "./RegionalManualTab";
+
+interface AddRegionalAgentDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onAgentAdded: () => void;
+}
+
+export const AddRegionalAgentDialog: React.FC<AddRegionalAgentDialogProps> = ({
+  open,
+  onOpenChange,
+  onAgentAdded
+}) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [activeTab, setActiveTab] = useState("configure");
+  const [formData, setFormData] = useState({
+    regionName: "",
+    agentIp: "",
+  });
+  const [agentToken, setAgentToken] = useState("");
+  const [agentId, setAgentId] = useState("");
+  const [currentPocketBaseUrl, setCurrentPocketBaseUrl] = useState("");
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  // Generate new credentials when dialog opens or after successful creation
+  const generateNewCredentials = () => {
+    const newToken = `rgn_${Math.random().toString(36).substring(2, 15)}${Math.random().toString(36).substring(2, 15)}`;
+    const newAgentId = `regional_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+    setAgentToken(newToken);
+    setAgentId(newAgentId);
+  };
+
+  useEffect(() => {
+    if (open) {
+      const endpoint = getCurrentEndpoint();
+      setCurrentPocketBaseUrl(endpoint);
+      generateNewCredentials();
+    }
+  }, [open]);
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (!formData.regionName.trim() || !formData.agentIp.trim()) return;
+
+    setIsSubmitting(true);
+    try {
+      await new Promise(resolve => setTimeout(resolve, 1000));
+      
+      toast({
+        title: t('success'),
+        description: t('agentCreatedSuccessfully'),
+      });
+      setActiveTab("one-click");
+      generateNewCredentials();
+      
+      onAgentAdded();
+    } catch (error) {
+      toast({
+        title: t('error'),
+        description: t('failedToCreateAgent'),
+        variant: "destructive",
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const handleDialogClose = () => {
+    setFormData({
+      regionName: "",
+      agentIp: "",
+    });
+    setActiveTab("configure");
+    generateNewCredentials();
+    onOpenChange(false);
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={handleDialogClose}>
+      <DialogContent className="sm:max-w-[900px] max-h-[90vh] overflow-auto">
+        <DialogHeader>
+          <DialogTitle>{t('addRegionalMonitoringAgent')}</DialogTitle>
+          <DialogDescription>
+            {t('deployRegionalMonitoringAgent')}
+          </DialogDescription>
+        </DialogHeader>
+
+        <Tabs value={activeTab} onValueChange={setActiveTab} className="w-full">
+          <TabsList className="grid w-full grid-cols-3">
+            <TabsTrigger value="configure">{t('configureAgent')}</TabsTrigger>
+            <TabsTrigger value="one-click">{t('oneClickInstallTab')}</TabsTrigger>
+            <TabsTrigger value="manual">{t('manualInstallTab')}</TabsTrigger>
+          </TabsList>
+
+          <TabsContent value="configure" className="space-y-6">
+            <RegionalAgentConfigForm
+              formData={formData}
+              setFormData={setFormData}
+              agentId={agentId}
+              agentToken={agentToken}
+              currentPocketBaseUrl={currentPocketBaseUrl}
+              isSubmitting={isSubmitting}
+              onSubmit={handleSubmit}
+            />
+          </TabsContent>
+
+          <TabsContent value="one-click" className="space-y-6">
+            <RegionalOneClickTab
+              agentToken={agentToken}
+              currentPocketBaseUrl={currentPocketBaseUrl}
+              formData={formData}
+              agentId={agentId}
+              onDialogClose={handleDialogClose}
+            />
+          </TabsContent>
+
+          <TabsContent value="manual" className="space-y-6">
+            <RegionalManualTab
+              agentToken={agentToken}
+              currentPocketBaseUrl={currentPocketBaseUrl}
+              formData={formData}
+              agentId={agentId}
+              onDialogClose={handleDialogClose}
+            />
+          </TabsContent>
+        </Tabs>
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/regional-monitoring/RegionalAgentCard.tsx b/application/src/components/regional-monitoring/RegionalAgentCard.tsx
new file mode 100644
index 0000000..79e47cd
--- /dev/null
+++ b/application/src/components/regional-monitoring/RegionalAgentCard.tsx
@@ -0,0 +1,153 @@
+
+import React from "react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from "@/components/ui/dropdown-menu";
+import { MapPin, Wifi, WifiOff, MoreVertical, Trash2, Terminal, Copy } from "lucide-react";
+import { RegionalService } from "@/types/regional.types";
+import { formatDistanceToNow } from "date-fns";
+import { useToast } from "@/hooks/use-toast";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface RegionalAgentCardProps {
+  agent: RegionalService;
+  onDelete: () => void;
+}
+
+export const RegionalAgentCard: React.FC<RegionalAgentCardProps> = ({ agent, onDelete }) => {
+  const { toast } = useToast();
+  const { t } = useLanguage();
+
+  // Check if this is the default agent that cannot be removed
+  const isDefaultAgent = agent.agent_id === "1" || agent.region_name === "Default";
+
+  const copyAgentId = async () => {
+    try {
+      await navigator.clipboard.writeText(agent.agent_id);
+      toast({
+        title: t('copied'),
+        description: t('copiedDescription'),
+      });
+    } catch (error) {
+      toast({
+        title: t('copyFailed'),
+        description: t('copyFailedDescription'),
+        variant: "destructive",
+      });
+    }
+  };
+
+  const getConnectionStatus = () => {
+    if (agent.connection === 'online') {
+      return {
+        icon: <Wifi className="h-4 w-4" />,
+        label: t('online'),
+        variant: 'default' as const,
+        className: 'bg-green-100 text-green-800 hover:bg-green-100'
+      };
+    } else {
+      return {
+        icon: <WifiOff className="h-4 w-4" />,
+        label: t('offline'),
+        variant: 'secondary' as const,
+        className: 'bg-red-100 text-red-800 hover:bg-red-100'
+      };
+    }
+  };
+
+  const connectionStatus = getConnectionStatus();
+
+  return (
+    <Card className="relative">
+      <CardHeader className="pb-3">
+        <div className="flex items-start justify-between">
+          <div className="flex items-center space-x-2">
+            <MapPin className="h-5 w-5 text-blue-600" />
+            <div>
+              <CardTitle className="text-lg flex items-center gap-2">
+                {agent.region_name}
+                {isDefaultAgent && (
+                  <Badge variant="outline" className="text-xs bg-blue-50 text-blue-700 border-blue-200">
+                    {t('defaultBadge')}
+                  </Badge>
+                )}
+              </CardTitle>
+              <CardDescription className="flex items-center gap-1 text-sm">
+                {agent.agent_ip_address}
+              </CardDescription>
+            </div>
+          </div>
+          
+          <DropdownMenu>
+            <DropdownMenuTrigger asChild>
+              <Button variant="ghost" size="sm">
+                <MoreVertical className="h-4 w-4" />
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end">
+              <DropdownMenuItem onClick={copyAgentId}>
+                <Copy className="mr-2 h-4 w-4" />
+                {t('copyAgentId')}
+              </DropdownMenuItem>
+              {!isDefaultAgent && (
+                <DropdownMenuItem onClick={onDelete} className="text-red-600">
+                  <Trash2 className="mr-2 h-4 w-4" />
+                  {t('removeAgent')}
+                </DropdownMenuItem>
+              )}
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      </CardHeader>
+      
+      <CardContent className="space-y-4">
+        <div className="flex items-center justify-between">
+          <Badge 
+            variant={connectionStatus.variant}
+            className={connectionStatus.className}
+          >
+            {connectionStatus.icon}
+            <span className="ml-1">{connectionStatus.label}</span>
+          </Badge>
+          
+          <Badge variant="outline" className="text-xs">
+            {agent.status}
+          </Badge>
+        </div>
+        
+        <div className="space-y-2">
+          <div className="flex justify-between text-sm">
+            <span className="text-muted-foreground">{t('agentId')}</span>
+            <span className="font-mono text-xs">{agent.agent_id.substring(0, 12)}...</span>
+          </div>
+          
+          <div className="flex justify-between text-sm">
+            <span className="text-muted-foreground">{t('lastUpdated')}</span>
+            <span className="text-xs">
+              {formatDistanceToNow(new Date(agent.updated), { addSuffix: true })}
+            </span>
+          </div>
+        </div>
+        
+        {agent.connection === 'online' && (
+          <div className="pt-2 border-t">
+            <div className="flex items-center text-xs text-green-600">
+              <div className="w-2 h-2 bg-green-600 rounded-full mr-2 animate-pulse"></div>
+              {t('activeMonitoring')}
+            </div>
+          </div>
+        )}
+        
+        {agent.connection === 'offline' && (
+          <div className="pt-2 border-t">
+            <div className="flex items-center text-xs text-red-600">
+              <div className="w-2 h-2 bg-red-600 rounded-full mr-2"></div>
+              {t('connectionLost')}
+            </div>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/regional-monitoring/RegionalAgentConfigForm.tsx b/application/src/components/regional-monitoring/RegionalAgentConfigForm.tsx
new file mode 100644
index 0000000..49a4e77
--- /dev/null
+++ b/application/src/components/regional-monitoring/RegionalAgentConfigForm.tsx
@@ -0,0 +1,128 @@
+import React from "react";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Button } from "@/components/ui/button";
+import { Copy } from "lucide-react";
+import { copyToClipboard } from "@/utils/copyUtils";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface RegionalAgentConfigFormProps {
+  formData: {
+    regionName: string;
+    agentIp: string;
+  };
+  setFormData: (data: { regionName: string; agentIp: string }) => void;
+  agentId: string;
+  agentToken: string;
+  currentPocketBaseUrl: string;
+  isSubmitting: boolean;
+  onSubmit: (e: React.FormEvent) => void;
+}
+
+export const RegionalAgentConfigForm: React.FC<RegionalAgentConfigFormProps> = ({
+  formData,
+  setFormData,
+  agentId,
+  agentToken,
+  currentPocketBaseUrl,
+  isSubmitting,
+  onSubmit,
+}) => {
+  const { t } = useLanguage();
+
+  return (
+    <form onSubmit={onSubmit} className="space-y-6">
+      <div className="space-y-4">
+        <div>
+          <Label htmlFor="regionName">{t('regionName')}</Label>
+          <Input
+            id="regionName"
+            placeholder={t('regionNamePlaceholder')}
+            value={formData.regionName}
+            onChange={(e) => setFormData({ ...formData, regionName: e.target.value })}
+            required
+          />
+        </div>
+
+        <div>
+          <Label htmlFor="agentIp">{t('agentServerIpAddress')}</Label>
+          <Input
+            id="agentIp"
+            placeholder={t('agentIpPlaceholder')}
+            value={formData.agentIp}
+            onChange={(e) => setFormData({ ...formData, agentIp: e.target.value })}
+            required
+          />
+        </div>
+
+        <div className="grid grid-cols-2 gap-4">
+          <div>
+            <Label className="text-sm font-medium">{t('agentId')}</Label>
+            <div className="relative">
+              <Input
+                value={agentId}
+                readOnly
+                className="font-mono text-sm bg-muted/50 border-muted-foreground/20 pr-10"
+              />
+              <Button
+                type="button"
+                size="sm"
+                variant="ghost"
+                className="absolute right-1 top-1/2 -translate-y-1/2 h-8 w-8 p-0 hover:bg-muted"
+                onClick={() => copyToClipboard(agentId)}
+              >
+                <Copy className="h-3 w-3" />
+              </Button>
+            </div>
+          </div>
+
+          <div>
+            <Label className="text-sm font-medium">{t('apiEndpoint')}</Label>
+            <div className="relative">
+              <Input
+                value={currentPocketBaseUrl}
+                readOnly
+                className="font-mono text-sm bg-muted/50 border-muted-foreground/20 pr-10"
+              />
+              <Button
+                type="button"
+                size="sm"
+                variant="ghost"
+                className="absolute right-1 top-1/2 -translate-y-1/2 h-8 w-8 p-0 hover:bg-muted"
+                onClick={() => copyToClipboard(currentPocketBaseUrl)}
+              >
+                <Copy className="h-3 w-3" />
+              </Button>
+            </div>
+          </div>
+        </div>
+
+        <div>
+          <Label className="text-sm font-medium">{t('authenticationToken')}</Label>
+          <div className="relative">
+            <Input
+              value={agentToken}
+              readOnly
+              className="font-mono text-sm bg-muted/50 border-muted-foreground/20 pr-10"
+            />
+            <Button
+              type="button"
+              size="sm"
+              variant="ghost"
+              className="absolute right-1 top-1/2 -translate-y-1/2 h-8 w-8 p-0 hover:bg-muted"
+              onClick={() => copyToClipboard(agentToken)}
+            >
+              <Copy className="h-3 w-3" />
+            </Button>
+          </div>
+        </div>
+      </div>
+
+      <div className="flex justify-end space-x-2">
+        <Button type="submit" disabled={isSubmitting}>
+          {isSubmitting ? t('creating') : t('createAgent')}
+        </Button>
+      </div>
+    </form>
+  );
+};
diff --git a/application/src/components/regional-monitoring/RegionalManualTab.tsx b/application/src/components/regional-monitoring/RegionalManualTab.tsx
new file mode 100644
index 0000000..fd1a62d
--- /dev/null
+++ b/application/src/components/regional-monitoring/RegionalManualTab.tsx
@@ -0,0 +1,159 @@
+import React from "react";
+import { Button } from "@/components/ui/button";
+import { Copy, Terminal } from "lucide-react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { copyToClipboard } from "@/utils/copyUtils";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface RegionalManualTabProps {
+  agentToken: string;
+  currentPocketBaseUrl: string;
+  formData: {
+    regionName: string;
+    agentIp: string;
+  };
+  agentId: string;
+  onDialogClose: () => void;
+}
+
+export const RegionalManualTab: React.FC<RegionalManualTabProps> = ({
+  agentToken,
+  currentPocketBaseUrl,
+  formData,
+  agentId,
+  onDialogClose,
+}) => {
+  const { t } = useLanguage();
+
+  const getManualInstallSteps = () => {
+    return [
+      {
+        title: t('step1DownloadPackage'),
+        commands: [
+          {
+            label: t('downloadAmd64Notice'),
+            command: 'wget https://github.com/operacle/Distributed-Regional-Monitoring/releases/download/V1.0.0/distributed-regional-check-agent_1.0.0_amd64.deb'
+          },
+          {
+            label: t('downloadArm64Notice'),
+            command: 'wget https://github.com/operacle/Distributed-Regional-Monitoring/releases/download/V1.0.0/distributed-regional-check-agent_1.0.0_arm64.deb'
+          }
+        ]
+      },
+      {
+        title: t('step2InstallPackage'),
+        commands: [
+          {
+            label: '',
+            command: 'sudo dpkg -i distributed-regional-check-agent_1.0.0_amd64.deb\nsudo apt-get install -f'
+          }
+        ]
+      },
+      {
+        title: t('step3ConfigureAgent'),
+        commands: [
+          {
+            label: '',
+            command: 'sudo nano /etc/regional-check-agent/regional-check-agent.env'
+          },
+          {
+            label: t('addConfigurationValues'),
+            command: `POCKETBASE_URL=${currentPocketBaseUrl}
+AGENT_TOKEN=${agentToken}
+AGENT_ID=${agentId}
+REGION_NAME=${formData.regionName}
+AGENT_IP=${formData.agentIp}`
+          }
+        ]
+      },
+      {
+        title: t('step4StartService'),
+        commands: [
+          {
+            label: '',
+            command: 'sudo systemctl enable regional-check-agent\nsudo systemctl start regional-check-agent'
+          }
+        ]
+      },
+      {
+        title: t('step5VerifyInstallation'),
+        commands: [
+          {
+            label: '',
+            command: 'sudo systemctl status regional-check-agent\ncurl http://localhost:8091/health'
+          }
+        ]
+      }
+    ];
+  };
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2">
+          <Terminal className="h-5 w-5" />
+          {t('manualInstallationSteps')}
+        </CardTitle>
+        <CardDescription>
+          {t('stepByStepManualInstallation')}
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        <div className="space-y-4">
+          {getManualInstallSteps().map((step, stepIndex) => (
+            <div key={stepIndex} className="border-l-4 border-blue-500 pl-4 space-y-2">
+              <div className="flex items-center gap-2">
+                <span className="flex items-center justify-center w-6 h-6 rounded-full bg-primary text-primary-foreground text-sm font-medium">
+                  {stepIndex + 1}
+                </span>
+                <p className="font-medium">{step.title}</p>
+              </div>
+              {step.commands.map((cmd, cmdIndex) => (
+                <div key={cmdIndex} className="space-y-1">
+                  {cmd.label && (
+                    <p className="text-xs text-muted-foreground ml-8">{cmd.label}</p>
+                  )}
+                  <div className="ml-8 relative">
+                    <pre className="bg-muted p-3 rounded-md text-sm overflow-x-auto whitespace-pre-wrap break-all">
+                      <code>{cmd.command}</code>
+                    </pre>
+                    <Button
+                      type="button"
+                      variant="outline"
+                      size="sm"
+                      className="absolute top-2 right-2"
+                      onClick={() => copyToClipboard(cmd.command)}
+                    >
+                      <Copy className="h-4 w-4 mr-1" />
+                      Copy
+                    </Button>
+                  </div>
+                </div>
+              ))}
+            </div>
+          ))}
+        </div>
+
+        <div className="bg-blue-50 dark:bg-blue-950/20 border border-blue-200 dark:border-blue-800 rounded-md p-4">
+          <h4 className="font-medium text-blue-900 dark:text-blue-100 mb-2">Prerequisites:</h4>
+          <ul className="text-sm text-blue-800 dark:text-blue-200 space-y-1 list-disc list-inside mb-3">
+            <li>Ensure you have root/sudo access on the target server</li>
+            <li>Make sure wget or curl is installed for downloading files</li>
+            <li>Internet connection required for downloading packages</li>
+          </ul>
+
+          <h4 className="font-medium text-blue-900 dark:text-blue-100 mb-2">After Installation:</h4>
+          <p className="text-sm text-blue-800 dark:text-blue-200">
+            The agent will start automatically and appear in your dashboard within a few minutes.
+          </p>
+        </div>
+
+        <div className="flex justify-end pt-4">
+          <Button onClick={onDialogClose}>
+            {t('done')}
+          </Button>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/application/src/components/regional-monitoring/RegionalMonitoringContent.tsx b/application/src/components/regional-monitoring/RegionalMonitoringContent.tsx
new file mode 100644
index 0000000..fa8b43c
--- /dev/null
+++ b/application/src/components/regional-monitoring/RegionalMonitoringContent.tsx
@@ -0,0 +1,166 @@
+
+import React, { useState } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Plus, MapPin, Activity, Wifi, WifiOff } from "lucide-react";
+import { regionalService } from "@/services/regionalService";
+import { RegionalService } from "@/types/regional.types";
+import { AddRegionalAgentDialog } from "./AddRegionalAgentDialog";
+import { RegionalAgentCard } from "./RegionalAgentCard";
+import { useToast } from "@/hooks/use-toast";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+export const RegionalMonitoringContent = () => {
+  const { t } = useLanguage();
+  const [addDialogOpen, setAddDialogOpen] = useState(false);
+  const { toast } = useToast();
+  const queryClient = useQueryClient();
+
+  const { data: regionalServices = [], isLoading, error } = useQuery({
+    queryKey: ['regional-services'],
+    queryFn: regionalService.getRegionalServices,
+    refetchInterval: 30000, // Refetch every 30 seconds
+  });
+
+  const handleAgentAdded = () => {
+    queryClient.invalidateQueries({ queryKey: ['regional-services'] });
+    toast({
+      title: t('regionalAgentAdded'),
+      description: t('regionalAgentAddedDesc'),
+    });
+  };
+
+  const handleDeleteAgent = async (id: string) => {
+    try {
+      await regionalService.deleteRegionalService(id);
+      queryClient.invalidateQueries({ queryKey: ['regional-services'] });
+      toast({
+        title: t('agentRemoved'),
+        description: t('agentRemovedDesc'),
+      });
+    } catch (error) {
+      toast({
+        title: t('error'),
+        description: t('failedToRemoveAgent'),
+        variant: "destructive",
+      });
+    }
+  };
+
+  const onlineAgents = regionalServices.filter(agent => agent.connection === 'online').length;
+  const totalAgents = regionalServices.length;
+
+  return (
+    <div className="p-6 space-y-6">
+      <div className="flex justify-between items-center">
+        <div>
+          <h1 className="text-3xl font-bold tracking-tight">{t('regionalmonitoring')}</h1>
+          <p className="text-muted-foreground">
+            {t('descriptRegionPage')}
+          </p>
+        </div>
+        <Button onClick={() => setAddDialogOpen(true)}>
+          <Plus className="mr-2 h-4 w-4" />
+          {t('addRegionalAgent')}
+        </Button>
+      </div>
+
+      {/* Stats Cards */}
+      <div className="grid grid-cols-1 md:grid-cols-3 gap-6">
+        <Card>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
+            <CardTitle className="text-sm font-medium">{t('totalAgents')}</CardTitle>
+            <MapPin className="h-4 w-4 text-muted-foreground" />
+          </CardHeader>
+          <CardContent>
+            <div className="text-2xl font-bold">{totalAgents}</div>
+            <p className="text-xs text-muted-foreground">
+              {t('regionalMonitoringAgents')}
+            </p>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
+            <CardTitle className="text-sm font-medium">{t('onlineAgents')}</CardTitle>
+            <Wifi className="h-4 w-4 text-green-600" />
+          </CardHeader>
+          <CardContent>
+            <div className="text-2xl font-bold text-green-600">{onlineAgents}</div>
+            <p className="text-xs text-muted-foreground">
+              {t('currentlyConnected')}
+            </p>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
+            <CardTitle className="text-sm font-medium">{t('offlineAgents')}</CardTitle>
+            <WifiOff className="h-4 w-4 text-red-600" />
+          </CardHeader>
+          <CardContent>
+            <div className="text-2xl font-bold text-red-600">{totalAgents - onlineAgents}</div>
+            <p className="text-xs text-muted-foreground">
+              {t('disconnectedAgents')}
+            </p>
+          </CardContent>
+        </Card>
+      </div>
+
+      {/* Agents List */}
+      <div className="space-y-4">
+        <h2 className="text-xl font-semibold">{t('regionalAgents')}</h2>
+        
+        {isLoading ? (
+          <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
+            {[...Array(3)].map((_, i) => (
+              <Card key={i} className="animate-pulse">
+                <CardHeader>
+                  <div className="h-4 bg-gray-200 rounded w-3/4"></div>
+                  <div className="h-3 bg-gray-200 rounded w-1/2"></div>
+                </CardHeader>
+                <CardContent>
+                  <div className="space-y-2">
+                    <div className="h-3 bg-gray-200 rounded"></div>
+                    <div className="h-3 bg-gray-200 rounded w-5/6"></div>
+                  </div>
+                </CardContent>
+              </Card>
+            ))}
+          </div>
+        ) : regionalServices.length === 0 ? (
+          <Card>
+            <CardContent className="flex flex-col items-center justify-center py-12">
+              <MapPin className="h-12 w-12 text-muted-foreground mb-4" />
+              <h3 className="text-lg font-semibold mb-2">{t('noRegionalAgents')}</h3>
+              <p className="text-muted-foreground text-center mb-4">
+                {t('getStartedAddAgent')}
+              </p>
+              <Button onClick={() => setAddDialogOpen(true)}>
+                <Plus className="mr-2 h-4 w-4" />
+                {t('addFirstAgent')}
+              </Button>
+            </CardContent>
+          </Card>
+        ) : (
+          <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
+            {regionalServices.map((agent) => (
+              <RegionalAgentCard 
+                key={agent.id} 
+                agent={agent} 
+                onDelete={() => handleDeleteAgent(agent.id)}
+              />
+            ))}
+          </div>
+        )}
+      </div>
+
+      <AddRegionalAgentDialog
+        open={addDialogOpen}
+        onOpenChange={setAddDialogOpen}
+        onAgentAdded={handleAgentAdded}
+      />
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/regional-monitoring/RegionalOneClickTab.tsx b/application/src/components/regional-monitoring/RegionalOneClickTab.tsx
new file mode 100644
index 0000000..5410e35
--- /dev/null
+++ b/application/src/components/regional-monitoring/RegionalOneClickTab.tsx
@@ -0,0 +1,126 @@
+import React from "react";
+import { Button } from "@/components/ui/button";
+import { Label } from "@/components/ui/label";
+import { Textarea } from "@/components/ui/textarea";
+import { Copy, Download, Zap, Play } from "lucide-react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { copyToClipboard } from "@/utils/copyUtils";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { useToast } from "@/hooks/use-toast";
+
+interface RegionalOneClickTabProps {
+  agentToken: string;
+  currentPocketBaseUrl: string;
+  formData: {
+    regionName: string;
+    agentIp: string;
+  };
+  agentId: string;
+  onDialogClose: () => void;
+}
+
+export const RegionalOneClickTab: React.FC<RegionalOneClickTabProps> = ({
+  agentToken,
+  currentPocketBaseUrl,
+  formData,
+  agentId,
+  onDialogClose,
+}) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+
+  const getOneClickCommand = () => {
+    return `curl -fsSL https://raw.githubusercontent.com/operacle/checkcle/refs/heads/main/scripts/install-regional-agent.sh | sudo bash -s -- \\
+  --region-name="${formData.regionName}" \\
+  --agent-id="${agentId}" \\
+  --agent-ip="${formData.agentIp}" \\
+  --token="${agentToken}" \\
+  --pocketbase-url="${currentPocketBaseUrl}"`;
+  };
+
+  const downloadScript = () => {
+    const scriptContent = getOneClickCommand();
+    const blob = new Blob([scriptContent], { type: 'text/plain' });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = `install-regional-agent-${agentId}.sh`;
+    document.body.appendChild(a);
+    a.click();
+    document.body.removeChild(a);
+    URL.revokeObjectURL(url);
+
+    toast({
+      title: t('downloaded'),
+      description: t('downloadedDescription'),
+    });
+  };
+
+  return (
+    <Card className="border-green-500/20 bg-green-50/50 dark:bg-green-950/20">
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2 text-green-700 dark:text-green-400">
+          <Zap className="h-5 w-5" />
+          {t('oneClickAutomaticInstallation')}
+        </CardTitle>
+        <CardDescription className="text-green-600 dark:text-green-300">
+          {t('completeInstallationDescription')}
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        <div className="bg-green-50 border border-green-200 rounded-lg p-4 dark:bg-green-950/50 dark:border-green-800">
+          <div className="flex items-center gap-2 text-green-800 dark:text-green-200 font-medium mb-2">
+            <Play className="h-4 w-4" />
+            {t('whatThisScriptDoes')}
+          </div>
+          <ul className="text-sm text-green-700 dark:text-green-300 space-y-1 ml-6">
+            <li>• {t('scriptActionDownload')}</li>
+            <li>• {t('scriptActionInstall')}</li>
+            <li>• {t('scriptActionConfigure')}</li>
+            <li>• {t('scriptActionStart')}</li>
+            <li>• {t('scriptActionHealthChecks')}</li>
+          </ul>
+        </div>
+
+        <div className="space-y-2">
+          <Label className="text-green-700 dark:text-green-400">{t('runCommandOnServer')}</Label>
+          <div className="relative">
+            <Textarea
+              readOnly
+              value={getOneClickCommand()}
+              className="font-mono text-sm min-h-[120px] pr-12 bg-muted/50 border-green-200 dark:border-green-800"
+            />
+            <Button
+              type="button"
+              size="sm"
+              variant="outline"
+              className="absolute top-2 right-2 bg-green-50 dark:bg-green-950/50 border-green-200 dark:border-green-800 hover:bg-green-100 dark:hover:bg-green-900"
+              onClick={() => copyToClipboard(getOneClickCommand())}
+            >
+              <Copy className="h-3 w-3" />
+            </Button>
+          </div>
+        </div>
+
+        <div className="flex gap-2">
+          <Button onClick={downloadScript} variant="outline" className="flex-1">
+            <Download className="mr-2 h-4 w-4" />
+            {t('downloadCompleteScript')}
+          </Button>
+        </div>
+
+        {(window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1') && (
+          <div className="bg-yellow-50 border border-yellow-200 rounded-lg p-3 dark:bg-yellow-950/20 dark:border-yellow-800">
+            <p className="text-sm text-yellow-800 dark:text-yellow-200" dangerouslySetInnerHTML={{ __html: t('localDevelopmentNotice') }} />
+          </div>
+        )}
+
+        <div className="flex justify-end pt-4">
+          <Button onClick={onDialogClose}>
+            {t('done')}
+          </Button>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/application/src/components/regional-monitoring/index.ts b/application/src/components/regional-monitoring/index.ts
new file mode 100644
index 0000000..399e613
--- /dev/null
+++ b/application/src/components/regional-monitoring/index.ts
@@ -0,0 +1,4 @@
+
+export { RegionalMonitoringContent } from './RegionalMonitoringContent';
+export { AddRegionalAgentDialog } from './AddRegionalAgentDialog';
+export { RegionalAgentCard } from './RegionalAgentCard';
\ No newline at end of file
diff --git a/application/src/components/schedule-incident/IncidentManagementTab.tsx b/application/src/components/schedule-incident/IncidentManagementTab.tsx
new file mode 100644
index 0000000..59bed3d
--- /dev/null
+++ b/application/src/components/schedule-incident/IncidentManagementTab.tsx
@@ -0,0 +1,13 @@
+
+import React from 'react';
+import { IncidentManagementContainer } from './incident-management';
+
+interface IncidentManagementTabProps {
+  refreshTrigger?: number;
+}
+
+export const IncidentManagementTab = React.memo(({ refreshTrigger = 0 }: IncidentManagementTabProps) => {
+  return <IncidentManagementContainer refreshTrigger={refreshTrigger} />;
+});
+
+IncidentManagementTab.displayName = 'IncidentManagementTab';
diff --git a/application/src/components/schedule-incident/ScheduleIncidentContent.tsx b/application/src/components/schedule-incident/ScheduleIncidentContent.tsx
new file mode 100644
index 0000000..05ee42a
--- /dev/null
+++ b/application/src/components/schedule-incident/ScheduleIncidentContent.tsx
@@ -0,0 +1,126 @@
+
+import React, { useState, useEffect } from 'react';
+import { Tabs, TabsList, TabsTrigger, TabsContent } from "@/components/ui/tabs";
+import { Button } from "@/components/ui/button";
+import { Plus, CalendarClock, AlertCircle } from "lucide-react";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { ScheduledMaintenanceTab } from "./ScheduledMaintenanceTab";
+import { IncidentManagementTab } from "./IncidentManagementTab";
+import { CreateMaintenanceDialog } from './maintenance/CreateMaintenanceDialog';
+import { CreateIncidentDialog } from './incident/CreateIncidentDialog';
+import { useToast } from '@/hooks/use-toast';
+import { initMaintenanceNotifications, stopMaintenanceNotifications } from '@/services/maintenance/maintenanceNotificationService';
+
+export const ScheduleIncidentContent = () => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [activeTab, setActiveTab] = useState("maintenance");
+  const [createMaintenanceDialogOpen, setCreateMaintenanceDialogOpen] = useState(false);
+  const [createIncidentDialogOpen, setCreateIncidentDialogOpen] = useState(false);
+  const [refreshTrigger, setRefreshTrigger] = useState(0);
+  const [incidentRefreshTrigger, setIncidentRefreshTrigger] = useState(0);
+
+  // Initialize maintenance notifications when the component mounts
+  useEffect(() => {
+   // console.log("Initializing maintenance notifications");
+    initMaintenanceNotifications();
+    
+    // Clean up when the component unmounts
+    return () => {
+     // console.log("Cleaning up maintenance notifications");
+      stopMaintenanceNotifications();
+    };
+  }, []);
+
+  const handleCreateButtonClick = () => {
+    if (activeTab === "maintenance") {
+      setCreateMaintenanceDialogOpen(true);
+    } else {
+      setCreateIncidentDialogOpen(true);
+    }
+  };
+
+  const handleMaintenanceCreated = () => {
+    // Refresh data by incrementing the refresh trigger
+    const newTriggerValue = refreshTrigger + 1;
+   // console.log("Maintenance created, refreshing data with new trigger value:", newTriggerValue);
+    setRefreshTrigger(newTriggerValue);
+    
+    // Show success toast
+    toast({
+      title: t('success'),
+      description: t('maintenanceCreatedSuccess'),
+    });
+  };
+
+  const handleIncidentCreated = () => {
+    // Refresh data by incrementing the refresh trigger
+    const newTriggerValue = incidentRefreshTrigger + 1;
+   // console.log("Incident created, refreshing data with new trigger value:", newTriggerValue);
+    setIncidentRefreshTrigger(newTriggerValue);
+    
+    // Show success toast
+    toast({
+      title: t('success'),
+      description: t('incidentCreatedSuccess'),
+    });
+  };
+
+  return (
+    <main className="flex-1 flex flex-col overflow-auto bg-background p-6">
+      <div className="flex flex-col gap-6">
+        <div className="flex justify-between items-center">
+          <h2 className="text-2xl font-bold text-foreground">
+            {t('scheduleIncidentManagement')}
+          </h2>
+          <Button 
+            className="text-primary-foreground"
+            onClick={handleCreateButtonClick}
+          >
+            <Plus className="w-4 h-4 mr-2" /> 
+            {activeTab === "maintenance" ? t('createMaintenanceWindow') : t('createIncident')}
+          </Button>
+        </div>
+        
+        <Tabs 
+          defaultValue="maintenance" 
+          className="w-full"
+          onValueChange={(value) => setActiveTab(value)}
+        >
+          <TabsList className="grid w-full grid-cols-2 mb-4">
+            <TabsTrigger value="maintenance">
+              <CalendarClock className="w-4 h-4 mr-2" />
+              {t('scheduledMaintenance')}
+            </TabsTrigger>
+            <TabsTrigger value="incidents">
+              <AlertCircle className="w-4 h-4 mr-2" />
+              {t('incidentManagement')}
+            </TabsTrigger>
+          </TabsList>
+          
+          <TabsContent value="maintenance" className="space-y-4">
+            <ScheduledMaintenanceTab refreshTrigger={refreshTrigger} />
+          </TabsContent>
+          
+          <TabsContent value="incidents" className="space-y-4">
+            <IncidentManagementTab refreshTrigger={incidentRefreshTrigger} />
+          </TabsContent>
+        </Tabs>
+      </div>
+
+      {/* Maintenance creation dialog */}
+      <CreateMaintenanceDialog 
+        open={createMaintenanceDialogOpen}
+        onOpenChange={setCreateMaintenanceDialogOpen}
+        onMaintenanceCreated={handleMaintenanceCreated}
+      />
+
+      {/* Incident creation dialog */}
+      <CreateIncidentDialog 
+        open={createIncidentDialogOpen}
+        onOpenChange={setCreateIncidentDialogOpen}
+        onIncidentCreated={handleIncidentCreated}
+      />
+    </main>
+  );
+};
diff --git a/application/src/components/schedule-incident/ScheduledMaintenanceTab.tsx b/application/src/components/schedule-incident/ScheduledMaintenanceTab.tsx
new file mode 100644
index 0000000..06b6004
--- /dev/null
+++ b/application/src/components/schedule-incident/ScheduledMaintenanceTab.tsx
@@ -0,0 +1,181 @@
+import React, { useEffect } from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Tabs, TabsList, TabsTrigger, TabsContent } from '@/components/ui/tabs';
+import { MaintenanceTable, MaintenanceStatusChecker } from './maintenance';
+import { LoadingState } from '@/components/services/LoadingState';
+import { Calendar, Clock, CheckCircle } from 'lucide-react';
+import { useMaintenanceData } from './hooks/useMaintenanceData';
+import { useToast } from '@/hooks/use-toast';
+import { useTheme } from '@/contexts/ThemeContext';
+
+interface ScheduledMaintenanceTabProps {
+  refreshTrigger?: number;
+}
+
+export const ScheduledMaintenanceTab = ({ refreshTrigger = 0 }: ScheduledMaintenanceTabProps) => {
+  const { t } = useLanguage();
+  const { theme } = useTheme();
+  const { toast } = useToast();
+  const [manualRefresh, setManualRefresh] = React.useState(0);
+
+  const combinedRefreshTrigger = refreshTrigger + manualRefresh;
+
+  const {
+    loading,
+    filter,
+    setFilter,
+    maintenanceData,
+    overviewStats,
+    fetchMaintenanceData,
+    isEmpty,
+    error,
+    initialized,
+  } = useMaintenanceData({ refreshTrigger: combinedRefreshTrigger });
+
+  useEffect(() => {
+    if (error) {
+      toast({
+        title: t('error'),
+        description: error,
+        variant: 'destructive',
+      });
+    }
+  }, [error, toast, t]);
+
+  useEffect(() => {
+    fetchMaintenanceData(true);
+  }, [fetchMaintenanceData]);
+
+  const handleMaintenanceUpdated = () => {
+    setManualRefresh((prev) => prev + 1);
+  };
+
+  const handleTabChange = (value: string) => {
+    setFilter(value);
+  };
+
+  if (loading && !initialized) {
+    return <LoadingState />;
+  }
+
+  const gradientCard = (
+    title: string,
+    value: string | number,
+    icon: JSX.Element,
+    gradient: string
+  ) => (
+    <Card
+      className="border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative z-10"
+      style={{
+        background: theme === 'dark'
+          ? `linear-gradient(135deg, rgba(65,59,55,0.8) 0%, ${gradient})`
+          : `linear-gradient(135deg, rgba(65,59,55,0.8) 0%, ${gradient})`,
+      }}
+    >
+      <div className="absolute inset-0 z-0 opacity-10">
+        <div
+          className="w-full h-full"
+          style={{
+            backgroundImage: `linear-gradient(#000 1px, transparent 1px),
+                              linear-gradient(90deg, #fff 1px, transparent 1px)`,
+            backgroundSize: '20px 20px',
+          }}
+        />
+      </div>
+      <CardHeader className="pb-2 relative z-10">
+        <CardTitle className="text-sm font-medium text-white">{title}</CardTitle>
+      </CardHeader>
+      <CardContent className="flex items-center justify-between relative z-10">
+        <span className="text-4xl font-bold text-white">{value}</span>
+        <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+          {icon}
+        </div>
+      </CardContent>
+    </Card>
+  );
+
+  return (
+    <>
+      <MaintenanceStatusChecker
+        maintenanceData={maintenanceData}
+        onStatusUpdated={handleMaintenanceUpdated}
+      />
+
+      {/* Overview Cards */}
+      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-6 mb-8 w-full">
+        {gradientCard(
+          t('upcomingMaintenance'),
+          loading ? '...' : overviewStats.upcoming,
+          <Calendar className="h-6 w-6 text-white" />,
+          'rgba(59,130,246,0.6)'
+        )}
+        {gradientCard(
+          t('ongoingMaintenance'),
+          loading ? '...' : overviewStats.ongoing,
+          <Clock className="h-6 w-6 text-white" />,
+          'rgba(251,191,36,0.6)'
+        )}
+        {gradientCard(
+          t('completedMaintenance'),
+          loading ? '...' : overviewStats.completed,
+          <CheckCircle className="h-6 w-6 text-white" />,
+          'rgba(34,197,94,0.6)'
+        )}
+        {gradientCard(
+          t('totalScheduledHours'),
+          loading ? '...' : `${overviewStats.totalDuration}h`,
+          <Clock className="h-6 w-6 text-white" />,
+          'rgba(139,92,246,0.6)'
+        )}
+      </div>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>{t('scheduledMaintenance')}</CardTitle>
+          <CardDescription>
+            {t('scheduledMaintenanceDesc')}
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <Tabs
+            defaultValue="upcoming"
+            value={filter}
+            className="w-full"
+            onValueChange={handleTabChange}
+          >
+            <TabsList className="mb-6">
+              <TabsTrigger value="upcoming">{t('upcomingMaintenance')}</TabsTrigger>
+              <TabsTrigger value="ongoing">{t('ongoingMaintenance')}</TabsTrigger>
+              <TabsTrigger value="completed">{t('completedMaintenance')}</TabsTrigger>
+            </TabsList>
+
+            <TabsContent value="upcoming">
+              <MaintenanceTable
+                data={maintenanceData}
+                isLoading={loading && initialized}
+                onMaintenanceUpdated={handleMaintenanceUpdated}
+              />
+            </TabsContent>
+
+            <TabsContent value="ongoing">
+              <MaintenanceTable
+                data={maintenanceData}
+                isLoading={loading && initialized}
+                onMaintenanceUpdated={handleMaintenanceUpdated}
+              />
+            </TabsContent>
+
+            <TabsContent value="completed">
+              <MaintenanceTable
+                data={maintenanceData}
+                isLoading={loading && initialized}
+                onMaintenanceUpdated={handleMaintenanceUpdated}
+              />
+            </TabsContent>
+          </Tabs>
+        </CardContent>
+      </Card>
+    </>
+  );
+};
diff --git a/application/src/components/schedule-incident/common/OverviewCard.tsx b/application/src/components/schedule-incident/common/OverviewCard.tsx
new file mode 100644
index 0000000..ccbeb45
--- /dev/null
+++ b/application/src/components/schedule-incident/common/OverviewCard.tsx
@@ -0,0 +1,117 @@
+
+import React, { ReactNode } from 'react';
+import { Card, CardContent } from "@/components/ui/card";
+import { cn } from "@/lib/utils";
+import { Skeleton } from "@/components/ui/skeleton";
+import { useTheme } from "@/contexts/ThemeContext";
+
+interface OverviewCardProps {
+  title: string;
+  value: string | number;
+  description?: string;
+  icon: ReactNode;
+  trend?: {
+    value: number;
+    isPositive: boolean;
+  };
+  className?: string;
+  valueClassName?: string;
+  isLoading?: boolean;
+  color?: string;
+  gradient?: string;
+}
+
+export const OverviewCard = ({
+  title,
+  value,
+  description,
+  icon,
+  trend,
+  className,
+  valueClassName,
+  isLoading = false,
+  color = "blue",
+  gradient,
+}: OverviewCardProps) => {
+  const { theme } = useTheme();
+  
+  // Map color prop to gradient colors
+  const getGradientBackground = () => {
+    if (gradient) {
+      return gradient;
+    }
+    const colors = {
+      blue: theme === 'dark'
+        ? "linear-gradient(135deg, rgba(25, 118, 210, 0.8) 0%, rgba(66, 165, 245, 0.6) 100%)"
+        : "linear-gradient(135deg, #1976d2 0%, #42a5f5 100%)",
+      green: theme === 'dark'
+        ? "linear-gradient(135deg, rgba(67, 160, 71, 0.8) 0%, rgba(102, 187, 106, 0.6) 100%)"
+        : "linear-gradient(135deg, #43a047 0%, #66bb6a 100%)",
+      amber: theme === 'dark'
+        ? "linear-gradient(135deg, rgba(255, 152, 0, 0.8) 0%, rgba(255, 183, 77, 0.6) 100%)"
+        : "linear-gradient(135deg, #ff9800 0%, #ffb74d 100%)",
+      red: theme === 'dark'
+        ? "linear-gradient(135deg, rgba(229, 57, 53, 0.8) 0%, rgba(239, 83, 80, 0.6) 100%)"
+        : "linear-gradient(135deg, #e53935 0%, #ef5350 100%)",
+      purple: theme === 'dark'
+        ? "linear-gradient(135deg, rgba(123, 31, 162, 0.8) 0%, rgba(156, 39, 176, 0.6) 100%)"
+        : "linear-gradient(135deg, #7b1fa2 0%, #9c27b0 100%)",
+      orange: theme === 'dark'
+        ? "linear-gradient(135deg, rgba(230, 81, 0, 0.8) 0%, rgba(255, 109, 0, 0.6) 100%)"
+        : "linear-gradient(135deg, #e65100 0%, #ff6d00 100%)",
+    };
+    
+    return colors[color as keyof typeof colors] || colors.blue;
+  };
+
+  return (
+    <Card 
+      className={cn(
+        "border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative z-10", 
+        className
+      )}
+      style={{
+        background: getGradientBackground()
+      }}
+    >
+      {/* Grid Pattern Overlay */}
+      <div className="absolute inset-0 z-0 opacity-10">
+        <div className="w-full h-full" 
+          style={{ 
+            backgroundImage: `linear-gradient(#fff 1px, transparent 1px), 
+                              linear-gradient(90deg, #fff 1px, transparent 1px)`,
+            backgroundSize: '20px 20px'
+          }}
+        ></div>
+      </div>
+      
+      <CardContent className="p-6 relative z-10">
+        <div className="flex items-center justify-between">
+          <div>
+            <p className="text-sm font-medium text-white/90 mb-1">{title}</p>
+            {isLoading ? (
+              <Skeleton className="h-8 w-16 bg-white/20" />
+            ) : (
+              <h3 className={cn("text-3xl font-bold text-white", valueClassName)}>{value}</h3>
+            )}
+            {description && (
+              <p className="text-sm text-white/80 mt-1">{description}</p>
+            )}
+            {trend && (
+              <div className={`flex items-center mt-2 text-sm ${trend.isPositive ? 'text-green-100' : 'text-red-100'}`}>
+                <span className="mr-1">
+                  {trend.isPositive ? '↑' : '↓'}
+                </span>
+                <span>{Math.abs(trend.value)}%</span>
+                <span className="ml-1 text-white/70">vs last month</span>
+              </div>
+            )}
+          </div>
+          <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+            {icon}
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
diff --git a/application/src/components/schedule-incident/hooks/index.ts b/application/src/components/schedule-incident/hooks/index.ts
new file mode 100644
index 0000000..eb66169
--- /dev/null
+++ b/application/src/components/schedule-incident/hooks/index.ts
@@ -0,0 +1,3 @@
+
+export * from './useMaintenanceData';
+export * from './useIncidentData';
diff --git a/application/src/components/schedule-incident/hooks/useIncidentData.ts b/application/src/components/schedule-incident/hooks/useIncidentData.ts
new file mode 100644
index 0000000..2e0a998
--- /dev/null
+++ b/application/src/components/schedule-incident/hooks/useIncidentData.ts
@@ -0,0 +1,200 @@
+import { useState, useEffect, useCallback, useMemo, useRef } from 'react';
+import { incidentService, IncidentItem } from '@/services/incident';
+
+interface UseIncidentDataProps {
+  refreshTrigger?: number;
+}
+
+export const useIncidentData = ({ refreshTrigger = 0 }: UseIncidentDataProps) => {
+  const [incidents, setIncidents] = useState<IncidentItem[]>([]);
+  const [filter, setFilter] = useState("unresolved");
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [initialized, setInitialized] = useState(false);
+  const [isRefreshing, setIsRefreshing] = useState(false);
+  
+  // Use a ref to prevent multiple simultaneous fetch requests
+  const isFetchingRef = useRef(false);
+  // Use a ref to track the refresh trigger
+  const lastRefreshTriggerRef = useRef(refreshTrigger);
+  
+  // Simplified fetch function with improved controls to prevent duplicate calls
+  const fetchIncidentData = useCallback(async (force = false) => {
+    // Skip if already fetching
+    if (isFetchingRef.current) {
+    //  console.log('Already fetching data, skipping additional request');
+      return;
+    }
+    
+    // Skip if not forced and already initialized
+    if (initialized && !force) {
+    //  console.log('Data already initialized and no force refresh, skipping fetch');
+      return;
+    }
+    
+    // Set fetching flags
+    isFetchingRef.current = true;
+    
+    if (!initialized || force) {
+      setLoading(true);
+    }
+    
+    if (force) {
+      setIsRefreshing(true);
+    }
+    
+    setError(null);
+    
+    try {
+    //  console.log(`Fetching incident data (force=${force})`);
+      const allIncidents = await incidentService.getAllIncidents(force);
+      
+      if (Array.isArray(allIncidents)) {
+        setIncidents(allIncidents);
+     //   console.log(`Successfully set ${allIncidents.length} incidents to state`);
+      } else {
+        setIncidents([]);
+      //  console.warn('No incidents returned from service');
+      }
+      
+      setInitialized(true);
+      setLoading(false);
+      setIsRefreshing(false);
+    } catch (error) {
+    //  console.error('Error fetching incident data:', error);
+      setError('Failed to load incident data. Please try again later.');
+      setIncidents([]);
+      setInitialized(true);
+      setLoading(false);
+      setIsRefreshing(false);
+    } finally {
+      // Reset fetching flag after a slight delay to prevent rapid consecutive calls
+      setTimeout(() => {
+        isFetchingRef.current = false;
+      }, 500);
+    }
+  }, [initialized]);
+
+  // Only fetch when component mounts or refreshTrigger changes
+  useEffect(() => {
+    // Skip if the refresh trigger hasn't changed (prevents duplicate effect calls)
+    if (refreshTrigger === lastRefreshTriggerRef.current && initialized) {
+    //  console.log('Refresh trigger unchanged, skipping fetch');
+      return;
+    }
+    
+    // Update last refresh trigger ref
+    lastRefreshTriggerRef.current = refreshTrigger;
+    
+    // Create an abort controller for cleanup
+    const abortController = new AbortController();
+    let isMounted = true;
+    
+   // console.log(`useIncidentData effect running, refreshTrigger: ${refreshTrigger}`);
+    
+    // Use a longer delay to ensure we don't trigger too many API calls
+    const fetchTimer = setTimeout(() => {
+      if (isMounted) {
+        fetchIncidentData(refreshTrigger > 0);
+      }
+    }, 500); // Use a longer delay
+    
+    // Cleanup function to abort any in-flight requests and clear timers
+    return () => {
+    //  console.log('Cleaning up incident data fetch effect');
+      isMounted = false;
+      clearTimeout(fetchTimer);
+      abortController.abort();
+    };
+  }, [fetchIncidentData, refreshTrigger, initialized]);
+
+  // Filter the data based on the current filter
+  const incidentData = useMemo(() => {
+    if (!initialized || incidents.length === 0) return [];
+    
+   // console.log(`Filtering incidents by: ${filter}`);
+    
+    if (filter === "unresolved") {
+      return incidents.filter(item => {
+        const status = (item.status || item.impact_status || '').toLowerCase();
+        return status !== 'resolved';
+      });
+    } else if (filter === "resolved") {
+      return incidents.filter(item => {
+        const status = (item.status || item.impact_status || '').toLowerCase();
+        return status === 'resolved';
+      });
+    }
+    
+    return [];
+  }, [filter, incidents, initialized]);
+
+  // Calculate stats for overview cards
+  const overviewStats = useMemo(() => {
+    if (!initialized || incidents.length === 0) {
+      return {
+        unresolved: 0,
+        resolved: 0,
+        critical: 0,
+        highPriority: 0,
+        avgResolutionTime: "0h"
+      };
+    }
+    
+    const unresolvedIncidents = incidents.filter(item => {
+      const status = (item.status || item.impact_status || '').toLowerCase();
+      return status !== 'resolved';
+    });
+    
+    const resolvedIncidents = incidents.filter(item => {
+      const status = (item.status || item.impact_status || '').toLowerCase();
+      return status === 'resolved';
+    });
+    
+    const criticalCount = unresolvedIncidents.filter(item => 
+      (item.priority?.toLowerCase() === 'critical') || 
+      (item.impact?.toLowerCase() === 'critical')
+    ).length;
+    
+    const highPriorityCount = unresolvedIncidents.filter(item => 
+      (item.priority?.toLowerCase() === 'high')
+    ).length;
+    
+    let avgResolutionTime = "0h";
+    if (resolvedIncidents.length > 0) {
+      const totalHours = resolvedIncidents.reduce((total, item) => {
+        if (!item.created || !item.resolution_time) return total;
+        
+        const createdAt = new Date(item.created).getTime();
+        const resolvedAt = new Date(item.resolution_time).getTime();
+        const durationHours = (resolvedAt - createdAt) / (1000 * 60 * 60);
+        return isNaN(durationHours) ? total : total + durationHours;
+      }, 0);
+      
+      avgResolutionTime = `${(totalHours / resolvedIncidents.length).toFixed(1)}h`;
+    }
+    
+    return {
+      unresolved: unresolvedIncidents.length,
+      resolved: resolvedIncidents.length,
+      critical: criticalCount,
+      highPriority: highPriorityCount,
+      avgResolutionTime
+    };
+  }, [incidents, initialized]);
+
+  const isEmpty = !incidentData.length && initialized && !loading;
+
+  return {
+    filter,
+    setFilter,
+    incidentData,
+    overviewStats,
+    fetchIncidentData,
+    isEmpty,
+    error,
+    loading,
+    initialized,
+    isRefreshing
+  };
+};
diff --git a/application/src/components/schedule-incident/hooks/useMaintenanceData.ts b/application/src/components/schedule-incident/hooks/useMaintenanceData.ts
new file mode 100644
index 0000000..a53ead8
--- /dev/null
+++ b/application/src/components/schedule-incident/hooks/useMaintenanceData.ts
@@ -0,0 +1,181 @@
+
+import { useState, useEffect, useCallback, useMemo, useRef } from 'react';
+import { maintenanceService, MaintenanceItem } from '@/services/maintenance';
+import { useToast } from '@/hooks/use-toast';
+import { useLanguage } from '@/contexts/LanguageContext';
+
+interface UseMaintenanceDataProps {
+  refreshTrigger?: number;
+}
+
+export const useMaintenanceData = ({ refreshTrigger = 0 }: UseMaintenanceDataProps) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [loading, setLoading] = useState(true);
+  const [allMaintenanceData, setAllMaintenanceData] = useState<MaintenanceItem[]>([]);
+  const [filter, setFilter] = useState("upcoming");
+  const [error, setError] = useState<string | null>(null);
+  const [initialized, setInitialized] = useState(false);
+  
+  // Refs for cleanup and request management
+  const mountedRef = useRef(true);
+  const currentRequestRef = useRef<Promise<void> | null>(null);
+
+  // Memoize categorized data to prevent unnecessary recalculations
+  const categorizedData = useMemo(() => {
+    if (!allMaintenanceData.length) return { upcoming: [], ongoing: [], completed: [] };
+    
+    const currentDate = new Date();
+    const upcoming: MaintenanceItem[] = [];
+    const ongoing: MaintenanceItem[] = [];
+    const completed: MaintenanceItem[] = [];
+    
+    allMaintenanceData.forEach(item => {
+      const status = item.status?.toLowerCase() || '';
+      const startTime = new Date(item.start_time);
+      const endTime = new Date(item.end_time);
+      
+      if (status === 'completed' || status === 'cancelled') {
+        completed.push(item);
+      } else if (status === 'in_progress' || 
+                (status === 'scheduled' && startTime <= currentDate && endTime >= currentDate)) {
+        ongoing.push(item);
+      } else if (status === 'scheduled' && startTime > currentDate) {
+        upcoming.push(item);
+      } else {
+        // Default case: treat as upcoming if we can't determine
+        upcoming.push(item);
+      }
+    });
+    
+    return { upcoming, ongoing, completed };
+  }, [allMaintenanceData]);
+
+  // Simple fetch function - only called when explicitly requested
+  const fetchMaintenanceData = useCallback(async (force = false) => {
+    // Check if component is still mounted
+    if (!mountedRef.current) return;
+    
+    // Prevent duplicate requests
+    if (currentRequestRef.current) {
+      await currentRequestRef.current;
+      return;
+    }
+    
+    // Only show loading state for initial load or forced refresh
+    if (!initialized || force) {
+      setLoading(true);
+    }
+    
+    setError(null);
+    
+    const requestPromise = (async () => {
+      try {
+        const data = await maintenanceService.getMaintenanceRecords();
+        
+        // Check if component is still mounted before updating state
+        if (!mountedRef.current) return;
+        
+        // Update state with fetched data
+        setAllMaintenanceData(data);
+        setInitialized(true);
+        
+        // Clear any previous error
+        if (error) {
+          setError(null);
+        }
+        
+      } catch (err) {
+        console.error('Error fetching maintenance data:', err);
+        
+        // Only update error state if component is still mounted
+        if (!mountedRef.current) return;
+        
+        const errorMessage = 'Failed to load maintenance data. Please try again.';
+        setError(errorMessage);
+        
+        // Show toast for errors
+        toast({
+          title: t('error'),
+          description: t('errorFetchingMaintenanceData'),
+          variant: 'destructive',
+        });
+      } finally {
+        // Only update loading state if component is still mounted
+        if (mountedRef.current) {
+          setLoading(false);
+        }
+        currentRequestRef.current = null;
+      }
+    })();
+
+    currentRequestRef.current = requestPromise;
+    await requestPromise;
+  }, [t, toast, error, initialized]);
+
+  // Initial fetch on mount - NO AUTOMATIC POLLING
+  useEffect(() => {
+    mountedRef.current = true;
+    
+    // Only fetch initial data, no polling
+    fetchMaintenanceData(true);
+    
+    return () => {
+      mountedRef.current = false;
+      currentRequestRef.current = null;
+    };
+  }, []); // Remove fetchMaintenanceData from dependencies to prevent re-runs
+
+  // Handle refresh trigger changes - ONLY when explicitly triggered
+  useEffect(() => {
+    if (refreshTrigger > 0) {
+      fetchMaintenanceData(true); // Force refresh to bypass cache
+    }
+  }, [refreshTrigger, fetchMaintenanceData]);
+
+  // Get filtered data based on current tab
+  const maintenanceData = useMemo(() => {
+    if (!initialized) return [];
+    return categorizedData[filter as keyof typeof categorizedData] || [];
+  }, [filter, categorizedData, initialized]);
+
+  // Calculate overview stats with memoization
+  const overviewStats = useMemo(() => {
+    const { upcoming, ongoing, completed } = categorizedData;
+    
+    // Calculate total hours more efficiently
+    const calculateTotalHours = (items: MaintenanceItem[]) => {
+      return items.reduce((total, item) => {
+        try {
+          const start = new Date(item.start_time).getTime();
+          const end = new Date(item.end_time).getTime();
+          const durationHours = (end - start) / (1000 * 60 * 60);
+          return total + (isNaN(durationHours) ? 0 : durationHours);
+        } catch (e) {
+          return total;
+        }
+      }, 0).toFixed(1);
+    };
+    
+    return {
+      upcoming: upcoming.length,
+      ongoing: ongoing.length,
+      completed: completed.length,
+      totalDuration: calculateTotalHours([...upcoming, ...ongoing]),
+    };
+  }, [categorizedData]);
+
+  const isEmpty = !loading && maintenanceData.length === 0 && initialized;
+
+  return {
+    loading,
+    filter,
+    setFilter,
+    maintenanceData,
+    overviewStats,
+    fetchMaintenanceData,
+    isEmpty,
+    error,
+    initialized,
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/schedule-incident/incident-management/ErrorState.tsx b/application/src/components/schedule-incident/incident-management/ErrorState.tsx
new file mode 100644
index 0000000..0292164
--- /dev/null
+++ b/application/src/components/schedule-incident/incident-management/ErrorState.tsx
@@ -0,0 +1,37 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { Button } from '@/components/ui/button';
+import { RefreshCw } from 'lucide-react';
+
+interface ErrorStateProps {
+  error: string | null;
+  onRefresh: () => void;
+  isRefreshing: boolean;
+}
+
+export const ErrorState: React.FC<ErrorStateProps> = ({ 
+  error,
+  onRefresh,
+  isRefreshing
+}) => {
+  const { t } = useLanguage();
+
+  if (!error) return null;
+
+  return (
+    <div className="text-center py-8">
+      <p className="text-muted-foreground mb-4">{error}</p>
+      <Button 
+        variant="outline" 
+        size="sm" 
+        onClick={onRefresh}
+        className="flex items-center gap-2"
+        disabled={isRefreshing}
+      >
+        <RefreshCw className={`h-4 w-4 ${isRefreshing ? 'animate-spin' : ''}`} />
+        {t('tryAgain')}
+      </Button>
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident-management/HeaderActions.tsx b/application/src/components/schedule-incident/incident-management/HeaderActions.tsx
new file mode 100644
index 0000000..fa1e9df
--- /dev/null
+++ b/application/src/components/schedule-incident/incident-management/HeaderActions.tsx
@@ -0,0 +1,37 @@
+
+import React from 'react';
+import { CardDescription, CardTitle } from '@/components/ui/card';
+import { Button } from '@/components/ui/button';
+import { RefreshCw } from 'lucide-react';
+import { useLanguage } from '@/contexts/LanguageContext';
+
+interface HeaderActionsProps {
+  onRefresh: () => void;
+  isRefreshing: boolean;
+}
+
+export const HeaderActions: React.FC<HeaderActionsProps> = ({ onRefresh, isRefreshing }) => {
+  const { t } = useLanguage();
+  
+  return (
+    <div className="flex flex-row items-center justify-between">
+      <div>
+        <CardTitle>{t('incidentManagement')}</CardTitle>
+        <CardDescription>
+          {t('incidentsManagementDesc')}
+        </CardDescription>
+      </div>
+      <Button 
+        variant="outline" 
+        size="icon" 
+        onClick={onRefresh} 
+        className="ml-auto"
+        title={t('refreshData')}
+        disabled={isRefreshing}
+      >
+        <RefreshCw className={`h-4 w-4 ${isRefreshing ? 'animate-spin' : ''}`} />
+        <span className="sr-only">{t('refresh')}</span>
+      </Button>
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident-management/IncidentManagementContainer.tsx b/application/src/components/schedule-incident/incident-management/IncidentManagementContainer.tsx
new file mode 100644
index 0000000..bca2878
--- /dev/null
+++ b/application/src/components/schedule-incident/incident-management/IncidentManagementContainer.tsx
@@ -0,0 +1,171 @@
+
+import React, { useState, useCallback, useRef } from 'react';
+import { Tabs, TabsList, TabsTrigger, TabsContent } from '@/components/ui/tabs';
+import { Card, CardContent, CardHeader } from '@/components/ui/card';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useIncidentData } from '../hooks/useIncidentData';
+import { IncidentItem } from '@/services/incident';
+import { useToast } from '@/hooks/use-toast';
+import { OverviewCards } from './OverviewCards';
+import { HeaderActions } from './HeaderActions';
+import { TabContent } from './TabContent';
+import { LoadingState } from '@/components/services/LoadingState';
+import { IncidentDetailDialog } from '../incident/detail-dialog/IncidentDetailDialog';
+
+interface IncidentManagementContainerProps {
+  refreshTrigger?: number;
+}
+
+export const IncidentManagementContainer: React.FC<IncidentManagementContainerProps> = ({ 
+  refreshTrigger = 0 
+}) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [selectedIncident, setSelectedIncident] = useState<IncidentItem | null>(null);
+  const [detailDialogOpen, setDetailDialogOpen] = useState(false);
+  const [manualRefresh, setManualRefresh] = useState(0);
+  
+  // Use a ref to debounce multiple refresh requests
+  const refreshTimerRef = useRef<number | null>(null);
+  
+  // Combine the external refresh trigger with our internal one
+  const combinedRefreshTrigger = refreshTrigger + manualRefresh;
+  
+  const { 
+    filter, 
+    setFilter, 
+    incidentData, 
+    overviewStats, 
+    isEmpty,
+    loading,
+    error,
+    initialized,
+    isRefreshing
+  } = useIncidentData({ refreshTrigger: combinedRefreshTrigger });
+
+  // Handle incident updates with debouncing
+  const handleIncidentUpdated = useCallback(() => {
+    console.log('Incident updated, triggering refresh');
+    
+    // Clear any existing timer
+    if (refreshTimerRef.current !== null) {
+      window.clearTimeout(refreshTimerRef.current);
+    }
+    
+    // Set a new timer to debounce multiple quick updates
+    refreshTimerRef.current = window.setTimeout(() => {
+      setManualRefresh(prev => prev + 1);
+      refreshTimerRef.current = null;
+      
+      toast({
+        title: t('incidentUpdated'),
+        description: t('incidentUpdateSuccess'),
+      });
+    }, 300);
+    
+  }, [t, toast]);
+
+  // Handle tab changes
+  const handleTabChange = useCallback((value: string) => {
+    console.log(`Tab changed to: ${value}`);
+    setFilter(value);
+  }, [setFilter]);
+
+  // Handle view incident details
+  const handleViewIncidentDetails = useCallback((incident: IncidentItem) => {
+    setSelectedIncident(incident);
+    setDetailDialogOpen(true);
+  }, []);
+
+  // Handle manual refresh
+  const handleManualRefresh = useCallback(() => {
+    console.log('Manual refresh triggered by user');
+    setManualRefresh(prev => prev + 1);
+  }, []);
+
+  // Handle detail dialog close with refresh
+  const handleDetailDialogClose = useCallback((open: boolean) => {
+    setDetailDialogOpen(open);
+    if (!open) {
+      // When dialog closes, refresh data
+      handleManualRefresh();
+    }
+  }, [handleManualRefresh]);
+
+  // Clean up timer on unmount
+  React.useEffect(() => {
+    return () => {
+      if (refreshTimerRef.current !== null) {
+        window.clearTimeout(refreshTimerRef.current);
+      }
+    };
+  }, []);
+
+  // Show full-page loading state during initial load
+  if (loading && !initialized) {
+    return <LoadingState />;
+  }
+
+  return (
+    <>
+      {/* Overview Cards */}
+      <OverviewCards 
+        overviewStats={overviewStats} 
+        loading={loading} 
+        initialized={initialized} 
+      />
+
+      <Card>
+        <CardHeader>
+          <HeaderActions 
+            onRefresh={handleManualRefresh} 
+            isRefreshing={isRefreshing} 
+          />
+        </CardHeader>
+        <CardContent>
+          <Tabs value={filter} className="w-full" onValueChange={handleTabChange}>
+            <TabsList className="mb-6">
+              <TabsTrigger value="unresolved">{t('unresolvedIncidents')}</TabsTrigger>
+              <TabsTrigger value="resolved">{t('resolvedIncidents')}</TabsTrigger>
+            </TabsList>
+
+            <TabsContent value="unresolved" className="space-y-4">
+              <TabContent 
+                error={error}
+                isEmpty={isEmpty}
+                data={incidentData}
+                loading={loading}
+                initialized={initialized}
+                isRefreshing={isRefreshing}
+                onIncidentUpdated={handleIncidentUpdated}
+                onViewDetails={handleViewIncidentDetails}
+                onRefresh={handleManualRefresh}
+              />
+            </TabsContent>
+            
+            <TabsContent value="resolved" className="space-y-4">
+              <TabContent 
+                error={error}
+                isEmpty={isEmpty}
+                data={incidentData}
+                loading={loading}
+                initialized={initialized}
+                isRefreshing={isRefreshing}
+                onIncidentUpdated={handleIncidentUpdated}
+                onViewDetails={handleViewIncidentDetails}
+                onRefresh={handleManualRefresh}
+              />
+            </TabsContent>
+          </Tabs>
+        </CardContent>
+      </Card>
+
+      {/* Incident Detail Dialog */}
+      <IncidentDetailDialog 
+        open={detailDialogOpen}
+        onOpenChange={handleDetailDialogClose}
+        incident={selectedIncident}
+      />
+    </>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident-management/OverviewCards.tsx b/application/src/components/schedule-incident/incident-management/OverviewCards.tsx
new file mode 100644
index 0000000..73566b9
--- /dev/null
+++ b/application/src/components/schedule-incident/incident-management/OverviewCards.tsx
@@ -0,0 +1,89 @@
+
+import React from 'react';
+import { AlertCircle, CheckCircle, Clock, AlertTriangle, Flag } from 'lucide-react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { OverviewCard } from '../common/OverviewCard';
+import { useTheme } from '@/contexts/ThemeContext';
+
+interface OverviewStatsProps {
+  unresolved: number;
+  resolved: number;
+  critical: number;
+  highPriority: number;
+  avgResolutionTime: string;
+}
+
+interface OverviewCardsProps {
+  overviewStats: OverviewStatsProps;
+  loading: boolean;
+  initialized: boolean;
+}
+
+export const OverviewCards: React.FC<OverviewCardsProps> = ({ 
+  overviewStats, 
+  loading, 
+  initialized 
+}) => {
+  const { t } = useLanguage();
+  const { theme } = useTheme();
+
+  return (
+    <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-5 gap-4 mb-6">
+      <OverviewCard
+        title={t('activeIncidents')}
+        value={overviewStats.unresolved.toString()}
+        icon={<AlertCircle className="h-5 w-5 text-white" />}
+        isLoading={loading && initialized}
+        gradient={
+          theme === "dark"
+            ? "linear-gradient(135deg, #4b3b37 0%, rgba(239, 83, 80, 0.6) 100%)"
+            : "linear-gradient(135deg, #4b3b37 0%, rgba(239, 83, 80, 0.6) 100%)"
+        }
+      />
+      <OverviewCard
+        title={t('criticalIssues')}
+        value={overviewStats.critical.toString()}
+        icon={<AlertTriangle className="h-5 w-5 text-white" />}
+        isLoading={loading && initialized}
+        gradient={
+          theme === "dark"
+            ? "linear-gradient(135deg, #4b3b37 0%, rgba(255, 183, 77, 0.6) 100%)"
+            : "linear-gradient(135deg, #4b3b37 0%, rgba(255, 183, 77, 0.6) 100%)"
+        }
+      />
+      <OverviewCard
+        title={t('highPriority')}
+        value={overviewStats.highPriority.toString()}
+        icon={<Flag className="h-5 w-5 text-white" />}
+        isLoading={loading && initialized}
+        gradient={
+          theme === "dark"
+            ? "linear-gradient(135deg, #4b3b37 0%, rgba(255, 109, 0, 0.6) 100%)"
+            : "linear-gradient(135deg, #4b3b37 0%, rgba(255, 109, 0, 0.6) 100%)"
+        }
+      />
+      <OverviewCard
+        title={t('resolvedIncidents')}
+        value={overviewStats.resolved.toString()}
+        icon={<CheckCircle className="h-5 w-5 text-white" />}
+        isLoading={loading && initialized}
+        gradient={
+          theme === "dark"
+            ? "linear-gradient(135deg, #4b3b37 0%, rgba(102, 187, 106, 0.6) 100%)"
+            : "linear-gradient(135deg, #4b3b37 0%, rgba(102, 187, 106, 0.6) 100%)"
+        }
+      />
+      <OverviewCard
+        title={t('avgResolutionTime')}
+        value={overviewStats.avgResolutionTime}
+        icon={<Clock className="h-5 w-5 text-white" />}
+        isLoading={loading && initialized}
+        gradient={
+          theme === "dark"
+            ? "linear-gradient(135deg, #4b3b37 0%, rgba(66, 165, 245, 0.6) 100%)"
+            : "linear-gradient(135deg, #4b3b37 0%, rgba(66, 165, 245, 0.6) 100%)"
+        }
+      />
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident-management/TabContent.tsx b/application/src/components/schedule-incident/incident-management/TabContent.tsx
new file mode 100644
index 0000000..a457694
--- /dev/null
+++ b/application/src/components/schedule-incident/incident-management/TabContent.tsx
@@ -0,0 +1,47 @@
+
+import React from 'react';
+import { IncidentTable } from '../incident/table/IncidentTable';
+import { EmptyIncidentState } from '../incident/EmptyIncidentState';
+import { ErrorState } from './ErrorState';
+import { IncidentItem } from '@/services/incident';
+
+interface TabContentProps {
+  error: string | null;
+  isEmpty: boolean;
+  data: IncidentItem[];
+  loading: boolean;
+  initialized: boolean;
+  isRefreshing: boolean;
+  onIncidentUpdated: () => void;
+  onViewDetails: (incident: IncidentItem) => void;
+  onRefresh: () => void;
+}
+
+export const TabContent: React.FC<TabContentProps> = ({
+  error,
+  isEmpty,
+  data,
+  loading,
+  initialized,
+  isRefreshing,
+  onIncidentUpdated,
+  onViewDetails,
+  onRefresh
+}) => {
+  if (error) {
+    return <ErrorState error={error} onRefresh={onRefresh} isRefreshing={isRefreshing} />;
+  }
+  
+  if (isEmpty) {
+    return <EmptyIncidentState />;
+  }
+  
+  return (
+    <IncidentTable 
+      data={data}
+      onIncidentUpdated={onIncidentUpdated}
+      onViewDetails={onViewDetails}
+      isLoading={loading && initialized}
+    />
+  );
+};
diff --git a/application/src/components/schedule-incident/incident-management/index.ts b/application/src/components/schedule-incident/incident-management/index.ts
new file mode 100644
index 0000000..4ad0804
--- /dev/null
+++ b/application/src/components/schedule-incident/incident-management/index.ts
@@ -0,0 +1,6 @@
+
+export * from './IncidentManagementContainer';
+export * from './OverviewCards';
+export * from './TabContent';
+export * from './ErrorState';
+export * from './HeaderActions';
diff --git a/application/src/components/schedule-incident/incident/CreateIncidentDialog.tsx b/application/src/components/schedule-incident/incident/CreateIncidentDialog.tsx
new file mode 100644
index 0000000..08dbf1c
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/CreateIncidentDialog.tsx
@@ -0,0 +1,96 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+  DialogFooter,
+} from '@/components/ui/dialog';
+import { Button } from '@/components/ui/button';
+import { Form } from '@/components/ui/form';
+import { useIncidentForm } from './hooks/useIncidentForm';
+import { ScrollArea } from '@/components/ui/scroll-area';
+import {
+  IncidentBasicFields,
+  IncidentAffectedFields,
+  IncidentConfigFields,
+  IncidentDetailsFields,
+} from './form';
+
+interface CreateIncidentDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onIncidentCreated: () => void;
+}
+
+export const CreateIncidentDialog: React.FC<CreateIncidentDialogProps> = ({
+  open,
+  onOpenChange,
+  onIncidentCreated,
+}) => {
+  const { t } = useLanguage();
+  const { form, onSubmit } = useIncidentForm(
+    onIncidentCreated,
+    () => onOpenChange(false)
+  );
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[700px] max-h-[90vh]">
+        <ScrollArea className="h-[80vh]">
+          <div className="px-1 py-2">
+            <DialogHeader className="mb-4">
+              <DialogTitle className="text-xl">{t('createIncident')}</DialogTitle>
+              <DialogDescription>
+                {t('createIncidentDesc')}
+              </DialogDescription>
+            </DialogHeader>
+            
+            <Form {...form}>
+              <form onSubmit={onSubmit} className="space-y-6">
+                <div className="space-y-8 pb-4">
+                  <div className="space-y-4">
+                    <h3 className="text-sm font-medium border-b pb-2">{t('basicInfo')}</h3>
+                    <IncidentBasicFields />
+                  </div>
+                  
+                  <div className="space-y-4">
+                    <h3 className="text-sm font-medium border-b pb-2">{t('affectedSystems')}</h3>
+                    <IncidentAffectedFields />
+                  </div>
+                  
+                  <div className="space-y-4">
+                    <h3 className="text-sm font-medium border-b pb-2">{t('configuration')}</h3>
+                    <IncidentConfigFields />
+                  </div>
+                  
+                  <div className="space-y-4">
+                    <h3 className="text-sm font-medium border-b pb-2">{t('resolutionDetails')}</h3>
+                    <IncidentDetailsFields />
+                  </div>
+                  
+                  <DialogFooter className="pt-4 mt-4 border-t">
+                    <Button
+                      type="button"
+                      variant="outline"
+                      onClick={() => onOpenChange(false)}
+                    >
+                      {t('cancel')}
+                    </Button>
+                    <Button type="submit">
+                      {form.formState.isSubmitting ? t('creating') : t('create')}
+                    </Button>
+                  </DialogFooter>
+                </div>
+              </form>
+            </Form>
+          </div>
+        </ScrollArea>
+      </DialogContent>
+    </Dialog>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/EditIncidentDialog.tsx b/application/src/components/schedule-incident/incident/EditIncidentDialog.tsx
new file mode 100644
index 0000000..4ea6a4a
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/EditIncidentDialog.tsx
@@ -0,0 +1,105 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+  DialogFooter,
+} from '@/components/ui/dialog';
+import { Button } from '@/components/ui/button';
+import { Form } from '@/components/ui/form';
+import { ScrollArea } from '@/components/ui/scroll-area';
+import { useIncidentEditForm } from './hooks/useIncidentEditForm';
+import {
+  IncidentBasicFields,
+  IncidentAffectedFields,
+  IncidentConfigFields,
+  IncidentDetailsFields,
+} from './form';
+import { IncidentItem } from '@/services/incident/types';
+
+interface EditIncidentDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  incident: IncidentItem;
+  onIncidentUpdated: () => void;
+}
+
+export const EditIncidentDialog: React.FC<EditIncidentDialogProps> = ({
+  open,
+  onOpenChange,
+  incident,
+  onIncidentUpdated,
+}) => {
+  const { t } = useLanguage();
+  
+  const handleClose = () => {
+    onOpenChange(false);
+  };
+  
+  const { form, onSubmit } = useIncidentEditForm(
+    incident,
+    onIncidentUpdated,
+    handleClose
+  );
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[700px] max-h-[90vh]">
+        <ScrollArea className="h-[80vh]">
+          <div className="px-1 py-2">
+            <DialogHeader className="mb-4">
+              <DialogTitle className="text-xl">{t('editIncident')}</DialogTitle>
+              <DialogDescription>
+                {t('editIncidentDesc')}
+              </DialogDescription>
+            </DialogHeader>
+            
+            <Form {...form}>
+              <form onSubmit={onSubmit} className="space-y-6">
+                <div className="space-y-8 pb-4">
+                  <div className="space-y-4">
+                    <h3 className="text-sm font-medium border-b pb-2">{t('basicInfo')}</h3>
+                    <IncidentBasicFields />
+                  </div>
+                  
+                  <div className="space-y-4">
+                    <h3 className="text-sm font-medium border-b pb-2">{t('affectedSystems')}</h3>
+                    <IncidentAffectedFields />
+                  </div>
+                  
+                  <div className="space-y-4">
+                    <h3 className="text-sm font-medium border-b pb-2">{t('configuration')}</h3>
+                    <IncidentConfigFields />
+                  </div>
+                  
+                  <div className="space-y-4">
+                    <h3 className="text-sm font-medium border-b pb-2">{t('resolutionDetails')}</h3>
+                    <IncidentDetailsFields />
+                  </div>
+                  
+                  <DialogFooter className="pt-4 mt-4 border-t">
+                    <Button
+                      type="button"
+                      variant="outline"
+                      onClick={handleClose}
+                    >
+                      {t('cancel')}
+                    </Button>
+                    <Button type="submit">
+                      {form.formState.isSubmitting ? t('updating') : t('update')}
+                    </Button>
+                  </DialogFooter>
+                </div>
+              </form>
+            </Form>
+          </div>
+        </ScrollArea>
+      </DialogContent>
+    </Dialog>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/EmptyIncidentState.tsx b/application/src/components/schedule-incident/incident/EmptyIncidentState.tsx
new file mode 100644
index 0000000..25aefa0
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/EmptyIncidentState.tsx
@@ -0,0 +1,18 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { AlertCircle } from 'lucide-react';
+
+export const EmptyIncidentState = () => {
+  const { t } = useLanguage();
+  
+  return (
+    <div className="flex flex-col items-center justify-center py-12 text-gray-500">
+      <AlertCircle className="w-12 h-12 mb-4" />
+      <h3 className="text-lg font-medium mb-2">{t('noIncidents')}</h3>
+      <p className="text-sm text-center max-w-md">
+        {t('noServices')}
+      </p>
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/IncidentActionsMenu.tsx b/application/src/components/schedule-incident/incident/IncidentActionsMenu.tsx
new file mode 100644
index 0000000..37b6615
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/IncidentActionsMenu.tsx
@@ -0,0 +1,114 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import { Button } from '@/components/ui/button';
+import { MoreHorizontal, Eye, Edit, Trash, Check } from 'lucide-react';
+import { useToast } from '@/hooks/use-toast';
+import { updateIncidentStatus, deleteIncident } from '@/services/incident/incidentOperations';
+import { IncidentItem } from '@/services/incident/types';
+
+interface IncidentActionsMenuProps {
+  item: IncidentItem;
+  onIncidentUpdated: () => void;
+  onViewDetails?: (incident: IncidentItem) => void;
+  onEditIncident?: (incident: IncidentItem) => void;
+}
+
+export const IncidentActionsMenu = ({ 
+  item, 
+  onIncidentUpdated,
+  onViewDetails,
+  onEditIncident
+}: IncidentActionsMenuProps) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+
+  const handleResolveIncident = async () => {
+    try {
+      await updateIncidentStatus(item.id, 'resolved');
+      toast({
+        title: t('success'),
+        description: t('incidentResolved'),
+      });
+      onIncidentUpdated();
+    } catch (error) {
+      console.error('Error resolving incident:', error);
+      toast({
+        title: t('error'),
+        description: t('errorResolvingIncident'),
+        variant: 'destructive',
+      });
+    }
+  };
+
+  const handleDeleteIncident = async () => {
+    try {
+      await deleteIncident(item.id);
+      toast({
+        title: t('success'),
+        description: t('incidentDeleted'),
+      });
+      onIncidentUpdated();
+    } catch (error) {
+      console.error('Error deleting incident:', error);
+      toast({
+        title: t('error'),
+        description: t('errorDeletingIncident'),
+        variant: 'destructive',
+      });
+    }
+  };
+
+  const handleEditClick = () => {
+    if (onEditIncident) {
+      onEditIncident(item);
+    } else {
+      console.log(`Edit incident ${item.id}`);
+    }
+  };
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button variant="ghost" className="h-8 w-8 p-0">
+          <span className="sr-only">{t('actions')}</span>
+          <MoreHorizontal className="h-4 w-4" />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="bg-background">
+        <DropdownMenuLabel>{t('actions')}</DropdownMenuLabel>
+        <DropdownMenuSeparator />
+        {onViewDetails && (
+          <DropdownMenuItem onClick={() => onViewDetails(item)}>
+            <Eye className="mr-2 h-4 w-4" />
+            {t('view')}
+          </DropdownMenuItem>
+        )}
+        <DropdownMenuItem onClick={handleEditClick}>
+          <Edit className="mr-2 h-4 w-4" />
+          {t('edit')}
+        </DropdownMenuItem>
+        <DropdownMenuItem onClick={handleResolveIncident}>
+          <Check className="mr-2 h-4 w-4" />
+          {t('resolve')}
+        </DropdownMenuItem>
+        <DropdownMenuSeparator />
+        <DropdownMenuItem
+          onClick={handleDeleteIncident}
+          className="text-red-600 focus:text-red-600"
+        >
+          <Trash className="mr-2 h-4 w-4" />
+          {t('delete')}
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/IncidentStatusBadge.tsx b/application/src/components/schedule-incident/incident/IncidentStatusBadge.tsx
new file mode 100644
index 0000000..3e76f66
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/IncidentStatusBadge.tsx
@@ -0,0 +1,105 @@
+
+import React from 'react';
+import { Badge } from '@/components/ui/badge';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { 
+  AlertCircle, 
+  CheckCircle, 
+  Gauge, 
+  Search, 
+  Wrench,
+  LucideIcon
+} from 'lucide-react';
+
+interface IncidentStatusBadgeProps {
+  status: string;
+}
+
+type StatusConfig = {
+  label: string;
+  variant: 'outline' | 'default' | 'secondary' | 'destructive';
+  icon: LucideIcon;
+  className?: string;
+}
+
+export const IncidentStatusBadge = ({ status }: IncidentStatusBadgeProps) => {
+  const { t } = useLanguage();
+  
+  // Normalize the status string
+  const normalizedStatus = (status || '').toLowerCase();
+  
+  // Status configuration map
+  const statusConfigs: Record<string, StatusConfig> = {
+    'investigating': {
+      label: t('investigating'),
+      variant: 'destructive',
+      icon: Search,
+      className: 'bg-red-100 border-red-200 text-red-700 hover:bg-red-100',
+    },
+    'identified': {
+      label: t('identified'),
+      variant: 'secondary',
+      icon: AlertCircle,
+      className: 'bg-amber-100 border-amber-200 text-amber-700 hover:bg-amber-100',
+    },
+    'found_root_cause': {
+      label: t('rootCauseFound'),
+      variant: 'secondary',
+      icon: AlertCircle,
+      className: 'bg-amber-100 border-amber-200 text-amber-700 hover:bg-amber-100',
+    },
+    'completed': {
+      label: t('completed'),
+      variant: 'default',
+      icon: CheckCircle,
+      className: 'bg-green-100 border-green-200 text-green-700 hover:bg-green-100',
+    },
+    'in_progress': {
+      label: t('inProgress'),
+      variant: 'default',
+      icon: Wrench,
+      className: 'bg-blue-100 border-blue-200 text-blue-700 hover:bg-blue-100',
+    },
+    'inprogress': {
+      label: t('inProgress'),
+      variant: 'default',
+      icon: Wrench,
+      className: 'bg-blue-100 border-blue-200 text-blue-700 hover:bg-blue-100',
+    },
+    'monitoring': {
+      label: t('monitoring'),
+      variant: 'outline',
+      icon: Gauge,
+      className: 'bg-purple-100 border-purple-200 text-purple-700 hover:bg-purple-100',
+    },
+    'resolved': {
+      label: t('resolved'),
+      variant: 'default',
+      icon: CheckCircle,
+      className: 'bg-green-100 border-green-200 text-green-700 hover:bg-green-100',
+    }
+  };
+  
+  // Find the appropriate config, defaulting to investigating if not found
+  const getStatusConfig = (): StatusConfig => {
+    for (const [key, config] of Object.entries(statusConfigs)) {
+      if (normalizedStatus.includes(key)) {
+        return config;
+      }
+    }
+    return statusConfigs['investigating'];
+  };
+  
+  const config = getStatusConfig();
+  const Icon = config.icon;
+  
+  return (
+    <Badge 
+      variant={config.variant} 
+      className={`flex items-center gap-1 ${config.className}`}
+    >
+      <Icon className="h-3 w-3" />
+      <span>{config.label}</span>
+    </Badge>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/IncidentStatusDropdown.tsx b/application/src/components/schedule-incident/incident/IncidentStatusDropdown.tsx
new file mode 100644
index 0000000..661e23a
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/IncidentStatusDropdown.tsx
@@ -0,0 +1,105 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { AlertCircle, CheckCircle, Gauge, Search, Wrench } from 'lucide-react';
+import { useToast } from '@/hooks/use-toast';
+import { updateIncidentStatus } from '@/services/incident/incidentOperations';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import { IncidentStatusBadge } from './IncidentStatusBadge';
+
+interface IncidentStatusDropdownProps {
+  status: string;
+  id: string;
+  onStatusUpdated: () => void;
+  disabled?: boolean;
+}
+
+export const IncidentStatusDropdown = ({
+  status,
+  id,
+  onStatusUpdated,
+  disabled = false
+}: IncidentStatusDropdownProps) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [localStatus, setLocalStatus] = React.useState(status);
+
+  // Update local status when prop changes
+  React.useEffect(() => {
+    setLocalStatus(status);
+  }, [status]);
+
+  const statusOptions = [
+    { value: 'investigating', label: t('investigating'), icon: <Search className="h-4 w-4 mr-2" /> },
+    { value: 'identified', label: t('identified'), icon: <AlertCircle className="h-4 w-4 mr-2" /> },
+    { value: 'found_root_cause', label: t('foundRootCause'), icon: <AlertCircle className="h-4 w-4 mr-2" /> },
+    { value: 'in_progress', label: t('inProgress'), icon: <Wrench className="h-4 w-4 mr-2" /> },
+    { value: 'monitoring', label: t('monitoring'), icon: <Gauge className="h-4 w-4 mr-2" /> },
+    { value: 'resolved', label: t('resolved'), icon: <CheckCircle className="h-4 w-4 mr-2" /> },
+  ];
+
+  const handleStatusChange = async (newStatus: string) => {
+    try {
+      // Don't update if the status is the same
+      if (localStatus === newStatus) {
+        return;
+      }
+      
+      console.log(`Changing incident status from ${localStatus} to ${newStatus}`);
+      
+      // Optimistically update the UI immediately
+      setLocalStatus(newStatus);
+      
+      // Make the API call in the background
+      await updateIncidentStatus(id, newStatus);
+      
+      toast({
+        title: t('statusUpdated'),
+        description: t('incidentStatusUpdated'),
+      });
+      
+      // Notify parent components about the status change
+      onStatusUpdated();
+      console.log('Status update complete, UI refresh triggered');
+    } catch (error) {
+      console.error('Error updating incident status:', error);
+      
+      // Revert to the original status on error
+      setLocalStatus(status);
+      
+      toast({
+        title: t('error'),
+        description: t('failedToUpdateStatus'),
+        variant: 'destructive',
+      });
+    }
+  };
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger disabled={disabled} className="w-full cursor-pointer">
+        <IncidentStatusBadge status={localStatus} />
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="bg-background border border-border shadow-md z-50">
+        {statusOptions.map((option) => (
+          <DropdownMenuItem
+            key={option.value}
+            className="flex items-center cursor-pointer"
+            onClick={(e) => {
+              e.stopPropagation(); // Prevent event from bubbling to table row click
+              handleStatusChange(option.value);
+            }}
+          >
+            {option.icon}
+            {option.label}
+          </DropdownMenuItem>
+        ))}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/IncidentTable.tsx b/application/src/components/schedule-incident/incident/IncidentTable.tsx
new file mode 100644
index 0000000..5512abc
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/IncidentTable.tsx
@@ -0,0 +1,3 @@
+
+// Re-export the refactored IncidentTable component
+export { IncidentTable } from './table/IncidentTable';
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailContent.tsx b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailContent.tsx
new file mode 100644
index 0000000..3424dee
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailContent.tsx
@@ -0,0 +1,77 @@
+
+import React from 'react';
+import { IncidentItem } from '@/services/incident/types';
+import { ScrollArea } from '@/components/ui/scroll-area';
+import { IncidentDetailHeader } from './IncidentDetailHeader';
+import { Separator } from '@/components/ui/separator';
+import { 
+  BasicInfoSection, 
+  TimelineSection, 
+  AffectedSystemsSection,
+  ResolutionSection
+} from './sections';
+import { IncidentDetailFooter } from './IncidentDetailFooter';
+import { useQuery } from '@tanstack/react-query';
+import { userService } from '@/services/userService';
+
+interface IncidentDetailContentProps {
+  incident: IncidentItem;
+  onClose: () => void;
+  assignedUser: any | null;
+}
+
+export const IncidentDetailContent = ({ 
+  incident, 
+  onClose, 
+  assignedUser 
+}: IncidentDetailContentProps) => {
+  // Fetch assigned user details if none was provided; prefer server field
+  const assigneeId = incident?.assigned_users || incident?.assigned_to;
+  const { data: fetchedUser } = useQuery({
+    queryKey: ['user', assigneeId],
+    queryFn: async () => {
+      if (!assigneeId) return null;
+      try {
+        return await userService.getUser(assigneeId);
+      } catch (error) {
+        console.error("Failed to fetch assigned user:", error);
+        return null;
+      }
+    },
+    enabled: !!assigneeId && !assignedUser,
+    staleTime: 300000 // Cache for 5 minutes
+  });
+
+  // Use the provided assignedUser or the one we fetched
+  const userToDisplay = assignedUser || fetchedUser;
+
+  return (
+    <ScrollArea className="h-[80vh] print:h-auto print:overflow-visible">
+      <div className="px-6 py-6">
+        <div className="print-section header-print">
+          <IncidentDetailHeader incident={incident} />
+        </div>
+
+        <div className="space-y-8 print-compact-spacing">
+          <div className="print-section">
+            <BasicInfoSection incident={incident} assignedUser={userToDisplay} />
+          </div>
+          <Separator className="print:border-blue-200" />
+          <div className="print-section">
+            <TimelineSection incident={incident} assignedUser={userToDisplay} />
+          </div>
+          <Separator className="print:border-blue-200" />
+          <div className="print-section">
+            <AffectedSystemsSection incident={incident} assignedUser={userToDisplay} />
+          </div>
+          <Separator className="print:border-blue-200" />
+          <div className="print-section">
+            <ResolutionSection incident={incident} assignedUser={userToDisplay} />
+          </div>
+
+          <IncidentDetailFooter onClose={onClose} incident={incident} />
+        </div>
+      </div>
+    </ScrollArea>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailDialog.tsx b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailDialog.tsx
new file mode 100644
index 0000000..5b0f77e
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailDialog.tsx
@@ -0,0 +1,54 @@
+
+import React from 'react';
+import { Dialog, DialogContent } from '@/components/ui/dialog';
+import { IncidentItem } from '@/services/incident/types';
+import { useQuery } from '@tanstack/react-query';
+import { userService } from '@/services/userService';
+import { IncidentDetailContent } from './IncidentDetailContent';
+
+interface IncidentDetailDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  incident: IncidentItem | null;
+}
+
+export const IncidentDetailDialog = ({ 
+  open, 
+  onOpenChange, 
+  incident 
+}: IncidentDetailDialogProps) => {
+  // Fetch user data for assigned field (prefer assigned_users, fallback to assigned_to)
+  const { data: users = [] } = useQuery({
+    queryKey: ['users'],
+    queryFn: async () => {
+      const usersList = await userService.getUsers();
+      return Array.isArray(usersList) ? usersList : [];
+    },
+    staleTime: 300000, // Cache for 5 minutes
+    enabled: !!(incident?.assigned_users || incident?.assigned_to) && open // Only run query if there's an assigned value and dialog is open
+  });
+
+  // Find the assigned user (prefer assigned_users, fallback to assigned_to)
+  const assignedUser = (incident?.assigned_users || incident?.assigned_to)
+    ? users.find(user => user.id === (incident?.assigned_users || incident?.assigned_to)) 
+    : null;
+  
+  if (!incident) return null;
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent 
+        className="dialog-content sm:max-w-[700px] max-h-[90vh] p-0
+                  print:max-w-none print:max-h-none print:overflow-visible 
+                  print:shadow-none print:m-0 print:p-0 print:border-none
+                  print:absolute print:left-0 print:top-0 print:w-full print:h-auto"
+      >
+        <IncidentDetailContent 
+          incident={incident}
+          onClose={() => onOpenChange(false)}
+          assignedUser={assignedUser}
+        />
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailFooter.tsx b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailFooter.tsx
new file mode 100644
index 0000000..e2bbcce
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailFooter.tsx
@@ -0,0 +1,31 @@
+
+import React from 'react';
+import { IncidentItem } from '@/services/incident';
+import { Separator } from '@/components/ui/separator';
+import { CloseButton, DownloadPdfButton, PrintButton } from './components';
+import { useLanguage } from '@/contexts/LanguageContext';
+
+interface IncidentDetailFooterProps {
+  onClose: () => void;
+  incident: IncidentItem;
+}
+
+export const IncidentDetailFooter: React.FC<IncidentDetailFooterProps> = ({
+  onClose,
+  incident,
+}) => {
+  const { t } = useLanguage();
+
+  return (
+    <div className="print:hidden">
+      <Separator className="my-6" />
+      <div className="flex justify-between items-center">
+        <CloseButton onClose={onClose} />
+        <div className="flex gap-2">
+          <DownloadPdfButton incident={incident} />
+          <PrintButton />
+        </div>
+      </div>
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailHeader.tsx b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailHeader.tsx
new file mode 100644
index 0000000..ee34373
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailHeader.tsx
@@ -0,0 +1,19 @@
+
+import React from 'react';
+import { DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { IncidentItem } from '@/services/incident/types';
+
+interface IncidentDetailHeaderProps {
+  incident: IncidentItem;
+}
+
+export const IncidentDetailHeader = ({ incident }: IncidentDetailHeaderProps) => {
+  return (
+    <DialogHeader className="mb-4">
+      <div className="flex items-center gap-2">
+        <DialogTitle className="text-xl">{incident.title || 'Incident Details'}</DialogTitle>
+        <span className="text-sm text-muted-foreground">#{incident.id}</span>
+      </div>
+    </DialogHeader>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailSections.tsx b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailSections.tsx
new file mode 100644
index 0000000..3eb9ae3
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/IncidentDetailSections.tsx
@@ -0,0 +1,55 @@
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentItem } from '@/services/incident';
+import { Separator } from '@/components/ui/separator';
+import { useQuery } from '@tanstack/react-query';
+import { userService } from '@/services/userService';
+
+// Import all section components from the new location
+import {
+  BasicInfoSection,
+  TimelineSection,
+  AffectedSystemsSection,
+  ResolutionSection
+} from './sections';
+
+// Re-export all section components for compatibility with existing imports
+export {
+  BasicInfoSection,
+  TimelineSection,
+  AffectedSystemsSection,
+  ResolutionSection
+};
+
+// Legacy component - keeping this for backward compatibility with other imports
+export const IncidentDetailSections = ({ incident }: { incident: IncidentItem | null }) => {
+  // Fetch assigned user details if there's an assigned field (prefer assigned_users, fallback to assigned_to)
+  const { data: assignedUser } = useQuery({
+    queryKey: ['user', incident?.assigned_users || incident?.assigned_to],
+    queryFn: async () => {
+      if (!(incident?.assigned_users || incident?.assigned_to)) return null;
+      try {
+        return await userService.getUser(incident?.assigned_users || incident?.assigned_to);
+      } catch (error) {
+        console.error("Failed to fetch assigned user:", error);
+        return null;
+      }
+    },
+    enabled: !!(incident?.assigned_users || incident?.assigned_to),
+    staleTime: 300000 // Cache for 5 minutes
+  });
+
+  if (!incident) return null;
+
+  return (
+    <div className="space-y-6">
+      <BasicInfoSection incident={incident} assignedUser={assignedUser} />
+      <Separator />
+      <TimelineSection incident={incident} assignedUser={assignedUser} />
+      <Separator />
+      <AffectedSystemsSection incident={incident} assignedUser={assignedUser} />
+      <Separator />
+      <ResolutionSection incident={incident} assignedUser={assignedUser} />
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/components/CloseButton.tsx b/application/src/components/schedule-incident/incident/detail-dialog/components/CloseButton.tsx
new file mode 100644
index 0000000..bec23d4
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/components/CloseButton.tsx
@@ -0,0 +1,26 @@
+
+import React from 'react';
+import { Button } from '@/components/ui/button';
+import { useLanguage } from '@/contexts/LanguageContext';
+
+interface CloseButtonProps {
+  onClose: () => void;
+  className?: string;
+}
+
+export const CloseButton: React.FC<CloseButtonProps> = ({ 
+  onClose,
+  className 
+}) => {
+  const { t } = useLanguage();
+  
+  return (
+    <Button 
+      variant="secondary" 
+      onClick={onClose} 
+      className={className}
+    >
+      {t('close', 'common')}
+    </Button>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/components/DownloadPdfButton.tsx b/application/src/components/schedule-incident/incident/detail-dialog/components/DownloadPdfButton.tsx
new file mode 100644
index 0000000..d3b3ebe
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/components/DownloadPdfButton.tsx
@@ -0,0 +1,31 @@
+
+import React from 'react';
+import { Button } from '@/components/ui/button';
+import { Download } from 'lucide-react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useDownloadIncidentPdf } from '../hooks';
+import { IncidentItem } from '@/services/incident';
+
+interface DownloadPdfButtonProps {
+  incident: IncidentItem;
+  className?: string;
+}
+
+export const DownloadPdfButton: React.FC<DownloadPdfButtonProps> = ({ 
+  incident, 
+  className 
+}) => {
+  const { t } = useLanguage();
+  const { handleDownloadPDF } = useDownloadIncidentPdf();
+  
+  return (
+    <Button
+      className={`flex items-center gap-2 ${className || ''}`}
+      onClick={() => handleDownloadPDF(incident)}
+      variant="outline"
+    >
+      <Download className="h-4 w-4" />
+      {t('downloadPdf', 'incident')}
+    </Button>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/components/PrintButton.tsx b/application/src/components/schedule-incident/incident/detail-dialog/components/PrintButton.tsx
new file mode 100644
index 0000000..27aa1b4
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/components/PrintButton.tsx
@@ -0,0 +1,26 @@
+
+import React from 'react';
+import { Button } from '@/components/ui/button';
+import { Printer } from 'lucide-react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { usePrintIncident } from '../hooks';
+
+interface PrintButtonProps {
+  className?: string;
+}
+
+export const PrintButton: React.FC<PrintButtonProps> = ({ className }) => {
+  const { t } = useLanguage();
+  const { handlePrint } = usePrintIncident();
+  
+  return (
+    <Button
+      className={`flex items-center gap-2 ${className || ''}`}
+      onClick={handlePrint}
+      variant="default"
+    >
+      <Printer className="h-4 w-4" />
+      {t('print', 'incident')}
+    </Button>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/components/index.ts b/application/src/components/schedule-incident/incident/detail-dialog/components/index.ts
new file mode 100644
index 0000000..b66885a
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/components/index.ts
@@ -0,0 +1,4 @@
+
+export * from './PrintButton';
+export * from './DownloadPdfButton';
+export * from './CloseButton';
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/hooks/index.ts b/application/src/components/schedule-incident/incident/detail-dialog/hooks/index.ts
new file mode 100644
index 0000000..2862893
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/hooks/index.ts
@@ -0,0 +1,3 @@
+
+export * from './usePrintIncident';
+export * from './useDownloadIncidentPdf';
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/hooks/useDownloadIncidentPdf.ts b/application/src/components/schedule-incident/incident/detail-dialog/hooks/useDownloadIncidentPdf.ts
new file mode 100644
index 0000000..8762384
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/hooks/useDownloadIncidentPdf.ts
@@ -0,0 +1,29 @@
+
+import { useToast } from '@/hooks/use-toast';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentItem, incidentService } from '@/services/incident';
+
+export const useDownloadIncidentPdf = () => {
+  const { toast } = useToast();
+  const { t } = useLanguage();
+  
+  const handleDownloadPDF = async (incident: IncidentItem) => {
+    try {
+      await incidentService.generateIncidentPDF(incident);
+      
+      toast({
+        title: t('success'),
+        description: t('pdfDownloaded'),
+      });
+    } catch (error) {
+      console.error("Error generating PDF:", error);
+      toast({
+        title: t('error'),
+        description: t('pdfGenerationFailed'),
+        variant: 'destructive',
+      });
+    }
+  };
+  
+  return { handleDownloadPDF };
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/hooks/usePrintIncident.ts b/application/src/components/schedule-incident/incident/detail-dialog/hooks/usePrintIncident.ts
new file mode 100644
index 0000000..f9554dd
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/hooks/usePrintIncident.ts
@@ -0,0 +1,173 @@
+
+import React from 'react';
+import { useToast } from '@/hooks/use-toast';
+import { useLanguage } from '@/contexts/LanguageContext';
+
+export const usePrintIncident = () => {
+  const { toast } = useToast();
+  const { t } = useLanguage();
+  
+  const handlePrint = React.useCallback(() => {
+    try {
+      // Add print-specific stylesheet temporarily
+      const style = document.createElement('style');
+      style.id = 'print-style';
+      style.textContent = `
+        @page {
+          size: A4;
+          margin: 10mm;
+        }
+        @media print {
+          body * {
+            visibility: hidden;
+          }
+          
+          .dialog-content, .dialog-content * {
+            visibility: visible;
+          }
+          
+          .dialog-content {
+            position: absolute !important;
+            left: 0;
+            top: 0;
+            width: 100%;
+            height: auto;
+            padding: 15mm !important;
+            margin: 0 !important;
+            background-color: white !important;
+            box-shadow: none;
+            overflow: visible !important;
+            display: block !important;
+            transform: none !important;
+          }
+          
+          /* Remove any black backgrounds */
+          html, body {
+            background-color: white !important;
+            color: black !important;
+          }
+          
+          /* Optimize spacing for single page */
+          .print-section {
+            margin-bottom: 2mm !important;
+            page-break-inside: avoid !important;
+          }
+          
+          /* Reduce vertical spacing */
+          h4 {
+            margin-bottom: 1mm !important;
+            margin-top: 1mm !important;
+            color: #1e40af !important; /* blue-800 */
+            font-weight: bold !important;
+          }
+          
+          .print-compact-text {
+            font-size: 9pt !important;
+            line-height: 1.2 !important;
+          }
+          
+          .print-compact-spacing > * {
+            margin-top: 1mm !important;
+            margin-bottom: 1mm !important;
+          }
+          
+          .print-grid {
+            display: grid !important;
+            grid-template-columns: 1fr 1fr !important;
+            gap: 1mm !important;
+          }
+          
+          .badge-print {
+            background-color: #dbeafe !important; /* blue-100 */
+            color: #1e40af !important; /* blue-800 */
+            border: 1px solid #93c5fd !important; /* blue-300 */
+            padding: 0.5mm 1mm !important;
+            margin: 0.5mm !important;
+            display: inline-block !important;
+            font-size: 8pt !important;
+          }
+          
+          /* More compact spacing */
+          .print-compact-margin {
+            margin: 1mm 0 !important;
+          }
+          
+          .print-smaller-font {
+            font-size: 8pt !important;
+          }
+          
+          .header-print {
+            background-color: #1e40af !important; /* blue-800 */
+            color: #ffffff !important;
+            padding: 2mm 3mm !important;
+            margin-bottom: 2mm !important;
+          }
+          
+          /* More compact header */
+          .header-print h1 {
+            font-size: 12pt !important;
+            margin-bottom: 0 !important;
+          }
+          
+          .header-print p {
+            font-size: 9pt !important;
+            margin-top: 1mm !important;
+          }
+          
+          /* Footer stays at bottom */
+          .footer-print {
+            font-size: 7pt !important;
+            color: #6b7280 !important; /* gray-500 */
+            border-top: 1px solid #e5e7eb !important; /* gray-200 */
+            position: fixed !important;
+            bottom: 10mm !important;
+            left: 15mm !important;
+            right: 15mm !important;
+            padding-top: 2mm !important;
+            background-color: white !important;
+          }
+          
+          /* Hide any unnecessary elements */
+          .print-hide {
+            display: none !important;
+          }
+          
+          /* Optimize description text */
+          .print-description {
+            max-height: 100px !important;
+            overflow: hidden !important;
+            text-overflow: ellipsis !important;
+          }
+        }
+      `;
+      document.head.appendChild(style);
+
+      // Wait a bit to ensure styles are applied
+      setTimeout(() => {
+        window.print();
+        
+        // Remove the style after printing dialog closes
+        setTimeout(() => {
+          const printStyle = document.getElementById('print-style');
+          if (printStyle) {
+            printStyle.remove();
+          }
+        }, 1000);
+      }, 100);
+
+      toast({
+        title: t('success'),
+        description: t('printJobStarted'),
+      });
+    } catch (error) {
+      console.error("Error printing:", error);
+      toast({
+        title: t('error'),
+        description: t('printingFailed'),
+        variant: 'destructive',
+      });
+    }
+  }, [t, toast]);
+  
+  return { handlePrint };
+};
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/index.ts b/application/src/components/schedule-incident/incident/detail-dialog/index.ts
new file mode 100644
index 0000000..6d33ea6
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/index.ts
@@ -0,0 +1,6 @@
+
+export * from './IncidentDetailDialog';
+export * from './IncidentDetailHeader';
+export * from './IncidentDetailContent';
+export * from './IncidentDetailSections';
+export * from './IncidentDetailFooter';
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/sections/AffectedSystemsSection.tsx b/application/src/components/schedule-incident/incident/detail-dialog/sections/AffectedSystemsSection.tsx
new file mode 100644
index 0000000..a029b94
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/sections/AffectedSystemsSection.tsx
@@ -0,0 +1,66 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentItem } from '@/services/incident';
+import { Badge } from '@/components/ui/badge';
+import { getAffectedSystemsArray } from './utils';
+
+interface AffectedSystemsSectionProps {
+  incident: IncidentItem | null;
+  assignedUser?: any | null;
+}
+
+export const AffectedSystemsSection: React.FC<AffectedSystemsSectionProps> = ({ incident }) => {
+  const { t } = useLanguage();
+  
+  if (!incident) return null;
+  
+  return (
+    <div className="space-y-2">
+      <h3 className="font-semibold text-lg">{t('affectedSystems')}</h3>
+      
+      <div className="space-y-4">
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('systems')}</h4>
+          <div className="mt-1 flex flex-wrap gap-1">
+            {getAffectedSystemsArray(incident.affected_systems).map((system, idx) => (
+              <Badge key={idx} variant="outline">{system}</Badge>
+            ))}
+            {getAffectedSystemsArray(incident.affected_systems).length === 0 && 
+              <span className="text-muted-foreground italic">{t('noSystems')}</span>
+            }
+          </div>
+        </div>
+        
+        <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+          <div>
+            <h4 className="text-sm font-medium text-muted-foreground">{t('impact')}</h4>
+            <div className="mt-1">
+              <Badge variant={
+                incident.impact?.toLowerCase() === 'critical' ? 'destructive' :
+                incident.impact?.toLowerCase() === 'high' ? 'default' :
+                incident.impact?.toLowerCase() === 'medium' ? 'secondary' : 'outline'
+              }>
+                {t(incident.impact?.toLowerCase() || 'low')}
+              </Badge>
+            </div>
+          </div>
+          
+          <div>
+            <h4 className="text-sm font-medium text-muted-foreground">{t('priority')}</h4>
+            <div className="mt-1">
+              <Badge variant={
+                incident.priority?.toLowerCase() === 'critical' ? 'destructive' :
+                incident.priority?.toLowerCase() === 'high' ? 'default' :
+                incident.priority?.toLowerCase() === 'medium' ? 'secondary' : 'outline'
+              }>
+                {t(incident.priority?.toLowerCase() || 'low')}
+              </Badge>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/sections/AssignmentSection.tsx b/application/src/components/schedule-incident/incident/detail-dialog/sections/AssignmentSection.tsx
new file mode 100644
index 0000000..e5b9a6a
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/sections/AssignmentSection.tsx
@@ -0,0 +1,44 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentItem } from '@/services/incident';
+import { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar';
+import { User } from '@/services/userService';
+import { getUserInitials } from './utils';
+
+interface AssignmentSectionProps {
+  incident: IncidentItem | null;
+  assignedUser?: User | null;
+}
+
+export const AssignmentSection: React.FC<AssignmentSectionProps> = ({ incident, assignedUser }) => {
+  const { t } = useLanguage();
+  
+  if (!incident) return null;
+  
+  return (
+    <div className="space-y-2">
+      <h3 className="font-semibold text-lg">{t('assignment')}</h3>
+      
+      <div>
+        <h4 className="text-sm font-medium text-muted-foreground">{t('assignedTo')}</h4>
+        <div className="mt-1">
+          {assignedUser ? (
+            <div className="flex items-center gap-2">
+              <Avatar className="h-6 w-6">
+                <AvatarImage src={assignedUser.avatar} alt={assignedUser.full_name || assignedUser.username} />
+                <AvatarFallback>{getUserInitials(assignedUser)}</AvatarFallback>
+              </Avatar>
+              <span>{assignedUser.full_name || assignedUser.username}</span>
+            </div>
+          ) : (incident.assigned_users || incident.assigned_to) ? (
+           <span>{incident.assigned_users || incident.assigned_to}</span>
+          ) : (
+            <span className="text-muted-foreground italic">{t('unassigned')}</span>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/sections/BasicInfoSection.tsx b/application/src/components/schedule-incident/incident/detail-dialog/sections/BasicInfoSection.tsx
new file mode 100644
index 0000000..062ee01
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/sections/BasicInfoSection.tsx
@@ -0,0 +1,69 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentItem } from '@/services/incident';
+import { User } from '@/services/userService';
+import { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar';
+import { IncidentStatusBadge } from '../../IncidentStatusBadge';
+import { getUserInitials } from './utils';
+
+interface BasicInfoSectionProps {
+  incident: IncidentItem | null;
+  assignedUser?: User | null;
+}
+
+export const BasicInfoSection: React.FC<BasicInfoSectionProps> = ({ incident, assignedUser }) => {
+  const { t } = useLanguage();
+  
+  if (!incident) return null;
+  
+  return (
+    <div className="space-y-2 print-compact-text">
+      <h3 className="font-semibold text-lg">{t('basicInfo')}</h3>
+      
+      <div className="grid grid-cols-1 md:grid-cols-2 gap-4 print-grid">
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('title')}</h4>
+          <p className="mt-1">{incident.title || '-'}</p>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('status')}</h4>
+          <div className="mt-1">
+            <IncidentStatusBadge status={incident.status || incident.impact_status || 'investigating'} />
+          </div>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('serviceId')}</h4>
+          <p className="mt-1">{incident.service_id || '-'}</p>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('assignedTo')}</h4>
+          <div className="mt-1">
+            {assignedUser ? (
+              <div className="flex items-center gap-2">
+                <Avatar className="h-6 w-6">
+                  <AvatarImage src={assignedUser.avatar} alt={assignedUser.full_name || assignedUser.username} />
+                  <AvatarFallback>{getUserInitials(assignedUser)}</AvatarFallback>
+                </Avatar>
+                <span>{assignedUser.full_name || assignedUser.username}</span>
+              </div>
+            ) : (incident.assigned_users || incident.assigned_to) ? (
+              <span>{incident.assigned_users || incident.assigned_to}</span>
+            ) : (
+              <span className="text-muted-foreground italic">{t('unassigned')}</span>
+            )}
+          </div>
+        </div>
+      </div>
+        
+      <div className="mt-2">
+        <h4 className="text-sm font-medium text-muted-foreground">{t('description')}</h4>
+        <p className="mt-1 whitespace-pre-line print-description">{incident.description || '-'}</p>
+      </div>
+    </div>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/sections/ImpactAnalysisSection.tsx b/application/src/components/schedule-incident/incident/detail-dialog/sections/ImpactAnalysisSection.tsx
new file mode 100644
index 0000000..2e9fe90
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/sections/ImpactAnalysisSection.tsx
@@ -0,0 +1,51 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentItem } from '@/services/incident';
+import { Badge } from '@/components/ui/badge';
+
+interface ImpactAnalysisSectionProps {
+  incident: IncidentItem | null;
+  assignedUser?: any | null;
+}
+
+export const ImpactAnalysisSection: React.FC<ImpactAnalysisSectionProps> = ({ incident }) => {
+  const { t } = useLanguage();
+  
+  if (!incident) return null;
+  
+  return (
+    <div className="space-y-2">
+      <h3 className="font-semibold text-lg">{t('impactAnalysis')}</h3>
+      
+      <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('impact')}</h4>
+          <div className="mt-1">
+            <Badge variant={
+              incident.impact?.toLowerCase() === 'critical' ? 'destructive' :
+              incident.impact?.toLowerCase() === 'high' ? 'default' :
+              incident.impact?.toLowerCase() === 'medium' ? 'secondary' : 'outline'
+            }>
+              {t(incident.impact?.toLowerCase() || 'low')}
+            </Badge>
+          </div>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('priority')}</h4>
+          <div className="mt-1">
+            <Badge variant={
+              incident.priority?.toLowerCase() === 'critical' ? 'destructive' :
+              incident.priority?.toLowerCase() === 'high' ? 'default' :
+              incident.priority?.toLowerCase() === 'medium' ? 'secondary' : 'outline'
+            }>
+              {t(incident.priority?.toLowerCase() || 'low')}
+            </Badge>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/sections/ResolutionSection.tsx b/application/src/components/schedule-incident/incident/detail-dialog/sections/ResolutionSection.tsx
new file mode 100644
index 0000000..7f94059
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/sections/ResolutionSection.tsx
@@ -0,0 +1,39 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentItem } from '@/services/incident';
+
+interface ResolutionSectionProps {
+  incident: IncidentItem | null;
+  assignedUser?: any | null;
+}
+
+export const ResolutionSection: React.FC<ResolutionSectionProps> = ({ incident }) => {
+  const { t } = useLanguage();
+  
+  if (!incident) return null;
+  
+  return (
+    <div className="space-y-2">
+      <h3 className="font-semibold text-lg">{t('resolutionDetails')}</h3>
+      
+      <div className="space-y-4">
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('rootCause')}</h4>
+          <p className="mt-1 whitespace-pre-line">{incident.root_cause || '-'}</p>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('resolutionSteps')}</h4>
+          <p className="mt-1 whitespace-pre-line">{incident.resolution_steps || '-'}</p>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('lessonsLearned')}</h4>
+          <p className="mt-1 whitespace-pre-line">{incident.lessons_learned || '-'}</p>
+        </div>
+      </div>
+    </div>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/sections/TimelineSection.tsx b/application/src/components/schedule-incident/incident/detail-dialog/sections/TimelineSection.tsx
new file mode 100644
index 0000000..2f2b203
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/sections/TimelineSection.tsx
@@ -0,0 +1,45 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentItem } from '@/services/incident';
+import { formatDate } from './utils';
+
+interface TimelineSectionProps {
+  incident: IncidentItem | null;
+  assignedUser?: any | null;
+}
+
+export const TimelineSection: React.FC<TimelineSectionProps> = ({ incident }) => {
+  const { t } = useLanguage();
+  
+  if (!incident) return null;
+  
+  return (
+    <div className="space-y-2">
+      <h3 className="font-semibold text-lg">{t('timeline')}</h3>
+      
+      <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('created')}</h4>
+          <p className="mt-1">{formatDate(incident.created)}</p>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('lastUpdated')}</h4>
+          <p className="mt-1">{formatDate(incident.updated)}</p>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('incidentTime')}</h4>
+          <p className="mt-1">{formatDate(incident.timestamp)}</p>
+        </div>
+        
+        <div>
+          <h4 className="text-sm font-medium text-muted-foreground">{t('resolutionTime')}</h4>
+          <p className="mt-1">{formatDate(incident.resolution_time)}</p>
+        </div>
+      </div>
+    </div>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/sections/index.ts b/application/src/components/schedule-incident/incident/detail-dialog/sections/index.ts
new file mode 100644
index 0000000..a3245ff
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/sections/index.ts
@@ -0,0 +1,7 @@
+
+// Export all section components
+export * from './BasicInfoSection';
+export * from './TimelineSection';
+export * from './AffectedSystemsSection';
+export * from './ResolutionSection';
+export * from './utils';
diff --git a/application/src/components/schedule-incident/incident/detail-dialog/sections/utils.ts b/application/src/components/schedule-incident/incident/detail-dialog/sections/utils.ts
new file mode 100644
index 0000000..b4409e1
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/detail-dialog/sections/utils.ts
@@ -0,0 +1,32 @@
+
+import { User } from '@/services/userService';
+import { format } from 'date-fns';
+
+// Helper function to get user initials
+export const getUserInitials = (user: User): string => {
+  if (user.full_name) {
+    const nameParts = user.full_name.split(' ');
+    if (nameParts.length > 1) {
+      return `${nameParts[0][0]}${nameParts[1][0]}`.toUpperCase();
+    }
+    return user.full_name.substring(0, 2).toUpperCase();
+  }
+  return user.username.substring(0, 2).toUpperCase();
+};
+
+// Format date helper
+export const formatDate = (dateStr?: string) => {
+  if (!dateStr) return '-';
+  try {
+    return format(new Date(dateStr), 'PPp');
+  } catch (error) {
+    console.error('Error formatting date:', dateStr, error);
+    return dateStr;
+  }
+};
+
+// Get affected systems helper
+export const getAffectedSystemsArray = (systems?: string) => {
+  if (!systems) return [];
+  return systems.split(',').map(system => system.trim()).filter(Boolean);
+};
diff --git a/application/src/components/schedule-incident/incident/form/IncidentAffectedFields.tsx b/application/src/components/schedule-incident/incident/form/IncidentAffectedFields.tsx
new file mode 100644
index 0000000..8213bc2
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/form/IncidentAffectedFields.tsx
@@ -0,0 +1,56 @@
+
+import React from 'react';
+import { useFormContext } from 'react-hook-form';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentFormValues } from '../hooks/useIncidentForm';
+import {
+  FormField,
+  FormItem,
+  FormLabel,
+  FormControl,
+  FormMessage,
+} from '@/components/ui/form';
+import { Input } from '@/components/ui/input';
+import { Textarea } from '@/components/ui/textarea';
+
+export const IncidentAffectedFields: React.FC = () => {
+  const { t } = useLanguage();
+  const { control } = useFormContext<IncidentFormValues>();
+
+  return (
+    <div className="space-y-4">
+      <FormField
+        control={control}
+        name="affected_systems"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('affectedSystems')}</FormLabel>
+            <FormControl>
+              <Input placeholder={t('enterAffectedSystems')} {...field} />
+            </FormControl>
+            <FormMessage />
+            <p className="text-sm text-muted-foreground">{t('separateSystemsWithComma')}</p>
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={control}
+        name="root_cause"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('rootCause')}</FormLabel>
+            <FormControl>
+              <Textarea 
+                placeholder={t('enterRootCause')}
+                className="min-h-[80px]"
+                {...field} 
+              />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/form/IncidentBasicFields.tsx b/application/src/components/schedule-incident/incident/form/IncidentBasicFields.tsx
new file mode 100644
index 0000000..3882595
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/form/IncidentBasicFields.tsx
@@ -0,0 +1,201 @@
+
+import React, { useEffect } from 'react';
+import { useFormContext } from 'react-hook-form';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentFormValues } from '../hooks/useIncidentForm';
+import {
+  FormField,
+  FormItem,
+  FormLabel,
+  FormControl,
+  FormMessage,
+} from '@/components/ui/form';
+import { Input } from '@/components/ui/input';
+import { Textarea } from '@/components/ui/textarea';
+import { useQuery } from '@tanstack/react-query';
+import { userService } from '@/services/userService';
+import { Badge } from '@/components/ui/badge';
+import { X, Users } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar';
+
+export const IncidentBasicFields: React.FC = () => {
+  const { t } = useLanguage();
+  const form = useFormContext<IncidentFormValues>();
+  const currentAssignedUserId = form.watch('assigned_to');
+
+  // For assigned users functionality
+  const [selectedUserIds, setSelectedUserIds] = React.useState<string[]>([]);
+
+  // Update selectedUserIds when form value changes (for edit mode)
+  useEffect(() => {
+    if (currentAssignedUserId) {
+      setSelectedUserIds([currentAssignedUserId]);
+    }
+  }, [currentAssignedUserId]);
+
+  // Fetch users for assignment
+  const { data: users = [], isLoading } = useQuery({
+    queryKey: ['users'],
+    queryFn: async () => {
+      try {
+        const usersList = await userService.getUsers();
+      //  console.log("Fetched users for incident assignment:", usersList);
+        return Array.isArray(usersList) ? usersList : [];
+      } catch (error) {
+      //  console.error("Failed to fetch users:", error);
+        return [];
+      }
+    },
+    staleTime: 300000 // Cache for 5 minutes
+  });
+
+  // Add user to assigned_to
+  const addUser = (userId: string) => {
+    // For now, we're using a single user assignment
+  //  console.log("Setting user ID in form:", userId);
+    form.setValue('assigned_to', userId, { shouldValidate: true, shouldDirty: true });
+    setSelectedUserIds([userId]);
+  };
+
+  // Remove assigned user
+  const removeUser = () => {
+    form.setValue('assigned_to', '', { shouldValidate: true, shouldDirty: true });
+    setSelectedUserIds([]);
+  };
+
+  // Get selected user data
+  const selectedUser = users.find(user => user.id === form.getValues('assigned_to'));
+
+  // Function to get user initials from name
+  const getUserInitials = (user: { full_name?: string; username: string }): string => {
+    if (user.full_name) {
+      const nameParts = user.full_name.split(' ');
+      if (nameParts.length > 1) {
+        return `${nameParts[0][0]}${nameParts[1][0]}`.toUpperCase();
+      }
+      return user.full_name.substring(0, 2).toUpperCase();
+    }
+    return user.username.substring(0, 2).toUpperCase();
+  };
+
+  return (
+    <div className="space-y-4">
+      <FormField
+        control={form.control}
+        name="title"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('title')}</FormLabel>
+            <FormControl>
+              <Input placeholder={t('enterIncidentTitle')} {...field} />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={form.control}
+        name="description"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('description')}</FormLabel>
+            <FormControl>
+              <Textarea 
+                placeholder={t('enterIncidentDescription')}
+                className="min-h-[100px]"
+                {...field} 
+              />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={form.control}
+        name="service_id"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('serviceId')}</FormLabel>
+            <FormControl>
+              <Input placeholder={t('enterServiceId')} {...field} />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={form.control}
+        name="assigned_to"
+        render={({ field }) => (
+          <FormItem className="flex flex-col">
+            <FormLabel className="flex items-center gap-1">
+              <Users className="h-4 w-4" /> {t('assignedTo')}
+            </FormLabel>
+            <div className="space-y-3">
+              <FormControl>
+                <select
+                  id="assigned-user-select"
+                  className="w-full h-10 rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
+                  value={field.value || ""}
+                  onChange={(e) => {
+                    const selectedValue = e.target.value;
+                    console.log("Selected user ID:", selectedValue);
+                    if (selectedValue) {
+                      addUser(selectedValue);
+                    }
+                  }}
+                  onBlur={field.onBlur}
+                  disabled={field.disabled}
+                  name={field.name}
+                >
+                  <option value="">{t('selectAssignedUser')}</option>
+                  {users.map(user => (
+                    <option 
+                      key={user.id} 
+                      value={user.id}
+                    >
+                      {user.full_name || user.username}
+                    </option>
+                  ))}
+                </select>
+              </FormControl>
+
+              {selectedUser ? (
+                <div className="flex flex-wrap gap-2 mt-2 border p-2 rounded-md bg-muted/50">
+                  <Badge key={selectedUser.id} variant="secondary" className="flex items-center gap-1 py-1 px-2">
+                    <Avatar className="h-5 w-5 mr-1">
+                      <AvatarImage src={selectedUser.avatar} alt={selectedUser.full_name || selectedUser.username} />
+                      <AvatarFallback className="text-[10px]">
+                        {getUserInitials(selectedUser)}
+                      </AvatarFallback>
+                    </Avatar>
+                    <span>{selectedUser.full_name || selectedUser.username}</span>
+                    <Button 
+                      variant="ghost" 
+                      size="icon" 
+                      className="h-4 w-4 p-0 ml-1 hover:bg-transparent hover:opacity-70"
+                      onClick={removeUser}
+                      type="button"
+                    >
+                      <X className="h-3 w-3" />
+                      <span className="sr-only">{t('remove')}</span>
+                    </Button>
+                  </Badge>
+                </div>
+              ) : (
+                <div className="text-sm text-muted-foreground italic p-2">
+                  {t('noAssignedUser')}
+                </div>
+              )}
+            </div>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/form/IncidentConfigFields.tsx b/application/src/components/schedule-incident/incident/form/IncidentConfigFields.tsx
new file mode 100644
index 0000000..56b86ed
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/form/IncidentConfigFields.tsx
@@ -0,0 +1,119 @@
+
+import React from 'react';
+import { useFormContext } from 'react-hook-form';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentFormValues } from '../hooks/useIncidentForm';
+import {
+  FormField,
+  FormItem,
+  FormLabel,
+  FormControl,
+  FormMessage,
+} from '@/components/ui/form';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import { ToggleGroup, ToggleGroupItem } from '@/components/ui/toggle-group';
+import { RadioGroup, RadioGroupItem } from '@/components/ui/radio-group';
+import { Label } from '@/components/ui/label';
+
+export const IncidentConfigFields: React.FC = () => {
+  const { t } = useLanguage();
+  const { control } = useFormContext<IncidentFormValues>();
+
+  return (
+    <div className="grid grid-cols-1 gap-4">
+      <FormField
+        control={control}
+        name="status"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('status')}</FormLabel>
+            <Select onValueChange={field.onChange} defaultValue={field.value}>
+              <FormControl>
+                <SelectTrigger>
+                  <SelectValue placeholder={t('selectIncidentStatus')} />
+                </SelectTrigger>
+              </FormControl>
+              <SelectContent>
+                <SelectItem value="investigating">{t('investigating')}</SelectItem>
+                <SelectItem value="identified">{t('identified')}</SelectItem>
+                <SelectItem value="found_root_cause">{t('foundRootCause')}</SelectItem>
+                <SelectItem value="in_progress">{t('inProgress')}</SelectItem>
+                <SelectItem value="monitoring">{t('monitoring')}</SelectItem>
+                <SelectItem value="resolved">{t('resolved')}</SelectItem>
+              </SelectContent>
+            </Select>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={control}
+        name="impact"
+        render={({ field }) => (
+          <FormItem className="space-y-2">
+            <FormLabel>{t('impact')}</FormLabel>
+            <FormControl>
+              <RadioGroup
+                onValueChange={field.onChange}
+                defaultValue={field.value}
+                className="flex space-x-1"
+              >
+                <div className="flex items-center space-x-2">
+                  <RadioGroupItem value="minor" id="minor" />
+                  <Label htmlFor="minor">{t('minor')}</Label>
+                </div>
+                <span>•</span>
+                <div className="flex items-center space-x-2">
+                  <RadioGroupItem value="major" id="major" />
+                  <Label htmlFor="major">{t('major')}</Label>
+                </div>
+                <span>•</span>
+                <div className="flex items-center space-x-2">
+                  <RadioGroupItem value="critical" id="critical" />
+                  <Label htmlFor="critical">{t('critical')}</Label>
+                </div>
+                <span>•</span>
+                <div className="flex items-center space-x-2">
+                  <RadioGroupItem value="none" id="none" />
+                  <Label htmlFor="none">{t('none')}</Label>
+                </div>
+              </RadioGroup>
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={control}
+        name="priority"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('priority')}</FormLabel>
+            <Select onValueChange={field.onChange} defaultValue={field.value}>
+              <FormControl>
+                <SelectTrigger>
+                  <SelectValue placeholder={t('selectPriorityLevel')} />
+                </SelectTrigger>
+              </FormControl>
+              <SelectContent>
+                <SelectItem value="low">{t('low')}</SelectItem>
+                <SelectItem value="medium">{t('medium')}</SelectItem>
+                <SelectItem value="high">{t('high')}</SelectItem>
+                <SelectItem value="critical">{t('critical')}</SelectItem>
+              </SelectContent>
+            </Select>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/form/IncidentDetailsFields.tsx b/application/src/components/schedule-incident/incident/form/IncidentDetailsFields.tsx
new file mode 100644
index 0000000..0134a8d
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/form/IncidentDetailsFields.tsx
@@ -0,0 +1,59 @@
+
+import React from 'react';
+import { useFormContext } from 'react-hook-form';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentFormValues } from '../hooks/useIncidentForm';
+import {
+  FormField,
+  FormItem,
+  FormLabel,
+  FormControl,
+  FormMessage,
+} from '@/components/ui/form';
+import { Textarea } from '@/components/ui/textarea';
+
+export const IncidentDetailsFields: React.FC = () => {
+  const { t } = useLanguage();
+  const { control } = useFormContext<IncidentFormValues>();
+
+  return (
+    <div className="space-y-4">
+      <FormField
+        control={control}
+        name="resolution_steps"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('resolutionSteps')}</FormLabel>
+            <FormControl>
+              <Textarea 
+                placeholder={t('enterResolutionSteps')}
+                className="min-h-[80px]"
+                {...field} 
+              />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={control}
+        name="lessons_learned"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('lessonsLearned')}</FormLabel>
+            <FormControl>
+              <Textarea 
+                placeholder={t('enterLessonsLearned')}
+                className="min-h-[80px]"
+                {...field} 
+              />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+    </div>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/incident/form/index.ts b/application/src/components/schedule-incident/incident/form/index.ts
new file mode 100644
index 0000000..9b06576
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/form/index.ts
@@ -0,0 +1,5 @@
+
+export * from './IncidentBasicFields';
+export * from './IncidentAffectedFields';
+export * from './IncidentConfigFields';
+export * from './IncidentDetailsFields';
diff --git a/application/src/components/schedule-incident/incident/hooks/useIncidentEditForm.ts b/application/src/components/schedule-incident/incident/hooks/useIncidentEditForm.ts
new file mode 100644
index 0000000..4d5ebc0
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/hooks/useIncidentEditForm.ts
@@ -0,0 +1,87 @@
+
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useToast } from '@/hooks/use-toast';
+import { incidentService, IncidentItem } from '@/services/incident';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { incidentFormSchema, IncidentFormValues } from './useIncidentForm';
+
+export const useIncidentEditForm = (
+  incident: IncidentItem,
+  onSuccess: () => void,
+  onClose: () => void
+) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  
+  // Initialize form with existing incident data
+  const form = useForm<IncidentFormValues>({
+    resolver: zodResolver(incidentFormSchema),
+    defaultValues: {
+      title: incident.title || '',
+      description: incident.description || '',
+      affected_systems: incident.affected_systems || '',
+      status: (incident.status?.toLowerCase() || incident.impact_status?.toLowerCase() || 'investigating') as any,
+      impact: (incident.impact?.toLowerCase() || 'minor') as any,
+      priority: (incident.priority?.toLowerCase() || 'medium') as any,
+      service_id: incident.service_id || '',
+      assigned_to: incident.assigned_users || incident.assigned_to || '',
+      root_cause: incident.root_cause || '',
+      resolution_steps: incident.resolution_steps || '',
+      lessons_learned: incident.lessons_learned || '',
+    },
+  });
+
+  const onSubmit = async (data: IncidentFormValues) => {
+    try {
+      console.log("Form data for update:", data);
+      console.log("Assigned user ID for update:", data.assigned_to);
+      
+      await incidentService.updateIncident(incident.id, {
+        title: data.title,
+        description: data.description,
+        status: data.status,
+        affected_systems: data.affected_systems,
+        impact: data.impact,
+        priority: data.priority,
+        service_id: data.service_id,
+        ...(data.assigned_to
+          ? { assigned_to: data.assigned_to, assigned_users: data.assigned_to }
+          : {}),
+        root_cause: data.root_cause,
+        resolution_steps: data.resolution_steps,
+        lessons_learned: data.lessons_learned,
+      });
+
+      
+      toast({
+        title: t('incidentUpdated'),
+        description: t('incidentUpdatedDesc'),
+      });
+      
+      onClose();
+      onSuccess();
+    } catch (error) {
+      console.error('Error updating incident:', error);
+      
+      if (error instanceof Error) {
+        toast({
+          title: t('error'),
+          description: `${t('errorUpdatingIncident')}: ${error.message}`,
+          variant: 'destructive',
+        });
+      } else {
+        toast({
+          title: t('error'),
+          description: t('errorUpdatingIncident'),
+          variant: 'destructive',
+        });
+      }
+    }
+  };
+
+  return {
+    form,
+    onSubmit: form.handleSubmit(onSubmit),
+  };
+};
diff --git a/application/src/components/schedule-incident/incident/hooks/useIncidentForm.ts b/application/src/components/schedule-incident/incident/hooks/useIncidentForm.ts
new file mode 100644
index 0000000..124e9b9
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/hooks/useIncidentForm.ts
@@ -0,0 +1,106 @@
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import * as z from 'zod';
+import { pb } from '@/lib/pocketbase';
+import { useToast } from '@/hooks/use-toast';
+import { incidentService, CreateIncidentInput } from '@/services/incident';
+import { useLanguage } from '@/contexts/LanguageContext';
+
+// Define the schema for our incident form
+export const incidentFormSchema = z.object({
+  title: z.string().min(1, { message: 'Title is required' }),
+  description: z.string().min(1, { message: 'Description is required' }),
+  affected_systems: z.string().min(1, { message: 'Affected systems are required' }),
+  status: z.enum(['investigating', 'found_root_cause', 'in_progress', 'monitoring', 'resolved']),
+  impact: z.enum(['none', 'minor', 'major', 'critical']),
+  priority: z.enum(['low', 'medium', 'high', 'critical']),
+  service_id: z.string().optional(),
+  assigned_to: z.string().optional(),
+  root_cause: z.string().optional(),
+  resolution_steps: z.string().optional(),
+  lessons_learned: z.string().optional(),
+});
+
+export type IncidentFormValues = z.infer<typeof incidentFormSchema>;
+
+export const useIncidentForm = (onSuccess: () => void, onClose: () => void) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  
+  const form = useForm<IncidentFormValues>({
+    resolver: zodResolver(incidentFormSchema),
+    defaultValues: {
+      title: '',
+      description: '',
+      affected_systems: '',
+      status: 'investigating',
+      impact: 'minor',
+      priority: 'medium',
+      service_id: '',
+      assigned_to: '',
+      root_cause: '',
+      resolution_steps: '',
+      lessons_learned: '',
+    },
+  });
+
+  const onSubmit = async (data: IncidentFormValues) => {
+    try {
+      console.log("Form data before submission:", data);
+      
+      const formattedData: CreateIncidentInput = {
+        title: data.title,
+        description: data.description,
+        status: data.status,
+        affected_systems: data.affected_systems,
+        impact: data.impact,
+        priority: data.priority,
+        service_id: data.service_id,
+        assigned_to: data.assigned_to,
+        assigned_users: data.assigned_to, // map to server field
+        root_cause: data.root_cause,
+        resolution_steps: data.resolution_steps,
+        lessons_learned: data.lessons_learned,
+        timestamp: new Date().toISOString(),
+        created_by: pb.authStore.model?.id || '',
+      };
+      
+      console.log("Formatted data for API:", formattedData);
+
+      await incidentService.createIncident(formattedData);
+      
+      toast({
+        title: t('incidentCreated'),
+        description: t('incidentCreatedDesc'),
+      });
+      
+      console.log("Incident created successfully, about to call onSuccess and onClose");
+      
+      form.reset();
+      onClose();
+      onSuccess();
+    } catch (error) {
+      console.error('Error creating incident:', error);
+      
+      if (error instanceof Error) {
+        console.error('Error details:', error.message);
+        toast({
+          title: t('error'),
+          description: `${t('errorCreatingIncident')}: ${error.message}`,
+          variant: 'destructive',
+        });
+      } else {
+        toast({
+          title: t('error'),
+          description: t('errorCreatingIncident'),
+          variant: 'destructive',
+        });
+      }
+    }
+  };
+
+  return {
+    form,
+    onSubmit: form.handleSubmit(onSubmit),
+  };
+};
diff --git a/application/src/components/schedule-incident/incident/index.ts b/application/src/components/schedule-incident/incident/index.ts
new file mode 100644
index 0000000..2421b33
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/index.ts
@@ -0,0 +1,9 @@
+
+export * from './IncidentTable';
+export * from './IncidentActionsMenu';
+export * from './IncidentStatusBadge';
+export * from './IncidentStatusDropdown';
+export * from './CreateIncidentDialog';
+export * from './EditIncidentDialog';
+export * from './EmptyIncidentState';
+export * from './detail-dialog';
diff --git a/application/src/components/schedule-incident/incident/table/IncidentTable.tsx b/application/src/components/schedule-incident/incident/table/IncidentTable.tsx
new file mode 100644
index 0000000..a163694
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/table/IncidentTable.tsx
@@ -0,0 +1,150 @@
+
+import React, { useState, useCallback } from 'react';
+import {
+  Table,
+  TableBody,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from '@/components/ui/table';
+import { format } from 'date-fns';
+import { IncidentItem } from '@/services/incident/types';
+import { IncidentTableRow } from './IncidentTableRow';
+import { IncidentDetailDialog } from '../detail-dialog/IncidentDetailDialog';
+import { EditIncidentDialog } from '../EditIncidentDialog';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { IncidentTableSkeleton } from './IncidentTableSkeleton';
+
+interface IncidentTableProps {
+  data: IncidentItem[]; 
+  isLoading: boolean;
+  onIncidentUpdated: () => void;
+  onViewDetails?: (incident: IncidentItem) => void;
+  onEditIncident?: (incident: IncidentItem) => void;
+}
+
+export const IncidentTable = ({ 
+  data, 
+  isLoading,
+  onIncidentUpdated,
+  onViewDetails,
+  onEditIncident 
+}: IncidentTableProps) => {
+  const { t } = useLanguage();
+  const [selectedIncident, setSelectedIncident] = useState<IncidentItem | null>(null);
+  const [isDetailOpen, setIsDetailOpen] = useState(false);
+  const [isEditOpen, setIsEditOpen] = useState(false);
+
+  const formatDate = useCallback((dateString: string | undefined) => {
+    if (!dateString) return '-';
+    try {
+      return format(new Date(dateString), 'PPp');
+    } catch (error) {
+      console.error('Error formatting date:', dateString, error);
+      return dateString;
+    }
+  }, []);
+
+  const getAffectedSystemsArray = useCallback((affectedSystems: string | undefined): string[] => {
+    if (!affectedSystems) return [];
+    return affectedSystems.split(',').map(system => system.trim()).filter(Boolean);
+  }, []);
+
+  const handleViewDetails = useCallback((incident: IncidentItem) => {
+    setSelectedIncident(incident);
+    setIsDetailOpen(true);
+  }, []);
+  
+  const handleEditIncident = useCallback((incident: IncidentItem) => {
+    setSelectedIncident(incident);
+    setIsEditOpen(true);
+  }, []);
+
+  // Handle status updates efficiently
+  const handleIncidentUpdated = useCallback(() => {
+    console.log("Incident updated in IncidentTable, propagating event");
+    onIncidentUpdated();
+  }, [onIncidentUpdated]);
+
+  // Handle dialog closing
+  const handleDetailDialogClose = useCallback((open: boolean) => {
+    setIsDetailOpen(open);
+    if (!open) {
+      onIncidentUpdated();
+    }
+  }, [onIncidentUpdated]);
+
+  // Handle edit dialog closing
+  const handleEditDialogClose = useCallback((open: boolean) => {
+    setIsEditOpen(open);
+    if (!open) {
+      onIncidentUpdated();
+    }
+  }, [onIncidentUpdated]);
+
+  if (isLoading) {
+    return <IncidentTableSkeleton />;
+  }
+
+  // Add a safety check to prevent map of undefined error
+  if (!data || !Array.isArray(data)) {
+    console.error('Data is not an array:', data);
+    return (
+      <div className="p-4 text-center">
+        <p>No incident data available</p>
+      </div>
+    );
+  }
+
+  return (
+    <>
+      <div className="rounded-md border">
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>{t('title')}</TableHead>
+              <TableHead>{t('status')}</TableHead>
+              <TableHead>{t('priority')}</TableHead>
+              <TableHead>{t('time')}</TableHead>
+              <TableHead>{t('affected')}</TableHead>
+              <TableHead>{t('impact')}</TableHead>
+              <TableHead>{t('assignedTo')}</TableHead>
+              <TableHead className="text-right">{t('actions')}</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {data.map((item) => (
+              <IncidentTableRow
+                key={item.id}
+                item={item}
+                formatDate={formatDate}
+                getAffectedSystemsArray={getAffectedSystemsArray}
+                onViewDetails={onViewDetails || handleViewDetails}
+                onEditIncident={onEditIncident || handleEditIncident}
+                onIncidentUpdated={handleIncidentUpdated}
+                t={t}
+              />
+            ))}
+          </TableBody>
+        </Table>
+      </div>
+
+      {/* Incident detail dialog */}
+      <IncidentDetailDialog
+        open={isDetailOpen}
+        onOpenChange={handleDetailDialogClose}
+        incident={selectedIncident}
+      />
+      
+      {/* Edit incident dialog */}
+      {selectedIncident && (
+        <EditIncidentDialog
+          open={isEditOpen}
+          onOpenChange={handleEditDialogClose}
+          incident={selectedIncident}
+          onIncidentUpdated={onIncidentUpdated}
+        />
+      )}
+    </>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/table/IncidentTableRow.tsx b/application/src/components/schedule-incident/incident/table/IncidentTableRow.tsx
new file mode 100644
index 0000000..43c1228
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/table/IncidentTableRow.tsx
@@ -0,0 +1,119 @@
+
+import React, { memo, useState } from 'react';
+import { TableRow, TableCell } from '@/components/ui/table';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import { Eye } from 'lucide-react';
+import { IncidentStatusDropdown } from '../IncidentStatusDropdown';
+import { IncidentActionsMenu } from '../IncidentActionsMenu';
+import { IncidentItem } from '@/services/incident';
+import { AssignedUserCell } from './IncidentTableUtils';
+
+interface IncidentTableRowProps {
+  item: IncidentItem;
+  formatDate: (date: string | undefined) => string;
+  getAffectedSystemsArray: (systems: string | undefined) => string[];
+  onViewDetails?: (incident: IncidentItem) => void;
+  onEditIncident?: (incident: IncidentItem) => void;
+  onIncidentUpdated: () => void;
+  t: (key: string) => string;
+}
+
+export const IncidentTableRow = memo(({ 
+  item, 
+  formatDate, 
+  getAffectedSystemsArray, 
+  onViewDetails, 
+  onEditIncident,
+  onIncidentUpdated, 
+  t
+}: IncidentTableRowProps) => {
+  // Use local state for optimistic UI updates
+  const [localItem, setLocalItem] = useState(item);
+  
+  // Update local state when props change
+  React.useEffect(() => {
+    setLocalItem(item);
+  }, [item]);
+  
+  // Handle status updates locally
+  const handleStatusUpdated = () => {
+    console.log("Status updated in TableRow, calling onIncidentUpdated");
+    onIncidentUpdated();
+  };
+  
+  return (
+    <TableRow 
+      key={localItem.id} 
+      className="hover:bg-muted/40 cursor-pointer"
+      onClick={() => onViewDetails && onViewDetails(localItem)}
+    >
+      <TableCell className="font-medium max-w-[200px] truncate">
+        {localItem.title || localItem.description || '-'}
+      </TableCell>
+      <TableCell onClick={(e) => e.stopPropagation()}>
+        <IncidentStatusDropdown
+          status={localItem.impact_status || localItem.status || 'investigating'}
+          id={localItem.id}
+          onStatusUpdated={handleStatusUpdated}
+        />
+      </TableCell>
+      <TableCell>
+        <Badge variant={
+          localItem.priority?.toLowerCase() === 'critical' ? 'destructive' :
+          localItem.priority?.toLowerCase() === 'high' ? 'default' :
+          localItem.priority?.toLowerCase() === 'medium' ? 'secondary' : 'outline'
+        }>
+          {t(localItem.priority?.toLowerCase() || 'low')}
+        </Badge>
+      </TableCell>
+      <TableCell>{formatDate(localItem.created)}</TableCell>
+      <TableCell>
+        <div className="flex flex-wrap gap-1">
+          {getAffectedSystemsArray(localItem.affected_systems).map((system, idx) => (
+            <Badge key={`${localItem.id}-system-${idx}`} variant="outline">{system}</Badge>
+          ))}
+          {getAffectedSystemsArray(localItem.affected_systems).length === 0 && '-'}
+        </div>
+      </TableCell>
+      <TableCell>
+        <Badge variant={
+          localItem.impact?.toLowerCase() === 'critical' ? 'destructive' :
+          localItem.impact?.toLowerCase() === 'high' ? 'default' :
+          localItem.impact?.toLowerCase() === 'medium' ? 'secondary' : 'outline'
+        }>
+          {t(localItem.impact?.toLowerCase() || 'low')}
+        </Badge>
+      </TableCell>
+      <TableCell>
+        <AssignedUserCell userId={localItem.assigned_users || localItem.assigned_to} />
+      </TableCell>
+      <TableCell className="text-right" onClick={(e) => e.stopPropagation()}>
+        <div className="flex justify-end items-center space-x-2">
+          {onViewDetails && (
+            <Button 
+              variant="ghost" 
+              size="sm" 
+              onClick={(e) => {
+                e.stopPropagation();
+                onViewDetails(localItem);
+              }}
+              className="h-8 w-8 p-0"
+            >
+              <Eye className="h-4 w-4" />
+              <span className="sr-only">{t('view')}</span>
+            </Button>
+          )}
+          <IncidentActionsMenu 
+            item={localItem} 
+            onIncidentUpdated={onIncidentUpdated}
+            onViewDetails={onViewDetails}
+            onEditIncident={onEditIncident}
+          />
+        </div>
+      </TableCell>
+    </TableRow>
+  );
+});
+
+IncidentTableRow.displayName = 'IncidentTableRow';
diff --git a/application/src/components/schedule-incident/incident/table/IncidentTableSkeleton.tsx b/application/src/components/schedule-incident/incident/table/IncidentTableSkeleton.tsx
new file mode 100644
index 0000000..1ae40df
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/table/IncidentTableSkeleton.tsx
@@ -0,0 +1,27 @@
+
+import React from 'react';
+import { TableRow, TableCell } from '@/components/ui/table';
+import { Skeleton } from '@/components/ui/skeleton';
+
+export const IncidentTableRowSkeleton = () => (
+  <TableRow>
+    <TableCell><Skeleton className="h-5 w-[180px]" /></TableCell>
+    <TableCell><Skeleton className="h-5 w-[100px]" /></TableCell>
+    <TableCell><Skeleton className="h-5 w-[80px]" /></TableCell>
+    <TableCell><Skeleton className="h-5 w-[120px]" /></TableCell>
+    <TableCell><Skeleton className="h-5 w-[150px]" /></TableCell>
+    <TableCell><Skeleton className="h-5 w-[80px]" /></TableCell>
+    <TableCell><Skeleton className="h-5 w-[100px]" /></TableCell>
+    <TableCell><Skeleton className="h-5 w-[60px]" /></TableCell>
+  </TableRow>
+);
+
+export const IncidentTableSkeleton = () => (
+  <div className="overflow-x-auto">
+    <TableRow>
+      {Array(3).fill(0).map((_, index) => (
+        <IncidentTableRowSkeleton key={`skeleton-${index}`} />
+      ))}
+    </TableRow>
+  </div>
+);
diff --git a/application/src/components/schedule-incident/incident/table/IncidentTableUtils.tsx b/application/src/components/schedule-incident/incident/table/IncidentTableUtils.tsx
new file mode 100644
index 0000000..2dd14d5
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/table/IncidentTableUtils.tsx
@@ -0,0 +1,57 @@
+
+import React from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { userService, User } from '@/services/userService';
+import { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar';
+import { Skeleton } from '@/components/ui/skeleton';
+
+// Helper function to get user initials
+export const getUserInitials = (user: User): string => {
+  if (user.full_name) {
+    const nameParts = user.full_name.split(' ');
+    if (nameParts.length > 1) {
+      return `${nameParts[0][0]}${nameParts[1][0]}`.toUpperCase();
+    }
+    return user.full_name.substring(0, 2).toUpperCase();
+  }
+  return user.username.substring(0, 2).toUpperCase();
+};
+
+interface AssignedUserCellProps {
+  userId?: string;
+}
+
+export const AssignedUserCell: React.FC<AssignedUserCellProps> = ({ userId }) => {
+  const { data: user, isLoading } = useQuery({
+    queryKey: ['user', userId],
+    queryFn: async () => {
+      if (!userId) return null;
+      try {
+        return await userService.getUser(userId);
+      } catch (error) {
+        console.error("Failed to fetch assigned user:", error);
+        return null;
+      }
+    },
+    enabled: !!userId,
+    staleTime: 300000 // Cache for 5 minutes
+  });
+
+  if (isLoading) {
+    return <Skeleton className="h-6 w-20" />;
+  }
+
+  if (!user || !userId) {
+    return <span>-</span>;
+  }
+
+  return (
+    <div className="flex items-center gap-2">
+      <Avatar className="h-6 w-6">
+        <AvatarImage src={user.avatar} alt={user.full_name || user.username} />
+        <AvatarFallback>{getUserInitials(user)}</AvatarFallback>
+      </Avatar>
+      <span className="truncate max-w-[100px]">{user.full_name || user.username}</span>
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/incident/table/index.ts b/application/src/components/schedule-incident/incident/table/index.ts
new file mode 100644
index 0000000..2d98564
--- /dev/null
+++ b/application/src/components/schedule-incident/incident/table/index.ts
@@ -0,0 +1,5 @@
+
+export * from './IncidentTable';
+export * from './IncidentTableRow';
+export * from './IncidentTableSkeleton';
+export * from './IncidentTableUtils';
diff --git a/application/src/components/schedule-incident/index.ts b/application/src/components/schedule-incident/index.ts
new file mode 100644
index 0000000..73f2997
--- /dev/null
+++ b/application/src/components/schedule-incident/index.ts
@@ -0,0 +1,18 @@
+
+// Export all components for easier imports
+export * from './ScheduleIncidentContent';
+export * from './ScheduledMaintenanceTab';
+export * from './IncidentManagementTab';
+export * from './maintenance/MaintenanceTable';
+export * from './maintenance/MaintenanceStatusBadge';
+export * from './maintenance/MaintenanceActionsMenu';
+export * from './maintenance/EmptyMaintenanceState';
+export * from './maintenance/CreateMaintenanceDialog';
+export * from './incident/IncidentTable';
+export * from './incident/IncidentStatusBadge';
+export * from './incident/IncidentActionsMenu';
+export * from './incident/EmptyIncidentState';
+export * from './incident/CreateIncidentDialog';
+export * from './incident-management';
+export * from './hooks';
+
diff --git a/application/src/components/schedule-incident/maintenance/CreateMaintenanceDialog.tsx b/application/src/components/schedule-incident/maintenance/CreateMaintenanceDialog.tsx
new file mode 100644
index 0000000..2ddc398
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/CreateMaintenanceDialog.tsx
@@ -0,0 +1,94 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { 
+  Dialog, 
+  DialogContent, 
+  DialogHeader, 
+  DialogTitle, 
+  DialogDescription,
+  DialogFooter
+} from '@/components/ui/dialog';
+import { Form } from '@/components/ui/form';
+import { Button } from '@/components/ui/button';
+import { useMaintenanceForm } from './hooks/useMaintenanceForm';
+import {
+  MaintenanceBasicFields,
+  MaintenanceTimeFields,
+  MaintenanceAffectedFields,
+  MaintenanceConfigFields,
+  MaintenanceNotificationSettingsField
+} from './form';
+
+interface CreateMaintenanceDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onMaintenanceCreated: () => void;
+}
+
+export const CreateMaintenanceDialog = ({ 
+  open, 
+  onOpenChange,
+  onMaintenanceCreated 
+}: CreateMaintenanceDialogProps) => {
+  const { t } = useLanguage();
+  
+  const handleSuccess = () => {
+    console.log("CreateMaintenanceDialog: maintenance created successfully");
+    onMaintenanceCreated();
+  };
+  
+  const handleClose = () => {
+    console.log("CreateMaintenanceDialog: closing dialog");
+    onOpenChange(false);
+  };
+  
+  const { form, onSubmit } = useMaintenanceForm(handleSuccess, handleClose);
+
+  // Log the form state for debugging
+  React.useEffect(() => {
+    const subscription = form.watch((value) => {
+      console.log("Form values changed:", value);
+    });
+    return () => subscription.unsubscribe();
+  }, [form]);
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[600px] max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>{t('createMaintenanceWindow')}</DialogTitle>
+          <DialogDescription>
+            {t('createMaintenanceDesc')}
+          </DialogDescription>
+        </DialogHeader>
+        
+        <Form {...form}>
+          <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
+            <MaintenanceBasicFields />
+            <MaintenanceTimeFields />
+            <MaintenanceAffectedFields />
+            <MaintenanceConfigFields />
+            <MaintenanceNotificationSettingsField />
+            
+            <DialogFooter className="pt-4">
+              <Button 
+                type="button" 
+                variant="outline" 
+                onClick={() => onOpenChange(false)}
+              >
+                {t('cancel')}
+              </Button>
+              <Button 
+                type="submit"
+                disabled={form.formState.isSubmitting}
+              >
+                {form.formState.isSubmitting ? t('creating') : t('createMaintenance')}
+              </Button>
+            </DialogFooter>
+          </form>
+        </Form>
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/EmptyMaintenanceState.tsx b/application/src/components/schedule-incident/maintenance/EmptyMaintenanceState.tsx
new file mode 100644
index 0000000..60ce11d
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/EmptyMaintenanceState.tsx
@@ -0,0 +1,18 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { CalendarClock } from 'lucide-react';
+
+export const EmptyMaintenanceState = () => {
+  const { t } = useLanguage();
+  
+  return (
+    <div className="flex flex-col items-center justify-center py-12 text-gray-500">
+      <CalendarClock className="w-12 h-12 mb-4" />
+      <h3 className="text-lg font-medium mb-2">{t('noScheduledMaintenance')}</h3>
+      <p className="text-sm text-center max-w-md">
+        {t('noMaintenanceWindows')}
+      </p>
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/MaintenanceActionsMenu.tsx b/application/src/components/schedule-incident/maintenance/MaintenanceActionsMenu.tsx
new file mode 100644
index 0000000..9828100
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/MaintenanceActionsMenu.tsx
@@ -0,0 +1,170 @@
+
+import React, { useState } from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import { Button } from '@/components/ui/button';
+import { MoreHorizontal, Eye, Edit, Trash, Play, CheckCircle, X } from 'lucide-react';
+import { useToast } from '@/hooks/use-toast';
+import { 
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+import { maintenanceService } from '@/services/maintenance';
+import { MaintenanceDetailDialog } from './detail-dialog/MaintenanceDetailDialog';
+import { EditMaintenanceDialog } from './edit-dialog/EditMaintenanceDialog';
+
+interface MaintenanceActionsMenuProps {
+  item: MaintenanceItem;
+  onMaintenanceUpdated: () => void;
+}
+
+export const MaintenanceActionsMenu = ({ item, onMaintenanceUpdated }: MaintenanceActionsMenuProps) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [detailDialogOpen, setDetailDialogOpen] = useState(false);
+  const [editDialogOpen, setEditDialogOpen] = useState(false);
+  const [deleteDialogOpen, setDeleteDialogOpen] = useState(false);
+
+  const handleStatusChange = async (newStatus: string) => {
+    try {
+      await maintenanceService.updateMaintenanceStatus(item.id, newStatus);
+      toast({
+        title: t('statusUpdated'),
+        description: t('maintenanceStatusUpdated'),
+      });
+      onMaintenanceUpdated();
+    } catch (error) {
+      console.error('Error updating maintenance status:', error);
+      toast({
+        title: t('error'),
+        description: t('errorUpdatingMaintenanceStatus'),
+        variant: 'destructive',
+      });
+    }
+  };
+
+  const handleDelete = async () => {
+    try {
+      await maintenanceService.deleteMaintenance(item.id);
+      toast({
+        title: t('maintenanceDeleted'),
+        description: t('maintenanceDeletedDesc'),
+      });
+      onMaintenanceUpdated();
+    } catch (error) {
+      console.error('Error deleting maintenance:', error);
+      toast({
+        title: t('error'),
+        description: t('errorDeletingMaintenance'),
+        variant: 'destructive',
+      });
+    } finally {
+      setDeleteDialogOpen(false);
+    }
+  };
+
+  // Convert status to lowercase for consistent comparison
+  const status = item.status.toLowerCase();
+
+  return (
+    <>
+      <DropdownMenu>
+        <DropdownMenuTrigger asChild>
+          <Button variant="ghost" className="h-8 w-8 p-0">
+            <span className="sr-only">{t('actions')}</span>
+            <MoreHorizontal className="h-4 w-4" />
+          </Button>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent align="end">
+          <DropdownMenuLabel>{t('actions')}</DropdownMenuLabel>
+          <DropdownMenuSeparator />
+          <DropdownMenuItem onClick={() => setDetailDialogOpen(true)}>
+            <Eye className="mr-2 h-4 w-4" />
+            {t('view')}
+          </DropdownMenuItem>
+          
+          <DropdownMenuItem onClick={() => setEditDialogOpen(true)}>
+            <Edit className="mr-2 h-4 w-4" />
+            {t('edit')}
+          </DropdownMenuItem>
+          
+          {status === 'scheduled' && (
+            <DropdownMenuItem onClick={() => handleStatusChange('in_progress')}>
+              <Play className="mr-2 h-4 w-4" />
+              {t('markAsInProgress')}
+            </DropdownMenuItem>
+          )}
+          
+          {(status === 'scheduled' || status === 'in_progress') && (
+            <DropdownMenuItem onClick={() => handleStatusChange('completed')}>
+              <CheckCircle className="mr-2 h-4 w-4" />
+              {t('markAsCompleted')}
+            </DropdownMenuItem>
+          )}
+          
+          {status !== 'cancelled' && (
+            <DropdownMenuItem onClick={() => handleStatusChange('cancelled')}>
+              <X className="mr-2 h-4 w-4" />
+              {t('markAsCancelled')}
+            </DropdownMenuItem>
+          )}
+          
+          <DropdownMenuSeparator />
+          <DropdownMenuItem
+            onClick={() => setDeleteDialogOpen(true)}
+            className="text-red-600 focus:text-red-600"
+          >
+            <Trash className="mr-2 h-4 w-4" />
+            {t('delete')}
+          </DropdownMenuItem>
+        </DropdownMenuContent>
+      </DropdownMenu>
+      
+      <MaintenanceDetailDialog
+        open={detailDialogOpen}
+        onOpenChange={setDetailDialogOpen}
+        maintenance={item}
+      />
+      
+      <EditMaintenanceDialog
+        open={editDialogOpen}
+        onOpenChange={setEditDialogOpen}
+        maintenance={item}
+        onMaintenanceUpdated={onMaintenanceUpdated}
+      />
+      
+      <AlertDialog open={deleteDialogOpen} onOpenChange={setDeleteDialogOpen}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>{t('confirmDelete')}</AlertDialogTitle>
+            <AlertDialogDescription>
+              {t('deleteMaintenanceConfirmation')}
+              <span className="font-semibold"> {item.title}</span>?
+              {t('thisActionCannotBeUndone')}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>{t('cancel')}</AlertDialogCancel>
+            <AlertDialogAction onClick={handleDelete} className="bg-red-600 hover:bg-red-700">
+              {t('delete')}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/MaintenanceStatusBadge.tsx b/application/src/components/schedule-incident/maintenance/MaintenanceStatusBadge.tsx
new file mode 100644
index 0000000..0df3a5b
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/MaintenanceStatusBadge.tsx
@@ -0,0 +1,71 @@
+
+import React from 'react';
+import { Badge } from '@/components/ui/badge';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { CalendarClock, Clock, CheckCircle, X } from 'lucide-react';
+
+interface MaintenanceStatusBadgeProps {
+  status: string;
+}
+
+export const MaintenanceStatusBadge = ({ status }: MaintenanceStatusBadgeProps) => {
+  const { t } = useLanguage();
+
+  // Ensure we have a string and normalize it
+  const normalizedStatus = typeof status === 'string' ? status.toLowerCase() : '';
+
+  const getStatusColor = () => {
+    switch (normalizedStatus) {
+      case 'scheduled':
+        return 'bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-300';
+      case 'in progress':
+      case 'in_progress':
+        return 'bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-300';
+      case 'completed':
+        return 'bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-300';
+      case 'cancelled':
+        return 'bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-300';
+      default:
+        return 'bg-gray-100 text-gray-800 dark:bg-gray-800 dark:text-gray-300';
+    }
+  };
+
+  const getStatusIcon = () => {
+    switch (normalizedStatus) {
+      case 'scheduled':
+        return <CalendarClock className="h-3 w-3" />;
+      case 'in progress':
+      case 'in_progress':
+        return <Clock className="h-3 w-3" />;
+      case 'completed':
+        return <CheckCircle className="h-3 w-3" />;
+      case 'cancelled':
+        return <X className="h-3 w-3" />;
+      default:
+        return <CalendarClock className="h-3 w-3" />;
+    }
+  };
+
+  const getDisplayStatus = () => {
+    switch (normalizedStatus) {
+      case 'scheduled':
+        return t('scheduled');
+      case 'in progress':
+      case 'in_progress':
+        return t('inProgress');
+      case 'completed':
+        return t('completed');
+      case 'cancelled':
+        return t('cancelled');
+      default:
+        return status || '';
+    }
+  };
+
+  return (
+    <Badge className={`${getStatusColor()} flex items-center gap-1 font-medium`} variant="outline">
+      {getStatusIcon()}
+      {getDisplayStatus()}
+    </Badge>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/MaintenanceStatusChecker.tsx b/application/src/components/schedule-incident/maintenance/MaintenanceStatusChecker.tsx
new file mode 100644
index 0000000..ace590b
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/MaintenanceStatusChecker.tsx
@@ -0,0 +1,175 @@
+
+import { useEffect, useRef } from 'react';
+import { maintenanceService } from '@/services/maintenance';
+import { useToast } from '@/hooks/use-toast';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+import { maintenanceNotificationService } from '@/services/maintenance/maintenanceNotificationService';
+
+interface MaintenanceStatusCheckerProps {
+  maintenanceData: MaintenanceItem[];
+  onStatusUpdated: () => void;
+}
+
+export const MaintenanceStatusChecker = ({ 
+  maintenanceData, 
+  onStatusUpdated 
+}: MaintenanceStatusCheckerProps) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const checkedItemsRef = useRef<Set<string>>(new Set());
+  const notificationSentRef = useRef<Set<string>>(new Set());
+  const intervalRef = useRef<number | null>(null);
+
+  useEffect(() => {
+    if (!maintenanceData || maintenanceData.length === 0) return;
+
+    const checkAndUpdateStatus = async () => {
+      const currentTime = new Date();
+      let hasUpdates = false;
+
+      console.log('MaintenanceStatusChecker: Checking status updates at', currentTime.toISOString());
+      console.log('MaintenanceStatusChecker: Checking', maintenanceData.length, 'maintenance items');
+
+      for (const item of maintenanceData) {
+        try {
+          const startTime = new Date(item.start_time);
+          const endTime = new Date(item.end_time);
+          const status = item.status.toLowerCase();
+          
+          console.log(`MaintenanceStatusChecker: Item ${item.id} - Status: ${status}, Start: ${startTime.toISOString()}, End: ${endTime.toISOString()}, Current: ${currentTime.toISOString()}`);
+          
+          // Check if scheduled maintenance should start (become in_progress)
+          if (status === 'scheduled' && currentTime >= startTime && currentTime <= endTime) {
+            const checkKey = `${item.id}-started`;
+            const notificationKey = `${item.id}-start-notification`;
+            
+            if (!checkedItemsRef.current.has(checkKey)) {
+              console.log(`MaintenanceStatusChecker: Starting maintenance ${item.id} at ${currentTime.toISOString()}`);
+              
+              // Update status to in_progress first
+              await maintenanceService.updateMaintenanceStatus(item.id, 'in_progress');
+              
+              // Send start notification only once
+              if (!notificationSentRef.current.has(notificationKey)) {
+                try {
+                  await maintenanceNotificationService.sendMaintenanceNotification({
+                    maintenance: item,
+                    notificationType: 'start'
+                  });
+                  notificationSentRef.current.add(notificationKey);
+                  console.log(`MaintenanceStatusChecker: Start notification sent for ${item.id}`);
+                } catch (notificationError) {
+                  console.log('MaintenanceStatusChecker: Start notification failed', notificationError);
+                }
+              }
+              
+              toast({
+                title: t('maintenanceInProgress'),
+                description: `${item.title} ${t('isNowInProgress')}`,
+              });
+              
+              checkedItemsRef.current.add(checkKey);
+              hasUpdates = true;
+            }
+          }
+          
+          // Check if in_progress maintenance should be completed
+          if (status === 'in_progress' && currentTime >= endTime) {
+            const checkKey = `${item.id}-completed`;
+            const notificationKey = `${item.id}-end-notification`;
+            
+            if (!checkedItemsRef.current.has(checkKey)) {
+              console.log(`MaintenanceStatusChecker: Completing maintenance ${item.id} at ${currentTime.toISOString()}`);
+              
+              // Update status to completed first
+              await maintenanceService.updateMaintenanceStatus(item.id, 'completed');
+              
+              // Send completion notification only once
+              if (!notificationSentRef.current.has(notificationKey)) {
+                try {
+                  await maintenanceNotificationService.sendMaintenanceNotification({
+                    maintenance: item,
+                    notificationType: 'end'
+                  });
+                  notificationSentRef.current.add(notificationKey);
+                  console.log(`MaintenanceStatusChecker: Completion notification sent for ${item.id}`);
+                } catch (notificationError) {
+                  console.log('MaintenanceStatusChecker: Completion notification failed', notificationError);
+                }
+              }
+              
+              toast({
+                title: t('maintenanceCompleted'),
+                description: `${item.title} ${t('hasBeenCompleted')}`,
+              });
+              
+              checkedItemsRef.current.add(checkKey);
+              hasUpdates = true;
+            }
+          }
+        } catch (error) {
+          console.error('MaintenanceStatusChecker: Error updating status for item', item.id, error);
+          // Clear the check flags after 2 minutes to allow retry
+          setTimeout(() => {
+            checkedItemsRef.current.delete(`${item.id}-started`);
+            checkedItemsRef.current.delete(`${item.id}-completed`);
+            notificationSentRef.current.delete(`${item.id}-start-notification`);
+            notificationSentRef.current.delete(`${item.id}-end-notification`);
+          }, 120000);
+        }
+      }
+
+      if (hasUpdates) {
+        console.log('MaintenanceStatusChecker: Status updates detected, triggering refresh');
+        // Force immediate refresh to update the UI
+        onStatusUpdated();
+      }
+    };
+
+    // Clear the interval if it exists
+    if (intervalRef.current) {
+      clearInterval(intervalRef.current);
+    }
+
+    // Initial check immediately
+    checkAndUpdateStatus();
+    
+    // Check every 5 seconds for immediate status updates
+    intervalRef.current = window.setInterval(checkAndUpdateStatus, 5000);
+    
+    return () => {
+      if (intervalRef.current) {
+        clearInterval(intervalRef.current);
+        intervalRef.current = null;
+      }
+    };
+  }, [maintenanceData, onStatusUpdated, t, toast]);
+
+  // Clear check flags when maintenance data changes significantly
+  useEffect(() => {
+    const currentIds = new Set(maintenanceData.map(item => item.id));
+    
+    // Clean up check flags for items that no longer exist
+    const keysToDelete = Array.from(checkedItemsRef.current).filter(key => {
+      const itemId = key.split('-')[0];
+      return !currentIds.has(itemId);
+    });
+    
+    keysToDelete.forEach(key => {
+      checkedItemsRef.current.delete(key);
+    });
+    
+    // Clean up notification flags for items that no longer exist
+    const notificationKeysToDelete = Array.from(notificationSentRef.current).filter(key => {
+      const itemId = key.split('-')[0];
+      return !currentIds.has(itemId);
+    });
+    
+    notificationKeysToDelete.forEach(key => {
+      notificationSentRef.current.delete(key);
+    });
+  }, [maintenanceData]);
+
+  return null;
+};
\ No newline at end of file
diff --git a/application/src/components/schedule-incident/maintenance/MaintenanceStatusDropdown.tsx b/application/src/components/schedule-incident/maintenance/MaintenanceStatusDropdown.tsx
new file mode 100644
index 0000000..9963728
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/MaintenanceStatusDropdown.tsx
@@ -0,0 +1,82 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { CalendarClock, Clock, CheckCircle, X } from 'lucide-react';
+import { useToast } from '@/hooks/use-toast';
+import { maintenanceService } from '@/services/maintenance';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import { MaintenanceStatusBadge } from './MaintenanceStatusBadge';
+
+interface MaintenanceStatusDropdownProps {
+  status: string;
+  id: string;
+  onStatusUpdated: () => void;
+  disabled?: boolean;
+}
+
+export const MaintenanceStatusDropdown = ({
+  status,
+  id,
+  onStatusUpdated,
+  disabled = false
+}: MaintenanceStatusDropdownProps) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+
+  const statusOptions = [
+    { value: 'scheduled', label: t('scheduled'), icon: <CalendarClock className="h-4 w-4 mr-2" /> },
+    { value: 'in_progress', label: t('inProgress'), icon: <Clock className="h-4 w-4 mr-2" /> },
+    { value: 'completed', label: t('completed'), icon: <CheckCircle className="h-4 w-4 mr-2" /> },
+    { value: 'cancelled', label: t('cancelled'), icon: <X className="h-4 w-4 mr-2" /> },
+  ];
+
+  const handleStatusChange = async (newStatus: string) => {
+    // Don't update if the status is the same
+    if (status.toLowerCase() === newStatus) return;
+    
+    try {
+      await maintenanceService.updateMaintenanceStatus(id, newStatus);
+      
+      toast({
+        title: t('statusUpdated'),
+        description: t('maintenanceStatusUpdated'),
+      });
+      
+      onStatusUpdated();
+    } catch (error) {
+      console.error('Error updating maintenance status:', error);
+      
+      toast({
+        title: t('error'),
+        description: t('failedToUpdateStatus'),
+        variant: 'destructive',
+      });
+    }
+  };
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger disabled={disabled} className="w-full cursor-pointer">
+        <MaintenanceStatusBadge status={status} />
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="start" className="bg-popover border border-border shadow-md">
+        {statusOptions.map((option) => (
+          <DropdownMenuItem
+            key={option.value}
+            className="flex items-center cursor-pointer"
+            onClick={() => handleStatusChange(option.value)}
+          >
+            {option.icon}
+            {option.label}
+          </DropdownMenuItem>
+        ))}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
+
diff --git a/application/src/components/schedule-incident/maintenance/MaintenanceTable.tsx b/application/src/components/schedule-incident/maintenance/MaintenanceTable.tsx
new file mode 100644
index 0000000..62295f6
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/MaintenanceTable.tsx
@@ -0,0 +1,152 @@
+
+import React, { useState, useMemo } from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from '@/components/ui/table';
+import { Badge } from '@/components/ui/badge';
+import { format } from 'date-fns';
+import { MaintenanceStatusDropdown } from './MaintenanceStatusDropdown';
+import { MaintenanceActionsMenu } from './MaintenanceActionsMenu';
+import { MaintenanceDetailDialog } from './detail-dialog/MaintenanceDetailDialog';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+import { Skeleton } from '@/components/ui/skeleton';
+import { EmptyMaintenanceState } from './EmptyMaintenanceState';
+
+interface MaintenanceTableProps {
+  data: MaintenanceItem[];
+  isLoading?: boolean;
+  onMaintenanceUpdated: () => void;
+}
+
+export const MaintenanceTable = ({ data, isLoading = false, onMaintenanceUpdated }: MaintenanceTableProps) => {
+  const { t } = useLanguage();
+  const [selectedMaintenance, setSelectedMaintenance] = useState<MaintenanceItem | null>(null);
+  const [detailDialogOpen, setDetailDialogOpen] = useState(false);
+
+  // Memoize the formatted date function to avoid recreating it on each render
+  const formatDate = useMemo(() => (dateString: string) => {
+    if (!dateString) return '-';
+    
+    try {
+      return format(new Date(dateString), 'MMM d, yyyy HH:mm');
+    } catch (error) {
+      return dateString || '-';
+    }
+  }, []);
+
+  const handleViewMaintenance = (maintenance: MaintenanceItem) => {
+    setSelectedMaintenance(maintenance);
+    setDetailDialogOpen(true);
+  };
+
+  if (isLoading) {
+    // Render skeleton loading state with table structure for smoother transitions
+    return (
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>{t('title')}</TableHead>
+            <TableHead>{t('status')}</TableHead>
+            <TableHead>{t('scheduledStart')}</TableHead>
+            <TableHead>{t('scheduledEnd')}</TableHead>
+            <TableHead>{t('affectedServices')}</TableHead>
+            <TableHead>{t('impact')}</TableHead>
+            <TableHead className="w-[80px]">{t('actions')}</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {[1, 2, 3].map(i => (
+            <TableRow key={`skeleton-${i}`}>
+              <TableCell><Skeleton className="h-6 w-28" /></TableCell>
+              <TableCell><Skeleton className="h-6 w-20" /></TableCell>
+              <TableCell><Skeleton className="h-6 w-32" /></TableCell>
+              <TableCell><Skeleton className="h-6 w-32" /></TableCell>
+              <TableCell><Skeleton className="h-6 w-24" /></TableCell>
+              <TableCell><Skeleton className="h-6 w-16" /></TableCell>
+              <TableCell><Skeleton className="h-6 w-8" /></TableCell>
+            </TableRow>
+          ))}
+        </TableBody>
+      </Table>
+    );
+  }
+
+  if (!data || data.length === 0) {
+    return <EmptyMaintenanceState />;
+  }
+
+  // Memoize the impact badge variant calculation
+  const getImpactBadgeVariant = (field: string | undefined) => {
+    const fieldLower = field?.toLowerCase() || '';
+    if (fieldLower === 'critical') return 'destructive';
+    if (fieldLower === 'major') return 'default';
+    if (fieldLower === 'minor') return 'secondary';
+    return 'outline';
+  };
+
+  return (
+    <>
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>{t('title')}</TableHead>
+            <TableHead>{t('status')}</TableHead>
+            <TableHead>{t('scheduledStart')}</TableHead>
+            <TableHead>{t('scheduledEnd')}</TableHead>
+            <TableHead>{t('affectedServices')}</TableHead>
+            <TableHead>{t('impact')}</TableHead>
+            <TableHead className="w-[80px]">{t('actions')}</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {data.map((item) => (
+            <TableRow key={item.id} className="cursor-pointer hover:bg-muted/40">
+              <TableCell className="font-medium" onClick={() => handleViewMaintenance(item)}>
+                {item.title || '-'}
+              </TableCell>
+              <TableCell onClick={(e) => e.stopPropagation()}>
+                <MaintenanceStatusDropdown 
+                  status={item.status} 
+                  id={item.id} 
+                  onStatusUpdated={onMaintenanceUpdated} 
+                />
+              </TableCell>
+              <TableCell onClick={() => handleViewMaintenance(item)}>
+                {formatDate(item.start_time)}
+              </TableCell>
+              <TableCell onClick={() => handleViewMaintenance(item)}>
+                {formatDate(item.end_time)}
+              </TableCell>
+              <TableCell onClick={() => handleViewMaintenance(item)}>
+                <div className="flex flex-wrap gap-1">
+                  {item.affected ? item.affected.split(',').slice(0, 2).map((service, index) => (
+                    <Badge key={index} variant="outline">{service.trim()}</Badge>
+                  )) : '-'}
+                  {item.affected && item.affected.split(',').length > 2 && (
+                    <Badge variant="outline">+{item.affected.split(',').length - 2}</Badge>
+                  )}
+                </div>
+              </TableCell>
+              <TableCell onClick={() => handleViewMaintenance(item)}>
+                <Badge variant={getImpactBadgeVariant(item.field)}>
+                  {item.field ? t(item.field.toLowerCase()) : '-'}
+                </Badge>
+              </TableCell>
+              <TableCell onClick={(e) => e.stopPropagation()}>
+                <MaintenanceActionsMenu 
+                  item={item} 
+                  onMaintenanceUpdated={onMaintenanceUpdated} 
+                />
+              </TableCell>
+            </TableRow>
+          ))}
+        </TableBody>
+      </Table>
+      
+      <MaintenanceDetailDialog
+        open={detailDialogOpen}
+        onOpenChange={setDetailDialogOpen}
+        maintenance={selectedMaintenance}
+      />
+    </>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailContent.tsx b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailContent.tsx
new file mode 100644
index 0000000..1eecbfe
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailContent.tsx
@@ -0,0 +1,150 @@
+
+import React, { useEffect, useState } from 'react';
+import { userService, User } from '@/services/userService';
+import { useQuery } from '@tanstack/react-query';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+import { MaintenanceDetailHeader } from './MaintenanceDetailHeader';
+import { MaintenanceDetailSections } from './MaintenanceDetailSections';
+import { MaintenanceDetailFooter } from './MaintenanceDetailFooter';
+import { alertConfigService } from '@/services/alertConfigService';
+
+interface MaintenanceDetailContentProps {
+  maintenance: MaintenanceItem;
+  onClose: () => void;
+}
+
+export const MaintenanceDetailContent = ({ 
+  maintenance,
+  onClose
+}: MaintenanceDetailContentProps) => {
+  const [assignedUsers, setAssignedUsers] = useState<User[]>([]);
+  const [maintenanceWithDetails, setMaintenanceWithDetails] = useState<MaintenanceItem>(maintenance);
+  
+  // Fetch all users to resolve the assigned users and creator
+  const { data: users = [] } = useQuery({
+    queryKey: ['users'],
+    queryFn: async () => {
+      const usersList = await userService.getUsers();
+      return usersList || [];
+    },
+    enabled: true
+  });
+
+  // Fetch notification channels for notification channel display
+  const { data: notificationChannels = [] } = useQuery({
+    queryKey: ['notificationChannels'],
+    queryFn: async () => {
+      const channels = await alertConfigService.getAlertConfigurations();
+      return channels || [];
+    },
+    enabled: true
+  });
+  
+  // Process user information when users data is available
+  useEffect(() => {
+    if (users.length > 0 && maintenance) {
+      // Create a copy of the maintenance object for modifications
+      const enhancedMaintenance = { ...maintenance };
+      
+      // Process assigned users
+      if (maintenance.assigned_users) {
+        let userIds: string[] = [];
+        
+        // Step 1: Extract user IDs from various formats
+        if (Array.isArray(maintenance.assigned_users)) {
+          userIds = maintenance.assigned_users;
+        } else if (typeof maintenance.assigned_users === 'string') {
+          // Try parsing the string to extract user IDs
+          try {
+            // Try parsing as JSON first
+            const parsedData = JSON.parse(maintenance.assigned_users);
+            if (Array.isArray(parsedData)) {
+              // Direct array format
+              userIds = parsedData;
+            } else if (typeof parsedData === 'string') {
+              // Nested JSON string
+              try {
+                const nestedData = JSON.parse(parsedData);
+                if (Array.isArray(nestedData)) {
+                  userIds = nestedData;
+                }
+              } catch (e) {
+                // If nested parsing fails, treat as single ID
+                userIds = [parsedData];
+              }
+            } else {
+              // Unknown format, use as is
+              userIds = [String(parsedData)];
+            }
+          } catch (e) {
+            // If JSON parsing fails, try comma splitting
+            if (maintenance.assigned_users.includes(',')) {
+              userIds = maintenance.assigned_users.split(',').map(id => id.trim()).filter(Boolean);
+            } else {
+              // Single ID
+              userIds = [maintenance.assigned_users];
+            }
+          }
+        }
+        
+        // Step 2: Clean up extracted IDs (remove quotes, brackets, etc.)
+        userIds = userIds.map(id => {
+          // Remove surrounding quotes if present
+          let cleanId = id.replace(/^["']|["']$/g, '');
+          // Remove any remaining JSON artifacts
+          cleanId = cleanId.replace(/[\[\]"'\\]/g, '');
+          return cleanId;
+        }).filter(Boolean);
+          
+        // Step 3: Find matching users from the users array
+        if (userIds.length > 0) {
+          const matchedUsers = users.filter(user => userIds.includes(user.id));
+          setAssignedUsers(matchedUsers);
+        } else {
+          setAssignedUsers([]);
+        }
+      } else {
+        setAssignedUsers([]);
+      }
+      
+      // Process created_by field - replace ID with full name if available
+      if (maintenance?.created_by) {
+        const creator = users.find(user => user.id === maintenance.created_by);
+        if (creator) {
+          enhancedMaintenance.created_by = creator.full_name || creator.username || maintenance.created_by;
+        }
+      }
+      
+      // Process notification channel if needed
+      if (maintenance.notify_subscribers === 'yes') {
+        // Try notification_channel_id first, fall back to notification_id if needed
+        const channelId = maintenance.notification_channel_id || maintenance.notification_id;
+        
+        if (channelId && notificationChannels.length > 0) {
+          const channel = notificationChannels.find(ch => ch.id === channelId);
+          if (channel) {
+            enhancedMaintenance.notification_channel_name = `${channel.notify_name} (${channel.notification_type})`;
+          } else {
+            enhancedMaintenance.notification_channel_name = `Channel ID: ${channelId}`;
+          }
+        }
+      }
+      
+      setMaintenanceWithDetails(enhancedMaintenance);
+    }
+  }, [maintenance, users, notificationChannels]);
+
+  return (
+    <>
+      <MaintenanceDetailHeader maintenance={maintenanceWithDetails} />
+      <MaintenanceDetailSections 
+        maintenance={maintenanceWithDetails}
+        assignedUsers={assignedUsers}
+      />
+      <MaintenanceDetailFooter 
+        maintenance={maintenanceWithDetails}
+        onClose={onClose}
+      />
+    </>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailDialog.tsx b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailDialog.tsx
new file mode 100644
index 0000000..5940e34
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailDialog.tsx
@@ -0,0 +1,37 @@
+
+import React from 'react';
+import { 
+  Dialog, 
+  DialogContent
+} from '@/components/ui/dialog';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+import { MaintenanceDetailContent } from './MaintenanceDetailContent';
+
+interface MaintenanceDetailDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  maintenance: MaintenanceItem | null;
+}
+
+export const MaintenanceDetailDialog = ({
+  open,
+  onOpenChange,
+  maintenance
+}: MaintenanceDetailDialogProps) => {
+  if (!maintenance) {
+    return null;
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent 
+        className="dialog-content sm:max-w-[700px] max-h-[90vh] overflow-y-auto 
+                  print:max-w-none print:max-h-none print:overflow-visible 
+                  print:shadow-none print:m-0 print:p-0 print:border-none
+                  print:absolute print:left-0 print:top-0 print:w-full print:h-auto"
+      >
+        <MaintenanceDetailContent maintenance={maintenance} onClose={() => onOpenChange(false)} />
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailFooter.tsx b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailFooter.tsx
new file mode 100644
index 0000000..a59a8cc
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailFooter.tsx
@@ -0,0 +1,27 @@
+
+import React from 'react';
+import { DialogFooter } from '@/components/ui/dialog';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+import { 
+  PrintButton,
+  DownloadPdfButton,
+  CloseButton
+} from './components';
+
+interface MaintenanceDetailFooterProps {
+  maintenance: MaintenanceItem;
+  onClose: () => void;
+}
+
+export const MaintenanceDetailFooter = ({ 
+  maintenance,
+  onClose
+}: MaintenanceDetailFooterProps) => {
+  return (
+    <DialogFooter className="gap-2 sm:gap-2 mt-6 pt-4 border-t print:hidden">
+      <PrintButton maintenance={maintenance} />
+      <DownloadPdfButton maintenance={maintenance} />
+      <CloseButton onClose={onClose} />
+    </DialogFooter>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailHeader.tsx b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailHeader.tsx
new file mode 100644
index 0000000..0b70c76
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailHeader.tsx
@@ -0,0 +1,82 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { CalendarClock } from 'lucide-react';
+import { 
+  DialogHeader,
+  DialogTitle
+} from '@/components/ui/dialog';
+import { Badge } from '@/components/ui/badge';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+
+interface MaintenanceDetailHeaderProps {
+  maintenance: MaintenanceItem;
+}
+
+export const MaintenanceDetailHeader = ({ maintenance }: MaintenanceDetailHeaderProps) => {
+  const { t } = useLanguage();
+
+  const getStatusColor = (status: string) => {
+    switch (status.toLowerCase()) {
+      case 'scheduled':
+        return 'bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-300';
+      case 'in_progress':
+      case 'in progress':
+        return 'bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-300';
+      case 'completed':
+        return 'bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-300';
+      case 'cancelled':
+        return 'bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-300';
+      default:
+        return 'bg-gray-100 text-gray-800 dark:bg-gray-800 dark:text-gray-300';
+    }
+  };
+  
+  const getImpactColor = (impact: string) => {
+    switch (impact.toLowerCase()) {
+      case 'critical':
+        return 'bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-300';
+      case 'major':
+        return 'bg-orange-100 text-orange-800 dark:bg-orange-900 dark:text-orange-300';
+      case 'minor':
+        return 'bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-300';
+      case 'none':
+        return 'bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-300';
+      default:
+        return 'bg-gray-100 text-gray-800 dark:bg-gray-800 dark:text-gray-300';
+    }
+  };
+  
+  const getPriorityColor = (priority: string) => {
+    switch (priority.toLowerCase()) {
+      case 'high':
+        return 'bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-300';
+      case 'medium':
+        return 'bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-300';
+      case 'low':
+        return 'bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-300';
+      default:
+        return 'bg-gray-100 text-gray-800 dark:bg-gray-800 dark:text-gray-300';
+    }
+  };
+
+  return (
+    <DialogHeader className="print:mb-6">
+      <div className="flex items-center gap-2 mb-1">
+        <CalendarClock className="h-5 w-5 text-blue-500 print:hidden" />
+        <DialogTitle className="text-xl">{maintenance.title}</DialogTitle>
+      </div>
+      <div className="flex flex-wrap gap-2 mt-2">
+        <Badge className={getStatusColor(maintenance.status)}>
+          {maintenance.status}
+        </Badge>
+        <Badge className={getImpactColor(maintenance.field)}>
+          {maintenance.field} {t('impact')}
+        </Badge>
+        <Badge className={getPriorityColor(maintenance.priority)}>
+          {maintenance.priority} {t('priority')}
+        </Badge>
+      </div>
+    </DialogHeader>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailSections.tsx b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailSections.tsx
new file mode 100644
index 0000000..d3abf71
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/MaintenanceDetailSections.tsx
@@ -0,0 +1,198 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { format } from 'date-fns';
+import { Separator } from '@/components/ui/separator';
+import { Badge } from '@/components/ui/badge';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+import { User } from '@/services/userService';
+
+interface MaintenanceDetailSectionsProps {
+  maintenance: MaintenanceItem;
+  assignedUsers: User[];
+}
+
+export const MaintenanceDetailSections = ({ 
+  maintenance, 
+  assignedUsers 
+}: MaintenanceDetailSectionsProps) => {
+  const { t } = useLanguage();
+
+  const formatDateTime = (dateString: string) => {
+    try {
+      return format(new Date(dateString), 'PPP p');
+    } catch (error) {
+      return dateString;
+    }
+  };
+
+  const calculateDuration = (start: string, end: string): string => {
+    try {
+      const startTime = new Date(start);
+      const endTime = new Date(end);
+      const durationMs = endTime.getTime() - startTime.getTime();
+      
+      // Convert to hours and minutes
+      const hours = Math.floor(durationMs / (1000 * 60 * 60));
+      const minutes = Math.floor((durationMs % (1000 * 60 * 60)) / (1000 * 60));
+      
+      if (hours === 0) {
+        return `${minutes}m`;
+      } else if (minutes === 0) {
+        return `${hours}h`;
+      } else {
+        return `${hours}h ${minutes}m`;
+      }
+    } catch (error) {
+      return "N/A";
+    }
+  };
+  
+  const affectedServices = typeof maintenance.affected === 'string' 
+    ? maintenance.affected.split(',').map(item => item.trim())
+    : [];
+
+  return (
+    <div className="space-y-4 print:space-y-1 print-compact-spacing">
+      {/* Print Header - Only visible when printing */}
+      <div className="hidden print:block print-section">
+        <div className="header-print bg-blue-800 text-white p-4 rounded-t-md">
+          <div className="flex justify-between">
+            <div>
+              <h1 className="text-xl font-bold">Scheduled Maintenance Report</h1>
+              <p className="text-blue-100 mt-1 print-compact-text">{maintenance.title}</p>
+            </div>
+            <div className="text-right">
+              <p className="text-xs text-blue-100">Reference ID: {maintenance.id}</p>
+              <p className="text-xs text-blue-100">Generated on {format(new Date(), 'PPP')}</p>
+            </div>
+          </div>
+        </div>
+      </div>
+      
+      {/* Reference ID - Only visible in UI */}
+      <div className="flex items-center justify-between text-sm print:hidden">
+        <span className="text-muted-foreground">{t('referenceID')}</span>
+        <span className="font-mono bg-muted px-2 py-1 rounded">{maintenance.id}</span>
+      </div>
+      
+      {/* Description Section */}
+      <div className="print:mt-0 print-section">
+        <h4 className="text-sm font-medium text-muted-foreground mb-2 print:text-xs print:font-bold print:text-blue-800">{t('description')}</h4>
+        <div className="bg-muted/50 p-3 rounded-md text-sm whitespace-pre-wrap print:bg-transparent print:border print:border-gray-200 print:p-1 print:rounded print:text-xs print:text-black print-description">
+          {maintenance.description || t('noDescriptionProvided')}
+        </div>
+      </div>
+      
+      <Separator className="print:hidden" />
+      
+      {/* Time Information */}
+      <div className="print-section">
+        <h4 className="text-sm font-medium text-muted-foreground mb-2 print:text-xs print:font-bold print:text-blue-800">{t('timeInformation')}</h4>
+        <div className="grid grid-cols-1 md:grid-cols-2 gap-4 print:grid-cols-2 print:gap-1 print:bg-gray-50 print:border print:border-gray-200 print:p-1 print:rounded print-compact-text">
+          <div>
+            <h4 className="text-sm font-medium text-muted-foreground mb-1 print:text-xs print:text-blue-700 print:mb-0">{t('scheduledStart')}</h4>
+            <p className="text-sm print:text-xs print:text-black print-smaller-font">{formatDateTime(maintenance.start_time)}</p>
+          </div>
+          <div>
+            <h4 className="text-sm font-medium text-muted-foreground mb-1 print:text-xs print:text-blue-700 print:mb-0">{t('scheduledEnd')}</h4>
+            <p className="text-sm print:text-xs print:text-black print-smaller-font">{formatDateTime(maintenance.end_time)}</p>
+          </div>
+          <div>
+            <h4 className="text-sm font-medium text-muted-foreground mb-1 print:text-xs print:text-blue-700 print:mb-0">{t('duration')}</h4>
+            <p className="text-sm print:text-xs print:text-black print-smaller-font">{calculateDuration(maintenance.start_time, maintenance.end_time)}</p>
+          </div>
+          <div>
+            <h4 className="text-sm font-medium text-muted-foreground mb-1 print:text-xs print:text-blue-700 print:mb-0">{t('maintenanceType')}</h4>
+            <p className="text-sm print:text-xs print:text-black print-smaller-font capitalize">{maintenance.field}</p>
+          </div>
+        </div>
+      </div>
+      
+      <Separator className="print:hidden" />
+      
+      {/* Affected Services */}
+      <div className="print-section">
+        <h4 className="text-sm font-medium text-muted-foreground mb-2 print:text-xs print:font-bold print:text-blue-800">{t('affectedServices')}</h4>
+        <div className="print:border print:border-gray-200 print:p-1 print:rounded">
+          {affectedServices.length > 0 ? (
+            <div className="flex flex-wrap gap-2 print:gap-1">
+              {affectedServices.map((service, index) => (
+                <Badge key={index} variant="outline" className="badge-print print:bg-blue-50 print:text-blue-800 print:border print:border-blue-200">
+                  {service}
+                </Badge>
+              ))}
+            </div>
+          ) : (
+            <span className="text-sm text-muted-foreground print:text-xs print:text-black">{t('noAffectedServices')}</span>
+          )}
+        </div>
+      </div>
+      
+      {/* Assigned Users - Simplified for print */}
+      <div className="print-section">
+        <h4 className="text-sm font-medium text-muted-foreground mb-2 print:text-xs print:font-bold print:text-blue-800">{t('assignedPersonnel')}</h4>
+        <div className="border border-border rounded-md p-3 print:border print:border-gray-200 print:p-1 print:rounded print:bg-gray-50">
+          {assignedUsers && assignedUsers.length > 0 ? (
+            <div className="print:grid print:grid-cols-2 print:gap-1">
+              {assignedUsers.map((user) => (
+                <div key={user.id} className="flex items-center gap-2 p-2 bg-muted/30 rounded-md print:bg-transparent print:p-0 print:text-xs">
+                  <div className="w-5 h-5 rounded-full bg-primary/10 flex items-center justify-center text-xs font-medium print:bg-blue-100 print:text-blue-800 print:w-4 print:h-4">
+                    {user && (user.full_name?.[0] || user.username?.[0] || 'U').toUpperCase()}
+                  </div>
+                  <span className="print:text-xs print:font-medium print:text-black print-smaller-font">{user.full_name || user.username}</span>
+                </div>
+              ))}
+            </div>
+          ) : (
+            <span className="text-sm text-muted-foreground print:text-xs print:text-black">{t('noAssignedUsers')}</span>
+          )}
+        </div>
+      </div>
+      
+      <Separator className="print:hidden" />
+      
+      {/* Metadata - Condensed for print */}
+      <div className="print-section">
+        <h4 className="text-sm font-medium text-muted-foreground mb-2 print:text-xs print:font-bold print:text-blue-800">{t('additionalInformation')}</h4>
+        <div className="grid grid-cols-1 md:grid-cols-2 gap-2 text-sm print:grid-cols-2 print:gap-1 print:bg-gray-50 print:border print:border-gray-200 print:p-1 print:rounded print-compact-text">
+          <div>
+            <h4 className="font-medium text-muted-foreground mb-0 print:text-xs print:text-blue-700">{t('createdBy')}</h4>
+            <p className="print:text-xs print:text-black print-smaller-font">{maintenance.created_by || t('notSpecified')}</p>
+          </div>
+          <div>
+            <h4 className="font-medium text-muted-foreground mb-0 print:text-xs print:text-blue-700">{t('notificationChannel')}</h4>
+            <p className="print:text-xs print:text-black print-smaller-font">{maintenance.notification_channel_name || t('notSpecified')}</p>
+          </div>
+          <div>
+            <h4 className="font-medium text-muted-foreground mb-0 print:text-xs print:text-blue-700">{t('created')}</h4>
+            <p className="print:text-xs print:text-black print-smaller-font">{formatDateTime(maintenance.created)}</p>
+          </div>
+          <div>
+            <h4 className="font-medium text-muted-foreground mb-0 print:text-xs print:text-blue-700">{t('lastUpdated')}</h4>
+            <p className="print:text-xs print:text-black print-smaller-font">{formatDateTime(maintenance.updated)}</p>
+          </div>
+        </div>
+      </div>
+      
+      {/* Notification Settings - Simplified for print */}
+      <div className="text-sm bg-muted/50 p-3 rounded-md print:bg-blue-50 print:border print:border-blue-200 print:p-1 print:rounded print-section print-compact-text">
+        <h4 className="font-medium mb-1 print:text-xs print:font-bold print:text-blue-800 print:mb-0">{t('notificationSettings')}</h4>
+        <p className="print:text-xs print:text-black print-smaller-font">
+          {maintenance.notify_subscribers === 'yes' 
+            ? t('subscribersWillBeNotified') 
+            : t('noNotifications')}
+        </p>
+      </div>
+      
+      {/* Print Footer - Only visible when printing */}
+      <div className="hidden print:block footer-print border-t border-gray-200 text-xs text-gray-500">
+        <div className="flex justify-between">
+          <span>Maintenance ID: {maintenance.id}</span>
+          <span>Printed on {format(new Date(), 'PPP')}</span>
+        </div>
+        <p className="mt-1 text-center">This document is confidential and intended for internal use only.</p>
+      </div>
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/components/CloseButton.tsx b/application/src/components/schedule-incident/maintenance/detail-dialog/components/CloseButton.tsx
new file mode 100644
index 0000000..14df70b
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/components/CloseButton.tsx
@@ -0,0 +1,18 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { Button } from '@/components/ui/button';
+
+interface CloseButtonProps {
+  onClose: () => void;
+}
+
+export const CloseButton: React.FC<CloseButtonProps> = ({ onClose }) => {
+  const { t } = useLanguage();
+  
+  return (
+    <Button variant="secondary" onClick={onClose}>
+      {t('close')}
+    </Button>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/components/DownloadPdfButton.tsx b/application/src/components/schedule-incident/maintenance/detail-dialog/components/DownloadPdfButton.tsx
new file mode 100644
index 0000000..dd2aa57
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/components/DownloadPdfButton.tsx
@@ -0,0 +1,31 @@
+
+import React from 'react';
+import { Button } from '@/components/ui/button';
+import { Download } from 'lucide-react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useDownloadMaintenancePdf } from '../hooks';
+import { MaintenanceItem } from '@/services/maintenance';
+
+interface DownloadPdfButtonProps {
+  maintenance: MaintenanceItem;
+  className?: string;
+}
+
+export const DownloadPdfButton: React.FC<DownloadPdfButtonProps> = ({ 
+  maintenance, 
+  className 
+}) => {
+  const { t } = useLanguage();
+  const { handleDownloadPDF } = useDownloadMaintenancePdf();
+  
+  return (
+    <Button
+      className={`flex items-center gap-2 ${className || ''}`}
+      onClick={() => handleDownloadPDF(maintenance)}
+      variant="outline"
+    >
+      <Download className="h-4 w-4" />
+      {t('downloadPdf')}
+    </Button>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/components/PrintButton.tsx b/application/src/components/schedule-incident/maintenance/detail-dialog/components/PrintButton.tsx
new file mode 100644
index 0000000..4480daf
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/components/PrintButton.tsx
@@ -0,0 +1,27 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { Printer } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { usePrintMaintenance } from '../hooks/usePrintMaintenance';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+
+interface PrintButtonProps {
+  maintenance: MaintenanceItem;
+}
+
+export const PrintButton: React.FC<PrintButtonProps> = ({ maintenance }) => {
+  const { t } = useLanguage();
+  const { handlePrint } = usePrintMaintenance();
+  
+  return (
+    <Button
+      className="flex items-center gap-2"
+      onClick={() => handlePrint(maintenance)}
+      variant="default"
+    >
+      <Printer className="h-4 w-4" />
+      {t('print')}
+    </Button>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/components/index.ts b/application/src/components/schedule-incident/maintenance/detail-dialog/components/index.ts
new file mode 100644
index 0000000..d0f807c
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/components/index.ts
@@ -0,0 +1,4 @@
+
+export * from './DownloadPdfButton';
+export * from './PrintButton';
+export * from './CloseButton';
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/index.ts b/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/index.ts
new file mode 100644
index 0000000..4150016
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/index.ts
@@ -0,0 +1,3 @@
+
+export * from './useDownloadMaintenancePdf';
+export * from './usePrintMaintenance';
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/useDownloadMaintenancePdf.ts b/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/useDownloadMaintenancePdf.ts
new file mode 100644
index 0000000..a605437
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/useDownloadMaintenancePdf.ts
@@ -0,0 +1,47 @@
+
+import { useToast } from '@/hooks/use-toast';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { MaintenanceItem, generateMaintenancePDF } from '@/services/maintenance';
+
+export const useDownloadMaintenancePdf = () => {
+  const { toast } = useToast();
+  const { t } = useLanguage();
+  
+  const handleDownloadPDF = async (maintenance: MaintenanceItem) => {
+    try {
+      // Show loading toast
+      toast({
+        title: t('generating'),
+        description: t('preparingPdf'),
+      });
+      
+      // Generate and download the PDF
+      const filename = await generateMaintenancePDF(maintenance);
+      
+      // Show success toast after successful generation
+      toast({
+        title: t('success'),
+        description: t('pdfDownloaded'),
+      });
+      
+      return filename;
+    } catch (error) {
+      console.error("Error generating PDF:", error);
+      
+      // Provide more detailed error message if available
+      const errorMessage = error instanceof Error 
+        ? error.message 
+        : t('pdfGenerationFailed');
+      
+      toast({
+        title: t('error'),
+        description: errorMessage,
+        variant: 'destructive',
+      });
+      
+      throw error;
+    }
+  };
+  
+  return { handleDownloadPDF };
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/usePrintMaintenance.ts b/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/usePrintMaintenance.ts
new file mode 100644
index 0000000..363308f
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/hooks/usePrintMaintenance.ts
@@ -0,0 +1,173 @@
+
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useToast } from '@/hooks/use-toast';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+
+export const usePrintMaintenance = () => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  
+  const handlePrint = (maintenance: MaintenanceItem) => {
+    try {
+      // Add print-specific stylesheet temporarily
+      const style = document.createElement('style');
+      style.id = 'print-style';
+      style.textContent = `
+        @page {
+          size: A4;
+          margin: 10mm;
+        }
+        @media print {
+          body * {
+            visibility: hidden;
+          }
+          
+          .dialog-content, .dialog-content * {
+            visibility: visible;
+          }
+          
+          .dialog-content {
+            position: absolute !important;
+            left: 0;
+            top: 0;
+            width: 100%;
+            height: auto;
+            padding: 15mm !important;
+            margin: 0 !important;
+            background-color: white !important;
+            box-shadow: none;
+            overflow: visible !important;
+            display: block !important;
+            transform: none !important;
+          }
+          
+          /* Remove any black backgrounds */
+          html, body {
+            background-color: white !important;
+            color: black !important;
+          }
+          
+          /* Optimize spacing for single page */
+          .print-section {
+            margin-bottom: 2mm !important;
+            page-break-inside: avoid !important;
+          }
+          
+          /* Reduce vertical spacing */
+          h4 {
+            margin-bottom: 1mm !important;
+            margin-top: 1mm !important;
+            color: #1e40af !important; /* blue-800 */
+            font-weight: bold !important;
+          }
+          
+          .print-compact-text {
+            font-size: 9pt !important;
+            line-height: 1.2 !important;
+          }
+          
+          .print-compact-spacing > * {
+            margin-top: 1mm !important;
+            margin-bottom: 1mm !important;
+          }
+          
+          .print-grid {
+            display: grid !important;
+            grid-template-columns: 1fr 1fr !important;
+            gap: 1mm !important;
+          }
+          
+          .badge-print {
+            background-color: #dbeafe !important; /* blue-100 */
+            color: #1e40af !important; /* blue-800 */
+            border: 1px solid #93c5fd !important; /* blue-300 */
+            padding: 0.5mm 1mm !important;
+            margin: 0.5mm !important;
+            display: inline-block !important;
+            font-size: 8pt !important;
+          }
+          
+          /* More compact spacing */
+          .print-compact-margin {
+            margin: 1mm 0 !important;
+          }
+          
+          .print-smaller-font {
+            font-size: 8pt !important;
+          }
+          
+          .header-print {
+            background-color: #1e40af !important; /* blue-800 */
+            color: #ffffff !important;
+            padding: 2mm 3mm !important;
+            margin-bottom: 2mm !important;
+          }
+          
+          /* More compact header */
+          .header-print h1 {
+            font-size: 12pt !important;
+            margin-bottom: 0 !important;
+          }
+          
+          .header-print p {
+            font-size: 9pt !important;
+            margin-top: 1mm !important;
+          }
+          
+          /* Footer stays at bottom */
+          .footer-print {
+            font-size: 7pt !important;
+            color: #6b7280 !important; /* gray-500 */
+            border-top: 1px solid #e5e7eb !important; /* gray-200 */
+            position: fixed !important;
+            bottom: 10mm !important;
+            left: 15mm !important;
+            right: 15mm !important;
+            padding-top: 2mm !important;
+            background-color: white !important;
+          }
+          
+          /* Hide any unnecessary elements */
+          .print-hide {
+            display: none !important;
+          }
+          
+          /* Optimize description text */
+          .print-description {
+            max-height: 100px !important;
+            overflow: hidden !important;
+            text-overflow: ellipsis !important;
+          }
+        }
+      `;
+      document.head.appendChild(style);
+
+      // Wait a bit to ensure styles are applied
+      setTimeout(() => {
+        window.print();
+        
+        // Remove the style after printing dialog closes
+        setTimeout(() => {
+          const printStyle = document.getElementById('print-style');
+          if (printStyle) {
+            printStyle.remove();
+          }
+        }, 1000);
+      }, 100);
+
+      toast({
+        title: t('success'),
+        description: t('printJobStarted'),
+      });
+    } catch (error) {
+      console.error("Error printing:", error);
+      toast({
+        title: t('error'),
+        description: t('printingFailed'),
+        variant: 'destructive',
+      });
+    }
+  };
+
+  return { handlePrint };
+};
diff --git a/application/src/components/schedule-incident/maintenance/detail-dialog/index.ts b/application/src/components/schedule-incident/maintenance/detail-dialog/index.ts
new file mode 100644
index 0000000..a559f25
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/detail-dialog/index.ts
@@ -0,0 +1,8 @@
+
+export * from './MaintenanceDetailDialog';
+export * from './MaintenanceDetailContent';
+export * from './MaintenanceDetailHeader';
+export * from './MaintenanceDetailSections';
+export * from './MaintenanceDetailFooter';
+export * from './components';
+export * from './hooks';
diff --git a/application/src/components/schedule-incident/maintenance/edit-dialog/EditMaintenanceDialog.tsx b/application/src/components/schedule-incident/maintenance/edit-dialog/EditMaintenanceDialog.tsx
new file mode 100644
index 0000000..d51184e
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/edit-dialog/EditMaintenanceDialog.tsx
@@ -0,0 +1,97 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { 
+  Dialog, 
+  DialogContent, 
+  DialogHeader, 
+  DialogTitle, 
+  DialogDescription,
+  DialogFooter
+} from '@/components/ui/dialog';
+import { Form } from '@/components/ui/form';
+import { Button } from '@/components/ui/button';
+import { MaintenanceItem } from '@/services/types/maintenance.types';
+import { useMaintenanceEditForm } from '../hooks/useMaintenanceEditForm';
+import {
+  MaintenanceBasicFields,
+  MaintenanceTimeFields,
+  MaintenanceAffectedFields,
+  MaintenanceConfigFields,
+  MaintenanceNotificationSettingsField
+} from '../form';
+
+interface EditMaintenanceDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  maintenance: MaintenanceItem;
+  onMaintenanceUpdated: () => void;
+}
+
+export const EditMaintenanceDialog = ({ 
+  open, 
+  onOpenChange,
+  maintenance,
+  onMaintenanceUpdated
+}: EditMaintenanceDialogProps) => {
+  const { t } = useLanguage();
+  
+  const handleSuccess = () => {
+    console.log("EditMaintenanceDialog: maintenance updated successfully");
+    onMaintenanceUpdated();
+  };
+  
+  const handleClose = () => {
+    console.log("EditMaintenanceDialog: closing dialog");
+    onOpenChange(false);
+  };
+  
+  const { form, onSubmit } = useMaintenanceEditForm(maintenance, handleSuccess, handleClose);
+
+  // Log the form state for debugging
+  React.useEffect(() => {
+    const subscription = form.watch((value) => {
+      console.log("Form values in edit dialog:", value);
+    });
+    return () => subscription.unsubscribe();
+  }, [form]);
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[600px] max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>{t('editMaintenanceWindow')}</DialogTitle>
+          <DialogDescription>
+            {t('editMaintenanceDesc')}
+          </DialogDescription>
+        </DialogHeader>
+        
+        <Form {...form}>
+          <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
+            <MaintenanceBasicFields />
+            <MaintenanceTimeFields />
+            <MaintenanceAffectedFields />
+            <MaintenanceConfigFields />
+            <MaintenanceNotificationSettingsField />
+            
+            <DialogFooter className="pt-4">
+              <Button 
+                type="button" 
+                variant="outline" 
+                onClick={() => onOpenChange(false)}
+              >
+                {t('cancel')}
+              </Button>
+              <Button 
+                type="submit"
+                disabled={form.formState.isSubmitting}
+              >
+                {form.formState.isSubmitting ? t('updating') : t('updateMaintenance')}
+              </Button>
+            </DialogFooter>
+          </form>
+        </Form>
+      </DialogContent>
+    </Dialog>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/edit-dialog/index.ts b/application/src/components/schedule-incident/maintenance/edit-dialog/index.ts
new file mode 100644
index 0000000..e4f699c
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/edit-dialog/index.ts
@@ -0,0 +1,2 @@
+
+export * from './EditMaintenanceDialog';
diff --git a/application/src/components/schedule-incident/maintenance/form/MaintenanceAffectedFields.tsx b/application/src/components/schedule-incident/maintenance/form/MaintenanceAffectedFields.tsx
new file mode 100644
index 0000000..2f933dd
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/MaintenanceAffectedFields.tsx
@@ -0,0 +1,35 @@
+
+import React from 'react';
+import { useFormContext } from 'react-hook-form';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { MaintenanceFormValues } from '../hooks/useMaintenanceForm';
+import {
+  FormField,
+  FormItem,
+  FormLabel,
+  FormControl,
+  FormMessage,
+} from '@/components/ui/form';
+import { Input } from '@/components/ui/input';
+
+export const MaintenanceAffectedFields: React.FC = () => {
+  const { t } = useLanguage();
+  const { control } = useFormContext<MaintenanceFormValues>();
+
+  return (
+    <FormField
+      control={control}
+      name="affected"
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>{t('affectedServices')}</FormLabel>
+          <FormControl>
+            <Input placeholder={t('enterAffectedServices')} {...field} />
+          </FormControl>
+          <FormMessage />
+          <p className="text-sm text-muted-foreground">{t('separateServicesWithComma')}</p>
+        </FormItem>
+      )}
+    />
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/MaintenanceBasicFields.tsx b/application/src/components/schedule-incident/maintenance/form/MaintenanceBasicFields.tsx
new file mode 100644
index 0000000..0ec8a9f
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/MaintenanceBasicFields.tsx
@@ -0,0 +1,55 @@
+
+import React from 'react';
+import { useFormContext } from 'react-hook-form';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { MaintenanceFormValues } from '../hooks/useMaintenanceForm';
+import {
+  FormField,
+  FormItem,
+  FormLabel,
+  FormControl,
+  FormMessage,
+} from '@/components/ui/form';
+import { Input } from '@/components/ui/input';
+import { Textarea } from '@/components/ui/textarea';
+
+export const MaintenanceBasicFields: React.FC = () => {
+  const { t } = useLanguage();
+  const { control } = useFormContext<MaintenanceFormValues>();
+
+  return (
+    <>
+      <FormField
+        control={control}
+        name="title"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('title')}</FormLabel>
+            <FormControl>
+              <Input placeholder={t('enterTitle')} {...field} />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={control}
+        name="description"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t('description')}</FormLabel>
+            <FormControl>
+              <Textarea
+                placeholder={t('enterDescription')}
+                className="resize-none"
+                {...field}
+              />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+    </>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/MaintenanceConfigFields.tsx b/application/src/components/schedule-incident/maintenance/form/MaintenanceConfigFields.tsx
new file mode 100644
index 0000000..3d581a2
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/MaintenanceConfigFields.tsx
@@ -0,0 +1,32 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { 
+  PriorityField,
+  StatusField,
+  ImpactLevelField,
+  AssignedUsersField
+} from './config';
+
+export const MaintenanceConfigFields = () => {
+  const { t } = useLanguage();
+  
+  return (
+    <div className="space-y-6">
+      <div className="text-sm font-medium">{t('configurationSettings')}</div>
+      
+      <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
+        <PriorityField />
+        <StatusField />
+      </div>
+
+      <div className="grid grid-cols-1 gap-4">
+        <ImpactLevelField />
+      </div>
+      
+      <div className="grid grid-cols-1 gap-6 mt-4">
+        <AssignedUsersField />
+      </div>
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/MaintenanceNotificationSettingsField.tsx b/application/src/components/schedule-incident/maintenance/form/MaintenanceNotificationSettingsField.tsx
new file mode 100644
index 0000000..9ec629a
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/MaintenanceNotificationSettingsField.tsx
@@ -0,0 +1,170 @@
+
+import React, { useEffect, useState } from 'react';
+import { useFormContext } from 'react-hook-form';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { alertConfigService, AlertConfiguration } from '@/services/alertConfigService';
+import { MaintenanceFormValues } from '../hooks/useMaintenanceForm';
+import { FormField, FormItem, FormLabel, FormControl, FormDescription } from '@/components/ui/form';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Switch } from '@/components/ui/switch';
+import { useToast } from '@/hooks/use-toast';
+import { Skeleton } from '@/components/ui/skeleton';
+import { Bell, BellOff } from 'lucide-react';
+
+export const MaintenanceNotificationSettingsField = () => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [notificationChannels, setNotificationChannels] = useState<AlertConfiguration[]>([]);
+  const [isLoading, setIsLoading] = useState(true);
+  const { control, watch, setValue, getValues } = useFormContext<MaintenanceFormValues>();
+  
+  // Watch the notification toggle state
+  const notifySubscribers = watch('notify_subscribers');
+  const notificationChannelId = watch('notification_channel_id');
+  
+  useEffect(() => {
+    const fetchNotificationChannels = async () => {
+      try {
+        setIsLoading(true);
+        const channels = await alertConfigService.getAlertConfigurations();
+       // console.log("Fetched notification channels for form:", channels);
+        
+        // Only show enabled channels
+        const enabledChannels = channels.filter(channel => channel.enabled);
+        setNotificationChannels(enabledChannels);
+        
+        // If we have notification channels and notification is enabled but no channel is selected,
+        // select the first one by default
+        const currentChannel = getValues('notification_channel_id');
+        const shouldNotify = getValues('notify_subscribers');
+        
+      //  console.log("Current notification values:", {
+      //    currentChannel,
+       //   shouldNotify,
+       //   availableChannels: enabledChannels.length
+       // });
+        
+        if (shouldNotify && (!currentChannel || currentChannel === 'none') && enabledChannels.length > 0) {
+        //  console.log("Setting default notification channel:", enabledChannels[0].id);
+          setValue('notification_channel_id', enabledChannels[0].id);
+        }
+      } catch (error) {
+       // console.error('Error fetching notification channels:', error);
+        toast({
+          title: t('error'),
+          description: t('errorFetchingNotificationChannels'),
+          variant: 'destructive',
+        });
+      } finally {
+        setIsLoading(false);
+      }
+    };
+    
+    fetchNotificationChannels();
+  }, [t, toast, setValue, getValues]);
+  
+  // Log value changes for debugging
+ // useEffect(() => {
+   // console.log("Current notification settings:", {
+  //    channel_id: getValues('notification_channel_id'),
+  //    notify: notifySubscribers
+  //  });
+ // }, [notifySubscribers, notificationChannelId, getValues]);
+  
+  return (
+    <div className="space-y-6">
+      <h3 className="font-medium text-lg">{t('notificationSettings')}</h3>
+      
+      <FormField
+        control={control}
+        name="notify_subscribers"
+        render={({ field }) => (
+          <FormItem className="flex flex-row items-center justify-between rounded-lg border p-4">
+            <div className="space-y-0.5">
+              <div className="flex items-center gap-2">
+                {field.value ? <Bell className="w-4 h-4" /> : <BellOff className="w-4 h-4" />}
+                <FormLabel className="text-base mb-0">
+                  {field.value ? t('notifySubscribers') : t('mutedNotifications')}
+                </FormLabel>
+              </div>
+              <FormDescription>
+                {field.value 
+                  ? t('notifySubscribersDesc') 
+                  : t('notificationsAreMuted')}
+              </FormDescription>
+            </div>
+            <FormControl>
+              <Switch
+                checked={field.value}
+                onCheckedChange={(checked) => {
+                  field.onChange(checked);
+                 // console.log("Notification toggle changed to:", checked);
+                  // If notifications are disabled, also clear the notification channel
+                  if (!checked) {
+                    setValue('notification_channel_id', '');
+                  } else if (notificationChannels.length > 0) {
+                    // If enabled and channels available, select the first one by default
+                    setValue('notification_channel_id', notificationChannels[0].id);
+                  }
+                }}
+              />
+            </FormControl>
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={control}
+        name="notification_channel_id"
+        render={({ field }) => {
+          // Make sure to handle both empty string and "none" as special cases
+          const displayValue = field.value || "";
+          
+        //  console.log("Rendering notification channel field with value:", {
+        //    fieldValue: field.value, 
+        //    displayValue
+       //   });
+          
+          return (
+            <FormItem>
+              <FormLabel>{t('notificationChannel')}</FormLabel>
+              <FormControl>
+                {isLoading ? (
+                  <Skeleton className="h-10 w-full" />
+                ) : (
+                  <Select 
+                    value={displayValue} 
+                    onValueChange={(value) => {
+                    //  console.log("Setting notification channel to:", value);
+                      field.onChange(value === "none" ? "" : value);
+                    }}
+                    disabled={!notifySubscribers}
+                  >
+                    <SelectTrigger className={!notifySubscribers ? 'opacity-50' : ''}>
+                      <SelectValue placeholder={t('selectNotificationChannel')} />
+                    </SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="none">
+                        {t('none')}
+                      </SelectItem>
+                      {notificationChannels.map((channel) => (
+                        <SelectItem key={channel.id} value={channel.id}>
+                          {channel.notify_name} ({channel.notification_type})
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                )}
+              </FormControl>
+              <FormDescription>
+                {notifySubscribers
+                  ? t('selectChannelForNotifications')
+                  : t('enableNotificationsFirst')}
+              </FormDescription>
+            </FormItem>
+          );
+        }}
+      />
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/MaintenanceTimeFields.tsx b/application/src/components/schedule-incident/maintenance/form/MaintenanceTimeFields.tsx
new file mode 100644
index 0000000..dde680b
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/MaintenanceTimeFields.tsx
@@ -0,0 +1,195 @@
+
+import React from 'react';
+import { useFormContext } from 'react-hook-form';
+import { format } from 'date-fns';
+import { CalendarIcon } from 'lucide-react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { MaintenanceFormValues } from '../hooks/useMaintenanceForm';
+import { cn } from '@/lib/utils';
+import {
+  FormField,
+  FormItem,
+  FormLabel,
+  FormControl,
+  FormMessage,
+} from '@/components/ui/form';
+import { Button } from '@/components/ui/button';
+import { Calendar } from '@/components/ui/calendar';
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from '@/components/ui/popover';
+import { Input } from '@/components/ui/input';
+
+export const MaintenanceTimeFields: React.FC = () => {
+  const { t } = useLanguage();
+  const { control } = useFormContext<MaintenanceFormValues>();
+
+  // Helper function to safely format dates
+  const safeFormat = (date: Date | null | undefined, formatStr: string): string => {
+    if (!date || !(date instanceof Date) || isNaN(date.getTime())) {
+      return '';
+    }
+    return format(date, formatStr);
+  };
+
+  return (
+    <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+      <FormField
+        control={control}
+        name="start_time"
+        render={({ field }) => (
+          <FormItem className="flex flex-col">
+            <FormLabel>{t('startTime')}</FormLabel>
+            <Popover>
+              <PopoverTrigger asChild>
+                <FormControl>
+                  <Button
+                    variant="outline"
+                    className={cn(
+                      "w-full pl-3 text-left font-normal",
+                      !field.value && "text-muted-foreground"
+                    )}
+                  >
+                    {field.value && field.value instanceof Date && !isNaN(field.value.getTime()) ? (
+                      safeFormat(field.value, "PPP HH:mm")
+                    ) : (
+                      <span>{t('selectDate')}</span>
+                    )}
+                    <CalendarIcon className="ml-auto h-4 w-4 opacity-50" />
+                  </Button>
+                </FormControl>
+              </PopoverTrigger>
+              <PopoverContent className="w-auto p-0" align="start">
+                <Calendar
+                  mode="single"
+                  selected={field.value instanceof Date && !isNaN(field.value.getTime()) ? field.value : undefined}
+                  onSelect={(date) => {
+                    if (date) {
+                      // If existing value is a valid date, preserve the time part
+                      if (field.value instanceof Date && !isNaN(field.value.getTime())) {
+                        const newDate = new Date(date);
+                        newDate.setHours(field.value.getHours(), field.value.getMinutes());
+                        field.onChange(newDate);
+                      } else {
+                        // Set default time to current time if no valid time exists
+                        const now = new Date();
+                        date.setHours(now.getHours(), now.getMinutes());
+                        field.onChange(date);
+                      }
+                    } else {
+                      field.onChange(undefined);
+                    }
+                  }}
+                  initialFocus
+                  className={cn("p-3 pointer-events-auto")}
+                />
+                <div className="p-3 border-t border-border">
+                  <Input
+                    type="time"
+                    onChange={(e) => {
+                      const timeValue = e.target.value;
+                      if (!timeValue) return;
+                      
+                      const [hours, minutes] = timeValue.split(':').map(Number);
+                      const date = new Date(field.value || new Date());
+                      
+                      // Ensure we have a valid date before setting hours/minutes
+                      if (!isNaN(date.getTime())) {
+                        date.setHours(hours, minutes);
+                        field.onChange(date);
+                      }
+                    }}
+                    value={field.value instanceof Date && !isNaN(field.value.getTime()) 
+                      ? safeFormat(field.value, "HH:mm") 
+                      : ""}
+                  />
+                </div>
+              </PopoverContent>
+            </Popover>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={control}
+        name="end_time"
+        render={({ field }) => (
+          <FormItem className="flex flex-col">
+            <FormLabel>{t('endTime')}</FormLabel>
+            <Popover>
+              <PopoverTrigger asChild>
+                <FormControl>
+                  <Button
+                    variant="outline"
+                    className={cn(
+                      "w-full pl-3 text-left font-normal",
+                      !field.value && "text-muted-foreground"
+                    )}
+                  >
+                    {field.value && field.value instanceof Date && !isNaN(field.value.getTime()) ? (
+                      safeFormat(field.value, "PPP HH:mm")
+                    ) : (
+                      <span>{t('selectDate')}</span>
+                    )}
+                    <CalendarIcon className="ml-auto h-4 w-4 opacity-50" />
+                  </Button>
+                </FormControl>
+              </PopoverTrigger>
+              <PopoverContent className="w-auto p-0" align="start">
+                <Calendar
+                  mode="single"
+                  selected={field.value instanceof Date && !isNaN(field.value.getTime()) ? field.value : undefined}
+                  onSelect={(date) => {
+                    if (date) {
+                      // If existing value is a valid date, preserve the time part
+                      if (field.value instanceof Date && !isNaN(field.value.getTime())) {
+                        const newDate = new Date(date);
+                        newDate.setHours(field.value.getHours(), field.value.getMinutes());
+                        field.onChange(newDate);
+                      } else {
+                        // Set default time to current time if no valid time exists
+                        const now = new Date();
+                        // Default to current time + 1 hour for end time
+                        date.setHours(now.getHours() + 1, now.getMinutes());
+                        field.onChange(date);
+                      }
+                    } else {
+                      field.onChange(undefined);
+                    }
+                  }}
+                  initialFocus
+                  className={cn("p-3 pointer-events-auto")}
+                />
+                <div className="p-3 border-t border-border">
+                  <Input
+                    type="time"
+                    onChange={(e) => {
+                      const timeValue = e.target.value;
+                      if (!timeValue) return;
+                      
+                      const [hours, minutes] = timeValue.split(':').map(Number);
+                      const date = new Date(field.value || new Date());
+                      
+                      // Ensure we have a valid date before setting hours/minutes
+                      if (!isNaN(date.getTime())) {
+                        date.setHours(hours, minutes);
+                        field.onChange(date);
+                      }
+                    }}
+                    value={field.value instanceof Date && !isNaN(field.value.getTime()) 
+                      ? safeFormat(field.value, "HH:mm")
+                      : ""}
+                  />
+                </div>
+              </PopoverContent>
+            </Popover>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+    </div>
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/config/AssignedUsersField.tsx b/application/src/components/schedule-incident/maintenance/form/config/AssignedUsersField.tsx
new file mode 100644
index 0000000..8e2f42e
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/config/AssignedUsersField.tsx
@@ -0,0 +1,185 @@
+
+import React, { useEffect } from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useFormContext } from 'react-hook-form';
+import { 
+  FormField, 
+  FormItem, 
+  FormLabel, 
+  FormControl, 
+  FormMessage,
+  FormDescription 
+} from '@/components/ui/form';
+import { 
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { useQuery } from '@tanstack/react-query';
+import { userService } from '@/services/userService';
+import { Badge } from '@/components/ui/badge';
+import { X, Users } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar';
+
+export const AssignedUsersField = () => {
+  const { t } = useLanguage();
+  const form = useFormContext();
+
+  // Ensure assigned_users is initialized as an array
+  useEffect(() => {
+    const currentValue = form.getValues('assigned_users');
+   // console.log("Initial assigned_users value:", currentValue);
+    
+    // Initialize as empty array if no value or invalid value
+    if (!currentValue || !Array.isArray(currentValue)) {
+    //  console.log("Initializing assigned_users as empty array");
+      form.setValue('assigned_users', [], { shouldValidate: false, shouldDirty: true });
+    }
+  }, [form]);
+
+  //console.log("Current form values:", form.getValues());
+  //console.log("Current assigned_users:", form.getValues('assigned_users'));
+
+  // Fetch users for the assignment dropdown
+  const { data: users = [], isLoading } = useQuery({
+    queryKey: ['users'],
+    queryFn: async () => {
+      try {
+        const usersList = await userService.getUsers();
+      //  console.log("Fetched users for assignment:", usersList);
+        return Array.isArray(usersList) ? usersList : [];
+      } catch (error) {
+      //  console.error("Failed to fetch users:", error);
+        return [];
+      }
+    },
+    staleTime: 300000 // Cache for 5 minutes to reduce API calls
+  });
+
+  // Get the currently selected assigned users from the form
+  const selectedUserIds = Array.isArray(form.watch('assigned_users')) 
+    ? form.watch('assigned_users') 
+    : [];
+  
+ // console.log("Selected user IDs:", selectedUserIds);
+
+  // Function to add a user
+  const addUser = (userId: string) => {
+    const currentValues = Array.isArray(form.getValues('assigned_users')) 
+      ? [...form.getValues('assigned_users')] 
+      : [];
+      
+    if (!currentValues.includes(userId)) {
+   //   console.log("Adding user:", userId);
+      form.setValue('assigned_users', [...currentValues, userId], { shouldValidate: true, shouldDirty: true });
+    }
+  };
+
+  // Function to remove a user
+  const removeUser = (userId: string) => {
+    const currentValues = Array.isArray(form.getValues('assigned_users')) 
+      ? [...form.getValues('assigned_users')] 
+      : [];
+      
+  //  console.log("Removing user:", userId);
+    form.setValue(
+      'assigned_users', 
+      currentValues.filter(id => id !== userId), 
+      { shouldValidate: true, shouldDirty: true }
+    );
+  };
+
+  // Get selected users data
+  const selectedUsers = users.filter(user => selectedUserIds.includes(user.id));
+ // console.log("Matched selected users:", selectedUsers);
+  
+  // Function to get user initials from name
+  const getUserInitials = (user: any): string => {
+    if (user.full_name) {
+      const nameParts = user.full_name.split(' ');
+      if (nameParts.length > 1) {
+        return `${nameParts[0][0]}${nameParts[1][0]}`.toUpperCase();
+      }
+      return user.full_name.substring(0, 2).toUpperCase();
+    }
+    return user.username.substring(0, 2).toUpperCase();
+  };
+  
+  return (
+    <FormField
+      control={form.control}
+      name="assigned_users"
+      render={({ field }) => (
+        <FormItem className="flex flex-col">
+          <FormLabel className="flex items-center gap-1">
+            <Users className="h-4 w-4" /> {t('assignedPersonnel')}
+          </FormLabel>
+          <div className="space-y-3">
+            <Select onValueChange={addUser}>
+              <FormControl>
+                <SelectTrigger className="w-full">
+                  <SelectValue placeholder={t('selectAssignedUsers')} />
+                </SelectTrigger>
+              </FormControl>
+              <SelectContent>
+                {isLoading ? (
+                  <div className="py-2 px-2 text-sm">{t('loading')}</div>
+                ) : users.length === 0 ? (
+                  <div className="py-2 px-2 text-sm">{t('noUsersFound')}</div>
+                ) : (
+                  users.map((user) => (
+                    <SelectItem 
+                      key={user.id} 
+                      value={user.id}
+                      disabled={selectedUserIds.includes(user.id)}
+                    >
+                      {user.full_name || user.username}
+                    </SelectItem>
+                  ))
+                )}
+              </SelectContent>
+            </Select>
+
+            {selectedUsers.length > 0 ? (
+              <div className="flex flex-wrap gap-2 mt-2 border p-2 rounded-md bg-muted/50">
+                {selectedUsers.map((user) => (
+                  <Badge key={user.id} variant="secondary" className="flex items-center gap-1 py-1 px-2">
+                    <Avatar className="h-5 w-5 mr-1">
+                      <AvatarImage src={user.avatar} alt={user.full_name || user.username} />
+                      <AvatarFallback className="text-[10px]">
+                        {getUserInitials(user)}
+                      </AvatarFallback>
+                    </Avatar>
+                    <span>{user.full_name || user.username}</span>
+                    <Button 
+                      variant="ghost" 
+                      size="icon" 
+                      className="h-4 w-4 p-0 ml-1 hover:bg-transparent hover:opacity-70"
+                      onClick={() => removeUser(user.id)}
+                      type="button"
+                    >
+                      <X className="h-3 w-3" />
+                      <span className="sr-only">{t('remove')}</span>
+                    </Button>
+                  </Badge>
+                ))}
+              </div>
+            ) : (
+              <div className="text-sm text-muted-foreground italic p-2">
+                {t('noAssignedUsers')}
+              </div>
+            )}
+          </div>
+
+          <FormDescription>
+            {t('assignedPersonnelDescription')}
+          </FormDescription>
+          <FormMessage />
+        </FormItem>
+      )}
+    />
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/config/ImpactLevelField.tsx b/application/src/components/schedule-incident/maintenance/form/config/ImpactLevelField.tsx
new file mode 100644
index 0000000..16f6ae5
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/config/ImpactLevelField.tsx
@@ -0,0 +1,56 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useFormContext } from 'react-hook-form';
+import { 
+  FormField, 
+  FormItem, 
+  FormLabel, 
+  FormControl, 
+  FormMessage,
+  FormDescription 
+} from '@/components/ui/form';
+import { 
+  Select, 
+  SelectContent, 
+  SelectItem, 
+  SelectTrigger, 
+  SelectValue 
+} from '@/components/ui/select';
+
+export const ImpactLevelField = () => {
+  const { t } = useLanguage();
+  const form = useFormContext();
+  
+  return (
+    <FormField
+      control={form.control}
+      name="field"
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>{t('impactLevel')}</FormLabel>
+          <Select 
+            onValueChange={field.onChange} 
+            defaultValue={field.value}
+          >
+            <FormControl>
+              <SelectTrigger>
+                <SelectValue placeholder={t('selectImpactLevel')} />
+              </SelectTrigger>
+            </FormControl>
+            <SelectContent>
+              <SelectItem value="none">{t('none')}</SelectItem>
+              <SelectItem value="minor">{t('minor')}</SelectItem>
+              <SelectItem value="major">{t('major')}</SelectItem>
+              <SelectItem value="critical">{t('critical')}</SelectItem>
+            </SelectContent>
+          </Select>
+          <FormDescription>
+            {t('impactLevelDescription')}
+          </FormDescription>
+          <FormMessage />
+        </FormItem>
+      )}
+    />
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/config/PriorityField.tsx b/application/src/components/schedule-incident/maintenance/form/config/PriorityField.tsx
new file mode 100644
index 0000000..4b64dd0
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/config/PriorityField.tsx
@@ -0,0 +1,56 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useFormContext } from 'react-hook-form';
+import { 
+  FormField, 
+  FormItem, 
+  FormLabel, 
+  FormControl, 
+  FormMessage,
+  FormDescription 
+} from '@/components/ui/form';
+import { 
+  Select, 
+  SelectContent, 
+  SelectItem, 
+  SelectTrigger, 
+  SelectValue 
+} from '@/components/ui/select';
+
+export const PriorityField = () => {
+  const { t } = useLanguage();
+  const form = useFormContext();
+  
+  return (
+    <FormField
+      control={form.control}
+      name="priority"
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>{t('priority')}</FormLabel>
+          <Select 
+            onValueChange={field.onChange} 
+            defaultValue={field.value}
+          >
+            <FormControl>
+              <SelectTrigger>
+                <SelectValue placeholder={t('selectPriority')} />
+              </SelectTrigger>
+            </FormControl>
+            <SelectContent>
+              <SelectItem value="low">{t('low')}</SelectItem>
+              <SelectItem value="medium">{t('medium')}</SelectItem>
+              <SelectItem value="high">{t('high')}</SelectItem>
+              <SelectItem value="critical">{t('critical')}</SelectItem>
+            </SelectContent>
+          </Select>
+          <FormDescription>
+            {t('priorityDescription')}
+          </FormDescription>
+          <FormMessage />
+        </FormItem>
+      )}
+    />
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/config/StatusField.tsx b/application/src/components/schedule-incident/maintenance/form/config/StatusField.tsx
new file mode 100644
index 0000000..4b65785
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/config/StatusField.tsx
@@ -0,0 +1,56 @@
+
+import React from 'react';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useFormContext } from 'react-hook-form';
+import { 
+  FormField, 
+  FormItem, 
+  FormLabel, 
+  FormControl, 
+  FormMessage,
+  FormDescription 
+} from '@/components/ui/form';
+import { 
+  Select, 
+  SelectContent, 
+  SelectItem, 
+  SelectTrigger, 
+  SelectValue 
+} from '@/components/ui/select';
+
+export const StatusField = () => {
+  const { t } = useLanguage();
+  const form = useFormContext();
+  
+  return (
+    <FormField
+      control={form.control}
+      name="status"
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>{t('status')}</FormLabel>
+          <Select 
+            onValueChange={field.onChange} 
+            defaultValue={field.value}
+          >
+            <FormControl>
+              <SelectTrigger>
+                <SelectValue placeholder={t('selectStatus')} />
+              </SelectTrigger>
+            </FormControl>
+            <SelectContent>
+              <SelectItem value="scheduled">{t('scheduled')}</SelectItem>
+              <SelectItem value="in_progress">{t('inProgress')}</SelectItem>
+              <SelectItem value="completed">{t('completed')}</SelectItem>
+              <SelectItem value="cancelled">{t('cancelled')}</SelectItem>
+            </SelectContent>
+          </Select>
+          <FormDescription>
+            {t('statusDescription')}
+          </FormDescription>
+          <FormMessage />
+        </FormItem>
+      )}
+    />
+  );
+};
diff --git a/application/src/components/schedule-incident/maintenance/form/config/index.ts b/application/src/components/schedule-incident/maintenance/form/config/index.ts
new file mode 100644
index 0000000..527ba25
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/config/index.ts
@@ -0,0 +1,5 @@
+
+export * from './PriorityField';
+export * from './StatusField';
+export * from './ImpactLevelField';
+export * from './AssignedUsersField';
diff --git a/application/src/components/schedule-incident/maintenance/form/index.ts b/application/src/components/schedule-incident/maintenance/form/index.ts
new file mode 100644
index 0000000..8d57b58
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/form/index.ts
@@ -0,0 +1,7 @@
+
+export * from './MaintenanceBasicFields';
+export * from './MaintenanceTimeFields';
+export * from './MaintenanceAffectedFields';
+export * from './MaintenanceConfigFields';
+export * from './MaintenanceNotificationSettingsField';
+export * from './config';
diff --git a/application/src/components/schedule-incident/maintenance/hooks/useMaintenanceEditForm.ts b/application/src/components/schedule-incident/maintenance/hooks/useMaintenanceEditForm.ts
new file mode 100644
index 0000000..3f42faa
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/hooks/useMaintenanceEditForm.ts
@@ -0,0 +1,201 @@
+
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useToast } from '@/hooks/use-toast';
+import { maintenanceService, MaintenanceItem } from '@/services/maintenance';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { maintenanceFormSchema, MaintenanceFormValues } from './useMaintenanceForm';
+
+export const useMaintenanceEditForm = (
+  maintenance: MaintenanceItem,
+  onSuccess: () => void,
+  onClose: () => void
+) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+
+  // Parse assigned_users to ensure it's an array
+  const getAssignedUsers = (): string[] => {
+    console.log("Original assigned_users:", maintenance.assigned_users);
+    
+    if (!maintenance.assigned_users) {
+      console.log("No assigned users, returning empty array");
+      return [];
+    }
+    
+    if (Array.isArray(maintenance.assigned_users)) {
+      console.log("Assigned users is already an array:", maintenance.assigned_users);
+      return maintenance.assigned_users;
+    }
+    
+    if (typeof maintenance.assigned_users === 'string') {
+      // Try to parse as JSON first (for array stored as string)
+      try {
+        const parsedData = JSON.parse(maintenance.assigned_users);
+        if (Array.isArray(parsedData)) {
+          console.log("Parsed assigned_users from JSON string:", parsedData);
+          return parsedData;
+        } else if (typeof parsedData === 'string') {
+          // Handle nested JSON strings
+          try {
+            const nestedData = JSON.parse(parsedData);
+            if (Array.isArray(nestedData)) {
+              console.log("Parsed assigned_users from nested JSON string:", nestedData);
+              return nestedData;
+            }
+          } catch (e) {
+            // Not a nested JSON string, continue
+          }
+          
+          // Single ID in a JSON string
+          console.log("Using parsed string as single ID:", [parsedData]);
+          return [parsedData];
+        } else {
+          // Some other type, convert to string and use as single ID
+          return [String(parsedData)];
+        }
+      } catch (e) {
+        // Not JSON, try comma splitting
+        if (maintenance.assigned_users.includes(',')) {
+          const userArray = maintenance.assigned_users.split(',').map(id => id.trim()).filter(Boolean);
+          console.log("Converted comma-separated string to array:", userArray);
+          return userArray;
+        } else {
+          // Single ID as string
+          console.log("Using string as single ID:", [maintenance.assigned_users]);
+          return [maintenance.assigned_users];
+        }
+      }
+    }
+    
+    console.warn("Unable to parse assigned_users, returning empty array");
+    return [];
+  };
+
+  // Clean up user IDs by removing quotes, brackets, etc.
+  const cleanUserIds = (userIds: string[]): string[] => {
+    return userIds.map(id => {
+      // Remove surrounding quotes if present
+      let cleanId = id.replace(/^["']|["']$/g, '');
+      // Remove any remaining JSON artifacts
+      cleanId = cleanId.replace(/[\[\]"'\\]/g, '');
+      return cleanId;
+    }).filter(Boolean);
+  };
+
+  // Get notification channel ID (from either notification_channel_id or notification_id)
+  const getNotificationChannelId = (): string => {
+    console.log("Getting notification channel ID from:", {
+      notification_channel_id: maintenance.notification_channel_id,
+      notification_id: maintenance.notification_id,
+      notify_subscribers: maintenance.notify_subscribers
+    });
+    
+    // Try notification_channel_id first
+    if (maintenance.notification_channel_id) {
+      console.log("Using notification_channel_id:", maintenance.notification_channel_id);
+      return maintenance.notification_channel_id;
+    } 
+    // Fall back to notification_id if notifications are enabled
+    else if (maintenance.notification_id && maintenance.notify_subscribers === 'yes') {
+      console.log("Using notification_id:", maintenance.notification_id);
+      return maintenance.notification_id;
+    }
+    
+    console.log("No notification channel ID found");
+    return '';
+  };
+
+  // Initialize form with existing maintenance data
+  const form = useForm<MaintenanceFormValues>({
+    resolver: zodResolver(maintenanceFormSchema),
+    defaultValues: {
+      title: maintenance.title || '',
+      description: maintenance.description || '',
+      start_time: maintenance.start_time ? new Date(maintenance.start_time) : new Date(),
+      end_time: maintenance.end_time ? new Date(maintenance.end_time) : new Date(),
+      affected: maintenance.affected || '',
+      priority: (maintenance.priority?.toLowerCase() || 'medium') as any,
+      status: (maintenance.status?.toLowerCase() || 'scheduled') as any,
+      field: (maintenance.field?.toLowerCase() || 'minor') as any,
+      assigned_users: cleanUserIds(getAssignedUsers()),
+      notify_subscribers: maintenance.notify_subscribers === 'yes',
+      notification_channel_id: getNotificationChannelId(),
+    },
+  });
+
+  const onSubmit = async (data: MaintenanceFormValues) => {
+    try {
+      console.log("Form data before submission:", data);
+      console.log("Assigned users to be submitted:", data.assigned_users);
+      console.log("Notification channel to be submitted:", data.notification_channel_id);
+      
+      // Verify dates are valid
+      if (!data.start_time || isNaN(data.start_time.getTime())) {
+        throw new Error("Invalid start time");
+      }
+      
+      if (!data.end_time || isNaN(data.end_time.getTime())) {
+        throw new Error("Invalid end time");
+      }
+      
+      // Format the update payload
+      const updateData = {
+        title: data.title,
+        description: data.description,
+        start_time: data.start_time.toISOString(),
+        end_time: data.end_time.toISOString(),
+        affected: data.affected,
+        priority: data.priority,
+        status: data.status,
+        field: data.field,
+        assigned_users: data.assigned_users || [], // Send as array
+        notify_subscribers: data.notify_subscribers ? 'yes' : 'no',
+        notification_channel_id: data.notify_subscribers && data.notification_channel_id && data.notification_channel_id !== 'none' 
+          ? data.notification_channel_id 
+          : '',
+        // Set notification_id to match notification_channel_id when notifications are enabled
+        notification_id: data.notify_subscribers && data.notification_channel_id && data.notification_channel_id !== 'none'
+          ? data.notification_channel_id
+          : '',
+      };
+      
+      console.log("Updating maintenance with data:", updateData);
+      console.log("Assigned users being sent for update:", updateData.assigned_users);
+      console.log("Notification channel being sent for update:", updateData.notification_channel_id);
+      console.log("Notification ID being sent for update:", updateData.notification_id);
+
+      // Update the maintenance record using our service function
+      await maintenanceService.updateMaintenance(maintenance.id, updateData);
+      
+      toast({
+        title: t('maintenanceUpdated'),
+        description: t('maintenanceUpdatedDesc'),
+      });
+      
+      onClose();
+      onSuccess();
+    } catch (error) {
+      console.error('Error updating maintenance:', error);
+      
+      if (error instanceof Error) {
+        toast({
+          title: t('error'),
+          description: `${t('errorUpdatingMaintenance')}: ${error.message}`,
+          variant: 'destructive',
+        });
+      } else {
+        toast({
+          title: t('error'),
+          description: t('errorUpdatingMaintenance'),
+          variant: 'destructive',
+        });
+      }
+    }
+  };
+
+  return {
+    form,
+    onSubmit,
+  };
+};
diff --git a/application/src/components/schedule-incident/maintenance/hooks/useMaintenanceForm.ts b/application/src/components/schedule-incident/maintenance/hooks/useMaintenanceForm.ts
new file mode 100644
index 0000000..d72b148
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/hooks/useMaintenanceForm.ts
@@ -0,0 +1,133 @@
+
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { z } from 'zod';
+import { useToast } from '@/hooks/use-toast';
+import { maintenanceService } from '@/services/maintenance';
+import { useLanguage } from '@/contexts/LanguageContext';
+import { authService } from '@/services/authService';
+
+// Define form schema with Zod
+export const maintenanceFormSchema = z.object({
+  title: z.string().min(3, { message: "Title must be at least 3 characters" }),
+  description: z.string().min(10, { message: "Description must be at least 10 characters" }),
+  start_time: z.date(),
+  end_time: z.date(),
+  affected: z.string().min(3, { message: "Affected services must be specified" }),
+  priority: z.enum(['low', 'medium', 'high']),
+  status: z.enum(['scheduled', 'in_progress', 'completed', 'cancelled']),
+  field: z.enum(['minor', 'moderate', 'major']),
+  assigned_users: z.array(z.string()).default([]),
+  notify_subscribers: z.boolean().default(false),
+  notification_channel_id: z.string().optional(),
+});
+
+// Infer TypeScript type from schema
+export type MaintenanceFormValues = z.infer<typeof maintenanceFormSchema>;
+
+export const useMaintenanceForm = (
+  onSuccess: () => void,
+  onClose: () => void
+) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  
+  // Get current user
+  const currentUser = authService.getCurrentUser();
+
+  // Initialize form with default values
+  const form = useForm<MaintenanceFormValues>({
+    resolver: zodResolver(maintenanceFormSchema),
+    defaultValues: {
+      title: '',
+      description: '',
+      start_time: new Date(),
+      end_time: new Date(Date.now() + 3600000), // 1 hour from now
+      affected: '',
+      priority: 'medium',
+      status: 'scheduled',
+      field: 'minor',
+      assigned_users: [],
+      notify_subscribers: false,
+      notification_channel_id: '',
+    },
+  });
+
+  const onSubmit = async (data: MaintenanceFormValues) => {
+    try {
+      console.log("Form data before submission:", data);
+      console.log("Assigned users before submission:", data.assigned_users);
+      console.log("Notification channel before submission:", data.notification_channel_id);
+      
+      // Verify dates are valid
+      if (!data.start_time || isNaN(data.start_time.getTime())) {
+        throw new Error("Invalid start time");
+      }
+      
+      if (!data.end_time || isNaN(data.end_time.getTime())) {
+        throw new Error("Invalid end time");
+      }
+      
+      // Format the submission payload
+      const formattedData = {
+        title: data.title,
+        description: data.description,
+        start_time: data.start_time.toISOString(),
+        end_time: data.end_time.toISOString(),
+        affected: data.affected,
+        priority: data.priority,
+        status: data.status,
+        field: data.field,
+        created_by: currentUser?.id || '',
+        // Ensure assigned_users is properly formatted as an array
+        assigned_users: Array.isArray(data.assigned_users) ? data.assigned_users : [],
+        notify_subscribers: data.notify_subscribers ? 'yes' : 'no',
+        // Set notification_channel_id correctly - avoid "none" value
+        notification_channel_id: data.notify_subscribers && data.notification_channel_id && data.notification_channel_id !== 'none' 
+          ? data.notification_channel_id 
+          : '',
+        // Set notification_id to match notification_channel_id for consistency
+        notification_id: data.notify_subscribers && data.notification_channel_id && data.notification_channel_id !== 'none'
+          ? data.notification_channel_id
+          : '',
+      };
+      
+      console.log("Submitting maintenance with data:", formattedData);
+      console.log("Assigned users being sent:", formattedData.assigned_users);
+      console.log("Notification channel being sent:", formattedData.notification_channel_id);
+      console.log("Notification ID being sent:", formattedData.notification_id);
+
+      // Create the maintenance record
+      await maintenanceService.createMaintenance(formattedData);
+      
+      toast({
+        title: t('maintenanceCreated'),
+        description: t('maintenanceCreatedDesc'),
+      });
+      
+      onClose();
+      onSuccess();
+    } catch (error) {
+      console.error('Error creating maintenance:', error);
+      
+      if (error instanceof Error) {
+        toast({
+          title: t('error'),
+          description: `${t('errorCreatingMaintenance')}: ${error.message}`,
+          variant: 'destructive',
+        });
+      } else {
+        toast({
+          title: t('error'),
+          description: t('errorCreatingMaintenance'),
+          variant: 'destructive',
+        });
+      }
+    }
+  };
+
+  return {
+    form,
+    onSubmit,
+  };
+};
diff --git a/application/src/components/schedule-incident/maintenance/index.ts b/application/src/components/schedule-incident/maintenance/index.ts
new file mode 100644
index 0000000..a8fd930
--- /dev/null
+++ b/application/src/components/schedule-incident/maintenance/index.ts
@@ -0,0 +1,11 @@
+
+// Export all maintenance components
+export * from './MaintenanceTable';
+export * from './MaintenanceStatusBadge';
+export * from './MaintenanceActionsMenu';
+export * from './EmptyMaintenanceState';
+export * from './CreateMaintenanceDialog';
+export * from './MaintenanceStatusDropdown';
+export * from './MaintenanceStatusChecker';
+export * from './detail-dialog';
+
diff --git a/application/src/components/servers/AddServerAgentDialog.tsx b/application/src/components/servers/AddServerAgentDialog.tsx
new file mode 100644
index 0000000..8b851d1
--- /dev/null
+++ b/application/src/components/servers/AddServerAgentDialog.tsx
@@ -0,0 +1,186 @@
+
+import React, { useState } from "react";
+import { useQueryClient } from "@tanstack/react-query";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { useToast } from "@/hooks/use-toast";
+import { Server } from "lucide-react";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { getCurrentEndpoint } from "@/lib/pocketbase";
+import { ServerAgentConfigForm } from "./ServerAgentConfigForm";
+import { OneClickInstallTab } from "./OneClickInstallTab";
+import { DockerOneClickTab } from "./DockerOneClickTab";
+import { ManualInstallTab } from "./ManualInstallTab";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface AddServerAgentDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onAgentAdded: () => void;
+}
+
+export const AddServerAgentDialog: React.FC<AddServerAgentDialogProps> = ({
+  open,
+  onOpenChange,
+  onAgentAdded,
+}) => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const queryClient = useQueryClient();
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [activeTab, setActiveTab] = useState("configure");
+
+  const currentPocketBaseUrl = getCurrentEndpoint();
+  const [formData, setFormData] = useState({
+    serverName: "",
+    description: "",
+    osType: "",
+    checkInterval: "60",
+    retryAttempt: "3",
+    dockerEnabled: false,
+    notificationEnabled: true,
+  });
+
+  const generateNewCredentials = () => ({
+    serverToken: `srv_${Math.random().toString(36).substring(2, 15)}${Math.random().toString(36).substring(2, 15)}`,
+    serverId: `agent_${Math.random().toString(36).substring(2, 15)}${Math.random().toString(36).substring(2, 15)}`
+  });
+
+  const [serverToken, setServerToken] = useState(() =>
+    `srv_${Math.random().toString(36).substring(2, 15)}${Math.random().toString(36).substring(2, 15)}`
+  );
+
+  const [serverId, setServerId] = useState(() =>
+    `agent_${Math.random().toString(36).substring(2, 15)}${Math.random().toString(36).substring(2, 15)}`
+  );
+
+  // Refresh credentials and reset form whenever the dialog opens
+  React.useEffect(() => {
+    if (open) {
+      const newCredentials = generateNewCredentials();
+      setServerToken(newCredentials.serverToken);
+      setServerId(newCredentials.serverId);
+      setActiveTab("configure");
+      setFormData({
+        serverName: "",
+        description: "",
+        osType: "",
+        checkInterval: "60",
+        retryAttempt: "3",
+        dockerEnabled: false,
+        notificationEnabled: true,
+      });
+    }
+  }, [open]);
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (isSubmitting) return;
+
+    if (!formData.serverName || !formData.osType) {
+      toast({
+        title: t('validationError'),
+        description: t('fillRequiredFields'),
+        variant: "destructive",
+      });
+      return;
+    }
+
+    setIsSubmitting(true);
+
+    try {
+      await new Promise(resolve => setTimeout(resolve, 1500));
+
+      toast({
+        title: t('serverAgentCreated'),
+        description: t('serverAgentCreatedDesc').replace('{name}', formData.serverName),
+      });
+      setActiveTab("one-click");
+      onAgentAdded();
+    } catch (error) {
+      toast({
+        title: t('error'),
+        description: t('failedToCreateAgent'),
+        variant: "destructive",
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const handleDialogClose = () => {
+    onOpenChange(false);
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={handleDialogClose}>
+      <DialogContent className="sm:max-w-[900px] max-w-[95vw] max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Server className="h-5 w-5" />
+            {t('addServerMonitoringAgent')}
+          </DialogTitle>
+          <DialogDescription>
+            {t('configureAgentDesc')}
+          </DialogDescription>
+        </DialogHeader>
+
+        <Tabs value={activeTab} onValueChange={setActiveTab} className="w-full">
+          <TabsList className="grid w-full grid-cols-4">
+            <TabsTrigger value="configure">{t('configureAgent')}</TabsTrigger>
+            <TabsTrigger value="one-click">{t('oneClickInstall')}</TabsTrigger>
+            <TabsTrigger value="docker-one-click">{t('dockerOneClick')}</TabsTrigger>
+            <TabsTrigger value="manual">{t('manualInstallation')}</TabsTrigger>
+          </TabsList>
+
+          <TabsContent value="configure" className="space-y-6">
+            <ServerAgentConfigForm
+              formData={formData}
+              setFormData={setFormData}
+              serverId={serverId}
+              serverToken={serverToken}
+              currentPocketBaseUrl={currentPocketBaseUrl}
+              isSubmitting={isSubmitting}
+              onSubmit={handleSubmit}
+            />
+          </TabsContent>
+
+          <TabsContent value="one-click" className="space-y-6">
+            <OneClickInstallTab
+              serverToken={serverToken}
+              currentPocketBaseUrl={currentPocketBaseUrl}
+              formData={formData}
+              serverId={serverId}
+              onDialogClose={handleDialogClose}
+            />
+          </TabsContent>
+
+          <TabsContent value="docker-one-click" className="space-y-6">
+            <DockerOneClickTab
+              serverToken={serverToken}
+              currentPocketBaseUrl={currentPocketBaseUrl}
+              formData={formData}
+              serverId={serverId}
+              onDialogClose={handleDialogClose}
+            />
+          </TabsContent>
+
+          <TabsContent value="manual" className="space-y-6">
+            <ManualInstallTab
+              serverToken={serverToken}
+              currentPocketBaseUrl={currentPocketBaseUrl}
+              formData={formData}
+              serverId={serverId}
+              onDialogClose={handleDialogClose}
+            />
+          </TabsContent>
+        </Tabs>
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/DockerOneClickTab.tsx b/application/src/components/servers/DockerOneClickTab.tsx
new file mode 100644
index 0000000..519653e
--- /dev/null
+++ b/application/src/components/servers/DockerOneClickTab.tsx
@@ -0,0 +1,178 @@
+
+import React from "react";
+import { Button } from "@/components/ui/button";
+import { Label } from "@/components/ui/label";
+import { Copy, Download, Container } from "lucide-react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { copyToClipboard } from "@/utils/copyUtils";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface DockerOneClickTabProps {
+  serverToken: string;
+  currentPocketBaseUrl: string;
+  formData: {
+    serverName: string;
+    osType: string;
+    checkInterval: string;
+    retryAttempt: string;
+  };
+  serverId: string;
+  onDialogClose: () => void;
+}
+
+export const DockerOneClickTab: React.FC<DockerOneClickTabProps> = ({
+  serverToken,
+  currentPocketBaseUrl,
+  formData,
+  serverId,
+  onDialogClose,
+}) => {
+  const { t } = useLanguage();
+  const getDockerOneClickCommand = () => {
+    const scriptUrl = "https://cdn.checkcle.io/scripts/server-docker-agent.sh";
+
+    return `curl -L -o server-docker-agent.sh "${scriptUrl}"
+chmod +x server-docker-agent.sh
+SERVER_TOKEN="${serverToken}" \\
+POCKETBASE_URL="${currentPocketBaseUrl}" \\
+SERVER_NAME="${formData.serverName}" \\
+AGENT_ID="${serverId}" \\
+sudo -E bash ./server-docker-agent.sh`;
+  };
+
+  const getDirectDockerCommand = () => {
+    return `docker run -d \\
+  --name monitoring-agent \\
+  --restart unless-stopped \\
+  -p 8081:8081 \\
+  --group-add 999 \\
+  -e AGENT_ID="${serverId}" \\
+  -e SERVER_NAME="${formData.serverName}" \\
+  -e SERVER_TOKEN="${serverToken}" \\
+  -e POCKETBASE_URL="${currentPocketBaseUrl}" \\
+  -e POCKETBASE_ENABLED=true \\
+  -v /proc:/host/proc:ro \\
+  -v /etc:/host/etc:ro \\
+  -v /sys:/host/sys:ro \\
+  -v /:/host/root:ro \\
+  -v /var/run:/host/var/run:ro \\
+  -v /dev:/host/dev:ro \\
+  -v /var/run/docker.sock:/var/run/docker.sock:ro \\
+  -v monitoring_data:/var/lib/monitoring-agent \\
+  -v monitoring_logs:/var/log/monitoring-agent \\
+  operacle/checkcle-server-agent:latest`;
+  };
+
+  const handleCopyOneClickCommand = async (e: React.MouseEvent) => {
+    e.preventDefault();
+    e.stopPropagation();
+  //  console.log('Copy one-click command button clicked');
+    const command = getDockerOneClickCommand();
+  //  console.log('Copying one-click command:', command);
+    await copyToClipboard(command);
+  };
+
+  const handleCopyDockerCommand = async (e: React.MouseEvent) => {
+    e.preventDefault();
+    e.stopPropagation();
+   // console.log('Copy docker command button clicked');
+    const command = getDirectDockerCommand();
+  //  console.log('Copying docker command:', command);
+    await copyToClipboard(command);
+  };
+
+  return (
+    <div className="space-y-6">
+      {/* One-Click Docker Installation */}
+      <Card className="border-blue-500/20 bg-blue-50/50 dark:bg-blue-950/20">
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2 text-blue-700 dark:text-blue-400">
+            <Container className="h-5 w-5" />
+            {t('dockerOneClickTitle')}
+          </CardTitle>
+          <CardDescription className="text-blue-600 dark:text-blue-300">
+            {t('dockerOneClickDesc')}
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="space-y-2">
+            <Label className="text-blue-700 dark:text-blue-400">{t('dockerOneClickCommand')}</Label>
+            <div className="relative">
+              <pre className="bg-blue-50 dark:bg-blue-950 border border-blue-200 dark:border-blue-800 p-4 rounded-md text-sm overflow-x-auto whitespace-pre-wrap break-all text-blue-800 dark:text-blue-200">
+                <code>{getDockerOneClickCommand()}</code>
+              </pre>
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="absolute top-2 right-2 bg-blue-50 dark:bg-blue-950/50 border-blue-200 dark:border-blue-800 hover:bg-blue-100 dark:hover:bg-blue-900 text-blue-700 dark:text-blue-400"
+                onClick={handleCopyOneClickCommand}
+              >
+                <Copy className="h-4 w-4 mr-1" />
+                {t('copy')}
+              </Button>
+            </div>
+          </div>
+          
+          <div className="text-sm text-blue-700 dark:text-blue-300 bg-blue-50 dark:bg-blue-950/50 border border-blue-200 dark:border-blue-800 p-3 rounded-md">
+            <p className="font-medium mb-1">{t('dockerScriptWill')}</p>
+            <ol className="list-decimal list-inside space-y-1 text-xs">
+              <li>{t('dockerScriptStep1')}</li>
+              <li>{t('dockerScriptStep2')}</li>
+              <li>{t('dockerScriptStep3')}</li>
+              <li>{t('dockerScriptStep4')}</li>
+            </ol>
+          </div>
+        </CardContent>
+      </Card>
+
+      {/* Direct Docker Run Command */}
+      <Card className="border-gray-500/20">
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Container className="h-5 w-5" />
+            {t('directDockerTitle')}
+          </CardTitle>
+          <CardDescription>
+            {t('directDockerDesc')}
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <div className="space-y-2">
+            <Label>{t('dockerRunCommand')}</Label>
+            <div className="relative">
+              <pre className="bg-muted border p-4 rounded-md text-sm overflow-x-auto whitespace-pre-wrap break-all">
+                <code>{getDirectDockerCommand()}</code>
+              </pre>
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="absolute top-2 right-2"
+                onClick={handleCopyDockerCommand}
+              >
+                <Copy className="h-4 w-4 mr-1" />
+                {t('copy')}
+              </Button>
+            </div>
+          </div>
+
+          <div className="text-sm text-muted-foreground bg-muted/50 border p-3 rounded-md">
+            <p className="font-medium mb-1">{t('dockerPrerequisites')}</p>
+            <ol className="list-decimal list-inside space-y-1 text-xs">
+              <li>{t('dockerPrereqStep1')}</li>
+              <li>{t('dockerPrereqStep2')}</li>
+              <li>{t('dockerPrereqStep3')}</li>
+            </ol>
+          </div>
+        </CardContent>
+      </Card>
+
+      <div className="flex justify-end pt-4">
+        <Button onClick={onDialogClose}>
+          {t('done')}
+        </Button>
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/EditServerDialog.tsx b/application/src/components/servers/EditServerDialog.tsx
new file mode 100644
index 0000000..ea3f414
--- /dev/null
+++ b/application/src/components/servers/EditServerDialog.tsx
@@ -0,0 +1,673 @@
+import React, { useState, useEffect } from "react";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Checkbox } from "@/components/ui/checkbox";
+import { useToast } from "@/hooks/use-toast";
+import { pb } from "@/lib/pocketbase";
+import { Server } from "@/types/server.types";
+import { RefreshCw, X } from "lucide-react";
+import { alertConfigService, AlertConfiguration } from "@/services/alertConfigService";
+import { templateService, ServerNotificationTemplate } from "@/services/templateService";
+import { serverThresholdService, ServerThreshold } from "@/services/serverThresholdService";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface EditServerDialogProps {
+  server: Server | null;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onServerUpdated: () => void;
+}
+
+interface ServerFormData {
+  name: string;
+  check_interval: number;
+  max_retries: number;
+  docker_monitoring: boolean;
+  notification_enabled: boolean;
+  notification_channels: string[]; // Changed to array for multiple selections
+  threshold_id: string;
+  template_id: string;
+}
+
+interface ThresholdFormData {
+  cpu_threshold: number;
+  ram_threshold: number;
+  disk_threshold: number;
+  network_threshold: number;
+}
+
+export const EditServerDialog: React.FC<EditServerDialogProps> = ({
+  server,
+  open,
+  onOpenChange,
+  onServerUpdated,
+}) => {
+  const { t } = useLanguage();
+  const [formData, setFormData] = useState<ServerFormData>({
+    name: "",
+    check_interval: 60,
+    max_retries: 3,
+    docker_monitoring: false,
+    notification_enabled: false,
+    notification_channels: [], // Changed to array
+    threshold_id: "none",
+    template_id: "none",
+  });
+  
+  const [thresholdFormData, setThresholdFormData] = useState<ThresholdFormData>({
+    cpu_threshold: 80,
+    ram_threshold: 80,
+    disk_threshold: 80,
+    network_threshold: 80,
+  });
+  
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [alertConfigs, setAlertConfigs] = useState<AlertConfiguration[]>([]);
+  const [templates, setTemplates] = useState<ServerNotificationTemplate[]>([]);
+  const [thresholds, setThresholds] = useState<ServerThreshold[]>([]);
+  const [selectedTemplate, setSelectedTemplate] = useState<ServerNotificationTemplate | null>(null);
+  const [selectedThreshold, setSelectedThreshold] = useState<ServerThreshold | null>(null);
+  const [loadingAlertConfigs, setLoadingAlertConfigs] = useState(false);
+  const [loadingTemplates, setLoadingTemplates] = useState(false);
+  const [loadingThresholds, setLoadingThresholds] = useState(false);
+  const { toast } = useToast();
+
+  // Initialize form data when server changes
+  useEffect(() => {
+    if (server) {
+      // Parse comma-separated notification_id into array
+      const notificationChannels = server.notification_id 
+        ? server.notification_id.split(',').map(id => id.trim()).filter(id => id)
+        : [];
+      
+      setFormData({
+        name: server.name || "",
+        check_interval: server.check_interval || 60,
+        max_retries: server.max_retries || 3,
+        docker_monitoring: server.docker === "true",
+        notification_enabled: server.notification_status === true,
+        notification_channels: notificationChannels,
+        threshold_id: server.threshold_id || "none",
+        template_id: server.template_id || "none",
+      });
+    }
+  }, [server]);
+
+  // Load data when dialog opens
+  useEffect(() => {
+    if (open) {
+      loadAlertConfigurations();
+      loadTemplates();
+      loadThresholds();
+    }
+  }, [open]);
+
+  // Load existing threshold data when thresholds are loaded and we have a server with threshold_id
+  useEffect(() => {
+    if (server && server.threshold_id && thresholds.length > 0) {
+      const existingThreshold = thresholds.find(t => t.id === server.threshold_id);
+      if (existingThreshold) {
+        setSelectedThreshold(existingThreshold);
+        // Handle the API response format with proper field names and type conversion
+        setThresholdFormData({
+          cpu_threshold: parseInt(String(existingThreshold.cpu_threshold)) || 80,
+          ram_threshold: parseInt(String((existingThreshold.ram_threshold_message ?? existingThreshold.ram_threshold))) || 80,
+          disk_threshold: parseInt(String(existingThreshold.disk_threshold)) || 80,
+          network_threshold: parseInt(String(existingThreshold.network_threshold)) || 80,
+        });
+      }
+    }
+  }, [server, thresholds]);
+
+  // Update selected template when form data or templates change
+  useEffect(() => {
+    if (formData.template_id && formData.template_id !== "none" && templates.length > 0) {
+      const template = templates.find(t => t.id === formData.template_id);
+      setSelectedTemplate(template || null);
+    } else {
+      setSelectedTemplate(null);
+    }
+  }, [formData.template_id, templates]);
+
+  // Update selected threshold when threshold_id changes in form
+  useEffect(() => {
+    if (formData.threshold_id && formData.threshold_id !== "none" && thresholds.length > 0) {
+      const threshold = thresholds.find(t => t.id === formData.threshold_id);
+      setSelectedThreshold(threshold || null);
+      if (threshold) {
+        // Handle the API response format with proper field names and type conversion
+        setThresholdFormData({
+          cpu_threshold: parseInt(String(threshold.cpu_threshold)) || 80,
+          ram_threshold: parseInt(String((threshold.ram_threshold_message ?? threshold.ram_threshold))) || 80,
+          disk_threshold: parseInt(String(threshold.disk_threshold)) || 80,
+          network_threshold: parseInt(String(threshold.network_threshold)) || 80,
+        });
+      }
+    } else if (formData.threshold_id === "none") {
+      setSelectedThreshold(null);
+      setThresholdFormData({
+        cpu_threshold: 80,
+        ram_threshold: 80,
+        disk_threshold: 80,
+        network_threshold: 80,
+      });
+    }
+  }, [formData.threshold_id, thresholds]);
+
+  const loadAlertConfigurations = async () => {
+    try {
+      setLoadingAlertConfigs(true);
+      const configs = await alertConfigService.getAlertConfigurations();
+      setAlertConfigs(configs);
+    } catch (error) {
+      toast({
+        variant: "destructive",
+        title: t('error', 'instance'),
+        description: t('failedToLoadChannels', 'instance'),
+      });
+    } finally {
+      setLoadingAlertConfigs(false);
+    }
+  };
+
+  const loadTemplates = async () => {
+    try {
+      setLoadingTemplates(true);
+      const templateList = await templateService.getTemplates('server');
+      // Cast to ServerNotificationTemplate[] since we know we're getting server templates
+      setTemplates(templateList as ServerNotificationTemplate[]);
+    } catch (error) {
+      toast({
+        variant: "destructive",
+        title: t('error', 'instance'),
+        description: t('failedToLoadTemplates', 'instance'),
+      });
+    } finally {
+      setLoadingTemplates(false);
+    }
+  };
+
+  const loadThresholds = async () => {
+    try {
+      setLoadingThresholds(true);
+      const thresholdList = await serverThresholdService.getServerThresholds();
+      setThresholds(thresholdList);
+    } catch (error) {
+      toast({
+        variant: "destructive",
+        title: t('error', 'instance'),
+        description: t('failedToLoadThresholds', 'instance'),
+      });
+    } finally {
+      setLoadingThresholds(false);
+    }
+  };
+
+  const handleNotificationChannelToggle = (channelId: string, checked: boolean) => {
+    setFormData(prev => ({
+      ...prev,
+      notification_channels: checked 
+        ? [...prev.notification_channels, channelId]
+        : prev.notification_channels.filter(id => id !== channelId)
+    }));
+  };
+
+  const removeNotificationChannel = (channelId: string) => {
+    setFormData(prev => ({
+      ...prev,
+      notification_channels: prev.notification_channels.filter(id => id !== channelId)
+    }));
+  };
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (!server || isSubmitting) return;
+
+    try {
+      setIsSubmitting(true);
+
+      // Convert notification channels array to comma-separated string
+      const notificationChannelsString = formData.notification_channels.join(',');
+
+      const updateData = {
+        name: formData.name,
+        check_interval: formData.check_interval,
+        max_retries: formData.max_retries,
+        docker: formData.docker_monitoring ? "true" : "false",
+        notification_status: formData.notification_enabled,
+        notification_id: notificationChannelsString,
+        threshold_id: formData.threshold_id !== "none" ? formData.threshold_id : "",
+        template_id: formData.template_id !== "none" ? formData.template_id : "",
+        updated: new Date().toISOString(),
+      };
+
+      await pb.collection('servers').update(server.id, updateData);
+
+      // Update threshold if a threshold is selected and values have been modified
+      if (selectedThreshold && formData.threshold_id !== "none") {
+        try {
+          const updateThresholdData = {
+            cpu_threshold: thresholdFormData.cpu_threshold,
+            ram_threshold_message: thresholdFormData.ram_threshold,
+            disk_threshold: thresholdFormData.disk_threshold,
+            network_threshold: thresholdFormData.network_threshold,
+          };
+
+          await serverThresholdService.updateServerThreshold(selectedThreshold.id, updateThresholdData);
+          
+          // Update local state
+          setSelectedThreshold({
+            ...selectedThreshold,
+            ...thresholdFormData,
+          });
+
+          // Update thresholds list
+          setThresholds(prev => prev.map(t => 
+            t.id === selectedThreshold.id 
+              ? { ...t, ...thresholdFormData }
+              : t
+          ));
+
+        } catch (error) {
+          toast({
+            variant: "destructive",
+            title: t('warning', 'instance'),
+            description: t('serverUpdatedButThresholdFailed', 'instance'),
+          });
+        }
+      }
+
+      toast({
+        title: t('serverUpdated', 'instance'),
+        description: t('serverUpdatedDesc', 'instance', { name: formData.name }),
+      });
+
+      onServerUpdated();
+      onOpenChange(false);
+      
+    } catch (error) {
+      toast({
+        variant: "destructive",
+        title: t('error', 'instance'),
+        description: t('failedToUpdateServer', 'instance'),
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const handleCancel = () => {
+    if (server) {
+      const notificationChannels = server.notification_id 
+        ? server.notification_id.split(',').map(id => id.trim()).filter(id => id)
+        : [];
+        
+      setFormData({
+        name: server.name || "",
+        check_interval: server.check_interval || 60,
+        max_retries: server.max_retries || 3,
+        docker_monitoring: server.docker === "true",
+        notification_enabled: server.notification_status === true,
+        notification_channels: notificationChannels,
+        threshold_id: server.threshold_id || "none",
+        template_id: server.template_id || "none",
+      });
+    }
+    onOpenChange(false);
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[700px] max-h-[80vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>{t('editServerConfiguration', 'instance')}</DialogTitle>
+        </DialogHeader>
+        
+        <form onSubmit={handleSubmit} className="space-y-6">
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+            <div className="space-y-2">
+              <Label htmlFor="serverName">{t('serverNameLabel', 'instance')}</Label>
+              <Input
+                id="serverName"
+                value={formData.name}
+                onChange={(e) => setFormData(prev => ({ ...prev, name: e.target.value }))}
+                placeholder={t('serverNamePlaceholder', 'instance')}
+                required
+              />
+            </div>
+
+            <div className="space-y-2">
+              <Label htmlFor="checkInterval">{t('checkIntervalLabel', 'instance')}</Label>
+              <Select
+                value={formData.check_interval.toString()}
+                onValueChange={(value) => setFormData(prev => ({ ...prev, check_interval: parseInt(value) }))}
+              >
+                <SelectTrigger>
+                  <SelectValue placeholder={t('selectInterval', 'instance')} />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="30">{t('interval30s', 'instance')}</SelectItem>
+                  <SelectItem value="60">{t('interval1m', 'instance')}</SelectItem>
+                  <SelectItem value="120">{t('interval2m', 'instance')}</SelectItem>
+                  <SelectItem value="300">{t('interval5m', 'instance')}</SelectItem>
+                  <SelectItem value="600">{t('interval10m', 'instance')}</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+
+            <div className="space-y-2">
+              <Label htmlFor="maxRetries">{t('maxRetriesLabel', 'instance')}</Label>
+              <Select
+                value={formData.max_retries.toString()}
+                onValueChange={(value) => setFormData(prev => ({ ...prev, max_retries: parseInt(value) }))}
+              >
+                <SelectTrigger>
+                  <SelectValue placeholder={t('selectMaxRetries', 'instance')} />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="1">{t('retry1', 'instance')}</SelectItem>
+                  <SelectItem value="2">{t('retry2', 'instance')}</SelectItem>
+                  <SelectItem value="3">{t('retry3', 'instance')}</SelectItem>
+                  <SelectItem value="5">{t('retry5', 'instance')}</SelectItem>
+                  <SelectItem value="10">{t('retry10', 'instance')}</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+
+            <div className="space-y-2">
+              <Label htmlFor="dockerMonitoring">{t('dockerMonitoring', 'instance')}</Label>
+              <div className="flex items-center space-x-2">
+                <Switch
+                  id="dockerMonitoring"
+                  checked={formData.docker_monitoring}
+                  onCheckedChange={(checked) => setFormData(prev => ({ 
+                    ...prev, 
+                    docker_monitoring: checked
+                  }))}
+                />
+                <Label htmlFor="dockerMonitoring" className="text-sm text-muted-foreground">
+                  {formData.docker_monitoring ? t('enabled', 'instance') : t('disabled', 'instance')}
+                </Label>
+              </div>
+            </div>
+          </div>
+
+          {/* Notification Status Toggle */}
+          <div className="space-y-4">
+            <div className="flex items-center space-x-2">
+              <Switch
+                id="notificationEnabled"
+                checked={formData.notification_enabled}
+                onCheckedChange={(checked) => setFormData(prev => ({ 
+                  ...prev, 
+                  notification_enabled: checked
+                  // Remove the automatic clearing of notification_channels, threshold_id, and template_id
+                }))}
+              />
+              <Label htmlFor="notificationEnabled">{t('enableNotifications', 'instance')}</Label>
+            </div>
+            
+            {/* Expanded Notification Settings */}
+            {formData.notification_enabled && (
+              <Card className="border-l-4 border-l-blue-500">
+                <CardHeader>
+                  <CardTitle className="text-lg">{t('notificationSettings', 'instance')}</CardTitle>
+                </CardHeader>
+                <CardContent className="space-y-4">
+                  {/* Multiple Notification Channels Selection */}
+                  <div className="space-y-2">
+                    <Label>{t('notificationChannels', 'instance')}</Label>
+                    <div className="space-y-2 max-h-40 overflow-y-auto border rounded-md p-3">
+                      {loadingAlertConfigs ? (
+                        <div className="text-sm text-muted-foreground">{t('loadingChannels', 'instance')}</div>
+                      ) : alertConfigs.length > 0 ? (
+                        alertConfigs.map((config) => (
+                          <div key={config.id} className="flex items-center space-x-2">
+                            <Checkbox
+                              id={`channel-${config.id}`}
+                              checked={formData.notification_channels.includes(config.id || "")}
+                              onCheckedChange={(checked) => 
+                                handleNotificationChannelToggle(config.id || "", checked as boolean)
+                              }
+                            />
+                            <Label 
+                              htmlFor={`channel-${config.id}`} 
+                              className="flex-1 text-sm cursor-pointer"
+                            >
+                              {config.notify_name} ({config.notification_type})
+                            </Label>
+                          </div>
+                        ))
+                      ) : (
+                        <div className="text-sm text-muted-foreground">{t('noChannelsAvailable', 'instance')}</div>
+                      )}
+                    </div>
+                    
+                    {/* Selected Channels Display */}
+                    {formData.notification_channels.length > 0 && (
+                      <div className="space-y-2">
+                        <Label className="text-sm font-medium">{t('selectedChannels', 'instance')}</Label>
+                        <div className="flex flex-wrap gap-2">
+                          {formData.notification_channels.map((channelId) => {
+                            const channel = alertConfigs.find(c => c.id === channelId);
+                            return (
+                              <div 
+                                key={channelId}
+                                className="flex items-center gap-1 bg-secondary text-secondary-foreground px-2 py-1 rounded-md text-sm"
+                              >
+                                <span>{channel?.notify_name || channelId}</span>
+                                <Button
+                                  type="button"
+                                  variant="ghost"
+                                  size="sm"
+                                  className="h-4 w-4 p-0 hover:bg-destructive hover:text-destructive-foreground"
+                                  onClick={() => removeNotificationChannel(channelId)}
+                                >
+                                  <X className="h-3 w-3" />
+                                </Button>
+                              </div>
+                            );
+                          })}
+                        </div>
+                      </div>
+                    )}
+                  </div>
+
+                  {/* Server Set Threshold Selection */}
+                  <div className="space-y-2">
+                    <Label htmlFor="thresholdId">{t('serverSetThreshold', 'instance')}</Label>
+                    <Select
+                      value={formData.threshold_id}
+                      onValueChange={(value) => setFormData(prev => ({ ...prev, threshold_id: value }))}
+                      disabled={loadingThresholds}
+                    >
+                      <SelectTrigger>
+                        <SelectValue placeholder={loadingThresholds ? t('loadingThresholds', 'instance') : t('selectServerThreshold', 'instance')} />
+                      </SelectTrigger>
+                      <SelectContent>
+                        <SelectItem value="none">{t('noThreshold', 'instance')}</SelectItem>
+                        {thresholds.map((threshold) => (
+                          <SelectItem key={threshold.id} value={threshold.id}>
+                            {threshold.name}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  </div>
+
+                  {/* Editable Threshold Details */}
+                  {selectedThreshold && (
+                    <Card className="bg-muted/50">
+                      <CardHeader>
+                        <CardTitle className="text-base">{t('thresholdDetails', 'instance')}: {selectedThreshold.name}</CardTitle>
+                      </CardHeader>
+                      <CardContent className="space-y-3">
+                        <div className="grid grid-cols-2 gap-3 text-sm">
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('cpuThresholdPct', 'instance')}</Label>
+                            <Input
+                              type="number"
+                              min="0"
+                              max="100"
+                              value={thresholdFormData.cpu_threshold}
+                              onChange={(e) => setThresholdFormData(prev => ({ 
+                                ...prev, 
+                                cpu_threshold: parseInt(e.target.value) || 0 
+                              }))}
+                              className="mt-1"
+                            />
+                          </div>
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('ramThresholdPct', 'instance')}</Label>
+                            <Input
+                              type="number"
+                              min="0"
+                              max="100"
+                              value={thresholdFormData.ram_threshold}
+                              onChange={(e) => setThresholdFormData(prev => ({ 
+                                ...prev, 
+                                ram_threshold: parseInt(e.target.value) || 0 
+                              }))}
+                              className="mt-1"
+                            />
+                          </div>
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('diskThresholdPct', 'instance')}</Label>
+                            <Input
+                              type="number"
+                              min="0"
+                              max="100"
+                              value={thresholdFormData.disk_threshold}
+                              onChange={(e) => setThresholdFormData(prev => ({ 
+                                ...prev, 
+                                disk_threshold: parseInt(e.target.value) || 0 
+                              }))}
+                              className="mt-1"
+                            />
+                          </div>
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('networkThresholdPct', 'instance')}</Label>
+                            <Input
+                              type="number"
+                              min="0"
+                              max="100"
+                              value={thresholdFormData.network_threshold}
+                              onChange={(e) => setThresholdFormData(prev => ({ 
+                                ...prev, 
+                                network_threshold: parseInt(e.target.value) || 0 
+                              }))}
+                              className="mt-1"
+                            />
+                          </div>
+                        </div>
+                      </CardContent>
+                    </Card>
+                  )}
+
+                  {/* Server Template Selection */}
+                  <div className="space-y-2">
+                    <Label htmlFor="templateId">{t('serverTemplate', 'instance')}</Label>
+                    <Select
+                      value={formData.template_id}
+                      onValueChange={(value) => setFormData(prev => ({ ...prev, template_id: value }))}
+                      disabled={loadingTemplates}
+                    >
+                      <SelectTrigger>
+                        <SelectValue placeholder={loadingTemplates ? t('loadingTemplates', 'instance') : t('selectServerTemplate', 'instance')} />
+                      </SelectTrigger>
+                      <SelectContent>
+                        <SelectItem value="none">{t('noTemplate', 'instance')}</SelectItem>
+                        {templates.map((template) => (
+                          <SelectItem key={template.id} value={template.id}>
+                            {template.name}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  </div>
+
+                  {/* Template Details */}
+                  {selectedTemplate && (
+                    <Card className="bg-muted/50">
+                      <CardHeader>
+                        <CardTitle className="text-base">{t('templateDetails', 'instance')}: {selectedTemplate.name}</CardTitle>
+                      </CardHeader>
+                      <CardContent className="space-y-3">
+                        <div className="grid grid-cols-1 gap-3 text-sm">
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('ramMessage', 'instance')}</Label>
+                            <p className="text-sm bg-background p-2 rounded border">
+                              {selectedTemplate.ram_message || t('noMessageDefined', 'instance', { name: 'RAM' })}
+                            </p>
+                          </div>
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('cpuMessage', 'instance')}</Label>
+                            <p className="text-sm bg-background p-2 rounded border">
+                              {selectedTemplate.cpu_message || t('noMessageDefined', 'instance', { name: 'CPU' })}
+                            </p>
+                          </div>
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('diskMessage', 'instance')}</Label>
+                            <p className="text-sm bg-background p-2 rounded border">
+                              {selectedTemplate.disk_message || t('noMessageDefined', 'instance', { name: 'disk' })}
+                            </p>
+                          </div>
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('networkMessage', 'instance')}</Label>
+                            <p className="text-sm bg-background p-2 rounded border">
+                              {selectedTemplate.network_message || t('noMessageDefined', 'instance', { name: 'network' })}
+                            </p>
+                          </div>
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('upMessage', 'instance')}</Label>
+                            <p className="text-sm bg-background p-2 rounded border">
+                              {selectedTemplate.up_message || t('noMessageDefined', 'instance', { name: 'up' })}
+                            </p>
+                          </div>
+                          <div>
+                            <Label className="text-xs font-medium text-muted-foreground">{t('downMessage', 'instance')}</Label>
+                            <p className="text-sm bg-background p-2 rounded border">
+                              {selectedTemplate.down_message || t('noMessageDefined', 'instance', { name: 'down' })}
+                            </p>
+                          </div>
+                        </div>
+                      </CardContent>
+                    </Card>
+                  )}
+                </CardContent>
+              </Card>
+            )}
+          </div>
+
+          <div className="flex justify-end space-x-2 pt-4">
+            <Button
+              type="button"
+              variant="outline"
+              onClick={handleCancel}
+              disabled={isSubmitting}
+            >
+              {t('cancel', 'instance')}
+            </Button>
+            <Button type="submit" disabled={isSubmitting}>
+              {isSubmitting ? (
+                <>
+                  <RefreshCw className="mr-2 h-4 w-4 animate-spin" />
+                  {t('updating', 'instance')}
+                </>
+              ) : (
+                t('updateServer', 'instance')
+              )}
+            </Button>
+          </div>
+        </form>
+      </DialogContent>
+    </Dialog>
+  );
+};
+
+export default EditServerDialog;
\ No newline at end of file
diff --git a/application/src/components/servers/ManualInstallTab.tsx b/application/src/components/servers/ManualInstallTab.tsx
new file mode 100644
index 0000000..00f3c5d
--- /dev/null
+++ b/application/src/components/servers/ManualInstallTab.tsx
@@ -0,0 +1,128 @@
+
+import React from "react";
+import { Button } from "@/components/ui/button";
+import { Copy, Terminal } from "lucide-react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { copyToClipboard } from "@/utils/copyUtils";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ManualInstallTabProps {
+  serverToken: string;
+  currentPocketBaseUrl: string;
+  formData: {
+    serverName: string;
+    osType: string;
+    checkInterval: string;
+  };
+  serverId: string;
+  onDialogClose: () => void;
+}
+
+export const ManualInstallTab: React.FC<ManualInstallTabProps> = ({
+  serverToken,
+  currentPocketBaseUrl,
+  formData,
+  serverId,
+  onDialogClose,
+}) => {
+  const { t } = useLanguage();
+
+  const getManualInstallSteps = () => {
+    const scriptUrl = "https://cdn.checkcle.io/scripts/server-agent.sh";
+    
+    return [
+      {
+        title: t('downloadScript'),
+        command: `curl -L -o server-agent.sh "${scriptUrl}"`
+      },
+      {
+        title: t('makeExecutable'),
+        command: `chmod +x server-agent.sh`
+      },
+      {
+        title: t('runInstall'),
+        command: `SERVER_TOKEN="${serverToken}" POCKETBASE_URL="${currentPocketBaseUrl}" SERVER_NAME="${formData.serverName}" AGENT_ID="${serverId}" sudo bash server-agent.sh`
+      }
+    ];
+  };
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2">
+          <Terminal className="h-5 w-5" />
+          {t('manualInstallTitle')}
+        </CardTitle>
+        <CardDescription>
+          {t('manualInstallDesc')}
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        <div className="space-y-2">
+          <div className="grid grid-cols-2 gap-4 text-sm">
+            <div>
+              <span className="font-medium">{t('serverName')}:</span> {formData.serverName}
+            </div>
+            <div>
+              <span className="font-medium">{t('agentId')}:</span> {serverId}
+            </div>
+            <div>
+              <span className="font-medium">{t('osType')}:</span> {formData.osType}
+            </div>
+            <div>
+              <span className="font-medium">{t('checkInterval')}:</span> {formData.checkInterval}s
+            </div>
+          </div>
+        </div>
+
+        <div className="space-y-4">
+          {getManualInstallSteps().map((step, index) => (
+            <div key={index} className="space-y-2">
+              <div className="flex items-center gap-2">
+                <span className="flex items-center justify-center w-6 h-6 rounded-full bg-primary text-primary-foreground text-sm font-medium">
+                  {index + 1}
+                </span>
+                <span className="font-medium">{step.title}</span>
+              </div>
+              <div className="ml-8 relative">
+                <pre className="bg-muted p-3 rounded-md text-sm overflow-x-auto whitespace-pre-wrap break-all">
+                  <code>{step.command}</code>
+                </pre>
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="sm"
+                  className="absolute top-2 right-2"
+                  onClick={() => copyToClipboard(step.command)}
+                >
+                  <Copy className="h-4 w-4 mr-1" />
+                  {t('copy')}
+                </Button>
+              </div>
+            </div>
+          ))}
+        </div>
+
+        <div className="bg-blue-50 dark:bg-blue-950/20 border border-blue-200 dark:border-blue-800 rounded-md p-4">
+          <h4 className="font-medium text-blue-900 dark:text-blue-100 mb-2">{t('prerequisites')}</h4>
+          <ul className="text-sm text-blue-800 dark:text-blue-200 space-y-1 list-disc list-inside mb-3">
+            <li>{t('prereqRoot')}</li>
+            <li>{t('prereqCurl')}</li>
+            <li>{t('prereqInternet')}</li>
+          </ul>
+          
+          <h4 className="font-medium text-blue-900 dark:text-blue-100 mb-2">{t('afterInstall')}</h4>
+          <p className="text-sm text-blue-800 dark:text-blue-200">
+            {t('agentWillStart')}
+          </p>
+        </div>
+
+        <div className="flex justify-end pt-4">
+          <Button onClick={onDialogClose}>
+            {t('done')}
+          </Button>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/OSSelector.tsx b/application/src/components/servers/OSSelector.tsx
new file mode 100644
index 0000000..6147997
--- /dev/null
+++ b/application/src/components/servers/OSSelector.tsx
@@ -0,0 +1,51 @@
+import React from "react";
+import { Check } from "lucide-react";
+import { cn } from "@/lib/utils";
+
+interface OSOption {
+  value: string;
+  name: string;
+  logo: string; // now it's a path to image, e.g., /logos/ubuntu.svg
+}
+
+const osOptions: OSOption[] = [
+  { value: "ubuntu", name: "Ubuntu", logo: "/upload/os/ubuntu.png" },
+  { value: "debian", name: "Debian", logo: "/upload/os/debian.png" },
+  { value: "centos", name: "CentOS", logo: "/upload/os/centos.png" },
+  { value: "rhel", name: "Red Hat Enterprise Linux", logo: "/upload/os/rhel.png" },
+  { value: "linux", name: "Linux (Generic)", logo: "/upload/os/linux.png" },
+  { value: "windows", name: "Windows Server", logo: "/upload/os/windows.png" },
+];
+
+interface OSSelectorProps {
+  value: string;
+  onValueChange: (value: string) => void;
+}
+
+export const OSSelector: React.FC<OSSelectorProps> = ({ value, onValueChange }) => {
+  return (
+    <div className="grid gap-2">
+      {osOptions.map((os) => (
+        <button
+          key={os.value}
+          type="button"
+          onClick={() => onValueChange(os.value)}
+          className={cn(
+            "flex items-center justify-between w-full rounded-md border px-4 py-2 text-left text-sm hover:bg-accent hover:text-accent-foreground transition",
+            value === os.value ? "bg-accent text-accent-foreground border-ring" : "border-input"
+          )}
+        >
+          <div className="flex items-center gap-3">
+            <img
+              src={os.logo}
+              alt={`${os.name} logo`}
+              className="w-6 h-6 object-contain"
+            />
+            <span>{os.name}</span>
+          </div>
+          {value === os.value && <Check className="h-4 w-4" />}
+        </button>
+      ))}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/OSTypeIcon.tsx b/application/src/components/servers/OSTypeIcon.tsx
new file mode 100644
index 0000000..ff3c0d2
--- /dev/null
+++ b/application/src/components/servers/OSTypeIcon.tsx
@@ -0,0 +1,27 @@
+
+import { Monitor, Server, Smartphone, Laptop } from "lucide-react";
+
+interface OSTypeIconProps {
+  osType: string;
+  className?: string;
+}
+
+export const OSTypeIcon = ({ osType, className = "h-4 w-4" }: OSTypeIconProps) => {
+  const getOSIcon = (os: string) => {
+    const osLower = os.toLowerCase();
+    
+    if (osLower.includes('linux') || osLower.includes('ubuntu') || osLower.includes('centos') || osLower.includes('debian')) {
+      return <Server className={className} />;
+    } else if (osLower.includes('windows')) {
+      return <Monitor className={className} />;
+    } else if (osLower.includes('mac') || osLower.includes('darwin')) {
+      return <Laptop className={className} />;
+    } else if (osLower.includes('android') || osLower.includes('ios')) {
+      return <Smartphone className={className} />;
+    } else {
+      return <Server className={className} />;
+    }
+  };
+
+  return getOSIcon(osType);
+};
\ No newline at end of file
diff --git a/application/src/components/servers/OneClickInstallTab.tsx b/application/src/components/servers/OneClickInstallTab.tsx
new file mode 100644
index 0000000..b9d9427
--- /dev/null
+++ b/application/src/components/servers/OneClickInstallTab.tsx
@@ -0,0 +1,104 @@
+
+import React from "react";
+import { Button } from "@/components/ui/button";
+import { Label } from "@/components/ui/label";
+import { Copy, Download } from "lucide-react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { copyToClipboard } from "@/utils/copyUtils";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface OneClickInstallTabProps {
+  serverToken: string;
+  currentPocketBaseUrl: string;
+  formData: {
+    serverName: string;
+    osType: string;
+    checkInterval: string;
+    retryAttempt: string;
+  };
+  serverId: string;
+  onDialogClose: () => void;
+}
+
+export const OneClickInstallTab: React.FC<OneClickInstallTabProps> = ({
+  serverToken,
+  currentPocketBaseUrl,
+  formData,
+  serverId,
+  onDialogClose,
+}) => {
+  const { t } = useLanguage();
+
+  const getOneClickInstallCommand = () => {
+    const scriptUrl = "https://cdn.checkcle.io/scripts/server-agent.sh";
+
+    return `curl -L -o server-agent.sh "${scriptUrl}"
+chmod +x server-agent.sh
+SERVER_TOKEN="${serverToken}" \\
+POCKETBASE_URL="${currentPocketBaseUrl}" \\
+SERVER_NAME="${formData.serverName}" \\
+AGENT_ID="${serverId}" \\
+OS_TYPE="${formData.osType}" \\
+CHECK_INTERVAL="${formData.checkInterval}" \\
+RETRY_ATTEMPTS="${formData.retryAttempt}" \\
+sudo -E bash ./server-agent.sh`;
+  };
+
+  const handleCopyCommand = async (e: React.MouseEvent) => {
+    e.preventDefault();
+    e.stopPropagation();
+    console.log('Copy button clicked'); // Debug log
+    const command = getOneClickInstallCommand();
+    console.log('Copying command:', command); // Debug log
+    await copyToClipboard(command);
+  };
+
+  return (
+    <Card className="border-green-500/20 bg-green-0/50 dark:bg-green-950/20">
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2 text-green-700 dark:text-green-400">
+          <Download className="h-5 w-5" />
+          {t('oneClickInstallTitle')}
+        </CardTitle>
+        <CardDescription className="text-green-600 dark:text-green-300">
+          {t('oneClickInstallDesc')}
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        <div className="space-y-2">
+          <Label className="text-green-700 dark:text-green-400">{t('quickInstallCommand')}</Label>
+          <div className="relative">
+            <pre className="bg-black-50 dark:bg-green-100/950 border border-green-200 dark:border-green-800 p-4 rounded-md text-sm overflow-x-auto whitespace-pre-wrap break-all text-green-800 dark:text-green-200">
+              <code>{getOneClickInstallCommand()}</code>
+            </pre>
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              className="absolute top-2 right-2 bg-green-50 dark:bg-green-950/50 border-green-200 dark:border-green-800 hover:bg-green-100 dark:hover:bg-green-900 text-green-700 dark:text-green-400"
+              onClick={handleCopyCommand}
+            >
+              <Copy className="h-4 w-4 mr-1" />
+              {t('copy')}
+            </Button>
+          </div>
+        </div>
+        
+        <div className="text-sm text-green-700 dark:text-green-300 bg-green-50 dark:bg-green-950/50 border border-green-200 dark:border-green-800 p-3 rounded-md">
+          <p className="font-medium mb-1">{t('runCommandOnServer')}</p>
+          <ol className="list-decimal list-inside space-y-1 text-xs">
+            <li>{t('sshIntoServer')}</li>
+            <li>{t('pasteAndRun')}</li>
+            <li>{t('agentInstalled')}</li>
+          </ol>
+        </div>
+
+        <div className="flex justify-end pt-4">
+          <Button onClick={onDialogClose}>
+            {t('done')}
+          </Button>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/ServerAgentConfigForm.tsx b/application/src/components/servers/ServerAgentConfigForm.tsx
new file mode 100644
index 0000000..13b3680
--- /dev/null
+++ b/application/src/components/servers/ServerAgentConfigForm.tsx
@@ -0,0 +1,175 @@
+
+import React from "react";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Copy } from "lucide-react";
+import { copyToClipboard } from "@/utils/copyUtils";
+import { OSSelector } from "./OSSelector";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServerAgentConfigFormProps {
+  formData: {
+    serverName: string;
+    description: string;
+    osType: string;
+    checkInterval: string;
+    retryAttempt: string;
+    dockerEnabled: boolean;
+    notificationEnabled: boolean;
+  };
+  setFormData: React.Dispatch<React.SetStateAction<{
+    serverName: string;
+    description: string;
+    osType: string;
+    checkInterval: string;
+    retryAttempt: string;
+    dockerEnabled: boolean;
+    notificationEnabled: boolean;
+  }>>;
+  serverId: string;
+  serverToken: string;
+  currentPocketBaseUrl: string;
+  isSubmitting: boolean;
+  onSubmit: (e: React.FormEvent) => void;
+}
+
+export const ServerAgentConfigForm: React.FC<ServerAgentConfigFormProps> = ({
+  formData,
+  setFormData,
+  serverId,
+  serverToken,
+  currentPocketBaseUrl,
+  isSubmitting,
+  onSubmit,
+}) => {
+  const { t } = useLanguage();
+
+  return (
+    <form onSubmit={onSubmit} className="space-y-4">
+      <div className="grid grid-cols-2 gap-4">
+        <div className="space-y-2">
+          <Label htmlFor="serverName">{t('serverName')} *</Label>
+          <Input
+            id="serverName"
+            placeholder={t('serverNamePlaceholder')}
+            value={formData.serverName}
+            onChange={(e) => setFormData(prev => ({ ...prev, serverName: e.target.value }))}
+            required
+          />
+          <p className="text-xs text-muted-foreground">{t('serverNameDesc')}</p>
+        </div>
+        
+        <div className="space-y-2">
+          <Label htmlFor="serverId">{t('serverAgentId')}</Label>
+          <div className="flex gap-2">
+            <Input
+              id="serverId"
+              value={serverId}
+              readOnly
+              className="font-mono text-sm bg-muted"
+            />
+            <Button
+              type="button"
+              variant="outline"
+              size="icon"
+              onClick={() => copyToClipboard(serverId)}
+            >
+              <Copy className="h-4 w-4" />
+            </Button>
+          </div>
+          <p className="text-xs text-muted-foreground">{t('serverAgentIdDesc')}</p>
+        </div>
+      </div>
+      
+      <div className="grid grid-cols-2 gap-4">
+        <div className="space-y-2">
+          <Label>{t('operatingSystem')} *</Label>
+          <OSSelector
+            value={formData.osType}
+            onValueChange={(value) => setFormData(prev => ({ ...prev, osType: value }))}
+          />
+        </div>
+
+        <div className="space-y-4">
+          <div className="space-y-2">
+            <Label htmlFor="checkInterval">{t('checkInterval')}</Label>
+            <Select
+              value={formData.checkInterval}
+              onValueChange={(value) => setFormData(prev => ({ ...prev, checkInterval: value }))}
+            >
+              <SelectTrigger>
+                <SelectValue placeholder={t('selectInterval')} />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="30">{t('interval30s')}</SelectItem>
+                <SelectItem value="60">{t('interval1m')}</SelectItem>
+                <SelectItem value="120">{t('interval2m')}</SelectItem>
+                <SelectItem value="300">{t('interval5m')}</SelectItem>
+              </SelectContent>
+            </Select>
+            <p className="text-xs text-muted-foreground">{t('checkIntervalDesc')}</p>
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="retryAttempt">{t('retryAttempts')}</Label>
+            <Select
+              value={formData.retryAttempt}
+              onValueChange={(value) => setFormData(prev => ({ ...prev, retryAttempt: value }))}
+            >
+              <SelectTrigger>
+                <SelectValue placeholder={t('selectRetryAttempts')} />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="1">{t('attempt1')}</SelectItem>
+                <SelectItem value="2">{t('attempt2')}</SelectItem>
+                <SelectItem value="3">{t('attempt3')}</SelectItem>
+                <SelectItem value="5">{t('attempt5')}</SelectItem>
+              </SelectContent>
+            </Select>
+            <p className="text-xs text-muted-foreground">{t('retryAttemptsDesc')}</p>
+          </div>
+
+          <div className="space-y-2">
+            <Label>{t('serverToken')}</Label>
+            <div className="flex gap-2">
+              <Input value={serverToken} readOnly className="font-mono text-sm bg-muted" />
+              <Button
+                type="button"
+                variant="outline"
+                size="icon"
+                onClick={() => copyToClipboard(serverToken)}
+              >
+                <Copy className="h-4 w-4" />
+              </Button>
+            </div>
+            <p className="text-xs text-muted-foreground">{t('serverTokenDesc')}</p>
+          </div>
+
+          <div className="space-y-2">
+            <Label>{t('systemUrl')}</Label>
+            <div className="flex gap-2">
+              <Input value={currentPocketBaseUrl} readOnly className="font-mono text-sm bg-muted" />
+              <Button
+                type="button"
+                variant="outline"
+                size="icon"
+                onClick={() => copyToClipboard(currentPocketBaseUrl)}
+              >
+                <Copy className="h-4 w-4" />
+              </Button>
+            </div>
+            <p className="text-xs text-muted-foreground">{t('systemUrlDesc')}</p>
+          </div>
+        </div>
+      </div>
+     
+      <div className="pt-4">
+        <Button type="submit" disabled={isSubmitting} className="w-full">
+          {isSubmitting ? t('creatingAgent') : t('createServerAgent')}
+        </Button>
+      </div>
+    </form>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/ServerHistoryCharts.tsx b/application/src/components/servers/ServerHistoryCharts.tsx
new file mode 100644
index 0000000..9f7c84b
--- /dev/null
+++ b/application/src/components/servers/ServerHistoryCharts.tsx
@@ -0,0 +1,167 @@
+
+import { useMemo } from "react";
+import { Card, CardContent } from "@/components/ui/card";
+import { Loader2, TrendingUp } from "lucide-react";
+import { TimeRangeSelector } from "./charts/TimeRangeSelector";
+import { useServerHistoryData } from "./charts/hooks/useServerHistoryData";
+import { CPUChart } from "./charts/CPUChart";
+import { MemoryChart } from "./charts/MemoryChart";
+import { DiskChart } from "./charts/DiskChart";
+import { NetworkChart } from "./charts/NetworkChart";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServerHistoryChartsProps {
+  serverId: string;
+}
+
+export const ServerHistoryCharts = ({ serverId }: ServerHistoryChartsProps) => {
+  const { t } = useLanguage();
+  const {
+    timeRange,
+    setTimeRange,
+    metrics,
+    chartData,
+    isLoading,
+    error,
+    isFetching
+  } = useServerHistoryData(serverId);
+
+ // console.log('ServerHistoryCharts: Rendering with serverId:', serverId, 'timeRange:', timeRange);
+
+  // Memoize latest data calculation to prevent unnecessary recalculations
+  const latestData = useMemo(() => {
+    return chartData.length > 0 ? chartData[chartData.length - 1] : null;
+  }, [chartData]);
+
+  // Show skeleton loading state for better UX
+  if (isLoading) {
+   return (
+      <div className="space-y-6">
+        <div className="flex items-center justify-between mb-4">
+          <div className="flex items-center gap-2">
+            <TrendingUp className="h-5 w-5" />
+            <h2 className="text-lg font-medium">{t("historicalPerformance")}</h2>
+            <div className="flex items-center gap-2 ml-2">
+              <Loader2 className="h-4 w-4 animate-spin" />
+              <span className="text-xs text-muted-foreground">{t("loading")}</span>
+            </div>
+          </div>
+          <TimeRangeSelector value={timeRange} onChange={setTimeRange} />
+        </div>
+        
+        {/* Skeleton loading cards */}
+        <div className="grid grid-cols-1 xl:grid-cols-2 gap-4 lg:gap-6">
+          {[1, 2, 3, 4].map((index) => (
+            <Card key={index} className="bg-gradient-to-br from-background to-muted/20">
+              <CardContent className="p-4 lg:p-6">
+                <div className="animate-pulse">
+                  <div className="flex items-center justify-between mb-4">
+                    <div className="flex items-center gap-3">
+                      <div className="w-8 h-8 bg-muted rounded-lg"></div>
+                      <div className="w-24 h-5 bg-muted rounded"></div>
+                    </div>
+                    <div className="w-16 h-4 bg-muted rounded"></div>
+                  </div>
+                  <div className="w-full h-64 lg:h-80 bg-muted rounded"></div>
+                </div>
+              </CardContent>
+            </Card>
+          ))}
+        </div>
+      </div>
+    );
+  }
+
+  if (error) {
+  //  console.error('ServerHistoryCharts: Error loading data:', error);
+    return (
+      <div className="space-y-4">
+        <div className="flex items-center justify-between">
+          <div className="flex items-center gap-2">
+            <TrendingUp className="h-5 w-5" />
+            <h2 className="text-lg font-medium">{t("historicalPerformance")}</h2>
+            {isFetching && <Loader2 className="h-4 w-4 animate-spin ml-2" />}
+          </div>
+          <TimeRangeSelector value={timeRange} onChange={setTimeRange} />
+        </div>
+        <Card>
+          <CardContent className="flex items-center justify-center py-12">
+            <div className="text-center">
+              <p className="text-muted-foreground">{t("errorLoadingChartData")}</p>
+              <p className="text-xs mt-2 font-mono text-red-500">{error?.message}</p>
+              <p className="text-xs mt-1 text-muted-foreground">{t("serverIdTimeRange", { serverId, timeRange })}</p>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+  if (chartData.length === 0) {
+    return (
+      <div className="space-y-4">
+        <div className="flex items-center justify-between">
+          <div className="flex items-center gap-2">
+            <TrendingUp className="h-5 w-5" />
+            <h2 className="text-lg font-medium">{t("historicalPerformance")}</h2>
+            {isFetching && <Loader2 className="h-4 w-4 animate-spin ml-2" />}
+          </div>
+          <TimeRangeSelector value={timeRange} onChange={setTimeRange} />
+        </div>
+        <Card>
+          <CardContent className="flex items-center justify-center py-12">
+            <div className="text-center">
+              <p className="text-muted-foreground">{t("noHistoricalData", { timeRange })}</p>
+              <p className="text-xs mt-2">{t("rawMetricsCount", { count: metrics.length })}</p>
+              <p className="text-xs mt-1">{t("serverIdTimeRange", { serverId, timeRange })}</p>
+              <p className="text-xs mt-1 text-muted-foreground">
+                {metrics.length > 0
+                  ? t("dataExistsOutsideRange")
+                  : t("noMetricsDataFound")}
+              </p>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+//  console.log('ServerHistoryCharts: Rendering charts with', chartData.length, 'data points for time range:', timeRange);
+
+  return (
+    <div className="space-y-6">
+      <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4">
+        <div className="flex items-center gap-2">
+          <TrendingUp className="h-5 w-5" />
+          <h2 className="text-lg font-medium">{t("historicalPerformance")}</h2>
+          <span className="text-xs text-muted-foreground">
+            ({chartData.length} data points • {timeRange})
+            {isFetching && (
+              <span className="inline-flex items-center gap-1 ml-2">
+                <Loader2 className="h-3 w-3 animate-spin" />
+                <span className="text-blue-500">{t("updating")}</span>
+              </span>
+            )}
+          </span>
+        </div>
+        <TimeRangeSelector value={timeRange} onChange={setTimeRange} />
+      </div>
+
+      {/* Improved responsive grid layout */}
+      <div className="grid grid-cols-1 xl:grid-cols-2 gap-4 lg:gap-6 auto-rows-fr">
+        <div className="w-full min-w-0">
+          <CPUChart data={chartData} latestData={latestData} />
+        </div>
+        <div className="w-full min-w-0">
+          <MemoryChart data={chartData} latestData={latestData} />
+        </div>
+        <div className="w-full min-w-0">
+          <DiskChart data={chartData} latestData={latestData} />
+        </div>
+        <div className="w-full min-w-0">
+          <NetworkChart data={chartData} latestData={latestData} />
+        </div>
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/ServerMetricsCharts.tsx b/application/src/components/servers/ServerMetricsCharts.tsx
new file mode 100644
index 0000000..1a60497
--- /dev/null
+++ b/application/src/components/servers/ServerMetricsCharts.tsx
@@ -0,0 +1,115 @@
+
+import { useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { serverService } from "@/services/serverService";
+import { Loader2, Cpu, HardDrive, Network, MemoryStick } from "lucide-react";
+import { formatChartData } from "./charts/dataUtils";
+import { TimeRangeSelector } from "./charts/TimeRangeSelector";
+import { CPUChart } from "./charts/CPUChart";
+import { MemoryChart } from "./charts/MemoryChart";
+import { DiskChart } from "./charts/DiskChart";
+import { NetworkChart } from "./charts/NetworkChart";
+
+interface ServerMetricsChartsProps {
+  serverId: string;
+}
+
+type TimeRange = '60m' | '1d' | '7d' | '1m' | '3m';
+
+export const ServerMetricsCharts = ({ serverId }: ServerMetricsChartsProps) => {
+  const [timeRange, setTimeRange] = useState<TimeRange>("1d");
+
+  const {
+    data: metrics = [],
+    isLoading,
+    error
+  } = useQuery({
+    queryKey: ['server-metrics', serverId, timeRange],
+    queryFn: () => serverService.getServerMetrics(serverId, timeRange),
+    enabled: !!serverId,
+    refetchInterval: timeRange === '60m' ? 60000 : timeRange === '1d' ? 120000 : 300000, // Increased intervals
+    staleTime: timeRange === '60m' ? 30000 : timeRange === '1d' ? 60000 : 120000, // Increased stale time
+    gcTime: 10 * 60 * 1000, // 10 minutes cache
+    refetchOnWindowFocus: false, // Prevent refetch on window focus
+  });
+
+  const chartData = formatChartData(metrics, timeRange);
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center justify-center h-96">
+        <Loader2 className="h-8 w-8 animate-spin" />
+        <span className="ml-2">Loading server metrics...</span>
+      </div>
+    );
+  }
+
+  if (error) {
+    return (
+      <div className="flex items-center justify-center h-96 text-muted-foreground">
+        <p>Error loading server metrics: {error.message}</p>
+      </div>
+    );
+  }
+
+  if (chartData.length === 0) {
+    return (
+      <div className="flex items-center justify-center h-96 text-muted-foreground">
+        <p>No server metrics data available for {timeRange}</p>
+      </div>
+    );
+  }
+
+  // Calculate latest data for each chart
+  const latestData = chartData[chartData.length - 1];
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <div className="flex items-center gap-2">
+          <h2 className="text-lg font-medium">Server Metrics</h2>
+          <span className="text-xs text-muted-foreground">({chartData.length} data points • {timeRange})</span>
+        </div>
+        <TimeRangeSelector value={timeRange} onChange={setTimeRange} />
+      </div>
+
+      <Tabs defaultValue="cpu" className="w-full">
+        <TabsList className="grid w-full grid-cols-4 bg-muted/50 backdrop-blur-sm">
+          <TabsTrigger value="cpu" className="flex items-center gap-2 data-[state=active]:bg-background data-[state=active]:shadow-sm">
+            <Cpu className="h-4 w-4" />
+            CPU
+          </TabsTrigger>
+          <TabsTrigger value="memory" className="flex items-center gap-2 data-[state=active]:bg-background data-[state=active]:shadow-sm">
+            <MemoryStick className="h-4 w-4" />
+            Memory
+          </TabsTrigger>
+          <TabsTrigger value="disk" className="flex items-center gap-2 data-[state=active]:bg-background data-[state=active]:shadow-sm">
+            <HardDrive className="h-4 w-4" />
+            Disk
+          </TabsTrigger>
+          <TabsTrigger value="network" className="flex items-center gap-2 data-[state=active]:bg-background data-[state=active]:shadow-sm">
+            <Network className="h-4 w-4" />
+            Network
+          </TabsTrigger>
+        </TabsList>
+
+        <TabsContent value="cpu" className="space-y-4 mt-6">
+          <CPUChart data={chartData} latestData={latestData} />
+        </TabsContent>
+
+        <TabsContent value="memory" className="space-y-4 mt-6">
+          <MemoryChart data={chartData} latestData={latestData} />
+        </TabsContent>
+
+        <TabsContent value="disk" className="space-y-4 mt-6">
+          <DiskChart data={chartData} latestData={latestData} />
+        </TabsContent>
+
+        <TabsContent value="network" className="space-y-4 mt-6">
+          <NetworkChart data={chartData} latestData={latestData} />
+        </TabsContent>
+      </Tabs>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/ServerMetricsOverview.tsx b/application/src/components/servers/ServerMetricsOverview.tsx
new file mode 100644
index 0000000..103edc8
--- /dev/null
+++ b/application/src/components/servers/ServerMetricsOverview.tsx
@@ -0,0 +1,259 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Server } from "@/types/server.types";
+import { Cpu, HardDrive, MemoryStick, Clock, Activity, Info } from "lucide-react";
+import { useTheme } from "@/contexts/ThemeContext";
+
+interface ServerMetricsOverviewProps {
+  server: Server;
+}
+
+export const ServerMetricsOverview = ({ server }: ServerMetricsOverviewProps) => {
+  const { theme } = useTheme();
+
+  const formatBytes = (bytes: number) => {
+    if (bytes === 0) return '0 B';
+    const k = 1024;
+    const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i];
+  };
+
+  const getStatusColor = (status: string) => {
+    switch (status) {
+      case 'up':
+        return 'text-green-500';
+      case 'down':
+        return 'text-red-500';
+      case 'warning':
+        return 'text-yellow-500';
+      default:
+        return 'text-muted-foreground';
+    }
+  };
+
+  const cpuUsagePercent = server.cpu_usage || 0;
+  const ramUsagePercent = server.ram_total > 0 ? (server.ram_used / server.ram_total) * 100 : 0;
+  const diskUsagePercent = server.disk_total > 0 ? (server.disk_used / server.disk_total) * 100 : 0;
+
+  const MetricCard = ({ title, used, total, free, percentage, icon: Icon, color, gradient, additionalInfo }: {
+    title: string;
+    used: string;
+    total: string;
+    free: string;
+    percentage: number;
+    icon: any;
+    color: string;
+    gradient: string;
+    additionalInfo?: string;
+  }) => (
+    <Card 
+      className="border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative"
+      style={{ background: gradient }}
+    >
+      {/* Grid Pattern Overlay */}
+      <div className="absolute inset-0 z-0 opacity-10">
+        <div 
+          className="w-full h-full" 
+          style={{ 
+            backgroundImage: `linear-gradient(rgba(255,255,255,0.1) 1px, transparent 1px), 
+                              linear-gradient(90deg, rgba(255,255,255,0.1) 1px, transparent 1px)`,
+            backgroundSize: '20px 20px'
+          }}
+        />
+      </div>
+      
+      <CardHeader className="pb-3 relative z-10">
+        <CardTitle className="flex items-center justify-between text-sm font-semibold">
+          <div className="flex items-center gap-3">
+            <div className="p-2.5 rounded-xl bg-white/20 backdrop-blur-sm shadow-sm transition-all duration-300 group-hover:scale-110">
+              <Icon className="h-4 w-4 text-white" />
+            </div>
+            <span className="text-white">{title}</span>
+          </div>
+          <div className="text-xs font-mono font-bold px-2 py-1 rounded-md bg-white/20 backdrop-blur-sm text-white border border-white/30">
+            {percentage.toFixed(1)}%
+          </div>
+        </CardTitle>
+      </CardHeader>
+      
+      <CardContent className="space-y-4 relative z-10">
+        <div className="grid grid-cols-2 gap-4 text-xs">
+          <div className="space-y-1">
+            <div className="flex justify-between">
+              <span className="text-white/70">Used:</span>
+              <span className="font-mono font-semibold text-white">{used}</span>
+            </div>
+            <div className="flex justify-between">
+              <span className="text-white/70">Free:</span>
+              <span className="font-mono font-semibold text-white">{free}</span>
+            </div>
+          </div>
+          <div className="space-y-1">
+            <div className="flex justify-between">
+              <span className="text-white/70">Total:</span>
+              <span className="font-mono font-semibold text-white">{total}</span>
+            </div>
+            {additionalInfo && (
+              <div className="flex justify-between">
+                <span className="text-white/70">Cores:</span>
+                <span className="font-mono font-semibold text-white">{additionalInfo}</span>
+              </div>
+            )}
+          </div>
+        </div>
+        
+        <div className="w-full bg-white/20 rounded-full h-3 overflow-hidden shadow-inner backdrop-blur-sm">
+          <div 
+            className="h-3 rounded-full transition-all duration-700 ease-out relative overflow-hidden bg-white/80"
+            style={{ width: `${Math.min(percentage, 100)}%` }}
+          >
+            <div className="absolute inset-0 bg-gradient-to-r from-transparent via-white/30 to-transparent animate-pulse" />
+            <div className="absolute inset-0 bg-gradient-to-t from-black/10 to-white/10" />
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  );
+
+  return (
+    <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 xl:grid-cols-5 gap-6">
+      {/* Status Card */}
+      <Card 
+        className="border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative"
+        style={{
+          background: theme === 'dark' 
+            ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(59, 130, 246, 0.6) 100%)" 
+            : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #3b82f6 100%)"
+        }}
+      >
+        {/* Grid Pattern Overlay */}
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div 
+            className="w-full h-full" 
+            style={{ 
+              backgroundImage: `linear-gradient(rgba(255,255,255,0.1) 1px, transparent 1px), 
+                                linear-gradient(90deg, rgba(255,255,255,0.1) 1px, transparent 1px)`,
+              backgroundSize: '20px 20px'
+            }}
+          />
+        </div>
+        
+        <CardHeader className="pb-3 relative z-10">
+          <CardTitle className="flex items-center gap-3 text-sm font-semibold">
+            <div className="p-2.5 rounded-xl bg-white/20 backdrop-blur-sm shadow-sm transition-all duration-300 group-hover:scale-110">
+              <Activity className="h-4 w-4 text-white" />
+            </div>
+            <span className="text-white">Status</span>
+          </CardTitle>
+        </CardHeader>
+        
+        <CardContent className="space-y-4 relative z-10">
+          <div className={`text-lg font-bold capitalize flex items-center gap-3 text-white`}>
+            <div className={`w-3 h-3 rounded-full ${server.status === 'up' ? 'bg-green-400' : server.status === 'down' ? 'bg-red-400' : 'bg-yellow-400'} animate-pulse shadow-sm`} />
+            {server.status}
+          </div>
+          <div className="space-y-2 text-xs">
+            <div className="flex justify-between py-1">
+              <span className="text-white/70">Agent:</span>
+              <span className="font-semibold text-white">{server.agent_status}</span>
+            </div>
+            <div className="flex justify-between py-1">
+              <span className="text-white/70">Connection:</span>
+              <span className="font-semibold text-white">{server.connection}</span>
+            </div>
+          </div>
+        </CardContent>
+      </Card>
+
+      {/* Uptime Card */}
+      <Card 
+        className="border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative"
+        style={{
+          background: theme === 'dark' 
+            ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(34, 197, 94, 0.6) 100%)" 
+            : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #22c55e 100%)"
+        }}
+      >
+        {/* Grid Pattern Overlay */}
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div 
+            className="w-full h-full" 
+            style={{ 
+              backgroundImage: `linear-gradient(rgba(255,255,255,0.1) 1px, transparent 1px), 
+                                linear-gradient(90deg, rgba(255,255,255,0.1) 1px, transparent 1px)`,
+              backgroundSize: '20px 20px'
+            }}
+          />
+        </div>
+        
+        <CardHeader className="pb-3 relative z-10">
+          <CardTitle className="flex items-center gap-3 text-sm font-semibold">
+            <div className="p-2.5 rounded-xl bg-white/20 backdrop-blur-sm shadow-sm transition-all duration-300 group-hover:scale-110">
+              <Clock className="h-4 w-4 text-white" />
+            </div>
+            <span className="text-white">Uptime</span>
+          </CardTitle>
+        </CardHeader>
+        
+        <CardContent className="space-y-4 relative z-10">
+          <div className="text-lg font-bold text-white">
+            {server.uptime}
+          </div>
+          <div className="text-xs text-white/70 space-y-1">
+            <div>Last Check:</div>
+            <div className="font-mono text-[10px] text-white/90 bg-white/10 px-2 py-1 rounded backdrop-blur-sm">
+              {new Date(server.last_checked).toLocaleString()}
+            </div>
+          </div>
+        </CardContent>
+      </Card>
+
+      {/* CPU Metric */}
+      <MetricCard
+        title="CPU"
+        used={`${cpuUsagePercent.toFixed(1)}%`}
+        total={`${server.cpu_cores} cores`}
+        free={`${(100 - cpuUsagePercent).toFixed(1)}%`}
+        percentage={cpuUsagePercent}
+        icon={Cpu}
+        color={theme === 'dark' ? "#3b82f6" : "#2563eb"}
+        gradient={theme === 'dark' 
+          ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(59, 130, 246, 0.6) 100%)" 
+          : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #3b82f6 100%)"
+        }
+        additionalInfo={server.cpu_cores?.toString()}
+      />
+
+      {/* Memory Metric */}
+      <MetricCard
+        title="Memory"
+        used={formatBytes(server.ram_used)}
+        total={formatBytes(server.ram_total)}
+        free={formatBytes(server.ram_total - server.ram_used)}
+        percentage={ramUsagePercent}
+        icon={MemoryStick}
+        color={theme === 'dark' ? "#10b981" : "#059669"}
+        gradient={theme === 'dark' 
+          ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(16, 185, 129, 0.6) 100%)" 
+          : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #10b981 100%)"
+        }
+      />
+
+      {/* Disk Metric */}
+      <MetricCard
+        title="Disk"
+        used={formatBytes(server.disk_used)}
+        total={formatBytes(server.disk_total)}
+        free={formatBytes(server.disk_total - server.disk_used)}
+        percentage={diskUsagePercent}
+        icon={HardDrive}
+        color={theme === 'dark' ? "#f59e0b" : "#d97706"}
+        gradient={theme === 'dark' 
+          ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(245, 158, 11, 0.6) 100%)" 
+          : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #f59e0b 100%)"
+        }
+      />
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/ServerStatsCards.tsx b/application/src/components/servers/ServerStatsCards.tsx
new file mode 100644
index 0000000..9febaeb
--- /dev/null
+++ b/application/src/components/servers/ServerStatsCards.tsx
@@ -0,0 +1,86 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Server, Activity, AlertTriangle, Power } from "lucide-react";
+import { ServerStats } from "@/types/server.types";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServerStatsCardsProps {
+  stats: ServerStats;
+}
+
+export const ServerStatsCards = ({ stats }: ServerStatsCardsProps) => {
+  const { t } = useLanguage();
+  const { theme } = useTheme();
+
+  const cards = [
+    {
+      title: t('totalServers', 'instance'),
+      value: stats.total,
+      icon: Server,
+      gradient: theme === 'dark' 
+        ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(160, 82, 45, 0.6) 100%)" 
+        : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #a0522d 100%)"
+    },
+    {
+      title: t('onlineServers', 'instance'),
+      value: stats.online,
+      icon: Activity,
+      gradient: theme === 'dark' 
+        ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(102, 187, 106, 0.6) 100%)" 
+        : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #66bb6a 100%)"
+    },
+    {
+      title: t('offlineServers', 'instance'),
+      value: stats.offline,
+      icon: Power,
+      gradient: theme === 'dark'
+        ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(239, 83, 80, 0.6) 100%)"
+        : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #ef5350 100%)"
+    },
+    {
+      title: t('warningServers', 'instance'),
+      value: stats.warning,
+      icon: AlertTriangle,
+      gradient: theme === 'dark'
+        ? "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, rgba(255, 183, 77, 0.6) 100%)"
+        : "linear-gradient(135deg, rgba(65, 59, 55, 0.8) 0%, #ffb74d 100%)"
+    }
+  ];
+
+  return (
+    <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 gap-6 mb-8 w-full">
+      {cards.map((card, index) => (
+        <Card 
+          key={index}
+          className={`border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 ${
+            theme === 'dark' ? 'dark-card' : ''
+          } relative z-10`}
+          style={{
+            background: card.gradient
+          }}
+        >
+          {/* Grid Pattern Overlay */}
+          <div className="absolute inset-0 z-0 opacity-10">
+            <div className="w-full h-full" 
+              style={{ 
+                backgroundImage: `linear-gradient(#000 1px, transparent 1px), 
+                                  linear-gradient(90deg, #fff 1px, transparent 1px)`,
+                backgroundSize: '20px 20px'
+              }}
+            ></div>
+          </div>
+          <CardHeader className="pb-2 relative z-10">
+            <CardTitle className="text-sm font-medium text-white">{card.title}</CardTitle>
+          </CardHeader>
+          <CardContent className="flex items-center justify-between relative z-10">
+            <span className="text-5xl font-bold text-white">{card.value}</span>
+            <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+              <card.icon className="h-6 w-6 text-white" />
+            </div>
+          </CardContent>
+        </Card>
+      ))}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/ServerStatusBadge.tsx b/application/src/components/servers/ServerStatusBadge.tsx
new file mode 100644
index 0000000..bdecfe5
--- /dev/null
+++ b/application/src/components/servers/ServerStatusBadge.tsx
@@ -0,0 +1,46 @@
+
+import { Badge } from "@/components/ui/badge";
+
+interface ServerStatusBadgeProps {
+  status: 'up' | 'down' | 'warning' | 'paused';
+}
+
+export const ServerStatusBadge = ({ status }: ServerStatusBadgeProps) => {
+  const getStatusConfig = (status: string) => {
+    switch (status) {
+      case 'up':
+        return {
+          label: 'Online',
+          className: 'bg-green-600 text-green-100 border-green-200'
+        };
+      case 'down':
+        return {
+          label: 'Offline',
+          className: 'bg-red-600 text-red-100 border-red-200'
+        };
+      case 'warning':
+        return {
+          label: 'Warning',
+          className: 'bg-yellow-600 text-yellow-800 border-yellow-200'
+        };
+        case 'paused':
+        return {
+          label: 'Paused',
+          className: 'bg-gray-600 text-gray-100 border-gray-200'
+        };
+      default:
+        return {
+          label: 'Unknown',
+          className: 'bg-gray-600 text-gray-100 border-gray-200'
+        };
+    }
+  };
+
+  const config = getStatusConfig(status);
+
+  return (
+    <Badge variant="outline" className={config.className}>
+      {config.label}
+    </Badge>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/ServerSystemInfoCard.tsx b/application/src/components/servers/ServerSystemInfoCard.tsx
new file mode 100644
index 0000000..002a849
--- /dev/null
+++ b/application/src/components/servers/ServerSystemInfoCard.tsx
@@ -0,0 +1,112 @@
+import { Card, CardContent } from "@/components/ui/card";
+import { Server, Monitor, Cpu, HardDrive, DatabaseIcon, InfoIcon } from "lucide-react";
+import { Server as ServerType } from "@/types/server.types";
+
+interface ServerSystemInfoCardProps {
+  server: ServerType;
+}
+
+export function ServerSystemInfoCard({ server }: ServerSystemInfoCardProps) {
+  // Parse system_info if it's a string
+  let systemInfo: any = {};
+  if (server.system_info) {
+    try {
+      systemInfo = typeof server.system_info === 'string' 
+        ? JSON.parse(server.system_info) 
+        : server.system_info;
+    } catch (error) {
+     // console.log('Error parsing system_info:', error);
+    }
+  }
+
+  const formatBytes = (bytes: number) => {
+    if (bytes === 0) return '0 Bytes';
+    const k = 1024;
+    const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+  };
+
+  const formatUptime = (uptimeSeconds: string | number) => {
+    const seconds = typeof uptimeSeconds === 'string' ? parseInt(uptimeSeconds) : uptimeSeconds;
+    const days = Math.floor(seconds / 86400);
+    const hours = Math.floor((seconds % 86400) / 3600);
+    const minutes = Math.floor((seconds % 3600) / 60);
+    
+    if (days > 0) return `${days}d ${hours}h`;
+    if (hours > 0) return `${hours}h ${minutes}m`;
+    return `${minutes}m`;
+  };
+
+  // Format the detailed system info string
+  const getDetailedSystemInfo = () => {
+    if (typeof server.system_info === 'string' && server.system_info.includes('|')) {
+      // If system_info is already in the detailed format, return it
+      return server.system_info;
+    }
+    
+    // Otherwise, build the detailed string from available data
+    const parts = [];
+    
+    // Basic server info
+    parts.push(server.hostname || 'Unknown');
+    parts.push(server.ip_address || 'Unknown IP');
+    parts.push(server.os_type || 'Unknown OS');
+    
+    // Parse additional info from system_info if available
+    if (systemInfo.OSName) {
+      parts.push(systemInfo.OSName + (systemInfo.OSVersion ? ` ${systemInfo.OSVersion}` : ''));
+    }
+    
+    if (systemInfo.Architecture) {
+      parts.push(`| ${systemInfo.Architecture}`);
+    }
+    
+    if (systemInfo.KernelVersion) {
+      parts.push(`| Kernel: ${systemInfo.KernelVersion}`);
+    }
+    
+    if (systemInfo.CPUModel) {
+      parts.push(`| CPU: ${systemInfo.CPUModel} (${server.cpu_cores || 0} cores)`);
+    } else if (server.cpu_cores) {
+      parts.push(`| CPU: ${server.cpu_cores} cores`);
+    }
+    
+    if (server.ram_total) {
+      parts.push(`| RAM: ${formatBytes(server.ram_total)}`);
+    }
+    
+    if (systemInfo.GoVersion) {
+      parts.push(`| Go ${systemInfo.GoVersion}`);
+    }
+    
+    if (systemInfo.IPAddress && systemInfo.IPAddress !== server.ip_address) {
+      parts.push(`| IP: ${systemInfo.IPAddress}`);
+    }
+    
+    // Check for Docker info
+    const dockerInfo = server.docker || systemInfo.Docker;
+    if (dockerInfo !== undefined) {
+      parts.push(`| Docker: ${dockerInfo}`);
+    }
+    
+    return parts.join(' • ').replace(/• \|/g, '|');
+  };
+
+  return (
+    <Card className="bg-card/50 backdrop-blur-sm border-border/50 max-w-md">
+      <CardContent className="p-4">
+        <div className="flex items-center gap-2 mb-3">
+          <div className="h-6 w-6 rounded bg-primary/10 flex items-center justify-center">
+            <InfoIcon className="h-3 w-3 text-primary" />
+          </div>
+          <h3 className="text-sm font-medium">System Information</h3>
+        </div>
+        
+        <div className="text-xs text-muted-foreground leading-relaxed break-all">
+          {getDetailedSystemInfo()}
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/servers/ServerTable.tsx b/application/src/components/servers/ServerTable.tsx
new file mode 100644
index 0000000..aa9ab03
--- /dev/null
+++ b/application/src/components/servers/ServerTable.tsx
@@ -0,0 +1,536 @@
+import { useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Checkbox } from "@/components/ui/checkbox";
+import { Input } from "@/components/ui/input";
+import { Badge } from "@/components/ui/badge";
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuSeparator, DropdownMenuTrigger } from "@/components/ui/dropdown-menu";
+import { AlertDialog, AlertDialogAction, AlertDialogCancel, AlertDialogContent, AlertDialogDescription, AlertDialogFooter, AlertDialogHeader, AlertDialogTitle } from "@/components/ui/alert-dialog";
+import { RefreshCw, Search, Eye, Activity, MoreHorizontal, Pause, Play, Edit, Trash2 } from "lucide-react";
+import { Server } from "@/types/server.types";
+import { ServerStatusBadge } from "./ServerStatusBadge";
+import { OSTypeIcon } from "./OSTypeIcon";
+import { EditServerDialog } from "./EditServerDialog";
+import { serverService } from "@/services/serverService";
+import { useToast } from "@/hooks/use-toast";
+import { pb } from "@/lib/pocketbase";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServerTableProps {
+  servers: Server[];
+  isLoading: boolean;
+  onRefresh: () => void;
+}
+
+export const ServerTable = ({ servers, isLoading, onRefresh }: ServerTableProps) => {
+  const { t } = useLanguage();
+  const { theme } = useTheme();
+  const [searchTerm, setSearchTerm] = useState("");
+  const [deleteDialogOpen, setDeleteDialogOpen] = useState(false);
+  const [editDialogOpen, setEditDialogOpen] = useState(false);
+  const [selectedServer, setSelectedServer] = useState<Server | null>(null);
+  const [isDeleting, setIsDeleting] = useState(false);
+  const [pausingServers, setPausingServers] = useState<Set<string>>(new Set());
+  const [selectedServerIds, setSelectedServerIds] = useState<Set<string>>(new Set());
+  const [bulkDeleteDialogOpen, setBulkDeleteDialogOpen] = useState(false);
+  const [isBulkDeleting, setIsBulkDeleting] = useState(false);
+  const navigate = useNavigate();
+  const { toast } = useToast();
+
+  const filteredServers = servers.filter(server =>
+    server.name.toLowerCase().includes(searchTerm.toLowerCase()) ||
+    server.hostname.toLowerCase().includes(searchTerm.toLowerCase()) ||
+    server.ip_address.toLowerCase().includes(searchTerm.toLowerCase())
+  );
+
+  const allVisibleSelected = filteredServers.length > 0 && filteredServers.every(s => selectedServerIds.has(s.id));
+  const someVisibleSelected = filteredServers.some(s => selectedServerIds.has(s.id)) && !allVisibleSelected;
+
+  const toggleSelectAllVisible = (checked: boolean) => {
+    const newSet = new Set(selectedServerIds);
+    if (checked) {
+      filteredServers.forEach(s => newSet.add(s.id));
+    } else {
+      filteredServers.forEach(s => newSet.delete(s.id));
+    }
+    setSelectedServerIds(newSet);
+  };
+
+  const toggleSelectOne = (serverId: string, checked: boolean) => {
+    const newSet = new Set(selectedServerIds);
+    if (checked) newSet.add(serverId); else newSet.delete(serverId);
+    setSelectedServerIds(newSet);
+  };
+
+  const handleViewDetails = (serverId: string) => {
+    navigate(`/server-detail/${serverId}`);
+  };
+
+  const handleViewContainers = (serverId: string) => {
+    navigate(`/container-monitoring/${serverId}`);
+  };
+
+  const handlePauseResume = async (server: Server) => {
+    const serverId = server.id;
+    const isPaused = server.status === "paused";
+    
+    if (pausingServers.has(serverId)) {
+      return; // Already processing this server
+    }
+
+    try {
+      setPausingServers(prev => new Set(prev).add(serverId));
+      
+      // Only update the status field, preserving all other server configuration
+      const updateData = {
+        status: isPaused ? "up" : "paused",
+        last_checked: new Date().toISOString()
+      };
+      
+      await pb.collection('servers').update(serverId, updateData);
+      
+      toast({
+        title: isPaused ? t('serverResumed') : t('serverPaused'),
+        description: isPaused ? t('monitoringResumed', { name: server.name }) : t('monitoringPaused', { name: server.name }),
+      });
+      
+     // console.log(`${isPaused ? 'Resume' : 'Pause'} server monitoring: ${serverId}`);
+      
+      // Refresh the server list to show updated status
+      onRefresh();
+      
+    } catch (error) {
+     // console.error('Error updating server status:', error);
+      toast({
+        variant: "destructive",
+        title: t('error'),
+        description: isPaused ? t('resumeServerError') : t('pauseServerError'),
+      });
+    } finally {
+      setPausingServers(prev => {
+        const newSet = new Set(prev);
+        newSet.delete(serverId);
+        return newSet;
+      });
+    }
+  };
+
+  const handleEdit = (server: Server) => {
+    setSelectedServer(server);
+    setEditDialogOpen(true);
+  };
+
+  const handleDelete = (server: Server) => {
+    setSelectedServer(server);
+    setDeleteDialogOpen(true);
+  };
+
+  const confirmDelete = async () => {
+    if (!selectedServer || isDeleting) return;
+
+    try {
+      setIsDeleting(true);
+      
+      // Delete the server from the database
+      await pb.collection('servers').delete(selectedServer.id);
+      
+      toast({
+        title: "Server deleted",
+        description: `${selectedServer.name} has been deleted successfully.`,
+      });
+      
+      // Refresh the server list
+      onRefresh();
+      
+      // Close the dialog
+      setDeleteDialogOpen(false);
+      setSelectedServer(null);
+      
+    } catch (error) {
+     // console.error('Error deleting server:', error);
+      toast({
+        variant: "destructive",
+        title: "Error",
+        description: "Failed to delete server. Please try again.",
+      });
+    } finally {
+      setIsDeleting(false);
+    }
+  };
+
+  const confirmBulkDelete = async () => {
+    if (selectedServerIds.size === 0 || isBulkDeleting) return;
+    try {
+      setIsBulkDeleting(true);
+      const ids = Array.from(selectedServerIds);
+      const deletions = ids.map(id => pb.collection('servers').delete(id));
+      const results = await Promise.allSettled(deletions);
+      const failed = results.filter(r => r.status === 'rejected').length;
+
+      if (failed === 0) {
+        toast({ title: "Servers deleted", description: `${ids.length} server(s) have been deleted.` });
+      } else if (failed === ids.length) {
+        toast({ variant: "destructive", title: "Error", description: "Failed to delete selected servers. Please try again." });
+      } else {
+        toast({ variant: "destructive", title: "Partial success", description: `Deleted ${ids.length - failed}, failed ${failed}.` });
+      }
+
+      onRefresh();
+      setSelectedServerIds(new Set());
+      setBulkDeleteDialogOpen(false);
+    } catch (_e) {
+      toast({ variant: "destructive", title: "Error", description: "Failed to delete selected servers. Please try again." });
+    } finally {
+      setIsBulkDeleting(false);
+    }
+  };
+
+  const CustomProgressBar = ({ 
+    value, 
+    label, 
+    subtitle, 
+    type 
+  }: { 
+    value: number; 
+    label: string; 
+    subtitle: string; 
+    type: 'cpu' | 'memory' | 'disk' 
+  }) => {
+    const getGradientColors = (type: string, value: number) => {
+      if (type === 'cpu') {
+        if (value > 90) return 'from-red-500 to-red-600';
+        if (value > 75) return 'from-orange-500 to-orange-600';
+        if (value > 60) return 'from-yellow-500 to-yellow-600';
+        return 'from-green-500 to-green-600';
+      }
+      if (type === 'memory') {
+        if (value > 90) return 'from-red-500 to-red-600';
+        if (value > 75) return 'from-yellow-500 to-yellow-600';
+        return 'from-blue-500 to-blue-600';
+      }
+      if (type === 'disk') {
+        if (value > 95) return 'from-red-500 to-red-600';
+        if (value > 85) return 'from-yellow-500 to-yellow-600';
+        return 'from-orange-500 to-orange-600';
+      }
+      return 'from-gray-500 to-gray-600';
+    };
+
+    const getTextColor = (value: number) => {
+      if (value > 90) return 'text-red-600 dark:text-red-400';
+      if (value > 75) return 'text-orange-600 dark:text-orange-400';
+      if (value > 60) return 'text-yellow-600 dark:text-yellow-400';
+      return 'text-green-600 dark:text-green-400';
+    };
+
+    return (
+      <div className="space-y-2 min-w-[120px]">
+        <div className="flex justify-between items-center">
+          <span className={`text-sm font-semibold ${getTextColor(value)}`}>
+            {label}
+          </span>
+          <span className="text-xs text-muted-foreground">
+            {subtitle}
+          </span>
+        </div>
+        <div className="relative">
+          <div className="w-full h-3 bg-muted/30 rounded-full overflow-hidden shadow-inner">
+            <div 
+              className={`h-full bg-gradient-to-r ${getGradientColors(type, value)} rounded-full transition-all duration-700 ease-out relative overflow-hidden`}
+              style={{ width: `${Math.min(value, 100)}%` }}
+            >
+              <div className="absolute inset-0 bg-gradient-to-r from-transparent via-white/20 to-transparent animate-pulse opacity-60" />
+              <div className="absolute inset-0 bg-gradient-to-t from-black/10 to-white/10" />
+            </div>
+          </div>
+          
+        </div>
+      </div>
+    );
+  };
+
+  if (isLoading) {
+    return (
+      <Card className="flex-1 flex flex-col">
+        <CardHeader className="flex-shrink-0">
+          <CardTitle>{t('servers')}</CardTitle>
+        </CardHeader>
+        <CardContent className="flex-1 flex items-center justify-center">
+          <div className="flex items-center justify-center h-32">
+            <RefreshCw className="h-6 w-6 animate-spin" />
+            <span className="ml-2">{t('loadingServers')}</span>
+          </div>
+        </CardContent>
+      </Card>
+    );
+  }
+
+  return (
+    <>
+      <Card className="bg-transparent border-0 shadow-none">
+        <CardHeader className="pb-4 px-0">
+          <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4">
+            <CardTitle className="text-xl font-semibold">{t('servers')}</CardTitle>
+            <div className="flex items-center gap-2">
+              <div className="relative flex-1 sm:w-64">
+                <Search className="absolute left-2 top-2.5 h-4 w-4 text-muted-foreground" />
+                <Input
+                  placeholder={t('searchServersPlaceholder')}
+                  value={searchTerm}
+                  onChange={(e) => setSearchTerm(e.target.value)}
+                  className="pl-8"
+                />
+              </div>
+              {selectedServerIds.size > 0 && (
+                <div className="hidden sm:block text-sm text-muted-foreground mr-2">
+                  {selectedServerIds.size} selected
+                </div>
+              )}
+              <Button
+                onClick={() => setBulkDeleteDialogOpen(true)}
+                variant="destructive"
+                disabled={selectedServerIds.size === 0}
+              >
+                Delete Selected
+              </Button>
+              <Button onClick={onRefresh} variant="outline" size="icon">
+                <RefreshCw className="h-4 w-4" />
+              </Button>
+            </div>
+          </div>
+        </CardHeader>
+        <CardContent className="p-0">
+          {filteredServers.length === 0 ? (
+            <div className="flex items-center justify-center p-8">
+              <p className="text-muted-foreground">{t('noServersFound')}</p>
+            </div>
+          ) : (
+            <div className={`${theme === 'dark' ? 'bg-gray-900' : 'bg-white'} rounded-lg border border-border shadow-sm`}>
+              <Table>
+                <TableHeader className={`${theme === 'dark' ? 'bg-gray-800' : 'bg-gray-50'}`}>
+                  <TableRow className={`${theme === 'dark' ? 'border-gray-700 hover:bg-gray-800' : 'border-gray-200 hover:bg-gray-100'}`}>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} w-10`}>
+                      <div onClick={(e) => e.stopPropagation()}>
+                        <Checkbox
+                          checked={allVisibleSelected}
+                          onCheckedChange={(v) => toggleSelectAllVisible(Boolean(v))}
+                          aria-label="Select all"
+                          indeterminate={someVisibleSelected}
+                        />
+                      </div>
+                    </TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('name')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('status')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('OS')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('IPAddress')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('CPU')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('memory')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('disk')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('uptime')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('lastChecked')}</TableHead>
+                    <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4 text-right`}>{t('actions')}</TableHead>
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
+                  {filteredServers.map((server) => {
+                    const cpuUsage = server.cpu_usage || 0;
+                    const memoryUsage = server.ram_total > 0 ? (server.ram_used / server.ram_total) * 100 : 0;
+                    const diskUsage = server.disk_total > 0 ? (server.disk_used / server.disk_total) * 100 : 0;
+                    const isPaused = server.status === "paused";
+                    const isProcessing = pausingServers.has(server.id);
+
+                    const isSelected = selectedServerIds.has(server.id);
+                    return (
+                      <TableRow 
+                        key={server.id} 
+                        className={`hover:bg-muted/50 cursor-pointer ${isSelected ? 'bg-muted/30' : ''}`}
+                        onClick={() => handleViewDetails(server.id)}
+                      >
+                        <TableCell onClick={(e) => e.stopPropagation()}>
+                          <Checkbox
+                            checked={isSelected}
+                            onCheckedChange={(v) => toggleSelectOne(server.id, Boolean(v))}
+                            aria-label={`Select ${server.name}`}
+                          />
+                        </TableCell>
+                        <TableCell className="font-medium">
+                          <div className="truncate" title={server.name}>
+                            {server.name}
+                          </div>
+                        </TableCell>
+                        <TableCell>
+                          <ServerStatusBadge status={server.status} />
+                        </TableCell>
+                        <TableCell>
+                          <div className="flex items-center gap-2">
+                            <OSTypeIcon osType={server.os_type} />
+                            <span className="text-sm truncate" title={server.os_type}>
+                              {server.os_type}
+                            </span>
+                          </div>
+                        </TableCell>
+                        <TableCell>
+                          <code className="text-sm bg-muted px-1 py-0.5 rounded text-xs">
+                            {server.ip_address}
+                          </code>
+                        </TableCell>
+                        <TableCell>
+                          <CustomProgressBar
+                            value={cpuUsage}
+                            label={`${cpuUsage.toFixed(1)}%`}
+                            subtitle={`${server.cpu_cores} cores`}
+                            type="cpu"
+                          />
+                        </TableCell>
+                        <TableCell>
+                          <CustomProgressBar
+                            value={memoryUsage}
+                            label={`${memoryUsage.toFixed(1)}%`}
+                            subtitle={serverService.formatBytes(server.ram_total)}
+                            type="memory"
+                          />
+                        </TableCell>
+                        <TableCell>
+                          <CustomProgressBar
+                            value={diskUsage}
+                            label={`${diskUsage.toFixed(1)}%`}
+                            subtitle={serverService.formatBytes(server.disk_total)}
+                            type="disk"
+                          />
+                        </TableCell>
+                        <TableCell>
+                          <div className="text-sm truncate" title={server.uptime}>
+                            {server.uptime}
+                          </div>
+                        </TableCell>
+                        <TableCell>
+                          <div className="text-sm text-muted-foreground text-xs">
+                            {new Date(server.last_checked).toLocaleString()}
+                          </div>
+                        </TableCell>
+                        <TableCell className="text-right" onClick={(e) => e.stopPropagation()}>
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <Button variant="ghost" className="h-8 w-8 p-0" disabled={isProcessing}>
+                                <span className="sr-only">{t('openMenu')}</span>
+                                {isProcessing ? (
+                                  <RefreshCw className="h-4 w-4 animate-spin" />
+                                ) : (
+                                  <MoreHorizontal className="h-4 w-4" />
+                                )}
+                              </Button>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end" className="w-[200px]">
+                              <DropdownMenuItem onClick={(e) => { e.stopPropagation(); handleViewDetails(server.id); }}>
+                                <Eye className="mr-2 h-4 w-4" />
+                                {t('viewServerDetail')}
+                              </DropdownMenuItem>
+                              {server.docker === 'true' && (
+                                <DropdownMenuItem onClick={(e) => { e.stopPropagation(); handleViewContainers(server.id); }}>
+                                  <Activity className="mr-2 h-4 w-4" />
+                                  {t('containerMonitoring')}
+                                </DropdownMenuItem>
+                              )}
+                              <DropdownMenuSeparator />
+                              <DropdownMenuItem 
+                                onClick={(e) => { e.stopPropagation(); handlePauseResume(server); }}
+                                disabled={isProcessing}
+                              >
+                                {isPaused ? (
+                                  <>
+                                    <Play className="mr-2 h-4 w-4" />
+                                    {t('resumeMonitoring')}
+                                  </>
+                                ) : (
+                                  <>
+                                    <Pause className="mr-2 h-4 w-4" />
+                                    {t('pauseMonitoring')}
+                                  </>
+                                )}
+                              </DropdownMenuItem>
+                              <DropdownMenuSeparator />
+                              <DropdownMenuItem onClick={(e) => { e.stopPropagation(); handleEdit(server); }}>
+                                <Edit className="mr-2 h-4 w-4" />
+                                {t('editServer')}
+                              </DropdownMenuItem>
+                              <DropdownMenuItem 
+                                onClick={(e) => { e.stopPropagation(); handleDelete(server); }}
+                                className="text-red-600 focus:text-red-600"
+                              >
+                                <Trash2 className="mr-2 h-4 w-4" />
+                                {t('deleteServer')}
+                              </DropdownMenuItem>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        </TableCell>
+                      </TableRow>
+                    );
+                  })}
+                </TableBody>
+              </Table>
+            </div>
+          )}
+        </CardContent>
+      </Card>
+
+      {/* Edit Server Dialog */}
+      <EditServerDialog
+        server={selectedServer}
+        open={editDialogOpen}
+        onOpenChange={setEditDialogOpen}
+        onServerUpdated={onRefresh}
+      />
+
+      {/* Delete Confirmation Dialog */}
+      <AlertDialog open={deleteDialogOpen} onOpenChange={setDeleteDialogOpen}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>{t('deleteServerConfirmTitle')}</AlertDialogTitle>
+            <AlertDialogDescription>
+              {t('deleteServerConfirmDesc').replace('{name}', selectedServer?.name ?? '')}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={isDeleting}>
+              {t('cancel')}
+            </AlertDialogCancel>
+            <AlertDialogAction
+              onClick={confirmDelete}
+              disabled={isDeleting}
+              className="bg-red-600 text-white hover:bg-red-700"
+            >
+              {isDeleting ? t('deleting') : t('delete')}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+
+      {/* Bulk Delete Confirmation Dialog */}
+      <AlertDialog open={bulkDeleteDialogOpen} onOpenChange={setBulkDeleteDialogOpen}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Delete selected servers?</AlertDialogTitle>
+            <AlertDialogDescription>
+              This action cannot be undone. This will permanently delete {selectedServerIds.size} server(s) and all of their monitoring data.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={isBulkDeleting}>
+              {t('cancel')}
+            </AlertDialogCancel>
+            <AlertDialogAction
+              onClick={confirmBulkDelete}
+              disabled={isBulkDeleting}
+              className="bg-red-600 text-white hover:bg-red-700"
+            >
+              {isBulkDeleting ? t('deleting') : 'Delete Selected'}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </>
+  );
+};
diff --git a/application/src/components/servers/charts/CPUChart.tsx b/application/src/components/servers/charts/CPUChart.tsx
new file mode 100644
index 0000000..29dff23
--- /dev/null
+++ b/application/src/components/servers/charts/CPUChart.tsx
@@ -0,0 +1,80 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { ChartContainer, ChartTooltip } from "@/components/ui/chart";
+import { AreaChart, Area, XAxis, YAxis, CartesianGrid, ResponsiveContainer } from "recharts";
+import { Cpu } from "lucide-react";
+import { useTheme } from "@/contexts/ThemeContext";
+import { DetailedTooltipContent } from "./tooltips/DetailedTooltipContent";
+
+interface CPUChartProps {
+  data: any[];
+  latestData?: any;
+}
+
+export const CPUChart = ({ data, latestData }: CPUChartProps) => {
+  const { theme } = useTheme();
+
+  const getGridColor = () => theme === 'dark' ? '#374151' : '#e5e7eb';
+  const getAxisColor = () => theme === 'dark' ? '#9ca3af' : '#6b7280';
+
+  return (
+    <Card className="bg-gradient-to-br from-background to-muted/20 border-border/50 shadow-lg hover:shadow-xl transition-all duration-300 backdrop-blur-sm h-full flex flex-col">
+      <CardHeader className="pb-2 flex-shrink-0">
+        <CardTitle className="flex items-center justify-between text-foreground">
+          <div className="flex items-center gap-2">
+            <div className="p-2 rounded-lg bg-blue-500/15">
+              <Cpu className="h-4 w-4 lg:h-5 lg:w-5 text-blue-500" />
+            </div>
+            <span className="text-sm lg:text-base">CPU Usage</span>
+          </div>
+          {latestData && (
+            <div className="text-right text-xs lg:text-sm">
+              <div className="text-blue-500 font-semibold">{latestData.cpuUsage}%</div>
+              <div className="text-xs text-muted-foreground">{latestData.cpuCores} cores</div>
+            </div>
+          )}
+        </CardTitle>
+      </CardHeader>
+      <CardContent className="pt-2 flex-1 min-h-0">
+        <div className="w-full h-full min-h-[240px] lg:min-h-[320px]">
+          <ResponsiveContainer width="100%" height="100%">
+            <AreaChart data={data} margin={{ top: 5, right: 5, left: 5, bottom: 5 }}>
+              <defs>
+                <linearGradient id="cpuGradient" x1="0" y1="0" x2="0" y2="1">
+                  <stop offset="5%" stopColor={theme === 'dark' ? "#3b82f6" : "#2563eb"} stopOpacity={0.4}/>
+                  <stop offset="95%" stopColor={theme === 'dark' ? "#1e40af" : "#1d4ed8"} stopOpacity={0.1}/>
+                </linearGradient>
+              </defs>
+              <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} opacity={0.3} />
+              <XAxis 
+                dataKey="timestamp" 
+                tick={{ fontSize: 10, fill: getAxisColor() }}
+                axisLine={{ stroke: getGridColor() }}
+              />
+              <YAxis 
+                domain={[0, 100]}
+                tick={{ fontSize: 10, fill: getAxisColor() }}
+                axisLine={{ stroke: getGridColor() }}
+                label={{ value: 'CPU %', angle: -90, position: 'insideLeft' }}
+              />
+              <ChartTooltip 
+                content={<DetailedTooltipContent />}
+                cursor={{ stroke: getGridColor() }}
+              />
+              <Area 
+                type="monotone" 
+                dataKey="cpuUsage" 
+                stroke={theme === 'dark' ? "#60a5fa" : "#2563eb"}
+                strokeWidth={2}
+                dot={false}
+                fill="url(#cpuGradient)"
+                fillOpacity={1}
+                name="CPU Usage (%)"
+              />
+            </AreaChart>
+          </ResponsiveContainer>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/charts/DiskChart.tsx b/application/src/components/servers/charts/DiskChart.tsx
new file mode 100644
index 0000000..d94098c
--- /dev/null
+++ b/application/src/components/servers/charts/DiskChart.tsx
@@ -0,0 +1,80 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { ChartContainer, ChartTooltip } from "@/components/ui/chart";
+import { AreaChart, Area, XAxis, YAxis, CartesianGrid, ResponsiveContainer } from "recharts";
+import { HardDrive } from "lucide-react";
+import { useTheme } from "@/contexts/ThemeContext";
+import { DetailedTooltipContent } from "./tooltips/DetailedTooltipContent";
+
+interface DiskChartProps {
+  data: any[];
+  latestData?: any;
+}
+
+export const DiskChart = ({ data, latestData }: DiskChartProps) => {
+  const { theme } = useTheme();
+
+  const getGridColor = () => theme === 'dark' ? '#374151' : '#e5e7eb';
+  const getAxisColor = () => theme === 'dark' ? '#9ca3af' : '#6b7280';
+
+  return (
+    <Card className="bg-gradient-to-br from-background to-muted/20 border-border/50 shadow-lg hover:shadow-xl transition-all duration-300 backdrop-blur-sm h-full flex flex-col">
+      <CardHeader className="pb-2 flex-shrink-0">
+        <CardTitle className="flex items-center justify-between text-foreground">
+          <div className="flex items-center gap-2">
+            <div className="p-2 rounded-lg bg-amber-500/15">
+              <HardDrive className="h-4 w-4 lg:h-5 lg:w-5 text-amber-500" />
+            </div>
+            <span className="text-sm lg:text-base">Disk Usage</span>
+          </div>
+          {latestData && (
+            <div className="text-right text-xs lg:text-sm">
+              <div className="text-amber-500 font-semibold">{latestData.diskUsagePercent}%</div>
+              <div className="text-xs text-muted-foreground">{latestData.diskUsed} / {latestData.diskTotal}</div>
+            </div>
+          )}
+        </CardTitle>
+      </CardHeader>
+      <CardContent className="pt-2 flex-1 min-h-0">
+        <div className="w-full h-full min-h-[240px] lg:min-h-[320px]">
+          <ResponsiveContainer width="100%" height="100%">
+            <AreaChart data={data} margin={{ top: 5, right: 5, left: 5, bottom: 5 }}>
+              <defs>
+                <linearGradient id="diskGradient" x1="0" y1="0" x2="0" y2="1">
+                  <stop offset="5%" stopColor={theme === 'dark' ? "#f59e0b" : "#d97706"} stopOpacity={0.6}/>
+                  <stop offset="95%" stopColor={theme === 'dark' ? "#d97706" : "#b45309"} stopOpacity={0.1}/>
+                </linearGradient>
+              </defs>
+              <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} opacity={0.3} />
+              <XAxis 
+                dataKey="timestamp" 
+                tick={{ fontSize: 10, fill: getAxisColor() }}
+                axisLine={{ stroke: getGridColor() }}
+              />
+              <YAxis 
+                domain={[0, 100]}
+                tick={{ fontSize: 10, fill: getAxisColor() }}
+                axisLine={{ stroke: getGridColor() }}
+                label={{ value: 'Disk %', angle: -90, position: 'insideLeft' }}
+              />
+              <ChartTooltip 
+                content={<DetailedTooltipContent />}
+                cursor={{ stroke: getGridColor() }}
+              />
+              <Area 
+                type="step" 
+                dataKey="diskUsagePercent" 
+                stroke={theme === 'dark' ? "#fbbf24" : "#d97706"}
+                strokeWidth={2}
+                dot={false}
+                fill="url(#diskGradient)"
+                fillOpacity={1}
+                name="Disk Usage (%)"
+              />
+            </AreaChart>
+          </ResponsiveContainer>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/charts/MemoryChart.tsx b/application/src/components/servers/charts/MemoryChart.tsx
new file mode 100644
index 0000000..be341ff
--- /dev/null
+++ b/application/src/components/servers/charts/MemoryChart.tsx
@@ -0,0 +1,80 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { ChartContainer, ChartTooltip } from "@/components/ui/chart";
+import { AreaChart, Area, XAxis, YAxis, CartesianGrid, ResponsiveContainer } from "recharts";
+import { MemoryStick } from "lucide-react";
+import { useTheme } from "@/contexts/ThemeContext";
+import { DetailedTooltipContent } from "./tooltips/DetailedTooltipContent";
+
+interface MemoryChartProps {
+  data: any[];
+  latestData?: any;
+}
+
+export const MemoryChart = ({ data, latestData }: MemoryChartProps) => {
+  const { theme } = useTheme();
+
+  const getGridColor = () => theme === 'dark' ? '#374151' : '#e5e7eb';
+  const getAxisColor = () => theme === 'dark' ? '#9ca3af' : '#6b7280';
+
+  return (
+    <Card className="bg-gradient-to-br from-background to-muted/20 border-border/50 shadow-lg hover:shadow-xl transition-all duration-300 backdrop-blur-sm h-full flex flex-col">
+      <CardHeader className="pb-2 flex-shrink-0">
+        <CardTitle className="flex items-center justify-between text-foreground">
+          <div className="flex items-center gap-2">
+            <div className="p-2 rounded-lg bg-green-500/15">
+              <MemoryStick className="h-4 w-4 lg:h-5 lg:w-5 text-green-500" />
+            </div>
+            <span className="text-sm lg:text-base">Memory Usage</span>
+          </div>
+          {latestData && (
+            <div className="text-right text-xs lg:text-sm">
+              <div className="text-green-500 font-semibold">{latestData.ramUsagePercent}%</div>
+              <div className="text-xs text-muted-foreground">{latestData.ramUsed} / {latestData.ramTotal}</div>
+            </div>
+          )}
+        </CardTitle>
+      </CardHeader>
+      <CardContent className="pt-2 flex-1 min-h-0">
+        <div className="w-full h-full min-h-[240px] lg:min-h-[320px]">
+          <ResponsiveContainer width="100%" height="100%">
+            <AreaChart data={data} margin={{ top: 5, right: 5, left: 5, bottom: 5 }}>
+              <defs>
+                <linearGradient id="memoryGradient" x1="0" y1="0" x2="0" y2="1">
+                  <stop offset="5%" stopColor={theme === 'dark' ? "#10b981" : "#059669"} stopOpacity={0.5}/>
+                  <stop offset="95%" stopColor={theme === 'dark' ? "#047857" : "#065f46"} stopOpacity={0.1}/>
+                </linearGradient>
+              </defs>
+              <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} opacity={0.3} />
+              <XAxis 
+                dataKey="timestamp" 
+                tick={{ fontSize: 10, fill: getAxisColor() }}
+                axisLine={{ stroke: getGridColor() }}
+              />
+              <YAxis 
+                domain={[0, 100]}
+                tick={{ fontSize: 10, fill: getAxisColor() }}
+                axisLine={{ stroke: getGridColor() }}
+                label={{ value: 'Memory %', angle: -90, position: 'insideLeft' }}
+              />
+              <ChartTooltip 
+                content={<DetailedTooltipContent />}
+                cursor={{ stroke: getGridColor() }}
+              />
+              <Area 
+                type="basis" 
+                dataKey="ramUsagePercent" 
+                stroke={theme === 'dark' ? "#34d399" : "#059669"}
+                strokeWidth={2}
+                dot={false}
+                fill="url(#memoryGradient)"
+                fillOpacity={1}
+                name="Memory Usage (%)"
+              />
+            </AreaChart>
+          </ResponsiveContainer>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/charts/NetworkChart.tsx b/application/src/components/servers/charts/NetworkChart.tsx
new file mode 100644
index 0000000..69985d6
--- /dev/null
+++ b/application/src/components/servers/charts/NetworkChart.tsx
@@ -0,0 +1,95 @@
+
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { ChartContainer, ChartTooltip } from "@/components/ui/chart";
+import { LineChart, Line, XAxis, YAxis, CartesianGrid, ResponsiveContainer } from "recharts";
+import { Wifi } from "lucide-react";
+import { useTheme } from "@/contexts/ThemeContext";
+import { NetworkTooltipContent } from "./tooltips/NetworkTooltipContent";
+
+interface NetworkChartProps {
+  data: any[];
+  latestData?: any;
+}
+
+export const NetworkChart = ({ data, latestData }: NetworkChartProps) => {
+  const { theme } = useTheme();
+
+  const getGridColor = () => theme === 'dark' ? '#374151' : '#e5e7eb';
+  const getAxisColor = () => theme === 'dark' ? '#9ca3af' : '#6b7280';
+
+  return (
+    <Card className="bg-gradient-to-br from-background to-muted/20 border-border/50 shadow-lg hover:shadow-xl transition-all duration-300 backdrop-blur-sm h-full flex flex-col">
+      <CardHeader className="pb-2 flex-shrink-0">
+        <CardTitle className="flex items-center justify-between text-foreground">
+          <div className="flex items-center gap-2">
+            <div className="p-2 rounded-lg bg-purple-500/15">
+              <Wifi className="h-4 w-4 lg:h-5 lg:w-5 text-purple-500" />
+            </div>
+            <span className="text-sm lg:text-base">Network Traffic</span>
+          </div>
+          {latestData && (
+            <div className="text-right text-xs lg:text-sm">
+              <div className="text-purple-500 font-semibold">{latestData.networkRxSpeed} KB/s ↓</div>
+              <div className="text-red-500 font-semibold">{latestData.networkTxSpeed} KB/s ↑</div>
+            </div>
+          )}
+        </CardTitle>
+      </CardHeader>
+      <CardContent className="pt-2 flex-1 min-h-0">
+        <div className="w-full h-full min-h-[240px] lg:min-h-[320px]">
+          <ResponsiveContainer width="100%" height="100%">
+            <LineChart data={data} margin={{ top: 5, right: 5, left: 5, bottom: 5 }}>
+              <defs>
+                <linearGradient id="networkGradient" x1="0" y1="0" x2="0" y2="1">
+                  <stop offset="5%" stopColor={theme === 'dark' ? "#8b5cf6" : "#7c3aed"} stopOpacity={0.2}/>
+                  <stop offset="95%" stopColor={theme === 'dark' ? "#7c3aed" : "#6d28d9"} stopOpacity={0.05}/>
+                </linearGradient>
+                <filter id="glow">
+                  <feGaussianBlur stdDeviation="2" result="coloredBlur"/>
+                  <feMerge> 
+                    <feMergeNode in="coloredBlur"/>
+                    <feMergeNode in="SourceGraphic"/>
+                  </feMerge>
+                </filter>
+              </defs>
+              <CartesianGrid strokeDasharray="3 3" stroke={getGridColor()} opacity={0.3} />
+              <XAxis 
+                dataKey="timestamp" 
+                tick={{ fontSize: 10, fill: getAxisColor() }}
+                axisLine={{ stroke: getGridColor() }}
+              />
+              <YAxis 
+                tick={{ fontSize: 10, fill: getAxisColor() }}
+                axisLine={{ stroke: getGridColor() }}
+                label={{ value: 'Network Speed (KB/s)', angle: -90, position: 'insideLeft' }}
+              />
+              <ChartTooltip 
+                content={<NetworkTooltipContent />}
+                cursor={{ stroke: getGridColor() }}
+              />
+              <Line 
+                type="monotone" 
+                dataKey="networkRxSpeed" 
+                stroke={theme === 'dark' ? "#a78bfa" : "#7c3aed"}
+                strokeWidth={2}
+                dot={false}
+                name="RX Speed"
+                filter="url(#glow)"
+                strokeDasharray="0"
+              />
+              <Line 
+                type="monotone" 
+                dataKey="networkTxSpeed" 
+                stroke={theme === 'dark' ? "#f87171" : "#dc2626"}
+                strokeWidth={2}
+                dot={false}
+                name="TX Speed"
+                strokeDasharray="5 5"
+              />
+            </LineChart>
+          </ResponsiveContainer>
+        </div>
+      </CardContent>
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/charts/TimeRangeSelector.tsx b/application/src/components/servers/charts/TimeRangeSelector.tsx
new file mode 100644
index 0000000..7a9f5f2
--- /dev/null
+++ b/application/src/components/servers/charts/TimeRangeSelector.tsx
@@ -0,0 +1,34 @@
+
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+
+type TimeRange = '60m' | '1d' | '7d' | '1m' | '3m';
+
+interface TimeRangeSelectorProps {
+  value: TimeRange;
+  onChange: (value: TimeRange) => void;
+}
+
+const timeRangeOptions = [
+  { value: '60m' as TimeRange, label: 'Last 60 minutes' },
+  { value: '1d' as TimeRange, label: 'Last 24 hours' },
+  { value: '7d' as TimeRange, label: 'Last 7 days' },
+  { value: '1m' as TimeRange, label: 'Last 30 days' },
+  { value: '3m' as TimeRange, label: 'Last 90 days' },
+];
+
+export const TimeRangeSelector = ({ value, onChange }: TimeRangeSelectorProps) => {
+  return (
+    <Select value={value} onValueChange={(value: TimeRange) => onChange(value)}>
+      <SelectTrigger className="w-[160px] h-8">
+        <SelectValue />
+      </SelectTrigger>
+      <SelectContent>
+        {timeRangeOptions.map((option) => (
+          <SelectItem key={option.value} value={option.value}>
+            {option.label}
+          </SelectItem>
+        ))}
+      </SelectContent>
+    </Select>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/charts/dataUtils.ts b/application/src/components/servers/charts/dataUtils.ts
new file mode 100644
index 0000000..4f3355e
--- /dev/null
+++ b/application/src/components/servers/charts/dataUtils.ts
@@ -0,0 +1,274 @@
+export const formatBytes = (bytes: number, decimals = 2) => {
+  if (bytes === 0) return '0 B';
+  const k = 1024;
+  const dm = decimals < 0 ? 0 : decimals;
+  const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(dm)) + ' ' + sizes[i];
+};
+
+export const parseValueWithUnit = (value: string | number): { numeric: number; unit: string; original: string } => {
+  if (typeof value === 'number') {
+    return { numeric: value, unit: 'B', original: value.toString() };
+  }
+  
+  const str = value.toString();
+  const match = str.match(/^([\d.]+)\s*([A-Za-z%]*)/);
+  if (match) {
+    const numeric = parseFloat(match[1]);
+    const unit = match[2] || '';
+    return { numeric, unit, original: str };
+  }
+  return { numeric: 0, unit: '', original: str };
+};
+
+export const convertToBytes = (value: string | number): number => {
+  if (typeof value === 'number') return value;
+  
+  const parsed = parseValueWithUnit(value);
+  const multipliers: { [key: string]: number } = {
+    'B': 1,
+    'KB': 1024,
+    'MB': 1024 * 1024,
+    'GB': 1024 * 1024 * 1024,
+    'TB': 1024 * 1024 * 1024 * 1024
+  };
+  
+  const multiplier = multipliers[parsed.unit.toUpperCase()] || 1;
+  return parsed.numeric * multiplier;
+};
+
+type TimeRange = '60m' | '1d' | '7d' | '1m' | '3m';
+
+export const timeRangeOptions = [
+  { value: '60m' as TimeRange, label: 'Last 60 minutes', hours: 1 },
+  { value: '1d' as TimeRange, label: 'Last 24 hours', hours: 24 },
+  { value: '7d' as TimeRange, label: 'Last 7 days', hours: 24 * 7 },
+  { value: '1m' as TimeRange, label: 'Last 30 days', hours: 24 * 30 },
+  { value: '3m' as TimeRange, label: 'Last 90 days', hours: 24 * 90 },
+];
+
+export const filterMetricsByTimeRange = (metrics: any[], timeRange: TimeRange): any[] => {
+  if (!metrics?.length) {
+   // console.log('🔍 filterMetricsByTimeRange: No metrics provided');
+    return [];
+  }
+  
+  //console.log('🔍 filterMetricsByTimeRange: Starting with', metrics.length, 'metrics for', timeRange);
+  
+  const now = new Date();
+  
+  // For 60m, let's be very specific about what we're looking for
+  if (timeRange === '60m') {
+   // console.log('⏰ 60m filter: Current time:', now.toISOString());
+    
+    // Try exact 60 minutes first
+    const cutoffTime60m = new Date(now.getTime() - (60 * 60 * 1000));
+   // console.log('⏰ 60m filter: Cutoff time:', cutoffTime60m.toISOString());
+    
+    const filtered60m = metrics.filter(metric => {
+      const metricTime = new Date(metric.created || metric.timestamp);
+      const isWithinRange = metricTime >= cutoffTime60m && metricTime <= now;
+      
+      if (!isWithinRange) {
+        const ageMinutes = Math.round((now.getTime() - metricTime.getTime()) / (1000 * 60));
+      //  console.log('⏰ Excluding record:', {
+       //   created: metric.created || metric.timestamp,
+       //   ageMinutes: ageMinutes,
+       //   reason: ageMinutes > 60 ? 'too old' : 'future date'
+       // });
+      }
+      
+      return isWithinRange;
+    });
+    
+   // console.log('✅ 60m strict filter result:', filtered60m.length, 'records');
+    
+    if (filtered60m.length > 0) {
+      return filtered60m.sort((a, b) => 
+        new Date(a.created || a.timestamp).getTime() - new Date(b.created || b.timestamp).getTime()
+      );
+    }
+    
+    // If no data in exactly 60m, show what we have and return it anyway for debugging
+   // console.log('⚠️ No data in 60m range, showing all available data ages:');
+    metrics.forEach((metric, index) => {
+      const metricTime = new Date(metric.created || metric.timestamp);
+      const ageMinutes = Math.round((now.getTime() - metricTime.getTime()) / (1000 * 60));
+    //  console.log(`Record ${index}: ${metric.created || metric.timestamp} (${ageMinutes} minutes ago)`);
+    });
+    
+    // Return the most recent data regardless of age
+    const sorted = metrics.sort((a, b) => 
+      new Date(b.created || b.timestamp).getTime() - new Date(a.created || a.timestamp).getTime()
+    );
+   // console.log('🔄 Returning most recent available data for 60m view');
+    return sorted.slice(0, 20); // Show last 20 records
+  }
+  
+  // For other time ranges, use normal filtering
+  const selectedRange = timeRangeOptions.find(opt => opt.value === timeRange);
+  if (!selectedRange) return metrics;
+
+  const cutoffTime = new Date(now.getTime() - (selectedRange.hours * 60 * 60 * 1000));
+  
+  const filtered = metrics.filter(metric => {
+    const metricTime = new Date(metric.created || metric.timestamp);
+    return metricTime >= cutoffTime && metricTime <= now;
+  });
+  
+ // console.log('✅ Filtered', metrics.length, 'to', filtered.length, 'metrics for', timeRange);
+  
+  return filtered.sort((a, b) => 
+    new Date(a.created || a.timestamp).getTime() - new Date(b.created || b.timestamp).getTime()
+  );
+};
+
+const timestampCache = new Map<string, string>();
+
+const formatTimestamp = (timestamp: string, timeRange: TimeRange): string => {
+  const cacheKey = `${timestamp}-${timeRange}`;
+  if (timestampCache.has(cacheKey)) {
+    return timestampCache.get(cacheKey)!;
+  }
+  
+  const date = new Date(timestamp);
+  let formatted: string;
+  
+  if (timeRange === '60m') {
+    formatted = date.toLocaleString('en-US', { 
+      hour: '2-digit',
+      minute: '2-digit',
+      second: '2-digit',
+      hour12: false
+    });
+  } else if (timeRange === '1d') {
+    formatted = date.toLocaleString('en-US', { 
+      month: 'short',
+      day: 'numeric',
+      hour: '2-digit', 
+      minute: '2-digit',
+      hour12: false
+    });
+  } else if (timeRange === '7d') {
+    formatted = date.toLocaleString('en-US', { 
+      month: 'short',
+      day: 'numeric',
+      hour: '2-digit',
+      hour12: false
+    });
+  } else {
+    formatted = date.toLocaleString('en-US', { 
+      month: 'short',
+      day: 'numeric',
+      year: '2-digit'
+    });
+  }
+  
+  if (timestampCache.size > 1000) {
+    timestampCache.clear();
+  }
+  timestampCache.set(cacheKey, formatted);
+  
+  return formatted;
+};
+
+export const formatChartData = (metrics: any[], timeRange: TimeRange) => {
+ // console.log('📊 formatChartData: Processing', {
+  //  inputCount: metrics?.length || 0,
+ //   timeRange,
+ //   sampleMetric: metrics?.[0] ? {
+  //    id: metrics[0].id,
+  //    created: metrics[0].created,
+  //    timestamp: metrics[0].timestamp,
+  //    server_id: metrics[0].server_id
+  //  } : null
+ // });
+  
+  if (!metrics?.length) {
+  //  console.log('❌ formatChartData: No metrics provided');
+    return [];
+  }
+  
+  const filteredMetrics = filterMetricsByTimeRange(metrics, timeRange);
+ // console.log('📊 formatChartData: After time filtering:', filteredMetrics?.length || 0, 'metrics');
+  
+  if (!filteredMetrics.length) {
+  //  console.log('❌ formatChartData: No metrics after time filtering');
+    return [];
+  }
+  
+  // Dynamic sampling based on time range and data volume
+  let maxDataPoints: number;
+  switch (timeRange) {
+    case '60m': maxDataPoints = 60; break;
+    case '1d': maxDataPoints = 144; break;
+    case '7d': maxDataPoints = 168; break;
+    case '1m': maxDataPoints = 120; break;
+    case '3m': maxDataPoints = 90; break;
+    default: maxDataPoints = 100;
+  }
+  
+  const sampledMetrics = filteredMetrics.length > maxDataPoints * 1.2
+    ? filteredMetrics.filter((_, index) => index % Math.ceil(filteredMetrics.length / maxDataPoints) === 0)
+    : filteredMetrics;
+  
+ // console.log('📊 formatChartData: After sampling:', sampledMetrics.length, 'metrics for display');
+  
+  const formattedData = sampledMetrics.map((metric) => {
+    const cpuUsage = typeof metric.cpu_usage === 'string' ? 
+      parseFloat(metric.cpu_usage.replace('%', '')) : 
+      parseFloat(metric.cpu_usage) || 0;
+
+    const ramUsedBytes = convertToBytes(metric.ram_used);
+    const ramTotalBytes = convertToBytes(metric.ram_total);
+    const ramFreeBytes = convertToBytes(metric.ram_free);
+    const ramUsagePercent = ramTotalBytes > 0 ? (ramUsedBytes / ramTotalBytes) * 100 : 0;
+
+    const diskUsedBytes = convertToBytes(metric.disk_used);
+    const diskTotalBytes = convertToBytes(metric.disk_total);
+    const diskFreeBytes = convertToBytes(metric.disk_free);
+    const diskUsagePercent = diskTotalBytes > 0 ? (diskUsedBytes / diskTotalBytes) * 100 : 0;
+
+    const networkRxBytes = metric.network_rx_bytes || 0;
+    const networkTxBytes = metric.network_tx_bytes || 0;
+    const networkRxSpeed = metric.network_rx_speed || 0;
+    const networkTxSpeed = metric.network_tx_speed || 0;
+
+    const timestamp = metric.created || metric.timestamp;
+
+    return {
+      timestamp: formatTimestamp(timestamp, timeRange),
+      fullTimestamp: timestamp,
+      cpuUsage: Math.round(cpuUsage * 100) / 100,
+      cpuCores: parseInt(metric.cpu_cores) || 0,
+      cpuFree: Math.round((100 - cpuUsage) * 100) / 100,
+      
+      ramUsedBytes,
+      ramTotalBytes,
+      ramFreeBytes,
+      ramUsed: formatBytes(ramUsedBytes),
+      ramTotal: formatBytes(ramTotalBytes),
+      ramFree: formatBytes(ramFreeBytes),
+      ramUsagePercent: Math.round(ramUsagePercent * 100) / 100,
+      
+      diskUsedBytes,
+      diskTotalBytes,
+      diskFreeBytes,
+      diskUsed: formatBytes(diskUsedBytes),
+      diskTotal: formatBytes(diskTotalBytes),
+      diskFree: formatBytes(diskFreeBytes),
+      diskUsagePercent: Math.round(diskUsagePercent * 100) / 100,
+      
+      networkRxBytes,
+      networkTxBytes,
+      networkRx: formatBytes(networkRxBytes),
+      networkTx: formatBytes(networkTxBytes),
+      networkRxSpeed: Math.round(networkRxSpeed * 100) / 100,
+      networkTxSpeed: Math.round(networkTxSpeed * 100) / 100,
+    };
+  });
+  
+ // console.log('✅ formatChartData: Final formatted data count:', formattedData.length);
+  return formattedData;
+};
\ No newline at end of file
diff --git a/application/src/components/servers/charts/hooks/useServerHistoryData.ts b/application/src/components/servers/charts/hooks/useServerHistoryData.ts
new file mode 100644
index 0000000..04e0365
--- /dev/null
+++ b/application/src/components/servers/charts/hooks/useServerHistoryData.ts
@@ -0,0 +1,49 @@
+
+import { useState, useMemo } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { serverService } from "@/services/serverService";
+import { formatChartData } from "../dataUtils";
+
+type TimeRange = '60m' | '1d' | '7d' | '1m' | '3m';
+
+export const useServerHistoryData = (serverId: string) => {
+  const [timeRange, setTimeRange] = useState<TimeRange>("60m");
+
+  const {
+    data: metrics = [],
+    isLoading,
+    error,
+    isFetching
+  } = useQuery({
+    queryKey: ['server-metrics-history', serverId, timeRange],
+    queryFn: async () => {
+    //  console.log('useServerHistoryData: Fetching metrics for serverId:', serverId, 'timeRange:', timeRange);
+      const result = await serverService.getServerMetrics(serverId, timeRange);
+    //  console.log('useServerHistoryData: Raw metrics result for timeRange', timeRange, ':', result?.length || 0, 'records');
+      return result || [];
+    },
+    enabled: !!serverId,
+    refetchInterval: timeRange === '60m' ? 60000 : timeRange === '1d' ? 120000 : 300000, // Significantly increased intervals
+    staleTime: timeRange === '60m' ? 30000 : timeRange === '1d' ? 60000 : 120000, // Increased stale time
+    retry: 1, // Reduced retries to prevent excessive requests
+    retryDelay: 2000, // Slower retry
+    gcTime: 10 * 60 * 1000, // 10 minutes cache
+    refetchOnWindowFocus: false, // Prevent refetch on window focus
+    refetchOnMount: false, // Prevent refetch on mount if data exists
+  });
+
+  // Memoize chart data formatting to prevent unnecessary recalculations
+  const chartData = useMemo(() => {
+    return formatChartData(metrics, timeRange);
+  }, [metrics, timeRange]);
+
+  return {
+    timeRange,
+    setTimeRange,
+    metrics,
+    chartData,
+    isLoading,
+    error,
+    isFetching
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/servers/charts/tooltips/DetailedTooltipContent.tsx b/application/src/components/servers/charts/tooltips/DetailedTooltipContent.tsx
new file mode 100644
index 0000000..042321f
--- /dev/null
+++ b/application/src/components/servers/charts/tooltips/DetailedTooltipContent.tsx
@@ -0,0 +1,65 @@
+
+interface DetailedTooltipContentProps {
+  active?: boolean;
+  payload?: any[];
+  label?: string;
+}
+
+export const DetailedTooltipContent = ({ active, payload, label }: DetailedTooltipContentProps) => {
+  if (!active || !payload || !payload.length) return null;
+
+  const data = payload[0]?.payload;
+
+  return (
+    <div className="bg-popover/95 border border-border backdrop-blur-sm rounded-lg p-3 shadow-lg">
+      <p className="font-medium text-popover-foreground mb-2">{label}</p>
+      {data?.fullTimestamp && (
+        <p className="text-xs text-muted-foreground mb-2">
+          {new Date(data.fullTimestamp).toLocaleString('en-US', {
+            weekday: 'short',
+            year: 'numeric',
+            month: 'short',
+            day: 'numeric',
+            hour: '2-digit',
+            minute: '2-digit',
+            second: '2-digit'
+          })}
+        </p>
+      )}
+      {payload.map((entry: any, index: number) => {
+        const data = entry.payload;
+        return (
+          <div key={index} className="space-y-1">
+            <div className="flex items-center gap-2">
+              <div 
+                className="w-3 h-3 rounded-full" 
+                style={{ backgroundColor: entry.color }}
+              />
+              <span className="text-sm font-medium">{entry.name}: {entry.value}%</span>
+            </div>
+            {entry.dataKey === 'cpuUsage' && (
+              <div className="text-xs text-muted-foreground ml-5">
+                <div>CPU Cores: {data.cpuCores}</div>
+                <div>Free: {data.cpuFree}%</div>
+              </div>
+            )}
+            {entry.dataKey === 'ramUsagePercent' && (
+              <div className="text-xs text-muted-foreground ml-5">
+                <div>Used: {data.ramUsed}</div>
+                <div>Total: {data.ramTotal}</div>
+                <div>Free: {data.ramFree}</div>
+              </div>
+            )}
+            {entry.dataKey === 'diskUsagePercent' && (
+              <div className="text-xs text-muted-foreground ml-5">
+                <div>Used: {data.diskUsed}</div>
+                <div>Total: {data.diskTotal}</div>
+                <div>Free: {data.diskFree}</div>
+              </div>
+            )}
+          </div>
+        );
+      })}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/servers/charts/tooltips/NetworkTooltipContent.tsx b/application/src/components/servers/charts/tooltips/NetworkTooltipContent.tsx
new file mode 100644
index 0000000..3a709b8
--- /dev/null
+++ b/application/src/components/servers/charts/tooltips/NetworkTooltipContent.tsx
@@ -0,0 +1,48 @@
+
+interface NetworkTooltipContentProps {
+  active?: boolean;
+  payload?: any[];
+  label?: string;
+}
+
+export const NetworkTooltipContent = ({ active, payload, label }: NetworkTooltipContentProps) => {
+  if (!active || !payload || !payload.length) return null;
+
+  const data = payload[0]?.payload;
+
+  return (
+    <div className="bg-popover/95 border border-border backdrop-blur-sm rounded-lg p-3 shadow-lg">
+      <p className="font-medium text-popover-foreground mb-2">{label}</p>
+      {data?.fullTimestamp && (
+        <p className="text-xs text-muted-foreground mb-2">
+          {new Date(data.fullTimestamp).toLocaleString('en-US', {
+            weekday: 'short',
+            year: 'numeric',
+            month: 'short',
+            day: 'numeric',
+            hour: '2-digit',
+            minute: '2-digit',
+            second: '2-digit'
+          })}
+        </p>
+      )}
+      {payload.map((entry: any, index: number) => (
+        <div key={index} className="flex items-center gap-2 mb-1">
+          <div 
+            className="w-3 h-3 rounded-full" 
+            style={{ backgroundColor: entry.color }}
+          />
+          <span className="text-sm font-medium">
+            {entry.name}: {entry.dataKey.includes('Speed') ? `${entry.value} KB/s` : entry.value}
+          </span>
+        </div>
+      ))}
+      {data && (
+        <div className="text-xs text-muted-foreground mt-2 pt-2 border-t border-border">
+          <div>Total RX: {data.networkRx}</div>
+          <div>Total TX: {data.networkTx}</div>
+        </div>
+      )}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/AddServiceDialog.tsx b/application/src/components/services/AddServiceDialog.tsx
new file mode 100644
index 0000000..af1cb5d
--- /dev/null
+++ b/application/src/components/services/AddServiceDialog.tsx
@@ -0,0 +1,50 @@
+
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { ServiceForm } from "./ServiceForm";
+import { ScrollArea } from "@/components/ui/scroll-area";
+import { useQueryClient } from "@tanstack/react-query";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface AddServiceDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+export function AddServiceDialog({ open, onOpenChange }: AddServiceDialogProps) {
+  const { t } = useLanguage();
+  const queryClient = useQueryClient();
+  const handleSuccess = async () => {
+    // Immediately invalidate and refetch services data
+    await queryClient.invalidateQueries({ queryKey: ["services"] });
+    await queryClient.refetchQueries({ queryKey: ["services"] });
+    onOpenChange(false);
+  };
+
+  const handleCancel = () => {
+    onOpenChange(false);
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[700px] max-h-[90vh] flex flex-col">
+        <DialogHeader>
+          <DialogTitle className="text-xl">{t("createNewService")}</DialogTitle>
+          <DialogDescription>
+            {t("createNewServiceDesc")}
+          </DialogDescription>
+        </DialogHeader>
+        <ScrollArea className="flex-1 pr-4 overflow-auto" style={{ height: "calc(80vh - 180px)" }}>
+          <div className="pr-2">
+            <ServiceForm onSuccess={handleSuccess} onCancel={handleCancel} />
+          </div>
+        </ScrollArea>
+      </DialogContent>
+    </Dialog>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/DateRangeFilter.tsx b/application/src/components/services/DateRangeFilter.tsx
new file mode 100644
index 0000000..1e1a736
--- /dev/null
+++ b/application/src/components/services/DateRangeFilter.tsx
@@ -0,0 +1,145 @@
+
+import { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Calendar } from "@/components/ui/calendar";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "@/components/ui/popover";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { format } from "date-fns";
+import { Calendar as CalendarIcon } from "lucide-react";
+import { cn } from "@/lib/utils";
+
+export type DateRangeOption = '24h' | '7d' | '30d' | '1y' | 'custom';
+
+interface DateRangeFilterProps {
+  onRangeChange: (startDate: Date, endDate: Date, option: DateRangeOption) => void;
+  selectedOption?: DateRangeOption;
+}
+
+interface DateRange {
+  from: Date | undefined;
+  to: Date | undefined;
+}
+
+export function DateRangeFilter({ onRangeChange, selectedOption = '24h' }: DateRangeFilterProps) {
+  const [currentOption, setCurrentOption] = useState<DateRangeOption>(selectedOption);
+  const [customDateRange, setCustomDateRange] = useState<DateRange>({
+    from: undefined,
+    to: undefined,
+  });
+  const [isCalendarOpen, setIsCalendarOpen] = useState(false);
+
+  const handleOptionChange = (value: string) => {
+    const option = value as DateRangeOption;
+    setCurrentOption(option);
+    
+    const now = new Date();
+    let startDate: Date;
+    let endDate: Date = new Date(now.getTime() + (5 * 60 * 1000)); // Add 5 minutes buffer to future
+    
+    switch (option) {
+      case '24h':
+        startDate = new Date(now.getTime() - (24 * 60 * 60 * 1000));
+        break;
+      case '7d':
+        startDate = new Date(now.getTime() - (7 * 24 * 60 * 60 * 1000));
+        break;
+      case '30d':
+        startDate = new Date(now.getTime() - (30 * 24 * 60 * 60 * 1000));
+        break;
+      case '1y':
+        startDate = new Date(now.getTime() - (365 * 24 * 60 * 60 * 1000));
+        break;
+      case 'custom':
+        setIsCalendarOpen(true);
+        return;
+      default:
+        startDate = new Date(now.getTime() - (24 * 60 * 60 * 1000)); // Default to 24 hours
+    }
+    
+    console.log(`DateRangeFilter: ${option} selected, range: ${startDate.toISOString()} to ${endDate.toISOString()}`);
+    onRangeChange(startDate, endDate, option);
+  };
+
+  const handleCustomRangeSelect = (range: DateRange | undefined) => {
+    if (!range || !range.from || !range.to) {
+      return;
+    }
+    
+    setCustomDateRange(range);
+    
+    const startOfDay = new Date(range.from);
+    startOfDay.setHours(0, 0, 0, 0);
+    
+    const endOfDay = new Date(range.to);
+    endOfDay.setHours(23, 59, 59, 999);
+    
+    console.log(`Custom range: ${startOfDay.toISOString()} to ${endOfDay.toISOString()}`);
+    onRangeChange(startOfDay, endOfDay, 'custom');
+    setIsCalendarOpen(false);
+  };
+
+  return (
+    <div className="flex items-center space-x-2">
+      <Select value={currentOption} onValueChange={handleOptionChange}>
+        <SelectTrigger className="w-[180px]">
+          <SelectValue placeholder="Select time range" />
+        </SelectTrigger>
+        <SelectContent>
+          <SelectItem value="24h">Last 24 hours</SelectItem>
+          <SelectItem value="7d">Last 7 days</SelectItem>
+          <SelectItem value="30d">Last 30 days</SelectItem>
+          <SelectItem value="1y">Last year</SelectItem>
+          <SelectItem value="custom">Custom range</SelectItem>
+        </SelectContent>
+      </Select>
+
+      {currentOption === 'custom' && (
+        <Popover open={isCalendarOpen} onOpenChange={setIsCalendarOpen}>
+          <PopoverTrigger asChild>
+            <Button
+              id="date"
+              variant="outline"
+              className={cn(
+                "w-[280px] justify-start text-left font-normal",
+                !customDateRange.from && "text-muted-foreground"
+              )}
+            >
+              <CalendarIcon className="mr-2 h-4 w-4" />
+              {customDateRange.from ? (
+                customDateRange.to ? (
+                  <>
+                    {format(customDateRange.from, "LLL dd, y")} -{" "}
+                    {format(customDateRange.to, "LLL dd, y")}
+                  </>
+                ) : (
+                  format(customDateRange.from, "LLL dd, y")
+                )
+              ) : (
+                "Pick a date range"
+              )}
+            </Button>
+          </PopoverTrigger>
+          <PopoverContent className="w-auto p-0" align="center">
+            <Calendar
+              mode="range"
+              selected={customDateRange}
+              onSelect={handleCustomRangeSelect}
+              initialFocus
+              className="pointer-events-auto"
+            />
+          </PopoverContent>
+        </Popover>
+      )}
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/HeatmapChart.tsx b/application/src/components/services/HeatmapChart.tsx
new file mode 100644
index 0000000..f0b5539
--- /dev/null
+++ b/application/src/components/services/HeatmapChart.tsx
@@ -0,0 +1,174 @@
+
+import { UptimeData } from "@/types/service.types";
+import { format, startOfMonth, endOfMonth, eachDayOfInterval, isSameDay } from "date-fns";
+
+interface HeatmapChartProps {
+  uptimeData: UptimeData[];
+  selectedMonth: Date;
+}
+
+export const HeatmapChart = ({ uptimeData, selectedMonth }: HeatmapChartProps) => {
+  const monthStart = startOfMonth(selectedMonth);
+  const monthEnd = endOfMonth(selectedMonth);
+  const daysInMonth = eachDayOfInterval({ start: monthStart, end: monthEnd });
+
+  const getStatusForDay = (day: Date) => {
+    const dayData = uptimeData.filter(data => 
+      isSameDay(new Date(data.timestamp), day)
+    );
+    
+    if (dayData.length === 0) return 'no-data';
+    
+    // Calculate the predominant status for the day
+    const statusCounts = dayData.reduce((acc, data) => {
+      acc[data.status] = (acc[data.status] || 0) + 1;
+      return acc;
+    }, {} as Record<string, number>);
+    
+    const predominantStatus = Object.entries(statusCounts)
+      .sort(([,a], [,b]) => b - a)[0][0];
+    
+    return predominantStatus;
+  };
+
+  const getStatusColor = (status: string) => {
+    switch (status) {
+      case 'up':
+        return 'bg-emerald-500';
+      case 'down':
+        return 'bg-red-500';
+      case 'warning':
+        return 'bg-amber-500';
+      case 'paused':
+        return 'bg-slate-500';
+      default:
+        return 'bg-slate-700';
+    }
+  };
+
+  const getStatusLabel = (status: string) => {
+    switch (status) {
+      case 'up':
+        return 'Up';
+      case 'down':
+        return 'Down';
+      case 'warning':
+        return 'Warning';
+      case 'paused':
+        return 'Paused';
+      default:
+        return 'No Data';
+    }
+  };
+
+  // Group days by weeks
+  const weeks: Date[][] = [];
+  let currentWeek: Date[] = [];
+  
+  daysInMonth.forEach((day, index) => {
+    if (index === 0) {
+      // Fill empty days at the start of the month
+      const dayOfWeek = day.getDay();
+      for (let i = 0; i < dayOfWeek; i++) {
+        currentWeek.push(new Date(0)); // Placeholder for empty cells
+      }
+    }
+    
+    currentWeek.push(day);
+    
+    if (currentWeek.length === 7) {
+      weeks.push([...currentWeek]);
+      currentWeek = [];
+    }
+  });
+  
+  // Add remaining days to last week
+  if (currentWeek.length > 0) {
+    while (currentWeek.length < 7) {
+      currentWeek.push(new Date(0)); // Placeholder for empty cells
+    }
+    weeks.push(currentWeek);
+  }
+
+  return (
+    <div className="space-y-6">
+      {/* Header */}
+      <div className="text-center">
+        <h3 className="text-xl font-semibold text-white mb-2">
+          Service Health - {format(selectedMonth, 'MMMM yyyy')}
+        </h3>
+        <p className="text-gray-400 text-sm">
+          Daily status overview for the current month
+        </p>
+      </div>
+
+      {/* Calendar Grid */}
+      <div className="space-y-4">
+        {/* Day labels */}
+        <div className="grid grid-cols-7 gap-2 text-sm text-gray-400 font-medium">
+          <div className="text-center py-2">Sun</div>
+          <div className="text-center py-2">Mon</div>
+          <div className="text-center py-2">Tue</div>
+          <div className="text-center py-2">Wed</div>
+          <div className="text-center py-2">Thu</div>
+          <div className="text-center py-2">Fri</div>
+          <div className="text-center py-2">Sat</div>
+        </div>
+        
+        {/* Calendar days */}
+        <div className="space-y-2">
+          {weeks.map((week, weekIndex) => (
+            <div key={weekIndex} className="grid grid-cols-7 gap-2">
+              {week.map((day, dayIndex) => {
+                const isPlaceholder = day.getTime() === 0;
+                const status = isPlaceholder ? 'no-data' : getStatusForDay(day);
+                const dayData = isPlaceholder ? [] : uptimeData.filter(data => 
+                  isSameDay(new Date(data.timestamp), day)
+                );
+                
+                return (
+                  <div
+                    key={dayIndex}
+                    className={`
+                      relative aspect-square rounded-lg flex items-center justify-center text-sm font-medium text-white
+                      transition-all duration-200 cursor-pointer
+                      ${isPlaceholder ? 'invisible' : `
+                        ${getStatusColor(status)} hover:scale-110 hover:shadow-lg
+                      `}
+                    `}
+                    title={isPlaceholder ? '' : `${format(day, 'MMM d, yyyy')}: ${getStatusLabel(status)}${dayData.length > 0 ? ` (${dayData.length} checks)` : ''}`}
+                  >
+                    {isPlaceholder ? '' : format(day, 'd')}
+                  </div>
+                );
+              })}
+            </div>
+          ))}
+        </div>
+      </div>
+      
+      {/* Status Legend */}
+      <div className="flex items-center justify-center gap-6 pt-4 border-t border-gray-700">
+        <span className="text-gray-400 text-sm font-medium">Status:</span>
+        <div className="flex items-center gap-4">
+          <div className="flex items-center space-x-2">
+            <div className="w-3 h-3 bg-emerald-500 rounded-full"></div>
+            <span className="text-gray-300 text-sm">Up</span>
+          </div>
+          <div className="flex items-center space-x-2">
+            <div className="w-3 h-3 bg-amber-500 rounded-full"></div>
+            <span className="text-gray-300 text-sm">Warning</span>
+          </div>
+          <div className="flex items-center space-x-2">
+            <div className="w-3 h-3 bg-red-500 rounded-full"></div>
+            <span className="text-gray-300 text-sm">Down</span>
+          </div>
+          <div className="flex items-center space-x-2">
+            <div className="w-3 h-3 bg-slate-500 rounded-full"></div>
+            <span className="text-gray-300 text-sm">Paused</span>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/HeatmapDialog.tsx b/application/src/components/services/HeatmapDialog.tsx
new file mode 100644
index 0000000..ef15c8b
--- /dev/null
+++ b/application/src/components/services/HeatmapDialog.tsx
@@ -0,0 +1,97 @@
+
+import { useState } from "react";
+import { ChevronLeft, ChevronRight } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { HeatmapChart } from "./HeatmapChart";
+import { UptimeData } from "@/types/service.types";
+import { addMonths, subMonths, format } from "date-fns";
+
+interface HeatmapDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  serviceName: string;
+  uptimeData: UptimeData[];
+}
+
+export const HeatmapDialog = ({
+  open,
+  onOpenChange,
+  serviceName,
+  uptimeData
+}: HeatmapDialogProps) => {
+  const [selectedMonth, setSelectedMonth] = useState(new Date());
+
+  const handlePreviousMonth = () => {
+    setSelectedMonth(prev => subMonths(prev, 1));
+  };
+
+  const handleNextMonth = () => {
+    setSelectedMonth(prev => addMonths(prev, 1));
+  };
+
+  const handleCurrentMonth = () => {
+    setSelectedMonth(new Date());
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-2xl max-h-[90vh] overflow-y-auto bg-slate-900 border-slate-700">
+        <DialogHeader className="pb-4">
+          <DialogTitle className="text-xl font-semibold text-white">
+            Health Heatmap - {serviceName}
+          </DialogTitle>
+          <DialogDescription className="text-gray-400">
+            Monthly overview of service health status with daily breakdown
+          </DialogDescription>
+        </DialogHeader>
+        
+        <div className="space-y-6">
+          {/* Month Navigation */}
+          <div className="flex items-center justify-between">
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={handlePreviousMonth}
+              className="flex items-center gap-2 bg-slate-800 border-slate-600 text-white hover:bg-slate-700"
+            >
+              <ChevronLeft className="h-4 w-4" />
+              Previous
+            </Button>
+            
+            <Button
+              variant="secondary"
+              size="sm"
+              onClick={handleCurrentMonth}
+              className="bg-slate-700 text-white hover:bg-slate-600"
+            >
+              Current Month
+            </Button>
+            
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={handleNextMonth}
+              className="flex items-center gap-2 bg-slate-800 border-slate-600 text-white hover:bg-slate-700"
+            >
+              Next
+              <ChevronRight className="h-4 w-4" />
+            </Button>
+          </div>
+          
+          {/* Heatmap Chart */}
+          <HeatmapChart 
+            uptimeData={uptimeData} 
+            selectedMonth={selectedMonth}
+          />
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/LastCheckedTime.tsx b/application/src/components/services/LastCheckedTime.tsx
new file mode 100644
index 0000000..85756a3
--- /dev/null
+++ b/application/src/components/services/LastCheckedTime.tsx
@@ -0,0 +1,89 @@
+
+import React from "react";
+import { Clock, TimerOff } from "lucide-react";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface LastCheckedTimeProps {
+  lastCheckedTime: string;
+  status?: string;
+  interval?: number;
+}
+
+export const LastCheckedTime = ({ lastCheckedTime, status, interval }: LastCheckedTimeProps) => {
+	const { t } = useLanguage();
+  // Format the time without seconds to display a static time
+  const formatTimeWithoutSeconds = (timeString: string) => {
+    try {
+      const date = new Date(timeString);
+      
+      // Check if it's a valid date
+      if (isNaN(date.getTime())) {
+        // If it's already in HH:MM format, just return it
+        if (timeString.includes(':') && !timeString.includes(':00:')) {
+          return timeString;
+        }
+        return timeString;
+      }
+      
+      // Format to only show hours and minutes (HH:MM)
+      return date.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
+    } catch (e) {
+      return timeString;
+    }
+  };
+
+  // Get the formatted time without creating a new Date for paused services
+  const formattedTime = formatTimeWithoutSeconds(lastCheckedTime);
+
+  // Explicitly prevent real-time updates for paused services
+  const isPaused = status === "paused";
+
+  // Format the interval for display
+  const formatInterval = (seconds: number) => {
+    if (seconds < 60) return `${seconds}s`;
+    const minutes = Math.round(seconds / 60);
+    return `${minutes}min`;
+  };
+
+  return (
+    <TooltipProvider>
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <div className="flex items-center space-x-2 text-sm text-gray-400 cursor-help">
+            {isPaused ? (
+              <TimerOff className="h-4 w-4" />
+            ) : (
+              <Clock className="h-4 w-4" />
+            )}
+            <span>
+              {isPaused ? t("pausedAt") : ""}
+              {formattedTime}
+            </span>
+          </div>
+        </TooltipTrigger>
+        <TooltipContent 
+          side="top"
+          className="bg-gray-900 text-white border-gray-800 px-3 py-2"
+        >
+          <div className="flex flex-col gap-1 text-xs">
+            <div className="font-medium">
+              {isPaused ? t("monitoringPaused") : t("lastCheckDetails")}
+            </div>
+            <div>
+              {isPaused ? t("noAutomaticChecks") : t("checkedAt") + `${formattedTime}`}
+            </div>
+            {interval && !isPaused && (
+              <div>
+	              {t("checkInterval")}: {formatInterval(interval)}
+              </div>
+            )}
+            <div className="text-gray-400 text-[10px]">
+              {new Date(lastCheckedTime).toLocaleString()}
+            </div>
+          </div>
+        </TooltipContent>
+      </Tooltip>
+    </TooltipProvider>
+  );
+};
diff --git a/application/src/components/services/LoadingState.tsx b/application/src/components/services/LoadingState.tsx
new file mode 100644
index 0000000..ebf909c
--- /dev/null
+++ b/application/src/components/services/LoadingState.tsx
@@ -0,0 +1,17 @@
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+export function LoadingState() {
+	const { t } = useLanguage();
+  return (
+    <div className="flex items-center justify-center h-screen bg-background text-foreground">
+      <div className="flex flex-col items-center text-center py-8 px-4 rounded-lg shadow-lg bg-card animate-fade-in">
+        <div className="relative flex items-center justify-center mb-4">
+          <div className="absolute w-12 h-12 rounded-full border-4 border-primary/20"></div>
+          <div className="w-12 h-12 rounded-full border-4 border-t-primary border-r-transparent border-b-transparent border-l-transparent animate-spin"></div>
+        </div>
+        <h3 className="text-xl font-medium mb-1">{t("loadingServerData")}</h3>
+        <p className="text-muted-foreground">{t("retrievingYourInformation")}</p>
+      </div>
+    </div>
+  );
+}
diff --git a/application/src/components/services/RegionalAgentFilter.tsx b/application/src/components/services/RegionalAgentFilter.tsx
new file mode 100644
index 0000000..f2396cd
--- /dev/null
+++ b/application/src/components/services/RegionalAgentFilter.tsx
@@ -0,0 +1,92 @@
+
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { useQuery } from "@tanstack/react-query";
+import { regionalService } from "@/services/regionalService";
+import { MapPin, Loader2, BarChart3 } from "lucide-react";
+
+interface RegionalAgentFilterProps {
+  selectedAgent: string;
+  onAgentChange: (agent: string) => void;
+}
+
+export function RegionalAgentFilter({ selectedAgent, onAgentChange }: RegionalAgentFilterProps) {
+  const { data: regionalAgents = [], isLoading } = useQuery({
+    queryKey: ['regional-services'],
+    queryFn: regionalService.getRegionalServices,
+  });
+
+  // Filter only online agents
+  const onlineAgents = regionalAgents.filter(agent => agent.connection === 'online');
+
+  const getCurrentAgentDisplay = () => {
+    if (!selectedAgent || selectedAgent === "all") {
+      return "All Monitoring";
+    }
+    
+    const [regionName] = selectedAgent.split("|");
+    const agent = onlineAgents.find(agent => 
+      `${agent.region_name}|${agent.agent_id}` === selectedAgent
+    );
+    
+    if (agent) {
+      return `${agent.region_name} (${agent.agent_ip_address})`;
+    }
+    
+    return regionName || "All Monitoring";
+  };
+
+  return (
+    <div className="w-64">
+      <label className="text-sm font-medium flex items-center gap-2 mb-2">
+        <MapPin className="h-4 w-4" />
+        Monitoring Source
+      </label>
+      <Select 
+        onValueChange={onAgentChange} 
+        value={selectedAgent || "all"}
+        disabled={isLoading}
+      >
+        <SelectTrigger>
+          <SelectValue placeholder={
+            isLoading 
+              ? "Loading agents..." 
+              : getCurrentAgentDisplay()
+          } />
+        </SelectTrigger>
+        <SelectContent>
+          {isLoading ? (
+            <SelectItem value="loading" disabled>
+              <div className="flex items-center gap-2">
+                <Loader2 className="h-4 w-4 animate-spin" />
+                Loading agents...
+              </div>
+            </SelectItem>
+          ) : (
+            <>
+              <SelectItem value="all">
+                <div className="flex items-center gap-2">
+                  <BarChart3 className="h-4 w-4 text-purple-500" />
+                  <span className="font-medium">All Monitoring</span>
+                </div>
+              </SelectItem>
+              {onlineAgents.length > 0 && onlineAgents.map((agent) => (
+                <SelectItem key={agent.id} value={`${agent.region_name}|${agent.agent_id}`}>
+                  <div className="flex items-center gap-2">
+                    <div className="w-2 h-2 bg-green-500 rounded-full"></div>
+                    <span className="font-medium">{agent.region_name}</span>
+                    <span className="text-muted-foreground">({agent.agent_ip_address})</span>
+                  </div>
+                </SelectItem>
+              ))}
+            </>
+          )}
+        </SelectContent>
+      </Select>
+      {onlineAgents.length === 0 && !isLoading && (
+        <p className="text-xs text-amber-600 mt-1">
+          No regional agents available. Using default monitoring only.
+        </p>
+      )}
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/ResponseTimeChart.tsx b/application/src/components/services/ResponseTimeChart.tsx
new file mode 100644
index 0000000..3d70d59
--- /dev/null
+++ b/application/src/components/services/ResponseTimeChart.tsx
@@ -0,0 +1,589 @@
+import { AreaChart, Area, XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContainer, ReferenceLine, LineChart, Line, BarChart, Bar } from "recharts";
+import { UptimeData } from "@/types/service.types";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useMemo, useState } from "react";
+import { format } from "date-fns";
+import { Button } from "@/components/ui/button";
+import { AreaChart as AreaChartIcon, BarChart3, TrendingUp } from "lucide-react";
+
+interface ResponseTimeChartProps {
+  uptimeData: UptimeData[];
+}
+
+type ChartType = 'area' | 'line' | 'bar';
+
+export function ResponseTimeChart({ uptimeData }: ResponseTimeChartProps) {
+  const { theme } = useTheme();
+  const [chartType, setChartType] = useState<ChartType>('area');
+  
+  // Fixed color palette - consistent colors that don't change
+  const fixedColors = [
+    { stroke: '#3b82f6', fill: 'rgba(59, 130, 246, 0.2)', name: 'Ocean Blue' },
+    { stroke: '#10b981', fill: 'rgba(16, 185, 129, 0.2)', name: 'Emerald Green' },
+    { stroke: '#f59e0b', fill: 'rgba(245, 158, 11, 0.2)', name: 'Golden Amber' },
+    { stroke: '#ef4444', fill: 'rgba(239, 68, 68, 0.2)', name: 'Ruby Red' },
+    { stroke: '#8b5cf6', fill: 'rgba(139, 92, 246, 0.2)', name: 'Royal Purple' },
+    { stroke: '#06b6d4', fill: 'rgba(6, 182, 212, 0.2)', name: 'Sky Cyan' },
+    { stroke: '#f97316', fill: 'rgba(249, 115, 22, 0.2)', name: 'Sunset Orange' },
+    { stroke: '#84cc16', fill: 'rgba(132, 204, 22, 0.2)', name: 'Fresh Lime' },
+    { stroke: '#ec4899', fill: 'rgba(236, 72, 153, 0.2)', name: 'Vibrant Pink' },
+    { stroke: '#14b8a6', fill: 'rgba(20, 184, 166, 0.2)', name: 'Ocean Teal' },
+  ];
+  
+  // Check if we have data from multiple sources
+  const hasMultipleSources = useMemo(() => {
+    const sources = new Set();
+    uptimeData.forEach(data => {
+      const source = data.source || 'default';
+      sources.add(source);
+    });
+    return sources.size > 1;
+  }, [uptimeData]);
+
+  // Format data for the chart with enhanced time formatting
+  const chartData = useMemo(() => {
+    if (!uptimeData || uptimeData.length === 0) return [];
+    
+    if (hasMultipleSources) {
+      // Group data by timestamp for multi-source display
+      const timeGroups = new Map();
+      
+      uptimeData.forEach(data => {
+        const timestamp = new Date(data.timestamp);
+        // Round to nearest minute for better grouping
+        const roundedTime = new Date(timestamp.getFullYear(), timestamp.getMonth(), timestamp.getDate(), 
+                                   timestamp.getHours(), timestamp.getMinutes());
+        const timeKey = roundedTime.getTime();
+        const source = data.source || 'default';
+        
+        if (!timeGroups.has(timeKey)) {
+          timeGroups.set(timeKey, {
+            time: format(roundedTime, 'HH:mm'),
+            rawTime: timeKey,
+            date: format(roundedTime, 'MMM dd, yyyy'),
+            timestamp: data.timestamp
+          });
+        }
+        
+        const group = timeGroups.get(timeKey);
+        
+        // Handle different data sources properly
+        if (source === 'default') {
+          // Only add pure default if we don't already have regional data with agent_id 1
+          const hasRegionalDefault = uptimeData.some(d => 
+            d.region_name === 'Default' && (d.agent_id === '1' || d.agent_id === 1)
+          );
+          
+          if (!hasRegionalDefault) {
+            group.defaultValue = data.status === "paused" ? null : data.responseTime;
+            group.defaultStatus = data.status;
+          }
+        } else {
+          // Regional monitoring data - distinguish by region and agent
+          const sourceKey = `regional_${source.replace('|', '_')}`;
+          
+          // Group by the same timestamp more accurately
+          const currentValue = group[`${sourceKey}_value`];
+          const newValue = data.status === "paused" ? null : data.responseTime;
+          
+          if (currentValue !== undefined && newValue !== null) {
+            // Average multiple values for the same time slot
+            const count = group[`${sourceKey}_count`] || 1;
+            group[`${sourceKey}_value`] = ((currentValue * count) + newValue) / (count + 1);
+            group[`${sourceKey}_count`] = count + 1;
+          } else if (newValue !== null) {
+            group[`${sourceKey}_value`] = newValue;
+            group[`${sourceKey}_count`] = 1;
+          }
+          
+          group[`${sourceKey}_status`] = data.status;
+          group[`${sourceKey}_label`] = data.region_name || source;
+          group[`${sourceKey}_agent_id`] = data.agent_id;
+        }
+      });
+      
+      return Array.from(timeGroups.values())
+        .sort((a, b) => a.rawTime - b.rawTime)
+        .slice(-50); // Show last 50 data points for better performance
+    } else {
+      // Single source display - use original styling
+      const sortedData = [...uptimeData].sort((a, b) => 
+        new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime()
+      );
+      
+      const isShortTimeRange = uptimeData.length > 0 &&
+        (new Date(uptimeData[0].timestamp).getTime() - new Date(uptimeData[uptimeData.length - 1].timestamp).getTime()) < 2 * 60 * 60 * 1000;
+      
+      return sortedData.map(data => {
+        const timestamp = new Date(data.timestamp);
+        
+        return {
+          time: isShortTimeRange 
+            ? format(timestamp, 'HH:mm:ss')
+            : format(timestamp, 'HH:mm'),
+          rawTime: timestamp.getTime(),
+          date: format(timestamp, 'MMM dd, yyyy'),
+          value: data.status === "paused" ? null : data.responseTime,
+          status: data.status,
+          upValue: data.status === "up" ? data.responseTime : null,
+          downValue: data.status === "down" ? data.responseTime : null,
+          warningValue: data.status === "warning" ? data.responseTime : null,
+        };
+      });
+    }
+  }, [uptimeData, hasMultipleSources]);
+  
+  // Calculate Y-axis domain for better positioning
+  const yAxisDomain = useMemo(() => {
+    if (!chartData.length) return [0, 100];
+    
+    let allValues: number[] = [];
+    
+    if (hasMultipleSources) {
+      chartData.forEach(d => {
+        Object.keys(d).forEach(key => {
+          if (key.endsWith('_value') || key === 'defaultValue') {
+            const value = d[key as keyof typeof d];
+            if (value !== null && value !== undefined && typeof value === 'number') {
+              allValues.push(value);
+            }
+          }
+        });
+      });
+    } else {
+      allValues = chartData
+        .filter(d => d.value !== null && d.status !== 'paused')
+        .map(d => d.value as number)
+        .filter(v => typeof v === 'number');
+    }
+    
+    if (allValues.length === 0) return [0, 100];
+    
+    const minValue = Math.min(...allValues);
+    const maxValue = Math.max(...allValues);
+    const padding = Math.max((maxValue - minValue) * 0.1, 10);
+    
+    return [Math.max(0, minValue - padding), maxValue + padding];
+  }, [chartData, hasMultipleSources]);
+
+  // Get unique sources for legend with consistent fixed colors
+  const sources = useMemo(() => {
+    if (!hasMultipleSources) return [];
+    
+    const sourceSet = new Set<string>();
+    const sourceInfo = new Map<string, any>();
+    
+    uptimeData.forEach(data => {
+      const source = data.source || 'default';
+      if (source !== 'default') {
+        sourceSet.add(source);
+        sourceInfo.set(source, data);
+      }
+    });
+    
+    // Sort sources to ensure consistent ordering
+    const sortedSources = Array.from(sourceSet).sort();
+    
+    const regionalSources = sortedSources.map((source, index) => {
+      const data = sourceInfo.get(source);
+      const [regionName, agentId] = source.split('|');
+      
+      // Create proper label with region and agent info
+      let label = regionName;
+      if (data?.agent_id && data.agent_id !== '1') {
+        label = `${regionName} (Agent ${data.agent_id})`;
+      } else if (regionName === 'Default' && data?.agent_id === '1') {
+        label = `Default System Check`;
+      }
+      
+      const colorIndex = index % fixedColors.length;
+      
+      return {
+        key: `regional_${source.replace('|', '_')}`,
+        label: label,
+        stroke: fixedColors[colorIndex].stroke,
+        fill: fixedColors[colorIndex].fill,
+        colorName: fixedColors[colorIndex].name
+      };
+    });
+
+    // Only add pure default monitoring if we have it AND no regional Default with agent_id 1
+    const hasRegionalDefault = uptimeData.some(data => 
+      data.region_name === 'Default' && (data.agent_id === '1' || data.agent_id === 1)
+    );
+    const hasPureDefault = uptimeData.some(data => data.source === 'default');
+    
+    const defaultSources = (hasPureDefault && !hasRegionalDefault) ? [{
+      key: 'default',
+      label: 'Default System',
+      stroke: fixedColors[regionalSources.length % fixedColors.length].stroke,
+      fill: fixedColors[regionalSources.length % fixedColors.length].fill,
+      colorName: fixedColors[regionalSources.length % fixedColors.length].name
+    }] : [];
+
+    return [...defaultSources, ...regionalSources];
+  }, [uptimeData, hasMultipleSources]);
+  
+  // Create a custom tooltip for the chart
+  const CustomTooltip = ({ active, payload, label }: any) => {
+    if (active && payload && payload.length) {
+      const data = payload[0].payload;
+      
+      return (
+        <div className={`${theme === 'dark' ? 'bg-gray-900 border-gray-700' : 'bg-white border-gray-200'} p-4 border rounded-lg shadow-lg min-w-64`}>
+          <p className="text-sm font-semibold mb-1">{String(label)}</p>
+          <p className="text-xs text-muted-foreground mb-3">{String(data.date)}</p>
+          
+          {hasMultipleSources ? (
+            // Multi-source tooltip
+            <div className="space-y-3">
+              {sources.map(source => {
+                const valueKey = source.key === 'default' ? 'defaultValue' : `${source.key}_value`;
+                const statusKey = source.key === 'default' ? 'defaultStatus' : `${source.key}_status`;
+                const value = data[valueKey];
+                const status = data[statusKey];
+                
+                if (value === undefined && status === undefined) return null;
+                
+                let statusBadgeClass = "px-2 py-1 rounded-full text-xs font-medium";
+                let statusText = "No Data";
+                
+                if (status === "up") {
+                  statusBadgeClass += " bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200";
+                  statusText = "Up";
+                } else if (status === "down") {
+                  statusBadgeClass += " bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200";
+                  statusText = "Down";
+                } else if (status === "warning") {
+                  statusBadgeClass += " bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-200";
+                  statusText = "Warning";
+                } else if (status === "paused") {
+                  statusBadgeClass += " bg-gray-100 text-gray-800 dark:bg-gray-800 dark:text-gray-200";
+                  statusText = "Paused";
+                } else {
+                  statusBadgeClass += " bg-gray-100 text-gray-600 dark:bg-gray-800 dark:text-gray-400";
+                }
+                
+                return (
+                  <div key={source.key} className="flex items-center justify-between gap-3">
+                    <div className="flex items-center gap-3 min-w-0 flex-1">
+                      <div 
+                        className="w-4 h-4 rounded-full border-2 border-white shadow-sm flex-shrink-0"
+                        style={{ backgroundColor: source.stroke }}
+                      ></div>
+                      <div className="min-w-0 flex-1">
+                        <span className="text-sm font-medium truncate block">{String(source.label)}</span>
+                        <span className="text-xs text-muted-foreground">{source.colorName}</span>
+                      </div>
+                    </div>
+                    <div className="flex flex-col items-end gap-1">
+                      <span className={statusBadgeClass}>
+                        {statusText}
+                      </span>
+                      <div className="text-sm font-mono">
+                        {status === "paused" ? "Paused" : 
+                         value !== null && value !== undefined ? `${value} ms` : "No data"}
+                      </div>
+                    </div>
+                  </div>
+                );
+              })}
+            </div>
+          ) : (
+            // Single source tooltip - showing status with color
+            <>
+              <div className={`flex items-center gap-3 mt-2 ${data.status === "paused" ? "opacity-70" : ""}`}>
+                <div className={`w-4 h-4 rounded-full ${
+                  data.status === "up" ? "bg-green-500" :
+                  data.status === "down" ? "bg-red-500" :
+                  data.status === "warning" ? "bg-yellow-500" : "bg-gray-500"
+                }`}></div>
+                <span className="font-medium">{
+                  data.status === "up" ? "Up" :
+                  data.status === "down" ? "Down" :
+                  data.status === "warning" ? "Warning" : "Paused"
+                }</span>
+              </div>
+              <p className="mt-2 font-mono text-lg">
+                {data.status === "paused" ? "Monitoring paused" : 
+                 data.value !== null ? `${data.value} ms` : "No data"}
+              </p>
+            </>
+          )}
+        </div>
+      );
+    }
+    return null;
+  };
+
+  // Render different chart types
+  const renderChart = () => {
+    const commonProps = {
+      data: chartData,
+      margin: { top: 10, right: 30, left: 0, bottom: 30 }
+    };
+
+    const commonAxisProps = {
+      xAxis: {
+        dataKey: "time",
+        stroke: theme === 'dark' ? '#666' : '#9ca3af',
+        angle: -45,
+        textAnchor: "end" as const,
+        tick: { fontSize: 10 },
+        height: 60,
+        interval: "preserveStartEnd" as const,
+        minTickGap: 5
+      },
+      yAxis: {
+        stroke: theme === 'dark' ? '#666' : '#9ca3af',
+        allowDecimals: false,
+        domain: yAxisDomain
+      }
+    };
+
+    if (hasMultipleSources) {
+      switch (chartType) {
+        case 'line':
+          return (
+            <LineChart {...commonProps}>
+              <CartesianGrid strokeDasharray="3 3" stroke={theme === 'dark' ? '#333' : '#e5e7eb'} />
+              <XAxis {...commonAxisProps.xAxis} />
+              <YAxis {...commonAxisProps.yAxis} />
+              <Tooltip content={<CustomTooltip />} />
+              
+              {sources.find(s => s.key === 'default') && (
+                <Line
+                  type="monotone"
+                  dataKey="defaultValue"
+                  stroke={sources.find(s => s.key === 'default')?.stroke}
+                  strokeWidth={3}
+                  dot={{ r: 4, strokeWidth: 2 }}
+                  connectNulls={false}
+                />
+              )}
+              
+              {sources.filter(s => s.key !== 'default').map((source) => (
+                <Line
+                  key={source.key}
+                  type="monotone"
+                  dataKey={`${source.key}_value`}
+                  stroke={source.stroke}
+                  strokeWidth={3}
+                  dot={{ r: 4, strokeWidth: 2 }}
+                  connectNulls={false}
+                />
+              ))}
+            </LineChart>
+          );
+
+        case 'bar':
+          return (
+            <BarChart {...commonProps}>
+              <CartesianGrid strokeDasharray="3 3" stroke={theme === 'dark' ? '#333' : '#e5e7eb'} />
+              <XAxis {...commonAxisProps.xAxis} />
+              <YAxis {...commonAxisProps.yAxis} />
+              <Tooltip content={<CustomTooltip />} />
+              
+              {sources.find(s => s.key === 'default') && (
+                <Bar
+                  dataKey="defaultValue"
+                  fill={sources.find(s => s.key === 'default')?.stroke}
+                  opacity={0.8}
+                />
+              )}
+              
+              {sources.filter(s => s.key !== 'default').map((source) => (
+                <Bar
+                  key={source.key}
+                  dataKey={`${source.key}_value`}
+                  fill={source.stroke}
+                  opacity={0.8}
+                />
+              ))}
+            </BarChart>
+          );
+
+        default: // area
+          return (
+            <AreaChart {...commonProps}>
+              <CartesianGrid strokeDasharray="3 3" stroke={theme === 'dark' ? '#333' : '#e5e7eb'} />
+              <XAxis {...commonAxisProps.xAxis} />
+              <YAxis {...commonAxisProps.yAxis} />
+              <Tooltip content={<CustomTooltip />} />
+              
+              {sources.find(s => s.key === 'default') && (
+                <Area
+                  type="monotone"
+                  dataKey="defaultValue"
+                  stroke={sources.find(s => s.key === 'default')?.stroke}
+                  fill={sources.find(s => s.key === 'default')?.fill}
+                  strokeWidth={3}
+                  dot={false}
+                  connectNulls={false}
+                />
+              )}
+              
+              {sources.filter(s => s.key !== 'default').map((source) => (
+                <Area
+                  key={source.key}
+                  type="monotone"
+                  dataKey={`${source.key}_value`}
+                  stroke={source.stroke}
+                  fill={source.fill}
+                  strokeWidth={3}
+                  dot={false}
+                  connectNulls={false}
+                />
+              ))}
+            </AreaChart>
+          );
+      }
+    } else {
+      // Single source charts remain the same
+      return (
+        <AreaChart {...commonProps}>
+          <CartesianGrid strokeDasharray="3 3" stroke={theme === 'dark' ? '#333' : '#e5e7eb'} />
+          <XAxis {...commonAxisProps.xAxis} />
+          <YAxis {...commonAxisProps.yAxis} />
+          <Tooltip content={<CustomTooltip />} />
+          
+          <Area 
+            type="monotone" 
+            dataKey="upValue"
+            stroke="#10b981"
+            fill="rgba(16, 185, 129, 0.2)"
+            strokeWidth={3}
+            dot={false}
+            connectNulls={false}
+          />
+          
+          <Area 
+            type="monotone" 
+            dataKey="downValue"
+            stroke="#ef4444"
+            fill="rgba(239, 68, 68, 0.2)"
+            strokeWidth={3}
+            dot={false}
+            connectNulls={false}
+          />
+          
+          <Area 
+            type="monotone" 
+            dataKey="warningValue"
+            stroke="#f59e0b"
+            fill="rgba(245, 158, 11, 0.2)"
+            strokeWidth={3}
+            dot={false}
+            connectNulls={false}
+          />
+          
+          {chartData.map((entry, index) => 
+            entry.status === 'paused' ? (
+              <ReferenceLine 
+                key={`ref-${index}`}
+                x={entry.time} 
+                stroke="#9ca3af"
+                strokeDasharray="3 3"
+              />
+            ) : null
+          )}
+        </AreaChart>
+      );
+    }
+  };
+
+  // Check if we have any data to display
+  const hasData = uptimeData.length > 0;
+  
+  // Get date range for display
+  const dateRange = useMemo(() => {
+    if (!chartData.length) return { start: "", end: "" };
+    
+    const sortedData = [...chartData].sort((a, b) => a.rawTime - b.rawTime);
+    return {
+      start: sortedData[0]?.date || "",
+      end: sortedData[sortedData.length - 1]?.date || ""
+    };
+  }, [chartData]);
+  
+  // Display date range if different dates
+  const dateRangeDisplay = dateRange.start === dateRange.end 
+    ? dateRange.start 
+    : `${dateRange.start} - ${dateRange.end}`;
+  
+  return (
+    <Card className="mb-8">
+      <CardHeader>
+        <CardTitle className="flex flex-col md:flex-row md:items-center gap-2 justify-between">
+          <span>Response Time History</span>
+          <div className="flex items-center gap-4">
+            {hasMultipleSources && (
+              <div className="flex items-center gap-2 bg-muted/30 p-1 rounded-lg border">
+                <Button
+                  variant={chartType === 'area' ? 'default' : 'ghost'}
+                  size="sm"
+                  onClick={() => setChartType('area')}
+                  className="h-8 px-2"
+                >
+                  <AreaChartIcon className="h-4 w-4" />
+                </Button>
+                <Button
+                  variant={chartType === 'line' ? 'default' : 'ghost'}
+                  size="sm"
+                  onClick={() => setChartType('line')}
+                  className="h-8 px-2"
+                >
+                  <TrendingUp className="h-4 w-4" />
+                </Button>
+                <Button
+                  variant={chartType === 'bar' ? 'default' : 'ghost'}
+                  size="sm"
+                  onClick={() => setChartType('bar')}
+                  className="h-8 px-2"
+                >
+                  <BarChart3 className="h-4 w-4" />
+                </Button>
+              </div>
+            )}
+            {hasData && (
+              <span className="text-sm font-normal text-muted-foreground">
+                {dateRangeDisplay}
+              </span>
+            )}
+          </div>
+        </CardTitle>
+        {hasMultipleSources && (
+          <div className="flex flex-wrap gap-4 text-sm bg-muted/30 p-3 rounded-lg border">
+            <div className="flex items-center gap-2 text-xs font-medium text-muted-foreground mb-2 w-full">
+              <span>Monitoring Sources:</span>
+            </div>
+            {sources.map(source => (
+              <div key={source.key} className="flex items-center gap-2 bg-background px-3 py-1.5 rounded-md border shadow-sm">
+                <div 
+                  className="w-3 h-3 rounded-full border border-white shadow-sm" 
+                  style={{ backgroundColor: source.stroke }}
+                ></div>
+                <span className="font-medium">{String(source.label)}</span>
+                <span className="text-xs text-muted-foreground">({source.colorName})</span>
+              </div>
+            ))}
+          </div>
+        )}
+      </CardHeader>
+      <CardContent>
+        {!hasData ? (
+          <div className="h-80 flex items-center justify-center text-muted-foreground">
+            <p>No data available for the selected time period.</p>
+          </div>
+        ) : (
+          <div className="h-80">
+            <ResponsiveContainer width="100%" height="100%">
+              {renderChart()}
+            </ResponsiveContainer>
+          </div>
+        )}
+      </CardContent>
+    </Card>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/ServiceDeleteDialog.tsx b/application/src/components/services/ServiceDeleteDialog.tsx
new file mode 100644
index 0000000..1109bc4
--- /dev/null
+++ b/application/src/components/services/ServiceDeleteDialog.tsx
@@ -0,0 +1,77 @@
+
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { Service } from "@/types/service.types";
+import { useTheme } from "@/contexts/ThemeContext";
+import { Loader2 } from "lucide-react";
+
+interface ServiceDeleteDialogProps {
+  isOpen: boolean;
+  onOpenChange: (open: boolean) => void;
+  selectedService: Service | null;
+  onConfirmDelete: () => Promise<void>;
+  isDeleting?: boolean;
+}
+
+export const ServiceDeleteDialog = ({
+  isOpen,
+  onOpenChange,
+  selectedService,
+  onConfirmDelete,
+  isDeleting = false,
+}: ServiceDeleteDialogProps) => {
+  const { theme } = useTheme();
+  
+  const handleConfirm = async () => {
+    if (!isDeleting) {
+      await onConfirmDelete();
+    }
+  };
+  
+  return (
+    <AlertDialog open={isOpen} onOpenChange={onOpenChange}>
+      <AlertDialogContent className={`${theme === 'dark' ? 'bg-gray-900 text-white border-gray-800' : 'bg-background text-foreground border-border'}`}>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Are you sure you want to delete this service?</AlertDialogTitle>
+          <AlertDialogDescription className={theme === 'dark' ? 'text-gray-400' : 'text-muted-foreground'}>
+            This action cannot be undone. This will permanently delete{' '}
+            <span className={theme === 'dark' ? 'font-semibold text-white' : 'font-semibold text-foreground'}>
+              {selectedService?.name}
+            </span>{' '}
+            and all of its uptime records.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel 
+            className={theme === 'dark' ? 'bg-gray-800 text-white border-gray-700 hover:bg-gray-700' : 'bg-secondary'}
+            disabled={isDeleting}
+          >
+            Cancel
+          </AlertDialogCancel>
+          <AlertDialogAction
+            onClick={handleConfirm}
+            disabled={isDeleting}
+            className={theme === 'dark' ? 'bg-red-900 text-white hover:bg-red-800' : 'bg-red-600 text-white hover:bg-red-700'}
+          >
+            {isDeleting ? (
+              <>
+                <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                Deleting...
+              </>
+            ) : (
+              'Delete'
+            )}
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+};
diff --git a/application/src/components/services/ServiceDetailContainer.tsx b/application/src/components/services/ServiceDetailContainer.tsx
new file mode 100644
index 0000000..e19901d
--- /dev/null
+++ b/application/src/components/services/ServiceDetailContainer.tsx
@@ -0,0 +1,6 @@
+
+import { ServiceDetailContainer as NewServiceDetailContainer } from "./ServiceDetailContainer/index";
+
+export const ServiceDetailContainer = () => {
+  return <NewServiceDetailContainer />;
+};
diff --git a/application/src/components/services/ServiceDetailContainer/ServiceDetailWrapper.tsx b/application/src/components/services/ServiceDetailContainer/ServiceDetailWrapper.tsx
new file mode 100644
index 0000000..cc2153d
--- /dev/null
+++ b/application/src/components/services/ServiceDetailContainer/ServiceDetailWrapper.tsx
@@ -0,0 +1,44 @@
+import React from "react";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { Header } from "@/components/dashboard/Header";
+import { LoadingState } from "@/components/services/LoadingState";
+import { ServiceNotFound } from "@/components/services/ServiceNotFound";
+import { Service } from "@/types/service.types";
+
+interface ServiceDetailWrapperProps {
+  children?: React.ReactNode;
+  isLoading: boolean;
+  service: Service | null;
+  currentUser: any;
+  handleLogout: () => void;
+}
+
+export const ServiceDetailWrapper = ({
+  children,
+  isLoading,
+  service,
+  currentUser,
+  handleLogout
+}: ServiceDetailWrapperProps) => {
+  return (
+    <div className="flex h-screen w-full overflow-hidden bg-background text-foreground">
+      <Sidebar />
+      <div className="flex flex-col flex-1 min-w-0">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+        />
+        
+        {isLoading ? (
+          <LoadingState />
+        ) : !service ? (
+          <ServiceNotFound />
+        ) : (
+          <div className="flex-1 overflow-auto">
+            {children}
+          </div>
+        )}
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/ServiceDetailContainer/hooks/index.ts b/application/src/components/services/ServiceDetailContainer/hooks/index.ts
new file mode 100644
index 0000000..68d53ec
--- /dev/null
+++ b/application/src/components/services/ServiceDetailContainer/hooks/index.ts
@@ -0,0 +1,3 @@
+
+export * from './useServiceData';
+export * from './useRealTimeUpdates';
diff --git a/application/src/components/services/ServiceDetailContainer/hooks/useRealTimeUpdates.tsx b/application/src/components/services/ServiceDetailContainer/hooks/useRealTimeUpdates.tsx
new file mode 100644
index 0000000..b4e6d82
--- /dev/null
+++ b/application/src/components/services/ServiceDetailContainer/hooks/useRealTimeUpdates.tsx
@@ -0,0 +1,134 @@
+
+import { useEffect, useRef } from "react";
+import { pb } from "@/lib/pocketbase";
+import { Service, UptimeData } from "@/types/service.types";
+
+interface UseRealTimeUpdatesProps {
+  serviceId: string | undefined;
+  startDate: Date;
+  endDate: Date;
+  setService: React.Dispatch<React.SetStateAction<Service | null>>;
+  setUptimeData: React.Dispatch<React.SetStateAction<UptimeData[]>>;
+}
+
+export const useRealTimeUpdates = ({
+  serviceId,
+  startDate,
+  endDate,
+  setService,
+  setUptimeData
+}: UseRealTimeUpdatesProps) => {
+  const subscriptionsRef = useRef<{
+    service?: () => void;
+    uptime?: () => void;
+  }>({});
+  
+  const lastUpdateRef = useRef<number>(0);
+  const updateThrottleMs = 30000; // Throttle to once per 30 seconds for better performance
+
+  // Listen for real-time updates to this service with throttling
+  useEffect(() => {
+    if (!serviceId) return;
+
+   // console.log(`Setting up real-time updates for service: ${serviceId}`);
+    
+    const setupSubscriptions = async () => {
+      try {
+        // Clean up existing subscriptions first
+        if (subscriptionsRef.current.service) {
+          subscriptionsRef.current.service();
+        }
+        if (subscriptionsRef.current.uptime) {
+          subscriptionsRef.current.uptime();
+        }
+
+        // Subscribe to the service record with throttling
+        const serviceUnsubscribe = await pb.collection('services').subscribe(serviceId, function(e) {
+          const now = Date.now();
+          if (now - lastUpdateRef.current < updateThrottleMs) {
+           // console.log("Service update throttled");
+            return;
+          }
+          lastUpdateRef.current = now;
+          
+         // console.log("Service updated (throttled):", e.record);
+          
+          // Update our local state with the new data
+          if (e.record) {
+            setService(prev => {
+              if (!prev) return null;
+              return {
+                ...prev,
+                status: e.record.status || prev.status,
+                responseTime: e.record.response_time || e.record.responseTime || prev.responseTime,
+                uptime: e.record.uptime || prev.uptime,
+                lastChecked: e.record.last_checked || e.record.lastChecked || prev.lastChecked,
+              };
+            });
+          }
+        });
+
+        subscriptionsRef.current.service = serviceUnsubscribe;
+
+        // Subscribe to uptime data updates with throttling
+        const uptimeUnsubscribe = await pb.collection('uptime_data').subscribe('*', function(e) {
+          if (!e.record || e.record.service_id !== serviceId) return;
+          
+          const now = Date.now();
+          if (now - lastUpdateRef.current < updateThrottleMs) {
+           // console.log("Uptime data update throttled");
+            return;
+          }
+          lastUpdateRef.current = now;
+          
+         // console.log("New uptime data (throttled):", e.record);
+          
+          // Add the new uptime data to our list if it's within the selected date range
+          const timestamp = new Date(e.record.timestamp);
+          if (timestamp >= startDate && timestamp <= endDate) {
+            setUptimeData(prev => {
+              // Limit the array size to prevent memory issues
+              const maxRecords = 100;
+              const newData: UptimeData = {
+                id: e.record.id,
+                service_id: e.record.service_id,
+                serviceId: e.record.service_id,
+                timestamp: e.record.timestamp,
+                status: e.record.status,
+                responseTime: e.record.response_time || 0,
+                date: e.record.timestamp,
+                uptime: e.record.uptime || 0
+              };
+              
+              // Add at the beginning and limit array size
+              const updatedData = [newData, ...prev];
+              return updatedData.slice(0, maxRecords);
+            });
+          }
+        });
+
+        subscriptionsRef.current.uptime = uptimeUnsubscribe;
+
+      } catch (error) {
+      //  console.error("Error setting up real-time updates:", error);
+      }
+    };
+
+    setupSubscriptions();
+
+    // Return cleanup function
+    return () => {
+    // console.log(`Cleaning up subscriptions for service: ${serviceId}`);
+      try {
+        if (subscriptionsRef.current.service) {
+          subscriptionsRef.current.service();
+        }
+        if (subscriptionsRef.current.uptime) {
+          subscriptionsRef.current.uptime();
+        }
+      } catch (error) {
+       // console.error("Error cleaning up subscriptions:", error);
+      }
+    };
+  }, [serviceId, startDate, endDate, setService, setUptimeData]);
+};
\ No newline at end of file
diff --git a/application/src/components/services/ServiceDetailContainer/hooks/useServiceData.tsx b/application/src/components/services/ServiceDetailContainer/hooks/useServiceData.tsx
new file mode 100644
index 0000000..0fbcb6b
--- /dev/null
+++ b/application/src/components/services/ServiceDetailContainer/hooks/useServiceData.tsx
@@ -0,0 +1,248 @@
+
+import { useState, useEffect, useCallback, useMemo } from "react";
+import { pb } from "@/lib/pocketbase";
+import { Service, UptimeData } from "@/types/service.types";
+import { useToast } from "@/hooks/use-toast";
+import { useNavigate } from "react-router-dom";
+import { uptimeService } from "@/services/uptimeService";
+import { DateRangeOption } from "../../DateRangeFilter";
+import { useQuery } from "@tanstack/react-query";
+import { regionalService } from "@/services/regionalService";
+
+export const useServiceData = (serviceId: string | undefined, startDate: Date, endDate: Date) => {
+  const [service, setService] = useState<Service | null>(null);
+  const [uptimeData, setUptimeData] = useState<UptimeData[]>([]);
+  const [isLoading, setIsLoading] = useState(true);
+  const [selectedRegionalAgent, setSelectedRegionalAgent] = useState<string>("all");
+  const { toast } = useToast();
+  const navigate = useNavigate();
+
+  // Get regional agents for "all" monitoring with optimized caching
+  const { data: regionalAgents = [] } = useQuery({
+    queryKey: ['regional-services'],
+    queryFn: regionalService.getRegionalServices,
+    enabled: selectedRegionalAgent === "all",
+    staleTime: 5 * 60 * 1000, // Cache for 5 minutes
+    gcTime: 10 * 60 * 1000, // Keep in cache for 10 minutes
+    refetchOnWindowFocus: false,
+  });
+
+  const handleStatusChange = useCallback(async (newStatus: "up" | "down" | "paused" | "warning") => {
+    if (!service || !serviceId) return;
+
+    try {
+      setService({ ...service, status: newStatus as Service["status"] });
+      
+      await pb.collection('services').update(serviceId, {
+        status: newStatus
+      });
+      
+      toast({
+        title: "Status updated",
+        description: `Service status changed to ${newStatus}`,
+      });
+    } catch (error) {
+    //  console.error("Failed to update service status:", error);
+      setService(prevService => prevService);
+      
+      toast({
+        variant: "destructive",
+        title: "Update failed",
+        description: "Could not update service status. Please try again.",
+      });
+    }
+  }, [service, serviceId, toast]);
+
+  const fetchUptimeData = useCallback(async (serviceId: string, start: Date, end: Date, selectedRange?: DateRangeOption | string, regionalAgent?: string) => {
+    try {
+      if (!service) {
+      //  console.log('No service data available for uptime fetch');
+        return [];
+      }
+
+      const currentAgent = regionalAgent || selectedRegionalAgent;
+     // console.log(`Fetching uptime data: ${start.toISOString()} to ${end.toISOString()} for range: ${selectedRange}, service type: ${service.type}, regional agent: ${currentAgent}`);
+      
+      // Clear existing data immediately when switching agents
+      setUptimeData([]);
+      
+      let limit = 500; // Default limit
+      
+      if (selectedRange === '24h') {
+        limit = 300;
+      } else if (selectedRange === '7d') {
+        limit = 400;
+      }
+      
+     // console.log(`Using limit ${limit} for range ${selectedRange}`);
+      
+      let history: UptimeData[] = [];
+      
+      if (currentAgent === "all") {
+        // Fetch data from all sources (default + all online regional agents)
+      //  console.log(`Fetching data from all monitoring sources`);
+        
+        // Fetch default monitoring data
+        const defaultData = await uptimeService.getUptimeHistory(serviceId, limit, start, end, service.type);
+       // console.log(`Retrieved ${defaultData.length} default monitoring records`);
+        
+        // Mark default data with source identifier
+        const markedDefaultData = defaultData.map(record => ({
+          ...record,
+          source: 'default' as const,
+          region_name: undefined,
+          agent_id: undefined
+        }));
+        
+        history = [...markedDefaultData];
+        
+        // Fetch regional monitoring data from all online agents
+        const onlineAgents = regionalAgents.filter(agent => agent.connection === 'online');
+        
+        for (const agent of onlineAgents) {
+          try {
+            const regionalData = await uptimeService.getUptimeHistoryByRegionalAgent(
+              serviceId, limit, start, end, service.type, agent.region_name, agent.agent_id
+            );
+          //  console.log(`Retrieved ${regionalData.length} records from ${agent.region_name}`);
+            
+            // Mark regional data with source identifier
+            const markedRegionalData = regionalData.map(record => ({
+              ...record,
+              source: `${agent.region_name}|${agent.agent_id}` as const,
+              region_name: agent.region_name,
+              agent_id: agent.agent_id
+            }));
+            
+            history = [...history, ...markedRegionalData];
+          } catch (error) {
+          //  console.error(`Error fetching data from ${agent.region_name}:`, error);
+          }
+        }
+        
+       // console.log(`Total combined records: ${history.length}`);
+        
+      } else {
+        // Fetch regional agent specific data
+        const [regionName, agentId] = currentAgent.split("|");
+       // console.log(`Fetching regional agent data for region: ${regionName}, agent: ${agentId} from ${service.type} collection`);
+        history = await uptimeService.getUptimeHistoryByRegionalAgent(serviceId, limit, start, end, service.type, regionName, agentId);
+       // console.log(`Retrieved ${history.length} regional monitoring records`);
+      }
+      
+      // Sort by timestamp (newest first)
+      const filteredHistory = [...history].sort((a, b) => 
+        new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
+      );
+      
+     // console.log(`Final dataset: ${filteredHistory.length} records for ${currentAgent === "all" ? "all sources" : "regional"} monitoring`);
+      setUptimeData(filteredHistory);
+      return filteredHistory;
+    } catch (error) {
+     // console.error("Error fetching uptime data:", error);
+      toast({
+        variant: "destructive",
+        title: "Error",
+        description: "Failed to load uptime history. Please try again.",
+      });
+      return [];
+    }
+  }, [service, selectedRegionalAgent, regionalAgents, toast]);
+
+  const handleRegionalAgentChange = useCallback((agent: string) => {
+   // console.log(`Regional agent changed from ${selectedRegionalAgent} to: ${agent}`);
+    
+    // Clear data immediately when switching
+    setUptimeData([]);
+    setSelectedRegionalAgent(agent);
+    
+    // Refetch data with new agent selection
+    if (serviceId && !isLoading && service) {
+    //  console.log(`Refetching data for new agent: ${agent}`);
+      fetchUptimeData(serviceId, startDate, endDate, '24h', agent);
+    }
+  }, [selectedRegionalAgent, serviceId, isLoading, service, fetchUptimeData, startDate, endDate]);
+
+  // Memoize the service data fetching to prevent unnecessary re-runs
+  const fetchServiceData = useCallback(async () => {
+    try {
+      if (!serviceId) {
+        setIsLoading(false);
+        return;
+      }
+      
+      setIsLoading(true);
+      
+      const timeoutPromise = new Promise((_, reject) => {
+        setTimeout(() => reject(new Error("Request timed out")), 10000);
+      });
+      
+      const fetchPromise = pb.collection('services').getOne(serviceId);
+      const serviceData = await Promise.race([fetchPromise, timeoutPromise]) as any;
+      
+      const formattedService: Service = {
+        id: serviceData.id,
+        name: serviceData.name,
+        url: serviceData.url || "",
+        host: serviceData.host || "",
+        port: serviceData.port || undefined,
+        domain: serviceData.domain || "",
+        type: serviceData.service_type || serviceData.type || "HTTP",
+        status: serviceData.status || "paused",
+        responseTime: serviceData.response_time || serviceData.responseTime || 0,
+        uptime: serviceData.uptime || 0,
+        lastChecked: serviceData.last_checked || serviceData.lastChecked || new Date().toLocaleString(),
+        interval: serviceData.heartbeat_interval || serviceData.interval || 60,
+        retries: serviceData.max_retries || serviceData.retries || 3,
+        notificationChannel: serviceData.notification_id,
+        alertTemplate: serviceData.template_id,
+        alerts: serviceData.alerts || "unmuted"
+      };
+      
+     // console.log(`Loaded service: ${formattedService.name} (${formattedService.type})`);
+      setService(formattedService);
+      
+      // Small delay to ensure state is updated before fetching uptime data
+      await new Promise(resolve => setTimeout(resolve, 100));
+    } catch (error) {
+     // console.error("Error fetching service:", error);
+      toast({
+        variant: "destructive",
+        title: "Error",
+        description: "Failed to load service data. Please try again.",
+      });
+      navigate("/dashboard");
+    } finally {
+      setIsLoading(false);
+    }
+  }, [serviceId, navigate, toast]);
+
+  // Initial data loading
+  useEffect(() => {
+    fetchServiceData();
+  }, [fetchServiceData]);
+
+  // Update data when date range changes or when service is loaded - with debouncing
+  useEffect(() => {
+    if (serviceId && !isLoading && service) {
+      const timeoutId = setTimeout(() => {
+      //  console.log(`Date range changed or service loaded, refetching data for ${serviceId}: ${startDate.toISOString()} to ${endDate.toISOString()}`);
+        fetchUptimeData(serviceId, startDate, endDate, '24h', selectedRegionalAgent);
+      }, 500); // Debounce API calls by 500ms
+
+      return () => clearTimeout(timeoutId);
+    }
+  }, [startDate, endDate, serviceId, isLoading, service, selectedRegionalAgent, regionalAgents, fetchUptimeData]);
+
+  return useMemo(() => ({
+    service,
+    setService,
+    uptimeData,
+    setUptimeData,
+    isLoading,
+    handleStatusChange,
+    fetchUptimeData,
+    selectedRegionalAgent,
+    handleRegionalAgentChange
+  }), [service, uptimeData, isLoading, handleStatusChange, fetchUptimeData, selectedRegionalAgent, handleRegionalAgentChange]);
+};
\ No newline at end of file
diff --git a/application/src/components/services/ServiceDetailContainer/index.tsx b/application/src/components/services/ServiceDetailContainer/index.tsx
new file mode 100644
index 0000000..3b2ab8f
--- /dev/null
+++ b/application/src/components/services/ServiceDetailContainer/index.tsx
@@ -0,0 +1,82 @@
+import React, { useState, useCallback } from "react";
+import { useParams, useNavigate } from "react-router-dom";
+import { DateRangeOption } from "../DateRangeFilter";
+import { authService } from "@/services/authService";
+import { ServiceDetailContent } from "../ServiceDetailContent";
+import { ServiceDetailWrapper } from "./ServiceDetailWrapper";
+import { useServiceData, useRealTimeUpdates } from "./hooks";
+
+export const ServiceDetailContainer = () => {
+  const { id } = useParams<{ id: string }>();
+  const navigate = useNavigate();
+  
+  const [startDate, setStartDate] = useState<Date>(() => {
+    const date = new Date();
+    date.setHours(date.getHours() - 24);
+    return date;
+  });
+  const [endDate, setEndDate] = useState<Date>(() => {
+    const date = new Date();
+    date.setMinutes(date.getMinutes() + 5);
+    return date;
+  });
+  const [selectedRange, setSelectedRange] = useState<DateRangeOption>('24h');
+  
+  const currentUser = authService.getCurrentUser();
+  
+  const handleLogout = () => {
+    authService.logout();
+    navigate("/login");
+  };
+
+  const {
+    service,
+    uptimeData,
+    isLoading,
+    handleStatusChange,
+    fetchUptimeData,
+    setService,
+    setUptimeData,
+    selectedRegionalAgent,
+    handleRegionalAgentChange
+  } = useServiceData(id, startDate, endDate);
+
+  useRealTimeUpdates({
+    serviceId: id,
+    startDate,
+    endDate,
+    setService,
+    setUptimeData
+  });
+
+  const handleDateRangeChange = useCallback((start: Date, end: Date, option: DateRangeOption) => {
+    setStartDate(start);
+    setEndDate(end);
+    setSelectedRange(option);
+    
+    if (id) {
+      fetchUptimeData(id, start, end, option, selectedRegionalAgent);
+    }
+  }, [id, fetchUptimeData, selectedRegionalAgent]);
+
+  return (
+    <ServiceDetailWrapper
+      isLoading={isLoading}
+      service={service}
+      currentUser={currentUser}
+      handleLogout={handleLogout}
+    >
+      {service ? (
+        <ServiceDetailContent 
+          service={service}
+          uptimeData={uptimeData}
+          onDateRangeChange={handleDateRangeChange}
+          onStatusChange={handleStatusChange}
+          selectedDateOption={selectedRange}
+          selectedRegionalAgent={selectedRegionalAgent}
+          onRegionalAgentChange={handleRegionalAgentChange}
+        />
+      ) : null}
+    </ServiceDetailWrapper>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/ServiceDetailContent.tsx b/application/src/components/services/ServiceDetailContent.tsx
new file mode 100644
index 0000000..8c26143
--- /dev/null
+++ b/application/src/components/services/ServiceDetailContent.tsx
@@ -0,0 +1,83 @@
+import { Service, UptimeData } from "@/types/service.types";
+import { ServiceHeader } from "@/components/services/ServiceHeader";
+import { ServiceStatsCards } from "@/components/services/ServiceStatsCards";
+import { ResponseTimeChart } from "@/components/services/ResponseTimeChart";
+import { LatestChecksTable } from "@/components/services/incident-history"; 
+import { DateRangeFilter, DateRangeOption } from "@/components/services/DateRangeFilter";
+import { Card, CardContent } from "@/components/ui/card";
+import { AlertTriangle } from "lucide-react";
+
+interface ServiceDetailContentProps {
+  service: Service;
+  uptimeData: UptimeData[];
+  onDateRangeChange: (start: Date, end: Date, option: DateRangeOption) => void;
+  onStatusChange: (newStatus: "up" | "down" | "paused" | "warning") => void;
+  selectedDateOption: DateRangeOption;
+  selectedRegionalAgent: string;
+  onRegionalAgentChange: (agent: string) => void;
+}
+
+export const ServiceDetailContent = ({
+  service,
+  uptimeData,
+  onDateRangeChange,
+  onStatusChange,
+  selectedDateOption,
+  selectedRegionalAgent,
+  onRegionalAgentChange
+}: ServiceDetailContentProps) => {
+  // Check if data is available
+  const hasUptimeData = uptimeData && uptimeData.length > 0;
+  
+  return (
+    <div className="p-4 md:p-6 pb-0 h-full overflow-auto">
+      <ServiceHeader 
+        service={service} 
+        onStatusChange={onStatusChange}
+        selectedRegionalAgent={selectedRegionalAgent}
+        onRegionalAgentChange={onRegionalAgentChange}
+        uptimeData={uptimeData}
+      />
+      <ServiceStatsCards service={service} uptimeData={uptimeData} />
+      
+      <div className="mb-4 md:mb-6 mt-6 md:mt-8 flex flex-col lg:flex-row justify-between items-start lg:items-center gap-4">
+        <h2 className="text-lg md:text-xl font-medium">Response Time History</h2>
+        <div className="flex flex-col md:flex-row items-start md:items-center gap-4">
+          <div className="flex flex-col md:flex-row items-start md:items-center gap-2">
+            <span className="text-sm text-muted-foreground">
+              Collection: {service.type.toLowerCase() === 'ping' || service.type.toLowerCase() === 'icmp' ? 'ping_data' : 
+                          service.type.toLowerCase() === 'dns' ? 'dns_data' : 
+                          service.type.toLowerCase() === 'tcp' ? 'tcp_data' : 'uptime_data'}
+            </span>
+            <DateRangeFilter 
+              onRangeChange={onDateRangeChange} 
+              selectedOption={selectedDateOption} 
+            />
+          </div>
+        </div>
+      </div>
+      
+      {!hasUptimeData && (
+        <Card className="mb-6 md:mb-8">
+          <CardContent className="flex items-center justify-center py-8 md:py-12">
+            <div className="text-center">
+              <AlertTriangle className="h-10 w-10 md:h-12 md:w-12 text-amber-500 mx-auto mb-2 md:mb-3 opacity-70" />
+              <h3 className="text-base md:text-lg font-medium mb-1">No uptime data available</h3>
+              <p className="text-muted-foreground max-w-md text-sm md:text-base">
+                There's no monitoring data for this service in the selected time period
+                {selectedRegionalAgent !== "default" ? " from the selected regional agent" : ""}.
+                This could be because the service was recently added or monitoring is paused.
+              </p>
+            </div>
+          </CardContent>
+        </Card>
+      )}
+      
+      {hasUptimeData && <ResponseTimeChart uptimeData={uptimeData} />}
+      
+      <div className="pb-6">
+        <LatestChecksTable uptimeData={uptimeData} />
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/ServiceEditDialog.tsx b/application/src/components/services/ServiceEditDialog.tsx
new file mode 100644
index 0000000..d020d56
--- /dev/null
+++ b/application/src/components/services/ServiceEditDialog.tsx
@@ -0,0 +1,79 @@
+
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { ServiceForm } from "./ServiceForm";
+import { Service } from "@/types/service.types";
+import { useQueryClient } from "@tanstack/react-query";
+import { useState, useEffect } from "react";
+import { ScrollArea } from "@/components/ui/scroll-area";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServiceEditDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  service: Service | null;
+}
+
+export function ServiceEditDialog({ open, onOpenChange, service }: ServiceEditDialogProps) {
+	const { t } = useLanguage();
+  const queryClient = useQueryClient();
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  
+  // Reset submission state when dialog opens/closes
+  useEffect(() => {
+    if (!open) {
+      setIsSubmitting(false);
+    }
+  }, [open]);
+  
+  const handleSuccess = () => {
+    // Invalidate the services query to trigger a refetch
+    queryClient.invalidateQueries({ queryKey: ["services"] });
+    setIsSubmitting(false);
+    onOpenChange(false);
+  };
+
+  const handleCancel = () => {
+    if (!isSubmitting) {
+      onOpenChange(false);
+    }
+  };
+
+  // Only render the form if dialog is open and service data exists
+  // This prevents form validation errors when dialog is closed
+  return (
+    <Dialog open={open} onOpenChange={(newOpen) => {
+      // Only allow closing if not currently submitting
+      if (!isSubmitting || !newOpen) {
+        onOpenChange(newOpen);
+      }
+    }}>
+      <DialogContent className="sm:max-w-[700px] max-h-[90vh] flex flex-col">
+        <DialogHeader>
+          <DialogTitle className="text-xl">{t("editService")}</DialogTitle>
+          <DialogDescription>
+	          {t("editServiceDesc")}
+          </DialogDescription>
+        </DialogHeader>
+        {open && service && (
+          <ScrollArea className="flex-1 pr-4 overflow-auto" style={{ height: "calc(80vh - 180px)" }}>
+            <div className="pr-2">
+              <ServiceForm 
+                onSuccess={handleSuccess} 
+                onCancel={handleCancel}
+                initialData={service}
+                isEdit={true}
+                onSubmitStart={() => setIsSubmitting(true)}
+              />
+            </div>
+          </ScrollArea>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/ServiceForm.tsx b/application/src/components/services/ServiceForm.tsx
new file mode 100644
index 0000000..b353005
--- /dev/null
+++ b/application/src/components/services/ServiceForm.tsx
@@ -0,0 +1,3 @@
+
+// Re-export the ServiceForm component from the add-service directory
+export { ServiceForm } from './add-service/ServiceForm';
\ No newline at end of file
diff --git a/application/src/components/services/ServiceHeader.tsx b/application/src/components/services/ServiceHeader.tsx
new file mode 100644
index 0000000..9bf2b15
--- /dev/null
+++ b/application/src/components/services/ServiceHeader.tsx
@@ -0,0 +1,116 @@
+
+import { ArrowLeft, Globe, BarChart3 } from "lucide-react";
+import { useNavigate } from "react-router-dom";
+import { Button } from "@/components/ui/button";
+import { StatusBadge } from "@/components/services/StatusBadge";
+import { ServiceMonitoringButton } from "@/components/services/ServiceMonitoringButton";
+import { RegionalAgentFilter } from "@/components/services/RegionalAgentFilter";
+import { HeatmapDialog } from "./HeatmapDialog";
+import { Service, UptimeData } from "@/types/service.types";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { cn } from "@/lib/utils";
+import { useState } from "react";
+
+interface ServiceHeaderProps {
+  service: Service;
+  onStatusChange?: (newStatus: "up" | "down" | "paused" | "warning") => void;
+  selectedRegionalAgent?: string;
+  onRegionalAgentChange?: (agent: string) => void;
+  uptimeData?: UptimeData[];
+}
+
+export function ServiceHeader({ 
+  service, 
+  onStatusChange, 
+  selectedRegionalAgent, 
+  onRegionalAgentChange,
+  uptimeData = []
+}: ServiceHeaderProps) {
+  const navigate = useNavigate();
+  const { t } = useLanguage();
+  const [showHeatmap, setShowHeatmap] = useState(false);
+  
+  return (
+    <>
+      <div className="mb-6">
+        <Button 
+          variant="ghost" 
+          className="mb-4 pl-0 hover:bg-transparent" 
+          onClick={() => navigate("/dashboard")}
+        >
+          <ArrowLeft className="mr-2 h-4 w-4" />
+          {t("back")}
+        </Button>
+        
+        <div className="flex flex-col md:flex-row md:items-center justify-between gap-4">
+          <div className="flex items-center">
+            <h1 className="text-2xl font-bold">{service.name}</h1>
+            
+            {/* Pulsating Circle Animation */}
+            <div className="relative ml-2 flex items-center">
+              <span 
+                className={cn(
+                  "flex h-3 w-3 relative",
+                  service.status === "up" ? "bg-green-500" : 
+                  service.status === "down" ? "bg-red-500" :
+                  service.status === "warning" ? "bg-yellow-500" : 
+                  "bg-blue-500",
+                  "rounded-full"
+                )}
+              />
+              <span 
+                className={cn(
+                  "animate-ping absolute h-3 w-3",
+                  service.status === "up" ? "bg-green-400" : 
+                  service.status === "down" ? "bg-red-400" :
+                  service.status === "warning" ? "bg-yellow-400" : 
+                  "bg-blue-400",
+                  "rounded-full opacity-75"
+                )}
+              />
+            </div>
+            
+            {service.url && (
+              <a 
+                href={service.url} 
+                target="_blank" 
+                rel="noopener noreferrer"
+                className="text-primary/80 hover:text-primary text-sm flex items-center mt-1 ml-1"
+              >
+                <Globe className="h-3 w-3 mr-1" />
+                {service.url}
+              </a>
+            )}
+          </div>
+          
+          <div className="flex items-center space-x-4">
+            <StatusBadge status={service.status} size="lg" />
+            <ServiceMonitoringButton service={service} onStatusChange={onStatusChange} />
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => setShowHeatmap(true)}
+              className="bg-blue-900/20 hover:bg-blue-900/30"
+            >
+              <BarChart3 className="h-4 w-4 mr-2" />
+              Heatmap
+            </Button>
+            {selectedRegionalAgent !== undefined && onRegionalAgentChange && (
+              <RegionalAgentFilter 
+                selectedAgent={selectedRegionalAgent}
+                onAgentChange={onRegionalAgentChange}
+              />
+            )}
+          </div>
+        </div>
+      </div>
+
+      <HeatmapDialog
+        open={showHeatmap}
+        onOpenChange={setShowHeatmap}
+        serviceName={service.name}
+        uptimeData={uptimeData}
+      />
+    </>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/ServiceHistoryDialog.tsx b/application/src/components/services/ServiceHistoryDialog.tsx
new file mode 100644
index 0000000..efcf8f7
--- /dev/null
+++ b/application/src/components/services/ServiceHistoryDialog.tsx
@@ -0,0 +1,75 @@
+
+import { useState, useEffect } from "react";
+import { 
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription
+} from "@/components/ui/dialog";
+import { Service } from "@/types/service.types";
+import { ServiceUptimeHistory } from "@/components/services/ServiceUptimeHistory";
+import { useTheme } from "@/contexts/ThemeContext";
+import { DateRangeFilter, DateRangeOption } from "@/components/services/DateRangeFilter";
+
+interface ServiceHistoryDialogProps {
+  isOpen: boolean;
+  onOpenChange: (open: boolean) => void;
+  selectedService: Service | null;
+}
+
+export const ServiceHistoryDialog = ({
+  isOpen,
+  onOpenChange,
+  selectedService,
+}: ServiceHistoryDialogProps) => {
+  const { theme } = useTheme();
+  const [startDate, setStartDate] = useState<Date>(new Date(Date.now() - 24 * 60 * 60 * 1000)); // Default to 24h ago
+  const [endDate, setEndDate] = useState<Date>(new Date());
+  
+  // Reset date range when dialog opens to ensure fresh data
+  useEffect(() => {
+    if (isOpen) {
+      setStartDate(new Date(Date.now() - 24 * 60 * 60 * 1000));
+      setEndDate(new Date());
+    }
+  }, [isOpen]);
+  
+  // Handle date range filter changes
+  const handleDateRangeChange = (start: Date, end: Date, option: DateRangeOption) => {
+    console.log(`ServiceHistoryDialog: Date range changed to ${start.toISOString()} - ${end.toISOString()}`);
+    setStartDate(start);
+    setEndDate(end);
+  };
+  
+  return (
+    <Dialog open={isOpen} onOpenChange={onOpenChange}>
+      <DialogContent className={`${theme === 'dark' ? 'bg-black text-white border-gray-800' : 'bg-background text-foreground border-border'} sm:max-w-[800px]`}>
+        <DialogHeader>
+          <DialogTitle className="text-xl">
+            {selectedService?.name} - Uptime History
+          </DialogTitle>
+          <DialogDescription className={theme === 'dark' ? 'text-gray-400' : 'text-muted-foreground'}>
+            Showing the most recent uptime checks for this service.
+            {selectedService?.interval && (
+              <span> Checked every {selectedService.interval} seconds.</span>
+            )}
+          </DialogDescription>
+        </DialogHeader>
+        
+        <div className="mb-4">
+          <DateRangeFilter onRangeChange={handleDateRangeChange} />
+        </div>
+        
+        {selectedService && (
+          <ServiceUptimeHistory 
+            serviceId={selectedService.id} 
+            serviceType={selectedService.type}
+            startDate={startDate}
+            endDate={endDate}
+          />
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/ServiceMonitoringButton.tsx b/application/src/components/services/ServiceMonitoringButton.tsx
new file mode 100644
index 0000000..8a0aed0
--- /dev/null
+++ b/application/src/components/services/ServiceMonitoringButton.tsx
@@ -0,0 +1,94 @@
+
+import { useState, useEffect } from "react";
+import { Button } from "@/components/ui/button";
+import { Play, Pause } from "lucide-react";
+import { Service } from "@/types/service.types";
+import { serviceService } from "@/services/serviceService"; 
+import { useToast } from "@/hooks/use-toast";
+
+interface ServiceMonitoringButtonProps {
+  service: Service;
+  onStatusChange?: (newStatus: "up" | "down" | "paused" | "warning") => void;
+}
+
+export function ServiceMonitoringButton({ service, onStatusChange }: ServiceMonitoringButtonProps) {
+  const [isMonitoring, setIsMonitoring] = useState(service.status !== "paused");
+  const [isLoading, setIsLoading] = useState(false);
+  const { toast } = useToast();
+
+  // Update local state when service prop changes
+  useEffect(() => {
+    setIsMonitoring(service.status !== "paused");
+  }, [service.status]);
+
+  const handleToggleMonitoring = async () => {
+    try {
+      setIsLoading(true);
+      
+      if (isMonitoring) {
+        // Pause monitoring
+      //  console.log(`Pausing monitoring for service ${service.id} (${service.name})`);
+        await serviceService.pauseMonitoring(service.id);
+        setIsMonitoring(false);
+        
+        if (onStatusChange) onStatusChange("paused");
+        
+        // Notification handling removed - will be handled by backend
+       // console.log("Service paused - notifications will be handled by backend");
+        
+        toast({
+          title: "Monitoring paused",
+          description: `Monitoring for ${service.name} has been paused.`,
+        });
+      } else {
+        // Start/resume monitoring
+      //  console.log(`Starting monitoring for service ${service.id} (${service.name})`);
+        
+        // First ensure we update the status in the database to not be paused anymore
+        await serviceService.resumeMonitoring(service.id);
+        setIsMonitoring(true);
+        
+        // Perform an immediate check
+        await serviceService.startMonitoringService(service.id);
+        
+        toast({
+          title: "Monitoring resumed",
+          description: `Monitoring for ${service.name} has been resumed. First check is running now.`,
+        });
+      }
+    } catch (error) {
+     // console.error("Error toggling monitoring:", error);
+      toast({
+        variant: "destructive",
+        title: "Error",
+        description: "Failed to change monitoring status. Please try again.",
+      });
+    } finally {
+      setIsLoading(false);
+    }
+  };
+
+  return (
+    <Button
+      variant="outline" 
+      size="sm"
+      onClick={handleToggleMonitoring}
+      disabled={isLoading}
+      className={isMonitoring ? "bg-red-900/20 hover:bg-red-900/30" : "bg-green-900/20 hover:bg-green-900/30"}
+    >
+      {isLoading ? (
+        "Processing..."
+      ) : isMonitoring ? (
+        <>
+          <Pause className="h-4 w-4 mr-2" />
+          Pause Monitoring
+        </>
+      ) : (
+        <>
+          <Play className="h-4 w-4 mr-2" />
+          Start Monitoring
+        </>
+      )}
+    </Button>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/ServiceNotFound.tsx b/application/src/components/services/ServiceNotFound.tsx
new file mode 100644
index 0000000..6873da0
--- /dev/null
+++ b/application/src/components/services/ServiceNotFound.tsx
@@ -0,0 +1,25 @@
+
+import { AlertTriangle } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { useNavigate } from "react-router-dom";
+
+export function ServiceNotFound() {
+  const navigate = useNavigate();
+  
+  return (
+    <div className="flex items-center justify-center h-screen bg-background text-foreground">
+      <div className="text-center">
+        <AlertTriangle className="mx-auto h-12 w-12 text-yellow-500" />
+        <h2 className="text-xl font-bold mt-4">Service Not Found</h2>
+        <p className="mt-2 text-muted-foreground">The service you're looking for doesn't exist or has been deleted.</p>
+        <Button 
+          className="mt-4" 
+          variant="outline" 
+          onClick={() => navigate("/dashboard")}
+        >
+          Back to Dashboard
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/application/src/components/services/ServiceRow.tsx b/application/src/components/services/ServiceRow.tsx
new file mode 100644
index 0000000..1340e87
--- /dev/null
+++ b/application/src/components/services/ServiceRow.tsx
@@ -0,0 +1,86 @@
+
+import React from "react";
+import { TableRow, TableCell } from "@/components/ui/table";
+import { Service } from "@/types/service.types";
+import { StatusBadge } from "./StatusBadge";
+import { UptimeBar } from "./UptimeBar";
+import { LastCheckedTime } from "./LastCheckedTime";
+import { 
+  ServiceRowActions, 
+  ServiceRowHeader, 
+  ServiceRowResponseTime 
+} from "./service-row";
+import { useTheme } from "@/contexts/ThemeContext";
+
+interface ServiceRowProps {
+  service: Service;
+  onViewDetail: (service: Service) => void;
+  onPauseResume: (service: Service) => Promise<void>;
+  onEdit: (service: Service) => void;
+  onDelete: (service: Service) => void;
+  onMuteAlerts?: (service: Service) => Promise<void>;
+}
+
+export const ServiceRow = ({ 
+  service, 
+  onViewDetail,
+  onPauseResume,
+  onEdit, 
+  onDelete,
+  onMuteAlerts
+}: ServiceRowProps) => {
+  const { theme } = useTheme();
+  const handleRowClick = () => {
+    onViewDetail(service);
+  };
+
+  // Get the timestamp to display - use only lastChecked since that's what's defined in the Service type
+  const displayTimestamp = service.lastChecked || new Date().toLocaleString();
+
+  return (
+    <TableRow 
+      key={service.id} 
+      className={`border-b ${theme === 'dark' ? 'border-gray-800 hover:bg-gray-900/60' : 'border-gray-200 hover:bg-gray-50'} cursor-pointer`}
+      onClick={handleRowClick}
+    >
+      <TableCell className="font-medium py-4">
+        <ServiceRowHeader service={service} />
+      </TableCell>
+      <TableCell className={`text-base py-4 ${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'}`}>
+        {service.type}
+      </TableCell>
+      <TableCell className="py-4">
+        <StatusBadge status={service.status} size="md" />
+      </TableCell>
+      <TableCell className="py-4">
+        <ServiceRowResponseTime responseTime={service.responseTime} />
+      </TableCell>
+      <TableCell className="w-60 py-4">
+        <UptimeBar 
+          uptime={service.uptime} 
+          status={service.status} 
+          serviceId={service.id} 
+          interval={service.interval}
+          serviceType={service.type}
+        />
+      </TableCell>
+      <TableCell className="py-4">
+        <LastCheckedTime 
+          lastCheckedTime={displayTimestamp} 
+          status={service.status} 
+          interval={service.interval} 
+        />
+      </TableCell>
+      <TableCell onClick={(e) => e.stopPropagation()} className="py-4">
+        <ServiceRowActions 
+          service={service} 
+          onViewDetail={onViewDetail}
+          onPauseResume={onPauseResume}
+          onEdit={onEdit}
+          onDelete={onDelete}
+          onMuteAlerts={onMuteAlerts}
+        />
+      </TableCell>
+    </TableRow>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/ServiceStatsCards.tsx b/application/src/components/services/ServiceStatsCards.tsx
new file mode 100644
index 0000000..4d84708
--- /dev/null
+++ b/application/src/components/services/ServiceStatsCards.tsx
@@ -0,0 +1,179 @@
+
+import { Clock, Server, ArrowUp, ArrowDown } from "lucide-react";
+import { Service, UptimeData } from "@/types/service.types";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { useMemo } from "react";
+import { formatDistanceStrict } from "date-fns";
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface ServiceStatsCardsProps {
+  service: Service;
+  uptimeData: UptimeData[];
+}
+
+export function ServiceStatsCards({ service, uptimeData }: ServiceStatsCardsProps) {
+
+	const { t } = useLanguage();
+  // Calculate uptime percentage
+  const calculateUptimePercentage = () => {
+    if (uptimeData.length === 0) return 100;
+    
+    const totalChecks = uptimeData.length;
+    const upChecks = uptimeData.filter(data => data.status === "up").length;
+    return Math.round((upChecks / totalChecks) * 100);
+  };
+
+  // Calculate total uptime/downtime
+  const uptimeStats = useMemo(() => {
+    if (uptimeData.length === 0) {
+      return {
+        totalUptimeFormatted: "N/A",
+        totalDowntimeFormatted: "N/A",
+        currentStatusDuration: "N/A"
+      };
+    }
+
+    // Sort data by timestamp for chronological analysis
+    const sortedData = [...uptimeData].sort((a, b) => 
+      new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime()
+    );
+
+    // Get the status change events
+    const statusChanges = sortedData.reduce((changes, check, index) => {
+      if (index === 0 || (index > 0 && sortedData[index-1].status !== check.status)) {
+        changes.push(check);
+      }
+      return changes;
+    }, [] as UptimeData[]);
+
+    let totalUptime = 0;
+    let totalDowntime = 0;
+    let currentStatus = service.status;
+    let lastChangeTime = new Date();
+
+    // Calculate durations between status changes
+    for (let i = 0; i < statusChanges.length; i++) {
+      const currentChange = statusChanges[i];
+      const nextChange = statusChanges[i + 1];
+      
+      if (nextChange) {
+        const duration = new Date(nextChange.timestamp).getTime() - new Date(currentChange.timestamp).getTime();
+        
+        if (currentChange.status === "up") {
+          totalUptime += duration;
+        } else {
+          totalDowntime += duration;
+        }
+      } else {
+        // For the last status, calculate time until now
+        lastChangeTime = new Date(currentChange.timestamp);
+        currentStatus = currentChange.status;
+      }
+    }
+    
+    // Add time from last change until now for current status
+    const now = new Date();
+    const sinceLastChange = now.getTime() - lastChangeTime.getTime();
+    
+    if (currentStatus === "up") {
+      totalUptime += sinceLastChange;
+    } else if (currentStatus === "down") {
+      totalDowntime += sinceLastChange;
+    }
+    
+    // Format durations
+    const formatDuration = (ms: number): string => {
+      if (ms < 1000) return "0s";
+      return formatDistanceStrict(0, ms, { addSuffix: false });
+    };
+
+    return {
+      totalUptimeFormatted: formatDuration(totalUptime),
+      totalDowntimeFormatted: formatDuration(totalDowntime),
+      currentStatusDuration: formatDuration(sinceLastChange)
+    };
+  }, [uptimeData, service.status]);
+
+  // Calculate average response time from recent checks
+  const calculateAverageResponseTime = () => {
+    const upChecks = uptimeData.filter(data => data.status === "up" && data.responseTime > 0);
+    if (upChecks.length === 0) return service.responseTime || 0;
+    
+    const sum = upChecks.reduce((total, check) => total + check.responseTime, 0);
+    return Math.round((sum / upChecks.length) * 100) / 100; // Two decimal precision
+  };
+
+  const uptimePercentage = calculateUptimePercentage();
+  const avgResponseTime = calculateAverageResponseTime();
+  // Define upChecks here so we can use it in both the calculation and the JSX
+  const upChecks = uptimeData.filter(data => data.status === "up" && data.responseTime > 0);
+
+  return (
+    <div className="grid grid-cols-1 md:grid-cols-3 gap-4 mb-8">
+      <Card className="border-blue-400 dark:border-blue-700 bg-blue-50 dark:bg-blue-900/50 shadow-md">
+        <CardHeader className="pb-2">
+          <CardTitle className="text-sm font-medium text-blue-800 dark:text-blue-100">{t('responseTime')}</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="text-2xl font-bold text-blue-700 dark:text-white">
+            {service.responseTime}ms
+          </div>
+          <p className="text-xs text-blue-600 dark:text-blue-200 mt-1">{t('lastCheckedAt').replace('{datetime}', service.lastChecked)}</p>
+          {avgResponseTime > 0 && avgResponseTime !== service.responseTime && (
+            <p className="text-xs text-blue-600 dark:text-blue-200 mt-1">{t('avg')}: {avgResponseTime}ms ({t('lastUpChecksCount').replace('{count}', String(upChecks.length))})</p>
+          )}
+        </CardContent>
+      </Card>
+      
+      <Card className="border-green-400 dark:border-green-700 bg-green-50 dark:bg-green-900/50 shadow-md">
+        <CardHeader className="pb-2">
+          <CardTitle className="text-sm font-medium text-green-800 dark:text-green-100">{t('uptime')}</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="text-2xl font-bold text-green-700 dark:text-white">
+            {uptimePercentage}%
+          </div>
+          <p className="text-xs text-green-600 dark:text-green-200 mt-1">{t('basedOnlastChecksCount').replace('{count}', String(uptimeData.length))}</p>
+          <div className="flex flex-col space-y-1 mt-2">
+            <div className="flex items-center text-xs text-green-600 dark:text-green-200">
+              <ArrowUp className="h-3 w-3 mr-1 text-green-600 dark:text-green-400" />
+              <span>{t("totalUptime")}: {uptimeStats.totalUptimeFormatted}</span>
+            </div>
+            <div className="flex items-center text-xs text-red-600 dark:text-red-200">
+              <ArrowDown className="h-3 w-3 mr-1 text-red-600 dark:text-red-400" />
+              <span>{t("totalDowntime")}: {uptimeStats.totalDowntimeFormatted}</span>
+            </div>
+            {service.status !== "paused" && (
+              <div className="flex items-center text-xs font-medium mt-1">
+                <span className={service.status === "up" ? "text-green-600 dark:text-green-400" : "text-red-600 dark:text-red-400"}>
+                  {
+										service.status === "up" ?
+											t('upStatusDuration').replace("{duration}", uptimeStats.currentStatusDuration)
+											:
+											t('downStatusDuration').replace("{duration}", uptimeStats.currentStatusDuration)
+									}
+                </span>
+              </div>
+            )}
+          </div>
+        </CardContent>
+      </Card>
+      
+      <Card className="border-purple-400 dark:border-purple-700 bg-purple-50 dark:bg-purple-900/50 shadow-md">
+        <CardHeader className="pb-2">
+          <CardTitle className="text-sm font-medium text-purple-800 dark:text-purple-100">{t('monitoringSettings')}</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="flex items-center text-sm text-purple-700 dark:text-purple-200">
+            <Clock className="h-4 w-4 mr-2 text-purple-600 dark:text-purple-400" />
+            <span>{t('monitoringSettingsInterval').replace('{interval}', String(service.interval))}</span>
+          </div>
+          <div className="flex items-center text-sm text-purple-700 dark:text-purple-200 mt-1">
+            <Server className="h-4 w-4 mr-2 text-purple-600 dark:text-purple-400" />
+            <span>{service.type} {t('monitoringSettingsType')}</span>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}
diff --git a/application/src/components/services/ServiceUptimeHistory.tsx b/application/src/components/services/ServiceUptimeHistory.tsx
new file mode 100644
index 0000000..fa75419
--- /dev/null
+++ b/application/src/components/services/ServiceUptimeHistory.tsx
@@ -0,0 +1,143 @@
+
+import { useQuery } from "@tanstack/react-query";
+import { UptimeData, Service } from "@/types/service.types"; 
+import { uptimeService } from "@/services/uptimeService";
+import { format, parseISO } from "date-fns";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { Badge } from "@/components/ui/badge";
+import { useTheme } from "@/contexts/ThemeContext";
+import { Check, X, AlertTriangle, Pause } from "lucide-react";
+
+interface ServiceUptimeHistoryProps {
+  serviceId: string;
+  serviceType: string; // Add service type to determine collection
+  startDate?: Date;
+  endDate?: Date;
+}
+
+export function ServiceUptimeHistory({ 
+  serviceId, 
+  serviceType,
+  startDate = new Date(Date.now() - 24 * 60 * 60 * 1000), 
+  endDate = new Date() 
+}: ServiceUptimeHistoryProps) {
+  const { theme } = useTheme();
+  const { data: uptimeHistory, isLoading, error } = useQuery({
+    queryKey: ['uptimeHistory', serviceId, serviceType, startDate?.toISOString(), endDate?.toISOString()],
+    queryFn: () => {
+   //   console.log(`ServiceUptimeHistory: Fetching for service ${serviceId} of type ${serviceType}`);
+      return uptimeService.getUptimeHistory(serviceId, 200, startDate, endDate, serviceType);
+    },
+    enabled: !!serviceId && !!serviceType,
+    refetchInterval: 5000, // Refresh UI every 5 seconds
+  });
+
+  if (isLoading) {
+    return (
+      <div className="py-4 text-center">
+        <p>Loading uptime history...</p>
+      </div>
+    );
+  }
+
+  if (error) {
+    return (
+      <div className="py-4 text-center">
+        <p>Error loading uptime history.</p>
+      </div>
+    );
+  }
+
+  if (!uptimeHistory || uptimeHistory.length === 0) {
+    return (
+      <div className="py-4 text-center">
+        <p>No uptime history available for the selected time period.</p>
+      </div>
+    );
+  }
+
+  // Function to get appropriate status badge styling
+  const getStatusBadge = (status: string) => {
+    switch(status) {
+      case 'up':
+        return {
+          variant: 'default' as const, 
+          className: 'bg-emerald-800 text-white hover:bg-emerald-700',
+          icon: <Check className="h-3 w-3 mr-1" />
+        };
+      case 'warning':
+        return {
+          variant: 'outline' as const,
+          className: 'bg-yellow-800/80 text-yellow-300 border-yellow-700 hover:bg-yellow-800',
+          icon: <AlertTriangle className="h-3 w-3 mr-1" />
+        };
+      case 'paused':
+        return {
+          variant: 'outline' as const,
+          className: 'bg-gray-800/50 text-gray-400 border-gray-700 hover:bg-gray-800',
+          icon: <Pause className="h-3 w-3 mr-1" />
+        };
+      default:
+        return {
+          variant: 'destructive' as const,
+          className: '',
+          icon: <X className="h-3 w-3 mr-1" />
+        };
+    }
+  };
+
+  return (
+    <div className="mt-4 bg-card rounded-lg overflow-hidden">
+      <Table>
+        <TableHeader>
+          <TableRow className="border-b border-border">
+            <TableHead className="text-muted-foreground font-medium">Time</TableHead>
+            <TableHead className="text-muted-foreground font-medium">Status</TableHead>
+            <TableHead className="text-muted-foreground font-medium">Response Time</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {uptimeHistory.map((record) => {
+            const statusBadge = getStatusBadge(record.status);
+            const isResponseTimeHigh = record.responseTime >= 1000;
+            
+            return (
+              <TableRow key={record.id} className="border-b border-border">
+                <TableCell>
+                  {format(parseISO(record.timestamp), 'yyyy-MM-dd HH:mm:ss')}
+                </TableCell>
+                <TableCell>
+                  <Badge 
+                    variant={statusBadge.variant}
+                    className={statusBadge.className}
+                  >
+                    <span className="flex items-center">
+                      {statusBadge.icon}
+                      {record.status === 'up' ? 'Up' : 
+                       record.status === 'down' ? 'Down' : 
+                       record.status === 'warning' ? 'Warning' : 'Paused'}
+                    </span>
+                  </Badge>
+                </TableCell>
+                <TableCell>
+                  <div className="font-mono flex items-center gap-1.5">
+                    {record.responseTime > 0 ? (
+                      <>
+                        <span className={isResponseTimeHigh ? "text-amber-500 font-semibold" : ""}>
+                          {record.responseTime}ms
+                        </span>
+                        {isResponseTimeHigh && (
+                          <AlertTriangle className="h-3 w-3 text-amber-500" />
+                        )}
+                      </>
+                    ) : 'N/A'}
+                  </div>
+                </TableCell>
+              </TableRow>
+            );
+          })}
+        </TableBody>
+      </Table>
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/ServicesPagination.tsx b/application/src/components/services/ServicesPagination.tsx
new file mode 100644
index 0000000..458142e
--- /dev/null
+++ b/application/src/components/services/ServicesPagination.tsx
@@ -0,0 +1,131 @@
+
+import { 
+  Pagination, 
+  PaginationContent, 
+  PaginationItem, 
+  PaginationLink, 
+  PaginationNext, 
+  PaginationPrevious 
+} from "@/components/ui/pagination";
+import { 
+  Select, 
+  SelectContent, 
+  SelectItem, 
+  SelectTrigger, 
+  SelectValue 
+} from "@/components/ui/select";
+import { PageSize } from "@/hooks/useServicesPagination";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServicesPaginationProps {
+  currentPage: number;
+  totalPages: number;
+  pageSize: PageSize;
+  totalItems: number;
+  onPageChange: (page: number) => void;
+  onPageSizeChange: (size: PageSize) => void;
+}
+
+export function ServicesPagination({
+  currentPage,
+  totalPages,
+  pageSize,
+  totalItems,
+  onPageChange,
+  onPageSizeChange,
+}: ServicesPaginationProps) {
+  const { t } = useLanguage();
+
+  // Generate page numbers to display
+  const getPageNumbers = () => {
+    const pages = [];
+    const maxVisiblePages = 5;
+    const halfVisible = Math.floor(maxVisiblePages / 2);
+    
+    let startPage = Math.max(1, currentPage - halfVisible);
+    let endPage = Math.min(totalPages, startPage + maxVisiblePages - 1);
+    
+    // Adjust start page if we don't have enough pages at the end
+    if (endPage - startPage + 1 < maxVisiblePages) {
+      startPage = Math.max(1, endPage - maxVisiblePages + 1);
+    }
+    
+    for (let i = startPage; i <= endPage; i++) {
+      pages.push(i);
+    }
+    
+    return pages;
+  };
+
+  const startItem = Math.min((currentPage - 1) * pageSize + 1, totalItems);
+  const endItem = Math.min(currentPage * pageSize, totalItems);
+
+  return (
+    <div className="flex items-center justify-between py-4 px-4 border-t border-border">
+      <div className="flex items-center space-x-2">
+       <span className="text-sm text-muted-foreground whitespace-nowrap">
+        {t("rowsPerPage") ?? "Rows per page"}:
+       </span>
+        <Select
+          value={pageSize.toString()}
+          onValueChange={(value) => onPageSizeChange(parseInt(value) as PageSize)}
+        >
+          <SelectTrigger className="h-8 w-[70px]">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="10">10</SelectItem>
+            <SelectItem value="30">30</SelectItem>
+            <SelectItem value="50">50</SelectItem>
+          </SelectContent>
+        </Select>
+        <span className="text-sm text-muted-foreground whitespace-nowrap">
+	        {totalItems > 0
+           ? t("servicesPagination", {"startItem": startItem, "endItem": endItem, "totalItems": totalItems})
+           : t("servicesPaginationNoService")
+          }
+        </span>
+      </div>
+      
+      {totalPages > 1 && (
+        <Pagination>
+          <PaginationContent>
+            <PaginationItem>
+              <PaginationPrevious
+                onClick={() => onPageChange(Math.max(1, currentPage - 1))}
+                className={
+                  currentPage === 1 
+                    ? "pointer-events-none opacity-50" 
+                    : "cursor-pointer"
+                }
+              />
+            </PaginationItem>
+            
+            {getPageNumbers().map((page) => (
+              <PaginationItem key={page}>
+                <PaginationLink
+                  isActive={page === currentPage}
+                  onClick={() => onPageChange(page)}
+                  className="cursor-pointer"
+                >
+                  {page}
+                </PaginationLink>
+              </PaginationItem>
+            ))}
+            
+            <PaginationItem>
+              <PaginationNext
+                onClick={() => onPageChange(Math.min(totalPages, currentPage + 1))}
+                className={
+                  currentPage === totalPages 
+                    ? "pointer-events-none opacity-50" 
+                    : "cursor-pointer"
+                }
+              />
+            </PaginationItem>
+          </PaginationContent>
+        </Pagination>
+      )}
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/ServicesTableContainer.tsx b/application/src/components/services/ServicesTableContainer.tsx
new file mode 100644
index 0000000..589f4ee
--- /dev/null
+++ b/application/src/components/services/ServicesTableContainer.tsx
@@ -0,0 +1,115 @@
+
+import { useEffect } from "react";
+import { Service } from "@/types/service.types";
+import { ServicesTableView } from "./ServicesTableView";
+import { ServicesPagination } from "./ServicesPagination";
+import { ServiceDeleteDialog } from "./ServiceDeleteDialog";
+import { ServiceHistoryDialog } from "./ServiceHistoryDialog";
+import { ServiceEditDialog } from "./ServiceEditDialog";
+import { useServiceActions, useDialogState } from "./hooks";
+import { useServicesPagination } from "@/hooks/useServicesPagination";
+
+interface ServicesTableContainerProps {
+  services: Service[];
+}
+
+export const ServicesTableContainer = ({ services }: ServicesTableContainerProps) => {
+  const {
+    services: localServices,
+    selectedService,
+    isDeleting,
+    setSelectedService,
+    updateServices,
+    handleViewDetail,
+    handlePauseResume,
+    handleEdit,
+    handleDelete,
+    confirmDelete,
+    handleMuteAlerts
+  } = useServiceActions(services);
+
+  const {
+    isHistoryDialogOpen,
+    isDeleteDialogOpen,
+    isEditDialogOpen,
+    setIsHistoryDialogOpen,
+    setIsDeleteDialogOpen,
+    handleEditDialogChange,
+    handleDeleteDialogChange
+  } = useDialogState();
+
+  const {
+    paginatedServices,
+    currentPage,
+    totalPages,
+    pageSize,
+    totalItems,
+    handlePageChange,
+    handlePageSizeChange,
+  } = useServicesPagination({ services: localServices });
+
+  // Update local services state when props change
+  useEffect(() => {
+    updateServices(services);
+  }, [services]);
+
+  // Handler functions that combine local state management
+  const onEdit = (service: Service) => {
+    const selectedService = handleEdit(service);
+    setTimeout(() => {
+      handleEditDialogChange(true);
+    }, 0);
+  };
+  
+  const onDelete = (service: Service) => {
+    handleDelete(service);
+    setIsDeleteDialogOpen(true);
+  };
+  
+  const openHistoryDialog = (service: Service) => {
+    setSelectedService(service);
+    setIsHistoryDialogOpen(true);
+  };
+
+  return (
+    <div className="flex-1 flex flex-col h-full">
+      <ServicesTableView 
+        services={paginatedServices}
+        onViewDetail={handleViewDetail}
+        onPauseResume={handlePauseResume}
+        onEdit={onEdit}
+        onDelete={onDelete}
+        onMuteAlerts={handleMuteAlerts}
+      />
+
+      <ServicesPagination
+        currentPage={currentPage}
+        totalPages={totalPages}
+        pageSize={pageSize}
+        totalItems={totalItems}
+        onPageChange={handlePageChange}
+        onPageSizeChange={handlePageSizeChange}
+      />
+
+      <ServiceHistoryDialog 
+        isOpen={isHistoryDialogOpen}
+        onOpenChange={setIsHistoryDialogOpen}
+        selectedService={selectedService}
+      />
+
+      <ServiceDeleteDialog 
+        isOpen={isDeleteDialogOpen}
+        onOpenChange={(open) => handleDeleteDialogChange(open, isDeleting)}
+        selectedService={selectedService}
+        onConfirmDelete={confirmDelete}
+        isDeleting={isDeleting}
+      />
+
+      <ServiceEditDialog
+        open={isEditDialogOpen}
+        onOpenChange={handleEditDialogChange}
+        service={selectedService}
+      />
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/ServicesTableView.tsx b/application/src/components/services/ServicesTableView.tsx
new file mode 100644
index 0000000..cc545ca
--- /dev/null
+++ b/application/src/components/services/ServicesTableView.tsx
@@ -0,0 +1,68 @@
+
+import { Table, TableHeader, TableRow, TableHead, TableBody, TableCell } from "@/components/ui/table";
+import { Service } from "@/types/service.types";
+import { ServiceRow } from "@/components/services/ServiceRow";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServicesTableViewProps {
+  services: Service[];
+  onViewDetail: (service: Service) => void;
+  onPauseResume: (service: Service) => Promise<void>;
+  onEdit: (service: Service) => void;
+  onDelete: (service: Service) => void;
+  onMuteAlerts?: (service: Service) => Promise<void>;
+}
+
+export const ServicesTableView = ({ 
+  services,
+  onViewDetail,
+  onPauseResume,
+  onEdit,
+  onDelete,
+  onMuteAlerts
+}: ServicesTableViewProps) => {
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+
+  return (
+    <div className={`${theme === 'dark' ? 'bg-gray-900' : 'bg-white'} rounded-lg overflow-hidden border border-border shadow-sm`}>
+      <div className="overflow-auto">
+        <Table>
+          <TableHeader className={`${theme === 'dark' ? 'bg-gray-800' : 'bg-gray-50'} sticky top-0 z-10`}>
+            <TableRow className={`${theme === 'dark' ? 'border-gray-700 hover:bg-gray-800' : 'border-gray-200 hover:bg-gray-100'}`}>
+              <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t("serviceName")}</TableHead>
+              <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t("serviceType")}</TableHead>
+              <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t("serviceStatus")}</TableHead>
+              <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t("responseTime")}</TableHead>
+              <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t("uptime")}</TableHead>
+              <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t("lastChecked")}</TableHead>
+              <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t("actions")}</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {services.length > 0 ? (
+              services.map((service) => (
+                <ServiceRow 
+                  key={service.id}
+                  service={service}
+                  onViewDetail={onViewDetail}
+                  onPauseResume={onPauseResume}
+                  onEdit={onEdit}
+                  onDelete={onDelete}
+                  onMuteAlerts={onMuteAlerts}
+                />
+              ))
+            ) : (
+              <TableRow>
+                <TableCell colSpan={7} className={`text-center py-8 text-base ${theme === 'dark' ? 'text-gray-300' : 'text-gray-500'}`}>
+                  {t("noServices")}
+                </TableCell>
+              </TableRow>
+            )}
+          </TableBody>
+        </Table>
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/StatusBadge.tsx b/application/src/components/services/StatusBadge.tsx
new file mode 100644
index 0000000..df8b8de
--- /dev/null
+++ b/application/src/components/services/StatusBadge.tsx
@@ -0,0 +1,70 @@
+
+import React, { memo } from "react";
+import { Badge } from "@/components/ui/badge";
+import { Check } from "lucide-react";
+
+interface StatusBadgeProps {
+  status: "up" | "down" | "paused" | "warning";
+  size?: "sm" | "md" | "lg";
+}
+
+const StatusBadgeComponent = ({ status, size = "sm" }: StatusBadgeProps) => {
+  const getStatusConfig = (status: string) => {
+    switch (status) {
+      case "up":
+        return {
+          variant: "default" as const,
+          className: "bg-emerald-700 text-emerald-100 border-emerald-200 hover:bg-emerald-200",
+          label:     
+          <span className="flex items-center gap-1">
+          <Check className="w-4 h-4" /> Up
+          </span>
+          
+        };
+      case "down":
+        return {
+          variant: "destructive" as const,
+          className: "bg-red-700 text-red-100 border-red-200 hover:bg-red-200",
+          label: "Down"
+        };
+      case "warning":
+        return {
+          variant: "destructive" as const,
+          className: "bg-amber-700 text-amber-100 border-amber-200 hover:bg-amber-200",
+          label: "Warning"
+        };
+      case "paused":
+        return {
+          variant: "secondary" as const,
+          className: "bg-gray-700 text-gray-100 border-gray-200 hover:bg-gray-200",
+          label: "Paused"
+        };
+      default:
+        return {
+          variant: "outline" as const,
+          className: "bg-gray-700 text-gray-100 border-gray-200",
+          label: "Unknown"
+        };
+    }
+  };
+
+  const sizeClasses = {
+    sm: "text-xs px-2 py-1",
+    md: "text-sm px-3 py-1.5",
+    lg: "text-base px-4 py-2"
+  };
+
+  const config = getStatusConfig(status);
+
+  return (
+    <Badge 
+      variant={config.variant} 
+      className={`${config.className} ${sizeClasses[size]} font-medium`}
+    >
+      {config.label}
+    </Badge>
+  );
+};
+
+// Memoize the component to prevent unnecessary re-renders
+export const StatusBadge = memo(StatusBadgeComponent);
\ No newline at end of file
diff --git a/application/src/components/services/UptimeBar.tsx b/application/src/components/services/UptimeBar.tsx
new file mode 100644
index 0000000..0d3e74c
--- /dev/null
+++ b/application/src/components/services/UptimeBar.tsx
@@ -0,0 +1,98 @@
+
+import React, { memo, useMemo } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { TooltipProvider } from '@/components/ui/tooltip';
+import { UptimeStatusItem } from './uptime/UptimeStatusItem';
+import { uptimeService } from '@/services/uptimeService';
+import { UptimeData } from '@/types/service.types';
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface UptimeBarProps {
+  uptime: number;
+  status: string;
+  serviceId: string;
+  interval: number;
+  serviceType?: string;
+}
+
+const UptimeBarComponent = ({ uptime, status, serviceId, interval, serviceType = "HTTP" }: UptimeBarProps) => {
+	const { t } = useLanguage();
+  // Calculate date range for last 20 checks with much more aggressive caching
+  const endDate = useMemo(() => new Date(), []);
+  const startDate = useMemo(() => {
+    const start = new Date(endDate);
+    start.setHours(start.getHours() - Math.max(interval * 20 / 3600, 24)); // At least 24 hours
+    return start;
+  }, [endDate, interval]);
+
+  // Fetch uptime data with immediate display and background updates
+  const { data: uptimeData = [] } = useQuery({
+    queryKey: ['uptime-bar', serviceId, serviceType],
+    queryFn: () => uptimeService.getUptimeHistory(serviceId, 20, startDate, endDate, serviceType),
+    enabled: !!serviceId,
+    staleTime: 300000, // Data stays fresh for 5 minutes - display immediately from cache
+    gcTime: 900000, // Keep in cache for 15 minutes
+    refetchInterval: 300000, // Reduced to 5 minute polling
+    refetchOnWindowFocus: false,
+    refetchOnMount: false,
+    refetchOnReconnect: false,
+    retry: 1, // Reduce retries for faster failure
+    retryDelay: 1000, // Faster retry delay
+    refetchIntervalInBackground: true, // Allow background updates
+    placeholderData: (previousData) => previousData, // Keep showing previous data while refetching
+  });
+
+  // Memoize the uptime calculation to prevent unnecessary recalculations
+  const { uptimePercentage, displayData } = useMemo(() => {
+    if (!uptimeData || uptimeData.length === 0) {
+      return {
+        uptimePercentage: uptime || 0,
+        displayData: []
+      };
+    }
+
+    // Calculate uptime percentage from actual data
+    const upCount = uptimeData.filter(item => item.status === 'up').length;
+    const totalCount = uptimeData.length;
+    const calculatedUptime = totalCount > 0 ? (upCount / totalCount) * 100 : 0;
+
+    // Limit display to last 20 items for performance
+    const limitedData = uptimeData.slice(0, 20);
+
+    return {
+      uptimePercentage: Math.round(calculatedUptime * 100) / 100,
+      displayData: limitedData
+    };
+  }, [uptimeData, uptime]);
+
+  // Memoize the status items to prevent unnecessary re-renders
+  const statusItems = useMemo(() => 
+    displayData.map((item, index) => (
+      <UptimeStatusItem key={`${item.id}-${index}`} item={item} index={index} />
+    )),
+    [displayData]
+  );
+
+  return (
+    <TooltipProvider>
+      <div className="flex items-center space-x-3">
+        <div className="flex space-x-0.5 min-w-0">
+          {statusItems.length > 0 ? statusItems : (
+            // Fallback display when no data
+            <div className="h-5 w-1.5 rounded-sm bg-gray-400" />
+          )}
+        </div>
+        <span className="text-sm font-medium whitespace-nowrap">
+          {uptimePercentage.toFixed(1)}%
+        </span>
+      </div>
+      
+      <span className="text-xs text-muted-foreground">
+            {t('last20Checks')}
+      </span>    
+    </TooltipProvider>
+  );
+};
+
+// Memoize the component to prevent unnecessary re-renders
+export const UptimeBar = memo(UptimeBarComponent);
\ No newline at end of file
diff --git a/application/src/components/services/add-service/ServiceBasicFields.tsx b/application/src/components/services/add-service/ServiceBasicFields.tsx
new file mode 100644
index 0000000..5eda597
--- /dev/null
+++ b/application/src/components/services/add-service/ServiceBasicFields.tsx
@@ -0,0 +1,32 @@
+
+import { FormControl, FormField, FormItem, FormLabel, FormMessage } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { UseFormReturn } from "react-hook-form";
+import { ServiceFormData } from "./types";
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface ServiceBasicFieldsProps {
+  form: UseFormReturn<ServiceFormData>;
+}
+
+export function ServiceBasicFields({ form }: ServiceBasicFieldsProps) {
+  const { t } = useLanguage();
+  return (
+    <FormField
+      control={form.control}
+      name="name"
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>{t('serviceName')}</FormLabel>
+          <FormControl>
+            <Input 
+              placeholder={t('serviceNameDesc')}
+              {...field} 
+            />
+          </FormControl>
+          <FormMessage />
+        </FormItem>
+      )}
+    />
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/add-service/ServiceConfigFields.tsx b/application/src/components/services/add-service/ServiceConfigFields.tsx
new file mode 100644
index 0000000..718505a
--- /dev/null
+++ b/application/src/components/services/add-service/ServiceConfigFields.tsx
@@ -0,0 +1,121 @@
+
+import { FormControl, FormField, FormItem, FormLabel, FormMessage, FormDescription } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { UseFormReturn } from "react-hook-form";
+import { ServiceFormData } from "./types";
+import { ServiceUrlField } from "./ServiceUrlField";
+import { useState } from "react";
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface ServiceConfigFieldsProps {
+  form: UseFormReturn<ServiceFormData>;
+}
+
+export function ServiceConfigFields({ form }: ServiceConfigFieldsProps) {
+  const { t } = useLanguage();
+  const [isCustomInterval, setIsCustomInterval] = useState(false);
+  const intervalValue = form.watch("interval");
+
+  const handleIntervalChange = (value: string) => {
+    if (value === "custom") {
+      setIsCustomInterval(true);
+      form.setValue("interval", "");
+    } else {
+      setIsCustomInterval(false);
+      form.setValue("interval", value);
+    }
+  };
+
+  return (
+    <div className="space-y-4">
+      <ServiceUrlField form={form} />
+      
+      <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+        <FormField
+          control={form.control}
+          name="interval"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t("checkInterval")}</FormLabel>
+              {!isCustomInterval ? (
+                <FormControl>
+                  <Select onValueChange={handleIntervalChange} value={isCustomInterval ? "custom" : field.value}>
+                    <SelectTrigger>
+                      <SelectValue />
+                    </SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="30">30 {t("seconds")}</SelectItem>
+                      <SelectItem value="60">1 {t("minute")}</SelectItem>
+                      <SelectItem value="300">5 {t("minutes")}</SelectItem>
+                      <SelectItem value="900">15 {t("minutes")}</SelectItem>
+                      <SelectItem value="1800">30 {t("minutes")}</SelectItem>
+                      <SelectItem value="3600">1 {t("hour")}</SelectItem>
+                      <SelectItem value="custom">{t("custom")}</SelectItem>
+                    </SelectContent>
+                  </Select>
+                </FormControl>
+              ) : (
+                <div className="space-y-2">
+                  <FormControl>
+                    <Input
+                      type="number"
+                      placeholder={t("checkIntervalPlaceholder")}
+                      value={field.value}
+                      onChange={field.onChange}
+                      min="10"
+                    />
+                  </FormControl>
+                  <button
+                    type="button"
+                    onClick={() => {
+                      setIsCustomInterval(false);
+                      form.setValue("interval", "60");
+                    }}
+                    className="text-sm text-blue-600 hover:text-blue-800"
+                  >
+	                  {t("backToPresets")}
+                  </button>
+                </div>
+              )}
+              <FormDescription className="text-xs">
+                {isCustomInterval 
+                  ? t("checkIntervalDescCustom")
+                  : t("checkIntervalDesc")
+                }
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="retries"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t("retryAttempts")}</FormLabel>
+              <FormControl>
+                <Select onValueChange={field.onChange} value={field.value ?? "3"}>
+                  <SelectTrigger>
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="1">1 {t("attempt")}</SelectItem>
+                    <SelectItem value="2">2 {t("attempts")}</SelectItem>
+                    <SelectItem value="3">3 {t("attempts")}</SelectItem>
+                    <SelectItem value="5">5 {t("attempts")}</SelectItem>
+                  </SelectContent>
+                </Select>
+              </FormControl>
+              <FormDescription className="text-xs">
+	              {t("retryAttemptsDesc")}
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+      </div>
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/add-service/ServiceForm.tsx b/application/src/components/services/add-service/ServiceForm.tsx
new file mode 100644
index 0000000..3023ff6
--- /dev/null
+++ b/application/src/components/services/add-service/ServiceForm.tsx
@@ -0,0 +1,160 @@
+import { Form } from "@/components/ui/form";
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { useState, useEffect } from "react";
+import { useToast } from "@/hooks/use-toast";
+import { useServiceSchema, ServiceFormData } from "./types";
+import { ServiceBasicFields } from "./ServiceBasicFields";
+import { ServiceTypeField } from "./ServiceTypeField";
+import { ServiceConfigFields } from "./ServiceConfigFields";
+import { ServiceNotificationFields } from "./ServiceNotificationFields";
+import { ServiceFormActions } from "./ServiceFormActions";
+import { serviceService } from "@/services/serviceService";
+import { Service } from "@/types/service.types";
+import { ServiceRegionalFields } from "./ServiceRegionalFields";
+import { getServiceFormDefaults, mapServiceToFormData, mapFormDataToServiceData } from "./serviceFormUtils";
+import { useQueryClient } from "@tanstack/react-query";
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface ServiceFormProps {
+  onSuccess: () => void;
+  onCancel: () => void;
+  initialData?: Service | null;
+  isEdit?: boolean;
+  onSubmitStart?: () => void;
+}
+
+export function ServiceForm({ 
+  onSuccess, 
+  onCancel, 
+  initialData, 
+  isEdit = false,
+  onSubmitStart
+}: ServiceFormProps) {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const queryClient = useQueryClient();
+
+	const serviceSchema = useServiceSchema();
+
+  // Initialize form with default values
+  const form = useForm<ServiceFormData>({
+    resolver: zodResolver(serviceSchema),
+    defaultValues: getServiceFormDefaults(),
+    mode: "onBlur",
+  });
+
+  // Populate form when initialData changes (separate from initialization)
+  useEffect(() => {
+    if (initialData && isEdit) {
+      const formData = mapServiceToFormData(initialData);
+      form.reset(formData);
+
+      // Log for debugging
+    //  console.log("Populating form with data:", { 
+    //    type: formData.type, 
+    //    url: formData.url, 
+    //    port: formData.port, 
+    //    regionalAgents: formData.regionalAgents,
+    //    regionalMonitoringEnabled: formData.regionalMonitoringEnabled,
+    //    regional_status: initialData.regional_status,
+    //    region_name: initialData.region_name,
+    //    agent_id: initialData.agent_id,
+     //   notification_status: initialData.notification_status,
+     //   notificationChannels: formData.notificationChannels
+    //  });
+    }
+  }, [initialData, isEdit, form]);
+
+  const handleSubmit = async (data: ServiceFormData) => {
+    if (isSubmitting) return;
+    
+    setIsSubmitting(true);
+    if (onSubmitStart) onSubmitStart();
+    
+    try {
+     // console.log("Form data being submitted:", data);
+      
+      const serviceData = mapFormDataToServiceData(data);
+     // console.log("Service data being sent:", serviceData);
+      
+      if (isEdit && initialData) {
+        // Update existing service
+        await serviceService.updateService(initialData.id, serviceData);
+        
+        toast({
+          title: "Service updated",
+          description: `${data.name} has been updated successfully.`,
+        });
+      } else {
+        // Create new service
+        await serviceService.createService(serviceData);
+        
+        toast({
+          title: "Service created",
+          description: `${data.name} has been added to monitoring.`,
+        });
+      }
+      
+      // Force immediate refresh of services data
+      queryClient.setQueryData(["services"], (oldData: any) => {
+        // Invalidate the cache to force a fresh fetch
+        return undefined;
+      });
+      
+      // Invalidate and refetch services query
+      await queryClient.invalidateQueries({ queryKey: ["services"] });
+      await queryClient.refetchQueries({ queryKey: ["services"] });
+
+      onSuccess();
+      if (!isEdit) {
+        form.reset();
+      }
+    } catch (error) {
+     // console.error(`Error ${isEdit ? 'updating' : 'creating'} service:`, error);
+      toast({
+        title: `Failed to ${isEdit ? 'update' : 'create'} service`,
+        description: `An error occurred while ${isEdit ? 'updating' : 'creating'} the service.`,
+        variant: "destructive",
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  return (
+    <Form {...form}>
+      <form onSubmit={form.handleSubmit(handleSubmit)} className="space-y-6 pb-6">
+        <div className="space-y-6">
+          <div className="space-y-4">
+            <h3 className="text-sm font-medium text-muted-foreground border-b pb-2">{t('basicInformation')}</h3>
+            <ServiceBasicFields form={form} />
+            <ServiceTypeField form={form} />
+          </div>
+          
+          <div className="space-y-4">
+            <h3 className="text-sm font-medium text-muted-foreground border-b pb-2">{t('configuration')}</h3>
+            <ServiceConfigFields form={form} />
+          </div>
+
+          <div className="space-y-4">
+            <h3 className="text-sm font-medium text-muted-foreground border-b pb-2">{t('regionalMonitoring')}</h3>
+            <ServiceRegionalFields form={form} />
+          </div>
+          
+          <div className="space-y-4">
+            <h3 className="text-sm font-medium text-muted-foreground border-b pb-2">{t('notifications')}</h3>
+            <ServiceNotificationFields form={form} />
+          </div>
+        </div>
+        
+        <ServiceFormActions 
+          isSubmitting={isSubmitting} 
+          onCancel={onCancel} 
+          submitLabel={isEdit ? t("updateService") : t("createService")}
+        />
+      </form>
+    </Form>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/add-service/ServiceFormActions.tsx b/application/src/components/services/add-service/ServiceFormActions.tsx
new file mode 100644
index 0000000..e9a5552
--- /dev/null
+++ b/application/src/components/services/add-service/ServiceFormActions.tsx
@@ -0,0 +1,52 @@
+
+import { Button } from "@/components/ui/button";
+import { Loader2 } from "lucide-react";
+import { MouseEvent } from "react";
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface ServiceFormActionsProps {
+  isSubmitting: boolean;
+  onCancel: () => void;
+  submitLabel?: string;
+}
+
+export function ServiceFormActions({ 
+  isSubmitting, 
+  onCancel,
+  submitLabel = "Create Service"
+}: ServiceFormActionsProps) {
+
+	const {t} = useLanguage();
+  const handleCancel = (e: MouseEvent<HTMLButtonElement>) => {
+    e.preventDefault();
+    if (!isSubmitting) {
+      onCancel();
+    }
+  };
+
+  return (
+    <div className="flex justify-end gap-3 pt-2">
+      <Button 
+        type="button" 
+        onClick={handleCancel}
+        variant="outline"
+        disabled={isSubmitting}
+      >
+	      {t("cancel")}
+      </Button>
+      <Button 
+        type="submit" 
+        disabled={isSubmitting}
+      >
+        {isSubmitting ? (
+          <>
+            <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+	          {t("processing")}...
+          </>
+        ) : (
+          submitLabel
+        )}
+      </Button>
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/add-service/ServiceNotificationFields.tsx b/application/src/components/services/add-service/ServiceNotificationFields.tsx
new file mode 100644
index 0000000..32da21f
--- /dev/null
+++ b/application/src/components/services/add-service/ServiceNotificationFields.tsx
@@ -0,0 +1,206 @@
+import { FormControl, FormField, FormItem, FormLabel, FormDescription } from "@/components/ui/form";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
+import { Badge } from "@/components/ui/badge";
+import { X } from "lucide-react";
+import { UseFormReturn } from "react-hook-form";
+import { ServiceFormData } from "./types";
+import { useQuery } from "@tanstack/react-query";
+import { alertConfigService, AlertConfiguration } from "@/services/alertConfigService";
+import { serviceNotificationTemplateService, ServiceNotificationTemplate } from "@/services/serviceNotificationTemplateService";
+import { useState, useEffect } from "react";
+import { useLanguage } from "@/contexts/LanguageContext.tsx";
+
+interface ServiceNotificationFieldsProps {
+  form: UseFormReturn<ServiceFormData>;
+}
+
+export function ServiceNotificationFields({ form }: ServiceNotificationFieldsProps) {
+	const { t } = useLanguage();
+  const [alertConfigs, setAlertConfigs] = useState<AlertConfiguration[]>([]);
+  
+  // Get the current form values for debugging
+  const notificationStatus = form.watch("notificationStatus");
+  const notificationChannels = form.watch("notificationChannels") || [];
+  const alertTemplate = form.watch("alertTemplate");
+   
+  // Fetch alert configurations for notification channels
+  const { data: alertConfigsData } = useQuery({
+    queryKey: ['alertConfigs'],
+    queryFn: () => alertConfigService.getAlertConfigurations(),
+  });
+
+  // Fetch service notification templates
+  const { data: serviceTemplates, isLoading: isLoadingTemplates } = useQuery({
+    queryKey: ['serviceNotificationTemplates'],
+    queryFn: () => serviceNotificationTemplateService.getTemplates(),
+  });
+  
+  // Update alert configs when data is loaded
+  useEffect(() => {
+    if (alertConfigsData) {
+      // Only show enabled channels
+      const enabledChannels = alertConfigsData.filter(config => config.enabled);
+      setAlertConfigs(enabledChannels);
+      
+      // Debug log to check what alert configs are loaded
+    }
+  }, [alertConfigsData]);
+
+  // Debug log for service templates
+  useEffect(() => {
+    if (serviceTemplates) {
+     // console.log("Loaded service notification templates:", serviceTemplates);
+    }
+  }, [serviceTemplates]);
+
+  // Log when form values change to debug
+  useEffect(() => {
+   // console.log("Notification values changed:", {
+   //   notificationStatus: form.getValues("notificationStatus"),
+   //   notificationChannels: form.getValues("notificationChannels")
+   // });
+  }, [form.watch("notificationStatus"), form.watch("notificationChannels")]);
+
+  const handleChannelAdd = (channelId: string) => {
+    const currentChannels = form.getValues("notificationChannels") || [];
+    if (!currentChannels.includes(channelId)) {
+      form.setValue("notificationChannels", [...currentChannels, channelId]);
+    }
+  };
+
+  const handleChannelRemove = (channelId: string) => {
+    const currentChannels = form.getValues("notificationChannels") || [];
+    form.setValue("notificationChannels", currentChannels.filter(id => id !== channelId));
+  };
+
+  const getSelectedChannelNames = () => {
+    return (notificationChannels || []).map(channelId => {
+      const config = alertConfigs.find(c => c.id === channelId);
+      return config ? `${config.notify_name} (${config.notification_type})` : channelId;
+    });
+  };
+  
+  return (
+    <>
+      <FormField
+        control={form.control}
+        name="notificationStatus"
+        render={({ field }) => (
+          <FormItem className="flex flex-row items-center justify-between rounded-lg border p-4">
+            <div className="space-y-0.5">
+              <FormLabel className="text-base">
+	              {t("enableNotifications")}
+              </FormLabel>
+              <FormDescription>
+	              {t("enableNotificationsDesc")}
+              </FormDescription>
+            </div>
+            <FormControl>
+              <Switch
+                checked={field.value === "enabled"}
+                onCheckedChange={(checked) => {
+                  field.onChange(checked ? "enabled" : "disabled");
+                  // Clear notification channels when disabled
+                  if (!checked) {
+                    form.setValue("notificationChannels", []);
+                  }
+                }}
+              />
+            </FormControl>
+          </FormItem>
+        )}
+      />
+      
+      <FormField
+        control={form.control}
+        name="notificationChannels"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{t("notificationChannels")}</FormLabel>
+            <FormDescription>
+              {notificationStatus === "enabled" 
+                ? t("notificationChannelsEnabledDesc")
+                : t("notificationChannelsDesc")}
+            </FormDescription>
+            
+            {/* Display selected channels as badges */}
+            {notificationChannels && notificationChannels.length > 0 && (
+              <div className="flex flex-wrap gap-2 mb-2">
+                {getSelectedChannelNames().map((channelName, index) => (
+                  <Badge key={notificationChannels[index]} variant="secondary" className="flex items-center gap-1">
+                    {channelName}
+                    <X 
+                      className="h-3 w-3 cursor-pointer" 
+                      onClick={() => handleChannelRemove(notificationChannels[index])}
+                    />
+                  </Badge>
+                ))}
+              </div>
+            )}
+            
+            <FormControl>
+              <Select 
+                onValueChange={handleChannelAdd}
+                disabled={notificationStatus !== "enabled"}
+                value="" // Always reset to empty after selection
+              >
+                <SelectTrigger className={notificationStatus !== "enabled" ? 'opacity-50' : ''}>
+                  <SelectValue placeholder={t("notificationChannelsPlaceholder")} />
+                </SelectTrigger>
+                <SelectContent>
+                  {alertConfigs
+                    .filter(config => !notificationChannels?.includes(config.id || ""))
+                    .map((config) => (
+                      <SelectItem key={config.id} value={config.id || ""}>
+                        {config.notify_name} ({config.notification_type})
+                      </SelectItem>
+                    ))}
+                </SelectContent>
+              </Select>
+            </FormControl>
+          </FormItem>
+        )}
+      />
+            
+      <FormField
+        control={form.control}
+        name="alertTemplate"
+        render={({ field }) => {
+         // console.log("Rendering alert template field with value:", field.value);
+          
+          return (
+            <FormItem>
+              <FormLabel>{t("alertTemplate")}</FormLabel>
+              <FormControl>
+                <Select 
+                  onValueChange={(value) => {
+                    field.onChange(value);
+                  }} 
+                  value={field.value || ""}
+                  disabled={notificationStatus !== "enabled" || isLoadingTemplates}
+                >
+                  <SelectTrigger className={notificationStatus !== "enabled" ? 'opacity-50' : ''}>
+                    <SelectValue placeholder={isLoadingTemplates ? t("alertTemplateLoading") : t("alertTemplatePlaceholder")} />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {serviceTemplates?.map((template) => (
+                      <SelectItem key={template.id} value={template.id}>
+                        {template.name}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </FormControl>
+              <FormDescription>
+                {notificationStatus === "enabled"
+                  ? t("alertTemplateEnabledDesc")
+                  : t("alertTemplateDesc")}
+              </FormDescription>
+            </FormItem>
+          );
+        }}
+      />
+    </>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/add-service/ServiceRegionalFields.tsx b/application/src/components/services/add-service/ServiceRegionalFields.tsx
new file mode 100644
index 0000000..239404d
--- /dev/null
+++ b/application/src/components/services/add-service/ServiceRegionalFields.tsx
@@ -0,0 +1,216 @@
+
+import { FormControl, FormField, FormItem, FormLabel, FormMessage } from "@/components/ui/form";
+import { Switch } from "@/components/ui/switch";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { UseFormReturn } from "react-hook-form";
+import { ServiceFormData } from "./types";
+import { useQuery } from "@tanstack/react-query";
+import { regionalService } from "@/services/regionalService";
+import { MapPin, Loader2, X, Plus } from "lucide-react";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { useLanguage } from "@/contexts/LanguageContext.tsx";
+
+interface ServiceRegionalFieldsProps {
+  form: UseFormReturn<ServiceFormData>;
+}
+
+export function ServiceRegionalFields({ form }: ServiceRegionalFieldsProps) {
+	const { t } = useLanguage();
+  const regionalMonitoringEnabled = form.watch("regionalMonitoringEnabled");
+  const currentRegionalAgents = form.watch("regionalAgents") || [];
+
+  const { data: regionalAgents = [], isLoading } = useQuery({
+    queryKey: ['regional-services'],
+    queryFn: regionalService.getRegionalServices,
+    enabled: regionalMonitoringEnabled,
+  });
+
+  // Filter only online agents and exclude the default localhost agent (ID 1)
+  const onlineAgents = regionalAgents.filter(agent => 
+    agent.connection === 'online' && agent.agent_id !== "1"
+  );
+
+  // Get available agents (not already selected)
+  const availableAgents = onlineAgents.filter(agent => 
+    !currentRegionalAgents.includes(`${agent.region_name}|${agent.agent_id}`)
+  );
+
+  // Get agent display name
+  const getAgentDisplayName = (agentValue: string) => {
+    const [regionName, agentId] = agentValue.split("|");
+    const agent = onlineAgents.find(agent => 
+      `${agent.region_name}|${agent.agent_id}` === agentValue
+    );
+    
+    if (agent) {
+      return `${agent.region_name} (${agent.agent_ip_address})`;
+    }
+    
+    // If agent is not found in online agents, it might be offline but still assigned
+    if (regionName && agentId) {
+      return `${regionName} (Agent ${agentId}) - Offline`;
+    }
+    
+    return agentValue;
+  };
+
+  // Add regional agent
+  const addRegionalAgent = (agentValue: string) => {
+    if (agentValue && agentValue !== "select") {
+      const currentAgents = form.getValues("regionalAgents") || [];
+      if (!currentAgents.includes(agentValue)) {
+        form.setValue("regionalAgents", [...currentAgents, agentValue]);
+      }
+    }
+  };
+
+  // Remove regional agent
+  const removeRegionalAgent = (agentValue: string) => {
+    const currentAgents = form.getValues("regionalAgents") || [];
+    form.setValue("regionalAgents", currentAgents.filter(agent => agent !== agentValue));
+  };
+
+  return (
+    <div className="space-y-4">
+      <FormField
+        control={form.control}
+        name="regionalMonitoringEnabled"
+        render={({ field }) => (
+          <FormItem className="flex flex-row items-center justify-between rounded-lg border p-4">
+            <div className="space-y-0.5">
+              <FormLabel className="text-base font-medium flex items-center gap-2">
+                <MapPin className="h-4 w-4" />
+	              {t("regionalMonitoring")}
+              </FormLabel>
+              <div className="text-sm text-muted-foreground">
+	              {t("regionalMonitoringDesc")}
+              </div>
+            </div>
+            <FormControl>
+              <Switch
+                checked={field.value || false}
+                onCheckedChange={(checked) => {
+                  field.onChange(checked);
+                  // Clear agents when disabling regional monitoring
+                  if (!checked) {
+                    form.setValue("regionalAgents", []);
+                  }
+                }}
+              />
+            </FormControl>
+          </FormItem>
+        )}
+      />
+
+      {regionalMonitoringEnabled && (
+        <FormField
+          control={form.control}
+          name="regionalAgents"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t("regionalAgents")}</FormLabel>
+              
+              {/* Display selected agents */}
+              {currentRegionalAgents.length > 0 && (
+                <div className="flex flex-wrap gap-2 mb-3">
+                  {currentRegionalAgents.map((agentValue) => (
+                    <Badge key={agentValue} variant="secondary" className="flex items-center gap-2">
+                      <div className="w-2 h-2 bg-green-500 rounded-full"></div>
+                      <span className="text-sm">{getAgentDisplayName(agentValue)}</span>
+                      <Button
+                        type="button"
+                        variant="ghost"
+                        size="sm"
+                        className="h-4 w-4 p-0 ml-1"
+                        onClick={() => removeRegionalAgent(agentValue)}
+                      >
+                        <X className="h-3 w-3" />
+                      </Button>
+                    </Badge>
+                  ))}
+                </div>
+              )}
+
+              {/* Add new agent selector */}
+              <Select 
+                onValueChange={addRegionalAgent}
+                value="select"
+                disabled={isLoading}
+              >
+                <FormControl>
+                  <SelectTrigger>
+                    <SelectValue placeholder={
+                      isLoading 
+                        ? t("regionalAgentsLoading")
+                        : availableAgents.length > 0 
+                          ? t("regionalAgentsAvailablePlaceholder")
+                          : currentRegionalAgents.length > 0 
+                            ? t("regionalAgentsAllSelected")
+                            : t("regionalAgentsNoAvailable")
+                    } />
+                  </SelectTrigger>
+                </FormControl>
+                <SelectContent>
+                  {isLoading ? (
+                    <SelectItem value="loading" disabled>
+                      <div className="flex items-center gap-2">
+                        <Loader2 className="h-4 w-4 animate-spin" />
+	                      t("regionalAgentsLoading")
+                      </div>
+                    </SelectItem>
+                  ) : availableAgents.length === 0 ? (
+                    <SelectItem value="no-agents" disabled>
+                      {currentRegionalAgents.length > 0 
+                        ? t("regionalAgentsAllSelected")
+                        : t("regionalAgentsNoOnlineAvailable")
+                      }
+                    </SelectItem>
+                  ) : (
+                    <>
+                      <SelectItem value="select" disabled>
+                        <div className="flex items-center gap-2">
+                          <Plus className="h-4 w-4 text-muted-foreground" />
+                          <span className="text-muted-foreground">Select an agent to add...</span>
+                        </div>
+                      </SelectItem>
+                      {availableAgents.map((agent) => (
+                        <SelectItem key={agent.id} value={`${agent.region_name}|${agent.agent_id}`}>
+                          <div className="flex items-center gap-2">
+                            <div className="w-2 h-2 bg-green-500 rounded-full"></div>
+                            <span className="font-medium">{agent.region_name}</span>
+                            <span className="text-muted-foreground">({agent.agent_ip_address})</span>
+                          </div>
+                        </SelectItem>
+                      ))}
+                    </>
+                  )}
+                </SelectContent>
+              </Select>
+              
+              <FormMessage />
+              
+              {regionalMonitoringEnabled && onlineAgents.length === 0 && !isLoading && (
+                <p className="text-sm text-amber-600">
+	                {t("regionalAgentsNotFoundMessage")}
+                </p>
+              )}
+              
+              {currentRegionalAgents.length === 0 && regionalMonitoringEnabled && (
+                <p className="text-sm text-orange-600">
+	                {t("regionalAgentsNotSelectedMessage")}
+                </p>
+              )}
+              
+              {currentRegionalAgents.length > 0 && (
+                <p className="text-sm text-green-600">
+                  Service assigned to {currentRegionalAgents.length} regional agent{currentRegionalAgents.length > 1 ? 's' : ''}.
+                </p>
+              )}
+            </FormItem>
+          )}
+        />
+      )}
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/add-service/ServiceTypeField.tsx b/application/src/components/services/add-service/ServiceTypeField.tsx
new file mode 100644
index 0000000..a3f1fa0
--- /dev/null
+++ b/application/src/components/services/add-service/ServiceTypeField.tsx
@@ -0,0 +1,105 @@
+
+import { FormControl, FormField, FormItem, FormLabel } from "@/components/ui/form";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Globe, Wifi, Server, Globe2 } from "lucide-react";
+import { UseFormReturn } from "react-hook-form";
+import { ServiceFormData } from "./types";
+import { useLanguage } from "@/contexts/LanguageContext.tsx";
+
+interface ServiceTypeFieldProps {
+  form: UseFormReturn<ServiceFormData>;
+}
+
+export function ServiceTypeField({ form }: ServiceTypeFieldProps) {
+	const { t } = useLanguage();
+  const getServiceIcon = (type: string) => {
+    switch (type) {
+      case "http":
+        return <Globe className="w-4 h-4" />;
+      case "ping":
+        return <Wifi className="w-4 h-4" />;
+      case "tcp":
+        return <Server className="w-4 h-4" />;
+      case "dns":
+        return <Globe2 className="w-4 h-4" />;
+      default:
+        return <Globe className="w-4 h-4" />;
+    }
+  };
+
+  return (
+    <FormField
+      control={form.control}
+      name="type"
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>{t("serviceType")}</FormLabel>
+          <FormControl>
+            <Select 
+              onValueChange={field.onChange} 
+              defaultValue={field.value}
+            >
+              <SelectTrigger>
+                <SelectValue>
+                  {field.value && (
+                    <div className="flex items-center gap-2">
+                      {getServiceIcon(field.value)}
+                      <span>{field.value.toUpperCase()}</span>
+                    </div>
+                  )}
+                  {!field.value && "Select a service type"}
+                </SelectValue>
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="http">
+                  <div className="flex flex-col">
+                    <div className="flex items-center gap-2">
+                      <Globe className="w-4 h-4" />
+                      <span>HTTP/S</span>
+                    </div>
+                    <p className="text-xs text-muted-foreground mt-1">
+	                    {t("serviceTypeHTTPDesc")}
+                    </p>
+                  </div>
+                </SelectItem>
+                <SelectItem value="ping">
+                  <div className="flex flex-col">
+                    <div className="flex items-center gap-2">
+                      <Wifi className="w-4 h-4" />
+                      <span>PING</span>
+                    </div>
+                    <p className="text-xs text-muted-foreground mt-1">
+	                    {t("serviceTypePINGDesc")}
+                    </p>
+                  </div>
+                </SelectItem>
+                <SelectItem value="tcp">
+                  <div className="flex flex-col">
+                    <div className="flex items-center gap-2">
+                      <Server className="w-4 h-4" />
+                      <span>TCP</span>
+                    </div>
+                    <p className="text-xs text-muted-foreground mt-1">
+	                    {t("serviceTypeTCPDesc")}
+                    </p>
+                  </div>
+                </SelectItem>
+                <SelectItem value="dns">
+                  <div className="flex flex-col">
+                    <div className="flex items-center gap-2">
+                      <Globe2 className="w-4 h-4" />
+                      <span>DNS</span>
+                    </div>
+                    <p className="text-xs text-muted-foreground mt-1">
+	                    {t("serviceTypeDNSDesc")}
+                    </p>
+                  </div>
+                </SelectItem>
+              </SelectContent>
+            </Select>
+          </FormControl>
+        </FormItem>
+      )}
+    />
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/add-service/ServiceUrlField.tsx b/application/src/components/services/add-service/ServiceUrlField.tsx
new file mode 100644
index 0000000..8b4aee0
--- /dev/null
+++ b/application/src/components/services/add-service/ServiceUrlField.tsx
@@ -0,0 +1,113 @@
+
+import { FormControl, FormField, FormItem, FormLabel, FormMessage, FormDescription } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { UseFormReturn } from "react-hook-form";
+import { ServiceFormData } from "./types";
+import { useLanguage } from "@/contexts/LanguageContext.tsx";
+
+interface ServiceUrlFieldProps {
+  form: UseFormReturn<ServiceFormData>;
+}
+
+export function ServiceUrlField({ form }: ServiceUrlFieldProps) {
+	const { t } = useLanguage();
+  const serviceType = form.watch("type");
+  
+  const getPlaceholder = () => {
+    switch (serviceType) {
+      case "http":
+        return "https://example.com";
+      case "ping":
+        return "example.com or 192.168.1.1";
+      case "tcp":
+        return "example.com or 192.168.1.1";
+      case "dns":
+        return "example.com";
+      default:
+        return t("targetDefaultPlaceholder");
+    }
+  };
+
+  const getDescription = () => {
+    switch (serviceType) {
+      case "http":
+        return t("targetHTTPDesc");
+      case "ping":
+        return t("targetPINGDesc");
+      case "tcp":
+        return t("targetTCPDesc");
+      case "dns":
+        return t("targetDNSDesc");
+      default:
+        return t("targetDefaultDesc");
+    }
+  };
+
+  const getFieldLabel = () => {
+    switch (serviceType) {
+      case "dns":
+        return t("targetDNS");
+      case "ping":
+        return "Hostname/IP";
+      case "tcp":
+        return "Hostname/IP";
+      default:
+        return t("targetDefault");
+    }
+  };
+
+  return (
+    <div className="space-y-4">
+      <FormField
+        control={form.control}
+        name="url"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>{getFieldLabel()}</FormLabel>
+            <FormControl>
+              <Input 
+                placeholder={getPlaceholder()}
+                {...field}
+                onChange={(e) => {
+                //  console.log(`${serviceType === "dns" ? "Domain" : serviceType === "tcp" ? "Host" : "URL"} field changed:`, e.target.value);
+                  field.onChange(e);
+                }}
+              />
+            </FormControl>
+            <FormDescription className="text-xs">
+              {getDescription()}
+            </FormDescription>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+
+      {serviceType === "tcp" && (
+        <FormField
+          control={form.control}
+          name="port"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Port</FormLabel>
+              <FormControl>
+                <Input 
+                  placeholder="8080"
+                  type="number"
+                  {...field}
+                  onChange={(e) => {
+                   // console.log("Port field changed:", e.target.value);
+                    field.onChange(e);
+                  }}
+                />
+              </FormControl>
+              <FormDescription className="text-xs">
+	              {t("targetTCPPortDesc")}
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+      )}
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/add-service/index.ts b/application/src/components/services/add-service/index.ts
new file mode 100644
index 0000000..aa5eb2a
--- /dev/null
+++ b/application/src/components/services/add-service/index.ts
@@ -0,0 +1,3 @@
+
+export * from "./ServiceForm";
+export * from "./types";
diff --git a/application/src/components/services/add-service/serviceFormUtils.ts b/application/src/components/services/add-service/serviceFormUtils.ts
new file mode 100644
index 0000000..b606d84
--- /dev/null
+++ b/application/src/components/services/add-service/serviceFormUtils.ts
@@ -0,0 +1,169 @@
+
+import { Service } from "@/types/service.types";
+import { ServiceFormData } from "./types";
+
+export const getServiceFormDefaults = (): ServiceFormData => ({
+  name: "",
+  type: "http",
+  url: "",
+  port: "",
+  interval: "60",
+  retries: "3",
+  notificationStatus: "disabled",
+  notificationChannels: [],
+  alertTemplate: "",
+  regionalMonitoringEnabled: false,
+  regionalAgents: [],
+});
+
+export const mapServiceToFormData = (service: Service): ServiceFormData => {
+  // Ensure the type is one of the allowed values
+  const serviceType = (service.type || "http").toLowerCase();
+  const validType = ["http", "ping", "tcp", "dns"].includes(serviceType) 
+    ? serviceType as "http" | "ping" | "tcp" | "dns"
+    : "http";
+
+  // For PING services, use host field; for DNS use domain field; for TCP use host field; others use url
+  let urlValue = "";
+  let portValue = "";
+  
+  if (validType === "ping") {
+    urlValue = service.host || "";
+  } else if (validType === "dns") {
+    urlValue = service.domain || "";
+  } else if (validType === "tcp") {
+    urlValue = service.host || "";
+    portValue = String(service.port || "");
+  } else {
+    urlValue = service.url || "";
+  }
+
+  // Handle regional monitoring data - check regional_status field
+  const isRegionalEnabled = service.regional_status === "enabled";
+  const regionalAgents: string[] = [];
+  
+  // Parse multiple regional agents from comma-separated region_name and agent_id fields
+  if (isRegionalEnabled && service.region_name && service.agent_id) {
+    const regionNames = service.region_name.includes(',') 
+      ? service.region_name.split(',').map(name => name.trim()).filter(name => name)
+      : [service.region_name];
+    
+    const agentIds = service.agent_id.includes(',')
+      ? service.agent_id.split(',').map(id => id.trim()).filter(id => id)
+      : [service.agent_id];
+    
+    // Combine region names and agent IDs (they should have the same length)
+    const maxLength = Math.max(regionNames.length, agentIds.length);
+    for (let i = 0; i < maxLength; i++) {
+      const regionName = regionNames[i] || regionNames[0] || "";
+      const agentId = agentIds[i] || agentIds[0] || "";
+      if (regionName && agentId) {
+        regionalAgents.push(`${regionName}|${agentId}`);
+      }
+    }
+  }
+
+  // Handle notification channels - prioritize notification_channel field which contains JSON array
+  const notificationChannels: string[] = [];
+  
+  // First check for notification_channel field (JSON string of array)
+  if (service.notification_channel) {
+    try {
+      const parsedChannels = JSON.parse(service.notification_channel);
+      if (Array.isArray(parsedChannels)) {
+        notificationChannels.push(...parsedChannels);
+      }
+    } catch (error) {
+      // If parsing fails, treat as single channel ID
+      notificationChannels.push(service.notification_channel);
+    }
+  }
+  
+  // Fallback to comma-separated notification_id field
+  if (notificationChannels.length === 0 && service.notificationChannel) {
+    // Check if it's comma-separated
+    if (service.notificationChannel.includes(',')) {
+      const channels = service.notificationChannel.split(',').map(id => id.trim()).filter(id => id);
+      notificationChannels.push(...channels);
+    } else {
+      notificationChannels.push(service.notificationChannel);
+    }
+  }
+
+  // Handle notification_status - it can be boolean or string
+  let notificationStatus: "enabled" | "disabled" = "disabled";
+  if (typeof service.notification_status === "boolean") {
+    notificationStatus = service.notification_status ? "enabled" : "disabled";
+  } else if (typeof service.notification_status === "string") {
+    notificationStatus = service.notification_status === "enabled" ? "enabled" : "disabled";
+  }
+
+  return {
+    name: service.name || "",
+    type: validType,
+    url: urlValue,
+    port: portValue,
+    interval: String(service.interval || 60),
+    retries: String(service.retries || 3),
+    notificationStatus: notificationStatus,
+    notificationChannels: notificationChannels,
+    alertTemplate: service.alertTemplate === "default" ? "" : service.alertTemplate || "",
+    regionalMonitoringEnabled: isRegionalEnabled,
+    regionalAgents: regionalAgents,
+  };
+};
+
+export const mapFormDataToServiceData = (data: ServiceFormData) => {
+  // Parse regional agent selections - store multiple agents as comma-separated values
+  let regionNames = "";
+  let agentIds = "";
+  let regionalStatus: "enabled" | "disabled" = "disabled";
+  
+  // Set regional status and agent data based on form values
+  if (data.regionalMonitoringEnabled && data.regionalAgents && data.regionalAgents.length > 0) {
+    regionalStatus = "enabled";
+    
+    // Extract region names and agent IDs from the selected agents
+    const parsedRegions: string[] = [];
+    const parsedAgentIds: string[] = [];
+    
+    data.regionalAgents.forEach(agentValue => {
+      if (agentValue && agentValue !== "") {
+        const [regionName, agentId] = agentValue.split("|");
+        if (regionName && agentId) {
+          parsedRegions.push(regionName);
+          parsedAgentIds.push(agentId);
+        }
+      }
+    });
+    
+    // Store as comma-separated strings
+    regionNames = parsedRegions.join(',');
+    agentIds = parsedAgentIds.join(',');
+  }
+  
+  // Prepare service data with proper field mapping
+  return {
+    name: data.name,
+    type: data.type,
+    interval: parseInt(data.interval),
+    retries: parseInt(data.retries),
+    // Convert string status to boolean for notification_status field
+    notificationStatus: data.notificationStatus === "enabled",
+    notificationChannels: data.notificationChannels || [],
+    alertTemplate: data.alertTemplate === "default" ? "" : data.alertTemplate,
+    // Use regional_status field and store multiple agents as comma-separated values
+    regionalStatus: regionalStatus,
+    regionName: regionNames,
+    agentId: agentIds,
+    // Map the URL field to appropriate database field based on service type
+    ...(data.type === "dns" 
+      ? { domain: data.url, url: "", host: "", port: undefined }  // DNS: store in domain field
+      : data.type === "ping"
+      ? { host: data.url, url: "", domain: "", port: undefined }  // PING: store in host field  
+      : data.type === "tcp"
+      ? { host: data.url, port: parseInt(data.port || "80"), url: "", domain: "" }  // TCP: store in host and port fields
+      : { url: data.url, domain: "", host: "", port: undefined }  // HTTP: store in url field
+    )
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/services/add-service/types.ts b/application/src/components/services/add-service/types.ts
new file mode 100644
index 0000000..f12e623
--- /dev/null
+++ b/application/src/components/services/add-service/types.ts
@@ -0,0 +1,46 @@
+import { z } from "zod";
+import type { ZodSchema } from "zod";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+
+export type ServiceFormData = {
+  name: string;
+  type: "http" | "ping" | "tcp" | "dns";
+  url: string;
+  port?: string;
+  interval: string;
+  retries: string;
+  notificationStatus?: "enabled" | "disabled";
+  notificationChannels?: string[];
+  alertTemplate?: string;
+  regionalMonitoringEnabled?: boolean;
+  regionalAgents?: string[];
+};
+
+// Hook to use the schema with translations
+export const useServiceSchema = () => {
+  const { t } = useLanguage();
+  return z.object({
+      name: z.string().min(1, t("serviceNameRequired")),
+      type: z.enum(["http", "ping", "tcp", "dns"]),
+      url: z.string()
+        .min(1, t("urlDomainHostRequired"))
+        .refine(
+          (value) => !/\s/.test(value),
+          t("spacesNotAllowed")
+        )
+        .refine(
+          (value) => value.trim().length > 0,
+          t("enterValidUrlHostnameDomain")
+        ),
+      port: z.string().optional(),
+      interval: z.string(),
+      retries: z.string(),
+      notificationStatus: z.enum(["enabled", "disabled"]).optional(),
+      notificationChannels: z.array(z.string()).optional(),
+      alertTemplate: z.string().optional(),
+      // Regional monitoring fields - now supports multiple agents
+      regionalMonitoringEnabled: z.boolean().optional(),
+      regionalAgents: z.array(z.string()).optional(),
+    });
+};
\ No newline at end of file
diff --git a/application/src/components/services/hooks/index.ts b/application/src/components/services/hooks/index.ts
new file mode 100644
index 0000000..2cb6785
--- /dev/null
+++ b/application/src/components/services/hooks/index.ts
@@ -0,0 +1,3 @@
+
+export * from './useServiceActions';
+export * from './useDialogState';
diff --git a/application/src/components/services/hooks/useConsolidatedUptimeData.ts b/application/src/components/services/hooks/useConsolidatedUptimeData.ts
new file mode 100644
index 0000000..195a8fd
--- /dev/null
+++ b/application/src/components/services/hooks/useConsolidatedUptimeData.ts
@@ -0,0 +1,267 @@
+import { useState, useEffect } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { uptimeService } from '@/services/uptimeService';
+import { UptimeData } from '@/types/service.types';
+
+interface UseConsolidatedUptimeDataProps {
+  serviceId?: string;
+  serviceType?: string;
+  status: string;
+  interval: number;
+}
+
+interface ConsolidatedTimeSlot {
+  timestamp: string;
+  items: Array<UptimeData & { source: string; isDefault: boolean }>;
+}
+
+// Helper function to safely check if a PocketBase field is actually undefined/null
+const isFieldEmpty = (field: any): boolean => {
+  if (field === undefined || field === null) return true;
+  if (typeof field === 'object' && field._type === 'undefined') return true;
+  if (typeof field === 'string' && (field === '' || field === 'undefined')) return true;
+  return false;
+};
+
+// Helper function to safely get field value from PocketBase
+const getFieldValue = (field: any): string | number | null => {
+  if (isFieldEmpty(field)) return null;
+  if (typeof field === 'object' && field.value !== undefined) return field.value;
+  return field;
+};
+
+// Helper function to normalize timestamp to minute precision
+const normalizeTimestamp = (timestamp: string): string => {
+  const date = new Date(timestamp);
+  // Round down to the nearest minute
+  date.setSeconds(0, 0);
+  return date.toISOString();
+};
+
+export const useConsolidatedUptimeData = ({ serviceId, serviceType, status, interval }: UseConsolidatedUptimeDataProps) => {
+  const [consolidatedItems, setConsolidatedItems] = useState<ConsolidatedTimeSlot[]>([]);
+  
+  // Fetch ALL uptime history data in a single query
+  const { data: uptimeData, isLoading, error, isFetching, refetch } = useQuery({
+    queryKey: ['consolidatedUptimeHistory', serviceId, serviceType],
+    queryFn: async () => {
+      if (!serviceId) {
+      //  console.log('No serviceId provided, skipping fetch');
+        return [];
+      }
+     // console.log(`Fetching consolidated uptime data for service ${serviceId} of type ${serviceType}`);
+      
+      // Get ALL uptime history data - this should include both default and regional data
+      const rawData = await uptimeService.getUptimeHistory(serviceId, 100, undefined, undefined, serviceType);
+      
+     // console.log(`Retrieved ${rawData.length} total records for service ${serviceId}`);
+    // console.log('Raw data sample:', rawData.slice(0, 5).map(d => ({
+    //   timestamp: d.timestamp,
+    //   region_name: d.region_name,
+    //   agent_id: d.agent_id,
+    //   status: d.status,
+    //   service_id: d.service_id,
+    //   response_time: d.responseTime
+    // })));
+      
+      return rawData;
+    },
+    enabled: !!serviceId,
+    refetchInterval: 30000,
+    staleTime: 15000,
+    placeholderData: (previousData) => previousData,
+    retry: 3,
+    retryDelay: (attemptIndex) => Math.min(1000 * 2 ** attemptIndex, 10000),
+  });
+  
+  // Process and consolidate uptime data
+  const processConsolidatedData = (data: UptimeData[]): ConsolidatedTimeSlot[] => {
+    if (!data || data.length === 0) return [];
+    
+   // console.log(`Processing ${data.length} uptime records for consolidation`);
+    
+    // Create a map to group records by normalized timestamp (minute precision)
+    const timeSlotMap = new Map<string, Array<UptimeData & { source: string; isDefault: boolean }>>();
+    
+    data.forEach(record => {
+      // Normalize timestamp to minute precision to avoid duplicate bars
+      const normalizedTimestamp = normalizeTimestamp(record.timestamp);
+      
+      // Safely extract region and agent information
+      const regionName = getFieldValue(record.region_name);
+      const agentId = getFieldValue(record.agent_id);
+      
+      // Determine the source name and whether it's default monitoring
+      let sourceName: string;
+      let isDefault: boolean;
+      
+      if (regionName && agentId) {
+        // Regional monitoring data
+        sourceName = `${regionName} (Agent ${agentId})`;
+        isDefault = false;
+    //    console.log(`Found regional data: ${sourceName} for normalized timestamp ${normalizedTimestamp}`);
+      } else if (agentId && !regionName) {
+        // Default monitoring with specific agent
+        sourceName = `Default (Agent ${agentId})`;
+        isDefault = true;
+     //   console.log(`Found default monitoring: ${sourceName} for normalized timestamp ${normalizedTimestamp}`);
+      } else {
+        // Default monitoring fallback
+        sourceName = 'Default (Agent 1)';
+        isDefault = true;
+     //   console.log(`Using fallback default monitoring for normalized timestamp ${normalizedTimestamp}`);
+      }
+      
+      // Get or create the array for this normalized timestamp
+      if (!timeSlotMap.has(normalizedTimestamp)) {
+        timeSlotMap.set(normalizedTimestamp, []);
+      }
+      
+      // Check if we already have an entry from this source for this time slot
+      const existingItems = timeSlotMap.get(normalizedTimestamp)!;
+      const existingFromSource = existingItems.find(item => item.source === sourceName);
+      
+      if (!existingFromSource) {
+        // Add the record with source information only if we don't already have one from this source
+        timeSlotMap.get(normalizedTimestamp)!.push({
+          ...record,
+          timestamp: normalizedTimestamp, // Use normalized timestamp
+          source: sourceName,
+          isDefault
+        });
+        
+       // console.log(`Added record to normalized timestamp ${normalizedTimestamp}: Source=${sourceName}, Status=${record.status}, IsDefault=${isDefault}, ResponseTime=${record.responseTime}ms`);
+      } else {
+      //  console.log(`Skipping duplicate record for source ${sourceName} at timestamp ${normalizedTimestamp}`);
+      }
+    });
+    
+    // Convert map to consolidated time slots and sort by timestamp (newest first)
+    const consolidatedTimeline: ConsolidatedTimeSlot[] = Array.from(timeSlotMap.entries())
+      .map(([timestamp, items]) => ({
+        timestamp,
+        items: items.sort((a, b) => {
+          // Sort so default monitoring appears first
+          if (a.isDefault && !b.isDefault) return -1;
+          if (!a.isDefault && b.isDefault) return 1;
+          return 0;
+        })
+      }))
+      .sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime())
+      .slice(0, 20); // Take the most recent 20 time slots
+    
+    // console.log(`Created ${consolidatedTimeline.length} consolidated time slots with normalized timestamps`);
+    // consolidatedTimeline.forEach((slot, index) => {
+    //   console.log(`Slot ${index} - Normalized Timestamp: ${slot.timestamp}, Items: ${slot.items.length}`);
+    //   slot.items.forEach((item, itemIndex) => {
+    //     console.log(`  Item ${itemIndex}: Source=${item.source}, Status=${item.status}, ResponseTime=${item.responseTime}ms, IsDefault=${item.isDefault}`);
+    //   });
+    // });
+    
+    return consolidatedTimeline;
+  };
+  
+  // Update consolidated items when data changes
+  useEffect(() => {
+    if (uptimeData && uptimeData.length > 0) {
+      // console.log(`Processing consolidated uptime data for service ${serviceId}`);
+      const processedData = processConsolidatedData(uptimeData);
+      
+      // If service is currently paused, override ONLY the latest (first) bar with paused status
+      if (status === "paused" && processedData.length > 0) {
+       // console.log(`Service ${serviceId} is paused, overriding latest bar with paused status`);
+        
+        // Create a paused entry for the latest timestamp
+        const latestTimestamp = new Date();
+        latestTimestamp.setSeconds(0, 0); // Normalize to minute precision
+        
+        const pausedSlot: ConsolidatedTimeSlot = {
+          timestamp: latestTimestamp.toISOString(),
+          items: [{
+            id: `paused-${serviceId}-latest`,
+            service_id: serviceId || "",
+            serviceId: serviceId || "",
+            timestamp: latestTimestamp.toISOString(),
+            status: "paused" as "up" | "down" | "warning" | "paused",
+            responseTime: 0,
+            source: 'Default (Agent 1)',
+            isDefault: true
+          }]
+        };
+        
+        // Replace the first item with paused status, keep the rest as historical data
+        const updatedData = [pausedSlot, ...processedData.slice(0, 19)];
+       // console.log(`Updated data with paused latest bar, total bars: ${updatedData.length}`);
+        setConsolidatedItems(updatedData);
+      } else {
+        // Service is active (up/down/warning) - merge real data with any existing paused bars
+      //  console.log(`Service ${serviceId} is active with status: ${status}, merging with existing paused bars`);
+        
+        // Get existing paused bars from current state
+        const existingPausedBars = consolidatedItems.filter(slot => 
+          slot.items.some(item => item.status === "paused")
+        );
+        
+        // Create a map of existing paused timestamps for quick lookup
+        const pausedTimestamps = new Set(existingPausedBars.map(slot => slot.timestamp));
+        
+        // Merge processed data with existing paused bars
+        const mergedData = [...processedData];
+        
+        // Add back any paused bars that don't conflict with new data
+        existingPausedBars.forEach(pausedSlot => {
+          const hasConflict = processedData.some(slot => slot.timestamp === pausedSlot.timestamp);
+          if (!hasConflict) {
+            mergedData.push(pausedSlot);
+          //  console.log(`Preserved paused bar at timestamp: ${pausedSlot.timestamp}`);
+          }
+        });
+        
+        // Sort by timestamp (newest first) and limit to 20
+        const finalData = mergedData
+          .sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime())
+          .slice(0, 20);
+        
+      //  console.log(`Final merged data has ${finalData.length} slots`);
+        setConsolidatedItems(finalData);
+      }
+    } else if (!serviceId || (uptimeData && uptimeData.length === 0)) {
+      // Generate placeholder data when no real data is available
+     // console.log(`No uptime data available for service ${serviceId}, generating placeholder with status: ${status}`);
+      
+      // Use the actual service status for placeholder data
+      const statusValue = status === "paused" ? "paused" : 
+                         (status === "up" || status === "down" || status === "warning") ? status : "unknown";
+        
+      const placeholderHistory: ConsolidatedTimeSlot[] = Array(20).fill(null).map((_, index) => {
+        const timestamp = new Date(Date.now() - (index * interval * 1000));
+        timestamp.setSeconds(0, 0); // Normalize to minute precision
+        
+        return {
+          timestamp: timestamp.toISOString(),
+          items: [{
+            id: `placeholder-${serviceId}-${index}`,
+            service_id: serviceId || "",
+            serviceId: serviceId || "",
+            timestamp: timestamp.toISOString(),
+            status: statusValue as "up" | "down" | "warning" | "paused",
+            responseTime: statusValue === "paused" ? 0 : (statusValue === "up" ? 200 : 0),
+            source: 'Default (Agent 1)',
+            isDefault: true
+          }]
+        };
+      });
+      
+    //  console.log(`Generated ${placeholderHistory.length} placeholder slots with status: ${statusValue}`);
+      setConsolidatedItems(placeholderHistory);
+    }
+  }, [uptimeData, serviceId, status, interval, consolidatedItems]);
+
+  return {
+    consolidatedItems,
+    isLoading,
+    error,
+    isFetching,
+    refetch
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/services/hooks/useDefaultUptimeData.ts b/application/src/components/services/hooks/useDefaultUptimeData.ts
new file mode 100644
index 0000000..9cdd546
--- /dev/null
+++ b/application/src/components/services/hooks/useDefaultUptimeData.ts
@@ -0,0 +1,180 @@
+
+import { useState, useEffect } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { uptimeService } from '@/services/uptimeService';
+import { UptimeData } from '@/types/service.types';
+
+interface UseDefaultUptimeDataProps {
+  serviceId?: string;
+  serviceType?: string;
+  status: string;
+  interval: number;
+}
+
+export const useDefaultUptimeData = ({ serviceId, serviceType, status, interval }: UseDefaultUptimeDataProps) => {
+  const [historyItems, setHistoryItems] = useState<UptimeData[]>([]);
+  
+  // Fetch ONLY Default (Agent ID 1) uptime history data - NO regional data whatsoever
+  const { data: uptimeData, isLoading, error, isFetching, refetch } = useQuery({
+    queryKey: ['strictDefaultUptimeHistory', serviceId, serviceType],
+    queryFn: async () => {
+      if (!serviceId) {
+       // console.log('No serviceId provided, skipping fetch');
+        return [];
+      }
+     // console.log(`Fetching STRICT Default (Agent ID 1) uptime data for service ${serviceId} of type ${serviceType}`);
+      
+      // Get raw uptime history data
+      const rawData = await uptimeService.getUptimeHistory(serviceId, 50, undefined, undefined, serviceType);
+      
+      // ULTRA-STRICT filtering: ONLY Default monitoring records (Agent ID 1)
+      // This means: NO region_name, NO agent_id, NO regional monitoring whatsoever
+      const strictDefaultData = rawData.filter(record => {
+        // Must have NO regional monitoring info at all
+        const isStrictDefault = (
+          !record.region_name && 
+          !record.agent_id &&
+          record.service_id === serviceId
+        );
+        
+        if (isStrictDefault) {
+         // console.log(`✓ ACCEPTED Default record: ${record.id} - ${record.timestamp} - Pure default monitoring`);
+        } else {
+         // console.log(`✗ REJECTED non-default record: ${record.id} - region: ${record.region_name || 'none'}, agent: ${record.agent_id || 'none'}`);
+        }
+        
+        return isStrictDefault;
+      });
+      
+      //console.log(`ULTRA-STRICT FILTER: Reduced ${rawData.length} records to ${strictDefaultData.length} pure default monitoring records`);
+      return strictDefaultData;
+    },
+    enabled: !!serviceId,
+    refetchInterval: 30000,
+    staleTime: 15000,
+    placeholderData: (previousData) => previousData,
+    retry: 3,
+    retryDelay: (attemptIndex) => Math.min(1000 * 2 ** attemptIndex, 10000),
+  });
+  
+  // Process uptime data with absolute timestamp uniqueness
+  const processUptimeData = (data: UptimeData[], intervalSeconds: number): UptimeData[] => {
+    if (!data || data.length === 0) return [];
+    
+   // console.log(`Processing ${data.length} strict default monitoring records for service ${serviceId}`);
+    
+    // Sort data by timestamp (newest first)
+    const sortedData = [...data].sort((a, b) => 
+      new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
+    );
+    
+    // ABSOLUTE timestamp uniqueness - use Map for O(1) lookup
+    const timestampMap = new Map<string, UptimeData>();
+    
+    sortedData.forEach(record => {
+      const exactTimestamp = record.timestamp;
+      
+      if (!timestampMap.has(exactTimestamp)) {
+        timestampMap.set(exactTimestamp, record);
+      //  console.log(`✓ Added unique default record: ${record.id} - ${exactTimestamp}`);
+      } else {
+      //  console.log(`✗ REJECTED absolute duplicate timestamp: ${record.id} - ${exactTimestamp} (exact timestamp match)`);
+      }
+    });
+    
+    // Convert Map back to array and take most recent 20
+    const uniqueRecords = Array.from(timestampMap.values());
+    const recentData = uniqueRecords.slice(0, 20);
+    
+    //console.log(`FINAL RESULT: ${recentData.length} absolutely unique default monitoring records`);
+    
+    return recentData;
+  };
+  
+  // Update history items when data changes
+  useEffect(() => {
+    if (uptimeData && uptimeData.length > 0) {
+     // console.log(`Received ${uptimeData.length} strict default monitoring records for service ${serviceId}`);
+      const processedData = processUptimeData(uptimeData, interval);
+      setHistoryItems(processedData);
+    } else if (!serviceId || (uptimeData && uptimeData.length === 0)) {
+      // Generate placeholder data when no real data is available
+     // console.log(`No strict default monitoring data available for service ${serviceId}, generating placeholder`);
+      
+      const statusValue = (status === "up" || status === "down" || status === "warning" || status === "paused") 
+        ? status 
+        : "paused";
+        
+      const placeholderHistory: UptimeData[] = Array(20).fill(null).map((_, index) => ({
+        id: `placeholder-${serviceId}-${index}`,
+        service_id: serviceId || "",
+        serviceId: serviceId || "",
+        timestamp: new Date(Date.now() - (index * interval * 1000)).toISOString(),
+        status: statusValue as "up" | "down" | "warning" | "paused",
+        responseTime: 0
+      }));
+      
+      setHistoryItems(placeholderHistory);
+    }
+  }, [uptimeData, serviceId, status, interval]);
+
+  // Ensure we always have exactly 20 items for consistent display
+  const getDisplayItems = (): UptimeData[] => {
+    const items = [...historyItems];
+    
+    // If we have fewer than 20 items, pad with older placeholder data
+    if (items.length < 20) {
+      const lastItem = items.length > 0 ? items[items.length - 1] : null;
+      const lastStatus = lastItem ? lastItem.status : 
+                        (status === "up" || status === "down" || status === "warning" || status === "paused") ? 
+                        status as "up" | "down" | "warning" | "paused" : "paused";
+      
+      const paddingCount = 20 - items.length;
+      const paddingItems: UptimeData[] = Array(paddingCount).fill(null).map((_, index) => {
+        const baseTime = lastItem ? new Date(lastItem.timestamp).getTime() : Date.now();
+        const timeOffset = (index + 1) * interval * 1000;
+        
+        return {
+          id: `padding-${serviceId}-${index}`,
+          service_id: serviceId || "",
+          serviceId: serviceId || "",
+          timestamp: new Date(baseTime - timeOffset).toISOString(),
+          status: lastStatus,
+          responseTime: 0
+        };
+      });
+      
+      items.push(...paddingItems);
+    }
+
+    // Final absolute validation - use Set for guaranteed uniqueness
+    const finalItems = items.slice(0, 20);
+    const seenTimestamps = new Set<string>();
+    const absolutelyUniqueItems: UptimeData[] = [];
+    
+    finalItems.forEach(item => {
+      if (!seenTimestamps.has(item.timestamp)) {
+        seenTimestamps.add(item.timestamp);
+        absolutelyUniqueItems.push(item);
+      } else {
+      //  console.log(`FINAL VALIDATION: Removing absolute duplicate timestamp ${item.timestamp} from display`);
+      }
+    });
+
+    // Sort by timestamp (newest first) and ensure exactly 20 items
+    const sortedValidated = absolutelyUniqueItems.sort((a, b) => 
+      new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
+    );
+    
+   // console.log(`DISPLAY READY: ${sortedValidated.length} absolutely validated default monitoring items`);
+    return sortedValidated.slice(0, 20);
+  };
+
+  return {
+    displayItems: getDisplayItems(),
+    isLoading,
+    error,
+    isFetching,
+    refetch
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/services/hooks/useDialogState.ts b/application/src/components/services/hooks/useDialogState.ts
new file mode 100644
index 0000000..7ebe89c
--- /dev/null
+++ b/application/src/components/services/hooks/useDialogState.ts
@@ -0,0 +1,30 @@
+
+import { useState } from "react";
+
+export function useDialogState() {
+  const [isHistoryDialogOpen, setIsHistoryDialogOpen] = useState(false);
+  const [isDeleteDialogOpen, setIsDeleteDialogOpen] = useState(false);
+  const [isEditDialogOpen, setIsEditDialogOpen] = useState(false);
+
+  const handleEditDialogChange = (open: boolean) => {
+    setIsEditDialogOpen(open);
+  };
+  
+  const handleDeleteDialogChange = (open: boolean, isDeleting: boolean = false) => {
+    // Only allow closing if not currently deleting
+    if (!isDeleting || !open) {
+      setIsDeleteDialogOpen(open);
+    }
+  };
+
+  return {
+    isHistoryDialogOpen,
+    isDeleteDialogOpen,
+    isEditDialogOpen,
+    setIsHistoryDialogOpen,
+    setIsDeleteDialogOpen,
+    setIsEditDialogOpen,
+    handleEditDialogChange,
+    handleDeleteDialogChange
+  };
+}
diff --git a/application/src/components/services/hooks/useServiceActions.ts b/application/src/components/services/hooks/useServiceActions.ts
new file mode 100644
index 0000000..85b0b9b
--- /dev/null
+++ b/application/src/components/services/hooks/useServiceActions.ts
@@ -0,0 +1,205 @@
+import { useState } from "react";
+import { useToast } from "@/hooks/use-toast";
+import { useNavigate } from "react-router-dom";
+import { useQueryClient } from "@tanstack/react-query";
+import { pb } from "@/lib/pocketbase";
+import { Service } from "@/types/service.types";
+import { serviceService } from "@/services/serviceService";
+import { recordMuteStatusChange } from "@/services/monitoring/utils/notificationUtils";
+
+export function useServiceActions(initialServices: Service[]) {
+  const [services, setServices] = useState<Service[]>(initialServices);
+  const [selectedService, setSelectedService] = useState<Service | null>(null);
+  const [isDeleting, setIsDeleting] = useState(false);
+  const { toast } = useToast();
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+
+  // Update services state when props change
+  const updateServices = (newServices: Service[]) => {
+    if (JSON.stringify(services) !== JSON.stringify(newServices)) {
+      setServices(newServices);
+    }
+  };
+
+  const handleViewDetail = (service: Service) => {
+   // console.log(`Navigating to service detail for service ID: ${service.id}`);
+    navigate(`/service/${service.id}`);
+  };
+  
+  const handlePauseResume = async (service: Service) => {
+    try {
+      if (service.status === "paused") {
+        // Resume monitoring
+        await serviceService.startMonitoringService(service.id);
+        toast({
+          title: "Service resumed",
+          description: `${service.name} monitoring has been resumed successfully.`,
+        });
+        
+        // Update local state - ensure status is properly typed as "up"
+        const updatedServices = services.map(s => 
+          s.id === service.id ? { ...s, status: "up" as const } : s
+        );
+        setServices(updatedServices);
+      } else {
+        // Pause monitoring
+        await serviceService.pauseMonitoring(service.id);
+        
+        // Get the pause time and update local state
+        const pauseTime = new Date().toISOString();
+        const updatedServices = services.map(s => 
+          s.id === service.id ? { ...s, status: "paused" as const, lastChecked: pauseTime } : s
+        );
+        setServices(updatedServices);
+        
+        toast({
+          title: "Service paused",
+          description: `${service.name} monitoring has been paused successfully.`,
+        });
+      }
+      
+      // Invalidate the services query to trigger a refetch
+      queryClient.invalidateQueries({ queryKey: ["services"] });
+    } catch (error) {
+      console.error("Error updating service status:", error);
+      toast({
+        variant: "destructive",
+        title: "Error",
+        description: "Failed to update service status. Please try again.",
+      });
+    }
+  };
+  
+  const handleEdit = (service: Service) => {
+    setSelectedService({...service}); // Create a copy to avoid reference issues
+    return service;
+  };
+  
+  const handleDelete = (service: Service) => {
+    setSelectedService(service);
+    return service;
+  };
+  
+  // Modified to return Promise<void> instead of Promise<boolean>
+  const confirmDelete = async (): Promise<void> => {
+    if (!selectedService || isDeleting) return;
+    
+    try {
+      setIsDeleting(true);
+      
+      // First try to pause monitoring for this service to prevent any concurrency issues
+      if (selectedService.status !== "paused") {
+        await serviceService.pauseMonitoring(selectedService.id);
+      }
+      
+      // Set a timeout to prevent hanging UI
+      const timeoutPromise = new Promise<never>((_, reject) => {
+        setTimeout(() => reject(new Error("Delete request timed out")), 10000);
+      });
+      
+      const deletePromise = pb.collection('services').delete(selectedService.id);
+      await Promise.race([deletePromise, timeoutPromise]);
+      
+      toast({
+        title: "Service deleted",
+        description: `${selectedService.name} has been deleted successfully.`,
+      });
+      
+      // Update local state
+      const updatedServices = services.filter(s => s.id !== selectedService.id);
+      setServices(updatedServices);
+      
+      // Invalidate the services query to trigger a refetch
+      queryClient.invalidateQueries({ queryKey: ["services"] });
+      
+      setSelectedService(null);
+    } catch (error) {
+    //  console.error("Error deleting service:", error);
+      toast({
+        variant: "destructive",
+        title: "Error",
+        description: "Failed to delete service. Please try again.",
+      });
+    } finally {
+      setIsDeleting(false);
+    }
+  };
+
+  const handleMuteAlerts = async (service: Service) => {
+    try {
+      // Check alerts status - check both fields for backward compatibility
+      const isMuted = service.alerts === "muted" || service.muteAlerts === true;
+      
+      // Toggle the mute alerts status for this specific service
+      const newMuteStatus = !isMuted;
+      
+     // console.log(`${newMuteStatus ? "Muting" : "Unmuting"} alerts for service ${service.id} (${service.name})`);
+      
+      // First update the local state immediately for better UI responsiveness
+      // Using proper type casting to ensure TypeScript knows we're creating valid Service objects
+      const updatedServices = services.map(s => {
+        if (s.id === service.id) {
+          return {
+            ...s,
+            muteAlerts: newMuteStatus,
+            alerts: newMuteStatus ? "muted" as const : "unmuted" as const
+          };
+        }
+        return s;
+      });
+      
+      setServices(updatedServices);
+      
+      // Record the mute status change (this will also update the service record)
+      await recordMuteStatusChange(service.id, service.name, newMuteStatus);
+      
+      // Show a toast message
+      toast({
+        title: newMuteStatus ? "Alerts muted" : "Alerts unmuted",
+        description: `Notifications for ${service.name} are now ${newMuteStatus ? "muted" : "enabled"}.`,
+      });
+      
+      // Immediately invalidate the services query to trigger a refetch
+      // This ensures our local state matches the database state
+      await queryClient.invalidateQueries({ queryKey: ["services"] });
+      
+    } catch (error) {
+    //  console.error("Error updating alert settings:", error);
+      
+      // Revert the local state change if the server update failed
+      const revertedServices = services.map(s => {
+        if (s.id === service.id) {
+          return {
+            ...s,
+            muteAlerts: service.muteAlerts,
+            alerts: service.alerts
+          };
+        }
+        return s;
+      });
+      
+      setServices(revertedServices);
+      
+      toast({
+        variant: "destructive",
+        title: "Error",
+        description: `Failed to ${!service.muteAlerts ? "mute" : "unmute"} alerts for ${service.name}. Please try again.`,
+      });
+    }
+  };
+
+  return {
+    services,
+    selectedService,
+    isDeleting,
+    setSelectedService,
+    updateServices,
+    handleViewDetail,
+    handlePauseResume,
+    handleEdit,
+    handleDelete,
+    confirmDelete,
+    handleMuteAlerts
+  };
+}
\ No newline at end of file
diff --git a/application/src/components/services/hooks/useUptimeData.ts b/application/src/components/services/hooks/useUptimeData.ts
new file mode 100644
index 0000000..96a20d1
--- /dev/null
+++ b/application/src/components/services/hooks/useUptimeData.ts
@@ -0,0 +1,102 @@
+
+import { useState, useEffect } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { uptimeService } from '@/services/uptimeService';
+import { UptimeData } from '@/types/service.types';
+
+interface UseUptimeDataProps {
+  serviceId?: string;
+  serviceType?: string;
+  status: string;
+  interval: number;
+}
+
+export const useUptimeData = ({ serviceId, serviceType, status, interval }: UseUptimeDataProps) => {
+  const [historyItems, setHistoryItems] = useState<UptimeData[]>([]);
+  
+  // Fetch ALL uptime history data including regional monitoring data with 1-minute polling
+  const { data: uptimeData, isLoading, error, isFetching, refetch } = useQuery({
+    queryKey: ['allUptimeHistory', serviceId, serviceType],
+    queryFn: async () => {
+      if (!serviceId) {
+        console.log('No serviceId provided, skipping fetch');
+        return [];
+      }
+      console.log(`Fetching ALL uptime data for service ${serviceId} of type ${serviceType} - including regional monitoring`);
+      
+      // Get raw uptime history data
+      const rawData = await uptimeService.getUptimeHistory(serviceId, 50, undefined, undefined, serviceType);
+      
+      // Include ALL monitoring data - both default and regional
+      const allMonitoringData = rawData.filter(record => record.service_id === serviceId);
+      
+      console.log(`Retrieved ${rawData.length} total records, filtered to ${allMonitoringData.length} records for service ${serviceId}`);
+      return allMonitoringData;
+    },
+    enabled: !!serviceId,
+    refetchInterval: 60000, // 1 minute polling
+    staleTime: 30000, // Data is fresh for 30 seconds
+    placeholderData: (previousData) => previousData,
+    retry: 3,
+    retryDelay: (attemptIndex) => Math.min(1000 * 2 ** attemptIndex, 10000),
+  });
+  
+  // Process uptime data to include both default and regional monitoring
+  const processUptimeData = (data: UptimeData[], intervalSeconds: number): UptimeData[] => {
+    if (!data || data.length === 0) return [];
+    
+    console.log(`Processing ${data.length} uptime records (all monitoring data) for service ${serviceId}`);
+    
+    // Sort data by timestamp (newest first)
+    const sortedData = [...data].sort((a, b) => 
+      new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
+    );
+    
+    // Take the most recent records to ensure we have enough data for both default and regional
+    const recentData = sortedData.slice(0, 50);
+    
+    console.log(`Using ${recentData.length} most recent records including both default and regional monitoring`);
+    
+    return recentData;
+  };
+  
+  // Update history items when data changes
+  useEffect(() => {
+    if (uptimeData && uptimeData.length > 0) {
+      console.log(`Received ${uptimeData.length} uptime records (all monitoring) for service ${serviceId}`);
+      const processedData = processUptimeData(uptimeData, interval);
+      setHistoryItems(processedData);
+    } else if (!serviceId || (uptimeData && uptimeData.length === 0)) {
+      // Generate placeholder data when no real data is available
+      console.log(`No uptime data available for service ${serviceId}, generating placeholder`);
+      
+      const statusValue = (status === "up" || status === "down" || status === "warning" || status === "paused") 
+        ? status 
+        : "paused";
+        
+      const placeholderHistory: UptimeData[] = Array(20).fill(null).map((_, index) => ({
+        id: `placeholder-${serviceId}-${index}`,
+        service_id: serviceId || "",
+        serviceId: serviceId || "",
+        timestamp: new Date(Date.now() - (index * interval * 1000)).toISOString(),
+        status: statusValue as "up" | "down" | "warning" | "paused",
+        responseTime: 0
+      }));
+      
+      setHistoryItems(placeholderHistory);
+    }
+  }, [uptimeData, serviceId, status, interval]);
+
+  // Return display items - all monitoring data for tooltip usage
+  const getDisplayItems = (): UptimeData[] => {
+    return historyItems;
+  };
+
+  return {
+    displayItems: getDisplayItems(),
+    isLoading,
+    error,
+    isFetching,
+    refetch
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/services/incident-history/EmptyState.tsx b/application/src/components/services/incident-history/EmptyState.tsx
new file mode 100644
index 0000000..113bbbb
--- /dev/null
+++ b/application/src/components/services/incident-history/EmptyState.tsx
@@ -0,0 +1,19 @@
+
+interface EmptyStateProps {
+  statusFilter: string;
+}
+
+export function EmptyState({ statusFilter }: EmptyStateProps) {
+  return (
+    <div className="text-center py-8 text-muted-foreground">
+      {statusFilter === "all"
+        ? "No incidents recorded in selected time period"
+        : `No ${
+            statusFilter === "up" ? "uptime" : 
+            statusFilter === "down" ? "downtime" : 
+            statusFilter === "warning" ? "warning" : 
+            "paused"
+          } incidents recorded in selected time period`}
+    </div>
+  );
+}
diff --git a/application/src/components/services/incident-history/IncidentTable.tsx b/application/src/components/services/incident-history/IncidentTable.tsx
new file mode 100644
index 0000000..e2184aa
--- /dev/null
+++ b/application/src/components/services/incident-history/IncidentTable.tsx
@@ -0,0 +1,81 @@
+
+import { format } from "date-fns";
+import { UptimeData } from "@/types/service.types";
+import { getStatusInfo } from "./utils";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface IncidentTableProps {
+  incidents: UptimeData[];
+}
+
+export function IncidentTable({ incidents }: IncidentTableProps) {
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+  
+  if (incidents.length === 0) {
+    return null;
+  }
+
+  return (
+    <Table className={theme === 'dark' ? 'text-gray-200' : 'text-gray-700'}>
+      <TableHeader className={theme === 'dark' ? 'bg-gray-800/50' : 'bg-gray-50'}>
+        <TableRow className={theme === 'dark' ? 'border-gray-700' : 'border-gray-200'}>
+          <TableHead className={theme === 'dark' ? 'text-gray-300' : 'text-gray-700'}>{t("time")}</TableHead>
+          <TableHead className={theme === 'dark' ? 'text-gray-300' : 'text-gray-700'}>{t("status")}</TableHead>
+          <TableHead className={theme === 'dark' ? 'text-gray-300' : 'text-gray-700'}>{t("responseTime")}</TableHead>
+          <TableHead className={theme === 'dark' ? 'text-gray-300' : 'text-gray-700'}>{t("errorMessage")}</TableHead>
+          <TableHead className={theme === 'dark' ? 'text-gray-300' : 'text-gray-700'}>{t("details")}</TableHead>
+        </TableRow>
+      </TableHeader>
+      <TableBody>
+        {incidents.map((check, index) => {
+          const statusInfo = getStatusInfo(check.status);
+          const timestamp = new Date(check.timestamp);
+          
+          return (
+            <TableRow key={check.id || `incident-${index}`} className={theme === 'dark' ? 'border-gray-800 hover:bg-gray-800/30' : 'border-gray-200 hover:bg-gray-50'}>
+              <TableCell>
+                <div className="flex flex-col">
+                  <span>{format(timestamp, 'MMM dd, yyyy')}</span>
+                  <span className={`text-xs ${theme === 'dark' ? 'text-gray-400' : 'text-gray-500'}`}>
+                    {format(timestamp, 'h:mm a')}
+                  </span>
+                </div>
+              </TableCell>
+              <TableCell>
+                <div className="flex items-center">
+                  {statusInfo.badge}
+                </div>
+              </TableCell>
+              <TableCell className={`font-mono ${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'}`}>
+                {check.status !== "paused" && check.responseTime > 0 
+                  ? `${check.responseTime}ms` 
+                  : "N/A"}
+              </TableCell>
+              <TableCell className={`text-sm ${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} max-w-[200px]`}>
+                {check.error_message ? (
+                  <div className="truncate" title={check.error_message}>
+                    {check.error_message}
+                  </div>
+                ) : (
+                  <span className={theme === 'dark' ? 'text-gray-500' : 'text-gray-400'}>-</span>
+                )}
+              </TableCell>
+              <TableCell className={`text-sm ${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} max-w-[250px]`}>
+                {check.details ? (
+                  <div className="truncate" title={check.details}>
+                    {check.details}
+                  </div>
+                ) : (
+                  <span className={theme === 'dark' ? 'text-gray-500' : 'text-gray-400'}>-</span>
+                )}
+              </TableCell>
+            </TableRow>
+          );
+        })}
+      </TableBody>
+    </Table>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/services/incident-history/LatestChecksTable.tsx b/application/src/components/services/incident-history/LatestChecksTable.tsx
new file mode 100644
index 0000000..7b976c1
--- /dev/null
+++ b/application/src/components/services/incident-history/LatestChecksTable.tsx
@@ -0,0 +1,96 @@
+
+import { useState, useEffect, useMemo } from "react";
+import { UptimeData } from "@/types/service.types";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { StatusFilterTabs } from "./StatusFilterTabs";
+import { TablePagination } from "./TablePagination";
+import { EmptyState } from "./EmptyState";
+import { IncidentTable } from "./IncidentTable";
+import { StatusFilter, PageSize } from "./types";
+import { getStatusChangeEvents } from "./utils";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+export function LatestChecksTable({ uptimeData }: { uptimeData: UptimeData[] }) {
+  // Get current theme
+  const { theme } = useTheme();
+	const { t } = useLanguage();
+  
+  // Filter state
+  const [statusFilter, setStatusFilter] = useState<StatusFilter>("all");
+  const [currentPage, setCurrentPage] = useState(1);
+  const [pageSize, setPageSize] = useState<PageSize>("25");
+  
+  // Reset to first page when filters change
+  useEffect(() => {
+    setCurrentPage(1);
+  }, [statusFilter, pageSize]);
+
+  // Filter incidents by status
+  const incidents = useMemo(() => {
+    const statusChanges = getStatusChangeEvents(uptimeData);
+  //  console.log(`Total status changes: ${statusChanges.length}`);
+  //  console.log(`Status types in incidents: ${[...new Set(statusChanges.map(i => i.status))].join(', ')}`);
+    
+    if (statusFilter === "all") return statusChanges;
+    
+    return statusChanges.filter(incident => incident.status === statusFilter);
+  }, [uptimeData, statusFilter]);
+
+  // Calculate pagination
+  const { paginatedIncidents, totalPages } = useMemo(() => {
+    if (pageSize === "all") {
+      return {
+        paginatedIncidents: incidents,
+        totalPages: 1,
+      };
+    }
+    
+    const itemsPerPage = parseInt(pageSize, 10);
+    const pages = Math.ceil(incidents.length / itemsPerPage);
+    const start = (currentPage - 1) * itemsPerPage;
+    const end = start + itemsPerPage;
+    
+    return {
+      paginatedIncidents: incidents.slice(start, end),
+      totalPages: Math.max(1, pages),
+    };
+  }, [incidents, currentPage, pageSize]);
+
+  // Calculate items per page for pagination display
+  const itemsPerPage = pageSize === "all" ? incidents.length : parseInt(pageSize, 10);
+
+ // console.log(`Status Filter: ${statusFilter}, Incidents: ${incidents.length}, Includes paused: ${incidents.some(i => i.status === 'paused')}`);
+
+  return (
+    <Card className={`mb-6 transition-colors ${theme === 'dark' ? 'bg-card border-border' : 'bg-white border-gray-200'}`}>
+      <CardHeader>
+        <div className="flex flex-col md:flex-row md:items-center justify-between gap-4">
+          <CardTitle className="text-card-foreground">
+            <span>{t("incidentHistory")}</span>
+          </CardTitle>
+          <StatusFilterTabs statusFilter={statusFilter} onStatusFilterChange={setStatusFilter} />
+        </div>
+      </CardHeader>
+      <CardContent>
+        {incidents.length === 0 ? (
+          <EmptyState statusFilter={statusFilter} />
+        ) : (
+          <>
+            <IncidentTable incidents={paginatedIncidents} />
+            
+            <TablePagination
+              currentPage={currentPage}
+              totalPages={totalPages}
+              pageSize={pageSize}
+              totalItems={incidents.length}
+              itemsPerPage={itemsPerPage}
+              onPageChange={setCurrentPage}
+              onPageSizeChange={setPageSize}
+            />
+          </>
+        )}
+      </CardContent>
+    </Card>
+  );
+}
diff --git a/application/src/components/services/incident-history/StatusFilterTabs.tsx b/application/src/components/services/incident-history/StatusFilterTabs.tsx
new file mode 100644
index 0000000..58e3472
--- /dev/null
+++ b/application/src/components/services/incident-history/StatusFilterTabs.tsx
@@ -0,0 +1,66 @@
+
+import { Activity, AlertTriangle, CheckCircle, Pause, X } from "lucide-react";
+import { Tabs, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { StatusFilter } from "./types";
+import { useTheme } from "@/contexts/ThemeContext";
+
+interface StatusFilterTabsProps {
+  statusFilter: StatusFilter;
+  onStatusFilterChange: (value: StatusFilter) => void;
+}
+
+export function StatusFilterTabs({
+  statusFilter,
+  onStatusFilterChange
+}: StatusFilterTabsProps) {
+  // Get current theme to apply appropriate styling
+  const { theme } = useTheme();
+  
+  return (
+    <Tabs 
+      value={statusFilter} 
+      onValueChange={value => onStatusFilterChange(value as StatusFilter)} 
+      className="w-full"
+    >
+      <TabsList className={`grid grid-cols-5 w-full max-w-md rounded-full ${
+        theme === 'dark' ? 'bg-secondary' : 'bg-slate-100'
+      }`}>
+        <TabsTrigger 
+          value="all" 
+          className="rounded-full flex items-center gap-1 data-[state=active]:bg-[#1A1F2C] data-[state=active]:text-[#D6BCFA] text-[#8E9196]"
+        >
+          <Activity className="h-4 w-4" />
+          <span>All</span>
+        </TabsTrigger>
+        <TabsTrigger 
+          value="up" 
+          className="rounded-full flex items-center gap-1 data-[state=active]:bg-[#1A1F2C] data-[state=active]:text-[#D6BCFA] text-[#8E9196]"
+        >
+          <CheckCircle className="h-4 w-4" />
+          <span>Up</span>
+        </TabsTrigger>
+        <TabsTrigger 
+          value="down" 
+          className="rounded-full flex items-center gap-1 data-[state=active]:bg-[#1A1F2C] data-[state=active]:text-[#D6BCFA] text-[#8E9196]"
+        >
+          <X className="h-4 w-4" />
+          <span>Down</span>
+        </TabsTrigger>
+        <TabsTrigger 
+          value="warning" 
+          className="rounded-full flex items-center gap-1 data-[state=active]:bg-[#1A1F2C] data-[state=active]:text-[#D6BCFA] text-[#8E9196]"
+        >
+          <AlertTriangle className="h-4 w-4" />
+          <span>Warning</span>
+        </TabsTrigger>
+        <TabsTrigger 
+          value="paused" 
+          className="rounded-full flex items-center gap-1 data-[state=active]:bg-[#1A1F2C] data-[state=active]:text-[#D6BCFA] text-[#8E9196]"
+        >
+          <Pause className="h-4 w-4" />
+          <span>Paused</span>
+        </TabsTrigger>
+      </TabsList>
+    </Tabs>
+  );
+}
diff --git a/application/src/components/services/incident-history/TablePagination.tsx b/application/src/components/services/incident-history/TablePagination.tsx
new file mode 100644
index 0000000..ca0f808
--- /dev/null
+++ b/application/src/components/services/incident-history/TablePagination.tsx
@@ -0,0 +1,120 @@
+
+import { 
+  Pagination, 
+  PaginationContent, 
+  PaginationItem, 
+  PaginationLink, 
+  PaginationNext, 
+  PaginationPrevious 
+} from "@/components/ui/pagination";
+import { 
+  Select, 
+  SelectContent, 
+  SelectItem, 
+  SelectTrigger, 
+  SelectValue 
+} from "@/components/ui/select";
+import { PageSize } from "./types";
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface TablePaginationProps {
+  currentPage: number;
+  totalPages: number;
+  pageSize: PageSize;
+  totalItems: number;
+  itemsPerPage: number;
+  onPageChange: (page: number) => void;
+  onPageSizeChange: (size: PageSize) => void;
+}
+
+export function TablePagination({
+  currentPage,
+  totalPages,
+  pageSize,
+  totalItems,
+  itemsPerPage,
+  onPageChange,
+  onPageSizeChange,
+}: TablePaginationProps) {
+	const {t} = useLanguage()
+  // Generate page numbers
+  const getPageNumbers = () => {
+    const pages = [];
+    const maxVisiblePages = 5;
+    const halfVisible = Math.floor(maxVisiblePages / 2);
+    
+    let startPage = Math.max(1, currentPage - halfVisible);
+    let endPage = Math.min(totalPages, startPage + maxVisiblePages - 1);
+    
+    if (endPage - startPage + 1 < maxVisiblePages) {
+      startPage = Math.max(1, endPage - maxVisiblePages + 1);
+    }
+    
+    for (let i = startPage; i <= endPage; i++) {
+      pages.push(i);
+    }
+    
+    return pages;
+  };
+
+  return (
+    <div className="mt-4 flex items-center justify-between">
+      <div className="flex items-center space-x-2">
+        <span className="text-sm text-muted-foreground">{t("rowsPerPage")}:</span>
+        <Select
+          value={pageSize}
+          onValueChange={(value) => onPageSizeChange(value as PageSize)}
+        >
+          <SelectTrigger className="h-8 w-[70px]">
+            <SelectValue placeholder="25" />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="10">10</SelectItem>
+            <SelectItem value="25">25</SelectItem>
+            <SelectItem value="50">50</SelectItem>
+            <SelectItem value="100">100</SelectItem>
+            <SelectItem value="250">250</SelectItem>
+            <SelectItem value="all">All</SelectItem>
+          </SelectContent>
+        </Select>
+        <span className="text-sm text-muted-foreground">
+          {pageSize === 'all' 
+            ? `Showing all ${totalItems} items` 
+            : `Showing ${Math.min((currentPage - 1) * itemsPerPage + 1, totalItems)}-${Math.min(currentPage * itemsPerPage, totalItems)} of ${totalItems} items`}
+        </span>
+      </div>
+      
+      {totalPages > 1 && (
+        <Pagination>
+          <PaginationContent>
+            <PaginationItem>
+              <PaginationPrevious
+                onClick={() => onPageChange(Math.max(1, currentPage - 1))}
+                className={currentPage === 1 ? "pointer-events-none opacity-50" : "cursor-pointer"}
+              />
+            </PaginationItem>
+            
+            {getPageNumbers().map((page) => (
+              <PaginationItem key={page}>
+                <PaginationLink
+                  isActive={page === currentPage}
+                  onClick={() => onPageChange(page)}
+                  className="cursor-pointer"
+                >
+                  {page}
+                </PaginationLink>
+              </PaginationItem>
+            ))}
+            
+            <PaginationItem>
+              <PaginationNext
+                onClick={() => onPageChange(Math.min(totalPages, currentPage + 1))}
+                className={currentPage === totalPages ? "pointer-events-none opacity-50" : "cursor-pointer"}
+              />
+            </PaginationItem>
+          </PaginationContent>
+        </Pagination>
+      )}
+    </div>
+  );
+}
diff --git a/application/src/components/services/incident-history/index.ts b/application/src/components/services/incident-history/index.ts
new file mode 100644
index 0000000..8e2cfdd
--- /dev/null
+++ b/application/src/components/services/incident-history/index.ts
@@ -0,0 +1,11 @@
+
+// Export components
+export { LatestChecksTable } from './LatestChecksTable';
+export { StatusFilterTabs } from './StatusFilterTabs';
+export { TablePagination } from './TablePagination';
+export { IncidentTable } from './IncidentTable';
+export { EmptyState } from './EmptyState';
+
+// Export types and utils
+export * from './types';
+export * from './utils';
diff --git a/application/src/components/services/incident-history/types.ts b/application/src/components/services/incident-history/types.ts
new file mode 100644
index 0000000..2629492
--- /dev/null
+++ b/application/src/components/services/incident-history/types.ts
@@ -0,0 +1,16 @@
+
+import { UptimeData } from "@/types/service.types";
+
+export type StatusFilter = "all" | "up" | "down" | "paused" | "warning";
+export type PageSize = "10" | "25" | "50" | "100" | "250" | "all";
+
+export interface LatestChecksTableProps {
+  uptimeData: UptimeData[];
+}
+
+export interface StatusInfo {
+  icon: JSX.Element;
+  text: string;
+  textColor: string;
+  badge: JSX.Element;
+}
diff --git a/application/src/components/services/incident-history/utils.tsx b/application/src/components/services/incident-history/utils.tsx
new file mode 100644
index 0000000..b4aa977
--- /dev/null
+++ b/application/src/components/services/incident-history/utils.tsx
@@ -0,0 +1,89 @@
+
+import { CheckCircle, AlertTriangle, X, Pause } from "lucide-react";
+import { Badge } from "@/components/ui/badge";
+import { UptimeData } from "@/types/service.types";
+import { format } from "date-fns";
+import { StatusInfo } from "./types";
+
+// Get appropriate icon and style for each status
+export const getStatusInfo = (status: string): StatusInfo => {
+  switch (status) {
+    case "up":
+      return { 
+        icon: <CheckCircle className="h-4 w-4 text-green-500 mr-2" />, 
+        text: "Up", 
+        textColor: "text-green-500",
+        badge: <Badge variant="default" className="bg-emerald-800 text-white hover:bg-emerald-700">Up</Badge>
+      };
+    case "warning":
+      return { 
+        icon: <AlertTriangle className="h-4 w-4 text-yellow-500 mr-2" />, 
+        text: "Warning", 
+        textColor: "text-yellow-500",
+        badge: <Badge variant="outline" className="bg-yellow-800/80 text-yellow-300 border-yellow-700 hover:bg-yellow-800">Warning</Badge>
+      };
+    case "paused":
+      return { 
+        icon: <Pause className="h-4 w-4 text-gray-500 mr-2" />, 
+        text: "Paused", 
+        textColor: "text-gray-500",
+        badge: <Badge variant="outline" className="bg-gray-800/50 text-gray-400 border-gray-700 hover:bg-gray-800">Paused</Badge>
+      };
+    default: // down
+      return { 
+        icon: <X className="h-4 w-4 text-red-500 mr-2" />, 
+        text: "Down", 
+        textColor: "text-red-500",
+        badge: <Badge variant="destructive">Down</Badge>
+      };
+  }
+};
+
+// Filter the uptimeData to only include status changes (incidents)
+export const getStatusChangeEvents = (uptimeData: UptimeData[]): UptimeData[] => {
+  if (!uptimeData.length) return [];
+
+  // First sort the data by timestamp (newest first for display)
+  const sortedData = [...uptimeData].sort((a, b) => 
+    new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
+  );
+
+  // We need to find all status changes, including to/from paused
+  const statusChanges: UptimeData[] = [];
+  
+  // Always include the most recent check as a baseline
+  if (sortedData.length > 0) {
+    statusChanges.push(sortedData[0]);
+  }
+  
+  // Compare each check with the previous one to detect status changes
+  for (let i = 0; i < sortedData.length - 1; i++) {
+    const currentCheck = sortedData[i];
+    const nextCheck = sortedData[i + 1]; // This is actually the "older" check
+    
+    // If the status changed, add the "older" check to our incidents list
+    // This shows what the status changed TO
+    if (currentCheck.status !== nextCheck.status) {
+      statusChanges.push(nextCheck);
+    }
+  }
+
+ // console.log(`Found ${statusChanges.length} status changes, including paused status changes: ${statusChanges.some(i => i.status === 'paused')}`);
+  
+  return statusChanges;
+};
+
+// Get date range for display
+export const getDateRangeDisplay = (incidents: UptimeData[]): string => {
+  if (!incidents.length) return "";
+  
+  const sortedData = [...incidents].sort((a, b) => 
+    new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime()
+  );
+  
+  const start = format(new Date(sortedData[0].timestamp), 'MMM dd, yyyy');
+  const end = format(new Date(sortedData[sortedData.length - 1].timestamp), 'MMM dd, yyyy');
+  
+  // Display date range if different dates
+  return start === end ? start : `${start} - ${end}`;
+};
diff --git a/application/src/components/services/index.ts b/application/src/components/services/index.ts
new file mode 100644
index 0000000..d314f50
--- /dev/null
+++ b/application/src/components/services/index.ts
@@ -0,0 +1,16 @@
+
+// Export all service components for easier imports
+export * from './ServiceHeader';
+export * from './ServiceStatsCards';
+export * from './ResponseTimeChart';
+export * from './incident-history/LatestChecksTable';
+export * from './LoadingState';
+export * from './ServiceNotFound';
+export * from './ServiceMonitoringButton';
+export * from './AddServiceDialog';
+export * from './ServicesTableContainer';
+export * from './ServicesTableView';
+export * from './ServiceDeleteDialog';
+export * from './ServiceHistoryDialog';
+export * from './ServiceEditDialog';
+export * from './ServiceForm';
\ No newline at end of file
diff --git a/application/src/components/services/service-row/ServiceRowActions.tsx b/application/src/components/services/service-row/ServiceRowActions.tsx
new file mode 100644
index 0000000..fd7c3b1
--- /dev/null
+++ b/application/src/components/services/service-row/ServiceRowActions.tsx
@@ -0,0 +1,186 @@
+
+import React from "react";
+import { Button } from "@/components/ui/button";
+import { MoreHorizontal, Eye, Play, Pause, Edit, Bell, BellOff, Trash2 } from "lucide-react";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+  DropdownMenuSeparator,
+} from "@/components/ui/dropdown-menu";
+import { Service } from "@/types/service.types";
+import { serviceService } from "@/services/serviceService";
+import { useToast } from "@/hooks/use-toast";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface ServiceRowActionsProps {
+  service: Service;
+  onViewDetail: (service: Service) => void;
+  onPauseResume: (service: Service) => Promise<void>;
+  onEdit: (service: Service) => void;
+  onDelete: (service: Service) => void;
+  onMuteAlerts?: (service: Service) => Promise<void>;
+}
+
+export const ServiceRowActions = ({ 
+  service, 
+  onViewDetail,
+  onPauseResume,
+  onEdit,
+  onDelete,
+  onMuteAlerts
+}: ServiceRowActionsProps) => {
+  const { toast } = useToast();
+	const { t } = useLanguage();
+
+  // Handle pause/resume directly from dropdown
+  const handlePauseResume = async (e: React.MouseEvent) => {
+    e.stopPropagation();
+    
+    try {
+      if (service.status === "paused") {
+        // Resume monitoring
+   //     console.log(`Resuming monitoring for service ${service.id} (${service.name}) from dropdown`);
+        
+        // First ensure we update the status
+        await serviceService.resumeMonitoring(service.id);
+        
+        // Then start monitoring service (performs an immediate check)
+        await serviceService.startMonitoringService(service.id);
+        
+        toast({
+          title: "Monitoring resumed",
+          description: `Monitoring for ${service.name} has been resumed. First check is running now.`,
+        });
+      } else {
+        // Pause monitoring
+     //   console.log(`Pausing monitoring for service ${service.id} (${service.name}) from dropdown`);
+        await serviceService.pauseMonitoring(service.id);
+        
+        toast({
+          title: "Monitoring paused",
+          description: `Monitoring for ${service.name} has been paused.`,
+        });
+      }
+      
+      // Call the parent handler to refresh the UI
+      onPauseResume(service);
+    } catch (error) {
+   //   console.error("Error toggling monitoring:", error);
+      toast({
+        variant: "destructive",
+        title: "Error",
+        description: "Failed to change monitoring status. Please try again.",
+      });
+    }
+  };
+
+  // Check alerts status - check both fields for backward compatibility
+  const alertsMuted = service.alerts === "muted" || service.muteAlerts === true;
+
+  // Handle mute/unmute alerts
+  const handleMuteAlerts = async (e: React.MouseEvent) => {
+    e.stopPropagation();
+    
+    if (onMuteAlerts) {
+      try {
+    //    console.log(`Attempting to ${alertsMuted ? 'unmute' : 'mute'} alerts for service ${service.id} (${service.name})`);
+        await onMuteAlerts(service);
+      } catch (error) {
+     //   console.error("Error toggling alerts:", error);
+        toast({
+          variant: "destructive",
+          title: "Error",
+          description: "Failed to change alert settings. Please try again.",
+        });
+      }
+    }
+  };
+
+  return (
+    <div className="flex space-x-1">
+      <DropdownMenu>
+        <DropdownMenuTrigger asChild>
+          <Button 
+            variant="ghost" 
+            size="icon" 
+            title="More options"
+            className="opacity-70 hover:opacity-100"
+            onClick={(e) => e.stopPropagation()}
+          >
+            <MoreHorizontal className="h-5 w-5" />
+          </Button>
+        </DropdownMenuTrigger>
+        <DropdownMenuContent 
+          align="end" 
+          className="w-48"
+        >
+          <DropdownMenuItem 
+            className="flex items-center gap-2 cursor-pointer text-base py-2.5"
+            onClick={(e) => {
+              e.stopPropagation();
+              onViewDetail(service);
+            }}
+          >
+            <Eye className="h-4 w-4" />
+            <span>{t("viewDetail")}</span>
+          </DropdownMenuItem>
+          <DropdownMenuItem 
+            className="flex items-center gap-2 cursor-pointer text-base py-2.5"
+            onClick={handlePauseResume}
+          >
+            {service.status === "paused" ? (
+              <>
+                <Play className="h-4 w-4" />
+                <span>{t("resumeMonitoring")}</span>
+              </>
+            ) : (
+              <>
+                <Pause className="h-4 w-4" />
+                <span>{t("pauseMonitoring")}</span>
+              </>
+            )}
+          </DropdownMenuItem>
+          <DropdownMenuItem 
+            className="flex items-center gap-2 cursor-pointer text-base py-2.5"
+            onClick={(e) => {
+              e.stopPropagation();
+              onEdit(service);
+            }}
+          >
+            <Edit className="h-4 w-4" />
+            <span>{t("edit")}</span>
+          </DropdownMenuItem>
+          <DropdownMenuItem 
+            className="flex items-center gap-2 cursor-pointer text-base py-2.5"
+            onClick={handleMuteAlerts}
+          >
+            {alertsMuted ? (
+              <>
+                <Bell className="h-4 w-4" />
+                <span>{t("unmuteAlerts")}</span>
+              </>
+            ) : (
+              <>
+                <BellOff className="h-4 w-4" />
+                <span>{t("muteAlerts")}</span>
+              </>
+            )}
+          </DropdownMenuItem>
+          <DropdownMenuSeparator />
+          <DropdownMenuItem 
+            className="flex items-center gap-2 text-destructive cursor-pointer text-base py-2.5"
+            onClick={(e) => {
+              e.stopPropagation();
+              onDelete(service);
+            }}
+          >
+            <Trash2 className="h-4 w-4" />
+            <span>{t("delete")}</span>
+          </DropdownMenuItem>
+        </DropdownMenuContent>
+      </DropdownMenu>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/service-row/ServiceRowHeader.tsx b/application/src/components/services/service-row/ServiceRowHeader.tsx
new file mode 100644
index 0000000..d02a947
--- /dev/null
+++ b/application/src/components/services/service-row/ServiceRowHeader.tsx
@@ -0,0 +1,72 @@
+
+import React from "react";
+import { BellOff } from "lucide-react";
+import { Service } from "@/types/service.types";
+
+interface ServiceRowHeaderProps {
+  service: Service;
+}
+
+export const ServiceRowHeader = ({ service }: ServiceRowHeaderProps) => {
+  // Check alerts status - check both fields for backward compatibility
+  const alertsMuted = service.alerts === "muted" || service.muteAlerts === true;
+  
+  // Determine what to display based on service type
+  const getServiceSubtitle = () => {
+    const serviceType = service.type.toLowerCase();
+    
+    if (serviceType === "dns" && service.domain) {
+      return service.domain;
+    }
+    
+    if ((serviceType === "ping" || serviceType === "tcp") && service.host) {
+      if (serviceType === "tcp" && service.port) {
+        return `${service.host}:${service.port}`;
+      }
+      return service.host;
+    }
+    
+    if (service.url) {
+      try {
+        // If the URL doesn't start with http:// or https://, add https:// prefix
+        const formattedUrl = (!service.url.startsWith('http://') && !service.url.startsWith('https://')) 
+          ? `https://${service.url}` 
+          : service.url;
+
+        try {
+          // Try to parse it as a URL
+          const urlObj = new URL(formattedUrl);
+          // For HTTP services, show full URL; for others show hostname
+          return serviceType === "http" ? formattedUrl : urlObj.hostname;
+        } catch (urlError) {
+          // If URL parsing fails, just show the original URL
+          return service.url;
+        }
+      } catch (e) {
+        // If any other error occurs, just show the original URL
+        return service.url;
+      }
+    }
+    
+    return "";
+  };
+
+  const serviceSubtitle = getServiceSubtitle();
+
+  return (
+    <div className="flex items-center gap-2">
+      <div>
+        <div className="text-base font-medium">{service.name}</div>
+        {serviceSubtitle && (
+          <div className="text-sm text-gray-500 mt-1">{serviceSubtitle}</div>
+        )}
+      </div>
+      {/* Add a visual indicator if alerts are muted for this service */}
+      {alertsMuted && (
+        <div className="ml-1" title="Alerts muted">
+          <BellOff className="h-4 w-4 text-gray-400" />
+        </div>
+      )}
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/service-row/ServiceRowResponseTime.tsx b/application/src/components/services/service-row/ServiceRowResponseTime.tsx
new file mode 100644
index 0000000..929de3a
--- /dev/null
+++ b/application/src/components/services/service-row/ServiceRowResponseTime.tsx
@@ -0,0 +1,27 @@
+
+import React from "react";
+import { AlertTriangle } from "lucide-react";
+
+interface ServiceRowResponseTimeProps {
+  responseTime: number;
+}
+
+export const ServiceRowResponseTime = ({ responseTime }: ServiceRowResponseTimeProps) => {
+  // Determine if response time is high (≥ 1000ms)
+  const isResponseTimeHigh = responseTime >= 1000;
+
+  return (
+    <div className="font-mono text-base flex items-center gap-1.5">
+      {responseTime > 0 ? (
+        <>
+          <span className={isResponseTimeHigh ? "text-amber-500 font-semibold" : ""}>
+            {responseTime}ms
+          </span>
+          {isResponseTimeHigh && (
+            <AlertTriangle className="h-4 w-4 text-amber-500" />
+          )}
+        </>
+      ) : 'N/A'}
+    </div>
+  );
+};
diff --git a/application/src/components/services/service-row/index.ts b/application/src/components/services/service-row/index.ts
new file mode 100644
index 0000000..3eb2c30
--- /dev/null
+++ b/application/src/components/services/service-row/index.ts
@@ -0,0 +1,4 @@
+
+export * from './ServiceRowActions';
+export * from './ServiceRowHeader';
+export * from './ServiceRowResponseTime';
diff --git a/application/src/components/services/uptime/UptimeErrorState.tsx b/application/src/components/services/uptime/UptimeErrorState.tsx
new file mode 100644
index 0000000..f53c61b
--- /dev/null
+++ b/application/src/components/services/uptime/UptimeErrorState.tsx
@@ -0,0 +1,33 @@
+
+import React from 'react';
+import { X, RefreshCcw } from 'lucide-react';
+
+interface UptimeErrorStateProps {
+  uptime: number;
+  onRetry: () => void;
+}
+
+export const UptimeErrorState = ({ uptime, onRetry }: UptimeErrorStateProps) => {
+  return (
+    <div className="flex flex-col w-full gap-1">
+      <div className="flex items-center space-x-0.5 w-full h-6">
+        {Array(20).fill(0).map((_, index) => (
+          <div 
+            key={`error-${index}`}
+            className={`h-5 w-1.5 rounded-sm bg-gray-700 opacity-40`}
+          />
+        ))}
+      </div>
+      <div className="flex items-center justify-between text-xs">
+        <span className="text-muted-foreground">{Math.round(uptime)}% uptime</span>
+        <button 
+          onClick={onRetry} 
+          className="text-xs text-red-400 flex items-center gap-1 hover:text-red-300 transition-colors"
+        >
+          <X className="h-3 w-3" /> Connection error 
+          <RefreshCcw className="h-3 w-3 ml-1" />
+        </button>
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/uptime/UptimeLoadingState.tsx b/application/src/components/services/uptime/UptimeLoadingState.tsx
new file mode 100644
index 0000000..a23b3b6
--- /dev/null
+++ b/application/src/components/services/uptime/UptimeLoadingState.tsx
@@ -0,0 +1,21 @@
+
+import React from 'react';
+
+export const UptimeLoadingState = () => {
+  return (
+    <div className="flex flex-col w-full gap-1">
+      <div className="flex items-center space-x-0.5 w-full h-6">
+        {Array(20).fill(0).map((_, index) => (
+          <div 
+            key={`skeleton-${index}`}
+            className={`h-5 w-1.5 rounded-sm bg-muted animate-pulse`}
+          />
+        ))}
+      </div>
+      <div className="flex items-center justify-between text-xs">
+        <span className="text-muted-foreground w-16 h-4 bg-muted animate-pulse rounded"></span>
+        <span className="text-muted-foreground w-24 h-4 bg-muted animate-pulse rounded"></span>
+      </div>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/uptime/UptimeStatusItem.tsx b/application/src/components/services/uptime/UptimeStatusItem.tsx
new file mode 100644
index 0000000..4759a93
--- /dev/null
+++ b/application/src/components/services/uptime/UptimeStatusItem.tsx
@@ -0,0 +1,80 @@
+
+import React from 'react';
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip';
+import { UptimeData } from '@/types/service.types';
+import { useTheme } from '@/contexts/ThemeContext';
+
+interface UptimeStatusItemProps {
+  item: UptimeData;
+  index: number;
+}
+
+export const UptimeStatusItem = ({ item, index }: UptimeStatusItemProps) => {
+  const { theme } = useTheme();
+
+  // Get appropriate color classes for each status type
+  const getStatusColor = (itemStatus: string) => {
+    switch(itemStatus) {
+      case "up":
+        return theme === "dark" ? "bg-emerald-500" : "bg-emerald-500"; 
+      case "down":
+        return theme === "dark" ? "bg-red-500" : "bg-red-500";
+      case "warning":
+        return theme === "dark" ? "bg-yellow-500" : "bg-yellow-500";
+      case "paused":
+      default:
+        return theme === "dark" ? "bg-gray-500" : "bg-gray-400";
+    }
+  };
+  
+  // Get status label
+  const getStatusLabel = (itemStatus: string): string => {
+    switch(itemStatus) {
+      case "up": return "Online";
+      case "down": return "Offline";
+      case "warning": return "Degraded";
+      case "paused": return "Paused";
+      default: return "Unknown";
+    }
+  };
+  
+  // Format timestamp for display
+  const formatTimestamp = (timestamp: string): string => {
+    try {
+      return new Date(timestamp).toLocaleString([], {
+        hour: '2-digit', 
+        minute: '2-digit',
+        month: 'short',
+        day: 'numeric'
+      });
+    } catch (e) {
+      return timestamp;
+    }
+  };
+
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <div 
+          className={`h-5 w-1.5 rounded-sm ${getStatusColor(item.status)} cursor-pointer hover:opacity-80 transition-opacity`}
+        />
+      </TooltipTrigger>
+      <TooltipContent 
+        side="top"
+        className="bg-gray-900 text-white border-gray-800 px-3 py-2"
+      >
+        <div className="flex flex-col gap-1 text-xs">
+          <div className="font-medium">{getStatusLabel(item.status)}</div>
+          <div>
+            {item.status !== "paused" && item.status !== "down" ? 
+              `${item.responseTime}ms` : 
+              "No response"}
+          </div>
+          <div className="text-gray-400">
+            {formatTimestamp(item.timestamp)}
+          </div>
+        </div>
+      </TooltipContent>
+    </Tooltip>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/uptime/UptimeSummary.tsx b/application/src/components/services/uptime/UptimeSummary.tsx
new file mode 100644
index 0000000..61ba496
--- /dev/null
+++ b/application/src/components/services/uptime/UptimeSummary.tsx
@@ -0,0 +1,22 @@
+
+import React from 'react';
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+interface UptimeSummaryProps {
+  uptime: number;
+  interval: number;
+}
+
+export const UptimeSummary = ({ uptime, interval }: UptimeSummaryProps) => {
+	const { t } = useLanguage();
+  return (
+    <div className="flex items-center justify-between text-xs mt-1">
+      <span className="text-muted-foreground">
+        {Math.round(uptime)}% uptime
+      </span>
+      <span className="text-xs text-muted-foreground">
+	      {t('last20Checks')}
+      </span>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/services/uptime/index.ts b/application/src/components/services/uptime/index.ts
new file mode 100644
index 0000000..0249c35
--- /dev/null
+++ b/application/src/components/services/uptime/index.ts
@@ -0,0 +1,5 @@
+
+export { UptimeStatusItem } from './UptimeStatusItem';
+export { UptimeSummary } from './UptimeSummary';
+export { UptimeLoadingState } from './UptimeLoadingState';
+export { UptimeErrorState } from './UptimeErrorState';
\ No newline at end of file
diff --git a/application/src/components/settings/GeneralSettings.tsx b/application/src/components/settings/GeneralSettings.tsx
new file mode 100644
index 0000000..96331ff
--- /dev/null
+++ b/application/src/components/settings/GeneralSettings.tsx
@@ -0,0 +1,4 @@
+
+import GeneralSettingsPanel from './general/GeneralSettingsPanel';
+
+export default GeneralSettingsPanel;
\ No newline at end of file
diff --git a/application/src/components/settings/about-system/AboutSystem.tsx b/application/src/components/settings/about-system/AboutSystem.tsx
new file mode 100644
index 0000000..aabc953
--- /dev/null
+++ b/application/src/components/settings/about-system/AboutSystem.tsx
@@ -0,0 +1,437 @@
+import React, { useState } from 'react';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Separator } from "@/components/ui/separator";
+import { Github, FileText, Twitter, MessageCircle, Code2, ServerIcon, FolderOpen, Database, CheckCircle } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Label } from "@/components/ui/label";
+import { Checkbox } from "@/components/ui/checkbox";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useSystemSettings } from "@/hooks/useSystemSettings";
+import { pb } from "@/lib/pocketbase";
+import { toast } from "@/components/ui/use-toast";
+
+export const AboutSystem: React.FC = () => {
+  const { t } = useLanguage();
+  const { theme } = useTheme();
+  const { systemName } = useSystemSettings();
+  const [isImporting, setIsImporting] = useState(false);
+  const [mergeFields, setMergeFields] = useState(true);
+  const [importResult, setImportResult] = useState<{
+    success: boolean;
+    created: number;
+    updated: number;
+    skipped: number;
+  } | null>(null);
+
+  // Helper function to check if a collection is a system collection
+  const isSystemCollection = (name: string): boolean => {
+    return name.startsWith('_') || ['users'].includes(name);
+  };
+
+  // Helper function to validate collection schema
+  const validateCollectionSchema = (collection: any): string | null => {
+    if (!collection.name) return "Collection name is required";
+    if (typeof collection.name !== 'string') return "Collection name must be a string";
+    if (!/^[a-z][a-z0-9_]*$/.test(collection.name)) {
+      return "Collection name must start with a letter and contain only lowercase letters, numbers, and underscores";
+    }
+    if (collection.name.length < 3 || collection.name.length > 32) {
+      return "Collection name must be between 3 and 32 characters";
+    }
+
+    // Validate schema array if present
+    if (collection.schema && !Array.isArray(collection.schema)) {
+      return "Collection schema must be an array";
+    }
+
+    // Validate each field in the schema
+    if (collection.schema) {
+      for (const field of collection.schema) {
+        if (!field.name || typeof field.name !== 'string') {
+          return `Invalid field name in collection '${collection.name}'`;
+        }
+        if (!field.type || typeof field.type !== 'string') {
+          return `Invalid field type for '${field.name}' in collection '${collection.name}'`;
+        }
+      }
+    }
+
+    return null;
+  };
+
+  const handleSchemaImport = async (schemaData: string) => {
+    if (!schemaData.trim()) {
+      toast({
+        title: "Error",
+        description: "No schema data provided",
+        variant: "destructive",
+      });
+      return;
+    }
+
+    try {
+      setIsImporting(true);
+      setImportResult(null);
+      
+      // Parse the JSON to validate it
+      const collections = JSON.parse(schemaData);
+      
+      if (!Array.isArray(collections)) {
+        throw new Error("Schema must be an array of collections");
+      }
+
+      // Check if user is authenticated as admin
+      if (!pb.authStore.isValid) {
+        throw new Error("Authentication required. Please log in as an admin.");
+      }
+      // Create/update collections one by one using PocketBase client
+      let successCount = 0;
+      let errorCount = 0;
+      let updatedCount = 0;
+      let skippedCount = 0;
+      const errors = [];
+
+      for (const collection of collections) {
+        try {
+          // Skip system collections
+          if (isSystemCollection(collection.name)) {
+            skippedCount++;
+            continue;
+          }
+
+          // Validate collection schema
+          const validationError = validateCollectionSchema(collection);
+          if (validationError) {
+            throw new Error(validationError);
+          }
+          // Check if collection already exists
+          const existingCollections = await pb.collections.getFullList();
+          const existingCollection = existingCollections.find(c => c.name === collection.name);
+          
+          if (existingCollection) {
+            if (mergeFields) {
+              
+              try {
+                // Get existing schema
+                const existingSchema = existingCollection.schema || [];
+                const newSchema = collection.schema || [];
+                // Merge schemas - add new fields, keep existing ones
+                const mergedSchema = [...existingSchema];
+                let fieldsAdded = 0;
+                
+                for (const newField of newSchema) {
+                  const existingFieldIndex = mergedSchema.findIndex(f => f.name === newField.name);
+                  if (existingFieldIndex >= 0) {
+                  } else {
+                    // Add new field
+                    mergedSchema.push(newField);
+                    fieldsAdded++;
+                  }
+                }
+                
+                // Update the collection with merged schema
+                const updateData = {
+                  ...collection,
+                  schema: mergedSchema
+                };
+                
+                const updatedCollection = await pb.collections.update(existingCollection.id, updateData);
+                updatedCount++;
+              } catch (mergeError) {
+                throw new Error(`Failed to merge fields: ${mergeError.message || mergeError}`);
+              }
+            } else {
+              skippedCount++;
+              continue;
+            }
+          } else {
+            // Create new collection
+            try {
+              const newCollection = await pb.collections.create(collection);
+              successCount++;
+            } catch (createError) {
+            
+              // Extract more detailed error information
+              let errorMessage = createError.message || createError;
+              if (createError.data) {
+                // Try to extract field-specific errors
+                if (createError.data.data) {
+                  const fieldErrors = Object.entries(createError.data.data).map(([field, msgs]) => 
+                    `${field}: ${Array.isArray(msgs) ? msgs.join(', ') : msgs}`
+                  ).join('; ');
+                  if (fieldErrors) {
+                    errorMessage += ` - Field errors: ${fieldErrors}`;
+                  }
+                }
+              }
+              
+              throw new Error(`Failed to create collection: ${errorMessage}`);
+            }
+          }
+        } catch (error) {
+          errorCount++;
+          const errorMsg = `Failed to process collection '${collection.name}': ${error.message || error}`;
+          errors.push(errorMsg);
+        }
+      }
+      // Set import result for display
+      setImportResult({
+        success: successCount + updatedCount > 0,
+        created: successCount,
+        updated: updatedCount,
+        skipped: skippedCount
+      });
+
+      // Show results
+      const totalProcessed = successCount + updatedCount;
+      if (totalProcessed > 0 || skippedCount > 0) {
+        let description = '';
+        if (totalProcessed > 0) {
+          description = `Successfully processed ${totalProcessed} collection(s)`;
+          if (successCount > 0) description += ` (${successCount} created)`;
+          if (updatedCount > 0) description += ` (${updatedCount} updated)`;
+        }
+        if (skippedCount > 0) {
+          if (description) description += `, `;
+          description += `${skippedCount} skipped (system collections or existing)`;
+        }
+        if (errorCount > 0) description += `. ${errorCount} failed.`;
+
+        toast({
+          title: "Import Complete",
+          description,
+          variant: totalProcessed > errorCount ? "default" : "destructive",
+        });
+      } else if (errorCount > 0) {
+        toast({
+          title: "Import Failed",
+          description: "No collections were processed successfully.",
+          variant: "destructive",
+        });
+      } else {
+        toast({
+          title: "No Changes",
+          description: "All collections already exist and no changes were made.",
+          variant: "default",
+        });
+      }
+
+      if (errors.length > 0) {
+        // Show detailed errors for debugging
+        if (errors.length <= 3) {
+          toast({
+            title: "Detailed Errors",
+            description: errors.join('; '),
+            variant: "destructive",
+          });
+        }
+      }
+      
+    } catch (error) {
+      toast({
+        title: "Import Failed",
+        description: error instanceof Error ? error.message : "Failed to import schema",
+        variant: "destructive",
+      });
+      setImportResult({
+        success: false,
+        created: 0,
+        updated: 0,
+        skipped: 0
+      });
+    } finally {
+      setIsImporting(false);
+    }
+  };
+
+  const handleLoadLocalSchema = async () => {
+    try {
+      setIsImporting(true);
+      setImportResult(null);
+      
+      const response = await fetch('/upload/data/pb_schema_latest.json');
+      
+      if (!response.ok) {
+        throw new Error(`Failed to load local schema: ${response.status} ${response.statusText}`);
+      }
+      
+      const schemaText = await response.text();
+      
+      // Validate that it's valid JSON
+      JSON.parse(schemaText);
+      
+      // Directly import the schema
+      await handleSchemaImport(schemaText);
+      
+    } catch (error) {
+      toast({
+        title: "Import Failed",
+        description: error instanceof Error ? error.message : "Failed to load and import local schema file",
+        variant: "destructive",
+      });
+      setImportResult({
+        success: false,
+        created: 0,
+        updated: 0,
+        skipped: 0
+      });
+      setIsImporting(false);
+    }
+  };
+
+  return (
+    <div className="space-y-6 animate-fade-in">
+      <div>
+        <h1 className="text-3xl font-bold tracking-tight">{t('aboutSystem')}</h1>
+      </div>
+      
+      <Separator />
+      
+      <div className="grid gap-8 md:grid-cols-2">
+        <Card className="overflow-hidden border border-border transition-all duration-300 hover:shadow-md">
+          <CardHeader className="bg-muted/50 pb-4">
+            <CardTitle className="flex items-center gap-2">
+              <ServerIcon className={`h-5 w-5 ${theme === 'dark' ? 'text-sky-400' : 'text-sky-600'}`} />
+              <span className="font-thin text-xl">{t('systemDescription')}</span>
+            </CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-6 pt-6">
+            <div className="flex flex-col space-y-4">
+              <div className="flex flex-col space-y-3 pt-2">
+                <div className="flex justify-between items-center">
+                  <span className="text-muted-foreground">{t('systemVersion')}</span>
+                  <span className="text-foreground font-medium">{t('version')} 1.5.1</span>
+                </div>
+                <Separator className="my-1" />
+                <div className="flex justify-between items-center">
+                  <span className="text-muted-foreground">{t('license')}</span>
+                  <span className="text-foreground font-medium">{t('mitLicense')}</span>
+                </div>
+                <Separator className="my-1" />
+                <div className="flex justify-between items-center">
+                  <span className="text-muted-foreground">{t('releasedOn')}</span>
+                  <span className="text-foreground font-medium">Auguest 21, 2025</span>
+                </div>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+        
+        <Card className="overflow-hidden border border-border transition-all duration-300 hover:shadow-md">
+          <CardHeader className="bg-muted/50 pb-4">
+            <CardTitle className="flex items-center gap-2">
+              <Code2 className={`h-5 w-5 ${theme === 'dark' ? 'text-emerald-400' : 'text-emerald-600'}`} />
+              <span>{t('links')}</span>
+            </CardTitle>
+            <CardDescription className="font-medium text-base">{systemName || 'CheckCle'} {t('resources').toLowerCase()}</CardDescription>
+          </CardHeader>
+          <CardContent className="space-y-4 pt-6">
+            <div className="grid grid-cols-1 gap-3">
+              <Button variant="outline" className="flex items-center justify-start gap-3 h-12 hover:bg-muted/50 transition-all duration-200" onClick={() => window.open("https://github.com/operacle/checkcle", "_blank")}>
+                <Github className={`h-5 w-5 ${theme === 'dark' ? 'text-white/80' : 'text-gray-700'}`} />
+                <span>{t('viewOnGithub')}</span>
+              </Button>
+              <Button variant="outline" className="flex items-center justify-start gap-3 h-12 hover:bg-muted/50 transition-all duration-200" onClick={() => window.open("https://docs.checkcle.io", "_blank")}>
+                <FileText className={`h-5 w-5 ${theme === 'dark' ? 'text-white/80' : 'text-gray-700'}`} />
+                <span>{t('viewDocumentation')}</span>
+              </Button>
+              <Button variant="outline" className="flex items-center justify-start gap-3 h-12 hover:bg-muted/50 transition-all duration-200" onClick={() => window.open("https://x.com/checkcle_oss", "_blank")}>
+                <Twitter className={`h-5 w-5 ${theme === 'dark' ? 'text-white/80' : 'text-gray-700'}`} />
+                <span>{t('followOnX')}</span>
+              </Button>
+              <Button variant="outline" className="flex items-center justify-start gap-3 h-12 hover:bg-muted/50 transition-all duration-200" onClick={() => window.open("https://discord.gg/xs9gbubGwX", "_blank")}>
+                <MessageCircle className={`h-5 w-5 ${theme === 'dark' ? 'text-white/80' : 'text-gray-700'}`} />
+                <span>{t('joinDiscord')}</span>
+              </Button>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+
+      <Separator />
+
+      <Card className="overflow-hidden border border-border transition-all duration-300 hover:shadow-md">
+        <CardHeader className="bg-muted/50 pb-4">
+          <CardTitle className="flex items-center gap-2">
+            <Database className={`h-5 w-5 ${theme === 'dark' ? 'text-blue-400' : 'text-blue-600'}`} />
+            <span>{t('updateSchema')}</span>
+          </CardTitle>
+          <CardDescription className="font-medium text-base">{t('updateSchemaDesc')}</CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4 pt-6">
+          <div className="space-y-3">
+            <div className="flex items-center space-x-2">
+              <Checkbox
+                id="merge-fields"
+                checked={mergeFields}
+                onCheckedChange={(checked) => setMergeFields(checked === true)}
+              />
+              <Label htmlFor="merge-fields" className="text-sm font-medium">
+	              {t('mergeFieldsLabel')}
+              </Label>
+            </div>
+          </div>
+          
+          <div className="flex gap-2 flex-wrap">
+            <Button
+              onClick={handleLoadLocalSchema}
+              disabled={isImporting}
+              className={`flex items-center gap-2 transition-all duration-200 ${
+                isImporting ? 'animate-pulse' : ''
+              }`}
+            >
+              <Database className={`h-4 w-4 ${isImporting ? 'animate-spin' : ''}`} />
+              {isImporting ? t('importing') : t('clickToUpdateSchema')}
+            </Button>
+          </div>
+
+          {importResult && (
+            <div className={`mt-4 p-4 rounded-lg border ${
+              importResult.success 
+                ? 'bg-green-50 border-green-200 dark:bg-green-900/20 dark:border-green-800' 
+                : 'bg-red-50 border-red-200 dark:bg-red-900/20 dark:border-red-800'
+            } animate-in fade-in-0 slide-in-from-bottom-2 duration-300`}>
+              <div className="flex items-center gap-2">
+                <CheckCircle className={`h-5 w-5 ${
+                  importResult.success 
+                    ? 'text-green-600 dark:text-green-400' 
+                    : 'text-red-600 dark:text-red-400'
+                }`} />
+                <span className={`font-medium ${
+                  importResult.success 
+                    ? 'text-green-800 dark:text-green-200' 
+                    : 'text-red-800 dark:text-red-200'
+                }`}>
+                  {importResult.success ? t('importSuccessful') : t('importFailed')}
+                </span>
+              </div>
+              <div className={`mt-2 text-sm ${
+                importResult.success 
+                  ? 'text-green-700 dark:text-green-300' 
+                  : 'text-red-700 dark:text-red-300'
+              }`}>
+                {importResult.created > 0 && t('collectionsCreatedCount').replace('{count}', String(importResult.created))}
+                {importResult.updated > 0 && (importResult.created > 0 ? ', ' : '') + t('collectionsUpdatedCount').replace('{count}', String(importResult.updated))}
+                {importResult.skipped > 0 && ((importResult.created > 0 || importResult.updated > 0) ? ', ' : '') + t('collectionsSkippedCount').replace('{count}', String(importResult.skipped))}
+              </div>
+            </div>
+          )}
+
+          <div className="text-sm text-muted-foreground">
+            <p className="mb-2">
+              <strong>{t('instructions')}:</strong>
+            </p>
+            <ul className="list-disc list-inside space-y-1 ml-2">
+              <li><strong>{t('mergeFields')}:</strong> {t('instructionsMergeFields')}</li>
+              <li>{t('instructionsCollections')}</li>
+              <li>{t('instructionsImportAuth')}</li>
+            </ul>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
+
+export default AboutSystem;
\ No newline at end of file
diff --git a/application/src/components/settings/about-system/index.ts b/application/src/components/settings/about-system/index.ts
new file mode 100644
index 0000000..714fc98
--- /dev/null
+++ b/application/src/components/settings/about-system/index.ts
@@ -0,0 +1,2 @@
+
+export { default as AboutSystem } from './AboutSystem';
diff --git a/application/src/components/settings/alerts-templates/AlertsTemplates.tsx b/application/src/components/settings/alerts-templates/AlertsTemplates.tsx
new file mode 100644
index 0000000..ec14f0d
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/AlertsTemplates.tsx
@@ -0,0 +1,164 @@
+
+import React, { useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { templateService, TemplateType } from "@/services/templateService";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { Plus, RefreshCcw } from "lucide-react";
+import { TemplateList } from "./TemplateList";
+import { TemplateDialog } from "./TemplateDialog";
+import { useToast } from "@/hooks/use-toast";
+
+export const AlertsTemplates = () => {
+  const { toast } = useToast();
+  const [activeTab, setActiveTab] = useState<TemplateType>('service');
+  const [isDialogOpen, setIsDialogOpen] = useState(false);
+  const [editingTemplate, setEditingTemplate] = useState<string | null>(null);
+  const [editingTemplateType, setEditingTemplateType] = useState<TemplateType | null>(null);
+
+  const {
+    data: templates = [],
+    isLoading,
+    error,
+    refetch
+  } = useQuery({
+    queryKey: ['notification_templates', activeTab],
+    queryFn: () => templateService.getTemplates(activeTab),
+  });
+
+  const handleAddTemplate = (templateType: TemplateType) => {
+    setEditingTemplate(null);
+    setEditingTemplateType(templateType);
+    setIsDialogOpen(true);
+  };
+
+  const handleEditTemplate = (id: string, templateType: TemplateType) => {
+    setEditingTemplate(id);
+    setEditingTemplateType(templateType);
+    setIsDialogOpen(true);
+  };
+
+  const handleRefresh = () => {
+    refetch();
+    toast({
+      title: "Refreshing",
+      description: "Updating template list...",
+    });
+  };
+
+  return (
+    <Card className="w-full">
+      <CardHeader className="flex flex-row items-center justify-between">
+        <CardTitle>Alert Templates</CardTitle>
+        <div className="flex space-x-2">
+          <Button variant="outline" onClick={handleRefresh} disabled={isLoading}>
+            <RefreshCcw className="h-4 w-4 mr-2" />
+            Refresh
+          </Button>
+          <Button onClick={() => handleAddTemplate(activeTab)}>
+            <Plus className="h-4 w-4 mr-2" />
+            Add Template
+          </Button>
+        </div>
+      </CardHeader>
+      <CardContent>
+        <Tabs value={activeTab} onValueChange={(value) => setActiveTab(value as TemplateType)}>
+          <TabsList className="grid w-full grid-cols-4">
+            <TabsTrigger value="service">Service Uptime</TabsTrigger>
+            <TabsTrigger value="server">Server Monitoring</TabsTrigger>
+            <TabsTrigger value="ssl">SSL Certificate</TabsTrigger>
+            <TabsTrigger value="server_threshold">Server Threshold</TabsTrigger>
+          </TabsList>
+          
+          <TabsContent value="service" className="mt-4">
+            {error ? (
+              <div className="text-center p-6">
+                <p className="text-destructive mb-4">Error loading service templates</p>
+                <Button variant="outline" onClick={() => refetch()}>
+                  Try Again
+                </Button>
+              </div>
+            ) : (
+              <TemplateList 
+                templates={templates} 
+                isLoading={isLoading} 
+                onEdit={(id) => handleEditTemplate(id, 'service')}
+                refetchTemplates={refetch}
+                templateType="service"
+              />
+            )}
+          </TabsContent>
+          
+          <TabsContent value="server" className="mt-4">
+            {error ? (
+              <div className="text-center p-6">
+                <p className="text-destructive mb-4">Error loading server templates</p>
+                <Button variant="outline" onClick={() => refetch()}>
+                  Try Again
+                </Button>
+              </div>
+            ) : (
+              <TemplateList 
+                templates={templates} 
+                isLoading={isLoading} 
+                onEdit={(id) => handleEditTemplate(id, 'server')}
+                refetchTemplates={refetch}
+                templateType="server"
+              />
+            )}
+          </TabsContent>
+          
+          <TabsContent value="ssl" className="mt-4">
+            {error ? (
+              <div className="text-center p-6">
+                <p className="text-destructive mb-4">Error loading SSL templates</p>
+                <Button variant="outline" onClick={() => refetch()}>
+                  Try Again
+                </Button>
+              </div>
+            ) : (
+              <TemplateList 
+                templates={templates} 
+                isLoading={isLoading} 
+                onEdit={(id) => handleEditTemplate(id, 'ssl')}
+                refetchTemplates={refetch}
+                templateType="ssl"
+              />
+            )}
+          </TabsContent>
+          
+          <TabsContent value="server_threshold" className="mt-4">
+            {error ? (
+              <div className="text-center p-6">
+                <p className="text-destructive mb-4">Error loading server threshold templates</p>
+                <Button variant="outline" onClick={() => refetch()}>
+                  Try Again
+                </Button>
+              </div>
+            ) : (
+              <TemplateList 
+                templates={templates} 
+                isLoading={isLoading} 
+                onEdit={(id) => handleEditTemplate(id, 'server_threshold')}
+                refetchTemplates={refetch}
+                templateType="server_threshold"
+              />
+            )}
+          </TabsContent>
+        </Tabs>
+      </CardContent>
+
+      <TemplateDialog
+        open={isDialogOpen}
+        templateId={editingTemplate}
+        templateType={editingTemplateType}
+        onOpenChange={setIsDialogOpen}
+        onSuccess={() => {
+          refetch();
+          setIsDialogOpen(false);
+        }}
+      />
+    </Card>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/TemplateDialog.tsx b/application/src/components/settings/alerts-templates/TemplateDialog.tsx
new file mode 100644
index 0000000..fc7f26a
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/TemplateDialog.tsx
@@ -0,0 +1,244 @@
+
+import React, { useEffect, useState } from "react";
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogFooter } from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { Form, FormField, FormItem, FormLabel, FormControl, FormMessage } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { useTemplateForm } from "./hooks/useTemplateForm";
+import { ServerTemplateFields } from "./form/ServerTemplateFields";
+import { ServiceTemplateFields } from "./form/ServiceTemplateFields";
+import { SslTemplateFields } from "./form/SslTemplateFields";
+import { ServerThresholdFields } from "./form/ServerThresholdFields";
+import { Loader2, ChevronDown } from "lucide-react";
+import { ScrollArea } from "@/components/ui/scroll-area";
+import { TemplateType, templateTypeConfigs } from "@/services/templateService";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Textarea } from "@/components/ui/textarea";
+import {z} from "zod";
+
+interface TemplateDialogProps {
+  open: boolean;
+  templateId: string | null;
+  templateType: TemplateType | null;
+  onOpenChange: (open: boolean) => void;
+  onSuccess: () => void;
+}
+
+export const TemplateDialog: React.FC<TemplateDialogProps> = ({
+  open,
+  templateId,
+  templateType: initialTemplateType,
+  onOpenChange,
+  onSuccess,
+}) => {
+  const [selectedTemplateType, setSelectedTemplateType] = useState<TemplateType>(initialTemplateType || 'service');
+  
+  const {
+    form,
+    isEditMode,
+    isLoadingTemplate,
+    isSubmitting,
+    onSubmit
+  } = useTemplateForm({
+    templateId,
+    templateType: selectedTemplateType,
+    open,
+    onOpenChange,
+    onSuccess
+  });
+
+  // Update template type when prop changes or dialog opens
+  useEffect(() => {
+    if (initialTemplateType) {
+      setSelectedTemplateType(initialTemplateType);
+    } else if (open && !isEditMode) {
+      setSelectedTemplateType('service');
+    }
+  }, [initialTemplateType, open, isEditMode]);
+
+  // Handle template type change
+  const handleTemplateTypeChange = (newType: TemplateType) => {
+    if (!isEditMode) {
+      setSelectedTemplateType(newType);
+      form.setValue('templateType', newType);
+    }
+  };
+
+  const renderTemplateFields = () => {
+    switch (selectedTemplateType) {
+      case 'server':
+        return <ServerTemplateFields control={form.control} />;
+      case 'service':
+        return <ServiceTemplateFields control={form.control} />;
+      case 'ssl':
+        return <SslTemplateFields control={form.control} />;
+      case 'server_threshold':
+        return <ServerThresholdFields control={form.control} />;
+      default:
+        return null;
+    }
+  };
+
+  const renderPlaceholderGuide = () => {
+
+    const config = templateTypeConfigs[selectedTemplateType];
+    if (!config) return null;
+
+    return (
+      <Card>
+        <CardHeader className="pb-3">
+          <CardTitle className="text-sm font-medium">Available Placeholders</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <p className="text-sm text-muted-foreground mb-3">
+            {config.description}. Use these placeholders in your messages:
+          </p>
+          <div className="grid grid-cols-2 md:grid-cols-3 gap-2 text-sm">
+            {config.placeholders.map((placeholder) => (
+              <div key={placeholder} className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">{placeholder}</code>
+              </div>
+            ))}
+          </div>
+        </CardContent>
+      </Card>
+    );
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-4xl max-h-[90vh] flex flex-col overflow-hidden">
+        <DialogHeader>
+          <DialogTitle>{isEditMode ? "Edit Template" : "Add Template"}</DialogTitle>
+        </DialogHeader>
+        
+        {isLoadingTemplate ? (
+          <div className="flex items-center justify-center py-8">
+            <Loader2 className="h-8 w-8 animate-spin text-primary" />
+            <span className="ml-2">Loading template data...</span>
+          </div>
+        ) : (
+          <Form {...form}>
+            <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-6 flex-1 flex flex-col">
+              <div className="relative flex-1">
+                <ScrollArea className="pr-4 overflow-auto" style={{ height: "calc(80vh - 180px)" }}>
+                  <div className="space-y-6 pb-6 pr-4">
+                    {/* Basic Fields */}
+                    <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+                      <FormField
+                        control={form.control}
+                        name="name"
+                        render={({ field }) => (
+                          <FormItem>
+                            <FormLabel>Template Name</FormLabel>
+                            <FormControl>
+                              <Input 
+                                placeholder="Enter template name" 
+                                {...field}
+                              />
+                            </FormControl>
+                            <FormMessage />
+                          </FormItem>
+                        )}
+                      />
+                      
+                      <FormField
+                        control={form.control}
+                        name="templateType"
+                        render={({ field }) => (
+                          <FormItem>
+                            <FormLabel>Template Type</FormLabel>
+                            <FormControl>
+                              <Select 
+                                onValueChange={handleTemplateTypeChange}
+                                value={selectedTemplateType}
+                                disabled={isEditMode}
+                              >
+                                <SelectTrigger>
+                                  <SelectValue placeholder="Select template type" />
+                                </SelectTrigger>
+                                <SelectContent>
+                                  <SelectItem value="server">Server Monitoring</SelectItem>
+                                  <SelectItem value="service">Service Uptime</SelectItem>
+                                  <SelectItem value="ssl">SSL Certificate</SelectItem>
+                                  <SelectItem value="server_threshold">Server Threshold</SelectItem>
+                                </SelectContent>
+                              </Select>
+                            </FormControl>
+                            <FormMessage />
+                          </FormItem>
+                        )}
+                      />
+                      
+                      {selectedTemplateType !== 'server_threshold' && (
+                        <FormField
+                          control={form.control}
+                          name="placeholder"
+                          render={({ field }) => (
+                            <FormItem>
+                              <FormLabel>Custom Placeholder</FormLabel>
+                              <FormControl>
+                                <Input 
+                                  placeholder="Optional custom placeholder"
+                                  {...field}
+                                />
+                              </FormControl>
+                              <FormMessage />
+                            </FormItem>
+                          )}
+                        />
+                      )}
+                    </div>
+                    
+                    <Tabs defaultValue="messages">
+                      <TabsList className="grid w-full grid-cols-2">
+                        <TabsTrigger value="messages">{selectedTemplateType === 'server_threshold' ? 'Thresholds' : 'Messages'}</TabsTrigger>
+                        <TabsTrigger value="placeholders">Placeholders</TabsTrigger>
+                      </TabsList>
+                      
+                      <TabsContent value="messages" className="pt-4">
+                        {renderTemplateFields()}
+                      </TabsContent>
+                      
+                      <TabsContent value="placeholders" className="pt-4">
+                        {renderPlaceholderGuide()}
+                      </TabsContent>
+                    </Tabs>
+                  </div>
+                </ScrollArea>
+                <div className="absolute bottom-2 right-4 text-muted-foreground opacity-60">
+                  <ChevronDown className="h-4 w-4 animate-bounce" />
+                </div>
+              </div>
+              
+              <DialogFooter className="mt-2 pt-2 border-t border-border">
+                <Button 
+                  type="button" 
+                  variant="outline" 
+                  onClick={() => onOpenChange(false)} 
+                  disabled={isSubmitting}
+                >
+                  Cancel
+                </Button>
+                <Button 
+                  type="submit" 
+                  disabled={isSubmitting || isLoadingTemplate}
+                  className="relative"
+                >
+                  {isSubmitting && (
+                    <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                  )}
+                  {isSubmitting 
+                    ? (isEditMode ? "Updating..." : "Creating...") 
+                    : (isEditMode ? "Update Template" : "Create Template")}
+                </Button>
+              </DialogFooter>
+            </form>
+          </Form>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/TemplateList.tsx b/application/src/components/settings/alerts-templates/TemplateList.tsx
new file mode 100644
index 0000000..d820e96
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/TemplateList.tsx
@@ -0,0 +1,181 @@
+
+import React, { useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import { Trash2, Edit, MoreVertical } from "lucide-react";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { useToast } from "@/hooks/use-toast";
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { templateService, AnyTemplate, TemplateType } from "@/services/templateService";
+
+interface TemplateListProps {
+  templates: AnyTemplate[];
+  isLoading: boolean;
+  onEdit: (id: string) => void;
+  refetchTemplates: () => void;
+  templateType: TemplateType;
+}
+
+export const TemplateList: React.FC<TemplateListProps> = ({ 
+  templates, 
+  isLoading, 
+  onEdit, 
+  refetchTemplates,
+  templateType 
+}) => {
+  const { toast } = useToast();
+  const queryClient = useQueryClient();
+  const [deleteTemplateId, setDeleteTemplateId] = useState<string | null>(null);
+
+  // Delete mutation
+  const deleteMutation = useMutation({
+    mutationFn: (id: string) => templateService.deleteTemplate(id, templateType),
+    onSuccess: () => {
+      toast({
+        title: "Template deleted",
+        description: "The template has been deleted successfully.",
+      });
+      queryClient.invalidateQueries({ queryKey: ['notification_templates', templateType] });
+      refetchTemplates();
+    },
+    onError: (error) => {
+     // console.error("Error deleting template:", error);
+      toast({
+        title: "Error",
+        description: "Failed to delete template. Please try again.",
+        variant: "destructive",
+      });
+    },
+  });
+
+  const handleDelete = (id: string) => {
+    setDeleteTemplateId(id);
+  };
+
+  const confirmDelete = () => {
+    if (deleteTemplateId) {
+      deleteMutation.mutate(deleteTemplateId);
+      setDeleteTemplateId(null);
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <div className="space-y-4">
+        {[...Array(3)].map((_, i) => (
+          <div key={i} className="flex items-center justify-between p-4 border border-border rounded-lg">
+            <div className="space-y-2">
+              <div className="h-4 bg-muted animate-pulse rounded w-32"></div>
+              <div className="h-3 bg-muted animate-pulse rounded w-48"></div>
+            </div>
+            <div className="flex space-x-2">
+              <div className="h-8 w-8 bg-muted animate-pulse rounded"></div>
+              <div className="h-8 w-8 bg-muted animate-pulse rounded"></div>
+            </div>
+          </div>
+        ))}
+      </div>
+    );
+  }
+
+  if (templates.length === 0) {
+    return (
+      <div className="text-center py-8">
+        <p className="text-muted-foreground">No templates found. Create your first template to get started.</p>
+      </div>
+    );
+  }
+
+  const getTemplateTypeLabel = (type: TemplateType) => {
+    switch (type) {
+      case 'server': return 'Server';
+      case 'service': return 'Service';
+      case 'ssl': return 'SSL';
+      default: return 'Unknown';
+    }
+  };
+
+  return (
+    <>
+      <div className="space-y-4">
+        {templates.map((template) => (
+          <div key={template.id} className="flex items-center justify-between p-4 border border-border rounded-lg hover:bg-muted/50 transition-colors">
+            <div className="space-y-1">
+              <div className="flex items-center gap-2">
+                <h3 className="font-medium">{template.name}</h3>
+                <Badge variant="outline">{getTemplateTypeLabel(templateType)}</Badge>
+              </div>
+              <p className="text-sm text-muted-foreground">
+                Created: {new Date(template.created).toLocaleDateString()}
+                {template.updated !== template.created && 
+                  ` • Updated: ${new Date(template.updated).toLocaleDateString()}`
+                }
+              </p>
+            </div>
+            <div className="flex items-center space-x-2">
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={() => onEdit(template.id)}
+              >
+                <Edit className="h-4 w-4 mr-1" />
+                Edit
+              </Button>
+              <DropdownMenu>
+                <DropdownMenuTrigger asChild>
+                  <Button variant="outline" size="sm">
+                    <MoreVertical className="h-4 w-4" />
+                  </Button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent align="end">
+                  <DropdownMenuItem
+                    onClick={() => handleDelete(template.id)}
+                    className="text-destructive focus:text-destructive"
+                  >
+                    <Trash2 className="h-4 w-4 mr-2" />
+                    Delete
+                  </DropdownMenuItem>
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </div>
+          </div>
+        ))}
+      </div>
+
+      <AlertDialog open={!!deleteTemplateId} onOpenChange={() => setDeleteTemplateId(null)}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Are you sure?</AlertDialogTitle>
+            <AlertDialogDescription>
+              This action cannot be undone. This will permanently delete the template.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Cancel</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={confirmDelete}
+              className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+            >
+              Delete
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/form/BasicTemplateFields.tsx b/application/src/components/settings/alerts-templates/form/BasicTemplateFields.tsx
new file mode 100644
index 0000000..e5061de
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/form/BasicTemplateFields.tsx
@@ -0,0 +1,61 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Control } from "react-hook-form";
+
+interface BasicTemplateFieldsProps {
+  control: Control<any>;
+}
+
+export const BasicTemplateFields: React.FC<BasicTemplateFieldsProps> = ({ control }) => {
+  return (
+    <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+      <FormField
+        control={control}
+        name="name"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>Template Name</FormLabel>
+            <FormControl>
+              <Input 
+                placeholder="Enter template name" 
+                {...field}
+              />
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+      <FormField
+        control={control}
+        name="type"
+        render={({ field }) => (
+          <FormItem>
+            <FormLabel>Template Type</FormLabel>
+            <FormControl>
+              <Select 
+                onValueChange={field.onChange}
+                value={field.value}
+                defaultValue={field.value}
+              >
+                <SelectTrigger>
+                  <SelectValue placeholder="Select template type" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="default">Default</SelectItem>
+                  <SelectItem value="service">Service</SelectItem>
+                  <SelectItem value="incident">Incident</SelectItem>
+                  <SelectItem value="maintenance">Maintenance</SelectItem>
+                  <SelectItem value="custom">Custom</SelectItem>
+                </SelectContent>
+              </Select>
+            </FormControl>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+    </div>
+  );
+};
diff --git a/application/src/components/settings/alerts-templates/form/MessagesTabContent.tsx b/application/src/components/settings/alerts-templates/form/MessagesTabContent.tsx
new file mode 100644
index 0000000..e3f1979
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/form/MessagesTabContent.tsx
@@ -0,0 +1,124 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage, FormDescription } from "@/components/ui/form";
+import { Textarea } from "@/components/ui/textarea";
+import { Control } from "react-hook-form";
+import { Card, CardContent } from "@/components/ui/card";
+
+interface MessagesTabContentProps {
+  control: Control<any>;
+}
+
+export const MessagesTabContent: React.FC<MessagesTabContentProps> = ({ control }) => {
+  return (
+    <div className="space-y-6">
+      <Card>
+        <CardContent className="pt-6">
+          <div className="space-y-4">
+            <FormField
+              control={control}
+              name="up_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Up Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Service ${service_name} is UP. Response time: ${response_time}ms" 
+                      className="min-h-24"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormDescription>
+                    Message sent when a service returns to UP status
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="down_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Down Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Service ${service_name} is DOWN. Status: ${status}" 
+                      className="min-h-24"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormDescription>
+                    Message sent when a service goes DOWN
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+      
+      <Card>
+        <CardContent className="pt-6">
+          <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+            <FormField
+              control={control}
+              name="maintenance_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Maintenance Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Service ${service_name} is under maintenance" 
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="incident_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Incident Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Warning: Service ${service_name} has an incident" 
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="resolved_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Resolved Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Issue with service ${service_name} has been resolved" 
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
diff --git a/application/src/components/settings/alerts-templates/form/PlaceholdersTabContent.tsx b/application/src/components/settings/alerts-templates/form/PlaceholdersTabContent.tsx
new file mode 100644
index 0000000..26bbec1
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/form/PlaceholdersTabContent.tsx
@@ -0,0 +1,313 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage, FormDescription } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { Control } from "react-hook-form";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+
+interface PlaceholdersTabContentProps {
+  control: Control<any>;
+}
+
+export const PlaceholdersTabContent: React.FC<PlaceholdersTabContentProps> = ({ control }) => {
+  return (
+    <div className="space-y-6">
+      <Card>
+        <CardHeader className="pb-3">
+          <CardTitle className="text-sm font-medium">Template Placeholders</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+            <FormField
+              control={control}
+              name="service_name_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Service Name Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${service_name}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for service name in messages
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="response_time_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Response Time Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${response_time}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for response time in milliseconds
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          
+            <FormField
+              control={control}
+              name="status_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Status Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${status}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for service status (UP, DOWN, etc.)
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="url_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>URL Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${url}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for service URL
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={control}
+              name="host_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Host/IP Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${host}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for service host or IP address
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={control}
+              name="service_type_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Service Type Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${service_type}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for service type (HTTP, PING, TCP, DNS)
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={control}
+              name="port_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Port Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${port}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for service port number
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={control}
+              name="domain_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Domain Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${domain}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for domain name (DNS services)
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={control}
+              name="region_name_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Region Name Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${region_name}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for regional agent name
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={control}
+              name="agent_id_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Agent ID Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${agent_id}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for regional agent ID
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={control}
+              name="uptime_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Uptime Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${uptime}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for service uptime percentage
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="time_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Time Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${time}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for current date and time
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={control}
+              name="error_message_placeholder"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Error Message Placeholder</FormLabel>
+                  <FormControl>
+                    <Input placeholder="${error_message}" {...field} />
+                  </FormControl>
+                  <FormDescription className="text-xs">
+                    Used for error details when service is down
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+      
+      <Card>
+        <CardHeader className="pb-3">
+          <CardTitle className="text-sm font-medium">Placeholder Usage Guide</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <p className="text-sm text-muted-foreground mb-3">
+            These placeholders will be replaced with actual values when notifications are sent:
+          </p>
+          <div className="space-y-2 text-sm">
+            <div className="grid grid-cols-2 gap-2">
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{service_name}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">The name of the service</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{response_time}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Response time in milliseconds</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{status}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Service status (UP, DOWN)</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{url}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Service URL</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{host}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Service host or IP address</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{service_type}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Service type (HTTP, PING, TCP, DNS)</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{port}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Service port number</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{domain}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Domain name (DNS services)</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{region_name}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Regional agent name</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{agent_id}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Regional agent ID</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{uptime}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Service uptime percentage</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{time}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Current date and time</p>
+              </div>
+              <div className="bg-muted/30 p-2 rounded">
+                <code className="text-xs">${"{error_message}"}</code>
+                <p className="text-xs text-muted-foreground mt-1">Error details when service is down</p>
+              </div>
+            </div>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/form/ServerTemplateFields.tsx b/application/src/components/settings/alerts-templates/form/ServerTemplateFields.tsx
new file mode 100644
index 0000000..92a90e9
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/form/ServerTemplateFields.tsx
@@ -0,0 +1,328 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage, FormDescription } from "@/components/ui/form";
+import { Textarea } from "@/components/ui/textarea";
+import { Control } from "react-hook-form";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+
+interface ServerTemplateFieldsProps {
+  control: Control<any>;
+}
+
+export const ServerTemplateFields: React.FC<ServerTemplateFieldsProps> = ({ control }) => {
+  return (
+    <div className="space-y-6">
+      <Card>
+        <CardHeader className="pb-3">
+          <CardTitle className="text-sm font-medium">System Resource Messages</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+            <FormField
+              control={control}
+              name="cpu_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>CPU Alert Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="CPU usage on ${server_name} is ${cpu_usage}% (threshold: ${threshold}%)"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="ram_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>RAM Alert Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Memory usage on ${server_name} is ${ram_usage}% (threshold: ${threshold}%)"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="disk_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Disk Alert Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Disk usage on ${server_name} is ${disk_usage}% (threshold: ${threshold}%)"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="network_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Network Alert Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Network usage on ${server_name} is ${network_usage}% (threshold: ${threshold}%)"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader className="pb-3">
+          <CardTitle className="text-sm font-medium">System Resource Restore Messages</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+            <FormField
+              control={control}
+              name="restore_cpu_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>CPU Restore Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="CPU usage on ${server_name} has returned to normal: ${cpu_usage}%"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="restore_ram_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>RAM Restore Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Memory usage on ${server_name} has returned to normal: ${ram_usage}%"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="restore_disk_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Disk Restore Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Disk usage on ${server_name} has returned to normal: ${disk_usage}%"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="restore_network_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Network Restore Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Network usage on ${server_name} has returned to normal: ${network_usage}%"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardContent className="pt-6">
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+            <FormField
+              control={control}
+              name="up_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Server Up Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Server ${server_name} is UP and responding"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="down_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Server Down Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Server ${server_name} is DOWN"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="warning_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Warning Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Warning: Server ${server_name} requires attention"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="paused_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Paused Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Monitoring for server ${server_name} is paused"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="cpu_temp_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>CPU Temperature Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="CPU temperature on ${server_name} is ${cpu_temp}°C"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="disk_io_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Disk I/O Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Disk I/O on ${server_name} is ${disk_io} MB/s"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="restore_cpu_temp_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>CPU Temperature Restore Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="CPU temperature on ${server_name} has returned to normal: ${cpu_temp}°C"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="restore_disk_io_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Disk I/O Restore Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Disk I/O on ${server_name} has returned to normal: ${disk_io} MB/s"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/form/ServerThresholdFields.tsx b/application/src/components/settings/alerts-templates/form/ServerThresholdFields.tsx
new file mode 100644
index 0000000..f50be47
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/form/ServerThresholdFields.tsx
@@ -0,0 +1,121 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage, FormDescription } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { Control } from "react-hook-form";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+
+interface ServerThresholdFieldsProps {
+  control: Control<any>;
+}
+
+export const ServerThresholdFields: React.FC<ServerThresholdFieldsProps> = ({ control }) => {
+  return (
+    <div className="space-y-6">
+      <Card>
+        <CardHeader className="pb-3">
+          <CardTitle className="text-sm font-medium">Server Resource Thresholds</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+            <FormField
+              control={control}
+              name="cpu_threshold"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>CPU Threshold (%)</FormLabel>
+                  <FormControl>
+                    <Input 
+                      type="number"
+                      min="0"
+                      max="100"
+                      placeholder="85"
+                      {...field}
+                      onChange={(e) => field.onChange(Number(e.target.value))}
+                    />
+                  </FormControl>
+                  <FormDescription>
+                    CPU usage percentage that triggers an alert
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="ram_threshold"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>RAM Threshold (%)</FormLabel>
+                  <FormControl>
+                    <Input 
+                      type="number"
+                      min="0"
+                      max="100"
+                      placeholder="80"
+                      {...field}
+                      onChange={(e) => field.onChange(Number(e.target.value))}
+                    />
+                  </FormControl>
+                  <FormDescription>
+                    Memory usage percentage that triggers an alert
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="disk_threshold"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Disk Threshold (%)</FormLabel>
+                  <FormControl>
+                    <Input 
+                      type="number"
+                      min="0"
+                      max="100"
+                      placeholder="90"
+                      {...field}
+                      onChange={(e) => field.onChange(Number(e.target.value))}
+                    />
+                  </FormControl>
+                  <FormDescription>
+                    Disk usage percentage that triggers an alert
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="network_threshold"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Network Threshold (%)</FormLabel>
+                  <FormControl>
+                    <Input 
+                      type="number"
+                      min="0"
+                      max="100"
+                      placeholder="75"
+                      {...field}
+                      onChange={(e) => field.onChange(Number(e.target.value))}
+                    />
+                  </FormControl>
+                  <FormDescription>
+                    Network usage percentage that triggers an alert
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/form/ServiceTemplateFields.tsx b/application/src/components/settings/alerts-templates/form/ServiceTemplateFields.tsx
new file mode 100644
index 0000000..bf2d15e
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/form/ServiceTemplateFields.tsx
@@ -0,0 +1,133 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage } from "@/components/ui/form";
+import { Textarea } from "@/components/ui/textarea";
+import { Control } from "react-hook-form";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+
+interface ServiceTemplateFieldsProps {
+  control: Control<any>;
+}
+
+export const ServiceTemplateFields: React.FC<ServiceTemplateFieldsProps> = ({ control }) => {
+  return (
+    <div className="space-y-6">
+      <Card>
+        <CardHeader className="pb-3">
+          <CardTitle className="text-sm font-medium">Service Status Messages</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+            <FormField
+              control={control}
+              name="up_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Service Up Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Service ${service_name} is UP. Response time: ${response_time}ms"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="down_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Service Down Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Service ${service_name} is DOWN. Status: ${status}"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="maintenance_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Maintenance Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Service ${service_name} is under maintenance"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="incident_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Incident Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Service ${service_name} has an incident"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="resolved_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Resolved Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Issue with service ${service_name} has been resolved"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="warning_message"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Warning Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Warning: Service ${service_name} response time is high"
+                      className="min-h-20"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/form/SslTemplateFields.tsx b/application/src/components/settings/alerts-templates/form/SslTemplateFields.tsx
new file mode 100644
index 0000000..8a7f14f
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/form/SslTemplateFields.tsx
@@ -0,0 +1,79 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage } from "@/components/ui/form";
+import { Textarea } from "@/components/ui/textarea";
+import { Control } from "react-hook-form";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+
+interface SslTemplateFieldsProps {
+  control: Control<any>;
+}
+
+export const SslTemplateFields: React.FC<SslTemplateFieldsProps> = ({ control }) => {
+  return (
+    <div className="space-y-6">
+      <Card>
+        <CardHeader className="pb-3">
+          <CardTitle className="text-sm font-medium">SSL Certificate Messages</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="space-y-4">
+            <FormField
+              control={control}
+              name="expired"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Certificate Expired Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="SSL certificate for ${domain} has EXPIRED on ${expiry_date}"
+                      className="min-h-24"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="exiring_soon"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Certificate Expiring Soon Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="SSL certificate for ${domain} will expire in ${days_left} days on ${expiry_date}"
+                      className="min-h-24"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+            
+            <FormField
+              control={control}
+              name="warning"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>Certificate Warning Message</FormLabel>
+                  <FormControl>
+                    <Textarea 
+                      placeholder="Warning: SSL certificate for ${domain} requires attention"
+                      className="min-h-24"
+                      {...field} 
+                    />
+                  </FormControl>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/form/index.ts b/application/src/components/settings/alerts-templates/form/index.ts
new file mode 100644
index 0000000..067ba53
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/form/index.ts
@@ -0,0 +1,4 @@
+
+export * from './BasicTemplateFields';
+export * from './MessagesTabContent';
+export * from './PlaceholdersTabContent';
diff --git a/application/src/components/settings/alerts-templates/hooks/index.ts b/application/src/components/settings/alerts-templates/hooks/index.ts
new file mode 100644
index 0000000..e01afac
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/hooks/index.ts
@@ -0,0 +1,2 @@
+
+export * from './useTemplateForm';
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/hooks/useTemplateForm.ts b/application/src/components/settings/alerts-templates/hooks/useTemplateForm.ts
new file mode 100644
index 0000000..cf96ef3
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/hooks/useTemplateForm.ts
@@ -0,0 +1,314 @@
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import * as z from "zod";
+import { useToast } from "@/hooks/use-toast";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { templateService, TemplateType, AnyTemplateData } from "@/services/templateService";
+import { useEffect } from "react";
+
+// Base schema
+const baseSchema = {
+  name: z.string().min(2, "Name is required and must be at least 2 characters"),
+  templateType: z.enum(['server', 'service', 'ssl', 'server_threshold'] as const),
+  placeholder: z.string().optional(),
+};
+
+// Server template schema
+const serverTemplateSchema = z.object({
+  ...baseSchema,
+  templateType: z.literal('server'),
+  ram_message: z.string().min(1, "RAM message is required"),
+  cpu_message: z.string().min(1, "CPU message is required"),
+  disk_message: z.string().min(1, "Disk message is required"),
+  network_message: z.string().min(1, "Network message is required"),
+  up_message: z.string().min(1, "Up message is required"),
+  down_message: z.string().min(1, "Down message is required"),
+  notification_id: z.string().optional(),
+  warning_message: z.string().min(1, "Warning message is required"),
+  paused_message: z.string().min(1, "Paused message is required"),
+  cpu_temp_message: z.string().min(1, "CPU temperature message is required"),
+  disk_io_message: z.string().min(1, "Disk I/O message is required"),
+  restore_ram_message: z.string().optional(),
+  restore_cpu_message: z.string().optional(),
+  restore_disk_message: z.string().optional(),
+  restore_network_message: z.string().optional(),
+  restore_cpu_temp_message: z.string().optional(),
+  restore_disk_io_message: z.string().optional(),
+});
+
+// Service template schema
+const serviceTemplateSchema = z.object({
+  ...baseSchema,
+  templateType: z.literal('service'),
+  up_message: z.string().min(1, "Up message is required"),
+  down_message: z.string().min(1, "Down message is required"),
+  maintenance_message: z.string().min(1, "Maintenance message is required"),
+  incident_message: z.string().min(1, "Incident message is required"),
+  resolved_message: z.string().min(1, "Resolved message is required"),
+  warning_message: z.string().min(1, "Warning message is required"),
+});
+
+// SSL template schema
+const sslTemplateSchema = z.object({
+  ...baseSchema,
+  templateType: z.literal('ssl'),
+  expired: z.string().min(1, "Expired message is required"),
+  exiring_soon: z.string().min(1, "Expiring soon message is required"),
+  warning: z.string().min(1, "Warning message is required"),
+});
+
+// Server threshold schema
+const serverThresholdSchema = z.object({
+  ...baseSchema,
+  templateType: z.literal('server_threshold'),
+  cpu_threshold: z.number().min(0).max(100, "CPU threshold must be between 0-100"),
+  ram_threshold: z.number().min(0).max(100, "RAM threshold must be between 0-100"),
+  disk_threshold: z.number().min(0).max(100, "Disk threshold must be between 0-100"),
+  network_threshold: z.number().min(0).max(100, "Network threshold must be between 0-100"),
+  notification_id: z.string().optional(),
+  server_template_id: z.string().optional(),
+});
+
+// Combined schema
+export const templateFormSchema = z.discriminatedUnion("templateType", [
+  serverTemplateSchema,
+  serviceTemplateSchema,
+  sslTemplateSchema,
+  serverThresholdSchema,
+]);
+
+export type TemplateFormData = z.infer<typeof templateFormSchema>;
+
+// Default form values for each template type
+const getDefaultValues = (templateType: TemplateType): TemplateFormData => {
+  const base = {
+    name: "",
+    templateType,
+    placeholder: "",
+  };
+
+  switch (templateType) {
+    case 'server':
+      return {
+        ...base,
+        templateType: 'server' as const,
+        ram_message: "Memory usage on ${server_name} is ${ram_usage}% (threshold: ${threshold}%)",
+        cpu_message: "CPU usage on ${server_name} is ${cpu_usage}% (threshold: ${threshold}%)",
+        disk_message: "Disk usage on ${server_name} is ${disk_usage}% (threshold: ${threshold}%)",
+        network_message: "Network usage on ${server_name} is ${network_usage}% (threshold: ${threshold}%)",
+        up_message: "Server ${server_name} is UP and responding",
+        down_message: "Server ${server_name} is DOWN",
+        notification_id: "",
+        warning_message: "Warning: Server ${server_name} requires attention",
+        paused_message: "Monitoring for server ${server_name} is paused",
+        cpu_temp_message: "CPU temperature on ${server_name} is ${cpu_temp}°C",
+        disk_io_message: "Disk I/O on ${server_name} is ${disk_io} MB/s",
+        restore_ram_message: "Memory usage on ${server_name} has returned to normal: ${ram_usage}%",
+        restore_cpu_message: "CPU usage on ${server_name} has returned to normal: ${cpu_usage}%",
+        restore_disk_message: "Disk usage on ${server_name} has returned to normal: ${disk_usage}%",
+        restore_network_message: "Network usage on ${server_name} has returned to normal: ${network_usage}%",
+        restore_cpu_temp_message: "CPU temperature on ${server_name} has returned to normal: ${cpu_temp}°C",
+        restore_disk_io_message: "Disk I/O on ${server_name} has returned to normal: ${disk_io} MB/s",
+      };
+    
+    case 'service':
+      return {
+        ...base,
+        templateType: 'service' as const,
+        up_message: "Service ${service_name} is UP. Response time: ${response_time}ms",
+        down_message: "Service ${service_name} is DOWN. Status: ${status}",
+        maintenance_message: "Service ${service_name} is under maintenance",
+        incident_message: "Service ${service_name} has an incident",
+        resolved_message: "Issue with service ${service_name} has been resolved",
+        warning_message: "Warning: Service ${service_name} response time is high",
+      };
+    
+    case 'ssl':
+      return {
+        ...base,
+        templateType: 'ssl' as const,
+        expired: "SSL certificate for ${domain} has EXPIRED on ${expiry_date}",
+        exiring_soon: "SSL certificate for ${domain} will expire in ${days_left} days on ${expiry_date}",
+        warning: "Warning: SSL certificate for ${domain} requires attention",
+      };
+
+    case 'server_threshold':
+      return {
+        ...base,
+        templateType: 'server_threshold' as const,
+        cpu_threshold: 85,
+        ram_threshold: 80,
+        disk_threshold: 90,
+        network_threshold: 75,
+        notification_id: "",
+        server_template_id: "",
+      };
+    
+    default:
+      throw new Error(`Unknown template type: ${templateType}`);
+  }
+};
+
+export interface UseTemplateFormProps {
+  templateId: string | null;
+  templateType: TemplateType;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onSuccess: () => void;
+}
+
+export const useTemplateForm = ({ templateId, templateType, open, onOpenChange, onSuccess }: UseTemplateFormProps) => {
+  const { toast } = useToast();
+  const queryClient = useQueryClient();
+  const isEditMode = !!templateId;
+  
+  const form = useForm<TemplateFormData>({
+    resolver: zodResolver(templateFormSchema),
+    defaultValues: getDefaultValues(templateType),
+    mode: "onChange"
+  });
+
+  // Query to fetch template data for editing
+  const { isLoading: isLoadingTemplate, data: templateData } = useQuery({
+    queryKey: ['template', templateId, templateType],
+    queryFn: () => {
+      if (!templateId) return null;
+      
+      return templateService.getTemplate(templateId, templateType);
+    },
+    enabled: !!templateId && open,
+  });
+
+  // Set form values when template data is loaded
+  useEffect(() => {
+    if (templateData && open) {
+           
+      const formData: any = {
+        name: templateData.name || "",
+        templateType: templateType,
+        placeholder: (templateData as any).placeholder || "",
+      };
+
+      // Define the expected fields for each template type
+      const expectedFields = {
+        server: [
+          'ram_message', 'cpu_message', 'disk_message', 'network_message',
+          'up_message', 'down_message', 'notification_id', 'warning_message',
+          'paused_message', 'cpu_temp_message', 'disk_io_message',
+          'restore_ram_message', 'restore_cpu_message', 'restore_disk_message',
+          'restore_network_message', 'restore_cpu_temp_message', 'restore_disk_io_message'
+        ],
+        service: [
+          'up_message', 'down_message', 'maintenance_message', 'incident_message',
+          'resolved_message', 'warning_message'
+        ],
+        ssl: ['expired', 'exiring_soon', 'warning'],
+        server_threshold: [
+          'cpu_threshold', 'ram_threshold', 'disk_threshold', 'network_threshold',
+          'notification_id', 'server_template_id'
+        ]
+      };
+
+      // Add template-specific fields
+      const fieldsToProcess = expectedFields[templateType] || [];
+      fieldsToProcess.forEach(key => {
+        let value = (templateData as any)[key];
+        
+        // Convert string values to numbers for server threshold fields
+        if (templateType === 'server_threshold' && 
+            ['cpu_threshold', 'ram_threshold', 'disk_threshold', 'network_threshold'].includes(key)) {
+          value = typeof value === 'string' ? Number(value) : value;
+          // Ensure valid number, fallback to default if invalid
+          if (isNaN(value)) {
+            const defaults = getDefaultValues(templateType) as any;
+            value = defaults[key] || 0;
+          }
+        }
+        
+        // Set the value, using empty string as fallback for string fields
+        formData[key] = value !== undefined && value !== null ? value : "";
+      });
+
+      console.log("Final form data being set:", formData);
+      form.reset(formData);
+    }
+  }, [templateData, open, form, templateType]);
+
+  // Create mutation
+  const createMutation = useMutation({
+    mutationFn: (data: AnyTemplateData) => templateService.createTemplate(data, templateType),
+    onSuccess: () => {
+      toast({
+        title: "Template created",
+        description: "Your notification template has been created successfully.",
+      });
+      queryClient.invalidateQueries({ queryKey: ['notification_templates', templateType] });
+      onSuccess();
+    },
+    onError: (error) => {
+
+      toast({
+        title: "Error",
+        description: "Failed to create template. Please check your inputs and try again.",
+        variant: "destructive",
+      });
+    },
+  });
+
+  // Update mutation
+  const updateMutation = useMutation({
+    mutationFn: ({ id, data }: { id: string; data: AnyTemplateData }) => 
+      templateService.updateTemplate(id, data, templateType),
+    onSuccess: () => {
+      toast({
+        title: "Template updated",
+        description: "Your notification template has been updated successfully.",
+      });
+      queryClient.invalidateQueries({ queryKey: ['notification_templates', templateType] });
+      onSuccess();
+    },
+    onError: (error) => {
+ 
+      toast({
+        title: "Error",
+        description: "Failed to update template. Please check your inputs and try again.",
+        variant: "destructive",
+      });
+    },
+  });
+
+  const isSubmitting = createMutation.isPending || updateMutation.isPending;
+
+  // Handle form submission
+  const onSubmit = (formData: TemplateFormData) => {
+   
+    
+    // Remove templateType from the data before sending to API
+    const { templateType: _, ...templateDataWithoutType } = formData;
+    const completeData = templateDataWithoutType as AnyTemplateData;
+    
+    if (isEditMode && templateId) {
+
+      updateMutation.mutate({ id: templateId, data: completeData });
+    } else {
+
+      createMutation.mutate(completeData);
+    }
+  };
+
+  // Reset form when dialog closes or template type changes
+  useEffect(() => {
+    if (!open) {
+      console.log("Dialog closed, resetting form");
+      form.reset(getDefaultValues(templateType));
+    }
+  }, [open, form, templateType]);
+
+  return {
+    form,
+    isEditMode,
+    isLoadingTemplate,
+    isSubmitting,
+    onSubmit
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/settings/alerts-templates/index.ts b/application/src/components/settings/alerts-templates/index.ts
new file mode 100644
index 0000000..fed0df7
--- /dev/null
+++ b/application/src/components/settings/alerts-templates/index.ts
@@ -0,0 +1,2 @@
+
+export { AlertsTemplates } from "./AlertsTemplates";
diff --git a/application/src/components/settings/data-retention/DataRetentionSettings.tsx b/application/src/components/settings/data-retention/DataRetentionSettings.tsx
new file mode 100644
index 0000000..5ab7df2
--- /dev/null
+++ b/application/src/components/settings/data-retention/DataRetentionSettings.tsx
@@ -0,0 +1,277 @@
+
+import React, { useState, useEffect } from 'react';
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Loader2, Database, Trash2, AlertTriangle, Globe, Server } from "lucide-react";
+import { useToast } from "@/hooks/use-toast";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { authService } from "@/services/authService";
+import { dataRetentionService } from "@/services/dataRetentionService";
+
+interface RetentionSettings {
+  uptimeRetentionDays: number;
+  serverRetentionDays: number;
+}
+
+const DataRetentionSettings = () => {
+  const { t } = useLanguage();
+  const { toast } = useToast();
+  const [settings, setSettings] = useState<RetentionSettings>({
+    uptimeRetentionDays: 30,
+    serverRetentionDays: 30
+  });
+  const [isLoading, setIsLoading] = useState(true);
+  const [isSaving, setIsSaving] = useState(false);
+  const [isUptimeShrinking, setIsUptimeShrinking] = useState(false);
+  const [isServerShrinking, setIsServerShrinking] = useState(false);
+  const [isFullShrinking, setIsFullShrinking] = useState(false);
+  const [lastCleanup, setLastCleanup] = useState<string | null>(null);
+
+  // Check if user is super admin
+  const currentUser = authService.getCurrentUser();
+  const isSuperAdmin = currentUser?.role === "superadmin";
+
+  useEffect(() => {
+    if (isSuperAdmin) {
+      loadSettings();
+    }
+  }, [isSuperAdmin]);
+
+  const loadSettings = async () => {
+    try {
+      setIsLoading(true);
+      const result = await dataRetentionService.getRetentionSettings();
+      if (result) {
+        setSettings({
+          uptimeRetentionDays: result.uptimeRetentionDays || 30,
+          serverRetentionDays: result.serverRetentionDays || 30
+        });
+        setLastCleanup(result.lastCleanup);
+      }
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to load retention settings",
+        variant: "destructive",
+      });
+    } finally {
+      setIsLoading(false);
+    }
+  };
+
+  const handleSave = async () => {
+    try {
+      setIsSaving(true);
+      await dataRetentionService.updateRetentionSettings(settings);
+      toast({
+        title: "Settings saved",
+        description: "Data retention settings have been updated",
+      });
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to save retention settings",
+        variant: "destructive",
+      });
+    } finally {
+      setIsSaving(false);
+    }
+  };
+
+  const handleUptimeShrink = async () => {
+    try {
+      setIsUptimeShrinking(true);
+      const result = await dataRetentionService.manualUptimeCleanup();
+      
+      toast({
+        title: "Uptime cleanup completed",
+        description: `Deleted ${result.deletedRecords} old uptime records`,
+      });
+      
+      // Reload settings to get updated last cleanup time
+      await loadSettings();
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to perform uptime data cleanup",
+        variant: "destructive",
+      });
+    } finally {
+      setIsUptimeShrinking(false);
+    }
+  };
+
+  const handleServerShrink = async () => {
+    try {
+      setIsServerShrinking(true);
+      const result = await dataRetentionService.manualServerCleanup();
+      
+      toast({
+        title: "Server cleanup completed",
+        description: `Deleted ${result.deletedRecords} old server records`,
+      });
+      
+      // Reload settings to get updated last cleanup time
+      await loadSettings();
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to perform server data cleanup",
+        variant: "destructive",
+      });
+    } finally {
+      setIsServerShrinking(false);
+    }
+  };
+
+  const handleFullShrink = async () => {
+    try {
+      setIsFullShrinking(true);
+      const result = await dataRetentionService.manualCleanup();
+      
+      toast({
+        title: "Database cleanup completed",
+        description: `Deleted ${result.deletedRecords} old records`,
+      });
+      
+      // Reload settings to get updated last cleanup time
+      await loadSettings();
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to perform database cleanup",
+        variant: "destructive",
+      });
+    } finally {
+      setIsFullShrinking(false);
+    }
+  };
+
+  // Show permission notice for admin users
+  if (!isSuperAdmin) {
+    return (
+      <div className="p-4">
+        <Card>
+          <CardHeader>
+            <CardTitle className="flex items-center gap-2">
+              <Database className="h-5 w-5" />
+              {t("dataRetention")}
+            </CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-4">
+            <Alert className="border-blue-200 bg-blue-50 dark:bg-blue-950 dark:border-blue-800">
+              <AlertTriangle className="h-5 w-5 text-blue-600 dark:text-blue-400" />
+              <AlertDescription className="text-blue-700 dark:text-blue-300">
+                <span className="font-medium">{t("permissionNotice")}</span> {t("permissionNoticeDataRetention")}
+              </AlertDescription>
+            </Alert>
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+  if (isLoading) {
+    return (
+      <div className="p-4 flex items-center justify-center">
+        <Loader2 className="h-6 w-6 animate-spin mr-2" />
+        {t("loadingRetentionSettings")}
+      </div>
+    );
+  }
+
+  return (
+    <div className="p-4 space-y-6">
+      <Card>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Database className="h-5 w-5" />
+            {t("dataRetention")}
+          </CardTitle>
+          <CardDescription>
+            {t("dataRetentionDescription")}
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-6">
+          <div className="space-y-4">
+            <div>
+              <Label htmlFor="uptimeRetention">{t("uptimeRetentionLabel")}</Label>
+              <Input
+                id="uptimeRetention"
+                type="number"
+                min="1"
+                max="365"
+                value={settings.uptimeRetentionDays}
+                onChange={(e) => {
+                  const value = e.target.value;
+                  if (value === '' || isNaN(Number(value))) {
+                    return;
+                  }
+                  setSettings(prev => ({
+                    ...prev,
+                    uptimeRetentionDays: Number(value)
+                  }));
+                }}
+                className="mt-1"
+              />
+              <p className="text-sm text-muted-foreground mt-1">
+                {t("uptimeRetentionHelp")}
+              </p>
+            </div>
+
+            <div>
+              <Label htmlFor="serverRetention">{t("serverRetentionLabel")}</Label>
+              <Input
+                id="serverRetention"
+                type="number"
+                min="1"
+                max="365"
+                value={settings.serverRetentionDays}
+                onChange={(e) => {
+                  const value = e.target.value;
+                  if (value === '' || isNaN(Number(value))) {
+                    return;
+                  }
+                  setSettings(prev => ({
+                    ...prev,
+                    serverRetentionDays: Number(value)
+                  }));
+                }}
+                className="mt-1"
+              />
+              <p className="text-sm text-muted-foreground mt-1">
+                {t("serverRetentionHelp")}
+              </p>
+            </div>
+          </div>
+
+          {lastCleanup && (
+            <Alert>
+              <Database className="h-4 w-4" />
+              <AlertDescription>
+                {t("lastCleanup")}: {new Date(lastCleanup).toLocaleString()}
+              </AlertDescription>
+            </Alert>
+          )}
+        </CardContent>
+        <CardFooter className="flex justify-end">
+          <Button
+            onClick={handleSave}
+            disabled={isSaving}
+            className="flex items-center gap-2"
+          >
+            {isSaving ? (
+              <Loader2 className="h-4 w-4 animate-spin" />
+            ) : null}
+            {t("save")}
+          </Button>
+        </CardFooter>
+      </Card>
+    </div>
+  );
+};
+
+export default DataRetentionSettings;
\ No newline at end of file
diff --git a/application/src/components/settings/data-retention/index.ts b/application/src/components/settings/data-retention/index.ts
new file mode 100644
index 0000000..bc25d28
--- /dev/null
+++ b/application/src/components/settings/data-retention/index.ts
@@ -0,0 +1,5 @@
+
+import DataRetentionSettings from './DataRetentionSettings';
+
+export default DataRetentionSettings;
+export { DataRetentionSettings };
\ No newline at end of file
diff --git a/application/src/components/settings/general/GeneralSettingsPanel.tsx b/application/src/components/settings/general/GeneralSettingsPanel.tsx
new file mode 100644
index 0000000..70019d3
--- /dev/null
+++ b/application/src/components/settings/general/GeneralSettingsPanel.tsx
@@ -0,0 +1,227 @@
+import React, { useState, useEffect } from 'react';
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "@/components/ui/card";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { Settings, Mail, ShieldAlert } from "lucide-react";
+import { Form } from "@/components/ui/form";
+import { useForm } from "react-hook-form";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { useSystemSettings } from "@/hooks/useSystemSettings";
+import { GeneralSettings } from "@/services/settingsService";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { authService } from "@/services/authService";
+import SystemSettingsTab from './SystemSettingsTab';
+import MailSettingsTab from './MailSettingsTab';
+import { GeneralSettingsPanelProps } from './types';
+
+const GeneralSettingsPanel: React.FC<GeneralSettingsPanelProps> = () => {
+  const { t } = useLanguage();
+  const [isEditing, setIsEditing] = useState(false);
+  const [activeTab, setActiveTab] = useState("system");
+  
+  // Get current user to check permissions
+  const currentUser = authService.getCurrentUser();
+  const isSuperAdmin = currentUser?.role === "superadmin";
+  
+  const {
+    settings,
+    isLoading,
+    error,
+    updateSettings,
+    isUpdating,
+  } = useSystemSettings();
+
+  const form = useForm<GeneralSettings>({
+    defaultValues: {
+      meta: {
+        appName: '',
+        appURL: '',
+        senderName: '',
+        senderAddress: '',
+        hideControls: false
+      },
+      smtp: {
+        enabled: false,
+        port: 587,
+        host: '',
+        username: '',
+        password: '',
+        authMethod: '',
+        tls: true,
+        localName: ''
+      }
+    }
+  });
+
+  useEffect(() => {
+    if (settings && isSuperAdmin) {
+      // Initialize form with existing settings, using system_name for appName if meta.appName is not set
+      const appName = settings.meta?.appName || settings.system_name || '';
+      
+      form.reset({
+        ...settings,
+        meta: {
+          appName: appName,
+          appURL: settings.meta?.appURL || '',
+          senderName: settings.meta?.senderName || '',
+          senderAddress: settings.meta?.senderAddress || '',
+          hideControls: settings.meta?.hideControls || false
+        },
+        smtp: settings.smtp || {
+          enabled: false,
+          port: 587,
+          host: '',
+          username: '',
+          password: '',
+          authMethod: '',
+          tls: true,
+          localName: ''
+        }
+      });
+    }
+  }, [settings, form, isSuperAdmin]);
+
+  const handleSave = async (formData: GeneralSettings) => {
+    try {
+      // Prepare data for PocketBase settings update (no ID needed)
+      const dataToSave = {
+        ...formData,
+        system_name: formData.meta?.appName || settings?.system_name
+      };
+      
+      console.log('Saving settings data:', dataToSave);
+      await updateSettings(dataToSave);
+      setIsEditing(false);
+    } catch (error) {
+      console.error("Error updating settings:", error);
+    }
+  };
+
+  const handleEditClick = () => {
+    console.log('Edit button clicked, setting isEditing to true');
+    setIsEditing(true);
+  };
+
+  const handleCancelClick = () => {
+    console.log('Cancel button clicked, setting isEditing to false');
+    setIsEditing(false);
+    // Reset form to original values
+    if (settings) {
+      const appName = settings.meta?.appName || settings.system_name || '';
+      form.reset({
+        ...settings,
+        meta: {
+          appName: appName,
+          appURL: settings.meta?.appURL || '',
+          senderName: settings.meta?.senderName || '',
+          senderAddress: settings.meta?.senderAddress || '',
+          hideControls: settings.meta?.hideControls || false
+        },
+        smtp: settings.smtp || {
+          enabled: false,
+          port: 587,
+          host: '',
+          username: '',
+          password: '',
+          authMethod: '',
+          tls: true,
+          localName: ''
+        }
+      });
+    }
+  };
+
+  // Show permission notice for admin users
+  if (!isSuperAdmin) {
+    return (
+      <div className="p-4">
+        <Card>
+          <CardHeader>
+            <CardTitle>{t("generalSettings", "menu")}</CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-4">
+            <Alert className="border-blue-200 bg-blue-50 dark:bg-blue-950 dark:border-blue-800">
+              <ShieldAlert className="h-5 w-5 text-blue-600 dark:text-blue-400" />
+              <AlertDescription className="text-blue-700 dark:text-blue-300">
+                <span className="font-medium">{t("permissionNotice")}</span> {t("permissionNoticeAddUser")}
+              </AlertDescription>
+            </Alert>
+          </CardContent>
+        </Card>
+      </div>
+    );
+  }
+
+  if (isLoading) {
+    return <div className="p-4">{t("loadingSettings")}</div>;
+  }
+
+  if (error) {
+    return <div className="p-4 text-red-500">{t("loadingSettingsError")}</div>;
+  }
+
+  return (
+    <div className="p-4">
+      <Card>
+        <CardHeader>
+          <CardTitle>{t("generalSettings", "menu")}</CardTitle>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <Form {...form}>
+            <form onSubmit={form.handleSubmit(handleSave)}>
+              <Tabs value={activeTab} onValueChange={setActiveTab} className="w-full">
+                <TabsList className="w-full mb-4">
+                  <TabsTrigger value="system" className="flex items-center gap-2 flex-1">
+                    <Settings className="h-4 w-4" />
+                    {t("systemSettings", "settings")}
+                  </TabsTrigger>
+                  <TabsTrigger value="mail" className="flex items-center gap-2 flex-1">
+                    <Mail className="h-4 w-4" />
+                    {t("mailSettings", "settings")}
+                  </TabsTrigger>
+                </TabsList>
+                
+                <TabsContent value="system">
+                  <SystemSettingsTab 
+                    form={form} 
+                    isEditing={isEditing} 
+                    settings={settings} 
+                  />
+                </TabsContent>
+                
+                <TabsContent value="mail">
+                  <MailSettingsTab 
+                    form={form} 
+                    isEditing={isEditing} 
+                    settings={settings}
+                  />
+                </TabsContent>
+              </Tabs>
+              
+              {isEditing && (
+                <div className="flex justify-between mt-6">
+                  <Button type="button" variant="outline" onClick={handleCancelClick} disabled={isUpdating}>
+                    {t("cancel", "common")}
+                  </Button>
+                  <Button type="submit" disabled={isUpdating}>
+                    {isUpdating ? t("saving", "settings") : t("save", "settings")}
+                  </Button>
+                </div>
+              )}
+            </form>
+          </Form>
+        </CardContent>
+        
+        {!isEditing && (
+          <CardFooter>
+            <Button type="button" onClick={handleEditClick}>
+              {t("edit", "common")}
+            </Button>
+          </CardFooter>
+        )}
+      </Card>
+    </div>
+  );
+};
+
+export default GeneralSettingsPanel;
\ No newline at end of file
diff --git a/application/src/components/settings/general/MailSettingsTab.tsx b/application/src/components/settings/general/MailSettingsTab.tsx
new file mode 100644
index 0000000..1e02c95
--- /dev/null
+++ b/application/src/components/settings/general/MailSettingsTab.tsx
@@ -0,0 +1,290 @@
+
+import React, { useState } from 'react';
+import { Input } from "@/components/ui/input";
+import { Switch } from "@/components/ui/switch";
+import { Button } from "@/components/ui/button";
+import { FormControl, FormField, FormItem, FormLabel } from "@/components/ui/form";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { SettingsTabProps } from "./types";
+import TestEmailDialog, { TestEmailData } from "./TestEmailDialog";
+import { Mail } from "lucide-react";
+
+interface MailSettingsTabProps extends SettingsTabProps {
+  // Remove handleTestConnection and isTestingConnection props since we're removing the test connection button
+}
+
+const MailSettingsTab: React.FC<MailSettingsTabProps> = ({
+  form,
+  isEditing
+}) => {
+  const { t } = useLanguage();
+  const [showTestEmailDialog, setShowTestEmailDialog] = useState(false);
+  const [isTestingEmail, setIsTestingEmail] = useState(false);
+
+  const handleTestEmail = async (data: TestEmailData) => {
+    try {
+      setIsTestingEmail(true);
+      console.log('Testing email with data:', data);
+      
+      const response = await fetch('/api/settings/test/email', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          email: data.email,
+          template: data.template,
+          ...(data.collection && { collection: data.collection })
+        })
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      const result = await response.json();
+      
+      if (!result.success) {
+        throw new Error(result.message || 'Test email failed');
+      }
+
+      console.log('Test email sent successfully');
+    } catch (error) {
+      console.error('Error sending test email:', error);
+      throw error; // Re-throw to let the dialog handle the error display
+    } finally {
+      setIsTestingEmail(false);
+    }
+  };
+
+  return (
+    <div className="space-y-4">
+      <div>
+        <FormField
+          control={form.control}
+          name="meta.senderName"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t("senderName", "settings")}</FormLabel>
+              <FormControl>
+                <Input 
+                  {...field} 
+                  disabled={!isEditing}
+                  placeholder="Support"
+                />
+              </FormControl>
+            </FormItem>
+          )}
+        />
+      </div>
+      
+      <div>
+        <FormField
+          control={form.control}
+          name="meta.senderAddress"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t("senderEmail", "settings")}</FormLabel>
+              <FormControl>
+                <Input 
+                  {...field} 
+                  disabled={!isEditing}
+                  placeholder="support@example.com"
+                  type="email"
+                />
+              </FormControl>
+            </FormItem>
+          )}
+        />
+      </div>
+    
+      <div className="flex items-center space-x-2 mb-4">
+        <FormField
+          control={form.control}
+          name="smtp.enabled"
+          render={({ field }) => (
+            <FormItem className="flex flex-row items-center space-x-3 space-y-0">
+              <FormControl>
+                <Switch 
+                  checked={field.value}
+                  onCheckedChange={field.onChange}
+                  disabled={!isEditing}
+                />
+              </FormControl>
+              <FormLabel className="mt-0">{t("smtpEnabled", "settings")}</FormLabel>
+            </FormItem>
+          )}
+        />
+      </div>
+      
+      <div className={!form.watch('smtp.enabled') ? 'opacity-50' : ''}>
+        <div>
+          <FormField
+            control={form.control}
+            name="smtp.host"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t("smtpHost", "settings")}</FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field} 
+                    disabled={!isEditing || !form.watch('smtp.enabled')}
+                    placeholder="smtp.example.com"
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+        </div>
+        
+        <div className="mt-4">
+          <FormField
+            control={form.control}
+            name="smtp.port"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t("smtpPort", "settings")}</FormLabel>
+                <FormControl>
+                  <Input 
+                    type="number"
+                    {...field}
+                    onChange={e => field.onChange(parseInt(e.target.value) || 587)} 
+                    disabled={!isEditing || !form.watch('smtp.enabled')}
+                    placeholder="587"
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+        </div>
+        
+        <div className="mt-4">
+          <FormField
+            control={form.control}
+            name="smtp.username"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t("smtpUsername", "settings")}</FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field} 
+                    disabled={!isEditing || !form.watch('smtp.enabled')}
+                    placeholder="user@example.com"
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+        </div>
+        
+        <div className="mt-4">
+          <FormField
+            control={form.control}
+            name="smtp.password"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t("smtpPassword", "settings")}</FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field} 
+                    type="password"
+                    disabled={!isEditing || !form.watch('smtp.enabled')}
+                    placeholder="••••••••"
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+        </div>
+        
+        <div className="mt-4">
+          <FormField
+            control={form.control}
+            name="smtp.authMethod"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t("smtpAuthMethod", "settings")}</FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field} 
+                    disabled={!isEditing || !form.watch('smtp.enabled')}
+                    placeholder="Login"
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+        </div>
+        
+        <div className="flex items-center space-x-2 mt-4">
+          <FormField
+            control={form.control}
+            name="smtp.tls"
+            render={({ field }) => (
+              <FormItem className="flex flex-row items-center space-x-3 space-y-0">
+                <FormControl>
+                  <Switch 
+                    checked={field.value}
+                    onCheckedChange={field.onChange}
+                    disabled={!isEditing || !form.watch('smtp.enabled')}
+                  />
+                </FormControl>
+                <FormLabel className="mt-0">{t("enableTLS", "settings")}</FormLabel>
+              </FormItem>
+            )}
+          />
+        </div>
+        
+        <div className="mt-4">
+          <FormField
+            control={form.control}
+            name="smtp.localName"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t("localName", "settings")}</FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field} 
+                    disabled={!isEditing || !form.watch('smtp.enabled')}
+                    placeholder="localhost"
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+        </div>
+      </div>
+
+      {/* Test Email button - outside the form area and always visible when SMTP is enabled */}
+      {form.watch('smtp.enabled') && (
+        <div className="mt-6 pt-4 border-t border-border">
+          <div className="flex items-center justify-between mb-4">
+            <div>
+              <h3 className="text-lg font-medium">{t("testEmailSettings", "settings")}</h3>
+              <p className="text-sm text-muted-foreground">{t("testEmailDescription", "settings")}</p>
+            </div>
+            <Button 
+              type="button" 
+              variant="outline" 
+              onClick={() => setShowTestEmailDialog(true)}
+              disabled={isTestingEmail}
+              className="flex items-center gap-2"
+            >
+              <Mail className="h-4 w-4" />
+              {t("testEmail", "settings")}
+            </Button>
+          </div>
+        </div>
+      )}
+
+      <TestEmailDialog
+        open={showTestEmailDialog}
+        onOpenChange={setShowTestEmailDialog}
+        onSendTest={handleTestEmail}
+        isTesting={isTestingEmail}
+      />
+    </div>
+  );
+};
+
+export default MailSettingsTab;
\ No newline at end of file
diff --git a/application/src/components/settings/general/SystemSettingsTab.tsx b/application/src/components/settings/general/SystemSettingsTab.tsx
new file mode 100644
index 0000000..c48a5e7
--- /dev/null
+++ b/application/src/components/settings/general/SystemSettingsTab.tsx
@@ -0,0 +1,63 @@
+
+import React from 'react';
+import { Input } from "@/components/ui/input";
+import { FormControl, FormField, FormItem, FormLabel } from "@/components/ui/form";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { SettingsTabProps } from "./types";
+
+const SystemSettingsTab: React.FC<SettingsTabProps> = ({ form, isEditing, settings }) => {
+  const { t } = useLanguage();
+
+  return (
+    <div className="space-y-6">
+      <div className="grid grid-cols-1 md:grid-cols-2 gap-6">
+        <div>
+          <FormField
+            control={form.control}
+            name="meta.appName"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel className="text-sm font-medium text-foreground">
+                  {t("appName", "settings")} <span className="text-destructive">*</span>
+                </FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field} 
+                    disabled={!isEditing}
+                    placeholder="CheckCle"
+                    className="bg-background border-input text-foreground placeholder:text-muted-foreground disabled:bg-muted disabled:text-muted-foreground"
+                    value={field.value || settings?.system_name || ''}
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+        </div>
+        
+        <div>
+          <FormField
+            control={form.control}
+            name="meta.appURL"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel className="text-sm font-medium text-foreground">
+                  {t("appURL", "settings")} <span className="text-destructive">*</span>
+                </FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field} 
+                    disabled={!isEditing}
+                    placeholder="https://pb-api.k8sops.asia"
+                    className="bg-background border-input text-foreground placeholder:text-muted-foreground disabled:bg-muted disabled:text-muted-foreground"
+                  />
+                </FormControl>
+              </FormItem>
+            )}
+          />
+        </div>
+      </div>
+    </div>
+  );
+};
+
+export default SystemSettingsTab;
\ No newline at end of file
diff --git a/application/src/components/settings/general/TestEmailDialog.tsx b/application/src/components/settings/general/TestEmailDialog.tsx
new file mode 100644
index 0000000..a38b241
--- /dev/null
+++ b/application/src/components/settings/general/TestEmailDialog.tsx
@@ -0,0 +1,223 @@
+import React, { useState } from 'react';
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogFooter } from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { Mail, X, AlertCircle, CheckCircle, Loader2 } from "lucide-react";
+import { toast } from "@/hooks/use-toast";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+
+interface TestEmailDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onSendTest: (data: TestEmailData) => Promise<void>;
+  isTesting: boolean;
+}
+
+export interface TestEmailData {
+  email: string;
+  template: string;
+  collection?: string;
+}
+
+const TestEmailDialog: React.FC<TestEmailDialogProps> = ({
+  open,
+  onOpenChange,
+  onSendTest,
+  isTesting
+}) => {
+  const { t } = useLanguage();
+  const [email, setEmail] = useState('');
+  const [template, setTemplate] = useState('verification');
+  const [collection, setCollection] = useState('_superusers');
+  const [lastResult, setLastResult] = useState<{ success: boolean; message: string } | null>(null);
+  const [isInternalTesting, setIsInternalTesting] = useState(false);
+
+  const validateEmail = (email: string): boolean => {
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    return emailRegex.test(email);
+  };
+
+  const handleSend = async () => {
+    if (!email.trim()) {
+      toast({
+        title: "Error",
+        description: "Please enter an email address",
+        variant: "destructive",
+      });
+      return;
+    }
+    
+    if (!validateEmail(email)) {
+      toast({
+        title: "Error",
+        description: "Please enter a valid email address",
+        variant: "destructive",
+      });
+      return;
+    }
+    
+    try {
+      setLastResult(null);
+      setIsInternalTesting(true);
+      
+      console.log('Sending test email with data:', {
+        email,
+        template,
+        collection: template === 'verification' || template === 'password-reset' ? collection : undefined
+      });
+      
+      await onSendTest({
+        email,
+        template,
+        collection: template === 'verification' || template === 'password-reset' ? collection : undefined
+      });
+      
+      setLastResult({
+        success: true,
+        message: `Test email sent successfully to ${email}`
+      });
+      
+      toast({
+        title: "Success",
+        description: `Test email sent successfully to ${email}`,
+        variant: "default",
+      });
+      
+    } catch (error) {
+      console.error('Error sending test email:', error);
+      const errorMessage = error instanceof Error ? error.message : "Failed to send test email";
+      
+      setLastResult({
+        success: false,
+        message: errorMessage
+      });
+      
+      toast({
+        title: "Error",
+        description: errorMessage,
+        variant: "destructive",
+      });
+    } finally {
+      setIsInternalTesting(false);
+    }
+  };
+
+  const handleClose = () => {
+    onOpenChange(false);
+    // Reset form but keep last result for reference
+    setEmail('');
+    setTemplate('verification');
+    setCollection('_superusers');
+    // Don't reset lastResult immediately to allow user to see the result
+    setTimeout(() => setLastResult(null), 300);
+  };
+
+  const isLoading = isTesting || isInternalTesting;
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Mail className="h-5 w-5" />
+            {t("sendTestEmail", "settings")}
+          </DialogTitle>
+        </DialogHeader>
+        
+        <div className="space-y-4 py-4">
+          {/* Show last result */}
+          {lastResult && (
+            <Alert variant={lastResult.success ? "default" : "destructive"}>
+              {lastResult.success ? (
+                <CheckCircle className="h-4 w-4" />
+              ) : (
+                <AlertCircle className="h-4 w-4" />
+              )}
+              <AlertDescription>
+                {lastResult.message}
+              </AlertDescription>
+            </Alert>
+          )}
+
+          {/* Template Selection */}
+          <div className="space-y-3">
+            <Label>{t("emailTemplate", "settings")}</Label>
+            <RadioGroup value={template} onValueChange={setTemplate} disabled={isLoading}>
+              <div className="flex items-center space-x-2">
+                <RadioGroupItem value="verification" id="verification" />
+                <Label htmlFor="verification">{t("verification", "settings")}</Label>
+              </div>
+              <div className="flex items-center space-x-2">
+                <RadioGroupItem value="password-reset" id="password-reset" />
+                <Label htmlFor="password-reset">{t("passwordReset", "settings")}</Label>
+              </div>
+              <div className="flex items-center space-x-2">
+                <RadioGroupItem value="email-change" id="email-change" />
+                <Label htmlFor="email-change">{t("confirmEmailChange", "settings")}</Label>
+              </div>
+            </RadioGroup>
+          </div>
+
+          {/* Auth Collection - show for verification and password-reset templates */}
+          {(template === 'verification' || template === 'password-reset') && (
+            <div className="space-y-2">
+              <Label>{t("authCollection", "settings")} *</Label>
+              <Select value={collection} onValueChange={setCollection} disabled={isLoading}>
+                <SelectTrigger>
+                  <SelectValue placeholder={t("selectCollection", "settings")} />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="_superusers">_superusers</SelectItem>
+                  <SelectItem value="users">users</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+          )}
+
+          {/* Email Address */}
+          <div className="space-y-2">
+            <Label>{t("toEmailAddress", "settings")} *</Label>
+            <Input
+              type="email"
+              value={email}
+              onChange={(e) => setEmail(e.target.value)}
+              placeholder={t("enterEmailAddress", "settings")}
+              required
+              disabled={isLoading}
+            />
+          </div>
+
+          {/* Info message */}
+          <Alert>
+            <AlertCircle className="h-4 w-4" />
+            <AlertDescription>{t("testEmailAlert", "settings")}</AlertDescription>
+          </Alert>
+        </div>
+
+        <DialogFooter className="flex justify-between">
+          <Button variant="outline" onClick={handleClose} disabled={isLoading}>
+            {t("close", "common")}
+          </Button>
+          <Button 
+            onClick={handleSend} 
+            disabled={!email || isLoading}
+            className="flex items-center gap-2"
+          >
+            {isLoading ? (
+              <Loader2 className="h-4 w-4 animate-spin" />
+            ) : (
+              <Mail className="h-4 w-4" />
+            )}
+            {isLoading ? t("sending", "settings") : t("send", "settings")}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};
+
+export default TestEmailDialog;
\ No newline at end of file
diff --git a/application/src/components/settings/general/types.ts b/application/src/components/settings/general/types.ts
new file mode 100644
index 0000000..4dfb11d
--- /dev/null
+++ b/application/src/components/settings/general/types.ts
@@ -0,0 +1,12 @@
+
+import { GeneralSettings } from "@/services/settingsService";
+
+export interface SettingsTabProps {
+  form: any;
+  isEditing: boolean;
+  settings?: GeneralSettings;
+}
+
+export interface GeneralSettingsPanelProps {
+  // No props needed for now, but we can add them in the future
+}
\ No newline at end of file
diff --git a/application/src/components/settings/notification-settings/NotificationChannelDialog.tsx b/application/src/components/settings/notification-settings/NotificationChannelDialog.tsx
new file mode 100644
index 0000000..be13fb2
--- /dev/null
+++ b/application/src/components/settings/notification-settings/NotificationChannelDialog.tsx
@@ -0,0 +1,937 @@
+import React, { useEffect } from "react";
+import { 
+  Dialog, 
+  DialogContent, 
+  DialogHeader, 
+  DialogTitle, 
+  DialogFooter 
+} from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { AlertConfiguration, alertConfigService } from "@/services/alertConfigService";
+import { useForm } from "react-hook-form";
+import { z } from "zod";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { Input } from "@/components/ui/input";
+import { Textarea } from "@/components/ui/textarea";
+import {
+  Form,
+  FormControl,
+  FormDescription,
+  FormField,
+  FormItem,
+  FormLabel,
+  FormMessage,
+} from "@/components/ui/form";
+import { Switch } from "@/components/ui/switch";
+import { Loader2, Copy } from "lucide-react";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { toast } from "@/hooks/use-toast";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface NotificationChannelDialogProps {
+  open: boolean;
+  onClose: (refreshList: boolean) => void;
+  editingConfig: AlertConfiguration | null;
+}
+
+
+const baseSchema = z.object({
+  notify_name: z.string().min(1, "Name is required"),
+  notification_type: z.enum(["telegram", "discord", "slack", "signal", "google_chat", "email", "ntfy", "pushover", "notifiarr", "gotify", "webhook", "matrix"]),
+  enabled: z.boolean().default(true),
+  service_id: z.string().default("global"),
+  template_id: z.string().optional(),
+});
+
+const telegramSchema = baseSchema.extend({
+  notification_type: z.literal("telegram"),
+  telegram_chat_id: z.string().min(1, "Chat ID is required"),
+  bot_token: z.string().min(1, "Bot token is required"),
+});
+
+const discordSchema = baseSchema.extend({
+  notification_type: z.literal("discord"),
+  discord_webhook_url: z.string().url("Must be a valid URL"),
+});
+
+const slackSchema = baseSchema.extend({
+  notification_type: z.literal("slack"),
+  slack_webhook_url: z.string().url("Must be a valid URL"),
+});
+
+const signalSchema = baseSchema.extend({
+  notification_type: z.literal("signal"),
+  signal_number: z.string().min(1, "Signal number is required"),
+  signal_api_endpoint: z.string().url("Must be a valid API endpoint URL"),
+});
+
+const googleChatSchema = baseSchema.extend({
+  notification_type: z.literal("google_chat"),
+  google_chat_webhook_url: z.string().url("Must be a valid URL"),
+});
+
+const emailSchema = baseSchema.extend({
+  notification_type: z.literal("email"),
+  email_address: z.string().email("Valid email is required"),
+  email_sender_name: z.string().min(1, "Sender name is required"),
+  smtp_server: z.string().min(1, "SMTP server is required"),
+  smtp_port: z.string().min(1, "SMTP port is required"),
+  smtp_password: z.string().min(1, "SMTP password is required"),
+});
+
+const ntfySchema = baseSchema.extend({
+  notification_type: z.literal("ntfy"),
+  ntfy_endpoint: z.string().url("Must be a valid NTFY endpoint URL"),
+  api_token: z.string().optional(),
+});
+
+const pushoverSchema = baseSchema.extend({
+  notification_type: z.literal("pushover"),
+  api_token: z.string().min(1, "API token is required"),
+  user_key: z.string().min(1, "User key is required"),
+});
+
+const notifiarrSchema = baseSchema.extend({
+  notification_type: z.literal("notifiarr"),
+  api_token: z.string().min(1, "API token is required"),
+  channel_id: z.string().min(1, "Channel ID is required"),
+});
+
+const webhookSchema = baseSchema.extend({
+  notification_type: z.literal("webhook"),
+  webhook_url: z.string().url("Must be a valid URL"),
+  webhook_payload_template: z.string().optional(),
+});
+
+const gotifySchema = baseSchema.extend({
+  notification_type: z.literal("gotify"),
+  api_token: z.string().min(1, "API token is required"),
+  server_url: z.string().url("Must be a valid server URL"),
+});
+
+const matrixSchema = baseSchema.extend({
+  notification_type: z.literal("matrix"),
+  matrix_homeserver: z.string().url("Must be a valid homeserver URL"),
+  matrix_room_id: z.string().min(1, "Room ID is required"),
+  matrix_access_token: z.string().min(1, "Access token is required"),
+});
+
+const formSchema = z.discriminatedUnion("notification_type", [
+  telegramSchema,
+  discordSchema,
+  slackSchema,
+  signalSchema,
+  googleChatSchema,
+  emailSchema,
+  ntfySchema,
+  pushoverSchema,
+  notifiarrSchema,
+  gotifySchema,
+  webhookSchema,
+  matrixSchema,
+]);
+
+type FormValues = z.infer<typeof formSchema>;
+
+const notificationTypeOptions = [
+  { 
+    value: "telegram", 
+    label: "Telegram", 
+    description: "Send notifications via Telegram bot",
+    icon: "/upload/notification/telegram.png"
+  },
+  { 
+    value: "discord", 
+    label: "Discord", 
+    description: "Send notifications to Discord webhook",
+    icon: "/upload/notification/discord.png"
+  },
+  { 
+    value: "slack", 
+    label: "Slack", 
+    description: "Send notifications to Slack webhook",
+    icon: "/upload/notification/slack.png"
+  },
+  { 
+    value: "signal", 
+    label: "Signal", 
+    description: "Send notifications via Signal",
+    icon: "/upload/notification/signal.png"
+  },
+  { 
+    value: "google_chat", 
+    label: "Google Chat", 
+    description: "Send notifications to Google Chat webhook",
+    icon: "/upload/notification/google.png"
+  },
+  { 
+    value: "email", 
+    label: "Email", 
+    description: "Send notifications via email",
+    icon: "/upload/notification/email.png"
+  },
+  { 
+    value: "ntfy", 
+    label: "NTFY", 
+    description: "Send notifications via NTFY push service",
+    icon: "/upload/notification/ntfy.png" 
+  },
+  { 
+    value: "pushover", 
+    label: "Pushover", 
+    description: "Send push notifications via Pushover",
+    icon: "/upload/notification/pushover.png" 
+  },
+
+  { 
+    value: "notifiarr", 
+    label: "Notifiarr", 
+    description: "Send notifications via Notifiarr",
+    icon: "/upload/notification/notifiarr.png" 
+  },
+  { 
+    value: "gotify", 
+    label: "Gotify", 
+    description: "Send push notifications via Gotify",
+    icon: "/upload/notification/gotify.png" 
+  },
+  {
+    value: "webhook",
+    label: "Webhook",
+    description: "Send notifications to custom webhook",
+    icon: "/upload/notification/webhook.png"
+  },
+  {
+    value: "matrix",
+    label: "Matrix",
+    description: "Send notifications to a Matrix chat room",
+    icon: "/upload/notification/matrix.png"
+  },
+];
+
+const webhookPayloadTemplates = {
+  server: `{
+  "alert_type": "server",
+  "server_name": "\${server_name}",
+  "status": "\${status}",
+  "cpu_usage": "\${cpu_usage}",
+  "ram_usage": "\${ram_usage}",
+  "disk_usage": "\${disk_usage}",
+  "network_usage": "\${network_usage}",
+  "cpu_temp": "\${cpu_temp}",
+  "disk_io": "\${disk_io}",
+  "threshold": "\${time}",
+  "message": "Server \${server_name} alert: \${status}"
+}`,
+  service: `{
+  "alert_type": "service",
+  "service_name": "\${service_name}",
+  "status": "\${status}",
+  "response_time": "\${response_time}",
+  "url": "\${url}",
+  "uptime": "\${uptime}",
+  "downtime": "\${downtime}",
+  "timestamp": "\${time}",
+  "message": "Service \${service_name} is \${status}"
+}`,
+  ssl: `{
+  "alert_type": "ssl",
+  "domain": "\${domain}",
+  "certificate_name": "\${certificate_name}",
+  "expiry_date": "\${expiry_date}",
+  "days_left": "\${days_left}",
+  "issuer": "\${issuer}",
+  "serial_number": "\${serial_number}",
+  "timestamp": "\${time}",
+  "message": "SSL certificate for \${domain} expires in \${days_left} days"
+}`
+};
+
+const defaultPayloadTemplate = `{
+  "alert_type": "general",
+  "service_name": "\${service_name}",
+  "status": "\${status}",
+  "message": "\${message}",
+  "timestamp": "\${time}"
+}`;
+
+export const NotificationChannelDialog = ({ 
+  open, 
+  onClose,
+  editingConfig 
+}: NotificationChannelDialogProps) => {
+  const { t } = useLanguage();
+  const isEditing = !!editingConfig;
+  const form = useForm<FormValues>({
+    resolver: zodResolver(formSchema),
+    defaultValues: {
+      notify_name: "",
+      notification_type: "telegram" as const,
+      enabled: true,
+      service_id: "global",
+      template_id: "",
+    },
+  });
+
+  const { watch, reset, setValue } = form;
+  const notificationType = watch("notification_type");
+  const [isSubmitting, setIsSubmitting] = React.useState(false);
+  
+  useEffect(() => {
+    if (editingConfig) {
+      // Handle string vs boolean for enabled field
+      const enabled = typeof editingConfig.enabled === 'string' 
+        ? editingConfig.enabled === "true" 
+        : !!editingConfig.enabled;
+
+      reset({
+        ...editingConfig,
+        enabled
+      });
+    } else if (open) {
+      reset({
+        notify_name: "",
+        notification_type: "telegram" as const,
+        enabled: true,
+        service_id: "global",
+        template_id: "",
+      });
+    }
+  }, [editingConfig, open, reset]);
+
+  const handleClose = () => {
+    onClose(false);
+  };
+
+  const insertTemplate = (template: string) => {
+    setValue("webhook_payload_template", template);
+  };
+
+  const onSubmit = async (values: FormValues) => {
+    setIsSubmitting(true);
+    try {
+      // Handle all notification types including webhook through alert_configurations
+      const configData = {
+        ...values,
+        service_id: values.service_id || "global",
+      };
+      
+      if (isEditing && editingConfig?.id) {
+        await alertConfigService.updateAlertConfiguration(editingConfig.id, configData);
+      } else {
+        await alertConfigService.createAlertConfiguration(configData as any);
+      }
+      
+      onClose(true); // Close with refresh
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to save notification channel",
+        variant: "destructive"
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={() => handleClose()}>
+      <DialogContent className="sm:max-w-[700px] max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle>
+            {isEditing ? t("editChannel") : t("addChannelDialog")}
+          </DialogTitle>
+        </DialogHeader>
+        
+        <Form {...form}>
+          <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-6">
+            <FormField
+              control={form.control}
+              name="notify_name"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>{t("channelName")}</FormLabel>
+                  <FormControl>
+                    <Input placeholder={t("channelNamePlaceholder")} {...field} />
+                  </FormControl>
+                  <FormDescription>
+                    {t("channelNameDesc")}
+                  </FormDescription>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            <FormField
+              control={form.control}
+              name="notification_type"
+              render={({ field }) => (
+                <FormItem>
+                  <FormLabel>{t("channelType")}</FormLabel>
+                  <Select onValueChange={field.onChange} value={field.value}>
+                    <FormControl>
+                      <SelectTrigger>
+                        <SelectValue placeholder={t("selectType")} />
+                      </SelectTrigger>
+                    </FormControl>
+                    <SelectContent>
+                      {notificationTypeOptions.map((option) => (
+                        <SelectItem key={option.value} value={option.value}>
+                          <div className="flex items-center space-x-3">
+                            <img 
+                              src={option.icon} 
+                              alt={`${option.label} icon`}
+                              className="w-5 h-5 object-contain"
+                            />
+                            <div className="flex flex-col">
+                              <span className="font-medium">{t(option.value)}</span>
+                              <span className="text-xs text-muted-foreground">{t(option.description)}</span>
+                            </div>
+                          </div>
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                  <FormMessage />
+                </FormItem>
+              )}
+            />
+
+            {notificationType === "telegram" && (
+              <>
+                <FormField
+                  control={form.control}
+                  name="telegram_chat_id"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("telegramChatId")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("telegramChatIdPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("telegramChatIdDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="bot_token"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("botToken")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("botTokenPlaceholder")} {...field} type="password" />
+                      </FormControl>
+                      <FormDescription>
+                        {t("botTokenDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </>
+            )}
+
+            {notificationType === "discord" && (
+              <FormField
+                control={form.control}
+                name="discord_webhook_url"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t("discordWebhookUrl")}</FormLabel>
+                    <FormControl>
+                      <Input placeholder={t("discordWebhookUrlPlaceholder")} {...field} />
+                    </FormControl>
+                    <FormDescription>
+                      {t("discordWebhookUrlDesc")}
+                    </FormDescription>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            )}
+
+            {notificationType === "slack" && (
+              <FormField
+                control={form.control}
+                name="slack_webhook_url"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t("slackWebhookUrl")}</FormLabel>
+                    <FormControl>
+                      <Input placeholder={t("slackWebhookUrlPlaceholder")} {...field} />
+                    </FormControl>
+                    <FormDescription>
+                      {t("slackWebhookUrlDesc")}
+                    </FormDescription>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            )}
+            
+            {notificationType === "signal" && (
+               <>
+                <FormField
+                  control={form.control}
+                  name="signal_number"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("signalNumber")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("signalNumberPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("signalNumberDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="signal_api_endpoint"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("signalApiEndpoint")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("signalApiEndpointPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("signalApiEndpointDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </>
+            )}
+
+            {notificationType === "google_chat" && (
+              <FormField
+                control={form.control}
+                name="google_chat_webhook_url"
+                render={({ field }) => (
+                  <FormItem>
+                    <FormLabel>{t("googleChatWebhookUrl")}</FormLabel>
+                    <FormControl>
+                      <Input placeholder={t("googleChatWebhookUrlPlaceholder")} {...field} />
+                    </FormControl>
+                    <FormDescription>
+                      {t("googleChatWebhookUrlDesc")}
+                    </FormDescription>
+                    <FormMessage />
+                  </FormItem>
+                )}
+              />
+            )}
+
+            {notificationType === "email" && (
+              <>
+                <FormField
+                  control={form.control}
+                  name="email_address"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("emailAddress")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("emailAddressPlaceholder")} {...field} type="email" />
+                      </FormControl>
+                      <FormDescription>
+                        {t("emailAddressDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="email_sender_name"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("emailSenderName")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("emailSenderNamePlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("emailSenderNameDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <div className="grid grid-cols-2 gap-4">
+                  <FormField
+                    control={form.control}
+                    name="smtp_server"
+                    render={({ field }) => (
+                      <FormItem>
+                        <FormLabel>{t("smtpServer")}</FormLabel>
+                        <FormControl>
+                          <Input placeholder={t("smtpServerPlaceholder")} {...field} />
+                        </FormControl>
+                        <FormMessage />
+                      </FormItem>
+                    )}
+                  />
+                  <FormField
+                    control={form.control}
+                    name="smtp_port"
+                    render={({ field }) => (
+                      <FormItem>
+                        <FormLabel>{t("smtpPort")}</FormLabel>
+                        <FormControl>
+                          <Input placeholder={t("smtpPortPlaceholder")} {...field} />
+                        </FormControl>
+                        <FormMessage />
+                      </FormItem>
+                    )}
+                  />
+                </div>
+                <FormField
+                  control={form.control}
+                  name="smtp_password"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("smtpPassword")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("smtpPasswordPlaceholder")} {...field} type="password" />
+                      </FormControl>
+                      <FormDescription>
+                        {t("smtpPasswordDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </>
+            )}
+
+             {notificationType === "ntfy" && (
+             <>
+                <FormField
+                  control={form.control}
+                  name="ntfy_endpoint"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("ntfyEndpoint")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("ntfyEndpointPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("ntfyEndpointDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="api_token"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("apiTokenOptional")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("apiTokenPlaceholder")} {...field} type="password" />
+                      </FormControl>
+                      <FormDescription>
+                        {t("apiTokenDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </>
+            )}
+
+            {notificationType === "pushover" && (
+              <>
+                <FormField
+                  control={form.control}
+                  name="api_token"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("apiToken")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("apiTokenPlaceholder")} {...field} type="password" />
+                      </FormControl>
+                      <FormDescription>
+                        {t("apiTokenDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="user_key"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("pushoverUserKey")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("pushoverUserKeyPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("pushoverUserKeyDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </>
+            )}
+
+             {notificationType === "notifiarr" && (
+              <>
+                <FormField
+                  control={form.control}
+                  name="api_token"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("apiToken")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("apiTokenPlaceholder")} {...field} type="password" />
+                      </FormControl>
+                      <FormDescription>
+                        {t("apiTokenDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="channel_id"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("notifiarrChannelId")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("notifiarrChannelIdPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("notifiarrChannelIdDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </>
+            )}
+
+            {notificationType === "gotify" && (
+              <>
+                <FormField
+                  control={form.control}
+                  name="api_token"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("apiToken")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("apiTokenPlaceholder")} {...field} type="password" />
+                      </FormControl>
+                      <FormDescription>
+                        {t("apiTokenDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="server_url"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("gotifyServerUrl")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("gotifyServerUrlPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("gotifyServerUrlDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </>
+            )}
+
+            {notificationType === "webhook" && (
+              <>
+                <FormField
+                  control={form.control}
+                  name="webhook_url"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("webhookUrl")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("webhookUrlPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("webhookUrlDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+
+                <div className="space-y-4">
+                  <FormField
+                    control={form.control}
+                    name="webhook_payload_template"
+                    render={({ field }) => (
+                      <FormItem>
+                        <FormLabel>{t("payloadTemplate")}</FormLabel>
+                        <FormDescription>
+                          {t("payloadTemplateDesc")}
+                        </FormDescription>
+                        <FormMessage />
+                      </FormItem>
+                    )}
+                  />
+
+                  <Card>
+                    <CardHeader className="pb-3">
+                      <CardTitle className="text-sm font-medium">{t("payloadTemplates")}</CardTitle>
+                    </CardHeader>
+                    <CardContent>
+                      <div className="space-y-3">
+                        <div className="mt-4">
+                          <h4 className="text-sm font-medium mb-2">{t("availablePlaceholders")}</h4>
+                          <div className="grid grid-cols-2 md:grid-cols-4 gap-2 text-xs">
+                            <div className="space-y-1">
+                              <p className="font-medium text-muted-foreground">{t("server")}</p>
+                              <div className="space-y-0.5">
+                                <code className="bg-muted px-1 rounded">${'{server_name}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{cpu_usage}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{ram_usage}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{disk_usage}'}</code>
+                              </div>
+                            </div>
+                            <div className="space-y-1">
+                              <p className="font-medium text-muted-foreground">{t("service")}</p>
+                              <div className="space-y-0.5">
+                                <code className="bg-muted px-1 rounded">${'{service_name}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{response_time}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{url}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{uptime}'}</code>
+                              </div>
+                            </div>
+                            <div className="space-y-1">
+                              <p className="font-medium text-muted-foreground">{t("ssl")}</p>
+                              <div className="space-y-0.5">
+                                <code className="bg-muted px-1 rounded">${'{domain}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{expiry_date}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{days_left}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{issuer}'}</code>
+                              </div>
+                            </div>
+                            <div className="space-y-1">
+                              <p className="font-medium text-muted-foreground">{t("common")}</p>
+                              <div className="space-y-0.5">
+                                <code className="bg-muted px-1 rounded">${'{status}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{time}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{message}'}</code><br/>
+                                <code className="bg-muted px-1 rounded">${'{threshold}'}</code>
+                              </div>
+                            </div>
+                          </div>
+                        </div>
+                      </div>
+                    </CardContent>
+                  </Card>
+                </div>
+              </>
+            )}
+            
+            {notificationType === "matrix" && (
+              <>
+                <FormField
+                  control={form.control}
+                  name="matrix_homeserver"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("matrixHomeserver")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("matrixHomeserverPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("matrixHomeserverDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="matrix_room_id"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("matrixRoomId")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("matrixRoomIdPlaceholder")} {...field} />
+                      </FormControl>
+                      <FormDescription>
+                        {t("matrixRoomIdDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+                <FormField
+                  control={form.control}
+                  name="matrix_access_token"
+                  render={({ field }) => (
+                    <FormItem>
+                      <FormLabel>{t("matrixAccessToken")}</FormLabel>
+                      <FormControl>
+                        <Input placeholder={t("matrixAccessTokenPlaceholder")} {...field} type="password" />
+                      </FormControl>
+                      <FormDescription>
+                        {t("matrixAccessTokenDesc")}
+                      </FormDescription>
+                      <FormMessage />
+                    </FormItem>
+                  )}
+                />
+              </>
+            )}
+
+            <FormField
+              control={form.control}
+              name="enabled"
+              render={({ field }) => (
+                <FormItem className="flex flex-row items-center justify-between rounded-lg border p-3">
+                  <div className="space-y-0.5">
+                    <FormLabel>{t("enabled")}</FormLabel>
+                    <FormDescription>
+                      {t("enabledDesc")}
+                    </FormDescription>
+                  </div>
+                  <FormControl>
+                    <Switch
+                      checked={field.value}
+                      onCheckedChange={field.onChange}
+                    />
+                  </FormControl>
+                </FormItem>
+              )}
+            />
+            
+            <DialogFooter>
+              <Button variant="outline" type="button" onClick={handleClose}>
+                {t("cancel")}
+              </Button>
+              <Button type="submit" disabled={isSubmitting}>
+                {isSubmitting && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
+                {isEditing ? t("updateChannel") : t("createChannel")}
+              </Button>
+            </DialogFooter>
+          </form>
+        </Form>
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/notification-settings/NotificationChannelList.tsx b/application/src/components/settings/notification-settings/NotificationChannelList.tsx
new file mode 100644
index 0000000..661b0db
--- /dev/null
+++ b/application/src/components/settings/notification-settings/NotificationChannelList.tsx
@@ -0,0 +1,192 @@
+
+import { AlertConfiguration } from "@/services/alertConfigService";
+import { Bell, Edit, Trash2 } from "lucide-react";
+import { useState } from "react";
+import { 
+  Table, 
+  TableBody, 
+  TableCell, 
+  TableHead, 
+  TableHeader, 
+  TableRow 
+} from "@/components/ui/table";
+import { Switch } from "@/components/ui/switch";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import { alertConfigService } from "@/services/alertConfigService";
+import { pb } from "@/lib/pocketbase";
+
+interface CombinedChannel extends Partial<AlertConfiguration> {
+  isWebhook?: boolean;
+  url?: string;
+  method?: string;
+  description?: string;
+}
+
+interface NotificationChannelListProps {
+  channels: CombinedChannel[];
+  onEdit: (config: AlertConfiguration) => void;
+  onDelete: (id: string) => void;
+}
+
+export const NotificationChannelList = ({
+  channels,
+  onEdit,
+  onDelete
+}: NotificationChannelListProps) => {
+  const [optimisticStates, setOptimisticStates] = useState<Record<string, boolean>>({});
+
+  const toggleEnabled = async (config: CombinedChannel) => {
+    if (!config.id) return;
+    
+    const currentEnabled = typeof config.enabled === 'string'
+      ? config.enabled === "true" || config.enabled === "on"
+      : !!config.enabled;
+    
+    // Apply optimistic update immediately
+    setOptimisticStates(prev => ({
+      ...prev,
+      [config.id!]: !currentEnabled
+    }));
+    
+    try {
+      if (config.isWebhook) {
+        // Handle webhook toggle
+        const newEnabled = currentEnabled ? "off" : "on";
+        await pb.collection('webhook').update(config.id, {
+          enabled: newEnabled
+        });
+      } else {
+        // Handle alert config toggle
+        await alertConfigService.updateAlertConfiguration(config.id, {
+          enabled: !currentEnabled
+        });
+      }
+  
+    } catch (error) {
+      setOptimisticStates(prev => ({
+        ...prev,
+        [config.id!]: currentEnabled
+      }));
+    }
+  };
+
+  const getChannelTypeLabel = (type: string | undefined) => {
+    switch(type) {
+      case "telegram": return "Telegram";
+      case "discord": return "Discord";
+      case "slack": return "Slack";
+      case "signal": return "Signal";
+      case "google_chat": return "Google Chat";
+      case "email": return "Email";
+      case "pushover": return "Pushover";
+      case "notifiarr": return "Notifiarr";
+      case "webhook": return "Webhook";
+      case "matrix": return "Matrix";
+      default: return type || "Unknown";
+    }
+  };
+
+  const getChannelDetails = (config: CombinedChannel) => {
+    if (config.isWebhook) {
+      return `${config.method || 'POST'} ${config.url || ''}`;
+    }
+    
+    switch(config.notification_type) {
+      case "telegram":
+        return config.telegram_chat_id || '';
+      case "discord":
+      case "slack":
+      case "google_chat":
+        return config.discord_webhook_url || config.slack_webhook_url || config.google_chat_webhook_url || '';
+      case "signal":
+        return config.signal_number || '';
+      case "email":
+        return config.email_address || '';
+      case "matrix":
+        return config.matrix_room_id || '';
+      default:
+        return '';
+    }
+  };
+
+  if (channels.length === 0) {
+    return (
+      <div className="flex flex-col items-center justify-center py-10 text-center">
+        <Bell className="h-12 w-12 text-muted-foreground mb-4" />
+        <h3 className="text-lg font-medium">No notification channels configured</h3>
+        <p className="text-muted-foreground mt-2">
+          Add a notification channel to get alerts when your services go down.
+        </p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="rounded-md border">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Name</TableHead>
+            <TableHead>Type</TableHead>
+            <TableHead>Details</TableHead>
+            <TableHead>Status</TableHead>
+            <TableHead>Created</TableHead>
+            <TableHead className="text-right">Actions</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {channels.map((channel) => (
+            <TableRow key={channel.id}>
+              <TableCell className="font-medium">{channel.notify_name}</TableCell>
+              <TableCell>
+                <Badge variant="outline">{getChannelTypeLabel(channel.notification_type)}</Badge>
+              </TableCell>
+              <TableCell className="max-w-xs truncate text-sm text-muted-foreground">
+                {getChannelDetails(channel)}
+              </TableCell>
+               <TableCell>
+                <Switch 
+                  checked={
+                    channel.id && optimisticStates.hasOwnProperty(channel.id)
+                      ? optimisticStates[channel.id]
+                      : typeof channel.enabled === 'string'
+                        ? channel.enabled === "true" || channel.enabled === "on"
+                        : !!channel.enabled
+                  }
+                  onCheckedChange={() => toggleEnabled(channel)}
+                />
+              </TableCell>
+              <TableCell>
+                {channel.created ? new Date(channel.created).toLocaleDateString() : "-"}
+              </TableCell>
+              <TableCell className="text-right">
+                <div className="flex justify-end gap-2">
+                  <Button 
+                    variant="outline" 
+                    size="sm" 
+                    onClick={() => onEdit(channel as AlertConfiguration)}
+                    disabled={channel.isWebhook} 
+                  >
+                    <Edit className="h-4 w-4" />
+                  </Button>
+                  <Button 
+                    variant="outline" 
+                    size="sm" 
+                    onClick={() => {
+                      if (channel.id && confirm("Are you sure you want to delete this notification channel?")) {
+                        onDelete(channel.id)
+                      }
+                    }}
+                  >
+                    <Trash2 className="h-4 w-4 text-destructive" />
+                  </Button>
+                </div>
+              </TableCell>
+            </TableRow>
+          ))}
+        </TableBody>
+      </Table>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/settings/notification-settings/NotificationSettings.tsx b/application/src/components/settings/notification-settings/NotificationSettings.tsx
new file mode 100644
index 0000000..c3f72b4
--- /dev/null
+++ b/application/src/components/settings/notification-settings/NotificationSettings.tsx
@@ -0,0 +1,185 @@
+
+import React, { useState, useEffect } from "react";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { Button } from "@/components/ui/button";
+import { Plus, Loader2 } from "lucide-react";
+import { AlertConfiguration, alertConfigService } from "@/services/alertConfigService";
+import { WebhookConfiguration, webhookService } from "@/services/webhookService";
+import { NotificationChannelDialog } from "./NotificationChannelDialog";
+import { NotificationChannelList } from "./NotificationChannelList";
+import { pb } from "@/lib/pocketbase";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface CombinedChannel extends Partial<AlertConfiguration> {
+  isWebhook?: boolean;
+  url?: string;
+  method?: string;
+  description?: string;
+}
+
+const NotificationSettings = () => {
+  const { t } = useLanguage();
+  const [isLoading, setIsLoading] = useState(true);
+  const [alertConfigs, setAlertConfigs] = useState<AlertConfiguration[]>([]);
+  const [webhookConfigs, setWebhookConfigs] = useState<WebhookConfiguration[]>([]);
+  const [dialogOpen, setDialogOpen] = useState(false);
+  const [currentTab, setCurrentTab] = useState<string>("all");
+  const [editingConfig, setEditingConfig] = useState<AlertConfiguration | null>(null);
+
+  const fetchNotificationChannels = async () => {
+    setIsLoading(true);
+    try {
+      // Fetch alert configurations
+      const configs = await alertConfigService.getAlertConfigurations();
+      setAlertConfigs(configs);
+
+      // Fetch webhooks
+      try {
+        const webhookResponse = await pb.collection('webhook').getList(1, 50);
+        setWebhookConfigs(webhookResponse.items as WebhookConfiguration[]);
+      } catch (webhookError) {
+        setWebhookConfigs([]);
+      }
+    } finally {
+      setIsLoading(false);
+    }
+  };
+
+  useEffect(() => {
+    fetchNotificationChannels();
+  }, []);
+
+  const handleAddNew = () => {
+    setEditingConfig(null);
+    setDialogOpen(true);
+  };
+
+  const handleEdit = (config: AlertConfiguration) => {
+    setEditingConfig(config);
+    setDialogOpen(true);
+  };
+
+  const handleDelete = async (id: string) => {
+    // Check if it's a webhook first
+    const isWebhook = webhookConfigs.find(w => w.id === id);
+    
+    if (isWebhook) {
+      // Handle webhook deletion
+      if (confirm("Are you sure you want to delete this webhook?")) {
+        try {
+          await pb.collection('webhook').delete(id);
+          fetchNotificationChannels();
+        } catch (error) {
+          console.error("Error deleting webhook:", error);
+        }
+      }
+    } else {
+      // Handle alert config deletion
+      const success = await alertConfigService.deleteAlertConfiguration(id);
+      if (success) {
+        fetchNotificationChannels();
+      }
+    }
+  };
+
+  const handleDialogClose = (refreshList: boolean) => {
+    setDialogOpen(false);
+    if (refreshList) {
+      fetchNotificationChannels();
+    }
+  };
+
+  const getCombinedChannels = (): CombinedChannel[] => {
+    const combined: CombinedChannel[] = [];
+    
+    // Add alert configurations
+    alertConfigs.forEach(config => {
+      combined.push(config);
+    });
+    
+    // Add webhooks as notification channels
+    webhookConfigs.forEach(webhook => {
+      combined.push({
+        id: webhook.id,
+        notify_name: webhook.name,
+        notification_type: "webhook" as const,
+        enabled: webhook.enabled === "on",
+        created: webhook.created,
+        updated: webhook.updated,
+        isWebhook: true,
+        url: webhook.url,
+        method: webhook.method,
+        description: webhook.description
+      });
+    });
+    
+    return combined;
+  };
+
+  const getFilteredConfigs = () => {
+    const combined = getCombinedChannels();
+    if (currentTab === "all") return combined;
+    return combined.filter(config => config.notification_type === currentTab);
+  };
+
+  return (
+    <Card className="w-full">
+      <CardHeader>
+        <div className="flex items-center justify-between">
+          <div>
+            <CardTitle>{t("titleNotification")}</CardTitle>
+            <CardDescription>
+              {t("descriptionChannelsServices")}
+            </CardDescription>
+          </div>
+          <Button onClick={handleAddNew}>
+            <Plus className="mr-2 h-4 w-4" /> {t("addChannel")}
+          </Button>
+        </div>
+      </CardHeader>
+      <CardContent>
+        <Tabs 
+          defaultValue="all" 
+          value={currentTab}
+          onValueChange={setCurrentTab}
+          className="w-full"
+        >
+          <TabsList className="mb-4">
+            <TabsTrigger value="all">{t("all")}</TabsTrigger>
+            <TabsTrigger value="telegram">{t("telegram")}</TabsTrigger>
+            <TabsTrigger value="discord">{t("discord")}</TabsTrigger>
+            <TabsTrigger value="slack">{t("slack")}</TabsTrigger>
+            <TabsTrigger value="signal">{t("signal")}</TabsTrigger>
+            <TabsTrigger value="google_chat">{t("googleChat")}</TabsTrigger>
+            <TabsTrigger value="email">{t("email")}</TabsTrigger>
+            <TabsTrigger value="webhook">{t("webhook")}</TabsTrigger>
+            <TabsTrigger value="matrix">{t("matrix")}</TabsTrigger>
+          </TabsList>
+          
+          <TabsContent value={currentTab} className="mt-0">
+            {isLoading ? (
+              <div className="flex items-center justify-center py-8">
+                <Loader2 className="h-8 w-8 animate-spin text-primary" />
+              </div>
+            ) : (
+              <NotificationChannelList 
+                channels={getFilteredConfigs()} 
+                onEdit={handleEdit}
+                onDelete={handleDelete}
+              />
+            )}
+          </TabsContent>
+        </Tabs>
+      </CardContent>
+
+      <NotificationChannelDialog 
+        open={dialogOpen} 
+        onClose={handleDialogClose} 
+        editingConfig={editingConfig}
+      />
+    </Card>
+  );
+};
+
+export default NotificationSettings;
\ No newline at end of file
diff --git a/application/src/components/settings/notification-settings/index.ts b/application/src/components/settings/notification-settings/index.ts
new file mode 100644
index 0000000..959fce3
--- /dev/null
+++ b/application/src/components/settings/notification-settings/index.ts
@@ -0,0 +1,4 @@
+
+import NotificationSettings from "./NotificationSettings";
+
+export { NotificationSettings };
diff --git a/application/src/components/settings/user-management/AddUserDialog.tsx b/application/src/components/settings/user-management/AddUserDialog.tsx
new file mode 100644
index 0000000..68357ef
--- /dev/null
+++ b/application/src/components/settings/user-management/AddUserDialog.tsx
@@ -0,0 +1,46 @@
+
+import React from "react";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { ScrollArea } from "@/components/ui/scroll-area";
+import { UseFormReturn } from "react-hook-form";
+import AddUserForm from "./form-fields/AddUserForm";
+
+interface AddUserDialogProps {
+  isOpen: boolean;
+  setIsOpen: (open: boolean) => void;
+  form: UseFormReturn<any>;
+  onSubmit: (data: any) => void;
+  isSubmitting: boolean;
+}
+
+const AddUserDialog = ({ isOpen, setIsOpen, form, onSubmit, isSubmitting }: AddUserDialogProps) => {
+  return (
+    <Dialog open={isOpen} onOpenChange={setIsOpen}>
+      <DialogContent className="sm:max-w-[700px] w-[95vw] max-h-[95vh] flex flex-col">
+        <DialogHeader className="flex-shrink-0">
+          <DialogTitle>Add New User</DialogTitle>
+          <DialogDescription>
+            Create a new user account
+          </DialogDescription>
+        </DialogHeader>
+        <ScrollArea className="flex-1 overflow-auto">
+          <div className="p-1">
+            <AddUserForm 
+              form={form} 
+              onSubmit={onSubmit} 
+              isSubmitting={isSubmitting} 
+            />
+          </div>
+        </ScrollArea>
+      </DialogContent>
+    </Dialog>
+  );
+};
+
+export default AddUserDialog;
\ No newline at end of file
diff --git a/application/src/components/settings/user-management/DeleteUserDialog.tsx b/application/src/components/settings/user-management/DeleteUserDialog.tsx
new file mode 100644
index 0000000..7da686a
--- /dev/null
+++ b/application/src/components/settings/user-management/DeleteUserDialog.tsx
@@ -0,0 +1,81 @@
+
+import React, { useState } from "react";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { User } from "@/services/userService";
+import { Loader2 } from "lucide-react";
+
+interface DeleteUserDialogProps {
+  isOpen: boolean;
+  setIsOpen: (open: boolean) => void;
+  user: User | null;
+  onDelete: () => void;
+  isDeleting?: boolean;
+}
+
+const DeleteUserDialog = ({
+  isOpen,
+  setIsOpen,
+  user,
+  onDelete,
+  isDeleting = false,
+}: DeleteUserDialogProps) => {
+  if (!user) return null;
+
+  const handleCancel = () => {
+    if (!isDeleting) {
+      setIsOpen(false);
+    }
+  };
+
+  const handleConfirm = () => {
+    if (!isDeleting) {
+      onDelete();
+    }
+  };
+
+  return (
+    <AlertDialog open={isOpen} onOpenChange={(newOpen) => {
+      // Only allow closing if not currently deleting
+      if (!isDeleting || !newOpen) {
+        setIsOpen(newOpen);
+      }
+    }}>
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Delete user</AlertDialogTitle>
+          <AlertDialogDescription>
+            Are you sure you want to delete {user.full_name || user.username}? This action cannot be undone.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel onClick={handleCancel} disabled={isDeleting}>Cancel</AlertDialogCancel>
+          <AlertDialogAction
+            onClick={handleConfirm}
+            disabled={isDeleting}
+            className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+          >
+            {isDeleting ? (
+              <>
+                <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                Deleting...
+              </>
+            ) : (
+              'Delete'
+            )}
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+};
+
+export default DeleteUserDialog;
diff --git a/application/src/components/settings/user-management/EditUserDialog.tsx b/application/src/components/settings/user-management/EditUserDialog.tsx
new file mode 100644
index 0000000..c718972
--- /dev/null
+++ b/application/src/components/settings/user-management/EditUserDialog.tsx
@@ -0,0 +1,175 @@
+import React from "react";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Form } from "@/components/ui/form";
+import { Button } from "@/components/ui/button";
+import { ScrollArea } from "@/components/ui/scroll-area";
+import { UseFormReturn } from "react-hook-form";
+import { User } from "@/services/userService";
+import { Loader2, AlertCircle } from "lucide-react";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import UserTextField from "./form-fields/UserTextField";
+import UserToggleField from "./form-fields/UserToggleField";
+import UserRoleField from "./form-fields/UserRoleField";
+import { Label } from "@/components/ui/label";
+import { Input } from "@/components/ui/input";
+
+interface EditUserDialogProps {
+  isOpen: boolean;
+  setIsOpen: (open: boolean) => void;
+  form: UseFormReturn<any>;
+  user: User | null;
+  onSubmit: (data: any) => void;
+  onImpersonate: (data: any) => void;
+  isSubmitting?: boolean;
+  error?: string | null;
+}
+
+const EditUserDialog = ({ 
+  isOpen, 
+  setIsOpen, 
+  form, 
+  user, 
+  onSubmit,
+  onImpersonate,
+  isSubmitting = false,
+  error = null
+}: EditUserDialogProps) => {
+  if (!user) return null;
+
+  const [impersonationDurationSeconds, setImpersonationDurationSeconds] = React.useState<number>(3600);
+
+  const handleImpersonateClick = () => {
+    // Impersonation should not depend on edit form validation.
+    onImpersonate({ user, durationSeconds: impersonationDurationSeconds });
+  };
+  
+  return (
+    <Dialog open={isOpen} onOpenChange={setIsOpen}>
+      <DialogContent className="sm:max-w-[700px] w-[95vw] max-h-[95vh] flex flex-col">
+        <DialogHeader className="flex-shrink-0">
+          <DialogTitle>Edit User</DialogTitle>
+          <DialogDescription>
+            Update user information
+          </DialogDescription>
+        </DialogHeader>
+        
+        <ScrollArea className="flex-1 overflow-auto">
+          <div className="p-1">
+            {error && (
+              <Alert variant="destructive" className="mb-4">
+                <AlertCircle className="h-4 w-4" />
+                <AlertDescription>{error}</AlertDescription>
+              </Alert>
+            )}
+            
+            <Form {...form}>
+              <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
+                
+                <div className="grid grid-cols-2 gap-4">
+                  <UserTextField
+                    control={form.control}
+                    name="full_name"
+                    label="Full Name"
+                    placeholder="Enter full name"
+                  />
+                  
+                  <UserTextField
+                    control={form.control}
+                    name="email"
+                    label="Email"
+                    placeholder="Enter email"
+                    type="email"
+                  />
+                  
+                  <UserTextField
+                    control={form.control}
+                    name="username"
+                    label="Username"
+                    placeholder="Enter username"
+                  />
+                  
+                  <UserRoleField
+                    control={form.control}
+                    name="role"
+                    label="Role"
+                  />
+                </div>
+                
+                <UserToggleField
+                  control={form.control}
+                  name="isActive"
+                  label="Active Status"
+                  description="User will be able to access the system"
+                />
+              </form>
+            </Form>
+
+            {/* Impersonation settings are not part of the form to avoid validation */}
+            <div className="mt-6 space-y-2">
+              <Label htmlFor="impersonation-duration">Impersonation token duration (seconds)</Label>
+              <Input
+                id="impersonation-duration"
+                type="number"
+                inputMode="numeric"
+                min={60}
+                step={60}
+                value={impersonationDurationSeconds}
+                onChange={(e) => setImpersonationDurationSeconds(Number(e.target.value || 0))}
+              />
+              <p className="text-xs text-muted-foreground">
+                Default is 3600 (1 hour). Minimum 60 seconds.
+              </p>
+            </div>
+          </div>
+        </ScrollArea>
+
+        <DialogFooter className="flex-shrink-0 pt-4 border-t">
+          <Button 
+            type="button" 
+            variant="outline" 
+            onClick={() => setIsOpen(false)}
+            disabled={isSubmitting}
+          >
+            Cancel
+          </Button>
+          <Button 
+            onClick={form.handleSubmit(onSubmit)} 
+            disabled={isSubmitting}
+          >
+            {isSubmitting ? (
+              <>
+                <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                Updating...
+              </>
+            ) : (
+              "Update User"
+            )}
+          </Button>
+          <Button 
+            type="button"
+            onClick={handleImpersonateClick}
+            disabled={isSubmitting}
+          >
+            {isSubmitting ? (
+              <>
+                <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                Impersonating...
+              </>
+            ) : (
+              "Impersonate"
+            )}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};
+
+export default EditUserDialog;
\ No newline at end of file
diff --git a/application/src/components/settings/user-management/ImpersonationTokenDialog.tsx b/application/src/components/settings/user-management/ImpersonationTokenDialog.tsx
new file mode 100644
index 0000000..bbb3726
--- /dev/null
+++ b/application/src/components/settings/user-management/ImpersonationTokenDialog.tsx
@@ -0,0 +1,65 @@
+import React from "react";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { copyToClipboard } from "@/utils/copyUtils";
+
+interface ImpersonationTokenDialogProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  token: string | null;
+  impersonatedUserLabel?: string;
+}
+
+const ImpersonationTokenDialog = ({
+  open,
+  onOpenChange,
+  token,
+  impersonatedUserLabel,
+}: ImpersonationTokenDialogProps) => {
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-[650px] w-[95vw]">
+        <DialogHeader>
+          <DialogTitle>Impersonation token</DialogTitle>
+          <DialogDescription>
+            {impersonatedUserLabel
+              ? `Use this token to impersonate ${impersonatedUserLabel}. Keep it secret.`
+              : "Use this token to impersonate the selected user. Keep it secret."}
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="space-y-2">
+          <div className="rounded-md border bg-muted p-3">
+            <pre className="text-sm overflow-x-auto whitespace-pre-wrap break-all">
+              <code>{token ?? ""}</code>
+            </pre>
+          </div>
+        </div>
+
+        <DialogFooter>
+          <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+            Close
+          </Button>
+          <Button
+            type="button"
+            onClick={() => {
+              if (token) copyToClipboard(token);
+            }}
+            disabled={!token}
+          >
+            Copy token
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+};
+
+export default ImpersonationTokenDialog;
diff --git a/application/src/components/settings/user-management/UserManagement.tsx b/application/src/components/settings/user-management/UserManagement.tsx
new file mode 100644
index 0000000..94dfb75
--- /dev/null
+++ b/application/src/components/settings/user-management/UserManagement.tsx
@@ -0,0 +1,102 @@
+import React from "react";
+import UserTable from "./UserTable";
+import AddUserDialog from "./AddUserDialog";
+import EditUserDialog from "./EditUserDialog";
+import DeleteUserDialog from "./DeleteUserDialog";
+import ImpersonationTokenDialog from "./ImpersonationTokenDialog";
+import { useUserManagement } from "./hooks";
+import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "@/components/ui/accordion";
+import { UserCog, Loader2, AlertCircle, Info, Users, ShieldAlert } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { authService } from "@/services/authService";
+import { useLanguage }  from "@/contexts/LanguageContext.tsx";
+
+const UserManagement = () => {
+  const { t } = useLanguage();
+  const {
+    users,
+    loading,
+    error,
+    newUserForm,
+    isAddUserDialogOpen,
+    setIsAddUserDialogOpen,
+    isDialogOpen,
+    setIsDialogOpen,
+    isDeleting,
+    setIsDeleting,
+    isSubmitting,
+    updateError,
+    form,
+    currentUser,
+    userToDelete,
+    handleEditUser,
+    handleDeletePrompt,
+    handleDeleteUser,
+    onSubmit,
+    onImpersonate,
+    onAddUser,
+    fetchUsers,
+    impersonationToken,
+    isImpersonationTokenDialogOpen,
+    setIsImpersonationTokenDialogOpen,
+  } = useUserManagement();
+
+  // Get the current logged in user to check their role
+  const loggedInUser = authService.getCurrentUser();
+  const isSuperAdmin = loggedInUser?.role === "superadmin";
+  return <div className="space-y-4">
+      <Accordion type="single" collapsible className="w-full" defaultValue="user-management">
+        <AccordionItem value="user-management">
+          <AccordionTrigger className="py-4 px-5 bg-card hover:bg-card/90 hover:no-underline rounded-lg text-lg font-medium flex items-center w-full">
+            <div className="flex items-center">
+              <UserCog className="h-5 w-5 mr-2 text-green-500" />
+              <span>{t("userManagement")}</span>
+            </div>
+          </AccordionTrigger>
+          <AccordionContent className="p-4 pt-6 bg-background rounded-b-lg">
+            <div className="flex justify-between items-center mb-6">
+              <h2 className="text-2xl font-bold">{t("userManagement")}</h2>
+              {isSuperAdmin && <button onClick={() => setIsAddUserDialogOpen(true)} className="bg-green-500 hover:bg-green-600 text-white py-2 px-4 rounded-md flex items-center">
+                  <span className="mr-1">+</span> {t("addUser")}
+                </button>}
+            </div>
+
+            {!isSuperAdmin && <Alert className="mb-6 border-blue-200 bg-blue-50 dark:bg-blue-950 dark:border-blue-800">
+                <ShieldAlert className="h-5 w-5 text-blue-600 dark:text-blue-400" />
+                <AlertDescription className="text-blue-700 dark:text-blue-300">
+                  <span className="font-medium">{t("permissionNotice")}</span> As an admin user, you have access to view and modify existing user details. However, only Super Admins have permission to create new user accounts. Contact your Super Admin if you need to add a new user.
+                </AlertDescription>
+              </Alert>}
+
+            {loading ? <div className="p-8 flex flex-col items-center justify-center text-center">
+                <Loader2 className="h-8 w-8 animate-spin mb-2 text-primary" />
+                <p className="text-muted-foreground">Loading users...</p>
+              </div> : error ? <div className="p-8 flex flex-col items-center justify-center text-center">
+                <AlertCircle className="h-8 w-8 text-destructive mb-2" />
+                <p className="text-destructive font-medium mb-2">Failed to load users</p>
+                <p className="text-muted-foreground mb-4">{error}</p>
+                <Button onClick={fetchUsers} variant="outline">
+                  Retry
+                </Button>
+              </div> : <UserTable users={users} onUserUpdate={handleEditUser} onUserDelete={handleDeletePrompt} />}
+
+            <AddUserDialog isOpen={isAddUserDialogOpen && isSuperAdmin} setIsOpen={setIsAddUserDialogOpen} form={newUserForm} onSubmit={onAddUser} isSubmitting={isSubmitting} />
+
+            <EditUserDialog isOpen={isDialogOpen} setIsOpen={setIsDialogOpen} form={form} user={currentUser} onImpersonate={onImpersonate} onSubmit={onSubmit} isSubmitting={isSubmitting} error={updateError} />
+
+            <ImpersonationTokenDialog
+              open={isImpersonationTokenDialogOpen}
+              onOpenChange={setIsImpersonationTokenDialogOpen}
+              token={impersonationToken}
+              impersonatedUserLabel={currentUser?.full_name || currentUser?.username}
+            />
+
+            <DeleteUserDialog isOpen={isDeleting} setIsOpen={setIsDeleting} user={userToDelete} onDelete={handleDeleteUser} isDeleting={isSubmitting} />
+          </AccordionContent>
+        </AccordionItem>
+      </Accordion>
+    </div>;
+};
+export default UserManagement;
+
diff --git a/application/src/components/settings/user-management/UserTable.tsx b/application/src/components/settings/user-management/UserTable.tsx
new file mode 100644
index 0000000..cbbe9a7
--- /dev/null
+++ b/application/src/components/settings/user-management/UserTable.tsx
@@ -0,0 +1,112 @@
+
+import React from "react";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Edit, Trash2 } from "lucide-react";
+import { User } from "@/services/userService";
+
+export interface UserTableProps {
+  users: User[];
+  onUserUpdate: (user: User) => void;
+  onUserDelete: (user: User) => void;
+}
+
+const UserTable = ({ users, onUserUpdate, onUserDelete }: UserTableProps) => {
+  // Helper function to get the user's initials for the avatar fallback
+  const getUserInitials = (user: User): string => {
+    return (user.full_name || user.username || "").substring(0, 2).toUpperCase();
+  };
+
+  return (
+    <div className="border rounded-lg overflow-hidden">
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>User</TableHead>
+            <TableHead>Username</TableHead>
+            <TableHead>Email</TableHead>
+            <TableHead>Role</TableHead>
+            <TableHead>Status</TableHead>
+            <TableHead className="text-right">Actions</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {users.length === 0 ? (
+            <TableRow>
+              <TableCell colSpan={6} className="text-center py-8">
+                No users found
+              </TableCell>
+            </TableRow>
+          ) : (
+            users.map((user) => (
+              <TableRow key={user.id}>
+                <TableCell className="font-medium">
+                  <div className="flex items-center gap-3">
+                    <Avatar className="h-8 w-8">
+                      {user.avatar ? (
+                        <AvatarImage 
+                          src={user.avatar} 
+                          alt={user.full_name || user.username} 
+                        />
+                      ) : (
+                        <AvatarFallback>
+                          {getUserInitials(user)}
+                        </AvatarFallback>
+                      )}
+                    </Avatar>
+                    <span>{user.full_name || "-"}</span>
+                  </div>
+                </TableCell>
+                <TableCell>{user.username}</TableCell>
+                <TableCell>{user.email}</TableCell>
+                <TableCell>{user.role || "user"}</TableCell>
+                <TableCell>
+                  {user.isActive !== false ? (
+                    <Badge variant="outline" className="bg-green-50 text-green-700 border-green-200">
+                      Active
+                    </Badge>
+                  ) : (
+                    <Badge variant="outline" className="bg-red-50 text-red-700 border-red-200">
+                      Inactive
+                    </Badge>
+                  )}
+                </TableCell>
+                <TableCell className="text-right space-x-1">
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    className="h-8 w-8 p-0"
+                    onClick={() => onUserUpdate(user)}
+                  >
+                    <Edit className="h-4 w-4" />
+                    <span className="sr-only">Edit</span>
+                  </Button>
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    className="h-8 w-8 p-0 text-red-500 hover:text-red-600 hover:bg-red-50"
+                    onClick={() => onUserDelete(user)}
+                  >
+                    <Trash2 className="h-4 w-4" />
+                    <span className="sr-only">Delete</span>
+                  </Button>
+                </TableCell>
+              </TableRow>
+            ))
+          )}
+        </TableBody>
+      </Table>
+    </div>
+  );
+};
+
+export default UserTable;
diff --git a/application/src/components/settings/user-management/avatarOptions.ts b/application/src/components/settings/user-management/avatarOptions.ts
new file mode 100644
index 0000000..b9028e1
--- /dev/null
+++ b/application/src/components/settings/user-management/avatarOptions.ts
@@ -0,0 +1,13 @@
+
+export const avatarOptions = [
+  { url: "https://api.dicebear.com/7.x/bottts/svg?seed=Felix", label: "Avatar 1" },
+  { url: "https://api.dicebear.com/7.x/bottts/svg?seed=Aneka", label: "Avatar 2" },
+  { url: "https://api.dicebear.com/7.x/bottts/svg?seed=Milo", label: "Avatar 3" },
+  { url: "https://api.dicebear.com/7.x/fun-emoji/svg?seed=Cuddles", label: "Avatar 4" },
+  { url: "https://api.dicebear.com/7.x/fun-emoji/svg?seed=Bella", label: "Avatar 5" },
+  { url: "https://api.dicebear.com/7.x/fun-emoji/svg?seed=Shadow", label: "Avatar 6" },
+  { url: "https://api.dicebear.com/7.x/lorelei/svg?seed=Jasper", label: "Avatar 7" },
+  { url: "https://api.dicebear.com/7.x/lorelei/svg?seed=Willow", label: "Avatar 8" },
+  { url: "https://api.dicebear.com/7.x/notionists/svg?seed=Mittens", label: "Avatar 9" },
+  { url: "https://api.dicebear.com/7.x/notionists/svg?seed=Oliver", label: "Avatar 10" },
+];
diff --git a/application/src/components/settings/user-management/form-fields/AddUserForm.tsx b/application/src/components/settings/user-management/form-fields/AddUserForm.tsx
new file mode 100644
index 0000000..013c2ac
--- /dev/null
+++ b/application/src/components/settings/user-management/form-fields/AddUserForm.tsx
@@ -0,0 +1,93 @@
+
+import React from "react";
+import { Form } from "@/components/ui/form";
+import { Button } from "@/components/ui/button";
+import { Loader2 } from "lucide-react";
+import { UseFormReturn } from "react-hook-form";
+import { UserTextField } from "./";
+import { UserToggleField } from "./";
+import { UserRoleField } from "./";
+import { DialogFooter } from "@/components/ui/dialog";
+
+interface AddUserFormProps {
+  form: UseFormReturn<any>;
+  onSubmit: (data: any) => void;
+  isSubmitting: boolean;
+}
+
+const AddUserForm = ({ form, onSubmit, isSubmitting }: AddUserFormProps) => {
+  return (
+    <Form {...form}>
+      <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
+        
+        <div className="grid grid-cols-2 gap-4">
+          <UserTextField
+            control={form.control}
+            name="full_name"
+            label="Full Name"
+            placeholder="Enter full name"
+          />
+          
+          <UserTextField
+            control={form.control}
+            name="email"
+            label="Email"
+            placeholder="Enter email"
+            type="email"
+          />
+          
+          <UserTextField
+            control={form.control}
+            name="username"
+            label="Username"
+            placeholder="Enter username"
+          />
+          
+          <UserRoleField
+            control={form.control}
+            name="role"
+            label="Role"
+          />
+          
+          <UserTextField
+            control={form.control}
+            name="password"
+            label="Password"
+            placeholder="Enter password"
+            type="password"
+          />
+          
+          <UserTextField
+            control={form.control}
+            name="passwordConfirm"
+            label="Confirm Password"
+            placeholder="Confirm password"
+            type="password"
+          />
+        </div>
+        
+        <UserToggleField
+          control={form.control}
+          name="isActive"
+          label="Active Status"
+          description="User will be able to access the system"
+        />
+
+        <DialogFooter className="pt-4">
+          <Button type="submit" disabled={isSubmitting}>
+            {isSubmitting ? (
+              <>
+                <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+                Creating...
+              </>
+            ) : (
+              "Create User"
+            )}
+          </Button>
+        </DialogFooter>
+      </form>
+    </Form>
+  );
+};
+
+export default AddUserForm;
\ No newline at end of file
diff --git a/application/src/components/settings/user-management/form-fields/UserProfilePictureField.tsx b/application/src/components/settings/user-management/form-fields/UserProfilePictureField.tsx
new file mode 100644
index 0000000..07d4d82
--- /dev/null
+++ b/application/src/components/settings/user-management/form-fields/UserProfilePictureField.tsx
@@ -0,0 +1,76 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage } from "@/components/ui/form";
+import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { Control } from "react-hook-form";
+
+// Custom interface for local profile images
+interface ProfileImage {
+  url: string;
+  label: string;
+}
+
+// Define local profile image paths - include all uploaded SVG images
+const localProfileImages: ProfileImage[] = [
+  { url: "/upload/profile/profile1.svg", label: "Profile 1" },
+  { url: "/upload/profile/profile2.svg", label: "Profile 2" },
+  { url: "/upload/profile/profile3.svg", label: "Profile 3" },
+  { url: "/upload/profile/profile4.svg", label: "Profile 4" },
+  { url: "/upload/profile/profile5.svg", label: "Profile 5" },
+  { url: "/upload/profile/profile6.svg", label: "Profile 6" },
+  { url: "/upload/profile/profile7.svg", label: "Profile 7" },
+  { url: "/upload/profile/profile8.svg", label: "Profile 8" }
+];
+
+interface UserProfilePictureFieldProps {
+  control: Control<any>;
+}
+
+const UserProfilePictureField = ({ control }: UserProfilePictureFieldProps) => {
+  return (
+    <FormField
+      control={control}
+      name="avatar"
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>Profile Picture</FormLabel>
+          <RadioGroup
+            onValueChange={field.onChange}
+            value={field.value}
+            className="grid grid-cols-3 gap-4"
+          >
+            {localProfileImages.map((avatar) => (
+              <FormItem key={avatar.url} className="flex flex-col items-center justify-center space-y-1">
+                <FormControl>
+                  <RadioGroupItem
+                    value={avatar.url}
+                    id={`new-${avatar.url}`}
+                    className="sr-only"
+                  />
+                </FormControl>
+                <label
+                  htmlFor={`new-${avatar.url}`}
+                  className={`cursor-pointer rounded-md p-1 ${
+                    field.value === avatar.url
+                      ? "ring-2 ring-primary ring-offset-2"
+                      : ""
+                  }`}
+                >
+                  <Avatar className="h-16 w-16">
+                    <AvatarImage src={avatar.url} alt={avatar.label} />
+                    <AvatarFallback>?</AvatarFallback>
+                  </Avatar>
+                </label>
+                <div className="text-xs text-center">{avatar.label}</div>
+              </FormItem>
+            ))}
+          </RadioGroup>
+          <FormMessage />
+        </FormItem>
+      )}
+    />
+  );
+};
+
+export default UserProfilePictureField;
diff --git a/application/src/components/settings/user-management/form-fields/UserRoleField.tsx b/application/src/components/settings/user-management/form-fields/UserRoleField.tsx
new file mode 100644
index 0000000..8e8853b
--- /dev/null
+++ b/application/src/components/settings/user-management/form-fields/UserRoleField.tsx
@@ -0,0 +1,47 @@
+
+import React from "react";
+import { Control } from "react-hook-form";
+import { FormControl, FormField, FormItem, FormLabel } from "@/components/ui/form";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { userRoles } from "../userForms";
+
+interface UserRoleFieldProps {
+  control: Control<any>;
+  name: string;
+  label: string;
+  disabled?: boolean;
+}
+
+const UserRoleField = ({ control, name, label, disabled = false }: UserRoleFieldProps) => {
+  return (
+    <FormField
+      control={control}
+      name={name}
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>{label}</FormLabel>
+          <FormControl>
+            <Select 
+              value={field.value} 
+              onValueChange={field.onChange}
+              disabled={disabled}
+            >
+              <SelectTrigger className="w-full">
+                <SelectValue placeholder="Select role" />
+              </SelectTrigger>
+              <SelectContent>
+                {userRoles.map(role => (
+                  <SelectItem key={role.value} value={role.value}>
+                    {role.label}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </FormControl>
+        </FormItem>
+      )}
+    />
+  );
+};
+
+export default UserRoleField;
\ No newline at end of file
diff --git a/application/src/components/settings/user-management/form-fields/UserTextField.tsx b/application/src/components/settings/user-management/form-fields/UserTextField.tsx
new file mode 100644
index 0000000..5e5d5c1
--- /dev/null
+++ b/application/src/components/settings/user-management/form-fields/UserTextField.tsx
@@ -0,0 +1,54 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { Control } from "react-hook-form";
+
+interface UserTextFieldProps {
+  control: Control<any>;
+  name: string;
+  label: string;
+  placeholder: string;
+  type?: string;
+  required?: boolean;
+}
+
+const UserTextField = ({
+  control,
+  name,
+  label,
+  placeholder,
+  type = "text",
+  required = false
+}: UserTextFieldProps) => {
+  return (
+    <FormField
+      control={control}
+      name={name}
+      render={({ field }) => (
+        <FormItem>
+          <FormLabel>
+            {label}
+            {required && <span className="text-destructive ml-1">*</span>}
+          </FormLabel>
+          <FormControl>
+            <Input
+              type={type}
+              placeholder={placeholder}
+              {...field}
+              value={field.value || ''}
+              onChange={e => {
+                // Handle the value change properly
+                const value = e.target.value;
+                field.onChange(value);
+              }}
+            />
+          </FormControl>
+          <FormMessage />
+        </FormItem>
+      )}
+    />
+  );
+};
+
+export default UserTextField;
diff --git a/application/src/components/settings/user-management/form-fields/UserToggleField.tsx b/application/src/components/settings/user-management/form-fields/UserToggleField.tsx
new file mode 100644
index 0000000..a08f5e4
--- /dev/null
+++ b/application/src/components/settings/user-management/form-fields/UserToggleField.tsx
@@ -0,0 +1,39 @@
+
+import React from "react";
+import { FormField, FormItem, FormLabel, FormControl, FormMessage, FormDescription } from "@/components/ui/form";
+import { Switch } from "@/components/ui/switch";
+import { Control } from "react-hook-form";
+
+interface UserToggleFieldProps {
+  control: Control<any>;
+  name: string;
+  label: string;
+  description: string;
+}
+
+const UserToggleField = ({ control, name, label, description }: UserToggleFieldProps) => {
+  return (
+    <FormField
+      control={control}
+      name={name}
+      render={({ field }) => (
+        <FormItem className="flex flex-row items-center justify-between rounded-lg border p-3">
+          <div className="space-y-0.5">
+            <FormLabel>{label}</FormLabel>
+            <FormDescription>
+              {description}
+            </FormDescription>
+          </div>
+          <FormControl>
+            <Switch
+              checked={field.value}
+              onCheckedChange={field.onChange}
+            />
+          </FormControl>
+        </FormItem>
+      )}
+    />
+  );
+};
+
+export default UserToggleField;
diff --git a/application/src/components/settings/user-management/form-fields/index.ts b/application/src/components/settings/user-management/form-fields/index.ts
new file mode 100644
index 0000000..d85b438
--- /dev/null
+++ b/application/src/components/settings/user-management/form-fields/index.ts
@@ -0,0 +1,5 @@
+
+export { default as UserTextField } from "./UserTextField";
+export { default as UserToggleField } from "./UserToggleField";
+export { default as UserProfilePictureField } from "./UserProfilePictureField";
+export { default as UserRoleField } from "./UserRoleField";
\ No newline at end of file
diff --git a/application/src/components/settings/user-management/hooks/index.ts b/application/src/components/settings/user-management/hooks/index.ts
new file mode 100644
index 0000000..4868ac2
--- /dev/null
+++ b/application/src/components/settings/user-management/hooks/index.ts
@@ -0,0 +1,6 @@
+
+export * from './useUserManagement';
+export * from './useUsersList';
+export * from './useUserForm';
+export * from './useUserDialogs';
+export * from './useUserOperations';
diff --git a/application/src/components/settings/user-management/hooks/useUserDialogs.ts b/application/src/components/settings/user-management/hooks/useUserDialogs.ts
new file mode 100644
index 0000000..b56bff3
--- /dev/null
+++ b/application/src/components/settings/user-management/hooks/useUserDialogs.ts
@@ -0,0 +1,51 @@
+
+import { useState } from "react";
+import { User } from "@/services/userService";
+
+export const useUserDialogs = () => {
+  const [isDialogOpen, setIsDialogOpen] = useState(false);
+  const [isAddUserDialogOpen, setIsAddUserDialogOpen] = useState(false);
+  const [isDeleting, setIsDeleting] = useState(false);
+  const [currentUser, setCurrentUser] = useState<User | null>(null);
+  const [userToDelete, setUserToDelete] = useState<User | null>(null);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [updateError, setUpdateError] = useState<string | null>(null);
+
+  const handleEditUser = (user: User, form: any) => {
+    setUpdateError(null);
+    setCurrentUser(user);
+    form.reset({
+      full_name: user.full_name || "",
+      email: user.email,
+      username: user.username,
+      isActive: user.isActive !== undefined ? user.isActive : true,
+      role: user.role || "user",
+      avatar: user.avatar || "",
+    });
+    setIsDialogOpen(true);
+  };
+
+  const handleDeletePrompt = (user: User) => {
+    setUserToDelete(user);
+    setIsDeleting(true);
+  };
+
+  return {
+    isDialogOpen,
+    setIsDialogOpen,
+    isAddUserDialogOpen,
+    setIsAddUserDialogOpen,
+    isDeleting,
+    setIsDeleting,
+    isSubmitting,
+    setIsSubmitting,
+    updateError,
+    setUpdateError,
+    currentUser,
+    setCurrentUser,
+    userToDelete,
+    setUserToDelete,
+    handleEditUser,
+    handleDeletePrompt,
+  };
+};
diff --git a/application/src/components/settings/user-management/hooks/useUserForm.ts b/application/src/components/settings/user-management/hooks/useUserForm.ts
new file mode 100644
index 0000000..2c7d7fb
--- /dev/null
+++ b/application/src/components/settings/user-management/hooks/useUserForm.ts
@@ -0,0 +1,35 @@
+
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { userFormSchema, newUserFormSchema, UserFormValues, NewUserFormValues } from "../userForms";
+import { avatarOptions } from "../avatarOptions";
+
+export const useUserForm = () => {
+  const form = useForm<UserFormValues>({
+    resolver: zodResolver(userFormSchema),
+    defaultValues: {
+      full_name: "",
+      email: "",
+      username: "",
+      isActive: true,
+      role: "user",
+      avatar: "",
+    },
+  });
+
+  const newUserForm = useForm<NewUserFormValues>({
+    resolver: zodResolver(newUserFormSchema),
+    defaultValues: {
+      full_name: "",
+      email: "",
+      username: "",
+      password: "",
+      passwordConfirm: "",
+      isActive: true,
+      role: "user",
+      avatar: avatarOptions[Math.floor(Math.random() * avatarOptions.length)].url,
+    },
+  });
+
+  return { form, newUserForm };
+};
diff --git a/application/src/components/settings/user-management/hooks/useUserManagement.ts b/application/src/components/settings/user-management/hooks/useUserManagement.ts
new file mode 100644
index 0000000..d5c7662
--- /dev/null
+++ b/application/src/components/settings/user-management/hooks/useUserManagement.ts
@@ -0,0 +1,103 @@
+import { useUsersList } from "./useUsersList";
+import { useUserForm } from "./useUserForm";
+import { useUserDialogs } from "./useUserDialogs";
+import { useUserOperations } from "./useUserOperations";
+import { User } from "@/services/userService";
+import { UserFormValues, NewUserFormValues } from "../userForms";
+import { useState } from "react";
+
+export const useUserManagement = () => {
+  const { users, loading, error, fetchUsers } = useUsersList();
+  const { form, newUserForm } = useUserForm();
+  const {
+    isDialogOpen,
+    setIsDialogOpen,
+    isAddUserDialogOpen,
+    setIsAddUserDialogOpen,
+    isDeleting,
+    setIsDeleting,
+    isSubmitting,
+    setIsSubmitting,
+    updateError,
+    setUpdateError,
+    currentUser,
+    setCurrentUser,
+    userToDelete,
+    setUserToDelete,
+    handleEditUser: baseHandleEditUser,
+    handleDeletePrompt,
+  } = useUserDialogs();
+
+  const {
+    handleDeleteUser: baseHandleDeleteUser,
+    onSubmit: baseOnSubmit,
+    onAddUser: baseOnAddUser,
+    onImpersonate: baseOnImpersonate,
+  } = useUserOperations(
+    fetchUsers,
+    setIsDialogOpen,
+    setIsAddUserDialogOpen,
+    setIsSubmitting,
+    setIsDeleting,
+    setUpdateError,
+    newUserForm.reset
+  );
+
+  const [impersonationToken, setImpersonationToken] = useState<string | null>(null);
+  const [isImpersonationTokenDialogOpen, setIsImpersonationTokenDialogOpen] = useState(false);
+
+  // Wrapper functions to provide the needed arguments
+  const handleEditUser = (user: User) => {
+    baseHandleEditUser(user, form);
+  };
+
+  const handleDeleteUser = async () => {
+    await baseHandleDeleteUser(userToDelete);
+    setUserToDelete(null);
+  };
+
+  const onSubmit = (data: UserFormValues) => {
+    baseOnSubmit(data, currentUser);
+  };
+
+  const onImpersonate = async (data: UserFormValues) => {
+    const token = await baseOnImpersonate(data, currentUser);
+
+    if (token) {
+      setImpersonationToken(token);
+      setIsImpersonationTokenDialogOpen(true);
+    }
+  };
+
+  const onAddUser = (data: NewUserFormValues) => {
+    baseOnAddUser(data);
+  };
+
+  return {
+    users,
+    loading,
+    error,
+    isDialogOpen,
+    setIsDialogOpen,
+    isAddUserDialogOpen,
+    setIsAddUserDialogOpen,
+    isDeleting,
+    setIsDeleting,
+    isSubmitting,
+    updateError,
+    form,
+    newUserForm,
+    currentUser,
+    userToDelete,
+    fetchUsers,
+    handleEditUser,
+    handleDeletePrompt,
+    handleDeleteUser,
+    onSubmit,
+    onImpersonate,
+    onAddUser,
+    impersonationToken,
+    isImpersonationTokenDialogOpen,
+    setIsImpersonationTokenDialogOpen,
+  };
+};
diff --git a/application/src/components/settings/user-management/hooks/useUserOperations.ts b/application/src/components/settings/user-management/hooks/useUserOperations.ts
new file mode 100644
index 0000000..5b641d9
--- /dev/null
+++ b/application/src/components/settings/user-management/hooks/useUserOperations.ts
@@ -0,0 +1,214 @@
+import { useState } from "react";
+import { useToast } from "@/hooks/use-toast";
+import { userService, User, UpdateUserData, CreateUserData } from "@/services/userService";
+import { UserFormValues, NewUserFormValues } from "../userForms";
+import { avatarOptions } from "../avatarOptions";
+import { authService } from "@/services/authService";
+import { useNavigate } from "react-router-dom";
+
+export const useUserOperations = (
+  fetchUsers: () => Promise<void>,
+  setIsDialogOpen: (isOpen: boolean) => void,
+  setIsAddUserDialogOpen: (isOpen: boolean) => void,
+  setIsSubmitting: (isSubmitting: boolean) => void,
+  setIsDeleting: (isDeleting: boolean) => void,
+  setUpdateError: (error: string | null) => void,
+  newUserFormReset: (values: any) => void
+) => {
+  const { toast } = useToast();
+  const navigate = useNavigate();
+
+  const handleDeleteUser = async (userToDelete: User | null) => {
+    if (!userToDelete) return;
+
+    try {
+      const success = await userService.deleteUser(userToDelete.id);
+      if (success) {
+        toast({
+          title: "User deleted",
+          description: `${userToDelete.full_name || userToDelete.username} has been deleted.`,
+        });
+        fetchUsers();
+      } else {
+        throw new Error("Failed to delete user");
+      }
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Could not delete user. Please try again later.",
+        variant: "destructive",
+      });
+    } finally {
+      setIsDeleting(false);
+    }
+  };
+
+  const onSubmit = async (data: UserFormValues, currentUser: User | null) => {
+    if (!currentUser) return;
+    setIsSubmitting(true);
+    setUpdateError(null);
+
+    try {
+      // Get current logged-in user to check if we're editing ourselves
+      const loggedInUser = authService.getCurrentUser();
+      const isEditingSelf = loggedInUser?.id === currentUser.id;
+      const isEmailChanged = data.email !== currentUser.email;
+      
+      // Create update object with only the fields we want to update
+      const updateData: UpdateUserData = {
+        full_name: data.full_name,
+        email: data.email,
+        username: data.username,
+        role: data.role,
+        isActive: data.isActive,
+      };
+      
+      // For avatar, only include if it's different from current one
+      if (data.avatar && data.avatar !== currentUser.avatar) {
+        updateData.avatar = data.avatar;
+      }
+
+      console.log("Submitting user update with data:", updateData);
+      
+      await userService.updateUser(currentUser.id, updateData);
+      
+      // Handle email change for current user
+      if (isEditingSelf && isEmailChanged) {
+        toast({
+          title: "Email changed successfully",
+          description: "You will be logged out for security reasons. Please log in again with your new email.",
+          variant: "default",
+        });
+        
+        setIsDialogOpen(false);
+        
+        // Auto-logout after 2 seconds if editing own email
+        setTimeout(() => {
+          authService.logout();
+          navigate("/login");
+        }, 2000);
+        
+        return; // Don't continue with normal flow
+      }
+      
+      // Normal success flow for other users or non-email changes
+      toast({
+        title: "User updated",
+        description: `${data.full_name || data.username}'s profile has been updated.`,
+      });
+      
+      setIsDialogOpen(false);
+      await fetchUsers();
+    } catch (error: any) {
+      console.error("Error updating user:", error);
+      let errorMessage = "Failed to update user. Please check your inputs and try again.";
+      
+      if (error.data?.message) {
+        errorMessage = error.data.message;
+      } else if (error.message) {
+        errorMessage = error.message;
+      }
+      
+      setUpdateError(errorMessage);
+      toast({
+        title: "Error updating user",
+        description: errorMessage,
+        variant: "destructive",
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const onImpersonate = async (
+    data: UserFormValues & { durationSeconds?: number },
+    currentUser: User | null
+  ): Promise<string | undefined> => {
+    const loggedInUser = authService.getCurrentUser();
+    if (!currentUser) return;
+
+    try {
+      const token = await authService.impersonateUser(currentUser.id, data?.durationSeconds ?? 3600);
+
+      toast({
+        title: "Impersonation token generated",
+        description: `Token generated for ${currentUser.full_name || currentUser.username}.`,
+      });
+
+      return token;
+    } catch (error) {
+      let description = "Error impersonating user.";
+      if (loggedInUser?.role !== "superadmin") {
+        description = "Only superadmin users can impersonate other users.";
+      }
+
+      toast({
+        title: "Error impersonating user",
+        description,
+        variant: "destructive",
+      });
+
+      throw error;
+    }
+  };
+
+  const onAddUser = async (data: NewUserFormValues) => {
+    setIsSubmitting(true);
+    try {
+      const newUserData: CreateUserData = {
+        username: data.username,
+        email: data.email,
+        password: data.password,
+        passwordConfirm: data.passwordConfirm,
+        full_name: data.full_name,
+        role: data.role,
+        isActive: data.isActive,
+        avatar: data.avatar,
+        emailVisibility: true,
+      };
+
+      await userService.createUser(newUserData);
+      
+      toast({
+        title: "User created",
+        description: `${data.full_name || data.username} has been added successfully.`,
+      });
+      
+      setIsAddUserDialogOpen(false);
+      newUserFormReset({
+        full_name: "",
+        email: "",
+        username: "",
+        password: "",
+        passwordConfirm: "",
+        isActive: true,
+        role: "user",
+        avatar: avatarOptions[0].url,
+      });
+      await fetchUsers();
+    } catch (error: any) {
+      let errorMessage = "Could not create user. Please try again later.";
+      
+      if (error.data?.message) {
+        errorMessage = error.data.message;
+      } else if (error.message) {
+        errorMessage = error.message;
+      }
+      
+      toast({
+        title: "Error creating user",
+        description: errorMessage,
+        variant: "destructive",
+      });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  return {
+    handleDeleteUser,
+    onSubmit,
+    onImpersonate,
+    onAddUser,
+  };
+};
\ No newline at end of file
diff --git a/application/src/components/settings/user-management/hooks/useUsersList.ts b/application/src/components/settings/user-management/hooks/useUsersList.ts
new file mode 100644
index 0000000..288d903
--- /dev/null
+++ b/application/src/components/settings/user-management/hooks/useUsersList.ts
@@ -0,0 +1,53 @@
+
+import { useState, useEffect } from "react";
+import { useToast } from "@/hooks/use-toast";
+import { userService, User } from "@/services/userService";
+
+export const useUsersList = () => {
+  const { toast } = useToast();
+  const [users, setUsers] = useState<User[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  const fetchUsers = async () => {
+    setLoading(true);
+    setError(null);
+    try {
+     // console.log("Fetching users list");
+      const data = await userService.getUsers();
+    //  console.log("Received users data:", data);
+      
+      if (Array.isArray(data) && data.length >= 0) {
+        setUsers(data);
+        // Clear any previous errors
+        setError(null);
+      } else {
+     //   console.error("Invalid users data format:", data);
+        setUsers([]);
+        setError("Invalid data format received from server");
+        toast({
+          title: "Warning",
+          description: "No users found or could not load users.",
+          variant: "destructive",
+        });
+      }
+    } catch (error) {
+    //  console.error("Error fetching users:", error);
+      setError(error instanceof Error ? error.message : "Unknown error");
+      toast({
+        title: "Error fetching users",
+        description: "Could not load users. Please try again later.",
+        variant: "destructive",
+      });
+      setUsers([]);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  useEffect(() => {
+    fetchUsers();
+  }, []);
+
+  return { users, loading, error, fetchUsers };
+};
diff --git a/application/src/components/settings/user-management/index.ts b/application/src/components/settings/user-management/index.ts
new file mode 100644
index 0000000..7b2d575
--- /dev/null
+++ b/application/src/components/settings/user-management/index.ts
@@ -0,0 +1,3 @@
+
+import UserManagement from "./UserManagement";
+export default UserManagement;
diff --git a/application/src/components/settings/user-management/userForms.ts b/application/src/components/settings/user-management/userForms.ts
new file mode 100644
index 0000000..c90e1d9
--- /dev/null
+++ b/application/src/components/settings/user-management/userForms.ts
@@ -0,0 +1,40 @@
+
+import * as z from "zod";
+
+// Define the available roles
+export const userRoles = [
+  { label: "Admin", value: "admin" },
+  { label: "Super Admin", value: "superadmin" }
+];
+
+export const userFormSchema = z.object({
+  full_name: z.string().min(2, {
+    message: "Name must be at least 2 characters.",
+  }),
+  email: z.string().email({
+    message: "Please enter a valid email address.",
+  }),
+  username: z.string().min(3, {
+    message: "Username must be at least 3 characters.",
+  }),
+  isActive: z.boolean().optional(),
+  role: z.string().min(1, {
+    message: "Please select a role",
+  }),
+  avatar: z.string().optional(),
+});
+
+export const newUserFormSchema = userFormSchema.extend({
+  password: z.string().min(8, {
+    message: "Password must be at least 8 characters.",
+  }),
+  passwordConfirm: z.string().min(8, {
+    message: "Password confirmation must be at least 8 characters.",
+  }),
+}).refine((data) => data.password === data.passwordConfirm, {
+  message: "Passwords don't match",
+  path: ["passwordConfirm"],
+});
+
+export type UserFormValues = z.infer<typeof userFormSchema>;
+export type NewUserFormValues = z.infer<typeof newUserFormSchema>;
\ No newline at end of file
diff --git a/application/src/components/ssl-domain/AddSSLCertificateForm.tsx b/application/src/components/ssl-domain/AddSSLCertificateForm.tsx
new file mode 100644
index 0000000..c601acb
--- /dev/null
+++ b/application/src/components/ssl-domain/AddSSLCertificateForm.tsx
@@ -0,0 +1,305 @@
+
+import React, { useEffect, useState } from "react";
+import { useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import * as z from "zod";
+import { toast } from "sonner";
+import { Bell, X } from "lucide-react";
+
+import { Form, FormControl, FormDescription, FormField, FormItem, FormLabel, FormMessage } from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import { Button } from "@/components/ui/button";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { DialogFooter } from "@/components/ui/dialog";
+import { Badge } from "@/components/ui/badge";
+import { AddSSLCertificateDto } from "@/types/ssl.types";
+import { alertConfigService, AlertConfiguration } from "@/services/alertConfigService";
+import { sslNotificationTemplateService, SslNotificationTemplate } from "@/services/sslNotificationTemplateService";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface AddSSLCertificateFormProps {
+  onSubmit: (data: AddSSLCertificateDto) => Promise<void>;
+  onCancel: () => void;
+  isPending?: boolean;
+}
+
+export const AddSSLCertificateForm = ({
+  onSubmit,
+  onCancel,
+  isPending = false
+}: AddSSLCertificateFormProps) => {
+  const { t } = useLanguage();
+
+  const formSchema = z.object({
+    domain: z.string()
+      .min(1, t("domain") + " is required")
+      .refine(
+        (value) => !/\s/.test(value),
+        t("spacesNotAllowed")
+      ),
+    warning_threshold: z.coerce.number().int().min(1).max(365),
+    expiry_threshold: z.coerce.number().int().min(1).max(30),
+    notification_channels: z.array(z.string()).optional(),
+    alert_template: z.string().optional(),
+    check_interval: z.coerce.number().int().min(1).max(30).optional()
+  });
+
+  const [alertConfigs, setAlertConfigs] = useState<AlertConfiguration[]>([]);
+  const [sslTemplates, setSslTemplates] = useState<SslNotificationTemplate[]>([]);
+  const [isLoading, setIsLoading] = useState(false);
+
+  const form = useForm<z.infer<typeof formSchema>>({
+    resolver: zodResolver(formSchema),
+    defaultValues: {
+      domain: "",
+      warning_threshold: 30,
+      expiry_threshold: 7,
+      notification_channels: [],
+      alert_template: "none",
+      check_interval: 1
+    }
+  });
+
+  // Fetch notification channels and SSL templates when form loads
+  useEffect(() => {
+    const fetchData = async () => {
+      setIsLoading(true);
+      try {
+        // Fetch notification channels
+        const configs = await alertConfigService.getAlertConfigurations();
+        const enabledConfigs = configs.filter(config => {
+          if (typeof config.enabled === 'string') {
+            return config.enabled === "true";
+          }
+          return config.enabled === true;
+        });
+        setAlertConfigs(enabledConfigs);
+
+        // Fetch SSL notification templates
+        const templates = await sslNotificationTemplateService.getTemplates();
+        setSslTemplates(templates);
+      } catch (error) {
+        toast.error(t('failedToLoadCertificates'));
+      } finally {
+        setIsLoading(false);
+      }
+    };
+
+    fetchData();
+  }, [t]);
+
+  const handleSubmit = async (values: z.infer<typeof formSchema>) => {
+    try {
+      // Convert the form values to the required DTO format
+      const certData: AddSSLCertificateDto = {
+        domain: values.domain,
+        warning_threshold: values.warning_threshold,
+        expiry_threshold: values.expiry_threshold,
+        notification_channel: values.notification_channels && values.notification_channels.length > 0
+          ? values.notification_channels.join(',')
+          : '',
+        notification_id: values.notification_channels && values.notification_channels.length > 0
+          ? values.notification_channels.join(',')
+          : '',
+        template_id: values.alert_template && values.alert_template !== 'none' ? values.alert_template : '',
+        check_interval: values.check_interval
+      };
+
+      await onSubmit(certData);
+      form.reset();
+    } catch (error) {
+      toast.error(t('failedToAddCertificate'));
+    }
+  };
+
+  const handleAddNotificationChannel = (channelId: string) => {
+    const currentChannels = form.getValues("notification_channels") || [];
+    if (!currentChannels.includes(channelId)) {
+      form.setValue("notification_channels", [...currentChannels, channelId]);
+    }
+  };
+
+  const handleRemoveNotificationChannel = (channelId: string) => {
+    const currentChannels = form.getValues("notification_channels") || [];
+    form.setValue("notification_channels", currentChannels.filter(id => id !== channelId));
+  };
+
+  const selectedChannels = form.watch("notification_channels") || [];
+
+  return (
+    <Form {...form}>
+      <form onSubmit={form.handleSubmit(handleSubmit)} className="space-y-6">
+        <FormField
+          control={form.control}
+          name="domain"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t('domain')}</FormLabel>
+              <FormControl>
+                <Input placeholder="example.com" {...field} />
+              </FormControl>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+          <FormField
+            control={form.control}
+            name="warning_threshold"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('warningThreshold')}</FormLabel>
+                <FormControl>
+                  <Input type="number" {...field} />
+                </FormControl>
+                <FormDescription>
+                  {t('getNotifiedExpiration')}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+          <FormField
+            control={form.control}
+            name="expiry_threshold"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('expiryThreshold')}</FormLabel>
+                <FormControl>
+                  <Input type="number" {...field} />
+                </FormControl>
+                <FormDescription>
+                  {t('getNotifiedCritical')}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+        </div>
+
+        <FormField
+          control={form.control}
+          name="check_interval"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Check Interval (Days)</FormLabel>
+              <FormControl>
+                <Input type="number" min="1" max="30" {...field} />
+              </FormControl>
+              <FormDescription>
+                How often to check the SSL certificate (in days)
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+        <FormField
+          control={form.control}
+          name="notification_channels"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t('notificationChannel')} (Multi-select)</FormLabel>
+              <div className="space-y-3">
+                <Select
+                  onValueChange={handleAddNotificationChannel}
+                  value=""
+                >
+                  <FormControl>
+                    <SelectTrigger>
+                      <SelectValue placeholder="Select channels to add..." />
+                    </SelectTrigger>
+                  </FormControl>
+                  <SelectContent>
+                    {alertConfigs.length > 0 ? (
+                      alertConfigs
+                        .filter(config => config.id && !selectedChannels.includes(config.id))
+                        .map((config) => (
+                          <SelectItem key={config.id} value={config.id || "unknown"}>
+                            {config.notify_name} ({config.notification_type})
+                          </SelectItem>
+                        ))
+                    ) : isLoading ? (
+                      <SelectItem value="loading-placeholder" disabled>{t('loadingChannels')}</SelectItem>
+                    ) : (
+                      <SelectItem value="no-channels-placeholder" disabled>{t('noChannelsFound')}</SelectItem>
+                    )}
+                  </SelectContent>
+                </Select>
+
+                {/* Display selected channels */}
+                {selectedChannels.length > 0 && (
+                  <div className="flex flex-wrap gap-2">
+                    {selectedChannels.map((channelId) => {
+                      const channel = alertConfigs.find(config => config.id === channelId);
+                      return (
+                        <Badge key={channelId} variant="secondary" className="flex items-center gap-1">
+                          {channel ? `${channel.notify_name} (${channel.notification_type})` : channelId}
+                          <Button
+                            type="button"
+                            variant="ghost"
+                            size="sm"
+                            className="h-auto p-0 ml-1"
+                            onClick={() => handleRemoveNotificationChannel(channelId)}
+                          >
+                            <X className="h-3 w-3" />
+                          </Button>
+                        </Badge>
+                      );
+                    })}
+                  </div>
+                )}
+              </div>
+              <FormDescription className="flex items-center gap-1">
+                <Bell className="h-4 w-4" />
+                {t('whereToSend')}
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="alert_template"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Alert Template</FormLabel>
+              <Select onValueChange={field.onChange} value={field.value || "none"}>
+                <FormControl>
+                  <SelectTrigger>
+                    <SelectValue placeholder="Choose an alert template (optional)" />
+                  </SelectTrigger>
+                </FormControl>
+                <SelectContent>
+                  <SelectItem value="none">None</SelectItem>
+                  {sslTemplates.length > 0 ? (
+                    sslTemplates.map((template) => (
+                      <SelectItem key={template.id} value={template.id}>
+                        {template.name}
+                      </SelectItem>
+                    ))
+                  ) : isLoading ? (
+                    <SelectItem value="loading-templates" disabled>Loading templates...</SelectItem>
+                  ) : (
+                    <SelectItem value="no-templates-found" disabled>No templates found</SelectItem>
+                  )}
+                </SelectContent>
+              </Select>
+              <FormDescription>
+                Template for SSL certificate alert messages
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+        <DialogFooter>
+          <Button type="button" variant="outline" onClick={onCancel}>{t('cancel')}</Button>
+          <Button type="submit" disabled={isPending || isLoading}>
+            {t('addCertificate')}
+          </Button>
+        </DialogFooter>
+      </form>
+    </Form>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/ssl-domain/EditSSLCertificateForm.tsx b/application/src/components/ssl-domain/EditSSLCertificateForm.tsx
new file mode 100644
index 0000000..eb8ee59
--- /dev/null
+++ b/application/src/components/ssl-domain/EditSSLCertificateForm.tsx
@@ -0,0 +1,385 @@
+
+import React, { useEffect, useState } from "react";
+import { useForm } from "react-hook-form";
+import { z } from "zod";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Form, FormControl, FormDescription, FormField, FormItem, FormLabel, FormMessage } from "@/components/ui/form";
+import { Badge } from "@/components/ui/badge";
+import { SSLCertificate } from "@/types/ssl.types";
+import { Loader2, Bell, X } from "lucide-react";
+import { toast } from "sonner";
+import { alertConfigService, AlertConfiguration } from "@/services/alertConfigService";
+import { sslNotificationTemplateService, SslNotificationTemplate } from "@/services/sslNotificationTemplateService";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+const formSchema = z.object({
+  domain: z.string().min(1, "Domain is required"),
+  warning_threshold: z.coerce.number().min(1, "Warning threshold must be at least 1 day"),
+  expiry_threshold: z.coerce.number().min(1, "Expiry threshold must be at least 1 day"),
+  notification_channels: z.array(z.string()).default([]),
+  alert_template: z.string().optional(),
+  check_interval: z.coerce.number().int().min(1).max(30).optional(),
+});
+
+type FormValues = z.infer<typeof formSchema>;
+
+interface EditSSLCertificateFormProps {
+  certificate: SSLCertificate;
+  onSubmit: (data: SSLCertificate) => void;
+  onCancel: () => void;
+  isPending: boolean;
+}
+
+export const EditSSLCertificateForm = ({ certificate, onSubmit, onCancel, isPending }: EditSSLCertificateFormProps) => {
+  const { t } = useLanguage();
+  const [alertConfigs, setAlertConfigs] = useState<AlertConfiguration[]>([]);
+  const [sslTemplates, setSslTemplates] = useState<SslNotificationTemplate[]>([]);
+  const [isLoading, setIsLoading] = useState(false);
+  
+  // Parse existing notification channels from certificate data
+  const parseNotificationChannels = (cert: SSLCertificate): string[] => {
+    const channels: string[] = [];
+    
+    // Check notification_id field first (multi-channel support)
+    if (cert.notification_id && cert.notification_id.trim()) {
+      channels.push(...cert.notification_id.split(',').map(id => id.trim()).filter(Boolean));
+    }
+    // Fallback to notification_channel field
+    else if (cert.notification_channel && cert.notification_channel.trim()) {
+      channels.push(...cert.notification_channel.split(',').map(id => id.trim()).filter(Boolean));
+    }
+    return channels;
+  };
+
+  // Get the alert template from certificate data
+  const getAlertTemplate = (cert: SSLCertificate): string => {
+    let templateId = "";
+    
+    // Check template_id field first (new field for PocketBase)
+    if (cert.template_id && cert.template_id.trim()) {
+      templateId = cert.template_id;
+    }
+    // Fallback to alert_template field
+    else if (cert.alert_template && cert.alert_template.trim()) {
+      templateId = cert.alert_template;
+    }
+
+    return templateId || "none";
+  };
+  
+  const form = useForm<FormValues>({
+    resolver: zodResolver(formSchema),
+    defaultValues: {
+      domain: certificate.domain,
+      warning_threshold: certificate.warning_threshold,
+      expiry_threshold: certificate.expiry_threshold,
+      notification_channels: parseNotificationChannels(certificate),
+      alert_template: getAlertTemplate(certificate),
+      check_interval: certificate.check_interval || 1,
+    },
+  });
+
+  const notificationChannels = form.watch("notification_channels") || [];
+
+  // Fetch notification channels and SSL templates when form loads
+  useEffect(() => {
+    const fetchData = async () => {
+      setIsLoading(true);
+      try {
+        // Fetch notification channels
+        const configs = await alertConfigService.getAlertConfigurations();
+        const enabledConfigs = configs.filter(config => {
+          if (typeof config.enabled === 'string') {
+            return config.enabled === "true";
+          }
+          return config.enabled === true;
+        });
+        setAlertConfigs(enabledConfigs);
+
+        // Fetch SSL notification templates
+        const templates = await sslNotificationTemplateService.getTemplates();
+        setSslTemplates(templates);
+      } catch (error) {
+        toast.error(t('failedToLoadCertificates'));
+      } finally {
+        setIsLoading(false);
+      }
+    };
+    
+    fetchData();
+  }, [t]);
+
+  // Update form values when certificate data changes
+  useEffect(() => {
+    if (certificate) {
+      const channels = parseNotificationChannels(certificate);
+      const template = getAlertTemplate(certificate);
+      
+      form.reset({
+        domain: certificate.domain,
+        warning_threshold: certificate.warning_threshold,
+        expiry_threshold: certificate.expiry_threshold,
+        notification_channels: channels,
+        alert_template: template,
+        check_interval: certificate.check_interval || 1,
+      });
+      
+    }
+  }, [certificate, form]);
+
+  const handleChannelAdd = (channelId: string) => {
+    const currentChannels = form.getValues("notification_channels") || [];
+    if (!currentChannels.includes(channelId)) {
+      const newChannels = [...currentChannels, channelId];
+      form.setValue("notification_channels", newChannels);
+    }
+  };
+
+  const handleChannelRemove = (channelId: string) => {
+    const currentChannels = form.getValues("notification_channels") || [];
+    const newChannels = currentChannels.filter(id => id !== channelId);
+    form.setValue("notification_channels", newChannels);
+  };
+
+  const getSelectedChannelNames = () => {
+    return (notificationChannels || []).map(channelId => {
+      const config = alertConfigs.find(c => c.id === channelId);
+      return config ? `${config.notify_name} (${config.notification_type})` : channelId;
+    });
+  };
+
+  const handleSubmit = (data: FormValues) => {  
+    // Merge the updated values with the original certificate
+    const updatedCertificate: SSLCertificate = {
+      ...certificate,
+      ...data,
+      
+      notification_channel: data.notification_channels.length > 0 ? data.notification_channels.join(',') : '',
+      notification_id: data.notification_channels.length > 0 ? data.notification_channels.join(',') : '',
+      template_id: data.alert_template && data.alert_template !== 'none' ? data.alert_template : '',
+      warning_threshold: Number(data.warning_threshold),
+      expiry_threshold: Number(data.expiry_threshold),
+      check_interval: data.check_interval ? Number(data.check_interval) : undefined
+    };
+    
+    onSubmit(updatedCertificate);
+  };
+
+  return (
+    <Form {...form}>
+      <form onSubmit={form.handleSubmit(handleSubmit)} className="space-y-4">
+        <FormField
+          control={form.control}
+          name="domain"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t('domainName')}</FormLabel>
+              <FormControl>
+                <Input 
+                  {...field}
+                  placeholder="example.com" 
+                  disabled={true}
+                />
+              </FormControl>
+              <FormDescription>
+                {t('domainCannotChange')}
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+        
+        <div className="grid grid-cols-1 md:grid-cols-3 gap-4">
+          <FormField
+            control={form.control}
+            name="warning_threshold"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('warningThresholdDays')}</FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field}
+                    type="number"
+                    min="1"
+                    placeholder="30" 
+                  />
+                </FormControl>
+                <FormDescription>
+                  {t('daysBeforeExpiration')}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+          
+          <FormField
+            control={form.control}
+            name="expiry_threshold"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>{t('expiryThresholdDays')}</FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field}
+                    type="number"
+                    min="1"
+                    placeholder="7" 
+                  />
+                </FormControl>
+                <FormDescription>
+                  {t('daysBeforeCritical')}
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+
+          <FormField
+            control={form.control}
+            name="check_interval"
+            render={({ field }) => (
+              <FormItem>
+                <FormLabel>Check Interval (Days)</FormLabel>
+                <FormControl>
+                  <Input 
+                    {...field}
+                    type="number"
+                    min="1"
+                    max="30"
+                    placeholder="1" 
+                  />
+                </FormControl>
+                <FormDescription>
+                  How often to check
+                </FormDescription>
+                <FormMessage />
+              </FormItem>
+            )}
+          />
+        </div>
+        
+        <FormField
+          control={form.control}
+          name="notification_channels"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>{t('notificationChannel')}</FormLabel>
+              <FormDescription>
+                Select multiple notification channels for this SSL certificate
+              </FormDescription>
+              
+              {/* Display selected channels as badges */}
+              {notificationChannels && notificationChannels.length > 0 && (
+                <div className="flex flex-wrap gap-2 mb-2">
+                  {getSelectedChannelNames().map((channelName, index) => (
+                    <Badge key={notificationChannels[index]} variant="secondary" className="flex items-center gap-1">
+                      {channelName}
+                      <X 
+                        className="h-3 w-3 cursor-pointer" 
+                        onClick={() => handleChannelRemove(notificationChannels[index])}
+                      />
+                    </Badge>
+                  ))}
+                </div>
+              )}
+              
+              <FormControl>
+                <Select 
+                  onValueChange={handleChannelAdd}
+                  disabled={isLoading}
+                  value=""
+                >
+                  <SelectTrigger>
+                    <SelectValue placeholder={t('chooseChannel')} />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {alertConfigs
+                      .filter(config => config.id && !notificationChannels?.includes(config.id))
+                      .map((config) => (
+                        <SelectItem key={config.id} value={config.id || "unknown"}>
+                          {config.notify_name} ({config.notification_type})
+                        </SelectItem>
+                      ))}
+                    {alertConfigs.filter(config => config.id && !notificationChannels?.includes(config.id)).length === 0 && (
+                      <SelectItem value="no-available-channels" disabled>No available channels</SelectItem>
+                    )}
+                  </SelectContent>
+                </Select>
+              </FormControl>
+              <FormDescription className="flex items-center gap-1">
+                <Bell className="h-4 w-4" /> 
+                {t('whereToSend')}
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <FormField
+          control={form.control}
+          name="alert_template"
+          render={({ field }) => (
+            <FormItem>
+              <FormLabel>Alert Template</FormLabel>
+              <FormControl>
+                <Select 
+                  onValueChange={field.onChange} 
+                  value={field.value || "none"}
+                  disabled={isLoading}
+                >
+                  <SelectTrigger>
+                    <SelectValue placeholder={isLoading ? "Loading templates..." : "Select an alert template"} />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="none">None</SelectItem>
+                    {sslTemplates?.map((template) => (
+                      <SelectItem key={template.id} value={template.id}>
+                        {template.name}
+                      </SelectItem>
+                    ))}
+                    {sslTemplates?.length === 0 && !isLoading && (
+                      <SelectItem value="no-templates-available" disabled>No templates found</SelectItem>
+                    )}
+                    {isLoading && (
+                      <SelectItem value="loading-templates-placeholder" disabled>Loading templates...</SelectItem>
+                    )}
+                  </SelectContent>
+                </Select>
+              </FormControl>
+              <FormDescription>
+                Choose a template for SSL certificate alert messages
+              </FormDescription>
+              <FormMessage />
+            </FormItem>
+          )}
+        />
+
+        <div className="flex justify-end gap-3 pt-4">
+          <Button 
+            type="button" 
+            variant="outline" 
+            onClick={onCancel}
+            disabled={isPending}
+          >
+            {t('cancel')}
+          </Button>
+          <Button 
+            type="submit" 
+            disabled={isPending}
+          >
+            {isPending ? (
+              <>
+                <Loader2 className="mr-2 h-4 w-4 animate-spin" /> {t('updating')}
+              </>
+            ) : (
+              t('saveChanges')
+            )}
+          </Button>
+        </div>
+      </form>
+    </Form>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/ssl-domain/SSLCertificateActions.tsx b/application/src/components/ssl-domain/SSLCertificateActions.tsx
new file mode 100644
index 0000000..68ad461
--- /dev/null
+++ b/application/src/components/ssl-domain/SSLCertificateActions.tsx
@@ -0,0 +1,70 @@
+
+import React from "react";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import { Button } from "@/components/ui/button";
+import { MoreHorizontal, RefreshCw, Edit, Trash2, Eye } from "lucide-react";
+import { SSLCertificate } from "@/types/ssl.types";
+import { triggerImmediateCheck } from "@/services/sslCertificateService";
+import { toast } from "sonner";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface SSLCertificateActionsProps {
+  certificate: SSLCertificate;
+  onView: (certificate: SSLCertificate) => void;
+  onEdit: (certificate: SSLCertificate) => void;
+  onDelete: (certificate: SSLCertificate) => void;
+}
+
+export const SSLCertificateActions = ({ 
+  certificate, 
+  onView,
+  onEdit, 
+  onDelete 
+}: SSLCertificateActionsProps) => {
+  const { t } = useLanguage();
+
+  const handleCheck = async () => {
+    try {
+      await triggerImmediateCheck(certificate.id);
+    } catch (error) {
+      console.error("Error triggering SSL check:", error);
+    }
+  };
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild>
+        <Button variant="ghost" className="h-8 w-8 p-0">
+          <span className="sr-only">Open menu</span>
+          <MoreHorizontal className="h-4 w-4" />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end">
+        <DropdownMenuItem onClick={(e) => { e.stopPropagation(); onView(certificate); }}>
+          <Eye className="mr-2 h-4 w-4" />
+          {t('view')}
+        </DropdownMenuItem>
+        <DropdownMenuItem onClick={(e) => { e.stopPropagation(); handleCheck(); }}>
+          <RefreshCw className="mr-2 h-4 w-4" />
+          Check
+        </DropdownMenuItem>
+        <DropdownMenuItem onClick={(e) => { e.stopPropagation(); onEdit(certificate); }}>
+          <Edit className="mr-2 h-4 w-4" />
+          {t('edit')}
+        </DropdownMenuItem>
+        <DropdownMenuItem 
+          onClick={(e) => { e.stopPropagation(); onDelete(certificate); }}
+          className="text-destructive"
+        >
+          <Trash2 className="mr-2 h-4 w-4" />
+          {t('delete')}
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+};
diff --git a/application/src/components/ssl-domain/SSLCertificateDetailDialog.tsx b/application/src/components/ssl-domain/SSLCertificateDetailDialog.tsx
new file mode 100644
index 0000000..b0e5232
--- /dev/null
+++ b/application/src/components/ssl-domain/SSLCertificateDetailDialog.tsx
@@ -0,0 +1,244 @@
+
+import React from "react";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Separator } from "@/components/ui/separator";
+import { SSLCertificate } from "@/types/ssl.types";
+import { SSLStatusBadge } from "./SSLStatusBadge";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface SSLCertificateDetailDialogProps {
+  certificate: SSLCertificate | null;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+export const SSLCertificateDetailDialog = ({
+  certificate,
+  open,
+  onOpenChange,
+}: SSLCertificateDetailDialogProps) => {
+  const { t } = useLanguage();
+
+  if (!certificate) return null;
+
+  // Parse Subject Alternative Names for better display
+  const formatSANs = (sans: string): string[] => {
+    if (!sans) return [];
+    
+    // Split by common delimiters and clean up
+    const sansList = sans
+      .split(/[,;\n]/)
+      .map(san => san.trim())
+      .filter(san => san.length > 0);
+    
+    return sansList;
+  };
+
+  const sansList = certificate.cert_sans ? formatSANs(certificate.cert_sans) : [];
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-4xl max-h-[90vh] overflow-y-auto">
+        <DialogHeader>
+          <DialogTitle className="text-xl font-bold">{t('sslCertificateDetails')}</DialogTitle>
+          <DialogDescription className="text-sm text-muted-foreground">
+            {t('viewDetailedInformation')} {certificate.domain}
+          </DialogDescription>
+        </DialogHeader>
+        
+        <div className="space-y-6">
+          {/* Domain & Status Overview */}
+          <Card>
+            <CardHeader>
+              <CardTitle className="text-lg flex items-center justify-between">
+                <span>{certificate.domain}</span>
+                <SSLStatusBadge status={certificate.status} />
+              </CardTitle>
+            </CardHeader>
+            <CardContent>
+              <div className="grid grid-cols-1 md:grid-cols-3 gap-6">
+                <div className="space-y-3">
+                  <div>
+                    <p className="text-sm font-medium text-muted-foreground">{t('status')}</p>
+                    <SSLStatusBadge status={certificate.status} />
+                  </div>
+                  <div>
+                    <p className="text-sm font-medium text-muted-foreground">{t('daysLeft')}</p>
+                    <Badge variant={certificate.days_left <= 7 ? 'destructive' : certificate.days_left <= 30 ? 'secondary' : 'default'}>
+                      {certificate.days_left} {t('days')}
+                    </Badge>
+                  </div>
+                </div>
+                <div className="space-y-3">
+                  <div>
+                    <p className="text-sm font-medium text-muted-foreground">{t('validFrom')}</p>
+                    <p className="text-sm">
+                      {certificate.valid_from ? new Date(certificate.valid_from).toLocaleString() : 'N/A'}
+                    </p>
+                  </div>
+                  <div>
+                    <p className="text-sm font-medium text-muted-foreground">{t('validUntil')}</p>
+                    <p className="text-sm">
+                      {certificate.valid_till ? new Date(certificate.valid_till).toLocaleString() : 'N/A'}
+                    </p>
+                  </div>
+                </div>
+                <div className="space-y-3">
+                  <div>
+                    <p className="text-sm font-medium text-muted-foreground">{t('validityPeriod')}</p>
+                    <p className="text-sm">{certificate.validity_days || 0} {t('days')}</p>
+                  </div>
+                  {certificate.resolved_ip && (
+                    <div>
+                      <p className="text-sm font-medium text-muted-foreground">{t('resolvedIP')}</p>
+                      <p className="text-sm font-mono bg-muted px-2 py-1 rounded">{certificate.resolved_ip}</p>
+                    </div>
+                  )}
+                </div>
+              </div>
+            </CardContent>
+          </Card>
+
+          {/* Certificate Information */}
+          <Card>
+            <CardHeader>
+              <CardTitle className="text-lg">{t('certificateDetails')}</CardTitle>
+            </CardHeader>
+            <CardContent className="space-y-4">
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-6">
+                <div className="space-y-4">
+                  <div>
+                    <p className="text-sm font-medium text-muted-foreground">{t('issuedTo')}</p>
+                    <p className="text-sm bg-muted px-3 py-2 rounded">{certificate.issued_to || 'N/A'}</p>
+                  </div>
+                  <div>
+                    <p className="text-sm font-medium text-muted-foreground">{t('issuer')}</p>
+                    <p className="text-sm bg-muted px-3 py-2 rounded">{certificate.issuer_o || certificate.issuer_cn || 'N/A'}</p>
+                  </div>
+                  {certificate.issuer_cn && certificate.issuer_cn !== certificate.issuer_o && (
+                    <div>
+                      <p className="text-sm font-medium text-muted-foreground">Issuer Common Name</p>
+                      <p className="text-sm bg-muted px-3 py-2 rounded">{certificate.issuer_cn}</p>
+                    </div>
+                  )}
+                </div>
+                <div className="space-y-4">
+                  {certificate.serial_number && (
+                    <div>
+                      <p className="text-sm font-medium text-muted-foreground">{t('serialNumber')}</p>
+                      <p className="text-xs font-mono bg-muted px-3 py-2 rounded break-all">{certificate.serial_number}</p>
+                    </div>
+                  )}
+                  {certificate.cert_alg && (
+                    <div>
+                      <p className="text-sm font-medium text-muted-foreground">{t('algorithm')}</p>
+                      <p className="text-sm bg-muted px-3 py-2 rounded">{certificate.cert_alg}</p>
+                    </div>
+                  )}
+                </div>
+              </div>
+              
+              {certificate.cert_sans && (
+                <div className="mt-4">
+                  <p className="text-sm font-medium text-muted-foreground mb-2">{t('subjectAlternativeNames')}</p>
+                  <div className="bg-muted px-3 py-2 rounded">
+                    {sansList.length > 0 ? (
+                      <div className="space-y-1">
+                        {sansList.map((san, index) => (
+                          <div key={index} className="text-sm font-mono break-all">
+                            {san}
+                          </div>
+                        ))}
+                      </div>
+                    ) : (
+                      <p className="text-sm">N/A</p>
+                    )}
+                  </div>
+                </div>
+              )}
+            </CardContent>
+          </Card>
+
+          {/* Monitoring Configuration */}
+          <Card>
+            <CardHeader>
+              <CardTitle className="text-lg">{t('monitoringConfiguration')}</CardTitle>
+            </CardHeader>
+            <CardContent>
+              <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-4">
+                <div className="bg-muted px-3 py-2 rounded">
+                  <p className="text-sm font-medium text-muted-foreground">{t('warningThreshold')}</p>
+                  <p className="text-sm font-semibold">{certificate.warning_threshold} {t('days')}</p>
+                </div>
+                <div className="bg-muted px-3 py-2 rounded">
+                  <p className="text-sm font-medium text-muted-foreground">{t('expiryThreshold')}</p>
+                  <p className="text-sm font-semibold">{certificate.expiry_threshold} {t('days')}</p>
+                </div>
+                <div className="bg-muted px-3 py-2 rounded">
+                  <p className="text-sm font-medium text-muted-foreground">Check Interval</p>
+                  <p className="text-sm font-semibold">{certificate.check_interval || 1} {t('days')}</p>
+                </div>
+                <div className="bg-muted px-3 py-2 rounded">
+                  <p className="text-sm font-medium text-muted-foreground">{t('notificationChannel')}</p>
+                  <p className="text-sm font-semibold">{certificate.notification_channel || 'N/A'}</p>
+                </div>
+              </div>
+              
+              {certificate.last_notified && (
+                <div className="mt-4">
+                  <p className="text-sm font-medium text-muted-foreground">{t('lastNotified')}</p>
+                  <p className="text-sm bg-muted px-3 py-2 rounded">{new Date(certificate.last_notified).toLocaleString()}</p>
+                </div>
+              )}
+            </CardContent>
+          </Card>
+
+          {/* System Information */}
+          <Card>
+            <CardHeader>
+              <CardTitle className="text-lg">{t('technicalInformation')}</CardTitle>
+            </CardHeader>
+            <CardContent>
+              <div className="grid grid-cols-1 md:grid-cols-2 gap-6">
+                <div className="space-y-3">
+                  {certificate.check_at && (
+                    <div>
+                      <p className="text-sm font-medium text-muted-foreground">Next Check</p>
+                      <p className="text-sm bg-muted px-3 py-2 rounded">{new Date(certificate.check_at).toLocaleString()}</p>
+                    </div>
+                  )}
+                  {certificate.created && (
+                    <div>
+                      <p className="text-sm font-medium text-muted-foreground">{t('created')}</p>
+                      <p className="text-sm bg-muted px-3 py-2 rounded">{new Date(certificate.created).toLocaleString()}</p>
+                    </div>
+                  )}
+                </div>
+                <div className="space-y-3">
+                  {certificate.updated && (
+                    <div>
+                      <p className="text-sm font-medium text-muted-foreground">{t('lastUpdated')}</p>
+                      <p className="text-sm bg-muted px-3 py-2 rounded">{new Date(certificate.updated).toLocaleString()}</p>
+                    </div>
+                  )}
+                  <div>
+                    <p className="text-sm font-medium text-muted-foreground">Certificate ID</p>
+                    <p className="text-xs font-mono bg-muted px-3 py-2 rounded break-all">{certificate.id}</p>
+                  </div>
+                </div>
+              </div>
+            </CardContent>
+          </Card>
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/ssl-domain/SSLCertificateStatusCards.tsx b/application/src/components/ssl-domain/SSLCertificateStatusCards.tsx
new file mode 100644
index 0000000..7ef844a
--- /dev/null
+++ b/application/src/components/ssl-domain/SSLCertificateStatusCards.tsx
@@ -0,0 +1,123 @@
+import React from "react";
+import { SSLCertificate } from "@/types/ssl.types";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
+import { Shield, ShieldAlert, ShieldX } from "lucide-react";
+import { useTheme } from "@/contexts/ThemeContext";
+
+interface SSLCertificateStatusCardsProps {
+  certificates: SSLCertificate[];
+}
+
+export const SSLCertificateStatusCards = ({ certificates }: SSLCertificateStatusCardsProps) => {
+  const { t } = useLanguage();
+  const { theme } = useTheme();
+
+  // Count certificates by status
+  const validCount = certificates.filter(cert => cert.status === "valid").length;
+  const expiringCount = certificates.filter(cert => cert.status === "expiring_soon").length;
+  const expiredCount = certificates.filter(cert => cert.status === "expired").length;
+
+  return (
+    <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-6 mb-8 w-full">
+      {/* Valid Certificates */}
+      <Card
+        className="border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative z-10"
+        style={{
+          background:
+            theme === "dark"
+              ? "linear-gradient(135deg, rgba(65,59,55,0.8) 0%, rgba(34,197,94,0.6) 100%)"
+              : "linear-gradient(135deg, rgba(65,59,55,0.8) 0%, #22c55e 100%)",
+        }}
+      >
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div
+            className="w-full h-full"
+            style={{
+              backgroundImage: `linear-gradient(#000 1px, transparent 1px),
+                                linear-gradient(90deg, #fff 1px, transparent 1px)`,
+              backgroundSize: "20px 20px",
+            }}
+          />
+        </div>
+        <CardHeader className="pb-2 relative z-10">
+          <CardTitle className="text-sm font-medium text-white">
+            {t("validCertificates")}
+          </CardTitle>
+        </CardHeader>
+        <CardContent className="flex items-center justify-between relative z-10">
+          <span className="text-5xl font-bold text-white">{validCount}</span>
+          <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+            <Shield className="h-6 w-6 text-white" />
+          </div>
+        </CardContent>
+      </Card>
+
+      {/* Expiring Soon */}
+      <Card
+        className="border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative z-10"
+        style={{
+          background:
+            theme === "dark"
+              ? "linear-gradient(135deg, rgba(65,59,55,0.8) 0%, rgba(251,191,36,0.6) 100%)"
+              : "linear-gradient(135deg, rgba(65,59,55,0.8) 0%, #fbbf24 100%)",
+        }}
+      >
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div
+            className="w-full h-full"
+            style={{
+              backgroundImage: `linear-gradient(#000 1px, transparent 1px),
+                                linear-gradient(90deg, #fff 1px, transparent 1px)`,
+              backgroundSize: "20px 20px",
+            }}
+          />
+        </div>
+        <CardHeader className="pb-2 relative z-10">
+          <CardTitle className="text-sm font-medium text-white">
+            {t("expiringSoon")}
+          </CardTitle>
+        </CardHeader>
+        <CardContent className="flex items-center justify-between relative z-10">
+          <span className="text-5xl font-bold text-white">{expiringCount}</span>
+          <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+            <ShieldAlert className="h-6 w-6 text-white" />
+          </div>
+        </CardContent>
+      </Card>
+
+      {/* Expired */}
+      <Card
+        className="border-none rounded-xl shadow-lg overflow-hidden transition-all duration-300 hover:shadow-xl transform hover:-translate-y-1 relative z-10"
+        style={{
+          background:
+            theme === "dark"
+              ? "linear-gradient(135deg, rgba(65,59,55,0.8) 0%, rgba(239,68,68,0.6) 100%)"
+              : "linear-gradient(135deg, rgba(65,59,55,0.8) 0%, #ef4444 100%)",
+        }}
+      >
+        <div className="absolute inset-0 z-0 opacity-10">
+          <div
+            className="w-full h-full"
+            style={{
+              backgroundImage: `linear-gradient(#000 1px, transparent 1px),
+                                linear-gradient(90deg, #fff 1px, transparent 1px)`,
+              backgroundSize: "20px 20px",
+            }}
+          />
+        </div>
+        <CardHeader className="pb-2 relative z-10">
+          <CardTitle className="text-sm font-medium text-white">
+            {t("expired")}
+          </CardTitle>
+        </CardHeader>
+        <CardContent className="flex items-center justify-between relative z-10">
+          <span className="text-5xl font-bold text-white">{expiredCount}</span>
+          <div className="rounded-full p-3 bg-white/25 backdrop-blur-sm">
+            <ShieldX className="h-6 w-6 text-white" />
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
diff --git a/application/src/components/ssl-domain/SSLCertificatesTable.tsx b/application/src/components/ssl-domain/SSLCertificatesTable.tsx
new file mode 100644
index 0000000..ab5ed6e
--- /dev/null
+++ b/application/src/components/ssl-domain/SSLCertificatesTable.tsx
@@ -0,0 +1,281 @@
+
+import React, { useState } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { Plus } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { SSLStatusBadge } from "./SSLStatusBadge";
+import { AddSSLCertificateForm } from "./AddSSLCertificateForm";
+import { EditSSLCertificateForm } from "./EditSSLCertificateForm";
+import { SSLCertificateActions } from "./SSLCertificateActions";
+import { SSLCertificateDetailDialog } from "./SSLCertificateDetailDialog";
+import { SSLPagination } from "./SSLPagination";
+import { fetchSSLCertificates, addSSLCertificate, deleteSSLCertificate } from "@/services/sslCertificateService";
+import { pb } from "@/lib/pocketbase";
+import { SSLCertificate } from "@/types/ssl.types";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useSSLPagination } from "@/hooks/useSSLPagination";
+import { toast } from "sonner";
+
+export const SSLCertificatesTable = () => {
+  const { t } = useLanguage();
+  const { theme } = useTheme();
+  const queryClient = useQueryClient();
+  const [showAddDialog, setShowAddDialog] = useState(false);
+  const [showEditDialog, setShowEditDialog] = useState(false);
+  const [showDeleteDialog, setShowDeleteDialog] = useState(false);
+  const [showViewDialog, setShowViewDialog] = useState(false);
+  const [selectedCertificate, setSelectedCertificate] = useState<SSLCertificate | null>(null);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  const { data: certificates = [], isLoading, isError } = useQuery({
+    queryKey: ['ssl-certificates'],
+    queryFn: fetchSSLCertificates,
+  });
+
+  const {
+    paginatedCertificates,
+    currentPage,
+    totalPages,
+    pageSize,
+    totalItems,
+    handlePageChange,
+    handlePageSizeChange,
+  } = useSSLPagination({ certificates });
+
+  if (isLoading) return <div>Loading...</div>;
+  if (isError) return <div>Error loading certificates</div>;
+
+  const handleAddCertificate = async (data: any) => {
+    setIsSubmitting(true);
+    try {
+      await addSSLCertificate(data);
+      await queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      setShowAddDialog(false);
+      toast.success(t('certificateAdded'));
+    } catch (error) {
+      toast.error(t('failedToAddCertificate'));
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const handleEditCertificate = async (updatedCertificate: SSLCertificate) => {
+    setIsSubmitting(true);
+    try {
+      await pb.collection('ssl_certificates').update(updatedCertificate.id, {
+        warning_threshold: updatedCertificate.warning_threshold,
+        expiry_threshold: updatedCertificate.expiry_threshold,
+        notification_channel: updatedCertificate.notification_channel,
+        notification_id: updatedCertificate.notification_id,
+        template_id: updatedCertificate.template_id,
+        check_interval: updatedCertificate.check_interval,
+      });
+      
+      await queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      setShowEditDialog(false);
+      setSelectedCertificate(null);
+      toast.success(t('certificateUpdated'));
+    } catch (error) {
+      toast.error(t('failedToUpdateCertificate'));
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const handleDeleteCertificate = async () => {
+    if (!selectedCertificate) return;
+    
+    setIsSubmitting(true);
+    try {
+      await deleteSSLCertificate(selectedCertificate.id);
+      await queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      setShowDeleteDialog(false);
+      setSelectedCertificate(null);
+      toast.success(t('certificateDeleted'));
+    } catch (error) {
+      toast.error(t('failedToDeleteCertificate'));
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+
+  const openViewDialog = (certificate: SSLCertificate) => {
+    setSelectedCertificate(certificate);
+    setShowViewDialog(true);
+  };
+
+  const openEditDialog = (certificate: SSLCertificate) => {
+    setSelectedCertificate(certificate);
+    setShowEditDialog(true);
+  };
+
+  const openDeleteDialog = (certificate: SSLCertificate) => {
+    setSelectedCertificate(certificate);
+    setShowDeleteDialog(true);
+  };
+
+  return (
+    <div className="flex-1 flex flex-col h-full">
+      {certificates.length === 0 ? (
+        <div className="text-center py-8 text-muted-foreground">
+          {t('noCertificatesFound')}
+        </div>
+      ) : (
+        <>
+          <div className={`${theme === 'dark' ? 'bg-gray-900' : 'bg-white'} rounded-lg border border-border shadow-sm`}>
+            <Table>
+              <TableHeader className={`${theme === 'dark' ? 'bg-gray-800' : 'bg-gray-50'}`}>
+                <TableRow className={`${theme === 'dark' ? 'border-gray-700 hover:bg-gray-800' : 'border-gray-200 hover:bg-gray-100'}`}>
+                  <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('domain')}</TableHead>
+                  <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('status')}</TableHead>
+                  <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('issuer')}</TableHead>
+                  <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('validUntil')}</TableHead>
+                  <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>{t('daysLeft')}</TableHead>
+                  <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4`}>Check Interval</TableHead>
+                  <TableHead className={`${theme === 'dark' ? 'text-gray-300' : 'text-gray-700'} font-medium text-base py-4 text-right w-[50px]`}>Actions</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {paginatedCertificates.map((certificate) => (
+                  <TableRow 
+                    key={certificate.id} 
+                    className="hover:bg-muted/50 cursor-pointer"
+                    onClick={() => openViewDialog(certificate)}
+                  >
+                    <TableCell className="font-medium">
+                      {certificate.domain}
+                    </TableCell>
+                    <TableCell>
+                      <SSLStatusBadge status={certificate.status} />
+                    </TableCell>
+                    <TableCell>{certificate.issuer_o || certificate.issuer_cn || 'Unknown'}</TableCell>
+                    <TableCell>
+                      {certificate.valid_till ? new Date(certificate.valid_till).toLocaleDateString() : 'N/A'}
+                    </TableCell>
+                    <TableCell>
+                      <span className={certificate.days_left <= 7 ? 'text-red-600 font-semibold' : certificate.days_left <= 30 ? 'text-yellow-600 font-semibold' : 'text-green-600'}>
+                        {certificate.days_left} {t('days')}
+                      </span>
+                    </TableCell>
+                    <TableCell>
+                      {certificate.check_interval || 1} {t('days')}
+                    </TableCell>
+                    <TableCell className="text-right" onClick={(e) => e.stopPropagation()}>
+                      <SSLCertificateActions
+                        certificate={certificate}
+                        onView={openViewDialog}
+                        onEdit={openEditDialog}
+                        onDelete={openDeleteDialog}
+                      />
+                    </TableCell>
+                  </TableRow>
+                ))}
+              </TableBody>
+            </Table>
+          </div>
+
+          <SSLPagination
+            currentPage={currentPage}
+            totalPages={totalPages}
+            pageSize={pageSize}
+            totalItems={totalItems}
+            onPageChange={handlePageChange}
+            onPageSizeChange={handlePageSizeChange}
+          />
+        </>
+      )}
+
+      {/* View Certificate Dialog */}
+      <SSLCertificateDetailDialog
+        certificate={selectedCertificate}
+        open={showViewDialog}
+        onOpenChange={setShowViewDialog}
+      />
+
+      {/* Add Certificate Dialog */}
+      <Dialog open={showAddDialog} onOpenChange={setShowAddDialog}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>{t('addSSLCertificate')}</DialogTitle>
+            <DialogDescription>
+              {t('addCertificateDescription')}
+            </DialogDescription>
+          </DialogHeader>
+          <AddSSLCertificateForm
+            onSubmit={handleAddCertificate}
+            onCancel={() => setShowAddDialog(false)}
+            isPending={isSubmitting}
+          />
+        </DialogContent>
+      </Dialog>
+
+      {/* Edit Certificate Dialog */}
+      <Dialog open={showEditDialog} onOpenChange={setShowEditDialog}>
+        <DialogContent className="max-w-2xl">
+          <DialogHeader>
+            <DialogTitle>{t('editSSLCertificate')}</DialogTitle>
+            <DialogDescription>
+              {t('editCertificateDescription')}
+            </DialogDescription>
+          </DialogHeader>
+          {selectedCertificate && (
+            <EditSSLCertificateForm
+              certificate={selectedCertificate}
+              onSubmit={handleEditCertificate}
+              onCancel={() => setShowEditDialog(false)}
+              isPending={isSubmitting}
+            />
+          )}
+        </DialogContent>
+      </Dialog>
+
+      {/* Delete Certificate Dialog */}
+      <AlertDialog open={showDeleteDialog} onOpenChange={setShowDeleteDialog}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>{t('deleteCertificate')}</AlertDialogTitle>
+            <AlertDialogDescription>
+              {t('deleteCertificateConfirmation')} {selectedCertificate?.domain}?
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>{t('cancel')}</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={handleDeleteCertificate}
+              disabled={isSubmitting}
+              className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+            >
+              {isSubmitting ? t('deleting') : t('delete')}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/ssl-domain/SSLDomainContent.tsx b/application/src/components/ssl-domain/SSLDomainContent.tsx
new file mode 100644
index 0000000..7fc4788
--- /dev/null
+++ b/application/src/components/ssl-domain/SSLDomainContent.tsx
@@ -0,0 +1,268 @@
+import React, { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { Button } from "@/components/ui/button";
+import { Plus, RefreshCw } from "lucide-react";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { toast } from "sonner";
+
+import { SSLCertificateStatusCards } from "./SSLCertificateStatusCards";
+import { SSLCertificatesTable } from "./SSLCertificatesTable";
+import { LoadingState } from "@/components/services/LoadingState";
+import { fetchSSLCertificates, addSSLCertificate, checkAndUpdateCertificate, refreshAllCertificates, deleteSSLCertificate } from "@/services/ssl";
+import { AddSSLCertificateForm } from "./AddSSLCertificateForm";
+import { EditSSLCertificateForm } from "./EditSSLCertificateForm";
+import type { AddSSLCertificateDto, SSLCertificate } from "@/types/ssl.types";
+import { pb } from "@/lib/pocketbase";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+export const SSLDomainContent = () => {
+  const { t } = useLanguage();
+  const [isAddDialogOpen, setIsAddDialogOpen] = useState(false);
+  const [isEditDialogOpen, setIsEditDialogOpen] = useState(false);
+  const [refreshingId, setRefreshingId] = useState<string | null>(null);
+  const [isRefreshingAll, setIsRefreshingAll] = useState(false);
+  const [selectedCertificate, setSelectedCertificate] = useState<SSLCertificate | null>(null);
+  const queryClient = useQueryClient();
+  
+  // Fetch SSL certificates with explicit error handling
+  const { data: certificates = [], isLoading, error } = useQuery({
+    queryKey: ['ssl-certificates'],
+    queryFn: async () => {
+      try {
+        const result = await fetchSSLCertificates();
+        return result;
+      } catch (error) {
+        toast.error(t('failedToLoadCertificates'));
+        throw error;
+      }
+    },
+    refetchOnWindowFocus: false,
+    refetchInterval: 300000, // Refresh every 5 minutes
+  });
+
+  // Add certificate mutation
+  const addMutation = useMutation({
+    mutationFn: addSSLCertificate,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      setIsAddDialogOpen(false);
+      toast.success(t('sslCertificateAdded'));
+    },
+    onError: (error) => {
+      toast.error(error instanceof Error ? error.message : t('failedToAddCertificate'));
+    }
+  });
+
+  // Edit certificate mutation - Updated to include notification_id and template_id
+  const editMutation = useMutation({
+    mutationFn: async (certificate: SSLCertificate) => {
+      
+      // Create the update data object with new fields
+      const updateData = {
+        warning_threshold: Number(certificate.warning_threshold),
+        expiry_threshold: Number(certificate.expiry_threshold),
+        notification_channel: certificate.notification_channel,
+        notification_id: certificate.notification_id || '', // Multi notification channels
+        template_id: certificate.template_id || '', // Alert template ID
+        check_interval: certificate.check_interval,
+      };
+      
+      
+      // Update certificate in the database using PocketBase directly
+      const updated = await pb.collection('ssl_certificates').update(certificate.id, updateData);
+      
+      // After updating the settings, refresh the certificate to ensure it's up to date
+      // This will also check if notification needs to be sent based on updated thresholds
+      const refreshedCert = await checkAndUpdateCertificate(certificate.id);
+      
+      return refreshedCert;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      setIsEditDialogOpen(false);
+      setSelectedCertificate(null);
+      toast.success(t('sslCertificateUpdated'));
+    },
+    onError: (error) => {
+      toast.error(error instanceof Error ? error.message : t('failedToUpdateCertificate'));
+    }
+  });
+
+  // Delete certificate mutation
+  const deleteMutation = useMutation({
+    mutationFn: deleteSSLCertificate,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      toast.success(t('sslCertificateDeleted'));
+    },
+    onError: (error) => {
+      toast.error(error instanceof Error ? error.message : t('failedToDeleteCertificate'));
+    }
+  });
+
+  // Refresh certificate mutation - Updated to remove individual toast notifications
+  const refreshMutation = useMutation({
+    mutationFn: checkAndUpdateCertificate,
+    onSuccess: (data) => {
+      queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      setRefreshingId(null);
+      // Removed individual success toast notification
+    },
+    onError: (error) => {
+      setRefreshingId(null);
+      
+      // Still refresh the data to show any partial information that was saved
+      queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      // Removed individual error toast notification
+    }
+  });
+  
+  // Refresh all certificates mutation
+  const refreshAllMutation = useMutation({
+    mutationFn: refreshAllCertificates,
+    onSuccess: (result) => {
+      queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+      setIsRefreshingAll(false);
+      
+      if (result.failed === 0) {
+        toast.success(t('allCertificatesRefreshed').replace('{count}', result.success.toString()));
+      } else {
+        toast.info(t('someCertificatesFailed')
+          .replace('{success}', result.success.toString())
+          .replace('{failed}', result.failed.toString()));
+      }
+    },
+    onError: (error) => {
+      toast.error(t('failedToCheckCertificate'));
+      setIsRefreshingAll(false);
+      
+      // Still refresh the data to show any partial information
+      queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] });
+    }
+  });
+
+  const handleAddCertificate = async (data: AddSSLCertificateDto) => {
+    addMutation.mutate(data);
+  };
+
+  const handleRefreshCertificate = (id: string) => {
+    if (refreshingId) return; // Prevent multiple refreshes
+    setRefreshingId(id);
+    refreshMutation.mutate(id);
+  };
+
+  const handleEditCertificate = (certificate: SSLCertificate) => {
+    setSelectedCertificate(certificate);
+    setIsEditDialogOpen(true);
+  };
+
+  const handleUpdateCertificate = (certificate: SSLCertificate) => {
+    editMutation.mutate(certificate);
+  };
+
+  const handleDeleteCertificate = (certificate: SSLCertificate) => {
+    deleteMutation.mutate(certificate.id);
+  };
+
+  const handleRefreshAll = async () => {
+    if (certificates.length === 0) {
+      toast.info(t('noCertificatesToRefresh'));
+      return;
+    }
+    
+    setIsRefreshingAll(true);
+    toast.info(t('startingRefreshAll').replace('{count}', certificates.length.toString()));
+    refreshAllMutation.mutate();
+  };
+
+  if (isLoading) {
+    return <LoadingState />;
+  }
+
+  if (error) {
+    return (
+      <div className="flex flex-col items-center justify-center h-full gap-4 text-foreground">
+        <p>{t('failedToLoadCertificates')}</p>
+        <Button onClick={() => queryClient.invalidateQueries({ queryKey: ['ssl-certificates'] })}>
+          {t('check')}
+        </Button>
+      </div>
+    );
+  }
+
+  return (
+    <main className="flex-1 flex flex-col overflow-auto bg-background p-6 pb-0">
+      <div className="flex flex-col flex-1">
+        <div className="flex justify-between items-center mb-6">
+          <div>
+            <h2 className="text-2xl font-bold text-foreground">{t('sslDomainManagement')}</h2>
+            <p className="text-sm text-muted-foreground mt-1">{t('monitorSSLCertificates')}</p>
+          </div>
+          <div className="flex gap-2">
+            <Button 
+              variant="outline"
+              onClick={handleRefreshAll}
+              disabled={isRefreshingAll || refreshingId !== null}
+              className="relative"
+            >
+              <RefreshCw className={`w-4 h-4 mr-2 ${isRefreshingAll ? 'animate-spin' : ''}`} /> 
+              {t('refreshAll')}
+              {isRefreshingAll && (
+                <span className="absolute top-0 right-0 -mt-2 -mr-2 bg-primary text-white text-xs rounded-full h-5 w-5 flex items-center justify-center">
+                  ...
+                </span>
+              )}
+            </Button>
+            <Button 
+              className="text-primary-foreground"
+              onClick={() => setIsAddDialogOpen(true)}
+            >
+              <Plus className="w-4 h-4 mr-2" /> {t('addDomain')}
+            </Button>
+          </div>
+        </div>
+        
+        <SSLCertificateStatusCards certificates={certificates} />
+        
+        <div className="mt-6 flex-1 flex flex-col pb-6">
+          <SSLCertificatesTable />
+        </div>
+      </div>
+
+      <Dialog open={isAddDialogOpen} onOpenChange={setIsAddDialogOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>{t('addSSLCertificate')}</DialogTitle>
+          </DialogHeader>
+          <AddSSLCertificateForm 
+            onSubmit={handleAddCertificate} 
+            onCancel={() => setIsAddDialogOpen(false)} 
+            isPending={addMutation.isPending}
+          />
+        </DialogContent>
+      </Dialog>
+
+      {selectedCertificate && (
+        <Dialog open={isEditDialogOpen} onOpenChange={(open) => {
+          setIsEditDialogOpen(open);
+          if (!open) setSelectedCertificate(null);
+        }}>
+          <DialogContent>
+            <DialogHeader>
+              <DialogTitle>{t('editSSLCertificate')}</DialogTitle>
+            </DialogHeader>
+            <EditSSLCertificateForm 
+              certificate={selectedCertificate}
+              onSubmit={handleUpdateCertificate}
+              onCancel={() => {
+                setIsEditDialogOpen(false);
+                setSelectedCertificate(null);
+              }}
+              isPending={editMutation.isPending}
+            />
+          </DialogContent>
+        </Dialog>
+      )}
+    </main>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/ssl-domain/SSLPagination.tsx b/application/src/components/ssl-domain/SSLPagination.tsx
new file mode 100644
index 0000000..2ee6721
--- /dev/null
+++ b/application/src/components/ssl-domain/SSLPagination.tsx
@@ -0,0 +1,131 @@
+
+import { 
+  Pagination, 
+  PaginationContent, 
+  PaginationItem, 
+  PaginationLink, 
+  PaginationNext, 
+  PaginationPrevious 
+} from "@/components/ui/pagination";
+import { 
+  Select, 
+  SelectContent, 
+  SelectItem, 
+  SelectTrigger, 
+  SelectValue 
+} from "@/components/ui/select";
+import { SSLPageSize } from "@/hooks/useSSLPagination";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface SSLPaginationProps {
+  currentPage: number;
+  totalPages: number;
+  pageSize: SSLPageSize;
+  totalItems: number;
+  onPageChange: (page: number) => void;
+  onPageSizeChange: (size: SSLPageSize) => void;
+}
+
+export function SSLPagination({
+  currentPage,
+  totalPages,
+  pageSize,
+  totalItems,
+  onPageChange,
+  onPageSizeChange,
+}: SSLPaginationProps) {
+  const { t } = useLanguage();
+
+  // Generate page numbers to display
+  const getPageNumbers = () => {
+    const pages = [];
+    const maxVisiblePages = 5;
+    const halfVisible = Math.floor(maxVisiblePages / 2);
+    
+    let startPage = Math.max(1, currentPage - halfVisible);
+    let endPage = Math.min(totalPages, startPage + maxVisiblePages - 1);
+    
+    // Adjust start page if we don't have enough pages at the end
+    if (endPage - startPage + 1 < maxVisiblePages) {
+      startPage = Math.max(1, endPage - maxVisiblePages + 1);
+    }
+    
+    for (let i = startPage; i <= endPage; i++) {
+      pages.push(i);
+    }
+    
+    return pages;
+  };
+
+  const startItem = Math.min((currentPage - 1) * pageSize + 1, totalItems);
+  const endItem = Math.min(currentPage * pageSize, totalItems);
+
+  return (
+    <div className="flex items-center justify-between py-4 px-4 border-t border-border">
+      <div className="flex items-center space-x-2">
+        <span className="text-sm text-muted-foreground">
+          {t("rowsPerPage") || "Rows per page"}:
+        </span>
+        <Select
+          value={pageSize.toString()}
+          onValueChange={(value) => onPageSizeChange(parseInt(value) as SSLPageSize)}
+        >
+          <SelectTrigger className="h-8 w-[70px]">
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="10">10</SelectItem>
+            <SelectItem value="30">30</SelectItem>
+            <SelectItem value="50">50</SelectItem>
+          </SelectContent>
+        </Select>
+        <span className="text-sm text-muted-foreground">
+          {totalItems > 0 
+            ? `${startItem}-${endItem} of ${totalItems} ${t("certificates") || "certificates"}`
+            : `0 ${t("certificates") || "certificates"}`
+          }
+        </span>
+      </div>
+      
+      {totalPages > 1 && (
+        <Pagination>
+          <PaginationContent>
+            <PaginationItem>
+              <PaginationPrevious
+                onClick={() => onPageChange(Math.max(1, currentPage - 1))}
+                className={
+                  currentPage === 1 
+                    ? "pointer-events-none opacity-50" 
+                    : "cursor-pointer"
+                }
+              />
+            </PaginationItem>
+            
+            {getPageNumbers().map((page) => (
+              <PaginationItem key={page}>
+                <PaginationLink
+                  isActive={page === currentPage}
+                  onClick={() => onPageChange(page)}
+                  className="cursor-pointer"
+                >
+                  {page}
+                </PaginationLink>
+              </PaginationItem>
+            ))}
+            
+            <PaginationItem>
+              <PaginationNext
+                onClick={() => onPageChange(Math.min(totalPages, currentPage + 1))}
+                className={
+                  currentPage === totalPages 
+                    ? "pointer-events-none opacity-50" 
+                    : "cursor-pointer"
+                }
+              />
+            </PaginationItem>
+          </PaginationContent>
+        </Pagination>
+      )}
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/application/src/components/ssl-domain/SSLStatusBadge.tsx b/application/src/components/ssl-domain/SSLStatusBadge.tsx
new file mode 100644
index 0000000..a7b0d6e
--- /dev/null
+++ b/application/src/components/ssl-domain/SSLStatusBadge.tsx
@@ -0,0 +1,41 @@
+import React from "react";
+import { Badge } from "@/components/ui/badge";
+import { useLanguage } from "@/contexts/LanguageContext";
+
+interface SSLStatusBadgeProps {
+  status: string;
+}
+
+export const SSLStatusBadge: React.FC<SSLStatusBadgeProps> = ({ status }) => {
+  const { t } = useLanguage();
+  let variant = "";
+  let label = "";
+
+  switch (status) {
+    case "valid":
+      variant = "bg-green-500 hover:bg-green-600";
+      label = t('valid');
+      break;
+    case "expiring_soon":
+      variant = "bg-yellow-500 hover:bg-yellow-600";
+      label = t('expiringSoon');
+      break;
+    case "expired":
+      variant = "bg-red-500 hover:bg-red-600";
+      label = t('expired');
+      break;
+    case "pending":
+      variant = "bg-blue-500 hover:bg-blue-600";
+      label = t('pending');
+      break;
+    default:
+      variant = "bg-gray-500 hover:bg-gray-600";
+      label = status.charAt(0).toUpperCase() + status.slice(1);
+  }
+
+  return (
+    <Badge className={`${variant} text-white`}>
+      {label}
+    </Badge>
+  );
+};
\ No newline at end of file
diff --git a/application/src/components/ui/accordion.tsx b/application/src/components/ui/accordion.tsx
new file mode 100644
index 0000000..e6a723d
--- /dev/null
+++ b/application/src/components/ui/accordion.tsx
@@ -0,0 +1,56 @@
+import * as React from "react"
+import * as AccordionPrimitive from "@radix-ui/react-accordion"
+import { ChevronDown } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const Accordion = AccordionPrimitive.Root
+
+const AccordionItem = React.forwardRef<
+  React.ElementRef<typeof AccordionPrimitive.Item>,
+  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Item>
+>(({ className, ...props }, ref) => (
+  <AccordionPrimitive.Item
+    ref={ref}
+    className={cn("border-b", className)}
+    {...props}
+  />
+))
+AccordionItem.displayName = "AccordionItem"
+
+const AccordionTrigger = React.forwardRef<
+  React.ElementRef<typeof AccordionPrimitive.Trigger>,
+  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Trigger>
+>(({ className, children, ...props }, ref) => (
+  <AccordionPrimitive.Header className="flex">
+    <AccordionPrimitive.Trigger
+      ref={ref}
+      className={cn(
+        "flex flex-1 items-center justify-between py-4 font-medium transition-all hover:underline [&[data-state=open]>svg]:rotate-180",
+        className
+      )}
+      {...props}
+    >
+      {children}
+      <ChevronDown className="h-4 w-4 shrink-0 transition-transform duration-200" />
+    </AccordionPrimitive.Trigger>
+  </AccordionPrimitive.Header>
+))
+AccordionTrigger.displayName = AccordionPrimitive.Trigger.displayName
+
+const AccordionContent = React.forwardRef<
+  React.ElementRef<typeof AccordionPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Content>
+>(({ className, children, ...props }, ref) => (
+  <AccordionPrimitive.Content
+    ref={ref}
+    className="overflow-hidden text-sm transition-all data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down"
+    {...props}
+  >
+    <div className={cn("pb-4 pt-0", className)}>{children}</div>
+  </AccordionPrimitive.Content>
+))
+
+AccordionContent.displayName = AccordionPrimitive.Content.displayName
+
+export { Accordion, AccordionItem, AccordionTrigger, AccordionContent }
diff --git a/application/src/components/ui/alert-dialog.tsx b/application/src/components/ui/alert-dialog.tsx
new file mode 100644
index 0000000..8722561
--- /dev/null
+++ b/application/src/components/ui/alert-dialog.tsx
@@ -0,0 +1,139 @@
+import * as React from "react"
+import * as AlertDialogPrimitive from "@radix-ui/react-alert-dialog"
+
+import { cn } from "@/lib/utils"
+import { buttonVariants } from "@/components/ui/button"
+
+const AlertDialog = AlertDialogPrimitive.Root
+
+const AlertDialogTrigger = AlertDialogPrimitive.Trigger
+
+const AlertDialogPortal = AlertDialogPrimitive.Portal
+
+const AlertDialogOverlay = React.forwardRef<
+  React.ElementRef<typeof AlertDialogPrimitive.Overlay>,
+  React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Overlay>
+>(({ className, ...props }, ref) => (
+  <AlertDialogPrimitive.Overlay
+    className={cn(
+      "fixed inset-0 z-50 bg-black/80  data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+      className
+    )}
+    {...props}
+    ref={ref}
+  />
+))
+AlertDialogOverlay.displayName = AlertDialogPrimitive.Overlay.displayName
+
+const AlertDialogContent = React.forwardRef<
+  React.ElementRef<typeof AlertDialogPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Content>
+>(({ className, ...props }, ref) => (
+  <AlertDialogPortal>
+    <AlertDialogOverlay />
+    <AlertDialogPrimitive.Content
+      ref={ref}
+      className={cn(
+        "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 border bg-background p-6 shadow-lg duration-200 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[state=closed]:slide-out-to-left-1/2 data-[state=closed]:slide-out-to-top-[48%] data-[state=open]:slide-in-from-left-1/2 data-[state=open]:slide-in-from-top-[48%] sm:rounded-lg",
+        className
+      )}
+      {...props}
+    />
+  </AlertDialogPortal>
+))
+AlertDialogContent.displayName = AlertDialogPrimitive.Content.displayName
+
+const AlertDialogHeader = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn(
+      "flex flex-col space-y-2 text-center sm:text-left",
+      className
+    )}
+    {...props}
+  />
+)
+AlertDialogHeader.displayName = "AlertDialogHeader"
+
+const AlertDialogFooter = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn(
+      "flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2",
+      className
+    )}
+    {...props}
+  />
+)
+AlertDialogFooter.displayName = "AlertDialogFooter"
+
+const AlertDialogTitle = React.forwardRef<
+  React.ElementRef<typeof AlertDialogPrimitive.Title>,
+  React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Title>
+>(({ className, ...props }, ref) => (
+  <AlertDialogPrimitive.Title
+    ref={ref}
+    className={cn("text-lg font-semibold", className)}
+    {...props}
+  />
+))
+AlertDialogTitle.displayName = AlertDialogPrimitive.Title.displayName
+
+const AlertDialogDescription = React.forwardRef<
+  React.ElementRef<typeof AlertDialogPrimitive.Description>,
+  React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Description>
+>(({ className, ...props }, ref) => (
+  <AlertDialogPrimitive.Description
+    ref={ref}
+    className={cn("text-sm text-muted-foreground", className)}
+    {...props}
+  />
+))
+AlertDialogDescription.displayName =
+  AlertDialogPrimitive.Description.displayName
+
+const AlertDialogAction = React.forwardRef<
+  React.ElementRef<typeof AlertDialogPrimitive.Action>,
+  React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Action>
+>(({ className, ...props }, ref) => (
+  <AlertDialogPrimitive.Action
+    ref={ref}
+    className={cn(buttonVariants(), className)}
+    {...props}
+  />
+))
+AlertDialogAction.displayName = AlertDialogPrimitive.Action.displayName
+
+const AlertDialogCancel = React.forwardRef<
+  React.ElementRef<typeof AlertDialogPrimitive.Cancel>,
+  React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Cancel>
+>(({ className, ...props }, ref) => (
+  <AlertDialogPrimitive.Cancel
+    ref={ref}
+    className={cn(
+      buttonVariants({ variant: "outline" }),
+      "mt-2 sm:mt-0",
+      className
+    )}
+    {...props}
+  />
+))
+AlertDialogCancel.displayName = AlertDialogPrimitive.Cancel.displayName
+
+export {
+  AlertDialog,
+  AlertDialogPortal,
+  AlertDialogOverlay,
+  AlertDialogTrigger,
+  AlertDialogContent,
+  AlertDialogHeader,
+  AlertDialogFooter,
+  AlertDialogTitle,
+  AlertDialogDescription,
+  AlertDialogAction,
+  AlertDialogCancel,
+}
diff --git a/application/src/components/ui/alert.tsx b/application/src/components/ui/alert.tsx
new file mode 100644
index 0000000..41fa7e0
--- /dev/null
+++ b/application/src/components/ui/alert.tsx
@@ -0,0 +1,59 @@
+import * as React from "react"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+
+const alertVariants = cva(
+  "relative w-full rounded-lg border p-4 [&>svg~*]:pl-7 [&>svg+div]:translate-y-[-3px] [&>svg]:absolute [&>svg]:left-4 [&>svg]:top-4 [&>svg]:text-foreground",
+  {
+    variants: {
+      variant: {
+        default: "bg-background text-foreground",
+        destructive:
+          "border-destructive/50 text-destructive dark:border-destructive [&>svg]:text-destructive",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  }
+)
+
+const Alert = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement> & VariantProps<typeof alertVariants>
+>(({ className, variant, ...props }, ref) => (
+  <div
+    ref={ref}
+    role="alert"
+    className={cn(alertVariants({ variant }), className)}
+    {...props}
+  />
+))
+Alert.displayName = "Alert"
+
+const AlertTitle = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLHeadingElement>
+>(({ className, ...props }, ref) => (
+  <h5
+    ref={ref}
+    className={cn("mb-1 font-medium leading-none tracking-tight", className)}
+    {...props}
+  />
+))
+AlertTitle.displayName = "AlertTitle"
+
+const AlertDescription = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLParagraphElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn("text-sm [&_p]:leading-relaxed", className)}
+    {...props}
+  />
+))
+AlertDescription.displayName = "AlertDescription"
+
+export { Alert, AlertTitle, AlertDescription }
diff --git a/application/src/components/ui/aspect-ratio.tsx b/application/src/components/ui/aspect-ratio.tsx
new file mode 100644
index 0000000..c4abbf3
--- /dev/null
+++ b/application/src/components/ui/aspect-ratio.tsx
@@ -0,0 +1,5 @@
+import * as AspectRatioPrimitive from "@radix-ui/react-aspect-ratio"
+
+const AspectRatio = AspectRatioPrimitive.Root
+
+export { AspectRatio }
diff --git a/application/src/components/ui/avatar.tsx b/application/src/components/ui/avatar.tsx
new file mode 100644
index 0000000..991f56e
--- /dev/null
+++ b/application/src/components/ui/avatar.tsx
@@ -0,0 +1,48 @@
+import * as React from "react"
+import * as AvatarPrimitive from "@radix-ui/react-avatar"
+
+import { cn } from "@/lib/utils"
+
+const Avatar = React.forwardRef<
+  React.ElementRef<typeof AvatarPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof AvatarPrimitive.Root>
+>(({ className, ...props }, ref) => (
+  <AvatarPrimitive.Root
+    ref={ref}
+    className={cn(
+      "relative flex h-10 w-10 shrink-0 overflow-hidden rounded-full",
+      className
+    )}
+    {...props}
+  />
+))
+Avatar.displayName = AvatarPrimitive.Root.displayName
+
+const AvatarImage = React.forwardRef<
+  React.ElementRef<typeof AvatarPrimitive.Image>,
+  React.ComponentPropsWithoutRef<typeof AvatarPrimitive.Image>
+>(({ className, ...props }, ref) => (
+  <AvatarPrimitive.Image
+    ref={ref}
+    className={cn("aspect-square h-full w-full", className)}
+    {...props}
+  />
+))
+AvatarImage.displayName = AvatarPrimitive.Image.displayName
+
+const AvatarFallback = React.forwardRef<
+  React.ElementRef<typeof AvatarPrimitive.Fallback>,
+  React.ComponentPropsWithoutRef<typeof AvatarPrimitive.Fallback>
+>(({ className, ...props }, ref) => (
+  <AvatarPrimitive.Fallback
+    ref={ref}
+    className={cn(
+      "flex h-full w-full items-center justify-center rounded-full bg-muted",
+      className
+    )}
+    {...props}
+  />
+))
+AvatarFallback.displayName = AvatarPrimitive.Fallback.displayName
+
+export { Avatar, AvatarImage, AvatarFallback }
diff --git a/application/src/components/ui/badge.tsx b/application/src/components/ui/badge.tsx
new file mode 100644
index 0000000..f64cf19
--- /dev/null
+++ b/application/src/components/ui/badge.tsx
@@ -0,0 +1,37 @@
+
+import * as React from "react"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+
+const badgeVariants = cva(
+  "inline-flex items-center rounded-full border px-2.5 py-0.5 text-xs font-semibold transition-colors focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2",
+  {
+    variants: {
+      variant: {
+        default:
+          "border-transparent bg-primary text-primary-foreground hover:bg-primary/80",
+        secondary:
+          "border-transparent bg-secondary text-secondary-foreground hover:bg-secondary/80",
+        destructive:
+          "border-transparent bg-destructive text-destructive-foreground hover:bg-destructive/80",
+        outline: "text-foreground",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  }
+)
+
+export interface BadgeProps
+  extends React.HTMLAttributes<HTMLDivElement>,
+    VariantProps<typeof badgeVariants> {}
+
+function Badge({ className, variant, ...props }: BadgeProps) {
+  return (
+    <div className={cn(badgeVariants({ variant }), className)} {...props} />
+  )
+}
+
+export { Badge, badgeVariants }
\ No newline at end of file
diff --git a/application/src/components/ui/breadcrumb.tsx b/application/src/components/ui/breadcrumb.tsx
new file mode 100644
index 0000000..71a5c32
--- /dev/null
+++ b/application/src/components/ui/breadcrumb.tsx
@@ -0,0 +1,115 @@
+import * as React from "react"
+import { Slot } from "@radix-ui/react-slot"
+import { ChevronRight, MoreHorizontal } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const Breadcrumb = React.forwardRef<
+  HTMLElement,
+  React.ComponentPropsWithoutRef<"nav"> & {
+    separator?: React.ReactNode
+  }
+>(({ ...props }, ref) => <nav ref={ref} aria-label="breadcrumb" {...props} />)
+Breadcrumb.displayName = "Breadcrumb"
+
+const BreadcrumbList = React.forwardRef<
+  HTMLOListElement,
+  React.ComponentPropsWithoutRef<"ol">
+>(({ className, ...props }, ref) => (
+  <ol
+    ref={ref}
+    className={cn(
+      "flex flex-wrap items-center gap-1.5 break-words text-sm text-muted-foreground sm:gap-2.5",
+      className
+    )}
+    {...props}
+  />
+))
+BreadcrumbList.displayName = "BreadcrumbList"
+
+const BreadcrumbItem = React.forwardRef<
+  HTMLLIElement,
+  React.ComponentPropsWithoutRef<"li">
+>(({ className, ...props }, ref) => (
+  <li
+    ref={ref}
+    className={cn("inline-flex items-center gap-1.5", className)}
+    {...props}
+  />
+))
+BreadcrumbItem.displayName = "BreadcrumbItem"
+
+const BreadcrumbLink = React.forwardRef<
+  HTMLAnchorElement,
+  React.ComponentPropsWithoutRef<"a"> & {
+    asChild?: boolean
+  }
+>(({ asChild, className, ...props }, ref) => {
+  const Comp = asChild ? Slot : "a"
+
+  return (
+    <Comp
+      ref={ref}
+      className={cn("transition-colors hover:text-foreground", className)}
+      {...props}
+    />
+  )
+})
+BreadcrumbLink.displayName = "BreadcrumbLink"
+
+const BreadcrumbPage = React.forwardRef<
+  HTMLSpanElement,
+  React.ComponentPropsWithoutRef<"span">
+>(({ className, ...props }, ref) => (
+  <span
+    ref={ref}
+    role="link"
+    aria-disabled="true"
+    aria-current="page"
+    className={cn("font-normal text-foreground", className)}
+    {...props}
+  />
+))
+BreadcrumbPage.displayName = "BreadcrumbPage"
+
+const BreadcrumbSeparator = ({
+  children,
+  className,
+  ...props
+}: React.ComponentProps<"li">) => (
+  <li
+    role="presentation"
+    aria-hidden="true"
+    className={cn("[&>svg]:size-3.5", className)}
+    {...props}
+  >
+    {children ?? <ChevronRight />}
+  </li>
+)
+BreadcrumbSeparator.displayName = "BreadcrumbSeparator"
+
+const BreadcrumbEllipsis = ({
+  className,
+  ...props
+}: React.ComponentProps<"span">) => (
+  <span
+    role="presentation"
+    aria-hidden="true"
+    className={cn("flex h-9 w-9 items-center justify-center", className)}
+    {...props}
+  >
+    <MoreHorizontal className="h-4 w-4" />
+    <span className="sr-only">More</span>
+  </span>
+)
+BreadcrumbEllipsis.displayName = "BreadcrumbElipssis"
+
+export {
+  Breadcrumb,
+  BreadcrumbList,
+  BreadcrumbItem,
+  BreadcrumbLink,
+  BreadcrumbPage,
+  BreadcrumbSeparator,
+  BreadcrumbEllipsis,
+}
diff --git a/application/src/components/ui/button.tsx b/application/src/components/ui/button.tsx
new file mode 100644
index 0000000..fede5fc
--- /dev/null
+++ b/application/src/components/ui/button.tsx
@@ -0,0 +1,57 @@
+
+import * as React from "react"
+import { Slot } from "@radix-ui/react-slot"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+
+const buttonVariants = cva(
+  "inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
+  {
+    variants: {
+      variant: {
+        default: "bg-primary text-primary-foreground hover:bg-primary/90",
+        destructive:
+          "bg-destructive text-destructive-foreground hover:bg-destructive/90",
+        outline:
+          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
+        secondary:
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
+        ghost: "hover:bg-accent hover:text-accent-foreground",
+        link: "text-primary underline-offset-4 hover:underline",
+      },
+      size: {
+        default: "h-10 px-4 py-2",
+        sm: "h-9 rounded-md px-3",
+        lg: "h-11 rounded-md px-8",
+        icon: "h-10 w-10",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  }
+)
+
+export interface ButtonProps
+  extends React.ButtonHTMLAttributes<HTMLButtonElement>,
+    VariantProps<typeof buttonVariants> {
+  asChild?: boolean
+}
+
+const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
+  ({ className, variant, size, asChild = false, ...props }, ref) => {
+    const Comp = asChild ? Slot : "button"
+    return (
+      <Comp
+        className={cn(buttonVariants({ variant, size, className }))}
+        ref={ref}
+        {...props}
+      />
+    )
+  }
+)
+Button.displayName = "Button"
+
+export { Button, buttonVariants }
\ No newline at end of file
diff --git a/application/src/components/ui/calendar.tsx b/application/src/components/ui/calendar.tsx
new file mode 100644
index 0000000..8af8f15
--- /dev/null
+++ b/application/src/components/ui/calendar.tsx
@@ -0,0 +1,65 @@
+
+import * as React from "react";
+import { ChevronLeft, ChevronRight } from "lucide-react";
+import { DayPicker } from "react-day-picker";
+
+import { cn } from "@/lib/utils";
+import { buttonVariants } from "@/components/ui/button";
+
+export type CalendarProps = React.ComponentProps<typeof DayPicker>;
+
+function Calendar({
+  className,
+  classNames,
+  showOutsideDays = true,
+  ...props
+}: CalendarProps) {
+  return (
+    <DayPicker
+      showOutsideDays={showOutsideDays}
+      className={cn("p-3", className)}
+      classNames={{
+        months: "flex flex-col sm:flex-row space-y-4 sm:space-x-4 sm:space-y-0",
+        month: "space-y-4",
+        caption: "flex justify-center pt-1 relative items-center",
+        caption_label: "text-sm font-medium",
+        nav: "space-x-1 flex items-center",
+        nav_button: cn(
+          buttonVariants({ variant: "outline" }),
+          "h-7 w-7 bg-transparent p-0 opacity-50 hover:opacity-100"
+        ),
+        nav_button_previous: "absolute left-1",
+        nav_button_next: "absolute right-1",
+        table: "w-full border-collapse space-y-1",
+        head_row: "flex",
+        head_cell:
+          "text-muted-foreground rounded-md w-9 font-normal text-[0.8rem]",
+        row: "flex w-full mt-2",
+        cell: "h-9 w-9 text-center text-sm p-0 relative [&:has([aria-selected].day-range-end)]:rounded-r-md [&:has([aria-selected].day-outside)]:bg-accent/50 [&:has([aria-selected])]:bg-accent first:[&:has([aria-selected])]:rounded-l-md last:[&:has([aria-selected])]:rounded-r-md focus-within:relative focus-within:z-20",
+        day: cn(
+          buttonVariants({ variant: "ghost" }),
+          "h-9 w-9 p-0 font-normal aria-selected:opacity-100"
+        ),
+        day_range_end: "day-range-end",
+        day_selected:
+          "bg-primary text-primary-foreground hover:bg-primary hover:text-primary-foreground focus:bg-primary focus:text-primary-foreground",
+        day_today: "bg-accent text-accent-foreground",
+        day_outside:
+          "day-outside text-muted-foreground opacity-50 aria-selected:bg-accent/50 aria-selected:text-muted-foreground aria-selected:opacity-30",
+        day_disabled: "text-muted-foreground opacity-50",
+        day_range_middle:
+          "aria-selected:bg-accent aria-selected:text-accent-foreground",
+        day_hidden: "invisible",
+        ...classNames,
+      }}
+      components={{
+        IconLeft: ({ ..._props }) => <ChevronLeft className="h-4 w-4" />,
+        IconRight: ({ ..._props }) => <ChevronRight className="h-4 w-4" />,
+      }}
+      {...props}
+    />
+  );
+}
+Calendar.displayName = "Calendar";
+
+export { Calendar };
diff --git a/application/src/components/ui/card.tsx b/application/src/components/ui/card.tsx
new file mode 100644
index 0000000..afa13ec
--- /dev/null
+++ b/application/src/components/ui/card.tsx
@@ -0,0 +1,79 @@
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+const Card = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn(
+      "rounded-lg border bg-card text-card-foreground shadow-sm",
+      className
+    )}
+    {...props}
+  />
+))
+Card.displayName = "Card"
+
+const CardHeader = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn("flex flex-col space-y-1.5 p-6", className)}
+    {...props}
+  />
+))
+CardHeader.displayName = "CardHeader"
+
+const CardTitle = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLHeadingElement>
+>(({ className, ...props }, ref) => (
+  <h3
+    ref={ref}
+    className={cn(
+      "text-2xl font-semibold leading-none tracking-tight",
+      className
+    )}
+    {...props}
+  />
+))
+CardTitle.displayName = "CardTitle"
+
+const CardDescription = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLParagraphElement>
+>(({ className, ...props }, ref) => (
+  <p
+    ref={ref}
+    className={cn("text-sm text-muted-foreground", className)}
+    {...props}
+  />
+))
+CardDescription.displayName = "CardDescription"
+
+const CardContent = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div ref={ref} className={cn("p-6 pt-0", className)} {...props} />
+))
+CardContent.displayName = "CardContent"
+
+const CardFooter = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    className={cn("flex items-center p-6 pt-0", className)}
+    {...props}
+  />
+))
+CardFooter.displayName = "CardFooter"
+
+export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent }
diff --git a/application/src/components/ui/carousel.tsx b/application/src/components/ui/carousel.tsx
new file mode 100644
index 0000000..9c2b9bf
--- /dev/null
+++ b/application/src/components/ui/carousel.tsx
@@ -0,0 +1,260 @@
+import * as React from "react"
+import useEmblaCarousel, {
+  type UseEmblaCarouselType,
+} from "embla-carousel-react"
+import { ArrowLeft, ArrowRight } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+import { Button } from "@/components/ui/button"
+
+type CarouselApi = UseEmblaCarouselType[1]
+type UseCarouselParameters = Parameters<typeof useEmblaCarousel>
+type CarouselOptions = UseCarouselParameters[0]
+type CarouselPlugin = UseCarouselParameters[1]
+
+type CarouselProps = {
+  opts?: CarouselOptions
+  plugins?: CarouselPlugin
+  orientation?: "horizontal" | "vertical"
+  setApi?: (api: CarouselApi) => void
+}
+
+type CarouselContextProps = {
+  carouselRef: ReturnType<typeof useEmblaCarousel>[0]
+  api: ReturnType<typeof useEmblaCarousel>[1]
+  scrollPrev: () => void
+  scrollNext: () => void
+  canScrollPrev: boolean
+  canScrollNext: boolean
+} & CarouselProps
+
+const CarouselContext = React.createContext<CarouselContextProps | null>(null)
+
+function useCarousel() {
+  const context = React.useContext(CarouselContext)
+
+  if (!context) {
+    throw new Error("useCarousel must be used within a <Carousel />")
+  }
+
+  return context
+}
+
+const Carousel = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement> & CarouselProps
+>(
+  (
+    {
+      orientation = "horizontal",
+      opts,
+      setApi,
+      plugins,
+      className,
+      children,
+      ...props
+    },
+    ref
+  ) => {
+    const [carouselRef, api] = useEmblaCarousel(
+      {
+        ...opts,
+        axis: orientation === "horizontal" ? "x" : "y",
+      },
+      plugins
+    )
+    const [canScrollPrev, setCanScrollPrev] = React.useState(false)
+    const [canScrollNext, setCanScrollNext] = React.useState(false)
+
+    const onSelect = React.useCallback((api: CarouselApi) => {
+      if (!api) {
+        return
+      }
+
+      setCanScrollPrev(api.canScrollPrev())
+      setCanScrollNext(api.canScrollNext())
+    }, [])
+
+    const scrollPrev = React.useCallback(() => {
+      api?.scrollPrev()
+    }, [api])
+
+    const scrollNext = React.useCallback(() => {
+      api?.scrollNext()
+    }, [api])
+
+    const handleKeyDown = React.useCallback(
+      (event: React.KeyboardEvent<HTMLDivElement>) => {
+        if (event.key === "ArrowLeft") {
+          event.preventDefault()
+          scrollPrev()
+        } else if (event.key === "ArrowRight") {
+          event.preventDefault()
+          scrollNext()
+        }
+      },
+      [scrollPrev, scrollNext]
+    )
+
+    React.useEffect(() => {
+      if (!api || !setApi) {
+        return
+      }
+
+      setApi(api)
+    }, [api, setApi])
+
+    React.useEffect(() => {
+      if (!api) {
+        return
+      }
+
+      onSelect(api)
+      api.on("reInit", onSelect)
+      api.on("select", onSelect)
+
+      return () => {
+        api?.off("select", onSelect)
+      }
+    }, [api, onSelect])
+
+    return (
+      <CarouselContext.Provider
+        value={{
+          carouselRef,
+          api: api,
+          opts,
+          orientation:
+            orientation || (opts?.axis === "y" ? "vertical" : "horizontal"),
+          scrollPrev,
+          scrollNext,
+          canScrollPrev,
+          canScrollNext,
+        }}
+      >
+        <div
+          ref={ref}
+          onKeyDownCapture={handleKeyDown}
+          className={cn("relative", className)}
+          role="region"
+          aria-roledescription="carousel"
+          {...props}
+        >
+          {children}
+        </div>
+      </CarouselContext.Provider>
+    )
+  }
+)
+Carousel.displayName = "Carousel"
+
+const CarouselContent = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => {
+  const { carouselRef, orientation } = useCarousel()
+
+  return (
+    <div ref={carouselRef} className="overflow-hidden">
+      <div
+        ref={ref}
+        className={cn(
+          "flex",
+          orientation === "horizontal" ? "-ml-4" : "-mt-4 flex-col",
+          className
+        )}
+        {...props}
+      />
+    </div>
+  )
+})
+CarouselContent.displayName = "CarouselContent"
+
+const CarouselItem = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => {
+  const { orientation } = useCarousel()
+
+  return (
+    <div
+      ref={ref}
+      role="group"
+      aria-roledescription="slide"
+      className={cn(
+        "min-w-0 shrink-0 grow-0 basis-full",
+        orientation === "horizontal" ? "pl-4" : "pt-4",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+CarouselItem.displayName = "CarouselItem"
+
+const CarouselPrevious = React.forwardRef<
+  HTMLButtonElement,
+  React.ComponentProps<typeof Button>
+>(({ className, variant = "outline", size = "icon", ...props }, ref) => {
+  const { orientation, scrollPrev, canScrollPrev } = useCarousel()
+
+  return (
+    <Button
+      ref={ref}
+      variant={variant}
+      size={size}
+      className={cn(
+        "absolute  h-8 w-8 rounded-full",
+        orientation === "horizontal"
+          ? "-left-12 top-1/2 -translate-y-1/2"
+          : "-top-12 left-1/2 -translate-x-1/2 rotate-90",
+        className
+      )}
+      disabled={!canScrollPrev}
+      onClick={scrollPrev}
+      {...props}
+    >
+      <ArrowLeft className="h-4 w-4" />
+      <span className="sr-only">Previous slide</span>
+    </Button>
+  )
+})
+CarouselPrevious.displayName = "CarouselPrevious"
+
+const CarouselNext = React.forwardRef<
+  HTMLButtonElement,
+  React.ComponentProps<typeof Button>
+>(({ className, variant = "outline", size = "icon", ...props }, ref) => {
+  const { orientation, scrollNext, canScrollNext } = useCarousel()
+
+  return (
+    <Button
+      ref={ref}
+      variant={variant}
+      size={size}
+      className={cn(
+        "absolute h-8 w-8 rounded-full",
+        orientation === "horizontal"
+          ? "-right-12 top-1/2 -translate-y-1/2"
+          : "-bottom-12 left-1/2 -translate-x-1/2 rotate-90",
+        className
+      )}
+      disabled={!canScrollNext}
+      onClick={scrollNext}
+      {...props}
+    >
+      <ArrowRight className="h-4 w-4" />
+      <span className="sr-only">Next slide</span>
+    </Button>
+  )
+})
+CarouselNext.displayName = "CarouselNext"
+
+export {
+  type CarouselApi,
+  Carousel,
+  CarouselContent,
+  CarouselItem,
+  CarouselPrevious,
+  CarouselNext,
+}
diff --git a/application/src/components/ui/chart.tsx b/application/src/components/ui/chart.tsx
new file mode 100644
index 0000000..a21d77e
--- /dev/null
+++ b/application/src/components/ui/chart.tsx
@@ -0,0 +1,363 @@
+import * as React from "react"
+import * as RechartsPrimitive from "recharts"
+
+import { cn } from "@/lib/utils"
+
+// Format: { THEME_NAME: CSS_SELECTOR }
+const THEMES = { light: "", dark: ".dark" } as const
+
+export type ChartConfig = {
+  [k in string]: {
+    label?: React.ReactNode
+    icon?: React.ComponentType
+  } & (
+    | { color?: string; theme?: never }
+    | { color?: never; theme: Record<keyof typeof THEMES, string> }
+  )
+}
+
+type ChartContextProps = {
+  config: ChartConfig
+}
+
+const ChartContext = React.createContext<ChartContextProps | null>(null)
+
+function useChart() {
+  const context = React.useContext(ChartContext)
+
+  if (!context) {
+    throw new Error("useChart must be used within a <ChartContainer />")
+  }
+
+  return context
+}
+
+const ChartContainer = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div"> & {
+    config: ChartConfig
+    children: React.ComponentProps<
+      typeof RechartsPrimitive.ResponsiveContainer
+    >["children"]
+  }
+>(({ id, className, children, config, ...props }, ref) => {
+  const uniqueId = React.useId()
+  const chartId = `chart-${id || uniqueId.replace(/:/g, "")}`
+
+  return (
+    <ChartContext.Provider value={{ config }}>
+      <div
+        data-chart={chartId}
+        ref={ref}
+        className={cn(
+          "flex aspect-video justify-center text-xs [&_.recharts-cartesian-axis-tick_text]:fill-muted-foreground [&_.recharts-cartesian-grid_line[stroke='#ccc']]:stroke-border/50 [&_.recharts-curve.recharts-tooltip-cursor]:stroke-border [&_.recharts-dot[stroke='#fff']]:stroke-transparent [&_.recharts-layer]:outline-none [&_.recharts-polar-grid_[stroke='#ccc']]:stroke-border [&_.recharts-radial-bar-background-sector]:fill-muted [&_.recharts-rectangle.recharts-tooltip-cursor]:fill-muted [&_.recharts-reference-line_[stroke='#ccc']]:stroke-border [&_.recharts-sector[stroke='#fff']]:stroke-transparent [&_.recharts-sector]:outline-none [&_.recharts-surface]:outline-none",
+          className
+        )}
+        {...props}
+      >
+        <ChartStyle id={chartId} config={config} />
+        <RechartsPrimitive.ResponsiveContainer>
+          {children}
+        </RechartsPrimitive.ResponsiveContainer>
+      </div>
+    </ChartContext.Provider>
+  )
+})
+ChartContainer.displayName = "Chart"
+
+const ChartStyle = ({ id, config }: { id: string; config: ChartConfig }) => {
+  const colorConfig = Object.entries(config).filter(
+    ([_, config]) => config.theme || config.color
+  )
+
+  if (!colorConfig.length) {
+    return null
+  }
+
+  return (
+    <style
+      dangerouslySetInnerHTML={{
+        __html: Object.entries(THEMES)
+          .map(
+            ([theme, prefix]) => `
+${prefix} [data-chart=${id}] {
+${colorConfig
+  .map(([key, itemConfig]) => {
+    const color =
+      itemConfig.theme?.[theme as keyof typeof itemConfig.theme] ||
+      itemConfig.color
+    return color ? `  --color-${key}: ${color};` : null
+  })
+  .join("\n")}
+}
+`
+          )
+          .join("\n"),
+      }}
+    />
+  )
+}
+
+const ChartTooltip = RechartsPrimitive.Tooltip
+
+const ChartTooltipContent = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<typeof RechartsPrimitive.Tooltip> &
+    React.ComponentProps<"div"> & {
+      hideLabel?: boolean
+      hideIndicator?: boolean
+      indicator?: "line" | "dot" | "dashed"
+      nameKey?: string
+      labelKey?: string
+    }
+>(
+  (
+    {
+      active,
+      payload,
+      className,
+      indicator = "dot",
+      hideLabel = false,
+      hideIndicator = false,
+      label,
+      labelFormatter,
+      labelClassName,
+      formatter,
+      color,
+      nameKey,
+      labelKey,
+    },
+    ref
+  ) => {
+    const { config } = useChart()
+
+    const tooltipLabel = React.useMemo(() => {
+      if (hideLabel || !payload?.length) {
+        return null
+      }
+
+      const [item] = payload
+      const key = `${labelKey || item.dataKey || item.name || "value"}`
+      const itemConfig = getPayloadConfigFromPayload(config, item, key)
+      const value =
+        !labelKey && typeof label === "string"
+          ? config[label as keyof typeof config]?.label || label
+          : itemConfig?.label
+
+      if (labelFormatter) {
+        return (
+          <div className={cn("font-medium", labelClassName)}>
+            {labelFormatter(value, payload)}
+          </div>
+        )
+      }
+
+      if (!value) {
+        return null
+      }
+
+      return <div className={cn("font-medium", labelClassName)}>{value}</div>
+    }, [
+      label,
+      labelFormatter,
+      payload,
+      hideLabel,
+      labelClassName,
+      config,
+      labelKey,
+    ])
+
+    if (!active || !payload?.length) {
+      return null
+    }
+
+    const nestLabel = payload.length === 1 && indicator !== "dot"
+
+    return (
+      <div
+        ref={ref}
+        className={cn(
+          "grid min-w-[8rem] items-start gap-1.5 rounded-lg border border-border/50 bg-background px-2.5 py-1.5 text-xs shadow-xl",
+          className
+        )}
+      >
+        {!nestLabel ? tooltipLabel : null}
+        <div className="grid gap-1.5">
+          {payload.map((item, index) => {
+            const key = `${nameKey || item.name || item.dataKey || "value"}`
+            const itemConfig = getPayloadConfigFromPayload(config, item, key)
+            const indicatorColor = color || item.payload.fill || item.color
+
+            return (
+              <div
+                key={item.dataKey}
+                className={cn(
+                  "flex w-full flex-wrap items-stretch gap-2 [&>svg]:h-2.5 [&>svg]:w-2.5 [&>svg]:text-muted-foreground",
+                  indicator === "dot" && "items-center"
+                )}
+              >
+                {formatter && item?.value !== undefined && item.name ? (
+                  formatter(item.value, item.name, item, index, item.payload)
+                ) : (
+                  <>
+                    {itemConfig?.icon ? (
+                      <itemConfig.icon />
+                    ) : (
+                      !hideIndicator && (
+                        <div
+                          className={cn(
+                            "shrink-0 rounded-[2px] border-[--color-border] bg-[--color-bg]",
+                            {
+                              "h-2.5 w-2.5": indicator === "dot",
+                              "w-1": indicator === "line",
+                              "w-0 border-[1.5px] border-dashed bg-transparent":
+                                indicator === "dashed",
+                              "my-0.5": nestLabel && indicator === "dashed",
+                            }
+                          )}
+                          style={
+                            {
+                              "--color-bg": indicatorColor,
+                              "--color-border": indicatorColor,
+                            } as React.CSSProperties
+                          }
+                        />
+                      )
+                    )}
+                    <div
+                      className={cn(
+                        "flex flex-1 justify-between leading-none",
+                        nestLabel ? "items-end" : "items-center"
+                      )}
+                    >
+                      <div className="grid gap-1.5">
+                        {nestLabel ? tooltipLabel : null}
+                        <span className="text-muted-foreground">
+                          {itemConfig?.label || item.name}
+                        </span>
+                      </div>
+                      {item.value && (
+                        <span className="font-mono font-medium tabular-nums text-foreground">
+                          {item.value.toLocaleString()}
+                        </span>
+                      )}
+                    </div>
+                  </>
+                )}
+              </div>
+            )
+          })}
+        </div>
+      </div>
+    )
+  }
+)
+ChartTooltipContent.displayName = "ChartTooltip"
+
+const ChartLegend = RechartsPrimitive.Legend
+
+const ChartLegendContent = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div"> &
+    Pick<RechartsPrimitive.LegendProps, "payload" | "verticalAlign"> & {
+      hideIcon?: boolean
+      nameKey?: string
+    }
+>(
+  (
+    { className, hideIcon = false, payload, verticalAlign = "bottom", nameKey },
+    ref
+  ) => {
+    const { config } = useChart()
+
+    if (!payload?.length) {
+      return null
+    }
+
+    return (
+      <div
+        ref={ref}
+        className={cn(
+          "flex items-center justify-center gap-4",
+          verticalAlign === "top" ? "pb-3" : "pt-3",
+          className
+        )}
+      >
+        {payload.map((item) => {
+          const key = `${nameKey || item.dataKey || "value"}`
+          const itemConfig = getPayloadConfigFromPayload(config, item, key)
+
+          return (
+            <div
+              key={item.value}
+              className={cn(
+                "flex items-center gap-1.5 [&>svg]:h-3 [&>svg]:w-3 [&>svg]:text-muted-foreground"
+              )}
+            >
+              {itemConfig?.icon && !hideIcon ? (
+                <itemConfig.icon />
+              ) : (
+                <div
+                  className="h-2 w-2 shrink-0 rounded-[2px]"
+                  style={{
+                    backgroundColor: item.color,
+                  }}
+                />
+              )}
+              {itemConfig?.label}
+            </div>
+          )
+        })}
+      </div>
+    )
+  }
+)
+ChartLegendContent.displayName = "ChartLegend"
+
+// Helper to extract item config from a payload.
+function getPayloadConfigFromPayload(
+  config: ChartConfig,
+  payload: unknown,
+  key: string
+) {
+  if (typeof payload !== "object" || payload === null) {
+    return undefined
+  }
+
+  const payloadPayload =
+    "payload" in payload &&
+    typeof payload.payload === "object" &&
+    payload.payload !== null
+      ? payload.payload
+      : undefined
+
+  let configLabelKey: string = key
+
+  if (
+    key in payload &&
+    typeof payload[key as keyof typeof payload] === "string"
+  ) {
+    configLabelKey = payload[key as keyof typeof payload] as string
+  } else if (
+    payloadPayload &&
+    key in payloadPayload &&
+    typeof payloadPayload[key as keyof typeof payloadPayload] === "string"
+  ) {
+    configLabelKey = payloadPayload[
+      key as keyof typeof payloadPayload
+    ] as string
+  }
+
+  return configLabelKey in config
+    ? config[configLabelKey]
+    : config[key as keyof typeof config]
+}
+
+export {
+  ChartContainer,
+  ChartTooltip,
+  ChartTooltipContent,
+  ChartLegend,
+  ChartLegendContent,
+  ChartStyle,
+}
diff --git a/application/src/components/ui/checkbox.tsx b/application/src/components/ui/checkbox.tsx
new file mode 100644
index 0000000..ddbdd01
--- /dev/null
+++ b/application/src/components/ui/checkbox.tsx
@@ -0,0 +1,28 @@
+import * as React from "react"
+import * as CheckboxPrimitive from "@radix-ui/react-checkbox"
+import { Check } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const Checkbox = React.forwardRef<
+  React.ElementRef<typeof CheckboxPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof CheckboxPrimitive.Root>
+>(({ className, ...props }, ref) => (
+  <CheckboxPrimitive.Root
+    ref={ref}
+    className={cn(
+      "peer h-4 w-4 shrink-0 rounded-sm border border-primary ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=checked]:text-primary-foreground",
+      className
+    )}
+    {...props}
+  >
+    <CheckboxPrimitive.Indicator
+      className={cn("flex items-center justify-center text-current")}
+    >
+      <Check className="h-4 w-4" />
+    </CheckboxPrimitive.Indicator>
+  </CheckboxPrimitive.Root>
+))
+Checkbox.displayName = CheckboxPrimitive.Root.displayName
+
+export { Checkbox }
diff --git a/application/src/components/ui/collapsible.tsx b/application/src/components/ui/collapsible.tsx
new file mode 100644
index 0000000..a23e7a2
--- /dev/null
+++ b/application/src/components/ui/collapsible.tsx
@@ -0,0 +1,9 @@
+import * as CollapsiblePrimitive from "@radix-ui/react-collapsible"
+
+const Collapsible = CollapsiblePrimitive.Root
+
+const CollapsibleTrigger = CollapsiblePrimitive.CollapsibleTrigger
+
+const CollapsibleContent = CollapsiblePrimitive.CollapsibleContent
+
+export { Collapsible, CollapsibleTrigger, CollapsibleContent }
diff --git a/application/src/components/ui/command.tsx b/application/src/components/ui/command.tsx
new file mode 100644
index 0000000..56a0979
--- /dev/null
+++ b/application/src/components/ui/command.tsx
@@ -0,0 +1,153 @@
+import * as React from "react"
+import { type DialogProps } from "@radix-ui/react-dialog"
+import { Command as CommandPrimitive } from "cmdk"
+import { Search } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+import { Dialog, DialogContent } from "@/components/ui/dialog"
+
+const Command = React.forwardRef<
+  React.ElementRef<typeof CommandPrimitive>,
+  React.ComponentPropsWithoutRef<typeof CommandPrimitive>
+>(({ className, ...props }, ref) => (
+  <CommandPrimitive
+    ref={ref}
+    className={cn(
+      "flex h-full w-full flex-col overflow-hidden rounded-md bg-popover text-popover-foreground",
+      className
+    )}
+    {...props}
+  />
+))
+Command.displayName = CommandPrimitive.displayName
+
+interface CommandDialogProps extends DialogProps {}
+
+const CommandDialog = ({ children, ...props }: CommandDialogProps) => {
+  return (
+    <Dialog {...props}>
+      <DialogContent className="overflow-hidden p-0 shadow-lg">
+        <Command className="[&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:font-medium [&_[cmdk-group-heading]]:text-muted-foreground [&_[cmdk-group]:not([hidden])_~[cmdk-group]]:pt-0 [&_[cmdk-group]]:px-2 [&_[cmdk-input-wrapper]_svg]:h-5 [&_[cmdk-input-wrapper]_svg]:w-5 [&_[cmdk-input]]:h-12 [&_[cmdk-item]]:px-2 [&_[cmdk-item]]:py-3 [&_[cmdk-item]_svg]:h-5 [&_[cmdk-item]_svg]:w-5">
+          {children}
+        </Command>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+const CommandInput = React.forwardRef<
+  React.ElementRef<typeof CommandPrimitive.Input>,
+  React.ComponentPropsWithoutRef<typeof CommandPrimitive.Input>
+>(({ className, ...props }, ref) => (
+  <div className="flex items-center border-b px-3" cmdk-input-wrapper="">
+    <Search className="mr-2 h-4 w-4 shrink-0 opacity-50" />
+    <CommandPrimitive.Input
+      ref={ref}
+      className={cn(
+        "flex h-11 w-full rounded-md bg-transparent py-3 text-sm outline-none placeholder:text-muted-foreground disabled:cursor-not-allowed disabled:opacity-50",
+        className
+      )}
+      {...props}
+    />
+  </div>
+))
+
+CommandInput.displayName = CommandPrimitive.Input.displayName
+
+const CommandList = React.forwardRef<
+  React.ElementRef<typeof CommandPrimitive.List>,
+  React.ComponentPropsWithoutRef<typeof CommandPrimitive.List>
+>(({ className, ...props }, ref) => (
+  <CommandPrimitive.List
+    ref={ref}
+    className={cn("max-h-[300px] overflow-y-auto overflow-x-hidden", className)}
+    {...props}
+  />
+))
+
+CommandList.displayName = CommandPrimitive.List.displayName
+
+const CommandEmpty = React.forwardRef<
+  React.ElementRef<typeof CommandPrimitive.Empty>,
+  React.ComponentPropsWithoutRef<typeof CommandPrimitive.Empty>
+>((props, ref) => (
+  <CommandPrimitive.Empty
+    ref={ref}
+    className="py-6 text-center text-sm"
+    {...props}
+  />
+))
+
+CommandEmpty.displayName = CommandPrimitive.Empty.displayName
+
+const CommandGroup = React.forwardRef<
+  React.ElementRef<typeof CommandPrimitive.Group>,
+  React.ComponentPropsWithoutRef<typeof CommandPrimitive.Group>
+>(({ className, ...props }, ref) => (
+  <CommandPrimitive.Group
+    ref={ref}
+    className={cn(
+      "overflow-hidden p-1 text-foreground [&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:py-1.5 [&_[cmdk-group-heading]]:text-xs [&_[cmdk-group-heading]]:font-medium [&_[cmdk-group-heading]]:text-muted-foreground",
+      className
+    )}
+    {...props}
+  />
+))
+
+CommandGroup.displayName = CommandPrimitive.Group.displayName
+
+const CommandSeparator = React.forwardRef<
+  React.ElementRef<typeof CommandPrimitive.Separator>,
+  React.ComponentPropsWithoutRef<typeof CommandPrimitive.Separator>
+>(({ className, ...props }, ref) => (
+  <CommandPrimitive.Separator
+    ref={ref}
+    className={cn("-mx-1 h-px bg-border", className)}
+    {...props}
+  />
+))
+CommandSeparator.displayName = CommandPrimitive.Separator.displayName
+
+const CommandItem = React.forwardRef<
+  React.ElementRef<typeof CommandPrimitive.Item>,
+  React.ComponentPropsWithoutRef<typeof CommandPrimitive.Item>
+>(({ className, ...props }, ref) => (
+  <CommandPrimitive.Item
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none data-[disabled=true]:pointer-events-none data-[selected='true']:bg-accent data-[selected=true]:text-accent-foreground data-[disabled=true]:opacity-50",
+      className
+    )}
+    {...props}
+  />
+))
+
+CommandItem.displayName = CommandPrimitive.Item.displayName
+
+const CommandShortcut = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLSpanElement>) => {
+  return (
+    <span
+      className={cn(
+        "ml-auto text-xs tracking-widest text-muted-foreground",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+CommandShortcut.displayName = "CommandShortcut"
+
+export {
+  Command,
+  CommandDialog,
+  CommandInput,
+  CommandList,
+  CommandEmpty,
+  CommandGroup,
+  CommandItem,
+  CommandShortcut,
+  CommandSeparator,
+}
diff --git a/application/src/components/ui/context-menu.tsx b/application/src/components/ui/context-menu.tsx
new file mode 100644
index 0000000..3e52999
--- /dev/null
+++ b/application/src/components/ui/context-menu.tsx
@@ -0,0 +1,198 @@
+import * as React from "react"
+import * as ContextMenuPrimitive from "@radix-ui/react-context-menu"
+import { Check, ChevronRight, Circle } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const ContextMenu = ContextMenuPrimitive.Root
+
+const ContextMenuTrigger = ContextMenuPrimitive.Trigger
+
+const ContextMenuGroup = ContextMenuPrimitive.Group
+
+const ContextMenuPortal = ContextMenuPrimitive.Portal
+
+const ContextMenuSub = ContextMenuPrimitive.Sub
+
+const ContextMenuRadioGroup = ContextMenuPrimitive.RadioGroup
+
+const ContextMenuSubTrigger = React.forwardRef<
+  React.ElementRef<typeof ContextMenuPrimitive.SubTrigger>,
+  React.ComponentPropsWithoutRef<typeof ContextMenuPrimitive.SubTrigger> & {
+    inset?: boolean
+  }
+>(({ className, inset, children, ...props }, ref) => (
+  <ContextMenuPrimitive.SubTrigger
+    ref={ref}
+    className={cn(
+      "flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[state=open]:bg-accent data-[state=open]:text-accent-foreground",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  >
+    {children}
+    <ChevronRight className="ml-auto h-4 w-4" />
+  </ContextMenuPrimitive.SubTrigger>
+))
+ContextMenuSubTrigger.displayName = ContextMenuPrimitive.SubTrigger.displayName
+
+const ContextMenuSubContent = React.forwardRef<
+  React.ElementRef<typeof ContextMenuPrimitive.SubContent>,
+  React.ComponentPropsWithoutRef<typeof ContextMenuPrimitive.SubContent>
+>(({ className, ...props }, ref) => (
+  <ContextMenuPrimitive.SubContent
+    ref={ref}
+    className={cn(
+      "z-50 min-w-[8rem] overflow-hidden rounded-md border bg-popover p-1 text-popover-foreground shadow-md data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+      className
+    )}
+    {...props}
+  />
+))
+ContextMenuSubContent.displayName = ContextMenuPrimitive.SubContent.displayName
+
+const ContextMenuContent = React.forwardRef<
+  React.ElementRef<typeof ContextMenuPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof ContextMenuPrimitive.Content>
+>(({ className, ...props }, ref) => (
+  <ContextMenuPrimitive.Portal>
+    <ContextMenuPrimitive.Content
+      ref={ref}
+      className={cn(
+        "z-50 min-w-[8rem] overflow-hidden rounded-md border bg-popover p-1 text-popover-foreground shadow-md animate-in fade-in-80 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+        className
+      )}
+      {...props}
+    />
+  </ContextMenuPrimitive.Portal>
+))
+ContextMenuContent.displayName = ContextMenuPrimitive.Content.displayName
+
+const ContextMenuItem = React.forwardRef<
+  React.ElementRef<typeof ContextMenuPrimitive.Item>,
+  React.ComponentPropsWithoutRef<typeof ContextMenuPrimitive.Item> & {
+    inset?: boolean
+  }
+>(({ className, inset, ...props }, ref) => (
+  <ContextMenuPrimitive.Item
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  />
+))
+ContextMenuItem.displayName = ContextMenuPrimitive.Item.displayName
+
+const ContextMenuCheckboxItem = React.forwardRef<
+  React.ElementRef<typeof ContextMenuPrimitive.CheckboxItem>,
+  React.ComponentPropsWithoutRef<typeof ContextMenuPrimitive.CheckboxItem>
+>(({ className, children, checked, ...props }, ref) => (
+  <ContextMenuPrimitive.CheckboxItem
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      className
+    )}
+    checked={checked}
+    {...props}
+  >
+    <span className="absolute left-2 flex h-3.5 w-3.5 items-center justify-center">
+      <ContextMenuPrimitive.ItemIndicator>
+        <Check className="h-4 w-4" />
+      </ContextMenuPrimitive.ItemIndicator>
+    </span>
+    {children}
+  </ContextMenuPrimitive.CheckboxItem>
+))
+ContextMenuCheckboxItem.displayName =
+  ContextMenuPrimitive.CheckboxItem.displayName
+
+const ContextMenuRadioItem = React.forwardRef<
+  React.ElementRef<typeof ContextMenuPrimitive.RadioItem>,
+  React.ComponentPropsWithoutRef<typeof ContextMenuPrimitive.RadioItem>
+>(({ className, children, ...props }, ref) => (
+  <ContextMenuPrimitive.RadioItem
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      className
+    )}
+    {...props}
+  >
+    <span className="absolute left-2 flex h-3.5 w-3.5 items-center justify-center">
+      <ContextMenuPrimitive.ItemIndicator>
+        <Circle className="h-2 w-2 fill-current" />
+      </ContextMenuPrimitive.ItemIndicator>
+    </span>
+    {children}
+  </ContextMenuPrimitive.RadioItem>
+))
+ContextMenuRadioItem.displayName = ContextMenuPrimitive.RadioItem.displayName
+
+const ContextMenuLabel = React.forwardRef<
+  React.ElementRef<typeof ContextMenuPrimitive.Label>,
+  React.ComponentPropsWithoutRef<typeof ContextMenuPrimitive.Label> & {
+    inset?: boolean
+  }
+>(({ className, inset, ...props }, ref) => (
+  <ContextMenuPrimitive.Label
+    ref={ref}
+    className={cn(
+      "px-2 py-1.5 text-sm font-semibold text-foreground",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  />
+))
+ContextMenuLabel.displayName = ContextMenuPrimitive.Label.displayName
+
+const ContextMenuSeparator = React.forwardRef<
+  React.ElementRef<typeof ContextMenuPrimitive.Separator>,
+  React.ComponentPropsWithoutRef<typeof ContextMenuPrimitive.Separator>
+>(({ className, ...props }, ref) => (
+  <ContextMenuPrimitive.Separator
+    ref={ref}
+    className={cn("-mx-1 my-1 h-px bg-border", className)}
+    {...props}
+  />
+))
+ContextMenuSeparator.displayName = ContextMenuPrimitive.Separator.displayName
+
+const ContextMenuShortcut = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLSpanElement>) => {
+  return (
+    <span
+      className={cn(
+        "ml-auto text-xs tracking-widest text-muted-foreground",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+ContextMenuShortcut.displayName = "ContextMenuShortcut"
+
+export {
+  ContextMenu,
+  ContextMenuTrigger,
+  ContextMenuContent,
+  ContextMenuItem,
+  ContextMenuCheckboxItem,
+  ContextMenuRadioItem,
+  ContextMenuLabel,
+  ContextMenuSeparator,
+  ContextMenuShortcut,
+  ContextMenuGroup,
+  ContextMenuPortal,
+  ContextMenuSub,
+  ContextMenuSubContent,
+  ContextMenuSubTrigger,
+  ContextMenuRadioGroup,
+}
diff --git a/application/src/components/ui/dialog.tsx b/application/src/components/ui/dialog.tsx
new file mode 100644
index 0000000..c23630e
--- /dev/null
+++ b/application/src/components/ui/dialog.tsx
@@ -0,0 +1,120 @@
+import * as React from "react"
+import * as DialogPrimitive from "@radix-ui/react-dialog"
+import { X } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const Dialog = DialogPrimitive.Root
+
+const DialogTrigger = DialogPrimitive.Trigger
+
+const DialogPortal = DialogPrimitive.Portal
+
+const DialogClose = DialogPrimitive.Close
+
+const DialogOverlay = React.forwardRef<
+  React.ElementRef<typeof DialogPrimitive.Overlay>,
+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Overlay>
+>(({ className, ...props }, ref) => (
+  <DialogPrimitive.Overlay
+    ref={ref}
+    className={cn(
+      "fixed inset-0 z-50 bg-black/80  data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+      className
+    )}
+    {...props}
+  />
+))
+DialogOverlay.displayName = DialogPrimitive.Overlay.displayName
+
+const DialogContent = React.forwardRef<
+  React.ElementRef<typeof DialogPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Content>
+>(({ className, children, ...props }, ref) => (
+  <DialogPortal>
+    <DialogOverlay />
+    <DialogPrimitive.Content
+      ref={ref}
+      className={cn(
+        "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 border bg-background p-6 shadow-lg duration-200 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[state=closed]:slide-out-to-left-1/2 data-[state=closed]:slide-out-to-top-[48%] data-[state=open]:slide-in-from-left-1/2 data-[state=open]:slide-in-from-top-[48%] sm:rounded-lg",
+        className
+      )}
+      {...props}
+    >
+      {children}
+      <DialogPrimitive.Close className="absolute right-4 top-4 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-accent data-[state=open]:text-muted-foreground">
+        <X className="h-4 w-4" />
+        <span className="sr-only">Close</span>
+      </DialogPrimitive.Close>
+    </DialogPrimitive.Content>
+  </DialogPortal>
+))
+DialogContent.displayName = DialogPrimitive.Content.displayName
+
+const DialogHeader = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn(
+      "flex flex-col space-y-1.5 text-center sm:text-left",
+      className
+    )}
+    {...props}
+  />
+)
+DialogHeader.displayName = "DialogHeader"
+
+const DialogFooter = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn(
+      "flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2",
+      className
+    )}
+    {...props}
+  />
+)
+DialogFooter.displayName = "DialogFooter"
+
+const DialogTitle = React.forwardRef<
+  React.ElementRef<typeof DialogPrimitive.Title>,
+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
+>(({ className, ...props }, ref) => (
+  <DialogPrimitive.Title
+    ref={ref}
+    className={cn(
+      "text-lg font-semibold leading-none tracking-tight",
+      className
+    )}
+    {...props}
+  />
+))
+DialogTitle.displayName = DialogPrimitive.Title.displayName
+
+const DialogDescription = React.forwardRef<
+  React.ElementRef<typeof DialogPrimitive.Description>,
+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
+>(({ className, ...props }, ref) => (
+  <DialogPrimitive.Description
+    ref={ref}
+    className={cn("text-sm text-muted-foreground", className)}
+    {...props}
+  />
+))
+DialogDescription.displayName = DialogPrimitive.Description.displayName
+
+export {
+  Dialog,
+  DialogPortal,
+  DialogOverlay,
+  DialogClose,
+  DialogTrigger,
+  DialogContent,
+  DialogHeader,
+  DialogFooter,
+  DialogTitle,
+  DialogDescription,
+}
diff --git a/application/src/components/ui/drawer.tsx b/application/src/components/ui/drawer.tsx
new file mode 100644
index 0000000..c17b0cc
--- /dev/null
+++ b/application/src/components/ui/drawer.tsx
@@ -0,0 +1,116 @@
+import * as React from "react"
+import { Drawer as DrawerPrimitive } from "vaul"
+
+import { cn } from "@/lib/utils"
+
+const Drawer = ({
+  shouldScaleBackground = true,
+  ...props
+}: React.ComponentProps<typeof DrawerPrimitive.Root>) => (
+  <DrawerPrimitive.Root
+    shouldScaleBackground={shouldScaleBackground}
+    {...props}
+  />
+)
+Drawer.displayName = "Drawer"
+
+const DrawerTrigger = DrawerPrimitive.Trigger
+
+const DrawerPortal = DrawerPrimitive.Portal
+
+const DrawerClose = DrawerPrimitive.Close
+
+const DrawerOverlay = React.forwardRef<
+  React.ElementRef<typeof DrawerPrimitive.Overlay>,
+  React.ComponentPropsWithoutRef<typeof DrawerPrimitive.Overlay>
+>(({ className, ...props }, ref) => (
+  <DrawerPrimitive.Overlay
+    ref={ref}
+    className={cn("fixed inset-0 z-50 bg-black/80", className)}
+    {...props}
+  />
+))
+DrawerOverlay.displayName = DrawerPrimitive.Overlay.displayName
+
+const DrawerContent = React.forwardRef<
+  React.ElementRef<typeof DrawerPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof DrawerPrimitive.Content>
+>(({ className, children, ...props }, ref) => (
+  <DrawerPortal>
+    <DrawerOverlay />
+    <DrawerPrimitive.Content
+      ref={ref}
+      className={cn(
+        "fixed inset-x-0 bottom-0 z-50 mt-24 flex h-auto flex-col rounded-t-[10px] border bg-background",
+        className
+      )}
+      {...props}
+    >
+      <div className="mx-auto mt-4 h-2 w-[100px] rounded-full bg-muted" />
+      {children}
+    </DrawerPrimitive.Content>
+  </DrawerPortal>
+))
+DrawerContent.displayName = "DrawerContent"
+
+const DrawerHeader = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn("grid gap-1.5 p-4 text-center sm:text-left", className)}
+    {...props}
+  />
+)
+DrawerHeader.displayName = "DrawerHeader"
+
+const DrawerFooter = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn("mt-auto flex flex-col gap-2 p-4", className)}
+    {...props}
+  />
+)
+DrawerFooter.displayName = "DrawerFooter"
+
+const DrawerTitle = React.forwardRef<
+  React.ElementRef<typeof DrawerPrimitive.Title>,
+  React.ComponentPropsWithoutRef<typeof DrawerPrimitive.Title>
+>(({ className, ...props }, ref) => (
+  <DrawerPrimitive.Title
+    ref={ref}
+    className={cn(
+      "text-lg font-semibold leading-none tracking-tight",
+      className
+    )}
+    {...props}
+  />
+))
+DrawerTitle.displayName = DrawerPrimitive.Title.displayName
+
+const DrawerDescription = React.forwardRef<
+  React.ElementRef<typeof DrawerPrimitive.Description>,
+  React.ComponentPropsWithoutRef<typeof DrawerPrimitive.Description>
+>(({ className, ...props }, ref) => (
+  <DrawerPrimitive.Description
+    ref={ref}
+    className={cn("text-sm text-muted-foreground", className)}
+    {...props}
+  />
+))
+DrawerDescription.displayName = DrawerPrimitive.Description.displayName
+
+export {
+  Drawer,
+  DrawerPortal,
+  DrawerOverlay,
+  DrawerTrigger,
+  DrawerClose,
+  DrawerContent,
+  DrawerHeader,
+  DrawerFooter,
+  DrawerTitle,
+  DrawerDescription,
+}
diff --git a/application/src/components/ui/dropdown-menu.tsx b/application/src/components/ui/dropdown-menu.tsx
new file mode 100644
index 0000000..769ff7a
--- /dev/null
+++ b/application/src/components/ui/dropdown-menu.tsx
@@ -0,0 +1,198 @@
+import * as React from "react"
+import * as DropdownMenuPrimitive from "@radix-ui/react-dropdown-menu"
+import { Check, ChevronRight, Circle } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const DropdownMenu = DropdownMenuPrimitive.Root
+
+const DropdownMenuTrigger = DropdownMenuPrimitive.Trigger
+
+const DropdownMenuGroup = DropdownMenuPrimitive.Group
+
+const DropdownMenuPortal = DropdownMenuPrimitive.Portal
+
+const DropdownMenuSub = DropdownMenuPrimitive.Sub
+
+const DropdownMenuRadioGroup = DropdownMenuPrimitive.RadioGroup
+
+const DropdownMenuSubTrigger = React.forwardRef<
+  React.ElementRef<typeof DropdownMenuPrimitive.SubTrigger>,
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.SubTrigger> & {
+    inset?: boolean
+  }
+>(({ className, inset, children, ...props }, ref) => (
+  <DropdownMenuPrimitive.SubTrigger
+    ref={ref}
+    className={cn(
+      "flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none focus:bg-accent data-[state=open]:bg-accent",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  >
+    {children}
+    <ChevronRight className="ml-auto h-4 w-4" />
+  </DropdownMenuPrimitive.SubTrigger>
+))
+DropdownMenuSubTrigger.displayName =
+  DropdownMenuPrimitive.SubTrigger.displayName
+
+const DropdownMenuSubContent = React.forwardRef<
+  React.ElementRef<typeof DropdownMenuPrimitive.SubContent>,
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.SubContent>
+>(({ className, ...props }, ref) => (
+  <DropdownMenuPrimitive.SubContent
+    ref={ref}
+    className={cn(
+      "z-50 min-w-[8rem] overflow-hidden rounded-md border bg-popover p-1 text-popover-foreground shadow-lg data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+      className
+    )}
+    {...props}
+  />
+))
+DropdownMenuSubContent.displayName =
+  DropdownMenuPrimitive.SubContent.displayName
+
+const DropdownMenuContent = React.forwardRef<
+  React.ElementRef<typeof DropdownMenuPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Content>
+>(({ className, sideOffset = 4, ...props }, ref) => (
+  <DropdownMenuPrimitive.Portal>
+    <DropdownMenuPrimitive.Content
+      ref={ref}
+      sideOffset={sideOffset}
+      className={cn(
+        "z-50 min-w-[8rem] overflow-hidden rounded-md border bg-popover p-1 text-popover-foreground shadow-md data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+        className
+      )}
+      {...props}
+    />
+  </DropdownMenuPrimitive.Portal>
+))
+DropdownMenuContent.displayName = DropdownMenuPrimitive.Content.displayName
+
+const DropdownMenuItem = React.forwardRef<
+  React.ElementRef<typeof DropdownMenuPrimitive.Item>,
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Item> & {
+    inset?: boolean
+  }
+>(({ className, inset, ...props }, ref) => (
+  <DropdownMenuPrimitive.Item
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none transition-colors focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  />
+))
+DropdownMenuItem.displayName = DropdownMenuPrimitive.Item.displayName
+
+const DropdownMenuCheckboxItem = React.forwardRef<
+  React.ElementRef<typeof DropdownMenuPrimitive.CheckboxItem>,
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.CheckboxItem>
+>(({ className, children, checked, ...props }, ref) => (
+  <DropdownMenuPrimitive.CheckboxItem
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none transition-colors focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      className
+    )}
+    checked={checked}
+    {...props}
+  >
+    <span className="absolute left-2 flex h-3.5 w-3.5 items-center justify-center">
+      <DropdownMenuPrimitive.ItemIndicator>
+        <Check className="h-4 w-4" />
+      </DropdownMenuPrimitive.ItemIndicator>
+    </span>
+    {children}
+  </DropdownMenuPrimitive.CheckboxItem>
+))
+DropdownMenuCheckboxItem.displayName =
+  DropdownMenuPrimitive.CheckboxItem.displayName
+
+const DropdownMenuRadioItem = React.forwardRef<
+  React.ElementRef<typeof DropdownMenuPrimitive.RadioItem>,
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.RadioItem>
+>(({ className, children, ...props }, ref) => (
+  <DropdownMenuPrimitive.RadioItem
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none transition-colors focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      className
+    )}
+    {...props}
+  >
+    <span className="absolute left-2 flex h-3.5 w-3.5 items-center justify-center">
+      <DropdownMenuPrimitive.ItemIndicator>
+        <Circle className="h-2 w-2 fill-current" />
+      </DropdownMenuPrimitive.ItemIndicator>
+    </span>
+    {children}
+  </DropdownMenuPrimitive.RadioItem>
+))
+DropdownMenuRadioItem.displayName = DropdownMenuPrimitive.RadioItem.displayName
+
+const DropdownMenuLabel = React.forwardRef<
+  React.ElementRef<typeof DropdownMenuPrimitive.Label>,
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Label> & {
+    inset?: boolean
+  }
+>(({ className, inset, ...props }, ref) => (
+  <DropdownMenuPrimitive.Label
+    ref={ref}
+    className={cn(
+      "px-2 py-1.5 text-sm font-semibold",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  />
+))
+DropdownMenuLabel.displayName = DropdownMenuPrimitive.Label.displayName
+
+const DropdownMenuSeparator = React.forwardRef<
+  React.ElementRef<typeof DropdownMenuPrimitive.Separator>,
+  React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Separator>
+>(({ className, ...props }, ref) => (
+  <DropdownMenuPrimitive.Separator
+    ref={ref}
+    className={cn("-mx-1 my-1 h-px bg-muted", className)}
+    {...props}
+  />
+))
+DropdownMenuSeparator.displayName = DropdownMenuPrimitive.Separator.displayName
+
+const DropdownMenuShortcut = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLSpanElement>) => {
+  return (
+    <span
+      className={cn("ml-auto text-xs tracking-widest opacity-60", className)}
+      {...props}
+    />
+  )
+}
+DropdownMenuShortcut.displayName = "DropdownMenuShortcut"
+
+export {
+  DropdownMenu,
+  DropdownMenuTrigger,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuCheckboxItem,
+  DropdownMenuRadioItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuShortcut,
+  DropdownMenuGroup,
+  DropdownMenuPortal,
+  DropdownMenuSub,
+  DropdownMenuSubContent,
+  DropdownMenuSubTrigger,
+  DropdownMenuRadioGroup,
+}
diff --git a/application/src/components/ui/form.tsx b/application/src/components/ui/form.tsx
new file mode 100644
index 0000000..4603f8b
--- /dev/null
+++ b/application/src/components/ui/form.tsx
@@ -0,0 +1,176 @@
+import * as React from "react"
+import * as LabelPrimitive from "@radix-ui/react-label"
+import { Slot } from "@radix-ui/react-slot"
+import {
+  Controller,
+  ControllerProps,
+  FieldPath,
+  FieldValues,
+  FormProvider,
+  useFormContext,
+} from "react-hook-form"
+
+import { cn } from "@/lib/utils"
+import { Label } from "@/components/ui/label"
+
+const Form = FormProvider
+
+type FormFieldContextValue<
+  TFieldValues extends FieldValues = FieldValues,
+  TName extends FieldPath<TFieldValues> = FieldPath<TFieldValues>
+> = {
+  name: TName
+}
+
+const FormFieldContext = React.createContext<FormFieldContextValue>(
+  {} as FormFieldContextValue
+)
+
+const FormField = <
+  TFieldValues extends FieldValues = FieldValues,
+  TName extends FieldPath<TFieldValues> = FieldPath<TFieldValues>
+>({
+  ...props
+}: ControllerProps<TFieldValues, TName>) => {
+  return (
+    <FormFieldContext.Provider value={{ name: props.name }}>
+      <Controller {...props} />
+    </FormFieldContext.Provider>
+  )
+}
+
+const useFormField = () => {
+  const fieldContext = React.useContext(FormFieldContext)
+  const itemContext = React.useContext(FormItemContext)
+  const { getFieldState, formState } = useFormContext()
+
+  const fieldState = getFieldState(fieldContext.name, formState)
+
+  if (!fieldContext) {
+    throw new Error("useFormField should be used within <FormField>")
+  }
+
+  const { id } = itemContext
+
+  return {
+    id,
+    name: fieldContext.name,
+    formItemId: `${id}-form-item`,
+    formDescriptionId: `${id}-form-item-description`,
+    formMessageId: `${id}-form-item-message`,
+    ...fieldState,
+  }
+}
+
+type FormItemContextValue = {
+  id: string
+}
+
+const FormItemContext = React.createContext<FormItemContextValue>(
+  {} as FormItemContextValue
+)
+
+const FormItem = React.forwardRef<
+  HTMLDivElement,
+  React.HTMLAttributes<HTMLDivElement>
+>(({ className, ...props }, ref) => {
+  const id = React.useId()
+
+  return (
+    <FormItemContext.Provider value={{ id }}>
+      <div ref={ref} className={cn("space-y-2", className)} {...props} />
+    </FormItemContext.Provider>
+  )
+})
+FormItem.displayName = "FormItem"
+
+const FormLabel = React.forwardRef<
+  React.ElementRef<typeof LabelPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof LabelPrimitive.Root>
+>(({ className, ...props }, ref) => {
+  const { error, formItemId } = useFormField()
+
+  return (
+    <Label
+      ref={ref}
+      className={cn(error && "text-destructive", className)}
+      htmlFor={formItemId}
+      {...props}
+    />
+  )
+})
+FormLabel.displayName = "FormLabel"
+
+const FormControl = React.forwardRef<
+  React.ElementRef<typeof Slot>,
+  React.ComponentPropsWithoutRef<typeof Slot>
+>(({ ...props }, ref) => {
+  const { error, formItemId, formDescriptionId, formMessageId } = useFormField()
+
+  return (
+    <Slot
+      ref={ref}
+      id={formItemId}
+      aria-describedby={
+        !error
+          ? `${formDescriptionId}`
+          : `${formDescriptionId} ${formMessageId}`
+      }
+      aria-invalid={!!error}
+      {...props}
+    />
+  )
+})
+FormControl.displayName = "FormControl"
+
+const FormDescription = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLParagraphElement>
+>(({ className, ...props }, ref) => {
+  const { formDescriptionId } = useFormField()
+
+  return (
+    <p
+      ref={ref}
+      id={formDescriptionId}
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  )
+})
+FormDescription.displayName = "FormDescription"
+
+const FormMessage = React.forwardRef<
+  HTMLParagraphElement,
+  React.HTMLAttributes<HTMLParagraphElement>
+>(({ className, children, ...props }, ref) => {
+  const { error, formMessageId } = useFormField()
+  const body = error ? String(error?.message) : children
+
+  if (!body) {
+    return null
+  }
+
+  return (
+    <p
+      ref={ref}
+      id={formMessageId}
+      className={cn("text-sm font-medium text-destructive", className)}
+      {...props}
+    >
+      {body}
+    </p>
+  )
+})
+FormMessage.displayName = "FormMessage"
+
+export {
+  useFormField,
+  Form,
+  FormItem,
+  FormLabel,
+  FormControl,
+  FormDescription,
+  FormMessage,
+  FormField,
+}
diff --git a/application/src/components/ui/hover-card.tsx b/application/src/components/ui/hover-card.tsx
new file mode 100644
index 0000000..863ff01
--- /dev/null
+++ b/application/src/components/ui/hover-card.tsx
@@ -0,0 +1,27 @@
+import * as React from "react"
+import * as HoverCardPrimitive from "@radix-ui/react-hover-card"
+
+import { cn } from "@/lib/utils"
+
+const HoverCard = HoverCardPrimitive.Root
+
+const HoverCardTrigger = HoverCardPrimitive.Trigger
+
+const HoverCardContent = React.forwardRef<
+  React.ElementRef<typeof HoverCardPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof HoverCardPrimitive.Content>
+>(({ className, align = "center", sideOffset = 4, ...props }, ref) => (
+  <HoverCardPrimitive.Content
+    ref={ref}
+    align={align}
+    sideOffset={sideOffset}
+    className={cn(
+      "z-50 w-64 rounded-md border bg-popover p-4 text-popover-foreground shadow-md outline-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+      className
+    )}
+    {...props}
+  />
+))
+HoverCardContent.displayName = HoverCardPrimitive.Content.displayName
+
+export { HoverCard, HoverCardTrigger, HoverCardContent }
diff --git a/application/src/components/ui/input-otp.tsx b/application/src/components/ui/input-otp.tsx
new file mode 100644
index 0000000..ebf5c28
--- /dev/null
+++ b/application/src/components/ui/input-otp.tsx
@@ -0,0 +1,69 @@
+import * as React from "react"
+import { OTPInput, OTPInputContext } from "input-otp"
+import { Dot } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const InputOTP = React.forwardRef<
+  React.ElementRef<typeof OTPInput>,
+  React.ComponentPropsWithoutRef<typeof OTPInput>
+>(({ className, containerClassName, ...props }, ref) => (
+  <OTPInput
+    ref={ref}
+    containerClassName={cn(
+      "flex items-center gap-2 has-[:disabled]:opacity-50",
+      containerClassName
+    )}
+    className={cn("disabled:cursor-not-allowed", className)}
+    {...props}
+  />
+))
+InputOTP.displayName = "InputOTP"
+
+const InputOTPGroup = React.forwardRef<
+  React.ElementRef<"div">,
+  React.ComponentPropsWithoutRef<"div">
+>(({ className, ...props }, ref) => (
+  <div ref={ref} className={cn("flex items-center", className)} {...props} />
+))
+InputOTPGroup.displayName = "InputOTPGroup"
+
+const InputOTPSlot = React.forwardRef<
+  React.ElementRef<"div">,
+  React.ComponentPropsWithoutRef<"div"> & { index: number }
+>(({ index, className, ...props }, ref) => {
+  const inputOTPContext = React.useContext(OTPInputContext)
+  const { char, hasFakeCaret, isActive } = inputOTPContext.slots[index]
+
+  return (
+    <div
+      ref={ref}
+      className={cn(
+        "relative flex h-10 w-10 items-center justify-center border-y border-r border-input text-sm transition-all first:rounded-l-md first:border-l last:rounded-r-md",
+        isActive && "z-10 ring-2 ring-ring ring-offset-background",
+        className
+      )}
+      {...props}
+    >
+      {char}
+      {hasFakeCaret && (
+        <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
+          <div className="h-4 w-px animate-caret-blink bg-foreground duration-1000" />
+        </div>
+      )}
+    </div>
+  )
+})
+InputOTPSlot.displayName = "InputOTPSlot"
+
+const InputOTPSeparator = React.forwardRef<
+  React.ElementRef<"div">,
+  React.ComponentPropsWithoutRef<"div">
+>(({ ...props }, ref) => (
+  <div ref={ref} role="separator" {...props}>
+    <Dot />
+  </div>
+))
+InputOTPSeparator.displayName = "InputOTPSeparator"
+
+export { InputOTP, InputOTPGroup, InputOTPSlot, InputOTPSeparator }
diff --git a/application/src/components/ui/input.tsx b/application/src/components/ui/input.tsx
new file mode 100644
index 0000000..68551b9
--- /dev/null
+++ b/application/src/components/ui/input.tsx
@@ -0,0 +1,22 @@
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+const Input = React.forwardRef<HTMLInputElement, React.ComponentProps<"input">>(
+  ({ className, type, ...props }, ref) => {
+    return (
+      <input
+        type={type}
+        className={cn(
+          "flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-base ring-offset-background file:border-0 file:bg-transparent file:text-sm file:font-medium file:text-foreground placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 md:text-sm",
+          className
+        )}
+        ref={ref}
+        {...props}
+      />
+    )
+  }
+)
+Input.displayName = "Input"
+
+export { Input }
diff --git a/application/src/components/ui/label.tsx b/application/src/components/ui/label.tsx
new file mode 100644
index 0000000..683faa7
--- /dev/null
+++ b/application/src/components/ui/label.tsx
@@ -0,0 +1,24 @@
+import * as React from "react"
+import * as LabelPrimitive from "@radix-ui/react-label"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+
+const labelVariants = cva(
+  "text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+)
+
+const Label = React.forwardRef<
+  React.ElementRef<typeof LabelPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof LabelPrimitive.Root> &
+    VariantProps<typeof labelVariants>
+>(({ className, ...props }, ref) => (
+  <LabelPrimitive.Root
+    ref={ref}
+    className={cn(labelVariants(), className)}
+    {...props}
+  />
+))
+Label.displayName = LabelPrimitive.Root.displayName
+
+export { Label }
diff --git a/application/src/components/ui/menubar.tsx b/application/src/components/ui/menubar.tsx
new file mode 100644
index 0000000..d11c299
--- /dev/null
+++ b/application/src/components/ui/menubar.tsx
@@ -0,0 +1,234 @@
+import * as React from "react"
+import * as MenubarPrimitive from "@radix-ui/react-menubar"
+import { Check, ChevronRight, Circle } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const MenubarMenu = MenubarPrimitive.Menu
+
+const MenubarGroup = MenubarPrimitive.Group
+
+const MenubarPortal = MenubarPrimitive.Portal
+
+const MenubarSub = MenubarPrimitive.Sub
+
+const MenubarRadioGroup = MenubarPrimitive.RadioGroup
+
+const Menubar = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.Root>
+>(({ className, ...props }, ref) => (
+  <MenubarPrimitive.Root
+    ref={ref}
+    className={cn(
+      "flex h-10 items-center space-x-1 rounded-md border bg-background p-1",
+      className
+    )}
+    {...props}
+  />
+))
+Menubar.displayName = MenubarPrimitive.Root.displayName
+
+const MenubarTrigger = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.Trigger>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.Trigger>
+>(({ className, ...props }, ref) => (
+  <MenubarPrimitive.Trigger
+    ref={ref}
+    className={cn(
+      "flex cursor-default select-none items-center rounded-sm px-3 py-1.5 text-sm font-medium outline-none focus:bg-accent focus:text-accent-foreground data-[state=open]:bg-accent data-[state=open]:text-accent-foreground",
+      className
+    )}
+    {...props}
+  />
+))
+MenubarTrigger.displayName = MenubarPrimitive.Trigger.displayName
+
+const MenubarSubTrigger = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.SubTrigger>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.SubTrigger> & {
+    inset?: boolean
+  }
+>(({ className, inset, children, ...props }, ref) => (
+  <MenubarPrimitive.SubTrigger
+    ref={ref}
+    className={cn(
+      "flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[state=open]:bg-accent data-[state=open]:text-accent-foreground",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  >
+    {children}
+    <ChevronRight className="ml-auto h-4 w-4" />
+  </MenubarPrimitive.SubTrigger>
+))
+MenubarSubTrigger.displayName = MenubarPrimitive.SubTrigger.displayName
+
+const MenubarSubContent = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.SubContent>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.SubContent>
+>(({ className, ...props }, ref) => (
+  <MenubarPrimitive.SubContent
+    ref={ref}
+    className={cn(
+      "z-50 min-w-[8rem] overflow-hidden rounded-md border bg-popover p-1 text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+      className
+    )}
+    {...props}
+  />
+))
+MenubarSubContent.displayName = MenubarPrimitive.SubContent.displayName
+
+const MenubarContent = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.Content>
+>(
+  (
+    { className, align = "start", alignOffset = -4, sideOffset = 8, ...props },
+    ref
+  ) => (
+    <MenubarPrimitive.Portal>
+      <MenubarPrimitive.Content
+        ref={ref}
+        align={align}
+        alignOffset={alignOffset}
+        sideOffset={sideOffset}
+        className={cn(
+          "z-50 min-w-[12rem] overflow-hidden rounded-md border bg-popover p-1 text-popover-foreground shadow-md data-[state=open]:animate-in data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+          className
+        )}
+        {...props}
+      />
+    </MenubarPrimitive.Portal>
+  )
+)
+MenubarContent.displayName = MenubarPrimitive.Content.displayName
+
+const MenubarItem = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.Item>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.Item> & {
+    inset?: boolean
+  }
+>(({ className, inset, ...props }, ref) => (
+  <MenubarPrimitive.Item
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm px-2 py-1.5 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  />
+))
+MenubarItem.displayName = MenubarPrimitive.Item.displayName
+
+const MenubarCheckboxItem = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.CheckboxItem>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.CheckboxItem>
+>(({ className, children, checked, ...props }, ref) => (
+  <MenubarPrimitive.CheckboxItem
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      className
+    )}
+    checked={checked}
+    {...props}
+  >
+    <span className="absolute left-2 flex h-3.5 w-3.5 items-center justify-center">
+      <MenubarPrimitive.ItemIndicator>
+        <Check className="h-4 w-4" />
+      </MenubarPrimitive.ItemIndicator>
+    </span>
+    {children}
+  </MenubarPrimitive.CheckboxItem>
+))
+MenubarCheckboxItem.displayName = MenubarPrimitive.CheckboxItem.displayName
+
+const MenubarRadioItem = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.RadioItem>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.RadioItem>
+>(({ className, children, ...props }, ref) => (
+  <MenubarPrimitive.RadioItem
+    ref={ref}
+    className={cn(
+      "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      className
+    )}
+    {...props}
+  >
+    <span className="absolute left-2 flex h-3.5 w-3.5 items-center justify-center">
+      <MenubarPrimitive.ItemIndicator>
+        <Circle className="h-2 w-2 fill-current" />
+      </MenubarPrimitive.ItemIndicator>
+    </span>
+    {children}
+  </MenubarPrimitive.RadioItem>
+))
+MenubarRadioItem.displayName = MenubarPrimitive.RadioItem.displayName
+
+const MenubarLabel = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.Label>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.Label> & {
+    inset?: boolean
+  }
+>(({ className, inset, ...props }, ref) => (
+  <MenubarPrimitive.Label
+    ref={ref}
+    className={cn(
+      "px-2 py-1.5 text-sm font-semibold",
+      inset && "pl-8",
+      className
+    )}
+    {...props}
+  />
+))
+MenubarLabel.displayName = MenubarPrimitive.Label.displayName
+
+const MenubarSeparator = React.forwardRef<
+  React.ElementRef<typeof MenubarPrimitive.Separator>,
+  React.ComponentPropsWithoutRef<typeof MenubarPrimitive.Separator>
+>(({ className, ...props }, ref) => (
+  <MenubarPrimitive.Separator
+    ref={ref}
+    className={cn("-mx-1 my-1 h-px bg-muted", className)}
+    {...props}
+  />
+))
+MenubarSeparator.displayName = MenubarPrimitive.Separator.displayName
+
+const MenubarShortcut = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLSpanElement>) => {
+  return (
+    <span
+      className={cn(
+        "ml-auto text-xs tracking-widest text-muted-foreground",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+MenubarShortcut.displayname = "MenubarShortcut"
+
+export {
+  Menubar,
+  MenubarMenu,
+  MenubarTrigger,
+  MenubarContent,
+  MenubarItem,
+  MenubarSeparator,
+  MenubarLabel,
+  MenubarCheckboxItem,
+  MenubarRadioGroup,
+  MenubarRadioItem,
+  MenubarPortal,
+  MenubarSubContent,
+  MenubarSubTrigger,
+  MenubarGroup,
+  MenubarSub,
+  MenubarShortcut,
+}
diff --git a/application/src/components/ui/navigation-menu.tsx b/application/src/components/ui/navigation-menu.tsx
new file mode 100644
index 0000000..1419f56
--- /dev/null
+++ b/application/src/components/ui/navigation-menu.tsx
@@ -0,0 +1,128 @@
+import * as React from "react"
+import * as NavigationMenuPrimitive from "@radix-ui/react-navigation-menu"
+import { cva } from "class-variance-authority"
+import { ChevronDown } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const NavigationMenu = React.forwardRef<
+  React.ElementRef<typeof NavigationMenuPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof NavigationMenuPrimitive.Root>
+>(({ className, children, ...props }, ref) => (
+  <NavigationMenuPrimitive.Root
+    ref={ref}
+    className={cn(
+      "relative z-10 flex max-w-max flex-1 items-center justify-center",
+      className
+    )}
+    {...props}
+  >
+    {children}
+    <NavigationMenuViewport />
+  </NavigationMenuPrimitive.Root>
+))
+NavigationMenu.displayName = NavigationMenuPrimitive.Root.displayName
+
+const NavigationMenuList = React.forwardRef<
+  React.ElementRef<typeof NavigationMenuPrimitive.List>,
+  React.ComponentPropsWithoutRef<typeof NavigationMenuPrimitive.List>
+>(({ className, ...props }, ref) => (
+  <NavigationMenuPrimitive.List
+    ref={ref}
+    className={cn(
+      "group flex flex-1 list-none items-center justify-center space-x-1",
+      className
+    )}
+    {...props}
+  />
+))
+NavigationMenuList.displayName = NavigationMenuPrimitive.List.displayName
+
+const NavigationMenuItem = NavigationMenuPrimitive.Item
+
+const navigationMenuTriggerStyle = cva(
+  "group inline-flex h-10 w-max items-center justify-center rounded-md bg-background px-4 py-2 text-sm font-medium transition-colors hover:bg-accent hover:text-accent-foreground focus:bg-accent focus:text-accent-foreground focus:outline-none disabled:pointer-events-none disabled:opacity-50 data-[active]:bg-accent/50 data-[state=open]:bg-accent/50"
+)
+
+const NavigationMenuTrigger = React.forwardRef<
+  React.ElementRef<typeof NavigationMenuPrimitive.Trigger>,
+  React.ComponentPropsWithoutRef<typeof NavigationMenuPrimitive.Trigger>
+>(({ className, children, ...props }, ref) => (
+  <NavigationMenuPrimitive.Trigger
+    ref={ref}
+    className={cn(navigationMenuTriggerStyle(), "group", className)}
+    {...props}
+  >
+    {children}{" "}
+    <ChevronDown
+      className="relative top-[1px] ml-1 h-3 w-3 transition duration-200 group-data-[state=open]:rotate-180"
+      aria-hidden="true"
+    />
+  </NavigationMenuPrimitive.Trigger>
+))
+NavigationMenuTrigger.displayName = NavigationMenuPrimitive.Trigger.displayName
+
+const NavigationMenuContent = React.forwardRef<
+  React.ElementRef<typeof NavigationMenuPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof NavigationMenuPrimitive.Content>
+>(({ className, ...props }, ref) => (
+  <NavigationMenuPrimitive.Content
+    ref={ref}
+    className={cn(
+      "left-0 top-0 w-full data-[motion^=from-]:animate-in data-[motion^=to-]:animate-out data-[motion^=from-]:fade-in data-[motion^=to-]:fade-out data-[motion=from-end]:slide-in-from-right-52 data-[motion=from-start]:slide-in-from-left-52 data-[motion=to-end]:slide-out-to-right-52 data-[motion=to-start]:slide-out-to-left-52 md:absolute md:w-auto ",
+      className
+    )}
+    {...props}
+  />
+))
+NavigationMenuContent.displayName = NavigationMenuPrimitive.Content.displayName
+
+const NavigationMenuLink = NavigationMenuPrimitive.Link
+
+const NavigationMenuViewport = React.forwardRef<
+  React.ElementRef<typeof NavigationMenuPrimitive.Viewport>,
+  React.ComponentPropsWithoutRef<typeof NavigationMenuPrimitive.Viewport>
+>(({ className, ...props }, ref) => (
+  <div className={cn("absolute left-0 top-full flex justify-center")}>
+    <NavigationMenuPrimitive.Viewport
+      className={cn(
+        "origin-top-center relative mt-1.5 h-[var(--radix-navigation-menu-viewport-height)] w-full overflow-hidden rounded-md border bg-popover text-popover-foreground shadow-lg data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-90 md:w-[var(--radix-navigation-menu-viewport-width)]",
+        className
+      )}
+      ref={ref}
+      {...props}
+    />
+  </div>
+))
+NavigationMenuViewport.displayName =
+  NavigationMenuPrimitive.Viewport.displayName
+
+const NavigationMenuIndicator = React.forwardRef<
+  React.ElementRef<typeof NavigationMenuPrimitive.Indicator>,
+  React.ComponentPropsWithoutRef<typeof NavigationMenuPrimitive.Indicator>
+>(({ className, ...props }, ref) => (
+  <NavigationMenuPrimitive.Indicator
+    ref={ref}
+    className={cn(
+      "top-full z-[1] flex h-1.5 items-end justify-center overflow-hidden data-[state=visible]:animate-in data-[state=hidden]:animate-out data-[state=hidden]:fade-out data-[state=visible]:fade-in",
+      className
+    )}
+    {...props}
+  >
+    <div className="relative top-[60%] h-2 w-2 rotate-45 rounded-tl-sm bg-border shadow-md" />
+  </NavigationMenuPrimitive.Indicator>
+))
+NavigationMenuIndicator.displayName =
+  NavigationMenuPrimitive.Indicator.displayName
+
+export {
+  navigationMenuTriggerStyle,
+  NavigationMenu,
+  NavigationMenuList,
+  NavigationMenuItem,
+  NavigationMenuContent,
+  NavigationMenuTrigger,
+  NavigationMenuLink,
+  NavigationMenuIndicator,
+  NavigationMenuViewport,
+}
diff --git a/application/src/components/ui/pagination.tsx b/application/src/components/ui/pagination.tsx
new file mode 100644
index 0000000..ea40d19
--- /dev/null
+++ b/application/src/components/ui/pagination.tsx
@@ -0,0 +1,117 @@
+import * as React from "react"
+import { ChevronLeft, ChevronRight, MoreHorizontal } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+import { ButtonProps, buttonVariants } from "@/components/ui/button"
+
+const Pagination = ({ className, ...props }: React.ComponentProps<"nav">) => (
+  <nav
+    role="navigation"
+    aria-label="pagination"
+    className={cn("mx-auto flex w-full justify-center", className)}
+    {...props}
+  />
+)
+Pagination.displayName = "Pagination"
+
+const PaginationContent = React.forwardRef<
+  HTMLUListElement,
+  React.ComponentProps<"ul">
+>(({ className, ...props }, ref) => (
+  <ul
+    ref={ref}
+    className={cn("flex flex-row items-center gap-1", className)}
+    {...props}
+  />
+))
+PaginationContent.displayName = "PaginationContent"
+
+const PaginationItem = React.forwardRef<
+  HTMLLIElement,
+  React.ComponentProps<"li">
+>(({ className, ...props }, ref) => (
+  <li ref={ref} className={cn("", className)} {...props} />
+))
+PaginationItem.displayName = "PaginationItem"
+
+type PaginationLinkProps = {
+  isActive?: boolean
+} & Pick<ButtonProps, "size"> &
+  React.ComponentProps<"a">
+
+const PaginationLink = ({
+  className,
+  isActive,
+  size = "icon",
+  ...props
+}: PaginationLinkProps) => (
+  <a
+    aria-current={isActive ? "page" : undefined}
+    className={cn(
+      buttonVariants({
+        variant: isActive ? "outline" : "ghost",
+        size,
+      }),
+      className
+    )}
+    {...props}
+  />
+)
+PaginationLink.displayName = "PaginationLink"
+
+const PaginationPrevious = ({
+  className,
+  ...props
+}: React.ComponentProps<typeof PaginationLink>) => (
+  <PaginationLink
+    aria-label="Go to previous page"
+    size="default"
+    className={cn("gap-1 pl-2.5", className)}
+    {...props}
+  >
+    <ChevronLeft className="h-4 w-4" />
+    <span>Previous</span>
+  </PaginationLink>
+)
+PaginationPrevious.displayName = "PaginationPrevious"
+
+const PaginationNext = ({
+  className,
+  ...props
+}: React.ComponentProps<typeof PaginationLink>) => (
+  <PaginationLink
+    aria-label="Go to next page"
+    size="default"
+    className={cn("gap-1 pr-2.5", className)}
+    {...props}
+  >
+    <span>Next</span>
+    <ChevronRight className="h-4 w-4" />
+  </PaginationLink>
+)
+PaginationNext.displayName = "PaginationNext"
+
+const PaginationEllipsis = ({
+  className,
+  ...props
+}: React.ComponentProps<"span">) => (
+  <span
+    aria-hidden
+    className={cn("flex h-9 w-9 items-center justify-center", className)}
+    {...props}
+  >
+    <MoreHorizontal className="h-4 w-4" />
+    <span className="sr-only">More pages</span>
+  </span>
+)
+PaginationEllipsis.displayName = "PaginationEllipsis"
+
+export {
+  Pagination,
+  PaginationContent,
+  PaginationEllipsis,
+  PaginationItem,
+  PaginationLink,
+  PaginationNext,
+  PaginationPrevious,
+}
diff --git a/application/src/components/ui/popover.tsx b/application/src/components/ui/popover.tsx
new file mode 100644
index 0000000..aaba3ea
--- /dev/null
+++ b/application/src/components/ui/popover.tsx
@@ -0,0 +1,30 @@
+
+import * as React from "react"
+import * as PopoverPrimitive from "@radix-ui/react-popover"
+
+import { cn } from "@/lib/utils"
+
+const Popover = PopoverPrimitive.Root
+
+const PopoverTrigger = PopoverPrimitive.Trigger
+
+const PopoverContent = React.forwardRef<
+  React.ElementRef<typeof PopoverPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>
+>(({ className, align = "center", sideOffset = 4, ...props }, ref) => (
+  <PopoverPrimitive.Portal>
+    <PopoverPrimitive.Content
+      ref={ref}
+      align={align}
+      sideOffset={sideOffset}
+      className={cn(
+        "z-50 w-72 rounded-md border bg-popover p-4 text-popover-foreground shadow-md outline-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+        className
+      )}
+      {...props}
+    />
+  </PopoverPrimitive.Portal>
+))
+PopoverContent.displayName = PopoverPrimitive.Content.displayName
+
+export { Popover, PopoverTrigger, PopoverContent }
\ No newline at end of file
diff --git a/application/src/components/ui/progress.tsx b/application/src/components/ui/progress.tsx
new file mode 100644
index 0000000..0904267
--- /dev/null
+++ b/application/src/components/ui/progress.tsx
@@ -0,0 +1,31 @@
+
+import * as React from "react"
+import * as ProgressPrimitive from "@radix-ui/react-progress"
+
+import { cn } from "@/lib/utils"
+
+interface ProgressProps extends React.ComponentPropsWithoutRef<typeof ProgressPrimitive.Root> {
+  indicatorClassName?: string;
+}
+
+const Progress = React.forwardRef<
+  React.ElementRef<typeof ProgressPrimitive.Root>,
+  ProgressProps
+>(({ className, indicatorClassName, value, ...props }, ref) => (
+  <ProgressPrimitive.Root
+    ref={ref}
+    className={cn(
+      "relative h-4 w-full overflow-hidden rounded-full bg-secondary",
+      className
+    )}
+    {...props}
+  >
+    <ProgressPrimitive.Indicator
+      className={cn("h-full w-full flex-1 bg-primary transition-all", indicatorClassName)}
+      style={{ transform: `translateX(-${100 - (value || 0)}%)` }}
+    />
+  </ProgressPrimitive.Root>
+))
+Progress.displayName = ProgressPrimitive.Root.displayName
+
+export { Progress }
diff --git a/application/src/components/ui/radio-group.tsx b/application/src/components/ui/radio-group.tsx
new file mode 100644
index 0000000..43b43b4
--- /dev/null
+++ b/application/src/components/ui/radio-group.tsx
@@ -0,0 +1,42 @@
+import * as React from "react"
+import * as RadioGroupPrimitive from "@radix-ui/react-radio-group"
+import { Circle } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const RadioGroup = React.forwardRef<
+  React.ElementRef<typeof RadioGroupPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof RadioGroupPrimitive.Root>
+>(({ className, ...props }, ref) => {
+  return (
+    <RadioGroupPrimitive.Root
+      className={cn("grid gap-2", className)}
+      {...props}
+      ref={ref}
+    />
+  )
+})
+RadioGroup.displayName = RadioGroupPrimitive.Root.displayName
+
+const RadioGroupItem = React.forwardRef<
+  React.ElementRef<typeof RadioGroupPrimitive.Item>,
+  React.ComponentPropsWithoutRef<typeof RadioGroupPrimitive.Item>
+>(({ className, ...props }, ref) => {
+  return (
+    <RadioGroupPrimitive.Item
+      ref={ref}
+      className={cn(
+        "aspect-square h-4 w-4 rounded-full border border-primary text-primary ring-offset-background focus:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
+        className
+      )}
+      {...props}
+    >
+      <RadioGroupPrimitive.Indicator className="flex items-center justify-center">
+        <Circle className="h-2.5 w-2.5 fill-current text-current" />
+      </RadioGroupPrimitive.Indicator>
+    </RadioGroupPrimitive.Item>
+  )
+})
+RadioGroupItem.displayName = RadioGroupPrimitive.Item.displayName
+
+export { RadioGroup, RadioGroupItem }
diff --git a/application/src/components/ui/resizable.tsx b/application/src/components/ui/resizable.tsx
new file mode 100644
index 0000000..cd3cb0e
--- /dev/null
+++ b/application/src/components/ui/resizable.tsx
@@ -0,0 +1,43 @@
+import { GripVertical } from "lucide-react"
+import * as ResizablePrimitive from "react-resizable-panels"
+
+import { cn } from "@/lib/utils"
+
+const ResizablePanelGroup = ({
+  className,
+  ...props
+}: React.ComponentProps<typeof ResizablePrimitive.PanelGroup>) => (
+  <ResizablePrimitive.PanelGroup
+    className={cn(
+      "flex h-full w-full data-[panel-group-direction=vertical]:flex-col",
+      className
+    )}
+    {...props}
+  />
+)
+
+const ResizablePanel = ResizablePrimitive.Panel
+
+const ResizableHandle = ({
+  withHandle,
+  className,
+  ...props
+}: React.ComponentProps<typeof ResizablePrimitive.PanelResizeHandle> & {
+  withHandle?: boolean
+}) => (
+  <ResizablePrimitive.PanelResizeHandle
+    className={cn(
+      "relative flex w-px items-center justify-center bg-border after:absolute after:inset-y-0 after:left-1/2 after:w-1 after:-translate-x-1/2 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-offset-1 data-[panel-group-direction=vertical]:h-px data-[panel-group-direction=vertical]:w-full data-[panel-group-direction=vertical]:after:left-0 data-[panel-group-direction=vertical]:after:h-1 data-[panel-group-direction=vertical]:after:w-full data-[panel-group-direction=vertical]:after:-translate-y-1/2 data-[panel-group-direction=vertical]:after:translate-x-0 [&[data-panel-group-direction=vertical]>div]:rotate-90",
+      className
+    )}
+    {...props}
+  >
+    {withHandle && (
+      <div className="z-10 flex h-4 w-3 items-center justify-center rounded-sm border bg-border">
+        <GripVertical className="h-2.5 w-2.5" />
+      </div>
+    )}
+  </ResizablePrimitive.PanelResizeHandle>
+)
+
+export { ResizablePanelGroup, ResizablePanel, ResizableHandle }
diff --git a/application/src/components/ui/scroll-area.tsx b/application/src/components/ui/scroll-area.tsx
new file mode 100644
index 0000000..55bab1f
--- /dev/null
+++ b/application/src/components/ui/scroll-area.tsx
@@ -0,0 +1,49 @@
+
+import * as React from "react"
+import * as ScrollAreaPrimitive from "@radix-ui/react-scroll-area"
+
+import { cn } from "@/lib/utils"
+
+const ScrollArea = React.forwardRef<
+  React.ElementRef<typeof ScrollAreaPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof ScrollAreaPrimitive.Root>
+>(({ className, children, ...props }, ref) => (
+  <ScrollAreaPrimitive.Root
+    ref={ref}
+    className={cn("relative overflow-hidden", className)}
+    {...props}
+  >
+    <ScrollAreaPrimitive.Viewport className="h-full w-full rounded-[inherit]">
+      {children}
+    </ScrollAreaPrimitive.Viewport>
+    <ScrollBar />
+    <ScrollAreaPrimitive.Corner />
+  </ScrollAreaPrimitive.Root>
+))
+ScrollArea.displayName = ScrollAreaPrimitive.Root.displayName
+
+const ScrollBar = React.forwardRef<
+  React.ElementRef<typeof ScrollAreaPrimitive.ScrollAreaScrollbar>,
+  React.ComponentPropsWithoutRef<typeof ScrollAreaPrimitive.ScrollAreaScrollbar>
+>(({ className, orientation = "vertical", ...props }, ref) => (
+  <ScrollAreaPrimitive.ScrollAreaScrollbar
+    ref={ref}
+    orientation={orientation}
+    className={cn(
+      "flex touch-none select-none transition-colors",
+      orientation === "vertical" &&
+        "h-full w-3.5 border-l border-l-transparent p-[3px]",
+      orientation === "horizontal" &&
+        "h-3.5 flex-col border-t border-t-transparent p-[3px]",
+      className
+    )}
+    {...props}
+  >
+    <ScrollAreaPrimitive.ScrollAreaThumb 
+      className="relative flex-1 rounded-full bg-gray-400 hover:bg-gray-600 transition-colors opacity-100 min-h-[40px]" 
+    />
+  </ScrollAreaPrimitive.ScrollAreaScrollbar>
+))
+ScrollBar.displayName = ScrollAreaPrimitive.ScrollAreaScrollbar.displayName
+
+export { ScrollArea, ScrollBar }
\ No newline at end of file
diff --git a/application/src/components/ui/select.tsx b/application/src/components/ui/select.tsx
new file mode 100644
index 0000000..fe56d4d
--- /dev/null
+++ b/application/src/components/ui/select.tsx
@@ -0,0 +1,158 @@
+import * as React from "react"
+import * as SelectPrimitive from "@radix-ui/react-select"
+import { Check, ChevronDown, ChevronUp } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const Select = SelectPrimitive.Root
+
+const SelectGroup = SelectPrimitive.Group
+
+const SelectValue = SelectPrimitive.Value
+
+const SelectTrigger = React.forwardRef<
+  React.ElementRef<typeof SelectPrimitive.Trigger>,
+  React.ComponentPropsWithoutRef<typeof SelectPrimitive.Trigger>
+>(({ className, children, ...props }, ref) => (
+  <SelectPrimitive.Trigger
+    ref={ref}
+    className={cn(
+      "flex h-10 w-full items-center justify-between rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 [&>span]:line-clamp-1",
+      className
+    )}
+    {...props}
+  >
+    {children}
+    <SelectPrimitive.Icon asChild>
+      <ChevronDown className="h-4 w-4 opacity-50" />
+    </SelectPrimitive.Icon>
+  </SelectPrimitive.Trigger>
+))
+SelectTrigger.displayName = SelectPrimitive.Trigger.displayName
+
+const SelectScrollUpButton = React.forwardRef<
+  React.ElementRef<typeof SelectPrimitive.ScrollUpButton>,
+  React.ComponentPropsWithoutRef<typeof SelectPrimitive.ScrollUpButton>
+>(({ className, ...props }, ref) => (
+  <SelectPrimitive.ScrollUpButton
+    ref={ref}
+    className={cn(
+      "flex cursor-default items-center justify-center py-1",
+      className
+    )}
+    {...props}
+  >
+    <ChevronUp className="h-4 w-4" />
+  </SelectPrimitive.ScrollUpButton>
+))
+SelectScrollUpButton.displayName = SelectPrimitive.ScrollUpButton.displayName
+
+const SelectScrollDownButton = React.forwardRef<
+  React.ElementRef<typeof SelectPrimitive.ScrollDownButton>,
+  React.ComponentPropsWithoutRef<typeof SelectPrimitive.ScrollDownButton>
+>(({ className, ...props }, ref) => (
+  <SelectPrimitive.ScrollDownButton
+    ref={ref}
+    className={cn(
+      "flex cursor-default items-center justify-center py-1",
+      className
+    )}
+    {...props}
+  >
+    <ChevronDown className="h-4 w-4" />
+  </SelectPrimitive.ScrollDownButton>
+))
+SelectScrollDownButton.displayName =
+  SelectPrimitive.ScrollDownButton.displayName
+
+const SelectContent = React.forwardRef<
+  React.ElementRef<typeof SelectPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof SelectPrimitive.Content>
+>(({ className, children, position = "popper", ...props }, ref) => (
+  <SelectPrimitive.Portal>
+    <SelectPrimitive.Content
+      ref={ref}
+      className={cn(
+        "relative z-50 max-h-96 min-w-[8rem] overflow-hidden rounded-md border bg-popover text-popover-foreground shadow-md data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+        position === "popper" &&
+          "data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1",
+        className
+      )}
+      position={position}
+      {...props}
+    >
+      <SelectScrollUpButton />
+      <SelectPrimitive.Viewport
+        className={cn(
+          "p-1",
+          position === "popper" &&
+            "h-[var(--radix-select-trigger-height)] w-full min-w-[var(--radix-select-trigger-width)]"
+        )}
+      >
+        {children}
+      </SelectPrimitive.Viewport>
+      <SelectScrollDownButton />
+    </SelectPrimitive.Content>
+  </SelectPrimitive.Portal>
+))
+SelectContent.displayName = SelectPrimitive.Content.displayName
+
+const SelectLabel = React.forwardRef<
+  React.ElementRef<typeof SelectPrimitive.Label>,
+  React.ComponentPropsWithoutRef<typeof SelectPrimitive.Label>
+>(({ className, ...props }, ref) => (
+  <SelectPrimitive.Label
+    ref={ref}
+    className={cn("py-1.5 pl-8 pr-2 text-sm font-semibold", className)}
+    {...props}
+  />
+))
+SelectLabel.displayName = SelectPrimitive.Label.displayName
+
+const SelectItem = React.forwardRef<
+  React.ElementRef<typeof SelectPrimitive.Item>,
+  React.ComponentPropsWithoutRef<typeof SelectPrimitive.Item>
+>(({ className, children, ...props }, ref) => (
+  <SelectPrimitive.Item
+    ref={ref}
+    className={cn(
+      "relative flex w-full cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none focus:bg-accent focus:text-accent-foreground data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+      className
+    )}
+    {...props}
+  >
+    <span className="absolute left-2 flex h-3.5 w-3.5 items-center justify-center">
+      <SelectPrimitive.ItemIndicator>
+        <Check className="h-4 w-4" />
+      </SelectPrimitive.ItemIndicator>
+    </span>
+
+    <SelectPrimitive.ItemText>{children}</SelectPrimitive.ItemText>
+  </SelectPrimitive.Item>
+))
+SelectItem.displayName = SelectPrimitive.Item.displayName
+
+const SelectSeparator = React.forwardRef<
+  React.ElementRef<typeof SelectPrimitive.Separator>,
+  React.ComponentPropsWithoutRef<typeof SelectPrimitive.Separator>
+>(({ className, ...props }, ref) => (
+  <SelectPrimitive.Separator
+    ref={ref}
+    className={cn("-mx-1 my-1 h-px bg-muted", className)}
+    {...props}
+  />
+))
+SelectSeparator.displayName = SelectPrimitive.Separator.displayName
+
+export {
+  Select,
+  SelectGroup,
+  SelectValue,
+  SelectTrigger,
+  SelectContent,
+  SelectLabel,
+  SelectItem,
+  SelectSeparator,
+  SelectScrollUpButton,
+  SelectScrollDownButton,
+}
diff --git a/application/src/components/ui/separator.tsx b/application/src/components/ui/separator.tsx
new file mode 100644
index 0000000..4116649
--- /dev/null
+++ b/application/src/components/ui/separator.tsx
@@ -0,0 +1,30 @@
+
+import * as React from "react"
+import * as SeparatorPrimitive from "@radix-ui/react-separator"
+
+import { cn } from "@/lib/utils"
+
+const Separator = React.forwardRef<
+  React.ElementRef<typeof SeparatorPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof SeparatorPrimitive.Root>
+>(
+  (
+    { className, orientation = "horizontal", decorative = true, ...props },
+    ref
+  ) => (
+    <SeparatorPrimitive.Root
+      ref={ref}
+      decorative={decorative}
+      orientation={orientation}
+      className={cn(
+        "shrink-0 bg-border",
+        orientation === "horizontal" ? "h-[1px] w-full" : "h-full w-[1px]",
+        className
+      )}
+      {...props}
+    />
+  )
+)
+Separator.displayName = SeparatorPrimitive.Root.displayName
+
+export { Separator }
\ No newline at end of file
diff --git a/application/src/components/ui/sheet.tsx b/application/src/components/ui/sheet.tsx
new file mode 100644
index 0000000..7b1dbe4
--- /dev/null
+++ b/application/src/components/ui/sheet.tsx
@@ -0,0 +1,131 @@
+import * as SheetPrimitive from "@radix-ui/react-dialog"
+import { cva, type VariantProps } from "class-variance-authority"
+import { X } from "lucide-react"
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+const Sheet = SheetPrimitive.Root
+
+const SheetTrigger = SheetPrimitive.Trigger
+
+const SheetClose = SheetPrimitive.Close
+
+const SheetPortal = SheetPrimitive.Portal
+
+const SheetOverlay = React.forwardRef<
+  React.ElementRef<typeof SheetPrimitive.Overlay>,
+  React.ComponentPropsWithoutRef<typeof SheetPrimitive.Overlay>
+>(({ className, ...props }, ref) => (
+  <SheetPrimitive.Overlay
+    className={cn(
+      "fixed inset-0 z-50 bg-black/80  data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+      className
+    )}
+    {...props}
+    ref={ref}
+  />
+))
+SheetOverlay.displayName = SheetPrimitive.Overlay.displayName
+
+const sheetVariants = cva(
+  "fixed z-50 gap-4 bg-background p-6 shadow-lg transition ease-in-out data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:duration-300 data-[state=open]:duration-500",
+  {
+    variants: {
+      side: {
+        top: "inset-x-0 top-0 border-b data-[state=closed]:slide-out-to-top data-[state=open]:slide-in-from-top",
+        bottom:
+          "inset-x-0 bottom-0 border-t data-[state=closed]:slide-out-to-bottom data-[state=open]:slide-in-from-bottom",
+        left: "inset-y-0 left-0 h-full w-3/4 border-r data-[state=closed]:slide-out-to-left data-[state=open]:slide-in-from-left sm:max-w-sm",
+        right:
+          "inset-y-0 right-0 h-full w-3/4  border-l data-[state=closed]:slide-out-to-right data-[state=open]:slide-in-from-right sm:max-w-sm",
+      },
+    },
+    defaultVariants: {
+      side: "right",
+    },
+  }
+)
+
+interface SheetContentProps
+  extends React.ComponentPropsWithoutRef<typeof SheetPrimitive.Content>,
+  VariantProps<typeof sheetVariants> { }
+
+const SheetContent = React.forwardRef<
+  React.ElementRef<typeof SheetPrimitive.Content>,
+  SheetContentProps
+>(({ side = "right", className, children, ...props }, ref) => (
+  <SheetPortal>
+    <SheetOverlay />
+    <SheetPrimitive.Content
+      ref={ref}
+      className={cn(sheetVariants({ side }), className)}
+      {...props}
+    >
+      {children}
+      <SheetPrimitive.Close className="absolute right-4 top-4 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-secondary">
+        <X className="h-4 w-4" />
+        <span className="sr-only">Close</span>
+      </SheetPrimitive.Close>
+    </SheetPrimitive.Content>
+  </SheetPortal>
+))
+SheetContent.displayName = SheetPrimitive.Content.displayName
+
+const SheetHeader = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn(
+      "flex flex-col space-y-2 text-center sm:text-left",
+      className
+    )}
+    {...props}
+  />
+)
+SheetHeader.displayName = "SheetHeader"
+
+const SheetFooter = ({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn(
+      "flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2",
+      className
+    )}
+    {...props}
+  />
+)
+SheetFooter.displayName = "SheetFooter"
+
+const SheetTitle = React.forwardRef<
+  React.ElementRef<typeof SheetPrimitive.Title>,
+  React.ComponentPropsWithoutRef<typeof SheetPrimitive.Title>
+>(({ className, ...props }, ref) => (
+  <SheetPrimitive.Title
+    ref={ref}
+    className={cn("text-lg font-semibold text-foreground", className)}
+    {...props}
+  />
+))
+SheetTitle.displayName = SheetPrimitive.Title.displayName
+
+const SheetDescription = React.forwardRef<
+  React.ElementRef<typeof SheetPrimitive.Description>,
+  React.ComponentPropsWithoutRef<typeof SheetPrimitive.Description>
+>(({ className, ...props }, ref) => (
+  <SheetPrimitive.Description
+    ref={ref}
+    className={cn("text-sm text-muted-foreground", className)}
+    {...props}
+  />
+))
+SheetDescription.displayName = SheetPrimitive.Description.displayName
+
+export {
+  Sheet, SheetClose,
+  SheetContent, SheetDescription, SheetFooter, SheetHeader, SheetOverlay, SheetPortal, SheetTitle, SheetTrigger
+}
+
diff --git a/application/src/components/ui/sidebar.tsx b/application/src/components/ui/sidebar.tsx
new file mode 100644
index 0000000..1a566bf
--- /dev/null
+++ b/application/src/components/ui/sidebar.tsx
@@ -0,0 +1,761 @@
+import * as React from "react"
+import { Slot } from "@radix-ui/react-slot"
+import { VariantProps, cva } from "class-variance-authority"
+import { PanelLeft } from "lucide-react"
+
+import { useIsMobile } from "@/hooks/use-mobile"
+import { cn } from "@/lib/utils"
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { Separator } from "@/components/ui/separator"
+import { Sheet, SheetContent } from "@/components/ui/sheet"
+import { Skeleton } from "@/components/ui/skeleton"
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipProvider,
+  TooltipTrigger,
+} from "@/components/ui/tooltip"
+
+const SIDEBAR_COOKIE_NAME = "sidebar:state"
+const SIDEBAR_COOKIE_MAX_AGE = 60 * 60 * 24 * 7
+const SIDEBAR_WIDTH = "16rem"
+const SIDEBAR_WIDTH_MOBILE = "18rem"
+const SIDEBAR_WIDTH_ICON = "3rem"
+const SIDEBAR_KEYBOARD_SHORTCUT = "b"
+
+type SidebarContext = {
+  state: "expanded" | "collapsed"
+  open: boolean
+  setOpen: (open: boolean) => void
+  openMobile: boolean
+  setOpenMobile: (open: boolean) => void
+  isMobile: boolean
+  toggleSidebar: () => void
+}
+
+const SidebarContext = React.createContext<SidebarContext | null>(null)
+
+function useSidebar() {
+  const context = React.useContext(SidebarContext)
+  if (!context) {
+    throw new Error("useSidebar must be used within a SidebarProvider.")
+  }
+
+  return context
+}
+
+const SidebarProvider = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div"> & {
+    defaultOpen?: boolean
+    open?: boolean
+    onOpenChange?: (open: boolean) => void
+  }
+>(
+  (
+    {
+      defaultOpen = true,
+      open: openProp,
+      onOpenChange: setOpenProp,
+      className,
+      style,
+      children,
+      ...props
+    },
+    ref
+  ) => {
+    const isMobile = useIsMobile()
+    const [openMobile, setOpenMobile] = React.useState(false)
+
+    // This is the internal state of the sidebar.
+    // We use openProp and setOpenProp for control from outside the component.
+    const [_open, _setOpen] = React.useState(defaultOpen)
+    const open = openProp ?? _open
+    const setOpen = React.useCallback(
+      (value: boolean | ((value: boolean) => boolean)) => {
+        const openState = typeof value === "function" ? value(open) : value
+        if (setOpenProp) {
+          setOpenProp(openState)
+        } else {
+          _setOpen(openState)
+        }
+
+        // This sets the cookie to keep the sidebar state.
+        document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}`
+      },
+      [setOpenProp, open]
+    )
+
+    // Helper to toggle the sidebar.
+    const toggleSidebar = React.useCallback(() => {
+      return isMobile
+        ? setOpenMobile((open) => !open)
+        : setOpen((open) => !open)
+    }, [isMobile, setOpen, setOpenMobile])
+
+    // Adds a keyboard shortcut to toggle the sidebar.
+    React.useEffect(() => {
+      const handleKeyDown = (event: KeyboardEvent) => {
+        if (
+          event.key === SIDEBAR_KEYBOARD_SHORTCUT &&
+          (event.metaKey || event.ctrlKey)
+        ) {
+          event.preventDefault()
+          toggleSidebar()
+        }
+      }
+
+      window.addEventListener("keydown", handleKeyDown)
+      return () => window.removeEventListener("keydown", handleKeyDown)
+    }, [toggleSidebar])
+
+    // We add a state so that we can do data-state="expanded" or "collapsed".
+    // This makes it easier to style the sidebar with Tailwind classes.
+    const state = open ? "expanded" : "collapsed"
+
+    const contextValue = React.useMemo<SidebarContext>(
+      () => ({
+        state,
+        open,
+        setOpen,
+        isMobile,
+        openMobile,
+        setOpenMobile,
+        toggleSidebar,
+      }),
+      [state, open, setOpen, isMobile, openMobile, setOpenMobile, toggleSidebar]
+    )
+
+    return (
+      <SidebarContext.Provider value={contextValue}>
+        <TooltipProvider delayDuration={0}>
+          <div
+            style={
+              {
+                "--sidebar-width": SIDEBAR_WIDTH,
+                "--sidebar-width-icon": SIDEBAR_WIDTH_ICON,
+                ...style,
+              } as React.CSSProperties
+            }
+            className={cn(
+              "group/sidebar-wrapper flex min-h-svh w-full has-[[data-variant=inset]]:bg-sidebar",
+              className
+            )}
+            ref={ref}
+            {...props}
+          >
+            {children}
+          </div>
+        </TooltipProvider>
+      </SidebarContext.Provider>
+    )
+  }
+)
+SidebarProvider.displayName = "SidebarProvider"
+
+const Sidebar = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div"> & {
+    side?: "left" | "right"
+    variant?: "sidebar" | "floating" | "inset"
+    collapsible?: "offcanvas" | "icon" | "none"
+  }
+>(
+  (
+    {
+      side = "left",
+      variant = "sidebar",
+      collapsible = "offcanvas",
+      className,
+      children,
+      ...props
+    },
+    ref
+  ) => {
+    const { isMobile, state, openMobile, setOpenMobile } = useSidebar()
+
+    if (collapsible === "none") {
+      return (
+        <div
+          className={cn(
+            "flex h-full w-[--sidebar-width] flex-col bg-sidebar text-sidebar-foreground",
+            className
+          )}
+          ref={ref}
+          {...props}
+        >
+          {children}
+        </div>
+      )
+    }
+
+    if (isMobile) {
+      return (
+        <Sheet open={openMobile} onOpenChange={setOpenMobile} {...props}>
+          <SheetContent
+            data-sidebar="sidebar"
+            data-mobile="true"
+            className="w-[--sidebar-width] bg-sidebar p-0 text-sidebar-foreground [&>button]:hidden"
+            style={
+              {
+                "--sidebar-width": SIDEBAR_WIDTH_MOBILE,
+              } as React.CSSProperties
+            }
+            side={side}
+          >
+            <div className="flex h-full w-full flex-col">{children}</div>
+          </SheetContent>
+        </Sheet>
+      )
+    }
+
+    return (
+      <div
+        ref={ref}
+        className="group peer hidden md:block text-sidebar-foreground"
+        data-state={state}
+        data-collapsible={state === "collapsed" ? collapsible : ""}
+        data-variant={variant}
+        data-side={side}
+      >
+        {/* This is what handles the sidebar gap on desktop */}
+        <div
+          className={cn(
+            "duration-200 relative h-svh w-[--sidebar-width] bg-transparent transition-[width] ease-linear",
+            "group-data-[collapsible=offcanvas]:w-0",
+            "group-data-[side=right]:rotate-180",
+            variant === "floating" || variant === "inset"
+              ? "group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)_+_theme(spacing.4))]"
+              : "group-data-[collapsible=icon]:w-[--sidebar-width-icon]"
+          )}
+        />
+        <div
+          className={cn(
+            "duration-200 fixed inset-y-0 z-10 hidden h-svh w-[--sidebar-width] transition-[left,right,width] ease-linear md:flex",
+            side === "left"
+              ? "left-0 group-data-[collapsible=offcanvas]:left-[calc(var(--sidebar-width)*-1)]"
+              : "right-0 group-data-[collapsible=offcanvas]:right-[calc(var(--sidebar-width)*-1)]",
+            // Adjust the padding for floating and inset variants.
+            variant === "floating" || variant === "inset"
+              ? "p-2 group-data-[collapsible=icon]:w-[calc(var(--sidebar-width-icon)_+_theme(spacing.4)_+2px)]"
+              : "group-data-[collapsible=icon]:w-[--sidebar-width-icon] group-data-[side=left]:border-r group-data-[side=right]:border-l",
+            className
+          )}
+          {...props}
+        >
+          <div
+            data-sidebar="sidebar"
+            className="flex h-full w-full flex-col bg-sidebar group-data-[variant=floating]:rounded-lg group-data-[variant=floating]:border group-data-[variant=floating]:border-sidebar-border group-data-[variant=floating]:shadow"
+          >
+            {children}
+          </div>
+        </div>
+      </div>
+    )
+  }
+)
+Sidebar.displayName = "Sidebar"
+
+const SidebarTrigger = React.forwardRef<
+  React.ElementRef<typeof Button>,
+  React.ComponentProps<typeof Button>
+>(({ className, onClick, ...props }, ref) => {
+  const { toggleSidebar } = useSidebar()
+
+  return (
+    <Button
+      ref={ref}
+      data-sidebar="trigger"
+      variant="ghost"
+      size="icon"
+      className={cn("h-7 w-7", className)}
+      onClick={(event) => {
+        onClick?.(event)
+        toggleSidebar()
+      }}
+      {...props}
+    >
+      <PanelLeft />
+      <span className="sr-only">Toggle Sidebar</span>
+    </Button>
+  )
+})
+SidebarTrigger.displayName = "SidebarTrigger"
+
+const SidebarRail = React.forwardRef<
+  HTMLButtonElement,
+  React.ComponentProps<"button">
+>(({ className, ...props }, ref) => {
+  const { toggleSidebar } = useSidebar()
+
+  return (
+    <button
+      ref={ref}
+      data-sidebar="rail"
+      aria-label="Toggle Sidebar"
+      tabIndex={-1}
+      onClick={toggleSidebar}
+      title="Toggle Sidebar"
+      className={cn(
+        "absolute inset-y-0 z-20 hidden w-4 -translate-x-1/2 transition-all ease-linear after:absolute after:inset-y-0 after:left-1/2 after:w-[2px] hover:after:bg-sidebar-border group-data-[side=left]:-right-4 group-data-[side=right]:left-0 sm:flex",
+        "[[data-side=left]_&]:cursor-w-resize [[data-side=right]_&]:cursor-e-resize",
+        "[[data-side=left][data-state=collapsed]_&]:cursor-e-resize [[data-side=right][data-state=collapsed]_&]:cursor-w-resize",
+        "group-data-[collapsible=offcanvas]:translate-x-0 group-data-[collapsible=offcanvas]:after:left-full group-data-[collapsible=offcanvas]:hover:bg-sidebar",
+        "[[data-side=left][data-collapsible=offcanvas]_&]:-right-2",
+        "[[data-side=right][data-collapsible=offcanvas]_&]:-left-2",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+SidebarRail.displayName = "SidebarRail"
+
+const SidebarInset = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"main">
+>(({ className, ...props }, ref) => {
+  return (
+    <main
+      ref={ref}
+      className={cn(
+        "relative flex min-h-svh flex-1 flex-col bg-background",
+        "peer-data-[variant=inset]:min-h-[calc(100svh-theme(spacing.4))] md:peer-data-[variant=inset]:m-2 md:peer-data-[state=collapsed]:peer-data-[variant=inset]:ml-2 md:peer-data-[variant=inset]:ml-0 md:peer-data-[variant=inset]:rounded-xl md:peer-data-[variant=inset]:shadow",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+SidebarInset.displayName = "SidebarInset"
+
+const SidebarInput = React.forwardRef<
+  React.ElementRef<typeof Input>,
+  React.ComponentProps<typeof Input>
+>(({ className, ...props }, ref) => {
+  return (
+    <Input
+      ref={ref}
+      data-sidebar="input"
+      className={cn(
+        "h-8 w-full bg-background shadow-none focus-visible:ring-2 focus-visible:ring-sidebar-ring",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+SidebarInput.displayName = "SidebarInput"
+
+const SidebarHeader = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div">
+>(({ className, ...props }, ref) => {
+  return (
+    <div
+      ref={ref}
+      data-sidebar="header"
+      className={cn("flex flex-col gap-2 p-2", className)}
+      {...props}
+    />
+  )
+})
+SidebarHeader.displayName = "SidebarHeader"
+
+const SidebarFooter = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div">
+>(({ className, ...props }, ref) => {
+  return (
+    <div
+      ref={ref}
+      data-sidebar="footer"
+      className={cn("flex flex-col gap-2 p-2", className)}
+      {...props}
+    />
+  )
+})
+SidebarFooter.displayName = "SidebarFooter"
+
+const SidebarSeparator = React.forwardRef<
+  React.ElementRef<typeof Separator>,
+  React.ComponentProps<typeof Separator>
+>(({ className, ...props }, ref) => {
+  return (
+    <Separator
+      ref={ref}
+      data-sidebar="separator"
+      className={cn("mx-2 w-auto bg-sidebar-border", className)}
+      {...props}
+    />
+  )
+})
+SidebarSeparator.displayName = "SidebarSeparator"
+
+const SidebarContent = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div">
+>(({ className, ...props }, ref) => {
+  return (
+    <div
+      ref={ref}
+      data-sidebar="content"
+      className={cn(
+        "flex min-h-0 flex-1 flex-col gap-2 overflow-auto group-data-[collapsible=icon]:overflow-hidden",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+SidebarContent.displayName = "SidebarContent"
+
+const SidebarGroup = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div">
+>(({ className, ...props }, ref) => {
+  return (
+    <div
+      ref={ref}
+      data-sidebar="group"
+      className={cn("relative flex w-full min-w-0 flex-col p-2", className)}
+      {...props}
+    />
+  )
+})
+SidebarGroup.displayName = "SidebarGroup"
+
+const SidebarGroupLabel = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div"> & { asChild?: boolean }
+>(({ className, asChild = false, ...props }, ref) => {
+  const Comp = asChild ? Slot : "div"
+
+  return (
+    <Comp
+      ref={ref}
+      data-sidebar="group-label"
+      className={cn(
+        "duration-200 flex h-8 shrink-0 items-center rounded-md px-2 text-xs font-medium text-sidebar-foreground/70 outline-none ring-sidebar-ring transition-[margin,opa] ease-linear focus-visible:ring-2 [&>svg]:size-4 [&>svg]:shrink-0",
+        "group-data-[collapsible=icon]:-mt-8 group-data-[collapsible=icon]:opacity-0",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+SidebarGroupLabel.displayName = "SidebarGroupLabel"
+
+const SidebarGroupAction = React.forwardRef<
+  HTMLButtonElement,
+  React.ComponentProps<"button"> & { asChild?: boolean }
+>(({ className, asChild = false, ...props }, ref) => {
+  const Comp = asChild ? Slot : "button"
+
+  return (
+    <Comp
+      ref={ref}
+      data-sidebar="group-action"
+      className={cn(
+        "absolute right-3 top-3.5 flex aspect-square w-5 items-center justify-center rounded-md p-0 text-sidebar-foreground outline-none ring-sidebar-ring transition-transform hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 [&>svg]:size-4 [&>svg]:shrink-0",
+        // Increases the hit area of the button on mobile.
+        "after:absolute after:-inset-2 after:md:hidden",
+        "group-data-[collapsible=icon]:hidden",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+SidebarGroupAction.displayName = "SidebarGroupAction"
+
+const SidebarGroupContent = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div">
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    data-sidebar="group-content"
+    className={cn("w-full text-sm", className)}
+    {...props}
+  />
+))
+SidebarGroupContent.displayName = "SidebarGroupContent"
+
+const SidebarMenu = React.forwardRef<
+  HTMLUListElement,
+  React.ComponentProps<"ul">
+>(({ className, ...props }, ref) => (
+  <ul
+    ref={ref}
+    data-sidebar="menu"
+    className={cn("flex w-full min-w-0 flex-col gap-1", className)}
+    {...props}
+  />
+))
+SidebarMenu.displayName = "SidebarMenu"
+
+const SidebarMenuItem = React.forwardRef<
+  HTMLLIElement,
+  React.ComponentProps<"li">
+>(({ className, ...props }, ref) => (
+  <li
+    ref={ref}
+    data-sidebar="menu-item"
+    className={cn("group/menu-item relative", className)}
+    {...props}
+  />
+))
+SidebarMenuItem.displayName = "SidebarMenuItem"
+
+const sidebarMenuButtonVariants = cva(
+  "peer/menu-button flex w-full items-center gap-2 overflow-hidden rounded-md p-2 text-left text-sm outline-none ring-sidebar-ring transition-[width,height,padding] hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 group-has-[[data-sidebar=menu-action]]/menu-item:pr-8 aria-disabled:pointer-events-none aria-disabled:opacity-50 data-[active=true]:bg-sidebar-accent data-[active=true]:font-medium data-[active=true]:text-sidebar-accent-foreground data-[state=open]:hover:bg-sidebar-accent data-[state=open]:hover:text-sidebar-accent-foreground group-data-[collapsible=icon]:!size-8 group-data-[collapsible=icon]:!p-2 [&>span:last-child]:truncate [&>svg]:size-4 [&>svg]:shrink-0",
+  {
+    variants: {
+      variant: {
+        default: "hover:bg-sidebar-accent hover:text-sidebar-accent-foreground",
+        outline:
+          "bg-background shadow-[0_0_0_1px_hsl(var(--sidebar-border))] hover:bg-sidebar-accent hover:text-sidebar-accent-foreground hover:shadow-[0_0_0_1px_hsl(var(--sidebar-accent))]",
+      },
+      size: {
+        default: "h-8 text-sm",
+        sm: "h-7 text-xs",
+        lg: "h-12 text-sm group-data-[collapsible=icon]:!p-0",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  }
+)
+
+const SidebarMenuButton = React.forwardRef<
+  HTMLButtonElement,
+  React.ComponentProps<"button"> & {
+    asChild?: boolean
+    isActive?: boolean
+    tooltip?: string | React.ComponentProps<typeof TooltipContent>
+  } & VariantProps<typeof sidebarMenuButtonVariants>
+>(
+  (
+    {
+      asChild = false,
+      isActive = false,
+      variant = "default",
+      size = "default",
+      tooltip,
+      className,
+      ...props
+    },
+    ref
+  ) => {
+    const Comp = asChild ? Slot : "button"
+    const { isMobile, state } = useSidebar()
+
+    const button = (
+      <Comp
+        ref={ref}
+        data-sidebar="menu-button"
+        data-size={size}
+        data-active={isActive}
+        className={cn(sidebarMenuButtonVariants({ variant, size }), className)}
+        {...props}
+      />
+    )
+
+    if (!tooltip) {
+      return button
+    }
+
+    if (typeof tooltip === "string") {
+      tooltip = {
+        children: tooltip,
+      }
+    }
+
+    return (
+      <Tooltip>
+        <TooltipTrigger asChild>{button}</TooltipTrigger>
+        <TooltipContent
+          side="right"
+          align="center"
+          hidden={state !== "collapsed" || isMobile}
+          {...tooltip}
+        />
+      </Tooltip>
+    )
+  }
+)
+SidebarMenuButton.displayName = "SidebarMenuButton"
+
+const SidebarMenuAction = React.forwardRef<
+  HTMLButtonElement,
+  React.ComponentProps<"button"> & {
+    asChild?: boolean
+    showOnHover?: boolean
+  }
+>(({ className, asChild = false, showOnHover = false, ...props }, ref) => {
+  const Comp = asChild ? Slot : "button"
+
+  return (
+    <Comp
+      ref={ref}
+      data-sidebar="menu-action"
+      className={cn(
+        "absolute right-1 top-1.5 flex aspect-square w-5 items-center justify-center rounded-md p-0 text-sidebar-foreground outline-none ring-sidebar-ring transition-transform hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 peer-hover/menu-button:text-sidebar-accent-foreground [&>svg]:size-4 [&>svg]:shrink-0",
+        // Increases the hit area of the button on mobile.
+        "after:absolute after:-inset-2 after:md:hidden",
+        "peer-data-[size=sm]/menu-button:top-1",
+        "peer-data-[size=default]/menu-button:top-1.5",
+        "peer-data-[size=lg]/menu-button:top-2.5",
+        "group-data-[collapsible=icon]:hidden",
+        showOnHover &&
+          "group-focus-within/menu-item:opacity-100 group-hover/menu-item:opacity-100 data-[state=open]:opacity-100 peer-data-[active=true]/menu-button:text-sidebar-accent-foreground md:opacity-0",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+SidebarMenuAction.displayName = "SidebarMenuAction"
+
+const SidebarMenuBadge = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div">
+>(({ className, ...props }, ref) => (
+  <div
+    ref={ref}
+    data-sidebar="menu-badge"
+    className={cn(
+      "absolute right-1 flex h-5 min-w-5 items-center justify-center rounded-md px-1 text-xs font-medium tabular-nums text-sidebar-foreground select-none pointer-events-none",
+      "peer-hover/menu-button:text-sidebar-accent-foreground peer-data-[active=true]/menu-button:text-sidebar-accent-foreground",
+      "peer-data-[size=sm]/menu-button:top-1",
+      "peer-data-[size=default]/menu-button:top-1.5",
+      "peer-data-[size=lg]/menu-button:top-2.5",
+      "group-data-[collapsible=icon]:hidden",
+      className
+    )}
+    {...props}
+  />
+))
+SidebarMenuBadge.displayName = "SidebarMenuBadge"
+
+const SidebarMenuSkeleton = React.forwardRef<
+  HTMLDivElement,
+  React.ComponentProps<"div"> & {
+    showIcon?: boolean
+  }
+>(({ className, showIcon = false, ...props }, ref) => {
+  // Random width between 50 to 90%.
+  const width = React.useMemo(() => {
+    return `${Math.floor(Math.random() * 40) + 50}%`
+  }, [])
+
+  return (
+    <div
+      ref={ref}
+      data-sidebar="menu-skeleton"
+      className={cn("rounded-md h-8 flex gap-2 px-2 items-center", className)}
+      {...props}
+    >
+      {showIcon && (
+        <Skeleton
+          className="size-4 rounded-md"
+          data-sidebar="menu-skeleton-icon"
+        />
+      )}
+      <Skeleton
+        className="h-4 flex-1 max-w-[--skeleton-width]"
+        data-sidebar="menu-skeleton-text"
+        style={
+          {
+            "--skeleton-width": width,
+          } as React.CSSProperties
+        }
+      />
+    </div>
+  )
+})
+SidebarMenuSkeleton.displayName = "SidebarMenuSkeleton"
+
+const SidebarMenuSub = React.forwardRef<
+  HTMLUListElement,
+  React.ComponentProps<"ul">
+>(({ className, ...props }, ref) => (
+  <ul
+    ref={ref}
+    data-sidebar="menu-sub"
+    className={cn(
+      "mx-3.5 flex min-w-0 translate-x-px flex-col gap-1 border-l border-sidebar-border px-2.5 py-0.5",
+      "group-data-[collapsible=icon]:hidden",
+      className
+    )}
+    {...props}
+  />
+))
+SidebarMenuSub.displayName = "SidebarMenuSub"
+
+const SidebarMenuSubItem = React.forwardRef<
+  HTMLLIElement,
+  React.ComponentProps<"li">
+>(({ ...props }, ref) => <li ref={ref} {...props} />)
+SidebarMenuSubItem.displayName = "SidebarMenuSubItem"
+
+const SidebarMenuSubButton = React.forwardRef<
+  HTMLAnchorElement,
+  React.ComponentProps<"a"> & {
+    asChild?: boolean
+    size?: "sm" | "md"
+    isActive?: boolean
+  }
+>(({ asChild = false, size = "md", isActive, className, ...props }, ref) => {
+  const Comp = asChild ? Slot : "a"
+
+  return (
+    <Comp
+      ref={ref}
+      data-sidebar="menu-sub-button"
+      data-size={size}
+      data-active={isActive}
+      className={cn(
+        "flex h-7 min-w-0 -translate-x-px items-center gap-2 overflow-hidden rounded-md px-2 text-sidebar-foreground outline-none ring-sidebar-ring hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:ring-2 active:bg-sidebar-accent active:text-sidebar-accent-foreground disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&>span:last-child]:truncate [&>svg]:size-4 [&>svg]:shrink-0 [&>svg]:text-sidebar-accent-foreground",
+        "data-[active=true]:bg-sidebar-accent data-[active=true]:text-sidebar-accent-foreground",
+        size === "sm" && "text-xs",
+        size === "md" && "text-sm",
+        "group-data-[collapsible=icon]:hidden",
+        className
+      )}
+      {...props}
+    />
+  )
+})
+SidebarMenuSubButton.displayName = "SidebarMenuSubButton"
+
+export {
+  Sidebar,
+  SidebarContent,
+  SidebarFooter,
+  SidebarGroup,
+  SidebarGroupAction,
+  SidebarGroupContent,
+  SidebarGroupLabel,
+  SidebarHeader,
+  SidebarInput,
+  SidebarInset,
+  SidebarMenu,
+  SidebarMenuAction,
+  SidebarMenuBadge,
+  SidebarMenuButton,
+  SidebarMenuItem,
+  SidebarMenuSkeleton,
+  SidebarMenuSub,
+  SidebarMenuSubButton,
+  SidebarMenuSubItem,
+  SidebarProvider,
+  SidebarRail,
+  SidebarSeparator,
+  SidebarTrigger,
+  useSidebar,
+}
diff --git a/application/src/components/ui/skeleton.tsx b/application/src/components/ui/skeleton.tsx
new file mode 100644
index 0000000..01b8b6d
--- /dev/null
+++ b/application/src/components/ui/skeleton.tsx
@@ -0,0 +1,15 @@
+import { cn } from "@/lib/utils"
+
+function Skeleton({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div
+      className={cn("animate-pulse rounded-md bg-muted", className)}
+      {...props}
+    />
+  )
+}
+
+export { Skeleton }
diff --git a/application/src/components/ui/slider.tsx b/application/src/components/ui/slider.tsx
new file mode 100644
index 0000000..e161dae
--- /dev/null
+++ b/application/src/components/ui/slider.tsx
@@ -0,0 +1,26 @@
+import * as React from "react"
+import * as SliderPrimitive from "@radix-ui/react-slider"
+
+import { cn } from "@/lib/utils"
+
+const Slider = React.forwardRef<
+  React.ElementRef<typeof SliderPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof SliderPrimitive.Root>
+>(({ className, ...props }, ref) => (
+  <SliderPrimitive.Root
+    ref={ref}
+    className={cn(
+      "relative flex w-full touch-none select-none items-center",
+      className
+    )}
+    {...props}
+  >
+    <SliderPrimitive.Track className="relative h-2 w-full grow overflow-hidden rounded-full bg-secondary">
+      <SliderPrimitive.Range className="absolute h-full bg-primary" />
+    </SliderPrimitive.Track>
+    <SliderPrimitive.Thumb className="block h-5 w-5 rounded-full border-2 border-primary bg-background ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50" />
+  </SliderPrimitive.Root>
+))
+Slider.displayName = SliderPrimitive.Root.displayName
+
+export { Slider }
diff --git a/application/src/components/ui/sonner.tsx b/application/src/components/ui/sonner.tsx
new file mode 100644
index 0000000..f4cc822
--- /dev/null
+++ b/application/src/components/ui/sonner.tsx
@@ -0,0 +1,32 @@
+
+import { useTheme } from "@/contexts/ThemeContext";
+import { Toaster as Sonner, toast } from "sonner";
+
+type ToasterProps = React.ComponentProps<typeof Sonner>;
+
+const Toaster = ({ ...props }: ToasterProps) => {
+  const { theme } = useTheme();
+
+  return (
+    <Sonner
+      theme={theme}
+      className="toaster group"
+      toastOptions={{
+        classNames: {
+          toast:
+            "group toast group-[.toaster]:bg-background group-[.toaster]:text-foreground group-[.toaster]:border-border group-[.toaster]:shadow-lg",
+          description: "group-[.toast]:text-muted-foreground",
+          actionButton:
+            "group-[.toast]:bg-primary group-[.toast]:text-primary-foreground",
+          cancelButton:
+            "group-[.toast]:bg-muted group-[.toast]:text-muted-foreground",
+          closeButton:
+            "group-[.toast]:text-foreground/50 group-[.toast]:hover:text-foreground/80",
+        },
+      }}
+      {...props}
+    />
+  );
+};
+
+export { Toaster, toast };
diff --git a/application/src/components/ui/switch.tsx b/application/src/components/ui/switch.tsx
new file mode 100644
index 0000000..ee1f4b8
--- /dev/null
+++ b/application/src/components/ui/switch.tsx
@@ -0,0 +1,28 @@
+
+import * as React from "react"
+import * as SwitchPrimitives from "@radix-ui/react-switch"
+
+import { cn } from "@/lib/utils"
+
+const Switch = React.forwardRef<
+  React.ElementRef<typeof SwitchPrimitives.Root>,
+  React.ComponentPropsWithoutRef<typeof SwitchPrimitives.Root>
+>(({ className, ...props }, ref) => (
+  <SwitchPrimitives.Root
+    className={cn(
+      "peer inline-flex h-6 w-11 shrink-0 cursor-pointer items-center rounded-full border-2 border-transparent transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:cursor-not-allowed disabled:opacity-50 data-[state=checked]:bg-primary data-[state=unchecked]:bg-input",
+      className
+    )}
+    {...props}
+    ref={ref}
+  >
+    <SwitchPrimitives.Thumb
+      className={cn(
+        "pointer-events-none block h-5 w-5 rounded-full bg-background shadow-lg ring-0 transition-transform data-[state=checked]:translate-x-5 data-[state=unchecked]:translate-x-0"
+      )}
+    />
+  </SwitchPrimitives.Root>
+))
+Switch.displayName = SwitchPrimitives.Root.displayName
+
+export { Switch }
diff --git a/application/src/components/ui/table.tsx b/application/src/components/ui/table.tsx
new file mode 100644
index 0000000..7f3502f
--- /dev/null
+++ b/application/src/components/ui/table.tsx
@@ -0,0 +1,117 @@
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+const Table = React.forwardRef<
+  HTMLTableElement,
+  React.HTMLAttributes<HTMLTableElement>
+>(({ className, ...props }, ref) => (
+  <div className="relative w-full overflow-auto">
+    <table
+      ref={ref}
+      className={cn("w-full caption-bottom text-sm", className)}
+      {...props}
+    />
+  </div>
+))
+Table.displayName = "Table"
+
+const TableHeader = React.forwardRef<
+  HTMLTableSectionElement,
+  React.HTMLAttributes<HTMLTableSectionElement>
+>(({ className, ...props }, ref) => (
+  <thead ref={ref} className={cn("[&_tr]:border-b", className)} {...props} />
+))
+TableHeader.displayName = "TableHeader"
+
+const TableBody = React.forwardRef<
+  HTMLTableSectionElement,
+  React.HTMLAttributes<HTMLTableSectionElement>
+>(({ className, ...props }, ref) => (
+  <tbody
+    ref={ref}
+    className={cn("[&_tr:last-child]:border-0", className)}
+    {...props}
+  />
+))
+TableBody.displayName = "TableBody"
+
+const TableFooter = React.forwardRef<
+  HTMLTableSectionElement,
+  React.HTMLAttributes<HTMLTableSectionElement>
+>(({ className, ...props }, ref) => (
+  <tfoot
+    ref={ref}
+    className={cn(
+      "border-t bg-muted/50 font-medium [&>tr]:last:border-b-0",
+      className
+    )}
+    {...props}
+  />
+))
+TableFooter.displayName = "TableFooter"
+
+const TableRow = React.forwardRef<
+  HTMLTableRowElement,
+  React.HTMLAttributes<HTMLTableRowElement>
+>(({ className, ...props }, ref) => (
+  <tr
+    ref={ref}
+    className={cn(
+      "border-b transition-colors hover:bg-muted/50 data-[state=selected]:bg-muted",
+      className
+    )}
+    {...props}
+  />
+))
+TableRow.displayName = "TableRow"
+
+const TableHead = React.forwardRef<
+  HTMLTableCellElement,
+  React.ThHTMLAttributes<HTMLTableCellElement>
+>(({ className, ...props }, ref) => (
+  <th
+    ref={ref}
+    className={cn(
+      "h-12 px-4 text-left align-middle font-medium text-muted-foreground [&:has([role=checkbox])]:pr-0",
+      className
+    )}
+    {...props}
+  />
+))
+TableHead.displayName = "TableHead"
+
+const TableCell = React.forwardRef<
+  HTMLTableCellElement,
+  React.TdHTMLAttributes<HTMLTableCellElement>
+>(({ className, ...props }, ref) => (
+  <td
+    ref={ref}
+    className={cn("p-4 align-middle [&:has([role=checkbox])]:pr-0", className)}
+    {...props}
+  />
+))
+TableCell.displayName = "TableCell"
+
+const TableCaption = React.forwardRef<
+  HTMLTableCaptionElement,
+  React.HTMLAttributes<HTMLTableCaptionElement>
+>(({ className, ...props }, ref) => (
+  <caption
+    ref={ref}
+    className={cn("mt-4 text-sm text-muted-foreground", className)}
+    {...props}
+  />
+))
+TableCaption.displayName = "TableCaption"
+
+export {
+  Table,
+  TableHeader,
+  TableBody,
+  TableFooter,
+  TableHead,
+  TableRow,
+  TableCell,
+  TableCaption,
+}
diff --git a/application/src/components/ui/tabs.tsx b/application/src/components/ui/tabs.tsx
new file mode 100644
index 0000000..e86ff41
--- /dev/null
+++ b/application/src/components/ui/tabs.tsx
@@ -0,0 +1,54 @@
+
+import * as React from "react"
+import * as TabsPrimitive from "@radix-ui/react-tabs"
+
+import { cn } from "@/lib/utils"
+
+const Tabs = TabsPrimitive.Root
+
+const TabsList = React.forwardRef<
+  React.ElementRef<typeof TabsPrimitive.List>,
+  React.ComponentPropsWithoutRef<typeof TabsPrimitive.List>
+>(({ className, ...props }, ref) => (
+  <TabsPrimitive.List
+    ref={ref}
+    className={cn(
+      "inline-flex h-10 items-center justify-center rounded-md bg-muted p-1 text-muted-foreground",
+      className
+    )}
+    {...props}
+  />
+))
+TabsList.displayName = TabsPrimitive.List.displayName
+
+const TabsTrigger = React.forwardRef<
+  React.ElementRef<typeof TabsPrimitive.Trigger>,
+  React.ComponentPropsWithoutRef<typeof TabsPrimitive.Trigger>
+>(({ className, ...props }, ref) => (
+  <TabsPrimitive.Trigger
+    ref={ref}
+    className={cn(
+      "inline-flex items-center justify-center whitespace-nowrap rounded-sm px-3 py-1.5 text-sm font-medium ring-offset-background transition-all focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:bg-background data-[state=active]:text-foreground data-[state=active]:shadow-sm",
+      className
+    )}
+    {...props}
+  />
+))
+TabsTrigger.displayName = TabsPrimitive.Trigger.displayName
+
+const TabsContent = React.forwardRef<
+  React.ElementRef<typeof TabsPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof TabsPrimitive.Content>
+>(({ className, ...props }, ref) => (
+  <TabsPrimitive.Content
+    ref={ref}
+    className={cn(
+      "mt-2 ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2",
+      className
+    )}
+    {...props}
+  />
+))
+TabsContent.displayName = TabsPrimitive.Content.displayName
+
+export { Tabs, TabsList, TabsTrigger, TabsContent }
\ No newline at end of file
diff --git a/application/src/components/ui/textarea.tsx b/application/src/components/ui/textarea.tsx
new file mode 100644
index 0000000..f2fd249
--- /dev/null
+++ b/application/src/components/ui/textarea.tsx
@@ -0,0 +1,25 @@
+
+import * as React from "react"
+
+import { cn } from "@/lib/utils"
+
+export interface TextareaProps
+  extends React.TextareaHTMLAttributes<HTMLTextAreaElement> {}
+
+const Textarea = React.forwardRef<HTMLTextAreaElement, TextareaProps>(
+  ({ className, ...props }, ref) => {
+    return (
+      <textarea
+        className={cn(
+          "flex min-h-20 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
+          className
+        )}
+        ref={ref}
+        {...props}
+      />
+    )
+  }
+)
+Textarea.displayName = "Textarea"
+
+export { Textarea }
\ No newline at end of file
diff --git a/application/src/components/ui/toast.tsx b/application/src/components/ui/toast.tsx
new file mode 100644
index 0000000..a822477
--- /dev/null
+++ b/application/src/components/ui/toast.tsx
@@ -0,0 +1,127 @@
+import * as React from "react"
+import * as ToastPrimitives from "@radix-ui/react-toast"
+import { cva, type VariantProps } from "class-variance-authority"
+import { X } from "lucide-react"
+
+import { cn } from "@/lib/utils"
+
+const ToastProvider = ToastPrimitives.Provider
+
+const ToastViewport = React.forwardRef<
+  React.ElementRef<typeof ToastPrimitives.Viewport>,
+  React.ComponentPropsWithoutRef<typeof ToastPrimitives.Viewport>
+>(({ className, ...props }, ref) => (
+  <ToastPrimitives.Viewport
+    ref={ref}
+    className={cn(
+      "fixed top-0 z-[100] flex max-h-screen w-full flex-col-reverse p-4 sm:bottom-0 sm:right-0 sm:top-auto sm:flex-col md:max-w-[420px]",
+      className
+    )}
+    {...props}
+  />
+))
+ToastViewport.displayName = ToastPrimitives.Viewport.displayName
+
+const toastVariants = cva(
+  "group pointer-events-auto relative flex w-full items-center justify-between space-x-4 overflow-hidden rounded-md border p-6 pr-8 shadow-lg transition-all data-[swipe=cancel]:translate-x-0 data-[swipe=end]:translate-x-[var(--radix-toast-swipe-end-x)] data-[swipe=move]:translate-x-[var(--radix-toast-swipe-move-x)] data-[swipe=move]:transition-none data-[state=open]:animate-in data-[state=closed]:animate-out data-[swipe=end]:animate-out data-[state=closed]:fade-out-80 data-[state=closed]:slide-out-to-right-full data-[state=open]:slide-in-from-top-full data-[state=open]:sm:slide-in-from-bottom-full",
+  {
+    variants: {
+      variant: {
+        default: "border bg-background text-foreground",
+        destructive:
+          "destructive group border-destructive bg-destructive text-destructive-foreground",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+    },
+  }
+)
+
+const Toast = React.forwardRef<
+  React.ElementRef<typeof ToastPrimitives.Root>,
+  React.ComponentPropsWithoutRef<typeof ToastPrimitives.Root> &
+    VariantProps<typeof toastVariants>
+>(({ className, variant, ...props }, ref) => {
+  return (
+    <ToastPrimitives.Root
+      ref={ref}
+      className={cn(toastVariants({ variant }), className)}
+      {...props}
+    />
+  )
+})
+Toast.displayName = ToastPrimitives.Root.displayName
+
+const ToastAction = React.forwardRef<
+  React.ElementRef<typeof ToastPrimitives.Action>,
+  React.ComponentPropsWithoutRef<typeof ToastPrimitives.Action>
+>(({ className, ...props }, ref) => (
+  <ToastPrimitives.Action
+    ref={ref}
+    className={cn(
+      "inline-flex h-8 shrink-0 items-center justify-center rounded-md border bg-transparent px-3 text-sm font-medium ring-offset-background transition-colors hover:bg-secondary focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 group-[.destructive]:border-muted/40 group-[.destructive]:hover:border-destructive/30 group-[.destructive]:hover:bg-destructive group-[.destructive]:hover:text-destructive-foreground group-[.destructive]:focus:ring-destructive",
+      className
+    )}
+    {...props}
+  />
+))
+ToastAction.displayName = ToastPrimitives.Action.displayName
+
+const ToastClose = React.forwardRef<
+  React.ElementRef<typeof ToastPrimitives.Close>,
+  React.ComponentPropsWithoutRef<typeof ToastPrimitives.Close>
+>(({ className, ...props }, ref) => (
+  <ToastPrimitives.Close
+    ref={ref}
+    className={cn(
+      "absolute right-2 top-2 rounded-md p-1 text-foreground/50 opacity-0 transition-opacity hover:text-foreground focus:opacity-100 focus:outline-none focus:ring-2 group-hover:opacity-100 group-[.destructive]:text-red-300 group-[.destructive]:hover:text-red-50 group-[.destructive]:focus:ring-red-400 group-[.destructive]:focus:ring-offset-red-600",
+      className
+    )}
+    toast-close=""
+    {...props}
+  >
+    <X className="h-4 w-4" />
+  </ToastPrimitives.Close>
+))
+ToastClose.displayName = ToastPrimitives.Close.displayName
+
+const ToastTitle = React.forwardRef<
+  React.ElementRef<typeof ToastPrimitives.Title>,
+  React.ComponentPropsWithoutRef<typeof ToastPrimitives.Title>
+>(({ className, ...props }, ref) => (
+  <ToastPrimitives.Title
+    ref={ref}
+    className={cn("text-sm font-semibold", className)}
+    {...props}
+  />
+))
+ToastTitle.displayName = ToastPrimitives.Title.displayName
+
+const ToastDescription = React.forwardRef<
+  React.ElementRef<typeof ToastPrimitives.Description>,
+  React.ComponentPropsWithoutRef<typeof ToastPrimitives.Description>
+>(({ className, ...props }, ref) => (
+  <ToastPrimitives.Description
+    ref={ref}
+    className={cn("text-sm opacity-90", className)}
+    {...props}
+  />
+))
+ToastDescription.displayName = ToastPrimitives.Description.displayName
+
+type ToastProps = React.ComponentPropsWithoutRef<typeof Toast>
+
+type ToastActionElement = React.ReactElement<typeof ToastAction>
+
+export {
+  type ToastProps,
+  type ToastActionElement,
+  ToastProvider,
+  ToastViewport,
+  Toast,
+  ToastTitle,
+  ToastDescription,
+  ToastClose,
+  ToastAction,
+}
diff --git a/application/src/components/ui/toaster.tsx b/application/src/components/ui/toaster.tsx
new file mode 100644
index 0000000..6c67edf
--- /dev/null
+++ b/application/src/components/ui/toaster.tsx
@@ -0,0 +1,33 @@
+import { useToast } from "@/hooks/use-toast"
+import {
+  Toast,
+  ToastClose,
+  ToastDescription,
+  ToastProvider,
+  ToastTitle,
+  ToastViewport,
+} from "@/components/ui/toast"
+
+export function Toaster() {
+  const { toasts } = useToast()
+
+  return (
+    <ToastProvider>
+      {toasts.map(function ({ id, title, description, action, ...props }) {
+        return (
+          <Toast key={id} {...props}>
+            <div className="grid gap-1">
+              {title && <ToastTitle>{title}</ToastTitle>}
+              {description && (
+                <ToastDescription>{description}</ToastDescription>
+              )}
+            </div>
+            {action}
+            <ToastClose />
+          </Toast>
+        )
+      })}
+      <ToastViewport />
+    </ToastProvider>
+  )
+}
diff --git a/application/src/components/ui/toggle-group.tsx b/application/src/components/ui/toggle-group.tsx
new file mode 100644
index 0000000..afe5da6
--- /dev/null
+++ b/application/src/components/ui/toggle-group.tsx
@@ -0,0 +1,59 @@
+import * as React from "react"
+import * as ToggleGroupPrimitive from "@radix-ui/react-toggle-group"
+import { type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+import { toggleVariants } from "@/components/ui/toggle"
+
+const ToggleGroupContext = React.createContext<
+  VariantProps<typeof toggleVariants>
+>({
+  size: "default",
+  variant: "default",
+})
+
+const ToggleGroup = React.forwardRef<
+  React.ElementRef<typeof ToggleGroupPrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof ToggleGroupPrimitive.Root> &
+    VariantProps<typeof toggleVariants>
+>(({ className, variant, size, children, ...props }, ref) => (
+  <ToggleGroupPrimitive.Root
+    ref={ref}
+    className={cn("flex items-center justify-center gap-1", className)}
+    {...props}
+  >
+    <ToggleGroupContext.Provider value={{ variant, size }}>
+      {children}
+    </ToggleGroupContext.Provider>
+  </ToggleGroupPrimitive.Root>
+))
+
+ToggleGroup.displayName = ToggleGroupPrimitive.Root.displayName
+
+const ToggleGroupItem = React.forwardRef<
+  React.ElementRef<typeof ToggleGroupPrimitive.Item>,
+  React.ComponentPropsWithoutRef<typeof ToggleGroupPrimitive.Item> &
+    VariantProps<typeof toggleVariants>
+>(({ className, children, variant, size, ...props }, ref) => {
+  const context = React.useContext(ToggleGroupContext)
+
+  return (
+    <ToggleGroupPrimitive.Item
+      ref={ref}
+      className={cn(
+        toggleVariants({
+          variant: context.variant || variant,
+          size: context.size || size,
+        }),
+        className
+      )}
+      {...props}
+    >
+      {children}
+    </ToggleGroupPrimitive.Item>
+  )
+})
+
+ToggleGroupItem.displayName = ToggleGroupPrimitive.Item.displayName
+
+export { ToggleGroup, ToggleGroupItem }
diff --git a/application/src/components/ui/toggle.tsx b/application/src/components/ui/toggle.tsx
new file mode 100644
index 0000000..9ecac28
--- /dev/null
+++ b/application/src/components/ui/toggle.tsx
@@ -0,0 +1,43 @@
+import * as React from "react"
+import * as TogglePrimitive from "@radix-ui/react-toggle"
+import { cva, type VariantProps } from "class-variance-authority"
+
+import { cn } from "@/lib/utils"
+
+const toggleVariants = cva(
+  "inline-flex items-center justify-center rounded-md text-sm font-medium ring-offset-background transition-colors hover:bg-muted hover:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 data-[state=on]:bg-accent data-[state=on]:text-accent-foreground",
+  {
+    variants: {
+      variant: {
+        default: "bg-transparent",
+        outline:
+          "border border-input bg-transparent hover:bg-accent hover:text-accent-foreground",
+      },
+      size: {
+        default: "h-10 px-3",
+        sm: "h-9 px-2.5",
+        lg: "h-11 px-5",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  }
+)
+
+const Toggle = React.forwardRef<
+  React.ElementRef<typeof TogglePrimitive.Root>,
+  React.ComponentPropsWithoutRef<typeof TogglePrimitive.Root> &
+    VariantProps<typeof toggleVariants>
+>(({ className, variant, size, ...props }, ref) => (
+  <TogglePrimitive.Root
+    ref={ref}
+    className={cn(toggleVariants({ variant, size, className }))}
+    {...props}
+  />
+))
+
+Toggle.displayName = TogglePrimitive.Root.displayName
+
+export { Toggle, toggleVariants }
diff --git a/application/src/components/ui/tooltip.tsx b/application/src/components/ui/tooltip.tsx
new file mode 100644
index 0000000..e121f0a
--- /dev/null
+++ b/application/src/components/ui/tooltip.tsx
@@ -0,0 +1,28 @@
+import * as React from "react"
+import * as TooltipPrimitive from "@radix-ui/react-tooltip"
+
+import { cn } from "@/lib/utils"
+
+const TooltipProvider = TooltipPrimitive.Provider
+
+const Tooltip = TooltipPrimitive.Root
+
+const TooltipTrigger = TooltipPrimitive.Trigger
+
+const TooltipContent = React.forwardRef<
+  React.ElementRef<typeof TooltipPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof TooltipPrimitive.Content>
+>(({ className, sideOffset = 4, ...props }, ref) => (
+  <TooltipPrimitive.Content
+    ref={ref}
+    sideOffset={sideOffset}
+    className={cn(
+      "z-50 overflow-hidden rounded-md border bg-popover px-3 py-1.5 text-sm text-popover-foreground shadow-md animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+      className
+    )}
+    {...props}
+  />
+))
+TooltipContent.displayName = TooltipPrimitive.Content.displayName
+
+export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider }
diff --git a/application/src/components/ui/use-toast.ts b/application/src/components/ui/use-toast.ts
new file mode 100644
index 0000000..b0aef21
--- /dev/null
+++ b/application/src/components/ui/use-toast.ts
@@ -0,0 +1,3 @@
+import { useToast, toast } from "@/hooks/use-toast";
+
+export { useToast, toast };
diff --git a/application/src/contexts/LanguageContext.tsx b/application/src/contexts/LanguageContext.tsx
new file mode 100644
index 0000000..31e7662
--- /dev/null
+++ b/application/src/contexts/LanguageContext.tsx
@@ -0,0 +1,108 @@
+import React, { createContext, useContext, useState, ReactNode, useCallback } from "react";
+import { translations, Language, TranslationModule, TranslationKey } from "@/translations";
+
+type TranslationVars = Record<string, string | number>;
+
+type LanguageContextType = {
+  language: Language;
+  setLanguage: (language: Language) => void;
+  t: {
+    (key: string): string;
+    (key: string, vars: TranslationVars): string;
+    <M extends TranslationModule>(key: string, module: M): string;
+    <M extends TranslationModule>(key: string, module: M, vars: TranslationVars): string;
+  };
+};
+
+const LanguageContext = createContext<LanguageContextType | undefined>(undefined);
+
+// eslint-disable-next-line react-refresh/only-export-components
+export const useLanguage = () => {
+  const context = useContext(LanguageContext);
+  if (!context) {
+    throw new Error("useLanguage must be used within a LanguageProvider");
+  }
+  return context;
+};
+
+export const LanguageProvider = ({ children }: { children: ReactNode }) => {
+  const [language, setLanguage] = useState<Language>("en");
+  const fallbackLanguage: Language = "en";
+
+  const interpolate = (template: string, vars: TranslationVars): string => {
+    return template.replace(/{(\w+)}/g, (match, key) => {
+      return vars[key] !== undefined ? String(vars[key]) : match;
+    });
+  };
+
+  const t = useCallback(((
+    key: string,
+    moduleOrVars?: TranslationModule | TranslationVars,
+    vars?: TranslationVars
+  ): string => {
+    let module: TranslationModule | undefined;
+    let variables: TranslationVars | undefined;
+
+    if (typeof moduleOrVars === "string") {
+      module = moduleOrVars;
+      variables = vars;
+    } else if (typeof moduleOrVars === "object") {
+      variables = moduleOrVars;
+    }
+
+    const langPack = translations[language];
+    const fallbackPack = translations[fallbackLanguage];
+    let translatedText = "";
+
+    if (module) {
+      const moduleKey = key as TranslationKey<typeof module>;
+      const valCur = langPack?.[module]?.[moduleKey];
+      if (typeof valCur === "string") {
+        translatedText = valCur;
+      } else {
+        const valEn = fallbackPack?.[module]?.[moduleKey];
+        translatedText = typeof valEn === "string" ? valEn : key;
+      }
+    } else {
+      let found = false;
+
+      for (const mod of Object.keys(langPack) as TranslationModule[]) {
+        const moduleTranslations = langPack[mod];
+        if (moduleTranslations && key in moduleTranslations) {
+          const val = moduleTranslations[key as keyof typeof moduleTranslations];
+          if (typeof val === "string") {
+            translatedText = val;
+            found = true;
+            break;
+          }
+        }
+      }
+
+      if (!found) {
+        for (const mod of Object.keys(fallbackPack) as TranslationModule[]) {
+          const moduleTranslations = fallbackPack[mod];
+          if (moduleTranslations && key in moduleTranslations) {
+            const val = moduleTranslations[key as keyof typeof moduleTranslations];
+            if (typeof val === "string") {
+              translatedText = val;
+              found = true;
+              break;
+            }
+          }
+        }
+      }
+
+      if (!found) {
+        translatedText = key;
+      }
+    }
+
+    return variables ? interpolate(translatedText, variables) : translatedText;
+  }) as LanguageContextType['t'], [language]);
+
+  return (
+    <LanguageContext.Provider value={{ language, setLanguage, t }}>
+      {children}
+    </LanguageContext.Provider>
+  );
+};
\ No newline at end of file
diff --git a/application/src/contexts/SidebarContext.tsx b/application/src/contexts/SidebarContext.tsx
new file mode 100644
index 0000000..2e695b1
--- /dev/null
+++ b/application/src/contexts/SidebarContext.tsx
@@ -0,0 +1,77 @@
+import React, { createContext, useContext, useState, useEffect } from 'react';
+
+interface SidebarContextType {
+  sidebarCollapsed: boolean;
+  setSidebarCollapsed: (collapsed: boolean) => void;
+  toggleSidebar: () => void;
+  isMobileOpen: boolean;
+  setIsMobileOpen: (open: boolean) => void;
+  toggleMobileMenu: () => void;
+}
+
+const SidebarContext = createContext<SidebarContextType | undefined>(undefined);
+
+export const SidebarProvider: React.FC<{ children?: React.ReactNode }> = ({ children }) => {
+  // Initialize sidebar collapsed state from localStorage with window check for safety
+  const [sidebarCollapsed, setSidebarCollapsed] = useState(() => {
+    if (typeof window !== 'undefined') {
+      const saved = localStorage.getItem("sidebarCollapsed");
+      return saved ? JSON.parse(saved) : false;
+    }
+    return false;
+  });
+  
+  // Fix: added isMobileOpen state for responsive mobile menu
+  const [isMobileOpen, setIsMobileOpen] = useState(false);
+
+  const toggleSidebar = () => {
+    setSidebarCollapsed(prev => {
+      const newState = !prev;
+      if (typeof window !== 'undefined') {
+        localStorage.setItem("sidebarCollapsed", JSON.stringify(newState));
+      }
+      return newState;
+    });
+  };
+
+  // Fix: added toggleMobileMenu function to manage mobile drawer state
+  const toggleMobileMenu = () => {
+    setIsMobileOpen(prev => !prev);
+  };
+
+  // Fix: added resize listener to close mobile menu when switching to desktop view
+  useEffect(() => {
+    if (typeof window === 'undefined') return;
+    
+    const handleResize = () => {
+      if (window.innerWidth >= 1024) {
+        setIsMobileOpen(false);
+      }
+    };
+    window.addEventListener('resize', handleResize);
+    return () => window.removeEventListener('resize', handleResize);
+  }, []);
+
+  const value = {
+    sidebarCollapsed,
+    setSidebarCollapsed,
+    toggleSidebar,
+    isMobileOpen,
+    setIsMobileOpen,
+    toggleMobileMenu
+  };
+
+  return (
+    <SidebarContext.Provider value={value}>
+      {children}
+    </SidebarContext.Provider>
+  );
+};
+
+export const useSidebar = () => {
+  const context = useContext(SidebarContext);
+  if (context === undefined) {
+    throw new Error('useSidebar must be used within a SidebarProvider');
+  }
+  return context;
+};
diff --git a/application/src/contexts/ThemeContext.tsx b/application/src/contexts/ThemeContext.tsx
new file mode 100644
index 0000000..aee7501
--- /dev/null
+++ b/application/src/contexts/ThemeContext.tsx
@@ -0,0 +1,77 @@
+
+import React, { createContext, useContext, useEffect, useState } from "react";
+
+type Theme = "dark" | "light";
+
+interface ThemeContextType {
+  theme: Theme;
+  toggleTheme: () => void;
+}
+
+const ThemeContext = createContext<ThemeContextType>({
+  theme: "dark",
+  toggleTheme: () => {},
+});
+
+export const ThemeProvider = ({ children }: { children: React.ReactNode }) => {
+  // Initialize theme from localStorage or default to system preference
+  const [theme, setTheme] = useState<Theme>(() => {
+    const savedTheme = localStorage.getItem("theme") as Theme;
+    
+    if (savedTheme) {
+      return savedTheme;
+    }
+    
+    // Check for system preference
+    if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) {
+      return "dark";
+    }
+    
+    return "light";
+  });
+
+  // Update theme class on document when theme changes
+  useEffect(() => {
+    const root = window.document.documentElement;
+    
+    if (theme === "dark") {
+      root.classList.add("dark");
+      root.classList.remove("light");
+    } else {
+      root.classList.add("light");
+      root.classList.remove("dark");
+    }
+    
+    // Save theme preference to localStorage
+    localStorage.setItem("theme", theme);
+  }, [theme]);
+
+  // Listen for system theme changes
+  useEffect(() => {
+    const mediaQuery = window.matchMedia('(prefers-color-scheme: dark)');
+    
+    const handleChange = (e: MediaQueryListEvent) => {
+      if (!localStorage.getItem("theme")) {
+        setTheme(e.matches ? "dark" : "light");
+      }
+    };
+    
+    mediaQuery.addEventListener('change', handleChange);
+    
+    return () => {
+      mediaQuery.removeEventListener('change', handleChange);
+    };
+  }, []);
+
+  const toggleTheme = () => {
+    setTheme(prevTheme => prevTheme === "dark" ? "light" : "dark");
+  };
+
+  return (
+    <ThemeContext.Provider value={{ theme, toggleTheme }}>
+      {children}
+    </ThemeContext.Provider>
+  );
+};
+
+export const useTheme = () => useContext(ThemeContext);
diff --git a/application/src/hooks/use-mobile.tsx b/application/src/hooks/use-mobile.tsx
new file mode 100644
index 0000000..2b0fe1d
--- /dev/null
+++ b/application/src/hooks/use-mobile.tsx
@@ -0,0 +1,19 @@
+import * as React from "react"
+
+const MOBILE_BREAKPOINT = 768
+
+export function useIsMobile() {
+  const [isMobile, setIsMobile] = React.useState<boolean | undefined>(undefined)
+
+  React.useEffect(() => {
+    const mql = window.matchMedia(`(max-width: ${MOBILE_BREAKPOINT - 1}px)`)
+    const onChange = () => {
+      setIsMobile(window.innerWidth < MOBILE_BREAKPOINT)
+    }
+    mql.addEventListener("change", onChange)
+    setIsMobile(window.innerWidth < MOBILE_BREAKPOINT)
+    return () => mql.removeEventListener("change", onChange)
+  }, [])
+
+  return !!isMobile
+}
diff --git a/application/src/hooks/use-toast.ts b/application/src/hooks/use-toast.ts
new file mode 100644
index 0000000..2c14125
--- /dev/null
+++ b/application/src/hooks/use-toast.ts
@@ -0,0 +1,191 @@
+import * as React from "react"
+
+import type {
+  ToastActionElement,
+  ToastProps,
+} from "@/components/ui/toast"
+
+const TOAST_LIMIT = 1
+const TOAST_REMOVE_DELAY = 1000000
+
+type ToasterToast = ToastProps & {
+  id: string
+  title?: React.ReactNode
+  description?: React.ReactNode
+  action?: ToastActionElement
+}
+
+const actionTypes = {
+  ADD_TOAST: "ADD_TOAST",
+  UPDATE_TOAST: "UPDATE_TOAST",
+  DISMISS_TOAST: "DISMISS_TOAST",
+  REMOVE_TOAST: "REMOVE_TOAST",
+} as const
+
+let count = 0
+
+function genId() {
+  count = (count + 1) % Number.MAX_SAFE_INTEGER
+  return count.toString()
+}
+
+type ActionType = typeof actionTypes
+
+type Action =
+  | {
+      type: ActionType["ADD_TOAST"]
+      toast: ToasterToast
+    }
+  | {
+      type: ActionType["UPDATE_TOAST"]
+      toast: Partial<ToasterToast>
+    }
+  | {
+      type: ActionType["DISMISS_TOAST"]
+      toastId?: ToasterToast["id"]
+    }
+  | {
+      type: ActionType["REMOVE_TOAST"]
+      toastId?: ToasterToast["id"]
+    }
+
+interface State {
+  toasts: ToasterToast[]
+}
+
+const toastTimeouts = new Map<string, ReturnType<typeof setTimeout>>()
+
+const addToRemoveQueue = (toastId: string) => {
+  if (toastTimeouts.has(toastId)) {
+    return
+  }
+
+  const timeout = setTimeout(() => {
+    toastTimeouts.delete(toastId)
+    dispatch({
+      type: "REMOVE_TOAST",
+      toastId: toastId,
+    })
+  }, TOAST_REMOVE_DELAY)
+
+  toastTimeouts.set(toastId, timeout)
+}
+
+export const reducer = (state: State, action: Action): State => {
+  switch (action.type) {
+    case "ADD_TOAST":
+      return {
+        ...state,
+        toasts: [action.toast, ...state.toasts].slice(0, TOAST_LIMIT),
+      }
+
+    case "UPDATE_TOAST":
+      return {
+        ...state,
+        toasts: state.toasts.map((t) =>
+          t.id === action.toast.id ? { ...t, ...action.toast } : t
+        ),
+      }
+
+    case "DISMISS_TOAST": {
+      const { toastId } = action
+
+      // ! Side effects ! - This could be extracted into a dismissToast() action,
+      // but I'll keep it here for simplicity
+      if (toastId) {
+        addToRemoveQueue(toastId)
+      } else {
+        state.toasts.forEach((toast) => {
+          addToRemoveQueue(toast.id)
+        })
+      }
+
+      return {
+        ...state,
+        toasts: state.toasts.map((t) =>
+          t.id === toastId || toastId === undefined
+            ? {
+                ...t,
+                open: false,
+              }
+            : t
+        ),
+      }
+    }
+    case "REMOVE_TOAST":
+      if (action.toastId === undefined) {
+        return {
+          ...state,
+          toasts: [],
+        }
+      }
+      return {
+        ...state,
+        toasts: state.toasts.filter((t) => t.id !== action.toastId),
+      }
+  }
+}
+
+const listeners: Array<(state: State) => void> = []
+
+let memoryState: State = { toasts: [] }
+
+function dispatch(action: Action) {
+  memoryState = reducer(memoryState, action)
+  listeners.forEach((listener) => {
+    listener(memoryState)
+  })
+}
+
+type Toast = Omit<ToasterToast, "id">
+
+function toast({ ...props }: Toast) {
+  const id = genId()
+
+  const update = (props: ToasterToast) =>
+    dispatch({
+      type: "UPDATE_TOAST",
+      toast: { ...props, id },
+    })
+  const dismiss = () => dispatch({ type: "DISMISS_TOAST", toastId: id })
+
+  dispatch({
+    type: "ADD_TOAST",
+    toast: {
+      ...props,
+      id,
+      open: true,
+      onOpenChange: (open) => {
+        if (!open) dismiss()
+      },
+    },
+  })
+
+  return {
+    id: id,
+    dismiss,
+    update,
+  }
+}
+
+function useToast() {
+  const [state, setState] = React.useState<State>(memoryState)
+
+  React.useEffect(() => {
+    listeners.push(setState)
+    return () => {
+      const index = listeners.indexOf(setState)
+      if (index > -1) {
+        listeners.splice(index, 1)
+      }
+    }
+  }, [state])
+
+  return {
+    ...state,
+    toast,
+    dismiss: (toastId?: string) => dispatch({ type: "DISMISS_TOAST", toastId }),
+  }
+}
+
+export { useToast, toast }
diff --git a/application/src/hooks/useOperationalPage.ts b/application/src/hooks/useOperationalPage.ts
new file mode 100644
index 0000000..db4d1a7
--- /dev/null
+++ b/application/src/hooks/useOperationalPage.ts
@@ -0,0 +1,91 @@
+
+import { useState, useEffect } from 'react';
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+import { operationalPageService } from '@/services/operationalPageService';
+import { OperationalPageRecord } from '@/types/operational.types';
+import { toast } from '@/hooks/use-toast';
+
+export const useOperationalPages = () => {
+  return useQuery({
+    queryKey: ['operational-pages'],
+    queryFn: operationalPageService.getOperationalPages,
+    staleTime: 30000,
+  });
+};
+
+export const useOperationalPage = (id: string) => {
+  return useQuery({
+    queryKey: ['operational-page', id],
+    queryFn: () => operationalPageService.getOperationalPage(id),
+    enabled: !!id,
+    staleTime: 30000,
+  });
+};
+
+export const useUpdateOperationalPage = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({ id, data }: { id: string; data: Partial<OperationalPageRecord> }) =>
+      operationalPageService.updateOperationalPage(id, data),
+    onSuccess: (data) => {
+      queryClient.invalidateQueries({ queryKey: ['operational-pages'] });
+      queryClient.invalidateQueries({ queryKey: ['operational-page', data.id] });
+      toast({
+        title: 'Success',
+        description: 'Operational page updated successfully',
+      });
+    },
+    onError: (error) => {
+      toast({
+        title: 'Error',
+        description: 'Failed to update operational page',
+        variant: 'destructive',
+      });
+    },
+  });
+};
+
+export const useCreateOperationalPage = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: operationalPageService.createOperationalPage,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['operational-pages'] });
+      toast({
+        title: 'Success',
+        description: 'Operational page created successfully',
+      });
+    },
+    onError: (error) => {
+      toast({
+        title: 'Error',
+        description: 'Failed to create operational page',
+        variant: 'destructive',
+      });
+    },
+  });
+};
+
+export const useDeleteOperationalPage = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: operationalPageService.deleteOperationalPage,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['operational-pages'] });
+      toast({
+        title: 'Success',
+        description: 'Operational page deleted successfully',
+      });
+    },
+    onError: (error) => {
+      toast({
+        title: 'Error',
+        description: 'Failed to delete operational page',
+        variant: 'destructive',
+      });
+    },
+  });
+};
\ No newline at end of file
diff --git a/application/src/hooks/useSSLPagination.ts b/application/src/hooks/useSSLPagination.ts
new file mode 100644
index 0000000..25bc9e0
--- /dev/null
+++ b/application/src/hooks/useSSLPagination.ts
@@ -0,0 +1,52 @@
+
+import { useState, useMemo } from 'react';
+import { SSLCertificate } from '@/types/ssl.types';
+
+export type SSLPageSize = 10 | 30 | 50;
+
+interface UseSSLPaginationProps {
+  certificates: SSLCertificate[];
+  initialPageSize?: SSLPageSize;
+}
+
+export const useSSLPagination = ({ 
+  certificates, 
+  initialPageSize = 10 
+}: UseSSLPaginationProps) => {
+  const [currentPage, setCurrentPage] = useState(1);
+  const [pageSize, setPageSize] = useState<SSLPageSize>(initialPageSize);
+
+  const { paginatedCertificates, totalPages } = useMemo(() => {
+    const totalItems = certificates.length;
+    const pages = Math.ceil(totalItems / pageSize);
+    const startIndex = (currentPage - 1) * pageSize;
+    const endIndex = startIndex + pageSize;
+    
+    return {
+      paginatedCertificates: certificates.slice(startIndex, endIndex),
+      totalPages: Math.max(1, pages)
+    };
+  }, [certificates, currentPage, pageSize]);
+
+  // Reset to first page when page size changes or certificates change
+  const handlePageSizeChange = (newPageSize: SSLPageSize) => {
+    setPageSize(newPageSize);
+    setCurrentPage(1);
+  };
+
+  // Reset to first page if current page exceeds total pages
+  const handlePageChange = (page: number) => {
+    const validPage = Math.min(Math.max(1, page), totalPages);
+    setCurrentPage(validPage);
+  };
+
+  return {
+    paginatedCertificates,
+    currentPage,
+    totalPages,
+    pageSize,
+    totalItems: certificates.length,
+    handlePageChange,
+    handlePageSizeChange,
+  };
+};
\ No newline at end of file
diff --git a/application/src/hooks/useServicesPagination.ts b/application/src/hooks/useServicesPagination.ts
new file mode 100644
index 0000000..960aca5
--- /dev/null
+++ b/application/src/hooks/useServicesPagination.ts
@@ -0,0 +1,52 @@
+
+import { useState, useMemo } from 'react';
+import { Service } from '@/types/service.types';
+
+export type PageSize = 10 | 30 | 50;
+
+interface UseServicesPaginationProps {
+  services: Service[];
+  initialPageSize?: PageSize;
+}
+
+export const useServicesPagination = ({ 
+  services, 
+  initialPageSize = 10 
+}: UseServicesPaginationProps) => {
+  const [currentPage, setCurrentPage] = useState(1);
+  const [pageSize, setPageSize] = useState<PageSize>(initialPageSize);
+
+  const { paginatedServices, totalPages } = useMemo(() => {
+    const totalItems = services.length;
+    const pages = Math.ceil(totalItems / pageSize);
+    const startIndex = (currentPage - 1) * pageSize;
+    const endIndex = startIndex + pageSize;
+    
+    return {
+      paginatedServices: services.slice(startIndex, endIndex),
+      totalPages: Math.max(1, pages)
+    };
+  }, [services, currentPage, pageSize]);
+
+  // Reset to first page when page size changes or services change
+  const handlePageSizeChange = (newPageSize: PageSize) => {
+    setPageSize(newPageSize);
+    setCurrentPage(1);
+  };
+
+  // Reset to first page if current page exceeds total pages
+  const handlePageChange = (page: number) => {
+    const validPage = Math.min(Math.max(1, page), totalPages);
+    setCurrentPage(validPage);
+  };
+
+  return {
+    paginatedServices,
+    currentPage,
+    totalPages,
+    pageSize,
+    totalItems: services.length,
+    handlePageChange,
+    handlePageSizeChange,
+  };
+};
\ No newline at end of file
diff --git a/application/src/hooks/useStatusPageComponents.ts b/application/src/hooks/useStatusPageComponents.ts
new file mode 100644
index 0000000..fea1748
--- /dev/null
+++ b/application/src/hooks/useStatusPageComponents.ts
@@ -0,0 +1,66 @@
+
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+import { statusPageComponentsService } from '@/services/statusPageComponentsService';
+import { StatusPageComponentRecord } from '@/types/statusPageComponents.types';
+import { toast } from '@/hooks/use-toast';
+
+export const useStatusPageComponents = () => {
+  return useQuery({
+    queryKey: ['status-page-components'],
+    queryFn: statusPageComponentsService.getStatusPageComponents,
+    staleTime: 30000,
+  });
+};
+
+export const useStatusPageComponentsByOperationalId = (operationalStatusId: string) => {
+  return useQuery({
+    queryKey: ['status-page-components', operationalStatusId],
+    queryFn: () => statusPageComponentsService.getStatusPageComponentsByOperationalId(operationalStatusId),
+    enabled: !!operationalStatusId,
+    staleTime: 30000,
+  });
+};
+
+export const useCreateStatusPageComponent = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: statusPageComponentsService.createStatusPageComponent,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['status-page-components'] });
+      toast({
+        title: 'Success',
+        description: 'Status page component created successfully',
+      });
+    },
+    onError: (error) => {
+      toast({
+        title: 'Error',
+        description: 'Failed to create status page component',
+        variant: 'destructive',
+      });
+    },
+  });
+};
+
+export const useDeleteStatusPageComponent = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: statusPageComponentsService.deleteStatusPageComponent,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['status-page-components'] });
+      toast({
+        title: 'Success',
+        description: 'Status page component deleted successfully',
+      });
+    },
+    onError: (error) => {
+      toast({
+        title: 'Error',
+        description: 'Failed to delete status page component',
+        variant: 'destructive',
+      });
+    },
+  });
+};
\ No newline at end of file
diff --git a/application/src/hooks/useSystemSettings.tsx b/application/src/hooks/useSystemSettings.tsx
new file mode 100644
index 0000000..195eee6
--- /dev/null
+++ b/application/src/hooks/useSystemSettings.tsx
@@ -0,0 +1,166 @@
+
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+import { toast } from "@/components/ui/use-toast";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { authService } from "@/services/authService";
+import { GeneralSettings } from "@/services/settingsService";
+
+interface ApiResponse {
+  success: boolean;
+  data?: GeneralSettings;
+  message?: string;
+}
+
+export function useSystemSettings() {
+  const queryClient = useQueryClient();
+  const { t } = useLanguage();
+  
+  // Check if user is super admin
+  const currentUser = authService.getCurrentUser();
+  const isSuperAdmin = currentUser?.role === "superadmin";
+  
+  // Fetch settings from API - only if user is super admin
+  const { 
+    data: settings,
+    isLoading,
+    error,
+    refetch
+  } = useQuery({
+    queryKey: ['generalSettings'],
+    queryFn: async (): Promise<GeneralSettings | null> => {
+      try {
+      //  console.log('Fetching settings from API...');
+        const response = await fetch('/api/settings', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({ action: 'getSettings' })
+        });
+        
+      //  console.log('API response status:', response.status);
+        
+        if (!response.ok) {
+          throw new Error(`HTTP error! status: ${response.status}`);
+        }
+        
+        const result: ApiResponse = await response.json();
+      //  console.log('API response data:', result);
+        
+        if (!result.success) {
+          throw new Error(result.message || 'Failed to fetch settings');
+        }
+        
+        return result.data || null;
+      } catch (error) {
+      //  console.error('Error fetching settings:', error);
+        toast({
+          title: t("errorFetchingSettings", "settings"),
+          description: error instanceof Error ? error.message : String(error),
+          variant: "destructive",
+        });
+        return null;
+      }
+    },
+    enabled: isSuperAdmin, // Only run query if user is super admin
+  });
+
+  // Update settings mutation
+  const updateSettingsMutation = useMutation({
+    mutationFn: async (updatedSettings: GeneralSettings): Promise<GeneralSettings> => {
+     // console.log('Updating settings:', updatedSettings);
+      const response = await fetch('/api/settings', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ 
+          action: 'updateSettings',
+          data: updatedSettings
+        })
+      });
+      
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+      
+      const result: ApiResponse = await response.json();
+      
+      if (!result.success || !result.data) {
+        throw new Error(result.message || 'Failed to update settings');
+      }
+      
+      return result.data;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['generalSettings'] });
+      toast({
+        title: t("settingsUpdated", "settings"),
+        description: "",
+        variant: "default",
+      });
+    },
+    onError: (error) => {
+    //  console.error('Error updating settings:', error);
+      toast({
+        title: t("errorSavingSettings", "settings"),
+        description: error instanceof Error ? error.message : String(error),
+        variant: "destructive",
+      });
+    }
+  });
+
+  // Test email connection
+  const testEmailConnectionMutation = useMutation({
+    mutationFn: async (smtpConfig: any): Promise<{success: boolean, message: string}> => {
+     // console.log('Testing email connection:', smtpConfig);
+      const response = await fetch('/api/settings', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ 
+          action: 'testEmailConnection',
+          data: smtpConfig
+        })
+      });
+      
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+      
+      const result = await response.json();
+      return {
+        success: result.success,
+        message: result.message || ''
+      };
+    },
+    onSuccess: (result) => {
+      toast({
+        title: result.success ? t("connectionSuccess", "settings") : t("connectionFailed", "settings"),
+        description: result.message,
+        variant: result.success ? "default" : "destructive",
+      });
+    },
+    onError: (error) => {
+     // console.error('Error testing connection:', error);
+      toast({
+        title: t("connectionFailed", "settings"),
+        description: error instanceof Error ? error.message : String(error),
+        variant: "destructive",
+      });
+    }
+  });
+
+  return {
+    settings,
+    isLoading,
+    error,
+    refetch,
+    updateSettings: updateSettingsMutation.mutate,
+    isUpdating: updateSettingsMutation.isPending,
+    testEmailConnection: testEmailConnectionMutation.mutate,
+    isTestingConnection: testEmailConnectionMutation.isPending,
+    systemName: settings?.system_name || settings?.meta?.appName || 'CheckCle',
+  };
+}
\ No newline at end of file
diff --git a/application/src/index.css b/application/src/index.css
new file mode 100644
index 0000000..0a2113b
--- /dev/null
+++ b/application/src/index.css
@@ -0,0 +1,161 @@
+
+@import url('https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap');
+
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+@layer base {
+  :root {
+    --background: 0 0% 100%;
+    --foreground: 222.2 84% 4.9%;
+
+    --card: 0 0% 100%;
+    --card-foreground: 222.2 84% 4.9%;
+
+    --popover: 0 0% 100%;
+    --popover-foreground: 222.2 84% 4.9%;
+
+    --primary: 222.2 47.4% 11.2%;
+    --primary-foreground: 210 40% 98%;
+
+    --secondary: 210 40% 96.1%;
+    --secondary-foreground: 222.2 47.4% 11.2%;
+
+    --muted: 210 40% 96.1%;
+    --muted-foreground: 215.4 16.3% 46.9%;
+
+    --accent: 210 40% 96.1%;
+    --accent-foreground: 222.2 47.4% 11.2%;
+
+    --destructive: 0 84.2% 60.2%;
+    --destructive-foreground: 210 40% 98%;
+
+    --border: 214.3 31.8% 91.4%;
+    --input: 214.3 31.8% 91.4%;
+    --ring: 222.2 84% 4.9%;
+
+    --radius: 0.5rem;
+
+    --sidebar-background: 220 14% 96%;
+    --sidebar-foreground: 240 5.3% 26.1%;
+    --sidebar-primary: 240 5.9% 10%;
+    --sidebar-primary-foreground: 0 0% 98%;
+    --sidebar-accent: 220 14% 92%;
+    --sidebar-accent-foreground: 240 5.9% 10%;
+    --sidebar-border: 220 13% 91%;
+    --sidebar-ring: 217.2 91.2% 59.8%;
+
+    /* Status card colors with 100% saturation for light mode */
+    --status-card-up: 142 76% 45%;
+    --status-card-down: 0 84% 60%;
+    --status-card-paused: 214 100% 52%;
+    --status-card-warning: 38 92% 50%;
+  }
+
+  .dark {
+    --background: 0 0% 7%; /* Updated to #121212 */
+    --foreground: 210 40% 98%;
+
+    --card: 0 0% 7%; /* Updated to match background */
+    --card-foreground: 210 40% 98%;
+
+    --popover: 0 0% 7%; /* Updated to match background */
+    --popover-foreground: 210 40% 98%;
+
+    --primary: 210 40% 98%;
+    --primary-foreground: 222.2 47.4% 11.2%;
+
+    --secondary: 217.2 32.6% 17.5%;
+    --secondary-foreground: 210 40% 98%;
+
+    --muted: 217.2 32.6% 17.5%;
+    --muted-foreground: 215 20.2% 65.1%;
+
+    --accent: 217.2 32.6% 17.5%;
+    --accent-foreground: 210 40% 98%;
+
+    --destructive: 0 62.8% 30.6%;
+    --destructive-foreground: 210 40% 98%;
+
+    --border: 217.2 32.6% 17.5%;
+    --input: 217.2 32.6% 17.5%;
+    --ring: 212.7 26.8% 83.9%;
+    
+    --sidebar-background: 0 0% 7%; /* Updated to match background */
+    --sidebar-foreground: 240 4.8% 95.9%;
+    --sidebar-primary: 224.3 76.3% 48%;
+    --sidebar-primary-foreground: 0 0% 100%;
+    --sidebar-accent: 0 0% 10%; /* Updated to be slightly lighter than background */
+    --sidebar-accent-foreground: 240 4.8% 95.9%;
+    --sidebar-border: 0 0% 12%; /* Updated to be slightly lighter than background */
+    --sidebar-ring: 217.2 91.2% 59.8%;
+  }
+}
+
+@layer base {
+  * {
+    @apply border-border;
+  }
+
+  body {
+    @apply bg-background text-foreground transition-colors duration-300 font-inter;
+  }
+  
+  /* Add smooth transitions for theme changes */
+  .transition-theme {
+    @apply transition-all duration-300 ease-in-out;
+  }
+  
+  /* Selection styles for both themes */
+  ::selection {
+    @apply bg-primary/20 text-foreground;
+  }
+}
+
+/* Custom scrollbar for both light and dark modes */
+@layer utilities {
+  .scrollbar::-webkit-scrollbar {
+    width: 10px;
+    height: 10px;
+  }
+
+  .scrollbar::-webkit-scrollbar-track {
+    @apply bg-muted;
+  }
+
+  .scrollbar::-webkit-scrollbar-thumb {
+    @apply bg-muted-foreground/40 hover:bg-muted-foreground/60 rounded;
+  }
+
+  .scrollbar {
+    scrollbar-width: thin;
+    scrollbar-color: var(--muted-foreground) var(--muted);
+  }
+  
+  /* Sidebar collapse functionality */
+  .sidebar-collapsed .sidebar {
+    width: 4rem;
+  }
+  
+  .sidebar {
+    transition: width 0.3s ease-in-out;
+  }
+  
+  /* Card styles with 100% color saturation for light mode */
+  .status-card-up {
+    @apply bg-green-500 border-green-600 text-white;
+  }
+  
+  .status-card-down {
+    @apply bg-red-500 border-red-600 text-white;
+  }
+  
+  .status-card-paused {
+    @apply bg-blue-500 border-blue-600 text-white;
+  }
+  
+  .status-card-warning {
+    @apply bg-yellow-500 border-yellow-600 text-white;
+  }
+}
diff --git a/application/src/lib/utils.ts b/application/src/lib/utils.ts
new file mode 100644
index 0000000..bd0c391
--- /dev/null
+++ b/application/src/lib/utils.ts
@@ -0,0 +1,6 @@
+import { clsx, type ClassValue } from "clsx"
+import { twMerge } from "tailwind-merge"
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs))
+}
diff --git a/application/src/main.tsx b/application/src/main.tsx
new file mode 100644
index 0000000..51f04b5
--- /dev/null
+++ b/application/src/main.tsx
@@ -0,0 +1,5 @@
+import { createRoot } from 'react-dom/client'
+import App from './App.tsx'
+import './index.css'
+
+createRoot(document.getElementById("root")!).render(<App />);
\ No newline at end of file
diff --git a/application/src/pages/ContainerMonitoring.tsx b/application/src/pages/ContainerMonitoring.tsx
new file mode 100644
index 0000000..bfe3e8e
--- /dev/null
+++ b/application/src/pages/ContainerMonitoring.tsx
@@ -0,0 +1,172 @@
+
+import { useState, useEffect } from "react";
+import { useParams, useNavigate } from "react-router-dom";
+import { useQuery } from "@tanstack/react-query";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { useSidebar } from "@/contexts/SidebarContext";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { Header } from "@/components/dashboard/Header";
+import { DockerStatsCards } from "@/components/docker/DockerStatsCards";
+import { DockerContainersTable } from "@/components/docker/DockerContainersTable";
+import { dockerService } from "@/services/dockerService";
+import { DockerContainer, DockerStats } from "@/types/docker.types";
+import { authService } from "@/services/authService";
+import { Button } from "@/components/ui/button";
+import { ArrowLeft } from "lucide-react";
+
+const ContainerMonitoring = () => {
+  const { serverId } = useParams();
+  const navigate = useNavigate();
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+  const { sidebarCollapsed, toggleSidebar } = useSidebar();
+  const [stats, setStats] = useState<DockerStats>({
+    total: 0,
+    running: 0,
+    stopped: 0,
+    warning: 0
+  });
+  const [currentUser, setCurrentUser] = useState(authService.getCurrentUser());
+
+ // console.log('ContainerMonitoring component loaded with serverId:', serverId);
+
+  const {
+    data: containers = [],
+    isLoading,
+    error,
+    refetch
+  } = useQuery({
+    queryKey: ['docker-containers', serverId],
+    queryFn: () => {
+   //   console.log('Query function called with serverId:', serverId);
+      return serverId ? dockerService.getContainersByServerId(serverId) : dockerService.getContainers();
+    },
+    refetchInterval: 30000 // Refetch every 30 seconds
+  });
+
+ // console.log('Query state:', { containers, isLoading, error });
+
+  useEffect(() => {
+  //  console.log('Containers changed:', containers);
+    if (containers.length > 0) {
+      dockerService.getContainerStats(containers).then(newStats => {
+      //  console.log('Stats calculated:', newStats);
+        setStats(newStats);
+      });
+    }
+  }, [containers]);
+
+  const handleRefresh = () => {
+  //  console.log('Manual refresh triggered');
+    refetch();
+  };
+
+  const handleLogout = () => {
+    authService.logout();
+    navigate('/login');
+  };
+
+  const handleBackToServers = () => {
+    navigate('/instance-monitoring');
+  };
+
+  if (error) {
+  //  console.error('Container monitoring error:', error);
+    return (
+      <div className="flex h-screen overflow-hidden bg-background text-foreground">
+        <Sidebar collapsed={sidebarCollapsed} />
+        <div className="flex flex-col flex-1">
+          <Header 
+            currentUser={currentUser} 
+            onLogout={handleLogout} 
+            sidebarCollapsed={sidebarCollapsed} 
+            toggleSidebar={toggleSidebar} 
+          />
+          <main className="flex-1 flex flex-col items-center justify-center p-4 sm:p-6">
+            <div className="text-center max-w-md w-full">
+              <h2 className="text-xl sm:text-2xl font-bold mb-4">{t('errorLoadingContainers')}</h2>
+              <p className="text-muted-foreground mb-4 text-sm sm:text-base">
+                {t('unableToFetchContainerData')}
+              </p>
+              <div className="text-xs text-muted-foreground mb-4 font-mono">
+                {t('errorUnknown')}: {error?.message || t('errorUnknown')}
+              </div>
+              <div className="flex gap-2 justify-center">
+                <Button onClick={handleRefresh} className="text-sm sm:text-base">
+                  {t('retry')}
+                </Button>
+                <Button onClick={handleBackToServers} variant="outline" className="text-sm sm:text-base">
+                  {t('backToServers')}
+                </Button>
+              </div>
+            </div>
+          </main>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex h-screen overflow-hidden bg-background text-foreground">
+      <Sidebar collapsed={sidebarCollapsed} />
+      <div className="flex flex-col flex-1">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+          sidebarCollapsed={sidebarCollapsed} 
+          toggleSidebar={toggleSidebar} 
+        />
+        <main className="flex-1 overflow-auto">
+          <div className="mx-[20px] my-[20px]">
+            {/* Header Section */}
+            <div className="mb-6 lg:mb-8">
+              <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4">
+                <div className="min-w-0 flex-1">
+                  <div className="flex items-center gap-3 mb-2">
+                    <Button
+                      onClick={handleBackToServers}
+                      variant="outline"
+                      size="sm"
+                      className="flex items-center gap-2"
+                    >
+                      <ArrowLeft className="h-4 w-4" />
+                      {t('backToServers')}
+                    </Button>
+                  </div>
+                  <h1 className="text-2xl font-bold text-foreground">
+                    {t('containerMonitoring')}
+                  </h1>
+                  <p className={`text-muted-foreground mt-1 sm:mt-2 transition-all duration-300 ${sidebarCollapsed ? 'text-base sm:text-lg' : 'text-sm sm:text-base'}`}>
+                    {t('monitorAndManageContainers')}
+                    {serverId && (
+                      <span className="block text-xs text-muted-foreground/70 mt-1">
+                        {t('serverIdLabel')}: {serverId}
+                      </span>
+                    )}
+                  </p>
+                </div>
+              </div>
+            </div>
+
+            {/* Stats Cards Section */}
+            <div className="mb-6 lg:mb-8">
+              <DockerStatsCards stats={stats} />
+            </div>
+            
+            {/* Containers Table Section */}
+            <div className="min-w-0">
+              <DockerContainersTable 
+                containers={containers} 
+                isLoading={isLoading} 
+                onRefresh={handleRefresh} 
+              />
+            </div>
+          </div>
+        </main>
+      </div>
+    </div>
+  );
+};
+
+export default ContainerMonitoring;
\ No newline at end of file
diff --git a/application/src/pages/Dashboard.tsx b/application/src/pages/Dashboard.tsx
new file mode 100644
index 0000000..65ab85f
--- /dev/null
+++ b/application/src/pages/Dashboard.tsx
@@ -0,0 +1,57 @@
+import React, { useEffect } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { Header } from "@/components/dashboard/Header";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { DashboardContent } from "@/components/dashboard/DashboardContent";
+import { serviceService } from "@/services/serviceService";
+import { authService } from "@/services/authService";
+import { useNavigate } from "react-router-dom";
+import { LoadingState } from "@/components/services/LoadingState";
+import { useSidebar } from "@/contexts/SidebarContext";
+
+const Dashboard = () => {
+  const currentUser = authService.getCurrentUser();
+  const navigate = useNavigate();
+  
+  const handleLogout = () => {
+    authService.logout();
+    navigate("/login");
+  };
+
+  const { data: services = [], isLoading, error } = useQuery({
+    queryKey: ['services'],
+    queryFn: serviceService.getServices,
+    refetchInterval: 60000,
+  });
+
+  useEffect(() => {
+    const startActiveServices = async () => {
+      await serviceService.startAllActiveServices();
+    };
+    const timeoutId = setTimeout(startActiveServices, 2000);
+    return () => clearTimeout(timeoutId);
+  }, []);
+
+  if (isLoading) {
+    return <LoadingState />;
+  }
+
+  return (
+    <div className="flex h-screen overflow-hidden bg-background text-foreground">
+      <Sidebar />
+      <div className="flex flex-col flex-1 min-w-0">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+        />
+        <DashboardContent 
+          services={services}
+          isLoading={isLoading}
+          error={error as Error}
+        />
+      </div>
+    </div>
+  );
+};
+
+export default Dashboard;
\ No newline at end of file
diff --git a/application/src/pages/Index.tsx b/application/src/pages/Index.tsx
new file mode 100644
index 0000000..0f01835
--- /dev/null
+++ b/application/src/pages/Index.tsx
@@ -0,0 +1,29 @@
+
+import React, { useEffect } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { authService } from '@/services/authService';
+
+const Index = () => {
+  const navigate = useNavigate();
+
+  useEffect(() => {
+    // Check if user is authenticated and redirect accordingly
+    if (authService.isAuthenticated()) {
+      navigate('/dashboard', { replace: true });
+    } else {
+      navigate('/login', { replace: true });
+    }
+  }, [navigate]);
+
+  // Show a loading state while redirecting
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-background">
+      <div className="text-center">
+        <div className="animate-spin rounded-full h-12 w-12 border-b-2 border-primary mx-auto mb-4"></div>
+        <p className="text-muted-foreground">Loading...</p>
+      </div>
+    </div>
+  );
+};
+
+export default Index;
\ No newline at end of file
diff --git a/application/src/pages/InstanceMonitoring.tsx b/application/src/pages/InstanceMonitoring.tsx
new file mode 100644
index 0000000..00b45d5
--- /dev/null
+++ b/application/src/pages/InstanceMonitoring.tsx
@@ -0,0 +1,88 @@
+import { useState, useEffect } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { Header } from "@/components/dashboard/Header";
+import { ServerStatsCards } from "@/components/servers/ServerStatsCards";
+import { ServerTable } from "@/components/servers/ServerTable";
+import { AddServerAgentDialog } from "@/components/servers/AddServerAgentDialog";
+import { serverService } from "@/services/serverService";
+import { Server, ServerStats } from "@/types/server.types";
+import { authService } from "@/services/authService";
+import { useNavigate } from "react-router-dom";
+import { Button } from "@/components/ui/button";
+import { Plus } from "lucide-react";
+
+const InstanceMonitoring = () => {
+  const { t } = useLanguage();
+  const navigate = useNavigate();
+  
+  const [stats, setStats] = useState<ServerStats>({
+    total: 0,
+    online: 0,
+    offline: 0,
+    warning: 0
+  });
+  
+  const [currentUser] = useState(authService.getCurrentUser());
+  const [addDialogOpen, setAddDialogOpen] = useState(false);
+  
+  const { data: servers = [], isLoading, error, refetch } = useQuery<Server[]>({
+    queryKey: ['servers'],
+    queryFn: serverService.getServers,
+    refetchInterval: 30000
+  });
+  
+  useEffect(() => {
+    if (servers.length > 0) {
+      serverService.getServerStats(servers).then(setStats);
+    }
+  }, [servers]);
+  
+  const handleLogout = () => {
+    authService.logout();
+    navigate('/login');
+  };
+
+  return (
+    <div className="flex h-screen overflow-hidden bg-background text-foreground">
+      <Sidebar />
+      <div className="flex flex-col flex-1 min-w-0">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+        />
+        <main className="flex-1 overflow-auto">
+          <div className="p-4 lg:p-8 space-y-6">
+            <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4">
+              <div className="min-w-0 flex-1">
+                <h1 className="text-2xl font-bold text-foreground">
+                  {t('instanceMonitoring')}
+                </h1>
+                <p className="text-muted-foreground mt-1 text-sm">
+                  {t('describeMonitorInstance')}
+                </p>
+              </div>
+              <Button onClick={() => setAddDialogOpen(true)} className="flex-shrink-0">
+                <Plus className="mr-2 h-4 w-4" />
+                {t('addServerAgent')}
+              </Button>
+            </div>
+
+            <ServerStatsCards stats={stats} />
+            <ServerTable servers={servers} isLoading={isLoading} onRefresh={refetch} />
+          </div>
+        </main>
+      </div>
+
+      <AddServerAgentDialog
+        open={addDialogOpen}
+        onOpenChange={setAddDialogOpen}
+        onAgentAdded={refetch}
+      />
+    </div>
+  );
+};
+
+export default InstanceMonitoring;
\ No newline at end of file
diff --git a/application/src/pages/Login.tsx b/application/src/pages/Login.tsx
new file mode 100644
index 0000000..c6885a8
--- /dev/null
+++ b/application/src/pages/Login.tsx
@@ -0,0 +1,222 @@
+
+import { useState, useCallback } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { authService } from '@/services/authService';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { toast } from '@/components/ui/use-toast';
+import { Alert, AlertDescription } from '@/components/ui/alert';
+import { Eye, EyeOff, Mail, LogIn, AlertCircle, Github } from "lucide-react";
+import { useLanguage } from '@/contexts/LanguageContext';
+import { useTheme } from '@/contexts/ThemeContext';
+import { ForgotPasswordDialog } from '@/components/auth/ForgotPasswordDialog';
+
+const Login = () => {
+  const [email, setEmail] = useState('');
+  const [password, setPassword] = useState('');
+  const [loading, setLoading] = useState(false);
+  const [showPassword, setShowPassword] = useState(false);
+  const [showForgotPassword, setShowForgotPassword] = useState(false);
+  const [loginError, setLoginError] = useState('');
+  const navigate = useNavigate();
+  const { t } = useLanguage();
+  const { theme } = useTheme();
+
+  const handleSubmit = useCallback(async (e: React.FormEvent) => {
+    e.preventDefault();
+    setLoading(true);
+    setLoginError(''); // Clear previous errors
+
+    try {
+      await authService.login({ email, password });
+      toast({
+        title: t("loginSuccessful"),
+        description: t("loginSuccessMessage"),
+      });
+      navigate('/dashboard');
+    } catch (error) {
+      console.error("Login error details:", error);
+      
+      // Set specific error message based on the error
+      if (error instanceof Error) {
+        if (error.message.includes('Failed to authenticate') || 
+            error.message.includes('Authentication failed') ||
+            error.message.includes('Invalid credentials') ||
+            error.message.includes('invalid email or password')) {
+          setLoginError(t("invalidCredentials"));
+        } else {
+          setLoginError(error.message);
+        }
+      } else {
+        setLoginError(t("authenticationFailed"));
+      }
+      
+      toast({
+        variant: "destructive",
+        title: t("loginFailed"),
+        description: error instanceof Error 
+          ? (error.message.includes('Failed to authenticate') || 
+             error.message.includes('Authentication failed') ||
+             error.message.includes('Invalid credentials') ||
+             error.message.includes('invalid email or password')) 
+            ? t("invalidCredentials")
+            : error.message
+          : t("authenticationFailed"),
+      });
+    } finally {
+      setLoading(false);
+    }
+  }, [email, password, navigate, t]);
+
+  const togglePasswordVisibility = useCallback(() => {
+    setShowPassword(prev => !prev);
+  }, []);
+
+  const handleEmailChange = useCallback((e: React.ChangeEvent<HTMLInputElement>) => {
+    setEmail(e.target.value);
+    setLoginError(''); // Clear error when user starts typing
+  }, []);
+
+  const handlePasswordChange = useCallback((e: React.ChangeEvent<HTMLInputElement>) => {
+    setPassword(e.target.value);
+    setLoginError(''); // Clear error when user starts typing
+  }, []);
+
+  const openExternalLink = useCallback((url: string) => {
+    window.open(url, '_blank');
+  }, []);
+
+  return (
+    <div className="flex flex-col items-center justify-center min-h-screen bg-background p-4">
+      <div className="w-full max-w-md p-4 sm:p-8 space-y-6 rounded-xl bg-card shadow-xl border border-border/20">
+        <div className="text-center">
+          {/* Logo */}
+          <div className="mb-4">
+            <img 
+              src="/checkcle_logo.svg" 
+              alt="CheckCle Logo" 
+              className="mx-auto h-16 w-auto"
+            />
+          </div>
+          
+          <h1 className="text-xl sm:text-2xl font-bold tracking-tight text-foreground">{t("signInToYourAccount")}</h1>
+        </div>
+
+        <form onSubmit={handleSubmit} className="space-y-4 sm:space-y-6">
+          {/* Error Alert */}
+          {loginError && (
+            <Alert variant="destructive" className="mb-4">
+              <AlertCircle className="h-4 w-4" />
+              <AlertDescription>{loginError}</AlertDescription>
+            </Alert>
+          )}
+
+          <div className="space-y-1 sm:space-y-2">
+            <label className="text-xs sm:text-sm font-medium text-foreground" htmlFor="email">{t("email")}</label>
+            <div className="relative">
+              <div className="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
+                <Mail className="h-4 w-4 text-muted-foreground" />
+              </div>
+              <Input
+                id="email"
+                placeholder="your.email@provider.com"
+                type="email"
+                value={email}
+                onChange={handleEmailChange}
+                required
+                className="pl-10 text-sm sm:text-base h-9 sm:h-10"
+              />
+            </div>
+          </div>
+          
+          <div className="space-y-1 sm:space-y-2">
+            <div className="flex items-center justify-between">
+              <label className="text-xs sm:text-sm font-medium text-foreground" htmlFor="password">{t("password")}</label>
+              <button 
+                type="button"
+                onClick={() => setShowForgotPassword(true)}
+                className="text-xs sm:text-sm text-emerald-500 hover:text-emerald-400"
+              >
+                {t("forgot")}
+              </button>
+            </div>
+            <div className="relative">
+              <div className="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
+                <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="text-muted-foreground">
+                  <rect x="3" y="11" width="18" height="11" rx="2" ry="2"></rect>
+                  <path d="M7 11V7a5 5 0 0 1 10 0v4"></path>
+                </svg>
+              </div>
+              <Input
+                id="password"
+                placeholder="••••••••••••"
+                type={showPassword ? 'text' : 'password'}
+                value={password}
+                onChange={handlePasswordChange}
+                required
+                className="pl-10 text-sm sm:text-base h-9 sm:h-10"
+              />
+              <button
+                type="button"
+                className="absolute inset-y-0 right-0 flex items-center pr-3"
+                onClick={togglePasswordVisibility}
+                aria-label={showPassword ? "Hide password" : "Show password"}
+              >
+                {showPassword ? (
+                  <EyeOff className="h-4 w-4 text-muted-foreground" />
+                ) : (
+                  <Eye className="h-4 w-4 text-muted-foreground" />
+                )}
+              </button>
+            </div>
+          </div>
+
+          <Button 
+            type="submit" 
+            className="w-full py-2 sm:py-6 bg-emerald-500 hover:bg-emerald-600 text-white font-medium text-sm sm:text-base"
+            disabled={loading}
+          >
+            {loading ? t("signingIn") : t("signIn")}
+            {!loading && <LogIn className="ml-2 h-4 w-4" />}
+          </Button>
+        </form>
+      </div>
+
+      {/* Footer with Social Media Icons */}
+      <div className="mt-8 flex items-center justify-center space-x-6">
+        <button
+          onClick={() => openExternalLink('https://github.com/operacle/checkcle')}
+          className="text-muted-foreground hover:text-foreground transition-colors"
+          aria-label="GitHub"
+        >
+          <Github className="h-5 w-5" />
+        </button>
+        <button
+          onClick={() => openExternalLink('https://x.com/checkcle_oss')}
+          className="text-muted-foreground hover:text-foreground transition-colors"
+          aria-label="X (Twitter)"
+        >
+          <svg className="h-5 w-5" viewBox="0 0 24 24" fill="currentColor">
+            <path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"/>
+          </svg>
+        </button>
+        <button
+          onClick={() => openExternalLink('https://discord.gg/xs9gbubGwX')}
+          className="text-muted-foreground hover:text-foreground transition-colors"
+          aria-label="Discord"
+        >
+          <svg className="h-5 w-5" viewBox="0 0 24 24" fill="currentColor">
+            <path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515a.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0a12.64 12.64 0 0 0-.617-1.25a.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057a19.9 19.9 0 0 0 5.993 3.03a.078.078 0 0 0 .084-.028a14.09 14.09 0 0 0 1.226-1.994a.076.076 0 0 0-.041-.106a13.107 13.107 0 0 1-1.872-.892a.077.077 0 0 1-.008-.128a10.2 10.2 0 0 0 .372-.292a.074.074 0 0 1 .077-.010c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127a12.299 12.299 0 0 1-1.873.892a.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028a19.839 19.839 0 0 0 6.002-3.03a.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419c0-1.333.956-2.419 2.157-2.419c1.21 0 2.176 1.096 2.157 2.42c0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419c0-1.333.955-2.419 2.157-2.419c1.21 0 2.176 1.096 2.157 2.42c0 1.333-.946 2.418-2.157 2.418z"/>
+          </svg>
+        </button>
+      </div>
+
+      <ForgotPasswordDialog 
+        open={showForgotPassword} 
+        onOpenChange={setShowForgotPassword} 
+      />
+    </div>
+  );
+};
+
+export default Login;
\ No newline at end of file
diff --git a/application/src/pages/NotFound.tsx b/application/src/pages/NotFound.tsx
new file mode 100644
index 0000000..cda36da
--- /dev/null
+++ b/application/src/pages/NotFound.tsx
@@ -0,0 +1,27 @@
+import { useLocation } from "react-router-dom";
+import { useEffect } from "react";
+
+const NotFound = () => {
+  const location = useLocation();
+
+  useEffect(() => {
+    console.error(
+      "404 Error: User attempted to access non-existent route:",
+      location.pathname
+    );
+  }, [location.pathname]);
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-100">
+      <div className="text-center">
+        <h1 className="text-4xl font-bold mb-4">404</h1>
+        <p className="text-xl text-gray-600 mb-4">Oops! Page not found</p>
+        <a href="/" className="text-blue-500 hover:text-blue-700 underline">
+          Return to Home
+        </a>
+      </div>
+    </div>
+  );
+};
+
+export default NotFound;
diff --git a/application/src/pages/OperationalPage.tsx b/application/src/pages/OperationalPage.tsx
new file mode 100644
index 0000000..ccfd3ed
--- /dev/null
+++ b/application/src/pages/OperationalPage.tsx
@@ -0,0 +1,42 @@
+
+import React from "react";
+import { Header } from "@/components/dashboard/Header";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { OperationalPageContent } from '@/components/operational-page/OperationalPageContent';
+import { authService } from "@/services/authService";
+import { useNavigate } from "react-router-dom";
+import { useSidebar } from "@/contexts/SidebarContext";
+
+const OperationalPage = () => {
+  // Use shared sidebar state
+  const { sidebarCollapsed, toggleSidebar } = useSidebar();
+
+  // Get current user
+  const currentUser = authService.getCurrentUser();
+  const navigate = useNavigate();
+  
+  // Handle logout
+  const handleLogout = () => {
+    authService.logout();
+    navigate("/login");
+  };
+
+  return (
+    <div className="flex h-screen overflow-hidden bg-background text-foreground">
+      <Sidebar collapsed={sidebarCollapsed} />
+      <div className="flex flex-col flex-1">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+          sidebarCollapsed={sidebarCollapsed} 
+          toggleSidebar={toggleSidebar} 
+        />
+        <div className="flex-1 overflow-auto">
+          <OperationalPageContent />
+        </div>
+      </div>
+    </div>
+  );
+};
+
+export default OperationalPage;
\ No newline at end of file
diff --git a/application/src/pages/Profile.tsx b/application/src/pages/Profile.tsx
new file mode 100644
index 0000000..021002a
--- /dev/null
+++ b/application/src/pages/Profile.tsx
@@ -0,0 +1,142 @@
+
+import React, { useState, useEffect, useCallback } from "react";
+import { Header } from "@/components/dashboard/Header";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { authService } from "@/services/authService";
+import { userService } from "@/services/userService";
+import { useNavigate } from "react-router-dom";
+import { ProfileContent } from "@/components/profile/ProfileContent";
+import { User } from "@/services/userService";
+import { useToast } from "@/hooks/use-toast";
+import { Loader2 } from "lucide-react";
+import { useSidebar } from "@/contexts/SidebarContext";
+import {useLanguage} from "@/contexts/LanguageContext.tsx";
+
+const Profile = () => {
+	const { t } = useLanguage()
+
+  // Use shared sidebar state
+  const { sidebarCollapsed, toggleSidebar } = useSidebar();
+
+  // Get current user
+  const currentUser = authService.getCurrentUser();
+  const [userData, setUserData] = useState<User | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const navigate = useNavigate();
+  const { toast } = useToast();
+  
+  // Fetch complete user data
+  const fetchUserData = useCallback(async () => {
+    if (!currentUser?.id) {
+      console.error("No current user ID found");
+      setLoading(false);
+      setError("No user found. Please login again.");
+      return;
+    }
+    
+    try {
+      console.log("Fetching user data for ID:", currentUser.id);
+      const data = await userService.getUser(currentUser.id);
+      console.log("Received user data:", data);
+      
+      if (data) {
+        setUserData(data);
+        setError(null);
+      } else {
+        console.error("No user data returned");
+        setError("Could not load user data");
+        toast({
+          title: "Error",
+          description: "Could not load user data. Please try again later.",
+          variant: "destructive",
+        });
+      }
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error";
+      console.error("Failed to load user data:", error);
+      setError(errorMessage);
+      toast({
+        title: "Error",
+        description: "Failed to load user profile. Please try again later.",
+        variant: "destructive",
+      });
+    } finally {
+      setLoading(false);
+    }
+  }, [currentUser?.id, toast]);
+  
+  useEffect(() => {
+    fetchUserData();
+  }, [fetchUserData]);
+  
+  // Handle logout
+  const handleLogout = () => {
+    authService.logout();
+    navigate("/login");
+  };
+
+  // Redirect if not authenticated
+  useEffect(() => {
+    if (!authService.isAuthenticated()) {
+      navigate("/login");
+    }
+  }, [navigate]);
+
+  if (!currentUser) {
+    return (
+      <div className="flex items-center justify-center h-screen">
+        <div className="text-center">
+          <p>{t("loginToViewProfile")}</p>
+          <button 
+            onClick={() => navigate("/login")} 
+            className="mt-4 px-4 py-2 bg-primary text-white rounded"
+          >
+	          {t("goToLogin")}
+          </button>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex h-screen bg-background text-foreground">
+      <Sidebar collapsed={sidebarCollapsed} />
+      <div className="flex flex-col flex-1 overflow-hidden">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+          sidebarCollapsed={sidebarCollapsed} 
+          toggleSidebar={toggleSidebar} 
+        />
+        <div className="flex-1 overflow-auto p-6">
+          {loading ? (
+            <div className="flex items-center justify-center h-full">
+              <Loader2 className="h-12 w-12 animate-spin text-primary" />
+              <span className="ml-2">{t("loadingUserData")}</span>
+            </div>
+          ) : error ? (
+            <div className="flex flex-col items-center justify-center h-full">
+              <div className="bg-destructive/10 text-destructive p-4 rounded-md mb-4">
+                <p>{error}</p>
+              </div>
+              <button 
+                onClick={() => fetchUserData()}
+                className="px-4 py-2 bg-primary text-primary-foreground rounded-md"
+              >
+	              {t("retry")}
+              </button>
+            </div>
+          ) : (
+            <ProfileContent 
+              currentUser={userData} 
+              onUserUpdated={fetchUserData}
+            />
+          )}
+        </div>
+      </div>
+    </div>
+  );
+};
+
+export default Profile;
diff --git a/application/src/pages/PublicStatusPage.tsx b/application/src/pages/PublicStatusPage.tsx
new file mode 100644
index 0000000..ab09109
--- /dev/null
+++ b/application/src/pages/PublicStatusPage.tsx
@@ -0,0 +1,9 @@
+
+import React from 'react';
+import { PublicStatusPage as PublicStatusPageContent } from '@/components/public/PublicStatusPage';
+
+const PublicStatusPage = () => {
+  return <PublicStatusPageContent />;
+};
+
+export default PublicStatusPage;
\ No newline at end of file
diff --git a/application/src/pages/RegionalMonitoring.tsx b/application/src/pages/RegionalMonitoring.tsx
new file mode 100644
index 0000000..31aff86
--- /dev/null
+++ b/application/src/pages/RegionalMonitoring.tsx
@@ -0,0 +1,38 @@
+
+import React, { useState } from "react";
+import { Header } from "@/components/dashboard/Header";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { authService } from "@/services/authService";
+import { useNavigate } from "react-router-dom";
+import { useSidebar } from "@/contexts/SidebarContext";
+import { RegionalMonitoringContent } from "@/components/regional-monitoring/RegionalMonitoringContent";
+
+const RegionalMonitoring = () => {
+  const { sidebarCollapsed, toggleSidebar } = useSidebar();
+  const currentUser = authService.getCurrentUser();
+  const navigate = useNavigate();
+
+  const handleLogout = () => {
+    authService.logout();
+    navigate("/login");
+  };
+
+  return (
+    <div className="flex h-screen bg-background text-foreground">
+      <Sidebar collapsed={sidebarCollapsed} />
+      <div className="flex flex-col flex-1 overflow-hidden">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+          sidebarCollapsed={sidebarCollapsed} 
+          toggleSidebar={toggleSidebar} 
+        />
+        <div className="flex-1 overflow-auto">
+          <RegionalMonitoringContent />
+        </div>
+      </div>
+    </div>
+  );
+};
+
+export default RegionalMonitoring;
\ No newline at end of file
diff --git a/application/src/pages/ScheduleIncident.tsx b/application/src/pages/ScheduleIncident.tsx
new file mode 100644
index 0000000..c58cb62
--- /dev/null
+++ b/application/src/pages/ScheduleIncident.tsx
@@ -0,0 +1,57 @@
+
+import React, { useEffect } from 'react';
+import { Header } from "@/components/dashboard/Header";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { ScheduleIncidentContent } from "@/components/schedule-incident/ScheduleIncidentContent";
+import { authService } from "@/services/authService";
+import { useNavigate } from "react-router-dom";
+import { initMaintenanceNotifications, stopMaintenanceNotifications } from "@/services/maintenance/maintenanceNotificationService";
+import { useSidebar } from "@/contexts/SidebarContext";
+
+const ScheduleIncident = () => {
+  // Use shared sidebar state
+  const { sidebarCollapsed, toggleSidebar } = useSidebar();
+  
+  // Get current theme and language
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+  
+  // Get current user
+  const currentUser = authService.getCurrentUser();
+  const navigate = useNavigate();
+  
+  // Initialize maintenance notifications
+  useEffect(() => {
+    initMaintenanceNotifications();
+    
+    // Clean up on unmount
+    return () => {
+      stopMaintenanceNotifications();
+    };
+  }, []);
+  
+  // Handle logout
+  const handleLogout = () => {
+    authService.logout();
+    navigate("/login");
+  };
+
+  return (
+    <div className="flex h-screen overflow-hidden bg-background text-foreground">
+      <Sidebar collapsed={sidebarCollapsed} />
+      <div className="flex flex-col flex-1">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+          sidebarCollapsed={sidebarCollapsed} 
+          toggleSidebar={toggleSidebar} 
+        />
+        <ScheduleIncidentContent />
+      </div>
+    </div>
+  );
+};
+
+export default ScheduleIncident;
\ No newline at end of file
diff --git a/application/src/pages/ServerDetail.tsx b/application/src/pages/ServerDetail.tsx
new file mode 100644
index 0000000..12918cf
--- /dev/null
+++ b/application/src/pages/ServerDetail.tsx
@@ -0,0 +1,247 @@
+import { useState, useEffect } from "react";
+import { useParams, useNavigate } from "react-router-dom";
+import { useQuery } from "@tanstack/react-query";
+import { useTheme } from "@/contexts/ThemeContext";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { useSidebar } from "@/contexts/SidebarContext";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { Header } from "@/components/dashboard/Header";
+import { serverService } from "@/services/serverService";
+import { authService } from "@/services/authService";
+import { Button } from "@/components/ui/button";
+import { ArrowLeft, Server } from "lucide-react";
+import { ServerMetricsOverview } from "@/components/servers/ServerMetricsOverview";
+import { ServerHistoryCharts } from "@/components/servers/ServerHistoryCharts";
+import { ServerSystemInfoCard } from "@/components/servers/ServerSystemInfoCard";
+
+const ServerDetail = () => {
+  const { serverId } = useParams();
+  const navigate = useNavigate();
+  const { theme } = useTheme();
+  const { t } = useLanguage();
+  const { sidebarCollapsed, toggleSidebar } = useSidebar();
+  const [currentUser, setCurrentUser] = useState(authService.getCurrentUser());
+
+  //console.log('ServerDetail component loaded with serverId:', serverId);
+
+  const {
+    data: server,
+    isLoading: serverLoading,
+    error: serverError
+  } = useQuery({
+    queryKey: ['server', serverId],
+    queryFn: () => serverService.getServer(serverId!),
+    enabled: !!serverId
+  });
+
+  const getOSLogo = (server: any) => {
+    if (!server) return null;
+    
+    // Parse system_info if it's a string, but handle both JSON and plain text
+    let systemInfo: any = {};
+    let systemInfoText = '';
+    
+    if (server.system_info) {
+      if (typeof server.system_info === 'string') {
+        // Try to parse as JSON first
+        try {
+          systemInfo = JSON.parse(server.system_info);
+        } catch (error) {
+          // If JSON parsing fails, treat it as plain text
+       //   console.log('system_info is plain text:', server.system_info);
+          systemInfoText = server.system_info.toLowerCase();
+        }
+      } else {
+        systemInfo = server.system_info;
+      }
+    }
+    
+    // Check system_info (both JSON and plain text), then fallback to os_type
+    const osFromJson = systemInfo.OSName || '';
+    const osFromText = systemInfoText;
+    const osFromType = server.os_type || '';
+    
+    // Combine all OS information for detection
+    const combinedOSInfo = `${osFromJson} ${osFromText} ${osFromType}`.toLowerCase();
+    
+   // console.log('OS detection info:', { osFromJson, osFromText, osFromType, combinedOSInfo });
+    
+    // Check for specific OS distributions first (most specific to least specific)
+    if (combinedOSInfo.includes('ubuntu')) {
+      return '/upload/os/ubuntu.png';
+    } else if (combinedOSInfo.includes('debian')) {
+      return '/upload/os/debian.png';
+    } else if (combinedOSInfo.includes('centos')) {
+      return '/upload/os/centos.png';
+    } else if (combinedOSInfo.includes('rhel') || combinedOSInfo.includes('red hat')) {
+      return '/upload/os/rhel.png';
+    } else if (combinedOSInfo.includes('fedora')) {
+      return '/upload/os/fedora.png';
+    } else if (combinedOSInfo.includes('suse') || combinedOSInfo.includes('opensuse')) {
+      return '/upload/os/suse.png';
+    } else if (combinedOSInfo.includes('arch')) {
+      return '/upload/os/arch.png';
+    } else if (combinedOSInfo.includes('alpine')) {
+      return '/upload/os/alpine.png';
+    } else if (combinedOSInfo.includes('windows')) {
+      return '/upload/os/windows.png';
+    } else if (combinedOSInfo.includes('macos') || combinedOSInfo.includes('darwin') || combinedOSInfo.includes('mac os')) {
+      return '/upload/os/macos.png';
+    } else if (combinedOSInfo.includes('freebsd')) {
+      return '/upload/os/freebsd.png';
+    } else if (combinedOSInfo.includes('linux') || combinedOSInfo.includes('gnu')) {
+      // Default to linux.png for any Linux-based system that doesn't match specific distributions
+      return '/upload/os/linux.png';
+    }
+    
+    // Final fallback - if we can't determine the OS, default to linux.png
+    return '/upload/os/linux.png';
+  };
+
+  const handleLogout = () => {
+    authService.logout();
+    navigate('/login');
+  };
+
+  const handleBackToServers = () => {
+    navigate('/instance-monitoring');
+  };
+
+  if (serverError) {
+    return (
+      <div className="flex h-screen overflow-hidden bg-background text-foreground">
+        <Sidebar collapsed={sidebarCollapsed} />
+        <div className="flex flex-col flex-1">
+          <Header 
+            currentUser={currentUser} 
+            onLogout={handleLogout} 
+            sidebarCollapsed={sidebarCollapsed} 
+            toggleSidebar={toggleSidebar} 
+          />
+          <main className="flex-1 flex flex-col items-center justify-center p-4 sm:p-6">
+            <div className="text-center max-w-md w-full">
+              <h2 className="text-xl sm:text-2xl font-bold mb-4">{t('errorLoadingServer')}</h2>
+              <p className="text-muted-foreground mb-4 text-sm sm:text-base">
+                {t('unableToFetchServerData')}
+              </p>
+              <div className="text-xs text-muted-foreground mb-4 font-mono">
+                Error: {serverError?.message || 'Unknown error'}
+              </div>
+              <Button onClick={handleBackToServers} variant="outline" className="text-sm sm:text-base">
+                {t('backToServers')}
+              </Button>
+            </div>
+          </main>
+        </div>
+      </div>
+    );
+  }
+
+  if (serverLoading) {
+    return (
+      <div className="flex h-screen overflow-hidden bg-background text-foreground">
+        <Sidebar collapsed={sidebarCollapsed} />
+        <div className="flex flex-col flex-1">
+          <Header 
+            currentUser={currentUser} 
+            onLogout={handleLogout} 
+            sidebarCollapsed={sidebarCollapsed} 
+            toggleSidebar={toggleSidebar} 
+          />
+          <main className="flex-1 flex flex-col items-center justify-center p-4 sm:p-6">
+            <div className="text-center">
+              <div className="animate-spin rounded-full h-8 w-8 border-b-2 border-primary mx-auto mb-4"></div>
+              <p className="text-muted-foreground">{t('loadingServerDetails')}</p>
+            </div>
+          </main>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex h-screen overflow-hidden bg-background text-foreground">
+      <Sidebar collapsed={sidebarCollapsed} />
+      <div className="flex flex-col flex-1 min-w-0">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+          sidebarCollapsed={sidebarCollapsed} 
+          toggleSidebar={toggleSidebar} 
+        />
+        <main className="flex-1 overflow-auto">
+          <div className="mx-[20px] my-[20px]">
+            {/* Header Section */}
+            <div className="mb-6 lg:mb-8">
+              <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4">
+                <div className="min-w-0 flex-1">
+                  <div className="flex items-center gap-3 mb-2">
+                    <Button
+                      onClick={handleBackToServers}
+                      variant="outline"
+                      size="sm"
+                      className="flex items-center gap-2"
+                    >
+                      <ArrowLeft className="h-4 w-4" />
+                      {t('backToServers')}
+                    </Button>
+                  </div>
+                  <div className="flex items-center gap-3 mb-2">
+                    <div className="h-12 w-12 rounded bg-primary/10 flex items-center justify-center p-2">
+                      {server && getOSLogo(server) ? (
+                        <img
+                          src={getOSLogo(server)}
+                          alt="OS Logo"
+                          className="w-full h-full object-contain"
+                        />
+                      ) : (
+                        <Server className="h-6 w-6 text-primary" />
+                      )}
+                    </div>
+                    <h1 className="text-2xl font-bold text-foreground">
+                      {server?.name || t('serverDetail')}
+                    </h1>
+                  </div>
+                  <p className="text-muted-foreground mt-1 sm:mt-2 text-sm sm:text-base">
+                    {t('monitorServerMetrics')}
+                    {server && (
+                      <span className="block text-xs text-muted-foreground/70 mt-1">
+                        {t('serverHostnameIpOs')
+                          .replace('{hostname}', server.hostname)
+                          .replace('{ip_address}', server.ip_address)
+                          .replace('{os_type}', server.os_type)}
+                      </span>
+                    )}
+                  </p>
+                </div>
+                
+                {/* System Info Card */}
+                {server && (
+                  <div className="flex-shrink-0">
+                    <ServerSystemInfoCard server={server} />
+                  </div>
+                )}
+              </div>
+            </div>
+
+            {/* Server Overview Cards */}
+            {server && (
+              <div className="mb-6 lg:mb-8">
+                <ServerMetricsOverview server={server} />
+              </div>
+            )}
+
+            {/* Historical Charts Section - Single comprehensive section */}
+            {server && (
+              <div className="min-w-0">
+                <ServerHistoryCharts serverId={server.id} />
+              </div>
+            )}
+          </div>
+        </main>
+      </div>
+    </div>
+  );
+};
+
+export default ServerDetail;
\ No newline at end of file
diff --git a/application/src/pages/ServiceDetail.tsx b/application/src/pages/ServiceDetail.tsx
new file mode 100644
index 0000000..e689d0d
--- /dev/null
+++ b/application/src/pages/ServiceDetail.tsx
@@ -0,0 +1,8 @@
+
+import { ServiceDetailContainer } from "@/components/services/ServiceDetailContainer";
+
+const ServiceDetail = () => {
+  return <ServiceDetailContainer />;
+};
+
+export default ServiceDetail;
diff --git a/application/src/pages/Settings.tsx b/application/src/pages/Settings.tsx
new file mode 100644
index 0000000..45c2018
--- /dev/null
+++ b/application/src/pages/Settings.tsx
@@ -0,0 +1,70 @@
+
+import React, { useState, useEffect } from "react";
+import { Header } from "@/components/dashboard/Header";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { authService } from "@/services/authService";
+import { useNavigate, useLocation } from "react-router-dom";
+import GeneralSettingsPanel from "@/components/settings/GeneralSettings";
+import UserManagement from "@/components/settings/user-management";
+import { NotificationSettings } from "@/components/settings/notification-settings";
+import { AlertsTemplates } from "@/components/settings/alerts-templates";
+import { AboutSystem } from "@/components/settings/about-system";
+import DataRetentionSettings from "@/components/settings/data-retention/DataRetentionSettings";
+import { useSidebar } from "@/contexts/SidebarContext";
+
+const Settings = () => {
+  // Use shared sidebar state
+  const { sidebarCollapsed, toggleSidebar } = useSidebar();
+
+  // Get current user
+  const currentUser = authService.getCurrentUser();
+  const navigate = useNavigate();
+  const location = useLocation();
+  
+  // Get the panel from URL query params
+  const queryParams = new URLSearchParams(location.search);
+  const panelParam = queryParams.get('panel');
+  
+  // State for active settings panel
+  const [activePanel, setActivePanel] = useState<string>(panelParam || "general");
+  
+  // Update active panel when URL changes
+  useEffect(() => {
+    const panel = queryParams.get('panel');
+    if (panel) {
+      setActivePanel(panel);
+    } else {
+      setActivePanel("general");
+    }
+  }, [location.search]);
+  
+  // Handle logout
+  const handleLogout = () => {
+    authService.logout();
+    navigate("/login");
+  };
+
+  return (
+    <div className="flex h-screen bg-background text-foreground">
+      <Sidebar collapsed={sidebarCollapsed} />
+      <div className="flex flex-col flex-1 overflow-hidden">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+          sidebarCollapsed={sidebarCollapsed} 
+          toggleSidebar={toggleSidebar} 
+        />
+        <div className="flex-1 overflow-auto p-6 space-y-6">
+          {activePanel === "general" && <GeneralSettingsPanel />}
+          {activePanel === "users" && <UserManagement />}
+          {activePanel === "notifications" && <NotificationSettings />}
+          {activePanel === "templates" && <AlertsTemplates />}
+          {activePanel === "data-retention" && <DataRetentionSettings />}
+          {activePanel === "about" && <AboutSystem />}
+        </div>
+      </div>
+    </div>
+  );
+};
+
+export default Settings;
\ No newline at end of file
diff --git a/application/src/pages/SslDomain.tsx b/application/src/pages/SslDomain.tsx
new file mode 100644
index 0000000..5b15bc7
--- /dev/null
+++ b/application/src/pages/SslDomain.tsx
@@ -0,0 +1,130 @@
+
+import React, { useEffect } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { authService } from "@/services/authService";
+import { useNavigate } from "react-router-dom";
+import { Header } from "@/components/dashboard/Header";
+import { Sidebar } from "@/components/dashboard/Sidebar";
+import { SSLDomainContent } from "@/components/ssl-domain/SSLDomainContent";
+import { LoadingState } from "@/components/services/LoadingState";
+import { fetchSSLCertificates, shouldRunDailyCheck, checkAllCertificatesAndNotify } from "@/services/sslCertificateService";
+import { useLanguage } from "@/contexts/LanguageContext";
+import { useSidebar } from "@/contexts/SidebarContext";
+
+const SslDomain = () => {
+  // Get language context for translations
+  const { t } = useLanguage();
+  
+  // Use shared sidebar state
+  const { sidebarCollapsed, toggleSidebar } = useSidebar();
+
+  // Get current user
+  const currentUser = authService.getCurrentUser();
+  const navigate = useNavigate();
+  
+  // Fetch SSL certificates with error handling and debugging
+  const { data: certificates = [], isLoading, error, refetch } = useQuery({
+    queryKey: ['ssl-certificates'],
+    queryFn: async () => {
+     // console.log("Fetching SSL certificates from SslDomain page...");
+      try {
+        const result = await fetchSSLCertificates();
+     //  console.log("SSL certificates fetch successful, count:", result.length);
+        return result;
+      } catch (err) {
+     //   console.error("Error fetching SSL certificates from page:", err);
+        throw err;
+      }
+    },
+    refetchOnWindowFocus: false,
+    refetchInterval: 300000, // Refresh every 5 minutes
+    retry: 3, // Retry failed requests 3 times
+  });
+  
+  // Check all SSL certificates once per day
+  useEffect(() => {
+    const checkCertificates = async () => {
+      // Check if we should run daily check
+      if (shouldRunDailyCheck()) {
+     //   console.log("Running daily SSL certificate check...");
+        await checkAllCertificatesAndNotify();
+        // Refresh certificate list after daily check
+        refetch();
+      }
+    };
+    
+    // Run check when component mounts
+    checkCertificates();
+  }, [refetch]);
+  
+  // Handle logout
+  const handleLogout = () => {
+    authService.logout();
+    navigate("/login");
+  };
+
+  // Show loading state while fetching data
+  if (isLoading) {
+    return (
+      <div className="flex h-screen overflow-hidden bg-background text-foreground">
+        <Sidebar collapsed={sidebarCollapsed} />
+        <div className="flex flex-col flex-1">
+          <Header 
+            currentUser={currentUser} 
+            onLogout={handleLogout} 
+            sidebarCollapsed={sidebarCollapsed} 
+            toggleSidebar={toggleSidebar} 
+          />
+          <LoadingState />
+        </div>
+      </div>
+    );
+  }
+
+  // Show error state
+  if (error) {
+    return (
+      <div className="flex h-screen overflow-hidden bg-background text-foreground">
+        <Sidebar collapsed={sidebarCollapsed} />
+        <div className="flex flex-col flex-1">
+          <Header 
+            currentUser={currentUser} 
+            onLogout={handleLogout} 
+            sidebarCollapsed={sidebarCollapsed} 
+            toggleSidebar={toggleSidebar} 
+          />
+          <div className="flex flex-col items-center justify-center h-full p-6">
+            <h2 className="text-xl font-bold mb-2">{t('failedToLoadCertificates')}</h2>
+            <p className="text-muted-foreground mb-4">
+              {error instanceof Error ? error.message : t('unknown')}
+            </p>
+            <button 
+              className="px-4 py-2 bg-primary text-primary-foreground rounded-md"
+              onClick={() => refetch()}
+            >
+              {t('check')}
+            </button>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
+  // Render with data
+  return (
+    <div className="flex h-screen overflow-hidden bg-background text-foreground">
+      <Sidebar collapsed={sidebarCollapsed} />
+      <div className="flex flex-col flex-1">
+        <Header 
+          currentUser={currentUser} 
+          onLogout={handleLogout} 
+          sidebarCollapsed={sidebarCollapsed} 
+          toggleSidebar={toggleSidebar} 
+        />
+        <SSLDomainContent />
+      </div>
+    </div>
+  );
+};
+
+export default SslDomain;
\ No newline at end of file
diff --git a/application/src/services/alertConfigService.ts b/application/src/services/alertConfigService.ts
new file mode 100644
index 0000000..b4d686d
--- /dev/null
+++ b/application/src/services/alertConfigService.ts
@@ -0,0 +1,185 @@
+
+import { pb } from "@/lib/pocketbase";
+import { toast } from "@/hooks/use-toast";
+
+export interface AlertConfiguration {
+  id?: string;
+  collectionId?: string;
+  collectionName?: string;
+  service_id: string;
+  notification_type: "telegram" | "discord" | "slack" | "signal" | "google_chat" | "email" | "ntfy" | "pushover" | "notifiarr" | "gotify" | "webhook" | "matrix";
+  telegram_chat_id?: string;
+  discord_webhook_url?: string;
+  signal_number?: string;
+  signal_api_endpoint?: string;
+  notify_name: string;
+  bot_token?: string;
+  template_id?: string;
+  slack_webhook_url?: string;
+  google_chat_webhook_url?: string;
+  enabled: boolean;
+  created?: string;
+  updated?: string;
+  // Email specific fields
+  email_address?: string;
+  email_sender_name?: string;
+  smtp_server?: string;
+  smtp_port?: string;
+  smtp_password?: string;
+  webhook_id?: string;
+  channel_id?: string;
+  ntfy_endpoint?: string;
+  api_token?: string;
+  user_key?: string;
+  server_url?: string;
+  webhook_url?: string;
+  webhook_payload_template?: string;
+  matrix_homeserver?: string;
+  matrix_room_id?: string;
+  matrix_access_token?: string;
+}
+
+export const alertConfigService = {
+  async getAlertConfigurations(): Promise<AlertConfiguration[]> {
+
+    try {
+      const response = await pb.collection('alert_configurations').getList(1, 50);
+      return response.items as AlertConfiguration[];
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to load notification settings",
+        variant: "destructive"
+      });
+      return [];
+    }
+  },
+
+  async createAlertConfiguration(config: Omit<AlertConfiguration, 'id' | 'collectionId' | 'collectionName' | 'created' | 'updated'>): Promise<AlertConfiguration | null> {
+    
+    try {
+      // Build the configuration object with proper field mapping
+      const cleanConfig: any = {
+        service_id: config.service_id || "global",
+        notification_type: config.notification_type,
+        notify_name: config.notify_name,
+        enabled: config.enabled,
+        template_id: config.template_id || "",
+      };
+
+      // Add type-specific fields based on notification type
+      if (config.notification_type === "telegram") {
+        cleanConfig.telegram_chat_id = config.telegram_chat_id || "";
+        cleanConfig.bot_token = config.bot_token || "";
+      } else if (config.notification_type === "discord") {
+        cleanConfig.discord_webhook_url = config.discord_webhook_url || "";
+      } else if (config.notification_type === "slack") {
+        cleanConfig.slack_webhook_url = config.slack_webhook_url || "";
+      } else if (config.notification_type === "signal") {
+        cleanConfig.signal_number = config.signal_number || "";
+        cleanConfig.signal_api_endpoint = config.signal_api_endpoint || "";
+      } else if (config.notification_type === "google_chat") {
+        cleanConfig.google_chat_webhook_url = config.google_chat_webhook_url || "";
+        
+      } else if (config.notification_type === "email") {
+       
+        cleanConfig.email_address = config.email_address || "";
+        cleanConfig.email_sender_name = config.email_sender_name || "";
+        cleanConfig.smtp_server = config.smtp_server || "";
+        cleanConfig.smtp_port = config.smtp_port || "";
+        cleanConfig.smtp_password = config.smtp_password || "";
+       
+      } else if (config.notification_type === "ntfy") { 
+        cleanConfig.ntfy_endpoint = config.ntfy_endpoint || "";
+        cleanConfig.api_token = config.api_token || "";
+
+      } else if (config.notification_type === "pushover") {       
+        cleanConfig.api_token = config.api_token || "";
+        cleanConfig.user_key = config.user_key || "";
+
+      } else if (config.notification_type === "notifiarr") {   
+        cleanConfig.api_token = config.api_token || "";
+        cleanConfig.channel_id = config.channel_id || "";
+
+      } else if (config.notification_type === "gotify") {      
+        cleanConfig.api_token = config.api_token || "";
+        cleanConfig.server_url = config.server_url || "";
+        
+      } else if (config.notification_type === "webhook") {
+        cleanConfig.webhook_url = config.webhook_url || "";
+        cleanConfig.webhook_payload_template = config.webhook_payload_template || "";
+
+      } else if (config.notification_type === "matrix") {
+        cleanConfig.matrix_homeserver = config.matrix_homeserver || "";
+        cleanConfig.matrix_room_id = config.matrix_room_id || "";
+        cleanConfig.matrix_access_token = config.matrix_access_token || "";
+
+      }
+      const result = await pb.collection('alert_configurations').create(cleanConfig);
+     
+      toast({
+        title: "Success",
+        description: "Notification channel created successfully",
+      });
+      return result as AlertConfiguration;
+    } catch (error) {
+    
+      // Try to get more details from the error
+      if (error && typeof error === 'object') {
+      }
+      
+      toast({
+        title: "Error",
+        description: "Failed to create notification channel",
+        variant: "destructive"
+      });
+      return null;
+    }
+  },
+
+  async updateAlertConfiguration(id: string, config: Partial<AlertConfiguration>): Promise<AlertConfiguration | null> {
+    try {
+      // Build the update config with proper field mapping
+      const updateConfig: any = {};
+      
+      // Copy all provided fields
+      Object.keys(config).forEach(key => {
+        if (config[key as keyof AlertConfiguration] !== undefined) {
+          updateConfig[key] = config[key as keyof AlertConfiguration];
+        }
+      });
+            
+      const result = await pb.collection('alert_configurations').update(id, updateConfig);
+      toast({
+        title: "Success",
+        description: "Notification channel updated successfully",
+      });
+      return result as AlertConfiguration;
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to update notification channel",
+        variant: "destructive"
+      });
+      return null;
+    }
+  },
+
+  async deleteAlertConfiguration(id: string): Promise<boolean> {
+    try {
+      await pb.collection('alert_configurations').delete(id);
+      toast({
+        title: "Success",
+        description: "Notification channel removed",
+      });
+      return true;
+    } catch (error) {
+      toast({
+        title: "Error",
+        description: "Failed to remove notification channel",
+        variant: "destructive"
+      });
+      return false;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/authService.ts b/application/src/services/authService.ts
new file mode 100644
index 0000000..474f9eb
--- /dev/null
+++ b/application/src/services/authService.ts
@@ -0,0 +1,106 @@
+import { pb } from '@/lib/pocketbase';
+
+export interface LoginCredentials {
+  email: string;
+  password: string;
+}
+
+export interface AuthUser {
+  id: string;
+  email: string;
+  name?: string;
+  avatar?: string;
+  role?: string;  // Added role property
+}
+
+export const authService = {
+  async login({ email, password }: LoginCredentials): Promise<AuthUser> {
+    try {
+      // First try to login as a regular admin user
+      try {
+      //  console.log("Attempting to login as admin user");
+        const authData = await pb.collection('users').authWithPassword(email, password);
+        
+        return {
+          id: authData.record.id,
+          email: authData.record.email,
+          name: authData.record.full_name || authData.record.name,
+          avatar: authData.record.avatar,
+          role: authData.record.role || "admin"
+        };
+      } catch (error) {
+      //  console.log("Failed to login as admin, trying as superadmin", error);
+        
+        // If regular user login fails, try superadmin
+        const authData = await pb.collection('_superusers').authWithPassword(email, password);
+        
+        return {
+          id: authData.record.id,
+          email: authData.record.email,
+          name: authData.record.full_name || authData.record.name,
+          avatar: authData.record.avatar,
+          role: "superadmin"
+        };
+      }
+    } catch (error) {
+     // console.error('Login failed:', error);
+      throw new Error('Authentication failed. Please check your credentials.');
+    }
+  },
+
+  logout(): void {
+    pb.authStore.clear();
+  },
+
+  getCurrentUser(): AuthUser | null {
+    if (!pb.authStore.isValid) {
+      return null;
+    }
+    
+    const userData = pb.authStore.model as any;
+    
+    if (!userData) return null;
+    
+    // Log the full user data for debugging
+    //console.log("Raw user data from authStore:", userData);
+    
+    // Determine if this is a superadmin by checking the collection name
+    const isSuperAdmin = userData.collectionName === '_superusers';
+    
+    // The avatar will be kept as is - either the full path from Pocketbase
+    // or we'll handle display in the UI components
+    return { 
+      id: userData.id, 
+      email: userData.email, 
+      name: userData.full_name || userData.name, 
+      avatar: userData.avatar,
+      role: isSuperAdmin ? "superadmin" : (userData.role || "admin")
+    };
+  },
+
+  isAuthenticated(): boolean {
+    return pb.authStore.isValid;
+  },
+  
+  // Method to refresh user data after updates
+  async refreshUserData(): Promise<void> {
+    if (!pb.authStore.isValid || !pb.authStore.model) return;
+    
+    try {
+      // Fetch the latest user data from the server
+      const userId = (pb.authStore.model as any).id;
+     // console.log("Refreshing user data for ID:", userId);
+      
+      // Use the getOne method directly to refresh the auth store
+      await pb.collection('users').getOne(userId);
+     // console.log("User data refreshed successfully");
+    } catch (error) {
+    //  console.error('Failed to refresh user data:', error);
+    }
+  },
+
+  async impersonateUser(userId: string, durationSeconds: number = 3600): Promise<string | undefined> {
+    const impersonateClient = await pb.collection("users").impersonate(userId, durationSeconds);
+    return impersonateClient.authStore?.token;
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/dataRetentionService.ts b/application/src/services/dataRetentionService.ts
new file mode 100644
index 0000000..05c7e76
--- /dev/null
+++ b/application/src/services/dataRetentionService.ts
@@ -0,0 +1,293 @@
+
+import { pb } from '@/lib/pocketbase';
+
+interface RetentionSettings {
+  uptimeRetentionDays: number;
+  serverRetentionDays: number;
+  lastCleanup?: string;
+}
+
+interface CleanupResult {
+  deletedRecords: number;
+  collections: string[];
+}
+
+export const dataRetentionService = {
+  async getRetentionSettings(): Promise<RetentionSettings | null> {
+    try {
+      // Try to get existing settings from data_settings collection
+      const records = await pb.collection('data_settings').getFullList({
+        sort: '-created'
+      });
+      
+      if (records.length > 0) {
+        const settings = records[0];
+        return {
+          uptimeRetentionDays: settings.uptime_retention_days || 30,
+          serverRetentionDays: settings.server_retention_days || 30,
+          lastCleanup: settings.last_cleanup
+        };
+      }
+      
+      // Return default settings if none exist
+      return {
+        uptimeRetentionDays: 30,
+        serverRetentionDays: 30
+      };
+    } catch (error) {
+      console.error("Error fetching retention settings:", error);
+      // Return default settings on error
+      return {
+        uptimeRetentionDays: 30,
+        serverRetentionDays: 30
+      };
+    }
+  },
+
+  async updateRetentionSettings(settings: RetentionSettings): Promise<void> {
+    try {
+      // Check if settings already exist
+      const existingRecords = await pb.collection('data_settings').getFullList({
+        sort: '-created'
+      });
+      
+      const data = {
+        uptime_retention_days: settings.uptimeRetentionDays,
+        server_retention_days: settings.serverRetentionDays,
+        retention_days: Math.max(settings.uptimeRetentionDays, settings.serverRetentionDays), // General retention days
+        backup: "auto", // Default backup setting
+        updated: new Date().toISOString()
+      };
+      
+      if (existingRecords.length > 0) {
+        // Update existing record
+        await pb.collection('data_settings').update(existingRecords[0].id, data);
+      } else {
+        // Create new record
+        await pb.collection('data_settings').create({
+          ...data,
+          created: new Date().toISOString()
+        });
+      }
+      
+      console.log("Retention settings updated successfully");
+    } catch (error) {
+      console.error("Error updating retention settings:", error);
+      throw new Error("Failed to update retention settings");
+    }
+  },
+
+  async manualUptimeCleanup(): Promise<CleanupResult> {
+    try {
+      const settings = await this.getRetentionSettings();
+      if (!settings) {
+        throw new Error("Could not load retention settings");
+      }
+
+      let totalDeleted = 0;
+      const cleanedCollections: string[] = [];
+
+      // Calculate cutoff date for uptime data
+      const uptimeCutoffDate = new Date();
+      uptimeCutoffDate.setDate(uptimeCutoffDate.getDate() - settings.uptimeRetentionDays);
+
+      console.log(`Starting uptime cleanup - Cutoff: ${uptimeCutoffDate.toISOString()}`);
+
+      // Clean uptime_data collection
+      try {
+        const uptimeRecords = await pb.collection('uptime_data').getFullList({
+          filter: `created < "${uptimeCutoffDate.toISOString()}"`
+        });
+        
+        console.log(`Found ${uptimeRecords.length} uptime records to delete`);
+        
+        for (const record of uptimeRecords) {
+          await pb.collection('uptime_data').delete(record.id);
+          totalDeleted++;
+        }
+        
+        if (uptimeRecords.length > 0) {
+          cleanedCollections.push('uptime_data');
+        }
+      } catch (error) {
+        console.error("Error cleaning uptime_data:", error);
+      }
+
+      console.log(`Uptime cleanup completed. Deleted ${totalDeleted} records`);
+
+      return {
+        deletedRecords: totalDeleted,
+        collections: cleanedCollections
+      };
+    } catch (error) {
+      console.error("Error during uptime cleanup:", error);
+      throw new Error("Failed to perform uptime data cleanup");
+    }
+  },
+
+  async manualServerCleanup(): Promise<CleanupResult> {
+    try {
+      const settings = await this.getRetentionSettings();
+      if (!settings) {
+        throw new Error("Could not load retention settings");
+      }
+
+      let totalDeleted = 0;
+      const cleanedCollections: string[] = [];
+
+      // Calculate cutoff date for server data
+      const serverCutoffDate = new Date();
+      serverCutoffDate.setDate(serverCutoffDate.getDate() - settings.serverRetentionDays);
+
+      console.log(`Starting server cleanup - Cutoff: ${serverCutoffDate.toISOString()}`);
+
+      // Clean ping_data collection
+      try {
+        const pingRecords = await pb.collection('ping_data').getFullList({
+          filter: `created < "${serverCutoffDate.toISOString()}"`
+        });
+        
+        console.log(`Found ${pingRecords.length} ping records to delete`);
+        
+        for (const record of pingRecords) {
+          await pb.collection('ping_data').delete(record.id);
+          totalDeleted++;
+        }
+        
+        if (pingRecords.length > 0) {
+          cleanedCollections.push('ping_data');
+        }
+      } catch (error) {
+        console.error("Error cleaning ping_data:", error);
+      }
+
+      console.log(`Server cleanup completed. Deleted ${totalDeleted} records`);
+
+      return {
+        deletedRecords: totalDeleted,
+        collections: cleanedCollections
+      };
+    } catch (error) {
+      console.error("Error during server cleanup:", error);
+      throw new Error("Failed to perform server data cleanup");
+    }
+  },
+
+  async manualCleanup(): Promise<CleanupResult> {
+    try {
+      // Get current retention settings
+      const settings = await this.getRetentionSettings();
+      if (!settings) {
+        throw new Error("Could not load retention settings");
+      }
+
+      let totalDeleted = 0;
+      const cleanedCollections: string[] = [];
+
+      // Calculate cutoff dates
+      const uptimeCutoffDate = new Date();
+      uptimeCutoffDate.setDate(uptimeCutoffDate.getDate() - settings.uptimeRetentionDays);
+      
+      const serverCutoffDate = new Date();
+      serverCutoffDate.setDate(serverCutoffDate.getDate() - settings.serverRetentionDays);
+
+      console.log(`Starting manual cleanup - Uptime cutoff: ${uptimeCutoffDate.toISOString()}, Server cutoff: ${serverCutoffDate.toISOString()}`);
+
+      // Clean uptime_data collection
+      try {
+        const uptimeRecords = await pb.collection('uptime_data').getFullList({
+          filter: `created < "${uptimeCutoffDate.toISOString()}"`
+        });
+        
+        console.log(`Found ${uptimeRecords.length} uptime records to delete`);
+        
+        for (const record of uptimeRecords) {
+          await pb.collection('uptime_data').delete(record.id);
+          totalDeleted++;
+        }
+        
+        if (uptimeRecords.length > 0) {
+          cleanedCollections.push('uptime_data');
+        }
+      } catch (error) {
+        console.error("Error cleaning uptime_data:", error);
+      }
+
+      // Clean ping_data collection
+      try {
+        const pingRecords = await pb.collection('ping_data').getFullList({
+          filter: `created < "${serverCutoffDate.toISOString()}"`
+        });
+        
+        console.log(`Found ${pingRecords.length} ping records to delete`);
+        
+        for (const record of pingRecords) {
+          await pb.collection('ping_data').delete(record.id);
+          totalDeleted++;
+        }
+        
+        if (pingRecords.length > 0) {
+          cleanedCollections.push('ping_data');
+        }
+      } catch (error) {
+        console.error("Error cleaning ping_data:", error);
+      }
+
+      // Update last cleanup timestamp
+      await this.updateLastCleanupTime();
+
+      console.log(`Manual cleanup completed. Deleted ${totalDeleted} records from collections: ${cleanedCollections.join(', ')}`);
+
+      return {
+        deletedRecords: totalDeleted,
+        collections: cleanedCollections
+      };
+    } catch (error) {
+      console.error("Error during manual cleanup:", error);
+      throw new Error("Failed to perform database cleanup");
+    }
+  },
+
+  async updateLastCleanupTime(): Promise<void> {
+    try {
+      const existingRecords = await pb.collection('data_settings').getFullList({
+        sort: '-created'
+      });
+      
+      const data = {
+        last_cleanup: new Date().toISOString()
+      };
+      
+      if (existingRecords.length > 0) {
+        await pb.collection('data_settings').update(existingRecords[0].id, data);
+      }
+    } catch (error) {
+      console.error("Error updating last cleanup time:", error);
+    }
+  },
+
+  async scheduleAutomaticCleanup(): Promise<void> {
+    try {
+      const settings = await this.getRetentionSettings();
+      if (!settings) return;
+
+      // Check if enough time has passed since last cleanup (run daily)
+      if (settings.lastCleanup) {
+        const lastCleanup = new Date(settings.lastCleanup);
+        const now = new Date();
+        const hoursSinceLastCleanup = (now.getTime() - lastCleanup.getTime()) / (1000 * 60 * 60);
+        
+        if (hoursSinceLastCleanup < 24) {
+          console.log("Skipping automatic cleanup - last cleanup was less than 24 hours ago");
+          return;
+        }
+      }
+
+      console.log("Starting scheduled automatic cleanup");
+      const result = await this.manualCleanup();
+      console.log(`Automatic cleanup completed. Deleted ${result.deletedRecords} records`);
+    } catch (error) {
+      console.error("Error during automatic cleanup:", error);
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/dockerService.ts b/application/src/services/dockerService.ts
new file mode 100644
index 0000000..8047240
--- /dev/null
+++ b/application/src/services/dockerService.ts
@@ -0,0 +1,154 @@
+
+import { pb } from "@/lib/pocketbase";
+import { DockerContainer, DockerMetrics, DockerStats } from "@/types/docker.types";
+
+class DockerService {
+  async getContainers(): Promise<DockerContainer[]> {
+    try {
+    //  console.log('Fetching all Docker containers...');
+      const records = await pb.collection('dockers').getFullList({
+        sort: '-created',
+      });
+   //   console.log('Docker containers fetched:', records);
+      return records as DockerContainer[];
+    } catch (error) {
+    //  console.error('Error fetching Docker containers:', error);
+      throw error;
+    }
+  }
+
+  async getContainersByServerId(serverId: string): Promise<DockerContainer[]> {
+    try {
+    //  console.log('Fetching Docker containers for server ID:', serverId);
+      
+      // First, try to get the server details to find the correct hostname
+      const server = await pb.collection('servers').getOne(serverId);
+    //  console.log('Server details:', server);
+      
+      // Try multiple filter approaches to find containers
+      const filters = [
+        `server_id = "${serverId}"`,
+        `hostname = "${server.hostname}"`,
+        `hostname ~ "${server.hostname}"`,
+        `ip_address = "${server.ip_address}"`,
+      ];
+      
+      let containers: DockerContainer[] = [];
+      
+      for (const filter of filters) {
+      //  console.log('Trying filter:', filter);
+        try {
+          const records = await pb.collection('dockers').getFullList({
+            filter: filter,
+            sort: '-created',
+          });
+        //  console.log(`Filter "${filter}" returned:`, records);
+          
+          if (records.length > 0) {
+            containers = records as DockerContainer[];
+            break;
+          }
+        } catch (filterError) {
+        //  console.warn(`Filter "${filter}" failed:`, filterError);
+          continue;
+        }
+      }
+      
+      // If no containers found with filters, get all and log for debugging
+      if (containers.length === 0) {
+      //  console.log('No containers found with filters, fetching all for debugging...');
+        const allContainers = await pb.collection('dockers').getFullList({
+          sort: '-created',
+        });
+      //  console.log('All available Docker containers:', allContainers);
+      //  console.log('Looking for containers that might match server:', {
+      ////    serverId,
+       //   serverHostname: server.hostname,
+      //    serverIp: server.ip_address
+      //  });
+      }
+      
+      return containers;
+    } catch (error) {
+    //  console.error('Error fetching Docker containers by server ID:', error);
+      throw error;
+    }
+  }
+
+  async getContainerMetrics(dockerId: string): Promise<DockerMetrics[]> {
+    try {
+    //  console.log('Fetching metrics for docker ID:', dockerId);
+      const records = await pb.collection('docker_metrics').getFullList({
+        filter: `docker_id = "${dockerId}"`,
+        sort: '-timestamp',
+        perPage: 100,
+      });
+    //  console.log('Docker metrics fetched:', records);
+      return records as DockerMetrics[];
+    } catch (error) {
+    //  console.error('Error fetching Docker metrics:', error);
+      throw error;
+    }
+  }
+
+  async getContainerStats(containers: DockerContainer[]): Promise<DockerStats> {
+    const total = containers.length;
+    
+    // Parse status field to determine if container is running
+    const running = containers.filter(c => {
+      const status = c.status?.toLowerCase() || '';
+      return status.includes('up') && !status.includes('exited');
+    }).length;
+    
+    const stopped = containers.filter(c => {
+      const status = c.status?.toLowerCase() || '';
+      return status.includes('exited') || status.includes('stopped');
+    }).length;
+    
+    const warning = containers.filter(c => {
+      const status = c.status?.toLowerCase() || '';
+      return status.includes('unhealthy') || status.includes('restarting');
+    }).length;
+
+    return {
+      total,
+      running,
+      stopped,
+      warning,
+    };
+  }
+
+  formatBytes(bytes: number): string {
+    if (bytes === 0) return '0 B';
+    const k = 1024;
+    const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+  }
+
+  formatUptime(uptime: string): string {
+    return uptime || 'N/A';
+  }
+
+  parseMetricValue(value: string): number {
+    if (!value || value === 'N/A') return 0;
+    
+    // Remove units and convert to number
+    const numericValue = parseFloat(value.toString().replace(/[^\d.]/g, ''));
+    return isNaN(numericValue) ? 0 : numericValue;
+  }
+
+  getStatusFromDockerStatus(status: string): 'running' | 'stopped' | 'warning' {
+    const statusLower = status?.toLowerCase() || '';
+    
+    if (statusLower.includes('up') && !statusLower.includes('exited')) {
+      return 'running';
+    } else if (statusLower.includes('exited') || statusLower.includes('stopped')) {
+      return 'stopped';
+    } else {
+      return 'warning';
+    }
+  }
+}
+
+export const dockerService = new DockerService();
\ No newline at end of file
diff --git a/application/src/services/incident/incidentCache.ts b/application/src/services/incident/incidentCache.ts
new file mode 100644
index 0000000..9094bf3
--- /dev/null
+++ b/application/src/services/incident/incidentCache.ts
@@ -0,0 +1,14 @@
+
+import { IncidentItem } from './types';
+
+// Export functions to update and invalidate the cache
+export const updateCache = (data: IncidentItem[]) => {
+//  console.log(`Updating cache with ${data.length} incidents`);
+  // The actual cache is now maintained in incidentFetch.ts
+};
+
+// Reset cache and request state
+export const invalidateCache = () => {
+//  console.log('Invalidating incidents cache');
+  // The invalidation is handled in incidentFetch.ts implementation
+};
diff --git a/application/src/services/incident/incidentFetch.ts b/application/src/services/incident/incidentFetch.ts
new file mode 100644
index 0000000..8db21c8
--- /dev/null
+++ b/application/src/services/incident/incidentFetch.ts
@@ -0,0 +1,147 @@
+
+import { pb } from '@/lib/pocketbase';
+import { IncidentItem } from './types';
+import { normalizeFetchedItem } from './incidentUtils';
+import { updateCache, invalidateCache } from './incidentCache';
+
+// Internal state variables instead of importing them
+let incidentsCache: {
+  data: IncidentItem[];
+  timestamp: number;
+} | null = null;
+let pendingRequest: Promise<any> | null = null;
+let isRequestInProgress = false;
+
+// Cache duration in milliseconds (30 minutes)
+const CACHE_DURATION = 30 * 60 * 1000;
+
+// Check if cache is valid
+export const isCacheValid = (): boolean => {
+  const now = Date.now();
+  return !!(incidentsCache && (now - incidentsCache.timestamp < CACHE_DURATION));
+};
+
+// Get all incidents with caching and error handling
+export const getAllIncidents = async (forceRefresh = false): Promise<IncidentItem[]> => {
+  // If a request is in progress, wait for it to complete rather than making a new one
+  if (isRequestInProgress) {
+  //  console.log('Request already in progress, waiting for completion');
+    try {
+      if (pendingRequest) {
+        await pendingRequest;
+      }
+      return incidentsCache?.data || [];
+    } catch (error) {
+      console.error('Error in existing incidents request:', error);
+      return incidentsCache?.data || [];
+    }
+  }
+  
+  // Use cache if available, not expired, and not forced refresh
+  if (!forceRefresh && isCacheValid()) {
+  //  console.log('Using cached incidents data from', new Date(incidentsCache!.timestamp).toLocaleTimeString());
+    return incidentsCache!.data;
+  }
+  
+  try {
+   // console.log('Fetching all incidents from API...');
+    isRequestInProgress = true;
+    
+    // Implement timeout for the request
+    const timeoutPromise = new Promise<never>((_, reject) => {
+      setTimeout(() => reject(new Error('Request timeout')), 20000); // Longer timeout (20s)
+    });
+    
+    // Create the fetch promise with a unique request key to prevent conflicts
+    const now = Date.now();
+    const requestKey = `incidents-${now}`;
+    const fetchPromise = pb.collection('incidents').getList(1, 100, {
+      sort: '-created',
+      requestKey,
+      $cancelKey: requestKey,
+    });
+    
+    // Store the pending request
+    pendingRequest = Promise.race([fetchPromise, timeoutPromise]);
+    
+    // Race between fetch and timeout
+    const result = await pendingRequest;
+    
+    // Clear request flags
+    pendingRequest = null;
+    isRequestInProgress = false;
+    
+    if (!result || !result.items) {
+    //  console.warn('No incidents found in API response');
+      return [];
+    }
+    
+    const normalizedItems = result.items.map(normalizeFetchedItem);
+    
+    // Update cache
+    updateCache(normalizedItems);
+    
+   // console.log(`Fetched ${normalizedItems.length} incidents at ${new Date().toLocaleTimeString()}`);
+    return normalizedItems;
+  } catch (error) {
+    if ((error as any)?.isAbort) {
+      console.log("Request aborted:", error);
+      return incidentsCache?.data || [];
+    }
+    
+  //  console.error('Error fetching incidents:', error);
+    
+    // Clear states to allow retry
+    pendingRequest = null;
+    isRequestInProgress = false;
+    
+    // Improve error message
+    if (error instanceof Error) {
+      throw new Error(`Failed to fetch incidents: ${error.message}`);
+    }
+    
+    // Still return cached data even on error
+    if (incidentsCache) {
+   //   console.log('Returning stale cached data after error');
+      return incidentsCache.data;
+    }
+    
+    return [];
+  }
+};
+
+// Get incident by id
+export const getIncidentById = async (id: string): Promise<IncidentItem | null> => {
+  try {
+  //  console.log(`Fetching incident with ID: ${id}`);
+    
+    // First check if the incident exists in the cache
+    if (isCacheValid() && incidentsCache) {
+      const cachedIncident = incidentsCache.data.find(incident => incident.id === id);
+      if (cachedIncident) {
+    //    console.log('Incident found in cache');
+        return cachedIncident;
+      }
+    }
+    
+    // If not in cache, fetch from API
+    const result = await pb.collection('incidents').getOne(id);
+    
+    if (!result) {
+      console.warn(`No incident found with ID: ${id}`);
+      return null;
+    }
+    
+    const normalizedIncident = normalizeFetchedItem(result);
+    return normalizedIncident;
+    
+  } catch (error) {
+  //  console.error(`Error fetching incident with ID ${id}:`, error);
+    
+    if (error instanceof Error) {
+      throw new Error(`Failed to fetch incident: ${error.message}`);
+    }
+    
+    return null;
+  }
+};
diff --git a/application/src/services/incident/incidentOperations.ts b/application/src/services/incident/incidentOperations.ts
new file mode 100644
index 0000000..8166389
--- /dev/null
+++ b/application/src/services/incident/incidentOperations.ts
@@ -0,0 +1,124 @@
+
+import { pb } from '@/lib/pocketbase';
+import { CreateIncidentInput, IncidentItem } from './types';
+import { formatStatus } from './incidentUtils';
+import { invalidateCache } from './incidentCache';
+
+// Update incident status
+export const updateIncidentStatus = async (id: string, status: string): Promise<void> => {
+  try {
+    const formattedStatus = formatStatus(status);
+    console.log(`Updating incident ${id} status to ${status} (formatted: ${formattedStatus})`);
+    
+    // Update both status and impact_status fields
+    await pb.collection('incidents').update(id, { 
+      status: formattedStatus,
+      impact_status: status.toLowerCase(), // Set impact_status to the lowercase status value
+      ...(status.toLowerCase() === 'resolved' ? { resolution_time: new Date().toISOString() } : {})
+    });
+    
+    // Invalidate cache after update
+    invalidateCache();
+    
+    console.log(`Incident ${id} status updated successfully to ${status}`);
+  } catch (error) {
+    console.error('Error updating incident status:', error);
+    throw error;
+  }
+};
+
+// Delete incident
+export const deleteIncident = async (id: string): Promise<void> => {
+  try {
+    await pb.collection('incidents').delete(id);
+    
+    // Invalidate cache after deletion
+    invalidateCache();
+    
+    console.log(`Incident ${id} deleted successfully`);
+  } catch (error) {
+    console.error('Error deleting incident:', error);
+    throw error;
+  }
+};
+
+// Create incident
+export const createIncident = async (data: CreateIncidentInput): Promise<void> => {
+  try {
+    // Format the payload according to API requirements
+    const payload = {
+      title: data.title,
+      description: data.description,
+      status: formatStatus(data.status),
+      impact_status: data.status.toLowerCase(),
+      // Use lowercase for impact and priority to match API expectations
+      impact: data.impact.toLowerCase(),
+      affected_systems: data.affected_systems,
+      priority: data.priority.toLowerCase(),
+      service_id: data.service_id || '',
+      //assigned_to: data.assigned_to || '', // Direct user ID assignment
+      //2025-08-18: // map UI field -> server schema
+      assigned_users: typeof data.assigned_to === 'string' ? data.assigned_to : '',
+      root_cause: data.root_cause || '',
+      resolution_steps: data.resolution_steps || '',
+      lessons_learned: data.lessons_learned || '',
+      timestamp: data.timestamp || new Date().toISOString(),
+      created_by: data.created_by,
+      resolution_time: data.status.toLowerCase() === 'resolved' ? new Date().toISOString() : null,
+    };
+    
+    console.log('Creating new incident with payload:', payload);
+    await pb.collection('incidents').create(payload);
+    
+    // Invalidate cache after create
+    invalidateCache();
+    
+    console.log('Incident created successfully');
+  } catch (error) {
+    console.error('Error creating incident:', error);
+    throw error;
+  }
+};
+
+// Update incident
+export const updateIncident = async (id: string, data: Partial<IncidentItem>): Promise<void> => {
+  try {
+    console.log(`Updating incident ${id} with:`, data);
+
+    const payload: Record<string, any> = {
+      ...data,
+      ...(data.impact ? { impact: data.impact.toLowerCase() } : {}),
+      ...(data.priority ? { priority: data.priority.toLowerCase() } : {}),
+      ...(data.status
+        ? {
+            status: formatStatus(data.status),
+            impact_status: data.status.toLowerCase(),
+          }
+        : {}),
+      // set only if assigned_to was provided
+      ...(typeof data.assigned_to === 'string'
+        ? {
+            assigned_users: data.assigned_to, // server field
+            assigned_to: data.assigned_to,    // legacy field for backward compatibility
+          }
+        : {}),
+      // add resolution_time only if status changes to resolved
+      ...((data.status?.toLowerCase() === 'resolved' && !data.resolution_time)
+        ? { resolution_time: new Date().toISOString() }
+        : {}),
+    };
+
+    console.log("Final payload for update:", payload);
+    await pb.collection('incidents').update(id, payload);
+
+    // Invalidate cache after update
+    invalidateCache();
+
+    console.log(`Incident ${id} updated successfully`);
+  } catch (error) {
+    console.error('Error updating incident:', error);
+    throw error;
+  }
+};
+
+
diff --git a/application/src/services/incident/incidentPdfService.ts b/application/src/services/incident/incidentPdfService.ts
new file mode 100644
index 0000000..872a73c
--- /dev/null
+++ b/application/src/services/incident/incidentPdfService.ts
@@ -0,0 +1,5 @@
+
+import { generateIncidentPDF } from './pdf';
+
+export { generateIncidentPDF };
+
diff --git a/application/src/services/incident/incidentService.ts b/application/src/services/incident/incidentService.ts
new file mode 100644
index 0000000..6a73826
--- /dev/null
+++ b/application/src/services/incident/incidentService.ts
@@ -0,0 +1,22 @@
+
+import { CreateIncidentInput, IncidentItem, UpdateIncidentInput } from './types';
+import { createIncident, updateIncident, updateIncidentStatus, deleteIncident } from './incidentOperations';
+import { getAllIncidents, getIncidentById } from './incidentFetch';
+import { generateIncidentPDF } from './incidentPdfService';
+
+export const incidentService = {
+  // Fetch operations
+  getAllIncidents,
+  getIncidentById,
+  
+  // CRUD operations
+  createIncident,
+  updateIncident,
+  updateIncidentStatus,
+  deleteIncident,
+  
+  // PDF operations
+  generateIncidentPDF,
+};
+
+export default incidentService;
diff --git a/application/src/services/incident/incidentUtils.ts b/application/src/services/incident/incidentUtils.ts
new file mode 100644
index 0000000..c1e703b
--- /dev/null
+++ b/application/src/services/incident/incidentUtils.ts
@@ -0,0 +1,29 @@
+
+import { pb } from '@/lib/pocketbase';
+import { IncidentItem } from './types';
+
+// Helper function to get the API URL
+export const getApiUrl = (): string => {
+  try {
+    return pb.baseUrl;
+  } catch (error) {
+    console.error('Error getting API URL:', error);
+    return '';
+  }
+};
+
+// Normalize fetched items to ensure consistent data structure
+export const normalizeFetchedItem = (item: any): IncidentItem => {
+  return {
+    ...item,
+    affected_systems: item.affected_systems || '',
+    status: item.impact_status || item.status || 'Investigating',
+    impact: item.impact || 'Low',
+    priority: item.priority || 'Low',
+  } as IncidentItem;
+};
+
+// Format status with first letter capitalized
+export const formatStatus = (status: string): string => {
+  return status.charAt(0).toUpperCase() + status.slice(1);
+};
diff --git a/application/src/services/incident/index.ts b/application/src/services/incident/index.ts
new file mode 100644
index 0000000..51d5447
--- /dev/null
+++ b/application/src/services/incident/index.ts
@@ -0,0 +1,12 @@
+
+export * from './types';
+export * from './incidentFetch';
+export * from './incidentOperations';
+export * from './incidentCache';
+export * from './incidentUtils';
+export * from './incidentPdfService';
+export * from './incidentService';
+
+// Export the incidentService as the default export
+export { incidentService } from './incidentService';
+
diff --git a/application/src/services/incident/pdf/generator.ts b/application/src/services/incident/pdf/generator.ts
new file mode 100644
index 0000000..d69b2a1
--- /dev/null
+++ b/application/src/services/incident/pdf/generator.ts
@@ -0,0 +1,125 @@
+
+import jsPDF from 'jspdf';
+import { IncidentItem } from '../types';
+import { userService } from '@/services/userService';
+import {
+  addBasicInfoSection,
+  addDescriptionSection,
+  addAffectedSystemsSection,
+  addRootCauseSection,
+  addResolutionSection,
+  addAssignmentSection,
+  addLessonsLearnedSection
+} from './sections';
+import { addHeader, addFooter } from './headerFooter';
+
+/**
+ * Generate a PDF for an incident report
+ */
+export const generatePdf = async (incident: IncidentItem): Promise<string> => {
+  // Validate incident data
+  if (!incident?.id) {
+    console.error('Invalid incident data for PDF generation');
+    throw new Error('Invalid incident data');
+  }
+  
+  // Fetch assigned user data if available
+  let assignedUser: { full_name?: string; username?: string } | null = null;
+  const assigneeId = incident?.assigned_users || incident?.assigned_to;
+  if (assigneeId) {
+    try {
+      assignedUser = await userService.getUser(assigneeId);
+    } catch (error) {
+      console.warn('Failed to fetch assigned user for PDF:', error);
+      // Continue without user data
+    }
+  }
+  
+  try {
+    // Create new PDF document with portrait orientation
+    const doc = new jsPDF({
+      orientation: 'portrait',
+      unit: 'mm',
+      format: 'a4',
+    });
+    
+    // Set title and filename
+    const title = incident.title || `Incident Report #${incident.id}`;
+    const filename = `incident-report-${incident.id}.pdf`;
+    
+    // Add metadata
+    doc.setProperties({
+      title: title,
+      subject: 'Incident Report',
+      author: 'CheckCle System',
+      creator: 'CheckCle',
+    });
+    
+    // Add header section
+    let yPos = addHeader(doc, incident);
+    
+    // Add basic information section
+    yPos = addBasicInfoSection(doc, incident, yPos);
+    
+    // Add description section
+    yPos = addDescriptionSection(doc, incident, yPos);
+    
+    // Check if we need to add a new page
+    if (yPos > 250) {
+      doc.addPage();
+      yPos = 20;
+    }
+    
+    // Add affected systems section
+    yPos = addAffectedSystemsSection(doc, incident, yPos);
+    
+    // Check if we need to add a new page
+    if (yPos > 250) {
+      doc.addPage();
+      yPos = 20;
+    }
+    
+    // Add root cause section
+    yPos = addRootCauseSection(doc, incident, yPos);
+    
+    // Check if we need to add a new page
+    if (yPos > 250) {
+      doc.addPage();
+      yPos = 20;
+    }
+    
+    // Add resolution steps section
+    yPos = addResolutionSection(doc, incident, yPos);
+    
+    // Check if we need to add a new page
+    if (yPos > 250) {
+      doc.addPage();
+      yPos = 20;
+    }
+    
+    // Add assignment section
+    yPos = addAssignmentSection(doc, incident, yPos, assignedUser);
+    
+    // Check if we need to add a new page
+    if (yPos > 250) {
+      doc.addPage();
+      yPos = 20;
+    }
+    
+    // Add lessons learned section if available
+    addLessonsLearnedSection(doc, incident, yPos);
+    
+    // Add footer to all pages
+    addFooter(doc);
+    
+    // Save the PDF
+    doc.save(filename);
+    
+    console.log('PDF generated successfully:', filename);
+    return filename;
+  } catch (error) {
+    console.error('Error generating incident PDF:', error);
+    throw new Error(`Failed to generate PDF: ${error instanceof Error ? error.message : 'Unknown error'}`);
+  }
+};
+
diff --git a/application/src/services/incident/pdf/headerFooter.ts b/application/src/services/incident/pdf/headerFooter.ts
new file mode 100644
index 0000000..4e0c443
--- /dev/null
+++ b/application/src/services/incident/pdf/headerFooter.ts
@@ -0,0 +1,63 @@
+
+import jsPDF from 'jspdf';
+import { IncidentItem } from '../types';
+import { fonts } from './utils';
+
+/**
+ * Add the PDF header with title and metadata
+ */
+export const addHeader = (doc: jsPDF, incident: IncidentItem): number => {
+  // Set initial y position
+  let yPos = 15;
+  
+  // Add header with title
+  doc.setFont(fonts.bold);
+  doc.setFontSize(18);
+  doc.setTextColor(0, 0, 0);
+  doc.text('INCIDENT REPORT', 105, yPos, { align: 'center' });
+  
+  // Add incident title
+  yPos += 8;
+  doc.setFontSize(14);
+  const title = incident.title || `Incident Report #${incident.id}`;
+  doc.text(title, 105, yPos, { align: 'center' });
+  
+  // Add current date
+  yPos += 8;
+  doc.setFont(fonts.normal);
+  doc.setFontSize(10);
+  doc.text(`Generated on: ${new Date().toLocaleDateString()}`, 105, yPos, { align: 'center' });
+  
+  // Add CheckCle logo or text
+  yPos += 8;
+  doc.setFontSize(12);
+  doc.setFont(fonts.italic);
+  doc.text('CheckCle Incident Management', 105, yPos, { align: 'center' });
+  
+  // Add horizontal line
+  yPos += 5;
+  doc.setLineWidth(0.5);
+  doc.line(15, yPos, 195, yPos);
+  
+  // Return next Y position with some padding
+  return yPos + 10;
+};
+
+/**
+ * Add footer to all pages
+ */
+export const addFooter = (doc: jsPDF): void => {
+  const pageCount = doc.getNumberOfPages();
+  for (let i = 1; i <= pageCount; i++) {
+    doc.setPage(i);
+    doc.setFontSize(8);
+    doc.setTextColor(100, 100, 100);
+    doc.text(
+      `Page ${i} of ${pageCount} | Generated by CheckCle Incident Management System`,
+      105,
+      285,
+      { align: 'center' }
+    );
+  }
+};
+
diff --git a/application/src/services/incident/pdf/index.ts b/application/src/services/incident/pdf/index.ts
new file mode 100644
index 0000000..6ba7099
--- /dev/null
+++ b/application/src/services/incident/pdf/index.ts
@@ -0,0 +1,12 @@
+
+import { generatePdf } from './generator';
+import { IncidentItem } from '../types';
+
+/**
+ * Generate and download PDF for incident report
+ */
+export const generateIncidentPDF = async (incident: IncidentItem): Promise<void> => {
+  await generatePdf(incident);
+  return Promise.resolve();
+};
+
diff --git a/application/src/services/incident/pdf/sections.ts b/application/src/services/incident/pdf/sections.ts
new file mode 100644
index 0000000..59c43cf
--- /dev/null
+++ b/application/src/services/incident/pdf/sections.ts
@@ -0,0 +1,200 @@
+
+import jsPDF from 'jspdf';
+import { IncidentItem } from '../types';
+import { fonts, formatDate, capitalize } from './utils';
+import autoTable from 'jspdf-autotable';
+
+/**
+ * Add the incident overview section to the PDF
+ */
+export const addBasicInfoSection = (doc: jsPDF, incident: IncidentItem, yPos: number): number => {
+  doc.setFont(fonts.bold);
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Incident Overview', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  yPos += 10;
+  
+  // Basic information table
+  autoTable(doc, {
+    startY: yPos,
+    head: [['Field', 'Information']],
+    body: [
+      ['ID', incident.id],
+      ['Status', capitalize(incident.status || 'Unknown')],
+      ['Priority', capitalize(incident.priority || 'Unknown')],
+      ['Impact', capitalize(incident.impact || 'Unknown')],
+      ['Created', formatDate(incident.created)],
+      ['Last Updated', formatDate(incident.updated)],
+    ],
+    headStyles: {
+      fillColor: [30, 64, 175], // Blue-800
+      textColor: [255, 255, 255],
+      fontStyle: 'bold',
+    },
+    alternateRowStyles: {
+      fillColor: [241, 245, 249], // Slate-100
+    },
+    margin: { left: 15, right: 15 },
+  });
+  
+  // Return the new Y position after the table
+  return (doc as any).lastAutoTable.finalY + 10;
+};
+
+/**
+ * Add the description section to the PDF
+ */
+export const addDescriptionSection = (doc: jsPDF, incident: IncidentItem, yPos: number): number => {
+  doc.setFont(fonts.bold);
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Description', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Add incident description
+  doc.setFont(fonts.normal);
+  doc.setFontSize(10);
+  doc.setTextColor(0, 0, 0);
+  const description = incident.description || 'No description provided';
+  const splitDescription = doc.splitTextToSize(description, 180);
+  doc.text(splitDescription, 15, yPos + 10);
+  
+  // Update y position after the description
+  return yPos + 15 + (splitDescription.length * 5);
+};
+
+/**
+ * Add the affected systems section to the PDF
+ */
+export const addAffectedSystemsSection = (doc: jsPDF, incident: IncidentItem, yPos: number): number => {
+  doc.setFont(fonts.bold);
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Affected Systems', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Add affected systems
+  doc.setFont(fonts.normal);
+  doc.setFontSize(10);
+  doc.setTextColor(0, 0, 0);
+  const affectedSystems = incident.affected_systems || 'None specified';
+  const systemsList = affectedSystems.split(',').map(system => system.trim());
+  
+  let currentY = yPos + 10;
+  systemsList.forEach((system) => {
+    doc.text(`• ${system}`, 15, currentY);
+    currentY += 5;
+  });
+  
+  return currentY + 5; // Return updated Y position with some padding
+};
+
+/**
+ * Add the root cause section to the PDF
+ */
+export const addRootCauseSection = (doc: jsPDF, incident: IncidentItem, yPos: number): number => {
+  doc.setFont(fonts.bold);
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Root Cause', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Add root cause
+  doc.setFont(fonts.normal);
+  doc.setFontSize(10);
+  doc.setTextColor(0, 0, 0);
+  const rootCause = incident.root_cause || 'Root cause not identified yet';
+  const splitRootCause = doc.splitTextToSize(rootCause, 180);
+  doc.text(splitRootCause, 15, yPos + 10);
+  
+  // Update y position after the root cause
+  return yPos + 15 + (splitRootCause.length * 5);
+};
+
+/**
+ * Add the resolution steps section to the PDF
+ */
+export const addResolutionSection = (doc: jsPDF, incident: IncidentItem, yPos: number): number => {
+  doc.setFont(fonts.bold);
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Resolution Steps', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Create resolution data table - Using resolution_steps
+  const resolutionSteps = incident.resolution_steps || 'No resolution steps provided';
+  const splitResolutionSteps = doc.splitTextToSize(resolutionSteps, 180);
+  
+  doc.setFontSize(10);
+  doc.setTextColor(0, 0, 0);
+  doc.text(splitResolutionSteps, 15, yPos + 10);
+  
+  return yPos + 20 + (splitResolutionSteps.length * 5);
+};
+
+/**
+ * Add the assignment information section to the PDF
+ */
+export const addAssignmentSection = (doc: jsPDF, incident: IncidentItem, yPos: number, assignedUser?: { full_name?: string; username?: string } | null): number => {
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Assignment Information', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Add assigned user info
+  yPos += 10;
+  doc.setFontSize(10);
+  doc.setTextColor(0, 0, 0);
+  
+  if (assignedUser) {
+    // Show user name if available
+    const userName = assignedUser.full_name || assignedUser.username || 'Unknown User';
+    doc.text(`Assigned to: ${userName}`, 15, yPos);
+  } else {
+    // Fallback to ID if no user data available
+    const assignedTo = incident.assigned_users || incident.assigned_to || 'Not assigned';
+    doc.text(`Assigned to: ${assignedTo}`, 15, yPos);
+  }
+  
+  return yPos + 10;
+};
+
+/**
+ * Add the lessons learned section to the PDF if available
+ */
+export const addLessonsLearnedSection = (doc: jsPDF, incident: IncidentItem, yPos: number): number => {
+  if (!incident.lessons_learned) {
+    return yPos; // No lessons learned, return current position
+  }
+  
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Lessons Learned', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Add lessons learned
+  const lessonsLearned = incident.lessons_learned;
+  const splitLessonsLearned = doc.splitTextToSize(lessonsLearned, 180);
+  
+  doc.setFontSize(10);
+  doc.setTextColor(0, 0, 0);
+  doc.text(splitLessonsLearned, 15, yPos + 10);
+  
+  return yPos + 15 + (splitLessonsLearned.length * 5);
+};
+
diff --git a/application/src/services/incident/pdf/utils.ts b/application/src/services/incident/pdf/utils.ts
new file mode 100644
index 0000000..65a6c48
--- /dev/null
+++ b/application/src/services/incident/pdf/utils.ts
@@ -0,0 +1,26 @@
+
+import { format } from 'date-fns';
+
+// Font configuration for the PDF
+export const fonts = {
+  normal: 'Helvetica',
+  bold: 'Helvetica-Bold',
+  italic: 'Helvetica-Oblique',
+};
+
+// Helper function to format dates
+export const formatDate = (dateString: string | undefined): string => {
+  if (!dateString) return 'N/A';
+  try {
+    return format(new Date(dateString), 'PPp');
+  } catch (e) {
+    return dateString || 'N/A';
+  }
+};
+
+// Helper function to capitalize first letter
+export const capitalize = (str: string): string => {
+  if (!str) return '';
+  return str.charAt(0).toUpperCase() + str.slice(1);
+};
+
diff --git a/application/src/services/incident/types.ts b/application/src/services/incident/types.ts
new file mode 100644
index 0000000..3a4a2ed
--- /dev/null
+++ b/application/src/services/incident/types.ts
@@ -0,0 +1,60 @@
+
+// Define the type for incident item
+export type IncidentItem = {
+  id: string;
+  service_id?: string;
+  timestamp?: string;
+  description: string;
+  assigned_to?: string; // legacy UI field
+  assigned_users?: string; // server field
+  resolution_time?: string;
+  impact: string;
+  affected_systems: string;
+  root_cause?: string;
+  resolution_steps?: string;
+  lessons_learned?: string;
+  operational_status_id?: string;
+  server_id?: string;
+  priority: string;
+  status: string;
+  impact_status?: string;
+  created: string;
+  updated: string;
+  category?: string;
+  title: string; 
+};
+
+// Define the input type for creating an incident
+export type CreateIncidentInput = {
+  title: string;
+  description: string;
+  status: string;
+  impact: string;
+  affected_systems: string;
+  priority: string;
+  service_id?: string;
+  assigned_to?: string; // legacy UI field
+  assigned_users?: string; // server field
+  root_cause?: string;
+  resolution_steps?: string;
+  lessons_learned?: string;
+  timestamp?: string;
+  created_by: string;
+};
+
+// Define the input type for updating an incident
+export type UpdateIncidentInput = {
+  id: string;
+  title?: string;
+  description?: string;
+  status?: string;
+  impact?: string;
+  affected_systems?: string;
+  priority?: string;
+  service_id?: string;
+  assigned_to?: string; // legacy UI field
+  assigned_users?: string; // server field
+  root_cause?: string;
+  resolution_steps?: string;
+  lessons_learned?: string;
+};
diff --git a/application/src/services/incidentService.ts b/application/src/services/incidentService.ts
new file mode 100644
index 0000000..d8e3f46
--- /dev/null
+++ b/application/src/services/incidentService.ts
@@ -0,0 +1,4 @@
+
+// Re-export incident service from the new modular structure
+export * from './incident';
+export { incidentService as default } from './incident';
diff --git a/application/src/services/maintenance/api/index.ts b/application/src/services/maintenance/api/index.ts
new file mode 100644
index 0000000..0997d32
--- /dev/null
+++ b/application/src/services/maintenance/api/index.ts
@@ -0,0 +1,10 @@
+
+// Re-export all maintenance API functions from their respective modules
+export { clearCache as clearMaintenanceCache } from './maintenanceCache';
+export { fetchAllMaintenanceRecords } from './maintenanceFetch';
+export { 
+  updateMaintenanceStatus,
+  updateMaintenance,
+  deleteMaintenance,
+  createMaintenance
+} from './maintenanceOperations';
diff --git a/application/src/services/maintenance/api/maintenanceCache.ts b/application/src/services/maintenance/api/maintenanceCache.ts
new file mode 100644
index 0000000..964cd3b
--- /dev/null
+++ b/application/src/services/maintenance/api/maintenanceCache.ts
@@ -0,0 +1,60 @@
+
+import { MaintenanceItem } from '../../types/maintenance.types';
+
+// Cache management for maintenance records
+
+// Cache for maintenance records
+let cachedMaintenanceRecords: MaintenanceItem[] | null = null;
+let lastFetchTimestamp = 0;
+const CACHE_EXPIRY_MS = 600000; // 10 minutes cache expiry (increased significantly)
+
+/**
+ * Check if cache is valid and can be used
+ */
+export const isCacheValid = (): boolean => {
+  const now = Date.now();
+  return !!(cachedMaintenanceRecords && now - lastFetchTimestamp < CACHE_EXPIRY_MS);
+};
+
+/**
+ * Get cached maintenance records if available
+ */
+export const getCachedRecords = () => {
+  if (cachedMaintenanceRecords) {
+    return [...cachedMaintenanceRecords]; // Return a copy to prevent mutation
+  }
+  return null;
+};
+
+/**
+ * Update cache with new data
+ */
+export const updateCache = (data: MaintenanceItem[], timestamp?: number): void => {
+  cachedMaintenanceRecords = data;
+  lastFetchTimestamp = timestamp || Date.now();
+};
+
+/**
+ * Clear cache to force refresh
+ */
+export const clearCache = (): void => {
+  cachedMaintenanceRecords = null;
+  lastFetchTimestamp = 0;
+};
+
+/**
+ * Get cache statistics for debugging
+ */
+export const getCacheStats = () => {
+  const now = Date.now();
+  const cacheAge = lastFetchTimestamp ? now - lastFetchTimestamp : 0;
+  const timeUntilExpiry = lastFetchTimestamp ? CACHE_EXPIRY_MS - cacheAge : 0;
+  
+  return {
+    hasCache: !!cachedMaintenanceRecords,
+    cacheSize: cachedMaintenanceRecords?.length || 0,
+    cacheAge: Math.round(cacheAge / 1000), // in seconds
+    timeUntilExpiry: Math.round(timeUntilExpiry / 1000), // in seconds
+    isValid: isCacheValid()
+  };
+};
\ No newline at end of file
diff --git a/application/src/services/maintenance/api/maintenanceFetch.ts b/application/src/services/maintenance/api/maintenanceFetch.ts
new file mode 100644
index 0000000..6056863
--- /dev/null
+++ b/application/src/services/maintenance/api/maintenanceFetch.ts
@@ -0,0 +1,99 @@
+
+import { pb } from '@/lib/pocketbase';
+import { MaintenanceItem } from '../../types/maintenance.types';
+import { normalizeMaintenanceItem } from '../maintenanceUtils';
+import { isCacheValid, getCachedRecords, updateCache, clearCache } from './maintenanceCache';
+
+// Request management
+let currentRequest: Promise<MaintenanceItem[]> | null = null;
+let lastRequestTime = 0;
+const MIN_REQUEST_INTERVAL = 30000; // 30 seconds minimum between requests
+
+/**
+ * Get all maintenance records from the API with strict request control
+ */
+export const fetchAllMaintenanceRecords = async (forceRefresh = false): Promise<MaintenanceItem[]> => {
+  try {
+    const now = Date.now();
+    
+    // If forced refresh, clear cache first
+    if (forceRefresh) {
+      clearCache();
+    }
+    
+    // Return cached data if available and not forced refresh
+    if (!forceRefresh && isCacheValid()) {
+      return getCachedRecords() as MaintenanceItem[];
+    }
+    
+    // Request deduplication: if a request is already in progress, wait for it
+    if (currentRequest) {
+      return await currentRequest;
+    }
+    
+    // Strict rate limiting - prevent requests too close together (unless forced)
+    const timeSinceLastRequest = now - lastRequestTime;
+    if (timeSinceLastRequest < MIN_REQUEST_INTERVAL && !forceRefresh) {
+      return getCachedRecords() || [];
+    }
+    
+    lastRequestTime = now;
+    
+    // Create the request promise
+    currentRequest = performRequest(now);
+    
+    try {
+      const result = await currentRequest;
+      return result;
+    } finally {
+      currentRequest = null; // Clear the current request
+    }
+    
+  } catch (error) {
+    currentRequest = null; // Clear the current request on error
+    
+    console.error('Error fetching maintenance records:', error);
+    
+    // Return cached data on error if available
+    return getCachedRecords() || [];
+  }
+};
+
+/**
+ * Perform the actual API request
+ */
+const performRequest = async (timestamp: number): Promise<MaintenanceItem[]> => {
+  // Create abort controller for request timeout
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 30000); // 30 second timeout
+  
+  try {
+    const result = await pb.collection('maintenance').getList(1, 200, {
+      sort: '-created',
+      requestKey: `maintenance-${timestamp}`,
+      $cancelKey: `maintenance-fetch-${timestamp}`,
+      expand: 'assigned_users',
+      signal: controller.signal,
+    });
+    
+    clearTimeout(timeoutId);
+    
+    if (!result || !result.items || result.items.length === 0) {
+      const emptyData: MaintenanceItem[] = [];
+      updateCache(emptyData, timestamp);
+      return emptyData;
+    }
+    
+    // Process and normalize data
+    const normalizedData = result.items.map(item => normalizeMaintenanceItem(item));
+    
+    // Update cache
+    updateCache(normalizedData, timestamp);
+    
+    return normalizedData;
+    
+  } catch (error) {
+    clearTimeout(timeoutId);
+    throw error;
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/maintenance/api/maintenanceOperations.ts b/application/src/services/maintenance/api/maintenanceOperations.ts
new file mode 100644
index 0000000..3ec0287
--- /dev/null
+++ b/application/src/services/maintenance/api/maintenanceOperations.ts
@@ -0,0 +1,85 @@
+
+import { pb } from '@/lib/pocketbase';
+import { MaintenanceItem, CreateMaintenanceInput } from '../../types/maintenance.types';
+import { clearCache } from './maintenanceCache';
+
+/**
+ * Update the status of a maintenance record
+ */
+export const updateMaintenanceStatus = async (id: string, status: string): Promise<void> => {
+  try {
+    await pb.collection('maintenance').update(id, { status });
+    clearCache();
+  } catch (error) {
+    console.error('Error updating maintenance status:', error);
+    throw error;
+  }
+};
+
+/**
+ * Update a maintenance record with partial data
+ */
+export const updateMaintenance = async (id: string, data: Partial<MaintenanceItem>): Promise<void> => {
+  try {
+    // Format assigned_users for storage
+    const formattedData = { ...data };
+    
+    // Ensure assigned_users is stored in a consistent format (JSON string)
+    if (formattedData.assigned_users) {
+      if (Array.isArray(formattedData.assigned_users)) {
+        formattedData.assigned_users = JSON.stringify(formattedData.assigned_users);
+      }
+    }
+    
+    console.log("Updating maintenance record with formatted data:", formattedData);
+    
+    await pb.collection('maintenance').update(id, formattedData);
+    clearCache();
+  } catch (error) {
+    console.error('Error updating maintenance:', error);
+    throw error;
+  }
+};
+
+/**
+ * Delete a maintenance record
+ */
+export const deleteMaintenance = async (id: string): Promise<void> => {
+  try {
+    await pb.collection('maintenance').delete(id);
+    clearCache();
+  } catch (error) {
+    console.error('Error deleting maintenance:', error);
+    throw error;
+  }
+};
+
+/**
+ * Create a new maintenance record
+ */
+export const createMaintenance = async (data: CreateMaintenanceInput): Promise<void> => {
+  try {
+    // Format data for submission
+    const formattedData = { ...data };
+    
+    // Ensure assigned_users is stored in a consistent format (JSON string)
+    if (formattedData.assigned_users) {
+      if (Array.isArray(formattedData.assigned_users)) {
+        formattedData.assigned_users = JSON.stringify(formattedData.assigned_users);
+      }
+    }
+    
+    // Ensure notification_id is set from notification_channel_id if not already present
+    if (formattedData.notification_channel_id && !formattedData.notification_id) {
+      formattedData.notification_id = formattedData.notification_channel_id;
+    }
+    
+    console.log("Creating maintenance record with formatted data:", formattedData);
+    
+    await pb.collection('maintenance').create(formattedData);
+    clearCache();
+  } catch (error) {
+    console.error('Error creating maintenance:', error);
+    throw error;
+  }
+};
diff --git a/application/src/services/maintenance/api/maintenanceValidation.ts b/application/src/services/maintenance/api/maintenanceValidation.ts
new file mode 100644
index 0000000..57f8e0e
--- /dev/null
+++ b/application/src/services/maintenance/api/maintenanceValidation.ts
@@ -0,0 +1,68 @@
+
+/**
+ * Validation utilities for maintenance data
+ */
+
+/**
+ * Validate status value to ensure it's one of the acceptable values
+ */
+export const validateStatus = (status: string): string => {
+  // Convert to lowercase and replace spaces with underscore for consistency
+  const formattedStatus = status.toLowerCase().replace(' ', '_');
+  
+  // Check if the status is one of the allowed values
+  const allowedStatuses = ['scheduled', 'in_progress', 'completed', 'cancelled'];
+  
+  if (!allowedStatuses.includes(formattedStatus)) {
+    console.warn(`Invalid status value: ${formattedStatus}. Using 'scheduled' as fallback.`);
+    return 'scheduled';
+  }
+  
+  return formattedStatus;
+};
+
+/**
+ * Ensure assigned_users is properly formatted
+ */
+export const formatAssignedUsers = (assignedUsers: unknown): string => {
+  // If it's already a JSON string, return it
+  if (typeof assignedUsers === 'string' && (assignedUsers.startsWith('[') || assignedUsers === '')) {
+    return assignedUsers;
+  }
+  
+  // If it's an array, stringify it
+  if (Array.isArray(assignedUsers)) {
+    return JSON.stringify(assignedUsers);
+  }
+  
+  // If it's a string but not JSON, convert it to array then stringify
+  if (typeof assignedUsers === 'string') {
+    const userArray = assignedUsers.trim() !== '' 
+      ? assignedUsers.split(',').map(id => id.trim())
+      : [];
+    return JSON.stringify(userArray);
+  }
+  
+  // Default to empty array
+  return '[]';
+};
+
+/**
+ * Process notification settings consistently
+ */
+export const processNotificationSettings = (
+  notifySubscribers: string, 
+  channelId?: string
+): { notification_channel_id: string, notification_id: string } => {
+  if (notifySubscribers !== 'yes' || !channelId) {
+    return {
+      notification_channel_id: '',
+      notification_id: ''
+    };
+  }
+  
+  return {
+    notification_channel_id: channelId,
+    notification_id: channelId  // Set notification_id to match notification_channel_id
+  };
+};
diff --git a/application/src/services/maintenance/index.ts b/application/src/services/maintenance/index.ts
new file mode 100644
index 0000000..3448f16
--- /dev/null
+++ b/application/src/services/maintenance/index.ts
@@ -0,0 +1,15 @@
+
+export * from './maintenanceService';
+// Export maintenance API functions from the new structure
+export { 
+  fetchAllMaintenanceRecords, 
+  updateMaintenanceStatus, 
+  updateMaintenance, 
+  deleteMaintenance, 
+  createMaintenance, 
+  clearMaintenanceCache 
+} from './api';
+// Export everything from maintenanceUtils
+export * from './maintenanceUtils';
+export * from './pdf';
+export * from '../types/maintenance.types';
diff --git a/application/src/services/maintenance/maintenanceNotificationService.ts b/application/src/services/maintenance/maintenanceNotificationService.ts
new file mode 100644
index 0000000..8c58f20
--- /dev/null
+++ b/application/src/services/maintenance/maintenanceNotificationService.ts
@@ -0,0 +1,199 @@
+
+import { MaintenanceItem } from '../types/maintenance.types';
+import { alertConfigService, AlertConfiguration } from '../alertConfigService';
+import { sendTelegramNotification } from '../notification/telegramService';
+import { pb } from '@/lib/pocketbase';
+import { formatDistanceToNow } from 'date-fns';
+
+interface NotificationParams {
+  maintenance: MaintenanceItem;
+  notificationType: 'start' | 'end' | 'update';
+}
+
+export const maintenanceNotificationService = {
+  /**
+   * Send notification for maintenance events
+   */
+  async sendMaintenanceNotification({ maintenance, notificationType }: NotificationParams): Promise<boolean> {
+    try {
+    //  console.log(`Preparing to send ${notificationType} notification for maintenance: ${maintenance.title}`);
+      
+      // Get notification channel ID - try both fields
+      let notificationChannelId = maintenance.notification_channel_id;
+      
+      // If notification_channel_id is empty, try to use notification_id
+      if (!notificationChannelId && maintenance.notification_id) {
+     //   console.log(`No notification_channel_id found, using notification_id: ${maintenance.notification_id}`);
+        notificationChannelId = maintenance.notification_id;
+      }
+      
+      // Check if maintenance has notification channel configured
+      if (!notificationChannelId) {
+      //  console.log("No notification channel configured for this maintenance");
+        return false;
+      }
+      
+      console.log(`Using notification channel ID: ${notificationChannelId}`);
+      
+      // Get notification channel configuration
+      let notificationConfig: AlertConfiguration;
+      try {
+        const config = await pb.collection('alert_configurations').getOne(notificationChannelId);
+        notificationConfig = config as unknown as AlertConfiguration;
+      } catch (error) {
+      //  console.error("Failed to fetch notification configuration:", error);
+        return false;
+      }
+      
+      if (!notificationConfig.enabled) {
+      //  console.log("Notification channel is disabled");
+        return false;
+      }
+      
+      // Create notification message based on type
+      const message = this.generateMaintenanceMessage(maintenance, notificationType);
+      
+    //  console.log(`Sending ${notificationConfig.notification_type} notification with message: ${message}`);
+      
+      // Send notification based on channel type
+      if (notificationConfig.notification_type === 'telegram') {
+        return await sendTelegramNotification(notificationConfig, message);
+      }
+      
+      // Add more notification types here as needed
+      
+     // console.log(`Unsupported notification type: ${notificationConfig.notification_type}`);
+      return false;
+    } catch (error) {
+     // console.error("Error sending maintenance notification:", error);
+      return false;
+    }
+  },
+  
+  /**
+   * Generate message for maintenance notification
+   */
+  generateMaintenanceMessage(maintenance: MaintenanceItem, type: 'start' | 'end' | 'update'): string {
+    const startDate = new Date(maintenance.start_time);
+    const endDate = new Date(maintenance.end_time);
+    const duration = formatDistanceToNow(endDate, { addSuffix: false });
+    const affectedServices = maintenance.affected.split(',').map(s => s.trim()).join(', ');
+    
+    let emoji = '🔧';
+    let statusText = '';
+    let timeText = '';
+    
+    switch (type) {
+      case 'start':
+        emoji = '⚠️';
+        statusText = 'has started';
+        timeText = `Estimated duration: ${duration}`;
+        break;
+      case 'end':
+        emoji = '✅';
+        statusText = 'has completed';
+        timeText = 'All systems are back to normal operation';
+        break;
+      case 'update':
+        emoji = '🔄';
+        statusText = 'has been updated';
+        timeText = `Scheduled for ${startDate.toLocaleString()} to ${endDate.toLocaleString()}`;
+        break;
+    }
+    
+    return `${emoji} <b>Maintenance ${statusText}</b>
+
+<b>Title:</b> ${maintenance.title}
+<b>Description:</b> ${maintenance.description}
+<b>Affected Services:</b> ${affectedServices}
+<b>${timeText}</b>
+
+<b>Priority:</b> ${maintenance.priority.toUpperCase()}
+<b>Impact:</b> ${maintenance.field.toUpperCase()}`;
+  }
+};
+
+// Set up scheduled maintenance notifications
+export const setupMaintenanceNotificationsScheduler = () => {
+ // console.log("Setting up maintenance notifications scheduler");
+  
+  // Check every minute for maintenance that needs notifications
+  const checkInterval = setInterval(async () => {
+    try {
+    //  console.log("Checking for maintenance notifications to send...");
+      const now = new Date();
+      
+      // Fetch upcoming and ongoing maintenance
+      const records = await pb.collection('maintenance').getList(1, 100, {
+        filter: `status = 'scheduled' || status = 'in_progress'`,
+      });
+      
+      if (!records || !records.items || records.items.length === 0) {
+        return;
+      }
+      
+      // Check each maintenance record
+      for (const record of records.items) {
+        const maintenance = record as unknown as MaintenanceItem;
+        const startTime = new Date(maintenance.start_time);
+        const endTime = new Date(maintenance.end_time);
+        
+        // If maintenance is scheduled to start within the next minute or has just started
+        if (maintenance.status === 'scheduled' && 
+            startTime <= new Date(now.getTime() + 60000) && 
+            startTime > new Date(now.getTime() - 60000)) {
+          
+        //  console.log(`Maintenance ${maintenance.title} is starting now, sending notification`);
+          await maintenanceNotificationService.sendMaintenanceNotification({
+            maintenance,
+            notificationType: 'start'
+          });
+          
+          // Update status to in_progress
+          await pb.collection('maintenance').update(maintenance.id, {
+            status: 'in_progress'
+          });
+        }
+        
+        // If maintenance is in progress and scheduled to end within the next minute or has just ended
+        if (maintenance.status === 'in_progress' && 
+            endTime <= new Date(now.getTime() + 60000) && 
+            endTime > new Date(now.getTime() - 60000)) {
+          
+         // console.log(`Maintenance ${maintenance.title} is ending now, sending notification`);
+          await maintenanceNotificationService.sendMaintenanceNotification({
+            maintenance,
+            notificationType: 'end'
+          });
+          
+          // Update status to completed
+          await pb.collection('maintenance').update(maintenance.id, {
+            status: 'completed'
+          });
+        }
+      }
+    } catch (error) {
+    //  console.error("Error checking maintenance notifications:", error);
+    }
+  }, 60000); // Check every minute
+  
+  return checkInterval;
+};
+
+// Initialize the notification scheduler
+let notificationScheduler: NodeJS.Timeout | null = null;
+
+export const initMaintenanceNotifications = () => {
+  if (notificationScheduler === null) {
+    notificationScheduler = setupMaintenanceNotificationsScheduler();
+   // console.log("Maintenance notifications scheduler initialized");
+  }
+};
+
+export const stopMaintenanceNotifications = () => {
+  if (notificationScheduler !== null) {
+    clearInterval(notificationScheduler);
+    notificationScheduler = null;
+  //  console.log("Maintenance notifications scheduler stopped");
+  }
+};
diff --git a/application/src/services/maintenance/maintenanceService.ts b/application/src/services/maintenance/maintenanceService.ts
new file mode 100644
index 0000000..faf3fda
--- /dev/null
+++ b/application/src/services/maintenance/maintenanceService.ts
@@ -0,0 +1,92 @@
+
+import { getCurrentEndpoint } from '@/lib/pocketbase';
+import { MaintenanceItem, CreateMaintenanceInput } from '../types/maintenance.types';
+import { categorizeMaintenance } from './maintenanceUtils';
+import { 
+  fetchAllMaintenanceRecords, 
+  updateMaintenanceStatus,
+  updateMaintenance,
+  deleteMaintenance,
+  createMaintenance as createMaintenanceRecord,
+  clearMaintenanceCache
+} from './api';
+
+// Helper function to get the API URL
+const getApiUrl = (): string => {
+  return getCurrentEndpoint();
+};
+
+// Get all maintenance records with performance optimizations
+const getMaintenanceRecords = async (): Promise<MaintenanceItem[]> => {
+  return await fetchAllMaintenanceRecords();
+};
+
+// Get upcoming maintenance with caching
+const getUpcomingMaintenance = async (): Promise<MaintenanceItem[]> => {
+  try {
+    const allRecords = await getMaintenanceRecords();
+    const { upcoming } = categorizeMaintenance(allRecords);
+    return upcoming;
+  } catch (error) {
+    console.error('Error fetching upcoming maintenance:', error);
+    return [];
+  }
+};
+
+// Get ongoing maintenance with caching
+const getOngoingMaintenance = async (): Promise<MaintenanceItem[]> => {
+  try {
+    const allRecords = await getMaintenanceRecords();
+    const { ongoing } = categorizeMaintenance(allRecords);
+    return ongoing;
+  } catch (error) {
+    console.error('Error fetching ongoing maintenance:', error);
+    return [];
+  }
+};
+
+// Get completed maintenance with caching
+const getCompletedMaintenance = async (): Promise<MaintenanceItem[]> => {
+  try {
+    const allRecords = await getMaintenanceRecords();
+    const { completed } = categorizeMaintenance(allRecords);
+    return completed;
+  } catch (error) {
+    console.error('Error fetching completed maintenance:', error);
+    return [];
+  }
+};
+
+// Create a new maintenance record
+const createMaintenance = async (data: CreateMaintenanceInput): Promise<void> => {
+  await createMaintenanceRecord(data);
+  clearMaintenanceCache(); // Force cache refresh after creation
+};
+
+// Update an existing maintenance record
+const updateMaintenanceRecord = async (id: string, data: Partial<MaintenanceItem>): Promise<void> => {
+  await updateMaintenance(id, data);
+  clearMaintenanceCache(); // Force cache refresh after update
+};
+
+// Refresh cache manually
+const refreshMaintenanceData = (): void => {
+  clearMaintenanceCache();
+};
+
+// Export all functions as the maintenanceService object
+export const maintenanceService = {
+  getApiUrl,
+  getMaintenanceRecords,
+  getUpcomingMaintenance,
+  getOngoingMaintenance,
+  getCompletedMaintenance,
+  updateMaintenanceStatus,
+  updateMaintenance: updateMaintenanceRecord,
+  deleteMaintenance,
+  createMaintenance,
+  refreshMaintenanceData
+};
+
+// Re-export types for convenience
+export type { MaintenanceItem, CreateMaintenanceInput };
\ No newline at end of file
diff --git a/application/src/services/maintenance/maintenanceUtils.ts b/application/src/services/maintenance/maintenanceUtils.ts
new file mode 100644
index 0000000..18969e7
--- /dev/null
+++ b/application/src/services/maintenance/maintenanceUtils.ts
@@ -0,0 +1,125 @@
+
+import { MaintenanceItem } from '../types/maintenance.types';
+
+// Normalize maintenance item data from PocketBase to our expected format
+export const normalizeMaintenanceItem = (item: any): MaintenanceItem => {
+  // Log the item to help debug
+  console.log(`Normalizing maintenance item ${item.id}, assigned_users:`, item.assigned_users);
+  
+  // Handle assigned_users, ensuring it's always an array
+  let assignedUsers: string[] = [];
+  
+  if (item.assigned_users) {
+    if (Array.isArray(item.assigned_users)) {
+      // If it's already an array, use it
+      assignedUsers = item.assigned_users;
+      console.log(`Maintenance ${item.id} assigned_users is an array:`, assignedUsers);
+    } else if (typeof item.assigned_users === 'string' && item.assigned_users.trim() !== '') {
+      // If it's a string, split it by comma
+      assignedUsers = item.assigned_users.split(',').filter((id: string) => id.trim() !== '').map((id: string) => id.trim());
+      console.log(`Maintenance ${item.id} converted assigned_users string to array:`, assignedUsers);
+    }
+  }
+  
+  // Include expand data if available
+  const expandData = item.expand ? {
+    expand: {
+      ...item.expand
+    }
+  } : {};
+
+  return {
+    id: item.id,
+    title: item.title || '',
+    description: item.description || '',
+    start_time: item.start_time || '',
+    end_time: item.end_time || '',
+    affected: item.affected || '',
+    priority: item.priority || 'medium',
+    status: item.status || 'scheduled',
+    field: item.field || 'minor',
+    created_by: item.created_by || '',
+    assigned_users: assignedUsers,
+    notify_subscribers: item.notify_subscribers || 'no',
+    notification_channel_id: item.notification_channel_id || '',
+    notification_id: item.notification_id || '',
+    operational_status_id: item.operational_status_id || '',
+    created: item.created || '',
+    updated: item.updated || '',
+    ...expandData
+  };
+};
+
+// Utility function to convert maintenance status to display format
+export const formatMaintenanceStatus = (status: string): string => {
+  if (!status) return 'Unknown';
+  
+  // Convert to lowercase and replace underscores with spaces
+  const formattedStatus = status.toLowerCase().replace('_', ' ');
+  
+  // Capitalize first letter
+  return formattedStatus.charAt(0).toUpperCase() + formattedStatus.slice(1);
+};
+
+// Get appropriate color class based on status
+export const getStatusColorClass = (status: string): string => {
+  const statusLower = status?.toLowerCase() || '';
+  
+  switch (statusLower) {
+    case 'scheduled':
+      return 'bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-300';
+    case 'in_progress':
+    case 'in progress':
+      return 'bg-yellow-100 text-yellow-800 dark:bg-yellow-900 dark:text-yellow-300';
+    case 'completed':
+      return 'bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-300';
+    case 'cancelled':
+      return 'bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-300';
+    default:
+      return 'bg-gray-100 text-gray-800 dark:bg-gray-800 dark:text-gray-300';
+  }
+};
+
+// Get appropriate badge variant based on priority
+export const getPriorityVariant = (priority: string): 'default' | 'destructive' | 'outline' | 'secondary' => {
+  const priorityLower = priority?.toLowerCase() || '';
+  
+  switch (priorityLower) {
+    case 'high':
+      return 'destructive';
+    case 'medium':
+      return 'default';
+    case 'low':
+      return 'secondary';
+    default:
+      return 'outline';
+  }
+};
+
+// Categorize maintenance records into upcoming, ongoing, and completed
+export const categorizeMaintenance = (maintenanceRecords: MaintenanceItem[]) => {
+  const currentDate = new Date();
+  const upcoming: MaintenanceItem[] = [];
+  const ongoing: MaintenanceItem[] = [];
+  const completed: MaintenanceItem[] = [];
+  
+  maintenanceRecords.forEach(item => {
+    const status = item.status?.toLowerCase() || '';
+    const startTime = new Date(item.start_time);
+    const endTime = new Date(item.end_time);
+    
+    if (status === 'completed' || status === 'cancelled') {
+      completed.push(item);
+    } else if (status === 'in_progress' || 
+              (status === 'scheduled' && startTime <= currentDate && endTime >= currentDate)) {
+      ongoing.push(item);
+    } else if (status === 'scheduled' && startTime > currentDate) {
+      upcoming.push(item);
+    } else {
+      // Default case: treat as upcoming if we can't determine
+      upcoming.push(item);
+    }
+  });
+  
+  return { upcoming, ongoing, completed };
+};
diff --git a/application/src/services/maintenance/pdf/generator.ts b/application/src/services/maintenance/pdf/generator.ts
new file mode 100644
index 0000000..6ef4fef
--- /dev/null
+++ b/application/src/services/maintenance/pdf/generator.ts
@@ -0,0 +1,91 @@
+
+import jsPDF from 'jspdf';
+import 'jspdf-autotable'; 
+import { format } from 'date-fns';
+import { MaintenanceItem } from '../../types/maintenance.types';
+import { addHeader, addFooter } from './headerFooter';
+import { 
+  addDescriptionSection, 
+  addScheduleSection, 
+  addAffectedServicesSection, 
+  addPersonnelSection 
+} from './sections';
+
+// Function to generate a professional PDF from maintenance record
+export const generatePdf = async (maintenance: MaintenanceItem): Promise<string> => {
+  try {
+    // Validate maintenance data
+    if (!maintenance?.id) {
+      console.error('Invalid maintenance data for PDF generation');
+      throw new Error('Invalid maintenance data');
+    }
+    
+    // Create a new PDF document
+    const doc = new jsPDF({
+      orientation: 'portrait',
+      unit: 'mm',
+      format: 'a4'
+    });
+    
+    // Add header with title and metadata
+    addHeader(doc, maintenance);
+    
+    // Start rendering content from this position
+    let yPos = 55;
+    
+    // Add description section
+    yPos = addDescriptionSection(doc, maintenance, yPos);
+    
+    // Check if we need to add a new page
+    if (yPos > 250) {
+      doc.addPage();
+      yPos = 20;
+    }
+    
+    // Add schedule information
+    yPos = addScheduleSection(doc, maintenance, yPos);
+    
+    // Check if we need to add a new page
+    if (yPos > 250) {
+      doc.addPage();
+      yPos = 20;
+    }
+    
+    // Add affected services section
+    yPos = addAffectedServicesSection(doc, maintenance, yPos);
+    
+    // Check if we need to add a new page
+    if (yPos > 250) {
+      doc.addPage();
+      yPos = 20;
+    }
+    
+    // Add personnel information section
+    addPersonnelSection(doc, maintenance, yPos);
+    
+    // Add footer to all pages
+    addFooter(doc);
+    
+    // Generate filename
+    const fileName = `maintenance-${maintenance.id}-${format(new Date(), 'yyyy-MM-dd')}.pdf`;
+    
+    // Create blob and URL for download
+    const pdfOutput = doc.output('blob');
+    const blobUrl = URL.createObjectURL(new Blob([pdfOutput], { type: 'application/pdf' }));
+    
+    // Trigger download using a technique that works in most browsers
+    const downloadLink = document.createElement('a');
+    downloadLink.href = blobUrl;
+    downloadLink.download = fileName;
+    downloadLink.style.display = 'none';
+    document.body.appendChild(downloadLink);
+    downloadLink.click();
+    document.body.removeChild(downloadLink);
+    
+    console.log('PDF generated successfully:', fileName);
+    return fileName;
+  } catch (error) {
+    console.error('Error generating maintenance PDF:', error);
+    throw new Error(`Failed to generate PDF: ${error instanceof Error ? error.message : 'Unknown error'}`);
+  }
+};
diff --git a/application/src/services/maintenance/pdf/headerFooter.ts b/application/src/services/maintenance/pdf/headerFooter.ts
new file mode 100644
index 0000000..a72f0a0
--- /dev/null
+++ b/application/src/services/maintenance/pdf/headerFooter.ts
@@ -0,0 +1,90 @@
+
+import jsPDF from 'jspdf';
+import { MaintenanceItem } from '../../types/maintenance.types';
+import { format } from 'date-fns';
+
+/**
+ * Add header with title and branding to the maintenance PDF
+ */
+export const addHeader = (doc: jsPDF, maintenance: MaintenanceItem): void => {
+  // Add colored header background
+  doc.setFillColor(30, 64, 175); // Blue-800 color
+  doc.rect(0, 0, 210, 35, 'F');
+  
+  // Add title
+  doc.setFontSize(22);
+  doc.setTextColor(255, 255, 255); // White text
+  doc.text('Scheduled Maintenance Report', 15, 15);
+  
+  // Add maintenance title
+  doc.setFontSize(12);
+  doc.text(maintenance.title || 'Maintenance Report', 15, 22);
+  
+  // Add reference ID
+  doc.setFontSize(9);
+  doc.setTextColor(219, 234, 254); // Blue-100 text
+  doc.text(`Reference ID: ${maintenance.id}`, 15, 28);
+  
+  // Add current date
+  doc.text(`Generated on: ${format(new Date(), 'PPP')}`, 140, 28, {
+    align: 'right'
+  });
+  
+  // Add status badge area below the header
+  doc.setFillColor(249, 250, 251); // Gray-50
+  doc.rect(0, 35, 210, 12, 'F');
+  
+  // Add status info
+  doc.setFontSize(10);
+  doc.setTextColor(0, 0, 0);
+  const statusText = `Status: ${maintenance.status || 'N/A'} | Priority: ${maintenance.priority || 'N/A'} | Impact: ${maintenance.field || 'N/A'}`;
+  doc.text(statusText, 105, 43, { align: 'center' });
+};
+
+/**
+ * Add footer to all pages of the PDF
+ */
+export const addFooter = (doc: jsPDF): void => {
+  // Add footer with blue background
+  doc.setFillColor(30, 64, 175); // Blue-800 for footer background
+  doc.rect(0, 277, 210, 20, 'F');
+  
+  // Get total page count
+  const totalPages = doc.getNumberOfPages();
+  
+  // Add footer to each page
+  for (let i = 1; i <= totalPages; i++) {
+    doc.setPage(i);
+    
+    // Add page number
+    doc.setFontSize(8);
+    doc.setTextColor(255, 255, 255); // White text for page numbers
+    doc.text(
+      `Page ${i} of ${totalPages}`,
+      195,
+      10,
+      { align: 'right' }
+    );
+    
+    // Add footer text with white color
+    doc.setFontSize(8);
+    doc.setTextColor(255, 255, 255); // White text for footer
+    doc.text(
+      `Maintenance ID: ${i === 1 ? doc.getTextWidth('Maintenance ID: ') : ''}`,
+      15,
+      283
+    );
+    doc.text(
+      `Generated on ${format(new Date(), 'PPP')}`,
+      195,
+      283,
+      { align: 'right' }
+    );
+    doc.text(
+      'This document is confidential and intended for internal use only.',
+      105,
+      290,
+      { align: 'center' }
+    );
+  }
+};
diff --git a/application/src/services/maintenance/pdf/index.ts b/application/src/services/maintenance/pdf/index.ts
new file mode 100644
index 0000000..3c4a621
--- /dev/null
+++ b/application/src/services/maintenance/pdf/index.ts
@@ -0,0 +1,16 @@
+
+import { generatePdf } from './generator';
+import { MaintenanceItem } from '../../types/maintenance.types';
+
+/**
+ * Generate and download PDF for maintenance report
+ */
+export const generateMaintenancePDF = async (maintenance: MaintenanceItem): Promise<string> => {
+  try {
+    const filename = await generatePdf(maintenance);
+    return filename;
+  } catch (error) {
+    console.error("Error in generateMaintenancePDF:", error);
+    throw error;
+  }
+};
diff --git a/application/src/services/maintenance/pdf/sections.ts b/application/src/services/maintenance/pdf/sections.ts
new file mode 100644
index 0000000..97884a6
--- /dev/null
+++ b/application/src/services/maintenance/pdf/sections.ts
@@ -0,0 +1,164 @@
+
+import jsPDF from 'jspdf';
+import autoTable from 'jspdf-autotable';
+import { MaintenanceItem } from '../../types/maintenance.types';
+import { formatDate, calculateDuration } from './utils';
+
+/**
+ * Add description section to the PDF
+ */
+export const addDescriptionSection = (doc: jsPDF, maintenance: MaintenanceItem, yPos: number): number => {
+  // Add section title
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800 color for headings
+  doc.text('Description', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.setDrawColor(30, 64, 175); // Blue-800
+  doc.setLineWidth(0.5);
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Handle multi-line description with word wrapping
+  const description = maintenance.description || 'No description provided';
+  const splitDescription = doc.splitTextToSize(description, 180);
+  
+  // Add description text
+  doc.setFontSize(10);
+  doc.setTextColor(0, 0, 0); // Reset text color
+  doc.text(splitDescription, 15, yPos + 10);
+  
+  // Return new Y position after the description text
+  return yPos + 15 + (splitDescription.length * 5);
+};
+
+/**
+ * Add schedule information section to the PDF
+ */
+export const addScheduleSection = (doc: jsPDF, maintenance: MaintenanceItem, yPos: number): number => {
+  // Add section title
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Schedule Information', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.setDrawColor(30, 64, 175); // Blue-800
+  doc.setLineWidth(0.5);
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Create schedule data table
+  autoTable(doc, {
+    startY: yPos + 10,
+    head: [['Start Time', 'End Time', 'Duration']],
+    body: [
+      [
+        formatDate(maintenance.start_time),
+        formatDate(maintenance.end_time),
+        calculateDuration(maintenance.start_time, maintenance.end_time)
+      ]
+    ],
+    theme: 'striped',
+    headStyles: {
+      fillColor: [30, 64, 175], // Blue-800
+      textColor: 255,
+      fontStyle: 'bold'
+    },
+    margin: { left: 15, right: 15 }
+  });
+  
+  // Return next Y position
+  return (doc as any).lastAutoTable.finalY + 15;
+};
+
+/**
+ * Add affected services section to the PDF
+ */
+export const addAffectedServicesSection = (doc: jsPDF, maintenance: MaintenanceItem, yPos: number): number => {
+  // Add section title
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Affected Services', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.setDrawColor(30, 64, 175); // Blue-800
+  doc.setLineWidth(0.5);
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Safely handle affected services string
+  const affectedServices = typeof maintenance.affected === 'string' && maintenance.affected.trim() !== ''
+    ? maintenance.affected.split(',').map(item => [item.trim()])
+    : [];
+  
+  if (affectedServices.length > 0) {
+    autoTable(doc, {
+      startY: yPos + 10,
+      head: [['Service Name']],
+      body: affectedServices,
+      theme: 'striped',
+      headStyles: {
+        fillColor: [30, 64, 175], // Blue-800
+        textColor: 255,
+        fontStyle: 'bold'
+      },
+      margin: { left: 15, right: 15 }
+    });
+    return (doc as any).lastAutoTable.finalY + 15;
+  } else {
+    doc.setFontSize(10);
+    doc.setTextColor(0, 0, 0);
+    doc.text('No affected services specified', 15, yPos + 10);
+    return yPos + 25;
+  }
+};
+
+/**
+ * Add personnel information section to the PDF
+ */
+export const addPersonnelSection = (doc: jsPDF, maintenance: MaintenanceItem, yPos: number): number => {
+  // Add section title
+  doc.setFontSize(14);
+  doc.setTextColor(30, 64, 175); // Blue-800
+  doc.text('Personnel Information', 15, yPos);
+  
+  // Draw a line under the heading
+  doc.setDrawColor(30, 64, 175); // Blue-800
+  doc.setLineWidth(0.5);
+  doc.line(15, yPos + 2, 195, yPos + 2);
+  
+  // Process assigned users for the table safely
+  let assignedUsersText = 'None';
+  if (maintenance.assigned_users) {
+    // Handle both string and array formats for assigned_users
+    const assignedUsersList = Array.isArray(maintenance.assigned_users)
+      ? maintenance.assigned_users
+      : (typeof maintenance.assigned_users === 'string' 
+          ? maintenance.assigned_users.split(',').map(item => item.trim())
+          : []);
+    
+    assignedUsersText = assignedUsersList.length > 0 
+      ? assignedUsersList.join(', ') 
+      : 'None';
+  }
+  
+  // Create personnel data table
+  autoTable(doc, {
+    startY: yPos + 10,
+    head: [['Created By', 'Assigned Personnel', 'Notifications']],
+    body: [
+      [
+        maintenance.created_by || 'Not specified',
+        assignedUsersText,
+        maintenance.notify_subscribers === 'yes' ? 'Enabled' : 'Disabled'
+      ]
+    ],
+    theme: 'striped',
+    headStyles: {
+      fillColor: [30, 64, 175], // Blue-800
+      textColor: 255,
+      fontStyle: 'bold'
+    },
+    margin: { left: 15, right: 15 }
+  });
+  
+  // Return next Y position
+  return (doc as any).lastAutoTable.finalY + 15;
+};
diff --git a/application/src/services/maintenance/pdf/utils.ts b/application/src/services/maintenance/pdf/utils.ts
new file mode 100644
index 0000000..7bd5720
--- /dev/null
+++ b/application/src/services/maintenance/pdf/utils.ts
@@ -0,0 +1,50 @@
+
+import { format } from 'date-fns';
+
+// Font configuration for the PDF
+export const fonts = {
+  normal: 'Helvetica',
+  bold: 'Helvetica-Bold',
+  italic: 'Helvetica-Oblique',
+};
+
+// Helper function to format dates
+export const formatDate = (dateString: string | undefined): string => {
+  if (!dateString) return 'N/A';
+  try {
+    return format(new Date(dateString), 'PPp');
+  } catch (e) {
+    return dateString || 'N/A';
+  }
+};
+
+// Helper function to calculate duration between two dates
+export const calculateDuration = (start: string, end: string): string => {
+  try {
+    if (!start || !end) return 'N/A';
+    
+    const startTime = new Date(start);
+    const endTime = new Date(end);
+    
+    // Validate dates
+    if (isNaN(startTime.getTime()) || isNaN(endTime.getTime())) {
+      return 'N/A';
+    }
+    
+    const durationMs = endTime.getTime() - startTime.getTime();
+    
+    // Check for negative duration
+    if (durationMs < 0) {
+      return 'Invalid date range';
+    }
+    
+    // Convert to hours and minutes
+    const hours = Math.floor(durationMs / (1000 * 60 * 60));
+    const minutes = Math.floor((durationMs % (1000 * 60 * 60)) / (1000 * 60));
+    
+    return `${hours}h ${minutes}m`;
+  } catch (error) {
+    console.error('Error calculating duration:', error);
+    return "N/A";
+  }
+};
diff --git a/application/src/services/maintenanceService.ts b/application/src/services/maintenanceService.ts
new file mode 100644
index 0000000..feccc2a
--- /dev/null
+++ b/application/src/services/maintenanceService.ts
@@ -0,0 +1,182 @@
+
+import { pb, getCurrentEndpoint } from '@/lib/pocketbase';
+import { MaintenanceItem, CreateMaintenanceInput } from './types/maintenance.types';
+
+// Helper function to get the API URL
+const getApiUrl = (): string => {
+  return getCurrentEndpoint();
+};
+
+// Helper function to normalize maintenance items
+const normalizeMaintenanceItem = (item: any): MaintenanceItem => {
+  return {
+    ...item,
+    id: item.id || '',
+    title: item.title || '',
+    description: item.description || '',
+    status: item.status || 'Scheduled',
+    affected: item.affected || '',
+    priority: item.priority || 'Medium',
+    field: item.field || 'Minor',
+  } as MaintenanceItem;
+};
+
+const getMaintenanceRecords = async (): Promise<MaintenanceItem[]> => {
+  try {
+    // Use a unique requestKey to prevent caching issues
+    const timestamp = new Date().getTime();
+    
+    console.log("Fetching maintenance records from API...");
+    
+    // Increase items per page to ensure we get all records
+    const result = await pb.collection('maintenance').getList(1, 200, {
+      sort: '-created',
+      requestKey: `maintenance-${timestamp}`,
+    });
+    
+    console.log("Maintenance API response:", result);
+    
+    if (!result || !result.items || result.items.length === 0) {
+      console.log("No maintenance records found");
+      return [];
+    }
+    
+    return result.items.map(normalizeMaintenanceItem);
+  } catch (error) {
+    // Handle abort errors gracefully without console errors
+    if ((error as any)?.isAbort) {
+      console.log("Request aborted:", error);
+      return [];
+    }
+    
+    console.error('Error fetching maintenance records:', error);
+    // Return empty array instead of throwing to prevent UI crashes
+    return [];
+  }
+};
+
+const getUpcomingMaintenance = async (): Promise<MaintenanceItem[]> => {
+  try {
+    const allRecords = await getMaintenanceRecords();
+    const currentDate = new Date();
+    
+    // Filter for upcoming maintenance
+    const upcomingItems = allRecords.filter(item => {
+      const status = item.status?.toLowerCase() || '';
+      const startTime = new Date(item.start_time);
+      
+      return (status === 'scheduled' && startTime > currentDate);
+    });
+    
+    return upcomingItems;
+  } catch (error) {
+    console.error('Error fetching upcoming maintenance:', error);
+    return [];
+  }
+};
+
+const getOngoingMaintenance = async (): Promise<MaintenanceItem[]> => {
+  try {
+    const allRecords = await getMaintenanceRecords();
+    const currentDate = new Date();
+    
+    // Filter for ongoing maintenance
+    const ongoingItems = allRecords.filter(item => {
+      const status = item.status?.toLowerCase() || '';
+      const startTime = new Date(item.start_time);
+      const endTime = new Date(item.end_time);
+      
+      return status === 'in_progress' || 
+             (status === 'scheduled' && startTime <= currentDate && endTime >= currentDate);
+    });
+    
+    return ongoingItems;
+  } catch (error) {
+    console.error('Error fetching ongoing maintenance:', error);
+    return [];
+  }
+};
+
+const getCompletedMaintenance = async (): Promise<MaintenanceItem[]> => {
+  try {
+    const allRecords = await getMaintenanceRecords();
+    
+    // Filter for completed maintenance
+    const completedItems = allRecords.filter(item => {
+      const status = item.status?.toLowerCase() || '';
+      return status === 'completed' || status === 'cancelled';
+    });
+    
+    return completedItems;
+  } catch (error) {
+    console.error('Error fetching completed maintenance:', error);
+    return [];
+  }
+};
+
+const updateMaintenanceStatus = async (id: string, status: string): Promise<void> => {
+  try {
+    // Ensure proper case for the status value
+    const formattedStatus = status.charAt(0).toUpperCase() + status.slice(1);
+    await pb.collection('maintenance').update(id, { status: formattedStatus });
+  } catch (error) {
+    console.error('Error updating maintenance status:', error);
+    throw error;
+  }
+};
+
+const deleteMaintenance = async (id: string): Promise<void> => {
+  try {
+    await pb.collection('maintenance').delete(id);
+  } catch (error) {
+    console.error('Error deleting maintenance:', error);
+    throw error;
+  }
+};
+
+const createMaintenance = async (data: CreateMaintenanceInput): Promise<void> => {
+  try {
+    // Validate that all required fields are present
+    if (!data.title || !data.description || !data.start_time || !data.end_time || 
+        !data.affected || !data.priority || !data.status || !data.field) {
+      throw new Error("Missing required fields for maintenance creation");
+    }
+    
+    // Format the payload according to API requirements
+    const payload = {
+      title: data.title,
+      description: data.description,
+      start_time: data.start_time,
+      end_time: data.end_time,
+      affected: data.affected,
+      priority: data.priority.charAt(0).toUpperCase() + data.priority.slice(1),
+      status: data.status.charAt(0).toUpperCase() + data.status.slice(1),
+      field: data.field.charAt(0).toUpperCase() + data.field.slice(1),
+      created_by: data.created_by,
+      notify_subscribers: data.notify_subscribers,
+      assigned_users: data.assigned_users || "",
+      notification_channel_id: data.notification_channel_id || "",
+    };
+    
+    await pb.collection('maintenance').create(payload);
+  } catch (error) {
+    console.error('Error creating maintenance:', error);
+    if (error instanceof Error) {
+      console.error('Error details:', error.message);
+    }
+    throw error;
+  }
+};
+
+export const maintenanceService = {
+  getApiUrl,
+  getMaintenanceRecords,
+  getUpcomingMaintenance,
+  getOngoingMaintenance,
+  getCompletedMaintenance,
+  updateMaintenanceStatus,
+  deleteMaintenance,
+  createMaintenance,
+};
+
+// No need to re-export types here as they are now imported from maintenance.types.ts
diff --git a/application/src/services/monitoring/handlers/serviceStatusHandlers.ts b/application/src/services/monitoring/handlers/serviceStatusHandlers.ts
new file mode 100644
index 0000000..4575772
--- /dev/null
+++ b/application/src/services/monitoring/handlers/serviceStatusHandlers.ts
@@ -0,0 +1,107 @@
+
+import { pb } from '@/lib/pocketbase';
+import { uptimeService } from '@/services/uptimeService';
+import { prepareServiceForNotification } from '../utils/httpUtils';
+import { UptimeData } from '@/types/service.types';
+
+/**
+ * Handle a service that is determined to be UP
+ */
+export async function handleServiceUp(service: any, responseTime: number, formattedTime: string): Promise<void> {
+ // console.log(`Service ${service.name} is UP! Response time: ${responseTime}ms`);
+  
+  // Create a history record of this check with a more accurate timestamp
+  const uptimeData: UptimeData = {
+    service_id: service.id, // Include service_id
+    serviceId: service.id, // Keep for backward compatibility
+    timestamp: new Date().toISOString(),
+    status: "up",
+    responseTime: responseTime,
+    // Include required properties from the UptimeData interface
+    date: new Date().toISOString(),
+    uptime: 100
+  };
+  
+  const previousStatus = service.status;
+  const statusChanged = previousStatus !== "up" && previousStatus !== "paused";
+  
+  try {
+    // Run service status update
+    await pb.collection('services').update(service.id, {
+      last_checked: formattedTime,
+      response_time: responseTime,
+      status: "up",
+      // Calculate uptime percentage based on previous checks (simple moving average)
+      uptime: service.uptime ? 
+        (service.uptime * 0.9 + 100 * 0.1) : 100,
+    });
+    
+    // Try to record uptime data, with retry logic
+    try {
+      await uptimeService.recordUptimeData(uptimeData);
+    } catch (error) {
+     // console.error("Failed to record uptime data on first try, retrying...", error);
+      // Wait a short time and retry once
+      await new Promise(resolve => setTimeout(resolve, 1000));
+      await uptimeService.recordUptimeData(uptimeData);
+    }
+    
+    // Status change logging (notification logic removed - will be handled by backend)
+    if (statusChanged) {
+     // console.log(`Status changed from ${previousStatus} to UP - notification will be handled by backend`);
+    }
+  } catch (error) {
+  //  console.error("Error handling service UP state:", error);
+  }
+}
+
+/**
+ * Handle a service that is determined to be DOWN
+ */
+export async function handleServiceDown(service: any, formattedTime: string): Promise<void> {
+ // console.log(`Service ${service.name} is DOWN!`);
+  
+  // Create a history record of this check
+  const uptimeData: UptimeData = {
+    service_id: service.id, // Include service_id
+    serviceId: service.id, // Keep for backward compatibility
+    timestamp: new Date().toISOString(),
+    status: "down",
+    responseTime: 0,
+    // Include required properties from the UptimeData interface
+    date: new Date().toISOString(),
+    uptime: 0
+  };
+  
+  const previousStatus = service.status;
+  const statusChanged = previousStatus !== "down";
+  
+ // console.log(`Service ${service.name} previous status: ${previousStatus}, statusChanged: ${statusChanged}`);
+  
+  try {
+    // Update service status
+    await pb.collection('services').update(service.id, {
+      last_checked: formattedTime,
+      response_time: 0,
+      status: "down",
+      // Calculate uptime percentage based on previous checks
+      uptime: service.uptime ? 
+        (service.uptime * 0.9 + 0 * 0.1) : 0,
+    });
+    
+    // Try to record uptime data with retry logic
+    try {
+      await uptimeService.recordUptimeData(uptimeData);
+    } catch (error) {
+    //  console.error("Failed to record uptime data on first try, retrying...", error);
+      // Wait a short time and retry once
+      await new Promise(resolve => setTimeout(resolve, 1000));
+      await uptimeService.recordUptimeData(uptimeData);
+    }
+    
+    // Status change logging (notification logic removed - will be handled by backend)
+   // console.log("Service DOWN status recorded - notification will be handled by backend");
+  } catch (error) {
+   // console.error("Error handling service DOWN state:", error);
+  }
+}
\ No newline at end of file
diff --git a/application/src/services/monitoring/httpChecker.ts b/application/src/services/monitoring/httpChecker.ts
new file mode 100644
index 0000000..02472d6
--- /dev/null
+++ b/application/src/services/monitoring/httpChecker.ts
@@ -0,0 +1,87 @@
+
+import { pb } from '@/lib/pocketbase';
+import { formatCurrentTime, makeHttpRequest } from './utils/httpUtils';
+import { handleServiceUp, handleServiceDown } from './handlers/serviceStatusHandlers';
+import { notificationService } from '@/services/notificationService';
+
+/**
+ * Check the status of an HTTP service
+ */
+export async function checkHttpService(serviceId: string): Promise<void> {
+  try {
+    // Fetch the service record from PocketBase
+    const service = await pb.collection('services').getOne(serviceId);
+    
+    if (!service) {
+      console.log(`Service with ID ${serviceId} not found`);
+      return;
+    }
+    
+    // Use the URL directly if provided, or construct from host
+    const serviceUrl = service.url || (service.host ? `https://${service.host}` : null);
+    
+    if (!serviceUrl) {
+      console.log(`No valid URL or host for service ID: ${serviceId}`);
+      return;
+    }
+    
+    // Format the current timestamp for display
+    const formattedTime = formatCurrentTime();
+    
+    console.log(`===============================================`);
+    console.log(`Starting HTTP service check: ${service.name} (${service.id})`);
+    console.log(`URL: ${serviceUrl}`);
+    console.log(`Current Status: ${service.status}`);
+    console.log(`Mute Alerts: ${service.mute_alerts || service.muteAlerts ? "YES" : "NO"}`);
+    console.log(`Time: ${formattedTime}`);
+    
+    // Use high resolution timer for more accurate response time measurement
+    const startTime = performance.now();
+    const maxRetries = service.max_retries || 3;
+    
+    // Make the request with improved retry logic
+    const { isUp, responseTime } = await makeHttpRequest(serviceUrl, maxRetries);
+    
+    console.log(`Service ${service.name} check result: ${isUp ? 'UP' : 'DOWN'}, responseTime: ${responseTime}ms`);
+    
+    // Handle service status based on check result
+    if (isUp) {
+      await handleServiceUp(service, responseTime, formattedTime);
+    } else {
+      await handleServiceDown(service, formattedTime);
+    }
+    
+    console.log(`Uptime data recorded for ${service.name}`);
+    console.log(`===============================================`);
+  } catch (error) {
+    console.error("Error in HTTP service monitoring:", error);
+  }
+}
+
+/**
+ * Force test the notification system with a specified service ID and status
+ */
+export async function testServiceNotification(serviceId: string, status: "up" | "down"): Promise<void> {
+  try {
+    // Fetch the service
+    const service = await pb.collection('services').getOne(serviceId);
+    
+    if (!service) {
+      console.error(`Service with ID ${serviceId} not found for test notification`);
+      return;
+    }
+    
+    console.log(`Sending test ${status.toUpperCase()} notification for service ${service.name}`);
+    
+    // Send a test notification
+    const message = status === "up" 
+      ? `🟢 Test notification: Service ${service.name} is UP` 
+      : `🔴 Test notification: Service ${service.name} is DOWN`;
+    
+    // Removed the actual test notification sending
+    console.log(`Test notification prepared for service ${service.name}, status: ${status}`);
+    // To manually test notifications, use the UI instead
+  } catch (error) {
+    console.error("Error preparing test notification:", error);
+  }
+}
diff --git a/application/src/services/monitoring/index.ts b/application/src/services/monitoring/index.ts
new file mode 100644
index 0000000..2e36988
--- /dev/null
+++ b/application/src/services/monitoring/index.ts
@@ -0,0 +1,15 @@
+
+import { monitoringIntervals } from './monitoringIntervals';
+import { 
+  startMonitoringService, 
+  pauseMonitoring, 
+  resumeMonitoring, 
+  startAllActiveServices 
+} from './service-status';
+
+export const monitoringService = {
+  startMonitoringService,
+  pauseMonitoring,
+  resumeMonitoring,
+  startAllActiveServices
+};
\ No newline at end of file
diff --git a/application/src/services/monitoring/monitoringIntervals.ts b/application/src/services/monitoring/monitoringIntervals.ts
new file mode 100644
index 0000000..fc71f08
--- /dev/null
+++ b/application/src/services/monitoring/monitoringIntervals.ts
@@ -0,0 +1,4 @@
+// Map to keep track of monitoring intervals by service ID
+const monitoringIntervals = new Map<string, number>();
+
+export { monitoringIntervals };
diff --git a/application/src/services/monitoring/service-status/index.ts b/application/src/services/monitoring/service-status/index.ts
new file mode 100644
index 0000000..b1e1060
--- /dev/null
+++ b/application/src/services/monitoring/service-status/index.ts
@@ -0,0 +1,13 @@
+
+import { startMonitoringService } from './startMonitoring';
+import { resumeMonitoring } from './resumeMonitoring';
+import { pauseMonitoring } from './pauseMonitoring';
+import { startAllActiveServices } from './startAllServices';
+
+// Export all service monitoring control functions
+export {
+  startMonitoringService,
+  resumeMonitoring,
+  pauseMonitoring,
+  startAllActiveServices
+};
diff --git a/application/src/services/monitoring/service-status/pauseMonitoring.ts b/application/src/services/monitoring/service-status/pauseMonitoring.ts
new file mode 100644
index 0000000..9fac22e
--- /dev/null
+++ b/application/src/services/monitoring/service-status/pauseMonitoring.ts
@@ -0,0 +1,38 @@
+
+import { pb } from '@/lib/pocketbase';
+import { monitoringIntervals } from '../monitoringIntervals';
+import { Service } from '@/types/service.types';
+
+/**
+ * Pause monitoring for a specific service
+ */
+export async function pauseMonitoring(serviceId: string): Promise<void> {
+  try {
+    // Clear the monitoring interval if it exists
+    const intervalId = monitoringIntervals.get(serviceId);
+    if (intervalId) {
+      clearInterval(intervalId);
+      monitoringIntervals.delete(serviceId);
+     // console.log(`Monitoring paused for service ${serviceId}`);
+    }
+    
+    // Get current timestamp formatted as a string
+    const now = new Date().toISOString();
+    
+    // Fetch the current service to get its name for better logging
+    const service = await pb.collection('services').getOne(serviceId);
+    
+    // Update the service status to paused and store the exact pause time
+    await pb.collection('services').update(serviceId, {
+      status: "paused",
+      lastChecked: now,
+      last_checked: now  // Ensure both field names are updated
+    });
+    
+    // We'll skip the notification here since it will be handled by the UI component
+    // This prevents duplicate notifications for the paused status
+   // console.log(`Service ${service.name} paused at ${now}, skipping notification to prevent duplication`);
+  } catch (error) {
+   // console.error("Error pausing monitoring:", error);
+  }
+}
diff --git a/application/src/services/monitoring/service-status/resumeMonitoring.ts b/application/src/services/monitoring/service-status/resumeMonitoring.ts
new file mode 100644
index 0000000..e32603d
--- /dev/null
+++ b/application/src/services/monitoring/service-status/resumeMonitoring.ts
@@ -0,0 +1,44 @@
+
+import { pb } from '@/lib/pocketbase';
+import { monitoringIntervals } from '../monitoringIntervals';
+import { Service } from '@/types/service.types';
+import { startMonitoringService } from './startMonitoring';
+
+/**
+ * Specifically resume a paused service
+ */
+export async function resumeMonitoring(serviceId: string): Promise<void> {
+  try {
+    // Get current timestamp formatted as a string
+    const now = new Date().toISOString();
+    
+    // Fetch the current service to get its name for better logging
+    const service = await pb.collection('services').getOne(serviceId);
+    
+  //  console.log(`Resuming service ${service.name} at ${now}`);
+    
+    // First, clear any existing interval just to be safe
+    const existingInterval = monitoringIntervals.get(serviceId);
+    if (existingInterval) {
+      clearInterval(existingInterval);
+      monitoringIntervals.delete(serviceId);
+    }
+    
+    // Update the service status to "up" in the database
+    await pb.collection('services').update(serviceId, {
+      status: "up",
+      lastChecked: now,
+      last_checked: now
+    });
+    
+    // IMPORTANT: Wait a brief moment to ensure the status update is processed
+    await new Promise(resolve => setTimeout(resolve, 500));
+    
+    // Now start the service monitoring with a clean slate
+    await startMonitoringService(serviceId);
+    
+   // console.log(`Service ${service.name} resumed and ready for monitoring`);
+  } catch (error) {
+   // console.error("Error resuming service:", error);
+  }
+}
\ No newline at end of file
diff --git a/application/src/services/monitoring/service-status/startAllServices.ts b/application/src/services/monitoring/service-status/startAllServices.ts
new file mode 100644
index 0000000..51334ec
--- /dev/null
+++ b/application/src/services/monitoring/service-status/startAllServices.ts
@@ -0,0 +1,24 @@
+
+import { pb } from '@/lib/pocketbase';
+import { startMonitoringService } from './startMonitoring';
+
+/**
+ * Start monitoring for all active services
+ */
+export async function startAllActiveServices(): Promise<void> {
+  try {
+    // Get all services that are not paused
+    const result = await pb.collection('services').getList(1, 100, {
+      filter: 'status != "paused"'
+    });
+    
+   // console.log(`Starting monitoring for ${result.items.length} active services`);
+    
+    // Start monitoring each active service
+    for (const service of result.items) {
+      await startMonitoringService(service.id);
+    }
+  } catch (error) {
+  //  console.error("Error starting all active services:", error);
+  }
+}
diff --git a/application/src/services/monitoring/service-status/startMonitoring.ts b/application/src/services/monitoring/service-status/startMonitoring.ts
new file mode 100644
index 0000000..5cfb9e8
--- /dev/null
+++ b/application/src/services/monitoring/service-status/startMonitoring.ts
@@ -0,0 +1,53 @@
+
+import { pb } from '@/lib/pocketbase';
+import { monitoringIntervals } from '../monitoringIntervals';
+
+/**
+ * Start monitoring for a specific service with optimized performance
+ */
+export async function startMonitoringService(serviceId: string): Promise<void> {
+  try {
+    // First check if the service is already being monitored
+    if (monitoringIntervals.has(serviceId)) {
+    //  console.log(`Service ${serviceId} is already being monitored`);
+      return;
+    }
+    
+    // Fetch the service to get its current configuration
+    const service = await pb.collection('services').getOne(serviceId);
+    
+    // If service was manually paused, don't auto-resume
+    if (service.status === "paused") {
+    //  console.log(`Service ${serviceId} (${service.name}) is paused. Not starting monitoring.`);
+      return;
+    }
+    
+   // console.log(`Starting optimized monitoring for service ${serviceId} (${service.name})`);
+    
+    // Update the service status to active/up in the database
+    await pb.collection('services').update(serviceId, {
+      status: "up",
+    });
+    
+    // The actual service checking is now handled by the Go microservice
+    // This frontend service just tracks the monitoring state with much less frequency
+    const intervalMs = Math.max((service.heartbeat_interval || 60) * 1000, 60000); // Minimum 1 minute
+   // console.log(`Service ${service.name} monitoring delegated to backend service with interval ${intervalMs}ms`);
+    
+    // Store a placeholder interval to track that this service is being monitored
+    // Significantly reduce frequency to prevent excessive logging and CPU usage
+    const intervalId = window.setInterval(() => {
+      // Only log every 5 minutes to reduce console spam
+      if (Date.now() % (5 * 60 * 1000) < intervalMs) {
+       // console.log(`Monitoring active for service ${service.name} (handled by backend)`);
+      }
+    }, Math.max(intervalMs, 300000)); // Minimum 5 minutes for logging
+    
+    // Store the interval ID for this service
+    monitoringIntervals.set(serviceId, intervalId);
+    
+   // console.log(`Optimized monitoring registered for service ${serviceId}`);
+  } catch (error) {
+   // console.error("Error starting service monitoring:", error);
+  }
+}
\ No newline at end of file
diff --git a/application/src/services/monitoring/utils/httpUtils.ts b/application/src/services/monitoring/utils/httpUtils.ts
new file mode 100644
index 0000000..1987b19
--- /dev/null
+++ b/application/src/services/monitoring/utils/httpUtils.ts
@@ -0,0 +1,60 @@
+
+import { Service } from "@/types/service.types";
+
+/**
+ * Prepare service for notification by converting from PocketBase format to our Service type
+ */
+export function prepareServiceForNotification(pbRecord: any, status: string, responseTime: number = 0): Service {
+  // Extract notification channel and template IDs
+  // Handle both naming conventions for backward compatibility
+  const notificationChannel = pbRecord.notification_id || pbRecord.notificationChannel || null;
+  const alertTemplate = pbRecord.template_id || pbRecord.alertTemplate || null;
+  const muteAlerts = pbRecord.mute_alerts !== undefined ? pbRecord.mute_alerts : 
+                    (pbRecord.muteAlerts !== undefined ? pbRecord.muteAlerts : false);
+  
+  console.log(`Preparing service for notification: ${pbRecord.name}, Mute Alerts: ${muteAlerts ? "YES" : "NO"}`);
+
+  // Return a standardized Service object for notification
+  return {
+    id: pbRecord.id,
+    name: pbRecord.name,
+    url: pbRecord.url,
+    host: pbRecord.host || "", // Include host property with fallback
+    type: pbRecord.type || pbRecord.service_type || "HTTP",
+    status: status as any,
+    responseTime: responseTime,
+    uptime: pbRecord.uptime || 0,
+    lastChecked: new Date().toISOString(),
+    interval: pbRecord.interval || pbRecord.heartbeat_interval || 60,
+    retries: pbRecord.retries || pbRecord.max_retries || 3,
+    notificationChannel,
+    alertTemplate,
+    muteAlerts
+  };
+}
+
+// Utility function to add 'https://' to URLs if they don't have a protocol
+export function ensureHttpsProtocol(url: string): string {
+  // Check if the URL starts with a protocol
+  if (!/^[a-z]+:\/\//i.test(url)) {
+    // If not, prepend https://
+    return `https://${url}`;
+  }
+  return url;
+}
+
+// Utility function to format a PocketBase record ID for display
+export function formatRecordId(id: string): string {
+  if (!id) return '';
+  
+  // Return the first 8 characters followed by '...'
+  return id.length > 8 ? `${id.substring(0, 8)}...` : id;
+}
+
+/**
+ * Format current time for display
+ */
+export function formatCurrentTime(): string {
+  const now = new Date();
+  return now.toISOString();
+}
\ No newline at end of file
diff --git a/application/src/services/monitoring/utils/notificationUtils.ts b/application/src/services/monitoring/utils/notificationUtils.ts
new file mode 100644
index 0000000..71494a5
--- /dev/null
+++ b/application/src/services/monitoring/utils/notificationUtils.ts
@@ -0,0 +1,41 @@
+
+import { pb } from '@/lib/pocketbase';
+import { formatCurrentTime } from './httpUtils';
+
+/**
+ * Records a mute status change for a service in the database
+ * @param serviceId The ID of the service
+ * @param serviceName The name of the service
+ * @param muteStatus The new mute status (true = muted, false = unmuted)
+ * @param userId Optional user ID who performed the action
+ */
+export async function recordMuteStatusChange(
+  serviceId: string, 
+  serviceName: string, 
+  muteStatus: boolean,
+  userId?: string
+): Promise<void> {
+  try {
+    const timestamp = new Date().toISOString();
+    const formattedTime = formatCurrentTime();
+    
+    console.log(`Recording ${muteStatus ? "mute" : "unmute"} status change for service ${serviceName} at ${formattedTime}`);
+    
+    // Update the service record with the correct alerts field value
+    // Use both mute_alerts and alerts fields for backward compatibility
+    const updateData = {
+      mute_changed_at: timestamp,
+      mute_alerts: muteStatus,
+      alerts: muteStatus ? "muted" : "unmuted"  // Use the correct field name as per DB schema
+    };
+    
+    console.log(`Updating service with data: ${JSON.stringify(updateData)}`);
+    
+    await pb.collection('services').update(serviceId, updateData);
+    
+    console.log(`Mute status change recorded for ${serviceName}: ${muteStatus ? "Muted" : "Unmuted"}`);
+  } catch (error) {
+    console.error("Error recording mute status change:", error);
+    throw error; // Rethrow the error to be handled by the caller
+  }
+}
diff --git a/application/src/services/notification/index.ts b/application/src/services/notification/index.ts
new file mode 100644
index 0000000..95cb37f
--- /dev/null
+++ b/application/src/services/notification/index.ts
@@ -0,0 +1,6 @@
+
+// Re-export template processor only
+export { processTemplate, generateDefaultMessage } from './templateProcessor';
+
+// Export types from template services
+export type { AnyTemplate } from '../templateService';
\ No newline at end of file
diff --git a/application/src/services/notification/signalService.ts b/application/src/services/notification/signalService.ts
new file mode 100644
index 0000000..9bee54c
--- /dev/null
+++ b/application/src/services/notification/signalService.ts
@@ -0,0 +1,91 @@
+
+import { toast } from "@/hooks/use-toast";
+import { AlertConfiguration } from "../alertConfigService";
+import api from "@/api";
+
+/**
+ * Send a notification via Signal
+ */
+export async function sendSignalNotification(
+  config: AlertConfiguration, 
+  message: string
+): Promise<boolean> {
+  try {
+    if (!config.signal_number) {
+      console.log("Missing Signal configuration - Signal number:", config.signal_number);
+      toast({
+        title: "Configuration Error",
+        description: "Missing Signal number",
+        variant: "destructive"
+      });
+      return false;
+    }
+
+    console.log("Sending Signal notification to number:", config.signal_number);
+    console.log("Message content:", message);
+    
+    // Prepare payload for the API call
+    const payload = {
+      type: "signal",
+      signalNumber: config.signal_number,
+      message: message
+    };
+    
+    console.log("Prepared payload for Signal notification:", payload);
+    
+    try {
+      // Call our client-side API handler
+      console.log("Sending request to /api/realtime endpoint for Signal");
+      const response = await api.handleRequest('/api/realtime', 'POST', payload);
+
+      console.log("API response status:", response.status);
+      
+      // Check if response is ok
+      if (response.status !== 200) {
+        console.error("Error response from Signal notification API:", response.status);
+        toast({
+          title: "Notification Failed",
+          description: `Server returned error ${response.status}`,
+          variant: "destructive"
+        });
+        return false;
+      }
+      
+      const responseData = response.json;
+      console.log("API response data:", responseData);
+      
+      if (responseData && responseData.ok === false) {
+        console.error("Error sending Signal notification:", responseData);
+        toast({
+          title: "Notification Failed",
+          description: responseData.description || "Failed to send Signal notification",
+          variant: "destructive"
+        });
+        return false;
+      }
+
+      console.log("Signal notification sent successfully");
+      toast({
+        title: "Notification Sent",
+        description: "Signal notification sent successfully"
+      });
+      return true;
+    } catch (error) {
+      console.error("Error calling Signal notification API:", error);
+      toast({
+        title: "API Error",
+        description: `Failed to communicate with Signal notification service: ${error instanceof Error ? error.message : "Network error"}`,
+        variant: "destructive"
+      });
+      return false;
+    }
+  } catch (error) {
+    console.error("Error in sendSignalNotification:", error);
+    toast({
+      title: "Notification Error",
+      description: `Error sending Signal notification: ${error instanceof Error ? error.message : "Unknown error"}`,
+      variant: "destructive"
+    });
+    return false;
+  }
+}
\ No newline at end of file
diff --git a/application/src/services/notification/telegramService.ts b/application/src/services/notification/telegramService.ts
new file mode 100644
index 0000000..596c6f5
--- /dev/null
+++ b/application/src/services/notification/telegramService.ts
@@ -0,0 +1,109 @@
+
+import { toast } from "@/hooks/use-toast";
+import { AlertConfiguration } from "../alertConfigService";
+import api from "@/api";
+
+/**
+ * Send a notification via Telegram
+ */
+export async function sendTelegramNotification(
+  config: AlertConfiguration, 
+  message: string
+): Promise<boolean> {
+  try {
+    console.log("====== TELEGRAM NOTIFICATION ATTEMPT ======");
+    console.log("Config:", JSON.stringify({
+      ...config,
+      notify_name: config.notify_name,
+      telegram_chat_id: config.telegram_chat_id,
+      bot_token: config.bot_token ? "[REDACTED]" : undefined,
+      enabled: config.enabled
+    }, null, 2));
+    
+    // Use provided credentials
+    const chatId = config.telegram_chat_id;
+    const botToken = config.bot_token;
+    
+    if (!chatId || !botToken) {
+      console.error("Missing Telegram configuration - Chat ID:", chatId, "Bot token present:", !!botToken);
+      toast({
+        title: "Configuration Error",
+        description: "Missing Telegram chat ID or bot token",
+        variant: "destructive"
+      });
+      return false;
+    }
+
+    console.log("Sending Telegram notification to chat ID:", chatId);
+    console.log("Bot token available:", !!botToken);
+    console.log("Message content:", message);
+    
+    // Prepare payload for the API call
+    const payload = {
+      type: "telegram",
+      chatId: chatId,
+      botToken: botToken,
+      message: message
+    };
+    
+    console.log("Prepared payload for notification:", {
+      ...payload,
+      botToken: "[REDACTED]"
+    });
+    
+    try {
+      // Call our client-side API handler
+      console.log("Sending request to /api/realtime endpoint");
+      const response = await api.handleRequest('/api/realtime', 'POST', payload);
+
+      console.log("API response status:", response.status);
+      console.log("API response data:", JSON.stringify(response.json, null, 2));
+      
+      // Check if response is ok
+      if (response.status !== 200) {
+        console.error("Error response from notification API:", response.status);
+        toast({
+          title: "Notification Failed",
+          description: `Server returned error ${response.status}: ${response.json?.description || "Unknown error"}`,
+          variant: "destructive"
+        });
+        return false;
+      }
+      
+      const responseData = response.json;
+      
+      if (responseData && responseData.ok === false) {
+        console.error("Error sending notification:", responseData);
+        toast({
+          title: "Notification Failed",
+          description: responseData.description || "Failed to send notification",
+          variant: "destructive"
+        });
+        return false;
+      }
+
+      console.log("Notification sent successfully");
+      toast({
+        title: "Notification Sent",
+        description: "Telegram notification sent successfully"
+      });
+      return true;
+    } catch (error) {
+      console.error("Error calling notification API:", error);
+      toast({
+        title: "API Error",
+        description: `Failed to communicate with notification service: ${error instanceof Error ? error.message : "Network error"}`,
+        variant: "destructive"
+      });
+      return false;
+    }
+  } catch (error) {
+    console.error("Error in sendTelegramNotification:", error);
+    toast({
+      title: "Notification Error",
+      description: `Error sending Telegram notification: ${error instanceof Error ? error.message : "Unknown error"}`,
+      variant: "destructive"
+    });
+    return false;
+  }
+}
\ No newline at end of file
diff --git a/application/src/services/notification/templateProcessor.ts b/application/src/services/notification/templateProcessor.ts
new file mode 100644
index 0000000..ec44151
--- /dev/null
+++ b/application/src/services/notification/templateProcessor.ts
@@ -0,0 +1,173 @@
+
+import { AnyTemplate } from "../templateService";
+
+/**
+ * Process a notification template with service data
+ */
+export function processTemplate(
+  template: AnyTemplate,
+  service: any,
+  status: string,
+  responseTime?: number
+): string {
+  try {
+    
+    let templateText = "";
+    
+    // Select the appropriate message template based on status
+    if (status === "up") {
+      templateText = (template as any).up_message || generateDefaultUptimeMessage(service, status, responseTime);
+    } else if (status === "down") {
+      templateText = (template as any).down_message || generateDefaultUptimeMessage(service, status, responseTime);
+    } else if (status === "warning") {
+      templateText = (template as any).incident_message || generateDefaultUptimeMessage(service, status, responseTime);
+    } else if (status === "maintenance" || status === "paused") {
+      templateText = (template as any).maintenance_message || generateDefaultUptimeMessage(service, status, responseTime);
+    } else if (status === "resolved") {
+      templateText = (template as any).resolved_message || generateDefaultUptimeMessage(service, status, responseTime);
+    } else {
+      templateText = generateDefaultUptimeMessage(service, status, responseTime);
+    }
+    
+    // Skip replacement if template is empty
+    if (!templateText) {
+      return generateDefaultUptimeMessage(service, status, responseTime);
+    }
+        
+    // Replace placeholders with actual values
+    let message = templateText
+      .replace(/\${service_name}/g, service.name || 'Unknown Service')
+      .replace(/\${status}/g, status.toUpperCase());
+    
+    // Add response time if available
+    if (responseTime !== undefined) {
+      message = message.replace(/\${response_time}/g, `${responseTime}ms`);
+    } else {
+      message = message.replace(/\${response_time}/g, 'N/A');
+    }
+    
+    // Replace service-specific placeholders
+    message = message
+      .replace(/\${url}/g, service.url || service.URL || 'N/A')
+      .replace(/\${host}/g, service.host || service.Host || 'N/A')
+      .replace(/\${service_type}/g, service.service_type?.toUpperCase() || service.ServiceType?.toUpperCase() || service.type?.toUpperCase() || 'N/A')
+      .replace(/\${port}/g, service.port ? service.port.toString() : (service.Port ? service.Port.toString() : 'N/A'))
+      .replace(/\${domain}/g, service.domain || service.Domain || 'N/A')
+      .replace(/\${region_name}/g, service.region_name || service.RegionName || 'Default')
+      .replace(/\${agent_id}/g, service.agent_id ? service.agent_id.toString() : (service.AgentID ? service.AgentID.toString() : '1'))
+      .replace(/\${uptime}/g, service.uptime ? `${service.uptime}%` : (service.Uptime ? `${service.Uptime}%` : 'N/A'))
+      .replace(/\${error_message}/g, service.error_message || service.ErrorMessage || service.error || '')
+      .replace(/\${time}/g, new Date().toLocaleString());
+      
+    return message;
+  } catch (error) {
+    return generateDefaultUptimeMessage(service, status, responseTime);
+  }
+}
+
+/**
+ * Generate a default uptime message with proper formatting and emojis
+ */
+export function generateDefaultUptimeMessage(
+  service: any,
+  status: string,
+  responseTime?: number
+): string {
+  const serviceName = service.name || service.Name || 'Unknown Service';
+  const statusUpper = status.toUpperCase();
+  
+  // Status emoji mapping
+  let statusEmoji = "🔵";
+  if (status === "up") {
+    statusEmoji = "🟢";
+  } else if (status === "down") {
+    statusEmoji = "🔴";
+  } else if (status === "warning") {
+    statusEmoji = "🟡";
+  } else if (status === "maintenance" || status === "paused") {
+    statusEmoji = "🟠";
+  }
+  
+  let message = `${statusEmoji}Service ${serviceName} is ${statusUpper}.`;
+  
+  // Add service details
+  const host = service.host || service.Host;
+  const url = service.url || service.URL;
+  const serviceType = service.service_type || service.ServiceType || service.type;
+  const port = service.port || service.Port;
+  const domain = service.domain || service.Domain;
+  const regionName = service.region_name || service.RegionName;
+  const agentId = service.agent_id || service.AgentID;
+  const uptime = service.uptime || service.Uptime;
+  
+  // Build formatted details
+  const details = [];
+  
+  if (url && url !== 'N/A') {
+    details.push(` - Host URL: ${url}`);
+  } else if (host && host !== 'N/A') {
+    details.push(` - Host: ${host}`);
+  }
+  
+  if (serviceType && serviceType !== 'N/A') {
+    details.push(` - Type: ${serviceType.toUpperCase()}`);
+  }
+  
+  if (port && port !== 'N/A') {
+    details.push(` - Port: ${port}`);
+  }
+  
+  if (domain && domain !== 'N/A') {
+    details.push(` - Domain: ${domain}`);
+  }
+  
+  // Response time handling
+  if (responseTime !== undefined && responseTime > 0) {
+    details.push(` - Response time: ${responseTime}ms`);
+  } else {
+    details.push(` - Response time: N/A`);
+  }
+  
+  if (regionName && regionName !== 'N/A') {
+    details.push(` - Region: ${regionName}`);
+  }
+  
+  if (agentId && agentId !== 'N/A') {
+    details.push(` - Agent: ${agentId}`);
+  }
+  
+  if (uptime !== undefined && uptime !== 'N/A') {
+    details.push(` - Uptime: ${uptime}%`);
+  }
+  
+  // Add timestamp
+  details.push(` - Time: ${new Date().toLocaleString()}`);
+  
+  // Combine message with details
+  if (details.length > 0) {
+    message += '\n' + details.join('\n');
+  }
+  
+  return message;
+}
+
+/**
+ * Generate a default message when no template is available (legacy support)
+ */
+export function generateDefaultMessage(
+  serviceName: string,
+  status: string,
+  responseTime?: number
+): string {
+  const statusText = status.toUpperCase();
+  
+  let message = `Service ${serviceName || 'Unknown'} is ${statusText}`;
+  
+  if (responseTime !== undefined) {
+    message += `. Response time: ${responseTime}ms`;
+  }
+  
+  message += `. Time: ${new Date().toLocaleString()}`;
+  
+  return message;
+}
\ No newline at end of file
diff --git a/application/src/services/notification/types.ts b/application/src/services/notification/types.ts
new file mode 100644
index 0000000..083fae8
--- /dev/null
+++ b/application/src/services/notification/types.ts
@@ -0,0 +1,11 @@
+
+import { Service } from "@/types/service.types";
+
+export interface NotificationPayload {
+  service: Service;
+  status: string;
+  responseTime?: number;
+  timestamp: string;
+  message?: string;
+  _notificationSource?: string; // Internal flag to prevent duplicate notifications
+}
diff --git a/application/src/services/operationalPageService.ts b/application/src/services/operationalPageService.ts
new file mode 100644
index 0000000..0417755
--- /dev/null
+++ b/application/src/services/operationalPageService.ts
@@ -0,0 +1,146 @@
+
+import { pb, getCurrentEndpoint } from '@/lib/pocketbase';
+import { OperationalPageRecord } from '@/types/operational.types';
+
+export const operationalPageService = {
+  async getOperationalPages(): Promise<OperationalPageRecord[]> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/operational_page/records`, {
+        method: 'GET',
+        headers,
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      const result = await response.json();
+      return result.items || [];
+    } catch (error) {
+     // console.error('Error fetching operational pages:', error);
+      throw error;
+    }
+  },
+
+  async getOperationalPage(id: string): Promise<OperationalPageRecord> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/operational_page/records/${id}`, {
+        method: 'GET',
+        headers,
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      return await response.json();
+    } catch (error) {
+    //  console.error('Error fetching operational page:', error);
+      throw error;
+    }
+  },
+
+  async updateOperationalPage(id: string, data: Partial<OperationalPageRecord>): Promise<OperationalPageRecord> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/operational_page/records/${id}`, {
+        method: 'PATCH',
+        headers,
+        body: JSON.stringify(data),
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      return await response.json();
+    } catch (error) {
+     // console.error('Error updating operational page:', error);
+      throw error;
+    }
+  },
+
+  async createOperationalPage(data: Omit<OperationalPageRecord, 'id' | 'collectionId' | 'collectionName' | 'created' | 'updated'>): Promise<OperationalPageRecord> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/operational_page/records`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(data),
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      return await response.json();
+    } catch (error) {
+    //  console.error('Error creating operational page:', error);
+      throw error;
+    }
+  },
+
+  async deleteOperationalPage(id: string): Promise<void> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/operational_page/records/${id}`, {
+        method: 'DELETE',
+        headers,
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+    } catch (error) {
+     // console.error('Error deleting operational page:', error);
+      throw error;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/regionalService.ts b/application/src/services/regionalService.ts
new file mode 100644
index 0000000..48f4aa3
--- /dev/null
+++ b/application/src/services/regionalService.ts
@@ -0,0 +1,368 @@
+import { pb } from '@/lib/pocketbase';
+import { RegionalService, CreateRegionalServiceParams, InstallCommand } from '@/types/regional.types';
+
+// Generate a random token
+const generateToken = (): string => {
+  return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
+};
+
+// Generate a random agent ID
+const generateAgentId = (): string => {
+  return 'agent_' + Math.random().toString(36).substring(2, 10);
+};
+
+export const regionalService = {
+  async getRegionalServices(): Promise<RegionalService[]> {
+    try {
+      const response = await pb.collection('regional_service').getFullList({
+        sort: '-created',
+      });
+      
+      return response.map(record => ({
+        id: record.id,
+        region_name: record.region_name,
+        status: record.status,
+        agent_id: record.agent_id,
+        agent_ip_address: record.agent_ip_address,
+        token: record.token,
+        connection: record.connection,
+        created: record.created,
+        updated: record.updated,
+      }));
+    } catch (error) {
+      console.error('Error fetching regional services:', error);
+      throw new Error('Failed to fetch regional services');
+    }
+  },
+
+  async createRegionalService(params: CreateRegionalServiceParams): Promise<{ service: RegionalService; installCommand: InstallCommand }> {
+    try {
+      const token = generateToken();
+      const agentId = generateAgentId();
+      
+      const data = {
+        region_name: params.region_name,
+        status: 'pending',
+        agent_id: agentId,
+        agent_ip_address: params.agent_ip_address,
+        token: token,
+        connection: 'offline',
+      };
+
+      const record = await pb.collection('regional_service').create(data);
+      
+      const service: RegionalService = {
+        id: record.id,
+        region_name: record.region_name,
+        status: record.status,
+        agent_id: record.agent_id,
+        agent_ip_address: record.agent_ip_address,
+        token: record.token,
+        connection: record.connection,
+        created: record.created,
+        updated: record.updated,
+      };
+
+      const installCommand: InstallCommand = {
+        token: token,
+        agent_id: agentId,
+        api_endpoint: pb.baseUrl,
+        bash_script: this.generateAutomaticInstallScript(token, agentId, pb.baseUrl, params.agent_ip_address, params.region_name)
+      };
+
+      return { service, installCommand };
+    } catch (error) {
+      console.error('Error creating regional service:', error);
+      throw new Error('Failed to create regional service');
+    }
+  },
+
+  async deleteRegionalService(id: string): Promise<void> {
+    try {
+      await pb.collection('regional_service').delete(id);
+    } catch (error) {
+      console.error('Error deleting regional service:', error);
+      throw new Error('Failed to delete regional service');
+    }
+  },
+
+  generateAutomaticInstallScript(token: string, agentId: string, apiEndpoint: string, agentIp: string, regionName: string): string {
+    return `#!/bin/bash
+
+# CheckCle Regional Monitoring Agent - Automatic Installation Script
+# Generated on: $(date)
+# This script will automatically detect architecture, download, install, configure and start the regional monitoring agent
+
+echo "🚀 CheckCle Regional Monitoring Agent - Automatic Installation"
+echo "=============================================================="
+echo ""
+
+# Configuration variables
+REGION_NAME="${regionName}"
+AGENT_ID="${agentId}"
+AGENT_IP_ADDRESS="${agentIp}"
+AGENT_TOKEN="${token}"
+POCKETBASE_URL="${apiEndpoint}"
+
+# Base package information
+BASE_PACKAGE_URL="https://github.com/operacle/Distributed-Regional-Monitoring/releases/download/V1.0.0"
+PACKAGE_VERSION="1.0.0"
+SERVICE_NAME="regional-check-agent"
+
+# Check if running as root
+if [[ $EUID -ne 0 ]]; then
+   echo "❌ This script must be run as root (use sudo)" 
+   echo "   Usage: sudo bash install-regional-agent.sh"
+   exit 1
+fi
+
+# Detect operating system
+echo "🔍 Detecting system information..."
+OS_TYPE=$(uname -s | tr '[:upper:]' '[:lower:]')
+echo "   Operating System: $OS_TYPE"
+
+# Check if it's a supported OS
+if [[ "$OS_TYPE" != "linux" ]]; then
+    echo "❌ Unsupported operating system: $OS_TYPE"
+    echo "   This installer only supports Linux systems"
+    exit 1
+fi
+
+# Detect architecture
+ARCH=$(uname -m)
+echo "   Hardware Architecture: $ARCH"
+
+# Map architecture to package architecture
+case $ARCH in
+    x86_64|amd64)
+        PKG_ARCH="amd64"
+        ;;
+    aarch64|arm64)
+        PKG_ARCH="arm64"
+        ;;
+    armv7l|armv6l)
+        PKG_ARCH="arm64"
+        echo "⚠️  ARM 32-bit detected, using ARM64 package (may require compatibility layer)"
+        ;;
+    *)
+        echo "❌ Unsupported architecture: $ARCH"
+        echo "   Supported architectures: x86_64 (amd64), aarch64 (arm64)"
+        echo "   Please contact support for your architecture: $ARCH"
+        exit 1
+        ;;
+esac
+
+echo "   Package Architecture: $PKG_ARCH"
+
+# Construct package URLs and names
+PACKAGE_URL="$BASE_PACKAGE_URL/distributed-regional-check-agent_\${PACKAGE_VERSION}_\${PKG_ARCH}.deb"
+PACKAGE_NAME="distributed-regional-check-agent_\${PACKAGE_VERSION}_\${PKG_ARCH}.deb"
+
+echo ""
+echo "📋 Installation Configuration:"
+echo "   Region Name: $REGION_NAME"
+echo "   Agent ID: $AGENT_ID"
+echo "   Agent IP: $AGENT_IP_ADDRESS"
+echo "   PocketBase URL: $POCKETBASE_URL"
+echo "   Package URL: $PACKAGE_URL"
+echo ""
+
+# Create temporary directory
+TEMP_DIR=$(mktemp -d)
+echo "📁 Created temporary directory: $TEMP_DIR"
+
+# Download the .deb package
+echo "📥 Downloading Regional Monitoring Agent package for $PKG_ARCH..."
+cd "$TEMP_DIR"
+
+# Test if package exists first
+echo "🔍 Checking package availability..."
+if command -v curl >/dev/null 2>&1; then
+    HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -I "$PACKAGE_URL")
+    if [ "$HTTP_STATUS" != "200" ]; then
+        echo "❌ Package not found at $PACKAGE_URL (HTTP $HTTP_STATUS)"
+        echo "   Available packages should be:"
+        echo "   - distributed-regional-check-agent_\${PACKAGE_VERSION}_amd64.deb"
+        echo "   - distributed-regional-check-agent_\${PACKAGE_VERSION}_arm64.deb"
+        rm -rf "$TEMP_DIR"
+        exit 1
+    fi
+    echo "✅ Package found, proceeding with download..."
+fi
+
+# Try wget first, then curl as fallback
+DOWNLOAD_SUCCESS=false
+
+if command -v wget >/dev/null 2>&1; then
+    if wget -q --show-progress --timeout=30 --tries=3 "$PACKAGE_URL" -O "$PACKAGE_NAME"; then
+        DOWNLOAD_SUCCESS=true
+        echo "✅ Package downloaded successfully using wget"
+    fi
+elif command -v curl >/dev/null 2>&1; then
+    if curl -L --connect-timeout 30 --max-time 300 --retry 3 --retry-delay 2 -o "$PACKAGE_NAME" "$PACKAGE_URL"; then
+        DOWNLOAD_SUCCESS=true
+        echo "✅ Package downloaded successfully using curl"
+    fi
+fi
+
+if [ "$DOWNLOAD_SUCCESS" = false ]; then
+    echo "❌ Failed to download package from $PACKAGE_URL"
+    echo "   Please check:"
+    echo "   - Internet connection"
+    echo "   - Package availability for $PKG_ARCH architecture"
+    echo "   - GitHub repository access: https://github.com/operacle/Distributed-Regional-Monitoring/releases"
+    echo "   - Firewall/proxy settings"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Verify package integrity
+echo ""
+echo "🔍 Verifying package..."
+if dpkg-deb --info "$PACKAGE_NAME" > /dev/null 2>&1; then
+    echo "✅ Package verification successful"
+else
+    echo "❌ Package verification failed - corrupted download"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Install the package
+echo ""
+echo "📦 Installing Regional Monitoring Agent package..."
+if dpkg -i "$PACKAGE_NAME"; then
+    echo "✅ Package installed successfully"
+else
+    echo "⚠️  Package installation had issues, attempting to fix dependencies..."
+    if apt-get install -f -y; then
+        echo "✅ Dependencies fixed and package installed successfully"
+    else
+        echo "❌ Failed to install package and fix dependencies"
+        echo "   This might be due to:"
+        echo "   - Missing system dependencies"
+        echo "   - Architecture compatibility issues"
+        echo "   - Insufficient disk space"
+        rm -rf "$TEMP_DIR"
+        exit 1
+    fi
+fi
+
+# Configure the agent
+echo ""
+echo "⚙️  Configuring Regional Monitoring Agent..."
+
+# Ensure configuration directory exists
+mkdir -p /etc/regional-check-agent
+
+# Create the environment configuration file
+cat > /etc/regional-check-agent/regional-check-agent.env << EOF
+# Distributed Regional Check Agent Configuration
+# Auto-generated on $(date)
+
+# Server Configuration
+PORT=8091
+
+# Operation defaults
+DEFAULT_COUNT=4
+DEFAULT_TIMEOUT=10s
+MAX_COUNT=20
+MAX_TIMEOUT=30s
+
+# Logging
+ENABLE_LOGGING=true
+
+# PocketBase integration
+POCKETBASE_ENABLED=true
+POCKETBASE_URL=$POCKETBASE_URL
+
+# Regional Agent Configuration - Auto-configured
+REGION_NAME=$REGION_NAME
+AGENT_ID=$AGENT_ID
+AGENT_IP_ADDRESS=$AGENT_IP_ADDRESS
+AGENT_TOKEN=$AGENT_TOKEN
+
+# Monitoring configuration
+CHECK_INTERVAL=30s
+MAX_RETRIES=3
+REQUEST_TIMEOUT=10s
+EOF
+
+echo "✅ Configuration file created at /etc/regional-check-agent/regional-check-agent.env"
+
+# Set proper permissions
+if id "regional-check-agent" &>/dev/null; then
+    chown root:regional-check-agent /etc/regional-check-agent/regional-check-agent.env
+    chmod 640 /etc/regional-check-agent/regional-check-agent.env
+else
+    echo "⚠️  regional-check-agent user not found, using root permissions"
+    chown root:root /etc/regional-check-agent/regional-check-agent.env
+    chmod 600 /etc/regional-check-agent/regional-check-agent.env
+fi
+
+# Enable and start the service
+echo ""
+echo "🔧 Starting Regional Monitoring Agent service..."
+
+# Reload systemd daemon
+systemctl daemon-reload
+
+# Enable the service for auto-start
+if systemctl enable $SERVICE_NAME; then
+    echo "✅ Service enabled for auto-start"
+else
+    echo "❌ Failed to enable service"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Start the service
+if systemctl start $SERVICE_NAME; then
+    echo "✅ Service started successfully"
+else
+    echo "❌ Failed to start service"
+    echo "   Check the configuration and try: sudo systemctl start $SERVICE_NAME"
+    echo "   View logs with: sudo journalctl -u $SERVICE_NAME -f"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Wait a moment for service to initialize
+sleep 3
+
+# Check service status
+echo ""
+echo "📊 Service Status:"
+systemctl status $SERVICE_NAME --no-pager -l
+
+# Test health endpoint
+echo ""
+echo "🩺 Testing agent health endpoint..."
+if curl -s -f http://localhost:8091/health > /dev/null; then
+    echo "✅ Agent health endpoint is responding"
+else
+    echo "⚠️  Agent health endpoint not responding yet (this is normal, may take a few moments)"
+fi
+
+# Cleanup
+rm -rf "$TEMP_DIR"
+echo ""
+echo "🎉 Regional Monitoring Agent Installation Complete!"
+echo ""
+echo "📋 Installation Summary:"
+echo "   Agent ID: $AGENT_ID"
+echo "   Region: $REGION_NAME"
+echo "   Architecture: $PKG_ARCH"
+echo "   Status: $(systemctl is-active $SERVICE_NAME)"
+echo "   Health URL: http://localhost:8091/health"
+echo "   Service endpoint: http://localhost:8091/operation"
+echo ""
+echo "📝 Useful commands:"
+echo "   Check status: sudo systemctl status $SERVICE_NAME"
+echo "   View logs: sudo journalctl -u $SERVICE_NAME -f"
+echo "   Restart: sudo systemctl restart $SERVICE_NAME"
+echo "   Stop: sudo systemctl stop $SERVICE_NAME"
+echo ""
+echo "✨ The agent is now monitoring and reporting to your CheckCle dashboard!"
+`;
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/serverNotificationTemplateService.ts b/application/src/services/serverNotificationTemplateService.ts
new file mode 100644
index 0000000..d793c50
--- /dev/null
+++ b/application/src/services/serverNotificationTemplateService.ts
@@ -0,0 +1,114 @@
+import { pb } from "@/lib/pocketbase";
+
+export interface ServerNotificationTemplate {
+  id: string;
+  collectionId: string;
+  collectionName: string;
+  name: string;
+  ram_message: string;
+  cpu_message: string;
+  disk_message: string;
+  network_message: string;
+  up_message: string;
+  down_message: string;
+  notification_id: string;
+  warning_message: string;
+  paused_message: string;
+  cpu_temp_message: string;
+  disk_io_message: string;
+  restore_ram_message: string;
+  restore_cpu_message: string;
+  restore_disk_message: string;
+  restore_network_message: string;
+  restore_disk_io_message: string;
+  restore_cpu_temp_message: string;
+  placeholder: string;
+  created: string;
+  updated: string;
+}
+
+export interface CreateUpdateServerNotificationTemplateData {
+  name: string;
+  ram_message: string;
+  cpu_message: string;
+  disk_message: string;
+  network_message: string;
+  up_message: string;
+  down_message: string;
+  notification_id: string;
+  warning_message: string;
+  paused_message: string;
+  cpu_temp_message: string;
+  disk_io_message: string;
+  restore_ram_message: string;
+  restore_cpu_message: string;
+  restore_disk_message: string;
+  restore_network_message: string;
+  restore_disk_io_message: string;
+  restore_cpu_temp_message: string;
+  placeholder: string;
+}
+
+export const serverNotificationTemplateService = {
+  async getTemplates(): Promise<ServerNotificationTemplate[]> {
+    try {
+      
+      const response = await pb.collection('server_notification_templates').getList(1, 50, {
+        sort: '-created',
+      });
+     
+      return response.items as unknown as ServerNotificationTemplate[];
+    } catch (error) {
+     
+      throw error;
+    }
+  },
+
+  async getTemplate(id: string): Promise<ServerNotificationTemplate> {
+    try {
+      
+      const response = await pb.collection('server_notification_templates').getOne(id);
+     
+      return response as unknown as ServerNotificationTemplate;
+    } catch (error) {
+     
+      throw error;
+    }
+  },
+
+  async createTemplate(data: CreateUpdateServerNotificationTemplateData): Promise<ServerNotificationTemplate> {
+    try {
+    
+      const response = await pb.collection('server_notification_templates').create(data);
+    
+      return response as unknown as ServerNotificationTemplate;
+    } catch (error) {
+     
+      throw error;
+    }
+  },
+
+  async updateTemplate(id: string, data: Partial<CreateUpdateServerNotificationTemplateData>): Promise<ServerNotificationTemplate> {
+    try {
+     
+      const response = await pb.collection('server_notification_templates').update(id, data);
+      
+      return response as unknown as ServerNotificationTemplate;
+    } catch (error) {
+     
+      throw error;
+    }
+  },
+
+  async deleteTemplate(id: string): Promise<boolean> {
+    try {
+
+      await pb.collection('server_notification_templates').delete(id);
+
+      return true;
+    } catch (error) {
+     
+      throw error;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/serverService.ts b/application/src/services/serverService.ts
new file mode 100644
index 0000000..1bdda23
--- /dev/null
+++ b/application/src/services/serverService.ts
@@ -0,0 +1,195 @@
+import { pb } from '@/lib/pocketbase';
+import { Server, ServerStats } from '@/types/server.types';
+
+export const serverService = {
+  async getServers(): Promise<Server[]> {
+    try {
+      const records = await pb.collection('servers').getFullList<Server>();
+      return records;
+    } catch (error) {
+    //  console.error('Error fetching servers:', error);
+      throw error;
+    }
+  },
+
+  async getServer(serverId: string): Promise<Server> {
+    try {
+      const record = await pb.collection('servers').getOne<Server>(serverId);
+      return record;
+    } catch (error) {
+    //  console.error('Error fetching server:', error);
+      throw error;
+    }
+  },
+
+  async getServerMetrics(serverId: string, timeRange?: string): Promise<any[]> {
+    try {
+     // console.log('🔍 serverService.getServerMetrics: Starting with serverId:', serverId, 'timeRange:', timeRange);
+      
+      // First, get the server to find the correct server_id for metrics
+      let server;
+      try {
+        server = await this.getServer(serverId);
+       // console.log('✅ serverService.getServerMetrics: Found server:', {
+      //    id: server.id,
+      //    server_id: server.server_id,
+      //    name: server.name
+      //  });
+      } catch (error) {
+      //  console.log('❌ serverService.getServerMetrics: Could not fetch server details:', error);
+      }
+
+      // Let's first check what data exists in the database for this server
+    //  console.log('🔍 Checking all records for this server...');
+      const allServerRecords = await pb.collection('server_metrics').getFullList({
+        filter: `server_id = "${serverId}" || server_id = "${server?.server_id}" || server_id = "${server?.id}"`,
+        sort: '-created',
+        requestKey: null
+      });
+      
+     // console.log('📊 Found total records for server:', allServerRecords.length);
+      if (allServerRecords.length > 0) {
+      //  console.log('📅 Date range of all records:', {
+      //    newest: allServerRecords[0]?.created,
+      //    oldest: allServerRecords[allServerRecords.length - 1]?.created
+      //  });
+        
+        // Check last 5 records
+       // console.log('🔄 Last 5 records timestamps:', allServerRecords.slice(0, 5).map(r => ({
+       //   created: r.created,
+       //   age_minutes: Math.round((new Date().getTime() - new Date(r.created).getTime()) / (1000 * 60))
+       // })));
+      }
+
+      // Calculate time range for filtering
+      const now = new Date();
+      let cutoffTime;
+      
+      if (timeRange === '60m') {
+        cutoffTime = new Date(now.getTime() - (60 * 60 * 1000)); // Exactly 60 minutes
+      //  console.log('⏰ 60m filter: Looking for records newer than:', cutoffTime.toISOString());
+      //  console.log('⏰ Current time:', now.toISOString());
+      //  console.log('⏰ Time difference in minutes:', Math.round((now.getTime() - cutoffTime.getTime()) / (1000 * 60)));
+      } else if (timeRange === '1d') {
+        cutoffTime = new Date(now.getTime() - (24 * 60 * 60 * 1000));
+      } else if (timeRange === '7d') {
+        cutoffTime = new Date(now.getTime() - (7 * 24 * 60 * 60 * 1000));
+      } else if (timeRange === '1m') {
+        cutoffTime = new Date(now.getTime() - (30 * 24 * 60 * 60 * 1000));
+      } else if (timeRange === '3m') {
+        cutoffTime = new Date(now.getTime() - (90 * 24 * 60 * 60 * 1000));
+      } else {
+        cutoffTime = new Date(now.getTime() - (24 * 60 * 60 * 1000));
+      }
+
+      // Try to get filtered records
+      const searchStrategies = [
+        server?.server_id,
+        serverId,
+        server?.id
+      ].filter(Boolean);
+
+      let filteredRecords: any[] = [];
+
+      for (const strategy of searchStrategies) {
+        try {
+          const cutoffISO = cutoffTime.toISOString();
+          const filter = `server_id = "${strategy}" && created >= "${cutoffISO}"`;
+          
+       //   console.log(`🔍 Trying filter: ${filter}`);
+
+          const records = await pb.collection('server_metrics').getFullList({
+            filter: filter,
+            sort: '-created',
+            requestKey: null
+          });
+
+        //  console.log(`📊 Strategy "${strategy}" found ${records.length} records within time range`);
+
+          if (records.length > 0) {
+            filteredRecords = records;
+          //  console.log('✅ Using records from strategy:', strategy);
+            break;
+          }
+        } catch (error) {
+        //  console.error(`❌ Error with strategy ${strategy}:`, error);
+          continue;
+        }
+      }
+
+      // If no filtered records found and it's 60m, let's see what we have in a larger window
+      if (filteredRecords.length === 0 && timeRange === '60m') {
+      //  console.log('⚠️ No records found in 60m window, checking last 24 hours...');
+        
+        const last24h = new Date(now.getTime() - (24 * 60 * 60 * 1000));
+        
+        for (const strategy of searchStrategies) {
+          try {
+            const filter = `server_id = "${strategy}" && created >= "${last24h.toISOString()}"`;
+            
+            const records = await pb.collection('server_metrics').getFullList({
+              filter: filter,
+              sort: '-created',
+              requestKey: null
+            });
+
+         //   console.log(`📊 Last 24h check for "${strategy}": ${records.length} records`);
+            
+            if (records.length > 0) {
+           //   console.log('📅 Sample record ages (minutes ago):', records.slice(0, 3).map(r => 
+              //  Math.round((now.getTime() - new Date(r.created).getTime()) / (1000 * 60))
+             // ));
+              
+              // Return all recent records for 60m if we have any
+              filteredRecords = records;
+              break;
+            }
+          } catch (error) {
+         //   console.error(`❌ Error with 24h fallback for ${strategy}:`, error);
+            continue;
+          }
+        }
+      }
+
+     // console.log('🎯 Final result:', filteredRecords.length, 'records found for', timeRange);
+      if (filteredRecords.length > 0) {
+     //   console.log('📅 Returned records age range (minutes ago):', {
+      //    newest: Math.round((now.getTime() - new Date(filteredRecords[0].created).getTime()) / (1000 * 60)),
+      //    oldest: Math.round((now.getTime() - new Date(filteredRecords[filteredRecords.length - 1].created).getTime()) / (1000 * 60))
+      //  });
+      }
+      
+      return filteredRecords;
+    } catch (error) {
+    //  console.error('❌ Error fetching server metrics:', error);
+      throw error;
+    }
+  },
+
+  async getServerStats(servers: Server[]): Promise<ServerStats> {
+    const total = servers.length;
+    const online = servers.filter(server => server.status === 'up').length;
+    const offline = servers.filter(server => server.status === 'down').length;
+    const warning = servers.filter(server => server.status === 'warning').length;
+
+    return {
+      total,
+      online,
+      offline,
+      warning
+    };
+  },
+
+  formatBytes(bytes: number): string {
+    if (bytes === 0) return '0 Bytes';
+    const k = 1024;
+    const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+  },
+
+  formatUptime(uptime: string): string {
+    // Simple uptime formatting - can be enhanced based on actual format
+    return uptime;
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/serverThresholdService.ts b/application/src/services/serverThresholdService.ts
new file mode 100644
index 0000000..f1bd080
--- /dev/null
+++ b/application/src/services/serverThresholdService.ts
@@ -0,0 +1,87 @@
+
+import { pb } from "@/lib/pocketbase";
+
+export interface ServerThreshold {
+  id: string;
+  name: string;
+  cpu_threshold: number;
+  ram_threshold: number;
+  // Some API responses may use a different field name; include it as optional
+  ram_threshold_message?: number;
+  disk_threshold: number;
+  network_threshold: number;
+  created: string;
+  updated: string;
+}
+
+export interface CreateUpdateServerThresholdData {
+  name: string;
+  cpu_threshold: number;
+  ram_threshold: number;
+  disk_threshold: number;
+  network_threshold: number;
+}
+
+export const serverThresholdService = {
+  async getServerThresholds(): Promise<ServerThreshold[]> {
+    try {
+    //  console.log("Fetching server threshold templates");
+      const response = await pb.collection('server_threshold_templates').getList(1, 50, {
+        sort: '-created',
+      });
+    //  console.log("Server threshold templates response:", response);
+      return response.items as unknown as ServerThreshold[];
+    } catch (error) {
+    //  console.error("Error fetching server threshold templates:", error);
+      throw error;
+    }
+  },
+
+  async getServerThreshold(id: string): Promise<ServerThreshold> {
+    try {
+    //  console.log(`Fetching server threshold template with id: ${id}`);
+      const response = await pb.collection('server_threshold_templates').getOne(id);
+    //  console.log("Server threshold template response:", response);
+      return response as unknown as ServerThreshold;
+    } catch (error) {
+    //  console.error(`Error fetching server threshold template with id ${id}:`, error);
+      throw error;
+    }
+  },
+
+  async createServerThreshold(data: CreateUpdateServerThresholdData): Promise<ServerThreshold> {
+    try {
+     // console.log("Creating new server threshold template with data:", data);
+      const response = await pb.collection('server_threshold_templates').create(data);
+    //  console.log("Create server threshold template response:", response);
+      return response as unknown as ServerThreshold;
+    } catch (error) {
+    //  console.error("Error creating server threshold template:", error);
+      throw error;
+    }
+  },
+
+  async updateServerThreshold(id: string, data: Partial<CreateUpdateServerThresholdData>): Promise<ServerThreshold> {
+    try {
+    //  console.log(`Updating server threshold template with id: ${id}`, data);
+      const response = await pb.collection('server_threshold_templates').update(id, data);
+    //  console.log("Update server threshold template response:", response);
+      return response as unknown as ServerThreshold;
+    } catch (error) {
+    //  console.error(`Error updating server threshold template with id ${id}:`, error);
+      throw error;
+    }
+  },
+
+  async deleteServerThreshold(id: string): Promise<boolean> {
+    try {
+    //  console.log(`Deleting server threshold template with id: ${id}`);
+      await pb.collection('server_threshold_templates').delete(id);
+    //  console.log("Server threshold template deleted successfully");
+      return true;
+    } catch (error) {
+    //  console.error(`Error deleting server threshold template with id ${id}:`, error);
+      throw error;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/serviceNotificationTemplateService.ts b/application/src/services/serviceNotificationTemplateService.ts
new file mode 100644
index 0000000..523813f
--- /dev/null
+++ b/application/src/services/serviceNotificationTemplateService.ts
@@ -0,0 +1,93 @@
+
+import { pb } from "@/lib/pocketbase";
+
+export interface ServiceNotificationTemplate {
+  id: string;
+  collectionId: string;
+  collectionName: string;
+  name: string;
+  up_message: string;
+  down_message: string;
+  maintenance_message: string;
+  incident_message: string;
+  resolved_message: string;
+  placeholder: string;
+  warning_message: string;
+  created: string;
+  updated: string;
+}
+
+export interface CreateUpdateServiceNotificationTemplateData {
+  name: string;
+  up_message: string;
+  down_message: string;
+  maintenance_message: string;
+  incident_message: string;
+  resolved_message: string;
+  placeholder: string;
+  warning_message: string;
+}
+
+export const serviceNotificationTemplateService = {
+  async getTemplates(): Promise<ServiceNotificationTemplate[]> {
+    try {
+   //  console.log("Fetching service notification templates");
+      const response = await pb.collection('service_notification_templates').getList(1, 50, {
+        sort: '-created',
+      });
+    //  console.log("Service notification templates response:", response);
+      return response.items as unknown as ServiceNotificationTemplate[];
+    } catch (error) {
+    //  console.error("Error fetching service notification templates:", error);
+      throw error;
+    }
+  },
+
+  async getTemplate(id: string): Promise<ServiceNotificationTemplate> {
+    try {
+     // console.log(`Fetching service notification template with id: ${id}`);
+      const response = await pb.collection('service_notification_templates').getOne(id);
+    //  console.log("Service notification template response:", response);
+      return response as unknown as ServiceNotificationTemplate;
+    } catch (error) {
+    //  console.error(`Error fetching service notification template with id ${id}:`, error);
+      throw error;
+    }
+  },
+
+  async createTemplate(data: CreateUpdateServiceNotificationTemplateData): Promise<ServiceNotificationTemplate> {
+    try {
+     // console.log("Creating new service notification template with data:", data);
+      const response = await pb.collection('service_notification_templates').create(data);
+     // console.log("Create service notification template response:", response);
+      return response as unknown as ServiceNotificationTemplate;
+    } catch (error) {
+    //  console.error("Error creating service notification template:", error);
+      throw error;
+    }
+  },
+
+  async updateTemplate(id: string, data: Partial<CreateUpdateServiceNotificationTemplateData>): Promise<ServiceNotificationTemplate> {
+    try {
+     // console.log(`Updating service notification template with id: ${id}`, data);
+      const response = await pb.collection('service_notification_templates').update(id, data);
+    //  console.log("Update service notification template response:", response);
+      return response as unknown as ServiceNotificationTemplate;
+    } catch (error) {
+    //  console.error(`Error updating service notification template with id ${id}:`, error);
+      throw error;
+    }
+  },
+
+  async deleteTemplate(id: string): Promise<boolean> {
+    try {
+     // console.log(`Deleting service notification template with id: ${id}`);
+      await pb.collection('service_notification_templates').delete(id);
+     // console.log("Service notification template deleted successfully");
+      return true;
+    } catch (error) {
+     // console.error(`Error deleting service notification template with id ${id}:`, error);
+      throw error;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/serviceService.ts b/application/src/services/serviceService.ts
new file mode 100644
index 0000000..88ad19b
--- /dev/null
+++ b/application/src/services/serviceService.ts
@@ -0,0 +1,218 @@
+
+import { pb } from '@/lib/pocketbase';
+import { Service, CreateServiceParams, UptimeData } from '@/types/service.types';
+import { monitoringService } from './monitoring';
+import { uptimeService } from './uptimeService';
+
+export type { Service, UptimeData, CreateServiceParams };
+
+export const serviceService = {
+  async getServices(): Promise<Service[]> {
+    try {
+      // First get the total count of records
+      const countResponse = await pb.collection('services').getList(1, 1, {
+        sort: 'name',
+      });
+      const totalRecords = countResponse.totalItems;
+      
+      // Then fetch all records using the total count as the limit
+      const response = await pb.collection('services').getList(1, totalRecords, {
+        sort: 'name',
+      });
+      
+      return response.items.map(item => ({
+        id: item.id,
+        name: item.name,
+        url: item.url || "",  // Ensure proper URL mapping
+        host: item.host || "",  // Map host field for PING and TCP services
+        port: item.port || undefined,  // Map port field for TCP services
+        domain: item.domain || "",  // Map domain field
+        type: item.service_type || item.type || "HTTP",  // Map service_type to type
+        status: item.status || "paused",
+        responseTime: item.response_time || item.responseTime || 0,
+        uptime: item.uptime || 0,
+        lastChecked: item.last_checked || item.lastChecked || new Date().toLocaleString(),
+        interval: item.heartbeat_interval || item.interval || 60,
+        retries: item.max_retries || item.retries || 3,
+        notificationChannel: item.notification_id,
+        notification_channel: item.notification_channel, // Add this field for multiple channels support
+        notification_status: item.notification_status || false,
+        alertTemplate: item.template_id,
+        muteAlerts: item.alerts === "muted",  // Convert string to boolean for compatibility
+        alerts: item.alerts || "unmuted",     // Store actual database field
+        muteChangedAt: item.mute_changed_at,
+        // Regional monitoring fields - use regional_status
+        region_name: item.region_name || "",
+        agent_id: item.agent_id || "",
+        regional_status: item.regional_status || "disabled",
+        regional_monitoring_enabled: item.regional_status === "enabled", // Backward compatibility
+      }));
+    } catch (error) {
+      throw new Error('Failed to load services data.');
+    }
+  },
+
+  async createService(params: any): Promise<Service> {
+    try {
+      // Convert service type to lowercase to avoid validation issues
+      const serviceType = params.type.toLowerCase();
+      
+      // Debug log to check what we're sending
+      
+      const data = {
+        name: params.name,
+        service_type: serviceType,  // Using lowercase value to avoid validation errors
+        status: "up", // Changed from "active" to "up" to match the expected enum values
+        response_time: 0,
+        uptime: 0,
+        last_checked: new Date().toLocaleString(),
+        heartbeat_interval: params.interval,
+        max_retries: params.retries,
+        // Store notification_status as boolean
+        notification_status: params.notificationStatus === true,
+        // Always store channels and template if provided (don't clear based on status)
+        notification_channel: params.notificationChannels && params.notificationChannels.length > 0 
+          ? JSON.stringify(params.notificationChannels)
+          : null,
+        notification_id: params.notificationChannels && params.notificationChannels.length > 0 
+          ? params.notificationChannels.join(',')
+          : null,
+        template_id: params.alertTemplate || null,
+        // Regional monitoring fields - use regional_status
+        regional_status: params.regionalStatus || "disabled",
+        region_name: params.regionName || "",
+        agent_id: params.agentId || "",
+        // Conditionally add fields based on service type
+        ...(serviceType === "dns" 
+          ? { domain: params.domain, url: "", host: "", port: null }  // DNS: store in domain field
+          : serviceType === "ping"
+          ? { host: params.host, url: "", domain: "", port: null }    // PING: store in host field
+          : serviceType === "tcp"
+          ? { host: params.host, port: params.port, url: "", domain: "" }  // TCP: store in host and port fields
+          : { url: params.url, domain: "", host: "", port: null }     // HTTP: store in url field
+        )
+      };
+
+      const record = await pb.collection('services').create(data);
+      
+      // Return the newly created service
+      const newService = {
+        id: record.id,
+        name: record.name,
+        url: record.url || "",
+        host: record.host || "",
+        port: record.port || undefined,
+        domain: record.domain || "",
+        type: record.service_type || "http",
+        status: record.status || "up", // Changed to match the status we set
+        responseTime: record.response_time || 0,
+        uptime: record.uptime || 0,
+        lastChecked: record.last_checked || new Date().toLocaleString(),
+        interval: record.heartbeat_interval || 60,
+        retries: record.max_retries || 3,
+        notificationChannel: record.notification_id,
+        notification_channel: record.notification_channel,
+        notification_status: record.notification_status || false,
+        alertTemplate: record.template_id,
+        regional_status: record.regional_status || "disabled",
+        regional_monitoring_enabled: record.regional_status === "enabled",
+        region_name: record.region_name || "",
+        agent_id: record.agent_id || "",
+      } as Service;
+      
+      // Immediately start monitoring for the new service
+      await monitoringService.startMonitoringService(record.id);
+      
+      return newService;
+    } catch (error) {
+      throw new Error('Failed to create service.');
+    }
+  },
+  
+  async updateService(id: string, params: any): Promise<Service> {
+    try {
+      // Convert service type to lowercase to avoid validation issues
+      const serviceType = params.type.toLowerCase();
+      
+      // Debug log to check what we're updating
+      
+      const data = {
+        name: params.name,
+        service_type: serviceType,
+        heartbeat_interval: params.interval,
+        max_retries: params.retries,
+        // Store notification_status as boolean - preserve existing channels/template
+        notification_status: params.notificationStatus === true,
+        // Only update channels and template if they are provided (don't clear them)
+        ...(params.notificationChannels && params.notificationChannels.length > 0 && {
+          notification_channel: JSON.stringify(params.notificationChannels),
+          notification_id: params.notificationChannels.join(',')
+        }),
+        ...(params.alertTemplate && {
+          template_id: params.alertTemplate
+        }),
+        // Regional monitoring fields - use regional_status
+        regional_status: params.regionalStatus || "disabled",
+        region_name: params.regionName || "",
+        agent_id: params.agentId || "",
+        // Conditionally update fields based on service type
+        ...(serviceType === "dns" 
+          ? { domain: params.domain, url: "", host: "", port: null }  // DNS: update domain field
+          : serviceType === "ping"
+          ? { host: params.host, url: "", domain: "", port: null }    // PING: update host field
+          : serviceType === "tcp"
+          ? { host: params.host, port: params.port, url: "", domain: "" }  // TCP: update host and port fields
+          : { url: params.url, domain: "", host: "", port: null }     // HTTP: update url field
+        )
+      };
+
+      
+      // Use timeout to ensure the request doesn't hang
+      const timeoutPromise = new Promise<never>((_, reject) => {
+        setTimeout(() => reject(new Error("Request timed out")), 10000);
+      });
+      
+      const updatePromise = pb.collection('services').update(id, data);
+      const record = await Promise.race([updatePromise, timeoutPromise]) as any;
+      
+      // Return the updated service
+      const updatedService = {
+        id: record.id,
+        name: record.name,
+        url: record.url || "",
+        host: record.host || "",
+        port: record.port || undefined,
+        domain: record.domain || "",
+        type: record.service_type || "http",
+        status: record.status,
+        responseTime: record.response_time || 0,
+        uptime: record.uptime || 0,
+        lastChecked: record.last_checked || new Date().toLocaleString(),
+        interval: record.heartbeat_interval || 60,
+        retries: record.max_retries || 3,
+        notificationChannel: record.notification_id,
+        notification_channel: record.notification_channel,
+        notification_status: record.notification_status || false,
+        alertTemplate: record.template_id,
+        regional_status: record.regional_status || "disabled",
+        regional_monitoring_enabled: record.regional_status === "enabled",
+        region_name: record.region_name || "",
+        agent_id: record.agent_id || "",
+      } as Service;
+      
+      return updatedService;
+    } catch (error) {
+      throw new Error(`Failed to update service: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+  },
+  
+  // Control service monitoring
+  startMonitoringService: monitoringService.startMonitoringService,
+  pauseMonitoring: monitoringService.pauseMonitoring,
+  resumeMonitoring: monitoringService.resumeMonitoring,
+  startAllActiveServices: monitoringService.startAllActiveServices,
+  
+  // Re-export uptime functions
+  recordUptimeData: uptimeService.recordUptimeData,
+  getUptimeHistory: uptimeService.getUptimeHistory
+};
\ No newline at end of file
diff --git a/application/src/services/settingsService.ts b/application/src/services/settingsService.ts
new file mode 100644
index 0000000..18963b5
--- /dev/null
+++ b/application/src/services/settingsService.ts
@@ -0,0 +1,129 @@
+
+export interface GeneralSettings {
+  id?: string;
+  created?: string;
+  updated?: string;
+  system_name?: string;
+  system_name_kh?: string;
+  logo_url?: string;
+  system_description?: string;
+  appearance?: string;
+  language?: string;
+  timezone?: string;
+  date_format?: string;
+  time_format?: string;
+  retention_days?: number;
+  server_retention_days?: number;
+  uptime_retention_days?: number;
+  notification_email?: string;
+  session_timeout?: number;
+  enable_public_stats?: boolean;
+  enable_email_notifications?: boolean;
+  enable_sms_notifications?: boolean;
+  enable_two_factor?: boolean;
+  enable_audit_logs?: boolean;
+  
+  // New fields for additional settings
+  meta?: {
+    appName?: string;
+    appURL?: string;
+    senderName?: string;
+    senderAddress?: string;
+    hideControls?: boolean;
+  };
+  smtp?: {
+    enabled?: boolean;
+    port?: number;
+    host?: string;
+    username?: string;
+    password?: string;
+    authMethod?: string;
+    tls?: boolean;
+    localName?: string;
+  };
+}
+
+export const settingsService = {
+  async getGeneralSettings(): Promise<GeneralSettings | null> {
+    try {
+      console.log('Fetching settings from /api/settings endpoint...');
+      const response = await fetch('/api/settings', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json'
+        },
+        body: JSON.stringify({ action: 'getSettings' })
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      const result = await response.json();
+      console.log('Settings API response:', result);
+      
+      return result.success ? result.data : null;
+    } catch (error) {
+      console.error("Failed to fetch general settings:", error);
+      return null;
+    }
+  },
+  
+  async updateGeneralSettings(data: Partial<GeneralSettings>): Promise<GeneralSettings | null> {
+    try {
+      console.log('Updating settings via /api/settings:', data);
+      
+      // Remove id and timestamp fields for settings update
+      const { id, created, updated, ...updateData } = data;
+      
+      const response = await fetch('/api/settings', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json'
+        },
+        body: JSON.stringify({ 
+          action: 'updateSettings',
+          data: updateData
+        })
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      const result = await response.json();
+      console.log('Settings update response:', result);
+      
+      return result.success ? result.data : null;
+    } catch (error) {
+      console.error("Failed to update general settings:", error);
+      return null;
+    }
+  },
+  
+  async testEmailConnection(smtpConfig: any): Promise<boolean> {
+    try {
+      console.log('Testing email connection via /api/settings:', smtpConfig);
+      const response = await fetch('/api/settings', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json'
+        },
+        body: JSON.stringify({ 
+          action: 'testEmailConnection',
+          data: smtpConfig
+        })
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      const result = await response.json();
+      return result.success || false;
+    } catch (error) {
+      console.error("Failed to test email connection:", error);
+      return false;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/ssl/index.ts b/application/src/services/ssl/index.ts
new file mode 100644
index 0000000..c12a334
--- /dev/null
+++ b/application/src/services/ssl/index.ts
@@ -0,0 +1,32 @@
+
+// Re-export all SSL-related functionality for domain SSL checking
+// Use explicit re-exports to avoid naming conflicts
+
+// SSL Status utilities
+export { determineSSLStatus } from './sslStatusUtils';
+
+// Primary export for fetchSSLCertificates
+export { fetchSSLCertificates } from './sslFetchService';
+
+// Certificate operations
+export { 
+  addSSLCertificate,
+  checkAndUpdateCertificate,
+  deleteSSLCertificate,
+  refreshAllCertificates,
+  triggerImmediateCheck
+} from './sslCertificateOperations';
+
+// SSL-specific notification service
+export {
+  checkAllCertificatesAndNotify,
+  checkCertificateAndNotify,
+  shouldRunDailyCheck,
+  sendSSLNotification
+} from './notification';
+
+// Export types
+export type { SSLCertificate, AddSSLCertificateDto, SSLNotification } from './types';
+
+// Export utility functions for SSL operations
+export { calculateDaysRemaining, isValid } from './utils';
\ No newline at end of file
diff --git a/application/src/services/ssl/notification/index.ts b/application/src/services/ssl/notification/index.ts
new file mode 100644
index 0000000..7c5d17c
--- /dev/null
+++ b/application/src/services/ssl/notification/index.ts
@@ -0,0 +1,9 @@
+
+// Export all SSL notification related functionality
+export { 
+  checkAllCertificatesAndNotify,
+  checkCertificateAndNotify
+} from './sslCheckNotifier';
+
+export { sendSSLNotification } from './sslNotificationSender';
+export { shouldRunDailyCheck } from './sslScheduleUtils';
\ No newline at end of file
diff --git a/application/src/services/ssl/notification/sslCheckNotifier.ts b/application/src/services/ssl/notification/sslCheckNotifier.ts
new file mode 100644
index 0000000..e35a494
--- /dev/null
+++ b/application/src/services/ssl/notification/sslCheckNotifier.ts
@@ -0,0 +1,53 @@
+
+import { pb } from "@/lib/pocketbase";
+import { SSLCertificate } from "@/types/ssl.types";
+
+/**
+ * Check a single SSL certificate - notifications are now handled by the backend
+ */
+export const checkCertificateAndNotify = async (certificate: SSLCertificate): Promise<void> => {
+  try {
+   // console.log(`Checking certificate for ${certificate.domain}...`);
+    
+    // The actual SSL checking and notifications are now handled by the Go service
+    // We just need to trigger a check by updating the check_at timestamp
+    
+    const now = new Date();
+    
+    // Update check_at to trigger backend check
+    await pb.collection('ssl_certificates').update(certificate.id, {
+      check_at: now.toISOString()
+    });
+        
+  } catch (error) {
+    throw error;
+  }
+};
+
+/**
+ * Check all SSL certificates - backend handles the actual checking and notifications
+ */
+export const checkAllCertificatesAndNotify = async (): Promise<{ success: number; failed: number }> => {
+  try {
+  
+    const response = await pb.collection('ssl_certificates').getList(1, 100);
+    const certificates = response.items as unknown as SSLCertificate[];
+        
+    let success = 0;
+    let failed = 0;
+    
+    for (const cert of certificates) {
+      try {
+        await checkCertificateAndNotify(cert);
+        success++;
+      } catch (error) {
+        failed++;
+      }
+    }
+    
+    return { success, failed };
+    
+  } catch (error) {
+    throw error;
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/ssl/notification/sslNotificationSender.ts b/application/src/services/ssl/notification/sslNotificationSender.ts
new file mode 100644
index 0000000..c104366
--- /dev/null
+++ b/application/src/services/ssl/notification/sslNotificationSender.ts
@@ -0,0 +1,141 @@
+
+import { pb } from "@/lib/pocketbase";
+import { SSLCertificate, SSLNotification } from "../types";
+import { AlertConfiguration } from "@/services/alertConfigService";
+
+/**
+ * Dedicated function to send SSL certificate notifications
+ */
+export async function sendSSLNotification(
+  certificate: SSLCertificate, 
+  message: string, 
+  isCritical: boolean
+): Promise<boolean> {
+  try {
+    // Check if notification channel is set
+    if (!certificate.notification_channel) {
+    //  console.log(`No notification channel set for certificate: ${certificate.domain}`);
+      return false;
+    }
+    
+    // Fetch the notification configuration
+    const alertConfigRecord = await pb.collection('alert_configurations').getOne(certificate.notification_channel);
+    
+    if (!alertConfigRecord) {
+    //  console.error(`Alert configuration not found for ID: ${certificate.notification_channel}`);
+      return false;
+    }
+    
+    if (!alertConfigRecord.enabled) {
+    //  console.log(`Alert configuration is disabled for certificate: ${certificate.domain}`);
+      return false;
+    }
+    
+    // Convert PocketBase record to AlertConfiguration
+    const alertConfig: AlertConfiguration = {
+      id: alertConfigRecord.id,
+      collectionId: alertConfigRecord.collectionId,
+      collectionName: alertConfigRecord.collectionName,
+      service_id: alertConfigRecord.service_id || "",
+      notification_type: alertConfigRecord.notification_type,
+      telegram_chat_id: alertConfigRecord.telegram_chat_id,
+      discord_webhook_url: alertConfigRecord.discord_webhook_url,
+      signal_number: alertConfigRecord.signal_number,
+      notify_name: alertConfigRecord.notify_name,
+      bot_token: alertConfigRecord.bot_token,
+      template_id: alertConfigRecord.template_id,
+      slack_webhook_url: alertConfigRecord.slack_webhook_url,
+      enabled: alertConfigRecord.enabled,
+      created: alertConfigRecord.created,
+      updated: alertConfigRecord.updated
+    };
+    
+    // Create an SSL notification object for tracking
+    const sslNotification: SSLNotification = {
+      certificateId: certificate.id,
+      domain: certificate.domain,
+      message: message,
+      isCritical: isCritical,
+      timestamp: new Date().toISOString()
+    };
+    
+    // Send the notification based on the notification type
+    return await sendNotificationByType(alertConfig, certificate, message, isCritical, sslNotification);
+    
+  } catch (error) {
+   // console.error("Error sending SSL notification:", error);
+    return false;
+  }
+}
+
+/**
+ * Send notification based on notification channel type
+ */
+async function sendNotificationByType(
+  alertConfig: AlertConfiguration,
+  certificate: SSLCertificate,
+  message: string,
+  isCritical: boolean,
+  notification: SSLNotification
+): Promise<boolean> {
+  switch (alertConfig.notification_type) {
+    case 'telegram':
+      return await sendTelegramNotification(alertConfig, certificate, message, isCritical);
+    // Add other notification types as they are implemented
+    // case 'discord':
+    //   return await sendDiscordNotification(alertConfig, certificate, message, isCritical);
+    // case 'slack':
+    //   return await sendSlackNotification(alertConfig, certificate, message, isCritical);
+    default:
+    //  console.log(`Notification type ${alertConfig.notification_type} not implemented yet for SSL certificates`);
+      return false;
+  }
+}
+
+/**
+ * Send notification via Telegram
+ */
+async function sendTelegramNotification(
+  alertConfig: AlertConfiguration,
+  certificate: SSLCertificate,
+  message: string,
+  isCritical: boolean
+): Promise<boolean> {
+  if (!alertConfig.bot_token || !alertConfig.telegram_chat_id) {
+  //  console.error("Missing Telegram bot token or chat ID");
+    return false;
+  }
+  
+  const telegramUrl = `https://api.telegram.org/bot${alertConfig.bot_token}/sendMessage`;
+  const severity = isCritical ? "🚨 CRITICAL" : "⚠️ WARNING";
+  
+  // Enhanced message with more SSL certificate details
+  const enhancedMessage = `${severity}: SSL Certificate Alert
+  
+Domain: ${certificate.domain}
+Days Remaining: ${certificate.days_left}
+Expiration Date: ${certificate.valid_till}
+Status: ${certificate.status.toUpperCase()}
+
+${message}
+
+This is an automated notification from your SSL certificate monitoring system.`;
+  
+  try {
+    const response = await fetch(telegramUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        chat_id: alertConfig.telegram_chat_id,
+        text: enhancedMessage,
+        parse_mode: 'Markdown'
+      })
+    });
+    
+    const result = await response.json();
+    return result.ok === true;
+  } catch (error) {
+    console.error("Error sending Telegram notification:", error);
+    return false;
+  }
+}
\ No newline at end of file
diff --git a/application/src/services/ssl/notification/sslScheduleUtils.ts b/application/src/services/ssl/notification/sslScheduleUtils.ts
new file mode 100644
index 0000000..5ae250e
--- /dev/null
+++ b/application/src/services/ssl/notification/sslScheduleUtils.ts
@@ -0,0 +1,27 @@
+
+/**
+ * Check if SSL certificate daily check should run
+ * This helps implement the once-per-day check logic
+ */
+export function shouldRunDailyCheck(): boolean {
+    const lastRunKey = 'ssl_daily_check_last_run';
+    const lastRun = localStorage.getItem(lastRunKey);
+    
+    if (!lastRun) {
+      // First time running, save timestamp and run
+      localStorage.setItem(lastRunKey, new Date().toISOString());
+      return true;
+    }
+    
+    const lastRunDate = new Date(lastRun).setHours(0, 0, 0, 0);
+    const today = new Date().setHours(0, 0, 0, 0);
+    
+    // If last run was not today, run again
+    if (lastRunDate < today) {
+      localStorage.setItem(lastRunKey, new Date().toISOString());
+      return true;
+    }
+    
+    // Already ran today
+    return false;
+  }
\ No newline at end of file
diff --git a/application/src/services/ssl/sslCertificateOperations.ts b/application/src/services/ssl/sslCertificateOperations.ts
new file mode 100644
index 0000000..830d29b
--- /dev/null
+++ b/application/src/services/ssl/sslCertificateOperations.ts
@@ -0,0 +1,134 @@
+
+import { pb } from "@/lib/pocketbase";
+import type { AddSSLCertificateDto, SSLCertificate } from "./types";
+import { determineSSLStatus } from "./sslStatusUtils";
+import { checkCertificateAndNotify } from "./notification"; // Import notification service
+import { toast } from "sonner";
+
+/**
+ * Add a new SSL certificate to monitor
+ * Note: SSL checking is now handled by the Go service
+ */
+export const addSSLCertificate = async (
+  certificateData: AddSSLCertificateDto
+): Promise<SSLCertificate> => {
+  try {
+    const currentTime = new Date().toISOString();
+    
+    // Prepare the data for saving to database
+    // The Go service will handle the actual SSL checking
+    const data = {
+      domain: certificateData.domain,
+      issued_to: certificateData.domain, // Will be updated by Go service
+      issuer_o: "", // Will be updated by Go service
+      status: "pending", // Initial status
+      cert_sans: "",
+      cert_alg: "",
+      serial_number: "",
+      valid_from: currentTime, // Will be updated by Go service
+      valid_till: currentTime, // Will be updated by Go service
+      validity_days: 0, // Will be updated by Go service
+      days_left: 0, // Will be updated by Go service
+      warning_threshold: Number(certificateData.warning_threshold) || 30,
+      expiry_threshold: Number(certificateData.expiry_threshold) || 7,
+      notification_channel: certificateData.notification_channel || "",
+      notification_id: certificateData.notification_id || "", // Multi notification channels
+      template_id: certificateData.template_id || "", // Alert template ID
+      check_interval: Number(certificateData.check_interval) || 1, // New field
+      check_at: currentTime, // Set to current time to trigger immediate check
+    };
+
+    // Save to database
+    const record = await pb.collection("ssl_certificates").create(data);
+
+    return record as unknown as SSLCertificate;
+  } catch (error) {
+    throw error;
+  }
+};
+
+/**
+ * Check and update a specific SSL certificate
+ * Note: This now relies on the Go service for SSL data fetching
+ */
+export const checkAndUpdateCertificate = async (
+  certificateId: string
+): Promise<SSLCertificate> => {
+  try {
+    // Get the certificate from database
+    const certificate = await pb.collection("ssl_certificates").getOne(certificateId);
+
+    if (!certificate) {
+      throw new Error(`Certificate with ID ${certificateId} not found`);
+    }
+
+    const typedCertificate = certificate as unknown as SSLCertificate;
+    
+    // The Go service will handle the actual SSL checking and updating
+    // For now, we'll just trigger notifications based on current data
+    await checkCertificateAndNotify(typedCertificate);
+    
+    // Return the current certificate data
+    return typedCertificate;
+  } catch (error) {
+    throw error;
+  }
+};
+
+/**
+ * Trigger immediate SSL check by setting check_at to current time
+ */
+export const triggerImmediateCheck = async (certificateId: string): Promise<void> => {
+  try {
+    const currentTime = new Date().toISOString();
+    
+    // Update the check_at field to current time to trigger immediate check by Go service
+    await pb.collection("ssl_certificates").update(certificateId, {
+      check_at: currentTime
+    });
+    
+    toast.success("SSL check scheduled - certificate will be checked shortly");
+  } catch (error) {
+    toast.error("Failed to schedule SSL check");
+    throw error;
+  }
+};
+
+/**
+ * Delete an SSL certificate from monitoring
+ */
+export const deleteSSLCertificate = async (id: string): Promise<boolean> => {
+  try {
+    await pb.collection("ssl_certificates").delete(id);
+    return true;
+  } catch (error) {
+    throw error;
+  }
+};
+
+/**
+ * Refresh all SSL certificates
+ * Note: The Go service handles the actual SSL checking
+ */
+export const refreshAllCertificates = async (): Promise<{ success: number; failed: number }> => {
+  try {
+    const response = await pb.collection("ssl_certificates").getList(1, 100);
+    const certificates = response.items as unknown as SSLCertificate[];
+
+    let success = 0;
+    let failed = 0;
+
+    for (const cert of certificates) {
+      try {
+        await checkCertificateAndNotify(cert);
+        success++;
+      } catch (error) {
+        failed++;
+      }
+    }
+
+    return { success, failed };
+  } catch (error) {
+    throw error;
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/ssl/sslCheckerService.ts b/application/src/services/ssl/sslCheckerService.ts
new file mode 100644
index 0000000..3e76871
--- /dev/null
+++ b/application/src/services/ssl/sslCheckerService.ts
@@ -0,0 +1,38 @@
+
+import type { SSLCheckerResponse } from "./types";
+import { toast } from "sonner";
+import { normalizeDomain, createErrorResponse } from "./sslCheckerUtils";
+
+/**
+ * Check SSL certificate for a domain
+ * Uses the reliable CORS proxy approach
+ */
+export const checkSSLCertificate = async (domain: string): Promise<SSLCheckerResponse> => {
+  try {
+   // console.log(`Checking SSL certificate for domain: ${domain}`);
+    
+    // Normalize domain (remove protocol if present)
+    const normalizedDomain = normalizeDomain(domain);
+    
+    if (!normalizedDomain) {
+      throw new Error("Invalid domain provided");
+    }
+    
+    // Use the working CORS proxy approach
+   // const result = await checkWithFetch(normalizedDomain);
+   // console.log("SSL check result:", result);
+   // return result;
+  } catch (error) {
+    //console.error("SSL check failed completely:", error);
+    toast.error(`SSL check failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    return createErrorResponse(domain, error);
+  }
+};
+
+/**
+ * Check SSL certificate using the CORS proxy
+ * This is kept for backward compatibility
+ */
+export const checkSSLApi = async (domain: string): Promise<SSLCheckerResponse> => {
+  return checkSSLCertificate(domain);
+};
\ No newline at end of file
diff --git a/application/src/services/ssl/sslCheckerUtils.ts b/application/src/services/ssl/sslCheckerUtils.ts
new file mode 100644
index 0000000..4c27156
--- /dev/null
+++ b/application/src/services/ssl/sslCheckerUtils.ts
@@ -0,0 +1,52 @@
+
+/**
+ * Normalize domain by removing protocol if present
+ */
+export const normalizeDomain = (domain: string): string => {
+    if (!domain) return '';
+    
+    // Remove any protocol (http://, https://)
+    return domain.replace(/^(https?:\/\/)/, '').trim();
+  };
+  
+  /**
+   * Create error response for SSL check failures
+   */
+  export const createErrorResponse = (domain: string, error: unknown): any => {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown SSL check error';
+    
+    const errorResponse = {
+      version: "1.0",
+      app: "ssl-checker",
+      host: domain,
+      response_time_sec: "0",
+      status: "error",
+      message: errorMessage,
+      error: errorMessage,
+      result: {
+        host: domain,
+        resolved_ip: domain,
+        issued_to: domain,
+        issued_o: null,
+        issuer_c: "Unknown",
+        issuer_o: "Unknown",
+        issuer_ou: null,
+        issuer_cn: "Unknown",
+        cert_sn: "Unknown",
+        cert_sha1: "",
+        cert_alg: "Unknown",
+        cert_ver: 0,
+        cert_sans: domain,
+        cert_exp: true,
+        cert_valid: false,
+        valid_from: "Unknown",
+        valid_till: "Unknown",
+        validity_days: 0,
+        days_left: 0,
+        valid_days_to_expire: 0,
+        hsts_header_enabled: false
+      }
+    };
+    
+    return errorResponse;
+  };
\ No newline at end of file
diff --git a/application/src/services/ssl/sslFetchService.ts b/application/src/services/ssl/sslFetchService.ts
new file mode 100644
index 0000000..087bf9c
--- /dev/null
+++ b/application/src/services/ssl/sslFetchService.ts
@@ -0,0 +1,89 @@
+
+import { pb } from "@/lib/pocketbase";
+import { SSLCertificate } from "@/types/ssl.types";
+import { toast } from "sonner";
+
+/**
+ * Fetch SSL certificates from PocketBase
+ */
+export const fetchSSLCertificates = async (): Promise<SSLCertificate[]> => {
+  try {
+  //  console.log("Fetching SSL certificates from PocketBase...");
+    
+    // Using the direct API path to fetch SSL certificates
+    const endpoint = "/api/collections/ssl_certificates/records";
+    const params = {
+      page: 1,
+      perPage: 200,
+      sort: "-created",
+      cache: Date.now() // Prevent caching by adding a timestamp
+    };
+    
+    // Convert params to query string
+    const queryString = new URLSearchParams(params as any).toString();
+    const fullEndpoint = `${endpoint}?${queryString}`;
+    
+  //  console.log("Fetching SSL certificates from:", fullEndpoint);
+    const response = await pb.send(fullEndpoint, {
+      method: "GET",
+      headers: {
+        'Cache-Control': 'no-cache',
+        'Pragma': 'no-cache'
+      }
+    });
+
+    // Check if response has expected structure
+    if (!response || !response.items) {
+      console.error("Invalid response format:", response);
+      toast.error("Failed to fetch SSL certificates: Invalid response format");
+      throw new Error("Invalid response format from PocketBase API");
+    }
+
+   // console.log("Received SSL certificates:", response.items.length);
+    
+    // Map items to SSLCertificate[] type with validation
+    return response.items.map(item => {
+      const cert = item as SSLCertificate;
+      
+      // Log certificate details for debugging
+   //   console.log(`Certificate for ${cert.domain}: Issued by ${cert.issuer_o}, Days left: ${cert.days_left}`);
+      
+      // Ensure dates are valid
+      try {
+        if (cert.valid_from) new Date(cert.valid_from).toISOString();
+        if (cert.valid_till) new Date(cert.valid_till).toISOString();
+        if (cert.last_notified) new Date(cert.last_notified).toISOString();
+      } catch (e) {
+    //    console.warn("Invalid date found in certificate", cert.id, e);
+        // Fix invalid dates if needed
+        if (cert.valid_from && isNaN(new Date(cert.valid_from).getTime())) {
+          cert.valid_from = new Date().toISOString();
+        }
+        if (cert.valid_till && isNaN(new Date(cert.valid_till).getTime())) {
+          const futureDate = new Date();
+          futureDate.setFullYear(futureDate.getFullYear() + 1);
+          cert.valid_till = futureDate.toISOString();
+        }
+      }
+      
+      // Calculate days left if not provided
+      if (typeof cert.days_left !== 'number' && cert.valid_till) {
+        try {
+          const expirationDate = new Date(cert.valid_till);
+          const currentDate = new Date();
+          const diffTime = expirationDate.getTime() - currentDate.getTime();
+          cert.days_left = Math.ceil(diffTime / (1000 * 3600 * 24));
+        } catch (e) {
+     //     console.warn("Error calculating days_left for certificate", cert.id, e);
+          cert.days_left = 0;
+        }
+      }
+      
+      return cert;
+    });
+  } catch (error) {
+   // console.error("Error fetching SSL certificates:", error);
+    toast.error("Failed to fetch SSL certificates. Please try again later.");
+    throw error;
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/ssl/sslStatusUtils.ts b/application/src/services/ssl/sslStatusUtils.ts
new file mode 100644
index 0000000..566ca34
--- /dev/null
+++ b/application/src/services/ssl/sslStatusUtils.ts
@@ -0,0 +1,15 @@
+
+/**
+ * Determine SSL certificate status based on days left
+ */
+export const determineSSLStatus = (daysLeft: number, warningThreshold: number, expiryThreshold: number): string => {
+    if (daysLeft <= 0) {
+      return "expired";
+    } else if (daysLeft <= expiryThreshold) {
+      return "expiring_soon";
+    } else if (daysLeft > expiryThreshold) {
+      return "valid";
+    } else {
+      return "unknown";
+    }
+  };
\ No newline at end of file
diff --git a/application/src/services/ssl/types.ts b/application/src/services/ssl/types.ts
new file mode 100644
index 0000000..c164b59
--- /dev/null
+++ b/application/src/services/ssl/types.ts
@@ -0,0 +1,56 @@
+
+// SSL Certificate DTO for adding new certificates
+export interface AddSSLCertificateDto {
+  domain: string;
+  warning_threshold: number;
+  expiry_threshold: number;
+  notification_channel: string;
+  alert_template?: string; // New field for SSL alert template
+  notification_id?: string; // Multi notification channels as comma-separated string
+  template_id?: string; // Alert template ID for PocketBase
+  check_interval?: number; // New field for check interval in days
+}
+
+// SSL Certificate model
+export interface SSLCertificate {
+  id: string;
+  domain: string;
+  issued_to: string;
+  issuer_o: string;
+  status: string;
+  cert_sans?: string;
+  cert_alg?: string;
+  serial_number?: number | string;
+  valid_from: string;
+  valid_till: string;
+  validity_days: number;
+  days_left: number;
+  valid_days_to_expire?: number;
+  warning_threshold: number;
+  expiry_threshold: number;
+  notification_channel: string;
+  alert_template?: string; // New field for SSL alert template
+  // PocketBase specific fields
+  notification_id?: string; // Multi notification channels as comma-separated string
+  template_id?: string; // Alert template ID for PocketBase
+  last_notified?: string;
+  created?: string;
+  updated?: string;
+  // New fields
+  check_interval?: number; // Check interval in days
+  check_at?: string; // Next check time
+  // Existing fields based on the provided structure
+  collectionId?: string;
+  collectionName?: string;
+  resolved_ip?: string;
+  issuer_cn?: string;
+}
+
+// SSL specific notification types
+export interface SSLNotification {
+  certificateId: string;
+  domain: string;
+  message: string;
+  isCritical: boolean;
+  timestamp: string;
+}
\ No newline at end of file
diff --git a/application/src/services/ssl/utils.ts b/application/src/services/ssl/utils.ts
new file mode 100644
index 0000000..9140590
--- /dev/null
+++ b/application/src/services/ssl/utils.ts
@@ -0,0 +1,23 @@
+
+// Calculate days remaining from expiration date
+export function calculateDaysRemaining(validTo: string): number {
+  try {
+    const expirationDate = new Date(validTo);
+    const currentDate = new Date();
+    const diffTime = expirationDate.getTime() - currentDate.getTime();
+    return Math.ceil(diffTime / (1000 * 3600 * 24)); // Convert ms to days
+  } catch (error) {
+    console.error("Error calculating days remaining:", error);
+    return 0;
+  }
+}
+
+// Check if the certificate is valid
+export function isValid(validTo: string): boolean {
+  try {
+    return new Date(validTo).getTime() > Date.now();
+  } catch (error) {
+    console.error("Error checking certificate validity:", error);
+    return false;
+  }
+}
\ No newline at end of file
diff --git a/application/src/services/sslCertificateService.ts b/application/src/services/sslCertificateService.ts
new file mode 100644
index 0000000..2cdb65f
--- /dev/null
+++ b/application/src/services/sslCertificateService.ts
@@ -0,0 +1,30 @@
+
+// This file re-exports all SSL certificate related services for backward compatibility
+import { 
+  fetchSSLCertificates,
+  addSSLCertificate,
+  checkAndUpdateCertificate,
+  triggerImmediateCheck,
+  deleteSSLCertificate
+} from './ssl';
+
+import { determineSSLStatus } from './ssl/sslStatusUtils';
+
+// Import from the new refactored location
+import {
+  checkAllCertificatesAndNotify,
+  checkCertificateAndNotify,
+  shouldRunDailyCheck
+} from './ssl/notification';
+
+export {
+  determineSSLStatus,
+  fetchSSLCertificates,
+  addSSLCertificate,
+  checkAndUpdateCertificate,
+  triggerImmediateCheck,
+  deleteSSLCertificate,
+  checkAllCertificatesAndNotify,
+  checkCertificateAndNotify,
+  shouldRunDailyCheck
+};
\ No newline at end of file
diff --git a/application/src/services/sslCheckerService.ts b/application/src/services/sslCheckerService.ts
new file mode 100644
index 0000000..0b21675
--- /dev/null
+++ b/application/src/services/sslCheckerService.ts
@@ -0,0 +1,5 @@
+
+// This file re-exports the SSL checker functionality from different implementations
+// Primary implementation is in sslCheckerService.ts in the ssl folder
+
+export { checkSSLCertificate, checkSSLApi } from './ssl/sslCheckerService';
diff --git a/application/src/services/sslNotificationTemplateService.ts b/application/src/services/sslNotificationTemplateService.ts
new file mode 100644
index 0000000..5dba96f
--- /dev/null
+++ b/application/src/services/sslNotificationTemplateService.ts
@@ -0,0 +1,87 @@
+
+import { pb } from "@/lib/pocketbase";
+
+export interface SslNotificationTemplate {
+  id: string;
+  collectionId: string;
+  collectionName: string;
+  name: string;
+  expired: string;
+  exiring_soon: string;
+  warning: string;
+  placeholder: string;
+  created: string;
+  updated: string;
+}
+
+export interface CreateUpdateSslNotificationTemplateData {
+  name: string;
+  expired: string;
+  exiring_soon: string;
+  warning: string;
+  placeholder: string;
+}
+
+export const sslNotificationTemplateService = {
+  async getTemplates(): Promise<SslNotificationTemplate[]> {
+    try {
+    //  console.log("Fetching SSL notification templates");
+      const response = await pb.collection('ssl_notification_templates').getList(1, 50, {
+        sort: '-created',
+      });
+    //  console.log("SSL notification templates response:", response);
+      return response.items as unknown as SslNotificationTemplate[];
+    } catch (error) {
+    //  console.error("Error fetching SSL notification templates:", error);
+      throw error;
+    }
+  },
+
+  async getTemplate(id: string): Promise<SslNotificationTemplate> {
+    try {
+     // console.log(`Fetching SSL notification template with id: ${id}`);
+      const response = await pb.collection('ssl_notification_templates').getOne(id);
+    //  console.log("SSL notification template response:", response);
+      return response as unknown as SslNotificationTemplate;
+    } catch (error) {
+    //  console.error(`Error fetching SSL notification template with id ${id}:`, error);
+      throw error;
+    }
+  },
+
+  async createTemplate(data: CreateUpdateSslNotificationTemplateData): Promise<SslNotificationTemplate> {
+    try {
+     // console.log("Creating new SSL notification template with data:", data);
+      const response = await pb.collection('ssl_notification_templates').create(data);
+     // console.log("Create SSL notification template response:", response);
+      return response as unknown as SslNotificationTemplate;
+    } catch (error) {
+     // console.error("Error creating SSL notification template:", error);
+      throw error;
+    }
+  },
+
+  async updateTemplate(id: string, data: Partial<CreateUpdateSslNotificationTemplateData>): Promise<SslNotificationTemplate> {
+    try {
+    //  console.log(`Updating SSL notification template with id: ${id}`, data);
+      const response = await pb.collection('ssl_notification_templates').update(id, data);
+    //  console.log("Update SSL notification template response:", response);
+      return response as unknown as SslNotificationTemplate;
+    } catch (error) {
+    //  console.error(`Error updating SSL notification template with id ${id}:`, error);
+      throw error;
+    }
+  },
+
+  async deleteTemplate(id: string): Promise<boolean> {
+    try {
+     // console.log(`Deleting SSL notification template with id: ${id}`);
+      await pb.collection('ssl_notification_templates').delete(id);
+     // console.log("SSL notification template deleted successfully");
+      return true;
+    } catch (error) {
+    //  console.error(`Error deleting SSL notification template with id ${id}:`, error);
+      throw error;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/statusPageComponentsService.ts b/application/src/services/statusPageComponentsService.ts
new file mode 100644
index 0000000..6e91d10
--- /dev/null
+++ b/application/src/services/statusPageComponentsService.ts
@@ -0,0 +1,131 @@
+
+import { pb, getCurrentEndpoint } from '@/lib/pocketbase';
+import { StatusPageComponentRecord } from '@/types/statusPageComponents.types';
+
+export const statusPageComponentsService = {
+  async getStatusPageComponents(): Promise<StatusPageComponentRecord[]> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/status_page_components/records`, {
+        method: 'GET',
+        headers,
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      const result = await response.json();
+      return result.items || [];
+    } catch (error) {
+     // console.error('Error fetching status page components:', error);
+      throw error;
+    }
+  },
+
+  async getStatusPageComponentsByOperationalId(operationalStatusId: string): Promise<StatusPageComponentRecord[]> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/status_page_components/records?filter=(operational_status_id='${operationalStatusId}')`, {
+        method: 'GET',
+        headers,
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      const result = await response.json();
+      return result.items || [];
+    } catch (error) {
+    //  console.error('Error fetching status page components by operational ID:', error);
+      throw error;
+    }
+  },
+
+  async createStatusPageComponent(data: {
+    operational_status_id: string;
+    name: string;
+    description: string;
+    service_id: string;
+    server_id: string;
+    display_order: number;
+  }): Promise<StatusPageComponentRecord> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+     // console.log('Creating status page component with data:', data);
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/status_page_components/records`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(data),
+      });
+
+      if (!response.ok) {
+        const errorText = await response.text();
+        console.error('Error response:', errorText);
+        throw new Error(`HTTP error! status: ${response.status} - ${errorText}`);
+      }
+
+      const result = await response.json();
+     // console.log('Created component:', result);
+      return result;
+    } catch (error) {
+     // console.error('Error creating status page component:', error);
+      throw error;
+    }
+  },
+
+  async deleteStatusPageComponent(id: string): Promise<void> {
+    try {
+      const authToken = pb.authStore.token;
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+      };
+
+      if (authToken) {
+        headers['Authorization'] = `Bearer ${authToken}`;
+      }
+
+      const baseUrl = getCurrentEndpoint();
+      const response = await fetch(`${baseUrl}/api/collections/status_page_components/records/${id}`, {
+        method: 'DELETE',
+        headers,
+      });
+
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+    } catch (error) {
+     // console.error('Error deleting status page component:', error);
+      throw error;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/templateService.ts b/application/src/services/templateService.ts
new file mode 100644
index 0000000..47f8ae1
--- /dev/null
+++ b/application/src/services/templateService.ts
@@ -0,0 +1,143 @@
+import { pb } from "@/lib/pocketbase";
+import { 
+  serverNotificationTemplateService, 
+  ServerNotificationTemplate,
+  CreateUpdateServerNotificationTemplateData 
+} from "./serverNotificationTemplateService";
+import { 
+  serviceNotificationTemplateService, 
+  ServiceNotificationTemplate,
+  CreateUpdateServiceNotificationTemplateData 
+} from "./serviceNotificationTemplateService";
+import { 
+  sslNotificationTemplateService, 
+  SslNotificationTemplate,
+  CreateUpdateSslNotificationTemplateData 
+} from "./sslNotificationTemplateService";
+import { 
+  serverThresholdService, 
+  ServerThreshold,
+  CreateUpdateServerThresholdData 
+} from "./serverThresholdService";
+
+export type TemplateType = 'server' | 'service' | 'ssl' | 'server_threshold';
+
+export type AnyTemplate = ServerNotificationTemplate | ServiceNotificationTemplate | SslNotificationTemplate | ServerThreshold;
+export type AnyTemplateData = CreateUpdateServerNotificationTemplateData | CreateUpdateServiceNotificationTemplateData | CreateUpdateSslNotificationTemplateData | CreateUpdateServerThresholdData;
+
+// Export individual template types
+export type { ServerNotificationTemplate, ServiceNotificationTemplate, SslNotificationTemplate, ServerThreshold };
+export type { CreateUpdateServerNotificationTemplateData, CreateUpdateServiceNotificationTemplateData, CreateUpdateSslNotificationTemplateData, CreateUpdateServerThresholdData };
+
+export const templateService = {
+  async getTemplates(type: TemplateType): Promise<AnyTemplate[]> {
+    switch (type) {
+      case 'server':
+        return serverNotificationTemplateService.getTemplates();
+      case 'service':
+        return serviceNotificationTemplateService.getTemplates();
+      case 'ssl':
+        return sslNotificationTemplateService.getTemplates();
+      case 'server_threshold':
+        return serverThresholdService.getServerThresholds();
+      default:
+        throw new Error(`Unknown template type: ${type}`);
+    }
+  },
+
+  async getTemplate(id: string, type: TemplateType): Promise<AnyTemplate> {
+    switch (type) {
+      case 'server':
+        return serverNotificationTemplateService.getTemplate(id);
+      case 'service':
+        return serviceNotificationTemplateService.getTemplate(id);
+      case 'ssl':
+        return sslNotificationTemplateService.getTemplate(id);
+      case 'server_threshold':
+        return serverThresholdService.getServerThreshold(id);
+      default:
+        throw new Error(`Unknown template type: ${type}`);
+    }
+  },
+
+  async createTemplate(data: AnyTemplateData, type: TemplateType): Promise<AnyTemplate> {
+    switch (type) {
+      case 'server':
+        return serverNotificationTemplateService.createTemplate(data as CreateUpdateServerNotificationTemplateData);
+      case 'service':
+        return serviceNotificationTemplateService.createTemplate(data as CreateUpdateServiceNotificationTemplateData);
+      case 'ssl':
+        return sslNotificationTemplateService.createTemplate(data as CreateUpdateSslNotificationTemplateData);
+      case 'server_threshold':
+        return serverThresholdService.createServerThreshold(data as CreateUpdateServerThresholdData);
+      default:
+        throw new Error(`Unknown template type: ${type}`);
+    }
+  },
+
+  async updateTemplate(id: string, data: Partial<AnyTemplateData>, type: TemplateType): Promise<AnyTemplate> {
+    switch (type) {
+      case 'server':
+        return serverNotificationTemplateService.updateTemplate(id, data as Partial<CreateUpdateServerNotificationTemplateData>);
+      case 'service':
+        return serviceNotificationTemplateService.updateTemplate(id, data as Partial<CreateUpdateServiceNotificationTemplateData>);
+      case 'ssl':
+        return sslNotificationTemplateService.updateTemplate(id, data as Partial<CreateUpdateSslNotificationTemplateData>);
+      case 'server_threshold':
+        return serverThresholdService.updateServerThreshold(id, data as Partial<CreateUpdateServerThresholdData>);
+      default:
+        throw new Error(`Unknown template type: ${type}`);
+    }
+  },
+
+  async deleteTemplate(id: string, type: TemplateType): Promise<boolean> {
+    switch (type) {
+      case 'server':
+        return serverNotificationTemplateService.deleteTemplate(id);
+      case 'service':
+        return serviceNotificationTemplateService.deleteTemplate(id);
+      case 'ssl':
+        return sslNotificationTemplateService.deleteTemplate(id);
+      case 'server_threshold':
+        return serverThresholdService.deleteServerThreshold(id);
+      default:
+        throw new Error(`Unknown template type: ${type}`);
+    }
+  }
+};
+
+// Template type configurations
+export const templateTypeConfigs = {
+  server: {
+    label: 'Server Monitoring',
+    description: 'Templates for server resource monitoring alerts',
+    placeholders: [
+      '${server_name}', '${cpu_usage}', '${ram_usage}', '${disk_usage}', 
+      '${network_usage}', '${cpu_temp}', '${disk_io}', '${threshold}', '${time}'
+    ]
+  },
+  service: {
+    label: 'Service Uptime',
+    description: 'Templates for service uptime monitoring alerts',
+    placeholders: [
+      '${service_name}', '${status}', '${response_time}', '${url}', 
+      '${host}', '${service_type}', '${port}', '${domain}', 
+      '${region_name}', '${agent_id}', '${uptime}', '${time}'
+    ]
+  },
+  ssl: {
+    label: 'SSL Certificate',
+    description: 'Templates for SSL certificate monitoring alerts',
+    placeholders: [
+      '${domain}', '${certificate_name}', '${expiry_date}', '${days_left}', 
+      '${issuer}', '${serial_number}', '${time}'
+    ]
+  },
+  server_threshold: {
+    label: 'Server Threshold',
+    description: 'Templates for server resource threshold configurations',
+    placeholders: [
+      '${name}', '${cpu_threshold}', '${ram_threshold}', '${disk_threshold}', '${network_threshold}'
+    ]
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/types/maintenance.types.ts b/application/src/services/types/maintenance.types.ts
new file mode 100644
index 0000000..8358bca
--- /dev/null
+++ b/application/src/services/types/maintenance.types.ts
@@ -0,0 +1,46 @@
+
+export interface MaintenanceItem {
+  id: string;
+  title: string;
+  description: string;
+  start_time: string;
+  end_time: string;
+  affected: string;
+  priority: string;
+  status: string;
+  field: string;
+  created_by: string;
+  assigned_users: string[] | string; // Can be array of user IDs or string (JSON or comma-separated)
+  notify_subscribers: string;
+  notification_channel_id?: string;
+  notification_id?: string;
+  operational_status_id?: string;
+  created: string;
+  updated: string;
+  notification_channel_name?: string; // Add this optional property for UI display purposes
+  expand?: {
+    assigned_users?: any[]; // For expanded user data
+  };
+}
+
+export interface CreateMaintenanceInput {
+  title: string;
+  description: string;
+  start_time: string;
+  end_time: string;
+  affected: string;
+  priority: string;
+  status: string;
+  field: string;
+  created_by: string;
+  assigned_users: string[] | string; // Can be array of user IDs or string representation
+  notify_subscribers: string;
+  notification_channel_id?: string;
+  notification_id?: string; // Added to ensure it's included in create operations
+}
+
+export interface MaintenanceFilter {
+  status?: string;
+  priority?: string;
+  field?: string;
+}
\ No newline at end of file
diff --git a/application/src/services/types/serverService.ts b/application/src/services/types/serverService.ts
new file mode 100644
index 0000000..179096f
--- /dev/null
+++ b/application/src/services/types/serverService.ts
@@ -0,0 +1,113 @@
+
+import { pb } from '@/lib/pocketbase';
+import { Server, ServerStats } from '@/types/server.types';
+
+export const serverService = {
+  async getServers(): Promise<Server[]> {
+    try {
+      const records = await pb.collection('servers').getFullList<Server>();
+      return records;
+    } catch (error) {
+   //   console.error('Error fetching servers:', error);
+      throw error;
+    }
+  },
+
+  async getServer(serverId: string): Promise<Server> {
+    try {
+      const record = await pb.collection('servers').getOne<Server>(serverId);
+      return record;
+    } catch (error) {
+   //   console.error('Error fetching server:', error);
+      throw error;
+    }
+  },
+
+  async getServerMetrics(serverId: string): Promise<any[]> {
+    try {
+    //  console.log('serverService.getServerMetrics: Fetching metrics for serverId:', serverId);
+      
+      // First, get the server to find the correct server_id for metrics
+      let server;
+      try {
+        server = await this.getServer(serverId);
+    //    console.log('serverService.getServerMetrics: Found server:', server);
+      } catch (error) {
+    //    console.log('serverService.getServerMetrics: Could not fetch server details:', error);
+      }
+
+      // Try to get metrics using the server's server_id field if available
+      let metricsServerId = serverId;
+      if (server && server.server_id) {
+        metricsServerId = server.server_id;
+    //    console.log('serverService.getServerMetrics: Using server.server_id for metrics:', metricsServerId);
+      }
+
+      // Try filtering by server_id first
+      let filteredRecords = await pb.collection('server_metrics').getFullList({
+        filter: `server_id = "${metricsServerId}"`,
+        sort: '-created',
+        requestKey: null
+      });
+
+    //  console.log('serverService.getServerMetrics: Filtered records by server_id:', filteredRecords.length);
+
+      // If no records found with server_id, try alternative approaches
+      if (filteredRecords.length === 0) {
+    //    console.log('serverService.getServerMetrics: No records found with server_id filter, trying alternatives...');
+        
+        // Get all records to see what's available
+        const allRecords = await pb.collection('server_metrics').getFullList({
+          sort: '-created',
+          requestKey: null
+        });
+        
+    //    console.log('serverService.getServerMetrics: Total server_metrics records:', allRecords.length);
+        if (allRecords.length > 0) {
+     //     console.log('serverService.getServerMetrics: Sample record fields:', Object.keys(allRecords[0]));
+     //     console.log('serverService.getServerMetrics: Sample server_id values:', allRecords.slice(0, 5).map(r => r.server_id));
+        }
+
+        // For now, return some sample data from available records if server matches pattern
+        // This is temporary until the correct server_id mapping is established
+        if (allRecords.length > 0) {
+      //    console.log('serverService.getServerMetrics: Using available records as fallback');
+          filteredRecords = allRecords.slice(0, 50); // Get recent 50 records
+        }
+      }
+      
+    //  console.log('serverService.getServerMetrics: Returning', filteredRecords.length, 'records');
+      return filteredRecords;
+    } catch (error) {
+     // console.error('Error fetching server metrics:', error);
+      throw error;
+    }
+  },
+
+  async getServerStats(servers: Server[]): Promise<ServerStats> {
+    const total = servers.length;
+    const online = servers.filter(server => server.status === 'up').length;
+    const offline = servers.filter(server => server.status === 'down').length;
+    const warning = servers.filter(server => server.status === 'warning').length;
+
+    return {
+      total,
+      online,
+      offline,
+      warning
+    };
+  },
+
+  formatBytes(bytes: number): string {
+    if (bytes === 0) return '0 Bytes';
+    const k = 1024;
+    const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+  },
+
+  formatUptime(uptime: string): string {
+    // Simple uptime formatting - can be enhanced based on actual format
+    return uptime;
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/uptimeService.ts b/application/src/services/uptimeService.ts
new file mode 100644
index 0000000..2da6452
--- /dev/null
+++ b/application/src/services/uptimeService.ts
@@ -0,0 +1,231 @@
+
+import { pb } from '@/lib/pocketbase';
+import { UptimeData } from '@/types/service.types';
+
+const uptimeCache = new Map<string, {
+  data: UptimeData[],
+  timestamp: number,
+  expiresIn: number
+}>();
+
+const CACHE_TTL = 3000; // 3 seconds for faster updates
+
+// Map service types to their corresponding collections
+const getCollectionForServiceType = (serviceType: string): string => {
+  const type = serviceType.toLowerCase();
+  switch (type) {
+    case 'ping':
+    case 'icmp':
+      return 'ping_data';
+    case 'dns':
+      return 'dns_data';
+    case 'tcp':
+      return 'tcp_data';
+    case 'http':
+    case 'https':
+    default:
+      return 'uptime_data';
+  }
+};
+
+export const uptimeService = {
+  async recordUptimeData(data: UptimeData): Promise<void> {
+    try {
+   //   console.log(`Recording uptime data for service ${data.serviceId || data.service_id}: Status ${data.status}, Response time: ${data.responseTime}ms`);
+      
+      const options = {
+        $autoCancel: false,
+        $cancelKey: `uptime_record_${data.serviceId || data.service_id}_${Date.now()}`
+      };
+      
+      const record = await pb.collection('uptime_data').create({
+        service_id: data.service_id || data.serviceId,
+        timestamp: data.timestamp,
+        status: data.status,
+        response_time: data.responseTime
+      }, options);
+      
+      // Invalidate cache for this service
+      const serviceId = data.service_id || data.serviceId;
+      const keysToDelete = Array.from(uptimeCache.keys()).filter(key => key.includes(`uptime_${serviceId}`));
+      keysToDelete.forEach(key => uptimeCache.delete(key));
+      
+    //  console.log(`Uptime data recorded successfully with ID: ${record.id}`);
+    } catch (error) {
+    //  console.error("Error recording uptime data:", error);
+      throw new Error(`Failed to record uptime data: ${error}`);
+    }
+  },
+  
+  async getUptimeHistory(
+    serviceId: string, 
+    limit: number = 200, 
+    startDate?: Date, 
+    endDate?: Date,
+    serviceType?: string
+  ): Promise<UptimeData[]> {
+    try {
+      if (!serviceId) {
+     //   console.log('No serviceId provided to getUptimeHistory');
+        return [];
+      }
+
+      const cacheKey = `uptime_${serviceId}_${limit}_${startDate?.toISOString() || ''}_${endDate?.toISOString() || ''}_${serviceType || 'default'}_default`;
+      
+      // Check cache
+      const cached = uptimeCache.get(cacheKey);
+      if (cached && (Date.now() - cached.timestamp) < cached.expiresIn) {
+       // console.log(`Using cached uptime history for service ${serviceId}`);
+        return cached.data;
+      }
+      
+      // Determine the correct collection based on service type
+      const collection = serviceType ? getCollectionForServiceType(serviceType) : 'uptime_data';
+     // console.log(`Fetching default uptime history for service ${serviceId} from collection ${collection}, limit: ${limit}`);
+      
+      // Build filter to get records for specific service_id
+      let filter = `service_id='${serviceId}'`;
+      
+      // Add date range filtering if provided
+      if (startDate && endDate) {
+        const startUTC = startDate.toISOString();
+        const endUTC = endDate.toISOString();
+        
+      //  console.log(`Date filter: ${startUTC} to ${endUTC}`);
+        filter += ` && timestamp >= "${startUTC}" && timestamp <= "${endUTC}"`;
+      }
+      
+      const options = {
+        filter: filter,
+        sort: '-timestamp', // Sort by timestamp descending (newest first)
+        $autoCancel: false,
+        $cancelKey: `uptime_history_${serviceId}_${Date.now()}`
+      };
+      
+     // console.log(`Filter query for default data: ${filter} on collection: ${collection}`);
+      
+      const response = await pb.collection(collection).getList(1, limit, options);
+      
+    //  console.log(`Fetched ${response.items.length} records for service ${serviceId} from ${collection}`);
+      
+      if (response.items.length > 0) {
+      //  console.log(`Date range in results: ${response.items[response.items.length - 1].timestamp} to ${response.items[0].timestamp}`);
+      } else {
+      //  console.log(`No records found for service_id '${serviceId}' in collection: ${collection}`);
+      }
+      
+      // Transform the response items to UptimeData format
+      const uptimeData = response.items.map(item => ({
+        id: item.id,
+        service_id: item.service_id,
+        serviceId: item.service_id,
+        timestamp: item.timestamp,
+        status: item.status as "up" | "down" | "warning" | "paused",
+        responseTime: item.response_time || 0,
+        date: item.timestamp,
+        uptime: 100,
+        error_message: item.error_message,
+        details: item.details
+      }));
+      
+      // Cache the result
+      uptimeCache.set(cacheKey, {
+        data: uptimeData,
+        timestamp: Date.now(),
+        expiresIn: CACHE_TTL
+      });
+      
+      return uptimeData;
+    } catch (error) {
+    //  console.error(`Error fetching uptime history for service ${serviceId}:`, error);
+      
+      // Try to return cached data as fallback
+      const cacheKey = `uptime_${serviceId}_${limit}_${startDate?.toISOString() || ''}_${endDate?.toISOString() || ''}_${serviceType || 'default'}_default`;
+      const cached = uptimeCache.get(cacheKey);
+      if (cached) {
+      //  console.log(`Using expired cached data for service ${serviceId} due to fetch error`);
+        return cached.data;
+      }
+      
+      // Return empty array instead of throwing to prevent UI crashes
+    //  console.log(`Returning empty array for service ${serviceId} due to fetch error`);
+      return [];
+    }
+  },
+
+  async getUptimeHistoryByRegionalAgent(
+    serviceId: string, 
+    limit: number = 50, 
+    startDate?: Date, 
+    endDate?: Date, 
+    serviceType?: string,
+    regionName?: string,
+    agentId?: string
+  ): Promise<UptimeData[]> {
+    try {
+      if (!regionName || !agentId) {
+      //  console.log('No region name or agent ID provided for regional query');
+        return [];
+      }
+
+      const cacheKey = `uptime_${serviceId}_${limit}_${startDate?.toISOString() || ''}_${endDate?.toISOString() || ''}_${serviceType || 'default'}_${regionName}_${agentId}`;
+      
+      // Check cache
+      const cached = uptimeCache.get(cacheKey);
+      if (cached && (Date.now() - cached.timestamp) < cached.expiresIn) {
+      //  console.log(`Using cached regional uptime history for service ${serviceId}`);
+        return cached.data;
+      }
+
+      // Determine the correct collection based on service type
+      const collection = serviceType ? getCollectionForServiceType(serviceType) : 'uptime_data';
+     // console.log(`Fetching regional uptime history from collection: ${collection} for service: ${serviceId}, region: ${regionName}, agent: ${agentId}`);
+
+      // Build filter for regional agent data
+      let filter = `service_id="${serviceId}" && region_name="${regionName}" && agent_id="${agentId}"`;
+
+      if (startDate && endDate) {
+        const startISO = startDate.toISOString();
+        const endISO = endDate.toISOString();
+        filter += ` && timestamp>="${startISO}" && timestamp<="${endISO}"`;
+      }
+
+    //  console.log(`Regional filter query: ${filter} on collection: ${collection}`);
+
+      const records = await pb.collection(collection).getList(1, limit, {
+        sort: '-timestamp',
+        filter: filter,
+        $autoCancel: false,
+        $cancelKey: `regional_uptime_history_${serviceId}_${Date.now()}`
+      });
+
+    //  console.log(`Retrieved ${records.items.length} regional uptime records from ${collection} for region ${regionName}, agent ${agentId}`);
+
+      const uptimeData = records.items.map(item => ({
+        id: item.id,
+        service_id: item.service_id,
+        serviceId: item.service_id,
+        timestamp: item.timestamp,
+        status: item.status as "up" | "down" | "paused" | "warning",
+        responseTime: item.response_time || item.responseTime || 0,
+        error_message: item.error_message,
+        details: item.details,
+        created: item.created,
+        updated: item.updated
+      }));
+
+      // Cache the result
+      uptimeCache.set(cacheKey, {
+        data: uptimeData,
+        timestamp: Date.now(),
+        expiresIn: CACHE_TTL
+      });
+
+      return uptimeData;
+    } catch (error) {
+      const collectionForError = serviceType ? getCollectionForServiceType(serviceType) : 'uptime_data';
+    //  console.error(`Error fetching regional uptime history from ${collectionForError}:`, error);
+      return [];
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/userService.ts b/application/src/services/userService.ts
new file mode 100644
index 0000000..aceeb81
--- /dev/null
+++ b/application/src/services/userService.ts
@@ -0,0 +1,309 @@
+import { pb } from "@/lib/pocketbase";
+
+export interface User {
+  id: string;
+  created: string;
+  updated: string;
+  username: string;
+  email: string;
+  emailVisibility: boolean;
+  verified: boolean;
+  full_name?: string;
+  avatar?: string;
+  role?: string;
+  isActive?: boolean;
+  status?: string; // Added this field to support the backend status
+}
+
+export interface CreateUserData {
+  username: string;
+  email: string;
+  password: string;
+  passwordConfirm: string;
+  full_name?: string;
+  avatar?: string;
+  role?: string;
+  isActive?: boolean;
+  emailVisibility?: boolean;
+}
+
+export interface UpdateUserData {
+  username?: string;
+  email?: string;
+  emailVisibility?: boolean;
+  full_name?: string;
+  avatar?: string;
+  role?: string;
+  isActive?: boolean;
+}
+
+// Helper function to convert PocketBase record to User type
+const convertToUserType = (record: any, role: string = "admin"): User => {
+  return {
+    id: record.id,
+    created: record.created,
+    updated: record.updated,
+    username: record.username,
+    email: record.email,
+    emailVisibility: record.emailVisibility,
+    verified: record.verified,
+    full_name: record.full_name,
+    avatar: record.avatar,
+    role: role,
+    isActive: record.isActive,
+    status: record.status,
+  };
+};
+
+export const userService = {
+  async getUsers(): Promise<User[] | null> {
+    try {
+     // console.log("Calling getUsers API");
+      
+      // Get both regular users and superadmins
+      const regularUsers = await pb.collection('users').getList(1, 50, {
+        sort: 'created',
+      });
+      
+      let superadminUsers: any = [];
+      try {
+        // Try to get superadmin users if exists
+        superadminUsers = await pb.collection('_superusers').getList(1, 50, {
+          sort: 'created',
+        });
+       // console.log("Successfully fetched superadmin users:", superadminUsers);
+      } catch (error) {
+       // console.log("No superadmin collection or access rights:", error);
+      }
+      
+      // Combine both user types and mark superadmins
+      const allUsers = [
+        ...regularUsers.items.map((user: any) => convertToUserType(user, user.role || "admin")),
+        ...superadminUsers.items.map((user: any) => convertToUserType(user, "superadmin"))
+      ];
+      
+    //  console.log("Combined users list:", allUsers);
+      
+      return allUsers;
+    } catch (error) {
+     // console.error("Failed to fetch users:", error);
+      return null;
+    }
+  },
+  
+  async getUser(id: string): Promise<User | null> {
+    try {
+    //  console.log(`Fetching user with ID: ${id}`);
+      
+      // Try fetching from regular users first
+      try {
+        const user = await pb.collection('users').getOne(id);
+     //   console.log("User fetch result (regular user):", user);
+        return convertToUserType(user, user.role || "admin");
+      } catch (error) {
+      //  console.log("User not found in regular users, trying superadmin collection");
+      }
+      
+      // If not found, try in superadmins
+      try {
+        const user = await pb.collection('_superusers').getOne(id);
+      //  console.log("User fetch result (superadmin):", user);
+        return convertToUserType(user, "superadmin");
+      } catch (error) {
+      //  console.log("User not found in superadmin collection either");
+        return null;
+      }
+    } catch (error) {
+    //  console.error(`Failed to fetch user ${id}:`, error);
+      return null;
+    }
+  },
+  
+  async updateUser(id: string, data: UpdateUserData): Promise<User | null> {
+    try {
+      // Create a clean update object - remove undefined and empty string values
+      const cleanData: Record<string, any> = {};
+      Object.entries(data).forEach(([key, value]) => {
+        // Skip undefined values and empty strings for non-required fields
+        if (value !== undefined && !(typeof value === 'string' && value.trim() === '')) {
+          cleanData[key] = value;
+        }
+      });
+      
+     // console.log("Updating user with clean data:", cleanData);
+      
+      // If there's nothing to update, return the current user
+      if (Object.keys(cleanData).length === 0) {
+     //   console.log("No changes to update");
+        const currentUser = await this.getUser(id);
+        return currentUser;
+      }
+      
+      // Special handling for role changes between admin and superadmin
+      const roleChange = cleanData.role !== undefined;
+      const targetRole = roleChange ? cleanData.role : null;
+      
+      // Remove role from regular update if it's being changed
+      if (roleChange) {
+        delete cleanData.role;
+      }
+
+      // Handle email updates with proper error handling
+      const hasEmailChange = cleanData.email !== undefined;
+      const emailToUpdate = hasEmailChange ? cleanData.email : null;
+      
+      let updatedUser: User | null = null;
+      
+      // First, determine if this is currently a regular user or superadmin
+      let isCurrentlySuperadmin = false;
+      try {
+        await pb.collection('_superusers').getOne(id);
+        isCurrentlySuperadmin = true;
+      } catch (error) {
+        // Not in superadmin collection
+      }
+      
+      // If we're changing the role and need to move the user between collections
+      if (roleChange && ((isCurrentlySuperadmin && targetRole !== "superadmin") || 
+                         (!isCurrentlySuperadmin && targetRole === "superadmin"))) {
+        // Get the full user data before changing collections
+        const currentUser = await this.getUser(id);
+        if (!currentUser) {
+          throw new Error("User not found during role change");
+        }
+        
+        // Prepare user data for transfer
+        const transferData = {
+          username: currentUser.username,
+          email: currentUser.email,
+          emailVisibility: currentUser.emailVisibility || true,
+          full_name: currentUser.full_name || "",
+          avatar: currentUser.avatar || "",
+          isActive: currentUser.isActive !== false,
+          ...cleanData
+        };
+        
+        try {
+          if (targetRole === "superadmin") {
+            // Create in superadmin collection
+            const newSuperUser = await pb.collection('_superusers').create(transferData);
+            // Delete from regular users
+            await pb.collection('users').delete(id);
+            updatedUser = convertToUserType(newSuperUser, "superadmin");
+          } else {
+            // Create in regular users collection
+            const newRegularUser = await pb.collection('users').create(transferData);
+            // Delete from superadmin
+            await pb.collection('_superusers').delete(id);
+            updatedUser = convertToUserType(newRegularUser, "admin");
+          }
+        //  console.log("User transferred between collections due to role change");
+          
+        } catch (error) {
+        //  console.error("Failed to transfer user between collections:", error);
+          throw new Error("Failed to change user role: " + (error instanceof Error ? error.message : "Unknown error"));
+        }
+      } else {
+        // Regular update without changing collections
+        if (Object.keys(cleanData).length > 0) {
+       //   console.log("Final update payload to PocketBase:", cleanData);
+          
+          try {
+            // Use the appropriate collection
+            const collection = isCurrentlySuperadmin ? '_superusers' : 'users';
+            const updatedRecord = await pb.collection(collection).update(id, cleanData);
+            updatedUser = convertToUserType(updatedRecord, isCurrentlySuperadmin ? "superadmin" : "admin");
+            
+        //    console.log("PocketBase update response:", updatedUser);
+            
+            // If email was updated successfully, show success message
+            if (hasEmailChange) {
+         //     console.log("Email updated successfully to:", emailToUpdate);
+            }
+            
+          } catch (error) {
+          //  console.error("Error updating user:", error);
+            
+            // Provide more specific error messages for email issues
+            if (hasEmailChange && error instanceof Error) {
+              if (error.message.includes("email")) {
+                throw new Error("Email update failed. The email address may already be in use or invalid.");
+              }
+            }
+            
+            throw error;
+          }
+        } else {
+          // If no fields to update, get the current user
+          updatedUser = await this.getUser(id);
+        }
+      }
+      
+      return updatedUser;
+    } catch (error) {
+    //  console.error("Failed to update user:", error);
+      throw error; // Re-throw to handle in the component
+    }
+  },
+  
+  async deleteUser(id: string): Promise<boolean> {
+    try {
+      // Try to delete from regular users first
+      try {
+        await pb.collection('users').delete(id);
+        return true;
+      } catch (error) {
+      //  console.log("User not found in regular users, trying superadmin collection");
+      }
+      
+      // If not found, try deleting from superadmin collection
+      try {
+        await pb.collection('_superusers').delete(id);
+        return true;
+      } catch (error) {
+     //   console.error("Failed to delete user from either collection:", error);
+        return false;
+      }
+    } catch (error) {
+   //   console.error("Failed to delete user:", error);
+      return false;
+    }
+  },
+
+  async createUser(data: CreateUserData): Promise<User | null> {
+    try {
+      // Create a clean data object without avatar field if it's a URL
+      // PocketBase requires actual file uploads for avatar, not URLs
+      const cleanData = { ...data };
+      
+      // Remove avatar if it's a URL (we'll handle this differently in the future)
+      if (cleanData.avatar && typeof cleanData.avatar === 'string') {
+        // Check if it's an external URL (not a file reference)
+        if (cleanData.avatar.startsWith('http') || 
+            cleanData.avatar.startsWith('/upload/') ||
+            cleanData.avatar.includes('api.dicebear.com')) {
+     //     console.log("Removing avatar URL for new user creation:", cleanData.avatar);
+          delete cleanData.avatar;
+        }
+      }
+      
+      // Determine which collection to use based on the role
+      const isSuperAdmin = cleanData.role === "superadmin";
+      const collection = isSuperAdmin ? '_superusers' : 'users';
+      
+    ///  console.log(`Creating new user in ${collection} collection with data:`, {
+    //    ...cleanData,
+     //   password: "[REDACTED]",
+    //    passwordConfirm: "[REDACTED]"
+    //  });
+      
+      // Create the user in the appropriate collection
+      const result = await pb.collection(collection).create(cleanData);
+      
+      return convertToUserType(result, isSuperAdmin ? "superadmin" : "admin");
+    } catch (error) {
+    //  console.error("Failed to create user:", error);
+      throw error;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/services/webhookService.ts b/application/src/services/webhookService.ts
new file mode 100644
index 0000000..604cc92
--- /dev/null
+++ b/application/src/services/webhookService.ts
@@ -0,0 +1,66 @@
+
+import { pb } from "@/lib/pocketbase";
+import { toast } from "@/hooks/use-toast";
+
+export interface WebhookConfiguration {
+  id?: string;
+  collectionId?: string;
+  collectionName?: string;
+  user_id?: string;
+  url: string;
+  enabled: string;
+  secret?: string;
+  headers?: string;
+  retry_count?: string;
+  trigger_events?: string;
+  description?: string;
+  name: string;
+  method?: string;
+  payload_template?: string;
+  created?: string;
+  updated?: string;
+}
+
+export const webhookService = {
+  async createWebhook(config: Omit<WebhookConfiguration, 'id' | 'collectionId' | 'collectionName' | 'created' | 'updated'>): Promise<WebhookConfiguration | null> {
+   // console.info("Creating webhook configuration:", config);
+    try {
+      const result = await pb.collection('webhook').create(config);
+     // console.info("Webhook configuration created:", result);
+      toast({
+        title: "Success",
+        description: "Webhook created successfully",
+      });
+      return result as WebhookConfiguration;
+    } catch (error) {
+     // console.error("Error creating webhook configuration:", error);
+      toast({
+        title: "Error",
+        description: "Failed to create webhook",
+        variant: "destructive"
+      });
+      return null;
+    }
+  },
+
+  async updateWebhook(id: string, config: Partial<WebhookConfiguration>): Promise<WebhookConfiguration | null> {
+   // console.info(`Updating webhook configuration ${id}:`, config);
+    try {
+      const result = await pb.collection('webhook').update(id, config);
+    //  console.info("Webhook configuration updated:", result);
+      toast({
+        title: "Success",
+        description: "Webhook updated successfully",
+      });
+      return result as WebhookConfiguration;
+    } catch (error) {
+     // console.error("Error updating webhook configuration:", error);
+      toast({
+        title: "Error",
+        description: "Failed to update webhook",
+        variant: "destructive"
+      });
+      return null;
+    }
+  }
+};
\ No newline at end of file
diff --git a/application/src/translations/de/about.ts b/application/src/translations/de/about.ts
new file mode 100644
index 0000000..90ea64c
--- /dev/null
+++ b/application/src/translations/de/about.ts
@@ -0,0 +1,21 @@
+// Über das System
+import { AboutTranslations } from '../types/about';
+
+export const aboutTranslations: AboutTranslations = {
+  aboutCheckCle: "Über Checkcle",
+  systemDescription: "Checkcle ist ein Open-Source-Überwachungs-Stack, der Echtzeit-Einblicke in Server- und Dienstzustände, Vorfallmanagement und operative Transparenz bietet. Veröffentlicht unter der MIT-Lizenz.",
+  systemVersion: "Systemversion",
+  license: "Lizenz",
+  mitLicense: "MIT-Lizenz",
+  links: "Links",
+  viewOnGithub: "Auf GitHub ansehen",
+  viewDocumentation: "Dokumentation ansehen",
+  followOnX: "Auf X folgen",
+  joinDiscord: "Discord beitreten",
+  quickActions: "Schnelle Aktionen",
+  quickActionsDescription: "Greifen Sie schnell auf gängige Überwachungsvorgänge und -funktionen zu. Wählen Sie unten eine Aktion aus, um loszulegen.",
+  quickTips: "Schnelle Tipps",
+  releasedOn: "Veröffentlicht",
+};
+
+
diff --git a/application/src/translations/de/common.ts b/application/src/translations/de/common.ts
new file mode 100644
index 0000000..0b2f409
--- /dev/null
+++ b/application/src/translations/de/common.ts
@@ -0,0 +1,32 @@
+
+import { CommonTranslations } from '../types/common';
+
+export const commonTranslations: CommonTranslations = {
+  welcome: "Willkommen",
+  logout: "Abmelden",
+  language: "Sprache",
+  english: "Englisch",
+  khmer: "ភាសាខ្មែរ",
+  german: "Deutsch",
+  korean: "한국어",
+  japanese: "日本語",
+  simplifiedChinese: "简体中文",
+  goodMorning: "Guten Morgen",
+  goodAfternoon: "Guten Nachmittag",
+  goodEvening: "Guten Abend",
+  profile: "Profil",
+  settings: "Einstellungen",
+  documentation: "Dokumentation",
+  notifications: "Benachrichtigungen",
+  close: "Schließen",
+  cancel: "Abbrechen",
+  view: "Anzeigen",
+  edit: "Bearbeiten",
+  delete: "Löschen",
+  status: "Status",
+  time: "Zeit",
+  title: "Titel",
+  description: "Beschreibung",
+  success: "Erfolg",
+  error: "Fehler",
+};
diff --git a/application/src/translations/de/incident.ts b/application/src/translations/de/incident.ts
new file mode 100644
index 0000000..7fe6348
--- /dev/null
+++ b/application/src/translations/de/incident.ts
@@ -0,0 +1,63 @@
+import { IncidentTranslations } from '../types/incident';
+
+export const incidentTranslations: IncidentTranslations = {
+  incidentManagement: 'Vorfallmanagement',
+  incidentsManagementDesc: 'Verfolgen und Verwalten von Servicevorfällen und deren Lösungen',
+  unresolvedIncidents: 'Ungelöst',
+  resolvedIncidents: 'Gelöst',
+  activeIncidents: 'Aktive Vorfälle',
+  criticalIssues: 'Kritische Probleme',
+  avgResolutionTime: 'Durchschn. Lösungszeit',
+  noIncidents: 'Keine aktiven Vorfälle',
+  createIncident: 'Vorfall erstellen',
+  investigating: 'Untersuchung läuft',
+  identified: 'Identifiziert',
+  monitoring: 'Überwachung',
+  resolved: 'Gelöst',
+  scheduleIncidentManagement: 'Zeitplanung & Vorfallmanagement',
+  incidentName: 'Vorfallname',
+  incidentStatus: 'Vorfallstatus',
+  highPriority: 'Hohe Priorität',
+  configurationSettings: 'Konfigurationseinstellungen',
+  incidentCreatedSuccess: 'Vorfall erfolgreich erstellt',
+  basicInfo: 'Grundinformationen',
+  serviceId: 'Service-ID',
+  assignedTo: 'Zugewiesen an',
+  unassigned: 'Nicht zugewiesen',
+  timeline: 'Zeitverlauf',
+  incidentTime: 'Vorfallszeit',
+  resolutionTime: 'Lösungszeit',
+  systems: 'Systeme',
+  noSystems: 'Keine betroffenen Systeme',
+  impactAnalysis: 'Auswirkungsanalyse',
+  rootCause: 'Ursache',
+  resolutionSteps: 'Lösungsschritte',
+  lessonsLearned: 'Erkenntnisse',
+  resolutionDetails: 'Details zur Lösung',
+  assignment: 'Zuweisung',
+  download: 'Herunterladen',
+  downloadPdf: 'PDF herunterladen',
+  print: 'Drucken',
+  confidentialNote: 'Dieses Dokument ist vertraulich und nur für den internen Gebrauch bestimmt.',
+  generatedOn: 'Erstellt am',
+  enterResolutionSteps: 'Geben Sie die zur Lösung ergriffenen Schritte ein',
+  enterLessonsLearned: 'Geben Sie die aus diesem Vorfall gewonnenen Erkenntnisse ein',
+  editIncident: 'Vorfall bearbeiten',
+  editIncidentDesc: 'Details zu diesem Vorfall aktualisieren',
+  updating: 'Aktualisiere...',
+  update: 'Aktualisieren',
+  create: 'Erstellen',
+  creating: 'Erstelle...',
+  configuration: 'Konfiguration',
+  failedToUpdateStatus: 'Fehler beim Aktualisieren des Status',
+  inProgress: 'In Bearbeitung',
+  enterRootCause: 'Grundursache eingeben',
+  enterIncidentTitle: 'Vorfalltitel eingeben',
+  enterIncidentDescription: 'Vorfallbeschreibung eingeben',
+  enterServiceId: 'Service-IDs durch Komma getrennt eingeben',
+  selectAssignedUser: 'Zugewiesenen Benutzer auswählen',
+  noAssignedUser: 'Der Vorfall ist derzeit keinem Benutzer zugewiesen',
+  affectedSystems: 'Betroffene Systeme',
+  enterAffectedSystems: 'Betroffene Systeme eingeben',
+  separateSystemsWithComma: 'Betroffene Systeme durch Komma getrennt eingeben',
+};
diff --git a/application/src/translations/de/index.ts b/application/src/translations/de/index.ts
new file mode 100644
index 0000000..e282607
--- /dev/null
+++ b/application/src/translations/de/index.ts
@@ -0,0 +1,25 @@
+
+import { Translations } from '../types';
+import { commonTranslations } from './common';
+import { menuTranslations } from './menu';
+import { loginTranslations } from './login';
+import { aboutTranslations } from './about';
+import { servicesTranslations } from './services';
+import { maintenanceTranslations } from './maintenance';
+import { incidentTranslations } from './incident';
+import { sslTranslations } from './ssl';
+import { settingsTranslations } from './settings';
+
+const enTranslations: Translations = {
+  common: commonTranslations,
+  menu: menuTranslations,
+  login: loginTranslations,
+  about: aboutTranslations,
+  services: servicesTranslations,
+  maintenance: maintenanceTranslations,
+  incident: incidentTranslations,
+  ssl: sslTranslations,
+  settings: settingsTranslations
+};
+
+export default enTranslations;
\ No newline at end of file
diff --git a/application/src/translations/de/login.ts b/application/src/translations/de/login.ts
new file mode 100644
index 0000000..4764c45
--- /dev/null
+++ b/application/src/translations/de/login.ts
@@ -0,0 +1,25 @@
+
+import { LoginTranslations } from '../types/login';
+
+export const loginTranslations: LoginTranslations = {
+  // Login-Seite
+  signInToYourAccount: "Melden Sie sich bei Ihrem Konto an",
+  dontHaveAccount: "Sie haben kein Konto?",
+  createOne: "Erstellen Sie eines",
+  signInWithGoogle: "Mit Google anmelden",
+  orContinueWith: "ODER",
+  email: "E-Mail",
+  password: "Passwort",
+  forgot: "Vergessen?",
+  signIn: "Anmelden",
+  signingIn: "Anmeldung läuft...",
+  loginSuccessful: "Anmeldung erfolgreich",
+  loginSuccessMessage: "Sie wurden erfolgreich angemeldet.",
+  loginFailed: "Anmeldung fehlgeschlagen",
+  authenticationFailed: "Authentifizierung fehlgeschlagen",
+  invalidCredentials: "Ungültige E-Mail oder Passwort",
+  bySigningIn: "Durch die Anmeldung stimmen Sie unseren",
+  termsAndConditions: "Allgemeinen Geschäftsbedingungen",
+  and: "und",
+  privacyPolicy: "Datenschutzrichtlinie",
+  };
diff --git a/application/src/translations/de/maintenance.ts b/application/src/translations/de/maintenance.ts
new file mode 100644
index 0000000..6e40b11
--- /dev/null
+++ b/application/src/translations/de/maintenance.ts
@@ -0,0 +1,80 @@
+import { MaintenanceTranslations } from '../types/maintenance';
+
+export const maintenanceTranslations: MaintenanceTranslations = {
+  scheduledMaintenance: 'Geplante Wartung',
+  scheduledMaintenanceDesc: 'Anzeigen und Verwalten geplanter Wartungsfenster für Ihre Systeme und Dienste',
+  upcomingMaintenance: 'Bevorstehend',
+  ongoingMaintenance: 'Laufend',
+  completedMaintenance: 'Abgeschlossen',
+  createMaintenanceWindow: 'Wartung erstellen',
+  totalScheduledHours: 'Geplante Gesamtstunden',
+  maintenanceName: 'Wartungsname',
+  maintenanceStatus: 'Status',
+  scheduledStart: 'Geplanter Start',
+  scheduledEnd: 'Geplantes Ende',
+  affectedServices: 'Betroffene Dienste',
+  impact: 'Auswirkung',
+  minor: 'Geringfügig',
+  major: 'Gravierend',
+  critical: 'Kritisch',
+  none: 'Keine',
+  actions: 'Aktionen',
+  scheduled: 'Geplant',
+  inprogress: 'In Bearbeitung',
+  completed: 'Abgeschlossen',
+  cancelled: 'Abgebrochen',
+  markAsInProgress: 'Als in Bearbeitung markieren',
+  markAsCompleted: 'Als abgeschlossen markieren',
+  markAsCancelled: 'Als abgebrochen markieren',
+  confirmDelete: 'Löschen bestätigen',
+  deleteMaintenanceConfirmation: 'Möchten Sie dieses Wartungsfenster wirklich löschen?',
+  thisActionCannotBeUndone: 'Diese Aktion kann nicht rückgängig gemacht werden.',
+  maintenanceDeleted: 'Wartung gelöscht',
+  maintenanceDeletedDesc: 'Das Wartungsfenster wurde erfolgreich gelöscht.',
+  errorDeletingMaintenance: 'Fehler beim Löschen des Wartungsfensters.',
+  statusUpdated: 'Status aktualisiert',
+  maintenanceStatusUpdated: 'Wartungsstatus wurde erfolgreich aktualisiert.',
+  errorUpdatingMaintenanceStatus: 'Fehler beim Aktualisieren des Wartungsstatus.',
+  createMaintenance: 'Wartung erstellen',
+  createMaintenanceDesc: 'Planen Sie ein neues Wartungsfenster für Ihre Dienste',
+  enterTitle: 'Wartungstitel eingeben',
+  enterDescription: 'Geben Sie eine detaillierte Beschreibung der Wartung ein',
+  startTime: 'Startzeit',
+  endTime: 'Endzeit',
+  selectDate: 'Datum auswählen',
+  enterAffectedServices: 'Betroffene Dienste eingeben',
+  separateServicesWithComma: 'Mehrere Dienste durch Kommas trennen',
+  priority: 'Priorität',
+  selectPriority: 'Priorität auswählen',
+  selectStatus: 'Status auswählen',
+  selectImpact: 'Auswirkung auswählen',
+  notifySubscribers: 'Abonnenten benachrichtigen',
+  notifySubscribersDesc: 'Beim Start dieser Wartung eine Benachrichtigung an alle Abonnenten senden',
+  maintenanceCreated: 'Wartung erstellt',
+  maintenanceCreatedDesc: 'Das Wartungsfenster wurde erfolgreich geplant.',
+  errorCreatingMaintenance: 'Fehler beim Erstellen des Wartungsfensters.',
+  errorFetchingMaintenanceData: 'Fehler beim Abrufen der Wartungsdaten.',
+  low: 'Niedrig',
+  medium: 'Mittel',
+  high: 'Hoch',
+  created: 'Erstellt',
+  lastUpdated: 'Zuletzt aktualisiert',
+  subscribersWillBeNotified: 'Abonnenten werden benachrichtigt, wenn die Wartung beginnt',
+  noNotifications: 'Es werden keine Benachrichtigungen gesendet',
+  noScheduledMaintenance: 'Keine geplanten Wartungen',
+  noMaintenanceWindows: 'Für diesen Zeitraum sind keine Wartungsfenster vorhanden. Erstellen Sie eines über die Schaltfläche „Wartung erstellen“.',
+  maintenanceCreatedSuccess: 'Wartungsfenster erfolgreich erstellt',
+  editMaintenanceWindow: 'Wartung bearbeiten',
+  editMaintenanceDesc: 'Wartungsdetails bearbeiten',
+  priorityDescription: 'Wartungspriorität auswählen',
+  statusDescription: 'Wartungsstatus auswählen',
+  impactLevel: 'Auswirkungsgrad',
+  impactLevelDescription: 'Auswirkungsgrad auswählen',
+  selectAssignedUsers: 'Zugewiesene Benutzer auswählen',
+  assignedPersonnelDescription: 'Derzeit zugewiesene Benutzer',
+  mutedNotifications: 'Benachrichtigungen deaktiviert',
+  notificationsAreMuted: 'Benachrichtigungen sind für diese Wartung derzeit deaktiviert',
+  selectNotificationChannel: 'Benachrichtigungskanal hinzufügen',
+  enableNotificationsFirst: 'Aktivieren Sie zuerst Benachrichtigungen, um einen Kanal auszuwählen',
+  updateMaintenance: 'Wartung aktualisieren',
+};
diff --git a/application/src/translations/de/menu.ts b/application/src/translations/de/menu.ts
new file mode 100644
index 0000000..0c64df0
--- /dev/null
+++ b/application/src/translations/de/menu.ts
@@ -0,0 +1,23 @@
+
+import { MenuTranslations } from '../types/menu';
+
+export const menuTranslations: MenuTranslations = {
+  // Hauptmenü-Übersetzungen
+  uptimeMonitoring: "Betriebszeitüberwachung",
+  instanceMonitoring: "Instanzüberwachung",
+  sslDomain: "SSL & Domain",
+  scheduleIncident: "Zeitplan & Vorfall",
+  operationalPage: "Betriebsstatus-Seite",
+  reports: "Berichte",
+  regionalMonitoring: "Regional Monitoring",
+  // Einstellungen-Panel
+  settingPanel: "Einstellungsbereich",
+  generalSettings: "Allgemeine Einstellungen",
+  userManagement: "Benutzerverwaltung",
+  notificationSettings: "Benachrichtigungseinstellungen",
+  alertsTemplates: "Alarmvorlagen",
+  rolesManagement: "Rollenverwaltung",
+  dataRetention: "Datenspeicherung",
+  backupSettings: "Backup-Einstellungen",
+  aboutSystem: "Über das System",
+};
diff --git a/application/src/translations/de/services.ts b/application/src/translations/de/services.ts
new file mode 100644
index 0000000..0117bec
--- /dev/null
+++ b/application/src/translations/de/services.ts
@@ -0,0 +1,98 @@
+import { ServicesTranslations } from '../types/services';
+
+export const servicesTranslations: ServicesTranslations = {
+  // Service Table
+  serviceStatus: "Dienststatus",
+  responseTime: "Antwortzeit",
+  uptime: "Betriebszeit",
+  lastChecked: "Zuletzt überprüft",
+  noServices: "Keine Dienste entsprechen Ihren Filterkriterien.",
+  currentlyMonitoring: "Derzeit überwacht",
+  retry: "Wiederholen",
+  overview: "Überblick",
+  newService: "Neuer Dienst",
+  rowsPerPage: "Zeilen pro Seite",
+  search: "Suchen",
+  allTypes: "Alle Arten",
+  createNewService: "Neuen Service hinzufügen",
+  createNewServiceDesc: "Geben Sie detaillierte Informationen ein, um einen neuen zu erstellen, den Sie überwachen möchten.",
+
+  // ServiceBasicFields.tsx
+  serviceName: "Dienstname",
+  serviceNameDesc: "Geben Sie einen aussagekräftigen Namen für Ihren Service ein",
+
+  // ServiceConfigFields.tsx
+  checkInterval: "Prüfintervall",
+  seconds: "Sekunden",
+  minute: "Minute",
+  minutes: "Minuten",
+  hour: "Stunde",
+  hours: "Stunden",
+  custom: "Benutzerdefiniert",
+  checkIntervalPlaceholder: "Intervall in Sekunden eingeben",
+  backToPresets: "Zurück zu Voreinstellungen",
+  checkIntervalDesc: "Wie oft der Dienststatus überprüft werden soll",
+  checkIntervalDescCustom: "Benutzerdefiniertes Intervall in Sekunden eingeben (mindestens 10 Sekunden)",
+  retryAttempts: "Wiederholungsversuche",
+  attempt: "Versuch",
+  attempts: "Versuche",
+  retryAttemptsDesc: "Anzahl der Wiederholungsversuche, bevor der Dienst als ausgefallen markiert wird",
+
+  // ServiceForm.tsx
+  updateService: "Dienst aktualisieren",
+  createService: "Dienst erstellen",
+
+  // ServiceNotificationFields.tsx
+  enableNotifications: "Benachrichtigungen aktivieren",
+  enableNotificationsDesc: "Benachrichtigungen für diesen Dienst aktivieren oder deaktivieren",
+  notificationChannels: "Benachrichtigungskanäle",
+  notificationChannelsEnabledDesc: "Benachrichtigungskanäle für diesen Dienst auswählen",
+  notificationChannelsDesc: "Aktivieren Sie zuerst Benachrichtigungen, um Kanäle auszuwählen",
+  notificationChannelsPlaceholder: "Benachrichtigungskanal hinzufügen",
+  alertTemplate: "Alarmvorlage",
+  alertTemplateLoading: "Lade Vorlagen...",
+  alertTemplatePlaceholder: "Alarmvorlage auswählen",
+  alertTemplateEnabledDesc: "Wählen Sie eine Vorlage für Alarmmeldungen",
+  alertTemplateDesc: "Aktivieren Sie zuerst Benachrichtigungen, um eine Vorlage auszuwählen",
+
+  // ServiceTypeField.tsx
+  serviceType: "Diensttyp",
+  serviceTypeHTTPDesc: "Webseiten und REST-APIs mit HTTP/HTTPS-Protokoll überwachen",
+  serviceTypePINGDesc: "Host-Verfügbarkeit mit PING-Protokoll überwachen",
+  serviceTypeTCPDesc: "TCP-Port-Konnektivität mit TCP-Protokoll überwachen",
+  serviceTypeDNSDesc: "DNS-Auflösung überwachen",
+
+  // ServiceRegionalFields.tsx
+  regionalMonitoring: "Regionale Überwachung",
+  regionalMonitoringDesc: "Diesen Dienst regionalen Überwachungsagenten für verteilte Überwachung zuweisen",
+  regionalAgents: "Regionale Agenten",
+  regionalAgentsLoading: "Lade Agenten...",
+  regionalAgentsAvailablePlaceholder: "Zusätzliche regionale Agenten auswählen...",
+  regionalAgentsAllSelected: "Alle verfügbaren Agenten ausgewählt",
+  regionalAgentsNoAvailable: "Keine regionalen Agenten verfügbar",
+  regionalAgentsNoOnlineAvailable: "Keine regionalen Agenten online verfügbar",
+  regionalAgentsNotFoundMessage: "Keine regionalen Online-Agenten gefunden. Dienste verwenden die Standardüberwachung.",
+  regionalAgentsNotSelectedMessage: "Keine regionalen Agenten ausgewählt. Der Dienst verwendet die Standardüberwachung.",
+
+  // ServiceUrlField.tsx
+  targetDefault: "Ziel-URL/Host",
+  targetDNS: "Domainname",
+  targetHTTPDesc: "Geben Sie die vollständige URL inklusive Protokoll ein (http:// oder https://)",
+  targetPINGDesc: "Geben Sie den Hostnamen oder die IP-Adresse zum Pingen ein",
+  targetTCPDesc: "Geben Sie Hostname oder IP-Adresse für TCP-Verbindungstest ein",
+  targetTCPPortDesc: "Geben Sie die Portnummer für den TCP-Verbindungstest ein",
+  targetDNSDesc: "Domainnamen für DNS-Überwachung eingeben (A, AAAA, MX, etc.)",
+  targetDefaultDesc: "Geben Sie die Ziel-URL oder den Hostnamen für die Überwachung ein",
+  targetDefaultPlaceholder: "URL oder Hostname eingeben",
+
+  // types.ts
+  serviceNameRequired: "Dienstname ist erforderlich",
+  urlDomainHostRequired: "URL/Domain/Host ist erforderlich",
+  enterValidUrlHostnameDomain: "Bitte eine gültige URL, einen Hostnamen oder eine Domain eingeben",
+
+  // Dashboard
+  upServices: "DIENSTE ONLINE",
+  downServices: "DIENSTE OFFLINE",
+  pausedServices: "DIENSTE PAUSIERT",
+  warningServices: "DIENSTE MIT WARNUNG",
+};
diff --git a/application/src/translations/de/settings.ts b/application/src/translations/de/settings.ts
new file mode 100644
index 0000000..1e46f50
--- /dev/null
+++ b/application/src/translations/de/settings.ts
@@ -0,0 +1,58 @@
+import { SettingsTranslations } from '../types/settings';
+
+export const settingsTranslations: SettingsTranslations = {
+  // Tabs
+  systemSettings: "Systemeinstellungen",
+  mailSettings: "E-Mail-Einstellungen",
+
+  // System Settings
+  appName: "Anwendungsname",
+  appURL: "Anwendungs-URL",
+  senderName: "Absendername",
+  senderEmail: "Absender-E-Mail-Adresse",
+  hideControls: "Steuerelemente ausblenden",
+
+  // Mail Settings
+  smtpSettings: "SMTP-Konfiguration",
+  smtpEnabled: "SMTP aktivieren",
+  smtpHost: "SMTP-Host",
+  smtpPort: "SMTP-Port",
+  smtpUsername: "SMTP-Benutzername",
+  smtpPassword: "SMTP Password",
+  smtpAuthMethod: "Authentifizierungsmethode",
+  enableTLS: "TLS aktivieren",
+  localName: "Lokaler Name",
+
+  // Test Email
+  testEmail: "Test Email",
+  sendTestEmail: "Send test email",
+  emailTemplate: "Email template",
+  verification: "Verification",
+  passwordReset: "Password reset",
+  confirmEmailChange: "Confirm email change",
+  otp: "OTP",
+  loginAlert: "Login alert",
+  authCollection: "Auth collection",
+  selectCollection: "Select collection",
+  toEmailAddress: "To email address",
+  enterEmailAddress: "Enter email address",
+  sending: "Sending...",
+
+  // Actions and status
+  save: "Änderungen speichern",
+  saving: "Speichere...",
+  settingsUpdated: "Einstellungen erfolgreich aktualisiert",
+  errorSavingSettings: "Fehler beim Speichern der Einstellungen",
+  errorFetchingSettings: "Error loading settings",
+  testConnection: "Verbindung testen",
+  testingConnection: "Verbindung wird getestet...",
+  connectionSuccess: "Verbindung erfolgreich",
+  connectionFailed: "Verbindung fehlgeschlagen",
+
+  // Ergänzte fehlende Einträge
+  addUser: "Benutzer hinzufügen",
+  permissionNotice: "Berechtigungshinweis:",
+  permissionNoticeAddUser: "Als Admin-Benutzer haben Sie keinen Zugriff auf die Anzeige oder Änderung von System- und E-Mail-Einstellungen. Diese Einstellungen können nur von Super-Admins aufgerufen und geändert werden. Wenden Sie sich an Ihren Super-Admin, wenn Sie Änderungen an der Systemkonfiguration oder den E-Mail-Einstellungen vornehmen müssen.",
+  loadingSettings: "Einstellungen werden geladen...",
+  loadingSettingsError: "Fehler beim Laden der Einstellungen",
+};
diff --git a/application/src/translations/de/ssl.ts b/application/src/translations/de/ssl.ts
new file mode 100644
index 0000000..eb51064
--- /dev/null
+++ b/application/src/translations/de/ssl.ts
@@ -0,0 +1,118 @@
+
+import { SSLTranslations } from '../types/ssl';
+
+export const sslTranslations: SSLTranslations = {
+  // Page and section titles
+  sslDomainManagement: "SSL- & Domainverwaltung",
+  monitorSSLCertificates: "SSL-Zertifikate und deren Ablaufdaten überwachen",
+  addSSLCertificate: "SSL-Zertifikat hinzufügen",
+  editSSLCertificate: "SSL-Zertifikat bearbeiten",
+  deleteSSLCertificate: "Delete SSL Certificate",
+  sslCertificateDetails: "SSL-Zertifikatdetails",
+  detailedInfo: "Detaillierte Informationen zum SSL-Zertifikat für",
+  viewDetailedInformation: "View detailed information for",
+
+  // Status related
+  valid: "Gültig",
+  expiringSoon: "Läuft bald ab",
+  expired: "Abgelaufen",
+  pending: "Ausstehend",
+
+  // Statistics and cards
+  validCertificates: "Gültige Zertifikate",
+  expiringSoonCertificates: "Läuft bald ab",
+  expiredCertificates: "Abgelaufen",
+
+  // Form fields
+  domain: "Domain",
+  domainName: "Domainname",
+  domainCannotChange: "Domainname kann nicht geändert werden. Um eine andere Domain zu überwachen, fügen Sie ein neues Zertifikat hinzu.",
+  warningThreshold: "Warnschwelle (Tage)",
+  warningThresholdDays: "Warnschwelle (Tage)",
+  expiryThreshold: "Ablaufschwelle (Tage)",
+  expiryThresholdDays: "Ablaufschwelle (Tage)",
+  notificationChannel: "Benachrichtigungskanal",
+  chooseChannel: "Wählen Sie, wo Sie Benachrichtigungen erhalten möchten",
+  whereToSend: "Wohin die Benachrichtigungen gesendet werden sollen",
+  daysBeforeExpiration: "Tage vor Ablauf zur Warnung",
+  daysBeforeCritical: "Tage vor Ablauf zur kritischen Warnung",
+  getNotifiedExpiration: "Benachrichtigung erhalten, wenn Zertifikate bald ablaufen",
+  getNotifiedCritical: "Benachrichtigung erhalten, wenn Zertifikate kritisch kurz vor Ablauf stehen",
+
+  // Table headers and fields
+  issuer: "Aussteller",
+  expirationDate: "Ablaufdatum",
+  daysLeft: "Verbleibende Tage",
+  status: "Status",
+  lastNotified: "Zuletzt benachrichtigt",
+  actions: "Aktionen",
+  validFrom: "Gültig von",
+  validUntil: "Gültig bis",
+  validityDays: "Gültigkeitsdauer Tage",
+  validityPeriod: "Validity Period",
+  organization: "Organisation",
+  commonName: "Allgemeiner Name",
+  serialNumber: "Seriennummer",
+  algorithm: "Algorithmus",
+  subjectAltNames: "Thema Alternative Bezeichnungen",
+  subjectAlternativeNames: "Subject Alternative Names",
+  resolvedIP: "Resolved IP",
+  issuedTo: "Issued To",
+  days: "days",
+  
+  // Buttons and actions
+  addDomain: "Domain hinzufügen",
+  refreshAll: "Alle aktualisieren",
+  cancel: "Abbrechen",
+  addCertificate: "Zertifikat hinzufügen",
+  check: "Prüfen",
+  view: "Ansehen",
+  edit: "Bearbeiten",
+  delete: "Löschen",
+  close: "Schließen",
+  saveChanges: "Änderungen speichern",
+  updating: "Aktualisiere",
+
+  // Sections in detail view
+  basicInformation: "Basisinformationen",
+  validity: "Gültigkeit",
+  issuerInfo: "Informationen zum Aussteller",
+  technicalDetails: "Technische Details",
+  technicalInformation: "Technical Information",
+  monitoringConfig: "Monitoring-Konfiguration",
+  monitoringConfiguration: "Monitoring Configuration",
+  recordInfo: "Aufzeichnungsinformationen",
+  certificateDetails: "Certificate Details",
+
+  // Notifications and messages
+  sslCertificateAdded: "SSL-Zertifikat erfolgreich hinzugefügt",
+  sslCertificateUpdated: "SSL-Zertifikat erfolgreich aktualisiert",
+  sslCertificateDeleted: "SSL-Zertifikat erfolgreich gelöscht",
+  sslCertificateRefreshed: "SSL-Zertifikat für {domain} erfolgreich aktualisiert",
+  allCertificatesRefreshed: "Alle {count} Zertifikate wurden erfolgreich aktualisiert",
+  someCertificatesFailed: "{success} Zertifikate aktualisiert, {failed} fehlgeschlagen",
+  failedToAddCertificate: "Fehler beim Hinzufügen des SSL-Zertifikats",
+  failedToLoadCertificates: "Fehler beim Laden der SSL-Zertifikate",
+  failedToUpdateCertificate: "Fehler beim Aktualisieren des SSL-Zertifikats",
+  failedToDeleteCertificate: "Fehler beim Löschen des SSL-Zertifikats",
+  failedToCheckCertificate: "Fehler beim Prüfen des SSL-Zertifikats",
+  noCertificatesToRefresh: "Keine Zertifikate zum Aktualisieren vorhanden",
+  startingRefreshAll: "Starte Aktualisierung von {count} Zertifikaten",
+  checkingSSLCertificate: "SSL-Zertifikat wird überprüft...",
+  deleteConfirmation: "Möchten Sie das Zertifikat für wirklich löschen?",
+  deleteWarning: "Diese Aktion kann nicht rückgängig gemacht werden. Das Zertifikat wird dauerhaft gelöscht.",
+
+  // Misc
+  unknown: "Unbekannt",
+  never: "Nie",
+  none: "Keine",
+  loadingChannels: "Lade Kanäle...",
+  noChannelsFound: "Keine Benachrichtigungskanäle gefunden",
+  noSSLCertificates: "Keine SSL-Zertifikate gefunden",
+  created: "Erstellt",
+  lastUpdated: "Zuletzt aktualisiert",
+  lastNotification: "Letzte Benachrichtigung",
+  collectionId: "Sammlungs-ID",
+  noCertificatesFound: "Keine Zertifikate gefunden",
+}
+
diff --git a/application/src/translations/en/about.ts b/application/src/translations/en/about.ts
new file mode 100644
index 0000000..3e399ac
--- /dev/null
+++ b/application/src/translations/en/about.ts
@@ -0,0 +1,34 @@
+
+import { AboutTranslations } from '../types/about';
+
+export const aboutTranslations: AboutTranslations = {
+  aboutCheckCle: "About Checkcle",
+  systemDescription: "Checkcle is an open-source monitoring stack offering real-time insights into server and service health, incident management, and operational transparency. Released as MIT License.",
+  systemVersion: "System Version",
+  license: "License",
+  mitLicense: "MIT License",
+  links: "Links",
+  viewOnGithub: "View on GitHub",
+  viewDocumentation: "View Documentation",
+  followOnX: "Follow on X",
+  joinDiscord: "Join Discord",
+  quickActions: "Quick Actions",
+  quickActionsDescription: "Access common monitoring operations and features quickly. Select an action below to get started.",
+  quickTips: "Quick Tips",
+  releasedOn: "Released On",
+	updateSchema: "Update Schema",
+	updateSchemaDesc: "Automatic import collections schema",
+	mergeFieldsLabel: "Merge fields with existing collections (safe - preserves data)",
+	importing: "Importing...",
+	clickToUpdateSchema: "Click to update Schema",
+	importSuccessful: "Import Successful",
+	importFailed: "Import Failed",
+	instructions: "Instructions",
+	mergeFields: "Merge fields",
+	instructionsMergeFields: "Safely add new fields to existing collections, preserves all data",
+	instructionsCollections: "System collections (starting with _) and users collection will be skipped automatically",
+	instructionsImportAuth: "Only authenticated admins can perform schema imports",
+	collectionsUpdatedCount: "{count} collections updated",
+	collectionsCreatedCount: "{count} collections created",
+	collectionsSkippedCount: "{count} collections created",
+};
diff --git a/application/src/translations/en/common.ts b/application/src/translations/en/common.ts
new file mode 100644
index 0000000..abda24b
--- /dev/null
+++ b/application/src/translations/en/common.ts
@@ -0,0 +1,32 @@
+
+import { CommonTranslations } from '../types/common';
+
+export const commonTranslations: CommonTranslations = {
+  welcome: "Welcome",
+  logout: "Logout",
+  language: "Language",
+  english: "Englisch",
+  khmer: "ភាសាខ្មែរ",
+  german: "Deutsch",
+  korean: "한국어",
+  japanese: "日本語",
+  simplifiedChinese: "简体中文",
+  goodMorning: "Good morning",
+  goodAfternoon: "Good afternoon",
+  goodEvening: "Good evening",
+  profile: "Profile",
+  settings: "Settings",
+  documentation: "Documentation",
+  notifications: "Notifications",
+  close: "Close",
+  cancel: "Cancel",
+  view: "View",
+  edit: "Edit",
+  delete: "Delete",
+  status: "Status",
+  time: "Time",
+  title: "Title",
+  description: "Description",
+  success: "Success",
+  error: "Error",
+};
diff --git a/application/src/translations/en/docker.ts b/application/src/translations/en/docker.ts
new file mode 100644
index 0000000..2a00203
--- /dev/null
+++ b/application/src/translations/en/docker.ts
@@ -0,0 +1,71 @@
+import { DockerTranslations } from '../types/docker';
+
+export const dockerTranslations: DockerTranslations = {
+  dockerContainers: "Docker Containers",
+  container: "Container",
+  status: "Status",
+  cpuUsage: "CPU Usage",
+  memory: "Memory",
+  disk: "Disk",
+  uptime: "Uptime",
+  lastChecked: "Last Checked",
+  actions: "Actions",
+  searchContainersPlaceholder: "Search containers...",
+  refresh: "Refresh",
+  openMenu: "Open menu",
+  viewMetrics: "View Metrics",
+  viewDetails: "View Details",
+
+  running: "Running",
+  stopped: "Stopped",
+  warning: "Warning",
+  unknown: "Unknown",
+  totalContainers: "Total Containers",
+  containersLabel: "Containers",
+
+  noContainersFound: "No containers found",
+  noContainersRunning: "No containers running",
+  tryAdjustSearch: "Try adjusting your search terms.",
+  startSomeContainers: "Start some containers to see them here.",
+
+  containerMetricsTitle: "Container Metrics: {name}",
+  dockerId: "Docker ID",
+  loadingMetrics: "Loading metrics...",
+  errorLoadingMetrics: "Error loading metrics",
+  noMetricsAvailable: "No metrics data available for this container",
+
+  minutes60: "60 minutes",
+  day1: "1 day",
+  days7: "7 days",
+  month1: "1 month",
+  months3: "3 months",
+
+  used: "Used:",
+  free: "Free:",
+  total: "Total:",
+  usage: "Usage:",
+  cpu: "CPU",
+  memoryTitle: "Memory",
+  diskTitle: "Disk",
+  network: "Network",
+
+  cpuUsagePct: "CPU Usage (%)",
+  cpuUsageVsAvailable: "CPU Usage vs Available",
+  cpuAvailablePct: "CPU Available (%)",
+  ramUsagePct: "RAM Usage (%)",
+  memoryUsageBytes: "Memory Usage (Bytes)",
+  usedMemory: "Used Memory",
+  totalMemory: "Total Memory",
+  diskUsagePct: "Disk Usage (%)",
+  diskUsageBytes: "Disk Usage (Bytes)",
+  usedDisk: "Used Disk",
+  totalDisk: "Total Disk",
+  networkTraffic: "Network Traffic",
+  networkSpeedKbs: "Network Speed (KB/s)",
+  rxBytes: "RX Bytes",
+  txBytes: "TX Bytes",
+  rxSpeedKbs: "RX Speed (KB/s)",
+  txSpeedKbs: "TX Speed (KB/s)",
+};
+
+
diff --git a/application/src/translations/en/incident.ts b/application/src/translations/en/incident.ts
new file mode 100644
index 0000000..3e30c90
--- /dev/null
+++ b/application/src/translations/en/incident.ts
@@ -0,0 +1,65 @@
+
+import { IncidentTranslations } from '../types/incident';
+
+export const incidentTranslations: IncidentTranslations = {
+  incidentManagement: 'Incident Management',
+  incidentsManagementDesc: 'Track and manage service incidents and their resolutions',
+  unresolvedIncidents: 'Unresolved',
+  resolvedIncidents: 'Resolved',
+  activeIncidents: 'Active Incidents',
+  criticalIssues: 'Critical Issues',
+  avgResolutionTime: 'Avg. Resolution Time',
+  noIncidents: 'No Active Incidents',
+  createIncident: 'Create Incident',
+  investigating: 'Investigating',
+  identified: 'Identified',
+  monitoring: 'Monitoring',
+  resolved: 'Resolved',
+  scheduleIncidentManagement: 'Schedule & Incident Management',
+  incidentName: 'Incident Name',
+  incidentStatus: 'Incident Status',
+  highPriority: 'High Priority',
+  configurationSettings: 'Configuration Settings',
+  incidentCreatedSuccess: 'Incident created successfully',
+  basicInfo: 'Basic Information',
+  serviceId: 'Service ID',
+  assignedTo: 'Assigned To',
+  unassigned: 'Unassigned',
+  timeline: 'Timeline',
+  incidentTime: 'Incident Time',
+  resolutionTime: 'Resolution Time',
+  systems: 'Systems',
+  noSystems: 'No systems affected',
+  impactAnalysis: 'Impact Analysis',
+  rootCause: 'Root Cause',
+  resolutionSteps: 'Resolution Steps',
+  lessonsLearned: 'Lessons Learned',
+  resolutionDetails: 'Resolution Details',
+  assignment: 'Assignment',
+  download: 'Download',
+  downloadPdf: 'Download PDF',
+  print: 'Print',
+  confidentialNote: 'This document is confidential and intended for internal use only.',
+  generatedOn: 'Generated on',
+  enterResolutionSteps: 'Enter steps taken to resolve the incident',
+  enterLessonsLearned: 'Enter lessons learned from this incident',
+  editIncident: 'Edit Incident',
+  editIncidentDesc: 'Update details for this incident',
+  updating: 'Updating...',
+  update: 'Update',
+  create: 'Create',
+  creating: 'Creating...',
+  configuration: 'Configuration',
+  failedToUpdateStatus: 'Failed to update status',
+  inProgress: 'In Progress',
+  enterRootCause: 'Enter Root Cause',
+  enterIncidentTitle: 'Enter Incident Title',
+  enterIncidentDescription: 'Enter Incident Description',
+  enterServiceId: 'Enter Service-IDs seperated by comma',
+  selectAssignedUser: 'Select Assigned User',
+  noAssignedUser: 'Incident is currently not assigned to any user',
+  affectedSystems: 'Affected Systems',
+  enterAffectedSystems: 'Enter Affected Systems',
+  separateSystemsWithComma: 'Enter affected systems seperated by comma',
+	createIncidentDesc: 'Create a new incident',
+};
diff --git a/application/src/translations/en/index.ts b/application/src/translations/en/index.ts
new file mode 100644
index 0000000..2eb1851
--- /dev/null
+++ b/application/src/translations/en/index.ts
@@ -0,0 +1,35 @@
+
+import { Translations } from '../types';
+import { commonTranslations } from './common';
+import { menuTranslations } from './menu';
+import { loginTranslations } from './login';
+import { aboutTranslations } from './about';
+import { servicesTranslations } from './services';
+import { maintenanceTranslations } from './maintenance';
+import { incidentTranslations } from './incident';
+import { sslTranslations } from './ssl';
+import { settingsTranslations } from './settings';
+import { instanceTranslations } from './instance';
+import { operationTranslations } from './operation';
+import { regionTranslations } from './region';
+import { dockerTranslations } from './docker';
+import { publicTranslations } from './public';
+
+const enTranslations: Translations = {
+  common: commonTranslations,
+  menu: menuTranslations,
+  login: loginTranslations,
+  about: aboutTranslations,
+  services: servicesTranslations,
+  maintenance: maintenanceTranslations,
+  incident: incidentTranslations,
+  ssl: sslTranslations,
+  settings: settingsTranslations,
+  instance: instanceTranslations,
+  operation: operationTranslations,
+  region: regionTranslations,
+  docker: dockerTranslations,
+  public: publicTranslations
+};
+
+export default enTranslations;
\ No newline at end of file
diff --git a/application/src/translations/en/instance.ts b/application/src/translations/en/instance.ts
new file mode 100644
index 0000000..739bca9
--- /dev/null
+++ b/application/src/translations/en/instance.ts
@@ -0,0 +1,176 @@
+
+import { InstanceTranslations } from '../types/instance';
+
+export const instanceTranslations: InstanceTranslations = {
+
+  // InstanceMonitoring.tsx
+  instanceMonitoring: "Instance Monitoring",
+  describeMonitorInstance: "Monitor and manage your server instances in real-time",
+  addServerAgent: "Add Server Agent",
+  errorLoadingServers: "Error loading servers",
+  unableToFetchServerData: "Unable to fetch server data. Please check your connection and try again.",
+  retry: "Retry",
+
+  
+
+  // ServerTable.tsx
+  servers: "Servers",
+  loadingServers: "Loading servers...",
+  searchServersPlaceholder: "Search servers...",
+  noServersFound: "No servers found",
+  deleteSelected: "Delete Selected",
+  deleteSelectedConfirmTitle: "Delete selected servers?",
+  deleteSelectedConfirmDesc: "This action cannot be undone. This will permanently delete {count} server(s) and all of their monitoring data.",
+  selectedCount: "{count} selected",
+  serversDeleted: "Servers deleted",
+  serversDeletedDesc: "{count} server(s) have been deleted.",
+  partialSuccess: "Partial success",
+  name: "Name",
+  status: "Status",
+  OS: "OS",
+  IPAddress: "IP Address",
+  CPU: "CPU",
+  memory: "Memory",
+  disk: "Disk",
+  uptime: "Uptime",
+  lastChecked: "Last Checked",
+  actions: "Actions",
+  viewServerDetail: "View Server Detail",
+  containerMonitoring: "Container Monitoring",
+  resumeMonitoring: "Resume Monitoring",
+  pauseMonitoring: "Pause Monitoring",
+  editServer: "Edit Server",
+  deleteServer: "Delete Server",
+  deleteServerConfirmTitle: "Are you sure you want to delete this server?",
+  deleteServerConfirmDesc: "This action cannot be undone. This will permanently delete {name} and all of its monitoring data.",
+  cancel: "Cancel",
+  deleting: "Deleting...",
+  delete: "Delete",
+  serverDeleted: "Server deleted",
+  serverDeletedDesc: "{name} has been deleted successfully.",
+  error: "Error",
+  deleteServerError: "Failed to delete server. Please try again.",
+  serverPaused: "Server paused",
+  serverResumed: "Server resumed",
+  monitoringPaused: "Monitoring paused for {name}",
+  monitoringResumed: "Monitoring resumed for {name}",
+  pauseServerError: "Failed to pause server monitoring. Please try again.",
+  resumeServerError: "Failed to resume server monitoring. Please try again.",
+
+  // server cards 
+  totalServers: "TOTAL SERVERS",
+  onlineServers: "ONLINE SERVERS",
+  offlineServers: "OFFLINE SERVERS",
+  warningServers: "WARNING SERVERS",
+
+  // AddServerAgentDialog.tsx
+  addServerMonitoringAgent: "Add Server Monitoring Agent",
+  configureAgentDesc: "Configure a new server monitoring agent to track system metrics and performance.",
+  configureAgent: "Configure Agent",
+  oneClickInstall: "One-Click Install",
+  dockerOneClick: "Docker One-Click",
+  manualInstallation: "Manual Installation",
+  validationError: "Validation Error",
+  fillRequiredFields: "Please fill in all required fields.",
+  serverAgentCreated: "Server Agent Created",
+  serverAgentCreatedDesc: "{name} monitoring agent has been configured successfully.",
+  failedToCreateAgent: "Failed to create server monitoring agent.",
+
+  // ServerAgentConfigForm.tsx
+  serverName: "Server Name",
+  serverNamePlaceholder: "e.g., web-server-01",
+  serverNameDesc: "What is the name or label used as the identifier",
+  serverAgentId: "Server Agent ID",
+  serverAgentIdDesc: "Auto-generated unique identifier",
+  operatingSystem: "Operating System",
+  checkInterval: "Check Interval",
+  selectInterval: "Select interval",
+  interval30s: "30 seconds",
+  interval1m: "1 minute",
+  interval2m: "2 minutes",
+  interval5m: "5 minutes",
+  checkIntervalDesc: "How often to check the server and metric status",
+  retryAttempts: "Retry Attempts",
+  selectRetryAttempts: "Select retry attempts",
+  attempt1: "1 attempt",
+  attempt2: "2 attempts",
+  attempt3: "3 attempts",
+  attempt5: "5 attempts",
+  retryAttemptsDesc: "Number of retry attempts before marking as down",
+  serverToken: "Server Token",
+  serverTokenDesc: "Auto-generated authentication token",
+  systemUrl: "System URL",
+  systemUrlDesc: "Current system API URL",
+  creatingAgent: "Creating Agent...",
+  createServerAgent: "Create Server Agent"
+
+
+  ,
+
+  // EditServerDialog.tsx
+  editServerConfiguration: "Edit Server Configuration",
+  serverNameLabel: "Server Name *",
+  enterServerNamePlaceholder: "Enter server name",
+  checkIntervalLabel: "Check Interval",
+  interval10m: "10 minutes",
+  maxRetriesLabel: "Max Retries",
+  selectMaxRetries: "Select max retries",
+  retry1: "1 retry",
+  retry2: "2 retries",
+  retry3: "3 retries",
+  retry5: "5 retries",
+  retry10: "10 retries",
+  dockerMonitoring: "Docker Monitoring",
+  enabled: "Enabled",
+  disabled: "Disabled",
+  enableNotifications: "Enable Notifications",
+  notificationSettings: "Notification Settings",
+  notificationChannels: "Notification Channels",
+  loadingChannels: "Loading channels...",
+  noChannelsAvailable: "No notification channels available",
+  selectedChannels: "Selected Channels:",
+  serverSetThreshold: "Server Set Threshold",
+  loadingThresholds: "Loading thresholds...",
+  selectServerThreshold: "Select server threshold",
+  noThreshold: "No threshold (use default)",
+  thresholdDetails: "Threshold Details",
+  cpuThresholdPct: "CPU Threshold (%)",
+  ramThresholdPct: "RAM Threshold (%)",
+  diskThresholdPct: "Disk Threshold (%)",
+  networkThresholdPct: "Network Threshold (%)",
+  serverTemplate: "Server Template",
+  loadingTemplates: "Loading templates...",
+  selectServerTemplate: "Select server template",
+  noTemplate: "No template (use default)",
+  templateDetails: "Template Details",
+  ramMessage: "RAM Message",
+  cpuMessage: "CPU Message",
+  diskMessage: "Disk Message",
+  networkMessage: "Network Message",
+  upMessage: "Up Message",
+  downMessage: "Down Message",
+  noMessageDefined: "No {name} message defined",
+  serverUpdated: "Server updated",
+  serverUpdatedDesc: "{name} has been updated successfully.",
+  updating: "Updating...",
+  updateServer: "Update Server",
+  failedToLoadChannels: "Failed to load notification channels",
+  failedToLoadTemplates: "Failed to load templates",
+  failedToLoadThresholds: "Failed to load server thresholds",
+  warning: "Warning",
+  serverUpdatedButThresholdFailed: "Server updated but failed to update threshold values.",
+  failedToUpdateServer: "Failed to update server. Please try again.",
+
+  // ServerHistoryCharts.tsx
+  historicalPerformance: "Historical Performance",
+  loading: "Loading...",
+  errorLoadingChartData: "Error loading chart data",
+  noHistoricalData: "No historical data available for {{timeRange}}",
+  rawMetricsCount: "Raw metrics count: {{count}}",
+  serverIdTimeRange: "Server ID: {{serverId}} • Time Range: {{timeRange}}",
+  dataExistsOutsideRange: "Data exists but may be outside selected time range",
+  noMetricsDataFound: "No metrics data found",
+  dataPointsTimeRange: "{{count}} data points • {{timeRange}}",
+  // updating: "Updating...",
+
+};
diff --git a/application/src/translations/en/login.ts b/application/src/translations/en/login.ts
new file mode 100644
index 0000000..87b0278
--- /dev/null
+++ b/application/src/translations/en/login.ts
@@ -0,0 +1,24 @@
+
+import { LoginTranslations } from '../types/login';
+
+export const loginTranslations: LoginTranslations = {
+  signInToYourAccount: "Sign in to your account",
+  dontHaveAccount: "Don't have an account?",
+  createOne: "Create one",
+  signInWithGoogle: "Sign in with Google",
+  orContinueWith: "OR",
+  email: "Email",
+  password: "Password",
+  forgot: "Forgot?",
+  signIn: "Sign In",
+  signingIn: "Signing in...",
+  loginSuccessful: "Login successful",
+  loginSuccessMessage: "You have been logged in successfully.",
+  loginFailed: "Login failed",
+  authenticationFailed: "Authentication failed",
+  invalidCredentials: "Invalid email or password",
+  bySigningIn: "By signing in, you agree to our",
+  termsAndConditions: "Terms & Conditions",
+  and: "and",
+  privacyPolicy: "Privacy Policy",
+};
diff --git a/application/src/translations/en/maintenance.ts b/application/src/translations/en/maintenance.ts
new file mode 100644
index 0000000..a4a4413
--- /dev/null
+++ b/application/src/translations/en/maintenance.ts
@@ -0,0 +1,89 @@
+
+import { MaintenanceTranslations } from '../types/maintenance';
+
+export const maintenanceTranslations: MaintenanceTranslations = {
+  scheduledMaintenance: 'Scheduled Maintenance',
+  scheduledMaintenanceDesc: 'View and manage planned maintenance windows for your systems and services',
+  upcomingMaintenance: 'Upcoming',
+  ongoingMaintenance: 'Ongoing',
+  completedMaintenance: 'Completed',
+  createMaintenanceWindow: 'Create Maintenance',
+  totalScheduledHours: 'Total Scheduled Hours',
+  maintenanceName: 'Maintenance Name',
+  maintenanceStatus: 'Status',
+  scheduledStart: 'Scheduled Start',
+  scheduledEnd: 'Scheduled End',
+  affectedServices: 'Affected Services',
+  impact: 'Impact',
+  minor: 'Minor',
+  major: 'Major',
+  critical: 'Critical',
+  none: 'None',
+  actions: 'Actions',
+  scheduled: 'Scheduled',
+  inprogress: 'In Progress',
+  completed: 'Completed',
+  cancelled: 'Cancelled',
+  markAsInProgress: 'Mark as In Progress',
+  markAsCompleted: 'Mark as Completed',
+  markAsCancelled: 'Mark as Cancelled',
+  confirmDelete: 'Confirm Delete',
+  deleteMaintenanceConfirmation: 'Are you sure you want to delete this maintenance window?',
+  thisActionCannotBeUndone: 'This action cannot be undone.',
+  maintenanceDeleted: 'Maintenance Deleted',
+  maintenanceDeletedDesc: 'The maintenance window has been deleted successfully.',
+  errorDeletingMaintenance: 'There was an error deleting the maintenance window.',
+  statusUpdated: 'Status Updated',
+  maintenanceStatusUpdated: 'Maintenance status has been updated successfully.',
+  errorUpdatingMaintenanceStatus: 'There was an error updating the maintenance status.',
+  createMaintenance: 'Create Maintenance',
+  createMaintenanceDesc: 'Schedule a new maintenance window for your services',
+  enterTitle: 'Enter maintenance title',
+  enterDescription: 'Enter detailed description of the maintenance',
+  startTime: 'Start Time',
+  endTime: 'End Time',
+  selectDate: 'Select a date',
+  enterAffectedServices: 'Enter affected services',
+  separateServicesWithComma: 'Separate multiple services with commas',
+  priority: 'Priority',
+  selectPriority: 'Select priority',
+  selectStatus: 'Select status',
+  selectImpact: 'Select impact',
+  notifySubscribers: 'Notify Subscribers',
+  notifySubscribersDesc: 'Send notifications to all subscribers when this maintenance starts',
+  maintenanceCreated: 'Maintenance Created',
+  maintenanceCreatedDesc: 'The maintenance window has been scheduled successfully.',
+  errorCreatingMaintenance: 'There was an error creating the maintenance window.',
+  errorFetchingMaintenanceData: 'There was an error fetching maintenance data.',
+  low: 'Low',
+  medium: 'Medium',
+  high: 'High',
+  created: 'Created',
+  lastUpdated: 'Last Updated',
+  subscribersWillBeNotified: 'Subscribers will be notified when maintenance begins',
+  noNotifications: 'No notifications will be sent',
+  noScheduledMaintenance: 'No Scheduled Maintenance',
+  noMaintenanceWindows: 'There are no maintenance windows for this period. Create one by clicking the "Create Maintenance" button.',
+  maintenanceCreatedSuccess: 'Maintenance window created successfully',
+  editMaintenanceWindow: 'Edit Maintenance',
+  editMaintenanceDesc: 'Edit maintenance details',
+  priorityDescription: 'Select maintenance priority',
+  statusDescription: 'Select maintenance status',
+  impactLevel: 'Impact Level',
+  impactLevelDescription: 'Select impact level',
+  selectAssignedUsers: 'Select Assigned Users',
+  assignedPersonnelDescription: 'Currently assigned users',
+  mutedNotifications: 'Notifications disabled',
+  notificationsAreMuted: 'Notifications are currently muted for this maintenance',
+  selectNotificationChannel: 'Add a notification channel', 
+  enableNotificationsFirst: 'Enable notifications first to select channel',
+  updateMaintenance: 'Update Maintenance',
+	loginToViewProfile: 'Please login to view your profile',
+	goToLogin: 'Go to Login',
+	loadingUserData: 'Loading user data...',
+	retry: 'Retry',
+	loadingServerData: 'Loading server data...',
+	retrievingYourInformation: 'Please wait while we retrieve your information...',
+	servicesPagination: '{startItem}-{endItem} of {totalItems} services',
+	servicesPaginationNoService: '0 services',
+};
diff --git a/application/src/translations/en/menu.ts b/application/src/translations/en/menu.ts
new file mode 100644
index 0000000..2f8e129
--- /dev/null
+++ b/application/src/translations/en/menu.ts
@@ -0,0 +1,21 @@
+
+import { MenuTranslations } from '../types/menu';
+
+export const menuTranslations: MenuTranslations = {
+  uptimeMonitoring: "Uptime Monitoring",
+  instanceMonitoring: "Instance Monitoring",
+  sslDomain: "SSL & Domain",
+  scheduleIncident: "Schedule & Incident",
+  operationalPage: "Operational Page",
+  reports: "Reports",
+  regionalMonitoring: "Regional Monitoring",
+  settingPanel: "Setting Panel",
+  generalSettings: "General Settings",
+  userManagement: "User Management",
+  notificationSettings: "Notification Settings",
+  alertsTemplates: "Alerts Templates",
+  rolesManagement: "Roles Management",
+  dataRetention: "Data Retention",
+  backupSettings: "Backup Settings",
+  aboutSystem: "About System",
+};
diff --git a/application/src/translations/en/operation.ts b/application/src/translations/en/operation.ts
new file mode 100644
index 0000000..3bb768c
--- /dev/null
+++ b/application/src/translations/en/operation.ts
@@ -0,0 +1,87 @@
+
+import { OperationTranslations } from '../types/operation';
+
+export const operationTranslations: OperationTranslations = {
+
+	// OperationalPageContent.tsx
+	failedToLoadOperationalPages: "Failed to load operational pages",
+	loadingoperationalPages: "There was an error loading your operational pages. Please try again.",
+	tryagain: "Try Again",
+	operationalPages: "Operational Pages",
+  	describeOperation: "Manage your public status pages and monitor service health",
+	refresh: "Refresh",
+	noOperationalPagesFound: "No operational pages found",
+	createYourFirstOperationalPage: "Create your first operational page to start monitoring your services and communicate status to your users.",
+	totalPages: "Total Pages",
+	publicPages: "Public Pages",
+	operational: "Operational",
+	deleteOperationalPage: "Delete Operational Page",
+	deleteOperationalPageConfirm: 'Are you sure you want to delete "{title}"? This action cannot be undone and will permanently remove the operational page and all its components.',
+	cancel: "Cancel",
+	delete: "Delete",
+	deleting: "Deleting...",
+
+	// EditOperationalPageDialog.tsx
+	editOperationalPage: "Edit Operational Page",
+	updateYourOperationalPage: "Update your operational status page settings and manage components.",
+	title: "Title",
+	myServiceStatusPlaceholder: "My Service Status",
+	slug: "Slug",
+	myServiceStatusSlugPlaceholder: "my-service-status",
+	description: "Description",
+	operationalPageDescriptionPlaceholder: "A brief description of your operational page",
+	theme: "Theme",
+	selectTheme: "Select theme",
+	themeDefault: "Default",
+	themeDark: "Dark",
+	themeLight: "Light",
+	status: "Status",
+	selectStatus: "Select status",
+	statusOperational: "Operational",
+	statusDegraded: "Degraded Performance",
+	statusMaintenance: "Under Maintenance",
+	statusMajorOutage: "Major Outage",
+	publicPage: "Public Page",
+	makePagePublic: "Make this page publicly accessible",
+	customDomainOptional: "Custom Domain (Optional)",
+	customDomainPlaceholder: "status.yourdomain.com",
+	customDomainDescription: "Custom domain for your status page",
+	cancelUpdate: "Cancel",
+	updating: "Updating...",
+	updatePage: "Update Page",
+
+	// ComponentsSelector.tsx
+	statusPageComponents: "Status Page Components",
+	addMonitoringComponentsDesc: "Add monitoring components like uptime services, SSL certificates, and incident tracking",
+	selectedComponents: "Selected Components",
+	service: "Service",
+	server: "Server",
+	addComponent: "Add Component",
+	componentName: "Component Name",
+	componentNamePlaceholder: "e.g., Main Website",
+	displayOrder: "Display Order",
+	descriptionOptional: "Description (Optional)",
+	descriptionPlaceholder: "Brief description of this component",
+	uptimeServiceOptional: "Uptime Service (Optional)",
+	selectUptimeService: "Select an uptime service",
+	serverIdOptional: "Server ID (Optional)",
+	serverIdPlaceholder: "server_456",
+	cancelComponent: "Cancel",
+
+	// OperationalPageCard.tsx
+	public: "Public",
+	yes: "Yes",
+	no: "No",
+	updated: "Updated",
+	view: "View",
+	edit: "Edit",
+
+	// CreateOperationalPageDialog.tsx
+	createOperationalPage: "Create Operational Page",
+	createOperationalPageDesc: "Create a new operational status page to monitor your services and components.",
+	createPage: "Create Page",
+	creating: "Creating...",
+	initialStatus: "Initial Status",
+
+  
+};
\ No newline at end of file
diff --git a/application/src/translations/en/public.ts b/application/src/translations/en/public.ts
new file mode 100644
index 0000000..2b5a2a9
--- /dev/null
+++ b/application/src/translations/en/public.ts
@@ -0,0 +1,23 @@
+import { PublicTranslations } from '../types/public';
+
+export const publicTranslations: PublicTranslations = {
+  systemStatus: "System Status",
+  allOperational: "All systems are operational",
+  degradedPerformance: "Some systems are experiencing degraded performance",
+  underMaintenance: "Systems are currently under maintenance",
+  majorOutage: "We are experiencing a major service outage",
+  statusUnknown: "Status unknown",
+  autoUpdatedByHealth: "Status automatically updated based on component health",
+  lastUpdatedAt: "Last updated: {time} UTC",
+  liveStatusMonitoring: "Live status monitoring",
+
+  loadingStatusPage: "Loading Status Page",
+  fetchingRealtimeStatus: "Fetching real-time system status...",
+  slugLabel: "Slug",
+  statusPageNotFound: "Status Page Not Found",
+  notFoundDescription: "The requested status page could not be found or is not publicly accessible.",
+  goBack: "Go Back",
+  retry: "Retry",
+};
+
+
diff --git a/application/src/translations/en/region.ts b/application/src/translations/en/region.ts
new file mode 100644
index 0000000..6bb66ad
--- /dev/null
+++ b/application/src/translations/en/region.ts
@@ -0,0 +1,95 @@
+
+import { RegionTranslations } from '../types/region';
+
+export const regionTranslations: RegionTranslations = {
+	
+  //RegionalMonitoringContent.tsx
+  regionalmonitoring: "Regional Monitoring",
+  descriptRegionPage: "Monitor your infrastructure from multiple regions for better reliability.",
+  addRegionalAgent: "Add Regional Agent",
+  totalAgents: "Total Agents",
+  regionalMonitoringAgents: "Regional monitoring agents",
+  onlineAgents: "Online Agents",
+  currentlyConnected: "Currently connected",
+  offlineAgents: "Offline Agents",
+  disconnectedAgents: "Disconnected agents",
+  regionalAgents: "Regional Agents",
+  noRegionalAgents: "No Regional Agents",
+  getStartedAddAgent: "Get started by adding your first regional monitoring agent to extend your monitoring coverage.",
+  addFirstAgent: "Add First Agent",
+  agentRemoved: "Agent Removed",
+  agentRemovedDesc: "The regional monitoring agent has been removed.",
+  regionalAgentAdded: "Regional Agent Added",
+  regionalAgentAddedDesc: "The regional monitoring agent has been successfully configured.",
+  error: "Error",
+  failedToRemoveAgent: "Failed to remove the regional monitoring agent.",
+
+  //AddRegionalAgentDialog.tsx
+  addRegionalMonitoringAgent: "Add Regional Monitoring Agent",
+  deployRegionalMonitoringAgent: "Deploy a regional monitoring agent with automatic one-click installation.",
+  regionName: "Region Name",
+  regionNamePlaceholder: "e.g., us-east-1, europe-west-1, asia-pacific-1",
+  agentServerIpAddress: "Agent Server IP Address",
+  agentIpPlaceholder: "e.g., 192.168.1.100 or your-server.example.com",
+  cancel: "Cancel",
+  generateInstallation: "Generate Installation",
+  generating: "Generating...",
+  agentConfigurationReady: "Agent Configuration Ready!",
+  oneClickInstallScriptGenerated: "One-click installation script generated with automatic configuration.",
+  oneClickInstallTab: "One-Click Install",
+  agentDetailsTab: "Agent Details",
+  manualInstallTab: "Manual Install",
+  oneClickAutomaticInstallation: "One-Click Automatic Installation",
+  completeInstallationDescription: "Complete installation, configuration, and service startup in one command",
+  whatThisScriptDoes: "What this script does automatically:",
+  scriptActionDownload: "Downloads the latest .deb package",
+  scriptActionInstall: "Installs the regional monitoring agent",
+  scriptActionConfigure: "Creates configuration file with your settings",
+  scriptActionStart: "Starts and enables the service",
+  scriptActionHealthChecks: "Runs health checks",
+  runCommandOnServer: "Run this command on your target server:",
+  downloadCompleteScript: "Download Complete Script",
+  copyFullScript: "Copy Full Script",
+  localDevelopmentNotice: "<strong>Local Development Notice:</strong> If clipboard copying fails, this is normal in local development. You can use the 'Download Complete Script' button instead or manually copy the text.",
+  generatedAgentConfiguration: "Generated Agent Configuration",
+  autoConfiguredDuringInstallation: "These values will be automatically configured during installation",
+  agentId: "Agent ID",
+  regionNameDetail: "Region Name",
+  serverIp: "Server IP",
+  apiEndpoint: "API Endpoint",
+  authenticationToken: "Server Token",
+  createAgent: "Create Agent",
+  configurationFileLocation: "<strong>Configuration file location:</strong> /etc/regional-check-agent/regional-check-agent.env",
+  manualInstallationSteps: "Manual Installation Steps",
+  stepByStepManualInstallation: "Step-by-step manual installation process",
+  step1DownloadPackage: "Step 1: Download Package",
+  downloadAmd64Notice: "✅ If you’re using the amd64 architecture, please download this package.",
+  downloadArm64Notice: "✅ If you’re using the arm64 architecture, please download this package.",
+  step2InstallPackage: "Step 2: Install Package",
+  step3ConfigureAgent: "Step 3: Configure Agent",
+  copySampleConfiguration: "Copy sample configuration from https://github.com/operacle/Distributed-Regional-Monitoring/blob/main/packaging/regional-check-agent.conf",
+  addConfigurationValues: "Add the configuration values shown in the Agent Details tab",
+  step4StartService: "Step 4: Start Service",
+  step5VerifyInstallation: "Step 5: Verify Installation",
+  addAnotherAgent: "Add Another Agent",
+  completeSetup: "Complete Setup",
+  copied: "Copied!",
+  copiedDescription: "{description} copied to clipboard.",
+  copyFailed: "Copy failed",
+  copyFailedDescription: "Failed to copy to clipboard.",
+  copyFailedLocalhost: "This is common in local development. Please manually copy the text.",
+  copyFailedChrome: "Try using HTTPS or enable clipboard permissions.",
+  downloaded: "Downloaded!",
+  downloadedDescription: "Installation script downloaded successfully.",
+  failedToCreateAgent: "Failed to create regional agent configuration.",
+
+  //RegionalAgentCard.tsx
+  defaultBadge: "Default",
+  copyAgentId: "Copy Agent ID",
+  removeAgent: "Remove Agent",
+  online: "Online",
+  offline: "Offline",
+  lastUpdated: "Last Updated:",
+  activeMonitoring: "Active monitoring",
+  connectionLost: "Connection lost",
+};
\ No newline at end of file
diff --git a/application/src/translations/en/services.ts b/application/src/translations/en/services.ts
new file mode 100644
index 0000000..9efc5b1
--- /dev/null
+++ b/application/src/translations/en/services.ts
@@ -0,0 +1,201 @@
+
+import { ServicesTranslations } from '../types/services';
+
+export const servicesTranslations: ServicesTranslations = {
+  serviceStatus: "Service Status",
+  uptime: "Uptime",
+  lastChecked: "Last Checked",
+  noServices: "No services match your filter criteria.",
+  currentlyMonitoring: "Currently Monitoring",
+  retry: "Retry",
+  overview: "Overview",
+  newService: "NewService",
+  rowsPerPage: "Rows Per Page",
+  search: "Search",
+  allTypes: "All Types",
+  createNewService: "Create New Service",
+  createNewServiceDesc: "Fill in the details to create a new service to monitor.",
+
+	// ServiceBasicFields.tsx
+	serviceName: "Service Name",
+	serviceNameDesc: "Enter a descriptive name for your service",
+
+	// ServiceConfigFields.tsx
+	checkInterval: "Check Interval",
+	seconds: "seconds",
+	minute: "minute",
+	minutes: "minutes",
+	hour: "hour",
+	hours: "hours",
+	custom: "Custom",
+	checkIntervalPlaceholder: "Enter interval in seconds",
+	backToPresets: "Back to presets",
+	checkIntervalDesc: "How often to check the service status",
+	checkIntervalDescCustom: "Enter custom interval in seconds (minimum 10 seconds)",
+	retryAttempts: "Retry Attempts",
+	attempt: "attempt",
+	attempts: "attempts",
+	retryAttemptsDesc: "Number of retry attempts before marking as down",
+
+	// ServiceForm.tsx
+	updateService: "Update Service",
+	createService: "Create Service",
+
+	// ServiceNotificationFields.tsx
+	enableNotifications: "Enable Notifications",
+	enableNotificationsDesc: "Enable or disable notifications for this service",
+	notificationChannels: "Notification Channels",
+	notificationChannelsEnabledDesc: "Select notification channels for this service",
+	notificationChannelsDesc: "Enable notifications first to select channels",
+	notificationChannelsPlaceholder: "Add a notification channel",
+	alertTemplate: "Alert Template",
+	alertTemplateLoading: "Loading templates...",
+	alertTemplatePlaceholder: "Select an alert template",
+	alertTemplateEnabledDesc: "Choose a template for alert messages",
+	alertTemplateDesc: "Enable notifications first to select template",
+
+	// ServiceTypeField.tsx
+	serviceType: "Service Type",
+	serviceTypeHTTPDesc: "Monitor websites and REST APIs with HTTP/HTTPS Protocol",
+	serviceTypePINGDesc: "Monitor host availability with PING Protocol",
+	serviceTypeTCPDesc: "Monitor TCP port connectivity with TCP Protocol",
+	serviceTypeDNSDesc: "Monitor DNS resolution",
+
+	// ServiceRegionalFields.tsx
+	regionalMonitoring: "Regional Monitoring",
+	regionalMonitoringDesc: "Assign this service to regional monitoring agents for distributed monitoring",
+	regionalAgents: "Regional Agents",
+	regionalAgentsLoading: "Loading agents...",
+	regionalAgentsAvailablePlaceholder: "Select additional regional agents...",
+	regionalAgentsAllSelected: "All available agents selected",
+	regionalAgentsNoAvailable: "No regional agents available",
+	regionalAgentsNoOnlineAvailable: "No online regional agents available",
+	regionalAgentsNotFoundMessage: "No online regional agents found. Services will use default monitoring.",
+	regionalAgentsNotSelectedMessage: "No regional agents selected. Service will use default monitoring.",
+
+	// ServiceUrlField.tsx
+	targetDefault: "Target URL/Host",
+	targetDNS: "Domain Name",
+	targetHTTPDesc: "Enter the full URL including protocol (http:// or https://)",
+	targetPINGDesc: "Enter hostname or IP address to ping",
+	targetTCPDesc: "Enter hostname or IP address for TCP connection test",
+	targetTCPPortDesc: "Enter the port number for TCP connection test",
+	targetDNSDesc: "Enter domain name for DNS record monitoring (A, AAAA, MX, etc.)",
+	targetDefaultDesc: "Enter the target URL or hostname for monitoring",
+	targetDefaultPlaceholder: "Enter URL or hostname",
+
+	// types.ts
+	serviceNameRequired: "Service name is required",
+	urlDomainHostRequired: "URL/Domain/Host is required",
+	enterValidUrlHostnameDomain: "Please enter a valid URL, hostname, or domain",
+	spacesNotAllowed: "Spaces are not allowed",
+
+	// Dashboard
+	upServices: "UP SERVICES",
+	downServices: "DOWN SERVICES",
+	pausedServices: "PAUSED SERVICES",
+	warningServices: "WARNING SERVICES",
+
+	// ServiceRowActions.tsx
+	viewDetail: "View Detail",
+	resumeMonitoring: "Resume Monitoring",
+	pauseMonitoring: "Pause Monitoring",
+
+
+	//IncidentTable.tsx
+	responseTime: "Response Time",
+	errorMessage: "Error Message",
+	details: "Details",
+	unmuteAlerts: "Unmute Alerts",
+	muteAlerts: "Mute Alerts",
+
+	//LastCheckedTime.tsx
+	pausedAt: "Paused at ",
+	lastCheckDetails: "Last Check Details",
+	checkedAt: "Checked at ",
+	monitoringPaused: "Monitoring Paused",
+	noAutomaticChecks: "No automatic checks",
+
+	//ServiveEditDialog.tsx
+	editService: "Edit Service",
+	editServiceDesc: "Update the details of your monitored service.",
+
+	//ServiceStatsCards.tsx
+	lastCheckedAt: "Last checked at {datetime}",
+	avg: "Avg",
+	lastUpChecksCount: "last {count} up checks",
+	basedOnlastChecksCount: "Based on last {count} checks",
+	totalUptime: "Total Uptime",
+	totalDowntime: "Total Downtime",
+	monitoringSettings: "Monitoring Settings",
+	monitoringSettingsInterval: "Checked every {interval} seconds",
+	monitoringSettingsType: "monitoring",
+	upStatusDuration: "Up for {duration}",
+	downStatusDuration: "Down for {duration}",
+
+	incidentHistory: "Incident History",
+	processing: "Processing",
+	back: "Back",
+	last20Checks: "Last 20 checks",
+
+	//OneClickInstallTab.tsx
+	oneClickInstallTitle: "One-Click Install (Recommended)",
+	oneClickInstallDesc: "Copy and paste this single command to install the monitoring agent instantly",
+	quickInstallCommand: "Quick Install Command",
+	copy: "Copy",
+	runCommandOnServer: "Simply run this command on your server:",
+	sshIntoServer: "SSH into your target server",
+	pasteAndRun: "Paste and run the command above",
+	agentInstalled: "The agent will be installed and started automatically",
+	done: "Done",
+
+	// DockerOneClickTab.tsx
+	dockerOneClickTitle: "Docker One-Click Install",
+	dockerOneClickDesc: "Automated Docker container installation with system monitoring capabilities",
+	dockerOneClickCommand: "Docker One-Click Command",
+	dockerScriptWill: "This script will automatically:",
+	dockerScriptStep1: "Download and setup the Docker monitoring agent",
+	dockerScriptStep2: "Configure all required environment variables",
+	dockerScriptStep3: "Start the container with proper system access",
+	dockerScriptStep4: "Setup monitoring data persistence",
+	directDockerTitle: "Direct Docker Run Command",
+	directDockerDesc: "If you prefer to run the Docker container directly without the script",
+	dockerRunCommand: "Docker Run Command",
+	dockerPrerequisites: "Prerequisites for direct Docker run:",
+	dockerPrereqStep1: "Docker must be installed and running",
+	dockerPrereqStep2: "The operacle/checkcle-server-agent image must be available",
+	dockerPrereqStep3: "Run as root or with sudo privileges",
+
+	// ManualInstallTab.tsx
+	manualInstallTitle: "Manual Installation Steps",
+	manualInstallDesc: "Step-by-step installation process",
+	serverName: "Server Name",
+	agentId: "Agent ID",
+	osType: "OS Type",
+	downloadScript: "Download the installation script",
+	makeExecutable: "Make the script executable",
+	runInstall: "Run the installation with your configuration",
+	prerequisites: "Prerequisites:",
+	prereqRoot: "Ensure you have root/sudo access on the target server",
+	prereqCurl: "Make sure curl is installed for downloading files",
+	prereqInternet: "Internet connection required for downloading script",
+	afterInstall: "After Installation:",
+	agentWillStart: "The agent will start automatically and appear in your dashboard within a few minutes.",
+
+	// ServerDetail.tsx
+	errorLoadingServer: "Error loading server",
+	unableToFetchServerData: "Unable to fetch server data. Please check your connection and try again.",
+	backToServers: "Back to Servers",
+	loadingServerDetails: "Loading server details...",
+	serverDetail: "Server Detail",
+	monitorServerMetrics: "Monitor server performance metrics and system health",
+	serverHostnameIpOs: "{hostname} • {ip_address} • {os_type}",
+
+	// ContainerMonitoring.tsx
+	errorLoadingContainers: "Error loading containers",
+	unableToFetchContainerData: "Unable to fetch container data. Please check your connection and try again.",
+	errorUnknown: "Unknown error",
+	containerMonitoring: "Container Monitoring",
+	monitorAndManageContainers: "Monitor and manage your Docker containers in real-time",
+	serverIdLabel: "Server ID",
+};
\ No newline at end of file
diff --git a/application/src/translations/en/settings.ts b/application/src/translations/en/settings.ts
new file mode 100644
index 0000000..917e609
--- /dev/null
+++ b/application/src/translations/en/settings.ts
@@ -0,0 +1,177 @@
+
+import { SettingsTranslations } from '../types/settings';
+
+export const settingsTranslations: SettingsTranslations = {
+	// General Settings - Tabs
+  systemSettings: "System Settings",
+  mailSettings: "Mail Settings",
+  
+	// General Settings - System Settings
+  appName: "Application Name",
+  appURL: "Application URL",
+  senderName: "Sender Name",
+  senderEmail: "Sender Email Address",
+  hideControls: "Hide Controls",
+  
+	// General Settings - Mail Settings
+  smtpSettings: "SMTP Configuration",
+  smtpEnabled: "Enable SMTP",
+  smtpHost: "SMTP Host",
+  smtpPort: "SMTP Port",
+  smtpUsername: "SMTP Username",
+  smtpPassword: "SMTP Password",
+  smtpAuthMethod: "Authentication Method",
+  enableTLS: "Enable TLS",
+  localName: "Local Name",
+  
+	// General Settings - Test Email
+  testEmail: "Test Email",
+  sendTestEmail: "Send test email",
+  emailTemplate: "Email template",
+  verification: "Verification",
+  passwordReset: "Password reset",
+  confirmEmailChange: "Confirm email change",
+  otp: "OTP",
+  loginAlert: "Login alert",
+  authCollection: "Auth collection",
+  selectCollection: "Select collection",
+  toEmailAddress: "To email address",
+  enterEmailAddress: "Enter email address",
+	send: "Send",
+  sending: "Sending...",
+	testEmailSettings: "Test Email Settings",
+	testEmailDescription: "Test whether the current Email Settings are available",
+	testEmailAlert: "This will send a test email using your configured SMTP settings. Make sure SMTP is properly configured first.",
+
+  // General Settings - Actions and status
+  save: "Save Changes",
+  saving: "Saving...",
+  settingsUpdated: "Settings updated successfully",
+  errorSavingSettings: "Error saving settings",
+  errorFetchingSettings: "Error loading settings",
+  testConnection: "Test Connection",
+  testingConnection: "Testing Connection...",
+  connectionSuccess: "Connection successful",
+  connectionFailed: "Connection failed",
+
+	// User Management
+	addUser: "Add User",
+	permissionNotice: "Permission Notice:",
+	permissionNoticeAddUser: "As an admin user, you do not have access to view or modify system and mail settings. These settings can only be accessed and modified by Super Admins. Contact your Super Admin if you need to make changes to system configuration or mail settings.",
+	loadingSettings: "Loading settings...",
+	loadingSettingsError: "Error loading settings",
+
+  //NotificationSettings.ts
+  titleNotification: "Notification Settings",
+  descriptionChannelsServices: "Configure notification channels for your services",
+  addChannel: "Add Channel",
+  all: "All Channels",
+  telegram: "Telegram",
+  discord: "Discord",
+  slack: "Slack",
+  signal: "Signal",
+  googleChat: "Google Chat",
+  email: "Email",
+  webhook: "Webhook",
+  matrix: "Matrix",
+
+  // NotificationChannelDialog.tsx
+  editChannel: "Edit Notification Channel",
+  addChannelDialog: "Add Notification Channel",
+  channelName: "Channel Name",
+  channelNameDesc: "A name to identify this notification channel",
+  channelType: "Channel Type",
+  selectType: "Select notification type",
+  enabled: "Enabled",
+  enabledDesc: "Enable or disable this notification channel",
+  cancel: "Cancel",
+  updateChannel: "Update Channel",
+  createChannel: "Create Channel",
+  payloadTemplates: "Payload Templates",
+  availablePlaceholders: "Available Placeholders:",
+  server: "Server",
+  service: "Service",
+  ssl: "SSL",
+  common: "Common",
+  webhookUrl: "Webhook URL",
+  webhookUrlDesc: "The URL where webhook notifications will be sent",
+  payloadTemplate: "Payload Template (Optional)",
+  payloadTemplateDesc: "JSON template for the webhook payload. Leave empty to use default template.",
+  telegramChatId: "Chat ID",
+  telegramChatIdDesc: "The Telegram chat ID to send notifications to",
+  botToken: "Bot Token",
+  botTokenDesc: "Your Telegram bot token from @BotFather",
+  discordWebhookUrl: "Webhook URL",
+  discordWebhookUrlDesc: "Discord webhook URL from your server settings",
+  slackWebhookUrl: "Webhook URL",
+  slackWebhookUrlDesc: "Slack incoming webhook URL",
+  signalNumber: "Signal Number",
+  signalNumberDesc: "Signal phone number to send notifications to",
+  signalApiEndpoint: "Signal API Endpoint",
+  signalApiEndpointDesc: "The Rest API endpoint for your Signal service",
+  googleChatWebhookUrl: "Google Chat Webhook URL",
+  googleChatWebhookUrlDesc: "Google Chat webhook URL from your Google Chat space",
+  emailAddress: "Email Address",
+  emailAddressDesc: "Email address to send notifications to",
+  emailSenderName: "Sender Name",
+  emailSenderNameDesc: "Display name for outgoing emails",
+  smtpServer: "SMTP Server",
+  // smtpPort: "SMTP Port",
+  // smtpPassword: "SMTP Password",
+  smtpPasswordDesc: "Password for authenticating with the SMTP server",
+  ntfyEndpoint: "NTFY Endpoint",
+  ntfyEndpointDesc: "The NTFY endpoint URL including your topic (e.g., https://ntfy.sh/checkcle)",
+  apiToken: "API Token",
+  apiTokenOptional: "API Token (Optional)",
+  apiTokenDesc: "Optional API token for authentication with NTFY server",
+  pushoverUserKey: "User Key",
+  pushoverUserKeyDesc: "Your Pushover user key (or group key)",
+  notifiarrChannelId: "Channel ID",
+  notifiarrChannelIdDesc: "The Discord channel ID where notifications will be sent",
+  gotifyServerUrl: "Server URL",
+  gotifyServerUrlDesc: "The URL of your Gotify server",
+  matrixHomeserver: "Homeserver URL",
+  matrixHomeserverDesc: "The URL of your Matrix homeserver (e.g. https://matrix.org)",
+  matrixRoomId: "Room ID",
+  matrixRoomIdDesc: "The Matrix room ID to send notifications to (e.g. !abc123:matrix.org)",
+  matrixAccessToken: "Access Token",
+  matrixAccessTokenDesc: "The access token of your Matrix bot account",
+  errorSaveChannel: "Failed to save notification channel",
+
+  channelNamePlaceholder: "My Notification Channel",
+  telegramChatIdPlaceholder: "Telegram Chat ID",
+  botTokenPlaceholder: "Telegram Bot Token",
+  discordWebhookUrlPlaceholder: "https://discord.com/api/webhooks/...",
+  slackWebhookUrlPlaceholder: "https://hooks.slack.com/services/...",
+  signalNumberPlaceholder: "+1234567890",
+  signalApiEndpointPlaceholder: "https://your-signal-api.com/v2/send",
+  googleChatWebhookUrlPlaceholder: "https://chat.googleapis.com/v1/spaces/...",
+  emailAddressPlaceholder: "notifications@example.com",
+  emailSenderNamePlaceholder: "Alert System",
+  smtpServerPlaceholder: "smtp.gmail.com",
+  smtpPortPlaceholder: "587",
+  smtpPasswordPlaceholder: "Enter your SMTP password",
+  ntfyEndpointPlaceholder: "https://ntfy.sh/your-topic",
+  apiTokenPlaceholder: "Enter API token",
+  pushoverUserKeyPlaceholder: "Your Pushover user key",
+  notifiarrChannelIdPlaceholder: "Discord Channel ID",
+  gotifyServerUrlPlaceholder: "https://your-gotify-server.com",
+  webhookUrlPlaceholder: "https://api.example.com/webhook",
+  matrixHomeserverPlaceholder: "https://matrix.org",
+  matrixRoomIdPlaceholder: "!roomid:matrix.org",
+  matrixAccessTokenPlaceholder: "syt_...",
+
+  // DataRetentionSettings.tsx
+  // permissionNotice: "Permission Notice:",
+  permissionNoticeDataRetention: "As an admin user, you do not have access to data retention settings. These settings can only be accessed and modified by Super Admins.",
+  loadingRetentionSettings: "Loading retention settings...",
+  dataRetention: "Data Retention Settings",
+  dataRetentionDescription: "Configure how long monitoring data is kept in the system",
+  uptimeRetentionLabel: "Uptime Monitoring Retention (days)",
+  uptimeRetentionHelp: "Service uptime and incident data older than this will be automatically deleted",
+  serverRetentionLabel: "Server Monitoring Retention (days)",
+  serverRetentionHelp: "Server metrics and process data older than this will be automatically deleted",
+  lastCleanup: "Last automatic cleanup",
+  // save: "Save Changes"
+
+};
\ No newline at end of file
diff --git a/application/src/translations/en/ssl.ts b/application/src/translations/en/ssl.ts
new file mode 100644
index 0000000..4cc13d8
--- /dev/null
+++ b/application/src/translations/en/ssl.ts
@@ -0,0 +1,117 @@
+
+import { SSLTranslations } from '../types/ssl';
+
+export const sslTranslations: SSLTranslations = {
+  // Page and section titles
+  sslDomainManagement: "SSL & Domain Management",
+  monitorSSLCertificates: "Monitor and manage SSL certificates for your domains",
+  addSSLCertificate: "Add SSL Certificate",
+  editSSLCertificate: "Edit SSL Certificate",
+  deleteSSLCertificate: "Delete SSL Certificate",
+  sslCertificateDetails: "SSL Certificate Details",
+  detailedInfo: "Detailed information for",
+  viewDetailedInformation: "View detailed information for",
+
+  // Status related
+  valid: "Valid",
+  expiringSoon: "Expiring Soon",
+  expired: "Expired",
+  pending: "Pending",
+
+  // Statistics and cards
+  validCertificates: "Valid Certificates",
+  expiringSoonCertificates: "Expiring Soon",
+  expiredCertificates: "Expired Certificates",
+
+  // Form fields
+  domain: "Domain",
+  domainName: "Domain Name",
+  domainCannotChange: "Domain cannot be changed after creation",
+  warningThreshold: "Warning Threshold",
+  warningThresholdDays: "Warning Threshold (Days)",
+  expiryThreshold: "Expiry Threshold",
+  expiryThresholdDays: "Expiry Threshold (Days)",
+  notificationChannel: "Notification Channel",
+  chooseChannel: "Choose a notification channel",
+  whereToSend: "Where to send notifications",
+  daysBeforeExpiration: "Days before expiration to receive warnings",
+  daysBeforeCritical: "Days before expiration to receive critical alerts",
+  getNotifiedExpiration: "Get notified when certificate is about to expire",
+  getNotifiedCritical: "Get notified when certificate is critically close to expiration",
+
+  // Table headers and fields
+  issuer: "Issuer",
+  expirationDate: "Expiration Date",
+  daysLeft: "Days Left",
+  status: "Status",
+  lastNotified: "Last Notified",
+  actions: "Actions",
+  validFrom: "Valid From",
+  validUntil: "Valid Until",
+  validityDays: "Validity Days",
+  validityPeriod: "Validity Period",
+  organization: "Organization",
+  commonName: "Common Name",
+  serialNumber: "Serial Number",
+  algorithm: "Algorithm",
+  subjectAltNames: "Subject Alternative Names",
+  subjectAlternativeNames: "Subject Alternative Names",
+  resolvedIP: "Resolved IP",
+  issuedTo: "Issued To",
+  days: "days",
+  
+  // Buttons and actions
+  addDomain: "Add Domain",
+  refreshAll: "Refresh All",
+  cancel: "Cancel",
+  addCertificate: "Add Certificate",
+  check: "Check",
+  view: "View",
+  edit: "Edit",
+  delete: "Delete",
+  close: "Close",
+  saveChanges: "Save Changes",
+  updating: "Updating",
+  
+  // Sections in detail view
+  basicInformation: "Basic Information",
+  validity: "Validity",
+  issuerInfo: "Issuer Information",
+  technicalDetails: "Technical Details",
+  technicalInformation: "Technical Information",
+  monitoringConfig: "Monitoring Configuration",
+  monitoringConfiguration: "Monitoring Configuration",
+  recordInfo: "Record Information",
+  certificateDetails: "Certificate Details",
+  
+  // Notifications and messages
+  sslCertificateAdded: "SSL Certificate added successfully",
+  sslCertificateUpdated: "SSL Certificate updated successfully",
+  sslCertificateDeleted: "SSL Certificate deleted successfully",
+  sslCertificateRefreshed: "SSL Certificate for {domain} refreshed successfully",
+  allCertificatesRefreshed: "All {count} certificates refreshed successfully",
+  someCertificatesFailed: "{success} certificates refreshed, {failed} failed",
+  failedToAddCertificate: "Failed to add SSL certificate",
+  failedToLoadCertificates: "Failed to load SSL certificates",
+  failedToUpdateCertificate: "Failed to update SSL certificate",
+  failedToDeleteCertificate: "Failed to delete SSL certificate",
+  failedToCheckCertificate: "Failed to check SSL certificate",
+  noCertificatesToRefresh: "No certificates to refresh",
+  startingRefreshAll: "Starting refresh of {count} certificates",
+  checkingSSLCertificate: "Checking SSL certificate...",
+  deleteConfirmation: "Are you sure you want to delete the certificate for",
+  deleteWarning: "This action cannot be undone. This will permanently delete the certificate.",
+  
+  // Misc
+  unknown: "Unknown",
+  never: "Never",
+  none: "None",
+  loadingChannels: "Loading channels...",
+  noChannelsFound: "No notification channels found",
+  noSSLCertificates: "No SSL certificates found",
+  created: "Created",
+  lastUpdated: "Last Updated",
+  lastNotification: "Last Notification",
+  collectionId: "Collection ID",
+  noCertificatesFound: "No Certificates Found",
+};
diff --git a/application/src/translations/index.ts b/application/src/translations/index.ts
new file mode 100644
index 0000000..8dd3223
--- /dev/null
+++ b/application/src/translations/index.ts
@@ -0,0 +1,21 @@
+import enTranslations from './en';
+import kmTranslations from './km';
+import deTranslations from './de';
+import koTranslations from './ko';
+import jaTranslations from './ja';
+import zhcnTranslations from './zhcn';
+
+export type Language = "en" | "km" | "de" | "ko" | "ja" | "zhcn";
+
+export const translations = {
+  en: enTranslations,
+  km: kmTranslations,
+  de: deTranslations,
+  ko: koTranslations,
+  ja: jaTranslations,
+  zhcn: zhcnTranslations,
+};
+
+// Type for accessing translations by module and key
+export type TranslationModule = keyof typeof enTranslations;
+export type TranslationKey<M extends TranslationModule> = keyof typeof enTranslations[M];
diff --git a/application/src/translations/ja/about.ts b/application/src/translations/ja/about.ts
new file mode 100644
index 0000000..4f4799d
--- /dev/null
+++ b/application/src/translations/ja/about.ts
@@ -0,0 +1,18 @@
+import { AboutTranslations } from '../types/about';
+
+export const aboutTranslations: AboutTranslations = {
+  aboutCheckCle: "Checkcleについて",
+  systemDescription: "Checkcleは、サーバーとサービスの健全性に関するリアルタイム監視、インシデント管理、運用の透明性を提供するオープンソースの監視スタックです。MIT ライセンスの下で公開されています。",
+  systemVersion: "システムバージョン",
+  license: "ライセンス",
+  mitLicense: "MIT ライセンス",
+  links: "リンク",
+  viewOnGithub: "GitHubで表示",
+  viewDocumentation: "ドキュメントを表示",
+  followOnX: "Xでフォロー",
+  joinDiscord: "Discordに参加",
+  quickActions: "クイックアクション",
+  quickActionsDescription: "一般的な監視操作と機能に素早くアクセスできます。開始するには、以下のアクションを選択してください。",
+  quickTips: "クイックヒント",
+  releasedOn: "公開日",
+};
\ No newline at end of file
diff --git a/application/src/translations/ja/common.ts b/application/src/translations/ja/common.ts
new file mode 100644
index 0000000..e59de9b
--- /dev/null
+++ b/application/src/translations/ja/common.ts
@@ -0,0 +1,31 @@
+import { CommonTranslations } from '../types/common';
+
+export const commonTranslations: CommonTranslations = {
+  welcome: "ようこそ",
+  logout: "ログアウト",
+  language: "言語",
+  english: "Englisch",
+  khmer: "ភាសាខ្មែរ",
+  german: "Deutsch",
+  korean: "한국어",
+  japanese: "日本語",
+  simplifiedChinese: "简体中文",
+  goodMorning: "おはようございます",
+  goodAfternoon: "こんにちは",
+  goodEvening: "こんばんは",
+  profile: "プロファイル",
+  settings: "設定",
+  documentation: "ドキュメント",
+  notifications: "通知",
+  close: "閉じる",
+  cancel: "キャンセル",
+  view: "表示",
+  edit: "編集",
+  delete: "削除",
+  status: "ステータス",
+  time: "時間",
+  title: "タイトル",
+  description: "説明",
+  success: "成功",
+  error: "エラー",
+};
diff --git a/application/src/translations/ja/incident.ts b/application/src/translations/ja/incident.ts
new file mode 100644
index 0000000..331a832
--- /dev/null
+++ b/application/src/translations/ja/incident.ts
@@ -0,0 +1,55 @@
+import { IncidentTranslations } from '../types/incident';
+
+export const incidentTranslations: IncidentTranslations = {
+  incidentManagement: 'インシデント管理',
+  incidentsManagementDesc: 'サービスのインシデントとその解決を追跡・管理する',
+  unresolvedIncidents: '未解決',
+  resolvedIncidents: '解決済み',
+  activeIncidents: 'アクティブなインシデント',
+  criticalIssues: '重要な問題',
+  avgResolutionTime: '平均解決時間',
+  noIncidents: 'アクティブなインシデントはありません',
+  createIncident: 'インシデントを作成',
+  investigating: '調査中',
+  identified: '特定済み',
+  monitoring: '監視中',
+  resolved: '解決済み',
+  scheduleIncidentManagement: 'スケジュール・インシデント管理',
+  incidentName: 'インシデント名',
+  incidentStatus: 'インシデントステータス',
+  highPriority: '高優先度',
+  configurationSettings: '設定',
+  incidentCreatedSuccess: 'インシデントが正常に作成されました',
+  basicInfo: '基本情報',
+  serviceId: 'サービスID',
+  assignedTo: '担当者',
+  unassigned: '未割り当て',
+  timeline: 'タイムライン',
+  incidentTime: 'インシデント発生時刻',
+  resolutionTime: '解決時刻',
+  systems: 'システム',
+  noSystems: '影響を受けるシステムはありません',
+  impactAnalysis: '影響分析',
+  rootCause: '根本原因',
+  resolutionSteps: '解決手順',
+  lessonsLearned: '学んだ教訓',
+  resolutionDetails: '解決詳細',
+  assignment: '割り当て',
+  download: 'ダウンロード',
+  downloadPdf: 'PDFダウンロード',
+  print: '印刷',
+  confidentialNote: 'この文書は機密情報であり、内部使用のみを目的としています。',
+  generatedOn: '生成日時',
+  enterResolutionSteps: 'インシデント解決のために取った手順を入力してください',
+  enterLessonsLearned: 'このインシデントから学んだ教訓を入力してください',
+  editIncident: 'インシデントを編集',
+  editIncidentDesc: 'このインシデントの詳細を更新',
+  updating: '更新中...',
+  update: '更新',
+  create: '作成',
+  creating: '作成中...',
+  configuration: '設定',
+  failedToUpdateStatus: 'ステータスの更新に失敗しました',
+  inProgress: '進行中',
+  enterRootCause: '原因を入力してください',
+};
\ No newline at end of file
diff --git a/application/src/translations/ja/index.ts b/application/src/translations/ja/index.ts
new file mode 100644
index 0000000..1359325
--- /dev/null
+++ b/application/src/translations/ja/index.ts
@@ -0,0 +1,24 @@
+import { Translations } from '../types';
+import { commonTranslations } from './common';
+import { menuTranslations } from './menu';
+import { loginTranslations } from './login';
+import { aboutTranslations } from './about';
+import { servicesTranslations } from './services';
+import { maintenanceTranslations } from './maintenance';
+import { incidentTranslations } from './incident';
+import { sslTranslations } from './ssl';
+import { settingsTranslations } from './settings';
+
+const jaTranslations: Translations = {
+  common: commonTranslations,
+  menu: menuTranslations,
+  login: loginTranslations,
+  about: aboutTranslations,
+  services: servicesTranslations,
+  maintenance: maintenanceTranslations,
+  incident: incidentTranslations,
+  ssl: sslTranslations,
+  settings: settingsTranslations
+};
+
+export default jaTranslations;
\ No newline at end of file
diff --git a/application/src/translations/ja/login.ts b/application/src/translations/ja/login.ts
new file mode 100644
index 0000000..bdef3e2
--- /dev/null
+++ b/application/src/translations/ja/login.ts
@@ -0,0 +1,23 @@
+import { LoginTranslations } from '../types/login';
+
+export const loginTranslations: LoginTranslations = {
+  signInToYourAccount: "アカウントにサインイン",
+  dontHaveAccount: "アカウントをお持ちでない場合",
+  createOne: "作成する",
+  signInWithGoogle: "Googleでサインイン",
+  orContinueWith: "または",
+  email: "メール",
+  password: "パスワード",
+  forgot: "忘れた場合",
+  signIn: "サインイン",
+  signingIn: "サインイン中...",
+  loginSuccessful: "ログイン成功",
+  loginSuccessMessage: "正常にログインしました。",
+  loginFailed: "ログイン失敗",
+  authenticationFailed: "認証に失敗しました",
+  invalidCredentials: "メールアドレスまたはパスワードが正しくありません",
+  bySigningIn: "サインインすることで、",
+  termsAndConditions: "利用規約",
+  and: "と",
+  privacyPolicy: "プライバシーポリシー",
+};
\ No newline at end of file
diff --git a/application/src/translations/ja/maintenance.ts b/application/src/translations/ja/maintenance.ts
new file mode 100644
index 0000000..393d3ab
--- /dev/null
+++ b/application/src/translations/ja/maintenance.ts
@@ -0,0 +1,67 @@
+import { MaintenanceTranslations } from '../types/maintenance';
+
+export const maintenanceTranslations: MaintenanceTranslations = {
+  scheduledMaintenance: 'スケジュール済みメンテナンス',
+  scheduledMaintenanceDesc: 'システムとサービスの計画されたメンテナンスウィンドウを表示・管理',
+  upcomingMaintenance: '予定',
+  ongoingMaintenance: '実行中',
+  completedMaintenance: '完了',
+  createMaintenanceWindow: 'メンテナンス作成',
+  totalScheduledHours: '総スケジュール時間',
+  maintenanceName: 'メンテナンス名',
+  maintenanceStatus: 'ステータス',
+  scheduledStart: 'スケジュール開始',
+  scheduledEnd: 'スケジュール終了',
+  affectedServices: '影響を受けるサービス',
+  impact: '影響',
+  minor: '軽微',
+  major: '重要',
+  critical: '重大',
+  none: 'なし',
+  actions: 'アクション',
+  scheduled: 'スケジュール済み',
+  inprogress: '進行中',
+  completed: '完了',
+  cancelled: 'キャンセル',
+  markAsInProgress: '進行中としてマーク',
+  markAsCompleted: '完了としてマーク',
+  markAsCancelled: 'キャンセルとしてマーク',
+  confirmDelete: '削除確認',
+  deleteMaintenanceConfirmation: 'このメンテナンスウィンドウを削除してもよろしいですか？',
+  thisActionCannotBeUndone: 'この操作は元に戻せません。',
+  maintenanceDeleted: 'メンテナンス削除完了',
+  maintenanceDeletedDesc: 'メンテナンスウィンドウが正常に削除されました。',
+  errorDeletingMaintenance: 'メンテナンスウィンドウの削除中にエラーが発生しました。',
+  statusUpdated: 'ステータス更新完了',
+  maintenanceStatusUpdated: 'メンテナンスステータスが正常に更新されました。',
+  errorUpdatingMaintenanceStatus: 'メンテナンスステータスの更新中にエラーが発生しました。',
+  createMaintenance: 'メンテナンス作成',
+  createMaintenanceDesc: 'サービスの新しいメンテナンスウィンドウをスケジュール',
+  enterTitle: 'メンテナンスタイトルを入力',
+  enterDescription: 'メンテナンスの詳細説明を入力',
+  startTime: '開始時刻',
+  endTime: '終了時刻',
+  selectDate: '日付を選択',
+  enterAffectedServices: '影響を受けるサービスを入力',
+  separateServicesWithComma: '複数のサービスはカンマで区切ってください',
+  priority: '優先度',
+  selectPriority: '優先度を選択',
+  selectStatus: 'ステータスを選択',
+  selectImpact: '影響を選択',
+  notifySubscribers: '購読者に通知',
+  notifySubscribersDesc: 'このメンテナンスが開始されたときに全購読者に通知を送信',
+  maintenanceCreated: 'メンテナンス作成完了',
+  maintenanceCreatedDesc: 'メンテナンスウィンドウが正常にスケジュールされました。',
+  errorCreatingMaintenance: 'メンテナンスウィンドウの作成中にエラーが発生しました。',
+  errorFetchingMaintenanceData: 'メンテナンスデータの取得中にエラーが発生しました。',
+  low: '低',
+  medium: '中',
+  high: '高',
+  created: '作成済み',
+  lastUpdated: '最終更新',
+  subscribersWillBeNotified: 'メンテナンス開始時に購読者に通知されます',
+  noNotifications: '通知は送信されません',
+  noScheduledMaintenance: 'スケジュール済みメンテナンスなし',
+  noMaintenanceWindows: 'この期間にメンテナンスウィンドウはありません。「メンテナンス作成」ボタンをクリックして作成してください。',
+  maintenanceCreatedSuccess: 'メンテナンスウィンドウが正常に作成されました',
+};
\ No newline at end of file
diff --git a/application/src/translations/ja/menu.ts b/application/src/translations/ja/menu.ts
new file mode 100644
index 0000000..cda8377
--- /dev/null
+++ b/application/src/translations/ja/menu.ts
@@ -0,0 +1,20 @@
+import { MenuTranslations } from '../types/menu';
+
+export const menuTranslations: MenuTranslations = {
+  uptimeMonitoring: "稼働監視",
+  instanceMonitoring: "インスタンス監視",
+  sslDomain: "SSL・ドメイン",
+  scheduleIncident: "スケジュール・インシデント",
+  operationalPage: "運用ページ",
+  reports: "レポート",
+  regionalMonitoring: "地域監視",
+  settingPanel: "設定パネル",
+  generalSettings: "一般設定",
+  userManagement: "ユーザー管理",
+  notificationSettings: "通知設定",
+  alertsTemplates: "アラートテンプレート",
+  rolesManagement: "ロール管理",
+  dataRetention: "データ保持",
+  backupSettings: "バックアップ設定",
+  aboutSystem: "システム情報",
+};
\ No newline at end of file
diff --git a/application/src/translations/ja/services.ts b/application/src/translations/ja/services.ts
new file mode 100644
index 0000000..bb64ae0
--- /dev/null
+++ b/application/src/translations/ja/services.ts
@@ -0,0 +1,21 @@
+import { ServicesTranslations } from '../types/services';
+
+export const servicesTranslations: ServicesTranslations = {
+  serviceName: "サービス名",
+  serviceNameDesc: "サービスのわかりやすい名前を入力してください",
+  serviceType: "サービスタイプ",
+  serviceStatus: "サービスステータス",
+  responseTime: "応答時間",
+  uptime: "稼働時間",
+  lastChecked: "最終チェック",
+  noServices: "フィルタ条件に一致するサービスがありません。",
+  currentlyMonitoring: "現在監視中",
+  retry: "再試行",
+  overview: "概要",
+  newService: "新しいサービス",
+  rowsPerPage: "1ページあたりの行数",
+  search: "検索",
+  allTypes: "すべてのタイプ",
+  createNewService: "新しいサービスを作成",
+  createNewServiceDesc: "監視する新しいサービスを作成するには、詳細を入力してください。",
+};
\ No newline at end of file
diff --git a/application/src/translations/ja/settings.ts b/application/src/translations/ja/settings.ts
new file mode 100644
index 0000000..8c4ec80
--- /dev/null
+++ b/application/src/translations/ja/settings.ts
@@ -0,0 +1,51 @@
+import { SettingsTranslations } from '../types/settings';
+
+export const settingsTranslations: SettingsTranslations = {
+  // タブ
+  systemSettings: "システム設定",
+  mailSettings: "メール設定",
+  
+  // システム設定
+  appName: "アプリケーション名",
+  appURL: "アプリケーションURL",
+  senderName: "送信者名",
+  senderEmail: "送信者メールアドレス",
+  hideControls: "コントロールを非表示",
+  
+  // メール設定
+  smtpSettings: "SMTP設定",
+  smtpEnabled: "SMTPを有効にする",
+  smtpHost: "SMTPホスト",
+  smtpPort: "SMTPポート",
+  smtpUsername: "SMTPユーザー名",
+  smtpPassword: "SMTPパスワード",
+  smtpAuthMethod: "認証方式",
+  enableTLS: "TLSを有効にする",
+  localName: "ローカル名",
+  
+  // テストメール
+  testEmail: "テストメール",
+  sendTestEmail: "テストメールを送信",
+  emailTemplate: "メールテンプレート",
+  verification: "認証",
+  passwordReset: "パスワードリセット",
+  confirmEmailChange: "メールアドレス変更確認",
+  otp: "OTP",
+  loginAlert: "ログインアラート",
+  authCollection: "認証コレクション",
+  selectCollection: "コレクションを選択",
+  toEmailAddress: "宛先メールアドレス",
+  enterEmailAddress: "メールアドレスを入力",
+  sending: "送信中...",
+  
+  // アクションとステータス
+  save: "変更を保存",
+  saving: "保存中...",
+  settingsUpdated: "設定が正常に更新されました",
+  errorSavingSettings: "設定の保存中にエラーが発生しました",
+  errorFetchingSettings: "設定の読み込み中にエラーが発生しました",
+  testConnection: "接続テスト",
+  testingConnection: "接続テスト中...",
+  connectionSuccess: "接続成功",
+  connectionFailed: "接続失敗"
+};
\ No newline at end of file
diff --git a/application/src/translations/ja/ssl.ts b/application/src/translations/ja/ssl.ts
new file mode 100644
index 0000000..2fb3622
--- /dev/null
+++ b/application/src/translations/ja/ssl.ts
@@ -0,0 +1,116 @@
+import { SSLTranslations } from '../types/ssl';
+
+export const sslTranslations: SSLTranslations = {
+  // ページとセクションタイトル
+  sslDomainManagement: "SSL・ドメイン管理",
+  monitorSSLCertificates: "ドメインのSSL証明書を監視・管理",
+  addSSLCertificate: "SSL証明書を追加",
+  editSSLCertificate: "SSL証明書を編集",
+  deleteSSLCertificate: "SSL証明書を削除",
+  sslCertificateDetails: "SSL証明書詳細",
+  detailedInfo: "詳細情報:",
+  viewDetailedInformation: "View detailed information for",
+
+  // ステータス関連
+  valid: "有効",
+  expiringSoon: "期限切れ間近",
+  expired: "期限切れ",
+  pending: "保留中",
+
+  // 統計とカード
+  validCertificates: "有効な証明書",
+  expiringSoonCertificates: "期限切れ間近",
+  expiredCertificates: "期限切れ証明書",
+
+  // フォームフィールド
+  domain: "ドメイン",
+  domainName: "ドメイン名",
+  domainCannotChange: "ドメインは作成後変更できません",
+  warningThreshold: "警告閾値",
+  warningThresholdDays: "警告閾値（日）",
+  expiryThreshold: "期限切れ閾値",
+  expiryThresholdDays: "期限切れ閾値（日）",
+  notificationChannel: "通知チャンネル",
+  chooseChannel: "通知チャンネルを選択",
+  whereToSend: "通知の送信先",
+  daysBeforeExpiration: "期限切れ前の警告を受信する日数",
+  daysBeforeCritical: "期限切れ前の重要アラートを受信する日数",
+  getNotifiedExpiration: "証明書の期限切れが近い時に通知を受信",
+  getNotifiedCritical: "証明書の期限切れが非常に近い時に通知を受信",
+
+  // テーブルヘッダーとフィールド
+  issuer: "発行者",
+  expirationDate: "有効期限",
+  daysLeft: "残り日数",
+  status: "ステータス",
+  lastNotified: "最終通知",
+  actions: "アクション",
+  validFrom: "有効開始日",
+  validUntil: "有効終了日",
+  validityDays: "有効期間",
+  validityPeriod: "Validity Period",
+  organization: "組織",
+  commonName: "コモンネーム",
+  serialNumber: "シリアル番号",
+  algorithm: "アルゴリズム",
+  subjectAltNames: "サブジェクト代替名",
+  subjectAlternativeNames: "Subject Alternative Names",
+  resolvedIP: "Resolved IP",
+  issuedTo: "Issued To",
+  days: "days",
+  
+  // ボタンとアクション
+  addDomain: "ドメインを追加",
+  refreshAll: "全て更新",
+  cancel: "キャンセル",
+  addCertificate: "証明書を追加",
+  check: "チェック",
+  view: "表示",
+  edit: "編集",
+  delete: "削除",
+  close: "閉じる",
+  saveChanges: "変更を保存",
+  updating: "更新中",
+  
+  // 詳細ビューのセクション
+  basicInformation: "基本情報",
+  validity: "有効性",
+  issuerInfo: "発行者情報",
+  technicalDetails: "技術的詳細",
+  technicalInformation: "Technical Information",
+  monitoringConfig: "監視設定",
+  monitoringConfiguration: "Monitoring Configuration",
+  recordInfo: "レコード情報",
+  certificateDetails: "Certificate Details",
+  
+  // 通知とメッセージ
+  sslCertificateAdded: "SSL証明書が正常に追加されました",
+  sslCertificateUpdated: "SSL証明書が正常に更新されました",
+  sslCertificateDeleted: "SSL証明書が正常に削除されました",
+  sslCertificateRefreshed: "{domain}のSSL証明書が正常に更新されました",
+  allCertificatesRefreshed: "全{count}件の証明書が正常に更新されました",
+  someCertificatesFailed: "{success}件の証明書が更新され、{failed}件が失敗しました",
+  failedToAddCertificate: "SSL証明書の追加に失敗しました",
+  failedToLoadCertificates: "SSL証明書の読み込みに失敗しました",
+  failedToUpdateCertificate: "SSL証明書の更新に失敗しました",
+  failedToDeleteCertificate: "SSL証明書の削除に失敗しました",
+  failedToCheckCertificate: "SSL証明書のチェックに失敗しました",
+  noCertificatesToRefresh: "更新する証明書がありません",
+  startingRefreshAll: "{count}件の証明書の更新を開始しています",
+  checkingSSLCertificate: "SSL証明書をチェック中...",
+  deleteConfirmation: "以下の証明書を削除してもよろしいですか？",
+  deleteWarning: "この操作は元に戻せません。証明書が完全に削除されます。",
+  
+  // その他
+  unknown: "不明",
+  never: "なし",
+  none: "なし",
+  loadingChannels: "チャンネル読み込み中...",
+  noChannelsFound: "通知チャンネルが見つかりません",
+  noSSLCertificates: "SSL証明書が見つかりません",
+  created: "作成日",
+  lastUpdated: "最終更新",
+  lastNotification: "最終通知",
+  collectionId: "コレクションID",
+  noCertificatesFound: "証明書が見つかりません",
+};
\ No newline at end of file
diff --git a/application/src/translations/km/about.ts b/application/src/translations/km/about.ts
new file mode 100644
index 0000000..ee6112c
--- /dev/null
+++ b/application/src/translations/km/about.ts
@@ -0,0 +1,34 @@
+
+import { AboutTranslations } from '../types/about';
+
+export const aboutTranslations: AboutTranslations = {
+  aboutCheckCle: "អំពី Checkcle",
+  systemDescription: "Checkcle គឺជាស្តាកការត្រួតពិនិត្យប្រភពបើកទូលាយដែលផ្តល់នូវការយល់ដឹងជាក់ស្តែងអំពីសុខភាពម៉ាស៊ីនមេ និងសេវាកម្ម, ការគ្រប់គ្រងឧបទ្ទវហេតុ, និងតម្លាភាពនៃប្រតិបត្តិការ។ ចេញផ្សាយជាអាជ្ញាបណ្ណ MIT។",
+  systemVersion: "កំណែប្រព័ន្ធ",
+  license: "អាជ្ញាបណ្ណ",
+  mitLicense: "អាជ្ញាបណ្ណ MIT",
+  links: "តំណភ្ជាប់",
+  viewOnGithub: "មើលលើ GitHub",
+  viewDocumentation: "មើលឯកសារ",
+  followOnX: "តាមដានលើ X",
+  joinDiscord: "ចូលរួមក្នុង Discord",
+  quickActions: "សកម្មភាពរហ័ស",
+  quickActionsDescription: "ចូលប្រើប្រតិបត្តិការត្រួតពិនិត្យ និងមុខងារទូទៅយ៉ាងរហ័ស។ ជ្រើសរើសសកម្មភាពខាងក្រោមដើម្បីចាប់ផ្តើម។",
+  quickTips: "គន្លឹះរហ័ស",
+  releasedOn: "បានចេញផ្សាយនៅថ្ងៃទី",
+    updateSchema: "ធ្វើបច្ចុប្បន្នភាព Schema",
+    updateSchemaDesc: "បញ្ចូល Schema នៃការប្រមូលដោយស្វ័យប្រវត្តិ",
+    mergeFieldsLabel: "បញ្ចូល fields ជាមួយនឹងការប្រមូលដែលមានស្រាប់ (សុវត្ថិភាព - រក្សាទិន្នន័យ)",
+    importing: "កំពុងបញ្ចូល...",
+    clickToUpdateSchema: "ចុចដើម្បីធ្វើបច្ចុប្បន្នភាព Schema",
+    importSuccessful: "បញ្ចូលជោគជ័យ",
+    importFailed: "បញ្ចូលបរាជ័យ",
+    instructions: "ការណែនាំ",
+    mergeFields: "បញ្ចូល fields",
+    instructionsMergeFields: "បន្ថែម fields ថ្មីទៅក្នុងការប្រមូលដែលមានស្រាប់ដោយសុវត្ថិភាព រក្សាទុកទិន្នន័យទាំងអស់",
+    instructionsCollections: "ការប្រមូលប្រព័ន្ធ (ចាប់ផ្តើមដោយ _) និងការប្រមូលអ្នកប្រើប្រាស់នឹងត្រូវរំលងដោយស្វ័យប្រវត្តិ",
+    instructionsImportAuth: "មានតែអ្នកគ្រប់គ្រងដែលបានផ្ទៀងផ្ទាត់អត្តសញ្ញាណប៉ុណ្ណោះអាចធ្វើការបញ្ចូល Schema",
+    collectionsUpdatedCount: "ការប្រមូលចំនួន {count} ត្រូវបានធ្វើបច្ចុប្បន្នភាព",
+    collectionsCreatedCount: "ការប្រមូលចំនួន {count} ត្រូវបានបង្កើត",
+    collectionsSkippedCount: "ការប្រមូលចំនួន {count} ត្រូវបានរំលង"
+};
\ No newline at end of file
diff --git a/application/src/translations/km/common.ts b/application/src/translations/km/common.ts
new file mode 100644
index 0000000..fe1a1f9
--- /dev/null
+++ b/application/src/translations/km/common.ts
@@ -0,0 +1,32 @@
+
+import { CommonTranslations } from '../types/common';
+
+export const commonTranslations: CommonTranslations = {
+  welcome: "សូមស្វាគមន៍",
+  logout: "ចាកចេញ",
+  language: "ភាសា",
+  english: "Englisch",
+  khmer: "ភាសាខ្មែរ",
+  german: "Deutsch",
+  korean: "한국어",
+  japanese: "日本語",
+  simplifiedChinese: "简体中文",
+  goodMorning: "អរុណសួស្តី",
+  goodAfternoon: "ទិវាសួស្តី",
+  goodEvening: "សាយណ្ហសួស្តី",
+  profile: "ប្រវត្តិរូប",
+  settings: "ការកំណត់",
+  documentation: "ឯកសារ",
+  notifications: "ការជូនដំណឹង",
+  close: "បិទ",
+  cancel: "បោះបង់",
+  view: "មើល",
+  edit: "កែសម្រួល",
+  delete: "លុប",
+  status: "ស្ថានភាព",
+  time: "ពេលវេលា",
+  title: "ចំណងជើង",
+  description: "ការពិពណ៌នា",
+  success: "ជោគជ័យ",
+  error: "កំហុស",
+};
diff --git a/application/src/translations/km/docker.ts b/application/src/translations/km/docker.ts
new file mode 100644
index 0000000..a1c235f
--- /dev/null
+++ b/application/src/translations/km/docker.ts
@@ -0,0 +1,71 @@
+import { DockerTranslations } from '../types/docker';
+
+export const dockerTranslations: DockerTranslations = {
+  dockerContainers: "Containers Docker",
+  container: "Containers",
+  status: "ស្ថានភាព",
+  cpuUsage: "ការប្រើប្រាស់ CPU",
+  memory: "អង្គចងចាំ",
+  disk: "ថាស",
+  uptime: "ពេលដំណើរការ",
+  lastChecked: "បានពិនិត្យចុងក្រោយ",
+  actions: "សកម្មភាព",
+  searchContainersPlaceholder: "ស្វែងរកContainers...",
+  refresh: "ធ្វើបច្ចុប្បន្នភាព",
+  openMenu: "បើកម៉ឺនុយ",
+  viewMetrics: "មើលមេត្រីក",
+  viewDetails: "មើលព័ត៌មានលម្អិត",
+
+  running: "ដំណើរការ",
+  stopped: "បានបញ្ឈប់",
+  warning: "ការព្រមាន",
+  unknown: "មិនស្គាល់",
+  totalContainers: "Containers សរុប",
+  containersLabel: "Containers",
+
+  noContainersFound: "រកមិនឃើញContainers",
+  noContainersRunning: "គ្មានContainersកំពុងដំណើរការ",
+  tryAdjustSearch: "សូមព្យាយាមកែសម្រួលពាក្យស្វែងរករបស់អ្នក។",
+  startSomeContainers: "ចាប់ផ្តើមContainersខ្លះៗ ដើម្បីមើលពួកវានៅទីនេះ។",
+
+  containerMetricsTitle: "មេត្រីកContainers: {name}",
+  dockerId: "Docker ID",
+  loadingMetrics: "កំពុងផ្ទុកមេត្រីក...",
+  errorLoadingMetrics: "កំហុសក្នុងការផ្ទុកមេត្រីក",
+  noMetricsAvailable: "គ្មានទិន្នន័យមេត្រីកសម្រាប់Containersនេះ",
+
+  minutes60: "៦០ នាទី",
+  day1: "១ ថ្ងៃ",
+  days7: "៧ ថ្ងៃ",
+  month1: "១ ខែ",
+  months3: "៣ ខែ",
+
+  used: "បានប្រើ:",
+  free: "ទំនេរ:",
+  total: "សរុប:",
+  usage: "ការប្រើប្រាស់:",
+  cpu: "CPU",
+  memoryTitle: "អង្គចងចាំ",
+  diskTitle: "ថាស",
+  network: "បណ្តាញ",
+
+  cpuUsagePct: "ការប្រើប្រាស់ CPU (%)",
+  cpuUsageVsAvailable: "ការប្រើប្រាស់ CPU នឹង អាចប្រើបាន",
+  cpuAvailablePct: "CPU អាចប្រើបាន (%)",
+  ramUsagePct: "ការប្រើប្រាស់ RAM (%)",
+  memoryUsageBytes: "ការប្រើប្រាស់អង្គចងចាំ (បៃ)",
+  usedMemory: "អង្គចងចាំបានប្រើ",
+  totalMemory: "អង្គចងចាំសរុប",
+  diskUsagePct: "ការប្រើប្រាស់ថាស (%)",
+  diskUsageBytes: "ការប្រើប្រាស់ថាស (បៃ)",
+  usedDisk: "ថាសបានប្រើ",
+  totalDisk: "ថាសសរុប",
+  networkTraffic: "ចរាចរបណ្តាញ",
+  networkSpeedKbs: "ល្បឿនបណ្តាញ (KB/s)",
+  rxBytes: "RX បៃ",
+  txBytes: "TX បៃ",
+  rxSpeedKbs: "ល្បឿន RX (KB/s)",
+  txSpeedKbs: "ល្បឿន TX (KB/s)",
+};
+
+
diff --git a/application/src/translations/km/incident.ts b/application/src/translations/km/incident.ts
new file mode 100644
index 0000000..7f204d5
--- /dev/null
+++ b/application/src/translations/km/incident.ts
@@ -0,0 +1,65 @@
+
+import { IncidentTranslations } from '../types/incident';
+
+export const incidentTranslations: IncidentTranslations = {
+  incidentManagement: "ការគ្រប់គ្រងឧប្បត្តិហេតុ",
+  incidentsManagementDesc: "តាមដាន និងគ្រប់គ្រងឧប្បត្តិហេតុសេវាកម្ម និងការដោះស្រាយរបស់ពួកវា",
+  unresolvedIncidents: "មិនទាន់ដោះស្រាយ",
+  resolvedIncidents: "បានដោះស្រាយ",
+  activeIncidents: "ឧប្បត្តិហេតុសកម្ម",
+  criticalIssues: "បញ្ហាសំខាន់ៗ",
+  avgResolutionTime: "ពេលវេលាដោះស្រាយជាមធ្យម",
+  noIncidents: "គ្មានឧប្បត្តិហេតុសកម្មទេ",
+  createIncident: "បង្កើតឧប្បត្តិហេតុ",
+  investigating: "កំពុងស៊ើបអង្កេត",
+  identified: "បានរកឃើញ",
+  monitoring: "កំពុងតាមដាន",
+  resolved: "បានដោះស្រាយ",
+  scheduleIncidentManagement: "ការគ្រប់គ្រងកាលវិភាគ និងឧប្បត្តិហេតុ",
+  incidentName: "ឈ្មោះឧប្បត្តិហេតុ",
+  incidentStatus: "ស្ថានភាពឧប្បត្តិហេតុ",
+  highPriority: "អាទិភាពខ្ពស់",
+  configurationSettings: "ការកំណត់រចនាសម្ព័ន្ធ",
+  incidentCreatedSuccess: "ឧប្បត្តិហេតុត្រូវបានបង្កើតដោយជោគជ័យ",
+  basicInfo: "ព័ត៌មានមូលដ្ឋាន",
+  serviceId: "លេខសម្គាល់សេវាកម្ម",
+  assignedTo: "ចាត់តាំងទៅឱ្យ",
+  unassigned: "មិនបានចាត់តាំង",
+  timeline: "កាលវិភាគ",
+  incidentTime: "ពេលមានឧប្បត្តិហេតុ",
+  resolutionTime: "ពេលវេលាដោះស្រាយ",
+  systems: "ប្រព័ន្ធ",
+  noSystems: "គ្មានប្រព័ន្ធរងផលប៉ះពាល់",
+  impactAnalysis: "ការវិភាគផលប៉ះពាល់",
+  rootCause: "មូលហេតុចម្បង",
+  resolutionSteps: "ជំហានដោះស្រាយ",
+  lessonsLearned: "មេរៀនដែលបានរៀន",
+  resolutionDetails: "ព័ត៌មានលម្អិតនៃដំណោះស្រាយ",
+  assignment: "ការចាត់តាំង",
+  download: "ទាញយក",
+  downloadPdf: "ទាញយកជា PDF",
+  print: "បោះពុម្ព",
+  confidentialNote: "ឯកសារនេះជាការសម្ងាត់និងសម្រាប់ការប្រើប្រាស់ផ្ទៃក្នុងតែប៉ុណ្ណោះ។",
+  generatedOn: "បង្កើតនៅថ្ងៃទី",
+  enterResolutionSteps: "បញ្ចូលជំហានដែលបានធ្វើដើម្បីដោះស្រាយឧប្បត្តិហេតុ",
+  enterLessonsLearned: "បញ្ចូលមេរៀនដែលបានរៀនពីឧប្បត្តិហេតុនេះ",
+  editIncident: "កែសម្រួលឧប្បត្តិហេតុ",
+  editIncidentDesc: "ធ្វើបច្ចុប្បន្នភាពព័ត៌មានលម្អិតសម្រាប់ឧប្បត្តិហេតុនេះ",
+  updating: "កំពុងធ្វើបច្ចុប្បន្នភាព...",
+  update: "ធ្វើបច្ចុប្បន្នភាព",
+  create: "បង្កើត",
+  creating: "កំពុងបង្កើត...",
+  configuration: "ការកំណត់រចនាសម្ព័ន្ធ",
+  failedToUpdateStatus: "បរាជ័យក្នុងការធ្វើបច្ចុប្បន្នភាពស្ថានភាព",
+  inProgress: "កំពុងដំណើរការ",
+  enterRootCause: 'បញ្ចូលហេតុផលដើម',
+  enterIncidentTitle: "បញ្ចូលចំណងជើងឧបទ្ទវហេតុ",
+  enterIncidentDescription: "បញ្ចូលការពិពណ៌នាអំពីឧបទ្ទវហេតុ",
+  enterServiceId: "បញ្ចូលលេខសម្គាល់សេវាកម្ម ដោយបំបែកដោយសញ្ញាក្បៀស",
+  selectAssignedUser: "ជ្រើសរើសអ្នកប្រើប្រាស់ដែលត្រូវបានចាត់តាំង",
+  noAssignedUser: "ឧបទ្ទវហេតុបច្ចុប្បន្នមិនត្រូវបានចាត់តាំងទៅអ្នកប្រើប្រាស់ណាមួយទេ",
+  affectedSystems: "ប្រព័ន្ធដែលរងផលប៉ះពាល់",
+  enterAffectedSystems: "បញ្ចូលប្រព័ន្ធដែលរងផលប៉ះពាល់",
+  separateSystemsWithComma: "បញ្ចូលប្រព័ន្ធដែលរងផលប៉ះពាល់ ដោយបំបែកដោយសញ្ញាក្បៀស",
+  createIncidentDesc: "បង្កើតឧបទ្ទវហេតុថ្មី"
+};
diff --git a/application/src/translations/km/index.ts b/application/src/translations/km/index.ts
new file mode 100644
index 0000000..61133bd
--- /dev/null
+++ b/application/src/translations/km/index.ts
@@ -0,0 +1,36 @@
+
+import { Translations } from '../types';
+import { commonTranslations } from './common';
+import { menuTranslations } from './menu';
+import { loginTranslations } from './login';
+import { aboutTranslations } from './about';
+import { servicesTranslations } from './services';
+import { maintenanceTranslations } from './maintenance';
+import { incidentTranslations } from './incident';
+import { sslTranslations } from './ssl';
+import { settingsTranslations } from './settings';
+import { instanceTranslations } from './instance';
+import { operationTranslations } from './operation';
+import { regionTranslations } from './region';
+import { dockerTranslations } from './docker';
+import { publicTranslations } from './public';
+
+const enTranslations: Translations = {
+  common: commonTranslations,
+  menu: menuTranslations,
+  login: loginTranslations,
+  about: aboutTranslations,
+  services: servicesTranslations,
+  maintenance: maintenanceTranslations,
+  incident: incidentTranslations,
+  ssl: sslTranslations,
+  settings: settingsTranslations,
+  instance: instanceTranslations,
+  operation: operationTranslations,
+  region: regionTranslations,
+  docker: dockerTranslations,
+  public: publicTranslations
+  
+};
+
+export default enTranslations;
\ No newline at end of file
diff --git a/application/src/translations/km/instance.ts b/application/src/translations/km/instance.ts
new file mode 100644
index 0000000..29d57f4
--- /dev/null
+++ b/application/src/translations/km/instance.ts
@@ -0,0 +1,165 @@
+
+import { InstanceTranslations } from '../types/instance';
+
+export const instanceTranslations: InstanceTranslations = {
+
+  // InstanceMonitoring.tsx
+  instanceMonitoring: "ការត្រួតពិនិត្យឧទាហរណ៍",
+  describeMonitorInstance: "ត្រួតពិនិត្យនិងគ្រប់គ្រងឧទាហរណ៍ម៉ាស៊ីនមេរបស់អ្នកក្នុងពេលជាក់ស្តែង",
+  addServerAgent: "បន្ថែមភ្នាក់ងារម៉ាស៊ីនមេ",
+  errorLoadingServers: "កំហុសក្នុងការផ្ទុកម៉ាស៊ីនមេ",
+  unableToFetchServerData: "មិនអាចទាញយកទិន្នន័យម៉ាស៊ីនមេបានទេ។ សូមពិនិត្យការតភ្ជាប់របស់អ្នក ហើយព្យាយាមម្តងទៀត។",
+  retry: "ព្យាយាមម្តងទៀត",
+
+  // ServerTable.tsx
+  servers: "ម៉ាស៊ីនមេ",
+  loadingServers: "កំពុងផ្ទុកម៉ាស៊ីនមេ...",
+  searchServersPlaceholder: "ស្វែងរកម៉ាស៊ីនមេ...",
+  noServersFound: "រកមិនឃើញម៉ាស៊ីនមេ",
+  name: "ឈ្មោះ",
+  status: "ស្ថានភាព",
+  OS: "ប្រព័ន្ធប្រតិបត្តិការ",
+  IPAddress: "អាសយដ្ឋាន IP",
+  CPU: "ស៊ីភីយូ",
+  memory: "អង្គចងចាំ",
+  disk: "ថាស",
+  uptime: "ពេលវេលាដំណើរការ",
+  lastChecked: "បានពិនិត្យចុងក្រោយ",
+  actions: "សកម្មភាព",
+  viewServerDetail: "មើលព័ត៌មានលម្អិតម៉ាស៊ីនមេ",
+  containerMonitoring: "ការត្រួតពិនិត្យ Container",
+  resumeMonitoring: "បន្តការត្រួតពិនិត្យ",
+  pauseMonitoring: "ផ្អាកការត្រួតពិនិត្យ",
+  editServer: "កែសម្រួលម៉ាស៊ីនមេ",
+  deleteServer: "លុបម៉ាស៊ីនមេ",
+  deleteServerConfirmTitle: "តើអ្នកប្រាកដថាចង់លុបម៉ាស៊ីនមេនេះទេ?",
+  deleteServerConfirmDesc: "សកម្មភាពនេះមិនអាចត្រឡប់វិញបានទេ។ វានឹងលុប {name} និងទិន្នន័យត្រួតពិនិត្យទាំងអស់របស់វាជាអចិន្ត្រៃយ៍។",
+  cancel: "បោះបង់",
+  deleting: "កំពុងលុប...",
+  delete: "លុប",
+  serverDeleted: "ម៉ាស៊ីនមេត្រូវបានលុប",
+  serverDeletedDesc: "{name} ត្រូវបានលុបដោយជោគជ័យ។",
+  error: "កំហុស",
+  deleteServerError: "បរាជ័យក្នុងការលុបម៉ាស៊ីនមេ។ សូមព្យាយាមម្តងទៀត។",
+  serverPaused: "ម៉ាស៊ីនមេត្រូវបានផ្អាក",
+  serverResumed: "ម៉ាស៊ីនមេត្រូវបានបន្ត",
+  monitoringPaused: "ការត្រួតពិនិត្យត្រូវបានផ្អាកសម្រាប់ {name}",
+  monitoringResumed: "ការត្រួតពិនិត្យត្រូវបានបន្តសម្រាប់ {name}",
+  pauseServerError: "បរាជ័យក្នុងការផ្អាកការត្រួតពិនិត្យម៉ាស៊ីនមេ។ សូមព្យាយាមម្តងទៀត។",
+  resumeServerError: "បរាជ័យក្នុងការបន្តការត្រួតពិនិត្យម៉ាស៊ីនមេ�। សូមព្យាយាមម្តងទៀត។",
+
+  // ServerStatsCards.tsx 
+  totalServers: "ម៉ាស៊ីនមេសរុប",
+  onlineServers: "ម៉ាស៊ីនមេដំណើរការ",
+  offlineServers: "ម៉ាស៊ីនមេផ្អាកដំណើរការ",
+  warningServers: "ម៉ាស៊ីនមេដែលមានការព្រមាន",
+
+  // AddServerAgentDialog.tsx
+  addServerMonitoringAgent: "បន្ថែមភ្នាក់ងារត្រួតពិនិត្យម៉ាស៊ីនមេ",
+  configureAgentDesc: "កំណត់រចនាសម្ព័ន្ធភ្នាក់ងារត្រួតពិនិត្យម៉ាស៊ីនមេថ្មីដើម្បីតាមដានម៉ែត្រប្រព័ន្ធ និងប្រសិទ្ធភាព។",
+  configureAgent: "កំណត់រចនាសម្ព័ន្ធភ្នាក់ងារ",
+  oneClickInstall: "ការដំឡើងតែមួយចុច",
+  dockerOneClick: "Docker ការដំឡើងតែមួយចុច",
+  manualInstallation: "ការដំឡើងដោយដៃ",
+  validationError: "កំហុសក្នុងការផ្ទៀងផ្ទាត់",
+  fillRequiredFields: "សូមបំពេញចន្លោះទាំងអស់ដែលតម្រូវឱ្យមាន។",
+  serverAgentCreated: "ភ្នាក់ងារម៉ាស៊ីនមេត្រូវបានបង្កើត",
+  serverAgentCreatedDesc: "ភ្នាក់ងារត្រួតពិនិត្យ {name} ត្រូវបានកំណត់រចនាសម្ព័ន្ធដោយជោគជ័យ។",
+  failedToCreateAgent: "បរាជ័យក្នុងការបង្កើតភ្នាក់ងារត្រួតពិនិត្យម៉ាស៊ីនមេ។",
+
+  // ServerAgentConfigForm.tsx
+serverName: "ឈ្មោះម៉ាស៊ីនមេ",
+serverNamePlaceholder: "ឧ. web-server-01",
+serverNameDesc: "ឈ្មោះ ឬស្លាកដែលប្រើជាអត្តសញ្ញាណ",
+serverAgentId: "លេខសម្គាល់ភ្នាក់ងារម៉ាស៊ីនមេ",
+serverAgentIdDesc: "លេខសម្គាល់តែមួយគត់ដែលបង្កើតដោយស្វ័យប្រវត្តិ",
+operatingSystem: "ប្រព័ន្ធប្រតិបត្តិការ",
+checkInterval: "ចន្លោះពេលពិនិត្យ",
+selectInterval: "ជ្រើសរើសចន្លោះពេល",
+interval30s: "៣០ វិនាទី",
+interval1m: "១ នាទី",
+interval2m: "២ នាទី",
+interval5m: "៥ នាទី",
+checkIntervalDesc: "ភាពញឹកញាប់នៃការពិនិត្យស្ថានភាពម៉ាស៊ីនមេ និងម៉ែត្រ",
+retryAttempts: "ការព្យាយាមឡើងវិញ",
+selectRetryAttempts: "ជ្រើសរើសចំនួនការព្យាយាមឡើងវិញ",
+attempt1: "១ ការព្យាយាម",
+attempt2: "២ ការព្យាយាម",
+attempt3: "៣ ការព្យាយាម",
+attempt5: "៥ ការព្យាយាម",
+retryAttemptsDesc: "ចំនួនការព្យាយាមឡើងវិញមុនពេលសម្គាល់ថាដាច់",
+serverToken: "សញ្ញាសម្ងាត់ម៉ាស៊ីនមេ",
+serverTokenDesc: "សញ្ញាសម្ងាត់ផ្ទៀងផ្ទាត់ដែលបង្កើតដោយស្វ័យប្រវត្តិ",
+systemUrl: "URL ប្រព័ន្ធ",
+systemUrlDesc: "URL API ប្រព័ន្ធបច្ចុប្បន្ន",
+creatingAgent: "កំពុងបង្កើតភ្នាក់ងារ...",
+createServerAgent: "បង្កើតភ្នាក់ងារម៉ាស៊ីនមេ",
+
+  // EditServerDialog.tsx
+  editServerConfiguration: "កែសម្រួលការកំណត់រចនាសម្ព័ន្ធម៉ាស៊ីនមេ",
+  serverNameLabel: "ឈ្មោះម៉ាស៊ីនមេ *",
+  enterServerNamePlaceholder: "បញ្ចូលឈ្មោះម៉ាស៊ីនមេ",
+  checkIntervalLabel: "ចន្លោះពេលពិនិត្យ",
+  // selectInterval: "ជ្រើសរើសចន្លោះពេល",
+  interval10m: "១០ នាទី",
+  maxRetriesLabel: "ការព្យាយាមឡើងវិញអតិបរិមា",
+  selectMaxRetries: "ជ្រើសរើសការព្យាយាមអតិបរិមា",
+  retry1: "១ ដង",
+  retry2: "២ ដង",
+  retry3: "៣ ដង",
+  retry5: "៥ ដង",
+  retry10: "១០ ដង",
+  dockerMonitoring: "ការត្រួតពិនិត្យ Docker",
+  enabled: "បានបើក",
+  disabled: "បានបិទ",
+  enableNotifications: "បើកការជូនដំណឹង",
+  notificationSettings: "ការកំណត់ការជូនដំណឹង",
+  notificationChannels: "ឆានែលការជូនដំណឹង",
+  loadingChannels: "កំពុងផ្ទុកឆានែល...",
+  noChannelsAvailable: "មិនមានឆានែលការជូនដំណឹង",
+  selectedChannels: "ឆានែលដែលបានជ្រើស:",
+  serverSetThreshold: "កំណត់កម្រិតម៉ាស៊ីនមេ",
+  loadingThresholds: "កំពុងផ្ទុកកម្រិត...",
+  selectServerThreshold: "ជ្រើសរើសកម្រិតម៉ាស៊ីនមេ",
+  noThreshold: "គ្មានកម្រិត (ប្រើលំនាំដើម)",
+  thresholdDetails: "ព័ត៌មានលម្អិតអំពីកម្រិត",
+  cpuThresholdPct: "កម្រិត CPU (%)",
+  ramThresholdPct: "កម្រិត RAM (%)",
+  diskThresholdPct: "កម្រិតថាស (%)",
+  networkThresholdPct: "កម្រិតបណ្តាញ (%)",
+  serverTemplate: "គម្រូម៉ាស៊ីនមេ",
+  loadingTemplates: "កំពុងផ្ទុកគម្រូ...",
+  selectServerTemplate: "ជ្រើសរើសគម្រូម៉ាស៊ីនមេ",
+  noTemplate: "គ្មានគម្រូ (ប្រើលំនាំដើម)",
+  templateDetails: "ព័ត៌មានលម្អិតអំពីគម្រូ",
+  ramMessage: "សារ RAM",
+  cpuMessage: "សារ CPU",
+  diskMessage: "សារ ថាស",
+  networkMessage: "សារ បណ្តាញ",
+  upMessage: "សារដំណើរការ",
+  downMessage: "សារផ្អាក",
+  noMessageDefined: "គ្មានសារសម្រាប់ {name}",
+  serverUpdated: "បានធ្វើបច្ចុប្បន្នភាពម៉ាស៊ីនមេ",
+  serverUpdatedDesc: "{name} ត្រូវបានធ្វើបច្ចុប្បន្នភាពដោយជោគជ័យ។",
+  updating: "កំពុងធ្វើបច្ចុប្បន្នភាព...",
+  updateServer: "ធ្វើបច្ចុប្បន្នភាពម៉ាស៊ីនមេ",
+  failedToLoadChannels: "បានបរាជ័យក្នុងការផ្ទុកឆានែលការជូនដំណឹង",
+  failedToLoadTemplates: "បានបរាជ័យក្នុងការផ្ទុកគម្រូ",
+  failedToLoadThresholds: "បានបរាជ័យក្នុងការផ្ទុកកម្រិតម៉ាស៊ីនមេ",
+  warning: "ការព្រមាន",
+  serverUpdatedButThresholdFailed: "ម៉ាស៊ីនមេត្រូវបានធ្វើបច្ចុប្បន្នភាព ប៉ុន្តែបរាជ័យក្នុងការធ្វើបច្ចុប្បន្នភាពតម្លៃកម្រិត។",
+  failedToUpdateServer: "បរាជ័យក្នុងការធ្វើបច្ចុប្បន្នភាពម៉ាស៊ីនមេ។ សូមព្យាយាមម្តងទៀត।",
+
+  // ServerDetail.tsx
+  historicalPerformance: "សម្ដែងប្រវត្តិប្រតិបត្តិការ",
+  loading: "កំពុងផ្ទុក...",
+  errorLoadingChartData: "មានបញ្ហាក្នុងការផ្ទុកទិន្នន័យតារាង",
+  noHistoricalData: "មិនមានទិន្នន័យចាស់សម្រាប់ {{timeRange}}",
+  rawMetricsCount: "ចំនួនមេត្រដើម៖ {{count}}",
+  serverIdTimeRange: "លេខសម្គាល់ម៉ាស៊ីនបម្រើ៖ {{serverId}} • ជួរពេលវេលា៖ {{timeRange}}",
+  dataExistsOutsideRange: "ទិន្នន័យមាន ប៉ុន្តែអាចនៅខាងក្រៅជួរពេលវេលាដែលបានជ្រើស",
+  noMetricsDataFound: "រកមិនឃើញទិន្នន័យមេត្រទេ",
+  dataPointsTimeRange: "{{count}} ចំណុចទិន្នន័យ • {{timeRange}}",
+  // updating: "កំពុងធ្វើបច្ចុប្បន្នភាព...",
+
+};
diff --git a/application/src/translations/km/login.ts b/application/src/translations/km/login.ts
new file mode 100644
index 0000000..1b8fea2
--- /dev/null
+++ b/application/src/translations/km/login.ts
@@ -0,0 +1,24 @@
+
+import { LoginTranslations } from '../types/login';
+
+export const loginTranslations: LoginTranslations = {
+  signInToYourAccount: "ចូលគណនីរបស់អ្នក",
+  dontHaveAccount: "មិនមានគណនីមែនទេ?",
+  createOne: "បង្កើតមួយ",
+  signInWithGoogle: "ចូលជាមួយ Google",
+  orContinueWith: "ឬ",
+  email: "អ៊ីមែល",
+  password: "ពាក្យសម្ងាត់",
+  forgot: "ភ្លេច?",
+  signIn: "ចូល",
+  signingIn: "កំពុងចូល...",
+  loginSuccessful: "ការចូលបានជោគជ័យ",
+  loginSuccessMessage: "អ្នកបានចូលប្រើដោយជោគជ័យ។",
+  loginFailed: "ការចូលបានបរាជ័យ",
+  authenticationFailed: "ការផ្ទៀងផ្ទាត់បានបរាជ័យ",
+  invalidCredentials: "អ៊ីមែល ឬពាក្យសម្ងាត់មិនត្រឹមត្រូវ",
+  bySigningIn: "ដោយការចូល អ្នកយល់ព្រមនឹង",
+  termsAndConditions: "លក្ខខណ្ឌ",
+  and: "និង",
+  privacyPolicy: "គោលនយោបាយឯកជនភាព",
+};
diff --git a/application/src/translations/km/maintenance.ts b/application/src/translations/km/maintenance.ts
new file mode 100644
index 0000000..127855a
--- /dev/null
+++ b/application/src/translations/km/maintenance.ts
@@ -0,0 +1,89 @@
+
+import { MaintenanceTranslations } from '../types/maintenance';
+
+export const maintenanceTranslations: MaintenanceTranslations = {
+  scheduledMaintenance: "ការថែទាំដែលបានកំណត់ពេល",
+  scheduledMaintenanceDesc: "មើល និងគ្រប់គ្រងកាលវិភាគថែទាំសម្រាប់ប្រព័ន្ធនិងសេវាកម្មរបស់អ្នក",
+  upcomingMaintenance: "ជិតមកដល់",
+  ongoingMaintenance: "កំពុងដំណើរការ",
+  completedMaintenance: "បានបញ្ចប់",
+  createMaintenanceWindow: "បង្កើតកាលវិភាគថែទាំ",
+  totalScheduledHours: "ចំនួនម៉ោងកំណត់សរុប",
+  maintenanceName: "ឈ្មោះកាលវិភាគថែទាំ",
+  maintenanceStatus: "ស្ថានភាព",
+  scheduledStart: "ពេលចាប់ផ្តើមដែលបានកំណត់",
+  scheduledEnd: "ពេលបញ្ចប់ដែលបានកំណត់",
+  affectedServices: "សេវាកម្មរងផលប៉ះពាល់",
+  impact: "ផលប៉ះពាល់",
+  minor: "តិចតួច",
+  major: "សំខាន់",
+  critical: "សំខាន់ខ្លាំង",
+  none: "គ្មាន",
+  actions: "សកម្មភាព",
+  scheduled: "បានកំណត់ពេល",
+  inprogress: "កំពុងដំណើរការ",
+  completed: "បានបញ្ចប់",
+  cancelled: "បានបោះបង់",
+  markAsInProgress: "សម្គាល់ថាកំពុងដំណើរការ",
+  markAsCompleted: "សម្គាល់ថាបានបញ្ចប់",
+  markAsCancelled: "សម្គាល់ថាបានបោះបង់",
+  confirmDelete: "បញ្ជាក់ការលុប",
+  deleteMaintenanceConfirmation: "តើអ្នកប្រាកដថាចង់លុបកាលវិភាគថែទាំនេះមែនទេ?",
+  thisActionCannotBeUndone: "សកម្មភាពនេះមិនអាចត្រឡប់ក្រោយវិញបានទេ។",
+  maintenanceDeleted: "លុបកាលវិភាគថែទាំ",
+  maintenanceDeletedDesc: "កាលវិភាគថែទាំត្រូវបានលុបដោយជោគជ័យ។",
+  errorDeletingMaintenance: "មានបញ្ហាក្នុងការលុបកាលវិភាគថែទាំ។",
+  statusUpdated: "បានធ្វើបច្ចុប្បន្នភាពស្ថានភាព",
+  maintenanceStatusUpdated: "ស្ថានភាពការថែទាំត្រូវបានធ្វើបច្ចុប្បន្នភាពដោយជោគជ័យ។",
+  errorUpdatingMaintenanceStatus: "មានកំហុសក្នុងការធ្វើបច្ចុប្បន្នភាពស្ថានភាពការថែទាំ។",
+  createMaintenance: "បង្កើតកាលវិភាគថែទាំ",
+  createMaintenanceDesc: "កំណត់ពេលវេលាថែទាំថ្មីសម្រាប់សេវាកម្មរបស់អ្នក",
+  enterTitle: "បញ្ចូលចំណងជើងកាលវិភាគថែទាំ",
+  enterDescription: "បញ្ចូលការពិពណ៌នាលម្អិតអំពីការថែទាំ",
+  startTime: "ពេលចាប់ផ្តើម",
+  endTime: "ពេលបញ្ចប់",
+  selectDate: "ជ្រើសរើសកាលបរិច្ឆេទ",
+  enterAffectedServices: "បញ្ចូលសេវាកម្មរងផលប៉ះពាល់",
+  separateServicesWithComma: "បំបែកសេវាកម្មច្រើនដោយសញ្ញាក្បៀស",
+  priority: "អាទិភាព",
+  selectPriority: "ជ្រើសរើសអាទិភាព",
+  selectStatus: "ជ្រើសរើសស្ថានភាព",
+  selectImpact: "ជ្រើសរើសផលប៉ះពាល់",
+  notifySubscribers: "ជូនដំណឹងដល់អ្នកជាវ",
+  notifySubscribersDesc: "ផ្ញើការជូនដំណឹងទៅអ្នកជាវទាំងអស់នៅពេលការថែទាំនេះចាប់ផ្តើម",
+  maintenanceCreated: "បានបង្កើតកាលវិភាគថែទាំ",
+  maintenanceCreatedDesc: "កាលវិភាគថែទាំត្រូវបានកំណត់ពេលដោយជោគជ័យ។",
+  errorCreatingMaintenance: "មានបញ្ហាក្នុងការបង្កើតកាលវិភាគថែទាំ។",
+  errorFetchingMaintenanceData: "មានបញ្ហាក្នុងការទាញយកទិន្នន័យកាលវិភាគថែទាំ។",
+  low: "ទាប",
+  medium: "មធ្យម",
+  high: "ខ្ពស់",
+  created: "បានបង្កើត",
+  lastUpdated: "ធ្វើបច្ចុប្បន្នភាពចុងក្រោយ",
+  subscribersWillBeNotified: "អ្នកជាវនឹងត្រូវបានជូនដំណឹងនៅពេលការថែទាំចាប់ផ្តើម",
+  noNotifications: "នឹងមិនមានការផ្ញើការជូនដំណឹងទេ",
+  noScheduledMaintenance: "មិនមានកាលវិភាគថែទាំទេ",
+  noMaintenanceWindows: "មិនមានកាលវិភាគថែទាំសម្រាប់រយៈពេលនេះទេ។ បង្កើតមួយដោយចុចប៊ូតុង \"បង្កើតកាលវិភាគថែទាំ\"។",
+  maintenanceCreatedSuccess: "កាលវិភាគថែទាំត្រូវបានបង្កើតដោយជោគជ័យ",
+  editMaintenanceWindow: "កែសម្រួលការថែទាំ",
+  editMaintenanceDesc: "កែសម្រួលព័ត៌មានលម្អិតនៃការថែទាំ",
+  priorityDescription: "ជ្រើសរើសអាទិភាពនៃការថែទាំ",
+  statusDescription: "ជ្រើសរើសស្ថានភាពនៃការថែទាំ",
+  impactLevel: "កម្រិតផលប៉ះពាល់",
+  impactLevelDescription: "ជ្រើសរើសកម្រិតផលប៉ះពាល់",
+  selectAssignedUsers: "ជ្រើសរើសអ្នកប្រើប្រាស់ដែលត្រូវបានចាត់តាំង",
+  assignedPersonnelDescription: "អ្នកប្រើប្រាស់ដែលត្រូវបានចាត់តាំងបច្ចុប្បន្ន",
+  mutedNotifications: "ការជូនដំណឹងត្រូវបានបិទ",
+  notificationsAreMuted: "ការជូនដំណឹងបច្ចុប្បន្នត្រូវបានបិទសម្រាប់ការថែទាំនេះ",
+  selectNotificationChannel: "បន្ថែមបណ្តាញជូនដំណឹង",
+  enableNotificationsFirst: "សូមបើកការជូនដំណឹងជាមុនសិន ដើម្បីជ្រើសរើសបណ្តាញ",
+  updateMaintenance: "ធ្វើបច្ចុប្បន្នភាពការថែទាំ",
+  loginToViewProfile: "សូមចូលគណនីដើម្បីមើលប្រវត្តិរូបរបស់អ្នក",
+  goToLogin: "ចូលគណនី",
+  loadingUserData: "កំពុងផ្ទុកទិន្នន័យអ្នកប្រើប្រាស់...",
+  retry: "ព្យាយាមម្តងទៀត",
+  loadingServerData: "កំពុងផ្ទុកទិន្នន័យម៉ាស៊ីនមេ...",
+  retrievingYourInformation: "សូមរង់ចាំខណៈពេលយើងទាញយកព័ត៌មានរបស់អ្នក...",
+  servicesPagination: "សេវាកម្ម {startItem}-{endItem} នៃ {totalItems} សេវាកម្ម",
+  servicesPaginationNoService: "គ្មានសេវាកម្ម",
+};
diff --git a/application/src/translations/km/menu.ts b/application/src/translations/km/menu.ts
new file mode 100644
index 0000000..36d47dd
--- /dev/null
+++ b/application/src/translations/km/menu.ts
@@ -0,0 +1,21 @@
+
+import { MenuTranslations } from '../types/menu';
+
+export const menuTranslations: MenuTranslations = {
+  uptimeMonitoring: "ត្រួតពិនិត្យ Uptime",
+  instanceMonitoring: "ត្រួតពិនិត្យម៉ាស៊ីនមេ",
+  sslDomain: "SSL និងដូមែន",
+  scheduleIncident: "កាលវិភាគនិងឧបទ្ទវហេតុ",
+  operationalPage: "ទំព័រប្រតិបត្តិការ",
+  reports: "របាយការណ៍",
+  regionalMonitoring: "ត្រួតពិនិត្យតំបន់",
+  settingPanel: "ផ្ទាំងការកំណត់",
+  generalSettings: "ការកំណត់ទូទៅ",
+  userManagement: "ការគ្រប់គ្រងអ្នកប្រើប្រាស់",
+  notificationSettings: "ការកំណត់ការជូនដំណឹង",
+  alertsTemplates: "គំរូការជូនដំណឹង",
+  rolesManagement: "ការគ្រប់គ្រងតួនាទី",
+  dataRetention: "ការរក្សាទុកទិន្នន័យ",
+  backupSettings: "ការកំណត់បម្រុងទុក",
+  aboutSystem: "អំពីប្រព័ន្ធ",
+};
\ No newline at end of file
diff --git a/application/src/translations/km/operation.ts b/application/src/translations/km/operation.ts
new file mode 100644
index 0000000..d255d06
--- /dev/null
+++ b/application/src/translations/km/operation.ts
@@ -0,0 +1,86 @@
+
+import { OperationTranslations } from '../types/operation';
+
+export const operationTranslations: OperationTranslations = {
+  // OperationalPageContent.tsx
+	failedToLoadOperationalPages: "បរាជ័យក្នុងការផ្ទុកទំព័រប្រតិបត្តិការ",
+	loadingoperationalPages: "មានបញ្ហាក្នុងការផ្ទុកទំព័រប្រតិបត្តិការរបស់អ្នក។ សូមព្យាយាមម្តងទៀត។",
+	tryagain: "ព្យាយាមម្តងទៀត",
+	operationalPages: "ទំព័រប្រតិបត្តិការ",
+  describeOperation: "គ្រប់គ្រងទំព័រស្ថានភាពសាធារណៈរបស់អ្នក និងត្រួតពិនិត្យសុខភាពសេវាកម្ម",
+	refresh: "ធ្វើបច្ចុប្បន្នភាព",
+	noOperationalPagesFound: "រកមិនឃើញទំព័រប្រតិបត្តិការទេ",
+	createYourFirstOperationalPage: "បង្កើតទំព័រប្រតិបត្តិការដំបូងរបស់អ្នក ដើម្បីចាប់ផ្តើមត្រួតពិនិត្យសេវាកម្មរបស់អ្នក និងប្រាស្រ័យទាក់ទងស្ថានភាពទៅកាន់អ្នកប្រើប្រាស់។",
+	totalPages: "ទំព័រសរុប",
+	publicPages: "ទំព័រសាធារណៈ",
+	operational: "ប្រតិបត្តិការ",
+	deleteOperationalPage: "លុបទំព័រប្រតិបត្តិការ",
+	deleteOperationalPageConfirm: 'តើអ្នកប្រាកដថាចង់លុប "{title}" ឬ? សកម្មភាពនេះមិនអាចត្រឡប់វិញបានទេ ហើយនឹងលុបទំព័រប្រតិបត្តិការ និងសមាសធាតុទាំងអស់របស់វាជាអចិន្ត្រៃយ៍។',
+	cancel: "បោះបង់",
+  delete: "លុប",
+  deleting: "កំពុងលុប...",
+  
+  // EditOperationalPageDialog.tsx
+  editOperationalPage: "កែសម្រួលទំព័រប្រតិបត្តិការ",
+  updateYourOperationalPage: "ធ្វើបច្ចុប្បន្នភាពការកំណត់ទំព័រស្ថានភាពប្រតិបត្តិការរបស់អ្នក និងគ្រប់គ្រងសមាសធាតុ។",
+  title: "ចំណងជើង",
+  myServiceStatusPlaceholder: "ស្ថានភាពសេវាកម្មរបស់ខ្ញុំ",
+  slug: "ចំនងជើង URL",
+  myServiceStatusSlugPlaceholder: "ស្ថានភាពសេវាកម្មរបស់ខ្ញុំ",
+  description: "ការពិពណ៌នា",
+  operationalPageDescriptionPlaceholder: "ការពិពណ៌នាខ្លីអំពីទំព័រប្រតិបត្តិការ​របស់អ្នក",
+  theme: "ផ្ទៃខាងក្រោយ",
+  selectTheme: "ជ្រើសរើសផ្ទៃខាងក្រោយ",
+  themeDefault: "លំនាំដើម",
+  themeDark: "ងងឹត",
+  themeLight: "ភ្លឺ",
+  status: "ស្ថានភាព",
+  selectStatus: "ជ្រើសរើសស្ថានភាព",
+  statusOperational: "ប្រតិបត្តិការ",
+  statusDegraded: "ការសមត្ថភាពធ្លាក់ចុះ",
+  statusMaintenance: "នៅក្រោមការថែទាំ",
+  statusMajorOutage: "ការបាត់បង់ធំ",
+  publicPage: "ទំព័រសាធារណៈ",
+  makePagePublic: "ធ្វើឱ្យទំព័រនេះអាចចូលដំណើរការបានសាធារណៈ",
+  customDomainOptional: "ដែនកំណត់ផ្ទាល់ខ្លួន (ជាជម្រើស)",
+  customDomainPlaceholder: "status.yourdomain.com",
+  customDomainDescription: "ដែនកំណត់ផ្ទាល់ខ្លួនសម្រាប់ទំព័រស្ថានភាពរបស់អ្នក",
+  cancelUpdate: "បោះបង់",
+  updating: "កំពុងធ្វើបច្ចុប្បន្នភាព...",
+  updatePage: "ធ្វើបច្ចុប្បន្នភាពទំព័រ",
+
+  // ComponentsSelector.tsx
+  statusPageComponents: "សមាសធាតុទំព័រស្ថានភាព",
+  addMonitoringComponentsDesc: "បន្ថែមសមាសធាតុត្រួតពិនិត្យដូចជាសេវាកម្មពេលវេលាដំណើរការ, វិញ្ញាបនបត្រ SSL, និងការតាមដានឧប្បត្តិហេតុ",
+  selectedComponents: "សមាសធាតុដែលបានជ្រើសរើស",
+  service: "សេវាកម្ម",
+  server: "ម៉ាស៊ីនមេ",
+  addComponent: "បន្ថែមសមាសធាតុ",
+  componentName: "ឈ្មោះសមាសធាតុ",
+  componentNamePlaceholder: "ឧ. គេហទំព័រមេ",
+  displayOrder: "លំដាប់បង្ហាញ",
+  descriptionOptional: "ការពិពណ៌នា (ស្រេចចិត្ត)",
+  descriptionPlaceholder: "ការពិពណ៌នាសង្ខេបអំពីសមាសធាតុនេះ",
+  uptimeServiceOptional: "សេវាកម្មពេលវេលាដំណើរការ (ស្រេចចិត្ត)",
+  selectUptimeService: "ជ្រើសរើសសេវាកម្មពេលវេលាដំណើរការ",
+  serverIdOptional: "លេខសម្គាល់ម៉ាស៊ីនមេ (ស្រេចចិត្ត)",
+  serverIdPlaceholder: "server_456",
+  cancelComponent: "បោះបង់",
+
+  // OperationalPageCard.tsx
+  public: "សាធារណៈ",
+  yes: "បាទ/ចាស",
+  no: "ទេ",
+  updated: "បានធ្វើបច្ចុប្បន្នភាព",
+  view: "មើល",
+  edit: "កែសម្រួល",
+
+  // CreateOperationalPageDialog.tsx
+  createOperationalPage: "បង្កើតទំព័រប្រតិបត្តិការ",
+  createOperationalPageDesc: "បង្កើតទំព័រស្ថានភាពប្រតិបត្តិការថ្មីដើម្បីត្រួតពិនិត្យសេវាកម្ម និងសមាសធាតុរបស់អ្នក។",
+  createPage: "បង្កើតទំព័រ",
+  creating: "កំពុងបង្កើត...",
+  initialStatus: "ស្ថានភាពដំបូង",
+
+
+};
diff --git a/application/src/translations/km/public.ts b/application/src/translations/km/public.ts
new file mode 100644
index 0000000..04a7c50
--- /dev/null
+++ b/application/src/translations/km/public.ts
@@ -0,0 +1,23 @@
+import { PublicTranslations } from '../types/public';
+
+export const publicTranslations: PublicTranslations = {
+  systemStatus: "ស្ថានភាពប្រព័ន្ធ",
+  allOperational: "ប្រព័ន្ធទាំងអស់ដំណើរការធម្មតា",
+  degradedPerformance: "ខ្លះៗកំពុងមានប្រសិទ្ធភាពធ្លាក់ចុះ",
+  underMaintenance: "ប្រព័ន្ធកំពុងថែទាំ",
+  majorOutage: "យើងកំពុងជួបការរាំងស្ទះធ្ងន់ធ្ងរ",
+  statusUnknown: "មិនស្គាល់ស្ថានភាព",
+  autoUpdatedByHealth: "ស្ថានភាពត្រូវបានធ្វើបច្ចុប្បន្នភាពដោយស្វ័យប្រវត្តិតាមសុខភាពសមាសភាគ",
+  lastUpdatedAt: "បានធ្វើបច្ចុប្បន្នភាពចុងក្រោយ: {time} UTC",
+  liveStatusMonitoring: "ការត្រួតពិនិត្យស្ថានភាពផ្ទាល់",
+
+  loadingStatusPage: "កំពុងផ្ទុកទំព័រស្ថានភាព",
+  fetchingRealtimeStatus: "កំពុងទាញយកស្ថានភាពប្រព័ន្ធពេលជាក់ស្តែង...",
+  slugLabel: "Slug",
+  statusPageNotFound: "រកមិនឃើញទំព័រស្ថានភាព",
+  notFoundDescription: "ទំព័រស្ថានភាពដែលបានស្នើរសុំមិនអាចរកឃើញ ឬមិនអាចចូលមើលជាសាធារណៈបាន។",
+  goBack: "ត្រឡប់ក្រោយ",
+  retry: "ព្យាយាមម្តងទៀត",
+};
+
+
diff --git a/application/src/translations/km/region.ts b/application/src/translations/km/region.ts
new file mode 100644
index 0000000..0161d21
--- /dev/null
+++ b/application/src/translations/km/region.ts
@@ -0,0 +1,95 @@
+
+import { RegionTranslations } from '../types/region';
+
+export const regionTranslations: RegionTranslations = {
+
+  //RegionalMonitoringContent.tsx
+  regionalmonitoring: "ត្រួតពិនិត្យតំបន់",
+  descriptRegionPage: "ត្រួតពិនិត្យហេដ្ឋារចនាសម្ព័ន្ធរបស់អ្នកពីតំបន់ជាច្រើនសម្រាប់ភាពជឿជាក់កាន់តែប្រសើរ។",
+  addRegionalAgent: "បន្ថែមភ្នាក់ងារតំបន់",
+  totalAgents: "ភ្នាក់ងារសរុប",
+  regionalMonitoringAgents: "ភ្នាក់ងារត្រួតពិនិត្យតំបន់",
+  onlineAgents: "ភ្នាក់ងារដំណើរការ",
+  currentlyConnected: "បច្ចុប្បន្នកំពុងភ្ជាប់",
+  offlineAgents: "ភ្នាក់ងារមិនដំណើរការ",
+  disconnectedAgents: "ភ្នាក់ងារដែលបានផ្តាច់",
+  regionalAgents: "ភ្នាក់ងារតំបន់",
+  noRegionalAgents: "គ្មានភ្នាក់ងារតំបន់",
+  getStartedAddAgent: "ចាប់ផ្តើមដោយបន្ថែមភ្នាក់ងារត្រួតពិនិត្យតំបន់ដំបូងរបស់អ្នក ដើម្បីពង្រីកការគ្របដណ្តប់ត្រួតពិនិត្យ។",
+  addFirstAgent: "បន្ថែមភ្នាក់ងារដំបូង",
+  agentRemoved: "ភ្នាក់ងារត្រូវបានដកចេញ",
+  agentRemovedDesc: "ភ្នាក់ងារត្រួតពិនិត្យតំបន់ត្រូវបានដកចេញ។",
+  regionalAgentAdded: "ភ្នាក់ងារតំបន់ត្រូវបានបន្ថែម",
+  regionalAgentAddedDesc: "ភ្នាក់ងារត្រួតពិនិត្យតំបន់ត្រូវបានកំណត់រចនាសម្ព័ន្ធដោយជោគជ័យ។",
+  error: "កំហុស",
+  failedToRemoveAgent: "បរាជ័យក្នុងការដកភ្នាក់ងារត្រួតពិនិត្យតំបន់។",
+
+  //AddRegionalAgentDialog.tsx
+  addRegionalMonitoringAgent: "បន្ថែមភ្នាក់ងារត្រួតពិនិត្យតំបន់",
+  deployRegionalMonitoringAgent: "ដាក់ពង្រាយភ្នាក់ងារត្រួតពិនិត្យតំបន់ជាមួយនឹងការដំឡើងតែមួយចុចដោយស្វ័យប្រវត្តិ",
+  regionName: "ឈ្មោះតំបន់",
+  regionNamePlaceholder: "ឧ. us-east-1, europe-west-1, asia-pacific-1",
+  agentServerIpAddress: "អាសយដ្ឋាន IP របស់ម៉ាស៊ីនមេភ្នាក់ងារ",
+  agentIpPlaceholder: "ឧ. 192.168.1.100 ឬ your-server.example.com",
+  cancel: "បោះបង់",
+  generateInstallation: "បង្កើតការដំឡើង",
+  generating: "កំពុងបង្កើត...",
+  agentConfigurationReady: "ការកំណត់រចនាសម្ព័ន្ធភ្នាក់ងាររួចរាល់!",
+  oneClickInstallScriptGenerated: "ស្គ្រីបដំឡើងតែមួយចុចត្រូវបានបង្កើតជាមួយនឹងការកំណត់រចនាសម្ព័ន្ធដោយស្វ័យប្រវត្តិ",
+  oneClickInstallTab: "ការដំឡើងតែមួយចុច",
+  agentDetailsTab: "ព័ត៌មានលម្អិតភ្នាក់ងារ",
+  manualInstallTab: "ការដំឡើងដោយដៃ",
+  oneClickAutomaticInstallation: "ការដំឡើងដោយស្វ័យប្រវត្តិតែមួយចុច",
+  completeInstallationDescription: "បញ្ចប់ការដំឡើង ការកំណត់រចនាសម្ព័ន្ធ និងការចាប់ផ្តើមសេវាកម្មក្នុងពាក្យបញ្ជាតែមួយ",
+  whatThisScriptDoes: "អ្វីដែលស្គ្រីបនេះធ្វើដោយស្វ័យប្រវត្តិ:",
+  scriptActionDownload: "ទាញយកកញ្ចប់ .deb ចុងក្រោយ",
+  scriptActionInstall: "ដំឡើងភ្នាក់ងារត្រួតពិនិត្យតំបន់",
+  scriptActionConfigure: "បង្កើតឯកសារកំណត់រចនាសម្ព័ន្ធជាមួយនឹងការកំណត់របស់អ្នក",
+  scriptActionStart: "ចាប់ផ្តើម និងបើកដំណើរការសេវាកម្ម",
+  scriptActionHealthChecks: "ដំណើរការការត្រួតពិនិត្យសុខភាព",
+  runCommandOnServer: "ដំណើរការពាក្យបញ្ជានេះនៅលើម៉ាស៊ីនមេគោលដៅរបស់អ្នក:",
+  downloadCompleteScript: "ទាញយកស្គ្រីបពេញលេញ",
+  copyFullScript: "ចម្លងស្គ្រីបពេញលេញ",
+  localDevelopmentNotice: "<strong>សេចក្តីជូនដំណឹងអំពីការអភិវឌ្ឍន៍មូលដ្ឋាន:</strong> ប្រសិនបើការចម្លងទៅក្តារកៅស៊ូបរាជ័យ នេះជារឿងធម្មតានៅក្នុងការអភិវឌ្ឍន៍មូលដ្ឋាន។ អ្នកអាចប្រើប៊ូតុង 'ទាញយកស្គ្រីបពេញលេញ' ជំនួស ឬចម្លងអត្ថបទដោយដៃ។",
+  generatedAgentConfiguration: "ការកំណត់រចនាសម្ព័ន្ធភ្នាក់ងារដែលបានបង្កើត",
+  autoConfiguredDuringInstallation: "តម្លៃទាំងនេះនឹងត្រូវបានកំណត់រចនាសម្ព័ន្ធដោយស្វ័យប្រវត្តិក្នុងអំឡុងពេលដំឡើង",
+  agentId: "លេខសម្គាល់ភ្នាក់ងារ",
+  regionNameDetail: "ឈ្មោះតំបន់",
+  serverIp: "អាសយដ្ឋាន IP ម៉ាស៊ីនមេ",
+  apiEndpoint: "ចំណុចបញ្ចប់ API",
+  authenticationToken: "សញ្ញាសម្ងាត់ផ្ទៀងផ្ទាត់",
+  configurationFileLocation: "<strong>ទីតាំងឯកសារកំណត់រចនាសម្ព័ន្ធ:</strong> /etc/regional-check-agent/regional-check-agent.env",
+  manualInstallationSteps: "ជំហានការដំឡើងដោយដៃ",
+  stepByStepManualInstallation: "ដំណើរការដំឡើងដោយដៃជាជំហានៗ",
+  step1DownloadPackage: "ជំហានទី១: ទាញយកកញ្ចប់",
+  downloadAmd64Notice: "✅ ប្រសិនបើអ្នកកំពុងប្រើស្ថាបត្យកម្ម amd64 សូមទាញយកកញ្ចប់នេះ។",
+  downloadArm64Notice: "✅ ប្រសិនបើអ្នកកំពុងប្រើស្ថាបត្យកម្ម arm64 សូមទាញយកកញ្ចប់នេះ�।",
+  step2InstallPackage: "ជំហានទី២: ដំឡើងកញ្ចប់",
+  step3ConfigureAgent: "ជំហានទី៣: កំណត់រចនាសម្ព័ន្ធភ្នាក់ងារ",
+  copySampleConfiguration: "ចម្លងការកំណត់រចនាសម្ព័ន្ធគំរូពី https://github.com/operacle/Distributed-Regional-Monitoring/blob/main/packaging/regional-check-agent.conf",
+  addConfigurationValues: "បន្ថែមតម្លៃកំណត់រចនាសម្ព័ន្ធដែលបង្ហាញនៅក្នុងផ្ទាំងព័ត៌មានលម្អិតភ្នាក់ងារ",
+  step4StartService: "ជំហានទី៤: ចាប់ផ្តើមសេវាកម្ម",
+  step5VerifyInstallation: "ជំហានទី៥: ផ្ទៀងផ្ទាត់ការដំឡើង",
+  addAnotherAgent: "បន្ថែមភ្នាក់ងារមួយទៀត",
+  completeSetup: "បញ្ចប់ការរៀបចំ",
+  copied: "បានចម្លង!",
+  copiedDescription: "{description} បានចម្លងទៅក្តារកៅស៊ូ។",
+  copyFailed: "ការចម្លងបរាជ័យ",
+  copyFailedDescription: "បរាជ័យក្នុងការចម្លងទៅក្តារកៅស៊ូ។",
+  copyFailedLocalhost: "នេះជារឿងធម្មតានៅក្នុងការអភិវឌ្ឍន៍មូលដ្ឋាន។ សូមចម្លងអត្ថបទដោយដៃ។",
+  copyFailedChrome: "សូមសាកល្បងប្រើ HTTPS ឬបើកសិទ្ធិចម្លងក្តារកៅស៊ូ។",
+  downloaded: "បានទាញយក!",
+  downloadedDescription: "ស្គ្រីបដំឡើងបានទាញយកដោយជោគជ័យ។",
+  failedToCreateAgent: "បរាជ័យក្នុងការបង្កើតការកំណត់រចនាសម្ព័ន្ធភ្នាក់ងារតំបន់។",
+
+  //RegionalAgentCard.tsx
+  defaultBadge: "លំនាំដើម",
+  copyAgentId: "ចម្លងលេខសម្គាល់ភ្នាក់ងារ",
+  removeAgent: "លុបភ្នាក់ងារ",
+  online: "ដំណើរការ",
+  offline: "មិនដំណើរការ",
+  lastUpdated: "ធ្វើបច្ចុប្បន្នភាពចុងក្រោយ:",
+  activeMonitoring: "ការត្រួតពិនិត្យសកម្ម",
+  connectionLost: "បាត់បង់ការតភ្ជាប់",
+  
+};
\ No newline at end of file
diff --git a/application/src/translations/km/services.ts b/application/src/translations/km/services.ts
new file mode 100644
index 0000000..88fcccc
--- /dev/null
+++ b/application/src/translations/km/services.ts
@@ -0,0 +1,201 @@
+
+import { ServicesTranslations } from '../types/services';
+
+export const servicesTranslations: ServicesTranslations = {
+  serviceStatus: "ស្ថានភាព",
+  uptime: "រយៈពេលដំណើរការ",
+  lastChecked: "បានពិនិត្យចុងក្រោយ",
+  noServices: "គ្មានសេវាកម្មណាមួយត្រូវនឹងលក្ខណៈវិនិច្ឆ័យតម្រងរបស់អ្នកទេ។",
+  currentlyMonitoring: "កំពុងត្រួតពិនិត្យ",
+  retry: "សាកល្បងម្តងទៀត",
+  overview: "ទិដ្ឋភាពទូទៅ",
+  newService: "សេវាកម្មថ្មី",
+  rowsPerPage: "ជួរដេកក្នុងមួយទំព័រ",
+  search: "ស្វែងរក",
+  allTypes: "គ្រប់ប្រភេទ",
+  createNewService: "បង្កើតសេវាកម្មថ្មី",
+  createNewServiceDesc: "បំពេញព័ត៌មានលម្អិតដើម្បីបង្កើតសេវាកម្មថ្មីសម្រាប់ត្រួតពិនិត្យ។",
+
+  // ServiceBasicFields.tsx
+  serviceName: "ឈ្មោះសេវាកម្ម",
+  serviceNameDesc: "បញ្ចូលឈ្មោះដែលពិពណ៌នាអំពីសេវាកម្មរបស់អ្នក",
+
+  // ServiceConfigFields.tsx
+  checkInterval: "ចន្លោះពេលពិនិត្យ",
+  seconds: "វិនាទី",
+  minute: "នាទី",
+  minutes: "នាទី",
+  hour: "ម៉ោង",
+  hours: "ម៉ោង",
+  custom: "ផ្ទាល់ខ្លួន",
+  checkIntervalPlaceholder: "បញ្ចូលចន្លោះពេលជាវិនាទី",
+  backToPresets: "ត្រឡប់ទៅការកំណត់ជាមុន",
+  checkIntervalDesc: "ភាពញឹកញាប់នៃការពិនិត្យស្ថានភាពសេវាកម្ម",
+  checkIntervalDescCustom: "បញ្ចូលចន្លោះពេលផ្ទាល់ខ្លួនជាវិនាទី (អប្បបរមា ១០ វិនាទី)",
+  retryAttempts: "ការព្យាយាមឡើងវិញ",
+  attempt: "ការព្យាយាម",
+  attempts: "ការព្យាយាម",
+  retryAttemptsDesc: "ចំនួនការព្យាយាមឡើងវិញមុននឹងចាត់ទុកថាមិនដំណើរការ",
+
+  // ServiceForm.tsx
+  updateService: "ធ្វើបច្ចុប្បន្នភាពសេវាកម្ម",
+  createService: "បង្កើតសេវាកម្ម",
+
+  // ServiceNotificationFields.tsx
+  enableNotifications: "បើកការជូនដំណឹង",
+  enableNotificationsDesc: "បើក ឬបិទការជូនដំណឹងសម្រាប់សេវាកម្មនេះ",
+  notificationChannels: "បណ្តាញជូនដំណឹង",
+  notificationChannelsEnabledDesc: "ជ្រើសរើសបណ្តាញជូនដំណឹងសម្រាប់សេវាកម្មនេះ",
+  notificationChannelsDesc: "បើកការជូនដំណឹងជាមុនដើម្បីជ្រើសរើសបណ្តាញ",
+  notificationChannelsPlaceholder: "បន្ថែមបណ្តាញជូនដំណឹង",
+  alertTemplate: "ទម្រង់ជូនដំណឹង",
+  alertTemplateLoading: "កំពុងផ្ទុកទម្រង់...",
+  alertTemplatePlaceholder: "ជ្រើសរើសទម onderwerpជូនដំណឹង",
+  alertTemplateEnabledDesc: "ជ្រើសរើសទម្រង់សម្រាប់សារជូនដំណឹង",
+  alertTemplateDesc: "បើកការជូនដំណឹងជាមុនដើម្បីជ្រើសរើសទម្រង់",
+
+  // ServiceTypeField.tsx
+  serviceType: "ប្រភេទ",
+  serviceTypeHTTPDesc: "ត្រួតពិនិត្យគេហទំព័រ និង REST APIs ជាមួយពិធីការ HTTP/HTTPS",
+  serviceTypePINGDesc: "ត្រួតពិនិត្យភាពអាចប្រើបានរបស់ម៉ាស៊ីនជាមួយពិធីការ PING",
+  serviceTypeTCPDesc: "ត្រួតពិនិត្យការតភ្ជាប់ច្រក TCP ជាមួយពិធីការ TCP",
+  serviceTypeDNSDesc: "ត្រួតពិនិត្យការដោះស្រាយ DNS",
+
+  // ServiceRegionalFields.tsx
+  regionalMonitoring: "ការត្រួតពិនិត្យតាមតំបន់",
+  regionalMonitoringDesc: "ចាត់តាំងសេវាកម្មនេះទៅភ្នាក់ងារត្រួតពិនិត្យតាមតំបន់សម្រាប់ការត្រួតពិនិត្យចែកចាយ",
+  regionalAgents: "ភ្នាក់ងារតាមតំបន់",
+  regionalAgentsLoading: "កំពុងផ្ទុកភ្នាក់ងារ...",
+  regionalAgentsAvailablePlaceholder: "ជ្រើសរើសភ្នាក់ងារតាមតំបន់បន្ថែម...",
+  regionalAgentsAllSelected: "បានជ្រើសរើសភ្នាក់ងារទាំងអស់ដែលមាន",
+  regionalAgentsNoAvailable: "គ្មានភ្នាក់ងារតាមតំបន់ដែលអាចប្រើបាន",
+  regionalAgentsNoOnlineAvailable: "គ្មានភ្នាក់ងារតាមតំបន់អនឡាញដែលអាចប្រើបាន",
+  regionalAgentsNotFoundMessage: "រកមិនឃើញភ្នាក់ងារតាមតំបន់អនឡាញទេ។ សេវាកម្មនឹងប្រើការត្រួតពិនិត្យលំនាំដើម។",
+  regionalAgentsNotSelectedMessage: "មិនបានជ្រើសរើសភ្នាក់ងារតាមតំបន់ទេ។ សេវាកម្មនឹងប្រើការត្រួតពិនិត្យលំនាំដើម។",
+
+  // ServiceUrlField.tsx
+  targetDefault: "URL/ម៉ាស៊ីនគោលដៅ",
+  targetDNS: "ឈ្មោះដែន",
+  targetHTTPDesc: "បញ្ចូល URL ពេញលេញរួមទាំងពិធីការ (http:// ឬ https://)",
+  targetPINGDesc: "បញ្ចូលឈ្មោះម៉ាស៊ីន ឬអាសយដ្ឋាន IP ដើម្បី ping",
+  targetTCPDesc: "បញ្ចូលឈ្មោះម៉ាស៊ីន ឬអាសយដ្ឋាន IP សម្រាប់ការធ្វើតេស្តការតភ្ជាប់ TCP",
+  targetTCPPortDesc: "បញ្ចូលលេខច្រកសម្រាប់ការធ្វើតេស្តការតភ្ជាប់ TCP",
+  targetDNSDesc: "បញ្ចូលឈ្មោះដែនសម្រាប់ការត្រួតពិនិត្យកំណត់ត្រា DNS (A, AAAA, MX, ជាដើម)",
+  targetDefaultDesc: "បញ្ចូល URL ឬឈ្មោះម៉ាស៊ីនគោលដៅសម្រាប់ការត្រួតពិនិត្យ",
+  targetDefaultPlaceholder: "បញ្ចូល URL ឬឈ្មោះម៉ាស៊ីន",
+
+  // types.ts
+  serviceNameRequired: "តម្រូវឱ្យមានឈ្មោះសេវាកម្ម",
+  urlDomainHostRequired: "តម្រូវឱ្យមាន URL/ដែន/ម៉ាស៊ីន",
+  enterValidUrlHostnameDomain: "សូមបញ្ចូល URL, ឈ្មោះម៉ាស៊ីន ឬដែនដែលត្រឹមត្រូវ",
+  spacesNotAllowed: "មិនអនុញ្ញាតឱ្យមានចន្លោះទំនេរទេ",
+
+  // Dashboard
+  upServices: "សេវាកម្មដំណើរការ",
+  downServices: "សេវាកម្មមិនដំណើរការ",
+  pausedServices: "សេវាកម្មផ្អាក",
+  warningServices: "សេវាកម្មព្រមាន",
+
+  // ServiceRowActions.tsx
+  viewDetail: "មើលលម្អិត",
+  resumeMonitoring: "បន្តការត្រួតពិនិត្យ",
+  pauseMonitoring: "ផ្អាកការត្រួតពិនិត្យ",
+
+  // IncidentTable.tsx
+  responseTime: "ពេលវេលាឆ្លើយតប",
+  errorMessage: "សារកំហុស",
+  details: "លម្អិត",
+  unmuteAlerts: "បើកសំឡេងការជូនដំណឹង",
+  muteAlerts: "បិទសំឡេងការជូនដំណឹង",
+
+  // LastCheckedTime.tsx
+  pausedAt: "ផ្អាកនៅ",
+  lastCheckDetails: "លម្អិតការពិនិត្យចុងក្រោយ",
+  checkedAt: "បានពិនិត្យនៅ",
+  monitoringPaused: "ការត្រួតពិនិត្យត្រូវបានផ្អាក",
+  noAutomaticChecks: "គ្មានការពិនិត្យដោយស្វ័យប្រវត្តិ",
+
+  // ServiveEditDialog.tsx
+  editService: "កែសម្រួលសេវាកម្ម",
+  editServiceDesc: "ធ្វើបច្ចុប្បន្នភាពលម្អិតនៃសេវាកម្មដែលត្រូវបានត្រួតពិនិត្យរបស់អ្នក។",
+
+  // ServiceStatsCards.tsx
+  lastCheckedAt: "បានពិនិត្យចុងក្រោយនៅ {datetime}",
+  avg: "មធ្យម",
+  lastUpChecksCount: "ការពិនិត្យដំណើរការចុងក្រោយ {count} ដង",
+  basedOnlastChecksCount: "ផ្អែកលើការពិនិត្យចុងក្រោយ {count} ដង",
+  totalUptime: "រយៈពេលដំណើរការសរុប",
+  totalDowntime: "រយៈពេលមិនដំណើរការសរុប",
+  monitoringSettings: "ការកំណត់ការត្រួតពិនិត្យ",
+  monitoringSettingsInterval: "បានពិនិត្យរៀងរាល់ {interval} វិនាទី",
+  monitoringSettingsType: "ការត្រួតពិនិត្យ",
+  upStatusDuration: "ដំណើរការអស់រយៈពេល {duration}",
+  downStatusDuration: "មិនដំណើរការអស់រយៈពេល {duration}",
+
+  incidentHistory: "ប្រវត្តិឧប្បត្តិហេតុ",
+  processing: "កំពុងដំណើរការ",
+  back: "ត្រឡប់ក្រោយ",
+  last20Checks: "ការពិនិត្យ ២០ ចុងក្រោយ",
+
+  //OneClickInstallTab.tsx
+  oneClickInstallTitle: "ការដំឡើងតែមួយចុច (ណែនាំ)",
+  oneClickInstallDesc: "ចម្លង និងបិទភ្ជាប់ពាក្យបញ្ជាតែមួយនេះដើម្បីដំឡើងភ្នាក់ងារត្រួតពិនិត្យភ្លាមៗ",
+  quickInstallCommand: "ពាក្យបញ្ជាដំឡើងរហ័ស",
+  copy: "ចម្លង",
+  runCommandOnServer: "គ្រាន់តែដំណើរការពាក្យបញ្ជានេះនៅលើម៉ាស៊ីនមេរបស់អ្នក:",
+  sshIntoServer: "ចូលទៅក្នុងម៉ាស៊ីនមេគោលដៅរបស់អ្នកតាម SSH",
+  pasteAndRun: "បិទភ្ជាប់ និងដំណើរការពាក្យបញ្ជាខាងលើ",
+  agentInstalled: "ភ្នាក់ងារនឹងត្រូវបានដំឡើង និងចាប់ផ្តើមដោយស្វ័យប្រវត្តិ",
+  done: "រួចរាល់",
+
+  // DockerOneClickTab.tsx
+  dockerOneClickTitle: "ការដំឡើង Docker តែមួយចុច",
+  dockerOneClickDesc: "ការដំឡើង Docker Container ដោយស្វ័យប្រវត្តិជាមួយនឹងសមត្ថភាពត្រួតពិនិត្យប្រព័ន្ធ",
+  dockerOneClickCommand: "ពាក្យបញ្ជា Docker តែមួយចុច",
+  dockerScriptWill: "ស្គ្រីបនេះនឹងធ្វើដោយស្វ័យប្រវត្តិ:",
+  dockerScriptStep1: "ទាញយក និងរៀបចំភ្នាក់ងារត្រួតពិនិត្យ Docker",
+  dockerScriptStep2: "កំណត់រចនាសម្ព័ន្ធអថេរបរិស្ថានដែលតម្រូវទាំងអស់",
+  dockerScriptStep3: "ចាប់ផ្តើម Container ជាមួយនឹងការចូលប្រើប្រព័ន្ធត្រឹមត្រូវ",
+  dockerScriptStep4: "រៀបចំការរក្សាទុកទិន្នន័យត្រួតពិនិត្យ",
+  directDockerTitle: "ពាក្យបញ្ជា Docker Run ដោយផ្ទាល់",
+  directDockerDesc: "ប្រសិនបើអ្នកចូលចិត្តដំណើរការ Docker Container ដោយផ្ទាល់ដោយគ្មានស្គ្រីប",
+  dockerRunCommand: "ពាក្យបញ្ជា Docker Run",
+  dockerPrerequisites: "តម្រូវការជាមុនសម្រាប់ការដំណើរការ Docker ដោយផ្ទាល់:",
+  dockerPrereqStep1: "Docker ត្រូវតែត្រូវបានដំឡើង និងដំណើរការ",
+  dockerPrereqStep2: "រូបភាព operacle/checkcle-server-agent ត្រូវតែមាន",
+  dockerPrereqStep3: "ដំណើរការជា root ឬជាមួយសិទ្ធិ sudo",
+
+  // ManualInstallTab.tsx
+  manualInstallTitle: "ជំហានការដំឡើងដោយដៃ",
+  manualInstallDesc: "ដំណើរការដំឡើងជាជំហានៗ",
+  serverName: "ឈ្មោះម៉ាស៊ីនមេ",
+  agentId: "លេខសម្គាល់ភ្នាក់ងារ",
+  osType: "ប្រភេទប្រព័ន្ធប្រតិបត្តិការ",
+  downloadScript: "ទាញយកស្គ្រីបដំឡើង",
+  makeExecutable: "ធ្វើឱ្យស្គ្រីបអាចប្រតិបត្តិបាន",
+  runInstall: "ដំណើរការការដំឡើងជាមួយនឹងការកំណត់រចនាសម្ព័ន្ធរបស់អ្នក",
+  prerequisites: "តម្រូវការជាមុន:",
+  prereqRoot: "ត្រូវប្រាកដថាអ្នកមានសិទ្ធិ root/sudo នៅលើម៉ាស៊ីនមេគោលដៅ",
+  prereqCurl: "ត្រូវប្រាកដថា curl ត្រូវបានដំឡើងសម្រាប់ទាញយកឯកសារ",
+  prereqInternet: "តម្រូវឱ្យមានការតភ្ជាប់អ៊ីនធឺណិតសម្រាប់ទាញយកស្គ្រីប",
+  afterInstall: "បន្ទាប់ពីការដំឡើង:",
+  agentWillStart: "ភ្នាក់ងារនឹងចាប់ផ្តើមដោយស្វ័យប្រវត្តិ និងនឹងបង្ហាញនៅក្នុងផ្ទាំងគ្រប់គ្រងរបស់អ្នកក្នុងរយៈពេលប៉ុន្មាននាទី។",
+
+  // ServerDetail.tsx
+  errorLoadingServer: "កំហុសក្នុងការផ្ទុកម៉ាស៊ីនមេ",
+  unableToFetchServerData: "មិនអាចទាញយកទិន្នន័យម៉ាីនមេបានទេ។ សូមពិនិត្យការតភ្ជាប់របស់អ្នក ហើយព្យាយាមម្តងទៀត។",
+  backToServers: "ត្រឡប់ទៅម៉ាស៊ីនមេ",
+  loadingServerDetails: "កំពុងផ្ទុកព័ត៌មានលម្អិតម៉ាស៊ីនមេ...",
+  serverDetail: "ព័ត៌មានលម្អិតម៉ាស៊ីនមេ",
+  monitorServerMetrics: "ត្រួតពិនិត្យMetricsប្រសិទ្ធភាពម៉ាស៊ីនមេ និងសុខភាពប្រព័ន្ធ",
+  serverHostnameIpOs: "{hostname} • {ip_address} • {os_type}",
+
+  // ContainerMonitoring.tsx
+  errorLoadingContainers: "កំហុសក្នុងការផ្ទុក Container",
+  unableToFetchContainerData: "មិនអាចទាញយកទិន្នន័យ Container បានទេ?। សូមពិនិត្យការតភ្ជាប់របស់អ្នក ហើយព្យាយាមម្តងទៀត។",
+  errorUnknown: "កំហុសមិនស្គាល់",
+  containerMonitoring: "ការត្រួតពិនិត្យ Container",
+  monitorAndManageContainers: "ត្រួតពិនិត្យ និងគ្រប់គ្រង Docker Container របស់អ្នកក្នុងពេលជាក់ស្តែង",
+  serverIdLabel: "លេខសម្គាល់ម៉ាស៊ីនមេ",
+
+};
diff --git a/application/src/translations/km/settings.ts b/application/src/translations/km/settings.ts
new file mode 100644
index 0000000..daf74fe
--- /dev/null
+++ b/application/src/translations/km/settings.ts
@@ -0,0 +1,175 @@
+
+import { SettingsTranslations } from '../types/settings';
+
+export const settingsTranslations: SettingsTranslations = {
+  // General Settings - Tabs
+  systemSettings: "ការកំណត់ប្រព័ន្ធ",
+  mailSettings: "ការកំណត់សំបុត្រ",
+
+  // General Settings - System Settings
+  appName: "ឈ្មោះកម្មវិធី",
+  appURL: "URL កម្មវិធី",
+  senderName: "ឈ្មោះអ្នកផ្ញើ",
+  senderEmail: "អាសយដ្ឋានអ៊ីមែលអ្នកផ្ញើ",
+  hideControls: "លាក់ការគ្រប់គ្រង",
+
+  // General Settings - Mail Settings
+  smtpSettings: "ការកំណត់រចនាសម្ព័ន្ធ SMTP",
+  smtpEnabled: "បើក SMTP",
+  smtpHost: "ម៉ាស៊ីន SMTP",
+  smtpPort: "ច្រក SMTP",
+  smtpUsername: "ឈ្មោះអ្នកប្រើ SMTP",
+  smtpPassword: "ពាក្យសម្ងាត់ SMTP",
+  smtpAuthMethod: "វិធីសាស្ត្រផ្ទៀងផ្ទាត់",
+  enableTLS: "បើក TLS",
+  localName: "ឈ្មោះមូលដ្ឋាន",
+
+  // General Settings - Test Email
+  testEmail: "សាកល្បងអ៊ីមែល",
+  sendTestEmail: "ផ្ញើអ៊ីមែលសាកល្បង",
+  emailTemplate: "គំរូអ៊ីមែល",
+  verification: "ការផ្ទៀងផ្ទាត់",
+  passwordReset: "កំណត់ពាក្យសម្ងាត់ឡើងវិញ",
+  confirmEmailChange: "បញ្ជាក់ការផ្លាស់ប្តូរអ៊ីមែល",
+  otp: "លេខកូដ OTP",
+  loginAlert: "ការជូនដំណឹងចូលប្រព័ន្ធ",
+  authCollection: "បណ្តុំផ្ទៀងផ្ទាត់",
+  selectCollection: "ជ្រើសរើសបណ្តុំ",
+  toEmailAddress: "ទៅអាសយដ្ឋានអ៊ីមែល",
+  enterEmailAddress: "បញ្ចូលអាសយដ្ឋានអ៊ីមែល",
+  send: "ផ្ញើ",
+  sending: "កំពុងផ្ញើ...",
+  testEmailSettings: "សាកល្បងការកំណត់អ៊ីមែល",
+  testEmailDescription: "សាកល្បងថាតើការកំណត់អ៊ីមែលបច្ចុប្បន្នអាចប្រើបានឬអត់",
+  testEmailAlert: "នេះនឹងផ្ញើអ៊ីមែលសាកល្បងដោយប្រើការកំណត់ SMTP របស់អ្នក។ សូមប្រាកដថា SMTP ត្រូវបានកំណត់យ៉ាងត្រឹមត្រូវជាមុន។",
+
+  // General Settings - Actions and status
+  save: "រក្សាទុកការផ្លាស់ប្តូរ",
+  saving: "កំពុងរក្សាទុក...",
+  settingsUpdated: "បានធ្វើបច្ចុប្បន្នភាពការកំណត់ដោយជោគជ័យ",
+  errorSavingSettings: "មានបញ្ហាក្នុងការរក្សាទុកការកំណត់",
+  errorFetchingSettings: "មានបញ្ហាក្នុងការទាញយកការកំណត់",
+  testConnection: "សាកល្បងការតភ្ជាប់",
+  testingConnection: "កំពុងសាកល្បងការតភ្ជាប់...",
+  connectionSuccess: "ការតភ្ជាប់ជោគជ័យ",
+  connectionFailed: "ការតភ្ជាប់បរាជ័យ",
+
+  // User Management
+  addUser: "បន្ថែមអ្នកប្រើប្រាស់",
+  permissionNotice: "សេចក្តីជូនដំណឹងអំពីការអនុញ្ញាត:",
+  permissionNoticeAddUser: "ក្នុងនាមជាអ្នកប្រើប្រាស់ជាអ្នកគ្រប់គ្រង អ្នកមិនមានសិទ្ធិចូលមើល ឬកែប្រែការកំណត់ប្រព័ន្ធ និងអ៊ីមែលទេ។ ការកំណត់ទាំងនេះអាចចូលប្រើ និងកែប្រែបានដោយអ្នកគ្រប់គ្រងជាន់ខ្ពស់តែប៉ុណ្ណោះ។ សូមទាក់ទងអ្នកគ្រប់គ្រងជាន់ខ្ពស់របស់អ្នក ប្រសិនបើអ្នកត្រូវការធ្វើការផ្លាស់ប្តូរលើការកំណត់ប្រព័ន្ធ ឬការកំណត់អ៊ីមែល។",
+  loadingSettings: "កំពុងផ្ទុកការកំណត់...",
+  loadingSettingsError: "កំហុសក្នុងការផ្ទុកការកំណត់",
+
+  //NotificationSettings.ts
+  titleNotification: "ការកំណត់ការជូនដំណឹង",
+descriptionChannelsServices: "កំណត់រចនាសម្ព័ន្ធបណ្តាញជូនដំណឹងសម្រាប់សេវាកម្មរបស់អ្នក",
+  addChannel: "បន្ថែមបណ្តាញ",
+  all: "បណ្តាញទាំងអស់",
+  telegram: "តេឡេក្រាម",
+  discord: "Discord",
+  slack: "Slack",
+  signal: "Signal",
+  googleChat: "Google Chat",
+  email: "អ៊ីមែល",
+  webhook: "Webhook",
+  matrix: "Matrix",
+
+  // NotificationChannelDialog.tsx
+  editChannel: "កែសម្រួលបណ្តាញជូនដំណឹង",
+  addChannelDialog: "បន្ថែមបណ្តាញជូនដំណឹង",
+  channelName: "ឈ្មោះបណ្តាញ",
+  channelNameDesc: "ឈ្មោះសម្រាប់កំណត់អត្តសញ្ញាណបណ្តាញជូនដំណឹងនេះ",
+  channelType: "ប្រភេទបណ្តាញ",
+  selectType: "ជ្រើសរើសប្រភេទជូនដំណឹង",
+  enabled: "បើក",
+  enabledDesc: "បើក ឬបិទបណ្តាញជូនដំណឹងនេះ",
+  cancel: "បោះបង់",
+  updateChannel: "ធ្វើបច្ចុប្បន្នភាពបណ្តាញ",
+  createChannel: "បង្កើតបណ្តាញ",
+  payloadTemplates: "ទម្រង់បន្ទុក",
+  availablePlaceholders: "កន្លែងទុកជាមុនដែលអាចប្រើបាន៖",
+  server: "ម៉ាស៊ីនបម្រើ",
+  service: "សេវាកម្ម",
+  ssl: "SSL",
+  common: "ទូទៅ",
+  webhookUrl: "URL នៃ Webhook",
+  webhookUrlDesc: "URL ដែលការជូនដំណឹង webhook នឹងត្រូវបានផ្ញើទៅ",
+  payloadTemplate: "ទម្រង់បន្ទុក (ជាជម្រើស)",
+  payloadTemplateDesc: "ទម្រង់ JSON សម្រាប់បន្ទុក webhook។ ទុកចោលទទេដើម្បីប្រើទម្រង់លំនាំដើម។",
+  telegramChatId: "លេខសម្គាល់ជជែក",
+  telegramChatIdDesc: "លេខសម្គាល់ជជែក Telegram ដើម្បីផ្ញើការជូនដំណឹងទៅ",
+  botToken: "លេខសម្គាល់បុត",
+  botTokenDesc: "លេខសម្គាល់បុត Telegram របស់អ្នកពី @BotFather",
+  discordWebhookUrl: "URL នៃ Webhook",
+  discordWebhookUrlDesc: "URL នៃ webhook របស់ Discord ពីការកំណត់ម៉ាស៊ីនបម្រើរបស់អ្នក",
+  slackWebhookUrl: "URL នៃ Webhook",
+  slackWebhookUrlDesc: "URL នៃ webhook ចូលរបស់ Slack",
+  signalNumber: "លេខ Signal",
+  signalNumberDesc: "លេខទូរស័ព្ទ Signal ដើម្បីផ្ញើការជូនដំណឹងទៅ",
+  signalApiEndpoint: "ចំណុចបញ្ចប់ API របស់ Signal",
+  signalApiEndpointDesc: "ចំណុចបញ្ចប់ API សម្រាប់សេវាកម្ម Signal របស់អ្នក",
+  googleChatWebhookUrl: "URL នៃ Webhook របស់ Google Chat",
+  googleChatWebhookUrlDesc: "URL នៃ webhook របស់ Google Chat ពីកន្លែង Google Chat របស់អ្នក",
+  emailAddress: "អាសយដ្ឋានអ៊ីមែល",
+  emailAddressDesc: "អាសយដ្ឋានអ៊ីមែលដើម្បីផ្ញើការជូនដំណឹងទៅ",
+  emailSenderName: "ឈ្មោះអ្នកផ្ញើ",
+  emailSenderNameDesc: "ឈ្មោះបង្ហាញសម្រាប់អ៊ីមែលដែលផ្ញើចេញ",
+  smtpServer: "ម៉ាស៊ីនបម្រើ SMTP",
+  // smtpPort: "ច្រក SMTP",
+  // smtpPassword: "លេខសម្ងាត់ SMTP",
+  smtpPasswordDesc: "លេខសម្ងាត់សម្រាប់ការផ្ទៀងផ្ទាត់ជាមួយម៉ាស៊ីនបម្រើ SMTP",
+  ntfyEndpoint: "ចំណុចបញ្ចប់ NTFY",
+  ntfyEndpointDesc: "URL នៃចំណុចបញ្ចប់ NTFY រួមទាំងប្រធានបទរបស់អ្នក (ឧ. https://ntfy.sh/checkcle)",
+  apiToken: "លេខសម្គាល់ API",
+  apiTokenOptional: "លេខសម្គាល់ API (ជាជម្រើស)",
+  apiTokenDesc: "លេខសម្គាល់ API ជាជម្រើសសម្រាប់ការផ្ទៀងផ្ទាត់ជាមួយម៉ាស៊ីនបម្រើ NTFY",
+  pushoverUserKey: "លេខសម្គាល់អ្នកប្រើប្រាស់",
+  pushoverUserKeyDesc: "លេខសម្គាល់អ្នកប្រើប្រាស់ Pushover របស់អ្នក (ឬលេខសម្គាល់ក្រុម)",
+  notifiarrChannelId: "លេខសម្គាល់បណ្តាញ",
+  notifiarrChannelIdDesc: "លេខសម្គាល់បណ្តាញ Discord ដែលការជូនដំណឹងនឹងត្រូវបានផ្ញើទៅ",
+  gotifyServerUrl: "URL នៃម៉ាស៊ីនបម្រើ",
+  gotifyServerUrlDesc: "URL នៃម៉ាស៊ីនបម្រើ Gotify របស់អ្នក",
+  matrixHomeserver: "Homeserver URL",
+  matrixHomeserverDesc: "URL នៃ Matrix homeserver របស់អ្នក (ឧ. https://matrix.org)",
+  matrixRoomId: "Room ID",
+  matrixRoomIdDesc: "Matrix room ID ដែលការជូនដំណឹងនឹងត្រូវបានផ្ញើទៅ (ឧ. !abc123:matrix.org)",
+  matrixAccessToken: "Access Token",
+  matrixAccessTokenDesc: "Access token នៃ Matrix bot account របស់អ្នក",
+  errorSaveChannel: "បរាជ័យក្នុងការរក្សាទុកបណ្តាញជូនដំណឹង",
+
+  channelNamePlaceholder: "ប៉ុស្តិ៍ផ្ទាល់សារជូនដំណឹងរបស់ខ្ញុំ",
+  telegramChatIdPlaceholder: "ID កុំព្យូទ័រនិមិត្តសារ Telegram",
+  botTokenPlaceholder: "Token Bot Telegram",
+  discordWebhookUrlPlaceholder: "https://discord.com/api/webhooks/...",
+  slackWebhookUrlPlaceholder: "https://hooks.slack.com/services/...",
+  signalNumberPlaceholder: "+1234567890",
+  signalApiEndpointPlaceholder: "https://your-signal-api.com/v2/send",
+  googleChatWebhookUrlPlaceholder: "https://chat.googleapis.com/v1/spaces/...",
+  emailAddressPlaceholder: "notifications@example.com",
+  emailSenderNamePlaceholder: "ប្រព័ន្ធជូនដំណឹងព្រមាន",
+  smtpServerPlaceholder: "smtp.gmail.com",
+  smtpPortPlaceholder: "587",
+  smtpPasswordPlaceholder: "បញ្ចូលពាក្យសម្ងាត់ SMTP របស់អ្នក",
+  ntfyEndpointPlaceholder: "https://ntfy.sh/your-topic",
+  apiTokenPlaceholder: "បញ្ចូល token API",
+  pushoverUserKeyPlaceholder: "កូនសោអ្នកប្រើ Pushover របស់អ្នក",
+  notifiarrChannelIdPlaceholder: "ID ប៉ុស្តិ៍ផ្ទាល់សារ Discord",
+  gotifyServerUrlPlaceholder: "https://your-gotify-server.com",
+  webhookUrlPlaceholder: "https://api.example.com/webhook",
+  matrixHomeserverPlaceholder: "https://matrix.org",
+  matrixRoomIdPlaceholder: "!roomid:matrix.org",
+  matrixAccessTokenPlaceholder: "syt_...",
+
+  // DataRetentionSettings.tsx
+  permissionNoticeDataRetention: "ជាអ្នកប្រើប្រាស់អ្នកគ្រប់គ្រង អ្នកមិនមានសិទ្ធចូលដំណើរការការកំណត់រក្សាទុកទិន្នន័យទេ។ ការកំណត់ទាំងនេះអាចត្រូវបានចូលដំណើរការនិងកែប្រែដោយតែអ្នកគ្រប់គ្រងដ៏ខ្ពស់ប៉ុណ្ណោះ។",
+  loadingRetentionSettings: "កំពុងផ្ទុកការកំណត់រក្សាទុក...",
+  dataRetention: "ការកំណត់រក្សាទុកទិន្នន័យ",
+  dataRetentionDescription: "កំណត់រចនាសម្ព័ន្ធពេលវេលាដែលទិន្នន័យត្រួតពិនិត្យត្រូវបានរក្សាទុកនៅក្នុងប្រព័ន្ធ",
+  uptimeRetentionLabel: "ការរក្សាទុកការតាមដានពេលដំណើរការ (ចំនួនថ្ងៃ)",
+  uptimeRetentionHelp: "ទិន្នន័យពេលដំណើរការសេវាកម្ម និងឧប្បត្តិហេតុយូរជាងនេះនឹងត្រូវលុបដោយស្វ័យប្រវត្តិ។",
+  serverRetentionLabel: "ការរក្សាទុកការតាមដានម៉ាស៊ីនមេ (ចំនួនថ្ងៃ)",
+  serverRetentionHelp: "រង្វាស់ម៉ាស៊ីនមេ និងទិន្នន័យដំណើរការដែលយូរជាងនេះនឹងត្រូវលុបដោយស្វ័យប្រវត្តិ។",
+  lastCleanup: "ការសម្អាតស្វ័យប្រវត្តិចុងក្រោយ",
+
+};
\ No newline at end of file
diff --git a/application/src/translations/km/ssl.ts b/application/src/translations/km/ssl.ts
new file mode 100644
index 0000000..05cb0fa
--- /dev/null
+++ b/application/src/translations/km/ssl.ts
@@ -0,0 +1,117 @@
+
+import { SSLTranslations } from '../types/ssl';
+
+export const sslTranslations: SSLTranslations = {
+  // Page and section titles
+  sslDomainManagement: "ការគ្រប់គ្រង SSL និង ដូមេន",
+  monitorSSLCertificates: "តាមដាន និង គ្រប់គ្រងវិញ្ញាបនបត្រ SSL សម្រាប់ដូមេនរបស់អ្នក",
+  addSSLCertificate: "បន្ថែមវិញ្ញាបនបត្រ SSL",
+  editSSLCertificate: "កែសម្រួលវិញ្ញាបនបត្រ SSL",
+  deleteSSLCertificate: "លុបវិញ្ញាបនបត្រ SSL",
+  sslCertificateDetails: "ព័ត៌មានលម្អិតនៃវិញ្ញាបនបត្រ SSL",
+  detailedInfo: "ព័ត៌មានលម្អិត",
+  viewDetailedInformation: "មើលព័ត៌មានលម្អិត",
+
+  // Status related
+  valid: "មានសុពលភាព",
+  expiringSoon: "ជិតផុតកំណត់",
+  expired: "ផុតកំណត់",
+  pending: "កំពុងរង់ចាំ",
+
+  // Statistics and cards
+  validCertificates: "វិញ្ញាបនបត្រមានសុពលភាព",
+  expiringSoonCertificates: "ជិតផុតកំណត់",
+  expiredCertificates: "វិញ្ញាបនបត្រផុតកំណត់",
+
+  // Form fields
+  domain: "ដូមេន",
+  domainName: "ឈ្មោះដូមេន",
+  domainCannotChange: "ដូមេនមិនអាចផ្លាស់ប្តូរបានបន្ទាប់ពីការបង្កើត",
+  warningThreshold: "កម្រិតព្រមាន",
+  warningThresholdDays: "កម្រិតព្រមាន (ថ្ងៃ)",
+  expiryThreshold: "កម្រិតផុតកំណត់",
+  expiryThresholdDays: "កម្រិតផុតកំណត់ (ថ្ងៃ)",
+  notificationChannel: "ឆានែលជូនដំណឹង",
+  chooseChannel: "ជ្រើសរើសឆានែលជូនដំណឹង",
+  whereToSend: "ទីកន្លែងដែលត្រូវផ្ញើការជូនដំណឹង",
+  daysBeforeExpiration: "ថ្ងៃមុនពេលផុតកំណត់ដើម្បីទទួលបានការព្រមាន",
+  daysBeforeCritical: "ថ្ងៃមុនពេលផុតកំណត់ដើម្បីទទួលបានការជូនដំណឹងសំខាន់ៗ",
+  getNotifiedExpiration: "ទទួលការជូនដំណឹងនៅពេលវិញ្ញាបនបត្រជិតផុតកំណត់",
+  getNotifiedCritical: "ទទួលការជូនដំណឹងនៅពេលវិញ្ញាបនបត្រជិតដល់ពេលផុតកំណត់ខ្លាំង",
+
+  // Table headers and fields
+  issuer: "អ្នកចេញផ្សាយ",
+  expirationDate: "កាលបរិច្ឆេទផុតកំណត់",
+  daysLeft: "ថ្ងៃនៅសល់",
+  status: "ស្ថានភាព",
+  lastNotified: "ជូនដំណឹងចុងក្រោយ",
+  actions: "សកម្មភាព",
+  validFrom: "មានសុពលភាពចាប់ពី",
+  validUntil: "មានសុពលភាពរហូតដល់",
+  validityDays: "ថ្ងៃសុពលភាព",
+  validityPeriod: "រយៈពេលសុពលភាព",
+  organization: "អង្គការ",
+  commonName: "ឈ្មោះទូទៅ",
+  serialNumber: "លេខសៀរៀល",
+  algorithm: "អាល់ហ្គោរីត",
+  subjectAltNames: "ឈ្មោះផ្សេងៗដែលអាចប្រើបាន",
+   subjectAlternativeNames: "ឈ្មោះជំនួសផ្សេងៗ",
+  resolvedIP: "IP របស់ដូមែន",
+  issuedTo: "ចេញសម្រាប់",
+  days: "ថ្ងៃ",
+  
+  // Buttons and actions
+  addDomain: "បន្ថែមដូមេន",
+  refreshAll: "ធ្វើបច្ចុប្បន្នភាពទាំងអស់",
+  cancel: "បោះបង់",
+  addCertificate: "បន្ថែមវិញ្ញាបនប័ត្រ",
+  check: "ពិនិត្យ",
+  view: "មើល",
+  edit: "កែសម្រួល",
+  delete: "លុប",
+  close: "បិទ",
+  saveChanges: "រក្សាទុកការផ្លាស់ប្តូរ",
+  updating: "កំពុងធ្វើបច្ចុប្បន្នភាព",
+  
+  // Sections in detail view
+  basicInformation: "ព័ត៌មានមូលដ្ឋាន",
+  validity: "សុពលភាព",
+  issuerInfo: "ព័ត៌មានអ្នកចេញផ្សាយ",
+  technicalDetails: "ព័ត៌មានបច្ចេកទេស",
+  technicalInformation: "ព័ត៌មានបច្ចេកទេស",
+  monitoringConfig: "ការកំណត់រចនាសម្ព័ន្ធការតាមដាន",
+  monitoringConfiguration: "ការកំណត់រចនាសម្ព័ន្ធការតាមដាន",
+  recordInfo: "ព័ត៌មានកំណត់ត្រា",
+  certificateDetails: "ព័ត៌មានលម្អិតវិញ្ញាបនបត្រ",
+  
+  // Notifications and messages
+  sslCertificateAdded: "វិញ្ញាបនបត្រ SSL បានបន្ថែមដោយជោគជ័យ",
+  sslCertificateUpdated: "វិញ្ញាបនបត្រ SSL បានធ្វើបច្ចុប្បន្នភាពដោយជោគជ័យ",
+  sslCertificateDeleted: "វិញ្ញាបនបត្រ SSL ត្រូវបានលុបដោយជោគជ័យ",
+  sslCertificateRefreshed: "វិញ្ញាបនបត្រ SSL សម្រាប់ {domain} បានធ្វើបច្ចុប្បន្នភាពដោយជោគជ័យ",
+  allCertificatesRefreshed: "វិញ្ញាបនបត្រទាំងអស់ {count} បានធ្វើបច្ចុប្បន្នភាពដោយជោគជ័យ",
+  someCertificatesFailed: "វិញ្ញាបនប័ត្រ {success} បានធ្វើបច្ចុប្បន្នភាព, {failed} បានបរាជ័យ",
+  failedToAddCertificate: "បរាជ័យក្នុងការបន្ថែមវិញ្ញាបនបត្រ SSL",
+  failedToLoadCertificates: "បរាជ័យក្នុងការផ្ទុកវិញ្ញាបនបត្រ SSL",
+  failedToUpdateCertificate: "បរាជ័យក្នុងការធ្វើបច្ចុប្បន្នភាពវិញ្ញាបនបត្រ SSL",
+  failedToDeleteCertificate: "បរាជ័យក្នុងការលុបវិញ្ញាបនបត្រ SSL",
+  failedToCheckCertificate: "បរាជ័យក្នុងការពិនិត្យមើលវិញ្ញាបនបត្រ SSL",
+  noCertificatesToRefresh: "មិនមានវិញ្ញាបនបត្រដើម្បីធ្វើបច្ចុប្បន្នភាពទេ",
+  startingRefreshAll: "ចាប់ផ្តើមធ្វើបច្ចុប្បន្នភាពវិញ្ញាបនបត្រចំនួន {count}",
+  checkingSSLCertificate: "កំពុងពិនិត្យមើលវិញ្ញាបនបត្រ SSL...",
+  deleteConfirmation: "តើអ្នកពិតជាចង់លុបវិញ្ញាបនបត្រសម្រាប់",
+  deleteWarning: "សកម្មភាពនេះមិនអាចត្រឡប់វិញបានទេ។ វានឹងលុបវិញ្ញាបនបត្រជាអចិន្ត្រៃយ៍។",
+  
+  // Misc
+  unknown: "មិនស្គាល់",
+  never: "មិនដែល",
+  none: "គ្មាន",
+  loadingChannels: "កំពុងផ្ទុកឆានែល...",
+  noChannelsFound: "រកមិនឃើញឆានែលជូនដំណឹងទេ",
+  noSSLCertificates: "រកមិនឃើញវិញ្ញាបនបត្រ SSL ទេ",
+  created: "បានបង្កើត",
+  lastUpdated: "បានធ្វើបច្ចុប្បន្នភាពចុងក្រោយ",
+  lastNotification: "ការជូនដំណឹងចុងក្រោយ",
+  collectionId: "លេខសម្គាល់ប្រមូលផ្តុំ",
+  noCertificatesFound: "រកមិនឃើញវិញ្ញាបនប័ត្រ",
+};
diff --git a/application/src/translations/ko/about.ts b/application/src/translations/ko/about.ts
new file mode 100644
index 0000000..e0d6ad6
--- /dev/null
+++ b/application/src/translations/ko/about.ts
@@ -0,0 +1,18 @@
+import { AboutTranslations } from '../types/about';
+
+export const aboutTranslations: AboutTranslations = {
+  aboutCheckCle: "About Checkcle",
+  systemDescription: "Checkcle는 서버 및 서비스 상태, 사고 관리, 운영 투명성에 대한 실시간 인사이트를 제공하는 오픈소스 모니터링 스택입니다. MIT 라이선스로 공개됨.",
+  systemVersion: "시스템 버전",
+  license: "라이선스",
+  mitLicense: "MIT 라이선스",
+  links: "링크",
+  viewOnGithub: "GitHub에서 보기",
+  viewDocumentation: "문서 보기",
+  followOnX: "X에서 팔로우",
+  joinDiscord: "Discord 참여",
+  quickActions: "빠른 작업",
+  quickActionsDescription: "자주 사용하는 모니터링 작업과 기능에 빠르게 접근하세요. 아래에서 작업을 선택하여 시작할 수 있습니다.",
+  quickTips: "빠른 팁",
+  releasedOn: "출시일",
+};
diff --git a/application/src/translations/ko/common.ts b/application/src/translations/ko/common.ts
new file mode 100644
index 0000000..fd08a0c
--- /dev/null
+++ b/application/src/translations/ko/common.ts
@@ -0,0 +1,31 @@
+import { CommonTranslations } from '../types/common';
+
+export const commonTranslations: CommonTranslations = {
+  welcome: "환영합니다",
+  logout: "로그아웃",
+  language: "언어",
+  english: "Englisch",
+  khmer: "ភាសាខ្មែរ",
+  german: "Deutsch",
+  korean: "한국어",
+  japanese: "日本語",
+  simplifiedChinese: "简体中文",
+  goodMorning: "좋은 아침입니다",
+  goodAfternoon: "좋은 오후입니다",
+  goodEvening: "좋은 저녁입니다",
+  profile: "프로필",
+  settings: "설정",
+  documentation: "문서",
+  notifications: "알림",
+  close: "닫기",
+  cancel: "취소",
+  view: "보기",
+  edit: "편집",
+  delete: "삭제",
+  status: "상태",
+  time: "시간",
+  title: "제목",
+  description: "설명",
+  success: "성공",
+  error: "오류",
+};
diff --git a/application/src/translations/ko/incident.ts b/application/src/translations/ko/incident.ts
new file mode 100644
index 0000000..e43ffaf
--- /dev/null
+++ b/application/src/translations/ko/incident.ts
@@ -0,0 +1,64 @@
+
+import { IncidentTranslations } from '../types/incident';
+
+export const incidentTranslations: IncidentTranslations = {
+  incidentManagement: '인시던트 관리',
+  incidentsManagementDesc: '서비스 인시던트 및 해결 과정을 추적하고 관리합니다',
+  unresolvedIncidents: '미해결',
+  resolvedIncidents: '해결됨',
+  activeIncidents: '활성 인시던트',
+  criticalIssues: '중대한 문제',
+  avgResolutionTime: '평균 해결 시간',
+  noIncidents: '활성 인시던트 없음',
+  createIncident: '인시던트 생성',
+  investigating: '조사 중',
+  identified: '확인됨',
+  monitoring: '모니터링 중',
+  resolved: '해결됨',
+  scheduleIncidentManagement: '일정 및 인시던트 관리',
+  incidentName: '인시던트 이름',
+  incidentStatus: '인시던트 상태',
+  highPriority: '높은 우선순위',
+  configurationSettings: '구성 설정',
+  incidentCreatedSuccess: '인시던트가 성공적으로 생성되었습니다',
+  basicInfo: '기본 정보',
+  serviceId: '서비스 ID',
+  assignedTo: '담당자',
+  unassigned: '미할당',
+  timeline: '타임라인',
+  incidentTime: '인시던트 발생 시간',
+  resolutionTime: '해결 시간',
+  systems: '시스템',
+  noSystems: '영향을 받은 시스템 없음',
+  impactAnalysis: '영향 분석',
+  rootCause: '근본 원인',
+  resolutionSteps: '해결 단계',
+  lessonsLearned: '교훈',
+  resolutionDetails: '해결 상세',
+  assignment: '할당',
+  download: '다운로드',
+  downloadPdf: 'PDF 다운로드',
+  print: '인쇄',
+  confidentialNote: '이 문서는 기밀이며 내부 용도로만 사용됩니다.',
+  generatedOn: '생성일',
+  enterResolutionSteps: '인시던트 해결 단계 입력',
+  enterLessonsLearned: '인시던트 교훈 입력',
+  editIncident: '인시던트 편집',
+  editIncidentDesc: '인시던트 세부 정보 업데이트',
+  updating: '업데이트 중...',
+  update: '업데이트',
+  create: '생성',
+  creating: '생성 중...',
+  configuration: '구성',
+  failedToUpdateStatus: '상태 업데이트 실패',
+  inProgress: '진행 중',
+  enterRootCause: '근본 원인 입력',
+  enterIncidentTitle: '인시던트 제목 입력',
+  enterIncidentDescription: '인시던트 설명 입력',
+  enterServiceId: '서비스 ID를 콤마로 구분하여 입력',
+  selectAssignedUser: '담당자 선택',
+  noAssignedUser: '현재 인시던트에 할당된 사용자가 없습니다',
+  affectedSystems: '영향을 받은 시스템',
+  enterAffectedSystems: '영향을 받은 시스템 입력',
+  separateSystemsWithComma: '영향 시스템을 콤마로 구분하여 입력',
+};
diff --git a/application/src/translations/ko/index.ts b/application/src/translations/ko/index.ts
new file mode 100644
index 0000000..e282607
--- /dev/null
+++ b/application/src/translations/ko/index.ts
@@ -0,0 +1,25 @@
+
+import { Translations } from '../types';
+import { commonTranslations } from './common';
+import { menuTranslations } from './menu';
+import { loginTranslations } from './login';
+import { aboutTranslations } from './about';
+import { servicesTranslations } from './services';
+import { maintenanceTranslations } from './maintenance';
+import { incidentTranslations } from './incident';
+import { sslTranslations } from './ssl';
+import { settingsTranslations } from './settings';
+
+const enTranslations: Translations = {
+  common: commonTranslations,
+  menu: menuTranslations,
+  login: loginTranslations,
+  about: aboutTranslations,
+  services: servicesTranslations,
+  maintenance: maintenanceTranslations,
+  incident: incidentTranslations,
+  ssl: sslTranslations,
+  settings: settingsTranslations
+};
+
+export default enTranslations;
\ No newline at end of file
diff --git a/application/src/translations/ko/login.ts b/application/src/translations/ko/login.ts
new file mode 100644
index 0000000..31f94f9
--- /dev/null
+++ b/application/src/translations/ko/login.ts
@@ -0,0 +1,24 @@
+
+import { LoginTranslations } from '../types/login';
+
+export const loginTranslations: LoginTranslations = {
+  signInToYourAccount: "계정 로그인",
+  dontHaveAccount: "계정이 없으신가요?",
+  createOne: "계정 생성",
+  signInWithGoogle: "Google로 로그인",
+  orContinueWith: "또는",
+  email: "이메일",
+  password: "비밀번호",
+  forgot: "잊으셨나요?",
+  signIn: "로그인",
+  signingIn: "로그인 중...",
+  loginSuccessful: "로그인 성공",
+  loginSuccessMessage: "성공적으로 로그인되었습니다.",
+  loginFailed: "로그인 실패",
+  authenticationFailed: "인증 실패",
+  invalidCredentials: "유효하지 않은 이메일 또는 비밀번호",
+  bySigningIn: "로그인하면 다음에 동의하게 됩니다:",
+  termsAndConditions: "이용약관",
+  and: "및",
+  privacyPolicy: "개인정보 처리방침",
+};
diff --git a/application/src/translations/ko/maintenance.ts b/application/src/translations/ko/maintenance.ts
new file mode 100644
index 0000000..9b4eb4c
--- /dev/null
+++ b/application/src/translations/ko/maintenance.ts
@@ -0,0 +1,81 @@
+
+import { MaintenanceTranslations } from '../types/maintenance';
+
+export const maintenanceTranslations: MaintenanceTranslations = {
+  scheduledMaintenance: '예정된 유지보수',
+  scheduledMaintenanceDesc: '시스템 및 서비스에 계획된 유지보수 일정을 보고 관리합니다',
+  upcomingMaintenance: '예정',
+  ongoingMaintenance: '진행 중',
+  completedMaintenance: '완료됨',
+  createMaintenanceWindow: '유지보수 생성',
+  totalScheduledHours: '총 예정 시간',
+  maintenanceName: '유지보수 이름',
+  maintenanceStatus: '상태',
+  scheduledStart: '예정 시작',
+  scheduledEnd: '예정 종료',
+  affectedServices: '영향받는 서비스',
+  impact: '영향',
+  minor: '경미',
+  major: '중대',
+  critical: '심각',
+  none: '없음',
+  actions: '작업',
+  scheduled: '예정됨',
+  inprogress: '진행 중',
+  completed: '완료됨',
+  cancelled: '취소됨',
+  markAsInProgress: '진행 중으로 표시',
+  markAsCompleted: '완료로 표시',
+  markAsCancelled: '취소로 표시',
+  confirmDelete: '삭제 확인',
+  deleteMaintenanceConfirmation: '이 유지보수 일정을 삭제하시겠습니까?',
+  thisActionCannotBeUndone: '이 작업은 되돌릴 수 없습니다.',
+  maintenanceDeleted: '유지보수 삭제됨',
+  maintenanceDeletedDesc: '유지보수 일정이 성공적으로 삭제되었습니다.',
+  errorDeletingMaintenance: '유지보수 삭제 중 오류가 발생했습니다.',
+  statusUpdated: '상태 업데이트됨',
+  maintenanceStatusUpdated: '유지보수 상태가 성공적으로 업데이트되었습니다.',
+  errorUpdatingMaintenanceStatus: '유지보수 상태 업데이트 중 오류가 발생했습니다.',
+  createMaintenance: '유지보수 생성',
+  createMaintenanceDesc: '서비스를 위한 새 유지보수 일정을 예약합니다',
+  enterTitle: '유지보수 제목 입력',
+  enterDescription: '유지보수 상세 설명 입력',
+  startTime: '시작 시간',
+  endTime: '종료 시간',
+  selectDate: '날짜 선택',
+  enterAffectedServices: '영향받는 서비스 입력',
+  separateServicesWithComma: '여러 서비스를 콤마로 구분하여 입력',
+  priority: '우선순위',
+  selectPriority: '우선순위 선택',
+  selectStatus: '상태 선택',
+  selectImpact: '영향 선택',
+  notifySubscribers: '구독자에게 알림',
+  notifySubscribersDesc: '유지보수 시작 시 모든 구독자에게 알림 전송',
+  maintenanceCreated: '유지보수 생성됨',
+  maintenanceCreatedDesc: '유지보수 일정이 성공적으로 예약되었습니다.',
+  errorCreatingMaintenance: '유지보수 생성 중 오류 발생',
+  errorFetchingMaintenanceData: '유지보수 데이터 가져오기 중 오류 발생',
+  low: '낮음',
+  medium: '중간',
+  high: '높음',
+  created: '생성됨',
+  lastUpdated: '마지막 업데이트',
+  subscribersWillBeNotified: '유지보수가 시작되면 구독자에게 알림이 전송됩니다',
+  noNotifications: '알림이 전송되지 않습니다',
+  noScheduledMaintenance: '예정된 유지보수 없음',
+  noMaintenanceWindows: '이 기간에 유지보수 일정이 없습니다. "유지보수 생성" 버튼을 클릭하여 새 일정을 생성하세요.',
+  maintenanceCreatedSuccess: '유지보수 일정이 성공적으로 생성되었습니다',
+  editMaintenanceWindow: '유지보수 편집',
+  editMaintenanceDesc: '유지보수 세부정보 편집',
+  priorityDescription: '유지보수 우선순위 선택',
+  statusDescription: '유지보수 상태 선택',
+  impactLevel: '영향 수준',
+  impactLevelDescription: '영향 수준 선택',
+  selectAssignedUsers: '담당 사용자 선택',
+  assignedPersonnelDescription: '현재 할당된 사용자',
+  mutedNotifications: '알림 비활성화됨',
+  notificationsAreMuted: '현재 유지보수 알림이 비활성화되어 있습니다',
+  selectNotificationChannel: '알림 채널 추가',
+  enableNotificationsFirst: '채널을 선택하려면 먼저 알림을 활성화하세요',
+  updateMaintenance: '유지보수 업데이트',
+};
diff --git a/application/src/translations/ko/menu.ts b/application/src/translations/ko/menu.ts
new file mode 100644
index 0000000..a29c5b0
--- /dev/null
+++ b/application/src/translations/ko/menu.ts
@@ -0,0 +1,21 @@
+
+import { MenuTranslations } from '../types/menu';
+
+export const menuTranslations: MenuTranslations = {
+  uptimeMonitoring: "가동 시간 모니터링",
+  instanceMonitoring: "인스턴스 모니터링",
+  sslDomain: "SSL & 도메인",
+  scheduleIncident: "일정 및 인시던트",
+  operationalPage: "운영 페이지",
+  reports: "리포트",
+  regionalMonitoring: "지역 모니터링",
+  settingPanel: "설정 패널",
+  generalSettings: "일반 설정",
+  userManagement: "사용자 관리",
+  notificationSettings: "알림 설정",
+  alertsTemplates: "알림 템플릿",
+  rolesManagement: "권한 관리",
+  dataRetention: "데이터 보존",
+  backupSettings: "백업 설정",
+  aboutSystem: "시스템 정보",
+};
diff --git a/application/src/translations/ko/services.ts b/application/src/translations/ko/services.ts
new file mode 100644
index 0000000..a9b3fa7
--- /dev/null
+++ b/application/src/translations/ko/services.ts
@@ -0,0 +1,89 @@
+
+import { ServicesTranslations } from '../types/services';
+
+export const servicesTranslations: ServicesTranslations = {
+  serviceStatus: "서비스 상태",
+  responseTime: "응답 시간",
+  uptime: "가동 시간",
+  lastChecked: "마지막 확인",
+  noServices: "필터 조건에 맞는 서비스가 없습니다.",
+  currentlyMonitoring: "현재 모니터링 중",
+  retry: "재시도",
+  overview: "개요",
+  newService: "새 서비스",
+  rowsPerPage: "페이지당 행",
+  search: "검색",
+  allTypes: "모든 유형",
+  createNewService: "새 서비스 생성",
+  createNewServiceDesc: "모니터링할 새 서비스의 세부 정보를 입력하세요.",
+
+  serviceName: "서비스 이름",
+  serviceNameDesc: "서비스에 대한 설명적인 이름을 입력하세요",
+
+  checkInterval: "체크 간격",
+  seconds: "초",
+  minute: "분",
+  minutes: "분",
+  hour: "시간",
+  hours: "시간",
+  custom: "사용자 정의",
+  checkIntervalPlaceholder: "초 단위로 간격 입력",
+  backToPresets: "기본값으로 돌아가기",
+  checkIntervalDesc: "서비스 상태를 확인하는 간격",
+  checkIntervalDescCustom: "사용자 정의 간격 입력 (최소 10초)",
+  retryAttempts: "재시도 횟수",
+  attempt: "회",
+  attempts: "회",
+  retryAttemptsDesc: "서비스 다운으로 표시되기 전 재시도 횟수",
+
+  updateService: "서비스 업데이트",
+  createService: "서비스 생성",
+
+  enableNotifications: "알림 활성화",
+  enableNotificationsDesc: "서비스 알림을 활성화하거나 비활성화합니다",
+  notificationChannels: "알림 채널",
+  notificationChannelsEnabledDesc: "서비스 알림 채널 선택",
+  notificationChannelsDesc: "채널을 선택하려면 먼저 알림을 활성화하세요",
+  notificationChannelsPlaceholder: "알림 채널 추가",
+  alertTemplate: "알림 템플릿",
+  alertTemplateLoading: "템플릿 로딩 중...",
+  alertTemplatePlaceholder: "알림 템플릿 선택",
+  alertTemplateEnabledDesc: "알림 메시지용 템플릿 선택",
+  alertTemplateDesc: "템플릿 선택 전 알림을 활성화하세요",
+
+  serviceType: "서비스 유형",
+  serviceTypeHTTPDesc: "HTTP/HTTPS 프로토콜로 웹사이트 및 REST API 모니터링",
+  serviceTypePINGDesc: "PING 프로토콜로 호스트 가용성 모니터링",
+  serviceTypeTCPDesc: "TCP 프로토콜로 TCP 포트 연결 상태 모니터링",
+  serviceTypeDNSDesc: "DNS 해석 모니터링",
+
+  regionalMonitoring: "지역 모니터링",
+  regionalMonitoringDesc: "이 서비스를 지역 모니터링 에이전트에 할당하여 분산 모니터링",
+  regionalAgents: "지역 에이전트",
+  regionalAgentsLoading: "에이전트 로딩 중...",
+  regionalAgentsAvailablePlaceholder: "추가 지역 에이전트 선택...",
+  regionalAgentsAllSelected: "모든 사용 가능한 에이전트 선택됨",
+  regionalAgentsNoAvailable: "사용 가능한 지역 에이전트 없음",
+  regionalAgentsNoOnlineAvailable: "온라인 지역 에이전트 없음",
+  regionalAgentsNotFoundMessage: "온라인 지역 에이전트 없음. 기본 모니터링 사용",
+  regionalAgentsNotSelectedMessage: "지역 에이전트 선택 안됨. 기본 모니터링 사용",
+
+  targetDefault: "대상 URL/호스트",
+  targetDNS: "도메인 이름",
+  targetHTTPDesc: "프로토콜 포함 전체 URL 입력 (http:// 또는 https://)",
+  targetPINGDesc: "호스트 이름 또는 IP 주소 입력",
+  targetTCPDesc: "TCP 연결 테스트용 호스트 이름 또는 IP 입력",
+  targetTCPPortDesc: "TCP 연결 테스트용 포트 번호 입력",
+  targetDNSDesc: "DNS 레코드 모니터링용 도메인 이름 입력 (A, AAAA, MX 등)",
+  targetDefaultDesc: "모니터링 대상 URL 또는 호스트 이름 입력",
+  targetDefaultPlaceholder: "URL 또는 호스트 이름 입력",
+
+  serviceNameRequired: "서비스 이름은 필수입니다",
+  urlDomainHostRequired: "URL/도메인/호스트는 필수입니다",
+  enterValidUrlHostnameDomain: "유효한 URL, 호스트 이름 또는 도메인을 입력하세요",
+
+  upServices: "가동 서비스",
+  downServices: "다운 서비스",
+  pausedServices: "일시정지 서비스",
+  warningServices: "경고 서비스",
+};
diff --git a/application/src/translations/ko/settings.ts b/application/src/translations/ko/settings.ts
new file mode 100644
index 0000000..c8f2fd4
--- /dev/null
+++ b/application/src/translations/ko/settings.ts
@@ -0,0 +1,59 @@
+
+import { SettingsTranslations } from '../types/settings';
+
+export const settingsTranslations: SettingsTranslations = {
+	// General Settings - Tabs
+  systemSettings: "시스템 설정",
+  mailSettings: "메일 설정",
+  
+	// General Settings - System Settings
+  appName: "앱 이름",
+  appURL: "앱 URL",
+  senderName: "발신자 이름",
+  senderEmail: "발신자 이메일 주소",
+  hideControls: "컨트롤 숨기기",
+  
+	// General Settings - Mail Settings
+  smtpSettings: "SMTP 구성",
+  smtpEnabled: "SMTP 활성화",
+  smtpHost: "SMTP 호스트",
+  smtpPort: "SMTP 포트",
+  smtpUsername: "SMTP 사용자 이름",
+  smtpPassword: "SMTP 비밀번호",
+  smtpAuthMethod: "인증 방법",
+  enableTLS: "TLS 활성화",
+  localName: "로컬 이름",
+  
+	// General Settings - Test Email
+  testEmail: "테스트 이메일",
+  sendTestEmail: "테스트 이메일 전송",
+  emailTemplate: "이메일 템플릿",
+  verification: "검증",
+  passwordReset: "비밀번호 재설정",
+  confirmEmailChange: "이메일 변경 확인",
+  otp: "OTP",
+  loginAlert: "로그인 알림",
+  authCollection: "인증 컬렉션",
+  selectCollection: "컬렉션 선택",
+  toEmailAddress: "받는 이메일",
+  enterEmailAddress: "이메일 주소 입력",
+  sending: "전송 중...",
+  
+  // General Settings - Actions and status
+  save: "변경 사항 저장",
+  saving: "저장 중...",
+  settingsUpdated: "설정이 성공적으로 업데이트되었습니다",
+  errorSavingSettings: "설정 저장 중 오류 발생",
+  errorFetchingSettings: "설정 불러오기 중 오류 발생",
+  testConnection: "연결 테스트",
+  testingConnection: "연결 테스트 중...",
+  connectionSuccess: "연결 성공",
+  connectionFailed: "연결 실패",
+
+	// User Management
+  addUser: "사용자 추가",
+  permissionNotice: "권한 안내:",
+  permissionNoticeAddUser: "관리자 계정은 시스템 및 메일 설정을 확인하거나 변경할 수 없습니다. 이 설정은 슈퍼 관리자만 접근 및 수정할 수 있습니다. 시스템 구성 또는 메일 설정 변경이 필요하면 슈퍼 관리자에게 문의하세요.",
+  loadingSettings: "설정 로딩 중...",
+  loadingSettingsError: "설정 로딩 중 오류 발생",
+};
\ No newline at end of file
diff --git a/application/src/translations/ko/ssl.ts b/application/src/translations/ko/ssl.ts
new file mode 100644
index 0000000..d08add2
--- /dev/null
+++ b/application/src/translations/ko/ssl.ts
@@ -0,0 +1,117 @@
+
+import { SSLTranslations } from '../types/ssl';
+
+export const sslTranslations: SSLTranslations = {
+  // Page and section titles
+  sslDomainManagement: "SSL & 도메인 관리",
+  monitorSSLCertificates: "도메인의 SSL 인증서를 모니터링하고 관리",
+  addSSLCertificate: "SSL 인증서 추가",
+  editSSLCertificate: "SSL 인증서 편집",
+  deleteSSLCertificate: "SSL 인증서 삭제",
+  sslCertificateDetails: "SSL 인증서 상세",
+  detailedInfo: "상세 정보",
+  viewDetailedInformation: "상세 정보 보기",
+
+  // Status related
+  valid: "유효",
+  expiringSoon: "곧 만료",
+  expired: "만료됨",
+  pending: "대기 중",
+
+  // Statistics and cards
+  validCertificates: "유효 인증서",
+  expiringSoonCertificates: "곧 만료 인증서",
+  expiredCertificates: "만료 인증서",
+
+  // Form fields
+  domain: "도메인",
+  domainName: "도메인 이름",
+  domainCannotChange: "생성 후 도메인은 변경할 수 없습니다",
+  warningThreshold: "경고 임계값",
+  warningThresholdDays: "경고 임계값(일)",
+  expiryThreshold: "만료 임계값",
+  expiryThresholdDays: "만료 임계값(일)",
+  notificationChannel: "알림 채널",
+  chooseChannel: "알림 채널 선택",
+  whereToSend: "알림 전송 위치",
+  daysBeforeExpiration: "만료 전 경고 받을 일수",
+  daysBeforeCritical: "만료 임박 시 알림 받을 일수",
+  getNotifiedExpiration: "인증서 만료 시 알림 받기",
+  getNotifiedCritical: "인증서 임박 시 알림 받기",
+
+  // Table headers and fields
+  issuer: "발급자",
+  expirationDate: "만료일",
+  daysLeft: "남은 일수",
+  status: "상태",
+  lastNotified: "마지막 알림",
+  actions: "작업",
+  validFrom: "유효 시작",
+  validUntil: "유효 종료",
+  validityDays: "유효 일수",
+  validityPeriod: "유효 기간",
+  organization: "조직",
+  commonName: "공통 이름",
+  serialNumber: "일련번호",
+  algorithm: "알고리즘",
+  subjectAltNames: "대체 이름",
+  subjectAlternativeNames: "대체 이름",
+  resolvedIP: "해결된 IP",
+  issuedTo: "발급 대상",
+  days: "일",
+  
+  // Buttons and actions
+  addDomain: "도메인 추가",
+  refreshAll: "모두 새로고침",
+  cancel: "취소",
+  addCertificate: "인증서 추가",
+  check: "확인",
+  view: "보기",
+  edit: "편집",
+  delete: "삭제",
+  close: "닫기",
+  saveChanges: "변경 사항 저장",
+  updating: "업데이트 중",
+  
+  // Sections in detail view
+  basicInformation: "기본 정보",
+  validity: "유효성",
+  issuerInfo: "발급자 정보",
+  technicalDetails: "기술 세부정보",
+  technicalInformation: "기술 정보",
+  monitoringConfig: "모니터링 구성",
+  monitoringConfiguration: "모니터링 구성",
+  recordInfo: "레코드 정보",
+  certificateDetails: "인증서 상세",
+  
+  // Notifications and messages
+  sslCertificateAdded: "SSL 인증서가 성공적으로 추가되었습니다",
+  sslCertificateUpdated: "SSL 인증서가 성공적으로 업데이트되었습니다",
+  sslCertificateDeleted: "SSL 인증서가 성공적으로 삭제되었습니다",
+  sslCertificateRefreshed: "{domain}의 SSL 인증서가 성공적으로 갱신되었습니다",
+  allCertificatesRefreshed: "총 {count}개의 인증서가 성공적으로 갱신되었습니다",
+  someCertificatesFailed: "{success}개의 인증서 갱신 성공, {failed}개 실패",
+  failedToAddCertificate: "SSL 인증서 추가 실패",
+  failedToLoadCertificates: "SSL 인증서 불러오기 실패",
+  failedToUpdateCertificate: "SSL 인증서 업데이트 실패",
+  failedToDeleteCertificate: "SSL 인증서 삭제 실패",
+  failedToCheckCertificate: "SSL 인증서 확인 실패",
+  noCertificatesToRefresh: "갱신할 인증서 없음",
+  startingRefreshAll: "{count}개의 인증서 갱신 시작",
+  checkingSSLCertificate: "SSL 인증서 확인 중...",
+  deleteConfirmation: "인증서를 삭제하시겠습니까?",
+  deleteWarning: "이 작업은 되돌릴 수 없으며 인증서를 영구적으로 삭제합니다.",
+  
+  // Misc
+  unknown: "알 수 없음",
+  never: "없음",
+  none: "없음",
+  loadingChannels: "채널 로딩 중...",
+  noChannelsFound: "알림 채널 없음",
+  noSSLCertificates: "SSL 인증서 없음",
+  created: "생성됨",
+  lastUpdated: "마지막 업데이트",
+  lastNotification: "마지막 알림",
+  collectionId: "컬렉션 ID",
+  noCertificatesFound: "인증서 없음",
+};
diff --git a/application/src/translations/types/about.ts b/application/src/translations/types/about.ts
new file mode 100644
index 0000000..e2972c1
--- /dev/null
+++ b/application/src/translations/types/about.ts
@@ -0,0 +1,32 @@
+
+export interface AboutTranslations {
+  aboutCheckCle: string;
+  systemDescription: string;
+  systemVersion: string;
+  license: string;
+  mitLicense: string;
+  links: string;
+  viewOnGithub: string;
+  viewDocumentation: string;
+  followOnX: string;
+  joinDiscord: string;
+  quickActions: string;
+  quickActionsDescription: string;
+  quickTips: string;
+  releasedOn: string;
+	updateSchema: string;
+	updateSchemaDesc: string;
+	mergeFieldsLabel: string;
+	importing: string;
+	clickToUpdateSchema: string;
+	importSuccessful: string;
+	importFailed: string;
+	instructions: string;
+	mergeFields: string;
+	instructionsMergeFields: string;
+	instructionsCollections: string;
+	instructionsImportAuth: string;
+	collectionsUpdatedCount: string;
+	collectionsCreatedCount: string;
+	collectionsSkippedCount: string;
+}
diff --git a/application/src/translations/types/common.ts b/application/src/translations/types/common.ts
new file mode 100644
index 0000000..5324bce
--- /dev/null
+++ b/application/src/translations/types/common.ts
@@ -0,0 +1,30 @@
+
+export interface CommonTranslations {
+  welcome: string;
+  logout: string;
+  language: string;
+  english: string;
+  khmer: string;
+  german: string;
+  korean: string;
+  japanese: string;
+  simplifiedChinese: string;
+  goodMorning: string;
+  goodAfternoon: string;
+  goodEvening: string;
+  profile: string;
+  settings: string;
+  documentation: string;
+  notifications: string;
+  close: string;
+  cancel: string;
+  view: string;
+  edit: string;
+  delete: string;
+  status: string;
+  time: string;
+  title: string;
+  description: string;
+  success: string;
+  error: string;
+}
diff --git a/application/src/translations/types/docker.ts b/application/src/translations/types/docker.ts
new file mode 100644
index 0000000..deef128
--- /dev/null
+++ b/application/src/translations/types/docker.ts
@@ -0,0 +1,76 @@
+export interface DockerTranslations {
+  // Tables and headers
+  dockerContainers: string;
+  container: string;
+  status: string;
+  cpuUsage: string;
+  memory: string;
+  disk: string;
+  uptime: string;
+  lastChecked: string;
+  actions: string;
+  searchContainersPlaceholder: string;
+  refresh: string;
+  openMenu: string;
+  viewMetrics: string;
+  viewDetails: string;
+
+  // Status badges and stats
+  running: string;
+  stopped: string;
+  warning: string;
+  unknown: string;
+  totalContainers: string;
+  containersLabel: string;
+
+  // Empty states
+  noContainersFound: string;
+  noContainersRunning: string;
+  tryAdjustSearch: string;
+  startSomeContainers: string;
+
+  // Metrics dialog
+  containerMetricsTitle: string; // e.g., Container Metrics: {name}
+  dockerId: string; // Docker ID
+  loadingMetrics: string;
+  errorLoadingMetrics: string;
+  noMetricsAvailable: string;
+
+  // Time ranges
+  minutes60: string;
+  day1: string;
+  days7: string;
+  month1: string;
+  months3: string;
+
+  // Metric labels
+  used: string;
+  free: string;
+  total: string;
+  usage: string;
+  cpu: string;
+  memoryTitle: string;
+  diskTitle: string;
+  network: string;
+
+  // Charts and series
+  cpuUsagePct: string;
+  cpuUsageVsAvailable: string;
+  cpuAvailablePct: string;
+  ramUsagePct: string;
+  memoryUsageBytes: string;
+  usedMemory: string;
+  totalMemory: string;
+  diskUsagePct: string;
+  diskUsageBytes: string;
+  usedDisk: string;
+  totalDisk: string;
+  networkTraffic: string;
+  networkSpeedKbs: string;
+  rxBytes: string;
+  txBytes: string;
+  rxSpeedKbs: string;
+  txSpeedKbs: string;
+}
+
+
diff --git a/application/src/translations/types/incident.ts b/application/src/translations/types/incident.ts
new file mode 100644
index 0000000..42c983d
--- /dev/null
+++ b/application/src/translations/types/incident.ts
@@ -0,0 +1,63 @@
+
+export interface IncidentTranslations {
+  incidentManagement: string;
+  incidentsManagementDesc: string;
+  unresolvedIncidents: string;
+  resolvedIncidents: string;
+  activeIncidents: string;
+  criticalIssues: string;
+  avgResolutionTime: string;
+  noIncidents: string;
+  createIncident: string;
+  investigating: string;
+  identified: string;
+  monitoring: string;
+  resolved: string;
+  scheduleIncidentManagement: string;
+  incidentName: string;
+  incidentStatus: string;
+  highPriority: string;
+  configurationSettings: string;
+  incidentCreatedSuccess: string;
+  basicInfo: string;
+  serviceId: string;
+  assignedTo: string;
+  unassigned: string;
+  timeline: string;
+  incidentTime: string;
+  resolutionTime: string;
+  systems: string;
+  noSystems: string;
+  impactAnalysis: string;
+  rootCause: string;
+  resolutionSteps: string;
+  lessonsLearned: string;
+  resolutionDetails: string;
+  assignment: string;
+  download: string;
+  downloadPdf: string;
+  print: string;
+  confidentialNote: string;
+  generatedOn: string;
+  enterResolutionSteps: string;
+  enterLessonsLearned: string;
+  editIncident: string;
+  editIncidentDesc: string;
+  updating: string;
+  update: string;
+  create: string;
+  creating: string;
+  configuration: string;
+  failedToUpdateStatus: string;
+  inProgress: string;
+  enterRootCause: string;
+  enterIncidentTitle: string;
+  enterIncidentDescription: string;
+  enterServiceId: string;
+  selectAssignedUser: string;
+  noAssignedUser: string;
+  affectedSystems: string;
+  enterAffectedSystems: string;
+  separateSystemsWithComma: string;
+	createIncidentDesc: string;
+}
diff --git a/application/src/translations/types/index.ts b/application/src/translations/types/index.ts
new file mode 100644
index 0000000..f6b8b31
--- /dev/null
+++ b/application/src/translations/types/index.ts
@@ -0,0 +1,32 @@
+
+import { CommonTranslations } from './common';
+import { MenuTranslations } from './menu';
+import { LoginTranslations } from './login';
+import { AboutTranslations } from './about';
+import { ServicesTranslations } from './services';
+import { MaintenanceTranslations } from './maintenance';
+import { IncidentTranslations } from './incident';
+import { SSLTranslations } from './ssl';
+import { SettingsTranslations } from './settings';
+import { InstanceTranslations } from './instance';
+import { OperationTranslations } from './operation';
+import { RegionTranslations } from './region';
+import { DockerTranslations } from './docker';
+import { PublicTranslations } from './public';
+
+export interface Translations {
+  common: CommonTranslations;
+  menu: MenuTranslations;
+  login: LoginTranslations;
+  about: AboutTranslations;
+  services: ServicesTranslations;
+  maintenance: MaintenanceTranslations;
+  incident: IncidentTranslations;
+  ssl: SSLTranslations;
+  settings: SettingsTranslations;
+  instance: InstanceTranslations;
+  operation: OperationTranslations;
+  region: RegionTranslations;
+  docker: DockerTranslations;
+  public: PublicTranslations;
+}
\ No newline at end of file
diff --git a/application/src/translations/types/instance.ts b/application/src/translations/types/instance.ts
new file mode 100644
index 0000000..d5ef40f
--- /dev/null
+++ b/application/src/translations/types/instance.ts
@@ -0,0 +1,169 @@
+
+export interface InstanceTranslations {
+
+  // InstanceMonitoring.tsx
+  instanceMonitoring: string;
+  describeMonitorInstance: string;
+  addServerAgent: string;
+  errorLoadingServers: string;
+  unableToFetchServerData: string;
+  retry: string;
+
+  // ServerTable.tsx
+  servers: string;
+  loadingServers: string;
+  searchServersPlaceholder: string;
+  noServersFound: string;
+  deleteSelected: string;
+  deleteSelectedConfirmTitle: string;
+  deleteSelectedConfirmDesc: string;
+  selectedCount: string;
+  serversDeleted: string;
+  serversDeletedDesc: string;
+  partialSuccess: string;
+  name: string;
+  status: string;
+  OS: string;
+  IPAddress: string;
+  CPU: string;
+  memory: string;
+  disk: string;
+  uptime: string;
+  lastChecked: string;
+  actions: string;
+  viewServerDetail: string;
+  containerMonitoring: string;
+  resumeMonitoring: string;
+  pauseMonitoring: string;
+  editServer: string;
+  deleteServer: string;
+  deleteServerConfirmTitle: string;
+  deleteServerConfirmDesc: string;
+  cancel: string;
+  deleting: string;
+  delete: string;
+  serverDeleted: string;
+  serverDeletedDesc: string;
+  error: string;
+  deleteServerError: string;
+  serverPaused: string;
+  serverResumed: string;
+  monitoringPaused: string;
+  monitoringResumed: string;
+  pauseServerError: string;
+  resumeServerError: string;
+
+  // ServerStatsCards.tsx
+  totalServers: string;
+  onlineServers: string; 
+  offlineServers: string;
+  warningServers: string;
+
+  // AddServerAgentDialog.tsx
+  addServerMonitoringAgent: string;
+  configureAgentDesc: string;
+  configureAgent: string;
+  oneClickInstall: string;
+  dockerOneClick: string;
+  manualInstallation: string;
+  validationError: string;
+  fillRequiredFields: string;
+  serverAgentCreated: string;
+  serverAgentCreatedDesc: string;
+  failedToCreateAgent: string;
+
+  // ServerAgentConfigForm.tsx
+  serverName: string;
+  serverNamePlaceholder: string;
+  serverNameDesc: string;
+  serverAgentId: string;
+  serverAgentIdDesc: string;
+  operatingSystem: string;
+  checkInterval: string;
+  selectInterval: string;
+  interval30s: string;
+  interval1m: string;
+  interval2m: string;
+  interval5m: string;
+  checkIntervalDesc: string;
+  retryAttempts: string;
+  selectRetryAttempts: string;
+  attempt1: string;
+  attempt2: string;
+  attempt3: string;
+  attempt5: string;
+  retryAttemptsDesc: string;
+  serverToken: string;
+  serverTokenDesc: string;
+  systemUrl: string;
+  systemUrlDesc: string;
+  creatingAgent: string;
+  createServerAgent: string;
+
+  // EditServerDialog.tsx
+  editServerConfiguration: string;
+  serverNameLabel: string;
+  enterServerNamePlaceholder: string;
+  checkIntervalLabel: string;
+  // selectInterval: string;
+  interval10m: string;
+  maxRetriesLabel: string;
+  selectMaxRetries: string;
+  retry1: string;
+  retry2: string;
+  retry3: string;
+  retry5: string;
+  retry10: string;
+  dockerMonitoring: string;
+  enabled: string;
+  disabled: string;
+  enableNotifications: string;
+  notificationSettings: string;
+  notificationChannels: string;
+  loadingChannels: string;
+  noChannelsAvailable: string;
+  selectedChannels: string;
+  serverSetThreshold: string;
+  loadingThresholds: string;
+  selectServerThreshold: string;
+  noThreshold: string;
+  thresholdDetails: string;
+  cpuThresholdPct: string;
+  ramThresholdPct: string;
+  diskThresholdPct: string;
+  networkThresholdPct: string;
+  serverTemplate: string;
+  loadingTemplates: string;
+  selectServerTemplate: string;
+  noTemplate: string;
+  templateDetails: string;
+  ramMessage: string;
+  cpuMessage: string;
+  diskMessage: string;
+  networkMessage: string;
+  upMessage: string;
+  downMessage: string;
+  noMessageDefined: string;
+  serverUpdated: string;
+  serverUpdatedDesc: string;
+  updating: string;
+  updateServer: string;
+  failedToLoadChannels: string;
+  failedToLoadTemplates: string;
+  failedToLoadThresholds: string;
+  warning: string;
+  serverUpdatedButThresholdFailed: string;
+  failedToUpdateServer: string;
+
+  // ServerHistoryCharts.tsx
+  historicalPerformance: string;
+  loading: string;
+  errorLoadingChartData: string;
+  noHistoricalData: string;
+  rawMetricsCount: string;
+  serverIdTimeRange: string;
+  dataExistsOutsideRange: string;
+  noMetricsDataFound: string;
+  dataPointsTimeRange: string;
+
+}
diff --git a/application/src/translations/types/login.ts b/application/src/translations/types/login.ts
new file mode 100644
index 0000000..08dcf35
--- /dev/null
+++ b/application/src/translations/types/login.ts
@@ -0,0 +1,22 @@
+
+export interface LoginTranslations {
+  signInToYourAccount: string;
+  dontHaveAccount: string;
+  createOne: string;
+  signInWithGoogle: string;
+  orContinueWith: string;
+  email: string;
+  password: string;
+  forgot: string;
+  signIn: string;
+  signingIn: string;
+  loginSuccessful: string;
+  loginSuccessMessage: string;
+  loginFailed: string;
+  authenticationFailed: string;
+  invalidCredentials: string;
+  bySigningIn: string;
+  termsAndConditions: string;
+  and: string;
+  privacyPolicy: string;
+}
diff --git a/application/src/translations/types/maintenance.ts b/application/src/translations/types/maintenance.ts
new file mode 100644
index 0000000..8e75bae
--- /dev/null
+++ b/application/src/translations/types/maintenance.ts
@@ -0,0 +1,87 @@
+
+export interface MaintenanceTranslations {
+  scheduledMaintenance: string;
+  scheduledMaintenanceDesc: string;
+  upcomingMaintenance: string;
+  ongoingMaintenance: string;
+  completedMaintenance: string;
+  createMaintenanceWindow: string;
+  totalScheduledHours: string;
+  maintenanceName: string;
+  maintenanceStatus: string;
+  scheduledStart: string;
+  scheduledEnd: string;
+  affectedServices: string;
+  impact: string;
+  minor: string;
+  major: string;
+  critical: string;
+  none: string;
+  actions: string;
+  scheduled: string;
+  inprogress: string;
+  completed: string;
+  cancelled: string;
+  markAsInProgress: string;
+  markAsCompleted: string;
+  markAsCancelled: string;
+  confirmDelete: string;
+  deleteMaintenanceConfirmation: string;
+  thisActionCannotBeUndone: string;
+  maintenanceDeleted: string;
+  maintenanceDeletedDesc: string;
+  errorDeletingMaintenance: string;
+  statusUpdated: string;
+  maintenanceStatusUpdated: string;
+  errorUpdatingMaintenanceStatus: string;
+  createMaintenance: string;
+  createMaintenanceDesc: string;
+  enterTitle: string;
+  enterDescription: string;
+  startTime: string;
+  endTime: string;
+  selectDate: string;
+  enterAffectedServices: string;
+  separateServicesWithComma: string;
+  priority: string;
+  selectPriority: string;
+  selectStatus: string;
+  selectImpact: string;
+  notifySubscribers: string;
+  notifySubscribersDesc: string;
+  maintenanceCreated: string;
+  maintenanceCreatedDesc: string;
+  errorCreatingMaintenance: string;
+  errorFetchingMaintenanceData: string;
+  low: string;
+  medium: string;
+  high: string;
+  created: string;
+  lastUpdated: string;
+  subscribersWillBeNotified: string;
+  noNotifications: string;
+  noScheduledMaintenance: string;
+  noMaintenanceWindows: string;
+  maintenanceCreatedSuccess: string;
+  editMaintenanceWindow: string;
+  editMaintenanceDesc: string;
+  priorityDescription: string;
+  statusDescription: string;
+  impactLevel: string;
+  impactLevelDescription: string;
+  selectAssignedUsers: string;
+  assignedPersonnelDescription: string;
+  mutedNotifications: string;
+  notificationsAreMuted: string;
+  selectNotificationChannel: string;
+  enableNotificationsFirst: string;
+  updateMaintenance: string;
+	loginToViewProfile: string;
+	goToLogin: string;
+	loadingUserData: string;
+	retry: string;
+	loadingServerData: string;
+	retrievingYourInformation: string;
+	servicesPagination: string;
+	servicesPaginationNoService: string;
+}
diff --git a/application/src/translations/types/menu.ts b/application/src/translations/types/menu.ts
new file mode 100644
index 0000000..639f6dc
--- /dev/null
+++ b/application/src/translations/types/menu.ts
@@ -0,0 +1,19 @@
+
+export interface MenuTranslations {
+  uptimeMonitoring: string;
+  instanceMonitoring: string;
+  sslDomain: string;
+  scheduleIncident: string;
+  operationalPage: string;
+  reports: string;
+  regionalMonitoring: string;
+  settingPanel: string;
+  generalSettings: string;
+  userManagement: string;
+  notificationSettings: string;
+  alertsTemplates: string;
+  rolesManagement: string;
+  dataRetention: string;
+  backupSettings: string;
+  aboutSystem: string;
+}
\ No newline at end of file
diff --git a/application/src/translations/types/operation.ts b/application/src/translations/types/operation.ts
new file mode 100644
index 0000000..22bd71f
--- /dev/null
+++ b/application/src/translations/types/operation.ts
@@ -0,0 +1,85 @@
+
+export interface OperationTranslations {
+
+  // OperationalPageContent.tsx
+  failedToLoadOperationalPages: string;
+  loadingoperationalPages: string;
+  tryagain: string;
+  operationalPages: string;
+  describeOperation: string;
+  refresh: string;
+  noOperationalPagesFound: string;
+  createYourFirstOperationalPage: string;
+  totalPages: string;
+  publicPages: string;
+  operational: string;
+  deleteOperationalPage: string;
+  deleteOperationalPageConfirm: string;
+  cancel: string;
+  delete: string;
+  deleting: string;
+
+  // editOperationalPageDialog.tsx
+  editOperationalPage: string;
+  updateYourOperationalPage: string;
+  title: string;
+  myServiceStatusPlaceholder: string;
+  slug: string;
+  myServiceStatusSlugPlaceholder: string;
+  description: string;
+  operationalPageDescriptionPlaceholder: string;
+  theme: string;
+  selectTheme: string;
+  themeDefault: string;
+  themeDark: string;
+  themeLight: string;
+  status: string;
+  selectStatus: string;
+  statusOperational: string;
+  statusDegraded: string;
+  statusMaintenance: string;
+  statusMajorOutage: string;
+  publicPage: string;
+  makePagePublic: string;
+  customDomainOptional: string;
+  customDomainPlaceholder: string;
+  customDomainDescription: string;
+  cancelUpdate: string;
+  updating: string;
+  updatePage: string;
+
+  // ComponentsSelector.tsx
+  statusPageComponents: string;
+  addMonitoringComponentsDesc: string;
+  selectedComponents: string;
+  service: string;
+  server: string;
+  addComponent: string;
+  componentName: string;
+  componentNamePlaceholder: string; 
+  displayOrder: string;
+  descriptionOptional: string;
+  descriptionPlaceholder: string;
+  uptimeServiceOptional: string;
+  selectUptimeService: string;
+  serverIdOptional: string;
+  serverIdPlaceholder: string;
+  cancelComponent : string;
+
+  // OperationalPageCard.tsx
+  public: string;
+  yes: string;
+  no: string;
+  updated: string;
+  view: string;
+  edit: string;
+
+  // CreateOperationalPageDialog.tsx
+  createOperationalPage: string;
+  createOperationalPageDesc: string;
+  createPage: string;
+  creating: string;
+  initialStatus: string;
+
+
+}
\ No newline at end of file
diff --git a/application/src/translations/types/public.ts b/application/src/translations/types/public.ts
new file mode 100644
index 0000000..c4191cf
--- /dev/null
+++ b/application/src/translations/types/public.ts
@@ -0,0 +1,23 @@
+export interface PublicTranslations {
+  // CurrentStatusSection
+  systemStatus: string;
+  allOperational: string;
+  degradedPerformance: string;
+  underMaintenance: string;
+  majorOutage: string;
+  statusUnknown: string;
+  autoUpdatedByHealth: string;
+  lastUpdatedAt: string; // e.g., Last updated: {time} UTC
+  liveStatusMonitoring: string;
+
+  // PublicStatusPage generic
+  loadingStatusPage: string;
+  fetchingRealtimeStatus: string;
+  slugLabel: string; // Slug
+  statusPageNotFound: string;
+  notFoundDescription: string;
+  goBack: string;
+  retry: string;
+}
+
+
diff --git a/application/src/translations/types/region.ts b/application/src/translations/types/region.ts
new file mode 100644
index 0000000..51e731c
--- /dev/null
+++ b/application/src/translations/types/region.ts
@@ -0,0 +1,92 @@
+
+export interface RegionTranslations {
+  
+  // RegionalMonitoringContent.tsx
+  regionalmonitoring: string;
+  descriptRegionPage: string;
+  addRegionalAgent: string;
+  totalAgents: string;
+  regionalMonitoringAgents: string;
+  onlineAgents: string;
+  currentlyConnected: string;
+  offlineAgents: string;
+  disconnectedAgents: string;
+  regionalAgents: string;
+  noRegionalAgents: string;
+  getStartedAddAgent: string;
+  addFirstAgent: string;
+  agentRemoved: string;
+  agentRemovedDesc: string;
+  regionalAgentAdded: string;
+  regionalAgentAddedDesc: string;
+  error: string;
+  failedToRemoveAgent: string;
+
+  // AddRegionalAgentDialog.tsx
+  addRegionalMonitoringAgent: string;
+  deployRegionalMonitoringAgent: string;
+  regionName: string;
+  regionNamePlaceholder: string;
+  agentServerIpAddress: string;
+  agentIpPlaceholder: string;
+  cancel: string;
+  generateInstallation: string;
+  generating: string;
+  agentConfigurationReady: string;
+  oneClickInstallScriptGenerated: string;
+  oneClickInstallTab: string;
+  agentDetailsTab: string;
+  manualInstallTab: string;
+  oneClickAutomaticInstallation: string;
+  completeInstallationDescription: string;
+  whatThisScriptDoes: string;
+  scriptActionDownload: string;
+  scriptActionInstall: string;
+  scriptActionConfigure: string;
+  scriptActionStart: string;
+  scriptActionHealthChecks: string;
+  runCommandOnServer: string;
+  downloadCompleteScript: string;
+  copyFullScript: string;
+  localDevelopmentNotice: string;
+  generatedAgentConfiguration: string;
+  autoConfiguredDuringInstallation: string;
+  agentId: string;
+  regionNameDetail: string;
+  serverIp: string;
+  apiEndpoint: string;
+  authenticationToken: string;
+  configurationFileLocation: string;
+  manualInstallationSteps: string;
+  stepByStepManualInstallation: string;
+  step1DownloadPackage: string;
+  downloadAmd64Notice: string;
+  downloadArm64Notice: string;
+  step2InstallPackage: string;
+  step3ConfigureAgent: string;
+  copySampleConfiguration: string;
+  addConfigurationValues: string;
+  step4StartService: string;
+  step5VerifyInstallation: string;
+  addAnotherAgent: string;
+  completeSetup: string;
+  copied: string;
+  copiedDescription: string;
+  copyFailed: string;
+  copyFailedDescription: string;
+  copyFailedLocalhost: string;
+  copyFailedChrome: string;
+  downloaded: string;
+  downloadedDescription: string;
+  failedToCreateAgent: string;
+
+  // RegionalAgentCard.tsx
+  defaultBadge: string;
+  copyAgentId: string;
+  removeAgent: string;
+  online: string;
+  offline: string;
+  lastUpdated: string;
+  activeMonitoring: string;
+  connectionLost: string;
+}
diff --git a/application/src/translations/types/services.ts b/application/src/translations/types/services.ts
new file mode 100644
index 0000000..55d744c
--- /dev/null
+++ b/application/src/translations/types/services.ts
@@ -0,0 +1,201 @@
+
+export interface ServicesTranslations {
+
+    serviceStatus: string;
+	uptime: string;
+	lastChecked: string;
+	noServices: string;
+	currentlyMonitoring: string;
+	retry: string;
+	overview: string;
+	newService: string;
+	rowsPerPage: string;
+	search: string;
+	allTypes: string;
+	createNewService: string;
+	createNewServiceDesc: string;
+
+	// ServiceBasicFields.tsx
+	serviceName: string;
+	serviceNameDesc: string;
+
+	// ServiceConfigFields.tsx
+	checkInterval: string;
+	seconds: string;
+	minute: string;
+	minutes: string;
+	hour: string;
+	hours: string;
+	custom: string;
+	checkIntervalPlaceholder: string;
+	backToPresets: string;
+	checkIntervalDesc: string;
+	checkIntervalDescCustom: string;
+	retryAttempts: string;
+	attempt: string;
+	attempts: string;
+	retryAttemptsDesc: string;
+
+	// ServiceForm.tsx
+	updateService: string;
+	createService: string;
+
+	// ServiceNotificationFields.tsx
+	enableNotifications: string;
+	enableNotificationsDesc: string;
+	notificationChannels: string;
+	notificationChannelsEnabledDesc: string;
+	notificationChannelsDesc: string;
+	notificationChannelsPlaceholder: string;
+	alertTemplate: string;
+	alertTemplateLoading: string;
+	alertTemplatePlaceholder: string;
+	alertTemplateEnabledDesc: string;
+	alertTemplateDesc: string;
+
+	// ServiceTypeField.tsx
+	serviceType: string;
+	serviceTypeHTTPDesc: string;
+	serviceTypePINGDesc: string;
+	serviceTypeTCPDesc: string;
+	serviceTypeDNSDesc: string;
+
+	// ServiceRegionalFields.tsx
+	regionalMonitoring: string;
+	regionalMonitoringDesc: string;
+	regionalAgents: string;
+	regionalAgentsLoading: string;
+	regionalAgentsAvailablePlaceholder: string;
+	regionalAgentsAllSelected: string;
+	regionalAgentsNoAvailable: string;
+	regionalAgentsNoOnlineAvailable: string;
+	regionalAgentsNotFoundMessage: string;
+	regionalAgentsNotSelectedMessage: string;
+
+	// ServiceUrlField.tsx
+	targetDefault: string;
+	targetDNS: string;
+	targetHTTPDesc: string;
+	targetPINGDesc: string;
+	targetTCPDesc: string;
+	targetTCPPortDesc: string;
+	targetDNSDesc: string;
+	targetDefaultDesc: string;
+	targetDefaultPlaceholder: string;
+
+	// types.ts
+	serviceNameRequired: string;
+	urlDomainHostRequired: string;
+	enterValidUrlHostnameDomain: string;
+	spacesNotAllowed: string;
+
+	// Dashboard
+	upServices: string;
+	downServices: string;
+	pausedServices: string;
+	warningServices: string;
+
+	// ServiceRowActions.tsx
+	viewDetail: string;
+	resumeMonitoring: string;
+	pauseMonitoring: string;
+	unmuteAlerts: string;
+	muteAlerts: string;
+
+	//IncidentTable.tsx
+	responseTime: string;
+	errorMessage: string;
+	details: string;
+
+	//LastCheckedTime.tsx
+	pausedAt: string;
+	lastCheckDetails: string;
+	checkedAt: string;
+	monitoringPaused: string;
+	noAutomaticChecks: string;
+
+	//ServiveEditDialog.tsx
+	editService: string;
+	editServiceDesc: string;
+
+	//ServiceStatsCards.tsx
+	lastCheckedAt: string;
+	avg: string;
+	lastUpChecksCount: string;
+	basedOnlastChecksCount: string;
+	totalUptime: string;
+	totalDowntime: string;
+	monitoringSettings: string;
+	monitoringSettingsInterval: string;
+	monitoringSettingsType: string;
+	upStatusDuration: string;
+	downStatusDuration: string;
+
+	incidentHistory: string;
+	processing: string;
+	back: string;
+	last20Checks: string;
+
+	// OneClickInstallTab.tsx
+	oneClickInstallTitle: string;
+	oneClickInstallDesc: string;
+	quickInstallCommand: string;
+	copy: string;
+	runCommandOnServer: string;
+	sshIntoServer: string;
+	pasteAndRun: string;
+	agentInstalled: string;
+	done: string;
+
+	// DockerOneClickTab.tsx
+	dockerOneClickTitle: string;
+	dockerOneClickDesc: string;
+	dockerOneClickCommand: string;
+	dockerScriptWill: string;
+	dockerScriptStep1: string;
+	dockerScriptStep2: string;
+	dockerScriptStep3: string;
+	dockerScriptStep4: string;
+	directDockerTitle: string;
+	directDockerDesc: string;
+	dockerRunCommand: string;
+	dockerPrerequisites: string;
+	dockerPrereqStep1: string;
+	dockerPrereqStep2: string;
+	dockerPrereqStep3: string;
+
+	// ManualInstallTab.tsx
+	manualInstallTitle: string;
+	manualInstallDesc: string;
+	serverName: string;
+	agentId: string;
+	osType: string;
+	downloadScript: string;
+	makeExecutable: string;
+	runInstall: string;
+	prerequisites: string;
+	prereqRoot: string;
+	prereqCurl: string;
+	prereqInternet: string;
+	afterInstall: string;
+	agentWillStart: string;
+
+	// ServerDetail.tsx
+	errorLoadingServer: string;
+	unableToFetchServerData: string;
+	backToServers: string;
+	loadingServerDetails: string;
+	serverDetail: string;
+	monitorServerMetrics: string;
+	serverHostnameIpOs: string;
+
+	// ContainerMonitoring.tsx
+	errorLoadingContainers: string;
+	unableToFetchContainerData: string;
+	errorUnknown: string;
+	containerMonitoring: string;
+	monitorAndManageContainers: string;
+	serverIdLabel: string;
+
+	
+}
diff --git a/application/src/translations/types/settings.ts b/application/src/translations/types/settings.ts
new file mode 100644
index 0000000..087f799
--- /dev/null
+++ b/application/src/translations/types/settings.ts
@@ -0,0 +1,174 @@
+
+export interface SettingsTranslations {
+	// General Settings - Tabs
+  systemSettings: string;
+  mailSettings: string;
+  
+	// General Settings - System Settings
+  appName: string;
+  appURL: string;
+  senderName: string;
+  senderEmail: string;
+  hideControls: string;
+  
+	// General Settings - Mail Settings
+  smtpSettings?: string;
+  smtpEnabled: string;
+  smtpHost: string;
+  smtpPort: string;
+  smtpUsername: string;
+  smtpPassword: string;
+  smtpAuthMethod: string;
+  enableTLS: string;
+  localName: string;
+
+	// General Settings - Test Email
+  testEmail: string;
+  sendTestEmail: string;
+  emailTemplate: string;
+  verification: string;
+  passwordReset: string;
+  confirmEmailChange: string;
+  otp: string;
+  loginAlert: string;
+  authCollection: string;
+  selectCollection: string;
+  toEmailAddress: string;
+  enterEmailAddress: string;
+	send: string;
+  sending: string;
+	testEmailSettings: string;
+	testEmailDescription: string;
+	testEmailAlert: string;
+
+	// General Settings - Actions and status
+  save: string;
+  saving: string;
+  settingsUpdated: string;
+  errorSavingSettings: string;
+  errorFetchingSettings: string;
+  testConnection: string;
+  testingConnection: string;
+  connectionSuccess: string;
+  connectionFailed: string;
+
+  // User Management
+	addUser: string;
+	permissionNotice: string;
+	permissionNoticeAddUser: string;
+	loadingSettings: string;
+	loadingSettingsError: string;
+
+  //NotificationSettings.ts
+  titleNotification: string;
+  descriptionChannelsServices: string;
+  addChannel: string;
+  all: string;
+  telegram: string;
+  discord: string;
+  slack: string;
+  signal: string;
+  googleChat: string;
+  email: string;
+  webhook: string;
+  matrix: string;
+
+  // NotificationChannelDialog.tsx
+  editChannel: string;
+  addChannelDialog: string;
+  channelName: string;
+  channelNameDesc: string;
+  channelType: string;
+  selectType: string;
+  enabled: string;
+  enabledDesc: string;
+  cancel: string;
+  updateChannel: string;
+  createChannel: string;
+  payloadTemplates: string;
+  availablePlaceholders: string;
+  server: string;
+  service: string;
+  ssl: string;
+  common: string;
+  webhookUrl: string;
+  webhookUrlDesc: string;
+  payloadTemplate: string;
+  payloadTemplateDesc: string;
+  telegramChatId: string;
+  telegramChatIdDesc: string;
+  botToken: string;
+  botTokenDesc: string;
+  discordWebhookUrl: string;
+  discordWebhookUrlDesc: string;
+  slackWebhookUrl: string;
+  slackWebhookUrlDesc: string;
+  signalNumber: string;
+  signalNumberDesc: string;
+  signalApiEndpoint: string;
+  signalApiEndpointDesc: string;
+  googleChatWebhookUrl: string;
+  googleChatWebhookUrlDesc: string;
+  emailAddress: string;
+  emailAddressDesc: string;
+  emailSenderName: string;
+  emailSenderNameDesc: string;
+  smtpServer: string;
+  // smtpPort: string;
+  // smtpPassword: string;
+  smtpPasswordDesc: string;
+  ntfyEndpoint: string;
+  ntfyEndpointDesc: string;
+  apiToken: string;
+  apiTokenOptional: string;
+  apiTokenDesc: string;
+  pushoverUserKey: string;
+  pushoverUserKeyDesc: string;
+  notifiarrChannelId: string;
+  notifiarrChannelIdDesc: string;
+  gotifyServerUrl: string;
+  gotifyServerUrlDesc: string;
+  matrixHomeserver: string;
+  matrixHomeserverDesc: string;
+  matrixRoomId: string;
+  matrixRoomIdDesc: string;
+  matrixAccessToken: string;
+  matrixAccessTokenDesc: string;
+  errorSaveChannel: string;
+
+  channelNamePlaceholder: string;
+  telegramChatIdPlaceholder: string;
+  botTokenPlaceholder: string;
+  discordWebhookUrlPlaceholder: string;
+  slackWebhookUrlPlaceholder: string;
+  signalNumberPlaceholder: string;
+  signalApiEndpointPlaceholder: string;
+  googleChatWebhookUrlPlaceholder: string;
+  emailAddressPlaceholder: string;
+  emailSenderNamePlaceholder: string;
+  smtpServerPlaceholder: string;
+  smtpPortPlaceholder: string;
+  smtpPasswordPlaceholder: string;
+  ntfyEndpointPlaceholder: string;
+  apiTokenPlaceholder: string;
+  pushoverUserKeyPlaceholder: string;
+  notifiarrChannelIdPlaceholder: string;
+  gotifyServerUrlPlaceholder: string;
+  webhookUrlPlaceholder: string;
+  matrixHomeserverPlaceholder: string;
+  matrixRoomIdPlaceholder: string;
+  matrixAccessTokenPlaceholder: string;
+
+  // DataRetentionSettings.tsx
+  // permissionNotice: string;
+  permissionNoticeDataRetention: string;
+  loadingRetentionSettings: string;
+  dataRetention: string;
+  dataRetentionDescription: string;
+  uptimeRetentionLabel: string;
+  uptimeRetentionHelp: string;
+  serverRetentionLabel: string;
+  serverRetentionHelp: string;
+  lastCleanup: string;
+  // save: string;
+}
\ No newline at end of file
diff --git a/application/src/translations/types/ssl.ts b/application/src/translations/types/ssl.ts
new file mode 100644
index 0000000..ac1f376
--- /dev/null
+++ b/application/src/translations/types/ssl.ts
@@ -0,0 +1,116 @@
+
+export interface SSLTranslations {
+  // Page and section titles
+  sslDomainManagement: string;
+  monitorSSLCertificates: string;
+  addSSLCertificate: string;
+  editSSLCertificate: string;
+  deleteSSLCertificate: string;
+  sslCertificateDetails: string;
+  detailedInfo: string;
+  viewDetailedInformation: string;
+
+  // Status related
+  valid: string;
+  expiringSoon: string;
+  expired: string;
+  pending: string;
+
+  // Statistics and cards
+  validCertificates: string;
+  expiringSoonCertificates: string;
+  expiredCertificates: string;
+
+  // Form fields
+  domain: string;
+  domainName: string;
+  domainCannotChange: string;
+  warningThreshold: string;
+  warningThresholdDays: string;
+  expiryThreshold: string;
+  expiryThresholdDays: string;
+  notificationChannel: string;
+  chooseChannel: string;
+  whereToSend: string;
+  daysBeforeExpiration: string;
+  daysBeforeCritical: string;
+  getNotifiedExpiration: string;
+  getNotifiedCritical: string;
+
+  // Table headers and fields
+  issuer: string;
+  expirationDate: string;
+  daysLeft: string;
+  status: string;
+  lastNotified: string;
+  actions: string;
+  validFrom: string;
+  validUntil: string;
+  validityDays: string;
+  validityPeriod: string;
+  organization: string;
+  commonName: string;
+  serialNumber: string;
+  algorithm: string;
+  subjectAltNames: string;
+  subjectAlternativeNames: string;
+  resolvedIP: string;
+  issuedTo: string;
+  days: string;
+  
+  // Buttons and actions
+  addDomain: string;
+  refreshAll: string;
+  cancel: string;
+  addCertificate: string;
+  check: string;
+  view: string;
+  edit: string;
+  delete: string;
+  close: string;
+  saveChanges: string;
+  updating: string;
+  
+  // Sections in detail view
+  basicInformation: string;
+  validity: string;
+  issuerInfo: string;
+  technicalDetails: string;
+  technicalInformation: string;
+  monitoringConfig: string;
+  monitoringConfiguration: string;
+  recordInfo: string;
+  certificateDetails: string;
+  
+  // Notifications and messages
+  sslCertificateAdded: string;
+  sslCertificateUpdated: string;
+  sslCertificateDeleted: string;
+  sslCertificateRefreshed: string;
+  allCertificatesRefreshed: string;
+  someCertificatesFailed: string;
+  failedToAddCertificate: string;
+  failedToLoadCertificates: string;
+  failedToUpdateCertificate: string;
+  failedToDeleteCertificate: string;
+  failedToCheckCertificate: string;
+  noCertificatesToRefresh: string;
+  startingRefreshAll: string;
+  checkingSSLCertificate: string;
+  deleteConfirmation: string;
+  deleteWarning: string;
+  
+  // Misc
+  unknown: string;
+  never: string;
+  none: string;
+  loadingChannels: string;
+  noChannelsFound: string;
+  noSSLCertificates: string;
+  created: string;
+  lastUpdated: string;
+  lastNotification: string;
+  collectionId: string;
+  noCertificatesFound: string;
+  spacesNotAllowed: string;
+}
\ No newline at end of file
diff --git a/application/src/translations/zhcn/about.ts b/application/src/translations/zhcn/about.ts
new file mode 100644
index 0000000..5e0d3de
--- /dev/null
+++ b/application/src/translations/zhcn/about.ts
@@ -0,0 +1,34 @@
+
+import { AboutTranslations } from '../types/about';
+
+export const aboutTranslations: AboutTranslations = {
+  aboutCheckCle: "关于 Checkcle",
+  systemDescription: "Checkcle 是一个开源监控平台，可提供有关服务器和服务健康状况的实时洞察、事件管理以及透明化运营。以 MIT 许可证发布。",
+  systemVersion: "系统版本",
+  license: "许可证",
+  mitLicense: "MIT 许可证",
+  links: "链接",
+  viewOnGithub: "在 GitHub 上查看",
+  viewDocumentation: "查看文档",
+  followOnX: "在 X 上关注",
+  joinDiscord: "加入 Discord",
+  quickActions: "快速操作",
+  quickActionsDescription: "快速访问常用的监控操作和功能。选择下面的操作开始。",
+  quickTips: "快速提示",
+  releasedOn: "发布于",
+	updateSchema: "更新架构",
+	updateSchemaDesc: "自动导入集合架构",
+	mergeFieldsLabel: "合并字段到现有集合（安全 - 保留数据）",
+	importing: "导入中...",
+	clickToUpdateSchema: "点击更新架构",
+	importSuccessful: "导入成功",
+	importFailed: "导入失败",
+	instructions: "说明",
+	mergeFields: "合并字段",
+	instructionsMergeFields: "安全地向现有集合添加新字段，保留所有数据",
+	instructionsCollections: "系统集合（以_开头的）和用户集合将被自动跳过",
+	instructionsImportAuth: "只有经过身份验证的管理员才能执行架构导入",
+	collectionsUpdatedCount: "已更新 {count} 个集合",
+	collectionsCreatedCount: "已创建 {count} 个集合",
+	collectionsSkippedCount: "已跳过 {count} 个集合",
+};
diff --git a/application/src/translations/zhcn/common.ts b/application/src/translations/zhcn/common.ts
new file mode 100644
index 0000000..7d30a2e
--- /dev/null
+++ b/application/src/translations/zhcn/common.ts
@@ -0,0 +1,32 @@
+
+import { CommonTranslations } from '../types/common';
+
+export const commonTranslations: CommonTranslations = {
+  welcome: "欢迎",
+  logout: "注销",
+  language: "语言",
+  english: "Englisch",
+  khmer: "ភាសាខ្មែរ",
+  german: "Deutsch",
+  korean: "한국어",
+  japanese: "日本語",
+  simplifiedChinese: "简体中文",
+  goodMorning: "早上好",
+  goodAfternoon: "下午好",
+  goodEvening: "晚上好",
+  profile: "个人资料",
+  settings: "设置",
+  documentation: "文档",
+  notifications: "通知",
+  close: "关闭",
+  cancel: "取消",
+  view: "查看",
+  edit: "编辑",
+  delete: "删除",
+  status: "状态",
+  time: "时间",
+  title: "标题",
+  description: "描述",
+  success: "成功",
+  error: "错误",
+};
diff --git a/application/src/translations/zhcn/incident.ts b/application/src/translations/zhcn/incident.ts
new file mode 100644
index 0000000..dc5a838
--- /dev/null
+++ b/application/src/translations/zhcn/incident.ts
@@ -0,0 +1,65 @@
+
+import { IncidentTranslations } from '../types/incident';
+
+export const incidentTranslations: IncidentTranslations = {
+  incidentManagement: '事件管理',
+  incidentsManagementDesc: '跟踪和管理服务事件及其解决方案',
+  unresolvedIncidents: '未解决',
+  resolvedIncidents: '已解决',
+  activeIncidents: '活动事件',
+  criticalIssues: '关键问题',
+  avgResolutionTime: '平均解决时间',
+  noIncidents: '没有活动事件',
+  createIncident: '创建事件',
+  investigating: '调查中',
+  identified: '已识别',
+  monitoring: '监控',
+  resolved: '已解决',
+  scheduleIncidentManagement: '计划与事件管理',
+  incidentName: '事件名称',
+  incidentStatus: '事件状态',
+  highPriority: '高优先级',
+  configurationSettings: '配置设置',
+  incidentCreatedSuccess: '事件创建成功',
+  basicInfo: '基本信息',
+  serviceId: '服务 ID',
+  assignedTo: '分配给',
+  unassigned: '未分配',
+  timeline: '时间线',
+  incidentTime: '事件时间',
+  resolutionTime: '解决时间',
+  systems: '系统',
+  noSystems: '没有受影响的系统',
+  impactAnalysis: '影响分析',
+  rootCause: '根本原因',
+  resolutionSteps: '解决步骤',
+  lessonsLearned: '经验',
+  resolutionDetails: '解决详情',
+  assignment: '分配',
+  download: '下载',
+  downloadPdf: '下载 PDF',
+  print: '打印',
+  confidentialNote: '此文档为机密文件，仅供内部使用。',
+  generatedOn: '生成时间',
+  enterResolutionSteps: '输入解决此事件的步骤',
+  enterLessonsLearned: '输入从此事件中学到的经验',
+  editIncident: '编辑事件',
+  editIncidentDesc: '更新此事件的详细信息',
+  updating: '更新中...',
+  update: '更新',
+  create: '创建',
+  creating: '创建中...',
+  configuration: '配置',
+  failedToUpdateStatus: '更新状态失败',
+  inProgress: '进行中',
+  enterRootCause: '输入故障根源',
+	enterIncidentTitle: '输入事件标题',
+  enterIncidentDescription: '输入事件描述',
+  enterServiceId: '输入以逗号分隔的服务ID',
+  selectAssignedUser: '选择分配用户',
+  noAssignedUser: '该事件当前未分配给任何用户',
+  affectedSystems: '受影响系统',
+  enterAffectedSystems: '受影响系统',
+  separateSystemsWithComma: '输入受影响的系统，以逗号分隔',
+	createIncidentDesc: '创建一个新的事件',
+};
diff --git a/application/src/translations/zhcn/index.ts b/application/src/translations/zhcn/index.ts
new file mode 100644
index 0000000..93397fc
--- /dev/null
+++ b/application/src/translations/zhcn/index.ts
@@ -0,0 +1,25 @@
+
+import { Translations } from '../types';
+import { commonTranslations } from './common';
+import { menuTranslations } from './menu';
+import { loginTranslations } from './login';
+import { aboutTranslations } from './about';
+import { servicesTranslations } from './services';
+import { maintenanceTranslations } from './maintenance';
+import { incidentTranslations } from './incident';
+import { sslTranslations } from './ssl';
+import { settingsTranslations } from './settings';
+
+const zhcnTranslations: Translations = {
+  common: commonTranslations,
+  menu: menuTranslations,
+  login: loginTranslations,
+  about: aboutTranslations,
+  services: servicesTranslations,
+  maintenance: maintenanceTranslations,
+  incident: incidentTranslations,
+  ssl: sslTranslations,
+  settings: settingsTranslations
+};
+
+export default zhcnTranslations;
diff --git a/application/src/translations/zhcn/login.ts b/application/src/translations/zhcn/login.ts
new file mode 100644
index 0000000..72ee713
--- /dev/null
+++ b/application/src/translations/zhcn/login.ts
@@ -0,0 +1,24 @@
+
+import { LoginTranslations } from '../types/login';
+
+export const loginTranslations: LoginTranslations = {
+  signInToYourAccount: "登录您的账号",
+  dontHaveAccount: "没有账号？",
+  createOne: "创建一个",
+  signInWithGoogle: "使用 Google 登录",
+  orContinueWith: "或",
+  email: "邮箱",
+  password: "密码",
+  forgot: "忘记密码？",
+  signIn: "登录",
+  signingIn: "登录中...",
+  loginSuccessful: "登录成功",
+  loginSuccessMessage: "您已成功登录。",
+  loginFailed: "登录失败",
+  authenticationFailed: "身份验证失败",
+  invalidCredentials: "邮箱或密码无效",
+  bySigningIn: "通过登录，您同意我们的",
+  termsAndConditions: "条款与条件",
+  and: "和",
+  privacyPolicy: "隐私政策",
+};
diff --git a/application/src/translations/zhcn/maintenance.ts b/application/src/translations/zhcn/maintenance.ts
new file mode 100644
index 0000000..3568711
--- /dev/null
+++ b/application/src/translations/zhcn/maintenance.ts
@@ -0,0 +1,89 @@
+
+import { MaintenanceTranslations } from '../types/maintenance';
+
+export const maintenanceTranslations: MaintenanceTranslations = {
+  scheduledMaintenance: '计划维护',
+  scheduledMaintenanceDesc: '查看和管理您系统和服务的计划维护窗口',
+  upcomingMaintenance: '计划中',
+  ongoingMaintenance: '进行中',
+  completedMaintenance: '已完成',
+  createMaintenanceWindow: '创建维护',
+  totalScheduledHours: '总计划小时',
+  maintenanceName: '维护名称',
+  maintenanceStatus: '状态',
+  scheduledStart: '计划开始时间',
+  scheduledEnd: '计划结束时间',
+  affectedServices: '受影响的服务',
+  impact: '影响',
+  minor: '次要',
+  major: '主要',
+  critical: '关键',
+  none: '无',
+  actions: '操作',
+  scheduled: '计划',
+  inprogress: '进行中',
+  completed: '已完成',
+  cancelled: '已取消',
+  markAsInProgress: '标记为进行中',
+  markAsCompleted: '标记为已完成',
+  markAsCancelled: '标记为已取消',
+  confirmDelete: '确认删除',
+  deleteMaintenanceConfirmation: '您确定要删除此维护窗口吗？',
+  thisActionCannotBeUndone: '此操作无法撤销。',
+  maintenanceDeleted: '维护已删除',
+  maintenanceDeletedDesc: '维护窗口已成功删除。',
+  errorDeletingMaintenance: '删除维护窗口时出错。',
+  statusUpdated: '状态更新',
+  maintenanceStatusUpdated: '维护状态已成功更新。',
+  errorUpdatingMaintenanceStatus: '更新维护状态时出错。',
+  createMaintenance: '创建维护',
+  createMaintenanceDesc: '为您的服务计划新的维护窗口',
+  enterTitle: '输入维护标题',
+  enterDescription: '输入详细的维护描述',
+  startTime: '开始时间',
+  endTime: '结束时间',
+  selectDate: '选择日期',
+  enterAffectedServices: '输入受影响的服务',
+  separateServicesWithComma: '用逗号分隔多个服务',
+  priority: '优先级',
+  selectPriority: '选择优先级',
+  selectStatus: '选择状态',
+  selectImpact: '选择影响',
+  notifySubscribers: '通知订阅者',
+  notifySubscribersDesc: '当此维护开始时，向所有订阅者发送通知',
+  maintenanceCreated: '创建维护',
+  maintenanceCreatedDesc: '维护窗口已成功计划。',
+  errorCreatingMaintenance: '创建维护窗口时出错。',
+  errorFetchingMaintenanceData: '获取维护数据时出错。',
+  low: '低',
+  medium: '中',
+  high: '高',
+  created: '创建',
+  lastUpdated: '最后更新',
+  subscribersWillBeNotified: '订阅者将在维护开始时收到通知',
+  noNotifications: '不会发送通知',
+  noScheduledMaintenance: '没有计划的维护',
+  noMaintenanceWindows: '没有此时间段的维护窗口。通过点击“创建维护”按钮创建一个。',
+  maintenanceCreatedSuccess: '维护窗口创建成功',
+	editMaintenanceWindow: '编辑维护',
+  editMaintenanceDesc: '编辑维护详情',
+  priorityDescription: '选择维护优先级',
+  statusDescription: '选择维护状态',
+  impactLevel: '影响级别',
+  impactLevelDescription: '选择影响级别',
+  selectAssignedUsers: '选择分配的用户',
+  assignedPersonnelDescription: '当前分配的用户',
+  mutedNotifications: '通知已禁用',
+  notificationsAreMuted: '此维护期间的通知当前已静音',
+  selectNotificationChannel: '添加通知渠道',
+  enableNotificationsFirst: '首先启用通知以选择频道',
+  updateMaintenance: '更新维护',
+	loginToViewProfile: '请登录查看您的个人资料',
+	goToLogin: '立即登录',
+	loadingUserData: '正在加载用户数据...',
+	retry: '重试',
+	loadingServerData: '正在加载服务器数据...',
+	retrievingYourInformation: '正在获取您的信息，请稍候...',
+	servicesPagination: '{startItem}-{endItem}, 共 {totalItems} 个服务',
+	servicesPaginationNoService: '0 服务',
+};
diff --git a/application/src/translations/zhcn/menu.ts b/application/src/translations/zhcn/menu.ts
new file mode 100644
index 0000000..0962799
--- /dev/null
+++ b/application/src/translations/zhcn/menu.ts
@@ -0,0 +1,21 @@
+
+import { MenuTranslations } from '../types/menu';
+
+export const menuTranslations: MenuTranslations = {
+  uptimeMonitoring: "在线监控",
+  instanceMonitoring: "实例监控",
+  sslDomain: "SSL & 域名",
+  scheduleIncident: "计划与事件",
+  operationalPage: "运营页面",
+  reports: "报告",
+  regionalMonitoring: "区域监控",
+  settingPanel: "设置面板",
+  generalSettings: "一般设置",
+  userManagement: "用户管理",
+  notificationSettings: "通知设置",
+  alertsTemplates: "警报模板",
+  rolesManagement: "角色管理",
+  dataRetention: "数据保留",
+  backupSettings: "备份设置",
+  aboutSystem: "关于系统",
+};
diff --git a/application/src/translations/zhcn/services.ts b/application/src/translations/zhcn/services.ts
new file mode 100644
index 0000000..f7ba25a
--- /dev/null
+++ b/application/src/translations/zhcn/services.ts
@@ -0,0 +1,138 @@
+
+import { ServicesTranslations } from '../types/services';
+
+export const servicesTranslations: ServicesTranslations = {
+  serviceStatus: "服务状态",
+  uptime: "在线时间",
+  lastChecked: "最后检查时间",
+  noServices: "没有符合您筛选条件的服务。",
+  currentlyMonitoring: "当前监控",
+  retry: "重试",
+  overview: "概览",
+  newService: "新增服务",
+  rowsPerPage: "每页行数",
+  search: "搜索",
+  allTypes: "所有类型",
+  createNewService: "添加新服务",
+  createNewServiceDesc: "填写详细信息以创建要监控的新服务。",
+
+	// ServiceBasicFields.tsx
+	serviceName: "服务名称",
+	serviceNameDesc: "为你的服务输入一个描述性名称",
+
+	// ServiceConfigFields.tsx
+	checkInterval: "检查间隔",
+	seconds: "秒",
+	minute: "分钟",
+	minutes: "分钟",
+	hour: "小时",
+	hours: "小时",
+	custom: "自定义",
+	checkIntervalPlaceholder: "输入间隔时间（秒）",
+	backToPresets: "回到预设",
+	checkIntervalDesc: "多久检查一次服务状态",
+	checkIntervalDescCustom: "输入自定义间隔时间（以秒为单位，最小10秒）",
+	retryAttempts: "重试次数",
+	attempt: "次",
+	attempts: "次",
+	retryAttemptsDesc: "在标记为下线之前重试的次数",
+
+	// ServiceForm.tsx
+	updateService: "更新服务",
+	createService: "创建服务",
+
+	// ServiceNotificationFields.tsx
+	enableNotifications: "启用通知",
+	enableNotificationsDesc: "为本服务启用或禁用通知",
+	notificationChannels: "通知渠道",
+	notificationChannelsEnabledDesc: "为本服务选择通知渠道",
+	notificationChannelsDesc: "先启用通知以选择渠道",
+	notificationChannelsPlaceholder: "添加一个通知渠道",
+	alertTemplate: "警报模板",
+	alertTemplateLoading: "正在加载模板...",
+	alertTemplatePlaceholder: "选择一个警报模板",
+	alertTemplateEnabledDesc: "选择一个警报消息的模板",
+	alertTemplateDesc: "先启用通知才能选择模板",
+
+	// ServiceTypeField.tsx
+	serviceType: "服务类型",
+	serviceTypeHTTPDesc: "使用 HTTP/HTTPS 协议监控网站和 RESTAPI",
+	serviceTypePINGDesc: "使用 PING 协议监控主机可用性",
+	serviceTypeTCPDesc: "使用 TCP 协议监控 TCP 端口连接性",
+	serviceTypeDNSDesc: "监控 DNS 解析",
+
+	// ServiceRegionalFields.tsx
+	regionalMonitoring: "区域监控",
+	regionalMonitoringDesc: "将此服务分配给区域监控代理以进行分布式监控",
+	regionalAgents: "区域代理",
+	regionalAgentsLoading: "加载代理中...",
+	regionalAgentsAvailablePlaceholder: "选择额外的区域代理...",
+	regionalAgentsAllSelected: "已选择所有可用代理",
+	regionalAgentsNoAvailable: "无可用区域代理",
+	regionalAgentsNoOnlineAvailable: "无可用在线区域代理",
+	regionalAgentsNotFoundMessage: "未找到在线区域代理。服务将使用默认监控。",
+	regionalAgentsNotSelectedMessage: "未选择区域代理。服务将使用默认监控。",
+
+	// ServiceUrlField.tsx
+	targetDefault: "目标 URL/Host",
+	targetDNS: "域名",
+	targetHTTPDesc: "输入完整的 URL，包括协议（http:// 或 https://）",
+	targetPINGDesc: "输入要 ping 的主机名或 IP 地址",
+	targetTCPDesc: "输入主机名或 IP 地址以进行 TCP 连接测试",
+	targetTCPPortDesc: "输入用于 TCP 连接测试的端口号",
+	targetDNSDesc: "输入要监控的 DNS 记录域名（A、AAAA、MX等）",
+	targetDefaultDesc: "输入要监控的目标 URL 或主机名",
+	targetDefaultPlaceholder: "输入 URL 或主机名",
+
+	// types.ts
+	serviceNameRequired: "服务名称是必填项",
+	urlDomainHostRequired: "URL/域名/主机名是必填项",
+	enterValidUrlHostnameDomain: "请输入有效的URL、主机名或域名",
+
+	// Dashboard
+	upServices: "在线服务",
+	downServices: "下线服务",
+	pausedServices: "暂停服务",
+	warningServices: "告警服务",
+
+	// ServiceRowActions.tsx
+	viewDetail: "查看详情",
+	resumeMonitoring: "恢复监控",
+	pauseMonitoring: "暂停监控",
+	unmuteAlerts: "取消静音警报",
+	muteAlerts: "静音警报",
+
+	//IncidentTable.tsx
+	responseTime: "响应时间",
+	errorMessage: "错误信息",
+	details: "详情",
+
+	//LastCheckedTime.tsx
+	pausedAt: "暂停于 ",
+	lastCheckDetails: "最近检查详情",
+	checkedAt: "检查于 ",
+	monitoringPaused: "监控已暂停",
+	noAutomaticChecks: "无自动检查",
+
+	//ServiveEditDialog.tsx
+	editService: "编辑服务",
+	editServiceDesc: "更新您所监控服务的详细信息。",
+
+	//ServiceStatsCards.tsx
+	lastCheckedAt: "最新检查时间 {datetime}",
+	avg: "平均",
+	lastUpChecksCount: "最近 {count} 次检查",
+	basedOnlastChecksCount: "基于最近的 {count} 次检查",
+	totalUptime: "总在线时间",
+	totalDowntime: "总宕机时间",
+	monitoringSettings: "监控设置",
+	monitoringSettingsInterval: "每 {interval} 秒检查一次",
+	monitoringSettingsType: "监控",
+	upStatusDuration: "已在线 {duration}",
+	downStatusDuration: "已宕机 {duration}",
+
+	incidentHistory: "事件历史",
+	processing: "处理中",
+	back: "返回",
+	last20Checks: "最近 20 次检查",
+};
\ No newline at end of file
diff --git a/application/src/translations/zhcn/settings.ts b/application/src/translations/zhcn/settings.ts
new file mode 100644
index 0000000..f5544aa
--- /dev/null
+++ b/application/src/translations/zhcn/settings.ts
@@ -0,0 +1,63 @@
+
+import { SettingsTranslations } from '../types/settings';
+
+export const settingsTranslations: SettingsTranslations = {
+	// General Settings - Tabs
+  systemSettings: "系统设置",
+  mailSettings: "邮件设置",
+  
+	// General Settings - System Settings
+  appName: "应用名称",
+  appURL: "应用 URL",
+  senderName: "发送者名称",
+  senderEmail: "发送者邮箱地址",
+  hideControls: "隐藏控件",
+  
+	// General Settings - Mail Settings
+  smtpSettings: "SMTP 配置",
+  smtpEnabled: "启用 SMTP",
+  smtpHost: "SMTP 主机",
+  smtpPort: "SMTP 端口",
+  smtpUsername: "SMTP 用户名",
+  smtpPassword: "SMTP 密码",
+  smtpAuthMethod: "认证方法",
+  enableTLS: "启用 TLS",
+  localName: "本地名称",
+  
+	// General Settings - Test Email
+  testEmail: "测试邮箱",
+  sendTestEmail: "发送测试邮箱",
+  emailTemplate: "邮箱模板",
+  verification: "验证",
+  passwordReset: "密码重置",
+  confirmEmailChange: "确认邮箱变更",
+  otp: "OTP",
+  loginAlert: "登录警报",
+  authCollection: "认证集合",
+  selectCollection: "选择集合",
+  toEmailAddress: "收件人邮箱地址",
+  enterEmailAddress: "输入收件人邮箱地址",
+	send: "发送",
+  sending: "发送中...",
+	testEmailSettings: "测试邮箱配置",
+	testEmailDescription: "测试当前的邮箱设置是否可用",
+	testEmailAlert: "这将使用您配置的SMTP设置发送一封测试邮件。请确保SMTP已正确配置。",
+
+	// General Settings - Actions and status
+  save: "保存变更",
+  saving: "保存中...",
+  settingsUpdated: "设置已成功更新",
+  errorSavingSettings: "保存设置时出错",
+  errorFetchingSettings: "加载设置时出错",
+  testConnection: "测试连接",
+  testingConnection: "测试连接中...",
+  connectionSuccess: "连接成功",
+  connectionFailed: "连接失败",
+
+	// User Management
+	addUser: "添加用户",
+	permissionNotice: "权限问题：",
+	permissionNoticeAddUser: "作为管理员用户，您无权查看或修改系统及邮件设置。这些设置仅超级管理员可访问和修改。如需更改系统配置或邮件设置，请联系您的超级管理员。",
+	loadingSettings: "加载设置中...",
+	loadingSettingsError: "加载设置时出错",
+};
\ No newline at end of file
diff --git a/application/src/translations/zhcn/ssl.ts b/application/src/translations/zhcn/ssl.ts
new file mode 100644
index 0000000..af4f7ae
--- /dev/null
+++ b/application/src/translations/zhcn/ssl.ts
@@ -0,0 +1,117 @@
+
+import { SSLTranslations } from '../types/ssl';
+
+export const sslTranslations: SSLTranslations = {
+  // Page and section titles
+  sslDomainManagement: "SSL & 域名管理",
+  monitorSSLCertificates: "监控和管理您的域名的 SSL 证书",
+  addSSLCertificate: "添加 SSL 证书",
+  editSSLCertificate: "编辑 SSL 证书",
+  deleteSSLCertificate: "删除 SSL 证书",
+  sslCertificateDetails: "SSL 证书详情",
+  detailedInfo: "关于",
+  viewDetailedInformation: "查看详细信息",
+
+  // Status related
+  valid: "有效",
+  expiringSoon: "即将过期",
+  expired: "已过期",
+  pending: "待处理",
+
+  // Statistics and cards
+  validCertificates: "有效证书",
+  expiringSoonCertificates: "即将过期",
+  expiredCertificates: "已过期",
+
+  // Form fields
+  domain: "域",
+  domainName: "域名",
+  domainCannotChange: "域名创建后不能更改",
+  warningThreshold: "警告阈值",
+  warningThresholdDays: "警告阈值（天）",
+  expiryThreshold: "过期阈值",
+  expiryThresholdDays: "过期阈值（天）",
+  notificationChannel: "通知渠道",
+  chooseChannel: "选择通知渠道",
+  whereToSend: "通知渠道",
+  daysBeforeExpiration: "过期前警告天数",
+  daysBeforeCritical: "过期前关键警告天数",
+  getNotifiedExpiration: "获取证书即将过期的通知",
+  getNotifiedCritical: "获取证书即将过期的关键通知",
+
+  // Table headers and fields
+  issuer: "发行机构",
+  expirationDate: "过期日期",
+  daysLeft: "剩余天数",
+  status: "状态",
+  lastNotified: "最后通知时间",
+  actions: "操作",
+  validFrom: "有效从",
+  validUntil: "有效至",
+  validityDays: "有效期天数",
+  validityPeriod: "有效期",
+  organization: "组织",
+  commonName: "通用名称",
+  serialNumber: "序列号",
+  algorithm: "算法",
+  subjectAltNames: "主题备用名称",
+  subjectAlternativeNames: "主题备用名称",
+  resolvedIP: "解析 IP",
+  issuedTo: "颁发给",
+  days: "天",
+  
+  // Buttons and actions
+  addDomain: "添加域名",
+  refreshAll: "刷新所有",
+  cancel: "取消",
+  addCertificate: "添加证书",
+  check: "检查",
+  view: "查看",
+  edit: "编辑",
+  delete: "删除",
+  close: "关闭",
+  saveChanges: "保存更改",
+  updating: "更新中",
+  
+  // Sections in detail view
+  basicInformation: "基本信息",
+  validity: "有效期",
+  issuerInfo: "发行机构信息",
+  technicalDetails: "技术详情",
+  technicalInformation: "技术信息",
+  monitoringConfig: "监控配置",
+  monitoringConfiguration: "监控配置",
+  recordInfo: "记录信息",
+  certificateDetails: "证书详情",
+  
+  // Notifications and messages
+  sslCertificateAdded: "SSL 证书添加成功",
+  sslCertificateUpdated: "SSL 证书更新成功",
+  sslCertificateDeleted: "SSL 证书删除成功",
+  sslCertificateRefreshed: "SSL 证书为 {domain} 刷新成功",
+  allCertificatesRefreshed: "所有 {count} 证书刷新成功",
+  someCertificatesFailed: "{success} 证书刷新成功，{failed} 失败",
+  failedToAddCertificate: "添加 SSL 证书失败",
+  failedToLoadCertificates: "加载 SSL 证书失败",
+  failedToUpdateCertificate: "更新 SSL 证书失败",
+  failedToDeleteCertificate: "删除 SSL 证书失败",
+  failedToCheckCertificate: "检查 SSL 证书失败",
+  noCertificatesToRefresh: "没有证书可刷新",
+  startingRefreshAll: "开始刷新 {count} 证书",
+  checkingSSLCertificate: "检查 SSL 证书...",
+  deleteConfirmation: "确定要删除 {domain} 的证书吗？",
+  deleteWarning: "此操作无法撤销。这将永久删除证书。",
+  
+  // Misc
+  unknown: "未知",
+  never: "从不",
+  none: "无",
+  loadingChannels: "加载通知渠道...",
+  noChannelsFound: "未找到通知渠道",
+  noSSLCertificates: "未找到 SSL 证书",
+  created: "创建时间",
+  lastUpdated: "最后更新时间",
+  lastNotification: "最后通知时间",
+  collectionId: "集合 ID",
+  noCertificatesFound: "未找到证书",
+};
diff --git a/application/src/types/docker.types.ts b/application/src/types/docker.types.ts
new file mode 100644
index 0000000..453e54b
--- /dev/null
+++ b/application/src/types/docker.types.ts
@@ -0,0 +1,56 @@
+
+export interface DockerContainer {
+  collectionId: string;
+  collectionName: string;
+  id: string;
+  docker_id: string;
+  name: string;
+  hostname: string;
+  ip_address: string;
+  os_template: string;
+  uptime: string;
+  ram_total: number;
+  ram_used: number;
+  cpu_cores: number;
+  cpu_usage: number;
+  disk_total: number;
+  disk_used: number;
+  last_checked: string;
+  template_id: string;
+  notification_id: string;
+  timestamp: string;
+  status: string;
+  created: string;
+  updated: string;
+}
+
+export interface DockerMetrics {
+  collectionId: string;
+  collectionName: string;
+  id: string;
+  docker_id: string;
+  timestamp: string;
+  ram_total: string;
+  ram_used: string;
+  ram_free: string;
+  cpu_cores: string;
+  cpu_usage: string;
+  cpu_free: string;
+  disk_total: string;
+  disk_used: string;
+  disk_free: string;
+  status: string;
+  network_rx_bytes: number;
+  network_tx_bytes: number;
+  network_rx_speed: number;
+  network_tx_speed: number;
+  created: string;
+  updated: string;
+}
+
+export interface DockerStats {
+  total: number;
+  running: number;
+  stopped: number;
+  warning: number;
+}
\ No newline at end of file
diff --git a/application/src/types/jspdf-autotable.d.ts b/application/src/types/jspdf-autotable.d.ts
new file mode 100644
index 0000000..44a756d
--- /dev/null
+++ b/application/src/types/jspdf-autotable.d.ts
@@ -0,0 +1,9 @@
+import 'jspdf';
+
+declare module 'jspdf' {
+  interface jsPDF {
+    lastAutoTable: {
+      finalY: number;
+    };
+  }
+}
\ No newline at end of file
diff --git a/application/src/types/operational.types.ts b/application/src/types/operational.types.ts
new file mode 100644
index 0000000..d0cbae2
--- /dev/null
+++ b/application/src/types/operational.types.ts
@@ -0,0 +1,24 @@
+
+export interface OperationalPageRecord {
+  collectionId: string;
+  collectionName: string;
+  id: string;
+  title: string;
+  description: string;
+  is_public: string;
+  slug: string;
+  theme: string;
+  logo_url: string;
+  custom_domain: string;
+  custom_css: string;
+  page_style: string;
+  status: 'operational' | 'degraded' | 'maintenance' | 'major_outage';
+  created: string;
+  updated: string;
+}
+
+export interface OperationalPageState {
+  data: OperationalPageRecord | null;
+  loading: boolean;
+  error: string | null;
+}
\ No newline at end of file
diff --git a/application/src/types/regional.types.ts b/application/src/types/regional.types.ts
new file mode 100644
index 0000000..0091e1c
--- /dev/null
+++ b/application/src/types/regional.types.ts
@@ -0,0 +1,24 @@
+
+export interface RegionalService {
+  id: string;
+  region_name: string;
+  status: string;
+  agent_id: string;
+  agent_ip_address: string;
+  token: string;
+  connection: "online" | "offline";
+  created: string;
+  updated: string;
+}
+
+export interface CreateRegionalServiceParams {
+  region_name: string;
+  agent_ip_address: string;
+}
+
+export interface InstallCommand {
+  token: string;
+  agent_id: string;
+  bash_script: string;
+  api_endpoint: string;
+}
\ No newline at end of file
diff --git a/application/src/types/server.types.ts b/application/src/types/server.types.ts
new file mode 100644
index 0000000..fad7360
--- /dev/null
+++ b/application/src/types/server.types.ts
@@ -0,0 +1,45 @@
+
+export interface Server {
+  collectionId: string;
+  collectionName: string;
+  id: string;
+  server_id: string;
+  name: string;
+  hostname: string;
+  ip_address: string;
+  os_type: string;
+  status: 'up' | 'down' | 'warning' | 'paused';
+  uptime: string;
+  ram_total: number;
+  ram_used: number;
+  cpu_cores: number;
+  cpu_usage: number;
+  disk_total: number;
+  disk_used: number;
+  last_checked: string;
+  server_token: string;
+  template_id: string;
+  threshold_id: string;
+  notification_id: string;
+  notification_status: boolean; 
+  max_retries: number;
+  timestamp: string;
+  connection: string;
+  agent_status: string;
+  system_info: string;
+  network_rx_bytes: string;
+  network_tx_bytes: string;
+  network_rx_speed: string;
+  network_tx_speed: string;
+  check_interval: number;
+  docker: string;
+  created: string;
+  updated: string;
+}
+
+export interface ServerStats {
+  total: number;
+  online: number;
+  offline: number;
+  warning: number;
+}
\ No newline at end of file
diff --git a/application/src/types/service.types.ts b/application/src/types/service.types.ts
new file mode 100644
index 0000000..5071174
--- /dev/null
+++ b/application/src/types/service.types.ts
@@ -0,0 +1,116 @@
+export interface Service {
+  id: string;
+  name: string;
+  url?: string;
+  host?: string; // Make host optional since it's not always required
+  port?: number;
+  domain?: string; // Add domain field for DNS services
+  type: "http" | "https" | "tcp" | "ping" | "icmp" | "dns";
+  status: "up" | "down" | "paused" | "warning";
+  responseTime: number;
+  uptime?: number;
+  lastChecked: string;
+  interval: number;
+  timeout?: number;
+  retries: number;
+  created?: string;
+  updated?: string;
+  notification_channel?: string;
+  notificationChannel?: string; // Keep for backward compatibility
+  notification_status?: "enabled" | "disabled"; // Add notification_status field
+  alertTemplate?: string;
+  alerts?: "muted" | "unmuted"; // Make sure alerts is properly typed as union
+  muteAlerts?: boolean; // Keep this to avoid breaking existing code
+  muteChangedAt?: string;
+  follow_redirects?: boolean;
+  verify_ssl?: boolean;
+  expected_status_code?: number;
+  keyword_check?: string;
+  keyword_check_type?: "contains" | "not_contains";
+  dns_record_type?: "A" | "AAAA" | "CNAME" | "MX" | "TXT" | "NS";
+  dns_expected_value?: string;
+  headers?: string;
+  body?: string;
+  method?: "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "HEAD" | "OPTIONS";
+  // Regional monitoring fields
+  region_name?: string;
+  agent_id?: string;
+  regional_status?: "enabled" | "disabled"; // Add regional_status field
+  regional_monitoring_enabled?: boolean;
+}
+
+export interface CreateServiceParams {
+  name: string;
+  url?: string;
+  host?: string; // Add host field for PING and TCP services
+  port?: number; // Add port field for TCP services
+  domain?: string; // Add domain field for DNS services
+  type: string;
+  interval: number;
+  retries: number;
+  notificationChannel?: string;
+  alertTemplate?: string;
+  // Regional monitoring params
+  regionalMonitoringEnabled?: boolean;
+  regionalStatus?: "enabled" | "disabled"; // Add regionalStatus field
+  regionName?: string;
+  agentId?: string;
+}
+
+export interface UptimeData {
+  id?: string;
+  service_id?: string; // Make service_id optional for backward compatibility
+  serviceId?: string; // Keep for backward compatibility
+  timestamp: string;
+  status: "up" | "down" | "paused" | "warning";
+  responseTime: number;
+  error_message?: string;
+  details?: string;
+  created?: string;
+  updated?: string;
+  date?: string; // Keep for backward compatibility
+  uptime?: number; // Keep for backward compatibility
+  // Regional monitoring fields
+  region_name?: string;
+  agent_id?: string | number;
+  // Source identifier for multi-source display
+  source?: string;
+}
+
+export interface PingData {
+  id?: string;
+  service_id: string;
+  timestamp: string;
+  status: "up" | "down" | "paused" | "warning";
+  responseTime: number;
+  packet_loss?: number;
+  error_message?: string;
+  details?: string;
+  created?: string;
+  updated?: string;
+}
+
+export interface DNSData {
+  id?: string;
+  service_id: string;
+  timestamp: string;
+  status: "up" | "down" | "paused" | "warning";
+  responseTime: number;
+  resolved_ip?: string;
+  error_message?: string;
+  details?: string;
+  created?: string;
+  updated?: string;
+}
+
+export interface TCPData {
+  id?: string;
+  service_id: string;
+  timestamp: string;
+  status: "up" | "down" | "paused" | "warning";
+  responseTime: number;
+  error_message?: string;
+  details?: string;
+  created?: string;
+  updated?: string;
+}
\ No newline at end of file
diff --git a/application/src/types/ssl.types.ts b/application/src/types/ssl.types.ts
new file mode 100644
index 0000000..b553646
--- /dev/null
+++ b/application/src/types/ssl.types.ts
@@ -0,0 +1,45 @@
+
+export interface SSLCertificate {
+  id: string;
+  domain: string;
+  issued_to: string;
+  issuer_o: string;
+  status: string;
+  cert_sans?: string;
+  cert_alg?: string;
+  serial_number?: number | string;
+  valid_from: string;
+  valid_till: string;
+  validity_days: number;
+  days_left: number;
+  valid_days_to_expire?: number;
+  warning_threshold: number;
+  expiry_threshold: number;
+  notification_channel: string;
+  alert_template?: string; // New field for SSL alert template
+  // PocketBase specific fields
+  notification_id?: string; // Multi notification channels as comma-separated string
+  template_id?: string; // Alert template ID for PocketBase
+  last_notified?: string;
+  created?: string;
+  updated?: string;
+  // New fields
+  check_interval?: number; // Check interval in days
+  check_at?: string; // Next check time
+  // Existing fields based on the provided structure
+  collectionId?: string;
+  collectionName?: string;
+  resolved_ip?: string;
+  issuer_cn?: string;
+}
+
+export interface AddSSLCertificateDto {
+  domain: string;
+  warning_threshold: number;
+  expiry_threshold: number;
+  notification_channel: string;
+  alert_template?: string; // New field for SSL alert template
+  notification_id?: string; // Multi notification channels as comma-separated string
+  template_id?: string; // Alert template ID for PocketBase
+  check_interval?: number; // New field for check interval in days
+}
\ No newline at end of file
diff --git a/application/src/types/statusPageComponents.types.ts b/application/src/types/statusPageComponents.types.ts
new file mode 100644
index 0000000..3fceb3c
--- /dev/null
+++ b/application/src/types/statusPageComponents.types.ts
@@ -0,0 +1,20 @@
+
+export interface StatusPageComponentRecord {
+  collectionId: string;
+  collectionName: string;
+  id: string;
+  operational_status_id: string;
+  name: string;
+  description: string;
+  service_id: string;
+  server_id: string;
+  display_order: number;
+  created: string;
+  updated: string;
+}
+
+export interface StatusPageComponentState {
+  data: StatusPageComponentRecord[] | null;
+  loading: boolean;
+  error: string | null;
+}
\ No newline at end of file
diff --git a/application/src/utils/copyUtils.ts b/application/src/utils/copyUtils.ts
new file mode 100644
index 0000000..21f29ee
--- /dev/null
+++ b/application/src/utils/copyUtils.ts
@@ -0,0 +1,60 @@
+
+import { toast } from "@/hooks/use-toast";
+
+export const copyToClipboard = async (text: string) => {
+ // console.log('copyToClipboard called with text:', text); // Debug log
+  
+  try {
+    // Try modern clipboard API first
+    if (navigator.clipboard && window.isSecureContext) {
+    //  console.log('Using modern clipboard API'); // Debug log
+      await navigator.clipboard.writeText(text);
+      toast({
+        title: "Copied!",
+        description: "Content copied to clipboard successfully.",
+      });
+      return;
+    }
+
+  //  console.log('Using fallback clipboard method'); // Debug log
+    
+    // Fallback for older browsers or non-secure contexts
+    const textArea = document.createElement("textarea");
+    textArea.value = text;
+    textArea.style.position = "fixed";
+    textArea.style.left = "-9999px";
+    textArea.style.top = "-9999px";
+    textArea.style.opacity = "0";
+    textArea.style.pointerEvents = "none";
+    textArea.style.zIndex = "-1";
+    document.body.appendChild(textArea);
+    
+    // Focus and select the text
+    textArea.focus();
+    textArea.select();
+    textArea.setSelectionRange(0, textArea.value.length);
+    
+    // Use execCommand as fallback
+    const successful = document.execCommand('copy');
+    document.body.removeChild(textArea);
+    
+    if (successful) {
+   //   console.log('Copy successful with execCommand'); // Debug log
+      toast({
+        title: "Copied!",
+        description: "Content copied to clipboard successfully.",
+      });
+    } else {
+      throw new Error('Copy command failed');
+    }
+  } catch (error) {
+  //  console.error('Failed to copy to clipboard:', error);
+    
+    // Show error toast
+    toast({
+      title: "Copy Failed",
+      description: "Unable to copy automatically. Please select and copy the text manually.",
+      variant: "destructive",
+    });
+  }
+};
\ No newline at end of file
diff --git a/application/src/vite-env.d.ts b/application/src/vite-env.d.ts
new file mode 100644
index 0000000..11f02fe
--- /dev/null
+++ b/application/src/vite-env.d.ts
@@ -0,0 +1 @@
+/// <reference types="vite/client" />
diff --git a/application/tailwind.config.ts b/application/tailwind.config.ts
new file mode 100644
index 0000000..23835c8
--- /dev/null
+++ b/application/tailwind.config.ts
@@ -0,0 +1,127 @@
+
+import type { Config } from "tailwindcss";
+
+export default {
+	darkMode: ["class"],
+	safelist: [
+		"text-purple-400",
+		"text-blue-400",
+		"text-cyan-400",
+		"text-emerald-400",
+		"text-amber-400",
+		"text-indigo-400",
+		"text-rose-400"
+	],
+	content: [
+		"./pages/**/*.{ts,tsx}",
+		"./components/**/*.{ts,tsx}",
+		"./app/**/*.{ts,tsx}",
+		"./src/**/*.{ts,tsx}",
+	],
+	prefix: "",
+	theme: {
+		container: {
+			center: true,
+			padding: '2rem',
+			screens: {
+				'2xl': '1400px'
+			}
+		},
+		extend: {
+			fontFamily: {
+				inter: ['Inter', 'sans-serif'],
+			},
+			colors: {
+				border: 'hsl(var(--border))',
+				input: 'hsl(var(--input))',
+				ring: 'hsl(var(--ring))',
+				background: 'hsl(var(--background))',
+				foreground: 'hsl(var(--foreground))',
+				primary: {
+					DEFAULT: 'hsl(var(--primary))',
+					foreground: 'hsl(var(--primary-foreground))'
+				},
+				secondary: {
+					DEFAULT: 'hsl(var(--secondary))',
+					foreground: 'hsl(var(--secondary-foreground))'
+				},
+				destructive: {
+					DEFAULT: 'hsl(var(--destructive))',
+					foreground: 'hsl(var(--destructive-foreground))'
+				},
+				muted: {
+					DEFAULT: 'hsl(var(--muted))',
+					foreground: 'hsl(var(--muted-foreground))'
+				},
+				accent: {
+					DEFAULT: 'hsl(var(--accent))',
+					foreground: 'hsl(var(--accent-foreground))'
+				},
+				popover: {
+					DEFAULT: 'hsl(var(--popover))',
+					foreground: 'hsl(var(--popover-foreground))'
+				},
+				card: {
+					DEFAULT: 'hsl(var(--card))',
+					foreground: 'hsl(var(--card-foreground))'
+				},
+				sidebar: {
+					DEFAULT: 'hsl(var(--sidebar-background))',
+					foreground: 'hsl(var(--sidebar-foreground))',
+					primary: 'hsl(var(--sidebar-primary))',
+					'primary-foreground': 'hsl(var(--sidebar-primary-foreground))',
+					accent: 'hsl(var(--sidebar-accent))',
+					'accent-foreground': 'hsl(var(--sidebar-accent-foreground))',
+					border: 'hsl(var(--sidebar-border))',
+					ring: 'hsl(var(--sidebar-ring))'
+				}
+			},
+			borderRadius: {
+				lg: 'var(--radius)',
+				md: 'calc(var(--radius) - 2px)',
+				sm: 'calc(var(--radius) - 4px)'
+			},
+			keyframes: {
+				'accordion-down': {
+					from: {
+						height: '0'
+					},
+					to: {
+						height: 'var(--radix-accordion-content-height)'
+					}
+				},
+				'accordion-up': {
+					from: {
+						height: 'var(--radix-accordion-content-height)'
+					},
+					to: {
+						height: '0'
+					}
+				},
+				'ping': {
+					'75%, 100%': {
+						transform: 'scale(2)',
+						opacity: '0'
+					}
+				},
+				'fade-in': {
+					'0%': {
+						opacity: '0',
+						transform: 'translateY(10px)'
+					},
+					'100%': {
+						opacity: '1',
+						transform: 'translateY(0)'
+					}
+				}
+			},
+			animation: {
+				'accordion-down': 'accordion-down 0.2s ease-out',
+				'accordion-up': 'accordion-up 0.2s ease-out',
+				'ping': 'ping 1.5s cubic-bezier(0, 0, 0.2, 1) infinite',
+				'fade-in': 'fade-in 0.3s ease-out'
+			}
+		}
+	},
+	plugins: [require("tailwindcss-animate")],
+} satisfies Config;
diff --git a/application/tsconfig.app.json b/application/tsconfig.app.json
new file mode 100644
index 0000000..0b0e43e
--- /dev/null
+++ b/application/tsconfig.app.json
@@ -0,0 +1,30 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "useDefineForClassFields": true,
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "isolatedModules": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "strict": false,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noImplicitAny": false,
+    "noFallthroughCasesInSwitch": false,
+
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["src"]
+}
diff --git a/application/tsconfig.json b/application/tsconfig.json
new file mode 100644
index 0000000..129b1a3
--- /dev/null
+++ b/application/tsconfig.json
@@ -0,0 +1,19 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.node.json" }
+  ],
+  "compilerOptions": {
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "noImplicitAny": false,
+    "noUnusedParameters": false,
+    "skipLibCheck": true,
+    "allowJs": true,
+    "noUnusedLocals": false,
+    "strictNullChecks": false
+  }
+}
diff --git a/application/tsconfig.node.json b/application/tsconfig.node.json
new file mode 100644
index 0000000..3133162
--- /dev/null
+++ b/application/tsconfig.node.json
@@ -0,0 +1,22 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2023"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "isolatedModules": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["vite.config.ts"]
+}
diff --git a/application/vite.config.ts b/application/vite.config.ts
new file mode 100644
index 0000000..4cd2097
--- /dev/null
+++ b/application/vite.config.ts
@@ -0,0 +1,19 @@
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react-swc";
+import path from "path";
+
+// https://vitejs.dev/config/
+export default defineConfig(({ mode }) => ({
+  server: {
+    host: "::",
+    port: 8990,
+  },
+  plugins: [
+    react(),
+  ],
+  resolve: {
+    alias: {
+      "@": path.resolve(__dirname, "./src"),
+    },
+  },
+}));
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..cca2a22
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,16 @@
+version: '3.9'
+services:
+  checkcle:
+    image: operacle/checkcle:latest
+    container_name: checkcle
+    restart: unless-stopped
+    ports:
+      - "8090:8090" # Map ports for external access, if local only "127.0.0.1:8090:8090"
+    volumes:
+      - /opt/pb_data:/mnt/pb_data  # Mount persistent data
+
+    # Optional: set user limits
+    ulimits:
+      nofile:
+        soft: 4096
+        hard: 8192
\ No newline at end of file
diff --git a/docker/Dockerfile.frontend b/docker/Dockerfile.frontend
new file mode 100644
index 0000000..07e0855
--- /dev/null
+++ b/docker/Dockerfile.frontend
@@ -0,0 +1,21 @@
+FROM node:20-alpine AS build
+WORKDIR /app
+
+# Install dependencies
+COPY application/package.json application/package-lock.json ./
+RUN npm ci
+
+# Copy source and build
+COPY application/. .
+RUN npm run build
+
+FROM nginx:1.27-alpine
+RUN rm -rf /usr/share/nginx/html/*
+COPY --from=build /app/dist /usr/share/nginx/html
+
+# SPA fallback + static asset caching
+RUN printf 'server {\n  listen 80;\n  server_name _;\n  root /usr/share/nginx/html;\n  index index.html;\n  location / { try_files $uri $uri/ /index.html; }\n  location ~* \\.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?)$ { expires 7d; add_header Cache-Control "public, max-age=604800, immutable"; try_files $uri =404; }\n}\n' > /etc/nginx/conf.d/default.conf
+
+EXPOSE 80
+CMD ["nginx","-g","daemon off;"]
+
diff --git a/docker/distributed-regional-monitoring.yml b/docker/distributed-regional-monitoring.yml
new file mode 100644
index 0000000..6cb24e3
--- /dev/null
+++ b/docker/distributed-regional-monitoring.yml
@@ -0,0 +1,21 @@
+# CheckCle Distributed Regional Monitoring Agent - System metrics collection (HTTP, PING, TCP, DNS)
+# This Dockerfile for build with this repository: https://github.com/operacle/Distributed-Regional-Monitoring
+
+FROM golang:1.21-alpine AS builder
+
+WORKDIR /app
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o service-operation .
+
+FROM alpine:latest
+RUN apk --no-cache add ca-certificates
+WORKDIR /root/
+
+COPY --from=builder /app/service-operation .
+
+EXPOSE 8091
+
+CMD ["./service-operation"]
diff --git a/docker/docker-compose-dev.yml b/docker/docker-compose-dev.yml
new file mode 100644
index 0000000..c3d1477
--- /dev/null
+++ b/docker/docker-compose-dev.yml
@@ -0,0 +1,39 @@
+version: '3.9'
+
+services:
+  checkcle:
+    image: operacle/checkcle:latest
+    container_name: checkcle-dev
+    restart: unless-stopped
+    ports:
+      - "8090:8090"
+    volumes:
+      - pb_data:/mnt/pb_data  # Persist PocketBase data across rebuilds
+    ulimits:
+      nofile:
+        soft: 4096
+        hard: 8192
+
+  frontend:
+    image: ghcr.io/operacle/checkcle-frontend:sha-b2ae075
+    container_name: checkcle-frontend
+    ports:
+      - "8990:80"
+    environment:
+      - NODE_ENV=development
+    depends_on:
+      - checkcle
+    # Fall back to dev server when FRONTEND_IMAGE is not set
+    deploy:
+      replicas: 1
+    # Compose doesn't support conditional configs; document usage:
+    # - To use prebuilt image: export FRONTEND_IMAGE=ghcr.io/<owner>/checkcle-frontend:<tag>
+    # - To use live dev server instead, comment 'image' above and uncomment the block below:
+    # working_dir: /app
+    # command: sh -c "npm ci && npm run dev -- --host 0.0.0.0 --port 8990"
+    # volumes:
+    #   - ../application:/app
+    #   - /app/node_modules
+
+volumes:
+  pb_data:
diff --git a/docker/docker-compose.prod.yml b/docker/docker-compose.prod.yml
new file mode 100644
index 0000000..93a9f75
--- /dev/null
+++ b/docker/docker-compose.prod.yml
@@ -0,0 +1,15 @@
+version: '3.9'
+
+services:
+  checkcle:
+    image: operacle/checkcle:latest
+    container_name: checkcle
+    restart: unless-stopped
+    ports:
+      - "8090:8090"  # Web Application
+    volumes:
+      - /opt/pb_data:/mnt/pb_data  # Host directory mapped to container path
+    ulimits:
+      nofile:
+        soft: 4096
+        hard: 8192
\ No newline at end of file
diff --git a/docker/server-docker-agent.yml b/docker/server-docker-agent.yml
new file mode 100644
index 0000000..76823b2
--- /dev/null
+++ b/docker/server-docker-agent.yml
@@ -0,0 +1,35 @@
+name: checkcle-server-agent
+
+services:
+  checkcle-server-agent:
+    container_name: monitoring-agent
+    restart: unless-stopped
+    ports:
+      - "8081:8081"
+    group_add:
+      - 999
+    environment:
+      AGENT_ID: agent_124343535
+      SERVER_NAME: "test"
+      SERVER_TOKEN: srv_123243434
+      POCKETBASE_URL: http://x.x.x.x:8090
+      POCKETBASE_ENABLED: "true"
+    volumes:
+      - /proc:/host/proc:ro
+      - /etc:/host/etc:ro
+      - /sys:/host/sys:ro
+      - /:/host/root:ro
+      - /var/run:/host/var/run:ro
+      - /dev:/host/dev:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - monitoring_data:/var/lib/monitoring-agent
+      - monitoring_logs:/var/log/monitoring-agent
+    image: operacle/checkcle-server-agent:latest
+
+volumes:
+  monitoring_data:
+    external: true
+    name: monitoring_data
+  monitoring_logs:
+    external: true
+    name: monitoring_logs
diff --git a/docs/CONTRIBUTING_ja.md b/docs/CONTRIBUTING_ja.md
new file mode 100644
index 0000000..37525e1
--- /dev/null
+++ b/docs/CONTRIBUTING_ja.md
@@ -0,0 +1,182 @@
+## 🌐 言語選択
+
+<table align="center">
+  <tr>
+    <td align="center">
+      <a href="../CONTRIBUTING.md">
+        <img src="https://flagcdn.com/24x18/gb.png" alt="English" />  
+        <br/><strong>English</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="CONTRIBUTING_km.md">
+        <img src="https://flagcdn.com/24x18/kh.png" alt="Khmer" />  
+        <br/><strong>ខ្មែរ</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="CONTRIBUTING_ja.md">
+        <img src="https://flagcdn.com/24x18/jp.png" alt="Japanese" />  
+        <br/><strong>日本語</strong>
+      </a>
+    </td>
+  </tr>
+</table>
+
+
+<p align="center">
+  このプロジェクトを発展させてくださったすべての貢献者、ユーザー、サポーターの皆様に感謝いたします。
+</p>
+
+<p align="center">
+  🚀 <strong>今後のアップデート、機能、改善にご期待ください。</strong>
+</p>
+
+# 🛠️ CheckCleへの貢献
+
+**CheckCle**への貢献にご興味をお持ちいただき、ありがとうございます — リアルタイムフルスタック監視のための究極のオープンソースプラットフォームです。バグの報告、機能の提案、ドキュメントの改善、またはコードの提出など、どのような形でのご貢献でも歓迎いたします！
+
+大小を問わず、あらゆる種類の貢献を歓迎します。このガイドが始めるのに役立ちます。
+
+---
+
+## 📌 目次
+- [行動規範](#-行動規範)
+- [貢献の方法](#-貢献の方法)
+- [開発環境のセットアップ](#-開発環境のセットアップ)
+- [プルリクエストのプロセス](#-プルリクエストのプロセス)
+- [バグと問題の報告](#-バグと問題の報告)
+- [機能リクエスト](#-機能リクエスト)
+- [コミュニティとサポート](#-コミュニティとサポート)
+- [ライセンス](#-ライセンス)
+
+---
+
+## 📜 行動規範
+
+私たちは[行動規範](https://opensource.guide/code-of-conduct/)に従い、オープンで歓迎するコミュニティを促進しています。参加することで、これらの基準を守ることに同意したものとします。
+
+---
+
+## 🤝 貢献の方法
+
+CheckCleの改善に役立つ方法をいくつか紹介します：
+
+- 🐞 **バグの報告** – 不具合を見つけましたか？[GitHub Issue](https://github.com/operacle/checkcle/issues)を開いてお知らせください。
+- 🌟 **機能の提案** – アイデアはありますか？[Discussion](https://github.com/operacle/checkcle/discussions)を始めるか、機能リクエストのissueを開いてください。
+- 🛠 **プルリクエストの提出** – コードの改善、バグの修正、機能の追加、ドキュメントの改善を行ってください。
+- 📝 **ドキュメントの改善** – タイポの修正でも大変助かります！
+- 🌍 **宣伝の協力** – リポジトリに⭐をつけて、SNSでシェアし、他の方にも貢献を呼びかけてください！
+
+---
+
+## 🧰 開発環境のセットアップ
+
+コードに貢献する前に、プロジェクトをローカルで設定してください：
+
+### 1. リポジトリをフォーク
+[GitHub](https://github.com/operacle/checkcle)で「Fork」をクリックして、自分のコピーを作成してください。
+
+### 2. フォークをクローン
+```bash
+git clone https://github.com/yourusername/checkcle.git
+cd checkcle
+```
+
+### 3. 依存関係のインストール
+READMEまたはプロジェクトドキュメントの指示に従って、必要なパッケージをインストールし、ローカル開発サーバーを実行してください。
+
+### 4. ローカル開発の開始
+```bash
+#Webアプリケーション
+cd application/
+npm install && npm run dev
+
+#サーバーバックエンド
+cd server
+./pocketbase serve --dir pb_data
+
+localhostを使用していない場合は、次のコマンドで実行してください (./pocketbase serve --http=0.0.0.0:8090 --dir pb_data)
+```
+
+### 5. サービスチェック操作の開始
+
+```bash
+#サーバーバックエンド
+サービス操作を開始 (PING、HTTP、TCP、DNSのサービスチェック)
+
+cd server/service-operation
+
+go run main.go (localhost接続の場合、.envを変更する必要はありません)
+```
+
+### 6. 分散地域エージェントの開始
+```bash
+#### 1. リポジトリをフォーク
+[GitHub](https://github.com/operacle/Distributed-Regional-Monitoring)で「Fork」をクリックして、自分のコピーを作成してください。
+
+#### 2. フォークをクローン
+git clone https://github.com/yourusername/Distributed-Regional-Monitoring.git
+cd Distributed-Regional-Monitoring
+
+#### 3. Goサービスのインストール（Goサービスがインストールされていることを確認してください）
+
+.env.example -> .envにコピー
+.envファイルで地域エージェント設定を変更
+そして実行: go run main.go
+
+```
+
+---
+
+## ✅ プルリクエストのプロセス
+
+1. コードが既存のスタイルと命名規則に従っていることを確認してください。
+2. 明確で簡潔なコミットメッセージを書いてください。
+3. ブランチをプッシュし、`develop`ブランチにプルリクエスト（PR）を開いてください。
+4. 意味のあるPRの説明を提供してください（何を/なぜ/どのように）。
+5. 関連するissueがある場合はリンクしてください（例：`Closes #12`）。
+6. すべてのチェックが通ることを確認してください（例：リンティング、テスト）。
+
+PRをレビューし、必要に応じて変更をリクエストし、準備ができ次第マージします！
+
+---
+
+## 🐛 バグと問題の報告
+
+可能な限り多くの情報を含めてください：
+- 明確で説明的なタイトル
+- 再現手順
+- 期待される動作と実際の動作
+- 環境情報（OS、ブラウザ、デバイスなど）
+- 該当する場合はスクリーンショットやログ
+
+報告には[Issue Tracker](https://github.com/operacle/checkcle/issues)をご利用ください。
+
+---
+
+## 💡 機能リクエスト
+
+アイデアをお聞かせください！[Discussion](https://github.com/operacle/checkcle/discussions)または機能リクエストのissueを開いてください。[ロードマップ](https://github.com/operacle/checkcle#development-roadmap)に既に記載されていないことを確認してください。
+
+---
+
+## 🌍 コミュニティとサポート
+
+ヘルプが必要ですか？つながりたいですか？
+
+- 💬 [Discordに参加](https://discord.gg/xs9gbubGwX)
+- 🗣 [GitHub Discussion](https://github.com/operacle/checkcle/discussions)を開始または参加
+- 🐦 [X（Twitter）](https://x.com/tl)でフォロー
+
+---
+
+## 📜 ライセンス
+
+貢献することで、あなたの貢献が[MITライセンス](LICENSE)の下でライセンスされることに同意したものとします。
+
+---
+
+## 🙏 ありがとうございます
+
+CheckCleを一緒に構築できることを嬉しく思います — **コミュニティによる、コミュニティのための**強力な監視プラットフォーム。あなたのサポートは私たちにとってとても大切です！💙
\ No newline at end of file
diff --git a/docs/CONTRIBUTING_km.md b/docs/CONTRIBUTING_km.md
new file mode 100644
index 0000000..78efbbb
--- /dev/null
+++ b/docs/CONTRIBUTING_km.md
@@ -0,0 +1,181 @@
+
+## 🌐 Select Language
+
+<table align="center">
+  <tr>
+    <td align="center">
+      <a href="../CONTRIBUTING.md">
+        <img src="https://flagcdn.com/24x18/gb.png" alt="English" />  
+        <br/><strong>English</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="CONTRIBUTING_km.md">
+        <img src="https://flagcdn.com/24x18/kh.png" alt="Khmer" />  
+        <br/><strong>ខ្មែរ</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="CONTRIBUTING_ja.md">
+        <img src="https://flagcdn.com/24x18/jp.png" alt="Japanese" />  
+        <br/><strong>Japanese</strong>
+      </a>
+    </td>
+  </tr>
+</table>
+
+<p align="center">
+  Thank you to all our contributors, users, and supporters for making this project thrive.
+</p>
+
+<p align="center">
+  🚀 <strong>Stay tuned for more updates, features, and improvements.</strong>
+</p>
+
+# 🛠️ Contributing to CheckCle
+
+Thank you for your interest in contributing to **CheckCle** — the ultimate open-source platform for real-time full-stack monitoring. Whether you're here to report bugs, suggest features, improve documentation, or submit code, your contribution matters!
+
+We welcome all kinds of contributions, big or small. This guide will help you get started.
+
+---
+
+## 📌 Table of Contents
+- [Code of Conduct](#-code-of-conduct)
+- [Ways to Contribute](#-ways-to-contribute)
+- [Development Setup](#-development-setup)
+- [Pull Request Process](#-pull-request-process)
+- [Reporting Bugs & Issues](#-reporting-bugs--issues)
+- [Feature Requests](#-feature-requests)
+- [Community & Support](#-community--support)
+- [License](#-license)
+
+---
+
+## 📜 Code of Conduct
+
+We follow a [Code of Conduct](https://opensource.guide/code-of-conduct/) to foster an open and welcoming community. By participating, you agree to uphold these standards.
+
+---
+
+## 🤝 Ways to Contribute
+
+Here are some ways you can help improve CheckCle:
+
+- 🐞 **Report Bugs** – Found a glitch? Let us know by opening a [GitHub Issue](https://github.com/operacle/checkcle/issues).
+- 🌟 **Suggest Features** – Have an idea? Start a [Discussion](https://github.com/operacle/checkcle/discussions) or open a Feature Request issue.
+- 🛠 **Submit Pull Requests** – Improve the code, fix bugs, add features, or enhance the docs.
+- 📝 **Improve Documentation** – Even a typo fix helps!
+- 🌍 **Spread the Word** – Star ⭐ the repo, share it on socials, and invite others to contribute!
+
+---
+
+## 🧰 Development Setup
+
+Before contributing code, set up the project locally:
+
+### 1. Fork the Repository
+Click "Fork" on [GitHub](https://github.com/operacle/checkcle) to create your own copy.
+
+### 2. Clone Your Fork
+```bash
+git clone --branch develop https://github.com/operacle/checkcle.git
+cd checkcle
+```
+
+### 3. Install Dependencies
+Follow the instructions in the README or project docs to install required packages and run the local development server.
+
+### 4. Start Local Development
+```bash
+#Web Application
+cd application/ 
+npm install && npm run dev
+
+#Server Backend
+cd server
+./pocketbase serve --dir pb_data 
+
+If you're not using localhost, please run with this (./pocketbase serve --http=0.0.0.0:8090 --dir pb_data)
+```
+
+### 4. Start Service Check Operation
+
+```bash
+#Server Backend 
+Start Service Operation (Check Service for PING, HTTP, TCP, DNS)
+
+cd server/service-operation
+
+go run main.go (you do not need to change the .env while it's the localhost connection)
+```
+
+### 5. Start Distributed Regional Agent
+```bash
+#### 1. Fork the Repository
+Click "Fork" on [GitHub](https://github.com/operacle/Distributed-Regional-Monitoring) to create your own copy.
+
+#### 2. Clone Your Fork
+git clone --branch main https://github.com/operacle/Distributed-Regional-Monitoring.git
+cd Distributed-Regional-Monitoring
+
+#### 3. Install Go Service (make sure you have installed the Go Service)
+
+Copy .env.example -> .env
+Change regional agent configuration in .env file
+and Run: go run main.go
+
+```
+---
+
+## ✅ Pull Request Process
+
+1. Ensure your code follows the existing style and naming conventions.
+2. Write clear, concise commit messages.
+3. Push your branch and open a Pull Request (PR) on the `develop` branch.
+4. Provide a meaningful PR description (what/why/how).
+5. Link related issues if applicable (e.g. `Closes #12`).
+6. Make sure all checks pass (e.g., linting, tests).
+
+We’ll review your PR, request changes if needed, and merge it once ready!
+
+---
+
+## 🐛 Reporting Bugs & Issues
+
+Please include as much information as possible:
+- A clear, descriptive title
+- Steps to reproduce
+- Expected vs actual behavior
+- Environment info (OS, browser, device, etc.)
+- Screenshots or logs if applicable
+
+Use the [Issue Tracker](https://github.com/operacle/checkcle/issues) to report.
+
+---
+
+## 💡 Feature Requests
+
+We’d love to hear your ideas! Open a [Discussion](https://github.com/operacle/checkcle/discussions) or Feature Request issue. Make sure it’s not already listed in the [Roadmap](https://github.com/operacle/checkcle#development-roadmap).
+
+---
+
+## 🌍 Community & Support
+
+Need help? Want to connect?
+
+- 💬 [Join our Discord](https://discord.gg/xs9gbubGwX)
+- 🗣 Start or join a [GitHub Discussion](https://github.com/operacle/checkcle/discussions)
+- 🐦 Follow us on [X (Twitter)](https://x.com/tl)
+
+---
+
+## 📜 License
+
+By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE).
+
+---
+
+## 🙏 Thank You
+
+We’re excited to build CheckCle together — a powerful monitoring platform **for the community, by the community**. Your support means the world! 💙
diff --git a/docs/DEVELOPMENT_ROADMAP.md b/docs/DEVELOPMENT_ROADMAP.md
new file mode 100644
index 0000000..150dd54
--- /dev/null
+++ b/docs/DEVELOPMENT_ROADMAP.md
@@ -0,0 +1,150 @@
+# 📍 Development Roadmap
+
+Welcome to the official development roadmap for this project. This document outlines our plans, priorities, and direction for upcoming releases. It is intended to keep contributors, users, and stakeholders informed about the project’s evolution.
+
+> 🔄 **Note**: This roadmap is subject to change based on feedback, urgency, or shifts in priorities.
+
+---
+
+## ✅ Goals and Vision
+
+Our mission is to deliver a robust, scalable, and user-friendly solution for "uptime monitoring and server infrastructure insights".
+
+**Core objectives:**
+- Provide high performance with low resource usage
+- Ensure scalability and modularity
+- Focus on excellent user experience (UX)
+- Maintain open-source transparency and community-driven features
+
+---
+
+## 🧩 Key Main Features
+
+#### Delivery Status:
+- ✅ Setup authentication and user management
+- ✅ Core monitoring dashboard
+- ✅ Agent communication with backend
+- ✅ Docker containerization
+- ✅ CheckCle Website
+- ✅ CheckCle Demo Server
+- ✅ SSL & Domain Monitoring
+- ✅ Schedule Maintenance
+- ✅ Incident Management
+- ✅ Infrastructure Server Monitoring
+- ✅ Operational Status / Public Status Pages
+- ✅ Uptime Monitoring (HTTP, TCP, PING, DNS)
+- ✅ Distributed Regional Monitoring Agent
+- ✅ System Setting Panel and Mail Settings
+- ✅ Data Retention & Automate Shrink
+- ✅ Open-source release with documentation
+
+---
+## 🚦 Roadmap Stages
+
+The roadmap is divided into the following stages:
+
+| Stage | Description |
+|-------|-------------|
+| 🎯 Planned | Approved features or improvements that are on the schedule |
+| 🔧 In Progress | Actively being developed |
+| ✅ Completed | Fully implemented and tested |
+| ⏳ Backlog | On hold or pending prioritization |
+| 🧪 Experimental | Testing new concepts or prototypes |
+
+---
+
+## 🗂 Milestone Overview
+
+### 🚀 v1.0.0-1.3.0 – Initial Release _(Target: Q2 2025)_
+**Status:** ✅ Completed 
+**Goal:** MVP feature completion, API stability, and core use-case readiness.
+
+#### Key Deliverables: https://github.com/operacle/checkcle/releases
+
+---
+
+### 🚀 v1.4 - 1.5 – Feature Enhancements _(Target: Q3 2025)_
+**Status:** ✅ Completed 
+#### Tentative Features:
+- [ ] ✅ Server and Service Table row clickable to detail page.
+- [ ] ✅ Implement pagination for the SSL dashboard table
+- [ ] ✅ Server Agent (RPM, Docker container, and general binary package) 
+- [ ] ✅ Notification System (Webhook, Telegram, Discord, Slack, Email, Google Chat)
+- [ ] ✅ Improve Uptime Service and Server connection update based on status and notification.
+- [ ] ✅ Improve SSL perform the initial check automatically after creation 
+- [ ] ✅ Rate limiting and abuse protection
+- [ ] ✅ Add ntfy push notifications
+
+### 🚀 v1.6.0 – Feature Enhancements _(Target: Q3 2025)_
+**Status:** ✅ Completed 
+#### Tentative Features:
+- [ ] ✅ Allow user to update the schema directly from the dashboard
+- [ ] ✅ Add Korean translations and update types. By @taking [#143](https://github.com/operacle/checkcle/pull/143)
+- [ ] ✅ Add Simplified Chinese translation. By @sqkkyzx [#128](https://github.com/operacle/checkcle/pull/128)
+- [ ] ✅ improve i18n and add new translations. @sqkkyzx [#132](https://github.com/operacle/checkcle/pull/132)
+- [ ] ✅ fix(incident): unify assigned user handling with fallback and UI update. By @ghotso [#142](https://github.com/operacle/checkcle/pull/142)
+- [ ] ✅ sync German translations across incident, maintenance, services & settings. By @ghotso [#141](https://github.com/operacle/checkcle/pull/141)
+- [ ] ✅ fix(services-form): max retry attempts. By @ghotso [#147](https://github.com/operacle/checkcle/pull/147)
+- [ ] ✅ Add Pushover notifications
+- [ ] ✅ fix(ssl):  Ensure edit form saves notification_id and template_id in DB.
+- [ ] ✅ Add Notifiarr notifications
+- [ ] ✅ Add Gotify notifications
+- [ ] ✅ Enhance the Data retention feature
+
+
+### 🚀 v1.7.0 – Feature Enhancements 
+**Status:** 🔧 In Progress
+#### Tentative Features:
+- [ ] ✅ Fix Regenerate Server Agent ID & Token without page refresh
+- [ ] ✅ feat: implement user impersonation by @giriparus
+- [ ] ✅ Fix server agent ID & token refresh when adding multiple agents (closes #165)
+- [ ] ✅ Fix hostname/IP validation to prevent whitespace input in the SSL and Create New Service form (closes #114)
+- [ ] ✅ Fix responsive breakpoints and flex layout for sidebar menu
+- [ ] 🔧 Implement CheckCle to Support Multiple Database (Postgres, MySQL and SQLite)
+- [ ] 🔧 Improve the uptime history bar load performance in the uptime monitoring dashboard.
+- [ ] 🔧 Bugfix: recovery time not displayed correctly in incident history on Uptime dashboard
+- [ ] 🔧 feat: add configurable notification support customizable delay before sending downtime notifications
+- [ ] 🔧 Convert the Docker Hub from personal account to an organization (the CheckCle Docker Compose image endpoint will need to be updated).
+- [ ] 🔧 Fix for the response time dashboard filter (date/time) in the uptime detail page
+- [ ] 🔧 Fix the server historical loading data
+- [ ] 🔧 Improve docker agent for server monitoring
+- [ ] 🔧 Improve the Server Agent on Unraid
+- [ ] 🔧 Server Windows Agent
+- [ ] 🔧 More Uptime Service Type (HTTP keyword, HTTP json)
+- [ ] 🔧 Server support with cpu temperature 
+- [ ] 🔧 Server upport with multiple disks/volume
+- [ ] 🔧 Server support with Multiple Network Interfaces 
+- [ ] 🔧 Improve the Operational status page
+- [ ] 🔧 Server network bandwidth monitoring
+- [ ] 🔧 Grouping uptime services
+- [ ] 🎯 Improve the Schedule and Incident for automation
+- [ ] 🎯 Uptime Monitoring option for choose: HTTP/HTTPS. Add Option to Bypass SSL Verification in Uptime
+- [ ] 🎯 Add 2FA support
+
+---
+
+## 🧠 Ideas / Community Wishlist
+
+These are community-suggested or experimental features under review:
+
+- [ ] OIDC Connect | OAuth2 integration
+- [ ] PWA support
+- [ ] Server outbound and inbound traffic usage
+
+You’re welcome to propose features via [GitHub Discussions](https://github.com/operacle/checkcle/discussions) or open an issue with the `feature-request` template.
+
+---
+
+## 📌 How to Contribute
+
+We encourage contributions from the community!  
+To get involved:
+
+- Review [CONTRIBUTING.md](../CONTRIBUTING.md) | https://docs.checkcle.io
+- Check out the [Open Issues](https://github.com/operacle/checkcle/issues)
+- Join us in shaping the roadmap via [Discussions](https://github.com/operacle/checkcle/discussions)
+
+---
+With ❤️ from the CheckCle  
+[Website](https://checkcle.io) | [GitHub](https://github.com/operacle/checkcle)
+
diff --git a/docs/DEVELOPMENT_ROADMAP_ja.md b/docs/DEVELOPMENT_ROADMAP_ja.md
new file mode 100644
index 0000000..8e0ee9b
--- /dev/null
+++ b/docs/DEVELOPMENT_ROADMAP_ja.md
@@ -0,0 +1,144 @@
+# 📍 開発ロードマップ
+
+このプロジェクトの公式開発ロードマップへようこそ。このドキュメントでは、今後のリリースに向けた計画、優先順位、方向性について説明します。貢献者、ユーザー、ステークホルダーにプロジェクトの進化について情報を提供することを目的としています。
+
+> 🔄 **注記**: このロードマップは、フィードバック、緊急性、または優先順位の変更に基づいて変更される場合があります。
+
+---
+
+## ✅ ゴールとビジョン
+
+私たちの使命は、「アップタイム監視とサーバーインフラストラクチャインサイト」のための堅牢でスケーラブル、かつユーザーフレンドリーなソリューションを提供することです。
+
+**主要な目標:**
+- 低リソース使用量での高パフォーマンスの提供
+- スケーラビリティとモジュラリティの確保
+- 優れたユーザーエクスペリエンス（UX）に焦点を当てる
+- オープンソースの透明性とコミュニティ主導機能の維持
+
+---
+
+## 🧩 主要機能
+
+#### 提供状況:
+- ✅ 認証とユーザー管理の設定
+- ✅ コア監視ダッシュボード
+- ✅ バックエンドとのエージェント通信
+- ✅ Docker コンテナ化
+- ✅ CheckCle ウェブサイト
+- ✅ CheckCle デモサーバー
+- ✅ SSL＆ドメイン監視
+- ✅ スケジュールメンテナンス
+- ✅ インシデント管理
+- ✅ インフラストラクチャサーバー監視
+- ✅ 運用ステータス / パブリックステータスページ
+- ✅ アップタイム監視（HTTP、TCP、PING、DNS）
+- ✅ 分散地域監視エージェント
+- ✅ システム設定パネルとメール設定
+- ✅ データ保持と自動縮小
+- ✅ ドキュメント付きオープンソースリリース
+
+---
+## 🚦 ロードマップステージ
+
+ロードマップは以下のステージに分かれています：
+
+| ステージ | 説明 |
+|-------|-------------|
+| 🎯 計画済み | スケジュールに組み込まれた承認済み機能または改善 |
+| 🔧 進行中 | 積極的に開発中 |
+| ✅ 完了 | 完全に実装およびテスト済み |
+| ⏳ バックログ | 保留または優先順位付け待ち |
+| 🧪 実験的 | 新しいコンセプトまたはプロトタイプのテスト |
+
+---
+
+## 🗂 マイルストーン概要
+
+### 🚀 v1.0.0-1.3.0 – 初期リリース _(目標: 2025年Q2)_
+**ステータス:** ✅ 完了
+**ゴール:** MVP機能完了、API安定性、コア使用事例対応。
+
+#### 主要成果物: https://github.com/operacle/checkcle/releases
+
+---
+
+### 🚀 v1.4 - 1.5 – 機能強化 _(目標: 2025年Q3)_
+**ステータス:** ✅ 完了
+#### 予定機能:
+- [ ] ✅ サーバーとサービステーブルの行をクリック可能にして詳細ページへ遷移
+- [ ] ✅ SSL ダッシュボードテーブルのページネーション実装
+- [ ] ✅ サーバーエージェント（RPM、Docker コンテナ、汎用バイナリパッケージ）
+- [ ] ✅ 通知システム（Webhook、Telegram、Discord、Slack、Email、Google Chat）
+- [ ] ✅ ステータスと通知に基づくアップタイムサービスとサーバー接続更新の改善
+- [ ] ✅ SSL作成後の初期チェック自動実行の改善
+- [ ] ✅ レート制限と悪用防止
+- [ ] ✅ ntfy プッシュ通知の追加
+
+### 🚀 v1.6.0 – 機能強化 _(目標: 2025年Q3)_
+**ステータス:** ✅ 完了
+#### 予定機能:
+- [ ] ✅ ダッシュボードから直接スキーマを更新できる機能の追加
+- [ ] ✅ 韓国語翻訳の追加と型の更新。@taking [#143](https://github.com/operacle/checkcle/pull/143)
+- [ ] ✅ 簡体字中国語翻訳の追加。@sqkkyzx [#128](https://github.com/operacle/checkcle/pull/128)
+- [ ] ✅ i18nの改善と新しい翻訳の追加。@sqkkyzx [#132](https://github.com/operacle/checkcle/pull/132)
+- [ ] ✅ fix(incident): フォールバックを使用した割り当てユーザー処理の統一とUI更新。@ghotso [#142](https://github.com/operacle/checkcle/pull/142)
+- [ ] ✅ インシデント、メンテナンス、サービス、設定のドイツ語翻訳の同期。@ghotso [#141](https://github.com/operacle/checkcle/pull/141)
+- [ ] ✅ fix(services-form): 最大リトライ試行回数。@ghotso [#147](https://github.com/operacle/checkcle/pull/147)
+- [ ] ✅ Pushover 通知の追加
+- [ ] ✅ fix(ssl): 編集フォームでnotification_idとtemplate_idがDBに保存されるようにする
+- [ ] ✅ Notifiarr 通知の追加
+- [ ] ✅ Gotify 通知の追加
+- [ ] ✅ データ保持機能の強化
+
+
+### 🚀 v1.7.0 – 機能強化 _(目標: 2025年Q3)_
+**ステータス:** 🔧 進行中
+#### 予定機能:
+- [ ] ✅ ページ更新なしでサーバーエージェントIDとトークンを再生成する機能の修正
+- [ ] 🔧 アップタイム監視ダッシュボードでのアップタイム履歴バーの読み込みパフォーマンスの改善
+- [ ] 🔧 バグ修正: アップタイムダッシュボードのインシデント履歴で復旧時間が正しく表示されない問題
+- [ ] 🔧 機能: ダウンタイム通知を送信する前にカスタマイズ可能な遅延を追加
+- [ ] 🔧 Docker Hubを個人アカウントから組織アカウントに変換（CheckCle Docker Compose イメージエンドポイントの更新が必要）
+- [ ] 🔧 アップタイム詳細ページのレスポンスタイムダッシュボードフィルタ（日付/時刻）の修正
+- [ ] 🔧 サーバー履歴データ読み込みの修正
+- [ ] 🔧 サーバー監視用Dockerエージェントの改善
+- [ ] 🔧 Unraid上のサーバーエージェントの改善
+- [ ] 🔧 サーバー Windows エージェント
+- [ ] 🔧 より多くのアップタイムサービスタイプ（HTTPキーワード、HTTP JSON）
+- [ ] 🔧 CPU温度対応のサーバーサポート
+- [ ] 🔧 複数ディスク/ボリューム対応のサーバーサポート
+- [ ] 🔧 複数ネットワークインターフェース対応のサーバーサポート
+- [ ] 🔧 運用ステータスページの改善
+- [ ] 🔧 サーバーネットワーク帯域幅監視
+- [ ] 🔧 アップタイムサービスのグループ化
+- [ ] 🎯 自動化のためのスケジュールとインシデントの改善
+- [ ] 🎯 アップタイム監視のHTTP/HTTPSオプション選択: アップタイムでSSL検証をバイパスするオプションの追加
+- [ ] 🎯 2FA サポート追加
+
+---
+
+## 🧠 アイデア / コミュニティウィッシュリスト
+
+以下はレビュー中のコミュニティ提案または実験的機能です：
+
+- [ ] OIDC Connect | OAuth2統合
+- [ ] PWA サポート
+- [ ] サーバーのアウトバウンドおよびインバウンドトラフィック使用量
+
+[GitHub Discussions](https://github.com/operacle/checkcle/discussions)で機能提案を歓迎します。または`feature-request`テンプレートでイシューを開いてください。
+
+---
+
+## 📌 貢献方法
+
+コミュニティからの貢献を歓迎しています！  
+参加方法：
+
+- [CONTRIBUTING.md](../CONTRIBUTING.md) | https://docs.checkcle.io をレビュー
+- [Open Issues](https://github.com/operacle/checkcle/issues) を確認
+- [Discussions](https://github.com/operacle/checkcle/discussions) でロードマップの形成に参加
+
+---
+CheckCle より ❤️ を込めて
+[ウェブサイト](https://checkcle.io) | [GitHub](https://github.com/operacle/checkcle)
\ No newline at end of file
diff --git a/docs/README_ja.md b/docs/README_ja.md
new file mode 100644
index 0000000..0cdb549
--- /dev/null
+++ b/docs/README_ja.md
@@ -0,0 +1,194 @@
+## 🌐 言語選択
+
+<table align="center">
+  <tr>
+    <td align="center">
+      <a href="../README.md">
+        <img src="https://flagcdn.com/24x18/gb.png" alt="English" />  
+        <br/><strong>English</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_km.md">
+        <img src="https://flagcdn.com/24x18/kh.png" alt="Khmer" />  
+        <br/><strong>ខ្មែរ</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_ja.md">
+        <img src="https://flagcdn.com/24x18/jp.png" alt="Japanese" />  
+        <br/><strong>日本語</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_zhcn.md">
+        <img src="https://flagcdn.com/24x18/cn.png" alt="Chinese" />  
+        <br/><strong>Chinese</strong>
+      </a>
+    </td>
+  </tr>
+</table>
+
+<p align="center">
+  このプロジェクトを発展させてくださったすべての貢献者、ユーザー、サポーターの皆様に感謝いたします。
+</p>
+
+<p align="center">
+  🚀 <strong>今後のアップデート、機能、改善にご期待ください。</strong>
+</p>
+
+![CheckCle Platform](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/server-detail-page.png)
+
+# 🚀 CheckCleとは？
+
+CheckCleは、フルスタックシステム、アプリケーション、インフラストラクチャのシームレスでリアルタイムな監視を実現するオープンソースソリューションです。開発者、システム管理者、DevOpsチームに対して、環境の全レイヤー（サーバー、アプリケーション、サービス）にわたる深い洞察と実用的なデータを提供します。CheckCleにより、テクノロジースタック全体の可視性、制御、最適なパフォーマンスの確保が可能になります。
+
+## 🎯 ライブデモ  
+👉 **今すぐ試す:** [CheckCle ライブデモ](https://demo.checkcle.io)
+    ユーザー: admin@example.com | パスワード: Admin123456
+
+## 🌟 主要機能
+### 📝 ロードマップ : [DEVELOPMENT_ROADMAP](docs/DEVELOPMENT_ROADMAP.md)
+
+### アップタイムサービス & インフラストラクチャサーバー監視
+- HTTP、DNS、Pingプロトコルの監視
+- TCPベースのAPIサービス（FTP、SMTP、HTTPなど）の監視
+- 詳細なアップタイム、レスポンス時間、パフォーマンス問題の追跡
+- 分散地域監視
+- インシデント履歴（UP/DOWN/WARNING/PAUSE）
+- SSL & ドメイン監視（ドメイン、発行者、有効期限、残り日数、ステータス、最終通知日）
+- インフラストラクチャサーバー監視：Linux（🐧 Debian、Ubuntu、CentOS、Red Hatなど）およびWindows（ベータ版）をサポート。ワンライン・インストール・エージェント・スクリプトによるサーバーメトリクス（CPU、RAM、ディスク使用量、ネットワーク活動）の監視
+- メンテナンススケジュール & インシデント管理
+- 運用ステータス / パブリックステータスページ
+- メール、Telegram、Discord、Slack経由の通知
+- レポート & 分析
+- 設定パネル（ユーザー管理、データ保持、多言語、テーマ（ダーク & ライトモード）、通知とチャネル、アラートテンプレート）
+
+## #️⃣ はじめに
+
+### 現在サポートされているアーキテクチャ
+* ✅ x86_64 PC、ラップトップ、サーバー（amd64）
+* ✅ 最新のRaspberry Pi 3/4/5（64ビットOS）、Apple Silicon Mac（arm64）
+
+### 以下のオプションのいずれかを使用してCheckCleをインストールします。
+
+1. Docker compose設定でインストール（推奨）
+```bash 
+
+version: '3.9'
+
+services:
+  checkcle:
+    image: operacle/checkcle:latest
+    container_name: checkcle
+    restart: unless-stopped
+    ports:
+      - "8090:8090"  # Webアプリケーション
+    volumes:
+      - /opt/pb_data:/mnt/pb_data  # ホストディレクトリをコンテナパスにマップ
+    ulimits:
+      nofile:
+        soft: 4096
+        hard: 8192
+
+```
+2. docker runでインストール。以下の準備済みdocker runコマンドをコピーするだけ
+```bash
+docker run -d \
+  --name checkcle \
+  --restart unless-stopped \
+  -p 8090:8090 \
+  -v /opt/pb_data:/mnt/pb_data \
+  --ulimit nofile=4096:8192 \
+  operacle/checkcle:latest
+
+```
+
+3. 管理Web画面
+
+    デフォルトURL: http://0.0.0.0:8090
+    ユーザー: admin@example.com
+    パスワード: Admin123456
+    
+4. https://docs.checkcle.io のクイックスタートガイドに従ってください
+
+###
+![checkcle-collapse-black](https://cdn.checkcle.io/images/uptime/uptime-1.4.png)
+![Service Detail Page](https://cdn.checkcle.io/images/uptime/uptime-regional-detail.png)
+![checkcle-server-instance](https://cdn.checkcle.io/images/server/server-list.png)
+![SSL Monitoring](https://cdn.checkcle.io/images/ssl-domain/ssl-list.png)
+![Notification System](https://cdn.checkcle.io/general/powerfull_notification.png)
+
+
+
+## 🌟 CheckCleはコミュニティのため？
+- **情熱を持って開発**: コミュニティのためのオープンソース愛好家によって作成
+- **フリー & オープンソース**: 隠れたコストなしで完全に無料で使用可能
+- **協力 & つながり**: オープンソースに情熱を持つ同志と出会う
+
+---
+
+## スポンサー
+スポンサーシップの受付は終了しました。今後は、クラウドサーバー、ドメイン、ホスティングクレジットなどのインフラストラクチャを提供するエコシステムおよびコミュニティパートナーシップの形でのみサポートを受け付けます。
+
+CheckCleをサポートすることに興味がある技術系企業の方は、著者まで直接お問い合わせください：tolaleng@checkcle.io
+
+### 🤝 エコシステム & コミュニティパートナー
+<div style="display: flex; align-items: center; gap: 10px;">
+  <a href="https://github.com/gitbookio">
+    <img src="https://avatars.githubusercontent.com/u/7111340?s=200&v=4"
+         width="75" height="75"
+         style="border-radius: 50%;"
+         alt="GitBook Logo" />
+  </a>
+
+  <a href="https://www.cloudflare.com">
+    <img src="https://cdn.checkcle.io/images/sponsor/cloudflare-checkcle_logo.png"
+         height="60"
+         alt="Cloudflare Logo" />
+  </a>
+    <a href="https://m.do.co/c/0c27ef82475f">
+    <img src="https://cdn.checkcle.io/images/sponsor/digitalocean_checkcle.png"
+         height="50"
+         alt="DigitalOcean Logo" />
+  </a>
+  </a>
+    <a href="https://www.jetbrains.com/">
+    <img src="https://cdn.checkcle.io/images/sponsor/jetbrains.png"
+         height="50"
+         alt="Jetbrains Logo" />
+  </a>
+</div>
+
+---
+
+## 👥 貢献者
+CheckCleの継続的な改善にご貢献いただき、ありがとうございます。皆様は素晴らしいです 🫶
+
+[![](https://contrib.rocks/image?repo=operacle/checkcle)](https://github.com/operacle/checkcle/graphs/contributors)
+
+---
+
+## 🤝 貢献の方法
+
+CheckCleの改善にご協力いただける方法をご紹介します：
+
+- 🐞 **バグ報告** – 不具合を発見しましたか？[GitHub Issue](https://github.com/operacle/checkcle/issues)を開いてお知らせください。
+- 🌟 **機能提案** – アイデアはありますか？[ディスカッション](https://github.com/operacle/checkcle/discussions)を開始するか、機能リクエストのissueを開いてください。
+- 🛠 **プルリクエスト送信** – コードの改善、バグ修正、機能追加、ドキュメントの改良を行ってください。
+- 📝 **ドキュメント改善** – タイポ修正でも助かります！
+- 🌍 **口コミ宣伝** – [CheckCle](https://github.com/operacle/checkcle.git) リポジトリに⭐をつけ、SNSでシェアし、他の人を貢献に招待してください！
+
+---
+
+## 🌍 つながりを保つ
+- ウェブサイト: [checkcle.io](https://checkcle.io)
+- ドキュメント: [docs.checkcle.io](https://docs.checkcle.io) | CheckCle OSS サイトプランをスポンサーしてくださった[GitBook](https://github.com/gitbookio)に特別な感謝を！
+- Discordでチャット: コミュニティに参加 [@discord](https://discord.gg/xs9gbubGwX)
+- Xでフォロー: [@checkcle_oss](https://x.com/checkcle_oss)
+
+## 📜 ライセンス
+
+CheckCleはMITライセンスの下でリリースされています。
+
+---
diff --git a/docs/README_km.md b/docs/README_km.md
new file mode 100644
index 0000000..4a057df
--- /dev/null
+++ b/docs/README_km.md
@@ -0,0 +1,188 @@
+## 🌐 Select Language
+
+<table align="center">
+  <tr>
+    <td align="center">
+      <a href="../README.md">
+        <img src="https://flagcdn.com/24x18/gb.png" alt="English" />  
+        <br/><strong>English</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_km.md">
+        <img src="https://flagcdn.com/24x18/kh.png" alt="Khmer" />  
+        <br/><strong>ខ្មែរ</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_ja.md">
+        <img src="https://flagcdn.com/24x18/jp.png" alt="Japanese" />  
+        <br/><strong>Japanese</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_zhcn.md">
+        <img src="https://flagcdn.com/24x18/cn.png" alt="Chinese" />  
+        <br/><strong>Chinese</strong>
+      </a>
+    </td>
+  </tr>
+</table>
+
+<p align="center">
+  Thank you to all our contributors, users, and supporters for making this project thrive.
+</p>
+
+<p align="center">
+  🚀 <strong>Stay tuned for more updates, features, and improvements.</strong>
+</p>
+
+![CheckCle Platform](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/server-detail-page.png)
+
+# 🚀 តើឆេកខលគឺជាអ្វី?
+
+ឆេកខល (CheckCle) គឺជាប្រពន័្ធប្រភពបើកចំហមួយដែលបើកអោយប្រើប្រាស់ទូទាំងពីភពលោកដោយឥតគិតថ្លៃ ដែលមានក្នុងមុខងារចំបងក្នុងការត្រួតពិនិត្យវ៉េបសាយ កម្មវិធីបច្ចេកវិទ្យា​និងហេដ្ឋារចនាសម្ព័ន្ធនៃម៉ាសុីនមេជាដើម។ វាផ្តល់ឱ្យអ្នកអភិវឌ្ឍន៍ អ្នកគ្រប់គ្រងប្រព័ន្ធ និងក្រុម DevOps នូវការពត័ស៊ីជម្រៅ និងទិន្នន័យនៃហេដ្ឋារចនាសម្ព័ន្ធ មិនថាជាម៉ាស៊ីនមេ កម្មវិធី ឬសេវាកម្មនោះទេ។ ជាមួយ CheckCle អ្នកមើលឃើញជាក្រាប វិភាគ​ និងហេតុការផ្សេងៗ​ និងធានាបាននូវការជូនដំណើរការនៅហេតុការផ្សេងៗដែលបានកើតឡើង។
+
+## 🎯 តេស្តសាកល្បងផ្ទាល់
+👉 **Try it now:** [CheckCle Live Demo](https://demo.checkcle.io)
+
+## 🌟 មុខងារចម្បង
+
+### ពិនិត្យប្រព័ន្ធវ៉េបសាយ និងការត្រួតពិនិត្យហេដ្ឋារចនាសម្ព័ន្ធនៃម៉ាស៊ីនមេ
+- ត្រួតពិនិត្យពិធីកម្មវិធី HTTP, DNS, and Ping protocols
+- ត្រួតពិនិត្យពិធីកម្មវិធី TCP-based, API services (e.g., FTP, SMTP, HTTP)
+- តាមដាននិងវិភាគលម្អិត, response times, and performance issues
+- តាមដាននិងវិភាគលម្អិតពីដំបន់ឬប្រទេសផ្សេងៗបាន
+- ប្រវត្តិឧប្បត្តិហេតុ (UP/DOWN/WARNING/PAUSE)
+- តាមដាន​ SSL & Domain (Domain, Issuer, Expiration Date, Days Left, Status, Last Notified)
+- តាមដាននិងត្រួតពិនិត្យម៉ាស៊ីនមេ, Supports Linux (🐧 Debian, Ubuntu, CentOS, Red Hat, etc.) and Windows (Beta). And Servers metrics like CPU, RAM, disk usage, and network activity) with an one-line installation angent script.
+- រៀបចំកាលវិភាគ និងការគ្រប់គ្រងឧប្បត្តិហេតុ
+- ទំព័រស្ថានភាពប្រតិបត្តិការ
+- ការជូនដំណឹងតាមរយៈ email, Telegram, Discord, and Slack
+- របាយការណ៍ & វិភាគលម្អិត
+- ផ្ទាំងការកំណត់ប្រព័ន្ធគ្រប់គ្រង (User Management, Data Retention, Multi-language, Themes (Dark & Light Mode), Notification and channels and alert templates).
+
+## #️⃣ ការចាប់ផ្តើម
+
+### ដំណើរការលើស្ថាបត្យកម្មដូចជា
+* ✅ x86_64 PCs, laptops, servers (amd64)
+* ✅ Modern Raspberry Pi 3/4/5 with (64-bit OS), Apple Silicon Macs (arm64)
+
+### អ្នកអាចដំឡើង CheckCle ដោយជ្រើសរើសជម្រើសមួយក្នុងចំណោមជម្រើសខាងក្រោម។
+
+
+1. CheckCle One-Click Installation - Just copy and run on terminal
+```bash 
+curl -fsSL https://checkcle.io/install.sh | bash
+
+```
+2. Install with docker run. Just copy ready docker run command below
+```bash 
+docker run -d \
+  --name checkcle \
+  --restart unless-stopped \
+  -p 8090:8090 \
+  -v /opt/pb_data:/mnt/pb_data \
+  --ulimit nofile=4096:8192 \
+  operacle/checkcle:latest
+
+```
+3. Install with Docker compose Configuration.
+```bash 
+
+version: '3.9'
+
+services:
+  checkcle:
+    image: operacle/checkcle:latest
+    container_name: checkcle
+    restart: unless-stopped
+    ports:
+      - "8090:8090"  # Web Application
+    volumes:
+      - /opt/pb_data:/mnt/pb_data  # Host directory mapped to container path
+    ulimits:
+      nofile:
+        soft: 4096
+        hard: 8192
+
+```
+3. ចូលទៅកាន់ផ្ទាំងគ្រប់គ្រង
+
+    Default URL: http://0.0.0.0:8090
+    User: admin@example.com
+    Passwd: Admin123456
+    
+4. ឯកសារ​ និងរបៀបប្រើប្រាស់ផ្សេង at https://docs.checkcle.io
+
+###
+![checkcle-collapse-black](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/uptime-monitoring.png)
+![Service Detail Page](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/uptime-service-detail.png)
+![checkcle-server-instance](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/instance-server-monitoring.png)
+![Schedule Maintenance](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/checkcle-schedule-maintenance.png)
+![SSL Monitoring](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/ssl-monitoring.png)
+
+## 📝 គម្រោងក្នុងការអភិវឌ្ឍន៍ប្រព័ន្ធគ្រប់គ្រង
+
+- ✅ Health check & uptime monitoring (HTTP)
+- ✅ Dashboard UI with live stats  
+- ✅ Auth with Multi-users system (admin)
+- ✅ Notifications (Telegram)
+- ✅ Docker containerization 
+- ✅ CheckCle Website
+- ✅ CheckCle Demo Server
+- ✅ SSL & Domain Monitoring
+- ✅ Schedule Maintenance 
+- ✅ Incident Management
+- [ ] Infrastructure Server Monitoring
+- ✅ Operational Status / Public Status Pages
+- ✅ Uptime monitoring (HTTP, TCP, PING, DNS) Full functionality
+- ✅ Distributed Regional Monitoring Agent [Support Operation](https://github.com/operacle/Distributed-Regional-Monitoring)
+- ✅ System Setting Panel and Mail Settings
+- ✅ User Permission Roles
+- [ ] Notifications (Email/Slack/Discord/Signal)  
+- ✅ Data Retention & Automate Strink (Muti Options to Shrink Data & Database )
+- ✅ Open-source release with full documentation 
+
+## 🌟 ឆេកខលសម្រាប់សហគមន៍
+- **Built with Passion**: Created by an open-source enthusiast for the community
+- **Free & Open Source**: Completely free to use with no hidden costs
+- **Collaborate & Connect**: Meet like-minded people passionate about Open Source
+
+---
+
+## 🤝 របៀបក្នុងការចូលរួមអភិវឌ្ឍន៍ប្រព័ន្ធកូដបើកជំហ
+
+នេះគឺជាវិធីមួយចំនួនដែលអ្នកអាចជួយកែលម្អ CheckCle:
+
+- 🐞 **រាយការណ៍កំហុស** - រកឃើញកំហុសថ្មី? អនុញ្ញាតឱ្យយើងដឹងដោយបើកផងដោយបង្កើត [GitHub Issue](https://github.com/operacle/checkcle/issues).
+- 🌟 **ផ្តល់យោបល់** – មានគំនិតថ្មី?​ អនុញ្ញាតឱ្យយើងដឹងដោយបើកផងដោយបង្កើត [Discussion](https://github.com/operacle/checkcle/discussions) or open a Feature Request issue.
+- 🛠 **បញ្ជូនសំណើអភិវឌ្ឍន៍កូដ** – កែលម្អកូដ ជួសជុលកំហុស បន្ថែមមុខងារ ឬកែលម្អឯកសារ។
+- 📝 **ធ្វើអោយឯកសារប្រសើរឡើង** – សូម្បីតែការកែលម្អបន្តិចបន្តួចក៏អាចជួយបាន!
+- 🌍 **ផ្សព្វផ្សាយ** – ដាក់ផ្កាយ ⭐ repo ចែករំលែកវានៅលើសង្គមហើយអញ្ជើញអ្នកផ្សេងទៀតឱ្យចូលរួមអភិវឌ្ឍន៍!
+
+---
+
+## 🌍 រក្សាទំនាក់ទំនង
+- វ៉េបសាយ: [checkcle.io](https://checkcle.io)
+- ឯកសារ: [docs.checkcle.io](https://docs.checkcle.io)
+- ឃ្លាំងផ្ទុកកូដ: ⭐ [CheckCle](https://github.com/operacle/checkcle.git)
+- ទំនាក់ទំនងក្រុម: Engage via discussions and issues!
+- បណ្តាញសង្គម: Join our community [@discord](https://discord.gg/xs9gbubGwX)
+- X: [@checkcle_oss](https://x.com/checkcle_oss)
+
+## 📜 License
+
+CheckCle ត្រូវបានចេញផ្សាយក្រោមអាជ្ញាប័ណ្ណ MIT ។
+
+---
+## 👥 អ្នករួមចំណែក
+
+[![](https://contrib.rocks/image?repo=operacle/checkcle)](https://github.com/operacle/checkcle/graphs/contributors)
+
+
+## ស្ថានភាពផ្តាយ
+
+[![Star History Chart](https://api.star-history.com/svg?repos=operacle/checkcle&type=Date)](https://www.star-history.com/#operacle/checkcle&Date)
+
+កុំភ្លេចប្រើប្រាស់ឆេកខលសម្រាប់ការងាររបស់អ្នក! 🌐
diff --git a/docs/README_zhcn.md b/docs/README_zhcn.md
new file mode 100644
index 0000000..7bdd5af
--- /dev/null
+++ b/docs/README_zhcn.md
@@ -0,0 +1,189 @@
+## 🌐 选择语言
+
+<table align="center">
+  <tr>
+    <td align="center">
+      <a href="../README.md">
+        <img src="https://flagcdn.com/24x18/gb.png" alt="English" />  
+        <br/><strong>English</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_km.md">
+        <img src="https://flagcdn.com/24x18/kh.png" alt="Khmer" />  
+        <br/><strong>ខ្មែរ</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_ja.md">
+        <img src="https://flagcdn.com/24x18/jp.png" alt="Japanese" />  
+        <br/><strong>Japanese</strong>
+      </a>
+    </td>
+    <td align="center">
+      <a href="README_zhcn.md">
+        <img src="https://flagcdn.com/24x18/cn.png" alt="Chinese" />  
+        <br/><strong>Chinese</strong>
+      </a>
+    </td>
+  </tr>
+</table>
+
+<p align="center">
+  感谢所有的贡献者、用户和支持者，是你们让这个项目蓬勃发展。
+</p>
+
+<p align="center">
+  🚀 <strong>敬请关注更多更新、功能和改进。</strong>
+</p>
+
+![CheckCle Platform](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/server-detail-page.png)
+
+# 🚀 CheckCle是什么？?
+
+CheckCle 是一款开源解决方案，用于对全栈系统、应用程序和基础设施进行无缝实时监控。它为开发人员、系统管理员和 DevOps 团队提供其环境各层（无论是服务器、应用程序还是服务）的深入洞察和可操作数据。借助 CheckCle，你可以在整个技术堆栈中获得可见性、控制权以及确保最佳性能的能力。
+
+## 🎯 在线演示  
+👉 **马上试试看:** [CheckCle Live Demo](https://demo.checkcle.io)
+    用户名: admin@example.com | 密码: Admin123456
+
+## 🌟 核心功能
+### 📝 开发路线图 : [DEVELOPMENT_ROADMAP](docs/DEVELOPMENT_ROADMAP.md) 
+
+### 服务可用性与基础设施/服务器监控
+- 监控 HTTP、DNS 和 Ping 协议
+- 监控基于 TCP 的服务与 API（如 FTP、SMTP、HTTP）
+- 跟踪详细的可用性（正常运行时间）、响应时间与性能问题
+- 分布式区域监控
+- 事件历史（UP / DOWN / WARNING / PAUSE：上线 / 下线 / 警告 / 暂停）
+- SSL 与域名监控（域名、签发者、到期日期、剩余天数、状态、上次通知）
+- 基础设施与服务器监控：支持 Linux（🐧Debian、Ubuntu、CentOS、Red Hat 等）与 Windows（Beta）；提供 CPU、内存、磁盘使用、网络活动等服务器指标；一行命令安装的 Agent 脚本
+- 维护计划与事件管理
+- 运行状态 / 公共状态页
+- 通过电子邮件、Telegram、Discord 和 Slack 通知
+- 报告与分析
+- 设置面板（用户管理、数据保留、多语言、主题〔深色/浅色模式〕、通知渠道与告警模板）
+
+## #️⃣ 入门指南
+
+### 当前架构支持
+* ✅ x86_64 PC、笔记本电脑、服务器 (amd64)
+* ✅ 现代树莓派3/4/5（搭载64位操作系统）、Apple Silicon Macs (arm64)
+
+### 使用以下方法之一安装 CheckCle ：
+
+1. 使用Docker Compose配置进行安装（推荐）
+```bash 
+
+version: '3.9'
+
+services:
+  checkcle:
+    image: operacle/checkcle:latest
+    container_name: checkcle
+    restart: unless-stopped
+    ports:
+      - "8090:8090"  # Web 应用端口
+    volumes:
+      - /opt/pb_data:/mnt/pb_data  # 将主机目录映射到容器路径
+    ulimits:
+      nofile:
+        soft: 4096
+        hard: 8192
+
+```
+2. 使用 docker run 进行安装。只需复制下面的 docker run 命令
+```bash 
+docker run -d \
+  --name checkcle \
+  --restart unless-stopped \
+  -p 8090:8090 \
+  -v /opt/pb_data:/mnt/pb_data \
+  --ulimit nofile=4096:8192 \
+  operacle/checkcle:latest
+
+```
+
+3. 网页管理
+
+    默认网址: http://0.0.0.0:8090
+    用户名: admin@example.com
+    密码: Admin123456
+    
+4. 遵循以下快速入门指南 https://docs.checkcle.io
+
+###
+![checkcle-collapse-black](https://pub-4a4062303020445f8f289a2fee84f9e8.r2.dev/images/uptime-1.4.png)
+![Service Detail Page](https://cdn.checkcle.io/images/uptime/uptime-regional-detail.png)
+![checkcle-server-instance](https://cdn.checkcle.io/images/server/server-list.png)
+![SSL Monitoring](https://cdn.checkcle.io/images/ssl-domain/ssl-list.png)
+![Notification System](https://cdn.checkcle.io/general/powerfull_notification.png)
+
+
+## 🌟 面向社区的 CheckCle
+
+- 以热忱打造：由一位开源爱好者为社区创建
+- 免费且开源：完全免费，无任何隐藏费用
+- 协作与连接：结识同样热爱开源的志同道合者
+
+---
+
+## 赞助商
+我们将不再接受赞助形式。从今以后，仅接受以生态系统和社区合作形式提供的支持，例如云服务器、域名或托管资源等基础设施支持。  
+
+如果您是科技公司且有意支持 CheckCle ，请直接通过邮箱 tolaleng@checkcle.io 联系作者。
+
+### 🧡 支持者
+<div style="display: flex; align-items: center; gap: 10px;">
+  <a href="https://github.com/gitbookio">
+    <img src="https://avatars.githubusercontent.com/u/7111340?s=200&v=4" 
+         width="75" height="75" 
+         style="border-radius: 50%;" 
+         alt="GitBook Logo" />
+  </a>
+
+  <a href="https://www.cloudflare.com">
+    <img src="https://cdn.checkcle.io/images/sponsor/cloudflare-checkcle_logo.png" 
+         height="60" 
+         alt="Cloudflare Logo" />
+  </a>
+    <a href="https://m.do.co/c/0c27ef82475f">
+    <img src="https://cdn.checkcle.io/images/sponsor/digitalocean_checkcle.png" 
+         height="50" 
+         alt="DigitalOcean Logo" />
+  </a>
+</div>
+
+---
+
+
+## 👥 贡献者
+感谢你为让CheckCle变得更好所做出的贡献与持续努力，你太棒了 🫶
+
+[![](https://contrib.rocks/image?repo=operacle/checkcle)](https://github.com/operacle/checkcle/graphs/contributors)
+
+---
+
+## 🤝 贡献方式
+
+以下是你可以帮助改进 CheckCle 的一些方式：
+
+- 🐞 **报告问题** – 发现故障/异常？请在提交 [GitHub Issue](https://github.com/operacle/checkcle/issues) 告诉我们。
+- 🌟 **建议功能** – 有个点子？发起 [Discussion](https://github.com/operacle/checkcle/discussions) 讨论，或提交一个功能请求 [Feature Request Issue](https://github.com/operacle/checkcle/issues)。
+- 🛠 **提交 Pull Request** – 改进代码、修复缺陷、添加功能，或完善文档。
+- 📝 **改善文档** – 就算是修正一个错别字也很有帮助！
+- 🌍 **传播项目** – 给 [CheckCle](https://github.com/operacle/checkcle.git) 仓库点个 Star ⭐，在社交平台分享，并邀请更多人参与贡献！
+
+---
+
+## 🌍 联系我们
+- 网站: [checkcle.io](https://checkcle.io)
+- 文档: [docs.checkcle.io](https://docs.checkcle.io) | 非常感谢 [GitBook](https://github.com/gitbookio) 赞助 CheckCle 的开源站点计划（OSS Site Plan）！
+- 在 Discord 上聊天: 加入我们的 [@discord](https://discord.gg/xs9gbubGwX) 频道 
+- 在 X 上关注我们: [@checkcle_oss](https://x.com/checkcle_oss)
+
+## 📜 许可证
+
+CheckCle 遵循 MIT 许可证发布。
+
+---
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..cc76d8e
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,6 @@
+{
+  "name": "checkcle",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {}
+}
diff --git a/scripts/entrypoint.sh b/scripts/entrypoint.sh
new file mode 100644
index 0000000..6b4e68e
--- /dev/null
+++ b/scripts/entrypoint.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+echo "Running on architecture: $(uname -m)"
+
+# Copy PocketBase data if empty
+if [ ! -f /mnt/pb_data/data.db ] && [ -d /app/pb_data ] && [ "$(ls -A /app/pb_data)" ]; then
+  cp -a /app/pb_data/. /mnt/pb_data/
+fi
+
+# Start PocketBase in the background
+echo "Starting CheckCle Application..."
+/app/pocketbase serve --http=0.0.0.0:8090 --dir /mnt/pb_data 2>&1 | grep -vE 'REST API|Dashboard' &
+
+# Wait for PocketBase to become available
+echo "Waiting for Backend Server to become available..."
+until curl -s http://localhost:8090/api/health >/dev/null; do
+  echo "Waiting on http://localhost:8090..."
+  sleep 1
+done
+
+echo "Backend Server is up!"
+
+# Start Go service
+echo "Starting Go Operational service..."
+/app/service-operation &
+
+echo "Default Access: admin@example.com/Admin123456"
+# Keep container alive
+wait
diff --git a/scripts/install-regional-agent.sh b/scripts/install-regional-agent.sh
new file mode 100644
index 0000000..92dba46
--- /dev/null
+++ b/scripts/install-regional-agent.sh
@@ -0,0 +1,367 @@
+
+#!/bin/bash
+
+# CheckCle Regional Monitoring Agent - Universal Installation Script
+# This script automatically detects system architecture and installs the appropriate package
+# Usage: curl -fsSL https://raw.githubusercontent.com/operacle/checkcle/main/scripts/install-regional-agent.sh | sudo bash -s -- [options]
+
+set -e
+
+# Default values
+REGION_NAME=""
+AGENT_ID=""
+AGENT_IP_ADDRESS=""
+AGENT_TOKEN=""
+POCKETBASE_URL=""
+BASE_PACKAGE_URL="https://github.com/operacle/Distributed-Regional-Monitoring/releases/download/V1.0.0"
+PACKAGE_VERSION="1.0.0"
+SERVICE_NAME="regional-check-agent"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Helper functions
+log_info() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+log_success() {
+    echo -e "${GREEN}[SUCCESS]${NC} $1"
+}
+
+log_warning() {
+    echo -e "${YELLOW}[WARNING]${NC} $1"
+}
+
+log_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+# Function to show usage
+show_usage() {
+    echo "Usage: $0 [OPTIONS]"
+    echo ""
+    echo "Options:"
+    echo "  --region-name=NAME        Set the region name (required)"
+    echo "  --agent-id=ID            Set the agent ID (required)"
+    echo "  --agent-ip=IP            Set the agent IP address (required)"
+    echo "  --token=TOKEN            Set the authentication token (required)"
+    echo "  --pocketbase-url=URL     Set the PocketBase API URL (required)"
+    echo "  --package-version=VER    Set package version (default: $PACKAGE_VERSION)"
+    echo "  --help                   Show this help message"
+    echo ""
+    echo "Example:"
+    echo "  $0 --region-name=\"us-east-1\" --agent-id=\"agent_abc123\" \\"
+    echo "     --agent-ip=\"192.168.1.100\" --token=\"your-token\" \\"
+    echo "     --pocketbase-url=\"https://your-pb.com\""
+}
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --region-name=*)
+            REGION_NAME="${1#*=}"
+            shift
+            ;;
+        --agent-id=*)
+            AGENT_ID="${1#*=}"
+            shift
+            ;;
+        --agent-ip=*)
+            AGENT_IP_ADDRESS="${1#*=}"
+            shift
+            ;;
+        --token=*)
+            AGENT_TOKEN="${1#*=}"
+            shift
+            ;;
+        --pocketbase-url=*)
+            POCKETBASE_URL="${1#*=}"
+            shift
+            ;;
+        --package-version=*)
+            PACKAGE_VERSION="${1#*=}"
+            shift
+            ;;
+        --help)
+            show_usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1"
+            show_usage
+            exit 1
+            ;;
+    esac
+done
+
+# Validate required parameters
+if [[ -z "$REGION_NAME" || -z "$AGENT_ID" || -z "$AGENT_IP_ADDRESS" || -z "$AGENT_TOKEN" || -z "$POCKETBASE_URL" ]]; then
+    log_error "Missing required parameters"
+    echo ""
+    show_usage
+    exit 1
+fi
+
+echo "============================================="
+echo "  CheckCle Regional Monitoring Agent"
+echo "  Universal Installation"
+echo "============================================="
+
+# Check if running as root
+if [[ $EUID -ne 0 ]]; then
+   log_error "This script must be run as root (use sudo)" 
+   echo "   Usage: sudo bash $0 [options]"
+   exit 1
+fi
+
+# Detect operating system
+OS_TYPE=$(uname -s | tr '[:upper:]' '[:lower:]')
+
+# Check if it's a supported OS
+if [[ "$OS_TYPE" != "linux" ]]; then
+    log_error "Unsupported operating system: $OS_TYPE"
+    log_info "This installer only supports Linux systems"
+    exit 1
+fi
+
+# Detect architecture
+ARCH=$(uname -m)
+
+# Map architecture to package architecture
+case $ARCH in
+    x86_64|amd64)
+        PKG_ARCH="amd64"
+        ;;
+    aarch64|arm64)
+        PKG_ARCH="arm64"
+        ;;
+    armv7l|armv6l)
+        PKG_ARCH="arm64"
+        log_warning "ARM 32-bit detected, using ARM64 package (may require compatibility layer)"
+        ;;
+    *)
+        log_error "Unsupported architecture: $ARCH"
+        log_info "Supported architectures: x86_64 (amd64), aarch64 (arm64)"
+        exit 1
+        ;;
+esac
+
+log_success "System: $OS_TYPE ($ARCH -> $PKG_ARCH)"
+
+# Construct package URLs and names
+PACKAGE_URL="$BASE_PACKAGE_URL/distributed-regional-check-agent_${PACKAGE_VERSION}_${PKG_ARCH}.deb"
+PACKAGE_NAME="distributed-regional-check-agent_${PACKAGE_VERSION}_${PKG_ARCH}.deb"
+
+# Check for required tools
+MISSING_TOOLS=()
+
+if ! command -v wget >/dev/null 2>&1 && ! command -v curl >/dev/null 2>&1; then
+    MISSING_TOOLS+=("wget or curl")
+fi
+
+if ! command -v dpkg >/dev/null 2>&1; then
+    MISSING_TOOLS+=("dpkg")
+fi
+
+if ! command -v systemctl >/dev/null 2>&1; then
+    MISSING_TOOLS+=("systemd")
+fi
+
+if [ ${#MISSING_TOOLS[@]} -ne 0 ]; then
+    log_error "Missing required tools: ${MISSING_TOOLS[*]}"
+    log_info "On Debian/Ubuntu: sudo apt-get update && sudo apt-get install wget curl"
+    exit 1
+fi
+
+# Create temporary directory
+TEMP_DIR=$(mktemp -d)
+
+# Download the .deb package
+log_info "Downloading package for $PKG_ARCH..."
+cd "$TEMP_DIR"
+
+# Test if package exists first
+if command -v curl >/dev/null 2>&1; then
+    HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -I "$PACKAGE_URL")
+    if [ "$HTTP_STATUS" != "200" ] && [ "$HTTP_STATUS" != "302" ]; then
+        log_error "Package not found at $PACKAGE_URL (HTTP $HTTP_STATUS)"
+        log_info "Check: https://github.com/operacle/Distributed-Regional-Monitoring/releases"
+        rm -rf "$TEMP_DIR"
+        exit 1
+    fi
+fi
+
+# Try wget first, then curl as fallback
+DOWNLOAD_SUCCESS=false
+
+if command -v wget >/dev/null 2>&1; then
+    if wget -q --show-progress --timeout=30 --tries=3 "$PACKAGE_URL" -O "$PACKAGE_NAME"; then
+        DOWNLOAD_SUCCESS=true
+    fi
+fi
+
+if [ "$DOWNLOAD_SUCCESS" = false ] && command -v curl >/dev/null 2>&1; then
+    if curl -L --connect-timeout 30 --max-time 300 --retry 3 --retry-delay 2 -o "$PACKAGE_NAME" "$PACKAGE_URL" --progress-bar; then
+        DOWNLOAD_SUCCESS=true
+    fi
+fi
+
+if [ "$DOWNLOAD_SUCCESS" = false ]; then
+    log_error "Failed to download package from $PACKAGE_URL"
+    log_info "Check internet connection and package availability"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Verify download was successful
+if [ ! -f "$PACKAGE_NAME" ] || [ ! -s "$PACKAGE_NAME" ]; then
+    log_error "Downloaded package is empty or missing"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Verify package integrity
+if dpkg-deb --info "$PACKAGE_NAME" > /dev/null 2>&1; then
+    log_success "Package verified"
+else
+    log_error "Package verification failed - corrupted download"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Install the package
+log_info "Installing package..."
+if dpkg -i "$PACKAGE_NAME" 2>/dev/null; then
+    log_success "Package installed"
+else
+    log_warning "Fixing dependencies..."
+    if apt-get update && apt-get install -f -y; then
+        log_success "Package installed with dependencies"
+    else
+        log_error "Failed to install package"
+        log_info "Try: sudo apt-get update && sudo apt-get install -f"
+        rm -rf "$TEMP_DIR"
+        exit 1
+    fi
+fi
+
+# Configure the agent
+log_info "Configuring agent..."
+
+# Ensure configuration directory exists
+mkdir -p /etc/regional-check-agent
+
+# Create the environment configuration file
+cat > /etc/regional-check-agent/regional-check-agent.env << EOF
+# Distributed Regional Check Agent Configuration
+# Auto-generated on $(date)
+
+# Server Configuration
+PORT=8091
+
+# Operation defaults
+DEFAULT_COUNT=4
+DEFAULT_TIMEOUT=10s
+MAX_COUNT=20
+MAX_TIMEOUT=30s
+
+# Logging
+ENABLE_LOGGING=true
+
+# PocketBase integration
+POCKETBASE_ENABLED=true
+POCKETBASE_URL=$POCKETBASE_URL
+
+# Regional Agent Configuration
+REGION_NAME=$REGION_NAME
+AGENT_ID=$AGENT_ID
+AGENT_IP_ADDRESS=$AGENT_IP_ADDRESS
+AGENT_TOKEN=$AGENT_TOKEN
+
+# Monitoring configuration
+CHECK_INTERVAL=30s
+MAX_RETRIES=3
+REQUEST_TIMEOUT=10s
+EOF
+
+# Set proper permissions
+if id "regional-check-agent" &>/dev/null; then
+    chown root:regional-check-agent /etc/regional-check-agent/regional-check-agent.env
+    chmod 640 /etc/regional-check-agent/regional-check-agent.env
+else
+    chown root:root /etc/regional-check-agent/regional-check-agent.env
+    chmod 600 /etc/regional-check-agent/regional-check-agent.env
+fi
+
+log_success "Configuration complete"
+
+# Enable and start the service
+log_info "Starting service..."
+
+# Reload systemd daemon
+systemctl daemon-reload
+
+# Enable the service for auto-start
+if systemctl enable $SERVICE_NAME; then
+    log_success "Service enabled"
+else
+    log_error "Failed to enable service"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Start the service
+if systemctl start $SERVICE_NAME; then
+    log_success "Service started"
+else
+    log_error "Failed to start service"
+    log_info "Check logs: sudo journalctl -u $SERVICE_NAME -f"
+    rm -rf "$TEMP_DIR"
+    exit 1
+fi
+
+# Wait a moment for service to initialize
+sleep 5
+
+# Test health endpoint
+HEALTH_CHECK_ATTEMPTS=3
+for i in $(seq 1 $HEALTH_CHECK_ATTEMPTS); do
+    if curl -s -f --connect-timeout 5 http://localhost:8091/health > /dev/null; then
+        log_success "Health endpoint responding"
+        break
+    else
+        if [ $i -lt $HEALTH_CHECK_ATTEMPTS ]; then
+            sleep 2
+        else
+            log_warning "Health endpoint not responding (service may still be starting)"
+        fi
+    fi
+done
+
+# Cleanup
+rm -rf "$TEMP_DIR"
+
+echo ""
+echo "============================================="
+echo "  Installation Complete!"
+echo "============================================="
+echo ""
+log_success "CheckCle Regional Monitoring Agent installed successfully"
+echo ""
+echo "Agent Details:"
+echo "  Region: $REGION_NAME"
+echo "  Agent ID: $AGENT_ID"
+echo "  Status: $(systemctl is-active $SERVICE_NAME 2>/dev/null || echo 'unknown')"
+echo "  Health: http://localhost:8091/health"
+echo ""
+echo "Management Commands:"
+echo "  Status: sudo systemctl status $SERVICE_NAME"
+echo "  Logs: sudo journalctl -u $SERVICE_NAME -f"
+echo "  Restart: sudo systemctl restart $SERVICE_NAME"
+echo ""
+log_success "Agent is now monitoring and reporting to your dashboard!"
\ No newline at end of file
diff --git a/scripts/server-agent.sh b/scripts/server-agent.sh
new file mode 100644
index 0000000..5f5d6f5
--- /dev/null
+++ b/scripts/server-agent.sh
@@ -0,0 +1,753 @@
+#!/bin/bash
+
+# CheckCle Server Monitoring Agent - One-Click Installation Script
+# This script provides fully automated installation using environment variables
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CONFIG_FILE="/etc/monitoring-agent/monitoring-agent.env"
+
+# GitHub release base URL
+GITHUB_BASE_URL="https://github.com/operacle/checke-server-agent/releases/download/v1.0.0"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Helper functions
+log_info() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+log_success() {
+    echo -e "${GREEN}[SUCCESS]${NC} $1"
+}
+
+log_warning() {
+    echo -e "${YELLOW}[WARNING]${NC} $1"
+}
+
+log_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+# Check if running as root
+check_root() {
+    if [[ $EUID -ne 0 ]]; then
+        log_error "This script must be run as root (use sudo)"
+        exit 1
+    fi
+}
+
+# Detect system architecture and package format with fallback
+detect_system() {
+    log_info "Detecting system architecture and package format..."
+    
+    # Detect architecture
+    ARCH=$(uname -m)
+    case $ARCH in
+        x86_64)
+            PACKAGE_ARCH="amd64"
+            ;;
+        aarch64|arm64)
+            PACKAGE_ARCH="arm64"
+            ;;
+        *)
+            log_error "Unsupported architecture: $ARCH"
+            log_info "Supported architectures: x86_64 (amd64), aarch64/arm64"
+            exit 1
+            ;;
+    esac
+    
+    # Detect OS and preferred package format
+    PREFERRED_FORMAT=""
+    PREFERRED_MANAGER=""
+    
+    if [[ -f /etc/os-release ]]; then
+        OS_ID=$(grep "^ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"')
+        OS_LIKE=$(grep "^ID_LIKE=" /etc/os-release 2>/dev/null | cut -d'=' -f2 | tr -d '"' || echo "")
+        
+        log_info "Detected OS: $OS_ID"
+        [[ -n "$OS_LIKE" ]] && log_info "OS family: $OS_LIKE"
+        
+        # Determine preferred package format based on OS
+        case "$OS_ID" in
+            debian|ubuntu|linuxmint|elementary|pop)
+                PREFERRED_FORMAT="deb"
+                PREFERRED_MANAGER="dpkg"
+                ;;
+            rhel|centos|fedora|rocky|almalinux|oracle|amazonlinux)
+                PREFERRED_FORMAT="rpm"
+                if command -v dnf >/dev/null 2>&1; then
+                    PREFERRED_MANAGER="dnf"
+                elif command -v yum >/dev/null 2>&1; then
+                    PREFERRED_MANAGER="yum"
+                else
+                    PREFERRED_MANAGER="rpm"
+                fi
+                ;;
+            arch|manjaro|artix|endeavouros)
+                # Arch-based systems - use tar.gz fallback
+                log_info "Arch-based system detected, using tar.gz format"
+                PREFERRED_FORMAT="tar.gz"
+                PREFERRED_MANAGER="tar"
+                ;;
+            *)
+                # Check OS_LIKE for family detection
+                if [[ "$OS_LIKE" == *"debian"* ]] || [[ "$OS_LIKE" == *"ubuntu"* ]]; then
+                    PREFERRED_FORMAT="deb"
+                    PREFERRED_MANAGER="dpkg"
+                elif [[ "$OS_LIKE" == *"rhel"* ]] || [[ "$OS_LIKE" == *"fedora"* ]]; then
+                    PREFERRED_FORMAT="rpm"
+                    if command -v dnf >/dev/null 2>&1; then
+                        PREFERRED_MANAGER="dnf"
+                    elif command -v yum >/dev/null 2>&1; then
+                        PREFERRED_MANAGER="yum"
+                    else
+                        PREFERRED_MANAGER="rpm"
+                    fi
+                elif [[ "$OS_LIKE" == *"arch"* ]]; then
+                    PREFERRED_FORMAT="tar.gz"
+                    PREFERRED_MANAGER="tar"
+                fi
+                ;;
+        esac
+    fi
+    
+    # If no preferred format detected, check available package managers
+    if [[ -z "$PREFERRED_FORMAT" ]]; then
+        if command -v dpkg >/dev/null 2>&1; then
+            PREFERRED_FORMAT="deb"
+            PREFERRED_MANAGER="dpkg"
+        elif command -v rpm >/dev/null 2>&1; then
+            PREFERRED_FORMAT="rpm"
+            if command -v dnf >/dev/null 2>&1; then
+                PREFERRED_MANAGER="dnf"
+            elif command -v yum >/dev/null 2>&1; then
+                PREFERRED_MANAGER="yum"
+            else
+                PREFERRED_MANAGER="rpm"
+            fi
+        else
+            # Fallback to tar.gz for unsupported systems
+            log_info "No native package manager found, using tar.gz fallback"
+            PREFERRED_FORMAT="tar.gz"
+            PREFERRED_MANAGER="tar"
+        fi
+    fi
+    
+    # Set initial package format and manager
+    PACKAGE_FORMAT="$PREFERRED_FORMAT"
+    PACKAGE_MANAGER="$PREFERRED_MANAGER"
+    
+    # Construct initial package filename and URL
+    construct_package_url
+    
+    log_success "System detection complete:"
+    log_info "  Architecture: $ARCH -> $PACKAGE_ARCH"
+    log_info "  Package format: $PACKAGE_FORMAT"
+    log_info "  Package manager: $PACKAGE_MANAGER"
+    log_info "  Package URL: $PACKAGE_URL"
+}
+
+# Construct package URL based on current format
+construct_package_url() {
+    if [[ "$PACKAGE_FORMAT" == "tar.gz" ]]; then
+        PACKAGE_FILENAME="monitoring-agent_1.0.0_${PACKAGE_ARCH}.tar.gz"
+    else
+        PACKAGE_FILENAME="monitoring-agent_1.0.0_${PACKAGE_ARCH}.${PACKAGE_FORMAT}"
+    fi
+    PACKAGE_URL="${GITHUB_BASE_URL}/${PACKAGE_FILENAME}"
+}
+
+# Validate required environment variables - check both current and sudo environments
+validate_environment() {
+    # Check if SERVER_TOKEN is available in current environment or passed as argument
+    if [[ -z "$SERVER_TOKEN" ]]; then
+        log_error "SERVER_TOKEN environment variable is required"
+        log_info "Usage examples:"
+        log_info "  SERVER_TOKEN=your-token sudo -E bash $0"
+        log_info "  sudo SERVER_TOKEN=your-token bash $0" 
+        log_info "  curl -L script-url | SERVER_TOKEN=your-token sudo bash"
+        log_info ""
+        log_info "Required: SERVER_TOKEN"
+        log_info "Optional: POCKETBASE_URL, SERVER_NAME, AGENT_ID, HEALTH_CHECK_PORT"
+        exit 1
+    fi
+    
+    log_success "Environment validation passed"
+    log_info "SERVER_TOKEN: ${SERVER_TOKEN:0:8}..."
+    [[ -n "$POCKETBASE_URL" ]] && log_info "POCKETBASE_URL: $POCKETBASE_URL"
+    [[ -n "$SERVER_NAME" ]] && log_info "SERVER_NAME: $SERVER_NAME"
+    [[ -n "$AGENT_ID" ]] && log_info "AGENT_ID: $AGENT_ID"
+}
+
+# Download package with fallback to tar.gz
+download_package() {
+    local temp_dir="/tmp/monitoring-agent-install"
+    mkdir -p "$temp_dir"
+    
+    log_info "Downloading monitoring agent package..."
+    log_info "URL: $PACKAGE_URL"
+    
+    # Try to download the preferred package format first
+    if curl -L -f -s -o "$temp_dir/$PACKAGE_FILENAME" "$PACKAGE_URL" 2>/dev/null; then
+        # Verify the file was actually downloaded and has content
+        if [[ -s "$temp_dir/$PACKAGE_FILENAME" ]]; then
+            DOWNLOADED_PACKAGE="$temp_dir/$PACKAGE_FILENAME"
+            log_success "Package downloaded successfully: $PACKAGE_FILENAME"
+            return 0
+        else
+            log_warning "Downloaded file is empty, trying fallback..."
+            rm -f "$temp_dir/$PACKAGE_FILENAME"
+        fi
+    else
+        log_warning "Failed to download preferred package format: $PACKAGE_FORMAT"
+    fi
+    
+    # If preferred format failed and it's not tar.gz, try tar.gz fallback
+    if [[ "$PACKAGE_FORMAT" != "tar.gz" ]]; then
+        log_warning "Native package ($PACKAGE_FORMAT) not available, trying tar.gz fallback..."
+        
+        # Switch to tar.gz format
+        PACKAGE_FORMAT="tar.gz"
+        PACKAGE_MANAGER="tar"
+        construct_package_url
+        
+        log_info "Fallback URL: $PACKAGE_URL"
+        
+        if curl -L -f -s -o "$temp_dir/$PACKAGE_FILENAME" "$PACKAGE_URL" 2>/dev/null; then
+            # Verify the file was actually downloaded and has content
+            if [[ -s "$temp_dir/$PACKAGE_FILENAME" ]]; then
+                DOWNLOADED_PACKAGE="$temp_dir/$PACKAGE_FILENAME"
+                log_success "Fallback package downloaded successfully: $PACKAGE_FILENAME"
+                return 0
+            else
+                log_error "Downloaded fallback file is empty"
+                rm -f "$temp_dir/$PACKAGE_FILENAME"
+            fi
+        else
+            log_error "Failed to download tar.gz fallback"
+        fi
+    fi
+    
+    # Both attempts failed
+    log_error "Failed to download package from: $PACKAGE_URL"
+    log_info "Please check:"
+    log_info "  1. Internet connectivity"
+    log_info "  2. Package availability for your architecture ($PACKAGE_ARCH)"
+    log_info "  3. GitHub repository access"
+    exit 1
+}
+
+# Install tar.gz package
+install_tar_package() {
+    log_info "Installing monitoring agent from tar.gz package..."
+    
+    local temp_extract_dir="/tmp/monitoring-agent-extract"
+    mkdir -p "$temp_extract_dir"
+    
+    # Extract tar.gz package
+    if tar -xzf "$DOWNLOADED_PACKAGE" -C "$temp_extract_dir"; then
+        log_success "Package extracted successfully"
+    else
+        log_error "Failed to extract tar.gz package"
+        exit 1
+    fi
+    
+    # Install files to their proper locations
+    log_info "Installing files to system directories..."
+    
+    # Create necessary directories
+    mkdir -p /usr/bin
+    mkdir -p /etc/monitoring-agent
+    mkdir -p /var/lib/monitoring-agent
+    mkdir -p /var/log/monitoring-agent
+    
+    # Detect systemd service directory based on OS
+    if [[ -d /lib/systemd/system ]]; then
+        SYSTEMD_DIR="/lib/systemd/system"
+    elif [[ -d /usr/lib/systemd/system ]]; then
+        SYSTEMD_DIR="/usr/lib/systemd/system"
+    else
+        SYSTEMD_DIR="/etc/systemd/system"
+    fi
+    mkdir -p "$SYSTEMD_DIR"
+    
+    # Copy files from extracted package
+    if [[ -f "$temp_extract_dir/usr/bin/monitoring-agent" ]]; then
+        cp "$temp_extract_dir/usr/bin/monitoring-agent" /usr/bin/
+        chmod +x /usr/bin/monitoring-agent
+        log_success "Binary installed to /usr/bin/monitoring-agent"
+    else
+        log_error "Binary not found in package"
+        exit 1
+    fi
+    
+    if [[ -f "$temp_extract_dir/etc/monitoring-agent/monitoring-agent.env" ]]; then
+        cp "$temp_extract_dir/etc/monitoring-agent/monitoring-agent.env" /etc/monitoring-agent/
+        log_success "Configuration template installed"
+    fi
+    
+    # Create monitoring-agent user and group if they don't exist
+    if ! getent group monitoring-agent >/dev/null 2>&1; then
+        groupadd --system monitoring-agent
+        log_success "Created monitoring-agent group"
+    else
+        log_info "monitoring-agent group already exists"
+    fi
+    
+    if ! getent passwd monitoring-agent >/dev/null 2>&1; then
+        useradd --system --gid monitoring-agent --home-dir /var/lib/monitoring-agent --shell /bin/false --comment "Monitoring Agent" monitoring-agent
+        log_success "Created monitoring-agent user"
+    else
+        log_info "monitoring-agent user already exists"
+    fi
+    
+    # Set proper ownership and permissions
+    chown -R monitoring-agent:monitoring-agent /var/lib/monitoring-agent
+    chown -R monitoring-agent:monitoring-agent /var/log/monitoring-agent
+    chown -R monitoring-agent:monitoring-agent /etc/monitoring-agent
+    chmod 755 /var/lib/monitoring-agent
+    chmod 755 /var/log/monitoring-agent
+    chmod 755 /etc/monitoring-agent
+    
+    # Check if Docker is installed and configure service file accordingly
+    DOCKER_AVAILABLE=false
+    if command -v docker >/dev/null 2>&1 && getent group docker >/dev/null 2>&1; then
+        DOCKER_AVAILABLE=true
+        # Add monitoring-agent user to docker group if Docker is available
+        usermod -a -G docker monitoring-agent
+        log_info "Docker detected, added monitoring-agent user to docker group"
+    else
+        log_info "Docker not detected, skipping Docker group configuration"
+    fi
+    
+    # Create the systemd service file with proper Docker configuration
+    create_systemd_service_file "$SYSTEMD_DIR" "$DOCKER_AVAILABLE"
+    
+    # Clean up extraction directory
+    rm -rf "$temp_extract_dir"
+    
+    log_success "Tar.gz package installation completed"
+}
+
+# Create systemd service file with Docker configuration
+create_systemd_service_file() {
+    local systemd_dir="$1"
+    local docker_available="$2"
+    
+    log_info "Creating systemd service file at $systemd_dir/monitoring-agent.service"
+    
+    cat > "$systemd_dir/monitoring-agent.service" << 'EOF'
+[Unit]
+Description=CheckCle Server Monitoring Agent
+Documentation=https://github.com/operacle/checkcle-server-agent
+After=network.target
+Wants=network.target
+
+[Service]
+Type=simple
+User=monitoring-agent
+Group=monitoring-agent
+EOF
+
+    # Add Docker group only if Docker is available
+    if [[ "$docker_available" == "true" ]]; then
+        echo "# Add docker group for Docker monitoring access" >> "$systemd_dir/monitoring-agent.service"
+        echo "SupplementaryGroups=docker" >> "$systemd_dir/monitoring-agent.service"
+    else
+        echo "# Docker not available - skipping Docker group configuration" >> "$systemd_dir/monitoring-agent.service"
+    fi
+
+    # Continue with the rest of the service configuration
+    cat >> "$systemd_dir/monitoring-agent.service" << 'EOF'
+ExecStart=/usr/bin/monitoring-agent
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+# Security settings
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+RestrictRealtime=yes
+
+# Allow access to system information and configuration
+ReadWritePaths=/var/log/monitoring-agent
+ReadOnlyPaths=/proc /sys /etc/monitoring-agent
+
+# Network access
+PrivateNetwork=no
+
+# Environment
+EnvironmentFile=/etc/monitoring-agent/monitoring-agent.env
+WorkingDirectory=/var/lib/monitoring-agent
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    
+    log_success "Created systemd service file with Docker support: $docker_available"
+}
+
+# Install package based on detected package manager
+install_package() {
+    log_info "Installing monitoring agent package using $PACKAGE_MANAGER..."
+    
+    case $PACKAGE_MANAGER in
+        dpkg)
+            # Update package lists
+            apt-get update -qq
+            
+            # Install the package
+            if dpkg -i "$DOWNLOADED_PACKAGE" 2>/dev/null; then
+                log_success "DEB package installed successfully"
+            else
+                log_warning "Package installation had dependency issues, fixing..."
+                apt-get install -f -y
+                log_success "Dependencies resolved and package installed"
+            fi
+            ;;
+            
+        rpm)
+            # Install the package directly
+            if rpm -ivh "$DOWNLOADED_PACKAGE" 2>/dev/null; then
+                log_success "RPM package installed successfully"
+            else
+                log_error "RPM package installation failed"
+                log_info "Try installing manually: sudo rpm -ivh $DOWNLOADED_PACKAGE"
+                exit 1
+            fi
+            ;;
+            
+        yum)
+            if yum localinstall -y "$DOWNLOADED_PACKAGE"; then
+                log_success "Package installed successfully via YUM"
+            else
+                log_error "YUM package installation failed"
+                exit 1
+            fi
+            ;;
+            
+        dnf)
+            if dnf localinstall -y "$DOWNLOADED_PACKAGE"; then
+                log_success "Package installed successfully via DNF"
+            else
+                log_error "DNF package installation failed"
+                exit 1
+            fi
+            ;;
+            
+        tar)
+            install_tar_package
+            ;;
+            
+        *)
+            log_error "Unsupported package manager: $PACKAGE_MANAGER"
+            exit 1
+            ;;
+    esac
+}
+
+# Auto-detect system information
+detect_system_info() {
+    log_info "Auto-detecting system information..."
+    
+    # Detect hostname
+    DETECTED_HOSTNAME=$(hostname)
+    log_info "Detected hostname: $DETECTED_HOSTNAME"
+    
+    # Detect IP address
+    DETECTED_IP=$(ip route get 8.8.8.8 2>/dev/null | head -1 | awk '{print $7}' | head -1)
+    if [[ -z "$DETECTED_IP" ]]; then
+        DETECTED_IP=$(hostname -I | awk '{print $1}')
+    fi
+    log_info "Detected IP address: $DETECTED_IP"
+    
+    # Detect OS
+    if [[ -f /etc/os-release ]]; then
+        DETECTED_OS=$(grep "^ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"')
+    else
+        DETECTED_OS="linux"
+    fi
+    log_info "Detected OS: $DETECTED_OS"
+}
+
+# Configure agent using environment variables
+configure_agent() {
+    log_info "Configuring agent with provided settings..."
+    
+    # Use environment variables or auto-detected defaults
+    SERVER_NAME="${SERVER_NAME:-$DETECTED_HOSTNAME}"
+    POCKETBASE_URL="${POCKETBASE_URL:-http://localhost:8090}"
+    IP_ADDRESS="${IP_ADDRESS:-$DETECTED_IP}"
+    HOSTNAME="${HOSTNAME:-$DETECTED_HOSTNAME}"
+    OS_TYPE="${OS_TYPE:-$DETECTED_OS}"
+    AGENT_ID="${AGENT_ID:-monitoring-agent-$(hostname -s)}"
+    HEALTH_CHECK_PORT="${HEALTH_CHECK_PORT:-8081}"
+    
+    log_info "Final configuration:"
+    log_info "  Server Name: $SERVER_NAME"
+    log_info "  Agent ID: $AGENT_ID"
+    log_info "  PocketBase URL: $POCKETBASE_URL"
+    log_info "  IP Address: $IP_ADDRESS"
+    log_info "  OS Type: $OS_TYPE"
+    log_info "  Health Check Port: $HEALTH_CHECK_PORT"
+    
+    write_config
+}
+
+# Write configuration to file
+write_config() {
+    log_info "Writing configuration to $CONFIG_FILE..."
+    
+    # Create directory if it doesn't exist
+    mkdir -p "$(dirname "$CONFIG_FILE")"
+    
+    cat > "$CONFIG_FILE" << EOF
+# CheckCle Server Monitoring Agent Configuration
+# Generated on $(date)
+
+# Basic Configuration
+AGENT_ID=$AGENT_ID
+CHECK_INTERVAL=30s
+HEALTH_CHECK_PORT=$HEALTH_CHECK_PORT
+
+# PocketBase Configuration
+POCKETBASE_ENABLED=true
+POCKETBASE_URL=$POCKETBASE_URL
+
+# Server Configuration
+SERVER_NAME=$SERVER_NAME
+HOSTNAME=$HOSTNAME
+IP_ADDRESS=$IP_ADDRESS
+OS_TYPE=$OS_TYPE
+SERVER_TOKEN=$SERVER_TOKEN
+
+# Remote Control
+REMOTE_CONTROL_ENABLED=true
+COMMAND_CHECK_INTERVAL=10s
+
+# Monitoring Settings
+REPORT_INTERVAL=5m
+MAX_RETRIES=3
+REQUEST_TIMEOUT=10s
+EOF
+    
+    # Set proper permissions
+    chown root:monitoring-agent "$CONFIG_FILE" 2>/dev/null || chown root:root "$CONFIG_FILE"
+    chmod 640 "$CONFIG_FILE"
+    
+    log_success "Configuration written successfully"
+}
+
+# Start and enable service
+start_service() {
+    log_info "Starting monitoring agent service..."
+    
+    # Reload systemd
+    systemctl daemon-reload
+    
+    # Enable service
+    systemctl enable monitoring-agent
+    log_success "Service enabled for auto-start"
+    
+    # Start service
+    if systemctl start monitoring-agent; then
+        log_success "Service started successfully"
+    else
+        log_error "Failed to start service"
+        log_info "Check logs with: journalctl -u monitoring-agent -f"
+        return 1
+    fi
+    
+    # Check service status
+    sleep 2
+    if systemctl is-active --quiet monitoring-agent; then
+        log_success "Service is running"
+    else
+        log_warning "Service may have issues, checking status..."
+        systemctl status monitoring-agent --no-pager
+        return 1
+    fi
+}
+
+# Test installation
+test_installation() {
+    log_info "Testing installation..."
+    
+    # Test health endpoint
+    local health_port=${HEALTH_CHECK_PORT:-8081}
+    log_info "Testing health endpoint at http://localhost:$health_port/health"
+    
+    # Wait a moment for service to fully start
+    sleep 3
+    
+    if curl -s "http://localhost:$health_port/health" > /dev/null; then
+        log_success "Health endpoint is responding"
+    else
+        log_warning "Health endpoint not responding yet (service may still be starting)"
+    fi
+    
+    # Show recent logs
+    log_info "Recent service logs:"
+    journalctl -u monitoring-agent --no-pager -n 5
+}
+
+# Show post-installation information
+show_post_install_info() {
+    echo
+    echo "============================================="
+    echo "  Installation Complete!"
+    echo "============================================="
+    echo
+    log_success "CheckCle Monitoring Agent installed and configured successfully"
+    echo
+    echo "System Information:"
+    echo "  Architecture: $ARCH ($PACKAGE_ARCH)"
+    echo "  Package: $PACKAGE_FILENAME"
+    echo "  Package Manager: $PACKAGE_MANAGER"
+    if [[ "$PACKAGE_FORMAT" == "tar.gz" ]]; then
+        echo "  Installation Type: Manual (tar.gz)"
+    else
+        echo "  Installation Type: Native package ($PACKAGE_FORMAT)"
+    fi
+    echo
+    echo "Configuration: $CONFIG_FILE"
+    echo "Service status: systemctl status monitoring-agent"
+    echo "Service logs: journalctl -u monitoring-agent -f"
+    echo "Health check: curl http://localhost:${HEALTH_CHECK_PORT:-8081}/health"
+    echo
+    echo "The monitoring agent is now running and will appear in your dashboard."
+    echo
+}
+
+# Clean up temporary files
+cleanup() {
+    if [[ -n "$DOWNLOADED_PACKAGE" && -f "$DOWNLOADED_PACKAGE" ]]; then
+        rm -f "$DOWNLOADED_PACKAGE"
+        rm -rf "$(dirname "$DOWNLOADED_PACKAGE")"
+    fi
+}
+
+# Main installation function
+main() {
+    echo "============================================="
+    echo "  CheckCle Server Monitoring Agent"
+    echo "  One-Click Installation"
+    echo "============================================="
+    echo
+    
+    check_root
+    validate_environment
+    detect_system
+    detect_system_info
+    
+    log_info "Starting automated installation..."
+    
+    # Set up cleanup trap
+    trap cleanup EXIT
+    
+    # Download and install package
+    download_package
+    install_package
+    
+    # Configure and start service
+    configure_agent
+    
+    if start_service; then
+        test_installation
+        show_post_install_info
+    else
+        log_error "Service failed to start properly"
+        log_info "Check configuration: sudo nano $CONFIG_FILE"
+        log_info "Restart service: sudo systemctl restart monitoring-agent"
+        exit 1
+    fi
+}
+
+# Handle script arguments
+case "${1:-}" in
+    --help|-h)
+        echo "CheckCle Server Monitoring Agent - One-Click Installer"
+        echo
+        echo "Usage: SERVER_TOKEN=your-token [OPTIONS] sudo bash $0"
+        echo "   or: sudo SERVER_TOKEN=your-token [OPTIONS] bash $0"
+        echo "   or: curl -L script-url | SERVER_TOKEN=your-token [OPTIONS] sudo bash"
+        echo
+        echo "System Requirements:"
+        echo "  - Linux with systemd"
+        echo "  - Supported architectures: x86_64 (amd64), aarch64/arm64"
+        echo "  - Supported distributions: Debian/Ubuntu (.deb), RHEL/CentOS/Fedora (.rpm), or any Linux (tar.gz fallback)"
+        echo
+        echo "Package Installation Logic:"
+        echo "  1. Detects OS and tries native package format first (.deb for Debian-based, .rpm for RHEL-based)"
+        echo "  2. If native package is not available, automatically falls back to tar.gz"
+        echo "  3. tar.gz works on any Linux distribution with systemd"
+        echo
+        echo "Required Environment Variables:"
+        echo "  SERVER_TOKEN          Server authentication token"
+        echo
+        echo "Optional Environment Variables:"
+        echo "  POCKETBASE_URL        PocketBase URL (default: http://localhost:8090)"
+        echo "  SERVER_NAME           Server name (default: hostname)"
+        echo "  AGENT_ID              Agent identifier (default: monitoring-agent-hostname)"
+        echo "  HEALTH_CHECK_PORT     Health check port (default: 8081)"
+        echo
+        echo "Examples:"
+        echo "  SERVER_TOKEN=abc123 sudo -E bash $0"
+        echo "  sudo SERVER_TOKEN=abc123 POCKETBASE_URL=https://pb.example.com bash $0"
+        echo
+        echo "Options:"
+        echo "  --help, -h            Show this help message"
+        echo "  --uninstall           Uninstall the monitoring agent"
+        echo
+        exit 0
+        ;;
+    --uninstall)
+        check_root
+        log_info "Uninstalling monitoring agent..."
+        systemctl stop monitoring-agent 2>/dev/null || true
+        systemctl disable monitoring-agent 2>/dev/null || true
+        
+        # Remove based on detected package manager
+        if command -v dpkg >/dev/null 2>&1 && dpkg -l monitoring-agent >/dev/null 2>&1; then
+            dpkg -r monitoring-agent 2>/dev/null || true
+            log_success "DEB package removed"
+        elif command -v rpm >/dev/null 2>&1 && rpm -q monitoring-agent >/dev/null 2>&1; then
+            rpm -e monitoring-agent 2>/dev/null || true
+            log_success "RPM package removed"
+        else
+            # Manual removal for tar.gz installations
+            log_info "Performing manual cleanup for tar.gz installation..."
+            rm -f /usr/bin/monitoring-agent 2>/dev/null || true
+            rm -rf /etc/monitoring-agent 2>/dev/null || true
+            rm -f /lib/systemd/system/monitoring-agent.service 2>/dev/null || true
+            rm -f /usr/lib/systemd/system/monitoring-agent.service 2>/dev/null || true
+            rm -f /etc/systemd/system/monitoring-agent.service 2>/dev/null || true
+            userdel monitoring-agent 2>/dev/null || true
+            groupdel monitoring-agent 2>/dev/null || true
+            rm -rf /var/lib/monitoring-agent 2>/dev/null || true
+            rm -rf /var/log/monitoring-agent 2>/dev/null || true
+            log_success "Manual cleanup completed"
+        fi
+        
+        systemctl daemon-reload 2>/dev/null || true
+        log_success "Monitoring agent uninstalled"
+        exit 0
+        ;;
+    *)
+        main "$@"
+        ;;
+esac
\ No newline at end of file
diff --git a/scripts/server-docker-agent.sh b/scripts/server-docker-agent.sh
new file mode 100644
index 0000000..49948c3
--- /dev/null
+++ b/scripts/server-docker-agent.sh
@@ -0,0 +1,361 @@
+
+#!/bin/bash
+
+# CheckCle Server Monitoring Agent - Docker One-Click Installation Script
+# This script provides fully automated Docker installation using environment variables
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Helper functions
+log_info() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+log_success() {
+    echo -e "${GREEN}[SUCCESS]${NC} $1"
+}
+
+log_warning() {
+    echo -e "${YELLOW}[WARNING]${NC} $1"
+}
+
+log_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+# Check if running as root
+check_root() {
+    if [[ $EUID -ne 0 ]]; then
+        log_error "This script must be run as root (use sudo)"
+        exit 1
+    fi
+}
+
+# Check if Docker is installed
+check_docker() {
+    if ! command -v docker >/dev/null 2>&1; then
+        log_error "Docker is not installed"
+        log_info "Please install Docker first:"
+        log_info "  Ubuntu/Debian: sudo apt-get update && sudo apt-get install docker.io"
+        log_info "  CentOS/RHEL: sudo yum install docker"
+        log_info "  Or visit: https://docs.docker.com/engine/install/"
+        exit 1
+    fi
+    
+    # Check if Docker daemon is running
+    if ! docker info >/dev/null 2>&1; then
+        log_error "Docker daemon is not running"
+        log_info "Start Docker with: sudo systemctl start docker"
+        exit 1
+    fi
+    
+    log_success "Docker is installed and running"
+}
+
+# Validate required environment variables
+validate_environment() {
+    local missing_vars=()
+    
+    # Check required variables
+    [[ -z "$SERVER_TOKEN" ]] && missing_vars+=("SERVER_TOKEN")
+    [[ -z "$POCKETBASE_URL" ]] && missing_vars+=("POCKETBASE_URL")
+    [[ -z "$SERVER_NAME" ]] && missing_vars+=("SERVER_NAME")
+    [[ -z "$AGENT_ID" ]] && missing_vars+=("AGENT_ID")
+    
+    if [[ ${#missing_vars[@]} -ne 0 ]]; then
+        log_error "Missing required environment variables: ${missing_vars[*]}"
+        log_info ""
+        log_info "Usage examples:"
+        log_info "  SERVER_TOKEN=your-token POCKETBASE_URL=http://host:8090 SERVER_NAME=server AGENT_ID=agent sudo -E bash $0"
+        log_info "  sudo SERVER_TOKEN=your-token POCKETBASE_URL=http://host:8090 SERVER_NAME=server AGENT_ID=agent bash $0"
+        log_info ""
+        log_info "Required variables:"
+        log_info "  SERVER_TOKEN          Server authentication token"
+        log_info "  POCKETBASE_URL        PocketBase URL (e.g., http://194.233.80.126:8090)"
+        log_info "  SERVER_NAME           Server name (e.g., DB-Server01)"
+        log_info "  AGENT_ID              Agent identifier (e.g., agent_hogr3np88u7dq5xf9balzl)"
+        log_info ""
+        log_info "Optional variables:"
+        log_info "  HEALTH_CHECK_PORT     Health check port (default: 8081)"
+        log_info "  CONTAINER_NAME        Container name (default: monitoring-agent)"
+        log_info "  DOCKER_IMAGE          Docker image (default: operacle/checkcle-server-agent:latest)"
+        exit 1
+    fi
+    
+    log_success "Environment validation passed"
+    log_info "SERVER_TOKEN: ${SERVER_TOKEN:0:8}..."
+    log_info "POCKETBASE_URL: $POCKETBASE_URL"
+    log_info "SERVER_NAME: $SERVER_NAME"
+    log_info "AGENT_ID: $AGENT_ID"
+}
+
+# Set default values for optional variables
+set_defaults() {
+    HEALTH_CHECK_PORT="${HEALTH_CHECK_PORT:-8081}"
+    CONTAINER_NAME="${CONTAINER_NAME:-monitoring-agent}"
+    DOCKER_IMAGE="${DOCKER_IMAGE:-operacle/checkcle-server-agent:latest}"
+    POCKETBASE_ENABLED="${POCKETBASE_ENABLED:-true}"
+    
+    log_info "Configuration:"
+    log_info "  Container name: $CONTAINER_NAME"
+    log_info "  Docker image: $DOCKER_IMAGE"
+    log_info "  Health check port: $HEALTH_CHECK_PORT"
+    log_info "  PocketBase enabled: $POCKETBASE_ENABLED"
+}
+
+# Stop and remove existing container if it exists
+cleanup_existing_container() {
+    if docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+        log_info "Stopping and removing existing container: $CONTAINER_NAME"
+        docker stop "$CONTAINER_NAME" >/dev/null 2>&1 || true
+        docker rm "$CONTAINER_NAME" >/dev/null 2>&1 || true
+        log_success "Existing container removed"
+    fi
+}
+
+# Create Docker volumes
+create_volumes() {
+    log_info "Creating Docker volumes..."
+    
+    # Create volumes if they don't exist
+    if ! docker volume ls --format '{{.Name}}' | grep -q "^monitoring_data$"; then
+        docker volume create monitoring_data
+        log_success "Created monitoring_data volume"
+    else
+        log_info "monitoring_data volume already exists"
+    fi
+    
+    if ! docker volume ls --format '{{.Name}}' | grep -q "^monitoring_logs$"; then
+        docker volume create monitoring_logs
+        log_success "Created monitoring_logs volume"
+    else
+        log_info "monitoring_logs volume already exists"
+    fi
+}
+
+# Get Docker group ID
+get_docker_group_id() {
+    local docker_gid
+    docker_gid=$(getent group docker | cut -d: -f3)
+    if [[ -z "$docker_gid" ]]; then
+        log_warning "Docker group not found, using default GID 999"
+        docker_gid=999
+    fi
+    echo "$docker_gid"
+}
+
+# Run the Docker container
+run_docker_container() {
+    log_info "Starting monitoring agent Docker container..."
+    
+    local docker_gid
+    docker_gid=$(get_docker_group_id)
+    
+    log_info "Docker group ID: $docker_gid"
+    
+    # Run the Docker container with all the required parameters
+    docker run -d \
+        --name "$CONTAINER_NAME" \
+        --restart unless-stopped \
+        -p "$HEALTH_CHECK_PORT:8081" \
+        --group-add "$docker_gid" \
+        -e AGENT_ID="$AGENT_ID" \
+        -e SERVER_NAME="$SERVER_NAME" \
+        -e SERVER_TOKEN="$SERVER_TOKEN" \
+        -e POCKETBASE_URL="$POCKETBASE_URL" \
+        -e POCKETBASE_ENABLED="$POCKETBASE_ENABLED" \
+        -v /proc:/host/proc:ro \
+        -v /etc:/host/etc:ro \
+        -v /sys:/host/sys:ro \
+        -v /:/host/root:ro \
+        -v /var/run:/host/var/run:ro \
+        -v /dev:/host/dev:ro \
+        -v /var/run/docker.sock:/var/run/docker.sock:ro \
+        -v monitoring_data:/var/lib/monitoring-agent \
+        -v monitoring_logs:/var/log/monitoring-agent \
+        "$DOCKER_IMAGE"
+    
+    log_success "Docker container started successfully"
+}
+
+# Wait for container to be ready
+wait_for_container() {
+    log_info "Waiting for container to be ready..."
+    
+    local max_attempts=30
+    local attempt=0
+    
+    while [[ $attempt -lt $max_attempts ]]; do
+        if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+            log_success "Container is running"
+            return 0
+        fi
+        
+        sleep 1
+        ((attempt++))
+    done
+    
+    log_error "Container failed to start within expected time"
+    return 1
+}
+
+# Test the installation
+test_installation() {
+    log_info "Testing installation..."
+    
+    # Check container status
+    if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+        log_error "Container is not running"
+        log_info "Check container logs: docker logs $CONTAINER_NAME"
+        return 1
+    fi
+    
+    # Wait a moment for the service to start
+    sleep 3
+    
+    # Test health endpoint
+    log_info "Testing health endpoint at http://localhost:$HEALTH_CHECK_PORT/health"
+    
+    if curl -s -f "http://localhost:$HEALTH_CHECK_PORT/health" >/dev/null 2>&1; then
+        log_success "Health endpoint is responding"
+    else
+        log_warning "Health endpoint not responding yet (service may still be starting)"
+    fi
+    
+    # Show recent container logs
+    log_info "Recent container logs:"
+    docker logs --tail 10 "$CONTAINER_NAME"
+}
+
+# Show post-installation information
+show_post_install_info() {
+    echo
+    echo "============================================="
+    echo "  Docker Installation Complete!"
+    echo "============================================="
+    echo
+    log_success "CheckCle Monitoring Agent Docker container installed and running successfully"
+    echo
+    echo "Container Information:"
+    echo "  Container name: $CONTAINER_NAME"
+    echo "  Docker image: $DOCKER_IMAGE"
+    echo "  Health check port: $HEALTH_CHECK_PORT"
+    echo "  Agent ID: $AGENT_ID"
+    echo "  Server name: $SERVER_NAME"
+    echo
+    echo "Useful commands:"
+    echo "  Container status: docker ps -f name=$CONTAINER_NAME"
+    echo "  Container logs: docker logs -f $CONTAINER_NAME"
+    echo "  Stop container: docker stop $CONTAINER_NAME"
+    echo "  Start container: docker start $CONTAINER_NAME"
+    echo "  Remove container: docker rm -f $CONTAINER_NAME"
+    echo "  Health check: curl http://localhost:$HEALTH_CHECK_PORT/health"
+    echo
+    echo "The monitoring agent is now running in a Docker container and will appear in your dashboard."
+    echo
+}
+
+# Main installation function
+main() {
+    echo "============================================="
+    echo "  CheckCle Server Monitoring Agent"
+    echo "  Docker One-Click Installation"
+    echo "============================================="
+    echo
+    
+    check_root
+    check_docker
+    validate_environment
+    set_defaults
+    
+    log_info "Starting Docker container installation..."
+    
+    # Setup and run container
+    cleanup_existing_container
+    create_volumes
+    run_docker_container
+    
+    if wait_for_container; then
+        test_installation
+        show_post_install_info
+    else
+        log_error "Container installation failed"
+        log_info "Check container logs: docker logs $CONTAINER_NAME"
+        exit 1
+    fi
+}
+
+# Handle script arguments
+case "${1:-}" in
+    --help|-h)
+        echo "CheckCle Server Monitoring Agent - Docker One-Click Installer"
+        echo
+        echo "Usage: SERVER_TOKEN=token POCKETBASE_URL=url SERVER_NAME=name AGENT_ID=id sudo bash $0"
+        echo
+        echo "System Requirements:"
+        echo "  - Docker installed and running"
+        echo "  - Root privileges (sudo)"
+        echo "  - Internet access to pull Docker image"
+        echo
+        echo "Required Environment Variables:"
+        echo "  SERVER_TOKEN          Server authentication token"
+        echo "  POCKETBASE_URL        PocketBase URL (e.g., http://194.233.80.126:8090)"
+        echo "  SERVER_NAME           Server name (e.g., DB-Server01)"
+        echo "  AGENT_ID              Agent identifier"
+        echo
+        echo "Optional Environment Variables:"
+        echo "  HEALTH_CHECK_PORT     Health check port (default: 8081)"
+        echo "  CONTAINER_NAME        Container name (default: monitoring-agent)"
+        echo "  DOCKER_IMAGE          Docker image (default: operacle/checkcle-server-agent:latest)"
+        echo "  POCKETBASE_ENABLED    Enable PocketBase (default: true)"
+        echo
+        echo "Examples:"
+        echo "  SERVER_TOKEN=abc123 POCKETBASE_URL=http://host:8090 SERVER_NAME=server AGENT_ID=agent sudo -E bash $0"
+        echo "  sudo SERVER_TOKEN=abc123 POCKETBASE_URL=http://host:8090 SERVER_NAME=server AGENT_ID=agent bash $0"
+        echo
+        echo "Options:"
+        echo "  --help, -h            Show this help message"
+        echo "  --uninstall           Remove the monitoring agent container"
+        echo
+        exit 0
+        ;;
+    --uninstall)
+        check_root
+        check_docker
+        set_defaults
+        
+        log_info "Uninstalling monitoring agent Docker container..."
+        
+        # Stop and remove container
+        if docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+            docker stop "$CONTAINER_NAME" >/dev/null 2>&1 || true
+            docker rm "$CONTAINER_NAME" >/dev/null 2>&1 || true
+            log_success "Container removed"
+        else
+            log_info "Container not found"
+        fi
+        
+        # Optionally remove volumes (ask user)
+        echo -n "Remove data volumes? (y/N): "
+        read -r response
+        if [[ "$response" =~ ^[Yy]$ ]]; then
+            docker volume rm monitoring_data monitoring_logs >/dev/null 2>&1 || true
+            log_success "Data volumes removed"
+        else
+            log_info "Data volumes preserved"
+        fi
+        
+        log_success "Monitoring agent Docker container uninstalled"
+        exit 0
+        ;;
+    *)
+        main "$@"
+        ;;
+esac
\ No newline at end of file
diff --git a/scripts/setup.sh b/scripts/setup.sh
new file mode 100644
index 0000000..85e698e
--- /dev/null
+++ b/scripts/setup.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+set -e
+
+DATA_DIR="/opt/pb_data"
+PORT=8090
+COMPOSE_FILE="/opt/docker-compose.yml"
+RAW_URL="https://raw.githubusercontent.com/operacle/checkcle/main/docker-compose.yml"
+
+echo "🚀 Installing Checkcle using Docker Compose"
+
+# Step 1: Check if port is already in use
+if lsof -i :"$PORT" &>/dev/null; then
+  echo "❗ ERROR: Port $PORT is already in use. Please free the port or change the Docker Compose configuration."
+  exit 1
+fi
+
+# Step 2: Ensure Docker is installed
+if ! command -v docker &> /dev/null; then
+  echo "🔧 Docker not found. Installing Docker..."
+  curl -fsSL https://get.docker.com | sh
+fi
+
+# Step 3: Ensure Docker Compose v2 is available
+if ! docker compose version &> /dev/null; then
+  echo "❗ Docker Compose v2 not found. Please install Docker Compose v2 and rerun this script."
+  exit 1
+fi
+
+# Step 4: Download docker-compose.yml if not exists
+if [ ! -f "$COMPOSE_FILE" ]; then
+  echo "📥 Downloading docker-compose.yml to $COMPOSE_FILE..."
+  curl -fsSL "$RAW_URL" -o "$COMPOSE_FILE"
+else
+  echo "✅ docker-compose.yml already exists at $COMPOSE_FILE"
+fi
+
+# Step 5: Create data volume directory if it doesn’t exist
+if [ ! -d "$DATA_DIR" ]; then
+  echo "📁 Creating data volume directory at $DATA_DIR"
+  sudo mkdir -p "$DATA_DIR"
+  sudo chown "$(whoami)":"$(whoami)" "$DATA_DIR"
+fi
+
+# Step 6: Start the service
+cd /opt
+echo "📦 Starting Checkcle service with Docker Compose..."
+docker compose -f "$COMPOSE_FILE" up -d
+
+# Step 7: Detect host IP address
+HOST_IP=$(hostname -I | awk '{print $1}')
+
+# Step 8: Show success output
+echo ""
+echo "✅ Checkcle has been successfully installed and started."
+echo ""
+echo "🛠️  Admin Web Management"
+echo "🔗 Default URL: http://$HOST_IP:$PORT"
+echo "👤 User: admin@example.com"
+echo "🔑 Passwd: Admin123456"
+echo ""
+echo "📌 Make sure port $PORT is accessible from your host system or cloud firewall."
diff --git a/server/core_backend-server/.github/SECURITY.md b/server/core_backend-server/.github/SECURITY.md
new file mode 100644
index 0000000..7bb5624
--- /dev/null
+++ b/server/core_backend-server/.github/SECURITY.md
@@ -0,0 +1,7 @@
+# Security
+
+If you discover a security vulnerability within PocketBase, please send an e-mail to **support at pocketbase.io**.
+
+**This is non-commercial personal open source project, so there are no bounties!**
+
+All reports will be promptly addressed and you'll be credited in the fix release notes.
diff --git a/server/core_backend-server/.github/chat-page-demo.png b/server/core_backend-server/.github/chat-page-demo.png
new file mode 100644
index 0000000..e228420
Binary files /dev/null and b/server/core_backend-server/.github/chat-page-demo.png differ
diff --git a/server/core_backend-server/.github/workflows/docker.yaml b/server/core_backend-server/.github/workflows/docker.yaml
new file mode 100644
index 0000000..a8aaf92
--- /dev/null
+++ b/server/core_backend-server/.github/workflows/docker.yaml
@@ -0,0 +1,80 @@
+#
+name: Create and publish a Docker image
+
+# Configures this workflow to run every time a change is pushed to the branch called `release`.
+on:
+  push:
+    tags:        
+      - '*'
+
+# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      #
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.17.0
+
+      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
+      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see [Usage](https://github.com/docker/build-push-action#usage) in the README of the `docker/build-push-action` repository.
+      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
+      - name: Set up QEMU for cross-platform builds
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # This step usually is not needed because the /ui/dist is pregenerated locally
+      # but its here to ensure that each release embeds the latest admin ui artifacts.
+      # If the artificats differs, a "dirty error" is thrown - https://goreleaser.com/errors/dirty/
+      - name: Build Admin dashboard UI
+        run: npm --prefix=./ui ci && npm --prefix=./ui run build
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          platforms: linux/amd64,linux/arm64
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+      
+      # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [Using artifact attestations to establish provenance for builds](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+      
diff --git a/server/core_backend-server/.github/workflows/release.yaml b/server/core_backend-server/.github/workflows/release.yaml
new file mode 100644
index 0000000..533ccf0
--- /dev/null
+++ b/server/core_backend-server/.github/workflows/release.yaml
@@ -0,0 +1,77 @@
+name: basebuild
+
+on:
+  pull_request:
+  push:
+    tags:        
+      - '*'
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        # Docker Hub image
+        image: postgres
+        env:
+          POSTGRES_USER: user
+          POSTGRES_PASSWORD: pass
+        ports:
+          - 6432:6432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      flags: ""
+    steps:
+      # re-enable auto-snapshot from goreleaser-action@v3
+      # (https://github.com/goreleaser/goreleaser-action-v4-auto-snapshot-example)
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        run: echo "flags=--snapshot" >> $GITHUB_ENV
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install PostgreSQL client tools
+        run: sudo apt-get update && sudo apt-get install -y postgresql-client
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.17.0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '>=1.25.5'
+
+      # This step usually is not needed because the /ui/dist is pregenerated locally
+      # but its here to ensure that each release embeds the latest admin ui artifacts.
+      # If the artificats differs, a "dirty error" is thrown - https://goreleaser.com/errors/dirty/
+      - name: Build Admin dashboard UI
+        run: npm --prefix=./ui ci && npm --prefix=./ui run build
+
+      # Temporary disable as the types can have random generated identifiers making it non-deterministic.
+      #
+      # # Similar to the above, the jsvm types are pregenerated locally
+      # # but its here to ensure that it wasn't forgotten to be executed.
+      # - name: Generate jsvm types
+      #   run: go run ./plugins/jsvm/internal/types/types.go
+
+      - name: Run tests
+        run: go test ./...
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: '~> v2'
+          args: release --clean ${{ env.flags }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/server/core_backend-server/.gitignore b/server/core_backend-server/.gitignore
new file mode 100644
index 0000000..9b99d92
--- /dev/null
+++ b/server/core_backend-server/.gitignore
@@ -0,0 +1,20 @@
+/.vscode/
+.idea
+
+.DS_Store
+
+# goreleaser builds folder
+/.builds/
+
+# tests coverage
+coverage.out
+
+# plaintask todo files
+*.todo
+
+# generated markdown previews
+README.html
+CHANGELOG.html
+CHANGELOG_16_22.html
+CHANGELOG_8_15.html
+LICENSE.html
diff --git a/server/core_backend-server/.goreleaser.yaml b/server/core_backend-server/.goreleaser.yaml
new file mode 100644
index 0000000..4958bd9
--- /dev/null
+++ b/server/core_backend-server/.goreleaser.yaml
@@ -0,0 +1,67 @@
+version: 2
+
+project_name: pocketbase
+
+dist: .builds
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - id: build_noncgo
+    main: ./examples/base
+    binary: pocketbase
+    ldflags:
+      - -s -w -X github.com/pocketbase/pocketbase.Version={{ .Version }}
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+      - arm
+      - s390x
+      - ppc64le
+    goarm:
+      - 7
+    ignore:
+      - goos: windows
+        goarch: arm
+      - goos: windows
+        goarch: s390x
+      - goos: windows
+        goarch: ppc64le
+      - goos: darwin
+        goarch: arm
+      - goos: darwin
+        goarch: s390x
+      - goos: darwin
+        goarch: ppc64le
+
+release:
+  draft: true
+
+archives:
+  - id: archive_noncgo
+    builds: [build_noncgo]
+    format: zip
+    files:
+      - LICENSE.md
+      - CHANGELOG.md
+
+checksum:
+  name_template: 'checksums.txt'
+
+snapshot:
+  version_template: '{{ incpatch .Version }}-next'
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^examples:'
+      - '^ui:'
diff --git a/server/core_backend-server/CONTRIBUTING.md b/server/core_backend-server/CONTRIBUTING.md
new file mode 100644
index 0000000..a55e7d5
--- /dev/null
+++ b/server/core_backend-server/CONTRIBUTING.md
@@ -0,0 +1,82 @@
+# Contributing to PocketBase
+
+Thanks for taking the time to improve PocketBase!
+
+This document describes how to prepare a PR for a change in the main repository.
+
+- [Prerequisites](#prerequisites)
+- [Making changes in the Go code](#making-changes-in-the-go-code)
+- [Making changes in the Admin UI](#making-changes-in-the-admin-ui)
+
+## Prerequisites
+
+- Go 1.23+ (for making changes in the Go code)
+- Node 18+ (for making changes in the Admin UI)
+
+If you haven't already, you can fork the main repository and clone your fork so that you can work locally:
+
+```
+git clone https://github.com/your_username/pocketbase.git
+```
+
+> [!IMPORTANT]
+> It is recommended to create a new branch from master for each of your bugfixes and features.
+> This is required if you are planning to submit multiple PRs in order to keep the changes separate for review until they eventually get merged.
+
+## Making changes in the Go code
+
+PocketBase is distributed as a Go package, which means that in order to run the project you'll have to create a Go `main` program that imports the package.
+
+The repository already includes such program, located in `examples/base`, that is also used for the prebuilt executables.
+
+So, let's assume that you already done some changes in the PocketBase Go code and you want now to run them:
+
+1. Navigate to `examples/base`
+2. Run `go run main.go serve`
+
+This will start a web server on `http://localhost:8090` with the embedded prebuilt Admin UI from `ui/dist`. And that's it!
+
+**Before making a PR to the main repository, it is a good idea to:**
+
+- Add unit/integration tests for your changes (we are using the standard `testing` go package).
+  To run the tests, you could execute (while in the root project directory):
+
+  ```sh
+  go test ./...
+
+  # or using the Makefile
+  make test
+  ```
+
+- Run the linter - **golangci** ([see how to install](https://golangci-lint.run/usage/install/#local-installation)):
+
+  ```sh
+  golangci-lint run -c ./golangci.yml ./...
+
+  # or using the Makefile
+  make lint
+  ```
+
+## Making changes in the Admin UI
+
+PocketBase Admin UI is a single-page application (SPA) built with Svelte and Vite.
+
+To start the Admin UI:
+
+1. Navigate to the `ui` project directory
+2. Run `npm install` to install the node dependencies
+3. Start vite's dev server
+   ```sh
+   npm run dev
+   ```
+
+You could open the browser and access the running Admin UI at `http://localhost:3000`.
+
+Since the Admin UI is just a client-side application, you need to have the PocketBase backend server also running in the background (either manually running the `examples/base/main.go` or download a prebuilt executable).
+
+> [!NOTE]
+> By default, the Admin UI is expecting the backend server to be started at `http://localhost:8090`, but you could change that by creating a new `ui/.env.development.local` file with `PB_BACKEND_URL = YOUR_ADDRESS` variable inside it.
+
+Every change you make in the Admin UI should be automatically reflected in the browser at `http://localhost:3000` without reloading the page.
+
+Once you are done with your changes, you have to build the Admin UI with `npm run build`, so that it can be embedded in the go package. And that's it - you can make your PR to the main PocketBase repository.
diff --git a/server/core_backend-server/Makefile b/server/core_backend-server/Makefile
new file mode 100644
index 0000000..e5780fa
--- /dev/null
+++ b/server/core_backend-server/Makefile
@@ -0,0 +1,15 @@
+lint:
+	golangci-lint run -c ./golangci.yml ./...
+
+build-frontend:
+	npm --prefix=./ui ci && npm --prefix=./ui run build
+
+test:
+	go test ./... -v --cover
+
+jstypes:
+	go run ./plugins/jsvm/internal/types/types.go
+
+test-report:
+	go test ./... -v --cover -coverprofile=coverage.out
+	go tool cover -html=coverage.out
diff --git a/server/core_backend-server/apis/api_error_aliases.go b/server/core_backend-server/apis/api_error_aliases.go
new file mode 100644
index 0000000..95b708b
--- /dev/null
+++ b/server/core_backend-server/apis/api_error_aliases.go
@@ -0,0 +1,47 @@
+package apis
+
+import "github.com/pocketbase/pocketbase/tools/router"
+
+// ApiError aliases to minimize the breaking changes with earlier versions
+// and for consistency with the JSVM binds.
+// -------------------------------------------------------------------
+
+// ToApiError wraps err into ApiError instance (if not already).
+func ToApiError(err error) *router.ApiError {
+	return router.ToApiError(err)
+}
+
+// NewApiError is an alias for [router.NewApiError].
+func NewApiError(status int, message string, errData any) *router.ApiError {
+	return router.NewApiError(status, message, errData)
+}
+
+// NewBadRequestError is an alias for [router.NewBadRequestError].
+func NewBadRequestError(message string, errData any) *router.ApiError {
+	return router.NewBadRequestError(message, errData)
+}
+
+// NewNotFoundError is an alias for [router.NewNotFoundError].
+func NewNotFoundError(message string, errData any) *router.ApiError {
+	return router.NewNotFoundError(message, errData)
+}
+
+// NewForbiddenError is an alias for [router.NewForbiddenError].
+func NewForbiddenError(message string, errData any) *router.ApiError {
+	return router.NewForbiddenError(message, errData)
+}
+
+// NewUnauthorizedError is an alias for [router.NewUnauthorizedError].
+func NewUnauthorizedError(message string, errData any) *router.ApiError {
+	return router.NewUnauthorizedError(message, errData)
+}
+
+// NewTooManyRequestsError is an alias for [router.NewTooManyRequestsError].
+func NewTooManyRequestsError(message string, errData any) *router.ApiError {
+	return router.NewTooManyRequestsError(message, errData)
+}
+
+// NewInternalServerError is an alias for [router.NewInternalServerError].
+func NewInternalServerError(message string, errData any) *router.ApiError {
+	return router.NewInternalServerError(message, errData)
+}
diff --git a/server/core_backend-server/apis/backup.go b/server/core_backend-server/apis/backup.go
new file mode 100644
index 0000000..f1f2eb6
--- /dev/null
+++ b/server/core_backend-server/apis/backup.go
@@ -0,0 +1,155 @@
+package apis
+
+import (
+	"context"
+	"net/http"
+	"path/filepath"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+// bindBackupApi registers the file api endpoints and the corresponding handlers.
+func bindBackupApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	sub := rg.Group("/backups")
+	sub.GET("", backupsList).Bind(RequireSuperuserAuth())
+	sub.POST("", backupCreate).Bind(RequireSuperuserAuth())
+	sub.POST("/upload", backupUpload).Bind(BodyLimit(0), RequireSuperuserAuth())
+	sub.GET("/{key}", backupDownload) // relies on superuser file token
+	sub.DELETE("/{key}", backupDelete).Bind(RequireSuperuserAuth())
+	sub.POST("/{key}/restore", backupRestore).Bind(RequireSuperuserAuth())
+}
+
+type backupFileInfo struct {
+	Modified types.DateTime `json:"modified"`
+	Key      string         `json:"key"`
+	Size     int64          `json:"size"`
+}
+
+func backupsList(e *core.RequestEvent) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	fsys, err := e.App.NewBackupsFilesystem()
+	if err != nil {
+		return e.BadRequestError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	backups, err := fsys.List("")
+	if err != nil {
+		return e.BadRequestError("Failed to retrieve backup items. Raw error: \n"+err.Error(), nil)
+	}
+
+	result := make([]backupFileInfo, len(backups))
+
+	for i, obj := range backups {
+		modified, _ := types.ParseDateTime(obj.ModTime)
+
+		result[i] = backupFileInfo{
+			Key:      obj.Key,
+			Size:     obj.Size,
+			Modified: modified,
+		}
+	}
+
+	return e.JSON(http.StatusOK, result)
+}
+
+func backupDownload(e *core.RequestEvent) error {
+	fileToken := e.Request.URL.Query().Get("token")
+
+	authRecord, err := e.App.FindAuthRecordByToken(fileToken, core.TokenTypeFile)
+	if err != nil || !authRecord.IsSuperuser() {
+		return e.ForbiddenError("Insufficient permissions to access the resource.", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	fsys, err := e.App.NewBackupsFilesystem()
+	if err != nil {
+		return e.InternalServerError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	key := e.Request.PathValue("key")
+
+	return fsys.Serve(
+		e.Response,
+		e.Request,
+		key,
+		filepath.Base(key), // without the path prefix (if any)
+	)
+}
+
+func backupDelete(e *core.RequestEvent) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	fsys, err := e.App.NewBackupsFilesystem()
+	if err != nil {
+		return e.InternalServerError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(ctx)
+
+	key := e.Request.PathValue("key")
+
+	if key != "" && cast.ToString(e.App.Store().Get(core.StoreKeyActiveBackup)) == key {
+		return e.BadRequestError("The backup is currently being used and cannot be deleted.", nil)
+	}
+
+	if err := fsys.Delete(key); err != nil {
+		return e.BadRequestError("Invalid or already deleted backup file. Raw error: \n"+err.Error(), nil)
+	}
+
+	return e.NoContent(http.StatusNoContent)
+}
+
+func backupRestore(e *core.RequestEvent) error {
+	if e.App.Store().Has(core.StoreKeyActiveBackup) {
+		return e.BadRequestError("Try again later - another backup/restore process has already been started.", nil)
+	}
+
+	key := e.Request.PathValue("key")
+
+	existsCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	fsys, err := e.App.NewBackupsFilesystem()
+	if err != nil {
+		return e.InternalServerError("Failed to load backups filesystem.", err)
+	}
+	defer fsys.Close()
+
+	fsys.SetContext(existsCtx)
+
+	if exists, err := fsys.Exists(key); !exists {
+		return e.BadRequestError("Missing or invalid backup file.", err)
+	}
+
+	routine.FireAndForget(func() {
+		// give some optimistic time to write the response before restarting the app
+		time.Sleep(1 * time.Second)
+
+		// wait max 10 minutes to fetch the backup
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+		defer cancel()
+
+		if err := e.App.RestoreBackup(ctx, key); err != nil {
+			e.App.Logger().Error("Failed to restore backup", "key", key, "error", err.Error())
+		}
+	})
+
+	return e.NoContent(http.StatusNoContent)
+}
diff --git a/server/core_backend-server/apis/backup_create.go b/server/core_backend-server/apis/backup_create.go
new file mode 100644
index 0000000..d2ebe8d
--- /dev/null
+++ b/server/core_backend-server/apis/backup_create.go
@@ -0,0 +1,78 @@
+package apis
+
+import (
+	"context"
+	"net/http"
+	"regexp"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func backupCreate(e *core.RequestEvent) error {
+	if e.App.Store().Has(core.StoreKeyActiveBackup) {
+		return e.BadRequestError("Try again later - another backup/restore process has already been started", nil)
+	}
+
+	form := new(backupCreateForm)
+	form.app = e.App
+
+	err := e.BindBody(form)
+	if err != nil {
+		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	err = form.validate()
+	if err != nil {
+		return e.BadRequestError("An error occurred while validating the submitted data.", err)
+	}
+
+	err = e.App.CreateBackup(context.Background(), form.Name)
+	if err != nil {
+		return e.BadRequestError("Failed to create backup.", err)
+	}
+
+	// we don't retrieve the generated backup file because it may not be
+	// available yet due to the eventually consistent nature of some S3 providers
+	return e.NoContent(http.StatusNoContent)
+}
+
+// -------------------------------------------------------------------
+
+var backupNameRegex = regexp.MustCompile(`^[a-z0-9_-]+\.zip$`)
+
+type backupCreateForm struct {
+	app core.App
+
+	Name string `form:"name" json:"name"`
+}
+
+func (form *backupCreateForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(
+			&form.Name,
+			validation.Length(1, 150),
+			validation.Match(backupNameRegex),
+			validation.By(form.checkUniqueName),
+		),
+	)
+}
+
+func (form *backupCreateForm) checkUniqueName(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil // nothing to check
+	}
+
+	fsys, err := form.app.NewBackupsFilesystem()
+	if err != nil {
+		return err
+	}
+	defer fsys.Close()
+
+	if exists, err := fsys.Exists(v); err != nil || exists {
+		return validation.NewError("validation_backup_name_exists", "The backup file name is invalid or already exists.")
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/apis/backup_test.go b/server/core_backend-server/apis/backup_test.go
new file mode 100644
index 0000000..54b8265
--- /dev/null
+++ b/server/core_backend-server/apis/backup_test.go
@@ -0,0 +1,823 @@
+package apis_test
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
+)
+
+func sqlite_TestBackupsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodGet,
+			URL:    "/api/backups",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/backups",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (empty list)",
+			Method: http.MethodGet,
+			URL:    "/api/backups",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{`[]`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/backups",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"test1.zip"`,
+				`"test2.zip"`,
+				`"test3.zip"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func sqlite_TestBackupsCreate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			URL:    "/api/backups",
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/backups",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (pending backup)",
+			Method: http.MethodPost,
+			URL:    "/api/backups",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Store().Set(core.StoreKeyActiveBackup, "")
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (autogenerated name)",
+			Method: http.MethodPost,
+			URL:    "/api/backups",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				files, err := getBackupFiles(app)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if total := len(files); total != 1 {
+					t.Fatalf("Expected 1 backup file, got %d", total)
+				}
+
+				expected := "pb_backup_"
+				if !strings.HasPrefix(files[0].Key, expected) {
+					t.Fatalf("Expected backup file with prefix %q, got %q", expected, files[0].Key)
+				}
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":              0,
+				"OnBackupCreate": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser (invalid name)",
+			Method: http.MethodPost,
+			URL:    "/api/backups",
+			Body:   strings.NewReader(`{"name":"!test.zip"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"name":{"code":"validation_match_invalid"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (valid name)",
+			Method: http.MethodPost,
+			URL:    "/api/backups",
+			Body:   strings.NewReader(`{"name":"test.zip"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				files, err := getBackupFiles(app)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if total := len(files); total != 1 {
+					t.Fatalf("Expected 1 backup file, got %d", total)
+				}
+
+				expected := "test.zip"
+				if files[0].Key != expected {
+					t.Fatalf("Expected backup file %q, got %q", expected, files[0].Key)
+				}
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":              0,
+				"OnBackupCreate": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestBackupUpload(t *testing.T) {
+	t.Parallel()
+
+	// create dummy form data bodies
+	type body struct {
+		buffer      io.Reader
+		contentType string
+	}
+	bodies := make([]body, 10)
+	for i := 0; i < 10; i++ {
+		func() {
+			zb := new(bytes.Buffer)
+			zw := zip.NewWriter(zb)
+			if err := zw.Close(); err != nil {
+				t.Fatal(err)
+			}
+
+			b := new(bytes.Buffer)
+			mw := multipart.NewWriter(b)
+
+			mfw, err := mw.CreateFormFile("file", "test")
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err := io.Copy(mfw, zb); err != nil {
+				t.Fatal(err)
+			}
+
+			mw.Close()
+
+			bodies[i] = body{
+				buffer:      b,
+				contentType: mw.FormDataContentType(),
+			}
+		}()
+	}
+	// ---
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			URL:    "/api/backups/upload",
+			Body:   bodies[0].buffer,
+			Headers: map[string]string{
+				"Content-Type": bodies[0].contentType,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/backups/upload",
+			Body:   bodies[1].buffer,
+			Headers: map[string]string{
+				"Content-Type":  bodies[1].contentType,
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (missing file)",
+			Method: http.MethodPost,
+			URL:    "/api/backups/upload",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureNoBackups(t, app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (existing backup name)",
+			Method: http.MethodPost,
+			URL:    "/api/backups/upload",
+			Body:   bodies[3].buffer,
+			Headers: map[string]string{
+				"Content-Type":  bodies[3].contentType,
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				fsys, err := app.NewBackupsFilesystem()
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer fsys.Close()
+				// create a dummy backup file to simulate existing backups
+				if err := fsys.Upload([]byte("123"), "test"); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				files, _ := getBackupFiles(app)
+				if total := len(files); total != 1 {
+					t.Fatalf("Expected %d backup file, got %d", 1, total)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"file":{`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (valid file)",
+			Method: http.MethodPost,
+			URL:    "/api/backups/upload",
+			Body:   bodies[4].buffer,
+			Headers: map[string]string{
+				"Content-Type":  bodies[4].contentType,
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				files, _ := getBackupFiles(app)
+				if total := len(files); total != 1 {
+					t.Fatalf("Expected %d backup file, got %d", 1, total)
+				}
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "ensure that the default body limit is skipped",
+			Method: http.MethodPost,
+			URL:    "/api/backups/upload",
+			Body:   bytes.NewBuffer(make([]byte, apis.DefaultMaxBodySize+100)),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:     400, // it doesn't matter as long as it is not 413
+			ExpectedContent:    []string{`"data":{`},
+			NotExpectedContent: []string{"entity too large"},
+			ExpectedEvents:     map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func sqlite_TestBackupsDownload(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with record auth header",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with superuser auth header",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with empty or invalid token",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip?token=",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with valid record auth token",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with valid record file token",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with valid superuser auth token",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with expired superuser file token",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.nqqtqpPhxU0045F4XP_ruAkzAidYBc5oPy9ErN3XBq0",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with valid superuser file token but missing backup name",
+			Method: http.MethodGet,
+			URL:    "/api/backups/missing?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "with valid superuser file token",
+			Method: http.MethodGet,
+			URL:    "/api/backups/test1.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				"storage/",
+				"data.db",
+				"auxiliary.db",
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "with valid superuser file token and backup name with escaped char",
+			Method: http.MethodGet,
+			URL:    "/api/backups/%40test4.zip?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				"storage/",
+				"data.db",
+				"auxiliary.db",
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func sqlite_TestBackupsDelete(t *testing.T) {
+	t.Parallel()
+
+	noTestBackupFilesChanges := func(t testing.TB, app *tests.TestApp) {
+		files, err := getBackupFiles(app)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		expected := 4
+		if total := len(files); total != expected {
+			t.Fatalf("Expected %d backup(s), got %d", expected, total)
+		}
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodDelete,
+			URL:    "/api/backups/test1.zip",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				noTestBackupFilesChanges(t, app)
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodDelete,
+			URL:    "/api/backups/test1.zip",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				noTestBackupFilesChanges(t, app)
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (missing file)",
+			Method: http.MethodDelete,
+			URL:    "/api/backups/missing.zip",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				noTestBackupFilesChanges(t, app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (existing file with matching active backup)",
+			Method: http.MethodDelete,
+			URL:    "/api/backups/test1.zip",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+
+				// mock active backup with the same name to delete
+				app.Store().Set(core.StoreKeyActiveBackup, "test1.zip")
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				noTestBackupFilesChanges(t, app)
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (existing file and no matching active backup)",
+			Method: http.MethodDelete,
+			URL:    "/api/backups/test1.zip",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+
+				// mock active backup with different name
+				app.Store().Set(core.StoreKeyActiveBackup, "new.zip")
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				files, err := getBackupFiles(app)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if total := len(files); total != 3 {
+					t.Fatalf("Expected %d backup files, got %d", 3, total)
+				}
+
+				deletedFile := "test1.zip"
+
+				for _, f := range files {
+					if f.Key == deletedFile {
+						t.Fatalf("Expected backup %q to be deleted", deletedFile)
+					}
+				}
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (backup with escaped character)",
+			Method: http.MethodDelete,
+			URL:    "/api/backups/%40test4.zip",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				files, err := getBackupFiles(app)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if total := len(files); total != 3 {
+					t.Fatalf("Expected %d backup files, got %d", 3, total)
+				}
+
+				deletedFile := "@test4.zip"
+
+				for _, f := range files {
+					if f.Key == deletedFile {
+						t.Fatalf("Expected backup %q to be deleted", deletedFile)
+					}
+				}
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func sqlite_TestBackupsRestore(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			URL:    "/api/backups/test1.zip/restore",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/backups/test1.zip/restore",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (missing file)",
+			Method: http.MethodPost,
+			URL:    "/api/backups/missing.zip/restore",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (active backup process)",
+			Method: http.MethodPost,
+			URL:    "/api/backups/test1.zip/restore",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := createTestBackups(app); err != nil {
+					t.Fatal(err)
+				}
+
+				app.Store().Set(core.StoreKeyActiveBackup, "")
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+// -------------------------------------------------------------------
+
+func createTestBackups(app core.App) error {
+	ctx := context.Background()
+
+	if err := app.CreateBackup(ctx, "test1.zip"); err != nil {
+		return err
+	}
+
+	if err := app.CreateBackup(ctx, "test2.zip"); err != nil {
+		return err
+	}
+
+	if err := app.CreateBackup(ctx, "test3.zip"); err != nil {
+		return err
+	}
+
+	if err := app.CreateBackup(ctx, "@test4.zip"); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func getBackupFiles(app core.App) ([]*blob.ListObject, error) {
+	fsys, err := app.NewBackupsFilesystem()
+	if err != nil {
+		return nil, err
+	}
+	defer fsys.Close()
+
+	return fsys.List("")
+}
+
+func ensureNoBackups(t testing.TB, app *tests.TestApp) {
+	files, err := getBackupFiles(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if total := len(files); total != 0 {
+		t.Fatalf("Expected 0 backup files, got %d", total)
+	}
+}
diff --git a/server/core_backend-server/apis/backup_upload.go b/server/core_backend-server/apis/backup_upload.go
new file mode 100644
index 0000000..81eaf05
--- /dev/null
+++ b/server/core_backend-server/apis/backup_upload.go
@@ -0,0 +1,72 @@
+package apis
+
+import (
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+)
+
+func backupUpload(e *core.RequestEvent) error {
+	fsys, err := e.App.NewBackupsFilesystem()
+	if err != nil {
+		return err
+	}
+	defer fsys.Close()
+
+	form := new(backupUploadForm)
+	form.fsys = fsys
+	files, _ := e.FindUploadedFiles("file")
+	if len(files) > 0 {
+		form.File = files[0]
+	}
+
+	err = form.validate()
+	if err != nil {
+		return e.BadRequestError("An error occurred while validating the submitted data.", err)
+	}
+
+	err = fsys.UploadFile(form.File, form.File.OriginalName)
+	if err != nil {
+		return e.BadRequestError("Failed to upload backup.", err)
+	}
+
+	// we don't retrieve the generated backup file because it may not be
+	// available yet due to the eventually consistent nature of some S3 providers
+	return e.NoContent(http.StatusNoContent)
+}
+
+// -------------------------------------------------------------------
+
+type backupUploadForm struct {
+	fsys *filesystem.System
+
+	File *filesystem.File `json:"file"`
+}
+
+func (form *backupUploadForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(
+			&form.File,
+			validation.Required,
+			validation.By(validators.UploadedFileMimeType([]string{"application/zip"})),
+			validation.By(form.checkUniqueName),
+		),
+	)
+}
+
+func (form *backupUploadForm) checkUniqueName(value any) error {
+	v, _ := value.(*filesystem.File)
+	if v == nil {
+		return nil // nothing to check
+	}
+
+	// note: we use the original name because that is what we upload
+	if exists, err := form.fsys.Exists(v.OriginalName); err != nil || exists {
+		return validation.NewError("validation_backup_name_exists", "Backup file with the specified name already exists.")
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/apis/base.go b/server/core_backend-server/apis/base.go
new file mode 100644
index 0000000..d4d6925
--- /dev/null
+++ b/server/core_backend-server/apis/base.go
@@ -0,0 +1,189 @@
+package apis
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/http"
+	"path/filepath"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+// StaticWildcardParam is the name of Static handler wildcard parameter.
+const StaticWildcardParam = "path"
+
+// NewRouter returns a new router instance loaded with the default app middlewares and api routes.
+func NewRouter(app core.App) (*router.Router[*core.RequestEvent], error) {
+	pbRouter := router.NewRouter(func(w http.ResponseWriter, r *http.Request) (*core.RequestEvent, router.EventCleanupFunc) {
+		event := new(core.RequestEvent)
+		event.Response = w
+		event.Request = r
+		event.App = app
+
+		return event, nil
+	})
+
+	// register default middlewares
+	pbRouter.Bind(activityLogger())
+	pbRouter.Bind(panicRecover())
+	pbRouter.Bind(rateLimit())
+	pbRouter.Bind(loadAuthToken())
+	pbRouter.Bind(securityHeaders())
+	pbRouter.Bind(BodyLimit(DefaultMaxBodySize))
+
+	apiGroup := pbRouter.Group("/api")
+	bindSettingsApi(app, apiGroup)
+	bindCollectionApi(app, apiGroup)
+	bindRecordCrudApi(app, apiGroup)
+	bindRecordAuthApi(app, apiGroup)
+	bindLogsApi(app, apiGroup)
+	bindBackupApi(app, apiGroup)
+	bindCronApi(app, apiGroup)
+	bindFileApi(app, apiGroup)
+	bindBatchApi(app, apiGroup)
+	bindRealtimeApi(app, apiGroup)
+	bindHealthApi(app, apiGroup)
+	bindSqlEditorApi(app, apiGroup)
+	bindEdgeFunctionsApi(app, apiGroup)
+
+	// Add /api/v1 versioned endpoints for public API access
+	// This provides a versioned API for external clients while keeping
+	// the admin UI using /api routes
+	apiV1Group := pbRouter.Group("/api/v1")
+	bindCollectionApi(app, apiV1Group)
+	bindRecordCrudApi(app, apiV1Group)
+	bindRecordAuthApi(app, apiV1Group)
+	bindFileApi(app, apiV1Group)
+	bindBatchApi(app, apiV1Group)
+	bindRealtimeApi(app, apiV1Group)
+	bindHealthApi(app, apiV1Group)
+
+	return pbRouter, nil
+
+}
+
+// WrapStdHandler wraps Go [http.Handler] into a PocketBase handler func.
+func WrapStdHandler(h http.Handler) func(*core.RequestEvent) error {
+	return func(e *core.RequestEvent) error {
+		h.ServeHTTP(e.Response, e.Request)
+		return nil
+	}
+}
+
+// WrapStdMiddleware wraps Go [func(http.Handler) http.Handle] into a PocketBase middleware func.
+func WrapStdMiddleware(m func(http.Handler) http.Handler) func(*core.RequestEvent) error {
+	return func(e *core.RequestEvent) (err error) {
+		m(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			e.Response = w
+			e.Request = r
+			err = e.Next()
+		})).ServeHTTP(e.Response, e.Request)
+		return err
+	}
+}
+
+// MustSubFS returns an [fs.FS] corresponding to the subtree rooted at fsys's dir.
+//
+// This is similar to [fs.Sub] but panics on failure.
+func MustSubFS(fsys fs.FS, dir string) fs.FS {
+	dir = filepath.ToSlash(filepath.Clean(dir)) // ToSlash in case of Windows path
+
+	sub, err := fs.Sub(fsys, dir)
+	if err != nil {
+		panic(fmt.Errorf("failed to create sub FS: %w", err))
+	}
+
+	return sub
+}
+
+// Static is a handler function to serve static directory content from fsys.
+//
+// If a file resource is missing and indexFallback is set, the request
+// will be forwarded to the base index.html (useful for SPA with pretty urls).
+//
+// NB! Expects the route to have a "{path...}" wildcard parameter.
+//
+// Special redirects:
+//   - if "path" is a file that ends in index.html, it is redirected to its non-index.html version (eg. /test/index.html -> /test/)
+//   - if "path" is a directory that has index.html, the index.html file is rendered,
+//     otherwise if missing - returns 404 or fallback to the root index.html if indexFallback is set
+//
+// Example:
+//
+//	fsys := os.DirFS("./pb_public")
+//	router.GET("/files/{path...}", apis.Static(fsys, false))
+func Static(fsys fs.FS, indexFallback bool) func(*core.RequestEvent) error {
+	if fsys == nil {
+		panic("Static: the provided fs.FS argument is nil")
+	}
+
+	return func(e *core.RequestEvent) error {
+		// disable the activity logger to avoid flooding with messages
+		//
+		// note: errors are still logged
+		if e.Get(requestEventKeySkipSuccessActivityLog) == nil {
+			e.Set(requestEventKeySkipSuccessActivityLog, true)
+		}
+
+		filename := e.Request.PathValue(StaticWildcardParam)
+		filename = filepath.ToSlash(filepath.Clean(strings.TrimPrefix(filename, "/")))
+
+		// eagerly check for directory traversal
+		//
+		// note: this is just out of an abundance of caution because the fs.FS implementation could be non-std,
+		// but usually shouldn't be necessary since os.DirFS.Open is expected to fail if the filename starts with dots
+		if len(filename) > 2 && filename[0] == '.' && filename[1] == '.' && (filename[2] == '/' || filename[2] == '\\') {
+			if indexFallback && filename != router.IndexPage {
+				return e.FileFS(fsys, router.IndexPage)
+			}
+			return router.ErrFileNotFound
+		}
+
+		fi, err := fs.Stat(fsys, filename)
+		if err != nil {
+			if indexFallback && filename != router.IndexPage {
+				return e.FileFS(fsys, router.IndexPage)
+			}
+			return router.ErrFileNotFound
+		}
+
+		if fi.IsDir() {
+			// redirect to a canonical dir url, aka. with trailing slash
+			if !strings.HasSuffix(e.Request.URL.Path, "/") {
+				return e.Redirect(http.StatusMovedPermanently, safeRedirectPath(e.Request.URL.Path+"/"))
+			}
+		} else {
+			urlPath := e.Request.URL.Path
+			if strings.HasSuffix(urlPath, "/") {
+				// redirect to a non-trailing slash file route
+				urlPath = strings.TrimRight(urlPath, "/")
+				if len(urlPath) > 0 {
+					return e.Redirect(http.StatusMovedPermanently, safeRedirectPath(urlPath))
+				}
+			} else if stripped, ok := strings.CutSuffix(urlPath, router.IndexPage); ok {
+				// redirect without the index.html
+				return e.Redirect(http.StatusMovedPermanently, safeRedirectPath(stripped))
+			}
+		}
+
+		fileErr := e.FileFS(fsys, filename)
+
+		if fileErr != nil && indexFallback && filename != router.IndexPage && errors.Is(fileErr, router.ErrFileNotFound) {
+			return e.FileFS(fsys, router.IndexPage)
+		}
+
+		return fileErr
+	}
+}
+
+// safeRedirectPath normalizes the path string by replacing all beginning slashes
+// (`\\`, `//`, `\/`) with a single forward slash to prevent open redirect attacks
+func safeRedirectPath(path string) string {
+	if len(path) > 1 && (path[0] == '\\' || path[0] == '/') && (path[1] == '\\' || path[1] == '/') {
+		path = "/" + strings.TrimLeft(path, `/\`)
+	}
+	return path
+}
diff --git a/server/core_backend-server/apis/base_test.go b/server/core_backend-server/apis/base_test.go
new file mode 100644
index 0000000..19d96a5
--- /dev/null
+++ b/server/core_backend-server/apis/base_test.go
@@ -0,0 +1,313 @@
+package apis_test
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+func TestWrapStdHandler(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+
+	e := new(core.RequestEvent)
+	e.App = app
+	e.Request = req
+	e.Response = rec
+
+	err := apis.WrapStdHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("test"))
+	}))(e)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if body := rec.Body.String(); body != "test" {
+		t.Fatalf("Expected body %q, got %q", "test", body)
+	}
+}
+
+func TestWrapStdMiddleware(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+
+	e := new(core.RequestEvent)
+	e.App = app
+	e.Request = req
+	e.Response = rec
+
+	err := apis.WrapStdMiddleware(func(h http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Write([]byte("test"))
+		})
+	})(e)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if body := rec.Body.String(); body != "test" {
+		t.Fatalf("Expected body %q, got %q", "test", body)
+	}
+}
+
+func TestStatic(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys := os.DirFS(filepath.Join(dir, "sub"))
+
+	type staticScenario struct {
+		path           string
+		indexFallback  bool
+		expectedStatus int
+		expectBody     string
+		expectError    bool
+	}
+
+	scenarios := []staticScenario{
+		{
+			path:           "",
+			indexFallback:  false,
+			expectedStatus: 200,
+			expectBody:     "sub index.html",
+			expectError:    false,
+		},
+		{
+			path:           "missing/a/b/c",
+			indexFallback:  false,
+			expectedStatus: 404,
+			expectBody:     "",
+			expectError:    true,
+		},
+		{
+			path:           "missing/a/b/c",
+			indexFallback:  true,
+			expectedStatus: 200,
+			expectBody:     "sub index.html",
+			expectError:    false,
+		},
+		{
+			path:           "testroot", // parent directory file
+			indexFallback:  false,
+			expectedStatus: 404,
+			expectBody:     "",
+			expectError:    true,
+		},
+		{
+			path:           "test",
+			indexFallback:  false,
+			expectedStatus: 200,
+			expectBody:     "sub test",
+			expectError:    false,
+		},
+		{
+			path:           "sub2",
+			indexFallback:  false,
+			expectedStatus: 301,
+			expectBody:     "",
+			expectError:    false,
+		},
+		{
+			path:           "sub2/",
+			indexFallback:  false,
+			expectedStatus: 200,
+			expectBody:     "sub2 index.html",
+			expectError:    false,
+		},
+		{
+			path:           "sub2/test",
+			indexFallback:  false,
+			expectedStatus: 200,
+			expectBody:     "sub2 test",
+			expectError:    false,
+		},
+		{
+			path:           "sub2/test/",
+			indexFallback:  false,
+			expectedStatus: 301,
+			expectBody:     "",
+			expectError:    false,
+		},
+	}
+
+	// extra directory traversal checks
+	dtp := []string{
+		"/../",
+		"\\../",
+		"../",
+		"../../",
+		"..\\",
+		"..\\..\\",
+		"../..\\",
+		"..\\..//",
+		`%2e%2e%2f`,
+		`%2e%2e%2f%2e%2e%2f`,
+		`%2e%2e/`,
+		`%2e%2e/%2e%2e/`,
+		`..%2f`,
+		`..%2f..%2f`,
+		`%2e%2e%5c`,
+		`%2e%2e%5c%2e%2e%5c`,
+		`%2e%2e\`,
+		`%2e%2e\%2e%2e\`,
+		`..%5c`,
+		`..%5c..%5c`,
+		`%252e%252e%255c`,
+		`%252e%252e%255c%252e%252e%255c`,
+		`..%255c`,
+		`..%255c..%255c`,
+	}
+	for _, p := range dtp {
+		scenarios = append(scenarios,
+			staticScenario{
+				path:           p + "testroot",
+				indexFallback:  false,
+				expectedStatus: 404,
+				expectBody:     "",
+				expectError:    true,
+			},
+			staticScenario{
+				path:           p + "testroot",
+				indexFallback:  true,
+				expectedStatus: 200,
+				expectBody:     "sub index.html",
+				expectError:    false,
+			},
+		)
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%v", i, s.path, s.indexFallback), func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/"+s.path, nil)
+			req.SetPathValue(apis.StaticWildcardParam, s.path)
+
+			rec := httptest.NewRecorder()
+
+			e := new(core.RequestEvent)
+			e.App = app
+			e.Request = req
+			e.Response = rec
+
+			err := apis.Static(fsys, s.indexFallback)(e)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			body := rec.Body.String()
+			if body != s.expectBody {
+				t.Fatalf("Expected body %q, got %q", s.expectBody, body)
+			}
+
+			if hasErr {
+				apiErr := router.ToApiError(err)
+				if apiErr.Status != s.expectedStatus {
+					t.Fatalf("Expected status code %d, got %d", s.expectedStatus, apiErr.Status)
+				}
+			}
+		})
+	}
+}
+
+func TestMustSubFS(t *testing.T) {
+	t.Parallel()
+
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	// invalid path (no beginning and ending slashes)
+	if !hasPanicked(func() {
+		apis.MustSubFS(os.DirFS(dir), "/test/")
+	}) {
+		t.Fatalf("Expected to panic")
+	}
+
+	// valid path
+	if hasPanicked(func() {
+		apis.MustSubFS(os.DirFS(dir), "./////a/b/c") // checks if ToSlash was called
+	}) {
+		t.Fatalf("Didn't expect to panic")
+	}
+
+	// check sub content
+	sub := apis.MustSubFS(os.DirFS(dir), "sub")
+
+	_, err := sub.Open("test")
+	if err != nil {
+		t.Fatalf("Missing expected file sub/test")
+	}
+}
+
+// -------------------------------------------------------------------
+
+func hasPanicked(f func()) (didPanic bool) {
+	defer func() {
+		if r := recover(); r != nil {
+			didPanic = true
+		}
+	}()
+	f()
+	return
+}
+
+// note: make sure to call os.RemoveAll(dir) after you are done
+// working with the created test dir.
+func createTestDir(t *testing.T) string {
+	dir, err := os.MkdirTemp(os.TempDir(), "test_dir")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := os.WriteFile(filepath.Join(dir, "index.html"), []byte("root index.html"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "testroot"), []byte("root test"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := os.MkdirAll(filepath.Join(dir, "sub"), os.ModePerm); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "sub/index.html"), []byte("sub index.html"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "sub/test"), []byte("sub test"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := os.MkdirAll(filepath.Join(dir, "sub", "sub2"), os.ModePerm); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "sub/sub2/index.html"), []byte("sub2 index.html"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "sub/sub2/test"), []byte("sub2 test"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	return dir
+}
diff --git a/server/core_backend-server/apis/batch.go b/server/core_backend-server/apis/batch.go
new file mode 100644
index 0000000..39f10d9
--- /dev/null
+++ b/server/core_backend-server/apis/batch.go
@@ -0,0 +1,548 @@
+package apis
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+func bindBatchApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	sub := rg.Group("/batch")
+	sub.POST("", batchTransaction).Unbind(DefaultBodyLimitMiddlewareId) // the body limit is inlined
+}
+
+type HandleFunc func(e *core.RequestEvent) error
+
+type BatchActionHandlerFunc func(app core.App, ir *core.InternalRequest, params map[string]string, next func(data any) error) HandleFunc
+
+// ValidBatchActions defines a map with the supported batch InternalRequest actions.
+//
+// Note: when adding new routes make sure that their middlewares are inlined!
+var ValidBatchActions = map[*regexp.Regexp]BatchActionHandlerFunc{
+	// "upsert" handler
+	regexp.MustCompile(`^PUT /api/collections/(?P<collection>[^\/\?]+)/records(?P<query>\?.*)?$`): func(app core.App, ir *core.InternalRequest, params map[string]string, next func(any) error) HandleFunc {
+		var id string
+		if len(ir.Body) > 0 && ir.Body["id"] != "" {
+			id = cast.ToString(ir.Body["id"])
+		}
+		if id != "" {
+			_, err := app.FindRecordById(params["collection"], id)
+			if err == nil {
+				// update
+				// ---
+				params["id"] = id // required for the path value
+				ir.Method = "PATCH"
+				ir.URL = "/api/collections/" + params["collection"] + "/records/" + id + params["query"]
+				return recordUpdate(false, next)
+			}
+		}
+
+		// create
+		// ---
+		ir.Method = "POST"
+		ir.URL = "/api/collections/" + params["collection"] + "/records" + params["query"]
+		return recordCreate(false, next)
+	},
+	regexp.MustCompile(`^POST /api/collections/(?P<collection>[^\/\?]+)/records(\?.*)?$`): func(app core.App, ir *core.InternalRequest, params map[string]string, next func(any) error) HandleFunc {
+		return recordCreate(false, next)
+	},
+	regexp.MustCompile(`^PATCH /api/collections/(?P<collection>[^\/\?]+)/records/(?P<id>[^\/\?]+)(\?.*)?$`): func(app core.App, ir *core.InternalRequest, params map[string]string, next func(any) error) HandleFunc {
+		return recordUpdate(false, next)
+	},
+	regexp.MustCompile(`^DELETE /api/collections/(?P<collection>[^\/\?]+)/records/(?P<id>[^\/\?]+)(\?.*)?$`): func(app core.App, ir *core.InternalRequest, params map[string]string, next func(any) error) HandleFunc {
+		return recordDelete(false, next)
+	},
+}
+
+type BatchRequestResult struct {
+	Body   any `json:"body"`
+	Status int `json:"status"`
+}
+
+type batchRequestsForm struct {
+	Requests []*core.InternalRequest `form:"requests" json:"requests"`
+
+	max int
+}
+
+func (brs batchRequestsForm) validate() error {
+	return validation.ValidateStruct(&brs,
+		validation.Field(&brs.Requests, validation.Required, validation.Length(0, brs.max)),
+	)
+}
+
+// NB! When the request is submitted as multipart/form-data,
+// the regular fields data is expected to be submitted as serailized
+// json under the @jsonPayload field and file keys need to follow the
+// pattern "requests.N.fileField" or  requests[N].fileField.
+func batchTransaction(e *core.RequestEvent) error {
+	maxRequests := e.App.Settings().Batch.MaxRequests
+	if !e.App.Settings().Batch.Enabled || maxRequests <= 0 {
+		return e.ForbiddenError("Batch requests are not allowed.", nil)
+	}
+
+	txTimeout := time.Duration(e.App.Settings().Batch.Timeout) * time.Second
+	if txTimeout <= 0 {
+		txTimeout = 3 * time.Second // for now always limit
+	}
+
+	maxBodySize := e.App.Settings().Batch.MaxBodySize
+	if maxBodySize <= 0 {
+		maxBodySize = 128 << 20
+	}
+
+	err := applyBodyLimit(e, maxBodySize)
+	if err != nil {
+		return err
+	}
+
+	form := &batchRequestsForm{max: maxRequests}
+
+	// load base requests data
+	err = e.BindBody(form)
+	if err != nil {
+		return e.BadRequestError("Failed to read the submitted batch data.", err)
+	}
+
+	// load uploaded files into each request item
+	// note: expects the files to be under "requests.N.fileField" or "requests[N].fileField" format
+	// 		 (the other regular fields must be put under `@jsonPayload` as serialized json)
+	if strings.HasPrefix(e.Request.Header.Get("Content-Type"), "multipart/form-data") {
+		for i, ir := range form.Requests {
+			iStr := strconv.Itoa(i)
+
+			files, err := extractPrefixedFiles(e.Request, "requests."+iStr+".", "requests["+iStr+"].")
+			if err != nil {
+				return e.BadRequestError("Failed to read the submitted batch files data.", err)
+			}
+
+			for key, files := range files {
+				if ir.Body == nil {
+					ir.Body = map[string]any{}
+				}
+				ir.Body[key] = files
+			}
+		}
+	}
+
+	// validate batch request form
+	err = form.validate()
+	if err != nil {
+		return e.BadRequestError("Invalid batch request data.", err)
+	}
+
+	event := new(core.BatchRequestEvent)
+	event.RequestEvent = e
+	event.Batch = form.Requests
+
+	return e.App.OnBatchRequest().Trigger(event, func(e *core.BatchRequestEvent) error {
+		bp := batchProcessor{
+			app:         e.App,
+			baseEvent:   e.RequestEvent,
+			infoContext: core.RequestInfoContextBatch,
+		}
+
+		if err := bp.Process(e.Batch, txTimeout); err != nil {
+			return firstApiError(err, e.BadRequestError("Batch transaction failed.", err))
+		}
+
+		return e.JSON(http.StatusOK, bp.results)
+	})
+}
+
+type batchProcessor struct {
+	app         core.App
+	baseEvent   *core.RequestEvent
+	infoContext string
+	results     []*BatchRequestResult
+	failedIndex int
+	errCh       chan error
+	stopCh      chan struct{}
+}
+
+func (p *batchProcessor) Process(batch []*core.InternalRequest, timeout time.Duration) error {
+	p.results = make([]*BatchRequestResult, 0, len(batch))
+
+	if p.stopCh != nil {
+		close(p.stopCh)
+	}
+	p.stopCh = make(chan struct{}, 1)
+
+	if p.errCh != nil {
+		close(p.errCh)
+	}
+	p.errCh = make(chan error, 1)
+
+	return p.app.RunInTransaction(func(txApp core.App) error {
+		// used to interupts the recursive processing calls in case of a timeout or connection close
+		defer func() {
+			p.stopCh <- struct{}{}
+		}()
+
+		go func() {
+			err := p.process(txApp, batch, 0)
+
+			if err != nil {
+				err = validation.Errors{
+					"requests": validation.Errors{
+						strconv.Itoa(p.failedIndex): &BatchResponseError{
+							code:    "batch_request_failed",
+							message: "Batch request failed.",
+							err:     router.ToApiError(err),
+						},
+					},
+				}
+			}
+
+			// note: to avoid copying and due to the process recursion the final results order is reversed
+			if err == nil {
+				slices.Reverse(p.results)
+			}
+
+			p.errCh <- err
+		}()
+
+		select {
+		case responseErr := <-p.errCh:
+			return responseErr
+		case <-time.After(timeout):
+			// note: we don't return 408 Reques Timeout error because
+			// some browsers perform automatic retry behind the scenes
+			// which are hard to debug and unnecessary
+			return errors.New("batch transaction timeout")
+		case <-p.baseEvent.Request.Context().Done():
+			return errors.New("batch request interrupted")
+		}
+	})
+}
+
+func (p *batchProcessor) process(activeApp core.App, batch []*core.InternalRequest, i int) error {
+	select {
+	case <-p.stopCh:
+		return nil
+	default:
+		if len(batch) == 0 {
+			return nil
+		}
+
+		result, err := processInternalRequest(
+			activeApp,
+			p.baseEvent,
+			batch[0],
+			p.infoContext,
+			func(_ any) error {
+				if len(batch) == 1 {
+					return nil
+				}
+
+				err := p.process(activeApp, batch[1:], i+1)
+
+				// update the failed batch index (if not already)
+				if err != nil && p.failedIndex == 0 {
+					p.failedIndex = i + 1
+				}
+
+				return err
+			},
+		)
+
+		if err != nil {
+			return err
+		}
+
+		p.results = append(p.results, result)
+
+		return nil
+	}
+}
+
+func processInternalRequest(
+	activeApp core.App,
+	baseEvent *core.RequestEvent,
+	ir *core.InternalRequest,
+	infoContext string,
+	optNext func(data any) error,
+) (*BatchRequestResult, error) {
+	handle, params, ok := prepareInternalAction(activeApp, ir, optNext)
+	if !ok {
+		return nil, errors.New("unknown batch request action")
+	}
+
+	// construct a new http.Request
+	// ---------------------------------------------------------------
+	buf, mw, err := multipartDataFromInternalRequest(ir)
+	if err != nil {
+		return nil, err
+	}
+
+	r, err := http.NewRequest(strings.ToUpper(ir.Method), ir.URL, buf)
+	if err != nil {
+		return nil, err
+	}
+
+	// cleanup multipart temp files
+	defer func() {
+		if r.MultipartForm != nil {
+			if err := r.MultipartForm.RemoveAll(); err != nil {
+				activeApp.Logger().Warn("failed to cleanup temp batch files", "error", err)
+			}
+		}
+	}()
+
+	// load batch request path params
+	// ---
+	for k, v := range params {
+		r.SetPathValue(k, v)
+	}
+
+	// clone original request
+	// ---
+	r.RequestURI = r.URL.RequestURI()
+	r.Proto = baseEvent.Request.Proto
+	r.ProtoMajor = baseEvent.Request.ProtoMajor
+	r.ProtoMinor = baseEvent.Request.ProtoMinor
+	r.Host = baseEvent.Request.Host
+	r.RemoteAddr = baseEvent.Request.RemoteAddr
+	r.TLS = baseEvent.Request.TLS
+
+	if s := baseEvent.Request.TransferEncoding; s != nil {
+		s2 := make([]string, len(s))
+		copy(s2, s)
+		r.TransferEncoding = s2
+	}
+
+	if baseEvent.Request.Trailer != nil {
+		r.Trailer = baseEvent.Request.Trailer.Clone()
+	}
+
+	if baseEvent.Request.Header != nil {
+		r.Header = baseEvent.Request.Header.Clone()
+	}
+
+	// apply batch request specific headers
+	// ---
+	for k, v := range ir.Headers {
+		// individual Authorization header keys don't have affect
+		// because the auth state is populated from the base event
+		if strings.EqualFold(k, "authorization") {
+			continue
+		}
+
+		r.Header.Set(k, v)
+	}
+	r.Header.Set("Content-Type", mw.FormDataContentType())
+
+	// construct a new RequestEvent
+	// ---------------------------------------------------------------
+	event := &core.RequestEvent{}
+	event.App = activeApp
+	event.Auth = baseEvent.Auth
+	event.SetAll(baseEvent.GetAll())
+
+	// load RequestInfo context
+	if infoContext == "" {
+		infoContext = core.RequestInfoContextDefault
+	}
+	event.Set(core.RequestEventKeyInfoContext, infoContext)
+
+	// assign request
+	event.Request = r
+	event.Request.Body = &router.RereadableReadCloser{ReadCloser: r.Body} // enables multiple reads
+
+	// assign response
+	rec := httptest.NewRecorder()
+	event.Response = &router.ResponseWriter{ResponseWriter: rec} // enables status and write tracking
+
+	// execute
+	// ---------------------------------------------------------------
+	if err := handle(event); err != nil {
+		return nil, err
+	}
+
+	result := rec.Result()
+	defer result.Body.Close()
+
+	body, _ := types.ParseJSONRaw(rec.Body.Bytes())
+
+	return &BatchRequestResult{
+		Status: result.StatusCode,
+		Body:   body,
+	}, nil
+}
+
+func multipartDataFromInternalRequest(ir *core.InternalRequest) (*bytes.Buffer, *multipart.Writer, error) {
+	buf := &bytes.Buffer{}
+
+	mw := multipart.NewWriter(buf)
+
+	regularFields := map[string]any{}
+	fileFields := map[string][]*filesystem.File{}
+
+	// separate regular fields from files
+	// ---
+	for k, rawV := range ir.Body {
+		switch v := rawV.(type) {
+		case *filesystem.File:
+			fileFields[k] = append(fileFields[k], v)
+		case []*filesystem.File:
+			fileFields[k] = append(fileFields[k], v...)
+		default:
+			regularFields[k] = v
+		}
+	}
+
+	// submit regularFields as @jsonPayload
+	// ---
+	rawBody, err := json.Marshal(regularFields)
+	if err != nil {
+		return nil, nil, errors.Join(err, mw.Close())
+	}
+
+	jsonPayload, err := mw.CreateFormField("@jsonPayload")
+	if err != nil {
+		return nil, nil, errors.Join(err, mw.Close())
+	}
+	_, err = jsonPayload.Write(rawBody)
+	if err != nil {
+		return nil, nil, errors.Join(err, mw.Close())
+	}
+
+	// submit fileFields as multipart files
+	// ---
+	for key, files := range fileFields {
+		for _, file := range files {
+			part, err := mw.CreateFormFile(key, file.Name)
+			if err != nil {
+				return nil, nil, errors.Join(err, mw.Close())
+			}
+
+			fr, err := file.Reader.Open()
+			if err != nil {
+				return nil, nil, errors.Join(err, mw.Close())
+			}
+
+			_, err = io.Copy(part, fr)
+			if err != nil {
+				return nil, nil, errors.Join(err, fr.Close(), mw.Close())
+			}
+
+			err = fr.Close()
+			if err != nil {
+				return nil, nil, errors.Join(err, mw.Close())
+			}
+		}
+	}
+
+	return buf, mw, mw.Close()
+}
+
+func extractPrefixedFiles(request *http.Request, prefixes ...string) (map[string][]*filesystem.File, error) {
+	if request.MultipartForm == nil {
+		if err := request.ParseMultipartForm(router.DefaultMaxMemory); err != nil {
+			return nil, err
+		}
+	}
+
+	result := make(map[string][]*filesystem.File)
+
+	for k, fhs := range request.MultipartForm.File {
+		for _, p := range prefixes {
+			if strings.HasPrefix(k, p) {
+				resultKey := strings.TrimPrefix(k, p)
+
+				for _, fh := range fhs {
+					file, err := filesystem.NewFileFromMultipart(fh)
+					if err != nil {
+						return nil, err
+					}
+
+					result[resultKey] = append(result[resultKey], file)
+				}
+			}
+		}
+	}
+
+	return result, nil
+}
+
+func prepareInternalAction(activeApp core.App, ir *core.InternalRequest, optNext func(data any) error) (HandleFunc, map[string]string, bool) {
+	full := strings.ToUpper(ir.Method) + " " + ir.URL
+
+	for re, actionFactory := range ValidBatchActions {
+		params, ok := findNamedMatches(re, full)
+		if ok {
+			return actionFactory(activeApp, ir, params, optNext), params, true
+		}
+	}
+
+	return nil, nil, false
+}
+
+func findNamedMatches(re *regexp.Regexp, str string) (map[string]string, bool) {
+	match := re.FindStringSubmatch(str)
+	if match == nil {
+		return nil, false
+	}
+
+	result := map[string]string{}
+
+	names := re.SubexpNames()
+
+	for i, m := range match {
+		if names[i] != "" {
+			result[names[i]] = m
+		}
+	}
+
+	return result, true
+}
+
+// -------------------------------------------------------------------
+
+var (
+	_ router.SafeErrorItem     = (*BatchResponseError)(nil)
+	_ router.SafeErrorResolver = (*BatchResponseError)(nil)
+)
+
+type BatchResponseError struct {
+	err     *router.ApiError
+	code    string
+	message string
+}
+
+func (e *BatchResponseError) Error() string {
+	return e.message
+}
+
+func (e *BatchResponseError) Code() string {
+	return e.code
+}
+
+func (e *BatchResponseError) Resolve(errData map[string]any) any {
+	errData["response"] = e.err
+	return errData
+}
+
+func (e BatchResponseError) MarshalJSON() ([]byte, error) {
+	return json.Marshal(map[string]any{
+		"message":  e.message,
+		"code":     e.code,
+		"response": e.err,
+	})
+}
diff --git a/server/core_backend-server/apis/batch_test.go b/server/core_backend-server/apis/batch_test.go
new file mode 100644
index 0000000..88b5bdd
--- /dev/null
+++ b/server/core_backend-server/apis/batch_test.go
@@ -0,0 +1,699 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+func TestBatchRequest(t *testing.T) {
+	t.Parallel()
+
+	formData, mp, err := tests.MockMultipartData(
+		map[string]string{
+			router.JSONPayloadKey: `{
+				"requests":[
+					{"method":"POST", "url":"/api/collections/demo3/records", "body": {"title": "batch1"}},
+					{"method":"POST", "url":"/api/collections/demo3/records", "body": {"title": "batch2"}},
+					{"method":"POST", "url":"/api/collections/demo3/records", "body": {"title": "batch3"}},
+					{"method":"PATCH", "url":"/api/collections/demo3/records/lcl9d87w22ml6jy", "body": {"files-": "test_FLurQTgrY8.txt"}}
+				]
+			}`,
+		},
+		"requests.0.files",
+		"requests.0.files",
+		"requests.0.files",
+		"requests[2].files",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "disabled batch requets",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().Batch.Enabled = false
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "max request limits reached",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"GET", "url":"/test1"},
+					{"method":"GET", "url":"/test2"},
+					{"method":"GET", "url":"/test3"}
+				]
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().Batch.Enabled = true
+				app.Settings().Batch.MaxRequests = 2
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"requests":{"code":"validation_length_too_long"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "trigger requests validations",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Body: strings.NewReader(`{
+				"requests": [
+					{},
+					{"method":"GET", "url":"/valid"},
+					{"method":"invalid", "url":"/valid"},
+					{"method":"POST", "url":"` + strings.Repeat("a", 2001) + `"}
+				]
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().Batch.Enabled = true
+				app.Settings().Batch.MaxRequests = 100
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"requests":{`,
+				`"0":{"method":{"code":"validation_required"`,
+				`"2":{"method":{"code":"validation_in_invalid"`,
+				`"3":{"url":{"code":"validation_length_too_long"`,
+			},
+			NotExpectedContent: []string{
+				`"1":`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "unknown batch request action",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"GET", "url":"/api/health"}
+				]
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"requests":{`,
+				`0":{"code":"batch_request_failed"`,
+				`"response":{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":              0,
+				"OnBatchRequest": 1,
+			},
+		},
+		{
+			Name:   "base 2 successful and 1 failed (public collection)",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Body: strings.NewReader(`{
+				"requests": [
+                    {"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch1"}},
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch2"}},
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": ""}}
+				]
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"response":{`,
+				`"2":{"code":"batch_request_failed"`,
+				`"response":{"data":{"title":{"code":"validation_required"`,
+			},
+			NotExpectedContent: []string{
+				`"0":`,
+				`"1":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnBatchRequest":           1,
+				"OnRecordCreateRequest":    3,
+				"OnModelCreate":            3,
+				"OnModelCreateExecute":     2,
+				"OnModelAfterCreateError":  3,
+				"OnModelValidate":          3,
+				"OnRecordCreate":           3,
+				"OnRecordCreateExecute":    2,
+				"OnRecordAfterCreateError": 3,
+				"OnRecordValidate":         3,
+				"OnRecordEnrich":           2,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				records, err := app.FindRecordsByFilter("demo2", `title~"batch"`, "", 0, 0)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if len(records) != 0 {
+					t.Fatalf("Expected no batch records to be persisted, got %d", len(records))
+				}
+			},
+		},
+		{
+			Name:   "base 4 successful (public collection)",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch1"}},
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch2"}},
+					{"method":"PUT", "url":"/api/collections/demo2/records", "body": {"title": "batch3"}},
+					{"method":"PUT", "url":"/api/collections/demo2/records?fields=*,id:excerpt(4,true)", "body": {"id":"achvryl401bhse3","title": "batch4"}}
+				]
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"title":"batch1"`,
+				`"title":"batch2"`,
+				`"title":"batch3"`,
+				`"title":"batch4"`,
+				`"id":"achv..."`,
+				`"active":false`,
+				`"active":true`,
+				`"status":200`,
+				`"body":{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                0,
+				"OnBatchRequest":   1,
+				"OnModelValidate":  4,
+				"OnRecordValidate": 4,
+				"OnRecordEnrich":   4,
+
+				"OnRecordCreateRequest":      3,
+				"OnModelCreate":              3,
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				records, err := app.FindRecordsByFilter("demo2", `title~"batch"`, "", 0, 0)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if len(records) != 4 {
+					t.Fatalf("Expected %d batch records to be persisted, got %d", 3, len(records))
+				}
+			},
+		},
+		{
+			Name:   "mixed create/update/delete (rules failure)",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch_create"}},
+					{"method":"DELETE", "url":"/api/collections/demo2/records/achvryl401bhse3"},
+					{"method":"PATCH", "url":"/api/collections/demo3/records/1tmknxy2868d869", "body": {"title": "batch_update"}}
+				]
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"requests":{`,
+				`"2":{"code":"batch_request_failed"`,
+				`"response":{`,
+			},
+			NotExpectedContent: []string{
+				// only demo3 requires authentication
+				`"0":`,
+				`"1":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnBatchRequest":           1,
+				"OnModelCreate":            1,
+				"OnModelCreateExecute":     1,
+				"OnModelAfterCreateError":  1,
+				"OnModelDelete":            1,
+				"OnModelDeleteExecute":     1,
+				"OnModelAfterDeleteError":  1,
+				"OnModelValidate":          1,
+				"OnRecordCreateRequest":    1,
+				"OnRecordCreate":           1,
+				"OnRecordCreateExecute":    1,
+				"OnRecordAfterCreateError": 1,
+				"OnRecordDeleteRequest":    1,
+				"OnRecordDelete":           1,
+				"OnRecordDeleteExecute":    1,
+				"OnRecordAfterDeleteError": 1,
+				"OnRecordEnrich":           1,
+				"OnRecordValidate":         1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				_, err := app.FindFirstRecordByFilter("demo2", `title="batch_create"`)
+				if err == nil {
+					t.Fatal("Expected record to not be created")
+				}
+
+				_, err = app.FindFirstRecordByFilter("demo3", `title="batch_update"`)
+				if err == nil {
+					t.Fatal("Expected record to not be updated")
+				}
+
+				_, err = app.FindRecordById("demo2", "achvryl401bhse3")
+				if err != nil {
+					t.Fatal("Expected record to not be deleted")
+				}
+			},
+		},
+		{
+			Name:   "mixed create/update/delete (rules success)",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Headers: map[string]string{
+				// test@example.com, clients
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch_create"}, "headers": {"Authorization": "ignored"}},
+					{"method":"DELETE", "url":"/api/collections/demo2/records/achvryl401bhse3", "headers": {"Authorization": "ignored"}},
+					{"method":"PATCH", "url":"/api/collections/demo3/records/1tmknxy2868d869", "body": {"title": "batch_update"}, "headers": {"Authorization": "ignored"}}
+				]
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"title":"batch_create"`,
+				`"title":"batch_update"`,
+				`"status":200`,
+				`"status":204`,
+				`"body":{`,
+				`"body":null`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":              0,
+				"OnBatchRequest": 1,
+				// ---
+				"OnModelCreate":             1,
+				"OnModelCreateExecute":      1,
+				"OnModelAfterCreateSuccess": 1,
+				"OnModelDelete":             1,
+				"OnModelDeleteExecute":      1,
+				"OnModelAfterDeleteSuccess": 1,
+				"OnModelUpdate":             1,
+				"OnModelUpdateExecute":      1,
+				"OnModelAfterUpdateSuccess": 1,
+				"OnModelValidate":           2,
+				// ---
+				"OnRecordCreateRequest":      1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordDeleteRequest":      1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           2,
+				"OnRecordEnrich":             2,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				_, err := app.FindFirstRecordByFilter("demo2", `title="batch_create"`)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				_, err = app.FindFirstRecordByFilter("demo3", `title="batch_update"`)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				_, err = app.FindRecordById("demo2", "achvryl401bhse3")
+				if err == nil {
+					t.Fatal("Expected record to be deleted")
+				}
+			},
+		},
+		{
+			Name:   "mixed create/update/delete (superuser auth)",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Headers: map[string]string{
+				// test@example.com, _superusers
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch_create"}},
+					{"method":"DELETE", "url":"/api/collections/demo2/records/achvryl401bhse3"},
+					{"method":"PATCH", "url":"/api/collections/demo3/records/1tmknxy2868d869", "body": {"title": "batch_update"}}
+				]
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"title":"batch_create"`,
+				`"title":"batch_update"`,
+				`"status":200`,
+				`"status":204`,
+				`"body":{`,
+				`"body":null`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":              0,
+				"OnBatchRequest": 1,
+				// ---
+				"OnModelCreate":             1,
+				"OnModelCreateExecute":      1,
+				"OnModelAfterCreateSuccess": 1,
+				"OnModelDelete":             1,
+				"OnModelDeleteExecute":      1,
+				"OnModelAfterDeleteSuccess": 1,
+				"OnModelUpdate":             1,
+				"OnModelUpdateExecute":      1,
+				"OnModelAfterUpdateSuccess": 1,
+				"OnModelValidate":           2,
+				// ---
+				"OnRecordCreateRequest":      1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordDeleteRequest":      1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           2,
+				"OnRecordEnrich":             2,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				_, err := app.FindFirstRecordByFilter("demo2", `title="batch_create"`)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				_, err = app.FindFirstRecordByFilter("demo3", `title="batch_update"`)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				_, err = app.FindRecordById("demo2", "achvryl401bhse3")
+				if err == nil {
+					t.Fatal("Expected record to be deleted")
+				}
+			},
+		},
+		{
+			Name:   "cascade delete/update",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Headers: map[string]string{
+				// test@example.com, _superusers
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"DELETE", "url":"/api/collections/demo3/records/1tmknxy2868d869"},
+					{"method":"DELETE", "url":"/api/collections/demo3/records/mk5fmymtx4wsprk"}
+				]
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"status":204`,
+				`"body":null`,
+			},
+			NotExpectedContent: []string{
+				`"status":200`,
+				`"body":{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":              0,
+				"OnBatchRequest": 1,
+				// ---
+				"OnModelDelete":             3, // 2 batch + 1 cascade delete
+				"OnModelDeleteExecute":      3,
+				"OnModelAfterDeleteSuccess": 3,
+				"OnModelUpdate":             5, // 5 cascade update
+				"OnModelUpdateExecute":      5,
+				"OnModelAfterUpdateSuccess": 5,
+				// ---
+				"OnRecordDeleteRequest":      2,
+				"OnRecordDelete":             3,
+				"OnRecordDeleteExecute":      3,
+				"OnRecordAfterDeleteSuccess": 3,
+				"OnRecordUpdate":             5,
+				"OnRecordUpdateExecute":      5,
+				"OnRecordAfterUpdateSuccess": 5,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ids := []string{
+					"1tmknxy2868d869",
+					"mk5fmymtx4wsprk",
+					"qzaqccwrmva4o1n",
+				}
+
+				for _, id := range ids {
+					_, err := app.FindRecordById("demo2", id)
+					if err == nil {
+						t.Fatalf("Expected record %q to be deleted", id)
+					}
+				}
+			},
+		},
+		{
+			Name:   "transaction timeout",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch1"}},
+					{"method":"POST", "url":"/api/collections/demo2/records", "body": {"title": "batch2"}}
+				]
+			}`),
+			Headers: map[string]string{
+				// test@example.com, _superusers
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().Batch.Enabled = true
+				app.Settings().Batch.Timeout = 1
+				app.OnRecordCreateRequest("demo2").BindFunc(func(e *core.RecordRequestEvent) error {
+					time.Sleep(600 * time.Millisecond) // < 1s so that the first request can succeed
+					return e.Next()
+				})
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnBatchRequest":           1,
+				"OnRecordCreateRequest":    2,
+				"OnModelCreate":            1,
+				"OnModelCreateExecute":     1,
+				"OnModelAfterCreateError":  1,
+				"OnModelValidate":          1,
+				"OnRecordCreate":           1,
+				"OnRecordCreateExecute":    1,
+				"OnRecordAfterCreateError": 1,
+				"OnRecordEnrich":           1,
+				"OnRecordValidate":         1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				records, err := app.FindRecordsByFilter("demo2", `title~"batch"`, "", 0, 0)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if len(records) != 0 {
+					t.Fatalf("Expected %d batch records to be persisted, got %d", 0, len(records))
+				}
+			},
+		},
+		{
+			Name:   "multipart/form-data + file upload",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Body:   formData,
+			Headers: map[string]string{
+				// test@example.com, clients
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+				"Content-Type":  mp.FormDataContentType(),
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"title":"batch1"`,
+				`"title":"batch2"`,
+				`"title":"batch3"`,
+				`"id":"lcl9d87w22ml6jy"`,
+				`"files":["300_UhLKX91HVb.png"]`,
+				`"tmpfile_`,
+				`"status":200`,
+				`"body":{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":              0,
+				"OnBatchRequest": 1,
+				// ---
+				"OnModelCreate":             3,
+				"OnModelCreateExecute":      3,
+				"OnModelAfterCreateSuccess": 3,
+				"OnModelUpdate":             1,
+				"OnModelUpdateExecute":      1,
+				"OnModelAfterUpdateSuccess": 1,
+				"OnModelValidate":           4,
+				// ---
+				"OnRecordCreateRequest":      3,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           4,
+				"OnRecordEnrich":             4,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				batch1, err := app.FindFirstRecordByFilter("demo3", `title="batch1"`)
+				if err != nil {
+					t.Fatalf("missing batch1: %v", err)
+				}
+				batch1Files := batch1.GetStringSlice("files")
+				if len(batch1Files) != 3 {
+					t.Fatalf("Expected %d batch1 file(s), got %d", 3, len(batch1Files))
+				}
+
+				batch2, err := app.FindFirstRecordByFilter("demo3", `title="batch2"`)
+				if err != nil {
+					t.Fatalf("missing batch2: %v", err)
+				}
+				batch2Files := batch2.GetStringSlice("files")
+				if len(batch2Files) != 0 {
+					t.Fatalf("Expected %d batch2 file(s), got %d", 0, len(batch2Files))
+				}
+
+				batch3, err := app.FindFirstRecordByFilter("demo3", `title="batch3"`)
+				if err != nil {
+					t.Fatalf("missing batch3: %v", err)
+				}
+				batch3Files := batch3.GetStringSlice("files")
+				if len(batch3Files) != 1 {
+					t.Fatalf("Expected %d batch3 file(s), got %d", 1, len(batch3Files))
+				}
+
+				batch4, err := app.FindRecordById("demo3", "lcl9d87w22ml6jy")
+				if err != nil {
+					t.Fatalf("missing batch4: %v", err)
+				}
+				batch4Files := batch4.GetStringSlice("files")
+				if len(batch4Files) != 1 {
+					t.Fatalf("Expected %d batch4 file(s), got %d", 1, len(batch4Files))
+				}
+			},
+		},
+		{
+			Name:   "create/update with expand query params",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Headers: map[string]string{
+				// test@example.com, _superusers
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"POST", "url":"/api/collections/demo5/records?expand=rel_one", "body": {"total": 9, "rel_one":"qzaqccwrmva4o1n"}},
+					{"method":"PATCH", "url":"/api/collections/demo5/records/qjeql998mtp1azp?expand=rel_many", "body": {"total": 10}}
+				]
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"body":{`,
+				`"id":"qjeql998mtp1azp"`,
+				`"id":"qzaqccwrmva4o1n"`,
+				`"id":"i9naidtvr6qsgb4"`,
+				`"expand":{"rel_one"`,
+				`"expand":{"rel_many"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":              0,
+				"OnBatchRequest": 1,
+				// ---
+				"OnModelCreate":             1,
+				"OnModelCreateExecute":      1,
+				"OnModelAfterCreateSuccess": 1,
+				"OnModelUpdate":             1,
+				"OnModelUpdateExecute":      1,
+				"OnModelAfterUpdateSuccess": 1,
+				"OnModelValidate":           2,
+				// ---
+				"OnRecordCreateRequest":      1,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           2,
+				"OnRecordEnrich":             5,
+			},
+		},
+		{
+			Name:   "check body limit middleware",
+			Method: http.MethodPost,
+			URL:    "/api/batch",
+			Headers: map[string]string{
+				// test@example.com, _superusers
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: strings.NewReader(`{
+				"requests": [
+					{"method":"POST", "url":"/api/collections/demo5/records?expand=rel_one", "body": {"total": 9, "rel_one":"qzaqccwrmva4o1n"}},
+					{"method":"PATCH", "url":"/api/collections/demo5/records/qjeql998mtp1azp?expand=rel_many", "body": {"total": 10}}
+				]
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().Batch.Enabled = true
+				app.Settings().Batch.MaxBodySize = 10
+			},
+			ExpectedStatus:  413,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		// Enable batch mode if not explicitly turned off
+		if scenario.BeforeTestFunc == nil {
+			scenario.BeforeTestFunc = func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().Batch.Enabled = true
+			}
+		}
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/collection.go b/server/core_backend-server/apis/collection.go
new file mode 100644
index 0000000..baa24fe
--- /dev/null
+++ b/server/core_backend-server/apis/collection.go
@@ -0,0 +1,209 @@
+package apis
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// bindCollectionApi registers the collection api endpoints and the corresponding handlers.
+func bindCollectionApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	subGroup := rg.Group("/collections").Bind(RequireSuperuserAuth())
+	subGroup.GET("", collectionsList)
+	subGroup.POST("", collectionCreate)
+	subGroup.GET("/{collection}", collectionView)
+	subGroup.PATCH("/{collection}", collectionUpdate)
+	subGroup.DELETE("/{collection}", collectionDelete)
+	subGroup.DELETE("/{collection}/truncate", collectionTruncate)
+	subGroup.PUT("/import", collectionsImport)
+	subGroup.GET("/meta/scaffolds", collectionScaffolds)
+}
+
+func collectionsList(e *core.RequestEvent) error {
+	fieldResolver := search.NewSimpleFieldResolver(
+		"id", "created", "updated", "name", "system", "type",
+	)
+
+	collections := []*core.Collection{}
+
+	result, err := search.NewProvider(fieldResolver).
+		Query(e.App.CollectionQuery()).
+		ParseAndExec(e.Request.URL.Query().Encode(), &collections)
+
+	if err != nil {
+		return e.BadRequestError("", err)
+	}
+
+	event := new(core.CollectionsListRequestEvent)
+	event.RequestEvent = e
+	event.Collections = collections
+	event.Result = result
+
+	return event.App.OnCollectionsListRequest().Trigger(event, func(e *core.CollectionsListRequestEvent) error {
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, e.Result)
+		})
+	})
+}
+
+func collectionView(e *core.RequestEvent) error {
+	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+	if err != nil || collection == nil {
+		return e.NotFoundError("", err)
+	}
+
+	event := new(core.CollectionRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+
+	return e.App.OnCollectionViewRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, e.Collection)
+		})
+	})
+}
+
+func collectionCreate(e *core.RequestEvent) error {
+	// populate the minimal required factory collection data (if any)
+	factoryExtract := struct {
+		Type string `form:"type" json:"type"`
+		Name string `form:"name" json:"name"`
+	}{}
+	if err := e.BindBody(&factoryExtract); err != nil {
+		return e.BadRequestError("Failed to load the collection type data due to invalid formatting.", err)
+	}
+
+	// create scaffold
+	collection := core.NewCollection(factoryExtract.Type, factoryExtract.Name)
+
+	// merge the scaffold with the submitted request data
+	if err := e.BindBody(collection); err != nil {
+		return e.BadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+	}
+
+	event := new(core.CollectionRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+
+	return e.App.OnCollectionCreateRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
+		if err := e.App.Save(e.Collection); err != nil {
+			// validation failure
+			var validationErrors validation.Errors
+			if errors.As(err, &validationErrors) {
+				return e.BadRequestError("Failed to create collection.", validationErrors)
+			}
+
+			// other generic db error
+			return e.BadRequestError("Failed to create collection. Raw error: \n"+err.Error(), nil)
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, e.Collection)
+		})
+	})
+}
+
+func collectionUpdate(e *core.RequestEvent) error {
+	collection, err := e.App.FindCollectionByNameOrId(e.Request.PathValue("collection"))
+	if err != nil || collection == nil {
+		return e.NotFoundError("", err)
+	}
+
+	if err := e.BindBody(collection); err != nil {
+		return e.BadRequestError("Failed to load the submitted data due to invalid formatting.", err)
+	}
+
+	event := new(core.CollectionRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+
+	return event.App.OnCollectionUpdateRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
+		if err := e.App.Save(e.Collection); err != nil {
+			// validation failure
+			var validationErrors validation.Errors
+			if errors.As(err, &validationErrors) {
+				return e.BadRequestError("Failed to update collection.", validationErrors)
+			}
+
+			// other generic db error
+			return e.BadRequestError("Failed to update collection. Raw error: \n"+err.Error(), nil)
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, e.Collection)
+		})
+	})
+}
+
+func collectionDelete(e *core.RequestEvent) error {
+	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+	if err != nil || collection == nil {
+		return e.NotFoundError("", err)
+	}
+
+	event := new(core.CollectionRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+
+	return e.App.OnCollectionDeleteRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
+		if err := e.App.Delete(e.Collection); err != nil {
+			msg := "Failed to delete collection"
+
+			// check fo references
+			refs, _ := e.App.FindCollectionReferences(e.Collection, e.Collection.Id)
+			if len(refs) > 0 {
+				names := make([]string, 0, len(refs))
+				for ref := range refs {
+					names = append(names, ref.Name)
+				}
+				msg += " probably due to existing reference in " + strings.Join(names, ", ")
+			}
+
+			return e.BadRequestError(msg, err)
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+func collectionTruncate(e *core.RequestEvent) error {
+	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+	if err != nil || collection == nil {
+		return e.NotFoundError("", err)
+	}
+
+	if collection.IsView() {
+		return e.BadRequestError("View collections cannot be truncated since they don't store their own records.", nil)
+	}
+
+	err = e.App.TruncateCollection(collection)
+	if err != nil {
+		return e.BadRequestError("Failed to truncate collection (most likely due to required cascade delete record references).", err)
+	}
+
+	return e.NoContent(http.StatusNoContent)
+}
+
+func collectionScaffolds(e *core.RequestEvent) error {
+	randomId := security.RandomStringWithAlphabet(10, core.DefaultIdAlphabet) // could be used as part of the default indexes name
+
+	collections := map[string]*core.Collection{
+		core.CollectionTypeBase: core.NewBaseCollection("", randomId),
+		core.CollectionTypeAuth: core.NewAuthCollection("", randomId),
+		core.CollectionTypeView: core.NewViewCollection("", randomId),
+	}
+
+	for _, c := range collections {
+		c.Id = "" // clear random id
+	}
+
+	return e.JSON(http.StatusOK, collections)
+}
diff --git a/server/core_backend-server/apis/collection_import.go b/server/core_backend-server/apis/collection_import.go
new file mode 100644
index 0000000..1a2f2ad
--- /dev/null
+++ b/server/core_backend-server/apis/collection_import.go
@@ -0,0 +1,62 @@
+package apis
+
+import (
+	"errors"
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func collectionsImport(e *core.RequestEvent) error {
+	form := new(collectionsImportForm)
+
+	err := e.BindBody(form)
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+
+	err = form.validate()
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	event := new(core.CollectionsImportRequestEvent)
+	event.RequestEvent = e
+	event.CollectionsData = form.Collections
+	event.DeleteMissing = form.DeleteMissing
+
+	return event.App.OnCollectionsImportRequest().Trigger(event, func(e *core.CollectionsImportRequestEvent) error {
+		importErr := e.App.ImportCollections(e.CollectionsData, form.DeleteMissing)
+		if importErr == nil {
+			return execAfterSuccessTx(true, e.App, func() error {
+				return e.NoContent(http.StatusNoContent)
+			})
+		}
+
+		// validation failure
+		var validationErrors validation.Errors
+		if errors.As(importErr, &validationErrors) {
+			return e.BadRequestError("Failed to import collections.", validationErrors)
+		}
+
+		// generic/db failure
+		return e.BadRequestError("Failed to import collections.", validation.Errors{"collections": validation.NewError(
+			"validation_collections_import_failure",
+			"Failed to import the collections configuration. Raw error:\n"+importErr.Error(),
+		)})
+	})
+}
+
+// -------------------------------------------------------------------
+
+type collectionsImportForm struct {
+	Collections   []map[string]any `form:"collections" json:"collections"`
+	DeleteMissing bool             `form:"deleteMissing" json:"deleteMissing"`
+}
+
+func (form *collectionsImportForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Collections, validation.Required),
+	)
+}
diff --git a/server/core_backend-server/apis/collection_import_test.go b/server/core_backend-server/apis/collection_import_test.go
new file mode 100644
index 0000000..aa0bf65
--- /dev/null
+++ b/server/core_backend-server/apis/collection_import_test.go
@@ -0,0 +1,369 @@
+package apis_test
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestCollectionsImport(t *testing.T) {
+	t.Parallel()
+
+	totalCollections := 16
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPut,
+			URL:             "/api/collections/import",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPut,
+			URL:    "/api/collections/import",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + empty collections",
+			Method: http.MethodPut,
+			URL:    "/api/collections/import",
+			Body:   strings.NewReader(`{"collections":[]}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"collections":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				collections := []*core.Collection{}
+				if err := app.CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				expected := totalCollections
+				if len(collections) != expected {
+					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
+				}
+			},
+		},
+		{
+			Name:   "authorized as superuser + collections validator failure",
+			Method: http.MethodPut,
+			URL:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"collections":[
+					{"name": "import1"},
+					{
+						"name": "import2",
+						"fields": [
+							{
+							  "id": "koih1lqx",
+							  "name": "expand",
+							  "type": "text"
+							}
+						]
+					}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"collections":{"code":"validation_collections_import_failure"`,
+				`import2`,
+				`fields`,
+			},
+			NotExpectedContent: []string{"Raw error:"},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionsImportRequest":   1,
+				"OnCollectionCreate":           2,
+				"OnCollectionCreateExecute":    2,
+				"OnCollectionAfterCreateError": 2,
+				"OnModelCreate":                2,
+				"OnModelCreateExecute":         2,
+				"OnModelAfterCreateError":      2,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				collections := []*core.Collection{}
+				if err := app.CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				expected := totalCollections
+				if len(collections) != expected {
+					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
+				}
+			},
+		},
+		{
+			Name:   "authorized as superuser + non-validator failure",
+			Method: http.MethodPut,
+			URL:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"collections":[
+					{
+						"name": "import1",
+						"fields": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						]
+					},
+					{
+						"name": "import2",
+						"fields": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						],
+						"indexes": [
+							"create index idx_test on import2 (test)"
+						]
+					}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"collections":{"code":"validation_collections_import_failure"`,
+				`Raw error:`,
+				`custom_error`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionsImportRequest":   1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnCollectionCreate().BindFunc(func(e *core.CollectionEvent) error {
+					return errors.New("custom_error")
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				collections := []*core.Collection{}
+				if err := app.CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+				expected := totalCollections
+				if len(collections) != expected {
+					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
+				}
+			},
+		},
+		{
+			Name:   "authorized as superuser + successful collections create",
+			Method: http.MethodPut,
+			URL:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"collections":[
+					{
+						"name": "import1",
+						"fields": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						]
+					},
+					{
+						"name": "import2",
+						"fields": [
+							{
+							  "id": "koih1lqx",
+							  "name": "test",
+							  "type": "text"
+							}
+						],
+						"indexes": [
+							"create index idx_test on import2 (test)"
+						]
+					},
+					{
+						"name": "auth_without_fields",
+						"type": "auth"
+					}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionsImportRequest":     1,
+				"OnCollectionCreate":             3,
+				"OnCollectionCreateExecute":      3,
+				"OnCollectionAfterCreateSuccess": 3,
+				"OnModelCreate":                  3,
+				"OnModelCreateExecute":           3,
+				"OnModelAfterCreateSuccess":      3,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				collections := []*core.Collection{}
+				if err := app.CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+
+				expected := totalCollections + 3
+				if len(collections) != expected {
+					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
+				}
+
+				indexes, err := app.TableIndexes("import2")
+				if err != nil || indexes["idx_test"] == "" {
+					t.Fatalf("Missing index %s (%v)", "idx_test", err)
+				}
+			},
+		},
+		{
+			Name:   "authorized as superuser + create/update/delete",
+			Method: http.MethodPut,
+			URL:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"deleteMissing": true,
+				"collections":[
+					{"name": "test123"},
+					{
+						"id":"wsmn24bux7wo113",
+						"name":"demo1",
+						"fields":[
+							{
+								"id":"_2hlxbmp",
+								"name":"title",
+								"type":"text",
+								"required":true
+							}
+						],
+						"indexes": []
+					}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnCollectionsImportRequest": 1,
+				// ---
+				"OnModelCreate":                  1,
+				"OnModelCreateExecute":           1,
+				"OnModelAfterCreateSuccess":      1,
+				"OnCollectionCreate":             1,
+				"OnCollectionCreateExecute":      1,
+				"OnCollectionAfterCreateSuccess": 1,
+				// ---
+				"OnModelUpdate":                  1,
+				"OnModelUpdateExecute":           1,
+				"OnModelAfterUpdateSuccess":      1,
+				"OnCollectionUpdate":             1,
+				"OnCollectionUpdateExecute":      1,
+				"OnCollectionAfterUpdateSuccess": 1,
+				// ---
+				"OnModelDelete":                  14,
+				"OnModelAfterDeleteSuccess":      14,
+				"OnModelDeleteExecute":           14,
+				"OnCollectionDelete":             9,
+				"OnCollectionDeleteExecute":      9,
+				"OnCollectionAfterDeleteSuccess": 9,
+				"OnRecordAfterDeleteSuccess":     5,
+				"OnRecordDelete":                 5,
+				"OnRecordDeleteExecute":          5,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				collections := []*core.Collection{}
+				if err := app.CollectionQuery().All(&collections); err != nil {
+					t.Fatal(err)
+				}
+
+				systemCollections := 0
+				for _, c := range collections {
+					if c.System {
+						systemCollections++
+					}
+				}
+
+				expected := systemCollections + 2
+				if len(collections) != expected {
+					t.Fatalf("Expected %d collections, got %d", expected, len(collections))
+				}
+			},
+		},
+		{
+			Name:   "OnCollectionsImportRequest tx body write check",
+			Method: http.MethodPut,
+			URL:    "/api/collections/import",
+			Body: strings.NewReader(`{
+				"deleteMissing": true,
+				"collections":[
+					{"name": "test123"},
+					{
+						"id":"wsmn24bux7wo113",
+						"name":"demo1",
+						"fields":[
+							{
+								"id":"_2hlxbmp",
+								"name":"title",
+								"type":"text",
+								"required":true
+							}
+						],
+						"indexes": []
+					}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnCollectionsImportRequest().BindFunc(func(e *core.CollectionsImportRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnCollectionsImportRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/collection_test.go b/server/core_backend-server/apis/collection_test.go
new file mode 100644
index 0000000..8d74f75
--- /dev/null
+++ b/server/core_backend-server/apis/collection_test.go
@@ -0,0 +1,1586 @@
+package apis_test
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestCollectionsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/collections",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/collections",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/collections",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":16`,
+				`"items":[{`,
+				`"name":"` + core.CollectionNameSuperusers + `"`,
+				`"name":"` + core.CollectionNameAuthOrigins + `"`,
+				`"name":"` + core.CollectionNameExternalAuths + `"`,
+				`"name":"` + core.CollectionNameMFAs + `"`,
+				`"name":"` + core.CollectionNameOTPs + `"`,
+				`"name":"users"`,
+				`"name":"nologin"`,
+				`"name":"clients"`,
+				`"name":"demo1"`,
+				`"name":"demo2"`,
+				`"name":"demo3"`,
+				`"name":"demo4"`,
+				`"name":"demo5"`,
+				`"name":"numeric_id_view"`,
+				`"name":"view1"`,
+				`"name":"view2"`,
+				`"type":"auth"`,
+				`"type":"base"`,
+				`"type":"view"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnCollectionsListRequest": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser + paging and sorting",
+			Method: http.MethodGet,
+			URL:    "/api/collections?page=2&perPage=2&sort=-created",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":2`,
+				`"perPage":2`,
+				`"totalItems":16`,
+				`"items":[{`,
+				`"name":"` + core.CollectionNameMFAs + `"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnCollectionsListRequest": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser + invalid filter",
+			Method: http.MethodGet,
+			URL:    "/api/collections?filter=invalidfield~'demo2'",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + valid filter",
+			Method: http.MethodGet,
+			URL:    "/api/collections?filter=name~'demo'",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":5`,
+				`"items":[{`,
+				`"name":"demo1"`,
+				`"name":"demo2"`,
+				`"name":"demo3"`,
+				`"name":"demo4"`,
+				`"name":"demo5"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnCollectionsListRequest": 1,
+			},
+		},
+		{
+			Name:   "OnCollectionsListRequest tx body write check",
+			Method: http.MethodGet,
+			URL:    "/api/collections",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnCollectionsListRequest().BindFunc(func(e *core.CollectionsListRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnCollectionsListRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestCollectionView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/demo1",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + nonexisting collection identifier",
+			Method: http.MethodGet,
+			URL:    "/api/collections/missing",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + using the collection name",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"wsmn24bux7wo113"`,
+				`"name":"demo1"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                       0,
+				"OnCollectionViewRequest": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser + using the collection id",
+			Method: http.MethodGet,
+			URL:    "/api/collections/wsmn24bux7wo113",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"wsmn24bux7wo113"`,
+				`"name":"demo1"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                       0,
+				"OnCollectionViewRequest": 1,
+			},
+		},
+		{
+			Name:   "OnCollectionViewRequest tx body write check",
+			Method: http.MethodGet,
+			URL:    "/api/collections/wsmn24bux7wo113",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnCollectionViewRequest().BindFunc(func(e *core.CollectionRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnCollectionViewRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestCollectionDelete(t *testing.T) {
+	t.Parallel()
+
+	ensureDeletedFiles := func(app *tests.TestApp, collectionId string) {
+		storageDir := filepath.Join(app.DataDir(), "storage", collectionId)
+
+		entries, _ := os.ReadDir(storageDir)
+		if len(entries) != 0 {
+			t.Errorf("Expected empty/deleted dir, found %d", len(entries))
+		}
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/demo1",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo1",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + nonexisting collection identifier",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/missing",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + using the collection name",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo5",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionDeleteRequest":      1,
+				"OnCollectionDelete":             1,
+				"OnCollectionDeleteExecute":      1,
+				"OnCollectionAfterDeleteSuccess": 1,
+				"OnModelDelete":                  1,
+				"OnModelDeleteExecute":           1,
+				"OnModelAfterDeleteSuccess":      1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureDeletedFiles(app, "9n89pl5vkct6330")
+			},
+		},
+		{
+			Name:   "authorized as superuser + using the collection id",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/9n89pl5vkct6330",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionDeleteRequest":      1,
+				"OnCollectionDelete":             1,
+				"OnCollectionDeleteExecute":      1,
+				"OnCollectionAfterDeleteSuccess": 1,
+				"OnModelDelete":                  1,
+				"OnModelDeleteExecute":           1,
+				"OnModelAfterDeleteSuccess":      1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureDeletedFiles(app, "9n89pl5vkct6330")
+			},
+		},
+		{
+			Name:   "authorized as superuser + trying to delete a system collection",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameMFAs,
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionDeleteRequest":    1,
+				"OnCollectionDelete":           1,
+				"OnCollectionDeleteExecute":    1,
+				"OnCollectionAfterDeleteError": 1,
+				"OnModelDelete":                1,
+				"OnModelDeleteExecute":         1,
+				"OnModelAfterDeleteError":      1,
+			},
+		},
+		{
+			Name:   "authorized as superuser + trying to delete a referenced collection",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo2",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionDeleteRequest":    1,
+				"OnCollectionDelete":           1,
+				"OnCollectionDeleteExecute":    1,
+				"OnCollectionAfterDeleteError": 1,
+				"OnModelDelete":                1,
+				"OnModelDeleteExecute":         1,
+				"OnModelAfterDeleteError":      1,
+			},
+		},
+		{
+			Name:   "authorized as superuser + deleting a view",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/view2",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionDeleteRequest":      1,
+				"OnCollectionDelete":             1,
+				"OnCollectionDeleteExecute":      1,
+				"OnCollectionAfterDeleteSuccess": 1,
+				"OnModelDelete":                  1,
+				"OnModelDeleteExecute":           1,
+				"OnModelAfterDeleteSuccess":      1,
+			},
+		},
+		{
+			Name:   "OnCollectionDeleteRequest tx body write check",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/view2",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnCollectionDeleteRequest().BindFunc(func(e *core.CollectionRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnCollectionDeleteRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestCollectionCreate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/collections",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body:   strings.NewReader(`{"name":"new","type":"base","fields":[{"type":"text","name":"test"}]}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + empty data",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body:   strings.NewReader(``),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"name":{"code":"validation_required"`,
+			},
+			NotExpectedContent: []string{
+				`"fields":{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionCreateRequest":    1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "authorized as superuser + invalid data (eg. existing name)",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body:   strings.NewReader(`{"name":"demo1","type":"base","fields":[{"type":"text","name":""}]}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"fields":{`,
+				`"name":{"code":"validation_collection_name_exists"`,
+				`"name":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionCreateRequest":    1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "authorized as superuser + valid data",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body:   strings.NewReader(`{"name":"new","type":"base","fields":[{"type":"text","id":"12345789","name":"test"}]}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":`,
+				`"name":"new"`,
+				`"type":"base"`,
+				`"system":false`,
+				// ensures that id field was prepended
+				`"fields":[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"12345789","max":0,"min":0,"name":"test","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"}]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionCreateRequest":      1,
+				"OnCollectionCreate":             1,
+				"OnCollectionCreateExecute":      1,
+				"OnCollectionAfterCreateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelCreate":                  1,
+				"OnModelCreateExecute":           1,
+				"OnModelAfterCreateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+		},
+		{
+			Name:   "creating auth collection (default settings merge test)",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"auth",
+				"emailChangeToken":{"duration":123},
+				"fields":[
+					{"type":"text","id":"12345789","name":"test"},
+					{"type":"text","name":"tokenKey","system":true,"required":false,"min":10}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":`,
+				`"name":"new"`,
+				`"type":"auth"`,
+				`"system":false`,
+				`"passwordAuth":{"enabled":true,"identityFields":["email"]}`,
+				`"authRule":""`,
+				`"manageRule":null`,
+				`"name":"test"`,
+				`"name":"id"`,
+				`"name":"tokenKey"`,
+				`"name":"password"`,
+				`"name":"email"`,
+				`"name":"emailVisibility"`,
+				`"name":"verified"`,
+				`"duration":123`,
+				// should overwrite the user required option but keep the min value
+				`{"autogeneratePattern":"","hidden":true,"id":"text2504183744","max":0,"min":10,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"}`,
+			},
+			NotExpectedContent: []string{
+				`"secret":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionCreateRequest":      1,
+				"OnCollectionCreate":             1,
+				"OnCollectionCreateExecute":      1,
+				"OnCollectionAfterCreateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelCreate":                  1,
+				"OnModelCreateExecute":           1,
+				"OnModelAfterCreateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+		},
+		{
+			Name:   "creating base collection with reserved auth fields",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"base",
+				"fields":[
+					{"type":"text","name":"email"},
+					{"type":"text","name":"username"},
+					{"type":"text","name":"verified"},
+					{"type":"text","name":"emailVisibility"},
+					{"type":"text","name":"lastResetSentAt"},
+					{"type":"text","name":"lastVerificationSentAt"},
+					{"type":"text","name":"tokenKey"},
+					{"type":"text","name":"passwordHash"},
+					{"type":"text","name":"password"},
+					{"type":"text","name":"passwordConfirm"},
+					{"type":"text","name":"oldPassword"}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"name":"new"`,
+				`"type":"base"`,
+				`"fields":[{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionCreateRequest":      1,
+				"OnCollectionCreate":             1,
+				"OnCollectionCreateExecute":      1,
+				"OnCollectionAfterCreateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelCreate":                  1,
+				"OnModelCreateExecute":           1,
+				"OnModelAfterCreateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+		},
+		{
+			Name:   "trying to create base collection with reserved system fields",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"base",
+				"fields":[
+					{"type":"text","name":"id"},
+					{"type":"text","name":"expand"},
+					{"type":"text","name":"collectionId"},
+					{"type":"text","name":"collectionName"}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{"fields":{`,
+				`"1":{"name":{"code":"validation_not_in_invalid`,
+				`"2":{"name":{"code":"validation_not_in_invalid`,
+				`"3":{"name":{"code":"validation_not_in_invalid`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionCreateRequest":    1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "trying to create auth collection with reserved auth fields",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"auth",
+				"fields":[
+					{"type":"text","name":"oldPassword"},
+					{"type":"text","name":"passwordConfirm"}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{"fields":{`,
+				`"1":{"name":{"code":"validation_reserved_field_name`,
+				`"2":{"name":{"code":"validation_reserved_field_name`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionCreateRequest":    1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "OnCollectionCreateRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body:   strings.NewReader(`{"name":"new","type":"base"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnCollectionCreateRequest().BindFunc(func(e *core.CollectionRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnCollectionCreateRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// view
+		// -----------------------------------------------------------
+		{
+			Name:   "trying to create view collection with invalid options",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"view",
+				"fields":[{"type":"text","id":"12345789","name":"ignored!@#$"}],
+				"viewQuery":"invalid"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"viewQuery":{"code":"validation_invalid_view_query`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionCreateRequest":    1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "creating view collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"view",
+				"fields":[{"type":"text","id":"12345789","name":"ignored!@#$"}],
+				"viewQuery": "select 1 as id from ` + core.CollectionNameSuperusers + `"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"name":"new"`,
+				`"type":"view"`,
+				`"fields":[{"autogeneratePattern":"","hidden":false,"id":"text3208210256","max":0,"min":0,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"}]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionCreateRequest":      1,
+				"OnCollectionCreate":             1,
+				"OnCollectionCreateExecute":      1,
+				"OnCollectionAfterCreateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelCreate":                  1,
+				"OnModelCreateExecute":           1,
+				"OnModelAfterCreateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+		},
+
+		// indexes
+		// -----------------------------------------------------------
+		{
+			Name:   "creating base collection with invalid indexes",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"base",
+				"fields":[
+					{"type":"text","name":"test"}
+				],
+				"indexes": [
+					"create index idx_test1 on new (test)",
+					"create index idx_test2 on new (missing)"
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"indexes":{"1":{"code":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionCreateRequest":    1,
+				"OnCollectionCreate":           1,
+				"OnCollectionCreateExecute":    1,
+				"OnCollectionAfterCreateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelCreate":                1,
+				"OnModelCreateExecute":         1,
+				"OnModelAfterCreateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "creating base collection with index name from another collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"base",
+				"fields":[
+					{"type":"text","name":"test"}
+				],
+				"indexes": [
+					"create index exist_test on new (test)"
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				demo1, err := app.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatal(err)
+				}
+				demo1.AddIndex("exist_test", false, "updated", "")
+				if err = app.Save(demo1); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"indexes":{`,
+				`"0":{"code":"validation_existing_index_name"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionCreateRequest":    1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "creating base collection with 2 indexes using the same name",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"base",
+				"indexes": [
+					"create index duplicate_idx on new (created)",
+					"create index duplicate_idx on new (updated)"
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"indexes":{`,
+				`"1":{"code":"validation_duplicated_index_name"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionCreateRequest":    1,
+				"OnCollectionCreate":           1,
+				"OnCollectionAfterCreateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelCreate":                1,
+				"OnModelAfterCreateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "creating base collection with valid indexes (+ random table name)",
+			Method: http.MethodPost,
+			URL:    "/api/collections",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"type":"base",
+				"fields":[
+					{"type":"text","name":"test"}
+				],
+				"indexes": [
+					"create index idx_test1 on new (test)",
+					"create index idx_test2 on anything (id, test)"
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"name":"new"`,
+				`"type":"base"`,
+				`"indexes":[`,
+				`idx_test1`,
+				`idx_test2`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionCreateRequest":      1,
+				"OnCollectionCreate":             1,
+				"OnCollectionCreateExecute":      1,
+				"OnCollectionAfterCreateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelCreate":                  1,
+				"OnModelCreateExecute":           1,
+				"OnModelAfterCreateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				indexes, err := app.TableIndexes("new")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				expected := []string{"idx_test1", "idx_test2"}
+				if len(indexes) != len(expected) {
+					t.Fatalf("Expected %d indexes, got %d\n%v", len(expected), len(indexes), indexes)
+				}
+				for name := range indexes {
+					if !list.ExistInSlice(name, expected) {
+						t.Fatalf("Missing index %q", name)
+					}
+				}
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestCollectionUpdate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/demo1",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + missing collection",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/missing",
+			Body:   strings.NewReader(`{}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + empty body",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1",
+			Body:   strings.NewReader(`{}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"wsmn24bux7wo113"`,
+				`"name":"demo1"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionUpdateRequest":      1,
+				"OnCollectionUpdate":             1,
+				"OnCollectionUpdateExecute":      1,
+				"OnCollectionAfterUpdateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelUpdate":                  1,
+				"OnModelUpdateExecute":           1,
+				"OnModelAfterUpdateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+		},
+		{
+			Name:   "OnCollectionUpdateRequest tx body write check",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1",
+			Body:   strings.NewReader(`{}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnCollectionUpdateRequest().BindFunc(func(e *core.CollectionRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnCollectionUpdateRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+		{
+			Name:   "authorized as superuser + invalid data (eg. existing name)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1",
+			Body: strings.NewReader(`{
+				"name":"demo2",
+				"type":"auth"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"name":{"code":"validation_collection_name_exists"`,
+				`"type":{"code":"validation_collection_type_change"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionUpdateRequest":    1,
+				"OnCollectionUpdate":           1,
+				"OnCollectionAfterUpdateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelUpdate":                1,
+				"OnModelAfterUpdateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "authorized as superuser + valid data",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1",
+			Body:   strings.NewReader(`{"name":"new"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":`,
+				`"name":"new"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionUpdateRequest":      1,
+				"OnCollectionUpdate":             1,
+				"OnCollectionUpdateExecute":      1,
+				"OnCollectionAfterUpdateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelUpdate":                  1,
+				"OnModelUpdateExecute":           1,
+				"OnModelAfterUpdateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				// check if the record table was renamed
+				if !app.HasTable("new") {
+					t.Fatal("Couldn't find record table 'new'.")
+				}
+			},
+		},
+		{
+			Name:   "trying to update collection with reserved fields",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"fields":[
+					{"type":"text","name":"id","id":"_pbf_text_id_"},
+					{"type":"text","name":"created"},
+					{"type":"text","name":"updated"},
+					{"type":"text","name":"expand"},
+					{"type":"text","name":"collectionId"},
+					{"type":"text","name":"collectionName"}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{"fields":{`,
+				`"3":{"name":{"code":"validation_not_in_invalid`,
+				`"4":{"name":{"code":"validation_not_in_invalid`,
+				`"5":{"name":{"code":"validation_not_in_invalid`,
+			},
+			NotExpectedContent: []string{
+				`"0":`,
+				`"1":`,
+				`"2":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionUpdateRequest":    1,
+				"OnCollectionUpdate":           1,
+				"OnCollectionAfterUpdateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelUpdate":                1,
+				"OnModelAfterUpdateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "trying to update collection with changed/removed system fields",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1",
+			Body: strings.NewReader(`{
+				"name":"new",
+				"fields":[
+					{"type":"text","name":"created"}
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{"fields":{`,
+				`"code":"validation_system_field_change"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionUpdateRequest":    1,
+				"OnCollectionUpdate":           1,
+				"OnCollectionAfterUpdateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelUpdate":                1,
+				"OnModelAfterUpdateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "trying to update auth collection with invalid options",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/users",
+			Body: strings.NewReader(`{
+				"passwordAuth":{"identityFields": ["missing"]}
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"passwordAuth":{"identityFields":{"code":"validation_missing_field"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionUpdateRequest":    1,
+				"OnCollectionUpdate":           1,
+				"OnCollectionAfterUpdateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelUpdate":                1,
+				"OnModelAfterUpdateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+
+		// view
+		// -----------------------------------------------------------
+		{
+			Name:   "trying to update view collection with invalid options",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/view1",
+			Body: strings.NewReader(`{
+				"fields":[{"type":"text","id":"12345789","name":"ignored!@#$"}],
+				"viewQuery":"invalid"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"viewQuery":{"code":"validation_invalid_view_query"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionUpdateRequest":    1,
+				"OnCollectionUpdate":           1,
+				"OnCollectionAfterUpdateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelUpdate":                1,
+				"OnModelAfterUpdateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "updating view collection",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/view2",
+			Body: strings.NewReader(`{
+				"name":"view2_update",
+				"fields":[{"type":"text","id":"12345789","name":"ignored!@#$"}],
+				"viewQuery": "select 2 as id, created, updated, email from ` + core.CollectionNameSuperusers + `"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"name":"view2_update"`,
+				`"type":"view"`,
+				`"fields":[{`,
+				`"name":"email"`,
+				`"name":"id"`,
+				`"name":"created"`,
+				`"name":"updated"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionUpdateRequest":      1,
+				"OnCollectionUpdate":             1,
+				"OnCollectionUpdateExecute":      1,
+				"OnCollectionAfterUpdateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelUpdate":                  1,
+				"OnModelUpdateExecute":           1,
+				"OnModelAfterUpdateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+		},
+
+		// indexes
+		// -----------------------------------------------------------
+		{
+			Name:   "updating base collection with invalid indexes",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo2",
+			Body: strings.NewReader(`{
+				"indexes": [
+					"create unique idx_test1 on demo1 (text)",
+					"create index idx_test2 on demo2 (id, title)"
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"indexes":{"0":{"code":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionUpdateRequest":    1,
+				"OnCollectionUpdate":           1,
+				"OnCollectionAfterUpdateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelUpdate":                1,
+				"OnModelAfterUpdateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+
+		{
+			Name:   "updating base collection with index name from another collection",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo2",
+			Body: strings.NewReader(`{
+				"indexes": [
+					"create index exist_test on new (test)"
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				demo1, err := app.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatal(err)
+				}
+				demo1.AddIndex("exist_test", false, "updated", "")
+				if err = app.Save(demo1); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"indexes":{`,
+				`"0":{"code":"validation_existing_index_name"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionUpdateRequest":    1,
+				"OnCollectionUpdate":           1,
+				"OnCollectionAfterUpdateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelUpdate":                1,
+				"OnModelAfterUpdateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+		{
+			Name:   "updating base collection with 2 indexes using the same name",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo2",
+			Body: strings.NewReader(`{
+				"indexes": [
+					"create index duplicate_idx on new (created)",
+					"create index duplicate_idx on new (updated)"
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"indexes":{`,
+				`"1":{"code":"validation_duplicated_index_name"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                            0,
+				"OnCollectionUpdateRequest":    1,
+				"OnCollectionUpdate":           1,
+				"OnCollectionAfterUpdateError": 1,
+				"OnCollectionValidate":         1,
+				"OnModelUpdate":                1,
+				"OnModelAfterUpdateError":      1,
+				"OnModelValidate":              1,
+			},
+		},
+
+		{
+			Name:   "updating base collection with valid indexes (+ random table name)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo2",
+			Body: strings.NewReader(`{
+				"indexes": [
+					"create unique index idx_test1 on demo2 (title)",
+					"create index idx_test2 on anything (active)"
+				]
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"name":"demo2"`,
+				`"indexes":[`,
+				`idx_test1`,
+				`idx_test2`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnCollectionUpdateRequest":      1,
+				"OnCollectionUpdate":             1,
+				"OnCollectionUpdateExecute":      1,
+				"OnCollectionAfterUpdateSuccess": 1,
+				"OnCollectionValidate":           1,
+				"OnModelUpdate":                  1,
+				"OnModelUpdateExecute":           1,
+				"OnModelAfterUpdateSuccess":      1,
+				"OnModelValidate":                1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				indexes, err := app.TableIndexes("demo2")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				expected := []string{"idx_test1", "idx_test2"}
+				if len(indexes) != len(expected) {
+					t.Fatalf("Expected %d indexes, got %d\n%v", len(expected), len(indexes), indexes)
+				}
+				for name := range indexes {
+					if !list.ExistInSlice(name, expected) {
+						t.Fatalf("Missing index %q", name)
+					}
+				}
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestCollectionScaffolds(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/meta/scaffolds",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/collections/meta/scaffolds",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/collections/meta/scaffolds",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":""`,
+				`"name":""`,
+				`"auth":{`,
+				`"base":{`,
+				`"view":{`,
+				`"type":"auth"`,
+				`"type":"base"`,
+				`"type":"view"`,
+				`"fields":[{`,
+				`"fields":[{`,
+				`"id":"text3208210256"`,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestCollectionTruncate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/demo5/truncate",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo5/truncate",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo5/truncate",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnModelDelete":              2,
+				"OnModelDeleteExecute":       2,
+				"OnModelAfterDeleteSuccess":  2,
+				"OnRecordDelete":             2,
+				"OnRecordDeleteExecute":      2,
+				"OnRecordAfterDeleteSuccess": 2,
+			},
+		},
+		{
+			Name:   "authorized as superuser but collection with required cascade delete references",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo3/truncate",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnModelDelete":            2,
+				"OnModelDeleteExecute":     2,
+				"OnModelAfterDeleteError":  2,
+				"OnModelUpdate":            2,
+				"OnModelUpdateExecute":     2,
+				"OnModelAfterUpdateError":  2,
+				"OnRecordDelete":           2,
+				"OnRecordDeleteExecute":    2,
+				"OnRecordAfterDeleteError": 2,
+				"OnRecordUpdate":           2,
+				"OnRecordUpdateExecute":    2,
+				"OnRecordAfterUpdateError": 2,
+			},
+		},
+		{
+			Name:   "authorized as superuser trying to truncate view collection",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/view2/truncate",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/cron.go b/server/core_backend-server/apis/cron.go
new file mode 100644
index 0000000..6195ed6
--- /dev/null
+++ b/server/core_backend-server/apis/cron.go
@@ -0,0 +1,59 @@
+package apis
+
+import (
+	"net/http"
+	"slices"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/cron"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/routine"
+)
+
+// bindCronApi registers the crons api endpoint.
+func bindCronApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	subGroup := rg.Group("/crons").Bind(RequireSuperuserAuth())
+	subGroup.GET("", cronsList)
+	subGroup.POST("/{id}", cronRun)
+}
+
+func cronsList(e *core.RequestEvent) error {
+	jobs := e.App.Cron().Jobs()
+
+	slices.SortStableFunc(jobs, func(a, b *cron.Job) int {
+		if strings.HasPrefix(a.Id(), "__pb") {
+			return 1
+		}
+		if strings.HasPrefix(b.Id(), "__pb") {
+			return -1
+		}
+		return strings.Compare(a.Id(), b.Id())
+	})
+
+	return e.JSON(http.StatusOK, jobs)
+}
+
+func cronRun(e *core.RequestEvent) error {
+	cronId := e.Request.PathValue("id")
+
+	var foundJob *cron.Job
+
+	jobs := e.App.Cron().Jobs()
+	for _, j := range jobs {
+		if j.Id() == cronId {
+			foundJob = j
+			break
+		}
+	}
+
+	if foundJob == nil {
+		return e.NotFoundError("Missing or invalid cron job", nil)
+	}
+
+	routine.FireAndForget(func() {
+		foundJob.Run()
+	})
+
+	return e.NoContent(http.StatusNoContent)
+}
diff --git a/server/core_backend-server/apis/cron_test.go b/server/core_backend-server/apis/cron_test.go
new file mode 100644
index 0000000..a72fb2f
--- /dev/null
+++ b/server/core_backend-server/apis/cron_test.go
@@ -0,0 +1,149 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/spf13/cast"
+)
+
+func TestCronsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/crons",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/crons",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (empty list)",
+			Method: http.MethodGet,
+			URL:    "/api/crons",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Cron().RemoveAll()
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{`[]`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/crons",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`{"id":"__pbLogsCleanup__","expression":"0 */6 * * *"}`,
+				`{"id":"__pbDBOptimize__","expression":"0 0 * * *"}`,
+				`{"id":"__pbMFACleanup__","expression":"0 * * * *"}`,
+				`{"id":"__pbOTPCleanup__","expression":"0 * * * *"}`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestCronsRun(t *testing.T) {
+	t.Parallel()
+
+	beforeTestFunc := func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+		app.Cron().Add("test", "* * * * *", func() {
+			app.Store().Set("testJobCalls", cast.ToInt(app.Store().Get("testJobCalls"))+1)
+		})
+	}
+
+	expectedCalls := func(expected int) func(t testing.TB, app *tests.TestApp, res *http.Response) {
+		return func(t testing.TB, app *tests.TestApp, res *http.Response) {
+			total := cast.ToInt(app.Store().Get("testJobCalls"))
+			if total != expected {
+				t.Fatalf("Expected total testJobCalls %d, got %d", expected, total)
+			}
+		}
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/crons/test",
+			Delay:           50 * time.Millisecond,
+			BeforeTestFunc:  beforeTestFunc,
+			AfterTestFunc:   expectedCalls(0),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/crons/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Delay:           50 * time.Millisecond,
+			BeforeTestFunc:  beforeTestFunc,
+			AfterTestFunc:   expectedCalls(0),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (missing job)",
+			Method: http.MethodPost,
+			URL:    "/api/crons/missing",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Delay:           50 * time.Millisecond,
+			BeforeTestFunc:  beforeTestFunc,
+			AfterTestFunc:   expectedCalls(0),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (existing job)",
+			Method: http.MethodPost,
+			URL:    "/api/crons/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Delay:          50 * time.Millisecond,
+			BeforeTestFunc: beforeTestFunc,
+			AfterTestFunc:  expectedCalls(1),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/edge_functions.go b/server/core_backend-server/apis/edge_functions.go
new file mode 100644
index 0000000..7f5308f
--- /dev/null
+++ b/server/core_backend-server/apis/edge_functions.go
@@ -0,0 +1,612 @@
+package apis
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/dop251/goja"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func executeEdgeFunction(app core.App, fn edgeFunction, record *core.Record) {
+	start := time.Now()
+	vm := goja.New()
+	vm.SetFieldNameMapper(goja.UncapFieldNameMapper())
+
+	var logs []string
+	outputMu := sync.Mutex{}
+
+	// Basic binds
+	vm.Set("$app", app)
+	if record != nil && record.Id != "" {
+		vm.Set("$record", record)
+	} else {
+		// Dummy record for testing
+		vm.Set("$record", map[string]any{
+			"id": "test_id",
+			"get": func(field string) string {
+				return "test_" + field
+			},
+			"collection": func() map[string]any {
+				return map[string]any{
+					"name": fn.TriggerCollection.String,
+				}
+			},
+		})
+	}
+
+	// Simple console.log implementation
+	vm.Set("console", map[string]any{
+		"log": func(args ...any) {
+			outputMu.Lock()
+			logs = append(logs, fmt.Sprint(args...))
+			outputMu.Unlock()
+			app.Logger().Info("Edge Function Log", "name", fn.Name, "message", args)
+		},
+	})
+
+	// Add fetch polyfill
+	vm.Set("fetch", func(url string, options map[string]any) (goja.Value, error) {
+		method := "GET"
+		var body io.Reader
+		headers := make(map[string]string)
+
+		if options != nil {
+			if m, ok := options["method"].(string); ok {
+				method = strings.ToUpper(m)
+			}
+			if h, ok := options["headers"].(map[string]any); ok {
+				for k, v := range h {
+					headers[k] = fmt.Sprintf("%v", v)
+				}
+			}
+			if b, ok := options["body"].(string); ok {
+				body = strings.NewReader(b)
+			}
+		}
+
+		req, err := http.NewRequest(method, url, body)
+		if err != nil {
+			return nil, err
+		}
+
+		for k, v := range headers {
+			req.Header.Set(k, v)
+		}
+
+		client := &http.Client{Timeout: 30 * time.Second}
+		resp, err := client.Do(req)
+		if err != nil {
+			return nil, err
+		}
+		defer resp.Body.Close()
+
+		respBody, _ := io.ReadAll(resp.Body)
+
+		// Parse JSON if possible
+		var jsonBody any
+		_ = json.Unmarshal(respBody, &jsonBody)
+
+		// Create response object
+		responseObj := map[string]any{
+			"ok":         resp.StatusCode >= 200 && resp.StatusCode < 300,
+			"status":     resp.StatusCode,
+			"statusText": resp.Status,
+			"json": func() (goja.Value, error) {
+				p, resolve, _ := vm.NewPromise()
+				resolve(vm.ToValue(jsonBody))
+				return vm.ToValue(p), nil
+			},
+			"text": func() (goja.Value, error) {
+				p, resolve, _ := vm.NewPromise()
+				resolve(vm.ToValue(string(respBody)))
+				return vm.ToValue(p), nil
+			},
+		}
+
+		// Return a resolved promise
+		promise, resolve, _ := vm.NewPromise()
+		resolve(vm.ToValue(responseObj))
+		return vm.ToValue(promise), nil
+	})
+
+	// Execute the body
+	_, err := vm.RunString(fn.Body.String)
+	duration := time.Since(start).Milliseconds()
+	output := strings.Join(logs, "\n")
+
+	if err != nil {
+		app.Logger().Error("Edge Function Execution Failed", "name", fn.Name, "error", err.Error())
+		logEdgeFunctionExecution(app, fn.Id, "error", duration, output, err.Error())
+	} else {
+		app.Logger().Info("Edge Function Executed Successfully", "name", fn.Name)
+		logEdgeFunctionExecution(app, fn.Id, "success", duration, output, "")
+	}
+}
+
+type edgeFunction struct {
+	Id                string         `db:"id" json:"id"`
+	Name              string         `db:"name" json:"name"`
+	Body              sql.NullString `db:"body" json:"body"`
+	TriggerType       sql.NullString `db:"trigger_type" json:"trigger_type"`
+	TriggerConfig     sql.NullString `db:"trigger_config" json:"trigger_config"`
+	Active            bool           `db:"active" json:"active"`
+	TriggerCollection sql.NullString `db:"trigger_collection" json:"trigger_collection"`
+	TriggerEvent      sql.NullString `db:"trigger_event" json:"trigger_event"`
+	Created           sql.NullTime   `db:"created" json:"created"`
+	Updated           sql.NullTime   `db:"updated" json:"updated"`
+}
+
+func logEdgeFunctionExecution(app core.App, fnId string, status string, duration int64, output string, errStr string) {
+	id := security.PseudorandomStringWithAlphabet(15, "abcdefghijklmnopqrstuvwxyz0123456789")
+	_, err := app.NonconcurrentDB().Insert("_edge_function_logs", dbx.Params{
+		"id":          id,
+		"function_id": fnId,
+		"status":      status,
+		"duration":    duration,
+		"output":      output,
+		"error":       errStr,
+	}).Execute()
+
+	if err != nil {
+		app.Logger().Error("Failed to save edge function log", "error", err.Error())
+	}
+}
+
+func reloadCronJobs(app core.App) {
+	if app.Cron() == nil {
+		app.Logger().Warn("Cron is not initialized, skipping reload")
+		return
+	}
+	app.Logger().Info("Reloading edge function cron jobs")
+	// Remove all existing edge function cron jobs
+	for _, job := range app.Cron().Jobs() {
+		if strings.HasPrefix(job.Id(), "edge_") {
+			app.Logger().Info("Removing cron job", "id", job.Id())
+			app.Cron().Remove(job.Id())
+		}
+	}
+
+	var functions []edgeFunction
+	err := app.DB().
+		Select("*").
+		From("_edge_functions").
+		Where(dbx.HashExp{
+			"active":       true,
+			"trigger_type": "cron",
+		}).
+		All(&functions)
+
+	if err != nil {
+		return
+	}
+
+	for _, fn := range functions {
+		cronExpr := fn.TriggerConfig.String
+		if cronExpr == "" {
+			continue
+		}
+
+		fnCopy := fn // capture for closure
+		jobName := "edge_" + fn.Id
+		app.Cron().Add(jobName, cronExpr, func() {
+			executeEdgeFunction(app, fnCopy, nil)
+		})
+	}
+}
+
+// bindEdgeFunctionsApi registers the Edge Functions API routes.
+func bindEdgeFunctionsApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	subGroup := rg.Group("/functions").Bind(RequireSuperuserAuth())
+
+	// Ensure the table exists on startup
+	ensureEdgeFunctionsTable(app)
+
+	// Load cron jobs and register webhook on startup
+	app.OnServe().BindFunc(func(e *core.ServeEvent) error {
+		// Register HTTP Trigger Route (Public)
+		// We register it here to avoid conflicts with the static file server
+		e.Router.POST("/edge-hook/{name}", func(e *core.RequestEvent) error {
+			name := e.Request.PathValue("name")
+
+			var fn edgeFunction
+			err := e.App.DB().
+				Select("*").
+				From("_edge_functions").
+				Where(dbx.HashExp{
+					"active":       true,
+					"trigger_type": "http",
+					"name":         name,
+				}).
+				One(&fn)
+
+			if err != nil {
+				return e.NotFoundError("Function not found or inactive.", nil)
+			}
+
+			// Execute function
+			go executeEdgeFunction(e.App, fn, nil)
+
+			return e.JSON(http.StatusOK, map[string]any{
+				"message": "Function triggered successfully",
+			})
+		})
+
+		reloadCronJobs(e.App)
+		return e.Next()
+	})
+
+	// Register hooks to trigger functions
+	app.OnRecordAfterCreateSuccess().BindFunc(func(e *core.RecordEvent) error {
+		collectionName := e.Record.Collection().Name
+
+		var functions []edgeFunction
+		err := e.App.DB().
+			Select("*").
+			From("_edge_functions").
+			Where(dbx.HashExp{
+				"active":             true,
+				"trigger_type":       "record",
+				"trigger_collection": collectionName,
+				"trigger_event":      "create",
+			}).
+			All(&functions)
+
+		if err != nil {
+			return e.Next()
+		}
+
+		for _, fn := range functions {
+			go executeEdgeFunction(e.App, fn, e.Record)
+		}
+
+		return e.Next()
+	})
+
+	app.OnRecordAfterUpdateSuccess().BindFunc(func(e *core.RecordEvent) error {
+		var functions []edgeFunction
+		err := e.App.DB().
+			Select("*").
+			From("_edge_functions").
+			Where(dbx.HashExp{
+				"active":             true,
+				"trigger_type":       "record",
+				"trigger_collection": e.Record.Collection().Name,
+				"trigger_event":      "update",
+			}).
+			All(&functions)
+
+		if err == nil {
+			for _, fn := range functions {
+				go executeEdgeFunction(e.App, fn, e.Record)
+			}
+		}
+
+		return e.Next()
+	})
+
+	app.OnRecordAfterDeleteSuccess().BindFunc(func(e *core.RecordEvent) error {
+		var functions []edgeFunction
+		err := e.App.DB().
+			Select("*").
+			From("_edge_functions").
+			Where(dbx.HashExp{
+				"active":             true,
+				"trigger_type":       "record",
+				"trigger_collection": e.Record.Collection().Name,
+				"trigger_event":      "delete",
+			}).
+			All(&functions)
+
+		if err == nil {
+			for _, fn := range functions {
+				go executeEdgeFunction(e.App, fn, e.Record)
+			}
+		}
+
+		return e.Next()
+	})
+
+	// Logs API
+	subGroup.GET("/{id}/logs", func(e *core.RequestEvent) error {
+		id := e.Request.PathValue("id")
+
+		var logs []map[string]any
+		err := e.App.DB().
+			Select("*").
+			From("_edge_function_logs").
+			Where(dbx.HashExp{"function_id": id}).
+			OrderBy("created DESC").
+			Limit(50).
+			All(&logs)
+
+		if err != nil {
+			return e.BadRequestError("Failed to load logs", err)
+		}
+
+		return e.JSON(http.StatusOK, logs)
+	})
+
+	subGroup.GET("", func(e *core.RequestEvent) error {
+		var functions []edgeFunction
+		e.App.Logger().Info("Executing GET /api/functions")
+
+		// Use app.DB() which is the standard way to access the data database
+		err := e.App.DB().
+			Select("*").
+			From("_edge_functions").
+			OrderBy("created DESC").
+			All(&functions)
+
+		if err != nil {
+			e.App.Logger().Error("Failed to load edge functions", "error", err.Error())
+			return e.BadRequestError("Failed to load edge functions: "+err.Error(), nil)
+		}
+
+		e.App.Logger().Info("Loaded edge functions from DB", "count", len(functions))
+		for _, f := range functions {
+			e.App.Logger().Info("Function in list", "id", f.Id, "name", f.Name)
+		}
+
+		// Convert to response format with string dates
+		result := make([]map[string]any, len(functions))
+		for i, f := range functions {
+			created := ""
+			if f.Created.Valid {
+				created = f.Created.Time.Format("2006-01-02 15:04:05.000Z")
+			}
+			updated := ""
+			if f.Updated.Valid {
+				updated = f.Updated.Time.Format("2006-01-02 15:04:05.000Z")
+			}
+
+			// Debug log each function ID and Name
+			e.App.Logger().Debug("Function row", "id", f.Id, "name", f.Name)
+
+			result[i] = map[string]any{
+				"id":                 f.Id,
+				"name":               f.Name,
+				"body":               f.Body.String,
+				"trigger_type":       f.TriggerType.String,
+				"trigger_config":     f.TriggerConfig.String,
+				"active":             f.Active,
+				"trigger_collection": f.TriggerCollection.String,
+				"trigger_event":      f.TriggerEvent.String,
+				"created":            created,
+				"updated":            updated,
+			}
+		}
+
+		return e.JSON(http.StatusOK, result)
+	})
+
+	subGroup.POST("", func(e *core.RequestEvent) error {
+		data := struct {
+			Name              string `json:"name" form:"name"`
+			Body              string `json:"body" form:"body"`
+			TriggerType       string `json:"trigger_type" form:"trigger_type"`
+			TriggerConfig     string `json:"trigger_config" form:"trigger_config"`
+			Active            bool   `json:"active" form:"active"`
+			TriggerCollection string `json:"trigger_collection" form:"trigger_collection"`
+			TriggerEvent      string `json:"trigger_event" form:"trigger_event"`
+		}{}
+
+		if err := e.BindBody(&data); err != nil {
+			return e.BadRequestError("Failed to parse request body.", err)
+		}
+
+		if data.Name == "" {
+			return e.BadRequestError("Function name is required.", nil)
+		}
+
+		e.App.Logger().Info("Creating function",
+			"name", data.Name,
+			"trigger_col", data.TriggerCollection,
+			"trigger_event", data.TriggerEvent)
+
+		id := security.PseudorandomStringWithAlphabet(15, "abcdefghijklmnopqrstuvwxyz0123456789")
+
+		// Insert the function
+		_, err := e.App.NonconcurrentDB().Insert("_edge_functions", dbx.Params{
+			"id":                 id,
+			"name":               data.Name,
+			"body":               data.Body,
+			"trigger_type":       data.TriggerType,
+			"trigger_config":     data.TriggerConfig,
+			"active":             data.Active,
+			"trigger_collection": data.TriggerCollection,
+			"trigger_event":      data.TriggerEvent,
+		}).Execute()
+
+		if err != nil {
+			return e.BadRequestError("Failed to create function: "+err.Error(), nil)
+		}
+
+		if data.TriggerType == "cron" {
+			reloadCronJobs(e.App)
+		}
+
+		// Return the created object
+		return e.JSON(http.StatusOK, map[string]any{
+			"id":                 id,
+			"name":               data.Name,
+			"body":               data.Body,
+			"trigger_type":       data.TriggerType,
+			"trigger_config":     data.TriggerConfig,
+			"active":             data.Active,
+			"trigger_collection": data.TriggerCollection,
+			"trigger_event":      data.TriggerEvent,
+		})
+	})
+
+	subGroup.GET("/{id}", func(e *core.RequestEvent) error {
+		id := e.Request.PathValue("id")
+
+		var f edgeFunction
+		err := e.App.ConcurrentDB().
+			Select("*").
+			From("_edge_functions").
+			Where(dbx.HashExp{"id": id}).
+			One(&f)
+
+		if err != nil {
+			return e.NotFoundError("Function not found.", nil)
+		}
+
+		created := ""
+		if f.Created.Valid {
+			created = f.Created.Time.Format("2006-01-02 15:04:05.000Z")
+		}
+		updated := ""
+		if f.Updated.Valid {
+			updated = f.Updated.Time.Format("2006-01-02 15:04:05.000Z")
+		}
+
+		return e.JSON(http.StatusOK, map[string]any{
+			"id":                 f.Id,
+			"name":               f.Name,
+			"body":               f.Body.String,
+			"trigger_collection": f.TriggerCollection.String,
+			"trigger_event":      f.TriggerEvent.String,
+			"created":            created,
+			"updated":            updated,
+		})
+	})
+
+	subGroup.POST("/{id}/test", func(e *core.RequestEvent) error {
+		id := e.Request.PathValue("id")
+
+		var f edgeFunction
+		err := e.App.ConcurrentDB().
+			Select("*").
+			From("_edge_functions").
+			Where(dbx.HashExp{"id": id}).
+			One(&f)
+
+		if err != nil {
+			return e.NotFoundError("Function not found.", nil)
+		}
+
+		// Execute with a dummy record
+		go executeEdgeFunction(e.App, f, &core.Record{})
+
+		return e.JSON(http.StatusOK, map[string]any{
+			"message": "Test execution started",
+		})
+	})
+
+	subGroup.PATCH("/{id}", func(e *core.RequestEvent) error {
+		id := e.Request.PathValue("id")
+		e.App.Logger().Info("PATCH function request", "id", id)
+
+		data := struct {
+			Name              string `json:"name" form:"name"`
+			Body              string `json:"body" form:"body"`
+			TriggerType       string `json:"trigger_type" form:"trigger_type"`
+			TriggerConfig     string `json:"trigger_config" form:"trigger_config"`
+			Active            bool   `json:"active" form:"active"`
+			TriggerCollection string `json:"trigger_collection" form:"trigger_collection"`
+			TriggerEvent      string `json:"trigger_event" form:"trigger_event"`
+		}{}
+
+		if err := e.BindBody(&data); err != nil {
+			e.App.Logger().Error("Failed to bind body", "error", err.Error())
+			return e.BadRequestError("Failed to parse request body.", err)
+		}
+
+		e.App.Logger().Info("Updating function",
+			"name", data.Name,
+			"body_len", len(data.Body),
+			"trigger_col", data.TriggerCollection,
+			"trigger_event", data.TriggerEvent)
+
+		_, err := e.App.NonconcurrentDB().Update("_edge_functions", dbx.Params{
+			"name":               data.Name,
+			"body":               data.Body,
+			"trigger_type":       data.TriggerType,
+			"trigger_config":     data.TriggerConfig,
+			"active":             data.Active,
+			"trigger_collection": data.TriggerCollection,
+			"trigger_event":      data.TriggerEvent,
+		}, dbx.HashExp{"id": id}).Execute()
+
+		if err != nil {
+			e.App.Logger().Error("Failed to update function in DB", "error", err.Error())
+			return e.BadRequestError("Failed to update function: "+err.Error(), nil)
+		}
+
+		reloadCronJobs(e.App)
+
+		return e.JSON(http.StatusOK, map[string]any{
+			"id":                 id,
+			"name":               data.Name,
+			"body":               data.Body,
+			"trigger_type":       data.TriggerType,
+			"trigger_config":     data.TriggerConfig,
+			"active":             data.Active,
+			"trigger_collection": data.TriggerCollection,
+			"trigger_event":      data.TriggerEvent,
+		})
+	})
+
+	subGroup.DELETE("/{id}", func(e *core.RequestEvent) error {
+		id := e.Request.PathValue("id")
+
+		_, err := e.App.NonconcurrentDB().Delete("_edge_functions", dbx.HashExp{"id": id}).Execute()
+
+		if err != nil {
+			return e.BadRequestError("Failed to delete function: "+err.Error(), nil)
+		}
+
+		reloadCronJobs(e.App)
+
+		return e.NoContent(http.StatusNoContent)
+	})
+}
+
+// ensureEdgeFunctionsTable creates the _edge_functions table if it doesn't exist (PostgreSQL compatible)
+func ensureEdgeFunctionsTable(app core.App) {
+	_, _ = app.NonconcurrentDB().NewQuery(`
+		CREATE TABLE IF NOT EXISTS _edge_functions (
+			id TEXT PRIMARY KEY,
+			name TEXT NOT NULL,
+			body TEXT,
+			trigger_type TEXT DEFAULT 'record',
+			trigger_config TEXT,
+			active BOOLEAN DEFAULT TRUE,
+			trigger_collection TEXT,
+			trigger_event TEXT,
+			created TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		)
+	`).Execute()
+
+	// Add columns if they don't exist (for existing tables)
+	_, _ = app.NonconcurrentDB().NewQuery(`ALTER TABLE _edge_functions ADD COLUMN IF NOT EXISTS trigger_type TEXT DEFAULT 'record'`).Execute()
+	_, _ = app.NonconcurrentDB().NewQuery(`ALTER TABLE _edge_functions ADD COLUMN IF NOT EXISTS trigger_config TEXT`).Execute()
+	_, _ = app.NonconcurrentDB().NewQuery(`ALTER TABLE _edge_functions ADD COLUMN IF NOT EXISTS active BOOLEAN DEFAULT TRUE`).Execute()
+	_, _ = app.NonconcurrentDB().NewQuery(`ALTER TABLE _edge_functions ADD COLUMN IF NOT EXISTS trigger_collection TEXT`).Execute()
+	_, _ = app.NonconcurrentDB().NewQuery(`ALTER TABLE _edge_functions ADD COLUMN IF NOT EXISTS trigger_event TEXT`).Execute()
+
+	// Create logs table
+	_, _ = app.NonconcurrentDB().NewQuery(`
+		CREATE TABLE IF NOT EXISTS _edge_function_logs (
+			id TEXT PRIMARY KEY,
+			function_id TEXT NOT NULL,
+			status TEXT,
+			duration INTEGER,
+			output TEXT,
+			error TEXT,
+			created TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		)
+	`).Execute()
+}
diff --git a/server/core_backend-server/apis/file.go b/server/core_backend-server/apis/file.go
new file mode 100644
index 0000000..f0d2390
--- /dev/null
+++ b/server/core_backend-server/apis/file.go
@@ -0,0 +1,233 @@
+package apis
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"os"
+	"runtime"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/spf13/cast"
+	"golang.org/x/sync/semaphore"
+	"golang.org/x/sync/singleflight"
+)
+
+var imageContentTypes = []string{"image/png", "image/jpg", "image/jpeg", "image/gif", "image/webp"}
+var defaultThumbSizes = []string{"100x100"}
+
+// bindFileApi registers the file api endpoints and the corresponding handlers.
+func bindFileApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	maxWorkers := cast.ToInt64(os.Getenv("PB_THUMBS_MAX_WORKERS"))
+	if maxWorkers <= 0 {
+		maxWorkers = int64(runtime.NumCPU() + 2) // the value is arbitrary chosen and may change in the future
+	}
+
+	maxWait := cast.ToInt64(os.Getenv("PB_THUMBS_MAX_WAIT"))
+	if maxWait <= 0 {
+		maxWait = 60
+	}
+
+	api := fileApi{
+		thumbGenPending: new(singleflight.Group),
+		thumbGenSem:     semaphore.NewWeighted(maxWorkers),
+		thumbGenMaxWait: time.Duration(maxWait) * time.Second,
+	}
+
+	sub := rg.Group("/files")
+	sub.POST("/token", api.fileToken).Bind(RequireAuth())
+	sub.GET("/{collection}/{recordId}/{filename}", api.download).Bind(collectionPathRateLimit("", "file"))
+}
+
+type fileApi struct {
+	// thumbGenSem is a semaphore to prevent too much concurrent
+	// requests generating new thumbs at the same time.
+	thumbGenSem *semaphore.Weighted
+
+	// thumbGenPending represents a group of currently pending
+	// thumb generation processes.
+	thumbGenPending *singleflight.Group
+
+	// thumbGenMaxWait is the maximum waiting time for starting a new
+	// thumb generation process.
+	thumbGenMaxWait time.Duration
+}
+
+func (api *fileApi) fileToken(e *core.RequestEvent) error {
+	if e.Auth == nil {
+		return e.UnauthorizedError("Missing auth context.", nil)
+	}
+
+	token, err := e.Auth.NewFileToken()
+	if err != nil {
+		return e.InternalServerError("Failed to generate file token", err)
+	}
+
+	event := new(core.FileTokenRequestEvent)
+	event.RequestEvent = e
+	event.Token = token
+	event.Record = e.Auth
+
+	return e.App.OnFileTokenRequest().Trigger(event, func(e *core.FileTokenRequestEvent) error {
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, map[string]string{"token": e.Token})
+		})
+	})
+}
+
+func (api *fileApi) download(e *core.RequestEvent) error {
+	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+	if err != nil {
+		return e.NotFoundError("", nil)
+	}
+
+	recordId := e.Request.PathValue("recordId")
+	if recordId == "" {
+		return e.NotFoundError("", nil)
+	}
+
+	record, err := e.App.FindRecordById(collection, recordId)
+	if err != nil {
+		return e.NotFoundError("", err)
+	}
+
+	filename := e.Request.PathValue("filename")
+
+	fileField := record.FindFileFieldByFile(filename)
+	if fileField == nil {
+		return e.NotFoundError("", nil)
+	}
+
+	// check whether the request is authorized to view the protected file
+	if fileField.Protected {
+		originalRequestInfo, err := e.RequestInfo()
+		if err != nil {
+			return e.InternalServerError("Failed to load request info", err)
+		}
+
+		token := e.Request.URL.Query().Get("token")
+		authRecord, _ := e.App.FindAuthRecordByToken(token, core.TokenTypeFile)
+
+		// create a shallow copy of the cached request data and adjust it to the current auth record (if any)
+		requestInfo := *originalRequestInfo
+		requestInfo.Context = core.RequestInfoContextProtectedFile
+		requestInfo.Auth = authRecord
+
+		if ok, _ := e.App.CanAccessRecord(record, &requestInfo, record.Collection().ViewRule); !ok {
+			return e.NotFoundError("", errors.New("insufficient permissions to access the file resource"))
+		}
+	}
+
+	baseFilesPath := record.BaseFilesPath()
+
+	// fetch the original view file field related record
+	if collection.IsView() {
+		fileRecord, err := e.App.FindRecordByViewFile(collection.Id, fileField.Name, filename)
+		if err != nil {
+			return e.NotFoundError("", fmt.Errorf("failed to fetch view file field record: %w", err))
+		}
+		baseFilesPath = fileRecord.BaseFilesPath()
+	}
+
+	fsys, err := e.App.NewFilesystem()
+	if err != nil {
+		return e.InternalServerError("Filesystem initialization failure.", err)
+	}
+	defer fsys.Close()
+
+	originalPath := baseFilesPath + "/" + filename
+
+	event := new(core.FileDownloadRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = record
+	event.FileField = fileField
+	event.ServedPath = originalPath
+	event.ServedName = filename
+
+	// check for valid thumb size param
+	thumbSize := e.Request.URL.Query().Get("thumb")
+	if thumbSize != "" && (list.ExistInSlice(thumbSize, defaultThumbSizes) || list.ExistInSlice(thumbSize, fileField.Thumbs)) {
+		// extract the original file meta attributes and check it existence
+		oAttrs, oAttrsErr := fsys.Attributes(originalPath)
+		if oAttrsErr != nil {
+			return e.NotFoundError("", err)
+		}
+
+		// check if it is an image
+		if list.ExistInSlice(oAttrs.ContentType, imageContentTypes) {
+			// add thumb size as file suffix
+			event.ServedName = thumbSize + "_" + filename
+			event.ServedPath = baseFilesPath + "/thumbs_" + filename + "/" + event.ServedName
+
+			// create a new thumb if it doesn't exist
+			if exists, _ := fsys.Exists(event.ServedPath); !exists {
+				if err := api.createThumb(e, fsys, originalPath, event.ServedPath, thumbSize); err != nil {
+					e.App.Logger().Warn(
+						"Fallback to original - failed to create thumb "+event.ServedName,
+						slog.Any("error", err),
+						slog.String("original", originalPath),
+						slog.String("thumb", event.ServedPath),
+					)
+
+					// fallback to the original
+					event.ThumbError = err
+					event.ServedName = filename
+					event.ServedPath = originalPath
+				}
+			}
+		}
+	}
+
+	if thumbSize != "" && event.ThumbError == nil && event.ServedPath == originalPath {
+		event.ThumbError = fmt.Errorf("the thumb size %q or the original file format are not supported", thumbSize)
+	}
+
+	// clickjacking shouldn't be a concern when serving uploaded files,
+	// so it safe to unset the global X-Frame-Options to allow files embedding
+	// (note: it is out of the hook to allow users to customize the behavior)
+	e.Response.Header().Del("X-Frame-Options")
+
+	return e.App.OnFileDownloadRequest().Trigger(event, func(e *core.FileDownloadRequestEvent) error {
+		err = execAfterSuccessTx(true, e.App, func() error {
+			return fsys.Serve(e.Response, e.Request, e.ServedPath, e.ServedName)
+		})
+		if err != nil {
+			return e.NotFoundError("", err)
+		}
+
+		return nil
+	})
+}
+
+func (api *fileApi) createThumb(
+	e *core.RequestEvent,
+	fsys *filesystem.System,
+	originalPath string,
+	thumbPath string,
+	thumbSize string,
+) error {
+	ch := api.thumbGenPending.DoChan(thumbPath, func() (any, error) {
+		ctx, cancel := context.WithTimeout(e.Request.Context(), api.thumbGenMaxWait)
+		defer cancel()
+
+		if err := api.thumbGenSem.Acquire(ctx, 1); err != nil {
+			return nil, err
+		}
+		defer api.thumbGenSem.Release(1)
+
+		return nil, fsys.CreateThumb(originalPath, thumbPath, thumbSize)
+	})
+
+	res := <-ch
+
+	api.thumbGenPending.Forget(thumbPath)
+
+	return res.Err
+}
diff --git a/server/core_backend-server/apis/file_test.go b/server/core_backend-server/apis/file_test.go
new file mode 100644
index 0000000..daee78f
--- /dev/null
+++ b/server/core_backend-server/apis/file_test.go
@@ -0,0 +1,568 @@
+package apis_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"sync"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestFileToken(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/files/token",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "regular user",
+			Method: http.MethodPost,
+			URL:    "/api/files/token",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                  0,
+				"OnFileTokenRequest": 1,
+			},
+		},
+		{
+			Name:   "superuser",
+			Method: http.MethodPost,
+			URL:    "/api/files/token",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                  0,
+				"OnFileTokenRequest": 1,
+			},
+		},
+		{
+			Name:   "hook token overwrite",
+			Method: http.MethodPost,
+			URL:    "/api/files/token",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileTokenRequest().BindFunc(func(e *core.FileTokenRequestEvent) error {
+					e.Token = "test"
+					return e.Next()
+				})
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"test"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                  0,
+				"OnFileTokenRequest": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestFileDownload(t *testing.T) {
+	t.Parallel()
+
+	_, currentFile, _, _ := runtime.Caller(0)
+	dataDirRelPath := "../tests/data/"
+
+	testFilePath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt")
+	testImgPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png")
+	testThumbCropCenterPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50_300_1SEi6Q6U72.png")
+	testThumbCropTopPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50t_300_1SEi6Q6U72.png")
+	testThumbCropBottomPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50b_300_1SEi6Q6U72.png")
+	testThumbFitPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50f_300_1SEi6Q6U72.png")
+	testThumbZeroWidthPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/0x50_300_1SEi6Q6U72.png")
+	testThumbZeroHeightPath := filepath.Join(path.Dir(currentFile), dataDirRelPath, "storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x0_300_1SEi6Q6U72.png")
+
+	testFile, fileErr := os.ReadFile(testFilePath)
+	if fileErr != nil {
+		t.Fatal(fileErr)
+	}
+
+	testImg, imgErr := os.ReadFile(testImgPath)
+	if imgErr != nil {
+		t.Fatal(imgErr)
+	}
+
+	testThumbCropCenter, thumbErr := os.ReadFile(testThumbCropCenterPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbCropTop, thumbErr := os.ReadFile(testThumbCropTopPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbCropBottom, thumbErr := os.ReadFile(testThumbCropBottomPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbFit, thumbErr := os.ReadFile(testThumbFitPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbZeroWidth, thumbErr := os.ReadFile(testThumbZeroWidthPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	testThumbZeroHeight, thumbErr := os.ReadFile(testThumbZeroHeightPath)
+	if thumbErr != nil {
+		t.Fatal(thumbErr)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "missing collection",
+			Method:          http.MethodGet,
+			URL:             "/api/files/missing/4q1xlclmfloku33/300_1SEi6Q6U72.png",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "missing record",
+			Method:          http.MethodGet,
+			URL:             "/api/files/_pb_users_auth_/missing/300_1SEi6Q6U72.png",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "missing file",
+			Method:          http.MethodGet,
+			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/missing.png",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "existing image",
+			Method:          http.MethodGet,
+			URL:             "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testImg)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "existing image - missing thumb (should fallback to the original)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=999x999",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError == nil {
+						t.Fatal("Expected thumb error, got nil")
+					}
+					return e.Next()
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testImg)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "existing image - existing thumb (crop center)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbCropCenter)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "existing image - existing thumb (crop top)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50t",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbCropTop)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "existing image - existing thumb (crop bottom)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50b",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbCropBottom)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "existing image - existing thumb (fit)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x50f",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbFit)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "existing image - existing thumb (zero width)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=0x50",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbZeroWidth)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "existing image - existing thumb (zero height)",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png?thumb=70x0",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError != nil {
+						t.Fatalf("Expected no thumb error, got %v", e.ThumbError)
+					}
+					return e.Next()
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testThumbZeroHeight)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "existing non image file - thumb parameter should be ignored",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt?thumb=100x100",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnFileDownloadRequest().BindFunc(func(e *core.FileDownloadRequestEvent) error {
+					if e.ThumbError == nil {
+						t.Fatal("Expected thumb error, got nil")
+					}
+					return e.Next()
+				})
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{string(testFile)},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+
+		// protected file access checks
+		{
+			Name:            "protected file - superuser with expired file token",
+			Method:          http.MethodGet,
+			URL:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.nqqtqpPhxU0045F4XP_ruAkzAidYBc5oPy9ErN3XBq0",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "protected file - superuser with valid file token",
+			Method:          http.MethodGet,
+			URL:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"PNG"},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "protected file - guest without view access",
+			Method:          http.MethodGet,
+			URL:             "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "protected file - guest with view access",
+			Method: http.MethodGet,
+			URL:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// mock public view access
+				c, err := app.FindCachedCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatalf("Failed to fetch mock collection: %v", err)
+				}
+				c.ViewRule = types.Pointer("")
+				if err := app.UnsafeWithoutHooks().Save(c); err != nil {
+					t.Fatalf("Failed to update mock collection: %v", err)
+				}
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"PNG"},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:   "protected file - auth record without view access",
+			Method: http.MethodGet,
+			URL:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// mock restricted user view access
+				c, err := app.FindCachedCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatalf("Failed to fetch mock collection: %v", err)
+				}
+				c.ViewRule = types.Pointer("@request.auth.verified = true")
+				if err := app.UnsafeWithoutHooks().Save(c); err != nil {
+					t.Fatalf("Failed to update mock collection: %v", err)
+				}
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "protected file - auth record with view access",
+			Method: http.MethodGet,
+			URL:    "/api/files/demo1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// mock user view access
+				c, err := app.FindCachedCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatalf("Failed to fetch mock collection: %v", err)
+				}
+				c.ViewRule = types.Pointer("@request.auth.verified = false")
+				if err := app.UnsafeWithoutHooks().Save(c); err != nil {
+					t.Fatalf("Failed to update mock collection: %v", err)
+				}
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"PNG"},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+		{
+			Name:            "protected file in view (view's View API rule failure)",
+			Method:          http.MethodGet,
+			URL:             "/api/files/view1/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "protected file in view (view's View API rule success)",
+			Method:          http.MethodGet,
+			URL:             "/api/files/view1/84nmscqy84lsi1t/test_d61b33QdDU.txt?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8ifQ.nSTLuCPcGpWn2K2l-BFkC3Vlzc-ZTDPByYq8dN1oPSo",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test"},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnFileDownloadRequest": 1,
+			},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:file",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:file"},
+					{MaxRequests: 0, Label: "users:file"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:file",
+			Method: http.MethodGet,
+			URL:    "/api/files/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:file"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		// clone for the HEAD test (the same as the original scenario but without body)
+		head := scenario
+		head.Method = http.MethodHead
+		head.Name = ("(HEAD) " + scenario.Name)
+		head.ExpectedContent = nil
+		head.Test(t)
+
+		// regular request test
+		scenario.Test(t)
+	}
+}
+
+func TestConcurrentThumbsGeneration(t *testing.T) {
+	t.Parallel()
+
+	app, err := tests.NewTestApp()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer app.Cleanup()
+
+	fsys, err := app.NewFilesystem()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	// create a dummy file field collection
+	demo1, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fileField := demo1.Fields.GetByName("file_one").(*core.FileField)
+	fileField.Protected = false
+	fileField.MaxSelect = 1
+	fileField.MaxSize = 999999
+	// new thumbs
+	fileField.Thumbs = []string{"111x111", "111x222", "111x333"}
+	demo1.Fields.Add(fileField)
+	if err = app.Save(demo1); err != nil {
+		t.Fatal(err)
+	}
+
+	fileKey := "wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png"
+
+	urls := []string{
+		"/api/files/" + fileKey + "?thumb=111x111",
+		"/api/files/" + fileKey + "?thumb=111x111", // should still result in single thumb
+		"/api/files/" + fileKey + "?thumb=111x222",
+		"/api/files/" + fileKey + "?thumb=111x333",
+	}
+
+	var wg sync.WaitGroup
+
+	wg.Add(len(urls))
+
+	for _, url := range urls {
+		go func() {
+			defer wg.Done()
+
+			recorder := httptest.NewRecorder()
+
+			req := httptest.NewRequest("GET", url, nil)
+
+			pbRouter, _ := apis.NewRouter(app)
+			mux, _ := pbRouter.BuildMux()
+			if mux != nil {
+				mux.ServeHTTP(recorder, req)
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	// ensure that all new requested thumbs were created
+	thumbKeys := []string{
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x111_" + filepath.Base(fileKey),
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x222_" + filepath.Base(fileKey),
+		"wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/111x333_" + filepath.Base(fileKey),
+	}
+	for _, k := range thumbKeys {
+		if exists, _ := fsys.Exists(k); !exists {
+			t.Fatalf("Missing thumb %q: %v", k, err)
+		}
+	}
+}
diff --git a/server/core_backend-server/apis/health.go b/server/core_backend-server/apis/health.go
new file mode 100644
index 0000000..5b13b42
--- /dev/null
+++ b/server/core_backend-server/apis/health.go
@@ -0,0 +1,53 @@
+package apis
+
+import (
+	"net/http"
+	"slices"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+// bindHealthApi registers the health api endpoint.
+func bindHealthApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	subGroup := rg.Group("/health")
+	subGroup.GET("", healthCheck)
+}
+
+// healthCheck returns a 200 OK response if the server is healthy.
+func healthCheck(e *core.RequestEvent) error {
+	resp := struct {
+		Message string         `json:"message"`
+		Code    int            `json:"code"`
+		Data    map[string]any `json:"data"`
+	}{
+		Code:    http.StatusOK,
+		Message: "API is healthy.",
+	}
+
+	if e.HasSuperuserAuth() {
+		resp.Data = make(map[string]any, 3)
+		resp.Data["canBackup"] = !e.App.Store().Has(core.StoreKeyActiveBackup)
+		resp.Data["realIP"] = e.RealIP()
+
+		// loosely check if behind a reverse proxy
+		// (usually used in the dashboard to remind superusers in case deployed behind reverse-proxy)
+		possibleProxyHeader := ""
+		headersToCheck := append(
+			slices.Clone(e.App.Settings().TrustedProxy.Headers),
+			// common proxy headers
+			"CF-Connecting-IP", "Fly-Client-IP", "X‑Forwarded-For",
+		)
+		for _, header := range headersToCheck {
+			if e.Request.Header.Get(header) != "" {
+				possibleProxyHeader = header
+				break
+			}
+		}
+		resp.Data["possibleProxyHeader"] = possibleProxyHeader
+	} else {
+		resp.Data = map[string]any{} // ensure that it is returned as object
+	}
+
+	return e.JSON(http.StatusOK, resp)
+}
diff --git a/server/core_backend-server/apis/health_test.go b/server/core_backend-server/apis/health_test.go
new file mode 100644
index 0000000..4f45c47
--- /dev/null
+++ b/server/core_backend-server/apis/health_test.go
@@ -0,0 +1,71 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestHealthAPI(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "GET health status (guest)",
+			Method:         http.MethodGet, // automatically matches also HEAD as a side-effect of the Go std mux
+			URL:            "/api/health",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"code":200`,
+				`"data":{}`,
+			},
+			NotExpectedContent: []string{
+				"canBackup",
+				"realIP",
+				"possibleProxyHeader",
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "GET health status (regular user)",
+			Method: http.MethodGet,
+			URL:    "/api/health",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"code":200`,
+				`"data":{}`,
+			},
+			NotExpectedContent: []string{
+				"canBackup",
+				"realIP",
+				"possibleProxyHeader",
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "GET health status (superuser)",
+			Method: http.MethodGet,
+			URL:    "/api/health",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"code":200`,
+				`"data":{`,
+				`"canBackup":true`,
+				`"realIP"`,
+				`"possibleProxyHeader"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/installer.go b/server/core_backend-server/apis/installer.go
new file mode 100644
index 0000000..7240580
--- /dev/null
+++ b/server/core_backend-server/apis/installer.go
@@ -0,0 +1,96 @@
+package apis
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+)
+
+// DefaultInstallerFunc is the default PocketBase installer function.
+//
+// It will attempt to open a link in the browser (with a short-lived auth
+// token for the systemSuperuser) to the installer UI so that users can
+// create their own custom superuser record.
+//
+// See https://github.com/pocketbase/pocketbase/discussions/5814.
+func DefaultInstallerFunc(app core.App, systemSuperuser *core.Record, baseURL string) error {
+	token, err := systemSuperuser.NewStaticAuthToken(30 * time.Minute)
+	if err != nil {
+		return err
+	}
+
+	// launch url (ignore errors and always print a help text as fallback)
+	url := fmt.Sprintf("%s/_/#/pbinstal/%s", strings.TrimRight(baseURL, "/"), token)
+	_ = osutils.LaunchURL(url)
+	color.Magenta("\n(!) Launch the URL below in the browser if it hasn't been open already to create your first superuser account:")
+	color.New(color.Bold).Add(color.FgCyan).Println(url)
+	color.New(color.FgHiBlack, color.Italic).Printf("(you can also create your first superuser by running: %s superuser upsert EMAIL PASS)\n\n", executablePath())
+
+	return nil
+}
+
+func loadInstaller(
+	app core.App,
+	baseURL string,
+	installerFunc func(app core.App, systemSuperuser *core.Record, baseURL string) error,
+) error {
+	if installerFunc == nil || !needInstallerSuperuser(app) {
+		return nil
+	}
+
+	superuser, err := findOrCreateInstallerSuperuser(app)
+	if err != nil {
+		return err
+	}
+
+	return installerFunc(app, superuser, baseURL)
+}
+
+func needInstallerSuperuser(app core.App) bool {
+	total, err := app.CountRecords(core.CollectionNameSuperusers, dbx.Not(dbx.HashExp{
+		"email": core.DefaultInstallerEmail,
+	}))
+
+	return err == nil && total == 0
+}
+
+func findOrCreateInstallerSuperuser(app core.App) (*core.Record, error) {
+	col, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		return nil, err
+	}
+
+	record, err := app.FindAuthRecordByEmail(col, core.DefaultInstallerEmail)
+	if err != nil {
+		if !errors.Is(err, sql.ErrNoRows) {
+			return nil, err
+		}
+
+		record = core.NewRecord(col)
+		record.SetEmail(core.DefaultInstallerEmail)
+		record.SetRandomPassword()
+
+		err = app.Save(record)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return record, nil
+}
+
+func executablePath() string {
+	if osutils.IsProbablyGoRun() {
+		return "go run ."
+	}
+
+	return os.Args[0]
+}
diff --git a/server/core_backend-server/apis/logs.go b/server/core_backend-server/apis/logs.go
new file mode 100644
index 0000000..9f92492
--- /dev/null
+++ b/server/core_backend-server/apis/logs.go
@@ -0,0 +1,73 @@
+package apis
+
+import (
+	"net/http"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+// bindLogsApi registers the request logs api endpoints.
+func bindLogsApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	sub := rg.Group("/logs").Bind(RequireSuperuserAuth(), SkipSuccessActivityLog())
+	sub.GET("", logsList)
+	sub.GET("/stats", logsStats)
+	sub.GET("/{id}", logsView)
+}
+
+var logFilterFields = []string{
+	"id", "created", "level", "message", "data",
+	`^data\.[\w\.\:]*\w+$`,
+}
+
+func logsList(e *core.RequestEvent) error {
+	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
+
+	result, err := search.NewProvider(fieldResolver).
+		Query(e.App.AuxModelQuery(&core.Log{})).
+		ParseAndExec(e.Request.URL.Query().Encode(), &[]*core.Log{})
+
+	if err != nil {
+		return e.BadRequestError("", err)
+	}
+
+	return e.JSON(http.StatusOK, result)
+}
+
+func logsStats(e *core.RequestEvent) error {
+	fieldResolver := search.NewSimpleFieldResolver(logFilterFields...)
+
+	filter := e.Request.URL.Query().Get(search.FilterQueryParam)
+
+	var expr dbx.Expression
+	if filter != "" {
+		var err error
+		expr, err = search.FilterData(filter).BuildExpr(fieldResolver)
+		if err != nil {
+			return e.BadRequestError("Invalid filter format.", err)
+		}
+	}
+
+	stats, err := e.App.LogsStats(expr)
+	if err != nil {
+		return e.BadRequestError("Failed to generate logs stats.", err)
+	}
+
+	return e.JSON(http.StatusOK, stats)
+}
+
+func logsView(e *core.RequestEvent) error {
+	id := e.Request.PathValue("id")
+	if id == "" {
+		return e.NotFoundError("", nil)
+	}
+
+	log, err := e.App.FindLogById(id)
+	if err != nil || log == nil {
+		return e.NotFoundError("", err)
+	}
+
+	return e.JSON(http.StatusOK, log)
+}
diff --git a/server/core_backend-server/apis/logs_test.go b/server/core_backend-server/apis/logs_test.go
new file mode 100644
index 0000000..ca3e33f
--- /dev/null
+++ b/server/core_backend-server/apis/logs_test.go
@@ -0,0 +1,212 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestLogsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/logs",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/logs",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/logs",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubLogsData(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":2`,
+				`"items":[{`,
+				`"id":"873f2133-9f38-44fb-bf82-c8f53b310d91"`,
+				`"id":"f2133873-44fb-9f38-bf82-c918f53b310d"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser + filter",
+			Method: http.MethodGet,
+			URL:    "/api/logs?filter=data.status>200",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubLogsData(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":1`,
+				`"items":[{`,
+				`"id":"f2133873-44fb-9f38-bf82-c918f53b310d"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestLogView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (nonexisting request log)",
+			Method: http.MethodGet,
+			URL:    "/api/logs/missing1-9f38-44fb-bf82-c8f53b310d91",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubLogsData(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (existing request log)",
+			Method: http.MethodGet,
+			URL:    "/api/logs/873f2133-9f38-44fb-bf82-c8f53b310d91",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubLogsData(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"873f2133-9f38-44fb-bf82-c8f53b310d91"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestLogsStats(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/logs/stats",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/logs/stats",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/logs/stats",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubLogsData(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`[{"date":"2022-05-01 10:00:00.000Z","total":1},{"date":"2022-05-02 10:00:00.000Z","total":1}]`,
+			},
+		},
+		{
+			Name:   "authorized as superuser + filter",
+			Method: http.MethodGet,
+			URL:    "/api/logs/stats?filter=data.status>200",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubLogsData(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`[{"date":"2022-05-02 10:00:00.000Z","total":1}]`,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/middlewares.go b/server/core_backend-server/apis/middlewares.go
new file mode 100644
index 0000000..6f4424d
--- /dev/null
+++ b/server/core_backend-server/apis/middlewares.go
@@ -0,0 +1,444 @@
+package apis
+
+import (
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"runtime"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/spf13/cast"
+)
+
+// Common request event store keys used by the middlewares and api handlers.
+const (
+	RequestEventKeyLogMeta = "pbLogMeta" // extra data to store with the request activity log
+
+	requestEventKeyExecStart              = "__execStart"                 // the value must be time.Time
+	requestEventKeySkipSuccessActivityLog = "__skipSuccessActivityLogger" // the value must be bool
+)
+
+const (
+	DefaultWWWRedirectMiddlewarePriority = -99999
+	DefaultWWWRedirectMiddlewareId       = "pbWWWRedirect"
+
+	DefaultActivityLoggerMiddlewarePriority   = DefaultRateLimitMiddlewarePriority - 40
+	DefaultActivityLoggerMiddlewareId         = "pbActivityLogger"
+	DefaultSkipSuccessActivityLogMiddlewareId = "pbSkipSuccessActivityLog"
+	DefaultEnableAuthIdActivityLog            = "pbEnableAuthIdActivityLog"
+
+	DefaultPanicRecoverMiddlewarePriority = DefaultRateLimitMiddlewarePriority - 30
+	DefaultPanicRecoverMiddlewareId       = "pbPanicRecover"
+
+	DefaultLoadAuthTokenMiddlewarePriority = DefaultRateLimitMiddlewarePriority - 20
+	DefaultLoadAuthTokenMiddlewareId       = "pbLoadAuthToken"
+
+	DefaultSecurityHeadersMiddlewarePriority = DefaultRateLimitMiddlewarePriority - 10
+	DefaultSecurityHeadersMiddlewareId       = "pbSecurityHeaders"
+
+	DefaultRequireGuestOnlyMiddlewareId                 = "pbRequireGuestOnly"
+	DefaultRequireAuthMiddlewareId                      = "pbRequireAuth"
+	DefaultRequireSuperuserAuthMiddlewareId             = "pbRequireSuperuserAuth"
+	DefaultRequireSuperuserOrOwnerAuthMiddlewareId      = "pbRequireSuperuserOrOwnerAuth"
+	DefaultRequireSameCollectionContextAuthMiddlewareId = "pbRequireSameCollectionContextAuth"
+)
+
+// RequireGuestOnly middleware requires a request to NOT have a valid
+// Authorization header.
+//
+// This middleware is the opposite of [apis.RequireAuth()].
+func RequireGuestOnly() *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id: DefaultRequireGuestOnlyMiddlewareId,
+		Func: func(e *core.RequestEvent) error {
+			if e.Auth != nil {
+				return router.NewBadRequestError("The request can be accessed only by guests.", nil)
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+// RequireAuth middleware requires a request to have a valid record Authorization header.
+//
+// The auth record could be from any collection.
+// You can further filter the allowed record auth collections by specifying their names.
+//
+// Example:
+//
+//	apis.RequireAuth()                      // any auth collection
+//	apis.RequireAuth("_superusers", "users") // only the listed auth collections
+func RequireAuth(optCollectionNames ...string) *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:   DefaultRequireAuthMiddlewareId,
+		Func: requireAuth(optCollectionNames...),
+	}
+}
+
+func requireAuth(optCollectionNames ...string) func(*core.RequestEvent) error {
+	return func(e *core.RequestEvent) error {
+		if e.Auth == nil {
+			return e.UnauthorizedError("The request requires valid record authorization token.", nil)
+		}
+
+		// check record collection name
+		if len(optCollectionNames) > 0 && !slices.Contains(optCollectionNames, e.Auth.Collection().Name) {
+			return e.ForbiddenError("The authorized record is not allowed to perform this action.", nil)
+		}
+
+		return e.Next()
+	}
+}
+
+// RequireSuperuserAuth middleware requires a request to have
+// a valid superuser Authorization header.
+func RequireSuperuserAuth() *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:   DefaultRequireSuperuserAuthMiddlewareId,
+		Func: requireAuth(core.CollectionNameSuperusers),
+	}
+}
+
+// RequireSuperuserOrOwnerAuth middleware requires a request to have
+// a valid superuser or regular record owner Authorization header set.
+//
+// This middleware is similar to [apis.RequireAuth()] but
+// for the auth record token expects to have the same id as the path
+// parameter ownerIdPathParam (default to "id" if empty).
+func RequireSuperuserOrOwnerAuth(ownerIdPathParam string) *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id: DefaultRequireSuperuserOrOwnerAuthMiddlewareId,
+		Func: func(e *core.RequestEvent) error {
+			if e.Auth == nil {
+				return e.UnauthorizedError("The request requires superuser or record authorization token.", nil)
+			}
+
+			if e.Auth.IsSuperuser() {
+				return e.Next()
+			}
+
+			if ownerIdPathParam == "" {
+				ownerIdPathParam = "id"
+			}
+			ownerId := e.Request.PathValue(ownerIdPathParam)
+
+			// note: it is considered "safe" to compare only the record id
+			// since the auth record ids are treated as unique across all auth collections
+			if e.Auth.Id != ownerId {
+				return e.ForbiddenError("You are not allowed to perform this request.", nil)
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+// RequireSameCollectionContextAuth middleware requires a request to have
+// a valid record Authorization header and the auth record's collection to
+// match the one from the route path parameter (default to "collection" if collectionParam is empty).
+func RequireSameCollectionContextAuth(collectionPathParam string) *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id: DefaultRequireSameCollectionContextAuthMiddlewareId,
+		Func: func(e *core.RequestEvent) error {
+			if e.Auth == nil {
+				return e.UnauthorizedError("The request requires valid record authorization token.", nil)
+			}
+
+			if collectionPathParam == "" {
+				collectionPathParam = "collection"
+			}
+
+			collection, _ := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue(collectionPathParam))
+			if collection == nil || e.Auth.Collection().Id != collection.Id {
+				return e.ForbiddenError(fmt.Sprintf("The request requires auth record from %s collection.", e.Auth.Collection().Name), nil)
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+// loadAuthToken attempts to load the auth context based on the "Authorization: TOKEN" header value.
+//
+// This middleware does nothing in case of:
+//   - missing, invalid or expired token
+//   - e.Auth is already loaded by another middleware
+//
+// This middleware is registered by default for all routes.
+//
+// Note: We don't throw an error on invalid or expired token to allow
+// users to extend with their own custom handling in external middleware(s).
+func loadAuthToken() *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultLoadAuthTokenMiddlewareId,
+		Priority: DefaultLoadAuthTokenMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			// already loaded by another middleware
+			if e.Auth != nil {
+				return e.Next()
+			}
+
+			token := getAuthTokenFromRequest(e)
+			if token == "" {
+				return e.Next()
+			}
+
+			record, err := e.App.FindAuthRecordByToken(token, core.TokenTypeAuth)
+			if err != nil {
+				e.App.Logger().Debug("loadAuthToken failure", "error", err)
+			} else if record != nil {
+				e.Auth = record
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+func getAuthTokenFromRequest(e *core.RequestEvent) string {
+	token := e.Request.Header.Get("Authorization")
+	if token != "" {
+		// the schema prefix is not required and it is only for
+		// compatibility with the defaults of some HTTP clients
+		token = strings.TrimPrefix(token, "Bearer ")
+	}
+	return token
+}
+
+// wwwRedirect performs www->non-www redirect(s) if the request host
+// matches with one of the values in redirectHosts.
+//
+// This middleware is registered by default on Serve for all routes.
+func wwwRedirect(redirectHosts []string) *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultWWWRedirectMiddlewareId,
+		Priority: DefaultWWWRedirectMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			host := e.Request.Host
+
+			if strings.HasPrefix(host, "www.") && list.ExistInSlice(host, redirectHosts) {
+				// note: e.Request.URL.Scheme would be empty
+				schema := "http://"
+				if e.IsTLS() {
+					schema = "https://"
+				}
+
+				return e.Redirect(
+					http.StatusTemporaryRedirect,
+					(schema + host[4:] + e.Request.RequestURI),
+				)
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+// panicRecover returns a default panic-recover handler.
+func panicRecover() *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultPanicRecoverMiddlewareId,
+		Priority: DefaultPanicRecoverMiddlewarePriority,
+		Func: func(e *core.RequestEvent) (err error) {
+			// panic-recover
+			defer func() {
+				recoverResult := recover()
+				if recoverResult == nil {
+					return
+				}
+
+				recoverErr, ok := recoverResult.(error)
+				if !ok {
+					recoverErr = fmt.Errorf("%v", recoverResult)
+				} else if errors.Is(recoverErr, http.ErrAbortHandler) {
+					// don't recover ErrAbortHandler so the response to the client can be aborted
+					panic(recoverResult)
+				}
+
+				stack := make([]byte, 2<<10) // 2 KB
+				length := runtime.Stack(stack, true)
+				err = e.InternalServerError("", fmt.Errorf("[PANIC RECOVER] %w %s", recoverErr, stack[:length]))
+			}()
+
+			err = e.Next()
+
+			return err
+		},
+	}
+}
+
+// securityHeaders middleware adds common security headers to the response.
+//
+// This middleware is registered by default for all routes.
+func securityHeaders() *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultSecurityHeadersMiddlewareId,
+		Priority: DefaultSecurityHeadersMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			e.Response.Header().Set("X-XSS-Protection", "1; mode=block")
+			e.Response.Header().Set("X-Content-Type-Options", "nosniff")
+			e.Response.Header().Set("X-Frame-Options", "SAMEORIGIN")
+
+			// @todo consider a default HSTS?
+			// (see also https://webkit.org/blog/8146/protecting-against-hsts-abuse/)
+
+			return e.Next()
+		},
+	}
+}
+
+// SkipSuccessActivityLog is a helper middleware that instructs the global
+// activity logger to log only requests that have failed/returned an error.
+func SkipSuccessActivityLog() *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id: DefaultSkipSuccessActivityLogMiddlewareId,
+		Func: func(e *core.RequestEvent) error {
+			e.Set(requestEventKeySkipSuccessActivityLog, true)
+			return e.Next()
+		},
+	}
+}
+
+// activityLogger middleware takes care to save the request information
+// into the logs database.
+//
+// This middleware is registered by default for all routes.
+//
+// The middleware does nothing if the app logs retention period is zero
+// (aka. app.Settings().Logs.MaxDays = 0).
+//
+// Users can attach the [apis.SkipSuccessActivityLog()] middleware if
+// you want to log only the failed requests.
+func activityLogger() *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultActivityLoggerMiddlewareId,
+		Priority: DefaultActivityLoggerMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			e.Set(requestEventKeyExecStart, time.Now())
+
+			err := e.Next()
+
+			logRequest(e, err)
+
+			return err
+		},
+	}
+}
+
+func logRequest(event *core.RequestEvent, err error) {
+	// no logs retention
+	if event.App.Settings().Logs.MaxDays == 0 {
+		return
+	}
+
+	// the non-error route has explicitly disabled the activity logger
+	if err == nil && event.Get(requestEventKeySkipSuccessActivityLog) != nil {
+		return
+	}
+
+	attrs := make([]any, 0, 15)
+
+	attrs = append(attrs, slog.String("type", "request"))
+
+	started := cast.ToTime(event.Get(requestEventKeyExecStart))
+	if !started.IsZero() {
+		attrs = append(attrs, slog.Float64("execTime", float64(time.Since(started))/float64(time.Millisecond)))
+	}
+
+	if meta := event.Get(RequestEventKeyLogMeta); meta != nil {
+		attrs = append(attrs, slog.Any("meta", meta))
+	}
+
+	status := event.Status()
+	method := cutStr(strings.ToUpper(event.Request.Method), 50)
+	requestUri := cutStr(event.Request.URL.RequestURI(), 3000)
+
+	// parse the request error
+	if err != nil {
+		apiErr, isPlainApiError := err.(*router.ApiError)
+		if isPlainApiError || errors.As(err, &apiErr) {
+			// the status header wasn't written yet
+			if status == 0 {
+				status = apiErr.Status
+			}
+
+			var errMsg string
+			if isPlainApiError {
+				errMsg = apiErr.Message
+			} else {
+				// wrapped ApiError -> add the full serialized version
+				// of the original error since it could contain more information
+				errMsg = err.Error()
+			}
+
+			attrs = append(
+				attrs,
+				slog.String("error", errMsg),
+				slog.Any("details", apiErr.RawData()),
+			)
+		} else {
+			attrs = append(attrs, slog.String("error", err.Error()))
+		}
+	}
+
+	attrs = append(
+		attrs,
+		slog.String("url", requestUri),
+		slog.String("method", method),
+		slog.Int("status", status),
+		slog.String("referer", cutStr(event.Request.Referer(), 2000)),
+		slog.String("userAgent", cutStr(event.Request.UserAgent(), 2000)),
+	)
+
+	if event.Auth != nil {
+		attrs = append(attrs, slog.String("auth", event.Auth.Collection().Name))
+
+		if event.App.Settings().Logs.LogAuthId {
+			attrs = append(attrs, slog.String("authId", event.Auth.Id))
+		}
+	} else {
+		attrs = append(attrs, slog.String("auth", ""))
+	}
+
+	if event.App.Settings().Logs.LogIP {
+		attrs = append(
+			attrs,
+			slog.String("userIP", event.RealIP()),
+			slog.String("remoteIP", event.RemoteIP()),
+		)
+	}
+
+	// don't block on logs write
+	routine.FireAndForget(func() {
+		message := method + " "
+
+		if escaped, unescapeErr := url.PathUnescape(requestUri); unescapeErr == nil {
+			message += escaped
+		} else {
+			message += requestUri
+		}
+
+		if err != nil {
+			event.App.Logger().Error(message, attrs...)
+		} else {
+			event.App.Logger().Info(message, attrs...)
+		}
+	})
+}
+
+func cutStr(str string, max int) string {
+	if len(str) > max {
+		return str[:max] + "..."
+	}
+	return str
+}
diff --git a/server/core_backend-server/apis/middlewares_body_limit.go b/server/core_backend-server/apis/middlewares_body_limit.go
new file mode 100644
index 0000000..3661a2e
--- /dev/null
+++ b/server/core_backend-server/apis/middlewares_body_limit.go
@@ -0,0 +1,120 @@
+package apis
+
+import (
+	"io"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+var ErrRequestEntityTooLarge = router.NewApiError(http.StatusRequestEntityTooLarge, "Request entity too large", nil)
+
+const DefaultMaxBodySize int64 = 32 << 20
+
+const (
+	DefaultBodyLimitMiddlewareId       = "pbBodyLimit"
+	DefaultBodyLimitMiddlewarePriority = DefaultRateLimitMiddlewarePriority + 10
+)
+
+// BodyLimit returns a middleware handler that changes the default request body size limit.
+//
+// If limitBytes <= 0, no limit is applied.
+//
+// Otherwise, if the request body size exceeds the configured limitBytes,
+// it sends 413 error response.
+func BodyLimit(limitBytes int64) *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultBodyLimitMiddlewareId,
+		Priority: DefaultBodyLimitMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			err := applyBodyLimit(e, limitBytes)
+			if err != nil {
+				return err
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+func dynamicCollectionBodyLimit(collectionPathParam string) *hook.Handler[*core.RequestEvent] {
+	if collectionPathParam == "" {
+		collectionPathParam = "collection"
+	}
+
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultBodyLimitMiddlewareId,
+		Priority: DefaultBodyLimitMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue(collectionPathParam))
+			if err != nil {
+				return e.NotFoundError("Missing or invalid collection context.", err)
+			}
+
+			limitBytes := DefaultMaxBodySize
+			if !collection.IsView() {
+				for _, f := range collection.Fields {
+					if calc, ok := f.(core.MaxBodySizeCalculator); ok {
+						limitBytes += calc.CalculateMaxBodySize()
+					}
+				}
+			}
+
+			err = applyBodyLimit(e, limitBytes)
+			if err != nil {
+				return err
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+func applyBodyLimit(e *core.RequestEvent, limitBytes int64) error {
+	// no limit
+	if limitBytes <= 0 {
+		return nil
+	}
+
+	// optimistically check the submitted request content length
+	if e.Request.ContentLength > limitBytes {
+		return ErrRequestEntityTooLarge
+	}
+
+	// replace the request body
+	//
+	// note: we don't use sync.Pool since the size of the elements could vary too much
+	// and it might not be efficient (see https://github.com/golang/go/issues/23199)
+	e.Request.Body = &limitedReader{ReadCloser: e.Request.Body, limit: limitBytes}
+
+	return nil
+}
+
+type limitedReader struct {
+	io.ReadCloser
+	limit     int64
+	totalRead int64
+}
+
+func (r *limitedReader) Read(b []byte) (int, error) {
+	n, err := r.ReadCloser.Read(b)
+	if err != nil {
+		return n, err
+	}
+
+	r.totalRead += int64(n)
+	if r.totalRead > r.limit {
+		return n, ErrRequestEntityTooLarge
+	}
+
+	return n, nil
+}
+
+func (r *limitedReader) Reread() {
+	rr, ok := r.ReadCloser.(router.Rereader)
+	if ok {
+		rr.Reread()
+	}
+}
diff --git a/server/core_backend-server/apis/middlewares_body_limit_test.go b/server/core_backend-server/apis/middlewares_body_limit_test.go
new file mode 100644
index 0000000..8e04e72
--- /dev/null
+++ b/server/core_backend-server/apis/middlewares_body_limit_test.go
@@ -0,0 +1,60 @@
+package apis_test
+
+import (
+	"bytes"
+	"fmt"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestBodyLimitMiddleware(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	pbRouter, err := apis.NewRouter(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pbRouter.POST("/a", func(e *core.RequestEvent) error {
+		return e.String(200, "a")
+	}) // default global BodyLimit check
+
+	pbRouter.POST("/b", func(e *core.RequestEvent) error {
+		return e.String(200, "b")
+	}).Bind(apis.BodyLimit(20))
+
+	mux, err := pbRouter.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		url            string
+		size           int64
+		expectedStatus int
+	}{
+		{"/a", 21, 200},
+		{"/a", apis.DefaultMaxBodySize + 1, 413},
+		{"/b", 20, 200},
+		{"/b", 21, 413},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("%s_%d", s.url, s.size), func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", s.url, bytes.NewReader(make([]byte, s.size)))
+			mux.ServeHTTP(rec, req)
+
+			result := rec.Result()
+			defer result.Body.Close()
+
+			if result.StatusCode != s.expectedStatus {
+				t.Fatalf("Expected response status %d, got %d", s.expectedStatus, result.StatusCode)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/apis/middlewares_cors.go b/server/core_backend-server/apis/middlewares_cors.go
new file mode 100644
index 0000000..204586d
--- /dev/null
+++ b/server/core_backend-server/apis/middlewares_cors.go
@@ -0,0 +1,327 @@
+package apis
+
+// -------------------------------------------------------------------
+// This middleware is ported from echo/middleware to minimize the breaking
+// changes and differences in the API behavior from earlier PocketBase versions
+// (https://github.com/labstack/echo/blob/ec5b858dab6105ab4c3ed2627d1ebdfb6ae1ecb8/middleware/cors.go).
+//
+// I doubt that this would matter for most cases, but the only major difference
+// is that for non-supported routes this middleware doesn't return 405 and fallbacks
+// to the default catch-all PocketBase route (aka. returns 404) to avoid
+// the extra overhead of further hijacking and wrapping the Go default mux
+// (https://github.com/golang/go/issues/65648#issuecomment-1955328807).
+// -------------------------------------------------------------------
+
+import (
+	"log"
+	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+const (
+	DefaultCorsMiddlewareId       = "pbCors"
+	DefaultCorsMiddlewarePriority = DefaultActivityLoggerMiddlewarePriority - 1 // before the activity logger and rate limit so that OPTIONS preflight requests are not counted
+)
+
+// CORSConfig defines the config for CORS middleware.
+type CORSConfig struct {
+	// AllowOrigins determines the value of the Access-Control-Allow-Origin
+	// response header.  This header defines a list of origins that may access the
+	// resource.  The wildcard characters '*' and '?' are supported and are
+	// converted to regex fragments '.*' and '.' accordingly.
+	//
+	// Security: use extreme caution when handling the origin, and carefully
+	// validate any logic. Remember that attackers may register hostile domain names.
+	// See https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+	//
+	// Optional. Default value []string{"*"}.
+	//
+	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+	AllowOrigins []string
+
+	// AllowOriginFunc is a custom function to validate the origin. It takes the
+	// origin as an argument and returns true if allowed or false otherwise. If
+	// an error is returned, it is returned by the handler. If this option is
+	// set, AllowOrigins is ignored.
+	//
+	// Security: use extreme caution when handling the origin, and carefully
+	// validate any logic. Remember that attackers may register hostile domain names.
+	// See https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+	//
+	// Optional.
+	AllowOriginFunc func(origin string) (bool, error)
+
+	// AllowMethods determines the value of the Access-Control-Allow-Methods
+	// response header.  This header specified the list of methods allowed when
+	// accessing the resource.  This is used in response to a preflight request.
+	//
+	// Optional. Default value DefaultCORSConfig.AllowMethods.
+	//
+	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+	AllowMethods []string
+
+	// AllowHeaders determines the value of the Access-Control-Allow-Headers
+	// response header.  This header is used in response to a preflight request to
+	// indicate which HTTP headers can be used when making the actual request.
+	//
+	// Optional. Default value []string{}.
+	//
+	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
+	AllowHeaders []string
+
+	// AllowCredentials determines the value of the
+	// Access-Control-Allow-Credentials response header.  This header indicates
+	// whether or not the response to the request can be exposed when the
+	// credentials mode (Request.credentials) is true. When used as part of a
+	// response to a preflight request, this indicates whether or not the actual
+	// request can be made using credentials.  See also
+	// [MDN: Access-Control-Allow-Credentials].
+	//
+	// Optional. Default value false, in which case the header is not set.
+	//
+	// Security: avoid using `AllowCredentials = true` with `AllowOrigins = *`.
+	// See "Exploiting CORS misconfigurations for Bitcoins and bounties",
+	// https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+	//
+	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
+	AllowCredentials bool
+
+	// UnsafeWildcardOriginWithAllowCredentials UNSAFE/INSECURE: allows wildcard '*' origin to be used with AllowCredentials
+	// flag. In that case we consider any origin allowed and send it back to the client with `Access-Control-Allow-Origin` header.
+	//
+	// This is INSECURE and potentially leads to [cross-origin](https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
+	// attacks. See: https://github.com/labstack/echo/issues/2400 for discussion on the subject.
+	//
+	// Optional. Default value is false.
+	UnsafeWildcardOriginWithAllowCredentials bool
+
+	// ExposeHeaders determines the value of Access-Control-Expose-Headers, which
+	// defines a list of headers that clients are allowed to access.
+	//
+	// Optional. Default value []string{}, in which case the header is not set.
+	//
+	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Header
+	ExposeHeaders []string
+
+	// MaxAge determines the value of the Access-Control-Max-Age response header.
+	// This header indicates how long (in seconds) the results of a preflight
+	// request can be cached.
+	// The header is set only if MaxAge != 0, negative value sends "0" which instructs browsers not to cache that response.
+	//
+	// Optional. Default value 0 - meaning header is not sent.
+	//
+	// See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+	MaxAge int
+}
+
+// DefaultCORSConfig is the default CORS middleware config.
+var DefaultCORSConfig = CORSConfig{
+	AllowOrigins: []string{"*"},
+	AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
+}
+
+// CORS returns a CORS middleware.
+func CORS(config CORSConfig) *hook.Handler[*core.RequestEvent] {
+	// Defaults
+	if len(config.AllowOrigins) == 0 {
+		config.AllowOrigins = DefaultCORSConfig.AllowOrigins
+	}
+	if len(config.AllowMethods) == 0 {
+		config.AllowMethods = DefaultCORSConfig.AllowMethods
+	}
+
+	allowOriginPatterns := make([]*regexp.Regexp, 0, len(config.AllowOrigins))
+	for _, origin := range config.AllowOrigins {
+		if origin == "*" {
+			continue // "*" is handled differently and does not need regexp
+		}
+
+		pattern := regexp.QuoteMeta(origin)
+		pattern = strings.ReplaceAll(pattern, "\\*", ".*")
+		pattern = strings.ReplaceAll(pattern, "\\?", ".")
+		pattern = "^" + pattern + "$"
+
+		re, err := regexp.Compile(pattern)
+		if err != nil {
+			// This is to preserve previous behaviour - invalid patterns were just ignored.
+			// If we would turn this to panic, users with invalid patterns
+			// would have applications crashing in production due unrecovered panic.
+			log.Println("invalid AllowOrigins pattern", origin)
+			continue
+		}
+		allowOriginPatterns = append(allowOriginPatterns, re)
+	}
+
+	allowMethods := strings.Join(config.AllowMethods, ",")
+	allowHeaders := strings.Join(config.AllowHeaders, ",")
+	exposeHeaders := strings.Join(config.ExposeHeaders, ",")
+
+	maxAge := "0"
+	if config.MaxAge > 0 {
+		maxAge = strconv.Itoa(config.MaxAge)
+	}
+
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultCorsMiddlewareId,
+		Priority: DefaultCorsMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			req := e.Request
+			res := e.Response
+			origin := req.Header.Get("Origin")
+			allowOrigin := ""
+
+			res.Header().Add("Vary", "Origin")
+
+			// Preflight request is an OPTIONS request, using three HTTP request headers: Access-Control-Request-Method,
+			// Access-Control-Request-Headers, and the Origin header. See: https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
+			// For simplicity we just consider method type and later `Origin` header.
+			preflight := req.Method == http.MethodOptions
+
+			// No Origin provided. This is (probably) not request from actual browser - proceed executing middleware chain
+			if origin == "" {
+				if !preflight {
+					return e.Next()
+				}
+				return e.NoContent(http.StatusNoContent)
+			}
+
+			if config.AllowOriginFunc != nil {
+				allowed, err := config.AllowOriginFunc(origin)
+				if err != nil {
+					return err
+				}
+				if allowed {
+					allowOrigin = origin
+				}
+			} else {
+				// Check allowed origins
+				for _, o := range config.AllowOrigins {
+					if o == "*" && config.AllowCredentials && config.UnsafeWildcardOriginWithAllowCredentials {
+						allowOrigin = origin
+						break
+					}
+					if o == "*" || o == origin {
+						allowOrigin = o
+						break
+					}
+					if matchSubdomain(origin, o) {
+						allowOrigin = origin
+						break
+					}
+				}
+
+				checkPatterns := false
+				if allowOrigin == "" {
+					// to avoid regex cost by invalid (long) domains (253 is domain name max limit)
+					if len(origin) <= (253+3+5) && strings.Contains(origin, "://") {
+						checkPatterns = true
+					}
+				}
+				if checkPatterns {
+					for _, re := range allowOriginPatterns {
+						if match := re.MatchString(origin); match {
+							allowOrigin = origin
+							break
+						}
+					}
+				}
+			}
+
+			// Origin not allowed
+			if allowOrigin == "" {
+				if !preflight {
+					return e.Next()
+				}
+				return e.NoContent(http.StatusNoContent)
+			}
+
+			res.Header().Set("Access-Control-Allow-Origin", allowOrigin)
+			if config.AllowCredentials {
+				res.Header().Set("Access-Control-Allow-Credentials", "true")
+			}
+
+			// Simple request
+			if !preflight {
+				if exposeHeaders != "" {
+					res.Header().Set("Access-Control-Expose-Headers", exposeHeaders)
+				}
+				return e.Next()
+			}
+
+			// Preflight request
+			res.Header().Add("Vary", "Access-Control-Request-Method")
+			res.Header().Add("Vary", "Access-Control-Request-Headers")
+			res.Header().Set("Access-Control-Allow-Methods", allowMethods)
+
+			if allowHeaders != "" {
+				res.Header().Set("Access-Control-Allow-Headers", allowHeaders)
+			} else {
+				h := req.Header.Get("Access-Control-Request-Headers")
+				if h != "" {
+					res.Header().Set("Access-Control-Allow-Headers", h)
+				}
+			}
+			if config.MaxAge != 0 {
+				res.Header().Set("Access-Control-Max-Age", maxAge)
+			}
+
+			return e.NoContent(http.StatusNoContent)
+		},
+	}
+}
+
+func matchScheme(domain, pattern string) bool {
+	didx := strings.Index(domain, ":")
+	pidx := strings.Index(pattern, ":")
+	return didx != -1 && pidx != -1 && domain[:didx] == pattern[:pidx]
+}
+
+// matchSubdomain compares authority with wildcard
+func matchSubdomain(domain, pattern string) bool {
+	if !matchScheme(domain, pattern) {
+		return false
+	}
+
+	didx := strings.Index(domain, "://")
+	pidx := strings.Index(pattern, "://")
+	if didx == -1 || pidx == -1 {
+		return false
+	}
+	domAuth := domain[didx+3:]
+	// to avoid long loop by invalid long domain
+	if len(domAuth) > 253 {
+		return false
+	}
+	patAuth := pattern[pidx+3:]
+
+	domComp := strings.Split(domAuth, ".")
+	patComp := strings.Split(patAuth, ".")
+	for i := len(domComp)/2 - 1; i >= 0; i-- {
+		opp := len(domComp) - 1 - i
+		domComp[i], domComp[opp] = domComp[opp], domComp[i]
+	}
+	for i := len(patComp)/2 - 1; i >= 0; i-- {
+		opp := len(patComp) - 1 - i
+		patComp[i], patComp[opp] = patComp[opp], patComp[i]
+	}
+
+	for i, v := range domComp {
+		if len(patComp) <= i {
+			return false
+		}
+		p := patComp[i]
+		if p == "*" {
+			return true
+		}
+		if p != v {
+			return false
+		}
+	}
+
+	return false
+}
diff --git a/server/core_backend-server/apis/middlewares_gzip.go b/server/core_backend-server/apis/middlewares_gzip.go
new file mode 100644
index 0000000..91faf1a
--- /dev/null
+++ b/server/core_backend-server/apis/middlewares_gzip.go
@@ -0,0 +1,247 @@
+package apis
+
+// -------------------------------------------------------------------
+// This middleware is ported from echo/middleware to minimize the breaking
+// changes and differences in the API behavior from earlier PocketBase versions
+// (https://github.com/labstack/echo/blob/ec5b858dab6105ab4c3ed2627d1ebdfb6ae1ecb8/middleware/compress.go).
+// -------------------------------------------------------------------
+
+import (
+	"bufio"
+	"bytes"
+	"compress/gzip"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+const (
+	gzipScheme = "gzip"
+)
+
+const (
+	DefaultGzipMiddlewareId = "pbGzip"
+)
+
+// GzipConfig defines the config for Gzip middleware.
+type GzipConfig struct {
+	// Gzip compression level.
+	// Optional. Default value -1.
+	Level int
+
+	// Length threshold before gzip compression is applied.
+	// Optional. Default value 0.
+	//
+	// Most of the time you will not need to change the default. Compressing
+	// a short response might increase the transmitted data because of the
+	// gzip format overhead. Compressing the response will also consume CPU
+	// and time on the server and the client (for decompressing). Depending on
+	// your use case such a threshold might be useful.
+	//
+	// See also:
+	// https://webmasters.stackexchange.com/questions/31750/what-is-recommended-minimum-object-size-for-gzip-performance-benefits
+	MinLength int
+}
+
+// Gzip returns a middleware which compresses HTTP response using Gzip compression scheme.
+func Gzip() *hook.Handler[*core.RequestEvent] {
+	return GzipWithConfig(GzipConfig{})
+}
+
+// GzipWithConfig returns a middleware which compresses HTTP response using gzip compression scheme.
+func GzipWithConfig(config GzipConfig) *hook.Handler[*core.RequestEvent] {
+	if config.Level < -2 || config.Level > 9 { // these are consts: gzip.HuffmanOnly and gzip.BestCompression
+		panic(errors.New("invalid gzip level"))
+	}
+	if config.Level == 0 {
+		config.Level = -1
+	}
+	if config.MinLength < 0 {
+		config.MinLength = 0
+	}
+
+	pool := sync.Pool{
+		New: func() interface{} {
+			w, err := gzip.NewWriterLevel(io.Discard, config.Level)
+			if err != nil {
+				return err
+			}
+			return w
+		},
+	}
+
+	bpool := sync.Pool{
+		New: func() interface{} {
+			b := &bytes.Buffer{}
+			return b
+		},
+	}
+
+	return &hook.Handler[*core.RequestEvent]{
+		Id: DefaultGzipMiddlewareId,
+		Func: func(e *core.RequestEvent) error {
+			e.Response.Header().Add("Vary", "Accept-Encoding")
+			if strings.Contains(e.Request.Header.Get("Accept-Encoding"), gzipScheme) {
+				w, ok := pool.Get().(*gzip.Writer)
+				if !ok {
+					return e.InternalServerError("", errors.New("failed to get gzip.Writer"))
+				}
+
+				rw := e.Response
+				w.Reset(rw)
+
+				buf := bpool.Get().(*bytes.Buffer)
+				buf.Reset()
+
+				grw := &gzipResponseWriter{Writer: w, ResponseWriter: rw, minLength: config.MinLength, buffer: buf}
+				defer func() {
+					// There are different reasons for cases when we have not yet written response to the client and now need to do so.
+					// a) handler response had only response code and no response body (ala 404 or redirects etc). Response code need to be written now.
+					// b) body is shorter than our minimum length threshold and being buffered currently and needs to be written
+					if !grw.wroteBody {
+						if rw.Header().Get("Content-Encoding") == gzipScheme {
+							rw.Header().Del("Content-Encoding")
+						}
+						if grw.wroteHeader {
+							rw.WriteHeader(grw.code)
+						}
+						// We have to reset response to it's pristine state when
+						// nothing is written to body or error is returned.
+						// See issue echo#424, echo#407.
+						e.Response = rw
+						w.Reset(io.Discard)
+					} else if !grw.minLengthExceeded {
+						// Write uncompressed response
+						e.Response = rw
+						if grw.wroteHeader {
+							rw.WriteHeader(grw.code)
+						}
+						grw.buffer.WriteTo(rw)
+						w.Reset(io.Discard)
+					}
+					w.Close()
+					bpool.Put(buf)
+					pool.Put(w)
+				}()
+				e.Response = grw
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+type gzipResponseWriter struct {
+	http.ResponseWriter
+	io.Writer
+	buffer            *bytes.Buffer
+	minLength         int
+	code              int
+	wroteHeader       bool
+	wroteBody         bool
+	minLengthExceeded bool
+}
+
+func (w *gzipResponseWriter) WriteHeader(code int) {
+	w.Header().Del("Content-Length") // Issue echo#444
+
+	w.wroteHeader = true
+
+	// Delay writing of the header until we know if we'll actually compress the response
+	w.code = code
+}
+
+func (w *gzipResponseWriter) Write(b []byte) (int, error) {
+	if w.Header().Get("Content-Type") == "" {
+		w.Header().Set("Content-Type", http.DetectContentType(b))
+	}
+
+	w.wroteBody = true
+
+	if !w.minLengthExceeded {
+		n, err := w.buffer.Write(b)
+
+		if w.buffer.Len() >= w.minLength {
+			w.minLengthExceeded = true
+
+			// The minimum length is exceeded, add Content-Encoding header and write the header
+			w.Header().Set("Content-Encoding", gzipScheme)
+			if w.wroteHeader {
+				w.ResponseWriter.WriteHeader(w.code)
+			}
+
+			return w.Writer.Write(w.buffer.Bytes())
+		}
+
+		return n, err
+	}
+
+	return w.Writer.Write(b)
+}
+
+func (w *gzipResponseWriter) Flush() {
+	if !w.minLengthExceeded {
+		// Enforce compression because we will not know how much more data will come
+		w.minLengthExceeded = true
+		w.Header().Set("Content-Encoding", gzipScheme)
+		if w.wroteHeader {
+			w.ResponseWriter.WriteHeader(w.code)
+		}
+
+		_, _ = w.Writer.Write(w.buffer.Bytes())
+	}
+
+	_ = w.Writer.(*gzip.Writer).Flush()
+
+	_ = http.NewResponseController(w.ResponseWriter).Flush()
+}
+
+func (w *gzipResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	return http.NewResponseController(w.ResponseWriter).Hijack()
+}
+
+func (w *gzipResponseWriter) Push(target string, opts *http.PushOptions) error {
+	rw := w.ResponseWriter
+	for {
+		switch p := rw.(type) {
+		case http.Pusher:
+			return p.Push(target, opts)
+		case router.RWUnwrapper:
+			rw = p.Unwrap()
+		default:
+			return http.ErrNotSupported
+		}
+	}
+}
+
+// Note: Disable the implementation for now because in case the platform
+// supports the sendfile fast-path it won't run gzipResponseWriter.Write,
+// preventing compression on the fly.
+//
+// func (w *gzipResponseWriter) ReadFrom(r io.Reader) (n int64, err error) {
+// 	if w.wroteHeader {
+// 		w.ResponseWriter.WriteHeader(w.code)
+// 	}
+// 	rw := w.ResponseWriter
+// 	for {
+// 		switch rf := rw.(type) {
+// 		case io.ReaderFrom:
+// 			return rf.ReadFrom(r)
+// 		case router.RWUnwrapper:
+// 			rw = rf.Unwrap()
+// 		default:
+// 			return io.Copy(w.ResponseWriter, r)
+// 		}
+// 	}
+// }
+
+func (w *gzipResponseWriter) Unwrap() http.ResponseWriter {
+	return w.ResponseWriter
+}
diff --git a/server/core_backend-server/apis/middlewares_rate_limit.go b/server/core_backend-server/apis/middlewares_rate_limit.go
new file mode 100644
index 0000000..bd8bff1
--- /dev/null
+++ b/server/core_backend-server/apis/middlewares_rate_limit.go
@@ -0,0 +1,363 @@
+package apis
+
+import (
+	"errors"
+	"sync"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/store"
+)
+
+const (
+	DefaultRateLimitMiddlewareId       = "pbRateLimit"
+	DefaultRateLimitMiddlewarePriority = -1000
+)
+
+const (
+	rateLimitersStoreKey       = "__pbRateLimiters__"
+	rateLimitersCronKey        = "__pbRateLimitersCleanup__"
+	rateLimitersSettingsHookId = "__pbRateLimitersSettingsHook__"
+)
+
+// rateLimit defines the global rate limit middleware.
+//
+// This middleware is registered by default for all routes.
+func rateLimit() *hook.Handler[*core.RequestEvent] {
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultRateLimitMiddlewareId,
+		Priority: DefaultRateLimitMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			if skipRateLimit(e) {
+				return e.Next()
+			}
+
+			rule, ok := e.App.Settings().RateLimits.FindRateLimitRule(
+				defaultRateLimitLabels(e),
+				defaultRateLimitAudience(e)...,
+			)
+			if ok {
+				err := checkRateLimit(e, rule.Label+rule.Audience, rule)
+				if err != nil {
+					return err
+				}
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+// collectionPathRateLimit defines a rate limit middleware for the internal collection handlers.
+func collectionPathRateLimit(collectionPathParam string, baseTags ...string) *hook.Handler[*core.RequestEvent] {
+	if collectionPathParam == "" {
+		collectionPathParam = "collection"
+	}
+
+	return &hook.Handler[*core.RequestEvent]{
+		Id:       DefaultRateLimitMiddlewareId,
+		Priority: DefaultRateLimitMiddlewarePriority,
+		Func: func(e *core.RequestEvent) error {
+			collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue(collectionPathParam))
+			if err != nil {
+				return e.NotFoundError("Missing or invalid collection context.", err)
+			}
+
+			if err := checkCollectionRateLimit(e, collection, baseTags...); err != nil {
+				return err
+			}
+
+			return e.Next()
+		},
+	}
+}
+
+// checkCollectionRateLimit checks whether the current request satisfy the
+// rate limit configuration for the specific collection.
+//
+// Each baseTags entry will be prefixed with the collection name and its wildcard variant.
+func checkCollectionRateLimit(e *core.RequestEvent, collection *core.Collection, baseTags ...string) error {
+	if skipRateLimit(e) {
+		return nil
+	}
+
+	labels := make([]string, 0, 2+len(baseTags)*2)
+
+	rtId := collection.Id + e.Request.Pattern
+
+	// add first the primary labels (aka. ["collectionName:action1", "collectionName:action2"])
+	for _, baseTag := range baseTags {
+		rtId += baseTag
+		labels = append(labels, collection.Name+":"+baseTag)
+	}
+
+	// add the wildcard labels (aka. [..., "*:action1","*:action2", "*"])
+	for _, baseTag := range baseTags {
+		labels = append(labels, "*:"+baseTag)
+	}
+	labels = append(labels, defaultRateLimitLabels(e)...)
+
+	rule, ok := e.App.Settings().RateLimits.FindRateLimitRule(labels, defaultRateLimitAudience(e)...)
+	if ok {
+		return checkRateLimit(e, rtId+rule.Audience, rule)
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+// @todo consider exporting as helper?
+//
+//nolint:unused
+func isClientRateLimited(e *core.RequestEvent, rtId string) bool {
+	rateLimiters, ok := e.App.Store().Get(rateLimitersStoreKey).(*store.Store[string, *rateLimiter])
+	if !ok || rateLimiters == nil {
+		return false
+	}
+
+	rt, ok := rateLimiters.GetOk(rtId)
+	if !ok || rt == nil {
+		return false
+	}
+
+	client, ok := rt.getClient(e.RealIP())
+	if !ok || client == nil {
+		return false
+	}
+
+	return client.available <= 0 && time.Now().Unix()-client.lastConsume < client.interval
+}
+
+// @todo consider exporting as helper?
+func checkRateLimit(e *core.RequestEvent, rtId string, rule core.RateLimitRule) error {
+	switch rule.Audience {
+	case core.RateLimitRuleAudienceAll:
+		// valid for both guest and regular users
+	case core.RateLimitRuleAudienceGuest:
+		if e.Auth != nil {
+			return nil
+		}
+	case core.RateLimitRuleAudienceAuth:
+		if e.Auth == nil {
+			return nil
+		}
+	}
+
+	rateLimiters := e.App.Store().GetOrSet(rateLimitersStoreKey, func() any {
+		return initRateLimitersStore(e.App)
+	}).(*store.Store[string, *rateLimiter])
+	if rateLimiters == nil {
+		e.App.Logger().Warn("Failed to retrieve app rate limiters store")
+		return nil
+	}
+
+	rt := rateLimiters.GetOrSet(rtId, func() *rateLimiter {
+		return newRateLimiter(rule.MaxRequests, rule.Duration, rule.Duration+1800)
+	})
+	if rt == nil {
+		e.App.Logger().Warn("Failed to retrieve app rate limiter", "id", rtId)
+		return nil
+	}
+
+	key := e.RealIP()
+	if key == "" {
+		e.App.Logger().Warn("Empty rate limit client key")
+		return nil
+	}
+
+	if !rt.isAllowed(key) {
+		return e.TooManyRequestsError("", errors.New("triggered rate limit rule: "+rule.String()))
+	}
+
+	return nil
+}
+
+func skipRateLimit(e *core.RequestEvent) bool {
+	return !e.App.Settings().RateLimits.Enabled || e.HasSuperuserAuth()
+}
+
+var defaultAuthAudience = []string{core.RateLimitRuleAudienceAll, core.RateLimitRuleAudienceAuth}
+var defaultGuestAudience = []string{core.RateLimitRuleAudienceAll, core.RateLimitRuleAudienceGuest}
+
+func defaultRateLimitAudience(e *core.RequestEvent) []string {
+	if e.Auth != nil {
+		return defaultAuthAudience
+	}
+
+	return defaultGuestAudience
+}
+
+func defaultRateLimitLabels(e *core.RequestEvent) []string {
+	return []string{e.Request.Method + " " + e.Request.URL.Path, e.Request.URL.Path}
+}
+
+func destroyRateLimitersStore(app core.App) {
+	app.OnSettingsReload().Unbind(rateLimitersSettingsHookId)
+	app.Cron().Remove(rateLimitersCronKey)
+	app.Store().Remove(rateLimitersStoreKey)
+}
+
+func initRateLimitersStore(app core.App) *store.Store[string, *rateLimiter] {
+	app.Cron().Add(rateLimitersCronKey, "2 * * * *", func() { // offset a little since too many cleanup tasks execute at 00
+		limitersStore, ok := app.Store().Get(rateLimitersStoreKey).(*store.Store[string, *rateLimiter])
+		if !ok {
+			return
+		}
+		limiters := limitersStore.GetAll()
+		for _, limiter := range limiters {
+			limiter.clean()
+		}
+	})
+
+	app.OnSettingsReload().Bind(&hook.Handler[*core.SettingsReloadEvent]{
+		Id: rateLimitersSettingsHookId,
+		Func: func(e *core.SettingsReloadEvent) error {
+			err := e.Next()
+			if err != nil {
+				return err
+			}
+
+			// reset
+			destroyRateLimitersStore(e.App)
+
+			return nil
+		},
+	})
+
+	return store.New[string, *rateLimiter](nil)
+}
+
+func newRateLimiter(maxAllowed int, intervalInSec int64, minDeleteIntervalInSec int64) *rateLimiter {
+	return &rateLimiter{
+		maxAllowed:        maxAllowed,
+		interval:          intervalInSec,
+		minDeleteInterval: minDeleteIntervalInSec,
+		clients:           map[string]*rateClient{},
+	}
+}
+
+type rateLimiter struct {
+	clients map[string]*rateClient
+
+	maxAllowed        int
+	interval          int64
+	minDeleteInterval int64
+	totalDeleted      int64
+
+	sync.RWMutex
+}
+
+//nolint:unused
+func (rt *rateLimiter) getClient(key string) (*rateClient, bool) {
+	rt.RLock()
+	client, ok := rt.clients[key]
+	rt.RUnlock()
+
+	return client, ok
+}
+
+func (rt *rateLimiter) isAllowed(key string) bool {
+	// lock only reads to minimize locks contention
+	rt.RLock()
+	client, ok := rt.clients[key]
+	rt.RUnlock()
+
+	if !ok {
+		rt.Lock()
+		// check again in case the client was added by another request
+		client, ok = rt.clients[key]
+		if !ok {
+			client = newRateClient(rt.maxAllowed, rt.interval)
+			rt.clients[key] = client
+		}
+		rt.Unlock()
+	}
+
+	return client.consume()
+}
+
+func (rt *rateLimiter) clean() {
+	rt.Lock()
+	defer rt.Unlock()
+
+	nowUnix := time.Now().Unix()
+
+	for k, client := range rt.clients {
+		if client.hasExpired(nowUnix, rt.minDeleteInterval) {
+			delete(rt.clients, k)
+			rt.totalDeleted++
+		}
+	}
+
+	// "shrink" the map if too may items were deleted
+	//
+	// @todo remove after https://github.com/golang/go/issues/20135
+	if rt.totalDeleted >= 300 {
+		shrunk := make(map[string]*rateClient, len(rt.clients))
+		for k, v := range rt.clients {
+			shrunk[k] = v
+		}
+		rt.clients = shrunk
+		rt.totalDeleted = 0
+	}
+}
+
+func newRateClient(maxAllowed int, intervalInSec int64) *rateClient {
+	return &rateClient{
+		maxAllowed: maxAllowed,
+		interval:   intervalInSec,
+	}
+}
+
+// @todo evaluate swiching to a more traditional fixed window or sliding window counter
+// implementations since some users complained that it is not intuitive (see #7329).
+//
+// rateClient is a mixture of token bucket and fixed window rate limit strategies
+// that refills the allowance only after at least "interval" seconds
+// has elapsed since the last request.
+type rateClient struct {
+	// use plain Mutex instead of RWMutex since the operations are expected
+	// to be mostly writes (e.g. consume()) and it should perform better
+	sync.Mutex
+
+	maxAllowed  int   // the max allowed tokens per interval
+	available   int   // the total available tokens
+	interval    int64 // in seconds
+	lastConsume int64 // the time of the last consume
+}
+
+// hasExpired checks whether it has been at least minElapsed seconds since the lastConsume time.
+// (usually used to perform periodic cleanup of staled instances).
+func (l *rateClient) hasExpired(relativeNow int64, minElapsed int64) bool {
+	l.Lock()
+	defer l.Unlock()
+
+	return relativeNow-l.lastConsume > minElapsed
+}
+
+// consume decreases the current allowance with 1 (if not exhausted already).
+//
+// It returns false if the allowance has been already exhausted and the user
+// has to wait until it resets back to its maxAllowed value.
+func (l *rateClient) consume() bool {
+	l.Lock()
+	defer l.Unlock()
+
+	nowUnix := time.Now().Unix()
+
+	// reset consumed counter
+	if nowUnix-l.lastConsume >= l.interval {
+		l.available = l.maxAllowed
+	}
+
+	if l.available > 0 {
+		l.available--
+		l.lastConsume = nowUnix
+
+		return true
+	}
+
+	return false
+}
diff --git a/server/core_backend-server/apis/middlewares_rate_limit_test.go b/server/core_backend-server/apis/middlewares_rate_limit_test.go
new file mode 100644
index 0000000..a884be0
--- /dev/null
+++ b/server/core_backend-server/apis/middlewares_rate_limit_test.go
@@ -0,0 +1,159 @@
+package apis_test
+
+import (
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestDefaultRateLimitMiddleware(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.Settings().RateLimits.Enabled = true
+	app.Settings().RateLimits.Rules = []core.RateLimitRule{
+		{
+			Label:       "/rate/",
+			MaxRequests: 2,
+			Duration:    1,
+		},
+		{
+			Label:       "/rate/b",
+			MaxRequests: 3,
+			Duration:    1,
+		},
+		{
+			Label:       "POST /rate/b",
+			MaxRequests: 1,
+			Duration:    1,
+		},
+		{
+			Label:       "/rate/guest",
+			MaxRequests: 1,
+			Duration:    1,
+			Audience:    core.RateLimitRuleAudienceGuest,
+		},
+		{
+			Label:       "/rate/auth",
+			MaxRequests: 1,
+			Duration:    1,
+			Audience:    core.RateLimitRuleAudienceAuth,
+		},
+	}
+
+	pbRouter, err := apis.NewRouter(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pbRouter.GET("/norate", func(e *core.RequestEvent) error {
+		return e.String(200, "norate")
+	}).BindFunc(func(e *core.RequestEvent) error {
+		return e.Next()
+	})
+	pbRouter.GET("/rate/a", func(e *core.RequestEvent) error {
+		return e.String(200, "a")
+	})
+	pbRouter.GET("/rate/b", func(e *core.RequestEvent) error {
+		return e.String(200, "b")
+	})
+	pbRouter.GET("/rate/guest", func(e *core.RequestEvent) error {
+		return e.String(200, "guest")
+	})
+	pbRouter.GET("/rate/auth", func(e *core.RequestEvent) error {
+		return e.String(200, "auth")
+	})
+
+	mux, err := pbRouter.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		url            string
+		wait           float64
+		authenticated  bool
+		expectedStatus int
+	}{
+		{"/norate", 0, false, 200},
+		{"/norate", 0, false, 200},
+		{"/norate", 0, false, 200},
+		{"/norate", 0, false, 200},
+		{"/norate", 0, false, 200},
+
+		{"/rate/a", 0, false, 200},
+		{"/rate/a", 0, false, 200},
+		{"/rate/a", 0, false, 429},
+		{"/rate/a", 0, false, 429},
+		{"/rate/a", 1.1, false, 200},
+		{"/rate/a", 0, false, 200},
+		{"/rate/a", 0, false, 429},
+
+		{"/rate/b", 0, false, 200},
+		{"/rate/b", 0, false, 200},
+		{"/rate/b", 0, false, 200},
+		{"/rate/b", 0, false, 429},
+		{"/rate/b", 1.1, false, 200},
+		{"/rate/b", 0, false, 200},
+		{"/rate/b", 0, false, 200},
+		{"/rate/b", 0, false, 429},
+
+		// "auth" with guest (should fallback to the /rate/ rule)
+		{"/rate/auth", 0, false, 200},
+		{"/rate/auth", 0, false, 200},
+		{"/rate/auth", 0, false, 429},
+		{"/rate/auth", 0, false, 429},
+
+		// "auth" rule with regular user (should match the /rate/auth rule)
+		{"/rate/auth", 0, true, 200},
+		{"/rate/auth", 0, true, 429},
+		{"/rate/auth", 0, true, 429},
+
+		// "guest" with guest (should match the /rate/guest rule)
+		{"/rate/guest", 0, false, 200},
+		{"/rate/guest", 0, false, 429},
+		{"/rate/guest", 0, false, 429},
+
+		// "guest" rule with regular user (should fallback to the /rate/ rule)
+		{"/rate/guest", 1.1, true, 200},
+		{"/rate/guest", 0, true, 200},
+		{"/rate/guest", 0, true, 429},
+		{"/rate/guest", 0, true, 429},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.url, func(t *testing.T) {
+			if s.wait > 0 {
+				time.Sleep(time.Duration(s.wait) * time.Second)
+			}
+
+			rec := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", s.url, nil)
+
+			if s.authenticated {
+				auth, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				token, err := auth.NewAuthToken()
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				req.Header.Add("Authorization", token)
+			}
+
+			mux.ServeHTTP(rec, req)
+
+			result := rec.Result()
+
+			if result.StatusCode != s.expectedStatus {
+				t.Fatalf("Expected response status %d, got %d", s.expectedStatus, result.StatusCode)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/apis/middlewares_test.go b/server/core_backend-server/apis/middlewares_test.go
new file mode 100644
index 0000000..d28c136
--- /dev/null
+++ b/server/core_backend-server/apis/middlewares_test.go
@@ -0,0 +1,539 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestPanicRecover(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "panic from route",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					panic("123")
+				})
+			},
+			ExpectedStatus:  500,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "panic from middleware",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(http.StatusOK, "test")
+				}).BindFunc(func(e *core.RequestEvent) error {
+					panic(123)
+				})
+			},
+			ExpectedStatus:  500,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRequireGuestOnly(t *testing.T) {
+	t.Parallel()
+
+	beforeTestFunc := func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+		e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+			return e.String(200, "test123")
+		}).Bind(apis.RequireGuestOnly())
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "valid regular user token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc:  beforeTestFunc,
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid superuser auth token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc:  beforeTestFunc,
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired/invalid token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoxNjQwOTkxNjYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.2D3tmqPn3vc5LoqqCz8V-iCDVXo9soYiH0d32G7FQT4",
+			},
+			BeforeTestFunc:  beforeTestFunc,
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "guest",
+			Method:          http.MethodGet,
+			URL:             "/my/test",
+			BeforeTestFunc:  beforeTestFunc,
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRequireAuth(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireAuth())
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoxNjQwOTkxNjYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.2D3tmqPn3vc5LoqqCz8V-iCDVXo9soYiH0d32G7FQT4",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireAuth())
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "invalid token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6ImZpbGUiLCJjb2xsZWN0aW9uSWQiOiJwYmNfMzE0MjYzNTgyMyJ9.Lupz541xRvrktwkrl55p5pPCF77T69ZRsohsIcb2dxc",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireAuth())
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid record auth token with no collection restrictions",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				// regular user
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireAuth())
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid record static auth token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				// regular user
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6ZmFsc2V9.4IsO6YMsR19crhwl_YWzvRH8pfq2Ri4Gv2dzGyneLak",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireAuth())
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid record auth token with collection not in the restricted list",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				// superuser
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireAuth("users", "demo1"))
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid record auth token with collection in the restricted list",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				// superuser
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireAuth("users", core.CollectionNameSuperusers))
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRequireSuperuserAuth(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserAuth())
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired/invalid token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjE2NDA5OTE2NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.0pDcBPGDpL2Khh76ivlRi7ugiLBSYvasct3qpHV3rfs",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserAuth())
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid regular user auth token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserAuth())
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid superuser auth token",
+			Method: http.MethodGet,
+			URL:    "/my/test",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserAuth())
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRequireSuperuserOrOwnerAuth(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			URL:    "/my/test/4q1xlclmfloku33",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired/invalid token",
+			Method: http.MethodGet,
+			URL:    "/my/test/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjE2NDA5OTE2NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.0pDcBPGDpL2Khh76ivlRi7ugiLBSYvasct3qpHV3rfs",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid record auth token (different user)",
+			Method: http.MethodGet,
+			URL:    "/my/test/oap640cot4yru2s",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid record auth token (owner)",
+			Method: http.MethodGet,
+			URL:    "/my/test/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid record auth token (owner + non-matching custom owner param)",
+			Method: http.MethodGet,
+			URL:    "/my/test/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth("test"))
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid record auth token (owner + matching custom owner param)",
+			Method: http.MethodGet,
+			URL:    "/my/test/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{test}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth("test"))
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid superuser auth token",
+			Method: http.MethodGet,
+			URL:    "/my/test/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRequireSameCollectionContextAuth(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			URL:    "/my/test/_pb_users_auth_",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSameCollectionContextAuth(""))
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired/invalid token",
+			Method: http.MethodGet,
+			URL:    "/my/test/_pb_users_auth_",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoxNjQwOTkxNjYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.2D3tmqPn3vc5LoqqCz8V-iCDVXo9soYiH0d32G7FQT4",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSameCollectionContextAuth(""))
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid record auth token (different collection)",
+			Method: http.MethodGet,
+			URL:    "/my/test/clients",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSameCollectionContextAuth(""))
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid record auth token (same collection)",
+			Method: http.MethodGet,
+			URL:    "/my/test/_pb_users_auth_",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSameCollectionContextAuth(""))
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test123"},
+		},
+		{
+			Name:   "valid record auth token (non-matching/missing collection param)",
+			Method: http.MethodGet,
+			URL:    "/my/test/_pb_users_auth_",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid record auth token (matching custom collection param)",
+			Method: http.MethodGet,
+			URL:    "/my/test/_pb_users_auth_",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{test}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSuperuserOrOwnerAuth("test"))
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superuser no exception check",
+			Method: http.MethodGet,
+			URL:    "/my/test/_pb_users_auth_",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
+					return e.String(200, "test123")
+				}).Bind(apis.RequireSameCollectionContextAuth(""))
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/realtime.go b/server/core_backend-server/apis/realtime.go
new file mode 100644
index 0000000..b690358
--- /dev/null
+++ b/server/core_backend-server/apis/realtime.go
@@ -0,0 +1,803 @@
+package apis
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/picker"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"golang.org/x/sync/errgroup"
+)
+
+// note: the chunk size is arbitrary chosen and may change in the future
+const clientsChunkSize = 150
+
+// RealtimeClientAuthKey is the name of the realtime client store key that holds its auth state.
+const RealtimeClientAuthKey = "auth"
+
+// bindRealtimeApi registers the realtime api endpoints.
+func bindRealtimeApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	sub := rg.Group("/realtime")
+	sub.GET("", realtimeConnect).Bind(SkipSuccessActivityLog())
+	sub.POST("", realtimeSetSubscriptions)
+
+	bindRealtimeEvents(app)
+
+	if app.IsRealtimeBridgeEnabled() {
+		bindRealtimeBridge(app)
+	}
+}
+
+func realtimeConnect(e *core.RequestEvent) error {
+	// disable global write deadline for the SSE connection
+	rc := http.NewResponseController(e.Response)
+	writeDeadlineErr := rc.SetWriteDeadline(time.Time{})
+	if writeDeadlineErr != nil {
+		if !errors.Is(writeDeadlineErr, http.ErrNotSupported) {
+			return e.InternalServerError("Failed to initialize SSE connection.", writeDeadlineErr)
+		}
+
+		// only log since there are valid cases where it may not be implement (e.g. httptest.ResponseRecorder)
+		e.App.Logger().Warn("SetWriteDeadline is not supported, fallback to the default server WriteTimeout")
+	}
+
+	// create cancellable request
+	cancelCtx, cancelRequest := context.WithCancel(e.Request.Context())
+	defer cancelRequest()
+	e.Request = e.Request.Clone(cancelCtx)
+
+	e.Response.Header().Set("Content-Type", "text/event-stream")
+	e.Response.Header().Set("Cache-Control", "no-store")
+	// https://github.com/pocketbase/pocketbase/discussions/480#discussioncomment-3657640
+	// https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering
+	e.Response.Header().Set("X-Accel-Buffering", "no")
+
+	connectEvent := new(core.RealtimeConnectRequestEvent)
+	connectEvent.RequestEvent = e
+	if realtimeBridge, ok := e.App.Store().Get(RealtimeBridgeInstanceKey).(IRealtimeBridge); ok {
+		connectEvent.Client = NewBridgedClient(realtimeBridge)
+	} else {
+		// fallback to pocketbase's default non-distributed client.
+		connectEvent.Client = subscriptions.NewDefaultClient()
+	}
+	connectEvent.IdleTimeout = 5 * time.Minute
+
+	return e.App.OnRealtimeConnectRequest().Trigger(connectEvent, func(ce *core.RealtimeConnectRequestEvent) error {
+		// register new subscription client
+		ce.App.SubscriptionsBroker().Register(ce.Client)
+		defer func() {
+			e.App.SubscriptionsBroker().Unregister(ce.Client.Id())
+			if syncClient, ok := ce.Client.(IBridgedClient); ok {
+				syncClient.BroadcastGoOffline()
+			}
+		}()
+
+		ce.App.Logger().Debug("Realtime connection established.", slog.String("clientId", ce.Client.Id()))
+
+		// signalize established connection (aka. fire "connect" message)
+		connectMsgEvent := new(core.RealtimeMessageEvent)
+		connectMsgEvent.RequestEvent = ce.RequestEvent
+		connectMsgEvent.Client = ce.Client
+		connectMsgEvent.Message = &subscriptions.Message{
+			Name: "PB_CONNECT",
+			Data: []byte(`{"clientId":"` + ce.Client.Id() + `"}`),
+		}
+		connectMsgErr := ce.App.OnRealtimeMessageSend().Trigger(connectMsgEvent, func(me *core.RealtimeMessageEvent) error {
+			err := me.Message.WriteSSE(me.Response, me.Client.Id())
+			if err != nil {
+				return err
+			}
+			return me.Flush()
+		})
+		if connectMsgErr != nil {
+			ce.App.Logger().Debug(
+				"Realtime connection closed (failed to deliver PB_CONNECT)",
+				slog.String("clientId", ce.Client.Id()),
+				slog.String("error", connectMsgErr.Error()),
+			)
+			return nil
+		}
+
+		// start an idle timer to keep track of inactive/forgotten connections
+		idleTimer := time.NewTimer(ce.IdleTimeout)
+		defer idleTimer.Stop()
+
+		for {
+			select {
+			case <-idleTimer.C:
+				cancelRequest()
+			case msg, ok := <-ce.Client.Channel():
+				if !ok {
+					// channel is closed
+					ce.App.Logger().Debug(
+						"Realtime connection closed (closed channel)",
+						slog.String("clientId", ce.Client.Id()),
+					)
+					return nil
+				}
+
+				msgEvent := new(core.RealtimeMessageEvent)
+				msgEvent.RequestEvent = ce.RequestEvent
+				msgEvent.Client = ce.Client
+				msgEvent.Message = &msg
+				msgErr := ce.App.OnRealtimeMessageSend().Trigger(msgEvent, func(me *core.RealtimeMessageEvent) error {
+					err := me.Message.WriteSSE(me.Response, me.Client.Id())
+					if err != nil {
+						return err
+					}
+					return me.Flush()
+				})
+				if msgErr != nil {
+					ce.App.Logger().Debug(
+						"Realtime connection closed (failed to deliver message)",
+						slog.String("clientId", ce.Client.Id()),
+						slog.String("error", msgErr.Error()),
+					)
+					return nil
+				}
+
+				idleTimer.Stop()
+				idleTimer.Reset(ce.IdleTimeout)
+			case <-ce.Request.Context().Done():
+				// connection is closed
+				ce.App.Logger().Debug(
+					"Realtime connection closed (cancelled request)",
+					slog.String("clientId", ce.Client.Id()),
+				)
+				return nil
+			}
+		}
+	})
+}
+
+type realtimeSubscribeForm struct {
+	ClientId      string   `form:"clientId" json:"clientId"`
+	Subscriptions []string `form:"subscriptions" json:"subscriptions"`
+}
+
+func (form *realtimeSubscribeForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.ClientId, validation.Required, validation.Length(1, 255)),
+		validation.Field(&form.Subscriptions,
+			validation.Length(0, 1000),
+			validation.Each(validation.Length(0, 2500)),
+		),
+	)
+}
+
+// note: in case of reconnect, clients will have to resubmit all subscriptions again
+func realtimeSetSubscriptions(e *core.RequestEvent) error {
+	form := new(realtimeSubscribeForm)
+
+	err := e.BindBody(form)
+	if err != nil {
+		return e.BadRequestError("", err)
+	}
+
+	err = form.validate()
+	if err != nil {
+		return e.BadRequestError("", err)
+	}
+
+	// find subscription client
+	client, err := e.App.SubscriptionsBroker().ClientById(form.ClientId)
+	if err != nil {
+		return e.NotFoundError("Missing or invalid client id.", err)
+	}
+
+	// for now allow only guest->auth upgrades and any other auth change is forbidden
+	clientAuth, _ := client.Get(RealtimeClientAuthKey).(*core.Record)
+	if clientAuth != nil && !isSameAuth(clientAuth, e.Auth) {
+		return e.ForbiddenError("The current and the previous request authorization don't match.", nil)
+	}
+
+	event := new(core.RealtimeSubscribeRequestEvent)
+	event.RequestEvent = e
+	event.Client = client
+	event.Subscriptions = form.Subscriptions
+
+	return e.App.OnRealtimeSubscribeRequest().Trigger(event, func(e *core.RealtimeSubscribeRequestEvent) error {
+		// update auth state
+		e.Client.Set(RealtimeClientAuthKey, e.Auth)
+
+		// unsubscribe from any previous existing subscriptions
+		e.Client.Unsubscribe()
+
+		// subscribe to the new subscriptions
+		e.Client.Subscribe(e.Subscriptions...)
+
+		if syncClient, ok := e.Client.(IBridgedClient); ok {
+			syncClient.BroadcastChanges()
+		}
+
+		e.App.Logger().Debug(
+			"Realtime subscriptions updated.",
+			slog.String("clientId", e.Client.Id()),
+			slog.Any("subscriptions", e.Subscriptions),
+		)
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// updateClientsAuth updates the existing clients auth record with the new one (matched by ID).
+func realtimeUpdateClientsAuth(app core.App, newAuthRecord *core.Record) error {
+	chunks := app.SubscriptionsBroker().ChunkedClients(clientsChunkSize)
+
+	group := new(errgroup.Group)
+
+	for _, chunk := range chunks {
+		group.Go(func() error {
+			for _, client := range chunk {
+				clientAuth, _ := client.Get(RealtimeClientAuthKey).(*core.Record)
+				if clientAuth != nil &&
+					clientAuth.Id == newAuthRecord.Id &&
+					clientAuth.Collection().Name == newAuthRecord.Collection().Name {
+					client.Set(RealtimeClientAuthKey, newAuthRecord)
+					if syncClient, ok := client.(IBridgedClient); ok {
+						syncClient.BroadcastChanges()
+					}
+				}
+			}
+
+			return nil
+		})
+	}
+
+	return group.Wait()
+}
+
+// realtimeUnsetClientsAuthState unsets the auth state of all clients that have the provided auth model.
+func realtimeUnsetClientsAuthState(app core.App, authModel core.Model) error {
+	chunks := app.SubscriptionsBroker().ChunkedClients(clientsChunkSize)
+
+	group := new(errgroup.Group)
+
+	for _, chunk := range chunks {
+		group.Go(func() error {
+			for _, client := range chunk {
+				clientAuth, _ := client.Get(RealtimeClientAuthKey).(*core.Record)
+				if clientAuth != nil &&
+					clientAuth.Id == authModel.PK() &&
+					clientAuth.Collection().Name == authModel.TableName() {
+					client.Unset(RealtimeClientAuthKey)
+					if syncClient, ok := client.(IBridgedClient); ok {
+						syncClient.BroadcastChanges()
+					}
+				}
+			}
+
+			return nil
+		})
+	}
+
+	return group.Wait()
+}
+
+func bindRealtimeEvents(app core.App) {
+	// update the clients that has auth record association
+	app.OnModelAfterUpdateSuccess().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			authRecord := realtimeResolveRecord(e.App, e.Model, core.CollectionTypeAuth)
+			if authRecord != nil {
+				if err := realtimeUpdateClientsAuth(e.App, authRecord); err != nil {
+					app.Logger().Warn(
+						"Failed to update client(s) associated to the updated auth record",
+						slog.Any("id", authRecord.Id),
+						slog.String("collectionName", authRecord.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+
+			return e.Next()
+		},
+		Priority: -99,
+	})
+
+	// remove the client(s) associated to the deleted auth model
+	// (note: works also with custom model for backward compatibility)
+	app.OnModelAfterDeleteSuccess().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			collection := realtimeResolveRecordCollection(e.App, e.Model)
+			if collection != nil && collection.IsAuth() {
+				if err := realtimeUnsetClientsAuthState(e.App, e.Model); err != nil {
+					app.Logger().Warn(
+						"Failed to remove client(s) associated to the deleted auth model",
+						slog.Any("id", e.Model.PK()),
+						slog.String("collectionName", e.Model.TableName()),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+
+			return e.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterCreateSuccess().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			record := realtimeResolveRecord(e.App, e.Model, "")
+			if record != nil {
+				err := realtimeBroadcastRecord(e.App, "create", record, false)
+				if err != nil {
+					app.Logger().Debug(
+						"Failed to broadcast record create",
+						slog.String("id", record.Id),
+						slog.String("collectionName", record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+
+			return e.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterUpdateSuccess().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			record := realtimeResolveRecord(e.App, e.Model, "")
+			if record != nil {
+				err := realtimeBroadcastRecord(e.App, "update", record, false)
+				if err != nil {
+					app.Logger().Debug(
+						"Failed to broadcast record update",
+						slog.String("id", record.Id),
+						slog.String("collectionName", record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+
+			return e.Next()
+		},
+		Priority: -99,
+	})
+
+	// delete: dry cache
+	app.OnModelDelete().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			record := realtimeResolveRecord(e.App, e.Model, "")
+			if record != nil {
+				// note: use the outside scoped app instance for the access checks so that the API rules
+				// are performed out of the delete transaction ensuring that they would still work even if
+				// a cascade-deleted record's API rule relies on an already deleted parent record
+				err := realtimeBroadcastRecord(e.App, "delete", record, true, app)
+				if err != nil {
+					app.Logger().Debug(
+						"Failed to dry cache record delete",
+						slog.String("id", record.Id),
+						slog.String("collectionName", record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+
+			return e.Next()
+		},
+		Priority: 99, // execute as later as possible
+	})
+
+	// delete: broadcast
+	app.OnModelAfterDeleteSuccess().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			// note: only ensure that it is a collection record
+			// and don't use realtimeResolveRecord because in case of a
+			// custom model it'll fail to resolve since the record is already deleted
+			collection := realtimeResolveRecordCollection(e.App, e.Model)
+			if collection != nil {
+				err := realtimeBroadcastDryCacheKey(e.App, getDryCacheKey("delete", e.Model))
+				if err != nil {
+					app.Logger().Debug(
+						"Failed to broadcast record delete",
+						slog.Any("id", e.Model.PK()),
+						slog.String("collectionName", collection.Name),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+
+			return e.Next()
+		},
+		Priority: -99,
+	})
+
+	// delete: failure
+	app.OnModelAfterDeleteError().Bind(&hook.Handler[*core.ModelErrorEvent]{
+		Func: func(e *core.ModelErrorEvent) error {
+			record := realtimeResolveRecord(e.App, e.Model, "")
+			if record != nil {
+				err := realtimeUnsetDryCacheKey(e.App, getDryCacheKey("delete", record))
+				if err != nil {
+					app.Logger().Debug(
+						"Failed to cleanup after broadcast record delete failure",
+						slog.String("id", record.Id),
+						slog.String("collectionName", record.Collection().Name),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+
+			return e.Next()
+		},
+		Priority: -99,
+	})
+}
+
+// resolveRecord converts *if possible* the provided model interface to a Record.
+// This is usually helpful if the provided model is a custom Record model struct.
+func realtimeResolveRecord(app core.App, model core.Model, optCollectionType string) *core.Record {
+	var record *core.Record
+	switch m := model.(type) {
+	case *core.Record:
+		record = m
+	case core.RecordProxy:
+		record = m.ProxyRecord()
+	}
+
+	if record != nil {
+		if optCollectionType == "" || record.Collection().Type == optCollectionType {
+			return record
+		}
+		return nil
+	}
+
+	tblName := model.TableName()
+
+	// skip Log model checks
+	if tblName == core.LogsTableName {
+		return nil
+	}
+
+	// check if it is custom Record model struct
+	collection, _ := app.FindCachedCollectionByNameOrId(tblName)
+	if collection != nil && (optCollectionType == "" || collection.Type == optCollectionType) {
+		if id, ok := model.PK().(string); ok {
+			record, _ = app.FindRecordById(collection, id)
+		}
+	}
+
+	return record
+}
+
+// realtimeResolveRecordCollection extracts *if possible* the Collection model from the provided model interface.
+// This is usually helpful if the provided model is a custom Record model struct.
+func realtimeResolveRecordCollection(app core.App, model core.Model) (collection *core.Collection) {
+	switch m := model.(type) {
+	case *core.Record:
+		return m.Collection()
+	case core.RecordProxy:
+		return m.ProxyRecord().Collection()
+	default:
+		// check if it is custom Record model struct
+		collection, err := app.FindCachedCollectionByNameOrId(model.TableName())
+		if err == nil {
+			return collection
+		}
+	}
+
+	return nil
+}
+
+// recordData represents the broadcasted record subscrition message data.
+type recordData struct {
+	Record any    `json:"record"` /* map or core.Record */
+	Action string `json:"action"`
+}
+
+// Note: the optAccessCheckApp is there in case you want the access check
+// to be performed against different db app context (e.g. out of a transaction).
+// If set, it is expected that optAccessCheckApp instance is used for read-only operations to avoid deadlocks.
+// If not set, it fallbacks to app.
+func realtimeBroadcastRecord(app core.App, action string, record *core.Record, dryCache bool, optAccessCheckApp ...core.App) error {
+	collection := record.Collection()
+	if collection == nil {
+		return errors.New("[broadcastRecord] Record collection not set")
+	}
+
+	chunks := app.SubscriptionsBroker().ChunkedClients(clientsChunkSize)
+	if len(chunks) == 0 {
+		return nil // no subscribers
+	}
+
+	subscriptionRuleMap := map[string]*string{
+		(collection.Name + "/" + record.Id + "?"): collection.ViewRule,
+		(collection.Id + "/" + record.Id + "?"):   collection.ViewRule,
+		(collection.Name + "/*?"):                 collection.ListRule,
+		(collection.Id + "/*?"):                   collection.ListRule,
+
+		// @deprecated: the same as the wildcard topic but kept for backward compatibility
+		(collection.Name + "?"): collection.ListRule,
+		(collection.Id + "?"):   collection.ListRule,
+	}
+
+	dryCacheKey := getDryCacheKey(action, record)
+
+	group := new(errgroup.Group)
+
+	accessCheckApp := app
+	if len(optAccessCheckApp) > 0 {
+		accessCheckApp = optAccessCheckApp[0]
+	}
+
+	for _, chunk := range chunks {
+		group.Go(func() error {
+			var clientAuth *core.Record
+
+			for _, client := range chunk {
+				// note: not executed concurrently to avoid races and to ensure
+				// that the access checks are applied for the current record db state
+				for prefix, rule := range subscriptionRuleMap {
+					subs := client.Subscriptions(prefix)
+					if len(subs) == 0 {
+						continue
+					}
+
+					clientAuth, _ = client.Get(RealtimeClientAuthKey).(*core.Record)
+
+					for sub, options := range subs {
+						// mock request data
+						requestInfo := &core.RequestInfo{
+							Context: core.RequestInfoContextRealtime,
+							Method:  "GET",
+							Query:   options.Query,
+							Headers: options.Headers,
+							Auth:    clientAuth,
+						}
+
+						if !realtimeCanAccessRecord(accessCheckApp, record, requestInfo, rule) {
+							continue
+						}
+
+						// create a clean record copy without expand and unknown fields because we don't know yet
+						// which exact fields the client subscription requested or has permissions to access
+						cleanRecord := record.Fresh()
+
+						// trigger the enrich hooks
+						enrichErr := triggerRecordEnrichHooks(app, requestInfo, []*core.Record{cleanRecord}, func() error {
+							// apply expand
+							rawExpand := options.Query[expandQueryParam]
+							if rawExpand != "" {
+								expandErrs := app.ExpandRecord(cleanRecord, strings.Split(rawExpand, ","), expandFetch(app, requestInfo))
+								if len(expandErrs) > 0 {
+									app.Logger().Debug(
+										"[broadcastRecord] expand errors",
+										slog.String("id", cleanRecord.Id),
+										slog.String("collectionName", cleanRecord.Collection().Name),
+										slog.String("sub", sub),
+										slog.String("expand", rawExpand),
+										slog.Any("errors", expandErrs),
+									)
+								}
+							}
+
+							// ignore the auth record email visibility checks
+							// for auth owner, superuser or manager
+							if collection.IsAuth() {
+								if isSameAuth(clientAuth, cleanRecord) ||
+									realtimeCanAccessRecord(accessCheckApp, cleanRecord, requestInfo, collection.ManageRule) {
+									cleanRecord.IgnoreEmailVisibility(true)
+								}
+							}
+
+							return nil
+						})
+						if enrichErr != nil {
+							app.Logger().Debug(
+								"[broadcastRecord] record enrich error",
+								slog.String("id", cleanRecord.Id),
+								slog.String("collectionName", cleanRecord.Collection().Name),
+								slog.String("sub", sub),
+								slog.Any("error", enrichErr),
+							)
+							continue
+						}
+
+						data := &recordData{
+							Action: action,
+							Record: cleanRecord,
+						}
+
+						// check fields
+						rawFields := options.Query[fieldsQueryParam]
+						if rawFields != "" {
+							decoded, err := picker.Pick(cleanRecord, rawFields)
+							if err == nil {
+								data.Record = decoded
+							} else {
+								app.Logger().Debug(
+									"[broadcastRecord] pick fields error",
+									slog.String("id", cleanRecord.Id),
+									slog.String("collectionName", cleanRecord.Collection().Name),
+									slog.String("sub", sub),
+									slog.String("fields", rawFields),
+									slog.String("error", err.Error()),
+								)
+							}
+						}
+
+						dataBytes, err := json.Marshal(data)
+						if err != nil {
+							app.Logger().Debug(
+								"[broadcastRecord] data marshal error",
+								slog.String("id", cleanRecord.Id),
+								slog.String("collectionName", cleanRecord.Collection().Name),
+								slog.String("error", err.Error()),
+							)
+							continue
+						}
+
+						msg := subscriptions.Message{
+							Name: sub,
+							Data: dataBytes,
+						}
+
+						if dryCache {
+							messages, ok := client.Get(dryCacheKey).([]subscriptions.Message)
+							if !ok {
+								messages = []subscriptions.Message{msg}
+							} else {
+								messages = append(messages, msg)
+							}
+							client.Set(dryCacheKey, messages)
+						} else {
+							routine.FireAndForget(func() {
+								client.Send(msg)
+							})
+						}
+					}
+				}
+			}
+
+			return nil
+		})
+	}
+
+	return group.Wait()
+}
+
+// realtimeBroadcastDryCacheKey broadcasts the dry cached key related messages.
+func realtimeBroadcastDryCacheKey(app core.App, key string) error {
+	chunks := app.SubscriptionsBroker().ChunkedClients(clientsChunkSize)
+	if len(chunks) == 0 {
+		return nil // no subscribers
+	}
+
+	group := new(errgroup.Group)
+
+	for _, chunk := range chunks {
+		group.Go(func() error {
+			for _, client := range chunk {
+				messages, ok := client.Get(key).([]subscriptions.Message)
+				if !ok {
+					continue
+				}
+
+				client.Unset(key)
+
+				client := client
+
+				routine.FireAndForget(func() {
+					for _, msg := range messages {
+						client.Send(msg)
+					}
+				})
+			}
+
+			return nil
+		})
+	}
+
+	return group.Wait()
+}
+
+// realtimeUnsetDryCacheKey removes the dry cached key related messages.
+func realtimeUnsetDryCacheKey(app core.App, key string) error {
+	chunks := app.SubscriptionsBroker().ChunkedClients(clientsChunkSize)
+	if len(chunks) == 0 {
+		return nil // no subscribers
+	}
+
+	group := new(errgroup.Group)
+
+	for _, chunk := range chunks {
+		group.Go(func() error {
+			for _, client := range chunk {
+				if client.Get(key) != nil {
+					client.Unset(key)
+				}
+			}
+
+			return nil
+		})
+	}
+
+	return group.Wait()
+}
+
+func getDryCacheKey(action string, model core.Model) string {
+	pkStr, ok := model.PK().(string)
+	if !ok {
+		pkStr = fmt.Sprintf("%v", model.PK())
+	}
+
+	return action + "/" + model.TableName() + "/" + pkStr
+}
+
+func isSameAuth(authA, authB *core.Record) bool {
+	if authA == nil {
+		return authB == nil
+	}
+
+	if authB == nil {
+		return false
+	}
+
+	return authA.Id == authB.Id && authA.Collection().Id == authB.Collection().Id
+}
+
+// realtimeCanAccessRecord checks if the subscription client has access to the specified record model.
+func realtimeCanAccessRecord(
+	app core.App,
+	record *core.Record,
+	requestInfo *core.RequestInfo,
+	accessRule *string,
+) bool {
+	// check the access rule
+	// ---
+	if ok, _ := app.CanAccessRecord(record, requestInfo, accessRule); !ok {
+		return false
+	}
+
+	// check the subscription client-side filter (if any)
+	// ---
+	filter := requestInfo.Query[search.FilterQueryParam]
+	if filter == "" {
+		return true // no further checks needed
+	}
+
+	err := checkForSuperuserOnlyRuleFields(requestInfo)
+	if err != nil {
+		return false
+	}
+
+	var exists int
+
+	q := app.ConcurrentDB().Select("(1)").
+		From(record.Collection().Name).
+		AndWhere(dbx.HashExp{record.Collection().Name + ".id": record.Id})
+
+	resolver := core.NewRecordFieldResolver(app, record.Collection(), requestInfo, false)
+	expr, err := search.FilterData(filter).BuildExpr(resolver)
+	if err != nil {
+		return false
+	}
+
+	q.AndWhere(expr)
+
+	err = resolver.UpdateQuery(q)
+	if err != nil {
+		return false
+	}
+
+	err = q.Limit(1).Row(&exists)
+
+	return err == nil && exists > 0
+}
diff --git a/server/core_backend-server/apis/realtime_bridge.go b/server/core_backend-server/apis/realtime_bridge.go
new file mode 100644
index 0000000..e6ff662
--- /dev/null
+++ b/server/core_backend-server/apis/realtime_bridge.go
@@ -0,0 +1,451 @@
+package apis
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"math/rand"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/jackc/pgx/v5/stdlib"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+type IRealtimeBridge interface {
+	// App returns the current app instance.
+	App() core.App
+
+	// SelfChannelId returns the channel id of the current instance.
+	SelfChannelId() string
+
+	// SendViaBridge sends a message to a remote client via the bridge.
+	SendViaBridge(channelId string, clientId string, message subscriptions.Message)
+}
+
+var _ IRealtimeBridge = (*RealtimeBridge)(nil)
+
+// RealtimeBridge leverage PostgresSQL's LISTEN/NOTIFY feature to synchronize
+// realtime information between different instances of the pocketbase server.
+type RealtimeBridge struct {
+	channelId string
+	app       core.App
+}
+
+var RealtimeBridgeInstanceKey = "realtime_bridge_instance"
+
+func bindRealtimeBridge(app core.App) {
+	if !core.IsPostgres(app) {
+		return
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	bridge := &RealtimeBridge{
+		channelId: genChannelId(),
+		app:       app,
+	}
+
+	app.OnServe().BindFunc(func(e *core.ServeEvent) error {
+		bridge.mustCreateTables()
+		go bridge.heartbeatLoop(ctx)
+		go bridge.listenSharedBridgeChannelLoop(ctx)
+		go bridge.listenBridgeMessagesLoop(ctx)
+
+		// allow bridge instance to be accessible from via app.Store()
+		app.Store().Set(RealtimeBridgeInstanceKey, bridge)
+
+		return e.Next()
+	})
+
+	app.OnTerminate().BindFunc(func(e *core.TerminateEvent) error {
+		cancel() // stopping all background goroutines
+		return e.Next()
+	})
+
+	// Special fixes for horizontally deployed pocketbase instances.
+	app.OnCollectionCreateRequest().BindFunc(bridge.broadcastCollectionChanged)
+	app.OnCollectionUpdateRequest().BindFunc(bridge.broadcastCollectionChanged)
+	app.OnCollectionDeleteRequest().BindFunc(bridge.broadcastCollectionChanged)
+	app.OnSettingsUpdateRequest().BindFunc(bridge.broadcastSettingsUpdated)
+}
+
+// listenSharedBridgeChannelLoop listens to the shared bridge channel.
+// It is a common communication channel between all pocketbase instances.
+// Currently, it has two purposes:
+// 1. Listen upsert, delete events in _realtimeClients table.
+// 2. Listen collection_updated and settings_updated events.
+func (t *RealtimeBridge) listenSharedBridgeChannelLoop(ctx context.Context) {
+	loopOnNotification(ctx, t.app, "shared_bridge_channel", func() {
+		// When it connected to the stream, we need to reload all subscriptions
+		// to make sure that we have the latest state.
+		t.fullRefreshSubscriptions()
+
+		// Reload collections and settings in case someone else updated them and
+		// this instance somehow didn't get the changes.
+		_ = t.app.ReloadCachedCollections()
+		_ = t.app.ReloadSettings()
+	}, func(notification *pgconn.Notification) {
+		if t.app.IsDev() {
+			fmt.Println("PID:", notification.PID, "Channel:", notification.Channel, "Payload:", notification.Payload)
+		}
+
+		messageType, messagePayload, ok := split2(notification.Payload, "|")
+		if !ok {
+			fmt.Fprintln(os.Stderr, "Invalid notification payload:", notification.Payload)
+			return
+		}
+
+		switch messageType {
+		case "subscription_upsert":
+			subscriptionJson, authRecordJson, ok := split2(messagePayload, "|")
+			if !ok {
+				fmt.Fprintln(os.Stderr, "Invalid subscriptionChange payload:", messagePayload)
+				return
+			}
+
+			var subscription ClientSubscription
+			err := json.Unmarshal([]byte(subscriptionJson), &subscription)
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "Error unmarshalling notification payload:", err)
+				os.Exit(1)
+			}
+			if subscription.UpdatedByChannelId == t.SelfChannelId() {
+				// Since the notification is broadcast to all channels, we need to skip the
+				// ones that are sent by the current channel.
+				return
+			}
+
+			var client IBridgedClient
+			if c, err := t.app.SubscriptionsBroker().ClientById(subscription.ClientId); err == nil {
+				client = c.(IBridgedClient)
+			} else {
+				client = NewBridgedClient(t, &subscription)
+				t.app.SubscriptionsBroker().Register(client)
+			}
+			client.ReceiveChanges(&subscription, authRecordJson)
+		case "subscription_delete":
+			clientId := messagePayload
+			t.app.SubscriptionsBroker().Unregister(clientId)
+		case "subscription_channel_offline":
+			channelId := messagePayload
+			// unregister all remote clients in that channel
+			for _, c := range t.app.SubscriptionsBroker().Clients() {
+				if syncClient, ok := c.(IBridgedClient); ok && syncClient.ClientSubscription().ChannelId == channelId {
+					t.app.SubscriptionsBroker().Unregister(syncClient.Id())
+				}
+			}
+		case "collection_updated":
+			_ = t.app.ReloadCachedCollections()
+		case "settings_updated":
+			_ = t.app.ReloadSettings()
+		default:
+			fmt.Fprintln(os.Stderr, "Unknown change type:", messageType)
+			panic("Unknown change type: " + messageType)
+		}
+	})
+}
+
+func (t *RealtimeBridge) SendViaBridge(channelId string, clientId string, message subscriptions.Message) {
+	if channelId == t.SelfChannelId() {
+		fmt.Fprintln(os.Stderr, "Cannot send bridged message to self channel:", channelId)
+		panic("Cannot send bridged message to self channel")
+	}
+	_, err := t.app.DB().NewQuery(`
+		SELECT pg_notify({:channelId}, {:payload})
+	`).Bind(dbx.Params{
+		"channelId": channelId,
+		"payload":   clientId + "|" + message.Name + "|" + string(message.Data),
+	}).Execute()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Error sending notification:", err)
+		os.Exit(1)
+	}
+}
+
+func (b *RealtimeBridge) listenBridgeMessagesLoop(ctx context.Context) {
+	loopOnNotification(ctx, b.app, b.SelfChannelId(), nil, func(notification *pgconn.Notification) {
+		if b.app.IsDev() {
+			fmt.Println("PID:", notification.PID, "Channel:", notification.Channel, "Payload:", notification.Payload)
+		}
+
+		clientId, messageName, messageData, ok := split3(notification.Payload, "|")
+		if !ok {
+			fmt.Fprintln(os.Stderr, "Invalid notification payload:", notification.Payload)
+			return
+		}
+		var client IBridgedClient
+		if c, err := b.app.SubscriptionsBroker().ClientById(clientId); err == nil {
+			client = c.(IBridgedClient)
+		} else {
+			fmt.Fprintln(os.Stderr, "Client not found, it may be already disconnected:", clientId)
+			return
+		}
+		// Message is send to the wrong channel.
+		// Eg: a message was supposed to be sent to local clientA which is in channelA.
+		// But somehow the message was sent to remote clientA in channelB.
+		if client.IsRemoteClient() {
+			fmt.Fprintln(os.Stderr, "Message is sent to the wrong channel:", notification.Payload)
+			return
+		}
+		client.Send(subscriptions.Message{
+			Name: messageName,
+			Data: []byte(messageData),
+		})
+	})
+}
+
+var pgTypes = pgtype.NewMap()
+
+// reload all remote realtime subscriptions
+func (t *RealtimeBridge) fullRefreshSubscriptions() {
+	rows, err := t.app.DB().NewQuery(`
+		SELECT "clientId", "channelId", "subscriptions", "authCollectionRef", "authRecordRef", "updatedByChannelId"
+		FROM "_realtimeClients"
+		WHERE "updatedByChannelId" != {:selfChannelId}
+	`).Bind(dbx.Params{
+		"selfChannelId": t.SelfChannelId(),
+	}).Rows()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Error loading subscriptions:", err)
+	}
+	defer rows.Close()
+
+	clientsToRemove := make(map[string]any)
+	for _, c := range t.app.SubscriptionsBroker().Clients() {
+		if client, ok := c.(IBridgedClient); ok && client.IsRemoteClient() {
+			clientsToRemove[client.Id()] = nil
+		}
+	}
+
+	for rows.Next() {
+		var subscription ClientSubscription
+		err := rows.Scan(
+			&subscription.ClientId,
+			&subscription.ChannelId,
+			pgTypes.SQLScanner(&subscription.Subscriptions),
+			&subscription.AuthCollectionRef,
+			&subscription.AuthRecordRef,
+			&subscription.UpdatedByChannelId,
+		)
+		if err != nil {
+			data := make(dbx.NullStringMap, 0)
+			err := rows.ScanMap(data)
+			fmt.Fprintln(os.Stderr, "Error scanning subscription:", err)
+			continue
+		}
+		var client IBridgedClient
+		if c, err := t.app.SubscriptionsBroker().ClientById(subscription.ClientId); err == nil {
+			client = c.(IBridgedClient)
+		} else {
+			client = NewBridgedClient(t, &subscription)
+			t.app.SubscriptionsBroker().Register(client)
+		}
+		client.ReceiveChanges(&subscription, "")
+		delete(clientsToRemove, client.Id())
+	}
+	for clientId := range clientsToRemove {
+		t.app.SubscriptionsBroker().Unregister(clientId)
+	}
+}
+
+func (t *RealtimeBridge) mustCreateTables() {
+	_, err := t.app.DB().NewQuery(`
+		CREATE TABLE IF NOT EXISTS "_realtimeChannels" (
+			"channelId" TEXT PRIMARY KEY,
+			"validUntil" TIMESTAMP NOT NULL
+		);
+		CREATE TABLE IF NOT EXISTS "_realtimeClients" (
+			"clientId" TEXT NOT NULL PRIMARY KEY,
+			"channelId" TEXT NOT NULL,
+			"subscriptions" TEXT[] NOT NULL,
+			"authCollectionRef" TEXT NOT NULL DEFAULT '',
+			"authRecordRef" TEXT NOT NULL DEFAULT '',
+			"updatedByChannelId" TEXT NOT NULL DEFAULT ''
+		);
+		CREATE INDEX IF NOT EXISTS "_realtimeClients_channelId_idx" ON "_realtimeClients" ("channelId");
+	`).Execute()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Error creating tables tables:", err)
+		os.Exit(1)
+	}
+}
+
+// heartbeatLoop periodically updates its status in the _realtimeChannels table
+// to tell other pocketbase instances that it is still alive.
+// It also helps to broadcast the subscription_channel_offline event to all pocketbase instances
+// if any of them is offline.
+func (t *RealtimeBridge) heartbeatLoop(ctx context.Context) {
+	for {
+		select {
+		case <-ctx.Done():
+			fmt.Fprintln(os.Stderr, "Stopping realtime sync heartbeat loop.")
+			return
+		default:
+			if t.app.DB() == nil {
+				fmt.Fprintln(os.Stderr, "App is not initialized or stopped, stopping realtime sync heartbeat loop.")
+				break
+			}
+			_, err := t.app.DB().NewQuery(`
+				WITH 
+					insert_operation AS (
+						INSERT INTO "_realtimeChannels" ("channelId", "validUntil")
+						VALUES ({:channelId}, now() + interval '40 seconds')
+						ON CONFLICT ("channelId") DO UPDATE
+						SET "validUntil" = EXCLUDED."validUntil"
+					),
+					deleted_channels AS (
+						DELETE FROM "_realtimeChannels"
+						WHERE "validUntil" < now()
+						RETURNING "channelId"
+					),
+					_ AS (
+						DELETE FROM "_realtimeClients"
+						WHERE "channelId" IN (SELECT "channelId" FROM deleted_channels)
+					)
+				SELECT pg_notify('shared_bridge_channel', 'subscription_channel_offline|' || "channelId") FROM deleted_channels;
+			`).Bind(dbx.Params{
+				"channelId": t.channelId,
+			}).Execute()
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "Error sending heartbeat:", err)
+				time.Sleep(time.Second * 1)
+				continue
+			}
+			jitter := time.Second * time.Duration(rand.Intn(5))
+			time.Sleep(time.Second*30 - jitter)
+		}
+	}
+}
+
+func (t *RealtimeBridge) SelfChannelId() string {
+	return t.channelId
+}
+
+func (t *RealtimeBridge) App() core.App {
+	return t.app
+}
+
+func genChannelId() string {
+	hostname, _ := os.Hostname()
+	randstr, _ := security.RandomStringByRegex(`[a-z0-9]{5}`)
+	channelId := "c" + "_" + hostname + "_" + randstr
+
+	// Normalize the channelId to be a valid Postgres identifier
+	// Only allow lowercase letters, numbers and underscores
+	channelId = strings.Map(func(r rune) rune {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '_' {
+			return r
+		}
+		if r >= 'A' && r <= 'Z' {
+			return r + ('a' - 'A') // Convert to lowercase
+		}
+		return '_'
+	}, channelId)
+
+	return channelId
+}
+
+func loopOnNotification(ctx context.Context, app core.App, channel string, afterListenFunc func(), handler func(*pgconn.Notification)) {
+	for {
+		select {
+		case <-ctx.Done():
+			fmt.Fprintln(os.Stderr, "Stopping PostgreSQL stream listener loop on channel:", channel)
+			return
+		default:
+			err := runPgxCommand(ctx, app, func(pgxConn *pgx.Conn) error {
+				_, err := pgxConn.Exec(ctx, fmt.Sprintf("LISTEN %s", channel))
+				if err != nil {
+					return fmt.Errorf("error listening on channel %s: %w", channel, err)
+				}
+
+				if afterListenFunc != nil {
+					afterListenFunc()
+				}
+
+				for {
+					notification, err := pgxConn.WaitForNotification(ctx)
+					if err != nil {
+						if err == context.Canceled {
+							app.Logger().Info("Context was canceled, exiting the loop on channel", "channel", channel)
+							return nil // context was canceled, exit the loop
+						}
+						return fmt.Errorf("error waiting for notification on channel %s: %w", channel, err)
+					}
+					handler(notification)
+				}
+			})
+			if err != nil {
+				app.Logger().Error("Error in PostgreSQL stream listener loop on channel", "channel", channel, "error", err)
+				fmt.Fprintln(os.Stderr, "Error in PostgreSQL stream listener loop on channel", channel, ":", err)
+				time.Sleep(time.Second * 1)
+				continue
+			}
+		}
+	}
+}
+
+// Special fixes for horizontally deployed pocketbase instances.
+// When a user update settings or collection definitions, the changes is now only
+// applied to the current instance where the dashboard is connected to.
+// We need to broadcast the changes to all other instances.
+// We leverage existing `shared_bridge_channel` notification channel to notify other instances.
+func (t *RealtimeBridge) broadcastCollectionChanged(e *core.CollectionRequestEvent) error {
+	if err := e.Next(); err != nil {
+		return err
+	}
+	sql := `SELECT pg_notify('shared_bridge_channel', 'collection_updated|' || 'empty-payload')`
+	if _, err := t.app.DB().NewQuery(sql).Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, "Error sending [collection_updated] notification:", err)
+		// ignore the error as it is not critical
+	}
+	return nil
+}
+
+// Special fixes for horizontally deployed pocketbase instances.
+// When a user update settings or collection definitions, the changes is now only
+// applied to the current instance where the dashboard is connected to.
+// We need to broadcast the changes to all other instances.
+// We leverage existing `shared_bridge_channel` notification channel to notify other instances.
+func (t *RealtimeBridge) broadcastSettingsUpdated(e *core.SettingsUpdateRequestEvent) error {
+	if err := e.Next(); err != nil {
+		return err
+	}
+	sql := `SELECT pg_notify('shared_bridge_channel', 'settings_updated|' || 'empty-payload')`
+	if _, err := t.app.DB().NewQuery(sql).Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, "Error sending [settings_updated] notification:", err)
+		// ignore the error as it is not critical
+	}
+	return nil
+}
+
+// runPgxCommand aquires a connection from connection pool, runs the provided pgxFunc,
+// and put the connection back to the pool.
+// *dbx.DB -> *sql.DB -> *sql.Conn -> *pgx.Conn
+func runPgxCommand(ctx context.Context, app core.App, pgxFunc func(*pgx.Conn) error) error {
+	dbxDB, _ := app.NonconcurrentDB().(*dbx.DB)
+	if dbxDB == nil {
+		return fmt.Errorf("app.NonconcurrentDB() is not a *dbx.DB instance")
+	}
+	sqlDB := dbxDB.DB() // *sql.DB, a connection pool
+	sqlConn, err := sqlDB.Conn(ctx)
+	if err != nil {
+		return fmt.Errorf("error acquiring SQL connection: %w", err)
+	}
+	defer sqlConn.Close() // Put back to connection pool
+
+	return sqlConn.Raw(func(driverConn any) error {
+		stdlibConn, ok := driverConn.(*stdlib.Conn)
+		if !ok {
+			return fmt.Errorf("driverConn is not a *stdlib.Conn instance, are you using the pgx's database/sql driver?")
+		}
+		pgxConn := stdlibConn.Conn()
+		return pgxFunc(pgxConn)
+	})
+}
diff --git a/server/core_backend-server/apis/realtime_bridge_test.go b/server/core_backend-server/apis/realtime_bridge_test.go
new file mode 100644
index 0000000..814c48d
--- /dev/null
+++ b/server/core_backend-server/apis/realtime_bridge_test.go
@@ -0,0 +1,327 @@
+package apis_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"path"
+	"path/filepath"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+func TestAuthRecordFromJson(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	id := "4q1xlclmfloku33"
+
+	sql := `
+	    SELECT row_to_json(users) FROM users WHERE id = '4q1xlclmfloku33' LIMIT 1
+	`
+	var jsonStr string
+	err := app.DB().NewQuery(sql).Row(&jsonStr)
+	if err != nil {
+		t.Fatalf("Failed to get JSON string: %v", err)
+	}
+
+	authRecord, err := apis.AuthRecordFromJson(app, "users", jsonStr)
+	if err != nil {
+		t.Fatalf("Failed to create AuthRecord from JSON: %v", err)
+	}
+	realAuthRecord, err := app.FindRecordById("users", id)
+	if err != nil {
+		t.Fatalf("Failed to find record by ID: %v", err)
+	}
+
+	json1, _ := json.Marshal(authRecord.Clone().Unhide(authRecord.Collection().Fields.FieldNames()...).IgnoreEmailVisibility(true).PublicExport())
+	json2, _ := json.Marshal(realAuthRecord.Clone().Unhide(realAuthRecord.Collection().Fields.FieldNames()...).IgnoreEmailVisibility(true).PublicExport())
+	if string(json1) != string(json2) {
+		t.Fatalf("AuthRecord JSON does not match: expected \n%s\n, got \n%s", string(json2), string(json1))
+	}
+}
+
+func TestRealtimeBridge(t *testing.T) {
+	_, currentFile, _, _ := runtime.Caller(0)
+	config := core.BaseAppConfig{
+		DataDir:          filepath.Join(path.Dir(currentFile), "..", "tests", "data"),
+		EncryptionEnv:    "pb_test_env",
+		PostgresURL:      "postgres://user:pass@127.0.0.1:6432/postgres?sslmode=disable",
+		PostgresDataDB:   "pb_test_" + security.RandomString(5),
+		PostgresAuxDB:    "pb_test_" + security.RandomString(5) + "_aux",
+		IsRealtimeBridge: true,
+		IsDev:            false, // Turn it on in unit tests to see sql erros.
+	}
+	app1, _ := tests.NewTestAppWithConfig(config)
+	// run second app with the same config (So that they share the same postgres db)
+	config.DataDir = app1.DataDir() // use the temp dir of the first app
+	app2 := &tests.TestApp{
+		BaseApp:    core.NewBaseApp(config),
+		EventCalls: make(map[string]int),
+		TestMailer: &tests.TestMailer{},
+	}
+	err := app2.Bootstrap()
+	if err != nil {
+		t.Fatalf("Failed to bootstrap app2: %v", err)
+	}
+	defer app1.Cleanup()
+	defer app2.Cleanup()
+
+	// simulate we have two running pocketbase instances
+	bridgeA, ok := newBridge(app1, ":8198")
+	if !ok {
+		t.Fatalf("Failed to create bridgeA")
+	}
+	bridgeB, ok := newBridge(app2, ":8091")
+	if !ok {
+		t.Fatalf("Failed to create bridgeB")
+	}
+
+	// wait 0.5 seconds for the bridge to initialize
+	time.Sleep(time.Second / 2)
+
+	local_client1_in_channelA := apis.NewBridgedClient(bridgeA)
+	// test client is used to capture messages sent to the ws clients
+	testClient := &TestClient{Client: local_client1_in_channelA.Client}
+	local_client1_in_channelA.Client = testClient
+
+	// client1 online
+	app1.SubscriptionsBroker().Register(local_client1_in_channelA)
+	local_client1_in_channelA.Subscribe("sub1")
+	local_client1_in_channelA.BroadcastChanges()
+
+	// wait 0.5 second for online event to be broadcasted
+	time.Sleep(time.Second / 2)
+
+	remote_client1_in_channelB_, _ := bridgeB.App().SubscriptionsBroker().ClientById(local_client1_in_channelA.Id())
+	remote_client1_in_channelB, _ := remote_client1_in_channelB_.(*apis.BridgedClient)
+
+	t.Run("Test client online events broadcasted to other servers", func(t *testing.T) {
+		// bridgeB in another pocketbase instance should receive the client online event
+		if remote_client1_in_channelB == nil {
+			t.Fatalf("Failed to find remote client by ID: %v", local_client1_in_channelA.Id())
+		}
+		if !remote_client1_in_channelB.IsRemoteClient() {
+			t.Fatalf("Expected remote client to be true, but got false")
+		}
+		if local_client1_in_channelA.IsRemoteClient() {
+			t.Fatalf("Expected local client to be false, but got true")
+		}
+		if remote_client1_in_channelB.Id() != local_client1_in_channelA.Id() {
+			t.Fatalf("Expected the client ID to be the same, but got %s and %s", remote_client1_in_channelB.Id(), local_client1_in_channelA.Id())
+		}
+	})
+
+	t.Run("Test local client message sent to local channel", func(t *testing.T) {
+		// Send message from to client1 from the same pocketbase instance
+		message := subscriptions.Message{Name: "test1", Data: []byte("Hello World!")}
+		local_client1_in_channelA.Send(message)
+		if len(testClient.SentMessages) != 1 {
+			t.Fatalf("Expected local client channel to have first message, but got empty")
+		} else {
+			msg := testClient.SentMessages[0]
+			if msg.Name != "test1" || string(msg.Data) != "Hello World!" {
+				t.Fatalf("Expected message to be 'Hello World!', but got %s", string(msg.Data))
+			}
+		}
+		if len(remote_client1_in_channelB.Channel()) != 0 {
+			t.Fatalf("Expected remote client channel to be empty, but got %d messages", len(remote_client1_in_channelB.Channel()))
+		}
+	})
+
+	t.Run("Test remote client message sent to remote channel", func(t *testing.T) {
+		// send message to client1 from different pocketbase instance
+		message := subscriptions.Message{Name: "test2", Data: []byte("Hello World!")}
+		remote_client1_in_channelB.Send(message)
+		time.Sleep(time.Second * 5) // wait for the message to be sent
+		if len(testClient.SentMessages) != 2 {
+			t.Fatalf("Expected local client channel to have second message, but got empty")
+		} else {
+			msg := testClient.SentMessages[1]
+			if msg.Name != "test2" || string(msg.Data) != "Hello World!" {
+				t.Fatalf("Expected message to be 'Hello World!', but got %s", string(msg.Data))
+			}
+		}
+		if len(remote_client1_in_channelB.Channel()) != 0 {
+			t.Fatalf("Expected remote client channel to be empty, but got %d messages", len(remote_client1_in_channelB.Channel()))
+		}
+	})
+
+	t.Run("Test client auth state broadcasted to other servers", func(t *testing.T) {
+		// auth state updated in app2
+		authRecord1, err := app2.FindRecordById("users", "4q1xlclmfloku33")
+		if err != nil {
+			t.Fatalf("Failed to find record by ID: %v", err)
+		}
+		remote_client1_in_channelB.Set(apis.RealtimeClientAuthKey, authRecord1)
+		remote_client1_in_channelB.BroadcastChanges()
+
+		time.Sleep(time.Second / 2)
+
+		// then auth state should be updated in app1
+		authRecord2, ok := local_client1_in_channelA.Get(apis.RealtimeClientAuthKey).(*core.Record)
+		if !ok {
+			t.Fatalf("Failed to get auth record from local client")
+		}
+		if authRecord2.Id != authRecord1.Id {
+			t.Fatalf("Expected auth record ID to be %s, but got %s", authRecord1.Id, authRecord2.Id)
+		}
+
+		json1, _ := json.Marshal(authRecord1.Clone().Unhide(authRecord1.Collection().Fields.FieldNames()...).IgnoreEmailVisibility(true).PublicExport())
+		json2, _ := json.Marshal(authRecord2.Clone().Unhide(authRecord2.Collection().Fields.FieldNames()...).IgnoreEmailVisibility(true).PublicExport())
+		if string(json1) != string(json2) {
+			t.Fatalf("AuthRecord JSON does not match: expected \n%s\n, got \n%s", string(json2), string(json1))
+		}
+	})
+
+	t.Run("Test client offline event broadcasted to other servers", func(t *testing.T) {
+		// client1 offline
+		local_client1_in_channelA.BroadcastGoOffline()
+
+		time.Sleep(1 * time.Second)
+
+		// assume bridgeB receives the client offline notification
+		client1_not_found_in_channelB, _ := app2.SubscriptionsBroker().ClientById(local_client1_in_channelA.Id())
+		if client1_not_found_in_channelB != nil {
+			t.Fatalf("Remote client should be nil, but got: %v", client1_not_found_in_channelB)
+		}
+	})
+
+	t.Logf("Test passed")
+}
+
+func TestRealtimeBridge_ChannelOffline(t *testing.T) {
+	_, currentFile, _, _ := runtime.Caller(0)
+	config := core.BaseAppConfig{
+		DataDir:          filepath.Join(path.Dir(currentFile), "..", "tests", "data"),
+		EncryptionEnv:    "pb_test_env",
+		PostgresURL:      "postgres://user:pass@127.0.0.1:6432/postgres?sslmode=disable",
+		PostgresDataDB:   "pb_test_" + security.RandomString(5),
+		PostgresAuxDB:    "pb_test_" + security.RandomString(5) + "_aux",
+		IsRealtimeBridge: true,
+		IsDev:            false, // Turn it on in unit tests to see sql erros.
+	}
+	app1, _ := tests.NewTestAppWithConfig(config)
+	// run second app with the same config (So that they share the same postgres db)
+	config.DataDir = app1.DataDir() // use the temp dir of the first app
+	app2 := &tests.TestApp{
+		BaseApp:    core.NewBaseApp(config),
+		EventCalls: make(map[string]int),
+		TestMailer: &tests.TestMailer{},
+	}
+	err := app2.Bootstrap()
+	if err != nil {
+		t.Fatalf("Failed to bootstrap app2: %v", err)
+	}
+	defer app1.Cleanup()
+	defer app2.Cleanup()
+
+	// simulate we have two running pocketbase instances
+	bridgeA, ok := newBridge(app1, ":8198")
+	if !ok {
+		t.Fatalf("Failed to create bridgeA")
+	}
+	bridgeB, ok := newBridge(app2, ":8091")
+	if !ok {
+		t.Fatalf("Failed to create bridgeB")
+	}
+	_ = bridgeB
+
+	// wait 0.5 seconds for the bridge to initialize
+	time.Sleep(time.Second / 2)
+
+	local_client1_in_channelA := apis.NewBridgedClient(bridgeA)
+	// test client is used to capture messages sent to the ws clients
+	testClient := &TestClient{Client: local_client1_in_channelA.Client}
+	local_client1_in_channelA.Client = testClient
+
+	// client1 online
+	app1.SubscriptionsBroker().Register(local_client1_in_channelA)
+	local_client1_in_channelA.Subscribe("sub1")
+	local_client1_in_channelA.BroadcastChanges()
+
+	// wait 0.5 second for online event to be broadcasted
+	time.Sleep(time.Second / 2)
+
+	t.Run("Test channel offline event broadcasted to other servers", func(t *testing.T) {
+		if app1.SubscriptionsBroker().TotalClients() != 1 {
+			t.Fatalf("Expected 1 client in channelA, but got %d", app1.SubscriptionsBroker().TotalClients())
+		}
+		if app2.SubscriptionsBroker().TotalClients() != 1 {
+			t.Fatalf("Expected 1 client in channelB, but got %d", app2.SubscriptionsBroker().TotalClients())
+		}
+
+		// Pretend that heartbeat event in app1 stopped 1 hour ago
+		_, err := app1.DB().NewQuery(`
+			UPDATE "_realtimeChannels"
+			SET "validUntil" = now() - interval '1 hour'
+		`).Execute()
+		if err != nil {
+			t.Fatalf("Failed to update client heartbeat: %v", err)
+		}
+
+		// Now a new pocketbase instance (app3) is started.
+		// It should send heartbeat events to postgres as well as
+		// cleaning the dead realtime channels (eg: app1).
+		app3 := &tests.TestApp{
+			BaseApp:    core.NewBaseApp(config),
+			EventCalls: make(map[string]int),
+			TestMailer: &tests.TestMailer{},
+		}
+		err = app3.Bootstrap()
+		if err != nil {
+			t.Fatalf("Failed to bootstrap app2: %v", err)
+		}
+		defer app3.Cleanup()
+		_, _ = newBridge(app3, ":8092")
+
+		// wait 1 second. app3 should clean the dead channels
+		// in its heartbeat loop operations.
+		time.Sleep(time.Second)
+
+		// check if the dead channels are cleaned
+		if app1.SubscriptionsBroker().TotalClients() != 0 {
+			t.Fatalf("Expected 0 clients in app1, but got %d", app1.SubscriptionsBroker().TotalClients())
+		}
+		if app2.SubscriptionsBroker().TotalClients() != 0 {
+			t.Fatalf("Expected 0 clients in app2, but got %d", app2.SubscriptionsBroker().TotalClients())
+		}
+		if app3.SubscriptionsBroker().TotalClients() != 0 {
+			t.Fatalf("Expected 0 clients in app3, but got %d", app3.SubscriptionsBroker().TotalClients())
+		}
+	})
+
+	t.Logf("Test passed")
+}
+
+func newBridge(app core.App, addr string) (*apis.RealtimeBridge, bool) {
+
+	// Create a new RealtimeBridge instance
+	serveEvent := new(core.ServeEvent)
+	serveEvent.App = app
+	serveEvent.Server = &http.Server{Addr: addr}
+	serveEvent.Router, _ = apis.NewRouter(app) // Set to nil for this test
+
+	app.OnServe().Trigger(serveEvent, func(se *core.ServeEvent) error {
+		return se.Next()
+	})
+
+	bridge, ok := app.Store().Get(apis.RealtimeBridgeInstanceKey).(*apis.RealtimeBridge)
+	return bridge, ok
+}
+
+type TestClient struct {
+	subscriptions.Client
+	SentMessages []subscriptions.Message
+}
+
+func (c *TestClient) Send(message subscriptions.Message) {
+	// c.Client.Send(message)
+	c.SentMessages = append(c.SentMessages, message)
+}
diff --git a/server/core_backend-server/apis/realtime_bridgedclient.go b/server/core_backend-server/apis/realtime_bridgedclient.go
new file mode 100644
index 0000000..4447976
--- /dev/null
+++ b/server/core_backend-server/apis/realtime_bridgedclient.go
@@ -0,0 +1,260 @@
+package apis
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+type IBridgedClient interface {
+	subscriptions.Client
+
+	ClientSubscription() *ClientSubscription
+
+	// IsRemoteClient returns true if the client is connected to current pocketbase instance via WebSocket.
+	// It returns false if the client is connected to other pocketbase instances.
+	IsRemoteClient() bool
+
+	// BroadcastGoOffline notifies all other pocketbase instances that the client is offline.
+	BroadcastGoOffline()
+
+	// BroadcastChanges notifies all other pocketbase instances about the client's subscription changes.
+	// It also works as BroadcastGoOnline() when it is called for the first time.
+	BroadcastChanges()
+
+	// ReceiveChanges receives subscription changes from other pocketbase instances.
+	ReceiveChanges(newSubscription *ClientSubscription, authRecordJson string)
+}
+
+// ClientSubscription is stored in the _realtimeClients table in PostgreSQL.
+// Every time a new client connects to the pocketbase server, a new row is created.
+// And other pocketbase servers are notified via Postgres's Listen/Notify feature.
+type ClientSubscription struct {
+	ClientId           string   `db:"pk,clientId" json:"clientId"`
+	ChannelId          string   `db:"channelId" json:"channelId"`
+	Subscriptions      []string `db:"subscriptions" json:"subscriptions"`
+	AuthCollectionRef  string   `db:"authCollectionRef" json:"authCollectionRef"`
+	AuthRecordRef      string   `db:"authRecordRef" json:"authRecordRef"`
+	UpdatedByChannelId string   `db:"updatedByChannelId" json:"updatedByChannelId"`
+}
+
+var _ subscriptions.Client = (*BridgedClient)(nil)
+var _ IBridgedClient = (*BridgedClient)(nil)
+
+// BridgedClient defines a remote subscription client.
+type BridgedClient struct {
+	subscriptions.Client
+	bridge       IRealtimeBridge
+	subscription *ClientSubscription
+}
+
+// NewBridgedClient
+// - NewBridgedClient(bridge) creates a local client
+// - NewBridgedClient(bridge, optionalSubscription) creates a remote client
+func NewBridgedClient(bridge IRealtimeBridge, optionalSubscription ...*ClientSubscription) *BridgedClient {
+	var client subscriptions.Client
+	var subscription *ClientSubscription
+
+	if len(optionalSubscription) > 0 && optionalSubscription[0] != nil {
+		// remote client (client is connected to other pocketbase instance)
+		client = subscriptions.NewDefaultClient(optionalSubscription[0].ClientId)
+		subscription = optionalSubscription[0]
+	} else {
+		// local client (client is connected to current pocketbase instance)
+		client = subscriptions.NewDefaultClient()
+		subscription = &ClientSubscription{
+			ClientId:           client.Id(),
+			ChannelId:          bridge.SelfChannelId(),
+			Subscriptions:      []string{},
+			AuthCollectionRef:  "",
+			AuthRecordRef:      "",
+			UpdatedByChannelId: "",
+		}
+	}
+
+	return &BridgedClient{
+		bridge:       bridge,
+		Client:       client,
+		subscription: subscription,
+	}
+}
+
+func (r *BridgedClient) BroadcastGoOffline() {
+	// delete and notify
+	_, err := r.bridge.App().DB().NewQuery(`
+		WITH deleted AS (
+			DELETE FROM "_realtimeClients"
+			WHERE "clientId" = {:clientId}
+			RETURNING *
+		)
+		SELECT pg_notify('shared_bridge_channel', 'subscription_delete|' || deleted."clientId") FROM deleted;
+	`).Bind(dbx.Params{
+		"clientId": r.subscription.ClientId,
+	}).Execute()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Error deleting subscription:", err)
+		return
+	}
+}
+
+// BroadcastChanges notifies all other pocketbase instances about the client's subscription changes.
+// If it is called for the first time, it will act as `BroadcastGoOnline()`.
+// If the client has an auth record, it will send the auth record JSON to other pocketbase instances.
+func (r *BridgedClient) BroadcastChanges() {
+	if len(r.RawSubscriptions()) == 0 {
+		// treat no subscriptions as offline
+		r.BroadcastGoOffline()
+		return
+	}
+
+	// 1. clientId should not be changed
+	// 2. channelId should not be changed
+	// 3. update subscriptions
+	r.subscription.Subscriptions = r.RawSubscriptions()
+	// 4. updatedByChannelId is set to the current channelId
+	r.subscription.UpdatedByChannelId = r.bridge.SelfChannelId()
+
+	// 5. update auth collection and record refs
+	var authSQL string
+	var authParams dbx.Params
+	if record, _ := r.Get(RealtimeClientAuthKey).(*core.Record); record != nil {
+		r.subscription.AuthCollectionRef = record.Collection().Id
+		r.subscription.AuthRecordRef = record.Id
+		authSQL = fmt.Sprintf(`SELECT * FROM {{%s}} WHERE id = {:authRecordRef} LIMIT 1`, record.TableName())
+		authParams = dbx.Params{
+			"authRecordRef": record.Id,
+		}
+	} else {
+		r.subscription.AuthCollectionRef = ""
+		r.subscription.AuthRecordRef = ""
+		authSQL = "SELECT WHERE 1=0" // empty rows.
+	}
+
+	// Update using raw SQL query
+	_, err := r.bridge.App().DB().NewQuery(fmt.Sprintf(`
+		WITH
+			updated AS (
+				INSERT INTO "_realtimeClients" (
+					"clientId", "channelId", "subscriptions", "authCollectionRef", "authRecordRef", "updatedByChannelId"
+				) VALUES (
+					{:clientId}, {:channelId}, {:subscriptions}, {:authCollectionRef}, {:authRecordRef}, {:updatedByChannelId}
+				) ON CONFLICT ("clientId") DO UPDATE
+				SET "subscriptions" = EXCLUDED."subscriptions",
+					"authCollectionRef" = EXCLUDED."authCollectionRef",
+					"authRecordRef" = EXCLUDED."authRecordRef",
+					"updatedByChannelId" = EXCLUDED."updatedByChannelId"
+				RETURNING *
+			),
+			auth AS (
+				%s
+			)
+		SELECT pg_notify(
+			'shared_bridge_channel', 
+			CONCAT_WS(
+				'|',
+				'subscription_upsert', 
+				(SELECT row_to_json(u) FROM updated u)::text, 
+				COALESCE((SELECT row_to_json(a) FROM auth a)::text, '')
+			)
+		);
+	`, authSQL)).Bind(authParams).Bind(dbx.Params{
+		"clientId":             r.subscription.ClientId,
+		"channelId":            r.subscription.ChannelId,
+		"subscriptions":         r.subscription.Subscriptions,
+		"authCollectionRef":   r.subscription.AuthCollectionRef,
+		"authRecordRef":       r.subscription.AuthRecordRef,
+		"updatedByChannelId": r.subscription.UpdatedByChannelId,
+	}).Execute()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Error updating subscription:", err)
+		return
+	}
+	// other sibling servers will be notified by Postgres Listen/Notify feature
+}
+
+func (r *BridgedClient) ReceiveChanges(newSubscription *ClientSubscription, authRecordJson string) {
+	// 1. clientId should not be changed
+	// 2. channelId should not be changed
+	// 3. update subscriptions
+	r.Client.Unsubscribe() // clear previous subscriptions
+	r.Client.Subscribe(newSubscription.Subscriptions...)
+	// 4. update auth collection and record refs
+	if newSubscription.AuthRecordRef == "" || newSubscription.AuthCollectionRef == "" {
+		r.Client.Unset(RealtimeClientAuthKey)
+	} else {
+		authRecord, err := AuthRecordFromJson(r.bridge.App(), newSubscription.AuthCollectionRef, authRecordJson)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "Error unmarshalling auth record JSON:", err)
+			return
+		}
+		r.Client.Set(RealtimeClientAuthKey, authRecord)
+	}
+	// 5. updatedByChannelId should not be changed
+
+	// Finally, update the subscription
+	r.subscription = newSubscription
+}
+
+// Send sends the specified message to the client's channel (if not discarded).
+func (r *BridgedClient) Send(m subscriptions.Message) {
+	if r.IsDiscarded() {
+		return
+	}
+
+	if r.IsRemoteClient() {
+		// send to sibling servers
+		r.bridge.SendViaBridge(r.subscription.ChannelId, r.Id(), m)
+	} else {
+		// send to connected clients
+		r.Client.Send(m)
+	}
+}
+
+func (r *BridgedClient) IsRemoteClient() bool {
+	return r.subscription.ChannelId != r.bridge.SelfChannelId()
+}
+
+func (r *BridgedClient) ClientSubscription() *ClientSubscription {
+	return r.subscription
+}
+
+func AuthRecordFromJson(app core.App, authCollectionNameOrId string, authRecordJson string) (*core.Record, error) {
+	if authRecordJson == "" {
+		return nil, nil
+	}
+	collection, err := app.FindCachedCollectionByNameOrId(authCollectionNameOrId)
+	if err != nil {
+		return nil, fmt.Errorf("error finding collection by name or ID: %w", err)
+	}
+	authRecord := core.NewRecord(collection)
+
+	data := make(map[string]any)
+	_ = json.Unmarshal([]byte(authRecordJson), &data)
+	for _, field := range collection.Fields {
+		fieldName := field.GetName()
+		value, _ := field.PrepareValue(authRecord, data[fieldName])
+		authRecord.SetRaw(fieldName, value)
+	}
+	return authRecord, nil
+}
+
+func split2(s string, sep string) (string, string, bool) {
+	parts := strings.SplitN(s, sep, 2)
+	if len(parts) != 2 {
+		return "", "", false
+	}
+	return parts[0], parts[1], true
+}
+
+func split3(s string, sep string) (string, string, string, bool) {
+	parts := strings.SplitN(s, sep, 3)
+	if len(parts) != 3 {
+		return "", "", "", false
+	}
+	return parts[0], parts[1], parts[2], true
+}
diff --git a/server/core_backend-server/apis/realtime_test.go b/server/core_backend-server/apis/realtime_test.go
new file mode 100644
index 0000000..c2a4dae
--- /dev/null
+++ b/server/core_backend-server/apis/realtime_test.go
@@ -0,0 +1,889 @@
+package apis_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestRealtimeConnect(t *testing.T) {
+	scenarios := []tests.ApiScenario{
+		{
+			Method:         http.MethodGet,
+			URL:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`id:`,
+				`event:PB_CONNECT`,
+				`data:{"clientId":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRealtimeConnectRequest": 1,
+				"OnRealtimeMessageSend":    1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if len(app.SubscriptionsBroker().Clients()) != 0 {
+					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
+				}
+			},
+		},
+		{
+			Name:           "PB_CONNECT interrupt",
+			Method:         http.MethodGet,
+			URL:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRealtimeConnectRequest": 1,
+				"OnRealtimeMessageSend":    1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRealtimeMessageSend().BindFunc(func(e *core.RealtimeMessageEvent) error {
+					if e.Message.Name == "PB_CONNECT" {
+						return errors.New("PB_CONNECT error")
+					}
+					return e.Next()
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if len(app.SubscriptionsBroker().Clients()) != 0 {
+					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
+				}
+			},
+		},
+		{
+			Name:           "Skipping/ignoring messages",
+			Method:         http.MethodGet,
+			URL:            "/api/realtime",
+			Timeout:        100 * time.Millisecond,
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRealtimeConnectRequest": 1,
+				"OnRealtimeMessageSend":    1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRealtimeMessageSend().BindFunc(func(e *core.RealtimeMessageEvent) error {
+					return nil
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if len(app.SubscriptionsBroker().Clients()) != 0 {
+					t.Errorf("Expected the subscribers to be removed after connection close, found %d", len(app.SubscriptionsBroker().Clients()))
+				}
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRealtimeSubscribe(t *testing.T) {
+	client := subscriptions.NewDefaultClient()
+
+	resetClient := func() {
+		client.Unsubscribe()
+		client.Set(apis.RealtimeClientAuthKey, nil)
+	}
+
+	validSubscriptionsLimit := make([]string, 1000)
+	for i := 0; i < len(validSubscriptionsLimit); i++ {
+		validSubscriptionsLimit[i] = fmt.Sprintf(`"%d"`, i)
+	}
+	invalidSubscriptionsLimit := make([]string, 1001)
+	for i := 0; i < len(invalidSubscriptionsLimit); i++ {
+		invalidSubscriptionsLimit[i] = fmt.Sprintf(`"%d"`, i)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "missing client",
+			Method:          http.MethodPost,
+			URL:             "/api/realtime",
+			Body:            strings.NewReader(`{"clientId":"missing","subscriptions":["test1", "test2"]}`),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "empty data",
+			Method:         http.MethodPost,
+			URL:            "/api/realtime",
+			Body:           strings.NewReader(`{}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"clientId":{"code":"validation_required`,
+			},
+			NotExpectedContent: []string{
+				`"subscriptions"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "existing client with invalid subscriptions limit",
+			Method: http.MethodPost,
+			URL:    "/api/realtime",
+			Body: strings.NewReader(`{
+				"clientId": "` + client.Id() + `",
+				"subscriptions": [` + strings.Join(invalidSubscriptionsLimit, ",") + `]
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				resetClient()
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"subscriptions":{"code":"validation_length_too_long"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "existing client with valid subscriptions limit",
+			Method: http.MethodPost,
+			URL:    "/api/realtime",
+			Body: strings.NewReader(`{
+				"clientId": "` + client.Id() + `",
+				"subscriptions": [` + strings.Join(validSubscriptionsLimit, ",") + `]
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRealtimeSubscribeRequest": 1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				client.Subscribe("test0") // should be replaced
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if len(client.Subscriptions()) != len(validSubscriptionsLimit) {
+					t.Errorf("Expected %d subscriptions, got %d", len(validSubscriptionsLimit), len(client.Subscriptions()))
+				}
+				if client.HasSubscription("test0") {
+					t.Errorf("Expected old subscriptions to be replaced")
+				}
+				resetClient()
+			},
+		},
+		{
+			Name:   "existing client with invalid topic length",
+			Method: http.MethodPost,
+			URL:    "/api/realtime",
+			Body: strings.NewReader(`{
+				"clientId": "` + client.Id() + `",
+				"subscriptions": ["abc", "` + strings.Repeat("a", 2501) + `"]
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				resetClient()
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"subscriptions":{"1":{"code":"validation_length_too_long"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "existing client with valid topic length",
+			Method: http.MethodPost,
+			URL:    "/api/realtime",
+			Body: strings.NewReader(`{
+				"clientId": "` + client.Id() + `",
+				"subscriptions": ["abc", "` + strings.Repeat("a", 2500) + `"]
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRealtimeSubscribeRequest": 1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				client.Subscribe("test0")
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if len(client.Subscriptions()) != 2 {
+					t.Errorf("Expected %d subscriptions, got %d", 2, len(client.Subscriptions()))
+				}
+				if client.HasSubscription("test0") {
+					t.Errorf("Expected old subscriptions to be replaced")
+				}
+				resetClient()
+			},
+		},
+		{
+			Name:           "existing client - empty subscriptions",
+			Method:         http.MethodPost,
+			URL:            "/api/realtime",
+			Body:           strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":[]}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRealtimeSubscribeRequest": 1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				client.Subscribe("test0")
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if len(client.Subscriptions()) != 0 {
+					t.Errorf("Expected no subscriptions, got %d", len(client.Subscriptions()))
+				}
+				resetClient()
+			},
+		},
+		{
+			Name:           "existing client - 2 new subscriptions",
+			Method:         http.MethodPost,
+			URL:            "/api/realtime",
+			Body:           strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRealtimeSubscribeRequest": 1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				client.Subscribe("test0")
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				expectedSubs := []string{"test1", "test2"}
+				if len(expectedSubs) != len(client.Subscriptions()) {
+					t.Errorf("Expected subscriptions %v, got %v", expectedSubs, client.Subscriptions())
+				}
+
+				for _, s := range expectedSubs {
+					if !client.HasSubscription(s) {
+						t.Errorf("Cannot find %q subscription in %v", s, client.Subscriptions())
+					}
+				}
+				resetClient()
+			},
+		},
+		{
+			Name:   "existing client - guest -> authorized superuser",
+			Method: http.MethodPost,
+			URL:    "/api/realtime",
+			Body:   strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRealtimeSubscribeRequest": 1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				authRecord, _ := client.Get(apis.RealtimeClientAuthKey).(*core.Record)
+				if authRecord == nil || !authRecord.IsSuperuser() {
+					t.Errorf("Expected superuser auth record, got %v", authRecord)
+				}
+				resetClient()
+			},
+		},
+		{
+			Name:   "existing client - guest -> authorized regular auth record",
+			Method: http.MethodPost,
+			URL:    "/api/realtime",
+			Body:   strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRealtimeSubscribeRequest": 1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				authRecord, _ := client.Get(apis.RealtimeClientAuthKey).(*core.Record)
+				if authRecord == nil {
+					t.Errorf("Expected regular user auth record, got %v", authRecord)
+				}
+				resetClient()
+			},
+		},
+		{
+			Name:   "existing client - same auth",
+			Method: http.MethodPost,
+			URL:    "/api/realtime",
+			Body:   strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRealtimeSubscribeRequest": 1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// the same user as the auth token
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				client.Set(apis.RealtimeClientAuthKey, user)
+
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				authRecord, _ := client.Get(apis.RealtimeClientAuthKey).(*core.Record)
+				if authRecord == nil {
+					t.Errorf("Expected auth record model, got nil")
+				}
+				resetClient()
+			},
+		},
+		{
+			Name:   "existing client - mismatched auth",
+			Method: http.MethodPost,
+			URL:    "/api/realtime",
+			Body:   strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test2@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				client.Set(apis.RealtimeClientAuthKey, user)
+
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				authRecord, _ := client.Get(apis.RealtimeClientAuthKey).(*core.Record)
+				if authRecord == nil {
+					t.Errorf("Expected auth record model, got nil")
+				}
+				resetClient()
+			},
+		},
+		{
+			Name:            "existing client - unauthorized client",
+			Method:          http.MethodPost,
+			URL:             "/api/realtime",
+			Body:            strings.NewReader(`{"clientId":"` + client.Id() + `","subscriptions":["test1", "test2"]}`),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test2@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				client.Set(apis.RealtimeClientAuthKey, user)
+
+				app.SubscriptionsBroker().Register(client)
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				authRecord, _ := client.Get(apis.RealtimeClientAuthKey).(*core.Record)
+				if authRecord == nil {
+					t.Errorf("Expected auth record model, got nil")
+				}
+				resetClient()
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRealtimeAuthRecordDeleteEvent(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// init realtime handlers
+	apis.NewRouter(testApp)
+
+	authRecord1, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord2, err := testApp.FindAuthRecordByEmail("users", "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client1 := subscriptions.NewDefaultClient()
+	client1.Set(apis.RealtimeClientAuthKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client1)
+
+	client2 := subscriptions.NewDefaultClient()
+	client2.Set(apis.RealtimeClientAuthKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client2)
+
+	client3 := subscriptions.NewDefaultClient()
+	client3.Set(apis.RealtimeClientAuthKey, authRecord2)
+	testApp.SubscriptionsBroker().Register(client3)
+
+	// mock delete event
+	e := new(core.ModelEvent)
+	e.App = testApp
+	e.Type = core.ModelEventTypeDelete
+	e.Context = context.Background()
+	e.Model = authRecord1
+
+	testApp.OnModelAfterDeleteSuccess().Trigger(e)
+
+	if total := len(testApp.SubscriptionsBroker().Clients()); total != 3 {
+		t.Fatalf("Expected %d subscription clients, found %d", 3, total)
+	}
+
+	if auth := client1.Get(apis.RealtimeClientAuthKey); auth != nil {
+		t.Fatalf("[client1] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client2.Get(apis.RealtimeClientAuthKey); auth != nil {
+		t.Fatalf("[client2] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client3.Get(apis.RealtimeClientAuthKey); auth == nil || auth.(*core.Record).Id != authRecord2.Id {
+		t.Fatalf("[client3] Expected the auth state to be left unchanged, found %#v", auth)
+	}
+}
+
+func TestRealtimeAuthRecordUpdateEvent(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// init realtime handlers
+	apis.NewRouter(testApp)
+
+	authRecord1, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client := subscriptions.NewDefaultClient()
+	client.Set(apis.RealtimeClientAuthKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client)
+
+	// refetch the authRecord and change its email
+	authRecord2, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	authRecord2.SetEmail("new@example.com")
+
+	// mock update event
+	e := new(core.ModelEvent)
+	e.App = testApp
+	e.Type = core.ModelEventTypeUpdate
+	e.Context = context.Background()
+	e.Model = authRecord2
+
+	testApp.OnModelAfterUpdateSuccess().Trigger(e)
+
+	clientAuthRecord, _ := client.Get(apis.RealtimeClientAuthKey).(*core.Record)
+	if clientAuthRecord.Email() != authRecord2.Email() {
+		t.Fatalf("Expected authRecord with email %q, got %q", authRecord2.Email(), clientAuthRecord.Email())
+	}
+}
+
+// Custom auth record model struct
+// -------------------------------------------------------------------
+var _ core.Model = (*CustomUser)(nil)
+
+type CustomUser struct {
+	core.BaseModel
+
+	Email string `db:"email" json:"email"`
+}
+
+func (m *CustomUser) TableName() string {
+	return "users"
+}
+
+func findCustomUserByEmail(app core.App, email string) (*CustomUser, error) {
+	model := &CustomUser{}
+
+	err := app.ModelQuery(model).
+		AndWhere(dbx.HashExp{"email": email}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+func TestRealtimeCustomAuthModelDeleteEvent(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// init realtime handlers
+	apis.NewRouter(testApp)
+
+	authRecord1, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord2, err := testApp.FindAuthRecordByEmail("users", "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client1 := subscriptions.NewDefaultClient()
+	client1.Set(apis.RealtimeClientAuthKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client1)
+
+	client2 := subscriptions.NewDefaultClient()
+	client2.Set(apis.RealtimeClientAuthKey, authRecord1)
+	testApp.SubscriptionsBroker().Register(client2)
+
+	client3 := subscriptions.NewDefaultClient()
+	client3.Set(apis.RealtimeClientAuthKey, authRecord2)
+	testApp.SubscriptionsBroker().Register(client3)
+
+	// refetch the authRecord as CustomUser
+	customUser, err := findCustomUserByEmail(testApp, authRecord1.Email())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// delete the custom user (should unset the client auth record)
+	if err := testApp.Delete(customUser); err != nil {
+		t.Fatal(err)
+	}
+
+	if total := len(testApp.SubscriptionsBroker().Clients()); total != 3 {
+		t.Fatalf("Expected %d subscription clients, found %d", 3, total)
+	}
+
+	if auth := client1.Get(apis.RealtimeClientAuthKey); auth != nil {
+		t.Fatalf("[client1] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client2.Get(apis.RealtimeClientAuthKey); auth != nil {
+		t.Fatalf("[client2] Expected the auth state to be unset, found %#v", auth)
+	}
+
+	if auth := client3.Get(apis.RealtimeClientAuthKey); auth == nil || auth.(*core.Record).Id != authRecord2.Id {
+		t.Fatalf("[client3] Expected the auth state to be left unchanged, found %#v", auth)
+	}
+}
+
+func TestRealtimeCustomAuthModelUpdateEvent(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// init realtime handlers
+	apis.NewRouter(testApp)
+
+	authRecord, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client := subscriptions.NewDefaultClient()
+	client.Set(apis.RealtimeClientAuthKey, authRecord)
+	testApp.SubscriptionsBroker().Register(client)
+
+	// refetch the authRecord as CustomUser
+	customUser, err := findCustomUserByEmail(testApp, "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// change its email
+	customUser.Email = "new@example.com"
+	if err := testApp.Save(customUser); err != nil {
+		t.Fatal(err)
+	}
+
+	clientAuthRecord, _ := client.Get(apis.RealtimeClientAuthKey).(*core.Record)
+	if clientAuthRecord.Email() != customUser.Email {
+		t.Fatalf("Expected authRecord with email %q, got %q", customUser.Email, clientAuthRecord.Email())
+	}
+}
+
+// -------------------------------------------------------------------
+
+var _ core.Model = (*CustomModelResolve)(nil)
+
+type CustomModelResolve struct {
+	core.BaseModel
+	tableName string
+
+	/* SQLite:
+	Created string `db:"created"`
+	*/
+	// PostgreSQL:
+	Created time.Time `db:"created"`
+}
+
+func (m *CustomModelResolve) TableName() string {
+	return m.tableName
+}
+
+func TestRealtimeRecordResolve(t *testing.T) {
+	t.Parallel()
+
+	const testCollectionName = "realtime_test_collection"
+
+	testRecordId := core.GenerateDefaultRandomId()
+
+	client0 := subscriptions.NewDefaultClient()
+	client0.Subscribe(testCollectionName + "/*")
+	client0.Discard()
+	// ---
+	client1 := subscriptions.NewDefaultClient()
+	client1.Subscribe(testCollectionName + "/*")
+	// ---
+	client2 := subscriptions.NewDefaultClient()
+	client2.Subscribe(testCollectionName + "/" + testRecordId)
+	// ---
+	client3 := subscriptions.NewDefaultClient()
+	client3.Subscribe("demo1/*")
+
+	scenarios := []struct {
+		name     string
+		op       func(testApp core.App) error
+		expected map[string][]string // clientId -> [events]
+	}{
+		{
+			"core.Record",
+			func(testApp core.App) error {
+				c, err := testApp.FindCollectionByNameOrId(testCollectionName)
+				if err != nil {
+					return err
+				}
+
+				r := core.NewRecord(c)
+				r.Id = testRecordId
+
+				// create
+				err = testApp.Save(r)
+				if err != nil {
+					return err
+				}
+
+				// update
+				err = testApp.Save(r)
+				if err != nil {
+					return err
+				}
+
+				// delete
+				err = testApp.Delete(r)
+				if err != nil {
+					return err
+				}
+
+				return nil
+			},
+			map[string][]string{
+				client1.Id(): {"create", "update", "delete"},
+				client2.Id(): {"create", "update", "delete"},
+			},
+		},
+		{
+			"core.RecordProxy",
+			func(testApp core.App) error {
+				c, err := testApp.FindCollectionByNameOrId(testCollectionName)
+				if err != nil {
+					return err
+				}
+
+				r := core.NewRecord(c)
+
+				proxy := &struct {
+					core.BaseRecordProxy
+				}{}
+				proxy.SetProxyRecord(r)
+				proxy.Id = testRecordId
+
+				// create
+				err = testApp.Save(proxy)
+				if err != nil {
+					return err
+				}
+
+				// update
+				err = testApp.Save(proxy)
+				if err != nil {
+					return err
+				}
+
+				// delete
+				err = testApp.Delete(proxy)
+				if err != nil {
+					return err
+				}
+
+				return nil
+			},
+			map[string][]string{
+				client1.Id(): {"create", "update", "delete"},
+				client2.Id(): {"create", "update", "delete"},
+			},
+		},
+		{
+			"custom model struct",
+			func(testApp core.App) error {
+				m := &CustomModelResolve{tableName: testCollectionName}
+				m.Id = testRecordId
+
+				// create
+				err := testApp.Save(m)
+				if err != nil {
+					return err
+				}
+
+				// update
+				m.Created = time.Now()
+				err = testApp.Save(m)
+				if err != nil {
+					return err
+				}
+
+				// delete
+				err = testApp.Delete(m)
+				if err != nil {
+					return err
+				}
+
+				return nil
+			},
+			map[string][]string{
+				client1.Id(): {"create", "update", "delete"},
+				client2.Id(): {"create", "update", "delete"},
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
+
+			// init realtime handlers
+			apis.NewRouter(testApp)
+
+			// create new test collection with public read access
+			testCollection := core.NewBaseCollection(testCollectionName)
+			testCollection.Fields.Add(&core.AutodateField{Name: "created", OnCreate: true, OnUpdate: true})
+			testCollection.ListRule = types.Pointer("")
+			testCollection.ViewRule = types.Pointer("")
+			err := testApp.Save(testCollection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			testApp.SubscriptionsBroker().Register(client0)
+			testApp.SubscriptionsBroker().Register(client1)
+			testApp.SubscriptionsBroker().Register(client2)
+			testApp.SubscriptionsBroker().Register(client3)
+
+			var wg sync.WaitGroup
+
+			var notifications = map[string][]string{}
+
+			var mu sync.Mutex
+			notify := func(clientId string, eventData []byte) {
+				data := struct{ Action string }{}
+				_ = json.Unmarshal(eventData, &data)
+
+				mu.Lock()
+				defer mu.Unlock()
+
+				if notifications[clientId] == nil {
+					notifications[clientId] = []string{}
+				}
+				notifications[clientId] = append(notifications[clientId], data.Action)
+			}
+
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+
+				timeout := time.After(250 * time.Millisecond)
+
+				for {
+					select {
+					case e, ok := <-client0.Channel():
+						if ok {
+							notify(client0.Id(), e.Data)
+						}
+					case e, ok := <-client1.Channel():
+						if ok {
+							notify(client1.Id(), e.Data)
+						}
+					case e, ok := <-client2.Channel():
+						if ok {
+							notify(client2.Id(), e.Data)
+						}
+					case e, ok := <-client3.Channel():
+						if ok {
+							notify(client3.Id(), e.Data)
+						}
+					case <-timeout:
+						return
+					}
+				}
+			}()
+
+			err = s.op(testApp)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			wg.Wait()
+
+			if len(s.expected) != len(notifications) {
+				t.Fatalf("Expected %d notified clients, got %d:\n%v", len(s.expected), len(notifications), notifications)
+			}
+
+			for id, events := range s.expected {
+				if len(events) != len(notifications[id]) {
+					t.Fatalf("[%s] Expected %d events, got %d:\n%v\n%v", id, len(events), len(notifications[id]), s.expected, notifications)
+				}
+				for _, event := range events {
+					if !slices.Contains(notifications[id], event) {
+						t.Fatalf("[%s] Missing expected event %q in %v", id, event, notifications[id])
+					}
+				}
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth.go b/server/core_backend-server/apis/record_auth.go
new file mode 100644
index 0000000..fe960f7
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth.go
@@ -0,0 +1,79 @@
+package apis
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+// bindRecordAuthApi registers the auth record api endpoints and
+// the corresponding handlers.
+func bindRecordAuthApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	// global oauth2 subscription redirect handler
+	rg.GET("/oauth2-redirect", oauth2SubscriptionRedirect).Bind(
+		SkipSuccessActivityLog(), // skip success log as it could contain sensitive information in the url
+	)
+	// add again as POST in case of response_mode=form_post
+	rg.POST("/oauth2-redirect", oauth2SubscriptionRedirect).Bind(
+		SkipSuccessActivityLog(), // skip success log as it could contain sensitive information in the url
+	)
+
+	sub := rg.Group("/collections/{collection}")
+
+	sub.GET("/auth-methods", recordAuthMethods).Bind(
+		collectionPathRateLimit("", "listAuthMethods"),
+	)
+
+	sub.POST("/auth-refresh", recordAuthRefresh).Bind(
+		collectionPathRateLimit("", "authRefresh"),
+		RequireSameCollectionContextAuth(""),
+	)
+
+	sub.POST("/auth-with-password", recordAuthWithPassword).Bind(
+		collectionPathRateLimit("", "authWithPassword", "auth"),
+	)
+
+	sub.POST("/auth-with-oauth2", recordAuthWithOAuth2).Bind(
+		collectionPathRateLimit("", "authWithOAuth2", "auth"),
+	)
+
+	sub.POST("/request-otp", recordRequestOTP).Bind(
+		collectionPathRateLimit("", "requestOTP"),
+	)
+	sub.POST("/auth-with-otp", recordAuthWithOTP).Bind(
+		collectionPathRateLimit("", "authWithOTP", "auth"),
+	)
+
+	sub.POST("/request-password-reset", recordRequestPasswordReset).Bind(
+		collectionPathRateLimit("", "requestPasswordReset"),
+	)
+	sub.POST("/confirm-password-reset", recordConfirmPasswordReset).Bind(
+		collectionPathRateLimit("", "confirmPasswordReset"),
+	)
+
+	sub.POST("/request-verification", recordRequestVerification).Bind(
+		collectionPathRateLimit("", "requestVerification"),
+	)
+	sub.POST("/confirm-verification", recordConfirmVerification).Bind(
+		collectionPathRateLimit("", "confirmVerification"),
+	)
+
+	sub.POST("/request-email-change", recordRequestEmailChange).Bind(
+		collectionPathRateLimit("", "requestEmailChange"),
+		RequireSameCollectionContextAuth(""),
+	)
+	sub.POST("/confirm-email-change", recordConfirmEmailChange).Bind(
+		collectionPathRateLimit("", "confirmEmailChange"),
+	)
+
+	sub.POST("/impersonate/{id}", recordAuthImpersonate).Bind(RequireSuperuserAuth())
+}
+
+func findAuthCollection(e *core.RequestEvent) (*core.Collection, error) {
+	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+
+	if err != nil || !collection.IsAuth() {
+		return nil, e.NotFoundError("Missing or invalid auth collection context.", err)
+	}
+
+	return collection, nil
+}
diff --git a/server/core_backend-server/apis/record_auth_email_change_confirm.go b/server/core_backend-server/apis/record_auth_email_change_confirm.go
new file mode 100644
index 0000000..799e082
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_email_change_confirm.go
@@ -0,0 +1,122 @@
+package apis
+
+import (
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func recordConfirmEmailChange(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if collection.Name == core.CollectionNameSuperusers {
+		return e.BadRequestError("All superusers can change their emails directly.", nil)
+	}
+
+	form := newEmailChangeConfirmForm(e.App, collection)
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	authRecord, newEmail, err := form.parseToken()
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("Invalid or expired token.", err))
+	}
+
+	event := new(core.RecordConfirmEmailChangeRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = authRecord
+	event.NewEmail = newEmail
+
+	return e.App.OnRecordConfirmEmailChangeRequest().Trigger(event, func(e *core.RecordConfirmEmailChangeRequestEvent) error {
+		e.Record.SetEmail(e.NewEmail)
+		e.Record.SetVerified(true)
+
+		if err := e.App.Save(e.Record); err != nil {
+			return firstApiError(err, e.BadRequestError("Failed to confirm email change.", err))
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+func newEmailChangeConfirmForm(app core.App, collection *core.Collection) *EmailChangeConfirmForm {
+	return &EmailChangeConfirmForm{
+		app:        app,
+		collection: collection,
+	}
+}
+
+type EmailChangeConfirmForm struct {
+	app        core.App
+	collection *core.Collection
+
+	Token    string `form:"token" json:"token"`
+	Password string `form:"password" json:"password"`
+}
+
+func (form *EmailChangeConfirmForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Token, validation.Required, validation.By(form.checkToken)),
+		validation.Field(&form.Password, validation.Required, validation.Length(1, 100), validation.By(form.checkPassword)),
+	)
+}
+
+func (form *EmailChangeConfirmForm) checkToken(value any) error {
+	_, _, err := form.parseToken()
+	return err
+}
+
+func (form *EmailChangeConfirmForm) checkPassword(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil // nothing to check
+	}
+
+	authRecord, _, _ := form.parseToken()
+	if authRecord == nil || !authRecord.ValidatePassword(v) {
+		return validation.NewError("validation_invalid_password", "Missing or invalid auth record password.")
+	}
+
+	return nil
+}
+
+func (form *EmailChangeConfirmForm) parseToken() (*core.Record, string, error) {
+	// check token payload
+	claims, _ := security.ParseUnverifiedJWT(form.Token)
+	newEmail, _ := claims[core.TokenClaimNewEmail].(string)
+	if newEmail == "" {
+		return nil, "", validation.NewError("validation_invalid_token_payload", "Invalid token payload - newEmail must be set.")
+	}
+
+	// ensure that there aren't other users with the new email
+	_, err := form.app.FindAuthRecordByEmail(form.collection, newEmail)
+	if err == nil {
+		return nil, "", validation.NewError("validation_existing_token_email", "The new email address is already registered: "+newEmail)
+	}
+
+	// verify that the token is not expired and its signature is valid
+	authRecord, err := form.app.FindAuthRecordByToken(form.Token, core.TokenTypeEmailChange)
+	if err != nil {
+		return nil, "", validation.NewError("validation_invalid_token", "Invalid or expired token.")
+	}
+
+	if authRecord.Collection().Id != form.collection.Id {
+		return nil, "", validation.NewError("validation_token_collection_mismatch", "The provided token is for different auth collection.")
+	}
+
+	return authRecord, newEmail, nil
+}
diff --git a/server/core_backend-server/apis/record_auth_email_change_confirm_test.go b/server/core_backend-server/apis/record_auth_email_change_confirm_test.go
new file mode 100644
index 0000000..bf56be7
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_email_change_confirm_test.go
@@ -0,0 +1,211 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordConfirmEmailChange(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "not an auth collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo1/confirm-email-change",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "empty data",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/confirm-email-change",
+			Body:           strings.NewReader(``),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":`,
+				`"token":{"code":"validation_required"`,
+				`"password":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid data",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/confirm-email-change",
+			Body:            strings.NewReader(`{"token`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired token and correct password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-email-change",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoxNjQwOTkxNjYxfQ.dff842MO0mgRTHY8dktp0dqG9-7LGQOgRuiAbQpYBls",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"token":{`,
+				`"code":"validation_invalid_token"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-email change token",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-email-change",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"token":{`,
+				`"code":"validation_invalid_token_payload"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid token and incorrect password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-email-change",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
+				"password":"1234567891"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"password":{`,
+				`"code":"validation_invalid_password"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid token and correct password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-email-change",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                 0,
+				"OnRecordConfirmEmailChangeRequest": 1,
+				"OnModelUpdate":                     1,
+				"OnModelUpdateExecute":              1,
+				"OnModelAfterUpdateSuccess":         1,
+				"OnModelValidate":                   1,
+				"OnRecordUpdate":                    1,
+				"OnRecordUpdateExecute":             1,
+				"OnRecordAfterUpdateSuccess":        1,
+				"OnRecordValidate":                  1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				_, err := app.FindAuthRecordByEmail("users", "change@example.com")
+				if err != nil {
+					t.Fatalf("Expected to find user with email %q, got error: %v", "change@example.com", err)
+				}
+			},
+		},
+		{
+			Name:   "valid token in different auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/confirm-email-change",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"token":{"code":"validation_token_collection_mismatch"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "OnRecordConfirmEmailChangeRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-email-change",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordConfirmEmailChangeRequest().BindFunc(func(e *core.RecordConfirmEmailChangeRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordConfirmEmailChangeRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:confirmEmailChange",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-email-change",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:confirmEmailChange"},
+					{MaxRequests: 0, Label: "users:confirmEmailChange"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:confirmEmailChange",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-email-change",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsInR5cGUiOiJlbWFpbENoYW5nZSIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSIsIm5ld0VtYWlsIjoiY2hhbmdlQGV4YW1wbGUuY29tIiwiZXhwIjoyNTI0NjA0NDYxfQ.Y7mVlaEPhJiNPoIvIqbIosZU4c4lEhwysOrRR8c95iU",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:confirmEmailChange"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_email_change_request.go b/server/core_backend-server/apis/record_auth_email_change_request.go
new file mode 100644
index 0000000..079b090
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_email_change_request.go
@@ -0,0 +1,92 @@
+package apis
+
+import (
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+)
+
+func recordRequestEmailChange(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if collection.Name == core.CollectionNameSuperusers {
+		return e.BadRequestError("All superusers can change their emails directly.", nil)
+	}
+
+	record := e.Auth
+	if record == nil {
+		return e.UnauthorizedError("The request requires valid auth record.", nil)
+	}
+
+	form := newEmailChangeRequestForm(e.App, record)
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	event := new(core.RecordRequestEmailChangeRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = record
+	event.NewEmail = form.NewEmail
+
+	return e.App.OnRecordRequestEmailChangeRequest().Trigger(event, func(e *core.RecordRequestEmailChangeRequestEvent) error {
+		if err := mails.SendRecordChangeEmail(e.App, e.Record, e.NewEmail); err != nil {
+			return firstApiError(err, e.BadRequestError("Failed to request email change.", err))
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+func newEmailChangeRequestForm(app core.App, record *core.Record) *emailChangeRequestForm {
+	return &emailChangeRequestForm{
+		app:    app,
+		record: record,
+	}
+}
+
+type emailChangeRequestForm struct {
+	app    core.App
+	record *core.Record
+
+	NewEmail string `form:"newEmail" json:"newEmail"`
+}
+
+func (form *emailChangeRequestForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.NewEmail,
+			validation.Required,
+			validation.Length(1, 255),
+			is.EmailFormat,
+			validation.NotIn(form.record.Email()),
+			validation.By(form.checkUniqueEmail),
+		),
+	)
+}
+
+func (form *emailChangeRequestForm) checkUniqueEmail(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil
+	}
+
+	found, _ := form.app.FindAuthRecordByEmail(form.record.Collection(), v)
+	if found != nil && found.Id != form.record.Id {
+		return validation.NewError("validation_invalid_new_email", "Invalid new email address.")
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/apis/record_auth_email_change_request_test.go b/server/core_backend-server/apis/record_auth_email_change_request_test.go
new file mode 100644
index 0000000..ef39e0c
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_email_change_request_test.go
@@ -0,0 +1,195 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordRequestEmailChange(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/request-email-change",
+			Body:            strings.NewReader(`{"newEmail":"change@example.com"}`),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "not an auth collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo1/request-email-change",
+			Body:            strings.NewReader(`{"newEmail":"change@example.com"}`),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "record authentication but from different auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/request-email-change",
+			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superuser authentication",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-email-change",
+			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "invalid data",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-email-change",
+			Body:   strings.NewReader(`{"newEmail`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "empty data",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-email-change",
+			Body:   strings.NewReader(`{}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":`,
+				`"newEmail":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid data (existing email)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-email-change",
+			Body:   strings.NewReader(`{"newEmail":"test2@example.com"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":`,
+				`"newEmail":{"code":"validation_invalid_new_email"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid data (new email)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-email-change",
+			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                 0,
+				"OnRecordRequestEmailChangeRequest": 1,
+				"OnMailerSend":                      1,
+				"OnMailerRecordEmailChangeSend":     1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if !strings.Contains(app.TestMailer.LastMessage().HTML, "/auth/confirm-email-change") {
+					t.Fatalf("Expected email change email, got\n%v", app.TestMailer.LastMessage().HTML)
+				}
+			},
+		},
+		{
+			Name:   "OnRecordRequestEmailChangeRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-email-change",
+			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordRequestEmailChangeRequest().BindFunc(func(e *core.RecordRequestEmailChangeRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordRequestEmailChangeRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:requestEmailChange",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-email-change",
+			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:requestEmailChange"},
+					{MaxRequests: 0, Label: "users:requestEmailChange"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:requestEmailChange",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-email-change",
+			Body:   strings.NewReader(`{"newEmail":"change@example.com"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:requestEmailChange"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_impersonate.go b/server/core_backend-server/apis/record_auth_impersonate.go
new file mode 100644
index 0000000..c198205
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_impersonate.go
@@ -0,0 +1,54 @@
+package apis
+
+import (
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// note: for now allow superusers but it may change in the future to allow access
+// also to users with "Manage API" rule access depending on the use cases that will arise
+func recordAuthImpersonate(e *core.RequestEvent) error {
+	if !e.HasSuperuserAuth() {
+		return e.ForbiddenError("", nil)
+	}
+
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	record, err := e.App.FindRecordById(collection, e.Request.PathValue("id"))
+	if err != nil {
+		return e.NotFoundError("", err)
+	}
+
+	form := &impersonateForm{}
+	if err = e.BindBody(form); err != nil {
+		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	}
+	if err = form.validate(); err != nil {
+		return e.BadRequestError("An error occurred while validating the submitted data.", err)
+	}
+
+	token, err := record.NewStaticAuthToken(time.Duration(form.Duration) * time.Second)
+	if err != nil {
+		e.InternalServerError("Failed to generate static auth token", err)
+	}
+
+	return recordAuthResponse(e, record, token, "", nil)
+}
+
+// -------------------------------------------------------------------
+
+type impersonateForm struct {
+	// Duration is the optional custom token duration in seconds.
+	Duration int64 `form:"duration" json:"duration"`
+}
+
+func (form *impersonateForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Duration, validation.Min(0)),
+	)
+}
diff --git a/server/core_backend-server/apis/record_auth_impersonate_test.go b/server/core_backend-server/apis/record_auth_impersonate_test.go
new file mode 100644
index 0000000..a5f2dc1
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_impersonate_test.go
@@ -0,0 +1,109 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordAuthImpersonate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/impersonate/4q1xlclmfloku33",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as different user",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.GfJo6EHIobgas_AXt-M-tj5IoQendPnrkMSe9ExuSEY",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as the same user",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"record":{`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields should remain hidden even though we are authenticated as superuser
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordAuthRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:   "authorized as superuser with custom invalid duration",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body:           strings.NewReader(`{"duration":-1}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"duration":{`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser with custom valid duration",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/impersonate/4q1xlclmfloku33",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body:           strings.NewReader(`{"duration":100}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"record":{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordAuthRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_methods.go b/server/core_backend-server/apis/record_auth_methods.go
new file mode 100644
index 0000000..0c54948
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_methods.go
@@ -0,0 +1,186 @@
+package apis
+
+import (
+	"log/slog"
+	"net/http"
+	"slices"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"golang.org/x/oauth2"
+)
+
+type otpResponse struct {
+	Enabled  bool  `json:"enabled"`
+	Duration int64 `json:"duration"` // in seconds
+}
+
+type mfaResponse struct {
+	Enabled  bool  `json:"enabled"`
+	Duration int64 `json:"duration"` // in seconds
+}
+
+type passwordResponse struct {
+	IdentityFields []string `json:"identityFields"`
+	Enabled        bool     `json:"enabled"`
+}
+
+type oauth2Response struct {
+	Providers []providerInfo `json:"providers"`
+	Enabled   bool           `json:"enabled"`
+}
+
+type providerInfo struct {
+	Name        string `json:"name"`
+	DisplayName string `json:"displayName"`
+	State       string `json:"state"`
+	AuthURL     string `json:"authURL"`
+
+	// @todo
+	// deprecated: use AuthURL instead
+	// AuthUrl will be removed after dropping v0.22 support
+	AuthUrl string `json:"authUrl"`
+
+	// technically could be omitted if the provider doesn't support PKCE,
+	// but to avoid breaking existing typed clients we'll return them as empty string
+	CodeVerifier        string `json:"codeVerifier"`
+	CodeChallenge       string `json:"codeChallenge"`
+	CodeChallengeMethod string `json:"codeChallengeMethod"`
+}
+
+type authMethodsResponse struct {
+	Password passwordResponse `json:"password"`
+	OAuth2   oauth2Response   `json:"oauth2"`
+	MFA      mfaResponse      `json:"mfa"`
+	OTP      otpResponse      `json:"otp"`
+
+	// legacy fields
+	// @todo remove after dropping v0.22 support
+	AuthProviders    []providerInfo `json:"authProviders"`
+	UsernamePassword bool           `json:"usernamePassword"`
+	EmailPassword    bool           `json:"emailPassword"`
+}
+
+func (amr *authMethodsResponse) fillLegacyFields() {
+	amr.EmailPassword = amr.Password.Enabled && slices.Contains(amr.Password.IdentityFields, "email")
+
+	amr.UsernamePassword = amr.Password.Enabled && slices.Contains(amr.Password.IdentityFields, "username")
+
+	if amr.OAuth2.Enabled {
+		amr.AuthProviders = amr.OAuth2.Providers
+	}
+}
+
+func recordAuthMethods(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	result := authMethodsResponse{
+		Password: passwordResponse{
+			IdentityFields: make([]string, 0, len(collection.PasswordAuth.IdentityFields)),
+		},
+		OAuth2: oauth2Response{
+			Providers: make([]providerInfo, 0, len(collection.OAuth2.Providers)),
+		},
+		OTP: otpResponse{
+			Enabled: collection.OTP.Enabled,
+		},
+		MFA: mfaResponse{
+			Enabled: collection.MFA.Enabled,
+		},
+	}
+
+	if collection.PasswordAuth.Enabled {
+		result.Password.Enabled = true
+		result.Password.IdentityFields = collection.PasswordAuth.IdentityFields
+	}
+
+	if collection.OTP.Enabled {
+		result.OTP.Duration = collection.OTP.Duration
+	}
+
+	if collection.MFA.Enabled {
+		result.MFA.Duration = collection.MFA.Duration
+	}
+
+	if !collection.OAuth2.Enabled {
+		result.fillLegacyFields()
+
+		return e.JSON(http.StatusOK, result)
+	}
+
+	result.OAuth2.Enabled = true
+
+	providers := make(map[string]auth.Provider)
+	for _, config := range collection.OAuth2.Providers {
+		provider, err := config.InitProvider()
+		if err != nil {
+			e.App.Logger().Debug(
+				"Failed to setup OAuth2 provider",
+				slog.String("name", config.Name),
+				slog.String("error", err.Error()),
+			)
+			continue // skip provider
+		}
+		providers[config.Name] = provider
+	}
+
+	for _, providerName := range auth.ProgrammaticEnabledProviders[collection.Name] {
+		providerFunc, ok := auth.Providers[providerName]
+		if !ok {
+			e.App.Logger().Debug(
+				"Failed to find programmatic provider",
+				slog.String("name", providerName),
+			)
+			continue
+		}
+		providers[providerName] = providerFunc()
+	}
+
+	for providerName, provider := range providers {
+		info := providerInfo{
+			Name:        providerName,
+			DisplayName: provider.DisplayName(),
+			State:       security.RandomString(30),
+		}
+
+		if info.DisplayName == "" {
+			info.DisplayName = providerName
+		}
+
+		urlOpts := []oauth2.AuthCodeOption{}
+
+		// custom providers url options
+		switch providerName {
+		case auth.NameAppleWeb:
+			// see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_js/incorporating_sign_in_with_apple_into_other_platforms#3332113
+			urlOpts = append(urlOpts, oauth2.SetAuthURLParam("response_mode", "form_post"))
+		}
+
+		if provider.PKCE() {
+			info.CodeVerifier = security.RandomString(43)
+			info.CodeChallenge = security.S256Challenge(info.CodeVerifier)
+			info.CodeChallengeMethod = "S256"
+			urlOpts = append(urlOpts,
+				oauth2.SetAuthURLParam("code_challenge", info.CodeChallenge),
+				oauth2.SetAuthURLParam("code_challenge_method", info.CodeChallengeMethod),
+			)
+		}
+
+		info.AuthURL = provider.BuildAuthURL(
+			info.State,
+			urlOpts...,
+		) + "&redirect_uri=" // empty redirect_uri so that users can append their redirect url
+
+		info.AuthUrl = info.AuthURL
+
+		result.OAuth2.Providers = append(result.OAuth2.Providers, info)
+	}
+
+	result.fillLegacyFields()
+
+	return e.JSON(http.StatusOK, result)
+}
diff --git a/server/core_backend-server/apis/record_auth_methods_test.go b/server/core_backend-server/apis/record_auth_methods_test.go
new file mode 100644
index 0000000..ec62468
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_methods_test.go
@@ -0,0 +1,106 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordAuthMethodsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "missing collection",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/missing/auth-methods",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "non auth collection",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/demo1/auth-methods",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "auth collection with none auth methods allowed",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/nologin/auth-methods",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"password":{"identityFields":[],"enabled":false}`,
+				`"oauth2":{"providers":[],"enabled":false}`,
+				`"mfa":{"enabled":false,"duration":0}`,
+				`"otp":{"enabled":false,"duration":0}`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:           "auth collection with all auth methods allowed",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/users/auth-methods",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"password":{"identityFields":["email","username"],"enabled":true}`,
+				`"mfa":{"enabled":true,"duration":1800}`,
+				`"otp":{"enabled":true,"duration":300}`,
+				`"oauth2":{`,
+				`"providers":[{`,
+				`"name":"google"`,
+				`"name":"gitlab"`,
+				`"state":`,
+				`"displayName":`,
+				`"codeVerifier":`,
+				`"codeChallenge":`,
+				`"codeChallengeMethod":`,
+				`"authURL":`,
+				`redirect_uri="`, // ensures that the redirect_uri is the last url param
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - nologin:listAuthMethods",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/auth-methods",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:listAuthMethods"},
+					{MaxRequests: 0, Label: "nologin:listAuthMethods"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:listAuthMethods",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/auth-methods",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:listAuthMethods"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_otp_request.go b/server/core_backend-server/apis/record_auth_otp_request.go
new file mode 100644
index 0000000..6cc5ff7
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_otp_request.go
@@ -0,0 +1,127 @@
+package apis
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func recordRequestOTP(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if !collection.OTP.Enabled {
+		return e.ForbiddenError("The collection is not configured to allow OTP authentication.", nil)
+	}
+
+	form := &createOTPForm{}
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	record, err := e.App.FindAuthRecordByEmail(collection, form.Email)
+
+	// ignore not found errors to allow custom record find implementations
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return e.InternalServerError("", err)
+	}
+
+	event := new(core.RecordCreateOTPRequestEvent)
+	event.RequestEvent = e
+	event.Password = security.RandomStringWithAlphabet(collection.OTP.Length, "1234567890")
+	event.Collection = collection
+	event.Record = record
+
+	originalApp := e.App
+
+	return e.App.OnRecordRequestOTPRequest().Trigger(event, func(e *core.RecordCreateOTPRequestEvent) error {
+		if e.Record == nil {
+			// write a dummy 200 response as a very rudimentary emails enumeration "protection"
+			e.JSON(http.StatusOK, map[string]string{
+				"otpId": core.GenerateDefaultRandomId(),
+			})
+
+			return fmt.Errorf("missing or invalid %s OTP auth record with email %s", collection.Name, form.Email)
+		}
+
+		var otp *core.OTP
+
+		// limit the new OTP creations for a single user
+		if !e.App.IsDev() {
+			otps, err := e.App.FindAllOTPsByRecord(e.Record)
+			if err != nil {
+				return firstApiError(err, e.InternalServerError("Failed to fetch previous record OTPs.", err))
+			}
+
+			totalRecent := 0
+			for _, existingOTP := range otps {
+				if !existingOTP.HasExpired(collection.OTP.DurationTime()) {
+					totalRecent++
+				}
+				// use the last issued one
+				if totalRecent > 9 {
+					otp = otps[0] // otps are DESC sorted
+					e.App.Logger().Warn(
+						"Too many OTP requests - reusing the last issued",
+						"email", form.Email,
+						"recordId", e.Record.Id,
+						"otpId", existingOTP.Id,
+					)
+					break
+				}
+			}
+		}
+
+		if otp == nil {
+			// create new OTP
+			// ---
+			otp = core.NewOTP(e.App)
+			otp.SetCollectionRef(e.Record.Collection().Id)
+			otp.SetRecordRef(e.Record.Id)
+			otp.SetPassword(e.Password)
+			err = e.App.Save(otp)
+			if err != nil {
+				return err
+			}
+
+			// send OTP email
+			// (in the background as a very basic timing attacks and emails enumeration protection)
+			// ---
+			routine.FireAndForget(func() {
+				err = mails.SendRecordOTP(originalApp, e.Record, otp.Id, e.Password)
+				if err != nil {
+					originalApp.Logger().Error("Failed to send OTP email", "error", errors.Join(err, originalApp.Delete(otp)))
+				}
+			})
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, map[string]string{"otpId": otp.Id})
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+type createOTPForm struct {
+	Email string `form:"email" json:"email"`
+}
+
+func (form createOTPForm) validate() error {
+	return validation.ValidateStruct(&form,
+		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.EmailFormat),
+	)
+}
diff --git a/server/core_backend-server/apis/record_auth_otp_request_test.go b/server/core_backend-server/apis/record_auth_otp_request_test.go
new file mode 100644
index 0000000..5a262d7
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_otp_request_test.go
@@ -0,0 +1,316 @@
+package apis_test
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestRecordRequestOTP(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "not an auth collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo1/request-otp",
+			Body:            strings.NewReader(`{"email":"test@example.com"}`),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth collection with disabled otp",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-otp",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				usersCol.OTP.Enabled = false
+
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "empty body",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/request-otp",
+			Body:            strings.NewReader(``),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid body",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/request-otp",
+			Body:            strings.NewReader(`{"email`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "invalid request data",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-otp",
+			Body:           strings.NewReader(`{"email":"invalid"}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"email":{"code":"validation_is_email`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:           "missing auth record",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-otp",
+			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"otpId":"`, // some fake random generated string
+			},
+			ExpectedEvents: map[string]int{
+				"*":                         0,
+				"OnRecordRequestOTPRequest": 1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 0 {
+					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
+				}
+			},
+		},
+		{
+			Name:   "existing auth record (with < 9 non-expired)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-otp",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:  100 * time.Millisecond,
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// insert 8 non-expired and 2 expired
+				for i := 0; i < 10; i++ {
+					otp := core.NewOTP(app)
+					otp.Id = "otp_" + strconv.Itoa(i)
+					otp.SetCollectionRef(user.Collection().Id)
+					otp.SetRecordRef(user.Id)
+					otp.SetPassword("123456")
+					if i >= 8 {
+						expiredDate := types.NowDateTime().AddDate(-3, 0, 0)
+						otp.SetRaw("created", expiredDate)
+						otp.SetRaw("updated", expiredDate)
+					}
+					if err := app.SaveNoValidate(otp); err != nil {
+						t.Fatal(err)
+					}
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"otpId":"`,
+			},
+			NotExpectedContent: []string{
+				`"otpId":"otp_`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordRequestOTPRequest":  1,
+				"OnMailerSend":               1,
+				"OnMailerRecordOTPSend":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnModelValidate":            2, // + 1 for the OTP update after the email send
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordValidate":           2,
+				// OTP update
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 1 {
+					t.Fatalf("Expected 1 email, got %d", app.TestMailer.TotalSend())
+				}
+
+				// ensure that sentTo is set
+				otps, err := app.FindRecordsByFilter(core.CollectionNameOTPs, "sentTo='test@example.com'", "", 0, 0)
+				if err != nil || len(otps) != 1 {
+					t.Fatalf("Expected to find 1 OTP with sentTo %q, found %d", "test@example.com", len(otps))
+				}
+			},
+		},
+		{
+			Name:   "existing auth record with intercepted email (with < 9 non-expired)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-otp",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:  100 * time.Millisecond,
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// prevent email sent
+				app.OnMailerRecordOTPSend("users").BindFunc(func(e *core.MailerRecordEvent) error {
+					return nil
+				})
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"otpId":"`,
+			},
+			NotExpectedContent: []string{
+				`"otpId":"otp_`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordRequestOTPRequest":  1,
+				"OnMailerRecordOTPSend":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 0 {
+					t.Fatalf("Expected 0 emails, got %d", app.TestMailer.TotalSend())
+				}
+
+				// ensure that there is no OTP with user email as sentTo
+				otps, err := app.FindRecordsByFilter(core.CollectionNameOTPs, "sentTo='test@example.com'", "", 0, 0)
+				if err != nil || len(otps) != 0 {
+					t.Fatalf("Expected to find 0 OTPs with sentTo %q, found %d", "test@example.com", len(otps))
+				}
+			},
+		},
+		{
+			Name:   "existing auth record (with > 9 non-expired)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-otp",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:  100 * time.Millisecond,
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// insert 10 non-expired
+				for i := 0; i < 10; i++ {
+					otp := core.NewOTP(app)
+					otp.Id = "otp_" + strconv.Itoa(i)
+					otp.SetCollectionRef(user.Collection().Id)
+					otp.SetRecordRef(user.Id)
+					otp.SetPassword("123456")
+					if err := app.SaveNoValidate(otp); err != nil {
+						t.Fatal(err)
+					}
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"otpId":"otp_9"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                         0,
+				"OnRecordRequestOTPRequest": 1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 0 {
+					t.Fatalf("Expected 0 sent emails, got %d", app.TestMailer.TotalSend())
+				}
+			},
+		},
+		{
+			Name:   "OnRecordRequestOTPRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-otp",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:  100 * time.Millisecond,
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordRequestOTPRequest().BindFunc(func(e *core.RecordCreateOTPRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordRequestOTPRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:requestOTP",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-otp",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:requestOTP"},
+					{MaxRequests: 0, Label: "users:requestOTP"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:requestOTP",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-otp",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:requestOTP"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_password_reset_confirm.go b/server/core_backend-server/apis/record_auth_password_reset_confirm.go
new file mode 100644
index 0000000..2d3e470
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_password_reset_confirm.go
@@ -0,0 +1,104 @@
+package apis
+
+import (
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+func recordConfirmPasswordReset(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	form := new(recordConfirmPasswordResetForm)
+	form.app = e.App
+	form.collection = collection
+	if err = e.BindBody(form); err != nil {
+		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	}
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	authRecord, err := e.App.FindAuthRecordByToken(form.Token, core.TokenTypePasswordReset)
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("Invalid or expired password reset token.", err))
+	}
+
+	event := new(core.RecordConfirmPasswordResetRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = authRecord
+
+	return e.App.OnRecordConfirmPasswordResetRequest().Trigger(event, func(e *core.RecordConfirmPasswordResetRequestEvent) error {
+		authRecord.SetPassword(form.Password)
+
+		if !authRecord.Verified() {
+			payload, err := security.ParseUnverifiedJWT(form.Token)
+			if err == nil && authRecord.Email() == cast.ToString(payload[core.TokenClaimEmail]) {
+				// mark as verified if the email hasn't changed
+				authRecord.SetVerified(true)
+			}
+		}
+
+		err = e.App.Save(authRecord)
+		if err != nil {
+			return firstApiError(err, e.BadRequestError("Failed to set new password.", err))
+		}
+
+		e.App.Store().Remove(getPasswordResetResendKey(authRecord))
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+type recordConfirmPasswordResetForm struct {
+	app        core.App
+	collection *core.Collection
+
+	Token           string `form:"token" json:"token"`
+	Password        string `form:"password" json:"password"`
+	PasswordConfirm string `form:"passwordConfirm" json:"passwordConfirm"`
+}
+
+func (form *recordConfirmPasswordResetForm) validate() error {
+	min := 1
+	passField, ok := form.collection.Fields.GetByName(core.FieldNamePassword).(*core.PasswordField)
+	if ok && passField != nil && passField.Min > 0 {
+		min = passField.Min
+	}
+
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Token, validation.Required, validation.By(form.checkToken)),
+		validation.Field(&form.Password, validation.Required, validation.Length(min, 255)), // the FieldPassword validator will check further the specicic length constraints
+		validation.Field(&form.PasswordConfirm, validation.Required, validation.By(validators.Equal(form.Password))),
+	)
+}
+
+func (form *recordConfirmPasswordResetForm) checkToken(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil
+	}
+
+	record, err := form.app.FindAuthRecordByToken(v, core.TokenTypePasswordReset)
+	if err != nil || record == nil {
+		return validation.NewError("validation_invalid_token", "Invalid or expired token.")
+	}
+
+	if record.Collection().Id != form.collection.Id {
+		return validation.NewError("validation_token_collection_mismatch", "The provided token is for different auth collection.")
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/apis/record_auth_password_reset_confirm_test.go b/server/core_backend-server/apis/record_auth_password_reset_confirm_test.go
new file mode 100644
index 0000000..87d1d89
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_password_reset_confirm_test.go
@@ -0,0 +1,360 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordConfirmPasswordReset(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "empty data",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/confirm-password-reset",
+			Body:           strings.NewReader(``),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"password":{"code":"validation_required"`,
+				`"passwordConfirm":{"code":"validation_required"`,
+				`"token":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid data format",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/confirm-password-reset",
+			Body:            strings.NewReader(`{"password`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired token and invalid password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.5Tm6_6amQqOlX3urAnXlEdmxwG5qQJfiTg6U0hHR1hk",
+				"password":"1234567",
+				"passwordConfirm":"7664321"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"token":{"code":"validation_invalid_token"`,
+				`"password":{"code":"validation_length_out_of_range"`,
+				`"passwordConfirm":{"code":"validation_values_mismatch"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-password reset token",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"token":{"code":"validation_invalid_token"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "non auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo1/confirm-password-reset?expand=rel,missing",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "different auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/confirm-password-reset?expand=rel,missing",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{"token":{"code":"validation_token_collection_mismatch"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid token and data (unverified user)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                   0,
+				"OnRecordConfirmPasswordResetRequest": 1,
+				"OnModelUpdate":                       1,
+				"OnModelUpdateExecute":                1,
+				"OnModelAfterUpdateSuccess":           1,
+				"OnModelValidate":                     1,
+				"OnRecordUpdate":                      1,
+				"OnRecordUpdateExecute":               1,
+				"OnRecordAfterUpdateSuccess":          1,
+				"OnRecordValidate":                    1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if user.Verified() {
+					t.Fatal("Expected the user to be unverified")
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				_, err := app.FindAuthRecordByToken(
+					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+					core.TokenTypePasswordReset,
+				)
+				if err == nil {
+					t.Fatal("Expected the password reset token to be invalidated")
+				}
+
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if !user.Verified() {
+					t.Fatal("Expected the user to be marked as verified")
+				}
+
+				if !user.ValidatePassword("1234567!") {
+					t.Fatal("Password wasn't changed")
+				}
+			},
+		},
+		{
+			Name:   "valid token and data (unverified user with different email from the one in the token)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                   0,
+				"OnRecordConfirmPasswordResetRequest": 1,
+				"OnModelUpdate":                       1,
+				"OnModelUpdateExecute":                1,
+				"OnModelAfterUpdateSuccess":           1,
+				"OnModelValidate":                     1,
+				"OnRecordUpdate":                      1,
+				"OnRecordUpdateExecute":               1,
+				"OnRecordAfterUpdateSuccess":          1,
+				"OnRecordValidate":                    1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if user.Verified() {
+					t.Fatal("Expected the user to be unverified")
+				}
+
+				oldTokenKey := user.TokenKey()
+
+				// manually change the email to check whether the verified state will be updated
+				user.SetEmail("test_update@example.com")
+				if err = app.Save(user); err != nil {
+					t.Fatalf("Failed to update user test email: %v", err)
+				}
+
+				// resave with the old token key since the email change above
+				// would change it and will make the password token invalid
+				user.SetTokenKey(oldTokenKey)
+				if err = app.Save(user); err != nil {
+					t.Fatalf("Failed to restore original user tokenKey: %v", err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				_, err := app.FindAuthRecordByToken(
+					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+					core.TokenTypePasswordReset,
+				)
+				if err == nil {
+					t.Fatalf("Expected the password reset token to be invalidated")
+				}
+
+				user, err := app.FindAuthRecordByEmail("users", "test_update@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if user.Verified() {
+					t.Fatal("Expected the user to remain unverified")
+				}
+
+				if !user.ValidatePassword("1234567!") {
+					t.Fatal("Password wasn't changed")
+				}
+			},
+		},
+		{
+			Name:   "valid token and data (verified user)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                   0,
+				"OnRecordConfirmPasswordResetRequest": 1,
+				"OnModelUpdate":                       1,
+				"OnModelUpdateExecute":                1,
+				"OnModelAfterUpdateSuccess":           1,
+				"OnModelValidate":                     1,
+				"OnRecordUpdate":                      1,
+				"OnRecordUpdateExecute":               1,
+				"OnRecordAfterUpdateSuccess":          1,
+				"OnRecordValidate":                    1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				// ensure that the user is already verified
+				user.SetVerified(true)
+				if err := app.Save(user); err != nil {
+					t.Fatalf("Failed to update user verified state")
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				_, err := app.FindAuthRecordByToken(
+					"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+					core.TokenTypePasswordReset,
+				)
+				if err == nil {
+					t.Fatal("Expected the password reset token to be invalidated")
+				}
+
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatalf("Failed to fetch confirm password user: %v", err)
+				}
+
+				if !user.Verified() {
+					t.Fatal("Expected the user to remain verified")
+				}
+
+				if !user.ValidatePassword("1234567!") {
+					t.Fatal("Password wasn't changed")
+				}
+			},
+		},
+		{
+			Name:   "OnRecordConfirmPasswordResetRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordConfirmPasswordResetRequest().BindFunc(func(e *core.RecordConfirmPasswordResetRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordConfirmPasswordResetRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:confirmPasswordReset",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:confirmPasswordReset"},
+					{MaxRequests: 0, Label: "users:confirmPasswordReset"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:confirmPasswordReset",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-password-reset",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY",
+				"password":"1234567!",
+				"passwordConfirm":"1234567!"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:confirmPasswordReset"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_password_reset_request.go b/server/core_backend-server/apis/record_auth_password_reset_request.go
new file mode 100644
index 0000000..16d7b84
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_password_reset_request.go
@@ -0,0 +1,88 @@
+package apis
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tools/routine"
+)
+
+func recordRequestPasswordReset(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if !collection.PasswordAuth.Enabled {
+		return e.BadRequestError("The collection is not configured to allow password authentication.", nil)
+	}
+
+	form := new(recordRequestPasswordResetForm)
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	record, err := e.App.FindAuthRecordByEmail(collection, form.Email)
+	if err != nil {
+		// eagerly write 204 response as a very basic measure against emails enumeration
+		e.NoContent(http.StatusNoContent)
+		return fmt.Errorf("failed to fetch %s record with email %s: %w", collection.Name, form.Email, err)
+	}
+
+	resendKey := getPasswordResetResendKey(record)
+	if e.App.Store().Has(resendKey) {
+		// eagerly write 204 response as a very basic measure against emails enumeration
+		e.NoContent(http.StatusNoContent)
+		return errors.New("try again later - you've already requested a password reset email")
+	}
+
+	event := new(core.RecordRequestPasswordResetRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = record
+
+	return e.App.OnRecordRequestPasswordResetRequest().Trigger(event, func(e *core.RecordRequestPasswordResetRequestEvent) error {
+		// run in background because we don't need to show the result to the client
+		app := e.App
+		routine.FireAndForget(func() {
+			if err := mails.SendRecordPasswordReset(app, e.Record); err != nil {
+				app.Logger().Error("Failed to send password reset email", "error", err)
+				return
+			}
+
+			app.Store().Set(resendKey, struct{}{})
+			time.AfterFunc(2*time.Minute, func() {
+				app.Store().Remove(resendKey)
+			})
+		})
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+type recordRequestPasswordResetForm struct {
+	Email string `form:"email" json:"email"`
+}
+
+func (form *recordRequestPasswordResetForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.EmailFormat),
+	)
+}
+
+func getPasswordResetResendKey(record *core.Record) string {
+	return "@limitPasswordResetEmail_" + record.Collection().Id + record.Id
+}
diff --git a/server/core_backend-server/apis/record_auth_password_reset_request_test.go b/server/core_backend-server/apis/record_auth_password_reset_request_test.go
new file mode 100644
index 0000000..0b4a348
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_password_reset_request_test.go
@@ -0,0 +1,169 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordRequestPasswordReset(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "not an auth collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo1/request-password-reset",
+			Body:            strings.NewReader(``),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "empty data",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/request-password-reset",
+			Body:            strings.NewReader(``),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid data",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/request-password-reset",
+			Body:            strings.NewReader(`{"email`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "existing auth record in a collection with disabled password login",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/nologin/request-password-reset",
+			Body:            strings.NewReader(`{"email":"test@example.com"}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "missing auth record",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-password-reset",
+			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 0 {
+					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
+				}
+			},
+		},
+		{
+			Name:           "existing auth record",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-password-reset",
+			Body:           strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                   0,
+				"OnRecordRequestPasswordResetRequest": 1,
+				"OnMailerSend":                        1,
+				"OnMailerRecordPasswordResetSend":     1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if !strings.Contains(app.TestMailer.LastMessage().HTML, "/auth/confirm-password-reset") {
+					t.Fatalf("Expected password reset email, got\n%v", app.TestMailer.LastMessage().HTML)
+				}
+			},
+		},
+		{
+			Name:           "existing auth record (after already sent)",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-password-reset",
+			Body:           strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{"*": 0},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// simulate recent verification sent
+				authRecord, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+				resendKey := "@limitPasswordResetEmail_" + authRecord.Collection().Id + authRecord.Id
+				app.Store().Set(resendKey, struct{}{})
+			},
+		},
+		{
+			Name:   "OnRecordRequestPasswordResetRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-password-reset",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordRequestPasswordResetRequest().BindFunc(func(e *core.RecordRequestPasswordResetRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordRequestPasswordResetRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:requestPasswordReset",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-password-reset",
+			Body:   strings.NewReader(`{"email":"missing@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:requestPasswordReset"},
+					{MaxRequests: 0, Label: "users:requestPasswordReset"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:requestPasswordReset",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-password-reset",
+			Body:   strings.NewReader(`{"email":"missing@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:requestPasswordReset"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_refresh.go b/server/core_backend-server/apis/record_auth_refresh.go
new file mode 100644
index 0000000..8d42962
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_refresh.go
@@ -0,0 +1,35 @@
+package apis
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+func recordAuthRefresh(e *core.RequestEvent) error {
+	record := e.Auth
+	if record == nil {
+		return e.NotFoundError("Missing auth record context.", nil)
+	}
+
+	event := new(core.RecordAuthRefreshRequestEvent)
+	event.RequestEvent = e
+	event.Collection = record.Collection()
+	event.Record = record
+
+	return e.App.OnRecordAuthRefreshRequest().Trigger(event, func(e *core.RecordAuthRefreshRequestEvent) error {
+		token := getAuthTokenFromRequest(e.RequestEvent)
+
+		// skip token renewal if the token's payload doesn't explicitly allow it (e.g. impersonate tokens)
+		claims, _ := security.ParseUnverifiedJWT(token) //
+		if v, ok := claims[core.TokenClaimRefreshable]; ok && cast.ToBool(v) {
+			var tokenErr error
+			token, tokenErr = e.Record.NewAuthToken()
+			if tokenErr != nil {
+				return e.InternalServerError("Failed to refresh auth token.", tokenErr)
+			}
+		}
+
+		return recordAuthResponse(e.RequestEvent, e.Record, token, "", nil)
+	})
+}
diff --git a/server/core_backend-server/apis/record_auth_refresh_test.go b/server/core_backend-server/apis/record_auth_refresh_test.go
new file mode 100644
index 0000000..ffca2ef
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_refresh_test.go
@@ -0,0 +1,216 @@
+package apis_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordAuthRefresh(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/auth-refresh",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superuser trying to refresh the auth of another auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-refresh",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record + not an auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo1/auth-refresh",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record + different auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-refresh?expand=rel,missing",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record + same auth collection as the token",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-refresh?expand=rel,missing",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":`,
+				`"record":`,
+				`"id":"4q1xlclmfloku33"`,
+				`"emailVisibility":false`,
+				`"email":"test@example.com"`, // the owner can always view their email address
+				`"expand":`,
+				`"rel":`,
+				`"id":"llvuca81nly1qls"`,
+			},
+			NotExpectedContent: []string{
+				`"missing":`,
+				// should return a different token
+				"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordAuthRefreshRequest": 1,
+				"OnRecordAuthRequest":        1,
+				"OnRecordEnrich":             2,
+			},
+		},
+		{
+			Name:   "auth record + same auth collection as the token but static/unrefreshable",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-refresh",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6ZmFsc2V9.4IsO6YMsR19crhwl_YWzvRH8pfq2Ri4Gv2dzGyneLak",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				// should return the same token
+				`"token":"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6ZmFsc2V9.4IsO6YMsR19crhwl_YWzvRH8pfq2Ri4Gv2dzGyneLak"`,
+				`"record":`,
+				`"id":"4q1xlclmfloku33"`,
+				`"emailVisibility":false`,
+				`"email":"test@example.com"`, // the owner can always view their email address
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordAuthRefreshRequest": 1,
+				"OnRecordAuthRequest":        1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "unverified auth record in onlyVerified collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-refresh",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im8xeTBkZDBzcGQ3ODZtZCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.Zi0yXE-CNmnbTdVaQEzYZVuECqRdn3LgEM6pmB3XWBE",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordAuthRefreshRequest": 1,
+			},
+		},
+		{
+			Name:   "verified auth record in onlyVerified collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-refresh",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":`,
+				`"record":`,
+				`"id":"gk390qegs4y47wn"`,
+				`"verified":true`,
+				`"email":"test@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordAuthRefreshRequest": 1,
+				"OnRecordAuthRequest":        1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "OnRecordAuthRefreshRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-refresh",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordAuthRefreshRequest().BindFunc(func(e *core.RecordAuthRefreshRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordAuthRefreshRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:authRefresh",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-refresh",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:authRefresh"},
+					{MaxRequests: 0, Label: "users:authRefresh"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:authRefresh",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-refresh",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:authRefresh"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_verification_confirm.go b/server/core_backend-server/apis/record_auth_verification_confirm.go
new file mode 100644
index 0000000..dcf86fb
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_verification_confirm.go
@@ -0,0 +1,102 @@
+package apis
+
+import (
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+func recordConfirmVerification(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if collection.Name == core.CollectionNameSuperusers {
+		return e.BadRequestError("All superusers are verified by default.", nil)
+	}
+
+	form := new(recordConfirmVerificationForm)
+	form.app = e.App
+	form.collection = collection
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	record, err := form.app.FindAuthRecordByToken(form.Token, core.TokenTypeVerification)
+	if err != nil {
+		return e.BadRequestError("Invalid or expired verification token.", err)
+	}
+
+	wasVerified := record.Verified()
+
+	event := new(core.RecordConfirmVerificationRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = record
+
+	return e.App.OnRecordConfirmVerificationRequest().Trigger(event, func(e *core.RecordConfirmVerificationRequestEvent) error {
+		if !wasVerified {
+			e.Record.SetVerified(true)
+
+			if err := e.App.Save(e.Record); err != nil {
+				return firstApiError(err, e.BadRequestError("An error occurred while saving the verified state.", err))
+			}
+		}
+
+		e.App.Store().Remove(getVerificationResendKey(e.Record))
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+type recordConfirmVerificationForm struct {
+	app        core.App
+	collection *core.Collection
+
+	Token string `form:"token" json:"token"`
+}
+
+func (form *recordConfirmVerificationForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Token, validation.Required, validation.By(form.checkToken)),
+	)
+}
+
+func (form *recordConfirmVerificationForm) checkToken(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil // nothing to check
+	}
+
+	claims, _ := security.ParseUnverifiedJWT(v)
+	email := cast.ToString(claims["email"])
+	if email == "" {
+		return validation.NewError("validation_invalid_token_claims", "Missing email token claim.")
+	}
+
+	record, err := form.app.FindAuthRecordByToken(v, core.TokenTypeVerification)
+	if err != nil || record == nil {
+		return validation.NewError("validation_invalid_token", "Invalid or expired token.")
+	}
+
+	if record.Collection().Id != form.collection.Id {
+		return validation.NewError("validation_token_collection_mismatch", "The provided token is for different auth collection.")
+	}
+
+	if record.Email() != email {
+		return validation.NewError("validation_token_email_mismatch", "The record email doesn't match with the requested token claims.")
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/apis/record_auth_verification_confirm_test.go b/server/core_backend-server/apis/record_auth_verification_confirm_test.go
new file mode 100644
index 0000000..ef48c7c
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_verification_confirm_test.go
@@ -0,0 +1,216 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordConfirmVerification(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "empty data",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/confirm-verification",
+			Body:           strings.NewReader(``),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"token":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid data format",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/confirm-verification",
+			Body:            strings.NewReader(`{"password`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired token",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-verification",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MTY0MDk5MTY2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.qqelNNL2Udl6K_TJ282sNHYCpASgA6SIuSVKGfBHMZU"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"token":{"code":"validation_invalid_token"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-verification token",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-verification",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InBhc3N3b3JkUmVzZXQiLCJjb2xsZWN0aW9uSWQiOiJfcGJfdXNlcnNfYXV0aF8iLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20ifQ.xR-xq1oHDy0D8Q4NDOAEyYKGHWd_swzoiSoL8FLFBHY"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"token":{"code":"validation_invalid_token"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "non auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo1/confirm-verification?expand=rel,missing",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
+			}`),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "different auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/confirm-verification?expand=rel,missing",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{"token":{"code":"validation_token_collection_mismatch"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid token",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-verification",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                  0,
+				"OnRecordConfirmVerificationRequest": 1,
+				"OnModelUpdate":                      1,
+				"OnModelValidate":                    1,
+				"OnModelUpdateExecute":               1,
+				"OnModelAfterUpdateSuccess":          1,
+				"OnRecordUpdate":                     1,
+				"OnRecordValidate":                   1,
+				"OnRecordUpdateExecute":              1,
+				"OnRecordAfterUpdateSuccess":         1,
+			},
+		},
+		{
+			Name:   "valid token (already verified)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-verification",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdDJAZXhhbXBsZS5jb20ifQ.QQmM3odNFVk6u4J4-5H8IBM3dfk9YCD7mPW-8PhBAI8"
+			}`),
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                  0,
+				"OnRecordConfirmVerificationRequest": 1,
+			},
+		},
+		{
+			Name:   "valid verification token from a collection without allowed login",
+			Method: http.MethodPost,
+			URL:    "/api/collections/nologin/confirm-verification",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6ImtwdjcwOXNrMmxxYnFrOCIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.5GmuZr4vmwk3Cb_3ZZWNxwbE75KZC-j71xxIPR9AsVw"
+			}`),
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"*":                                  0,
+				"OnRecordConfirmVerificationRequest": 1,
+				"OnModelUpdate":                      1,
+				"OnModelValidate":                    1,
+				"OnModelUpdateExecute":               1,
+				"OnModelAfterUpdateSuccess":          1,
+				"OnRecordUpdate":                     1,
+				"OnRecordValidate":                   1,
+				"OnRecordUpdateExecute":              1,
+				"OnRecordAfterUpdateSuccess":         1,
+			},
+		},
+		{
+			Name:   "OnRecordConfirmVerificationRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/confirm-verification",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6Il9wYl91c2Vyc19hdXRoXyIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.SetHpu2H-x-q4TIUz-xiQjwi7MNwLCLvSs4O0hUSp0E"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordConfirmVerificationRequest().BindFunc(func(e *core.RecordConfirmVerificationRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordConfirmVerificationRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - nologin:confirmVerification",
+			Method: http.MethodPost,
+			URL:    "/api/collections/nologin/confirm-verification",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6ImtwdjcwOXNrMmxxYnFrOCIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.5GmuZr4vmwk3Cb_3ZZWNxwbE75KZC-j71xxIPR9AsVw"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:confirmVerification"},
+					{MaxRequests: 0, Label: "nologin:confirmVerification"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:confirmVerification",
+			Method: http.MethodPost,
+			URL:    "/api/collections/nologin/confirm-verification",
+			Body: strings.NewReader(`{
+				"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6ImtwdjcwOXNrMmxxYnFrOCIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.5GmuZr4vmwk3Cb_3ZZWNxwbE75KZC-j71xxIPR9AsVw"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:confirmVerification"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_verification_request.go b/server/core_backend-server/apis/record_auth_verification_request.go
new file mode 100644
index 0000000..dbabe2d
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_verification_request.go
@@ -0,0 +1,91 @@
+package apis
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tools/routine"
+)
+
+func recordRequestVerification(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if collection.Name == core.CollectionNameSuperusers {
+		return e.BadRequestError("All superusers are verified by default.", nil)
+	}
+
+	form := new(recordRequestVerificationForm)
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	record, err := e.App.FindAuthRecordByEmail(collection, form.Email)
+	if err != nil {
+		// eagerly write 204 response as a very basic measure against emails enumeration
+		e.NoContent(http.StatusNoContent)
+		return fmt.Errorf("failed to fetch %s record with email %s: %w", collection.Name, form.Email, err)
+	}
+
+	resendKey := getVerificationResendKey(record)
+	if !record.Verified() && e.App.Store().Has(resendKey) {
+		// eagerly write 204 response as a very basic measure against emails enumeration
+		e.NoContent(http.StatusNoContent)
+		return errors.New("try again later - you've already requested a verification email")
+	}
+
+	event := new(core.RecordRequestVerificationRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = record
+
+	return e.App.OnRecordRequestVerificationRequest().Trigger(event, func(e *core.RecordRequestVerificationRequestEvent) error {
+		if e.Record.Verified() {
+			return e.NoContent(http.StatusNoContent)
+		}
+
+		// run in background because we don't need to show the result to the client
+		app := e.App
+		routine.FireAndForget(func() {
+			if err := mails.SendRecordVerification(app, e.Record); err != nil {
+				app.Logger().Error("Failed to send verification email", "error", err)
+			}
+
+			app.Store().Set(resendKey, struct{}{})
+			time.AfterFunc(2*time.Minute, func() {
+				app.Store().Remove(resendKey)
+			})
+		})
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.NoContent(http.StatusNoContent)
+		})
+	})
+}
+
+// -------------------------------------------------------------------
+
+type recordRequestVerificationForm struct {
+	Email string `form:"email" json:"email"`
+}
+
+func (form *recordRequestVerificationForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Email, validation.Required, validation.Length(1, 255), is.EmailFormat),
+	)
+}
+
+func getVerificationResendKey(record *core.Record) string {
+	return "@limitVerificationEmail_" + record.Collection().Id + record.Id
+}
diff --git a/server/core_backend-server/apis/record_auth_verification_request_test.go b/server/core_backend-server/apis/record_auth_verification_request_test.go
new file mode 100644
index 0000000..edbc7ca
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_verification_request_test.go
@@ -0,0 +1,186 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordRequestVerification(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "not an auth collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo1/request-verification",
+			Body:            strings.NewReader(``),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "empty data",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/request-verification",
+			Body:            strings.NewReader(``),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{"email":{"code":"validation_required","message":"Cannot be blank."}}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid data",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/request-verification",
+			Body:            strings.NewReader(`{"email`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "missing auth record",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-verification",
+			Body:           strings.NewReader(`{"email":"missing@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 0 {
+					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
+				}
+			},
+		},
+		{
+			Name:           "already verified auth record",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-verification",
+			Body:           strings.NewReader(`{"email":"test2@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                  0,
+				"OnRecordRequestVerificationRequest": 1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 0 {
+					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
+				}
+			},
+		},
+		{
+			Name:           "existing auth record",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-verification",
+			Body:           strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                                  0,
+				"OnRecordRequestVerificationRequest": 1,
+				"OnMailerSend":                       1,
+				"OnMailerRecordVerificationSend":     1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if !strings.Contains(app.TestMailer.LastMessage().HTML, "/auth/confirm-verification") {
+					t.Fatalf("Expected verification email, got\n%v", app.TestMailer.LastMessage().HTML)
+				}
+			},
+		},
+		{
+			Name:           "existing auth record (after already sent)",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/request-verification",
+			Body:           strings.NewReader(`{"email":"test@example.com"}`),
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*": 0,
+				// terminated before firing the event
+				// "OnRecordRequestVerificationRequest": 1,
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// simulate recent verification sent
+				authRecord, err := app.FindFirstRecordByData("users", "email", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+				resendKey := "@limitVerificationEmail_" + authRecord.Collection().Id + authRecord.Id
+				app.Store().Set(resendKey, struct{}{})
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 0 {
+					t.Fatalf("Expected zero emails, got %d", app.TestMailer.TotalSend())
+				}
+			},
+		},
+		{
+			Name:   "OnRecordRequestVerificationRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-verification",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordRequestVerificationRequest().BindFunc(func(e *core.RecordRequestVerificationRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordRequestVerificationRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:requestVerification",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-verification",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:requestVerification"},
+					{MaxRequests: 0, Label: "users:requestVerification"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:requestVerification",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/request-verification",
+			Body:   strings.NewReader(`{"email":"test@example.com"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:requestVerification"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_with_oauth2.go b/server/core_backend-server/apis/record_auth_with_oauth2.go
new file mode 100644
index 0000000..d2ac9b5
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_with_oauth2.go
@@ -0,0 +1,421 @@
+package apis
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"maps"
+	"net/http"
+	"slices"
+	"strings"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"golang.org/x/oauth2"
+)
+
+func recordAuthWithOAuth2(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if !collection.OAuth2.Enabled {
+		return e.ForbiddenError("The collection is not configured to allow OAuth2 authentication.", nil)
+	}
+
+	var fallbackAuthRecord *core.Record
+	if e.Auth != nil && e.Auth.Collection().Id == collection.Id {
+		fallbackAuthRecord = e.Auth
+	}
+
+	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextOAuth2)
+
+	form := new(recordOAuth2LoginForm)
+	form.collection = collection
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+
+	if form.RedirectUrl != "" && form.RedirectURL == "" {
+		e.App.Logger().Warn("[recordAuthWithOAuth2] redirectUrl body param is deprecated and will be removed in the future. Please replace it with redirectURL.")
+		form.RedirectURL = form.RedirectUrl
+	}
+
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+
+	// exchange token for OAuth2 user info and locate existing ExternalAuth rel
+	// ---------------------------------------------------------------
+
+	// load provider configuration
+	var provider auth.Provider
+	if slices.Contains(auth.ProgrammaticEnabledProviders[collection.Name], form.Provider) {
+		provider, err = auth.NewProviderByName(form.Provider)
+		if err != nil {
+			return firstApiError(err, e.InternalServerError("Failed to init provider "+form.Provider, err))
+		}
+	} else {
+		providerConfig, ok := collection.OAuth2.GetProviderConfig(form.Provider)
+		if !ok {
+			return e.InternalServerError("Missing or invalid provider config.", nil)
+		}
+
+		provider, err = providerConfig.InitProvider()
+		if err != nil {
+			return firstApiError(err, e.InternalServerError("Failed to init provider "+form.Provider, err))
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(e.Request.Context(), 30*time.Second)
+	defer cancel()
+
+	provider.SetContext(ctx)
+	provider.SetRedirectURL(form.RedirectURL)
+
+	var opts []oauth2.AuthCodeOption
+
+	if provider.PKCE() {
+		opts = append(opts, oauth2.SetAuthURLParam("code_verifier", form.CodeVerifier))
+	}
+
+	// fetch token
+	token, err := provider.FetchToken(form.Code, opts...)
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("Failed to fetch OAuth2 token.", err))
+	}
+
+	// fetch external auth user
+	authUser, err := provider.FetchAuthUser(token)
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("Failed to fetch OAuth2 user.", err))
+	}
+
+	// Apple currently returns the user's name only as part of the first redirect data response
+	// so we try to assign the [apis.oauth2SubscriptionRedirect] forwarded name.
+	if form.Provider == auth.NameAppleWeb && authUser.Name == "" {
+		nameKey := oauth2RedirectAppleNameStoreKeyPrefix + form.Code
+		name, ok := e.App.Store().Get(nameKey).(string)
+		if ok {
+			e.App.Store().Remove(nameKey)
+			authUser.Name = name
+		} else {
+			e.App.Logger().Debug("Missing or already removed Apple user's name")
+		}
+	}
+
+	var authRecord *core.Record
+
+	// check for existing relation with the auth collection
+	externalAuthRel, err := e.App.FindFirstExternalAuthByExpr(dbx.HashExp{
+		"collectionRef": form.collection.Id,
+		"provider":      form.Provider,
+		"providerId":    authUser.Id,
+	})
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return e.InternalServerError("Failed OAuth2 relation check.", err)
+	}
+
+	switch {
+	case err == nil && externalAuthRel != nil:
+		authRecord, err = e.App.FindRecordById(form.collection, externalAuthRel.RecordRef())
+		if err != nil {
+			return err
+		}
+	case len(auth.EquivalentProviders[form.Provider]) > 0:
+		// Special case for multiple ClientId/ClientSecret pairs for a same platform
+		// See [auth.EquivalentProviders]
+		equivalentExternalAuthRel, err := e.App.FindFirstExternalAuthByExpr(dbx.HashExp{
+			"collectionRef": form.collection.Id,
+			"provider":      list.ToInterfaceSlice(auth.EquivalentProviders[form.Provider]),
+			"providerId":    authUser.Id,
+		})
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			return e.InternalServerError("Failed OAuth2 auth record check.", err)
+		}
+		if equivalentExternalAuthRel != nil {
+			authRecord, err = e.App.FindRecordById(form.collection, equivalentExternalAuthRel.RecordRef())
+			if err != nil {
+				return err
+			}
+			break // authRecord found
+		}
+		fallthrough // authRecord not found, try other methods.
+	case fallbackAuthRecord != nil && fallbackAuthRecord.Collection().Id == form.collection.Id:
+		// fallback to the logged auth record (if any)
+		authRecord = fallbackAuthRecord
+	case authUser.Email != "":
+		// look for an existing auth record by the external auth record's email
+		authRecord, err = e.App.FindAuthRecordByEmail(form.collection.Id, authUser.Email)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			return e.InternalServerError("Failed OAuth2 auth record check.", err)
+		}
+	}
+
+	// ---------------------------------------------------------------
+
+	event := new(core.RecordAuthWithOAuth2RequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.ProviderName = form.Provider
+	event.ProviderClient = provider
+	event.OAuth2User = authUser
+	event.CreateData = form.CreateData
+	event.Record = authRecord
+	event.IsNewRecord = authRecord == nil
+
+	return e.App.OnRecordAuthWithOAuth2Request().Trigger(event, func(e *core.RecordAuthWithOAuth2RequestEvent) error {
+		if err := oauth2Submit(e, externalAuthRel); err != nil {
+			return firstApiError(err, e.BadRequestError("Failed to authenticate.", err))
+		}
+
+		// @todo revert back to struct after removing the custom auth.AuthUser marshalization
+		meta := map[string]any{}
+		rawOAuth2User, err := json.Marshal(e.OAuth2User)
+		if err != nil {
+			return err
+		}
+		err = json.Unmarshal(rawOAuth2User, &meta)
+		if err != nil {
+			return err
+		}
+		meta["isNew"] = e.IsNewRecord
+
+		return RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodOAuth2, meta)
+	})
+}
+
+// -------------------------------------------------------------------
+
+type recordOAuth2LoginForm struct {
+	collection *core.Collection
+
+	// Additional data that will be used for creating a new auth record
+	// if an existing OAuth2 account doesn't exist.
+	CreateData map[string]any `form:"createData" json:"createData"`
+
+	// The name of the OAuth2 client provider (eg. "google")
+	Provider string `form:"provider" json:"provider"`
+
+	// The authorization code returned from the initial request.
+	Code string `form:"code" json:"code"`
+
+	// The optional PKCE code verifier as part of the code_challenge sent with the initial request.
+	CodeVerifier string `form:"codeVerifier" json:"codeVerifier"`
+
+	// The redirect url sent with the initial request.
+	RedirectURL string `form:"redirectURL" json:"redirectURL"`
+
+	// @todo
+	// deprecated: use RedirectURL instead
+	// RedirectUrl will be removed after dropping v0.22 support
+	RedirectUrl string `form:"redirectUrl" json:"redirectUrl"`
+}
+
+func (form *recordOAuth2LoginForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Provider, validation.Required, validation.Length(0, 100), validation.By(form.checkProviderName)),
+		validation.Field(&form.Code, validation.Required),
+		validation.Field(&form.RedirectURL, validation.Required),
+	)
+}
+
+func (form *recordOAuth2LoginForm) checkProviderName(value any) error {
+	name, _ := value.(string)
+
+	if slices.Contains(auth.ProgrammaticEnabledProviders[form.collection.Name], name) {
+		return nil
+	}
+
+	_, ok := form.collection.OAuth2.GetProviderConfig(name)
+	if !ok {
+		return validation.NewError("validation_invalid_provider", "Provider with name {{.name}} is missing or is not enabled.").
+			SetParams(map[string]any{"name": name})
+	}
+
+	return nil
+}
+
+func oldCanAssignUsername(txApp core.App, collection *core.Collection, username string) bool {
+	// ensure that username is unique
+	index, hasUniqueue := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, collection.OAuth2.MappedFields.Username)
+	if hasUniqueue {
+		var expr dbx.Expression
+		if strings.EqualFold(index.Columns[0].Collate, "nocase") {
+			// case-insensitive search
+			expr = dbx.NewExp("username = {:username} COLLATE NOCASE", dbx.Params{"username": username})
+		} else {
+			expr = dbx.HashExp{"username": username}
+		}
+
+		var exists int
+		_ = txApp.RecordQuery(collection).Select("(1)").AndWhere(expr).Limit(1).Row(&exists)
+		if exists > 0 {
+			return false
+		}
+	}
+
+	// ensure that the value matches the pattern of the username field (if text)
+	txtField, _ := collection.Fields.GetByName(collection.OAuth2.MappedFields.Username).(*core.TextField)
+
+	return txtField != nil && txtField.ValidatePlainValue(username) == nil
+}
+
+func oauth2Submit(e *core.RecordAuthWithOAuth2RequestEvent, optExternalAuth *core.ExternalAuth) error {
+	return e.App.RunInTransaction(func(txApp core.App) error {
+		if e.Record == nil {
+			// extra check to prevent creating a superuser record via
+			// OAuth2 in case the method is used by another action
+			if e.Collection.Name == core.CollectionNameSuperusers {
+				return errors.New("superusers are not allowed to sign-up with OAuth2")
+			}
+
+			payload := maps.Clone(e.CreateData)
+			if payload == nil {
+				payload = map[string]any{}
+			}
+
+			// assign the OAuth2 user email only if the user hasn't submitted one
+			// (ignore empty/invalid values for consistency with the OAuth2->existing user update flow)
+			if v, _ := payload[core.FieldNameEmail].(string); v == "" {
+				payload[core.FieldNameEmail] = e.OAuth2User.Email
+			}
+
+			// map known fields (unless the field was explicitly submitted as part of CreateData)
+			if _, ok := payload[e.Collection.OAuth2.MappedFields.Id]; !ok && e.Collection.OAuth2.MappedFields.Id != "" {
+				payload[e.Collection.OAuth2.MappedFields.Id] = e.OAuth2User.Id
+			}
+			if _, ok := payload[e.Collection.OAuth2.MappedFields.Name]; !ok && e.Collection.OAuth2.MappedFields.Name != "" {
+				payload[e.Collection.OAuth2.MappedFields.Name] = e.OAuth2User.Name
+			}
+			if _, ok := payload[e.Collection.OAuth2.MappedFields.Username]; !ok &&
+				// no explicit username payload value and existing OAuth2 mapping
+				e.Collection.OAuth2.MappedFields.Username != "" &&
+				// extra checks for backward compatibility with earlier versions
+				oldCanAssignUsername(txApp, e.Collection, e.OAuth2User.Username) {
+				payload[e.Collection.OAuth2.MappedFields.Username] = e.OAuth2User.Username
+			}
+			if _, ok := payload[e.Collection.OAuth2.MappedFields.AvatarURL]; !ok &&
+				// no explicit avatar payload value and existing OAuth2 mapping
+				e.Collection.OAuth2.MappedFields.AvatarURL != "" &&
+				// non-empty OAuth2 avatar url
+				e.OAuth2User.AvatarURL != "" {
+				mappedField := e.Collection.Fields.GetByName(e.Collection.OAuth2.MappedFields.AvatarURL)
+				if mappedField != nil && mappedField.Type() == core.FieldTypeFile {
+					// download the avatar if the mapped field is a file
+					avatarFile, err := func() (*filesystem.File, error) {
+						ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+						defer cancel()
+						return filesystem.NewFileFromURL(ctx, e.OAuth2User.AvatarURL)
+					}()
+					if err != nil {
+						txApp.Logger().Warn("Failed to retrieve OAuth2 avatar", slog.String("error", err.Error()))
+					} else {
+						payload[e.Collection.OAuth2.MappedFields.AvatarURL] = avatarFile
+					}
+				} else {
+					// otherwise - assign the url string
+					payload[e.Collection.OAuth2.MappedFields.AvatarURL] = e.OAuth2User.AvatarURL
+				}
+			}
+
+			createdRecord, err := sendOAuth2RecordCreateRequest(txApp, e, payload)
+			if err != nil {
+				return err
+			}
+
+			e.Record = createdRecord
+
+			if e.Record.Email() == e.OAuth2User.Email && !e.Record.Verified() {
+				// mark as verified as long as it matches the OAuth2 data (even if the email is empty)
+				e.Record.SetVerified(true)
+				if err := txApp.Save(e.Record); err != nil {
+					return err
+				}
+			}
+		} else {
+			var needUpdate bool
+
+			isLoggedAuthRecord := e.Auth != nil &&
+				e.Auth.Id == e.Record.Id &&
+				e.Auth.Collection().Id == e.Record.Collection().Id
+
+			// set random password for users with unverified email
+			// (this is in case a malicious actor has registered previously with the user email)
+			if !isLoggedAuthRecord && e.Record.Email() != "" && !e.Record.Verified() {
+				e.Record.SetRandomPassword()
+				needUpdate = true
+			}
+
+			// update the existing auth record empty email if the data.OAuth2User has one
+			// (this is in case previously the auth record was created
+			// with an OAuth2 provider that didn't return an email address)
+			if e.Record.Email() == "" && e.OAuth2User.Email != "" {
+				e.Record.SetEmail(e.OAuth2User.Email)
+				needUpdate = true
+			}
+
+			// update the existing auth record verified state
+			// (only if the auth record doesn't have an email or the auth record email match with the one in data.OAuth2User)
+			if !e.Record.Verified() && (e.Record.Email() == "" || e.Record.Email() == e.OAuth2User.Email) {
+				e.Record.SetVerified(true)
+				needUpdate = true
+			}
+
+			if needUpdate {
+				if err := txApp.Save(e.Record); err != nil {
+					return err
+				}
+			}
+		}
+
+		// create ExternalAuth relation if missing
+		if optExternalAuth == nil {
+			optExternalAuth = core.NewExternalAuth(txApp)
+			optExternalAuth.SetCollectionRef(e.Record.Collection().Id)
+			optExternalAuth.SetRecordRef(e.Record.Id)
+			optExternalAuth.SetProvider(e.ProviderName)
+			optExternalAuth.SetProviderId(e.OAuth2User.Id)
+
+			if err := txApp.Save(optExternalAuth); err != nil {
+				return fmt.Errorf("failed to save linked rel: %w", err)
+			}
+		}
+
+		return nil
+	})
+}
+
+func sendOAuth2RecordCreateRequest(txApp core.App, e *core.RecordAuthWithOAuth2RequestEvent, payload map[string]any) (*core.Record, error) {
+	ir := &core.InternalRequest{
+		Method: http.MethodPost,
+		URL:    "/api/collections/" + e.Collection.Name + "/records",
+		Body:   payload,
+	}
+
+	var createdRecord *core.Record
+	response, err := processInternalRequest(txApp, e.RequestEvent, ir, core.RequestInfoContextOAuth2, func(data any) error {
+		createdRecord, _ = data.(*core.Record)
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if response.Status != http.StatusOK || createdRecord == nil {
+		return nil, errors.New("failed to create OAuth2 auth record")
+	}
+
+	return createdRecord, nil
+}
diff --git a/server/core_backend-server/apis/record_auth_with_oauth2_redirect.go b/server/core_backend-server/apis/record_auth_with_oauth2_redirect.go
new file mode 100644
index 0000000..c4ac458
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_with_oauth2_redirect.go
@@ -0,0 +1,148 @@
+package apis
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+const (
+	oauth2SubscriptionTopic               string = "@oauth2"
+	oauth2RedirectFailurePath             string = "../_/#/auth/oauth2-redirect-failure"
+	oauth2RedirectSuccessPath             string = "../_/#/auth/oauth2-redirect-success"
+	oauth2RedirectAppleNameStoreKeyPrefix string = "@redirect_name_"
+)
+
+type oauth2RedirectData struct {
+	State string `form:"state" json:"state"`
+	Code  string `form:"code" json:"code"`
+	Error string `form:"error" json:"error,omitempty"`
+
+	// returned by Apple only
+	AppleUser string `form:"user" json:"-"`
+}
+
+func oauth2SubscriptionRedirect(e *core.RequestEvent) error {
+	redirectStatusCode := http.StatusTemporaryRedirect
+	if e.Request.Method != http.MethodGet {
+		redirectStatusCode = http.StatusSeeOther
+	}
+
+	data := oauth2RedirectData{}
+
+	if e.Request.Method == http.MethodPost {
+		if err := e.BindBody(&data); err != nil {
+			e.App.Logger().Debug("Failed to read OAuth2 redirect data", "error", err)
+			return e.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+		}
+	} else {
+		query := e.Request.URL.Query()
+		data.State = query.Get("state")
+		data.Code = query.Get("code")
+		data.Error = query.Get("error")
+	}
+
+	if data.State == "" {
+		e.App.Logger().Debug("Missing OAuth2 state parameter")
+		return e.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	client, err := e.App.SubscriptionsBroker().ClientById(data.State)
+	if err != nil || client.IsDiscarded() || !client.HasSubscription(oauth2SubscriptionTopic) {
+		e.App.Logger().Debug("Missing or invalid OAuth2 subscription client", "error", err, "clientId", data.State)
+		return e.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+	defer client.Unsubscribe(oauth2SubscriptionTopic)
+
+	// temporary store the Apple user's name so that it can be later retrieved with the authWithOAuth2 call
+	// (see https://github.com/pocketbase/pocketbase/issues/7090)
+	if data.AppleUser != "" && data.Error == "" && data.Code != "" {
+		nameErr := parseAndStoreAppleRedirectName(
+			e.App,
+			oauth2RedirectAppleNameStoreKeyPrefix+data.Code,
+			data.AppleUser,
+		)
+		if nameErr != nil {
+			// non-critical error
+			e.App.Logger().Debug("Failed to parse and load Apple Redirect name data", "error", nameErr)
+		}
+	}
+
+	encodedData, err := json.Marshal(data)
+	if err != nil {
+		e.App.Logger().Debug("Failed to marshalize OAuth2 redirect data", "error", err)
+		return e.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	msg := subscriptions.Message{
+		Name: oauth2SubscriptionTopic,
+		Data: encodedData,
+	}
+
+	client.Send(msg)
+
+	if data.Error != "" || data.Code == "" {
+		e.App.Logger().Debug("Failed OAuth2 redirect due to an error or missing code parameter", "error", data.Error, "clientId", data.State)
+		return e.Redirect(redirectStatusCode, oauth2RedirectFailurePath)
+	}
+
+	return e.Redirect(redirectStatusCode, oauth2RedirectSuccessPath)
+}
+
+// parseAndStoreAppleRedirectName extracts the first and last name
+// from serializedNameData and temporary store them in the app.Store.
+//
+// This is hacky workaround to forward safely and seamlessly the Apple
+// redirect user's name back to the OAuth2 auth handler.
+//
+// Note that currently Apple is the only provider that behaves like this and
+// for now it is unnecessary to check whether the redirect is coming from Apple or not.
+//
+// Ideally this shouldn't be needed and will be removed in the future
+// once Apple adds a dedicated userinfo endpoint.
+func parseAndStoreAppleRedirectName(app core.App, nameKey string, serializedNameData string) error {
+	if serializedNameData == "" {
+		return nil
+	}
+
+	// just in case to prevent storing large strings in memory
+	if len(nameKey) > 1000 {
+		return errors.New("nameKey is too large")
+	}
+
+	// https://developer.apple.com/documentation/signinwithapple/incorporating-sign-in-with-apple-into-other-platforms#Handle-the-response
+	extracted := struct {
+		Name struct {
+			FirstName string `json:"firstName"`
+			LastName  string `json:"lastName"`
+		} `json:"name"`
+	}{}
+	if err := json.Unmarshal([]byte(serializedNameData), &extracted); err != nil {
+		return err
+	}
+
+	fullName := extracted.Name.FirstName + " " + extracted.Name.LastName
+
+	// truncate just in case to prevent storing large strings in memory
+	if len(fullName) > 150 {
+		fullName = fullName[:150]
+	}
+
+	fullName = strings.TrimSpace(fullName)
+	if fullName == "" {
+		return nil
+	}
+
+	// store (and remove)
+	app.Store().Set(nameKey, fullName)
+	time.AfterFunc(1*time.Minute, func() {
+		app.Store().Remove(nameKey)
+	})
+
+	return nil
+}
diff --git a/server/core_backend-server/apis/record_auth_with_oauth2_redirect_test.go b/server/core_backend-server/apis/record_auth_with_oauth2_redirect_test.go
new file mode 100644
index 0000000..fbf7ac3
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_with_oauth2_redirect_test.go
@@ -0,0 +1,343 @@
+package apis_test
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+func TestRecordAuthWithOAuth2Redirect(t *testing.T) {
+	t.Parallel()
+
+	clientStubs := make([]map[string]subscriptions.Client, 0, 10)
+
+	for i := 0; i < 10; i++ {
+		c1 := subscriptions.NewDefaultClient()
+
+		c2 := subscriptions.NewDefaultClient()
+		c2.Subscribe("@oauth2")
+
+		c3 := subscriptions.NewDefaultClient()
+		c3.Subscribe("test1", "@oauth2")
+
+		c4 := subscriptions.NewDefaultClient()
+		c4.Subscribe("test1", "test2")
+
+		c5 := subscriptions.NewDefaultClient()
+		c5.Subscribe("@oauth2")
+		c5.Discard()
+
+		clientStubs = append(clientStubs, map[string]subscriptions.Client{
+			"c1": c1,
+			"c2": c2,
+			"c3": c3,
+			"c4": c4,
+			"c5": c5,
+		})
+	}
+
+	checkFailureRedirect := func(t testing.TB, app *tests.TestApp, res *http.Response) {
+		loc := res.Header.Get("Location")
+		if !strings.Contains(loc, "/oauth2-redirect-failure") {
+			t.Fatalf("Expected failure redirect, got %q", loc)
+		}
+	}
+
+	checkSuccessRedirect := func(t testing.TB, app *tests.TestApp, res *http.Response) {
+		loc := res.Header.Get("Location")
+		if !strings.Contains(loc, "/oauth2-redirect-success") {
+			t.Fatalf("Expected success redirect, got %q", loc)
+		}
+	}
+
+	// note: don't exit because it is usually called as part of a separate goroutine
+	checkClientMessages := func(t testing.TB, clientId string, msg subscriptions.Message, expectedMessages map[string][]string) {
+		if len(expectedMessages[clientId]) == 0 {
+			t.Errorf("Unexpected client %q message, got %q:\n%q", clientId, msg.Name, msg.Data)
+			return
+		}
+
+		if msg.Name != "@oauth2" {
+			t.Errorf("Expected @oauth2 msg.Name, got %q", msg.Name)
+			return
+		}
+
+		for _, txt := range expectedMessages[clientId] {
+			if !strings.Contains(string(msg.Data), txt) {
+				t.Errorf("Failed to find %q in \n%s", txt, msg.Data)
+				return
+			}
+		}
+	}
+
+	beforeTestFunc := func(
+		clients map[string]subscriptions.Client,
+		expectedMessages map[string][]string,
+	) func(testing.TB, *tests.TestApp, *core.ServeEvent) {
+		return func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			for _, client := range clients {
+				app.SubscriptionsBroker().Register(client)
+			}
+
+			ctx, cancelFunc := context.WithTimeout(context.Background(), 100*time.Millisecond)
+
+			// add to the app store so that it can be cancelled manually after test completion
+			app.Store().Set("cancelFunc", cancelFunc)
+
+			go func() {
+				defer cancelFunc()
+
+				for {
+					select {
+					case msg, ok := <-clients["c1"].Channel():
+						if ok {
+							checkClientMessages(t, "c1", msg, expectedMessages)
+						} else {
+							t.Errorf("Unexpected c1 closed channel")
+						}
+					case msg, ok := <-clients["c2"].Channel():
+						if ok {
+							checkClientMessages(t, "c2", msg, expectedMessages)
+						} else {
+							t.Errorf("Unexpected c2 closed channel")
+						}
+					case msg, ok := <-clients["c3"].Channel():
+						if ok {
+							checkClientMessages(t, "c3", msg, expectedMessages)
+						} else {
+							t.Errorf("Unexpected c3 closed channel")
+						}
+					case msg, ok := <-clients["c4"].Channel():
+						if ok {
+							checkClientMessages(t, "c4", msg, expectedMessages)
+						} else {
+							t.Errorf("Unexpected c4 closed channel")
+						}
+					case _, ok := <-clients["c5"].Channel():
+						if ok {
+							t.Errorf("Expected c5 channel to be closed")
+						}
+					case <-ctx.Done():
+						for _, c := range clients {
+							c.Discard()
+						}
+						return
+					}
+				}
+			}()
+		}
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "no state query param",
+			Method:         http.MethodGet,
+			URL:            "/api/oauth2-redirect?code=123",
+			BeforeTestFunc: beforeTestFunc(clientStubs[0], nil),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+			},
+		},
+		{
+			Name:           "invalid or missing client",
+			Method:         http.MethodGet,
+			URL:            "/api/oauth2-redirect?code=123&state=missing",
+			BeforeTestFunc: beforeTestFunc(clientStubs[1], nil),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+			},
+		},
+		{
+			Name:   "no code query param",
+			Method: http.MethodGet,
+			URL:    "/api/oauth2-redirect?state=" + clientStubs[2]["c3"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[2], map[string][]string{
+				"c3": {`"state":"` + clientStubs[2]["c3"].Id(), `"code":""`},
+			}),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+
+				if clientStubs[2]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
+		},
+		{
+			Name:   "error query param",
+			Method: http.MethodGet,
+			URL:    "/api/oauth2-redirect?error=example&code=123&state=" + clientStubs[3]["c3"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[3], map[string][]string{
+				"c3": {`"state":"` + clientStubs[3]["c3"].Id(), `"code":"123"`, `"error":"example"`},
+			}),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+
+				if clientStubs[3]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
+		},
+		{
+			Name:           "discarded client with @oauth2 subscription",
+			Method:         http.MethodGet,
+			URL:            "/api/oauth2-redirect?code=123&state=" + clientStubs[4]["c5"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[4], nil),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+			},
+		},
+		{
+			Name:           "client without @oauth2 subscription",
+			Method:         http.MethodGet,
+			URL:            "/api/oauth2-redirect?code=123&state=" + clientStubs[4]["c4"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[5], nil),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkFailureRedirect(t, app, res)
+			},
+		},
+		{
+			Name:   "client with @oauth2 subscription",
+			Method: http.MethodGet,
+			URL:    "/api/oauth2-redirect?code=123&state=" + clientStubs[6]["c3"].Id(),
+			BeforeTestFunc: beforeTestFunc(clientStubs[6], map[string][]string{
+				"c3": {`"state":"` + clientStubs[6]["c3"].Id(), `"code":"123"`},
+			}),
+			ExpectedStatus: http.StatusTemporaryRedirect,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[6]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
+		},
+		{
+			Name:   "(POST) client with @oauth2 subscription",
+			Method: http.MethodPost,
+			URL:    "/api/oauth2-redirect",
+			Body:   strings.NewReader("code=123&state=" + clientStubs[7]["c3"].Id()),
+			Headers: map[string]string{
+				"content-type": "application/x-www-form-urlencoded",
+			},
+			BeforeTestFunc: beforeTestFunc(clientStubs[7], map[string][]string{
+				"c3": {`"state":"` + clientStubs[7]["c3"].Id(), `"code":"123"`},
+			}),
+			ExpectedStatus: http.StatusSeeOther,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[7]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+			},
+		},
+		{
+			Name:   "(POST) Apple user's name json (nameKey error)",
+			Method: http.MethodPost,
+			URL:    "/api/oauth2-redirect",
+			Body: strings.NewReader(url.Values{
+				"code":  []string{strings.Repeat("a", 986)},
+				"state": []string{clientStubs[8]["c3"].Id()},
+				"user": []string{
+					`{"name":{"firstName":"aaa","lastName":"` + strings.Repeat("b", 200) + `"}}`,
+				},
+			}.Encode()),
+			Headers: map[string]string{
+				"content-type": "application/x-www-form-urlencoded",
+			},
+			BeforeTestFunc: beforeTestFunc(clientStubs[8], map[string][]string{
+				"c3": {`"state":"` + clientStubs[8]["c3"].Id(), `"code":"` + strings.Repeat("a", 986) + `"`},
+			}),
+			ExpectedStatus: http.StatusSeeOther,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[8]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+
+				if storedName := app.Store().Get("@redirect_name_" + strings.Repeat("a", 986)); storedName != nil {
+					t.Fatalf("Didn't expect stored name, got %q", storedName)
+				}
+			},
+		},
+		{
+			Name:   "(POST) Apple user's name json",
+			Method: http.MethodPost,
+			URL:    "/api/oauth2-redirect",
+			Body: strings.NewReader(url.Values{
+				"code":  []string{strings.Repeat("a", 985)},
+				"state": []string{clientStubs[9]["c3"].Id()},
+				"user": []string{
+					`{"name":{"firstName":"aaa","lastName":"` + strings.Repeat("b", 200) + `"}}`,
+				},
+			}.Encode()),
+			Headers: map[string]string{
+				"content-type": "application/x-www-form-urlencoded",
+			},
+			BeforeTestFunc: beforeTestFunc(clientStubs[9], map[string][]string{
+				"c3": {`"state":"` + clientStubs[9]["c3"].Id(), `"code":"` + strings.Repeat("a", 985) + `"`},
+			}),
+			ExpectedStatus: http.StatusSeeOther,
+			ExpectedEvents: map[string]int{"*": 0},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				app.Store().Get("cancelFunc").(context.CancelFunc)()
+
+				checkSuccessRedirect(t, app, res)
+
+				if clientStubs[9]["c3"].HasSubscription("@oauth2") {
+					t.Fatalf("Expected oauth2 subscription to be removed")
+				}
+
+				storedName, _ := app.Store().Get("@redirect_name_" + strings.Repeat("a", 985)).(string)
+				expectedName := "aaa " + strings.Repeat("b", 146)
+				if storedName != expectedName {
+					t.Fatalf("Expected stored name\n%q\ngot\n%q", expectedName, storedName)
+				}
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_with_oauth2_test.go b/server/core_backend-server/apis/record_auth_with_oauth2_test.go
new file mode 100644
index 0000000..6c999f2
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_with_oauth2_test.go
@@ -0,0 +1,1813 @@
+package apis_test
+
+import (
+	"bytes"
+	"errors"
+	"image"
+	"image/png"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"golang.org/x/oauth2"
+)
+
+var _ auth.Provider = (*oauth2MockProvider)(nil)
+
+type oauth2MockProvider struct {
+	auth.BaseProvider
+
+	AuthUser *auth.AuthUser
+	Token    *oauth2.Token
+}
+
+func (p *oauth2MockProvider) FetchToken(code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error) {
+	if p.Token == nil {
+		return nil, errors.New("failed to fetch OAuth2 token")
+	}
+	return p.Token, nil
+}
+
+func (p *oauth2MockProvider) FetchAuthUser(token *oauth2.Token) (*auth.AuthUser, error) {
+	if p.AuthUser == nil {
+		return nil, errors.New("failed to fetch OAuth2 user")
+	}
+	return p.AuthUser, nil
+}
+
+func TestRecordAuthWithOAuth2(t *testing.T) {
+	t.Parallel()
+
+	// start a test server
+	server := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		buf := new(bytes.Buffer)
+		png.Encode(buf, image.Rect(0, 0, 1, 1)) // tiny 1x1 png
+		http.ServeContent(res, req, "test_avatar.png", time.Now(), bytes.NewReader(buf.Bytes()))
+	}))
+	defer server.Close()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "disabled OAuth2 auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/nologin/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider":     "test",
+				"code":         "123",
+				"codeVerifier": "456",
+				"redirectURL":  "https://example.com"
+			}`),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid body",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/auth-with-oauth2",
+			Body:            strings.NewReader(`{"provider"`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "trigger form validations (missing provider)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "missing"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"provider":`,
+				`"code":`,
+				`"redirectURL":`,
+			},
+			NotExpectedContent: []string{
+				`"codeVerifier":`, // should be optional
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "trigger form validations (existing but disabled provider)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "apple_web"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"provider":`,
+				`"code":`,
+				`"redirectURL":`,
+			},
+			NotExpectedContent: []string{
+				`"codeVerifier":`, // should be optional
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "existing linked OAuth2 (unverified user)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com",
+				"createData": {
+					"name": "test_new"
+				}
+			}`),
+			Headers: map[string]string{
+				// users, test2@example.com
+				// (auth with some other user from the same collection to ensure that it is ignored)
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.GfJo6EHIobgas_AXt-M-tj5IoQendPnrkMSe9ExuSEY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if user.Verified() {
+					t.Fatalf("Expected user %q to be unverified", user.Email())
+				}
+
+				// ensure that the old password works
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				user.Collection().MFA.Enabled = false
+				user.Collection().OAuth2.Enabled = true
+				user.Collection().OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+
+				// stub linked provider
+				ea := core.NewExternalAuth(app)
+				ea.SetCollectionRef(user.Collection().Id)
+				ea.SetRecordRef(user.Id)
+				ea.SetProvider("test")
+				ea.SetProviderId("test_id")
+				if err := app.Save(ea); err != nil {
+					t.Fatal(err)
+				}
+
+				// test at least once that the correct request info context is properly loaded
+				app.OnRecordAuthRequest().BindFunc(func(e *core.RecordAuthRequestEvent) error {
+					info, err := e.RequestInfo()
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					if info.Context != core.RequestInfoContextOAuth2 {
+						t.Fatalf("Expected request context %q, got %q", core.RequestInfoContextOAuth2, info.Context)
+					}
+
+					return e.Next()
+				})
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"meta":{`,
+				`"email":"test@example.com"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"id":"test_id"`,
+				`"verified":false`, // shouldn't change
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordEnrich":                1,
+				// ---
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				// ---
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  2, // create + update
+				"OnRecordValidate": 2,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if name := user.GetString("name"); name != "test1" {
+					t.Fatalf("Expected name to not change, got %q", name)
+				}
+
+				if user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be changed", "1234567890")
+				}
+
+				devices, err := app.FindAllAuthOriginsByRecord(user)
+				if len(devices) != 1 {
+					t.Fatalf("Expected only 1 auth origin to be created, got %d (%v)", len(devices), err)
+				}
+			},
+		},
+		{
+			Name:   "existing linked OAuth2 (verified user)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test2@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.Verified() {
+					t.Fatalf("Expected user %q to be verified", user.Email())
+				}
+
+				// ensure that the old password works
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				user.Collection().MFA.Enabled = false
+				user.Collection().OAuth2.Enabled = true
+				user.Collection().OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+
+				// stub linked provider
+				ea := core.NewExternalAuth(app)
+				ea.SetCollectionRef(user.Collection().Id)
+				ea.SetRecordRef(user.Id)
+				ea.SetProvider("test")
+				ea.SetProviderId("test_id")
+				if err := app.Save(ea); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"meta":{`,
+				`"isNew":false`,
+				`"email":"test2@example.com"`,
+				`"id":"oap640cot4yru2s"`,
+				`"id":"test_id"`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordEnrich":                1,
+				// ---
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				// ---
+				"OnModelValidate":  1,
+				"OnRecordValidate": 1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test2@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected old password %q to be valid", "1234567890")
+				}
+
+				devices, err := app.FindAllAuthOriginsByRecord(user)
+				if len(devices) != 1 {
+					t.Fatalf("Expected only 1 auth origin to be created, got %d (%v)", len(devices), err)
+				}
+			},
+		},
+		{
+			Name:   "link by email",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if user.Verified() {
+					t.Fatalf("Expected user %q to be unverified", user.Email())
+				}
+
+				// ensure that the old password works
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id", Email: "test@example.com"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				user.Collection().MFA.Enabled = false
+				user.Collection().OAuth2.Enabled = true
+				user.Collection().OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"meta":{`,
+				`"isNew":false`,
+				`"email":"test@example.com"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"id":"test_id"`,
+				`"verified":true`, // should be updated
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordEnrich":                1,
+				// ---
+				"OnModelCreate":              2, // authOrigins + externalAuths
+				"OnModelCreateExecute":       2,
+				"OnModelAfterCreateSuccess":  2,
+				"OnRecordCreate":             2,
+				"OnRecordCreateExecute":      2,
+				"OnRecordAfterCreateSuccess": 2,
+				// ---
+				"OnModelUpdate":              1, // record password and verified states
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  3, // record + authOrigins + externalAuths
+				"OnRecordValidate": 3,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be changed", "1234567890")
+				}
+
+				devices, err := app.FindAllAuthOriginsByRecord(user)
+				if len(devices) != 1 {
+					t.Fatalf("Expected only 1 auth origin to be created, got %d (%v)", len(devices), err)
+				}
+			},
+		},
+		{
+			Name:   "link by fallback user (OAuth2 user with different email)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if user.Verified() {
+					t.Fatalf("Expected user %q to be unverified", user.Email())
+				}
+
+				// ensure that the old password works
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:    "test_id",
+							Email: "test2@example.com", // different email -> should be ignored
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				user.Collection().MFA.Enabled = false
+				user.Collection().OAuth2.Enabled = true
+				user.Collection().OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"meta":{`,
+				`"isNew":false`,
+				`"email":"test@example.com"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"id":"test_id"`,
+				`"verified":false`, // shouldn't change because the OAuth2 user email is different
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordEnrich":                1,
+				// ---
+				"OnModelCreate":              2, // authOrigins + externalAuths
+				"OnModelCreateExecute":       2,
+				"OnModelAfterCreateSuccess":  2,
+				"OnRecordCreate":             2,
+				"OnRecordCreateExecute":      2,
+				"OnRecordAfterCreateSuccess": 2,
+				// ---
+				"OnModelValidate":  2,
+				"OnRecordValidate": 2,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q not to be changed", "1234567890")
+				}
+
+				devices, err := app.FindAllAuthOriginsByRecord(user)
+				if len(devices) != 1 {
+					t.Fatalf("Expected only 1 auth origin to be created, got %d (%v)", len(devices), err)
+				}
+			},
+		},
+		{
+			Name:   "link by fallback user (user without email)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if user.Verified() {
+					t.Fatalf("Expected user %q to be unverified", user.Email())
+				}
+
+				// ensure that the old password works
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+
+				oldTokenKey := user.TokenKey()
+
+				// manually unset the user email
+				user.SetEmail("")
+				if err = app.Save(user); err != nil {
+					t.Fatal(err)
+				}
+
+				// resave with the old token key since the email change above
+				// would change it and will make the password token invalid
+				user.SetTokenKey(oldTokenKey)
+				if err = app.Save(user); err != nil {
+					t.Fatalf("Failed to restore original user tokenKey: %v", err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:    "test_id",
+							Email: "test_oauth2@example.com",
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				user.Collection().MFA.Enabled = false
+				user.Collection().OAuth2.Enabled = true
+				user.Collection().OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"meta":{`,
+				`"isNew":false`,
+				`"email":"test_oauth2@example.com"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"id":"test_id"`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordEnrich":                1,
+				// ---
+				"OnModelCreate":              2, // authOrigins + externalAuths
+				"OnModelCreateExecute":       2,
+				"OnModelAfterCreateSuccess":  2,
+				"OnRecordCreate":             2,
+				"OnRecordCreateExecute":      2,
+				"OnRecordAfterCreateSuccess": 2,
+				// ---
+				"OnModelUpdate":              1, // record email set
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  3, // record + authOrigins + externalAuths
+				"OnRecordValidate": 3,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test_oauth2@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q not to be changed", "1234567890")
+				}
+
+				devices, err := app.FindAllAuthOriginsByRecord(user)
+				if len(devices) != 1 {
+					t.Fatalf("Expected only 1 auth origin to be created, got %d (%v)", len(devices), err)
+				}
+			},
+		},
+		{
+			Name:   "link by fallback user (unverified user with matching email)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if user.Verified() {
+					t.Fatalf("Expected user %q to be unverified", user.Email())
+				}
+
+				// ensure that the old password works
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:    "test_id",
+							Email: "test@example.com", // matching email -> should be marked as verified
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				user.Collection().MFA.Enabled = false
+				user.Collection().OAuth2.Enabled = true
+				user.Collection().OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"meta":{`,
+				`"isNew":false`,
+				`"email":"test@example.com"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"id":"test_id"`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordEnrich":                1,
+				// ---
+				"OnModelCreate":              2, // authOrigins + externalAuths
+				"OnModelCreateExecute":       2,
+				"OnModelAfterCreateSuccess":  2,
+				"OnRecordCreate":             2,
+				"OnRecordCreateExecute":      2,
+				"OnRecordAfterCreateSuccess": 2,
+				// ---
+				"OnModelUpdate":              1, // record verified update
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  3, // record + authOrigins + externalAuths
+				"OnRecordValidate": 3,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q not to be changed", "1234567890")
+				}
+
+				devices, err := app.FindAllAuthOriginsByRecord(user)
+				if len(devices) != 1 {
+					t.Fatalf("Expected only 1 auth origin to be created, got %d (%v)", len(devices), err)
+				}
+			},
+		},
+		{
+			Name:   "creating user (no extra create data or custom fields mapping)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"record":{`,
+				`"token":"`,
+				`"meta":{`,
+				`"isNew":true`,
+				`"email":""`,
+				`"id":"test_id"`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelUpdate":              1, // created record verified state change
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  4,
+				"OnRecordValidate": 4,
+			},
+		},
+		{
+			Name:   "creating user (submit failure - form auth fields validator)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com",
+				"createData": {
+					"verified": true,
+					"email": "invalid",
+					"rel": "invalid",
+					"file": "invalid"
+				}
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"verified":{"code":"validation_values_mismatch"`,
+			},
+			NotExpectedContent: []string{
+				`"email":`, // ignored because the record validator never ran
+				`"rel":`,   // ignored because the record validator never ran
+				`"file":`,  // ignored because the record validator never ran
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordCreateRequest":         1,
+			},
+		},
+		{
+			Name:   "creating user (submit failure - record fields validator)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com",
+				"createData": {
+					"email": "invalid",
+					"rel": "invalid",
+					"file": "invalid"
+				}
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"email":{"code":"validation_is_email"`,
+				`"rel":{"code":"validation_missing_rel_records"`,
+				`"file":{"code":"validation_invalid_file"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordCreateRequest":         1,
+				"OnModelValidate":               1,
+				"OnRecordValidate":              1,
+				"OnModelCreate":                 1,
+				"OnModelAfterCreateError":       1,
+				"OnRecordCreate":                1,
+				"OnRecordAfterCreateError":      1,
+			},
+		},
+		{
+			Name:   "creating user (valid create data with empty submitted email)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com",
+				"createData": {
+					"email": "",
+					"emailVisibility": true,
+					"password": "1234567890",
+					"passwordConfirm": "1234567890",
+					"name": "test_name",
+					"username": "test_username",
+					"rel": "0yxhwia2amd8gec"
+				}
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"isNew":true`,
+				`"email":""`,
+				`"emailVisibility":true`,
+				`"name":"test_name"`,
+				`"username":"test_username"`,
+				`"verified":true`,
+				`"rel":"0yxhwia2amd8gec"`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelUpdate":              1, // created record verified state change
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  4,
+				"OnRecordValidate": 4,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindFirstRecordByData("users", "username", "test_username")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+			},
+		},
+		{
+			Name:   "creating user (valid create data with non-empty valid submitted email)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com",
+				"createData": {
+					"email": "test_create@example.com",
+					"emailVisibility": true,
+					"password": "1234567890",
+					"passwordConfirm": "1234567890",
+					"name": "test_name",
+					"username": "test_username",
+					"rel": "0yxhwia2amd8gec"
+				}
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:    "test_id",
+							Email: "oauth2@example.com", // should be ignored because of the explicit submitted email
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test_create@example.com"`,
+				`"emailVisibility":true`,
+				`"name":"test_name"`,
+				`"username":"test_username"`,
+				`"verified":false`,
+				`"rel":"0yxhwia2amd8gec"`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelValidate":  3,
+				"OnRecordValidate": 3,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindFirstRecordByData("users", "username", "test_username")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.ValidatePassword("1234567890") {
+					t.Fatalf("Expected password %q to be valid", "1234567890")
+				}
+			},
+		},
+		{
+			Name:   "creating user (with mapped OAuth2 fields and avatarURL->file field)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com",
+				"createData": {
+					"name": "test_name",
+					"emailVisibility": true,
+					"rel": "0yxhwia2amd8gec"
+				}
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:        "oauth2_id",
+							Email:     "oauth2@example.com",
+							Username:  "oauth2_username",
+							AvatarURL: server.URL + "/oauth2_avatar.png",
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				usersCol.OAuth2.MappedFields = core.OAuth2KnownFields{
+					Username:  "name", // should be ignored because of the explicit submitted value
+					Id:        "username",
+					AvatarURL: "avatar",
+				}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"isNew":true`,
+				`"email":"oauth2@example.com"`,
+				`"emailVisibility":true`,
+				`"name":"test_name"`,
+				`"username":"oauth2_username"`,
+				`"verified":true`,
+				`"rel":"0yxhwia2amd8gec"`,
+				`"avatar":"oauth2_avatar_`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelUpdate":              1, // created record verified state change
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  4,
+				"OnRecordValidate": 4,
+			},
+		},
+		{
+			Name:   "creating user (with mapped OAuth2 avatarURL field but empty OAuth2User.avatarURL value)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:        "oauth2_id",
+							Email:     "oauth2@example.com",
+							AvatarURL: "",
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				usersCol.OAuth2.MappedFields = core.OAuth2KnownFields{
+					AvatarURL: "avatar",
+				}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"isNew":true`,
+				`"email":"oauth2@example.com"`,
+				`"emailVisibility":false`,
+				`"verified":true`,
+				`"avatar":""`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelUpdate":              1, // created record verified state change
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  4,
+				"OnRecordValidate": 4,
+			},
+		},
+		{
+			Name:   "creating user (with mapped OAuth2 fields, case-sensitive username and avatarURL->non-file field)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:        "oauth2_id",
+							Email:     "oauth2@example.com",
+							Username:  "tESt2_username", // wouldn't match with existing because the related field index is case-sensitive
+							Name:      "oauth2_name",
+							AvatarURL: server.URL + "/oauth2_avatar.png",
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				usersCol.OAuth2.MappedFields = core.OAuth2KnownFields{
+					Username:  "username",
+					AvatarURL: "name",
+				}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"isNew":true`,
+				`"email":"oauth2@example.com"`,
+				`"emailVisibility":false`,
+				`"username":"tESt2_username"`,
+				`"name":"http://127.`,
+				`"verified":true`,
+				`"avatar":""`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelUpdate":              1, // created record verified state change
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  4,
+				"OnRecordValidate": 4,
+			},
+		},
+		{
+			Name:   "creating user (with mapped OAuth2 fields and duplicated case-insensitive username)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:       "oauth2_id",
+							Email:    "oauth2@example.com",
+							Username: "tESt2_username",
+							Name:     "oauth2_name",
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// make the username index case-insensitive to ensure that case-insensitive match is used
+				index, ok := dbutils.FindSingleColumnUniqueIndex(usersCol.Indexes, "username")
+				if ok {
+					index.Columns[0].Collate = "nocase"
+					usersCol.RemoveIndex(index.IndexName)
+					usersCol.Indexes = append(usersCol.Indexes, index.Build())
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				usersCol.OAuth2.MappedFields = core.OAuth2KnownFields{
+					Username: "username",
+				}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"isNew":true`,
+				`"email":"oauth2@example.com"`,
+				`"emailVisibility":false`,
+				`"verified":true`,
+				`"avatar":""`,
+				`"username":"users`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelUpdate":              1, // created record verified state change
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  4,
+				"OnRecordValidate": 4,
+			},
+		},
+		{
+			Name:   "creating user (with mapped OAuth2 fields and username that doesn't match the field validations)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{
+							Id:       "oauth2_id",
+							Email:    "oauth2@example.com",
+							Username: "!@invalid",
+							Name:     "oauth2_name",
+						},
+						Token: &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				usersCol.MFA.Enabled = false
+				usersCol.OAuth2.Enabled = true
+				usersCol.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				usersCol.OAuth2.MappedFields = core.OAuth2KnownFields{
+					Username: "username",
+				}
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"isNew":true`,
+				`"email":"oauth2@example.com"`,
+				`"emailVisibility":false`,
+				`"verified":true`,
+				`"avatar":""`,
+				`"username":"users`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnRecordAuthWithOAuth2Request": 1,
+				"OnRecordAuthRequest":           1,
+				"OnRecordCreateRequest":         1,
+				"OnRecordEnrich":                2, // the auth response and from the create request
+				// ---
+				"OnModelCreate":              3, // record + authOrigins + externalAuths
+				"OnModelCreateExecute":       3,
+				"OnModelAfterCreateSuccess":  3,
+				"OnRecordCreate":             3,
+				"OnRecordCreateExecute":      3,
+				"OnRecordAfterCreateSuccess": 3,
+				// ---
+				"OnModelUpdate":              1, // created record verified state change
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				// ---
+				"OnModelValidate":  4,
+				"OnRecordValidate": 4,
+			},
+		},
+		{
+			Name:   "OnRecordAuthWithOAuth2Request tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"123",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				// add the test provider in the collection
+				user.Collection().MFA.Enabled = false
+				user.Collection().OAuth2.Enabled = true
+				user.Collection().OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+
+				// stub linked provider
+				ea := core.NewExternalAuth(app)
+				ea.SetCollectionRef(user.Collection().Id)
+				ea.SetRecordRef(user.Id)
+				ea.SetProvider("test")
+				ea.SetProviderId("test_id")
+				if err := app.Save(ea); err != nil {
+					t.Fatal(err)
+				}
+
+				app.OnRecordAuthWithOAuth2Request().BindFunc(func(e *core.RecordAuthWithOAuth2RequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordAuthWithOAuth2Request": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// Apple AuthUser.Name assign checks
+		// -----------------------------------------------------------
+		{
+			Name:   "store name with Apple provider",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "apple_web",
+				"code":"test_code",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				users, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers[auth.NameAppleWeb] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				app.Store().Set("@redirect_name_test_code", "test_store_name")
+
+				// add the test provider in the collection
+				users.MFA.Enabled = false
+				users.OAuth2.Enabled = true
+				users.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         auth.NameAppleWeb,
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(users); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"meta":{`,
+				`"name":"test_store_name"`,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.Store().Has("@redirect_name_test_code") {
+					t.Fatal("Expected @redirect_name_test_code store key to be removed")
+				}
+			},
+		},
+		{
+			Name:   "store name with non-Apple provider",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			Body: strings.NewReader(`{
+				"provider": "test",
+				"code":"test_code",
+				"redirectURL": "https://example.com"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				users, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// register the test provider
+				auth.Providers["test"] = func() auth.Provider {
+					return &oauth2MockProvider{
+						AuthUser: &auth.AuthUser{Id: "test_id"},
+						Token:    &oauth2.Token{AccessToken: "abc"},
+					}
+				}
+
+				app.Store().Set("@redirect_name_test_code", "test_store_name")
+
+				// add the test provider in the collection
+				users.MFA.Enabled = false
+				users.OAuth2.Enabled = true
+				users.OAuth2.Providers = []core.OAuth2ProviderConfig{{
+					Name:         "test",
+					ClientId:     "123",
+					ClientSecret: "456",
+				}}
+				if err := app.Save(users); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			NotExpectedContent: []string{
+				`"name":"test_store_name"`,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if !app.Store().Has("@redirect_name_test_code") {
+					t.Fatal("Expected @redirect_name_test_code store key to NOT be deleted")
+				}
+			},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:authWithOAuth2",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:authWithOAuth2"},
+					{MaxRequests: 100, Label: "users:auth"},
+					{MaxRequests: 0, Label: "users:authWithOAuth2"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:authWithOAuth2",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:auth"},
+					{MaxRequests: 0, Label: "*:authWithOAuth2"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit tag - users:auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:authWithOAuth2"},
+					{MaxRequests: 0, Label: "users:auth"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit tag - *:auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-oauth2",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:auth"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_with_otp.go b/server/core_backend-server/apis/record_auth_with_otp.go
new file mode 100644
index 0000000..c464167
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_with_otp.go
@@ -0,0 +1,106 @@
+package apis
+
+import (
+	"errors"
+	"fmt"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func recordAuthWithOTP(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if !collection.OTP.Enabled {
+		return e.ForbiddenError("The collection is not configured to allow OTP authentication.", nil)
+	}
+
+	form := &authWithOTPForm{}
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+	if err = form.validate(); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextOTP)
+
+	event := new(core.RecordAuthWithOTPRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+
+	// extra validations
+	// (note: returns a generic 400 as a very basic OTPs enumeration protection)
+	// ---
+	event.OTP, err = e.App.FindOTPById(form.OTPId)
+	if err != nil {
+		return e.BadRequestError("Invalid or expired OTP", err)
+	}
+
+	if event.OTP.CollectionRef() != collection.Id {
+		return e.BadRequestError("Invalid or expired OTP", errors.New("the OTP is for a different collection"))
+	}
+
+	if event.OTP.HasExpired(collection.OTP.DurationTime()) {
+		return e.BadRequestError("Invalid or expired OTP", errors.New("the OTP is expired"))
+	}
+
+	event.Record, err = e.App.FindRecordById(event.OTP.CollectionRef(), event.OTP.RecordRef())
+	if err != nil {
+		return e.BadRequestError("Invalid or expired OTP", fmt.Errorf("missing auth record: %w", err))
+	}
+
+	// since otps are usually simple digit numbers, enforce an extra rate limit rule as basic enumaration protection
+	err = checkRateLimit(e, "@pb_otp_"+event.Record.Id, core.RateLimitRule{MaxRequests: 5, Duration: 180})
+	if err != nil {
+		return e.TooManyRequestsError("Too many attempts, please try again later with a new OTP.", nil)
+	}
+
+	if !event.OTP.ValidatePassword(form.Password) {
+		return e.BadRequestError("Invalid or expired OTP", errors.New("incorrect password"))
+	}
+	// ---
+
+	return e.App.OnRecordAuthWithOTPRequest().Trigger(event, func(e *core.RecordAuthWithOTPRequestEvent) error {
+		// update the user email verified state in case the OTP originate from an email address matching the current record one
+		//
+		// note: don't wait for success auth response (it could fail because of MFA) and because we already validated the OTP above
+		otpSentTo := e.OTP.SentTo()
+		if !e.Record.Verified() && otpSentTo != "" && e.Record.Email() == otpSentTo {
+			e.Record.SetVerified(true)
+			err = e.App.Save(e.Record)
+			if err != nil {
+				e.App.Logger().Error("Failed to update record verified state after successful OTP validation",
+					"error", err,
+					"otpId", e.OTP.Id,
+					"recordId", e.Record.Id,
+				)
+			}
+		}
+
+		// try to delete the used otp
+		err = e.App.Delete(e.OTP)
+		if err != nil {
+			e.App.Logger().Error("Failed to delete used OTP", "error", err, "otpId", e.OTP.Id)
+		}
+
+		return RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodOTP, nil)
+	})
+}
+
+// -------------------------------------------------------------------
+
+type authWithOTPForm struct {
+	OTPId    string `form:"otpId" json:"otpId"`
+	Password string `form:"password" json:"password"`
+}
+
+func (form *authWithOTPForm) validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.OTPId, validation.Required, validation.Length(1, 255)),
+		validation.Field(&form.Password, validation.Required, validation.Length(1, 71)),
+	)
+}
diff --git a/server/core_backend-server/apis/record_auth_with_otp_test.go b/server/core_backend-server/apis/record_auth_with_otp_test.go
new file mode 100644
index 0000000..bc51442
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_with_otp_test.go
@@ -0,0 +1,608 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestRecordAuthWithOTP(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "not an auth collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo1/auth-with-otp",
+			Body:            strings.NewReader(`{"otpId":"test","password":"123456"}`),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth collection with disabled otp",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body:   strings.NewReader(`{"otpId":"test","password":"123456"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				usersCol, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				usersCol.OTP.Enabled = false
+
+				if err := app.Save(usersCol); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid body",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/users/auth-with-otp",
+			Body:            strings.NewReader(`{"email`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "empty body",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/users/auth-with-otp",
+			Body:           strings.NewReader(``),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"otpId":{"code":"validation_required"`,
+				`"password":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "invalid request data",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + strings.Repeat("a", 256) + `",
+				"password":"` + strings.Repeat("a", 72) + `"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"otpId":{"code":"validation_length_out_of_range"`,
+				`"password":{"code":"validation_length_out_of_range"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "missing otp",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"missing",
+				"password":"123456"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+				otp := core.NewOTP(app)
+				otp.Id = strings.Repeat("a", 15)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef(user.Id)
+				otp.SetPassword("123456")
+				if err := app.Save(otp); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "otp for different collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + strings.Repeat("a", 15) + `",
+				"password":"123456"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				client, err := app.FindAuthRecordByEmail("clients", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+				otp := core.NewOTP(app)
+				otp.Id = strings.Repeat("a", 15)
+				otp.SetCollectionRef(client.Collection().Id)
+				otp.SetRecordRef(client.Id)
+				otp.SetPassword("123456")
+				if err := app.Save(otp); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "otp with wrong password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + strings.Repeat("a", 15) + `",
+				"password":"123456"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+				otp := core.NewOTP(app)
+				otp.Id = strings.Repeat("a", 15)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef(user.Id)
+				otp.SetPassword("1234567890")
+				if err := app.Save(otp); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expired otp with valid password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + strings.Repeat("a", 15) + `",
+				"password":"123456"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+				otp := core.NewOTP(app)
+				otp.Id = strings.Repeat("a", 15)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef(user.Id)
+				otp.SetPassword("123456")
+				expiredDate := types.NowDateTime().AddDate(-3, 0, 0)
+				otp.SetRaw("created", expiredDate)
+				otp.SetRaw("updated", expiredDate)
+				if err := app.Save(otp); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid otp with valid password (enabled MFA)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + strings.Repeat("a", 15) + `",
+				"password":"123456"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+				otp := core.NewOTP(app)
+				otp.Id = strings.Repeat("a", 15)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef(user.Id)
+				otp.SetPassword("123456")
+				if err := app.Save(otp); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"mfaId":"`},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordAuthWithOTPRequest": 1,
+				"OnRecordAuthRequest":        1,
+				// ---
+				"OnModelValidate":           1,
+				"OnModelCreate":             1, // mfa record
+				"OnModelCreateExecute":      1,
+				"OnModelAfterCreateSuccess": 1,
+				"OnModelDelete":             1, // otp delete
+				"OnModelDeleteExecute":      1,
+				"OnModelAfterDeleteSuccess": 1,
+				// ---
+				"OnRecordValidate":           1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+		{
+			Name:   "valid otp with valid password and empty sentTo (disabled MFA)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + strings.Repeat("a", 15) + `",
+				"password":"123456"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// ensure that the user is unverified
+				user.SetVerified(false)
+				if err = app.Save(user); err != nil {
+					t.Fatal(err)
+				}
+
+				// disable MFA
+				user.Collection().MFA.Enabled = false
+				if err = app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+
+				otp := core.NewOTP(app)
+				otp.Id = strings.Repeat("a", 15)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef(user.Id)
+				otp.SetPassword("123456")
+				if err := app.Save(otp); err != nil {
+					t.Fatal(err)
+				}
+
+				// test at least once that the correct request info context is properly loaded
+				app.OnRecordAuthRequest().BindFunc(func(e *core.RecordAuthRequestEvent) error {
+					info, err := e.RequestInfo()
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					if info.Context != core.RequestInfoContextOTP {
+						t.Fatalf("Expected request context %q, got %q", core.RequestInfoContextOTP, info.Context)
+					}
+
+					return e.Next()
+				})
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+				`"record":{`,
+				`"email":"test@example.com"`,
+			},
+			NotExpectedContent: []string{
+				`"meta":`,
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordAuthWithOTPRequest": 1,
+				"OnRecordAuthRequest":        1,
+				"OnRecordEnrich":             1,
+				// ---
+				"OnModelValidate":           1,
+				"OnModelCreate":             1, // authOrigin
+				"OnModelCreateExecute":      1,
+				"OnModelAfterCreateSuccess": 1,
+				"OnModelDelete":             1, // otp delete
+				"OnModelDeleteExecute":      1,
+				"OnModelAfterDeleteSuccess": 1,
+				// ---
+				"OnRecordValidate":           1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if user.Verified() {
+					t.Fatal("Expected the user to remain unverified because sentTo != email")
+				}
+			},
+		},
+		{
+			Name:   "valid otp with valid password and nonempty sentTo=email (disabled MFA)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + strings.Repeat("a", 15) + `",
+				"password":"123456"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// ensure that the user is unverified
+				user.SetVerified(false)
+				if err = app.Save(user); err != nil {
+					t.Fatal(err)
+				}
+
+				// disable MFA
+				user.Collection().MFA.Enabled = false
+				if err = app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+
+				otp := core.NewOTP(app)
+				otp.Id = strings.Repeat("a", 15)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef(user.Id)
+				otp.SetPassword("123456")
+				otp.SetSentTo(user.Email())
+				if err := app.Save(otp); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"token":"`,
+				`"record":{`,
+				`"email":"test@example.com"`,
+			},
+			NotExpectedContent: []string{
+				`"meta":`,
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordAuthWithOTPRequest": 1,
+				"OnRecordAuthRequest":        1,
+				"OnRecordEnrich":             1,
+				// ---
+				"OnModelValidate": 2, // +1 because of the verified user update
+				// authOrigin create
+				"OnModelCreate":             1,
+				"OnModelCreateExecute":      1,
+				"OnModelAfterCreateSuccess": 1,
+				// OTP delete
+				"OnModelDelete":             1,
+				"OnModelDeleteExecute":      1,
+				"OnModelAfterDeleteSuccess": 1,
+				// user verified update
+				"OnModelUpdate":             1,
+				"OnModelUpdateExecute":      1,
+				"OnModelAfterUpdateSuccess": 1,
+				// ---
+				"OnRecordValidate":           2,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if !user.Verified() {
+					t.Fatal("Expected the user to be marked as verified")
+				}
+			},
+		},
+		{
+			Name:   "OnRecordAuthWithOTPRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + strings.Repeat("a", 15) + `",
+				"password":"123456"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// disable MFA
+				user.Collection().MFA.Enabled = false
+				if err = app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+
+				otp := core.NewOTP(app)
+				otp.Id = strings.Repeat("a", 15)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef(user.Id)
+				otp.SetPassword("123456")
+				if err := app.Save(otp); err != nil {
+					t.Fatal(err)
+				}
+
+				app.OnRecordAuthWithOTPRequest().BindFunc(func(e *core.RecordAuthWithOTPRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordAuthWithOTPRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:authWithOTP",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:authWithOTP"},
+					{MaxRequests: 100, Label: "users:auth"},
+					{MaxRequests: 0, Label: "users:authWithOTP"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:authWithOTP",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:auth"},
+					{MaxRequests: 0, Label: "*:authWithOTP"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - users:auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:authWithOTP"},
+					{MaxRequests: 0, Label: "users:auth"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:auth"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordAuthWithOTPManualRateLimiterCheck(t *testing.T) {
+	t.Parallel()
+
+	var storeCache map[string]any
+
+	otpAId := strings.Repeat("a", 15)
+	otpBId := strings.Repeat("b", 15)
+
+	scenarios := []struct {
+		otpId          string
+		password       string
+		expectedStatus int
+	}{
+		{otpAId, "12345", 400},
+		{otpAId, "12345", 400},
+		{otpBId, "12345", 400},
+		{otpBId, "12345", 400},
+		{otpBId, "12345", 400},
+		{otpAId, "12345", 429},
+		{otpAId, "123456", 429}, // reject even if it is correct
+		{otpAId, "123456", 429},
+		{otpBId, "123456", 429},
+	}
+
+	for _, s := range scenarios {
+		(&tests.ApiScenario{
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-otp",
+			Body: strings.NewReader(`{
+				"otpId":"` + s.otpId + `",
+				"password":"` + s.password + `"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				for k, v := range storeCache {
+					app.Store().Set(k, v)
+				}
+
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				user.Collection().MFA.Enabled = false
+				if err := app.Save(user.Collection()); err != nil {
+					t.Fatal(err)
+				}
+
+				for _, id := range []string{otpAId, otpBId} {
+					otp := core.NewOTP(app)
+					otp.Id = id
+					otp.SetCollectionRef(user.Collection().Id)
+					otp.SetRecordRef(user.Id)
+					otp.SetPassword("123456")
+					if err := app.Save(otp); err != nil {
+						t.Fatal(err)
+					}
+				}
+			},
+			ExpectedStatus:  s.expectedStatus,
+			ExpectedContent: []string{`"`}, // it doesn't matter anything non-empty
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				storeCache = app.Store().GetAll()
+			},
+		}).Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_auth_with_password.go b/server/core_backend-server/apis/record_auth_with_password.go
new file mode 100644
index 0000000..7a52ff5
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_with_password.go
@@ -0,0 +1,144 @@
+package apis
+
+import (
+	"database/sql"
+	"errors"
+	"slices"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func recordAuthWithPassword(e *core.RequestEvent) error {
+	collection, err := findAuthCollection(e)
+	if err != nil {
+		return err
+	}
+
+	if !collection.PasswordAuth.Enabled {
+		return e.ForbiddenError("The collection is not configured to allow password authentication.", nil)
+	}
+
+	form := &authWithPasswordForm{}
+	if err = e.BindBody(form); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while loading the submitted data.", err))
+	}
+	if err = form.validate(collection); err != nil {
+		return firstApiError(err, e.BadRequestError("An error occurred while validating the submitted data.", err))
+	}
+
+	e.Set(core.RequestEventKeyInfoContext, core.RequestInfoContextPasswordAuth)
+
+	var foundRecord *core.Record
+	var foundErr error
+
+	if form.IdentityField != "" {
+		foundRecord, foundErr = findRecordByIdentityField(e.App, collection, form.IdentityField, form.Identity)
+	} else {
+		identityFields := collection.PasswordAuth.IdentityFields
+
+		// @todo consider removing with the stable release or moving it in the collection save
+		//
+		// prioritize email lookup to minimize breaking changes with earlier versions
+		if len(identityFields) > 1 && identityFields[0] != core.FieldNameEmail {
+			identityFields = slices.Clone(identityFields)
+			slices.SortStableFunc(identityFields, func(a, b string) int {
+				if a == "email" {
+					return -1
+				}
+				if b == "email" {
+					return 1
+				}
+				return 0
+			})
+		}
+
+		for _, name := range identityFields {
+			if name == core.FieldNameEmail && is.EmailFormat.Validate(form.Identity) != nil {
+				continue // no need to query the database if we know that the submitted value is not an email
+			}
+
+			foundRecord, foundErr = findRecordByIdentityField(e.App, collection, name, form.Identity)
+			if foundErr == nil {
+				break
+			}
+		}
+	}
+
+	// ignore not found errors to allow custom record find implementations
+	if foundErr != nil && !errors.Is(foundErr, sql.ErrNoRows) {
+		return e.InternalServerError("", foundErr)
+	}
+
+	event := new(core.RecordAuthWithPasswordRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = foundRecord
+	event.Identity = form.Identity
+	event.Password = form.Password
+	event.IdentityField = form.IdentityField
+
+	return e.App.OnRecordAuthWithPasswordRequest().Trigger(event, func(e *core.RecordAuthWithPasswordRequestEvent) error {
+		if e.Record == nil || !e.Record.ValidatePassword(e.Password) {
+			return e.BadRequestError("Failed to authenticate.", errors.New("invalid login credentials"))
+		}
+
+		return RecordAuthResponse(e.RequestEvent, e.Record, core.MFAMethodPassword, nil)
+	})
+}
+
+// -------------------------------------------------------------------
+
+type authWithPasswordForm struct {
+	Identity string `form:"identity" json:"identity"`
+	Password string `form:"password" json:"password"`
+
+	// IdentityField specifies the field to use to search for the identity
+	// (leave it empty for "auto" detection).
+	IdentityField string `form:"identityField" json:"identityField"`
+}
+
+func (form *authWithPasswordForm) validate(collection *core.Collection) error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.Identity, validation.Required, validation.Length(1, 255)),
+		validation.Field(&form.Password, validation.Required, validation.Length(1, 255)),
+		validation.Field(
+			&form.IdentityField,
+			validation.Length(1, 255),
+			validation.In(list.ToInterfaceSlice(collection.PasswordAuth.IdentityFields)...),
+		),
+	)
+}
+
+func findRecordByIdentityField(app core.App, collection *core.Collection, field string, value any) (*core.Record, error) {
+	if !slices.Contains(collection.PasswordAuth.IdentityFields, field) {
+		return nil, errors.New("invalid identity field " + field)
+	}
+
+	index, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, field)
+	if !ok {
+		return nil, errors.New("missing " + field + " unique index constraint")
+	}
+
+	var expr dbx.Expression
+	if strings.EqualFold(index.Columns[0].Collate, "nocase") {
+		// case-insensitive search
+		expr = dbx.NewExp("[["+field+"]] = {:identity} COLLATE NOCASE", dbx.Params{"identity": value})
+	} else {
+		expr = dbx.HashExp{field: value}
+	}
+
+	record := &core.Record{}
+
+	err := app.RecordQuery(collection).AndWhere(expr).Limit(1).One(record)
+	if err != nil {
+		return nil, err
+	}
+
+	return record, nil
+}
diff --git a/server/core_backend-server/apis/record_auth_with_password_test.go b/server/core_backend-server/apis/record_auth_with_password_test.go
new file mode 100644
index 0000000..37f7ce6
--- /dev/null
+++ b/server/core_backend-server/apis/record_auth_with_password_test.go
@@ -0,0 +1,764 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+)
+
+func TestRecordAuthWithPassword(t *testing.T) {
+	t.Parallel()
+
+	updateIdentityIndex := func(collectionIdOrName string, fieldCollateMap map[string]string) func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+		return func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+			collection, err := app.FindCollectionByNameOrId("clients")
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			for column, collate := range fieldCollateMap {
+				index, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, column)
+				if !ok {
+					t.Fatalf("Missing unique identityField index for column %q", column)
+				}
+
+				index.Columns[0].Collate = collate
+
+				collection.RemoveIndex(index.IndexName)
+				collection.Indexes = append(collection.Indexes, index.Build())
+			}
+
+			err = app.Save(collection)
+			if err != nil {
+				t.Fatalf("Failed to update identityField index: %v", err)
+			}
+		}
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "disabled password auth",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/nologin/auth-with-password",
+			Body:            strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "non-auth collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo1/auth-with-password",
+			Body:            strings.NewReader(`{"identity":"test@example.com","password":"1234567890"}`),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "invalid body format",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/clients/auth-with-password",
+			Body:            strings.NewReader(`{"identity`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "empty body params",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/clients/auth-with-password",
+			Body:           strings.NewReader(`{"identity":"","password":""}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"identity":{`,
+				`"password":{`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "OnRecordAuthWithPasswordRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordAuthWithPasswordRequest().BindFunc(func(e *core.RecordAuthWithPasswordRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordAuthWithPasswordRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+		{
+			Name:   "valid identity field and invalid password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"invalid"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+			},
+		},
+		{
+			Name:   "valid identity field (email) and valid password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// test at least once that the correct request info context is properly loaded
+				app.OnRecordAuthRequest().BindFunc(func(e *core.RecordAuthRequestEvent) error {
+					info, err := e.RequestInfo()
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					if info.Context != core.RequestInfoContextPasswordAuth {
+						t.Fatalf("Expected request context %q, got %q", core.RequestInfoContextPasswordAuth, info.Context)
+					}
+
+					return e.Next()
+				})
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			Name:   "valid identity field (username) and valid password",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"clients57772",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"clients57772"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			// https://github.com/pocketbase/pocketbase/issues/7256
+			Name:   "valid non-email identity field with a value that is a properly formatted email",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"username_as_email@example.com",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				record, err := app.FindAuthRecordByEmail("clients", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				record.Set("username", "username_as_email@example.com")
+
+				err = app.SaveNoValidate(record)
+				if err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"username_as_email@example.com"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			Name:   "unknown explicit identityField",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identityField": "created",
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"identityField":{"code":"validation_in_invalid"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "valid identity field and valid password with mismatched explicit identityField",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identityField": "username",
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+			},
+		},
+		{
+			Name:   "valid identity field and valid password with matched explicit identityField",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identityField": "username",
+				"identity":"clients57772",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"clients57772"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			Name:   "valid identity (unverified) and valid password in onlyVerified collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test2@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+			},
+		},
+		{
+			Name:   "already authenticated record",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"gk390qegs4y47wn"`,
+				`"email":"test@example.com"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			Name:   "with mfa first auth check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			ExpectedStatus: 401,
+			ExpectedContent: []string{
+				`"mfaId":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				// mfa create
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				mfas, err := app.FindAllMFAsByRecord(user)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if v := len(mfas); v != 1 {
+					t.Fatalf("Expected 1 mfa record to be created, got %d", v)
+				}
+			},
+		},
+		{
+			Name:   "with mfa second auth check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-password",
+			Body: strings.NewReader(`{
+				"mfaId": "` + strings.Repeat("a", 15) + `",
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// insert a dummy mfa record
+				mfa := core.NewMFA(app)
+				mfa.Id = strings.Repeat("a", 15)
+				mfa.SetCollectionRef(user.Collection().Id)
+				mfa.SetRecordRef(user.Id)
+				mfa.SetMethod("test")
+				if err := app.Save(mfa); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                0, // disabled auth email alerts
+				"OnMailerRecordAuthAlertSend": 0,
+				// mfa delete
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+		{
+			Name:   "with enabled mfa but unsatisfied mfa rule (aka. skip the mfa check)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"test@example.com",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				users, err := app.FindCollectionByNameOrId("users")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				users.MFA.Enabled = true
+				users.MFA.Rule = "1=2"
+
+				if err := app.Save(users); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                0, // disabled auth email alerts
+				"OnMailerRecordAuthAlertSend": 0,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				mfas, err := app.FindAllMFAsByRecord(user)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if v := len(mfas); v != 0 {
+					t.Fatalf("Expected no mfa records to be created, got %d", v)
+				}
+			},
+		},
+
+		// case sensitivity checks
+		// -----------------------------------------------------------
+		{
+			Name:   "with explicit identityField (case-sensitive)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identityField": "username",
+				"identity":"Clients57772",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc:  updateIdentityIndex("clients", map[string]string{"username": ""}),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+			},
+		},
+		{
+			Name:   "with explicit identityField (case-insensitive)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identityField": "username",
+				"identity":"Clients57772",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"username": "nocase"}),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"clients57772"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			Name:   "without explicit identityField and non-email field (case-insensitive)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"Clients57772",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"username": "nocase"}),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"clients57772"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+		{
+			Name:   "without explicit identityField and email field (case-insensitive)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/clients/auth-with-password",
+			Body: strings.NewReader(`{
+				"identity":"tESt@example.com",
+				"password":"1234567890"
+			}`),
+			BeforeTestFunc: updateIdentityIndex("clients", map[string]string{"email": "nocase"}),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"test@example.com"`,
+				`"username":"clients57772"`,
+				`"token":`,
+			},
+			NotExpectedContent: []string{
+				// hidden fields
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnRecordAuthWithPasswordRequest": 1,
+				"OnRecordAuthRequest":             1,
+				"OnRecordEnrich":                  1,
+				// authOrigin track
+				"OnModelCreate":               1,
+				"OnModelCreateExecute":        1,
+				"OnModelAfterCreateSuccess":   1,
+				"OnModelValidate":             1,
+				"OnRecordCreate":              1,
+				"OnRecordCreateExecute":       1,
+				"OnRecordAfterCreateSuccess":  1,
+				"OnRecordValidate":            1,
+				"OnMailerSend":                1,
+				"OnMailerRecordAuthAlertSend": 1,
+			},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - users:authWithPassword",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-password",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:authWithPassword"},
+					{MaxRequests: 100, Label: "users:auth"},
+					{MaxRequests: 0, Label: "users:authWithPassword"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:authWithPassword",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-password",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:auth"},
+					{MaxRequests: 0, Label: "*:authWithPassword"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - users:auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-password",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:authWithPassword"},
+					{MaxRequests: 0, Label: "users:auth"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/auth-with-password",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:auth"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_crud.go b/server/core_backend-server/apis/record_crud.go
new file mode 100644
index 0000000..e6f39f2
--- /dev/null
+++ b/server/core_backend-server/apis/record_crud.go
@@ -0,0 +1,790 @@
+package apis
+
+import (
+	cryptoRand "crypto/rand"
+	"errors"
+	"fmt"
+	"math/big"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// bindRecordCrudApi registers the record crud api endpoints and
+// the corresponding handlers.
+//
+// note: the rate limiter is "inlined" because some of the crud actions are also used in the batch APIs
+func bindRecordCrudApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	subGroup := rg.Group("/collections/{collection}/records").Unbind(DefaultRateLimitMiddlewareId)
+	subGroup.GET("", recordsList)
+	subGroup.GET("/{id}", recordView)
+	subGroup.POST("", recordCreate(true, nil)).Bind(dynamicCollectionBodyLimit(""))
+	subGroup.PATCH("/{id}", recordUpdate(true, nil)).Bind(dynamicCollectionBodyLimit(""))
+	subGroup.DELETE("/{id}", recordDelete(true, nil))
+}
+
+func recordsList(e *core.RequestEvent) error {
+	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+	if err != nil || collection == nil {
+		return e.NotFoundError("Missing collection context.", err)
+	}
+
+	err = checkCollectionRateLimit(e, collection, "list")
+	if err != nil {
+		return err
+	}
+
+	requestInfo, err := e.RequestInfo()
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("", err))
+	}
+
+	if collection.ListRule == nil && !requestInfo.HasSuperuserAuth() {
+		return e.ForbiddenError("Only superusers can perform this action.", nil)
+	}
+
+	// forbid users and guests to query special filter/sort fields
+	err = checkForSuperuserOnlyRuleFields(requestInfo)
+	if err != nil {
+		return err
+	}
+
+	query := e.App.RecordQuery(collection)
+
+	fieldsResolver := core.NewRecordFieldResolver(e.App, collection, requestInfo, true)
+
+	if !requestInfo.HasSuperuserAuth() && collection.ListRule != nil && *collection.ListRule != "" {
+		expr, err := search.FilterData(*collection.ListRule).BuildExpr(fieldsResolver)
+		if err != nil {
+			return err
+		}
+		query.AndWhere(expr)
+
+		// will be applied by the search provider right before executing the query
+		// fieldsResolver.UpdateQuery(query)
+	}
+
+	// hidden fields are searchable only by superusers
+	fieldsResolver.SetAllowHiddenFields(requestInfo.HasSuperuserAuth())
+
+	searchProvider := search.NewProvider(fieldsResolver).Query(query)
+
+	// use rowid when available to minimize the need of a covering index with the "id" field
+	if !collection.IsView() {
+		if core.IsPostgres(e.App) {
+			// PostgreSQL:
+			searchProvider.CountCol("ctid")
+		} else if core.IsMysql(e.App) {
+			// MySQL:
+			searchProvider.CountCol("id")
+		} else {
+			// SQLite:
+			searchProvider.CountCol("_rowid_")
+		}
+	}
+
+	records := []*core.Record{}
+	result, err := searchProvider.ParseAndExec(e.Request.URL.Query().Encode(), &records)
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("", err))
+	}
+
+	event := new(core.RecordsListRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Records = records
+	event.Result = result
+
+	return e.App.OnRecordsListRequest().Trigger(event, func(e *core.RecordsListRequestEvent) error {
+		if err := EnrichRecords(e.RequestEvent, e.Records); err != nil {
+			return firstApiError(err, e.InternalServerError("Failed to enrich records", err))
+		}
+
+		// Add a randomized throttle in case of too many empty search filter attempts.
+		//
+		// This is just for extra precaution since security researches raised concern regarding the possibility of eventual
+		// timing attacks because the List API rule acts also as filter and executes in a single run with the client-side filters.
+		// This is by design and it is an accepted trade off between performance, usability and correctness.
+		//
+		// While technically the below doesn't fully guarantee protection against filter timing attacks, in practice combined with the network latency it makes them even less feasible.
+		// A properly configured rate limiter or individual fields Hidden checks are better suited if you are really concerned about eventual information disclosure by side-channel attacks.
+		//
+		// In all cases it doesn't really matter that much because it doesn't affect the builtin PocketBase security sensitive fields (e.g. password and tokenKey) since they
+		// are not client-side filterable and in the few places where they need to be compared against an external value, a constant time check is used.
+		if !e.HasSuperuserAuth() &&
+			(collection.ListRule != nil && *collection.ListRule != "") &&
+			(requestInfo.Query["filter"] != "") &&
+			len(e.Records) == 0 &&
+			checkRateLimit(e.RequestEvent, "@pb_list_timing_check_"+collection.Id, listTimingRateLimitRule) != nil {
+			e.App.Logger().Debug("Randomized throttle because of too many failed searches", "collectionId", collection.Id)
+			randomizedThrottle(500)
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, e.Result)
+		})
+	})
+}
+
+var listTimingRateLimitRule = core.RateLimitRule{MaxRequests: 3, Duration: 3}
+
+func randomizedThrottle(softMax int64) {
+	var timeout int64
+	randRange, err := cryptoRand.Int(cryptoRand.Reader, big.NewInt(softMax))
+	if err == nil {
+		timeout = randRange.Int64()
+	} else {
+		timeout = softMax
+	}
+
+	time.Sleep(time.Duration(timeout) * time.Millisecond)
+}
+
+func recordView(e *core.RequestEvent) error {
+	collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+	if err != nil || collection == nil {
+		return e.NotFoundError("Missing collection context.", err)
+	}
+
+	err = checkCollectionRateLimit(e, collection, "view")
+	if err != nil {
+		return err
+	}
+
+	recordId := e.Request.PathValue("id")
+	if recordId == "" {
+		return e.NotFoundError("", nil)
+	}
+
+	requestInfo, err := e.RequestInfo()
+	if err != nil {
+		return firstApiError(err, e.BadRequestError("", err))
+	}
+
+	if collection.ViewRule == nil && !requestInfo.HasSuperuserAuth() {
+		return e.ForbiddenError("Only superusers can perform this action.", nil)
+	}
+
+	ruleFunc := func(q *dbx.SelectQuery) error {
+		if !requestInfo.HasSuperuserAuth() && collection.ViewRule != nil && *collection.ViewRule != "" {
+			resolver := core.NewRecordFieldResolver(e.App, collection, requestInfo, true)
+
+			expr, err := search.FilterData(*collection.ViewRule).BuildExpr(resolver)
+			if err != nil {
+				return err
+			}
+
+			q.AndWhere(expr)
+
+			err = resolver.UpdateQuery(q)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	record, fetchErr := e.App.FindRecordById(collection, recordId, ruleFunc)
+	if fetchErr != nil || record == nil {
+		return firstApiError(err, e.NotFoundError("", fetchErr))
+	}
+
+	event := new(core.RecordRequestEvent)
+	event.RequestEvent = e
+	event.Collection = collection
+	event.Record = record
+
+	return e.App.OnRecordViewRequest().Trigger(event, func(e *core.RecordRequestEvent) error {
+		if err := EnrichRecord(e.RequestEvent, e.Record); err != nil {
+			return firstApiError(err, e.InternalServerError("Failed to enrich record", err))
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, e.Record)
+		})
+	})
+}
+
+func recordCreate(responseWriteAfterTx bool, optFinalizer func(data any) error) func(e *core.RequestEvent) error {
+	return func(e *core.RequestEvent) error {
+		collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+		if err != nil || collection == nil {
+			return e.NotFoundError("Missing collection context.", err)
+		}
+
+		if collection.IsView() {
+			return e.BadRequestError("Unsupported collection type.", nil)
+		}
+
+		err = checkCollectionRateLimit(e, collection, "create")
+		if err != nil {
+			return err
+		}
+
+		requestInfo, err := e.RequestInfo()
+		if err != nil {
+			return firstApiError(err, e.BadRequestError("", err))
+		}
+
+		hasSuperuserAuth := requestInfo.HasSuperuserAuth()
+		if !hasSuperuserAuth && collection.CreateRule == nil {
+			return e.ForbiddenError("Only superusers can perform this action.", nil)
+		}
+
+		record := core.NewRecord(collection)
+
+		data, err := recordDataFromRequest(e, record)
+		if err != nil {
+			return firstApiError(err, e.BadRequestError("Failed to read the submitted data.", err))
+		}
+
+		// set a random password for the OAuth2 ignoring its plain password validators
+		var skipPlainPasswordRecordValidators bool
+		if requestInfo.Context == core.RequestInfoContextOAuth2 {
+			if _, ok := data[core.FieldNamePassword]; !ok {
+				data[core.FieldNamePassword] = security.RandomString(30)
+				data[core.FieldNamePassword+"Confirm"] = data[core.FieldNamePassword]
+				skipPlainPasswordRecordValidators = true
+			}
+		}
+
+		// replace modifiers fields so that the resolved value is always
+		// available when accessing requestInfo.Body
+		requestInfo.Body = data
+
+		form := forms.NewRecordUpsert(e.App, record)
+		if hasSuperuserAuth {
+			form.GrantSuperuserAccess()
+		}
+		form.Load(data)
+
+		if skipPlainPasswordRecordValidators {
+			// unset the plain value to skip the plain password field validators
+			if raw, ok := record.GetRaw(core.FieldNamePassword).(*core.PasswordFieldValue); ok {
+				raw.Plain = ""
+			}
+		}
+
+		// check the request and record data against the create and manage rules
+		if !hasSuperuserAuth && collection.CreateRule != nil {
+			dummyRecord := record.Clone()
+
+			dummyRandomPart := "__pb_create__" + security.PseudorandomString(6)
+
+			// set an id if it doesn't have already
+			// (the value doesn't matter; it is used only to minimize the breaking changes with earlier versions)
+			if dummyRecord.Id == "" {
+				dummyRecord.Id = "__temp_id__" + dummyRandomPart
+			}
+
+			// unset the verified field to prevent manage API rule misuse in case the rule relies on it
+			dummyRecord.SetVerified(false)
+
+			// export the dummy record data into db params
+			dummyExport, err := dummyRecord.DBExport(e.App)
+			if err != nil {
+				return e.BadRequestError("Failed to create record", fmt.Errorf("dummy DBExport error: %w", err))
+			}
+
+			dummyParams := make(dbx.Params, len(dummyExport))
+			selects := make([]string, 0, len(dummyExport))
+			var param string
+			for k, v := range dummyExport {
+				k = inflector.Columnify(k) // columnify is just as extra measure in case of custom fields
+				param = "__pb_create__" + k
+				dummyParams[param] = v
+				// PostgreSQL only:
+				// Special case to handle PostgreSQL prepared statement strong type checking.
+				// If we don't explicity specify a type for a dynamic param in the prepared statement,
+				// It will be treated as text by PostgreSQL by default. And if we send a numeric value
+				// to a text-typed param, PostgreSQL will complain about a type mismatch. Eg:
+				// Related Issue:
+				// - https://github.com/jackc/pgx/issues/798,
+				// - https://github.com/jackc/pgx/issues/2307
+				typehint := ""
+				switch v.(type) {
+				case float64:
+					typehint = "::numeric"
+				case bool:
+					typehint = "::boolean"
+				}
+				selects = append(selects, "{:"+param+"}"+typehint+" AS [["+k+"]]")
+			}
+
+			// shallow clone the current collection
+			dummyCollection := *collection
+			dummyCollection.Id += dummyRandomPart
+			dummyCollection.Name += inflector.Columnify(dummyRandomPart)
+
+			withFrom := fmt.Sprintf("WITH {{%s}} as (SELECT %s)", dummyCollection.Name, strings.Join(selects, ","))
+
+			// check non-empty create rule
+			if *dummyCollection.CreateRule != "" {
+				ruleQuery := e.App.ConcurrentDB().Select("(1)").PreFragment(withFrom).From(dummyCollection.Name).AndBind(dummyParams)
+
+				resolver := core.NewRecordFieldResolver(e.App, &dummyCollection, requestInfo, true)
+
+				expr, err := search.FilterData(*dummyCollection.CreateRule).BuildExpr(resolver)
+				if err != nil {
+					return e.BadRequestError("Failed to create record", fmt.Errorf("create rule build expression failure: %w", err))
+				}
+				ruleQuery.AndWhere(expr)
+
+				err = resolver.UpdateQuery(ruleQuery)
+				if err != nil {
+					return e.BadRequestError("Failed to create record", fmt.Errorf("create rule update query failure: %w", err))
+				}
+
+				var exists int
+				err = ruleQuery.Limit(1).Row(&exists)
+				if err != nil || exists == 0 {
+					return e.BadRequestError("Failed to create record", fmt.Errorf("create rule failure: %w", err))
+				}
+			}
+
+			// check for manage rule access
+			manageRuleQuery := e.App.ConcurrentDB().Select("(1)").PreFragment(withFrom).From(dummyCollection.Name).AndBind(dummyParams)
+			if !form.HasManageAccess() &&
+				hasAuthManageAccess(e.App, requestInfo, &dummyCollection, manageRuleQuery) {
+				form.GrantManagerAccess()
+			}
+		}
+
+		var isOptFinalizerCalled bool
+
+		event := new(core.RecordRequestEvent)
+		event.RequestEvent = e
+		event.Collection = collection
+		event.Record = record
+
+		hookErr := e.App.OnRecordCreateRequest().Trigger(event, func(e *core.RecordRequestEvent) error {
+			form.SetApp(e.App)
+			form.SetRecord(e.Record)
+
+			err := form.Submit()
+			if err != nil {
+				return firstApiError(err, e.BadRequestError("Failed to create record", err))
+			}
+
+			err = EnrichRecord(e.RequestEvent, e.Record)
+			if err != nil {
+				return firstApiError(err, e.InternalServerError("Failed to enrich record", err))
+			}
+
+			err = execAfterSuccessTx(responseWriteAfterTx, e.App, func() error {
+				return e.JSON(http.StatusOK, e.Record)
+			})
+			if err != nil {
+				return err
+			}
+
+			if optFinalizer != nil {
+				isOptFinalizerCalled = true
+				err = optFinalizer(e.Record)
+				if err != nil {
+					return firstApiError(err, e.InternalServerError("", err))
+				}
+			}
+
+			return nil
+		})
+		if hookErr != nil {
+			return hookErr
+		}
+
+		// e.g. in case the regular hook chain was stopped and the finalizer cannot be executed as part of the last e.Next() task
+		if !isOptFinalizerCalled && optFinalizer != nil {
+			if err := optFinalizer(event.Record); err != nil {
+				return firstApiError(err, e.InternalServerError("", err))
+			}
+		}
+
+		return nil
+	}
+}
+
+func recordUpdate(responseWriteAfterTx bool, optFinalizer func(data any) error) func(e *core.RequestEvent) error {
+	return func(e *core.RequestEvent) error {
+		collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+		if err != nil || collection == nil {
+			return e.NotFoundError("Missing collection context.", err)
+		}
+
+		if collection.IsView() {
+			return e.BadRequestError("Unsupported collection type.", nil)
+		}
+
+		err = checkCollectionRateLimit(e, collection, "update")
+		if err != nil {
+			return err
+		}
+
+		recordId := e.Request.PathValue("id")
+		if recordId == "" {
+			return e.NotFoundError("", nil)
+		}
+
+		requestInfo, err := e.RequestInfo()
+		if err != nil {
+			return firstApiError(err, e.BadRequestError("", err))
+		}
+
+		hasSuperuserAuth := requestInfo.HasSuperuserAuth()
+
+		if !hasSuperuserAuth && collection.UpdateRule == nil {
+			return firstApiError(err, e.ForbiddenError("Only superusers can perform this action.", nil))
+		}
+
+		// eager fetch the record so that the modifiers field values can be resolved
+		record, err := e.App.FindRecordById(collection, recordId)
+		if err != nil {
+			return firstApiError(err, e.NotFoundError("", err))
+		}
+
+		data, err := recordDataFromRequest(e, record)
+		if err != nil {
+			return firstApiError(err, e.BadRequestError("Failed to read the submitted data.", err))
+		}
+
+		// replace modifiers fields so that the resolved value is always
+		// available when accessing requestInfo.Body
+		requestInfo.Body = data
+
+		ruleFunc := func(q *dbx.SelectQuery) error {
+			if !hasSuperuserAuth && collection.UpdateRule != nil && *collection.UpdateRule != "" {
+				resolver := core.NewRecordFieldResolver(e.App, collection, requestInfo, true)
+
+				expr, err := search.FilterData(*collection.UpdateRule).BuildExpr(resolver)
+				if err != nil {
+					return err
+				}
+
+				q.AndWhere(expr)
+
+				err = resolver.UpdateQuery(q)
+				if err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+
+		// refetch with access checks
+		record, err = e.App.FindRecordById(collection, recordId, ruleFunc)
+		if err != nil {
+			return firstApiError(err, e.NotFoundError("", err))
+		}
+
+		form := forms.NewRecordUpsert(e.App, record)
+		if hasSuperuserAuth {
+			form.GrantSuperuserAccess()
+		}
+		form.Load(data)
+
+		manageRuleQuery := e.App.ConcurrentDB().Select("(1)").From(collection.Name).AndWhere(dbx.HashExp{
+			collection.Name + ".id": record.Id,
+		})
+		if !form.HasManageAccess() &&
+			hasAuthManageAccess(e.App, requestInfo, collection, manageRuleQuery) {
+			form.GrantManagerAccess()
+		}
+
+		var isOptFinalizerCalled bool
+
+		event := new(core.RecordRequestEvent)
+		event.RequestEvent = e
+		event.Collection = collection
+		event.Record = record
+
+		hookErr := e.App.OnRecordUpdateRequest().Trigger(event, func(e *core.RecordRequestEvent) error {
+			form.SetApp(e.App)
+			form.SetRecord(e.Record)
+
+			err := form.Submit()
+			if err != nil {
+				return firstApiError(err, e.BadRequestError("Failed to update record.", err))
+			}
+
+			err = EnrichRecord(e.RequestEvent, e.Record)
+			if err != nil {
+				return firstApiError(err, e.InternalServerError("Failed to enrich record", err))
+			}
+
+			err = execAfterSuccessTx(responseWriteAfterTx, e.App, func() error {
+				return e.JSON(http.StatusOK, e.Record)
+			})
+			if err != nil {
+				return err
+			}
+
+			if optFinalizer != nil {
+				isOptFinalizerCalled = true
+				err = optFinalizer(e.Record)
+				if err != nil {
+					return firstApiError(err, e.InternalServerError("", fmt.Errorf("update optFinalizer error: %w", err)))
+				}
+			}
+
+			return nil
+		})
+		if hookErr != nil {
+			return hookErr
+		}
+
+		// e.g. in case the regular hook chain was stopped and the finalizer cannot be executed as part of the last e.Next() task
+		if !isOptFinalizerCalled && optFinalizer != nil {
+			if err := optFinalizer(event.Record); err != nil {
+				return firstApiError(err, e.InternalServerError("", fmt.Errorf("update optFinalizer error: %w", err)))
+			}
+		}
+
+		return nil
+	}
+}
+
+func recordDelete(responseWriteAfterTx bool, optFinalizer func(data any) error) func(e *core.RequestEvent) error {
+	return func(e *core.RequestEvent) error {
+		collection, err := e.App.FindCachedCollectionByNameOrId(e.Request.PathValue("collection"))
+		if err != nil || collection == nil {
+			return e.NotFoundError("Missing collection context.", err)
+		}
+
+		if collection.IsView() {
+			return e.BadRequestError("Unsupported collection type.", nil)
+		}
+
+		err = checkCollectionRateLimit(e, collection, "delete")
+		if err != nil {
+			return err
+		}
+
+		recordId := e.Request.PathValue("id")
+		if recordId == "" {
+			return e.NotFoundError("", nil)
+		}
+
+		requestInfo, err := e.RequestInfo()
+		if err != nil {
+			return firstApiError(err, e.BadRequestError("", err))
+		}
+
+		if !requestInfo.HasSuperuserAuth() && collection.DeleteRule == nil {
+			return e.ForbiddenError("Only superusers can perform this action.", nil)
+		}
+
+		ruleFunc := func(q *dbx.SelectQuery) error {
+			if !requestInfo.HasSuperuserAuth() && collection.DeleteRule != nil && *collection.DeleteRule != "" {
+				resolver := core.NewRecordFieldResolver(e.App, collection, requestInfo, true)
+
+				expr, err := search.FilterData(*collection.DeleteRule).BuildExpr(resolver)
+				if err != nil {
+					return err
+				}
+
+				q.AndWhere(expr)
+
+				err = resolver.UpdateQuery(q)
+				if err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+
+		record, err := e.App.FindRecordById(collection, recordId, ruleFunc)
+		if err != nil || record == nil {
+			return e.NotFoundError("", err)
+		}
+
+		var isOptFinalizerCalled bool
+
+		event := new(core.RecordRequestEvent)
+		event.RequestEvent = e
+		event.Collection = collection
+		event.Record = record
+
+		hookErr := e.App.OnRecordDeleteRequest().Trigger(event, func(e *core.RecordRequestEvent) error {
+			if err := e.App.Delete(e.Record); err != nil {
+				return firstApiError(err, e.BadRequestError("Failed to delete record. Make sure that the record is not part of a required relation reference.", err))
+			}
+
+			err = execAfterSuccessTx(responseWriteAfterTx, e.App, func() error {
+				return e.NoContent(http.StatusNoContent)
+			})
+			if err != nil {
+				return err
+			}
+
+			if optFinalizer != nil {
+				isOptFinalizerCalled = true
+				err = optFinalizer(e.Record)
+				if err != nil {
+					return firstApiError(err, e.InternalServerError("", fmt.Errorf("delete optFinalizer error: %w", err)))
+				}
+			}
+
+			return nil
+		})
+		if hookErr != nil {
+			return hookErr
+		}
+
+		// e.g. in case the regular hook chain was stopped and the finalizer cannot be executed as part of the last e.Next() task
+		if !isOptFinalizerCalled && optFinalizer != nil {
+			if err := optFinalizer(event.Record); err != nil {
+				return firstApiError(err, e.InternalServerError("", fmt.Errorf("delete optFinalizer error: %w", err)))
+			}
+		}
+
+		return nil
+	}
+}
+
+// -------------------------------------------------------------------
+
+func recordDataFromRequest(e *core.RequestEvent, record *core.Record) (map[string]any, error) {
+	info, err := e.RequestInfo()
+	if err != nil {
+		return nil, err
+	}
+
+	// resolve regular fields
+	result := record.ReplaceModifiers(info.Body)
+
+	// resolve uploaded files
+	uploadedFiles, err := extractUploadedFiles(e, record.Collection(), "")
+	if err != nil {
+		return nil, err
+	}
+	if len(uploadedFiles) > 0 {
+		for k, files := range uploadedFiles {
+			uploaded := make([]any, 0, len(files))
+
+			// if not remove/prepend/append -> merge with the submitted
+			// info.Body values to prevent accidental old files deletion
+			if info.Body[k] != nil &&
+				!strings.HasPrefix(k, "+") &&
+				!strings.HasSuffix(k, "+") &&
+				!strings.HasSuffix(k, "-") {
+				existing := list.ToUniqueStringSlice(info.Body[k])
+				for _, name := range existing {
+					uploaded = append(uploaded, name)
+				}
+			}
+
+			for _, file := range files {
+				uploaded = append(uploaded, file)
+			}
+
+			result[k] = uploaded
+		}
+
+		result = record.ReplaceModifiers(result)
+	}
+
+	isAuth := record.Collection().IsAuth()
+
+	// unset hidden fields for non-superusers
+	if !info.HasSuperuserAuth() {
+		for _, f := range record.Collection().Fields {
+			if f.GetHidden() {
+				// exception for the auth collection "password" field
+				if isAuth && f.GetName() == core.FieldNamePassword {
+					continue
+				}
+
+				delete(result, f.GetName())
+			}
+		}
+	}
+
+	return result, nil
+}
+
+func extractUploadedFiles(re *core.RequestEvent, collection *core.Collection, prefix string) (map[string][]*filesystem.File, error) {
+	contentType := re.Request.Header.Get("content-type")
+	if !strings.HasPrefix(contentType, "multipart/form-data") {
+		return nil, nil // not multipart/form-data request
+	}
+
+	result := map[string][]*filesystem.File{}
+
+	for _, field := range collection.Fields {
+		if field.Type() != core.FieldTypeFile {
+			continue
+		}
+
+		baseKey := field.GetName()
+
+		keys := []string{
+			baseKey,
+			// prepend and append modifiers
+			"+" + baseKey,
+			baseKey + "+",
+		}
+
+		for _, k := range keys {
+			if prefix != "" {
+				k = prefix + "." + k
+			}
+			files, err := re.FindUploadedFiles(k)
+			if err != nil && !errors.Is(err, http.ErrMissingFile) {
+				return nil, err
+			}
+			if len(files) > 0 {
+				result[k] = files
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// hasAuthManageAccess checks whether the client is allowed to have
+// [forms.RecordUpsert] auth management permissions
+// (e.g. allowing to change system auth fields without oldPassword).
+func hasAuthManageAccess(app core.App, requestInfo *core.RequestInfo, collection *core.Collection, query *dbx.SelectQuery) bool {
+	if !collection.IsAuth() {
+		return false
+	}
+
+	manageRule := collection.ManageRule
+
+	if manageRule == nil || *manageRule == "" {
+		return false // only for superusers (manageRule can't be empty)
+	}
+
+	if requestInfo == nil || requestInfo.Auth == nil {
+		return false // no auth record
+	}
+
+	resolver := core.NewRecordFieldResolver(app, collection, requestInfo, true)
+
+	expr, err := search.FilterData(*manageRule).BuildExpr(resolver)
+	if err != nil {
+		app.Logger().Error("Manage rule build expression error", "error", err, "collectionId", collection.Id)
+		return false
+	}
+	query.AndWhere(expr)
+
+	err = resolver.UpdateQuery(query)
+	if err != nil {
+		return false
+	}
+
+	var exists int
+
+	err = query.Limit(1).Row(&exists)
+
+	return err == nil && exists > 0
+}
diff --git a/server/core_backend-server/apis/record_crud_auth_origin_test.go b/server/core_backend-server/apis/record_crud_auth_origin_test.go
new file mode 100644
index 0000000..98db76c
--- /dev/null
+++ b/server/core_backend-server/apis/record_crud_auth_origin_test.go
@@ -0,0 +1,314 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordCrudAuthOriginList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "guest",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"totalPages":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+		{
+			Name:   "regular auth with authOrigins",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":1`,
+				`"totalPages":1`,
+				`"id":"9r2j0m74260ur8i"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       1,
+			},
+		},
+		{
+			Name:   "regular auth without authOrigins",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"totalPages":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudAuthOriginView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-owner",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{`"id":"9r2j0m74260ur8i"`},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudAuthOriginDelete(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-owner",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudAuthOriginCreate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"recordRef":     "4q1xlclmfloku33",
+			"collectionRef": "_pb_users_auth_",
+			"fingerprint":   "abc"
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			ExpectedContent: []string{
+				`"fingerprint":"abc"`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudAuthOriginUpdate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"fingerprint":"abc"
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameAuthOrigins + "/records/9r2j0m74260ur8i",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			ExpectedContent: []string{
+				`"id":"9r2j0m74260ur8i"`,
+				`"fingerprint":"abc"`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_crud_external_auth_test.go b/server/core_backend-server/apis/record_crud_external_auth_test.go
new file mode 100644
index 0000000..c4d1c48
--- /dev/null
+++ b/server/core_backend-server/apis/record_crud_external_auth_test.go
@@ -0,0 +1,316 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordCrudExternalAuthList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:           "guest",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/" + core.CollectionNameExternalAuths + "/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"totalPages":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+		{
+			Name:   "regular auth with externalAuths",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":1`,
+				`"totalPages":1`,
+				`"id":"f1z5b3843pzc964"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       1,
+			},
+		},
+		{
+			Name:   "regular auth without externalAuths",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records",
+			Headers: map[string]string{
+				// users, test2@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.GfJo6EHIobgas_AXt-M-tj5IoQendPnrkMSe9ExuSEY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"totalPages":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudExternalAuthView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-owner",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{`"id":"dlmflokuq1xl342"`},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudExternalAuthDelete(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-owner",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudExternalAuthCreate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"recordRef":     "4q1xlclmfloku33",
+			"collectionRef": "_pb_users_auth_",
+			"provider":      "github",
+			"providerId":    "abc"
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/" + core.CollectionNameExternalAuths + "/records",
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			ExpectedContent: []string{
+				`"recordRef":"4q1xlclmfloku33"`,
+				`"providerId":"abc"`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudExternalAuthUpdate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"providerId": "abc"
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameExternalAuths + "/records/dlmflokuq1xl342",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			ExpectedContent: []string{
+				`"id":"dlmflokuq1xl342"`,
+				`"providerId":"abc"`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_crud_mfa_test.go b/server/core_backend-server/apis/record_crud_mfa_test.go
new file mode 100644
index 0000000..f82c446
--- /dev/null
+++ b/server/core_backend-server/apis/record_crud_mfa_test.go
@@ -0,0 +1,405 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordCrudMFAList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"totalPages":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+		{
+			Name:   "regular auth with mfas",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":1`,
+				`"totalPages":1`,
+				`"id":"user1_0"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       1,
+			},
+		},
+		{
+			Name:   "regular auth without mfas",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"totalPages":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudMFAView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-owner",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{`"id":"user1_0"`},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudMFADelete(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-owner",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudMFACreate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"recordRef":     "4q1xlclmfloku33",
+			"collectionRef": "_pb_users_auth_",
+			"method":        "abc"
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
+			Body:   body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body: body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedContent: []string{
+				`"recordRef":"4q1xlclmfloku33"`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudMFAUpdate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"method":"abc"
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			Body:   body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body: body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameMFAs + "/records/user1_0",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubMFARecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedContent: []string{
+				`"id":"user1_0"`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_crud_otp_test.go b/server/core_backend-server/apis/record_crud_otp_test.go
new file mode 100644
index 0000000..d7c44b8
--- /dev/null
+++ b/server/core_backend-server/apis/record_crud_otp_test.go
@@ -0,0 +1,405 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordCrudOTPList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"totalPages":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+		{
+			Name:   "regular auth with otps",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":1`,
+				`"totalPages":1`,
+				`"id":"user1_0"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       1,
+			},
+		},
+		{
+			Name:   "regular auth without otps",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"totalPages":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudOTPView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-owner",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{`"id":"user1_0"`},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudOTPDelete(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-owner auth",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudOTPCreate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"recordRef":     "4q1xlclmfloku33",
+			"collectionRef": "_pb_users_auth_",
+			"password":      "abc"
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
+			Body:   body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body: body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedContent: []string{
+				`"recordRef":"4q1xlclmfloku33"`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudOTPUpdate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"password":"abc"
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "guest",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			Body:   body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "owner regular auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body: body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameOTPs + "/records/user1_0",
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				if err := tests.StubOTPRecords(app); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedContent: []string{
+				`"id":"user1_0"`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_crud_superuser_test.go b/server/core_backend-server/apis/record_crud_superuser_test.go
new file mode 100644
index 0000000..6c2ad58
--- /dev/null
+++ b/server/core_backend-server/apis/record_crud_superuser_test.go
@@ -0,0 +1,336 @@
+package apis_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordCrudSuperuserList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-superusers auth",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records",
+			Headers: map[string]string{
+				// _superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":4`,
+				`"items":[{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       4,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudSuperuserView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-superusers auth",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodGet,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
+			Headers: map[string]string{
+				// _superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"sywbhecnh46rhm0"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudSuperuserDelete(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records/sbmbsdb40jyxf7h",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-superusers auth",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sbmbsdb40jyxf7h",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sbmbsdb40jyxf7h",
+			Headers: map[string]string{
+				// _superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              4, // + 3 AuthOrigins
+				"OnModelDeleteExecute":       4,
+				"OnModelAfterDeleteSuccess":  4,
+				"OnRecordDelete":             4,
+				"OnRecordDeleteExecute":      4,
+				"OnRecordAfterDeleteSuccess": 4,
+			},
+		},
+		{
+			Name:   "delete the last superuser",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
+			Headers: map[string]string{
+				// _superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				// delete all other superusers
+				superusers, err := app.FindAllRecords(core.CollectionNameSuperusers, dbx.Not(dbx.HashExp{"id": "sywbhecnh46rhm0"}))
+				if err != nil {
+					t.Fatal(err)
+				}
+				for _, superuser := range superusers {
+					if err = app.Delete(superuser); err != nil {
+						t.Fatal(err)
+					}
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordDeleteRequest":    1,
+				"OnModelDelete":            1,
+				"OnModelAfterDeleteError":  1,
+				"OnRecordDelete":           1,
+				"OnRecordAfterDeleteError": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudSuperuserCreate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"email":           "test_new@example.com",
+			"password":        "1234567890",
+			"passwordConfirm": "1234567890",
+			"verified":        false
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records",
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-superusers auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPost,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records",
+			Headers: map[string]string{
+				// _superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			ExpectedContent: []string{
+				`"collectionName":"_superusers"`,
+				`"email":"test_new@example.com"`,
+				`"verified":true`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudSuperuserUpdate(t *testing.T) {
+	t.Parallel()
+
+	body := func() *strings.Reader {
+		return strings.NewReader(`{
+			"email":    "test_new@example.com",
+			"verified": true
+		}`)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "guest",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "non-superusers auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body:            body(),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superusers auth",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/" + core.CollectionNameSuperusers + "/records/sywbhecnh46rhm0",
+			Headers: map[string]string{
+				// _superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Body: body(),
+			ExpectedContent: []string{
+				`"collectionName":"_superusers"`,
+				`"id":"sywbhecnh46rhm0"`,
+				`"email":"test_new@example.com"`,
+				`"verified":true`,
+			},
+			ExpectedStatus: 200,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnRecordEnrich":             1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnModelValidate":            1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordValidate":           1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_crud_test.go b/server/core_backend-server/apis/record_crud_test.go
new file mode 100644
index 0000000..c911021
--- /dev/null
+++ b/server/core_backend-server/apis/record_crud_test.go
@@ -0,0 +1,3610 @@
+package apis_test
+
+import (
+	"bytes"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestRecordCrudList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "missing collection",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/missing/records",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "unauthenticated trying to access nil rule collection (aka. need superuser auth)",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/demo1/records",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authenticated record trying to access nil rule collection (aka. need superuser auth)",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "public collection but with superuser only filter param (aka. @collection, @request, etc.)",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/demo2/records?filter=%40collection.demo2.title='test1'",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "public collection but with superuser only sort param (aka. @collection, @request, etc.)",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/demo2/records?sort=@request.auth.title",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "public collection but with ENCODED superuser only filter/sort (aka. @collection)",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/demo2/records?filter=%40collection.demo2.title%3D%27test1%27",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "public collection",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/demo2/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"0yxhwia2amd8gec"`,
+				`"id":"achvryl401bhse3"`,
+				`"id":"llvuca81nly1qls"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       3,
+			},
+		},
+		{
+			Name:           "public collection (using the collection id)",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/sz5l5z67tg7gku0/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"0yxhwia2amd8gec"`,
+				`"id":"achvryl401bhse3"`,
+				`"id":"llvuca81nly1qls"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       3,
+			},
+		},
+		{
+			Name:   "authorized as superuser trying to access nil rule collection (aka. need superuser auth)",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"al1h9ijdeojtsjy"`,
+				`"id":"84nmscqy84lsi1t"`,
+				`"id":"imy661ixudk5izi"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       3,
+			},
+		},
+		{
+			Name:   "valid query params",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records?filter=text~'test'&sort=-bool",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":2`,
+				`"items":[{`,
+				`"id":"al1h9ijdeojtsjy"`,
+				`"id":"84nmscqy84lsi1t"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       2,
+			},
+		},
+		{
+			Name:   "invalid filter",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records?filter=invalid~'test'",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "expand relations",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records?expand=rel_one,rel_many.rel,missing&perPage=2&sort=created",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":2`,
+				`"totalPages":2`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"collectionName":"demo1"`,
+				`"id":"84nmscqy84lsi1t"`,
+				`"id":"al1h9ijdeojtsjy"`,
+				`"expand":{`,
+				`"rel_one":""`,
+				`"rel_one":{"`,
+				`"rel_many":[{`,
+				`"rel":{`,
+				`"rel":""`,
+				`"json":[1,2,3]`,
+				`"select_many":["optionB","optionC"]`,
+				`"select_many":["optionB"]`,
+				// subrel items
+				`"id":"0yxhwia2amd8gec"`,
+				`"id":"llvuca81nly1qls"`,
+				// email visibility should be ignored for superusers even in expanded rels
+				`"email":"test@example.com"`,
+				`"email":"test2@example.com"`,
+				`"email":"test3@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       8,
+			},
+		},
+		{
+			Name:   "authenticated record model that DOESN'T match the collection list rule",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo3/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalItems":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+		{
+			Name:   "authenticated record that matches the collection list rule",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo3/records",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":4`,
+				`"items":[{`,
+				`"id":"1tmknxy2868d869"`,
+				`"id":"lcl9d87w22ml6jy"`,
+				`"id":"7nwo8tuiatetxdm"`,
+				`"id":"mk5fmymtx4wsprk"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       4,
+			},
+		},
+		{
+			Name:   "authenticated regular record that matches the collection list rule with hidden field",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo3/records",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				col, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// mock hidden field
+				col.Fields.GetByName("title").SetHidden(true)
+
+				col.ListRule = types.Pointer("title ~ 'test'")
+
+				if err = app.Save(col); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":4`,
+				`"items":[{`,
+				`"id":"1tmknxy2868d869"`,
+				`"id":"lcl9d87w22ml6jy"`,
+				`"id":"7nwo8tuiatetxdm"`,
+				`"id":"mk5fmymtx4wsprk"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       4,
+			},
+		},
+		{
+			Name:   "authenticated regular record filtering with a hidden field",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo3/records?filter=title~'test'",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				col, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// mock hidden field
+				col.Fields.GetByName("title").SetHidden(true)
+
+				if err = app.Save(col); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "superuser filtering with a hidden field",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo3/records?filter=title~'test'",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				col, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// mock hidden field
+				col.Fields.GetByName("title").SetHidden(true)
+
+				if err = app.Save(col); err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":4`,
+				`"items":[{`,
+				`"id":"1tmknxy2868d869"`,
+				`"id":"lcl9d87w22ml6jy"`,
+				`"id":"7nwo8tuiatetxdm"`,
+				`"id":"mk5fmymtx4wsprk"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       4,
+			},
+		},
+		{
+			Name:           ":rule modifer",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/demo5/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":1`,
+				`"items":[{`,
+				`"id":"qjeql998mtp1azp"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       1,
+			},
+		},
+		{
+			Name:           "multi-match - at least one of (guest - non-satisfied relation filter API rule)",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length?=2"),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":0`,
+				`"totalItems":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       0,
+			},
+		},
+		{
+			Name:   "multi-match - at least one of (clients)",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length?=2"),
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":1`,
+				`"items":[{`,
+				`"id":"qzaqccwrmva4o1n"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       1,
+			},
+		},
+		{
+			Name:   "multi-match - all (clients)",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo4/records?filter=" + url.QueryEscape("rel_many_no_cascade_required.files:length=2"),
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":0`,
+				`"totalItems":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+		{
+			Name:   "OnRecordsListRequest tx body write check",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo4/records",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordsListRequest().BindFunc(func(e *core.RecordsListRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordsListRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// auth collection
+		// -----------------------------------------------------------
+		{
+			Name:           "check email visibility as guest",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/nologin/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"phhq3wr65cap535"`,
+				`"id":"dc49k6jgejn40h3"`,
+				`"id":"oos036e9xvqeexy"`,
+				`"email":"test2@example.com"`,
+				`"emailVisibility":true`,
+				`"emailVisibility":false`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"email":"test@example.com"`,
+				`"email":"test3@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       3,
+			},
+		},
+		{
+			Name:   "check email visibility as any authenticated record",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/records",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"phhq3wr65cap535"`,
+				`"id":"dc49k6jgejn40h3"`,
+				`"id":"oos036e9xvqeexy"`,
+				`"email":"test2@example.com"`,
+				`"emailVisibility":true`,
+				`"emailVisibility":false`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey":"`,
+				`"password":""`,
+				`"email":"test@example.com"`,
+				`"email":"test3@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       3,
+			},
+		},
+		{
+			Name:   "check email visibility as manage auth record",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"phhq3wr65cap535"`,
+				`"id":"dc49k6jgejn40h3"`,
+				`"id":"oos036e9xvqeexy"`,
+				`"email":"test@example.com"`,
+				`"email":"test2@example.com"`,
+				`"email":"test3@example.com"`,
+				`"emailVisibility":true`,
+				`"emailVisibility":false`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       3,
+			},
+		},
+		{
+			Name:   "check email visibility as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/records",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"phhq3wr65cap535"`,
+				`"id":"dc49k6jgejn40h3"`,
+				`"id":"oos036e9xvqeexy"`,
+				`"email":"test@example.com"`,
+				`"email":"test2@example.com"`,
+				`"email":"test3@example.com"`,
+				`"emailVisibility":true`,
+				`"emailVisibility":false`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       3,
+			},
+		},
+		{
+			Name:   "check self email visibility resolver",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/records",
+			Headers: map[string]string{
+				// nologin, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoia3B2NzA5c2sybHFicWs4IiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.fdUPFLDx5b6RM_XFqnqsyiyNieyKA2HIIkRmUh9kIoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":3`,
+				`"items":[{`,
+				`"id":"phhq3wr65cap535"`,
+				`"id":"dc49k6jgejn40h3"`,
+				`"id":"oos036e9xvqeexy"`,
+				`"email":"test2@example.com"`,
+				`"email":"test@example.com"`,
+				`"emailVisibility":true`,
+				`"emailVisibility":false`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"email":"test3@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       3,
+			},
+		},
+
+		// view collection
+		// -----------------------------------------------------------
+		{
+			Name:           "public view records",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/view2/records?filter=state=false",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":2`,
+				`"items":[{`,
+				`"id":"al1h9ijdeojtsjy"`,
+				`"id":"imy661ixudk5izi"`,
+			},
+			NotExpectedContent: []string{
+				`"created"`,
+				`"updated"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       2,
+			},
+		},
+		{
+			Name:           "guest that doesn't match the view collection list rule",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/view1/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":0`,
+				`"totalItems":0`,
+				`"items":[]`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+			},
+		},
+		{
+			Name:   "authenticated record that matches the view collection list rule",
+			Method: http.MethodGet,
+			URL:    "/api/collections/view1/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":1`,
+				`"items":[{`,
+				`"id":"84nmscqy84lsi1t"`,
+				`"bool":true`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       1,
+			},
+		},
+		{
+			Name:           "view collection with numeric ids",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/numeric_id_view/records",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"page":1`,
+				`"perPage":30`,
+				`"totalPages":1`,
+				`"totalItems":2`,
+				`"items":[{`,
+				`"id":"1"`,
+				`"id":"2"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                    0,
+				"OnRecordsListRequest": 1,
+				"OnRecordEnrich":       2,
+			},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - view2:list",
+			Method: http.MethodGet,
+			URL:    "/api/collections/view2/records",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:list"},
+					{MaxRequests: 0, Label: "view2:list"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:list",
+			Method: http.MethodGet,
+			URL:    "/api/collections/view2/records",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:list"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "missing collection",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/missing/records/0yxhwia2amd8gec",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "missing record",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/demo2/records/missing",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "unauthenticated trying to access nil rule collection (aka. need superuser auth)",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/demo1/records/imy661ixudk5izi",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authenticated record trying to access nil rule collection (aka. need superuser auth)",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records/imy661ixudk5izi",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authenticated record that doesn't match the collection view rule",
+			Method: http.MethodGet,
+			URL:    "/api/collections/users/records/bgs820n361vj1qd",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "public collection view",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/demo2/records/0yxhwia2amd8gec",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"0yxhwia2amd8gec"`,
+				`"collectionName":"demo2"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:           "public collection view (using the collection id)",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/sz5l5z67tg7gku0/records/0yxhwia2amd8gec",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"0yxhwia2amd8gec"`,
+				`"collectionName":"demo2"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:   "authorized as superuser trying to access nil rule collection view (aka. need superuser auth)",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records/imy661ixudk5izi",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"imy661ixudk5izi"`,
+				`"collectionName":"demo1"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:   "authenticated record that does match the collection view rule",
+			Method: http.MethodGet,
+			URL:    "/api/collections/users/records/4q1xlclmfloku33",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"4q1xlclmfloku33"`,
+				`"collectionName":"users"`,
+				// owners can always view their email
+				`"emailVisibility":false`,
+				`"email":"test@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:   "expand relations",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records/al1h9ijdeojtsjy?expand=rel_one,rel_many.rel,missing&perPage=2&sort=created",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"al1h9ijdeojtsjy"`,
+				`"collectionName":"demo1"`,
+				`"rel_many":[{`,
+				`"rel_one":{`,
+				`"collectionName":"users"`,
+				`"id":"bgs820n361vj1qd"`,
+				`"expand":{"rel":{`,
+				`"id":"0yxhwia2amd8gec"`,
+				`"collectionName":"demo2"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      7,
+			},
+		},
+		{
+			Name:   "OnRecordViewRequest tx body write check",
+			Method: http.MethodGet,
+			URL:    "/api/collections/demo1/records/al1h9ijdeojtsjy",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordViewRequest().BindFunc(func(e *core.RecordRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordViewRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// auth collection
+		// -----------------------------------------------------------
+		{
+			Name:           "check email visibility as guest",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/nologin/records/oos036e9xvqeexy",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"oos036e9xvqeexy"`,
+				`"emailVisibility":false`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"email":"test3@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:   "check email visibility as any authenticated record",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/records/oos036e9xvqeexy",
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"oos036e9xvqeexy"`,
+				`"emailVisibility":false`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"email":"test3@example.com"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:   "check email visibility as manage auth record",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/records/oos036e9xvqeexy",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"oos036e9xvqeexy"`,
+				`"emailVisibility":false`,
+				`"email":"test3@example.com"`,
+				`"verified":true`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:   "check email visibility as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/records/oos036e9xvqeexy",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"oos036e9xvqeexy"`,
+				`"emailVisibility":false`,
+				`"email":"test3@example.com"`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:   "check self email visibility resolver",
+			Method: http.MethodGet,
+			URL:    "/api/collections/nologin/records/dc49k6jgejn40h3",
+			Headers: map[string]string{
+				// nologin, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoia3B2NzA5c2sybHFicWs4IiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.fdUPFLDx5b6RM_XFqnqsyiyNieyKA2HIIkRmUh9kIoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"dc49k6jgejn40h3"`,
+				`"email":"test@example.com"`,
+				`"emailVisibility":false`,
+				`"verified":false`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+
+		// view collection
+		// -----------------------------------------------------------
+		{
+			Name:           "public view record",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/view2/records/84nmscqy84lsi1t",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"84nmscqy84lsi1t"`,
+				`"state":true`,
+				`"file_many":["`,
+				`"rel_many":["`,
+			},
+			NotExpectedContent: []string{
+				`"created"`,
+				`"updated"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:            "guest that doesn't match the view collection view rule",
+			Method:          http.MethodGet,
+			URL:             "/api/collections/view1/records/84nmscqy84lsi1t",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authenticated record that matches the view collection view rule",
+			Method: http.MethodGet,
+			URL:    "/api/collections/view1/records/84nmscqy84lsi1t",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"84nmscqy84lsi1t"`,
+				`"bool":true`,
+				`"text":"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+		{
+			Name:           "view record with numeric id",
+			Method:         http.MethodGet,
+			URL:            "/api/collections/numeric_id_view/records/1",
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"1"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                   0,
+				"OnRecordViewRequest": 1,
+				"OnRecordEnrich":      1,
+			},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - numeric_id_view:view",
+			Method: http.MethodGet,
+			URL:    "/api/collections/numeric_id_view/records/1",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:view"},
+					{MaxRequests: 0, Label: "numeric_id_view:view"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:view",
+			Method: http.MethodGet,
+			URL:    "/api/collections/numeric_id_view/records/1",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:view"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudDelete(t *testing.T) {
+	t.Parallel()
+
+	ensureDeletedFiles := func(app *tests.TestApp, collectionId string, recordId string) {
+		storageDir := filepath.Join(app.DataDir(), "storage", collectionId, recordId)
+
+		entries, _ := os.ReadDir(storageDir)
+		if len(entries) != 0 {
+			t.Errorf("Expected empty/deleted dir, found: %d\n%v", len(entries), entries)
+		}
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "missing collection",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/missing/records/0yxhwia2amd8gec",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "missing record",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/demo2/records/missing",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "unauthenticated trying to delete nil rule collection (aka. need superuser auth)",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/demo1/records/imy661ixudk5izi",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authenticated record trying to delete nil rule collection (aka. need superuser auth)",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo1/records/imy661ixudk5izi",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authenticated record that doesn't match the collection delete rule",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/users/records/bgs820n361vj1qd",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "trying to delete a view collection record",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/view1/records/imy661ixudk5izi",
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "public collection record delete",
+			Method:         http.MethodDelete,
+			URL:            "/api/collections/nologin/records/dc49k6jgejn40h3",
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+		{
+			Name:           "public collection record delete (using the collection id as identifier)",
+			Method:         http.MethodDelete,
+			URL:            "/api/collections/kpv709sk2lqbqk8/records/dc49k6jgejn40h3",
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser trying to delete nil rule collection view (aka. need superuser auth)",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/clients/records/o1y0dd0spd786md",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+		{
+			Name:   "OnRecordDeleteRequest tx body write check",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/clients/records/o1y0dd0spd786md",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordDeleteRequest().BindFunc(func(e *core.RecordRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordDeleteRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+		{
+			Name:   "authenticated record that match the collection delete rule",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/users/records/4q1xlclmfloku33",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              3, // +2 for the externalAuths
+				"OnModelDeleteExecute":       3,
+				"OnModelAfterDeleteSuccess":  3,
+				"OnRecordDelete":             3,
+				"OnRecordDeleteExecute":      3,
+				"OnRecordAfterDeleteSuccess": 3,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnRecordUpdateExecute":      1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				ensureDeletedFiles(app, "_pb_users_auth_", "4q1xlclmfloku33")
+
+				// check if all the external auths records were deleted
+				collection, _ := app.FindCollectionByNameOrId("users")
+				record := core.NewRecord(collection)
+				record.Set("id", "4q1xlclmfloku33")
+				externalAuths, err := app.FindAllExternalAuthsByRecord(record)
+				if err != nil {
+					t.Errorf("Failed to fetch external auths: %v", err)
+				}
+				if len(externalAuths) > 0 {
+					t.Errorf("Expected the linked external auths to be deleted, got %d", len(externalAuths))
+				}
+			},
+		},
+		{
+			Name:            "@request :isset (rule failure check)",
+			Method:          http.MethodDelete,
+			URL:             "/api/collections/demo5/records/la4y2w4o98acwuj",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "@request :isset (rule pass check)",
+			Method:         http.MethodDelete,
+			URL:            "/api/collections/demo5/records/la4y2w4o98acwuj?test=1",
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+			},
+		},
+
+		// cascade delete checks
+		// -----------------------------------------------------------
+		{
+			Name:   "trying to delete a record while being part of a non-cascade required relation",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo3/records/7nwo8tuiatetxdm",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordDeleteRequest":    1,
+				"OnModelDelete":            2, // the record itself + rel_one_cascade of test1 record
+				"OnModelDeleteExecute":     2,
+				"OnModelAfterDeleteError":  2,
+				"OnRecordDelete":           2,
+				"OnRecordDeleteExecute":    2,
+				"OnRecordAfterDeleteError": 2,
+				"OnModelUpdate":            2, // self_rel_many update of test1 record + rel_one_cascade demo4 cascaded in demo5
+				"OnModelUpdateExecute":     2,
+				"OnModelAfterUpdateError":  2,
+				"OnRecordUpdate":           2,
+				"OnRecordUpdateExecute":    2,
+				"OnRecordAfterUpdateError": 2,
+			},
+		},
+		{
+			Name:   "delete a record with non-cascade references",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo3/records/1tmknxy2868d869",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              1,
+				"OnModelDeleteExecute":       1,
+				"OnModelAfterDeleteSuccess":  1,
+				"OnRecordDelete":             1,
+				"OnRecordDeleteExecute":      1,
+				"OnRecordAfterDeleteSuccess": 1,
+				"OnModelUpdate":              2,
+				"OnModelUpdateExecute":       2,
+				"OnModelAfterUpdateSuccess":  2,
+				"OnRecordUpdate":             2,
+				"OnRecordUpdateExecute":      2,
+				"OnRecordAfterUpdateSuccess": 2,
+			},
+		},
+		{
+			Name:   "delete a record with cascade references",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/users/records/oap640cot4yru2s",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			Delay:          100 * time.Millisecond,
+			ExpectedStatus: 204,
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordDeleteRequest":      1,
+				"OnModelDelete":              2,
+				"OnModelDeleteExecute":       2,
+				"OnModelAfterDeleteSuccess":  2,
+				"OnRecordDelete":             2,
+				"OnRecordDeleteExecute":      2,
+				"OnRecordAfterDeleteSuccess": 2,
+				"OnModelUpdate":              2,
+				"OnModelUpdateExecute":       2,
+				"OnModelAfterUpdateSuccess":  2,
+				"OnRecordUpdate":             2,
+				"OnRecordUpdateExecute":      2,
+				"OnRecordAfterUpdateSuccess": 2,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				recId := "84nmscqy84lsi1t"
+				rec, _ := app.FindRecordById("demo1", recId, nil)
+				if rec != nil {
+					t.Errorf("Expected record %s to be cascade deleted", recId)
+				}
+				ensureDeletedFiles(app, "wsmn24bux7wo113", recId)
+				ensureDeletedFiles(app, "_pb_users_auth_", "oap640cot4yru2s")
+			},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - demo5:delete",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo5/records/la4y2w4o98acwuj?test=1",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:delete"},
+					{MaxRequests: 0, Label: "demo5:delete"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:delete",
+			Method: http.MethodDelete,
+			URL:    "/api/collections/demo5/records/la4y2w4o98acwuj?test=1",
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:delete"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudCreate(t *testing.T) {
+	t.Parallel()
+
+	formData, mp, err := tests.MockMultipartData(map[string]string{
+		"title": "title_test",
+	}, "files")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	formData2, mp2, err2 := tests.MockMultipartData(map[string]string{
+		router.JSONPayloadKey: `{"title": "title_test2", "testPayload": 123}`,
+	}, "files")
+	if err2 != nil {
+		t.Fatal(err2)
+	}
+
+	formData3, mp3, err3 := tests.MockMultipartData(map[string]string{
+		router.JSONPayloadKey: `{"title": "title_test3", "testPayload": 123}`,
+	}, "files")
+	if err3 != nil {
+		t.Fatal(err3)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "missing collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/missing/records",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "guest trying to access nil-rule collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo1/records",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record trying to access nil-rule collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo1/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "trying to create a new view collection record",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/view1/records",
+			Body:            strings.NewReader(`{"text":"new"}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "submit invalid body",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo2/records",
+			Body:            strings.NewReader(`{"`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "submit nil body",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/demo2/records",
+			Body:           nil,
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"title":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordCreateRequest":    1,
+				"OnModelCreate":            1,
+				"OnModelValidate":          1,
+				"OnModelAfterCreateError":  1,
+				"OnRecordCreate":           1,
+				"OnRecordValidate":         1,
+				"OnRecordAfterCreateError": 1,
+			},
+		},
+		{
+			Name:           "submit empty json body",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/nologin/records",
+			Body:           strings.NewReader(`{}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"password":{"code":"validation_required"`,
+				`"passwordConfirm":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnRecordCreateRequest": 1,
+			},
+		},
+		{
+			Name:           "guest submit in public collection",
+			Method:         http.MethodPost,
+			URL:            "/api/collections/demo2/records",
+			Body:           strings.NewReader(`{"title":"new"}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":`,
+				`"title":"new"`,
+				`"active":false`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:            "guest trying to submit in restricted collection",
+			Method:          http.MethodPost,
+			URL:             "/api/collections/demo3/records",
+			Body:            strings.NewReader(`{"title":"test123"}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record submit in restricted collection (rule failure check)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body:   strings.NewReader(`{"title":"test123"}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record submit in restricted collection (rule pass check) + expand relations",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo4/records?expand=missing,rel_one_no_cascade,rel_many_no_cascade_required",
+			Body: strings.NewReader(`{
+				"title":"test123",
+				"rel_one_no_cascade":"mk5fmymtx4wsprk",
+				"rel_one_no_cascade_required":"7nwo8tuiatetxdm",
+				"rel_one_cascade":"mk5fmymtx4wsprk",
+				"rel_many_no_cascade":"mk5fmymtx4wsprk",
+				"rel_many_no_cascade_required":["7nwo8tuiatetxdm","lcl9d87w22ml6jy"],
+				"rel_many_cascade":"lcl9d87w22ml6jy"
+			}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":`,
+				`"title":"test123"`,
+				`"expand":{}`, // empty expand even because of the query param
+				`"rel_one_no_cascade":"mk5fmymtx4wsprk"`,
+				`"rel_one_no_cascade_required":"7nwo8tuiatetxdm"`,
+				`"rel_one_cascade":"mk5fmymtx4wsprk"`,
+				`"rel_many_no_cascade":["mk5fmymtx4wsprk"]`,
+				`"rel_many_no_cascade_required":["7nwo8tuiatetxdm","lcl9d87w22ml6jy"]`,
+				`"rel_many_cascade":["lcl9d87w22ml6jy"]`,
+			},
+			NotExpectedContent: []string{
+				// the users auth records don't have access to view the demo3 expands
+				`"missing"`,
+				`"id":"mk5fmymtx4wsprk"`,
+				`"id":"7nwo8tuiatetxdm"`,
+				`"id":"lcl9d87w22ml6jy"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "superuser submit in restricted collection (rule skip check) + expand relations",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo4/records?expand=missing,rel_one_no_cascade,rel_many_no_cascade_required",
+			Body: strings.NewReader(`{
+				"title":"test123",
+				"rel_one_no_cascade":"mk5fmymtx4wsprk",
+				"rel_one_no_cascade_required":"7nwo8tuiatetxdm",
+				"rel_one_cascade":"mk5fmymtx4wsprk",
+				"rel_many_no_cascade":"mk5fmymtx4wsprk",
+				"rel_many_no_cascade_required":["7nwo8tuiatetxdm","lcl9d87w22ml6jy"],
+				"rel_many_cascade":"lcl9d87w22ml6jy"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":`,
+				`"title":"test123"`,
+				`"rel_one_no_cascade":"mk5fmymtx4wsprk"`,
+				`"rel_one_no_cascade_required":"7nwo8tuiatetxdm"`,
+				`"rel_one_cascade":"mk5fmymtx4wsprk"`,
+				`"rel_many_no_cascade":["mk5fmymtx4wsprk"]`,
+				`"rel_many_no_cascade_required":["7nwo8tuiatetxdm","lcl9d87w22ml6jy"]`,
+				`"rel_many_cascade":["lcl9d87w22ml6jy"]`,
+				`"expand":{`,
+				`"id":"mk5fmymtx4wsprk"`,
+				`"id":"7nwo8tuiatetxdm"`,
+				`"id":"lcl9d87w22ml6jy"`,
+			},
+			NotExpectedContent: []string{
+				`"missing"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             4,
+			},
+		},
+		{
+			Name:   "superuser submit via multipart form data",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body:   formData,
+			Headers: map[string]string{
+				"Content-Type":  mp.FormDataContentType(),
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"`,
+				`"title":"title_test"`,
+				`"files":["`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "submit via multipart form data with @jsonPayload key and unsatisfied @request.body rule",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body:   formData2,
+			Headers: map[string]string{
+				"Content-Type": mp2.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				collection, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatalf("failed to find demo3 collection: %v", err)
+				}
+				collection.CreateRule = types.Pointer("@request.body.testPayload != 123")
+				if err := app.Save(collection); err != nil {
+					t.Fatalf("failed to update demo3 collection create rule: %v", err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "submit via multipart form data with @jsonPayload key and satisfied @request.body rule",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body:   formData3,
+			Headers: map[string]string{
+				"Content-Type": mp3.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				collection, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatalf("failed to find demo3 collection: %v", err)
+				}
+				collection.CreateRule = types.Pointer("@request.body.testPayload = 123")
+				if err := app.Save(collection); err != nil {
+					t.Fatalf("failed to update demo3 collection create rule: %v", err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"`,
+				`"title":"title_test3"`,
+				`"files":["`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "unique field error check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo2/records",
+			Body: strings.NewReader(`{
+				"title":"test2"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"title":{`,
+				`"code":"validation_not_unique"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordCreateRequest":    1,
+				"OnModelCreate":            1,
+				"OnModelCreateExecute":     1,
+				"OnModelAfterCreateError":  1,
+				"OnModelValidate":          1,
+				"OnRecordCreate":           1,
+				"OnRecordCreateExecute":    1,
+				"OnRecordAfterCreateError": 1,
+				"OnRecordValidate":         1,
+			},
+		},
+		{
+			Name:   "OnRecordCreateRequest tx body write check",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo2/records",
+			Body:   strings.NewReader(`{"title":"new"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordCreateRequest().BindFunc(func(e *core.RecordRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordCreateRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+
+		// ID checks
+		// -----------------------------------------------------------
+		{
+			Name:   "invalid custom insertion id (less than 15 chars)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "12345678901234",
+				"title": "test"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"id":{"code":"validation_min_text_constraint"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordCreateRequest":    1,
+				"OnModelCreate":            1,
+				"OnModelValidate":          1,
+				"OnModelAfterCreateError":  1,
+				"OnRecordCreate":           1,
+				"OnRecordValidate":         1,
+				"OnRecordAfterCreateError": 1,
+			},
+		},
+		{
+			Name:   "invalid custom insertion id (more than 15 chars)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "1234567890123456",
+				"title": "test"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"id":{"code":"validation_max_text_constraint"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordCreateRequest":    1,
+				"OnModelCreate":            1,
+				"OnModelValidate":          1,
+				"OnModelAfterCreateError":  1,
+				"OnRecordCreate":           1,
+				"OnRecordValidate":         1,
+				"OnRecordAfterCreateError": 1,
+			},
+		},
+		{
+			Name:   "valid custom insertion id (exactly 15 chars)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "123456789012345",
+				"title": "test"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"123456789012345"`,
+				`"title":"test"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "valid custom insertion id existing in another non-auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "0yxhwia2amd8gec",
+				"title": "test"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"0yxhwia2amd8gec"`,
+				`"title":"test"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "valid custom insertion auth id duplicating in another auth collection",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/records",
+			Body: strings.NewReader(`{
+				"id":"o1y0dd0spd786md",
+				"title":"test",
+				"password":"1234567890",
+				"passwordConfirm":"1234567890"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"id":{"code":"validation_invalid_auth_id"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordCreateRequest":    1,
+				"OnModelCreate":            1,
+				"OnModelCreateExecute":     1, // unique constraints are handled on db level
+				"OnModelAfterCreateError":  1,
+				"OnRecordCreate":           1,
+				"OnRecordCreateExecute":    1,
+				"OnRecordAfterCreateError": 1,
+				"OnModelValidate":          1,
+				"OnRecordValidate":         1,
+			},
+		},
+
+		// check whether if @request.body modifer fields are properly resolved
+		// -----------------------------------------------------------
+		{
+			Name:   "@request.body.field with compute modifers (rule failure check)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo5/records",
+			Body: strings.NewReader(`{
+				"total+":4,
+				"total-":2
+			}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "@request.body.field with compute modifers (rule pass check)",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo5/records",
+			Body: strings.NewReader(`{
+				"total+":4,
+				"total-":1
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"`,
+				`"collectionName":"demo5"`,
+				`"total":3`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+
+		// auth records
+		// -----------------------------------------------------------
+		{
+			Name:   "auth record with invalid form data",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/records",
+			Body: strings.NewReader(`{
+				"password":"1234567",
+				"passwordConfirm":"1234560",
+				"email":"invalid",
+				"username":"Users75657"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"passwordConfirm":{"code":"validation_values_mismatch"`,
+			},
+			NotExpectedContent: []string{
+				// record fields are not checked if the base auth form fields have errors
+				`"rel":`,
+				`"email":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnRecordCreateRequest": 1,
+			},
+		},
+		{
+			Name:   "auth record with valid form data but invalid record fields",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/records",
+			Body: strings.NewReader(`{
+				"password":"1234567",
+				"passwordConfirm":"1234567",
+				"rel":"invalid"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"rel":{"code":`,
+				`"password":{"code":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordCreateRequest":    1,
+				"OnModelCreate":            1,
+				"OnModelValidate":          1,
+				"OnModelAfterCreateError":  1,
+				"OnRecordCreate":           1,
+				"OnRecordValidate":         1,
+				"OnRecordAfterCreateError": 1,
+			},
+		},
+		{
+			Name:   "auth record with valid data and explicitly verified state by guest",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/records",
+			Body: strings.NewReader(`{
+				"password":"12345678",
+				"passwordConfirm":"12345678",
+				"verified":true
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"verified":{"code":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnRecordCreateRequest": 1,
+				// no validation hooks because it should fail before save by the form auth fields validator
+			},
+		},
+		{
+			Name:   "auth record with valid data and explicitly verified state by random user",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/records",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body: strings.NewReader(`{
+				"password":"12345678",
+				"passwordConfirm":"12345678",
+				"emailVisibility":true,
+				"verified":true
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"verified":{"code":`,
+			},
+			NotExpectedContent: []string{
+				`"emailVisibility":{"code":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnRecordCreateRequest": 1,
+				// no validation hooks because it should fail before save by the form auth fields validator
+			},
+		},
+		{
+			Name:   "auth record with valid data by superuser",
+			Method: http.MethodPost,
+			URL:    "/api/collections/users/records",
+			Body: strings.NewReader(`{
+				"id":"o1o1y0pd78686mq",
+				"username":"test.valid",
+				"email":"new@example.com",
+				"password":"12345678",
+				"passwordConfirm":"12345678",
+				"rel":"achvryl401bhse3",
+				"emailVisibility":true,
+				"verified":true
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"o1o1y0pd78686mq"`,
+				`"username":"test.valid"`,
+				`"email":"new@example.com"`,
+				`"rel":"achvryl401bhse3"`,
+				`"emailVisibility":true`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"passwordConfirm"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "auth record with valid data by auth record with manage access",
+			Method: http.MethodPost,
+			URL:    "/api/collections/nologin/records",
+			Body: strings.NewReader(`{
+				"email":"new@example.com",
+				"password":"12345678",
+				"passwordConfirm":"12345678",
+				"name":"test_name",
+				"emailVisibility":true,
+				"verified":true
+			}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"`,
+				`"username":"`,
+				`"email":"new@example.com"`,
+				`"name":"test_name"`,
+				`"emailVisibility":true`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"passwordConfirm"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+
+		// ensure that hidden fields cannot be set by non-superusers
+		// -----------------------------------------------------------
+		{
+			Name:   "create with hidden field as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "abcde1234567890",
+				"title": "test_create"
+			}`),
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				col, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// mock hidden field
+				col.Fields.GetByName("title").SetHidden(true)
+
+				if err = app.Save(col); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				record, err := app.FindRecordById("demo3", "abcde1234567890")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// ensure that the title wasn't saved
+				if v := record.GetString("title"); v != "" {
+					t.Fatalf("Expected empty title, got %q", v)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"abcde1234567890"`,
+			},
+			NotExpectedContent: []string{
+				`"title"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "create with hidden field as superuser",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo3/records",
+			Body: strings.NewReader(`{
+				"id": "abcde1234567890",
+				"title": "test_create"
+			}`),
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				col, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// mock hidden field
+				col.Fields.GetByName("title").SetHidden(true)
+
+				if err = app.Save(col); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				record, err := app.FindRecordById("demo3", "abcde1234567890")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// ensure that the title was saved
+				if v := record.GetString("title"); v != "test_create" {
+					t.Fatalf("Expected title %q, got %q", "test_create", v)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"abcde1234567890"`,
+				`"title":"test_create"`,
+			},
+			NotExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordCreateRequest":      1,
+				"OnModelCreate":              1,
+				"OnModelCreateExecute":       1,
+				"OnModelAfterCreateSuccess":  1,
+				"OnRecordCreate":             1,
+				"OnRecordCreateExecute":      1,
+				"OnRecordAfterCreateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - demo2:create",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo2/records",
+			Body:   strings.NewReader(`{"title":"new"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:create"},
+					{MaxRequests: 0, Label: "demo2:create"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:create",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo2/records",
+			Body:   strings.NewReader(`{"title":"new"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:create"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+
+		// dynamic body limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "body > collection BodyLimit",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo1/records",
+			// the exact body doesn't matter as long as it returns 413
+			Body: bytes.NewReader(make([]byte, apis.DefaultMaxBodySize+5+20+2+1)),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				collection, err := app.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// adjust field sizes for the test
+				// ---
+				fileOneField := collection.Fields.GetByName("file_one").(*core.FileField)
+				fileOneField.MaxSize = 5
+
+				fileManyField := collection.Fields.GetByName("file_many").(*core.FileField)
+				fileManyField.MaxSize = 10
+				fileManyField.MaxSelect = 2
+
+				jsonField := collection.Fields.GetByName("json").(*core.JSONField)
+				jsonField.MaxSize = 2
+
+				err = app.Save(collection)
+				if err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  413,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "body <= collection BodyLimit",
+			Method: http.MethodPost,
+			URL:    "/api/collections/demo1/records",
+			// the exact body doesn't matter as long as it doesn't return 413
+			Body: bytes.NewReader(make([]byte, apis.DefaultMaxBodySize+5+20+2)),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				collection, err := app.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// adjust field sizes for the test
+				// ---
+				fileOneField := collection.Fields.GetByName("file_one").(*core.FileField)
+				fileOneField.MaxSize = 5
+
+				fileManyField := collection.Fields.GetByName("file_many").(*core.FileField)
+				fileManyField.MaxSize = 10
+				fileManyField.MaxSelect = 2
+
+				jsonField := collection.Fields.GetByName("json").(*core.JSONField)
+				jsonField.MaxSize = 2
+
+				err = app.Save(collection)
+				if err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestRecordCrudUpdate(t *testing.T) {
+	t.Parallel()
+
+	formData, mp, err := tests.MockMultipartData(map[string]string{
+		"title": "title_test",
+	}, "files")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	formData2, mp2, err2 := tests.MockMultipartData(map[string]string{
+		router.JSONPayloadKey: `{"title": "title_test2", "testPayload": 123}`,
+	}, "files")
+	if err2 != nil {
+		t.Fatal(err2)
+	}
+
+	formData3, mp3, err3 := tests.MockMultipartData(map[string]string{
+		router.JSONPayloadKey: `{"title": "title_test3", "testPayload": 123, "files":"300_JdfBOieXAW.png"}`,
+	}, "files")
+	if err3 != nil {
+		t.Fatal(err3)
+	}
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "missing collection",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/missing/records/0yxhwia2amd8gec",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "guest trying to access nil-rule collection record",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/demo1/records/imy661ixudk5izi",
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record trying to access nil-rule collection",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1/records/imy661ixudk5izi",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "trying to update a view collection record",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/view1/records/imy661ixudk5izi",
+			Body:            strings.NewReader(`{"text":"new"}`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:            "submit invalid body",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/demo2/records/0yxhwia2amd8gec",
+			Body:            strings.NewReader(`{"`),
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:           "submit nil body (aka. no fields change)",
+			Method:         http.MethodPatch,
+			URL:            "/api/collections/demo2/records/0yxhwia2amd8gec",
+			Body:           nil,
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"collectionName":"demo2"`,
+				`"id":"0yxhwia2amd8gec"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:           "submit empty body (aka. no fields change)",
+			Method:         http.MethodPatch,
+			URL:            "/api/collections/demo2/records/0yxhwia2amd8gec",
+			Body:           strings.NewReader(`{}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"collectionName":"demo2"`,
+				`"id":"0yxhwia2amd8gec"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:           "trigger field validation",
+			Method:         http.MethodPatch,
+			URL:            "/api/collections/demo2/records/0yxhwia2amd8gec",
+			Body:           strings.NewReader(`{"title":"a"}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`data":{`,
+				`"title":{"code":"validation_min_text_constraint"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordUpdateRequest":    1,
+				"OnModelUpdate":            1,
+				"OnModelValidate":          1,
+				"OnModelAfterUpdateError":  1,
+				"OnRecordUpdate":           1,
+				"OnRecordValidate":         1,
+				"OnRecordAfterUpdateError": 1,
+			},
+		},
+		{
+			Name:           "guest submit in public collection",
+			Method:         http.MethodPatch,
+			URL:            "/api/collections/demo2/records/0yxhwia2amd8gec",
+			Body:           strings.NewReader(`{"title":"new"}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"0yxhwia2amd8gec"`,
+				`"title":"new"`,
+				`"active":true`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:            "guest trying to submit in restricted collection",
+			Method:          http.MethodPatch,
+			URL:             "/api/collections/demo3/records/mk5fmymtx4wsprk",
+			Body:            strings.NewReader(`{"title":"new"}`),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record submit in restricted collection (rule failure check)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo3/records/mk5fmymtx4wsprk",
+			Body:   strings.NewReader(`{"title":"new"}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "auth record submit in restricted collection (rule pass check) + expand relations",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo4/records/i9naidtvr6qsgb4?expand=missing,rel_one_no_cascade,rel_many_no_cascade_required",
+			Body: strings.NewReader(`{
+				"title":"test123",
+				"rel_one_no_cascade":"mk5fmymtx4wsprk",
+				"rel_one_no_cascade_required":"7nwo8tuiatetxdm",
+				"rel_one_cascade":"mk5fmymtx4wsprk",
+				"rel_many_no_cascade":"mk5fmymtx4wsprk",
+				"rel_many_no_cascade_required":["7nwo8tuiatetxdm","lcl9d87w22ml6jy"],
+				"rel_many_cascade":"lcl9d87w22ml6jy"
+			}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"i9naidtvr6qsgb4"`,
+				`"title":"test123"`,
+				`"expand":{}`, // empty expand even because of the query param
+				`"rel_one_no_cascade":"mk5fmymtx4wsprk"`,
+				`"rel_one_no_cascade_required":"7nwo8tuiatetxdm"`,
+				`"rel_one_cascade":"mk5fmymtx4wsprk"`,
+				`"rel_many_no_cascade":["mk5fmymtx4wsprk"]`,
+				`"rel_many_no_cascade_required":["7nwo8tuiatetxdm","lcl9d87w22ml6jy"]`,
+				`"rel_many_cascade":["lcl9d87w22ml6jy"]`,
+			},
+			NotExpectedContent: []string{
+				// the users auth records don't have access to view the demo3 expands
+				`"missing"`,
+				`"id":"mk5fmymtx4wsprk"`,
+				`"id":"7nwo8tuiatetxdm"`,
+				`"id":"lcl9d87w22ml6jy"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "superuser submit in restricted collection (rule skip check) + expand relations",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo4/records/i9naidtvr6qsgb4?expand=missing,rel_one_no_cascade,rel_many_no_cascade_required",
+			Body: strings.NewReader(`{
+				"title":"test123",
+				"rel_one_no_cascade":"mk5fmymtx4wsprk",
+				"rel_one_no_cascade_required":"7nwo8tuiatetxdm",
+				"rel_one_cascade":"mk5fmymtx4wsprk",
+				"rel_many_no_cascade":"mk5fmymtx4wsprk",
+				"rel_many_no_cascade_required":["7nwo8tuiatetxdm","lcl9d87w22ml6jy"],
+				"rel_many_cascade":"lcl9d87w22ml6jy"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"i9naidtvr6qsgb4"`,
+				`"title":"test123"`,
+				`"rel_one_no_cascade":"mk5fmymtx4wsprk"`,
+				`"rel_one_no_cascade_required":"7nwo8tuiatetxdm"`,
+				`"rel_one_cascade":"mk5fmymtx4wsprk"`,
+				`"rel_many_no_cascade":["mk5fmymtx4wsprk"]`,
+				`"rel_many_no_cascade_required":["7nwo8tuiatetxdm","lcl9d87w22ml6jy"]`,
+				`"rel_many_cascade":["lcl9d87w22ml6jy"]`,
+				`"expand":{`,
+				`"id":"mk5fmymtx4wsprk"`,
+				`"id":"7nwo8tuiatetxdm"`,
+				`"id":"lcl9d87w22ml6jy"`,
+			},
+			NotExpectedContent: []string{
+				`"missing"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             4,
+			},
+		},
+		{
+			Name:   "superuser submit via multipart form data",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo3/records/mk5fmymtx4wsprk",
+			Body:   formData,
+			Headers: map[string]string{
+				"Content-Type":  mp.FormDataContentType(),
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"mk5fmymtx4wsprk"`,
+				`"title":"title_test"`,
+				`"files":["`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "submit via multipart form data with @jsonPayload key and unsatisfied @request.body rule",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo3/records/mk5fmymtx4wsprk",
+			Body:   formData2,
+			Headers: map[string]string{
+				"Content-Type": mp2.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				collection, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatalf("failed to find demo3 collection: %v", err)
+				}
+				collection.UpdateRule = types.Pointer("@request.body.testPayload != 123")
+				if err := app.Save(collection); err != nil {
+					t.Fatalf("failed to update demo3 collection update rule: %v", err)
+				}
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "submit via multipart form data with @jsonPayload key and satisfied @request.body rule",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo3/records/mk5fmymtx4wsprk",
+			Body:   formData3,
+			Headers: map[string]string{
+				"Content-Type": mp3.FormDataContentType(),
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				collection, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatalf("failed to find demo3 collection: %v", err)
+				}
+				collection.UpdateRule = types.Pointer("@request.body.testPayload = 123")
+				if err := app.Save(collection); err != nil {
+					t.Fatalf("failed to update demo3 collection update rule: %v", err)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"mk5fmymtx4wsprk"`,
+				`"title":"title_test3"`,
+				`"files":["`,
+				`"300_JdfBOieXAW.png"`,
+				`"tmpfile_`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "OnRecordUpdateRequest tx body write check",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo2/records/0yxhwia2amd8gec",
+			Body:   strings.NewReader(`{"title":"new"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnRecordUpdateRequest().BindFunc(func(e *core.RecordRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnRecordUpdateRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+		{
+			Name:   "try to change the id of an existing record",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo3/records/mk5fmymtx4wsprk",
+			Body: strings.NewReader(`{
+				"id": "mk5fmymtx4wspra"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"id":{"code":"validation_pk_change"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordUpdateRequest":    1,
+				"OnModelUpdate":            1,
+				"OnModelValidate":          1,
+				"OnModelAfterUpdateError":  1,
+				"OnRecordUpdate":           1,
+				"OnRecordValidate":         1,
+				"OnRecordAfterUpdateError": 1,
+			},
+		},
+		{
+			Name:   "unique field error check",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo2/records/llvuca81nly1qls",
+			Body: strings.NewReader(`{
+				"title":"test2"
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"title":{`,
+				`"code":"validation_not_unique"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordUpdateRequest":    1,
+				"OnModelUpdate":            1,
+				"OnModelUpdateExecute":     1,
+				"OnModelAfterUpdateError":  1,
+				"OnRecordUpdate":           1,
+				"OnRecordUpdateExecute":    1,
+				"OnRecordAfterUpdateError": 1,
+				"OnModelValidate":          1,
+				"OnRecordValidate":         1,
+			},
+		},
+
+		// check whether if @request.body modifer fields are properly resolved
+		// -----------------------------------------------------------
+		{
+			Name:   "@request.body.field with compute modifers (rule failure check)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo5/records/la4y2w4o98acwuj",
+			Body: strings.NewReader(`{
+				"total+":3,
+				"total-":1
+			}`),
+			ExpectedStatus: 404,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "@request.body.field with compute modifers (rule pass check)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo5/records/la4y2w4o98acwuj",
+			Body: strings.NewReader(`{
+				"total+":2,
+				"total-":1
+			}`),
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"la4y2w4o98acwuj"`,
+				`"collectionName":"demo5"`,
+				`"total":3`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+
+		// auth records
+		// -----------------------------------------------------------
+		{
+			Name:   "auth record with invalid form data",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/users/records/bgs820n361vj1qd",
+			Body: strings.NewReader(`{
+				"password":"",
+				"passwordConfirm":"1234560",
+				"email":"invalid",
+				"verified":false
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"passwordConfirm":{`,
+				`"password":{`,
+			},
+			NotExpectedContent: []string{
+				// record fields are not checked if the base auth form fields have errors
+				`"email":`,
+				"verified", // superusers are allowed to change the verified state
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnRecordUpdateRequest": 1,
+			},
+		},
+		{
+			Name:   "auth record with valid form data but invalid record fields",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/users/records/bgs820n361vj1qd",
+			Body: strings.NewReader(`{
+				"password":"1234567",
+				"passwordConfirm":"1234567",
+				"rel":"invalid"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"rel":{"code":`,
+				`"password":{"code":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                        0,
+				"OnRecordUpdateRequest":    1,
+				"OnModelUpdate":            1,
+				"OnModelValidate":          1,
+				"OnModelAfterUpdateError":  1,
+				"OnRecordUpdate":           1,
+				"OnRecordValidate":         1,
+				"OnRecordAfterUpdateError": 1,
+			},
+		},
+		{
+			Name:   "try to change account managing fields by guest",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/nologin/records/phhq3wr65cap535",
+			Body: strings.NewReader(`{
+				"password":"12345678",
+				"passwordConfirm":"12345678",
+				"emailVisibility":true,
+				"verified":true
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"verified":{"code":`,
+				`"oldPassword":{"code":`,
+			},
+			NotExpectedContent: []string{
+				`"emailVisibility":{"code":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnRecordUpdateRequest": 1,
+			},
+		},
+		{
+			Name:   "try to change account managing fields by auth record (owner)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/users/records/4q1xlclmfloku33",
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			Body: strings.NewReader(`{
+				"password":"12345678",
+				"passwordConfirm":"12345678",
+				"emailVisibility":true,
+				"verified":true
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"verified":{"code":`,
+				`"oldPassword":{"code":`,
+			},
+			NotExpectedContent: []string{
+				`"emailVisibility":{"code":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnRecordUpdateRequest": 1,
+			},
+		},
+		{
+			Name:   "try to unset/downgrade email and verified fields (owner)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/users/records/oap640cot4yru2s",
+			Headers: map[string]string{
+				// users, test2@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6Im9hcDY0MGNvdDR5cnUycyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.GfJo6EHIobgas_AXt-M-tj5IoQendPnrkMSe9ExuSEY",
+			},
+			Body: strings.NewReader(`{
+				"email":"",
+				"verified":false
+			}`),
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"email":{"code":`,
+				`"verified":{"code":`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnRecordUpdateRequest": 1,
+			},
+		},
+		{
+			Name:   "try to change account managing fields by auth record with managing rights",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/nologin/records/phhq3wr65cap535",
+			Body: strings.NewReader(`{
+				"email":"new@example.com",
+				"password":"12345678",
+				"passwordConfirm":"12345678",
+				"name":"test_name",
+				"emailVisibility":true,
+				"verified":true
+			}`),
+			Headers: map[string]string{
+				// users, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"email":"new@example.com"`,
+				`"name":"test_name"`,
+				`"emailVisibility":true`,
+				`"verified":true`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"passwordConfirm"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				record, _ := app.FindRecordById("nologin", "phhq3wr65cap535")
+				if !record.ValidatePassword("12345678") {
+					t.Fatal("Password update failed.")
+				}
+			},
+		},
+		{
+			Name:   "update auth record with valid data by superuser",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/users/records/oap640cot4yru2s",
+			Body: strings.NewReader(`{
+				"username":"test.valid",
+				"email":"new@example.com",
+				"password":"12345678",
+				"passwordConfirm":"12345678",
+				"rel":"achvryl401bhse3",
+				"emailVisibility":true,
+				"verified":false
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"username":"test.valid"`,
+				`"email":"new@example.com"`,
+				`"rel":"achvryl401bhse3"`,
+				`"emailVisibility":true`,
+				`"verified":false`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				record, _ := app.FindRecordById("users", "oap640cot4yru2s")
+				if !record.ValidatePassword("12345678") {
+					t.Fatal("Password update failed.")
+				}
+			},
+		},
+		{
+			Name:   "update auth record with valid data by guest (empty update filter + auth origins check)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/nologin/records/dc49k6jgejn40h3",
+			Body: strings.NewReader(`{
+				"username":"test_new",
+				"emailVisibility":true,
+				"name":"test"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				nologin, err := app.FindCollectionByNameOrId("nologin")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// add dummy auth origins for the record
+				for i := 0; i < 3; i++ {
+					d := core.NewAuthOrigin(app)
+					d.SetCollectionRef(nologin.Id)
+					d.SetRecordRef("dc49k6jgejn40h3")
+					d.SetFingerprint("abc_" + strconv.Itoa(i))
+					if err = app.Save(d); err != nil {
+						t.Fatalf("Failed to save dummy auth origin %d: %v", i, err)
+					}
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"username":"test_new"`,
+				`"email":"test@example.com"`, // the email should be visible since we updated the emailVisibility
+				`"emailVisibility":true`,
+				`"verified":false`,
+				`"name":"test"`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"passwordConfirm"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				record, _ := app.FindRecordById("nologin", "dc49k6jgejn40h3")
+
+				// the dummy auth origins should NOT have been removed since we didn't change the password
+				devices, err := app.FindAllAuthOriginsByRecord(record)
+				if err != nil {
+					t.Fatalf("Failed to retrieve dummy auth origins: %v", err)
+				}
+				if len(devices) != 3 {
+					t.Fatalf("Expected %d auth origins, got %d", 3, len(devices))
+				}
+			},
+		},
+		{
+			Name:   "success password change with oldPassword (+authOrigins reset check)",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/nologin/records/dc49k6jgejn40h3",
+			Body: strings.NewReader(`{
+				"password":"123456789",
+				"passwordConfirm":"123456789",
+				"oldPassword":"1234567890"
+			}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				nologin, err := app.FindCollectionByNameOrId("nologin")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// add dummy auth origins for the record
+				for i := 0; i < 3; i++ {
+					d := core.NewAuthOrigin(app)
+					d.SetCollectionRef(nologin.Id)
+					d.SetRecordRef("dc49k6jgejn40h3")
+					d.SetFingerprint("abc_" + strconv.Itoa(i))
+					if err = app.Save(d); err != nil {
+						t.Fatalf("Failed to save dummy auth origin %d: %v", i, err)
+					}
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"dc49k6jgejn40h3"`,
+			},
+			NotExpectedContent: []string{
+				`"tokenKey"`,
+				`"password"`,
+				`"passwordConfirm"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+				// auth origins
+				"OnModelDelete":              3,
+				"OnModelDeleteExecute":       3,
+				"OnModelAfterDeleteSuccess":  3,
+				"OnRecordDelete":             3,
+				"OnRecordDeleteExecute":      3,
+				"OnRecordAfterDeleteSuccess": 3,
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				record, _ := app.FindRecordById("nologin", "dc49k6jgejn40h3")
+				if !record.ValidatePassword("123456789") {
+					t.Fatal("Password update failed.")
+				}
+
+				// the dummy auth origins should have been removed
+				devices, err := app.FindAllAuthOriginsByRecord(record)
+				if err != nil {
+					t.Fatalf("Failed to retrieve dummy auth origins: %v", err)
+				}
+				if len(devices) > 0 {
+					t.Fatalf("Expected auth origins to be removed, got %d", len(devices))
+				}
+			},
+		},
+
+		// ensure that hidden fields cannot be set by non-superusers
+		// -----------------------------------------------------------
+		{
+			Name:   "update with hidden field as regular user",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo3/records/1tmknxy2868d869",
+			Body: strings.NewReader(`{
+				"title": "test_update"
+			}`),
+			Headers: map[string]string{
+				// clients, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImdrMzkwcWVnczR5NDd3biIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoidjg1MXE0cjc5MHJoa25sIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.0ONnm_BsvPRZyDNT31GN1CKUB6uQRxvVvQ-Wc9AZfG0",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				col, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// mock hidden field
+				col.Fields.GetByName("title").SetHidden(true)
+
+				if err = app.Save(col); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				record, err := app.FindRecordById("demo3", "1tmknxy2868d869")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// ensure that the title wasn't saved
+				if v := record.GetString("title"); v != "test1" {
+					t.Fatalf("Expected no title change, got %q", v)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"1tmknxy2868d869"`,
+			},
+			NotExpectedContent: []string{
+				`"title"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+		{
+			Name:   "update with hidden field as superuser",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo3/records/1tmknxy2868d869",
+			Body: strings.NewReader(`{
+				"title": "test_update"
+			}`),
+			Headers: map[string]string{
+				// superusers, test@example.com
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				col, err := app.FindCollectionByNameOrId("demo3")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// mock hidden field
+				col.Fields.GetByName("title").SetHidden(true)
+
+				if err = app.Save(col); err != nil {
+					t.Fatal(err)
+				}
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				record, err := app.FindRecordById("demo3", "1tmknxy2868d869")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// ensure that the title has been updated
+				if v := record.GetString("title"); v != "test_update" {
+					t.Fatalf("Expected title %q, got %q", "test_update", v)
+				}
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"id":"1tmknxy2868d869"`,
+				`"title":"test_update"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                          0,
+				"OnRecordUpdateRequest":      1,
+				"OnModelUpdate":              1,
+				"OnModelUpdateExecute":       1,
+				"OnModelAfterUpdateSuccess":  1,
+				"OnRecordUpdate":             1,
+				"OnRecordUpdateExecute":      1,
+				"OnRecordAfterUpdateSuccess": 1,
+				"OnModelValidate":            1,
+				"OnRecordValidate":           1,
+				"OnRecordEnrich":             1,
+			},
+		},
+
+		// rate limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "RateLimit rule - demo2:update",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo2/records/0yxhwia2amd8gec",
+			Body:   strings.NewReader(`{"title":"new"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 100, Label: "*:update"},
+					{MaxRequests: 0, Label: "demo2:update"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "RateLimit rule - *:update",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo2/records/0yxhwia2amd8gec",
+			Body:   strings.NewReader(`{"title":"new"}`),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.Settings().RateLimits.Enabled = true
+				app.Settings().RateLimits.Rules = []core.RateLimitRule{
+					{MaxRequests: 100, Label: "abc"},
+					{MaxRequests: 0, Label: "*:update"},
+				}
+			},
+			ExpectedStatus:  429,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+
+		// dynamic body limit checks
+		// -----------------------------------------------------------
+		{
+			Name:   "body > collection BodyLimit",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1/records/imy661ixudk5izi",
+			// the exact body doesn't matter as long as it returns 413
+			Body: bytes.NewReader(make([]byte, apis.DefaultMaxBodySize+5+20+2+1)),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				collection, err := app.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// adjust field sizes for the test
+				// ---
+				fileOneField := collection.Fields.GetByName("file_one").(*core.FileField)
+				fileOneField.MaxSize = 5
+
+				fileManyField := collection.Fields.GetByName("file_many").(*core.FileField)
+				fileManyField.MaxSize = 10
+				fileManyField.MaxSelect = 2
+
+				jsonField := collection.Fields.GetByName("json").(*core.JSONField)
+				jsonField.MaxSize = 2
+
+				err = app.Save(collection)
+				if err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  413,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "body <= collection BodyLimit",
+			Method: http.MethodPatch,
+			URL:    "/api/collections/demo1/records/imy661ixudk5izi",
+			// the exact body doesn't matter as long as it doesn't return 413
+			Body: bytes.NewReader(make([]byte, apis.DefaultMaxBodySize+5+20+2)),
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				collection, err := app.FindCollectionByNameOrId("demo1")
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// adjust field sizes for the test
+				// ---
+				fileOneField := collection.Fields.GetByName("file_one").(*core.FileField)
+				fileOneField.MaxSize = 5
+
+				fileManyField := collection.Fields.GetByName("file_many").(*core.FileField)
+				fileManyField.MaxSize = 10
+				fileManyField.MaxSelect = 2
+
+				jsonField := collection.Fields.GetByName("json").(*core.JSONField)
+				jsonField.MaxSize = 2
+
+				err = app.Save(collection)
+				if err != nil {
+					t.Fatal(err)
+				}
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/record_helpers.go b/server/core_backend-server/apis/record_helpers.go
new file mode 100644
index 0000000..ff138e9
--- /dev/null
+++ b/server/core_backend-server/apis/record_helpers.go
@@ -0,0 +1,657 @@
+package apis
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+const (
+	expandQueryParam = "expand"
+	fieldsQueryParam = "fields"
+)
+
+var ErrMFA = errors.New("mfa required")
+
+// RecordAuthResponse writes standardized json record auth response
+// into the specified request context.
+//
+// The authMethod argument specify the name of the current authentication method (eg. password, oauth2, etc.)
+// that it is used primarily as an auth identifier during MFA and for login alerts.
+//
+// Set authMethod to empty string if you want to ignore the MFA checks and the login alerts
+// (can be also adjusted additionally via the OnRecordAuthRequest hook).
+func RecordAuthResponse(e *core.RequestEvent, authRecord *core.Record, authMethod string, meta any) error {
+	token, tokenErr := authRecord.NewAuthToken()
+	if tokenErr != nil {
+		return e.InternalServerError("Failed to create auth token.", tokenErr)
+	}
+
+	return recordAuthResponse(e, authRecord, token, authMethod, meta)
+}
+
+func recordAuthResponse(e *core.RequestEvent, authRecord *core.Record, token string, authMethod string, meta any) error {
+	originalRequestInfo, err := e.RequestInfo()
+	if err != nil {
+		return err
+	}
+
+	ok, err := e.App.CanAccessRecord(authRecord, originalRequestInfo, authRecord.Collection().AuthRule)
+	if !ok {
+		return firstApiError(err, e.ForbiddenError("The request doesn't satisfy the collection requirements to authenticate.", err))
+	}
+
+	event := new(core.RecordAuthRequestEvent)
+	event.RequestEvent = e
+	event.Collection = authRecord.Collection()
+	event.Record = authRecord
+	event.Token = token
+	event.Meta = meta
+	event.AuthMethod = authMethod
+
+	return e.App.OnRecordAuthRequest().Trigger(event, func(e *core.RecordAuthRequestEvent) error {
+		if e.Written() {
+			return nil
+		}
+
+		// MFA
+		// ---
+		mfaId, err := checkMFA(e.RequestEvent, e.Record, e.AuthMethod)
+		if err != nil {
+			return err
+		}
+
+		// require additional authentication
+		if mfaId != "" {
+			// eagerly write the mfa response and return an err so that
+			// external middlewars are aware that the auth response requires an extra step
+			e.JSON(http.StatusUnauthorized, map[string]string{
+				"mfaId": mfaId,
+			})
+			return ErrMFA
+		}
+		// ---
+
+		// create a shallow copy of the cached request data and adjust it to the current auth record
+		requestInfo := *originalRequestInfo
+		requestInfo.Auth = e.Record
+
+		err = triggerRecordEnrichHooks(e.App, &requestInfo, []*core.Record{e.Record}, func() error {
+			if e.Record.IsSuperuser() {
+				e.Record.Unhide(e.Record.Collection().Fields.FieldNames()...)
+			}
+
+			// allow always returning the email address of the authenticated model
+			e.Record.IgnoreEmailVisibility(true)
+
+			// expand record relations
+			expands := strings.Split(e.Request.URL.Query().Get(expandQueryParam), ",")
+			if len(expands) > 0 {
+				failed := e.App.ExpandRecord(e.Record, expands, expandFetch(e.App, &requestInfo))
+				if len(failed) > 0 {
+					e.App.Logger().Warn("[recordAuthResponse] Failed to expand relations", "error", failed)
+				}
+			}
+
+			return nil
+		})
+		if err != nil {
+			return err
+		}
+
+		if e.AuthMethod != "" && authRecord.Collection().AuthAlert.Enabled {
+			if err = authAlert(e.RequestEvent, e.Record); err != nil {
+				e.App.Logger().Warn("[recordAuthResponse] Failed to send login alert", "error", err)
+			}
+		}
+
+		result := struct {
+			Meta   any          `json:"meta,omitempty"`
+			Record *core.Record `json:"record"`
+			Token  string       `json:"token"`
+		}{
+			Token:  e.Token,
+			Record: e.Record,
+		}
+
+		if e.Meta != nil {
+			result.Meta = e.Meta
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, result)
+		})
+	})
+}
+
+// wantsMFA checks whether to enable MFA for the specified auth record based on its MFA rule
+// (note: returns true even in case of an error as a safer default).
+func wantsMFA(e *core.RequestEvent, record *core.Record) (bool, error) {
+	rule := record.Collection().MFA.Rule
+	if rule == "" {
+		return true, nil
+	}
+
+	requestInfo, err := e.RequestInfo()
+	if err != nil {
+		return true, err
+	}
+
+	var exists int
+
+	query := e.App.RecordQuery(record.Collection()).
+		Select("(1)").
+		AndWhere(dbx.HashExp{record.Collection().Name + ".id": record.Id})
+
+	// parse and apply the access rule filter
+	resolver := core.NewRecordFieldResolver(e.App, record.Collection(), requestInfo, true)
+	expr, err := search.FilterData(rule).BuildExpr(resolver)
+	if err != nil {
+		return true, err
+	}
+
+	err = resolver.UpdateQuery(query)
+	if err != nil {
+		return true, err
+	}
+
+	err = query.AndWhere(expr).Limit(1).Row(&exists)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return true, err
+	}
+
+	return exists > 0, nil
+}
+
+// checkMFA handles any MFA auth checks that needs to be performed for the specified request event.
+// Returns the mfaId that needs to be written as response to the user.
+//
+// (note: all auth methods are treated as equal and there is no requirement for "pairing").
+func checkMFA(e *core.RequestEvent, authRecord *core.Record, currentAuthMethod string) (string, error) {
+	if !authRecord.Collection().MFA.Enabled || currentAuthMethod == "" {
+		return "", nil
+	}
+
+	ok, err := wantsMFA(e, authRecord)
+	if err != nil {
+		return "", e.BadRequestError("Failed to authenticate.", fmt.Errorf("MFA rule failure: %w", err))
+	}
+	if !ok {
+		return "", nil // no mfa needed for this auth record
+	}
+
+	// read the mfaId either from the qyery params or request body
+	mfaId := e.Request.URL.Query().Get("mfaId")
+	if mfaId == "" {
+		// check the body
+		data := struct {
+			MfaId string `form:"mfaId" json:"mfaId" xml:"mfaId"`
+		}{}
+		if err := e.BindBody(&data); err != nil {
+			return "", firstApiError(err, e.BadRequestError("Failed to read MFA Id", err))
+		}
+		mfaId = data.MfaId
+	}
+
+	// first-time auth
+	// ---
+	if mfaId == "" {
+		mfa := core.NewMFA(e.App)
+		mfa.SetCollectionRef(authRecord.Collection().Id)
+		mfa.SetRecordRef(authRecord.Id)
+		mfa.SetMethod(currentAuthMethod)
+		if err := e.App.Save(mfa); err != nil {
+			return "", firstApiError(err, e.InternalServerError("Failed to create MFA record", err))
+		}
+
+		return mfa.Id, nil
+	}
+
+	// second-time auth
+	// ---
+	mfa, err := e.App.FindMFAById(mfaId)
+	deleteMFA := func() {
+		// try to delete the expired mfa
+		if mfa != nil {
+			if deleteErr := e.App.Delete(mfa); deleteErr != nil {
+				e.App.Logger().Warn("Failed to delete expired MFA record", "error", deleteErr, "mfaId", mfa.Id)
+			}
+		}
+	}
+	if err != nil || mfa.HasExpired(authRecord.Collection().MFA.DurationTime()) {
+		deleteMFA()
+		return "", e.BadRequestError("Invalid or expired MFA session.", err)
+	}
+
+	if mfa.RecordRef() != authRecord.Id || mfa.CollectionRef() != authRecord.Collection().Id {
+		return "", e.BadRequestError("Invalid MFA session.", nil)
+	}
+
+	if mfa.Method() == currentAuthMethod {
+		return "", e.BadRequestError("A different authentication method is required.", nil)
+	}
+
+	deleteMFA()
+
+	return "", nil
+}
+
+// EnrichRecord parses the request context and enrich the provided record:
+//   - expands relations (if defaultExpands and/or ?expand query param is set)
+//   - ensures that the emails of the auth record and its expanded auth relations
+//     are visible only for the current logged superuser, record owner or record with manage access
+func EnrichRecord(e *core.RequestEvent, record *core.Record, defaultExpands ...string) error {
+	return EnrichRecords(e, []*core.Record{record}, defaultExpands...)
+}
+
+// EnrichRecords parses the request context and enriches the provided records:
+//   - expands relations (if defaultExpands and/or ?expand query param is set)
+//   - ensures that the emails of the auth records and their expanded auth relations
+//     are visible only for the current logged superuser, record owner or record with manage access
+//
+// Note: Expects all records to be from the same collection!
+func EnrichRecords(e *core.RequestEvent, records []*core.Record, defaultExpands ...string) error {
+	if len(records) == 0 {
+		return nil
+	}
+
+	info, err := e.RequestInfo()
+	if err != nil {
+		return err
+	}
+
+	return triggerRecordEnrichHooks(e.App, info, records, func() error {
+		expands := defaultExpands
+		if param := info.Query[expandQueryParam]; param != "" {
+			expands = append(expands, strings.Split(param, ",")...)
+		}
+
+		err := defaultEnrichRecords(e.App, info, records, expands...)
+		if err != nil {
+			// only log because it is not critical
+			e.App.Logger().Warn("failed to apply default enriching", "error", err)
+		}
+
+		return nil
+	})
+}
+
+type iterator[T any] struct {
+	items []T
+	index int
+}
+
+func (ri *iterator[T]) next() T {
+	var item T
+
+	if ri.index < len(ri.items) {
+		item = ri.items[ri.index]
+		ri.index++
+	}
+
+	return item
+}
+
+func triggerRecordEnrichHooks(app core.App, requestInfo *core.RequestInfo, records []*core.Record, finalizer func() error) error {
+	it := iterator[*core.Record]{items: records}
+
+	enrichHook := app.OnRecordEnrich()
+
+	event := new(core.RecordEnrichEvent)
+	event.App = app
+	event.RequestInfo = requestInfo
+
+	var iterate func(record *core.Record) error
+	iterate = func(record *core.Record) error {
+		if record == nil {
+			return nil
+		}
+
+		event.Record = record
+
+		return enrichHook.Trigger(event, func(ee *core.RecordEnrichEvent) error {
+			next := it.next()
+			if next == nil {
+				if finalizer != nil {
+					return finalizer()
+				}
+				return nil
+			}
+
+			event.App = ee.App // in case it was replaced with a transaction
+			event.Record = next
+
+			err := iterate(next)
+
+			event.App = app
+			event.Record = record
+
+			return err
+		})
+	}
+
+	return iterate(it.next())
+}
+
+func defaultEnrichRecords(app core.App, requestInfo *core.RequestInfo, records []*core.Record, expands ...string) error {
+	err := autoResolveRecordsFlags(app, records, requestInfo)
+	if err != nil {
+		return fmt.Errorf("failed to resolve records flags: %w", err)
+	}
+
+	if len(expands) > 0 {
+		expandErrs := app.ExpandRecords(records, expands, expandFetch(app, requestInfo))
+		if len(expandErrs) > 0 {
+			errsSlice := make([]error, 0, len(expandErrs))
+			for key, err := range expandErrs {
+				errsSlice = append(errsSlice, fmt.Errorf("failed to expand %q: %w", key, err))
+			}
+			return fmt.Errorf("failed to expand records: %w", errors.Join(errsSlice...))
+		}
+	}
+
+	return nil
+}
+
+// expandFetch is the records fetch function that is used to expand related records.
+func expandFetch(app core.App, originalRequestInfo *core.RequestInfo) core.ExpandFetchFunc {
+	// shallow clone the provided request info to set an "expand" context
+	requestInfoClone := *originalRequestInfo
+	requestInfoPtr := &requestInfoClone
+	requestInfoPtr.Context = core.RequestInfoContextExpand
+
+	return func(relCollection *core.Collection, relIds []string) ([]*core.Record, error) {
+		records, findErr := app.FindRecordsByIds(relCollection.Id, relIds, func(q *dbx.SelectQuery) error {
+			if requestInfoPtr.Auth != nil && requestInfoPtr.Auth.IsSuperuser() {
+				return nil // superusers can access everything
+			}
+
+			if relCollection.ViewRule == nil {
+				return fmt.Errorf("only superusers can view collection %q records", relCollection.Name)
+			}
+
+			if *relCollection.ViewRule != "" {
+				resolver := core.NewRecordFieldResolver(app, relCollection, requestInfoPtr, true)
+
+				expr, err := search.FilterData(*(relCollection.ViewRule)).BuildExpr(resolver)
+				if err != nil {
+					return err
+				}
+
+				q.AndWhere(expr)
+
+				err = resolver.UpdateQuery(q)
+				if err != nil {
+					return err
+				}
+			}
+
+			return nil
+		})
+		if findErr != nil {
+			return nil, findErr
+		}
+
+		enrichErr := triggerRecordEnrichHooks(app, requestInfoPtr, records, func() error {
+			if err := autoResolveRecordsFlags(app, records, requestInfoPtr); err != nil {
+				// non-critical error
+				app.Logger().Warn("Failed to apply autoResolveRecordsFlags for the expanded records", "error", err)
+			}
+
+			return nil
+		})
+		if enrichErr != nil {
+			return nil, enrichErr
+		}
+
+		return records, nil
+	}
+}
+
+// autoResolveRecordsFlags resolves various visibility flags of the provided records.
+//
+// Currently it enables:
+// - export of hidden fields if the current auth model is a superuser
+// - email export ignoring the emailVisibity checks if the current auth model is superuser, owner or a "manager".
+//
+// Note: Expects all records to be from the same collection!
+func autoResolveRecordsFlags(app core.App, records []*core.Record, requestInfo *core.RequestInfo) error {
+	if len(records) == 0 {
+		return nil // nothing to resolve
+	}
+
+	if requestInfo.HasSuperuserAuth() {
+		hiddenFields := records[0].Collection().Fields.FieldNames()
+		for _, rec := range records {
+			rec.Unhide(hiddenFields...)
+			rec.IgnoreEmailVisibility(true)
+		}
+	}
+
+	// additional emailVisibility checks
+	// ---------------------------------------------------------------
+	if !records[0].Collection().IsAuth() {
+		return nil // not auth collection records
+	}
+
+	collection := records[0].Collection()
+
+	mappedRecords := make(map[string]*core.Record, len(records))
+	recordIds := make([]any, len(records))
+	for i, rec := range records {
+		mappedRecords[rec.Id] = rec
+		recordIds[i] = rec.Id
+	}
+
+	if requestInfo.Auth != nil && mappedRecords[requestInfo.Auth.Id] != nil {
+		mappedRecords[requestInfo.Auth.Id].IgnoreEmailVisibility(true)
+	}
+
+	if collection.ManageRule == nil || *collection.ManageRule == "" {
+		return nil // no manage rule to check
+	}
+
+	// fetch the ids of the managed records
+	// ---
+	managedIds := []string{}
+
+	query := app.RecordQuery(collection).
+		Select(app.ConcurrentDB().QuoteSimpleColumnName(collection.Name) + ".id").
+		AndWhere(dbx.In(app.ConcurrentDB().QuoteSimpleColumnName(collection.Name)+".id", recordIds...))
+
+	resolver := core.NewRecordFieldResolver(app, collection, requestInfo, true)
+	expr, err := search.FilterData(*collection.ManageRule).BuildExpr(resolver)
+	if err != nil {
+		return err
+	}
+
+	query.AndWhere(expr)
+
+	err = resolver.UpdateQuery(query)
+	if err != nil {
+		return err
+	}
+
+	err = query.Column(&managedIds)
+	if err != nil {
+		return err
+	}
+	// ---
+
+	// ignore the email visibility check for the managed records
+	for _, id := range managedIds {
+		if rec, ok := mappedRecords[id]; ok {
+			rec.IgnoreEmailVisibility(true)
+		}
+	}
+
+	return nil
+}
+
+var ruleQueryParams = []string{search.FilterQueryParam, search.SortQueryParam}
+var superuserOnlyRuleFields = []string{"@collection.", "@request."}
+
+// checkForSuperuserOnlyRuleFields loosely checks and returns an error if
+// the provided RequestInfo contains rule fields that only the superuser can use.
+func checkForSuperuserOnlyRuleFields(requestInfo *core.RequestInfo) error {
+	if len(requestInfo.Query) == 0 || requestInfo.HasSuperuserAuth() {
+		return nil // superuser or nothing to check
+	}
+
+	for _, param := range ruleQueryParams {
+		v := requestInfo.Query[param]
+		if v == "" {
+			continue
+		}
+
+		for _, field := range superuserOnlyRuleFields {
+			if strings.Contains(v, field) {
+				return router.NewForbiddenError("Only superusers can filter by "+field, nil)
+			}
+		}
+	}
+
+	return nil
+}
+
+// firstApiError returns the first ApiError from the errors list
+// (this is used usually to prevent unnecessary wraping and to allow bubling ApiError from nested hooks)
+//
+// If no ApiError is found, returns a default "Internal server" error.
+func firstApiError(errs ...error) *router.ApiError {
+	var apiErr *router.ApiError
+	var ok bool
+
+	for _, err := range errs {
+		if err == nil {
+			continue
+		}
+
+		// quick assert to avoid the reflection checks
+		apiErr, ok = err.(*router.ApiError)
+		if ok {
+			return apiErr
+		}
+
+		// nested/wrapped errors
+		if errors.As(err, &apiErr) {
+			return apiErr
+		}
+	}
+
+	return router.NewInternalServerError("", errors.Join(errs...))
+}
+
+// execAfterSuccessTx ensures that fn is executed only after a succesul transaction.
+//
+// If the current app instance is not a transactional or checkTx is false,
+// then fn is directly executed.
+//
+// It could be usually used to allow propagating an error or writing
+// custom response from within the wrapped transaction block.
+func execAfterSuccessTx(checkTx bool, app core.App, fn func() error) error {
+	if txInfo := app.TxInfo(); txInfo != nil && checkTx {
+		txInfo.OnComplete(func(txErr error) error {
+			if txErr == nil {
+				return fn()
+			}
+			return nil
+		})
+		return nil
+	}
+
+	return fn()
+}
+
+// -------------------------------------------------------------------
+
+const maxAuthOrigins = 5
+
+func authAlert(e *core.RequestEvent, authRecord *core.Record) error {
+	// generate fingerprint
+	// ---
+	ip := e.RealIP()
+
+	userAgent := e.Request.UserAgent()
+	if len(userAgent) > 200 {
+		userAgent = userAgent[:200] + "..."
+	}
+
+	fingerprint := security.MD5(ip + userAgent)
+	alertInfo := fmt.Sprintf("%s - %s %s", types.NowDateTime().String(), ip, userAgent)
+	// ---
+
+	origins, err := e.App.FindAllAuthOriginsByRecord(authRecord)
+	if err != nil {
+		return err
+	}
+
+	isFirstLogin := len(origins) == 0
+
+	var currentOrigin *core.AuthOrigin
+	for _, origin := range origins {
+		if origin.Fingerprint() == fingerprint {
+			currentOrigin = origin
+			break
+		}
+	}
+	if currentOrigin == nil {
+		currentOrigin = core.NewAuthOrigin(e.App)
+		currentOrigin.SetCollectionRef(authRecord.Collection().Id)
+		currentOrigin.SetRecordRef(authRecord.Id)
+		currentOrigin.SetFingerprint(fingerprint)
+	}
+
+	// send email alert for the new origin auth (skip first login)
+	//
+	// Note: The "fake" timeout is a temp solution to avoid blocking
+	//       for too long when the SMTP server is not accessible, due
+	//       to the lack of context cancellation support in the underlying
+	//       mailer and net/smtp package.
+	//       The goroutine technically "leaks" but we assume that the OS will
+	//       terminate the connection after some time (usually after 3-4 mins).
+	if !isFirstLogin && currentOrigin.IsNew() && authRecord.Email() != "" {
+		mailSent := make(chan error, 1)
+
+		timer := time.AfterFunc(15*time.Second, func() {
+			mailSent <- errors.New("auth alert mail send wait timeout reached")
+		})
+
+		routine.FireAndForget(func() {
+			err := mails.SendRecordAuthAlert(e.App, authRecord, alertInfo)
+			timer.Stop()
+			mailSent <- err
+		})
+
+		err = <-mailSent
+		if err != nil {
+			return err
+		}
+	}
+
+	// try to keep only up to maxAuthOrigins
+	// (pop the last used ones; it is not executed in a transaction to avoid unnecessary locks)
+	if currentOrigin.IsNew() && len(origins) >= maxAuthOrigins {
+		for i := len(origins) - 1; i >= maxAuthOrigins-1; i-- {
+			if err := e.App.Delete(origins[i]); err != nil {
+				// treat as non-critical error, just log for now
+				e.App.Logger().Warn("Failed to delete old AuthOrigin record", "error", err, "authOriginId", origins[i].Id)
+			}
+		}
+	}
+
+	// create/update the origin fingerprint
+	return e.App.Save(currentOrigin)
+}
diff --git a/server/core_backend-server/apis/record_helpers_test.go b/server/core_backend-server/apis/record_helpers_test.go
new file mode 100644
index 0000000..d0458d3
--- /dev/null
+++ b/server/core_backend-server/apis/record_helpers_test.go
@@ -0,0 +1,761 @@
+package apis_test
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestEnrichRecords(t *testing.T) {
+	t.Parallel()
+
+	// mock test data
+	// ---
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	freshRecords := func(records []*core.Record) []*core.Record {
+		result := make([]*core.Record, len(records))
+		for i, r := range records {
+			result[i] = r.Fresh()
+		}
+		return result
+	}
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	usersRecords, err := app.FindRecordsByIds("users", []string{"4q1xlclmfloku33", "bgs820n361vj1qd"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	nologinRecords, err := app.FindRecordsByIds("nologin", []string{"dc49k6jgejn40h3", "oos036e9xvqeexy"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	demo1Records, err := app.FindRecordsByIds("demo1", []string{"al1h9ijdeojtsjy", "84nmscqy84lsi1t"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	demo5Records, err := app.FindRecordsByIds("demo5", []string{"la4y2w4o98acwuj", "qjeql998mtp1azp"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// temp update the view rule to ensure that request context is set to "expand"
+	demo4, err := app.FindCollectionByNameOrId("demo4")
+	if err != nil {
+		t.Fatal(err)
+	}
+	demo4.ViewRule = types.Pointer("@request.context = 'expand'")
+	if err := app.Save(demo4); err != nil {
+		t.Fatal(err)
+	}
+	// ---
+
+	scenarios := []struct {
+		name           string
+		auth           *core.Record
+		records        []*core.Record
+		queryExpand    string
+		defaultExpands []string
+		expected       []string
+		notExpected    []string
+	}{
+		// email visibility checks
+		{
+			name:           "[emailVisibility] guest",
+			auth:           nil,
+			records:        freshRecords(usersRecords),
+			queryExpand:    "",
+			defaultExpands: nil,
+			expected: []string{
+				`"customField":"123"`,
+				`"test3@example.com"`, // emailVisibility=true
+			},
+			notExpected: []string{
+				`"test@example.com"`,
+			},
+		},
+		{
+			name:           "[emailVisibility] owner",
+			auth:           user,
+			records:        freshRecords(usersRecords),
+			queryExpand:    "",
+			defaultExpands: nil,
+			expected: []string{
+				`"customField":"123"`,
+				`"test3@example.com"`, // emailVisibility=true
+				`"test@example.com"`,  // owner
+			},
+		},
+		{
+			name:           "[emailVisibility] manager",
+			auth:           user,
+			records:        freshRecords(nologinRecords),
+			queryExpand:    "",
+			defaultExpands: nil,
+			expected: []string{
+				`"customField":"123"`,
+				`"test3@example.com"`,
+				`"test@example.com"`,
+			},
+		},
+		{
+			name:           "[emailVisibility] superuser",
+			auth:           superuser,
+			records:        freshRecords(nologinRecords),
+			queryExpand:    "",
+			defaultExpands: nil,
+			expected: []string{
+				`"customField":"123"`,
+				`"test3@example.com"`,
+				`"test@example.com"`,
+			},
+		},
+		{
+			name:           "[emailVisibility + expand] recursive auth rule checks (regular user)",
+			auth:           user,
+			records:        freshRecords(demo1Records),
+			queryExpand:    "",
+			defaultExpands: []string{"rel_many"},
+			expected: []string{
+				`"customField":"123"`,
+				`"expand":{"rel_many"`,
+				`"expand":{}`,
+				`"test@example.com"`,
+			},
+			notExpected: []string{
+				`"id":"bgs820n361vj1qd"`,
+				`"id":"oap640cot4yru2s"`,
+			},
+		},
+		{
+			name:           "[emailVisibility + expand] recursive auth rule checks (superuser)",
+			auth:           superuser,
+			records:        freshRecords(demo1Records),
+			queryExpand:    "",
+			defaultExpands: []string{"rel_many"},
+			expected: []string{
+				`"customField":"123"`,
+				`"test@example.com"`,
+				`"expand":{"rel_many"`,
+				`"id":"bgs820n361vj1qd"`,
+				`"id":"4q1xlclmfloku33"`,
+				`"id":"oap640cot4yru2s"`,
+			},
+			notExpected: []string{
+				`"expand":{}`,
+			},
+		},
+
+		// expand checks
+		{
+			name:           "[expand] guest (query)",
+			auth:           nil,
+			records:        freshRecords(usersRecords),
+			queryExpand:    "rel",
+			defaultExpands: nil,
+			expected: []string{
+				`"customField":"123"`,
+				`"expand":{"rel"`,
+				`"id":"llvuca81nly1qls"`,
+				`"id":"0yxhwia2amd8gec"`,
+			},
+			notExpected: []string{
+				`"expand":{}`,
+			},
+		},
+		{
+			name:           "[expand] guest (default expands)",
+			auth:           nil,
+			records:        freshRecords(usersRecords),
+			queryExpand:    "",
+			defaultExpands: []string{"rel"},
+			expected: []string{
+				`"customField":"123"`,
+				`"expand":{"rel"`,
+				`"id":"llvuca81nly1qls"`,
+				`"id":"0yxhwia2amd8gec"`,
+			},
+		},
+		{
+			name:           "[expand] @request.context=expand check",
+			auth:           nil,
+			records:        freshRecords(demo5Records),
+			queryExpand:    "rel_one",
+			defaultExpands: []string{"rel_many"},
+			expected: []string{
+				`"customField":"123"`,
+				`"expand":{}`,
+				`"expand":{"`,
+				`"rel_many":[{`,
+				`"rel_one":{`,
+				`"id":"i9naidtvr6qsgb4"`,
+				`"id":"qzaqccwrmva4o1n"`,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			app.OnRecordEnrich().BindFunc(func(e *core.RecordEnrichEvent) error {
+				e.Record.WithCustomData(true)
+				e.Record.Set("customField", "123")
+				return e.Next()
+			})
+
+			req := httptest.NewRequest(http.MethodGet, "/?expand="+s.queryExpand, nil)
+			rec := httptest.NewRecorder()
+
+			requestEvent := new(core.RequestEvent)
+			requestEvent.App = app
+			requestEvent.Request = req
+			requestEvent.Response = rec
+			requestEvent.Auth = s.auth
+
+			err := apis.EnrichRecords(requestEvent, s.records, s.defaultExpands...)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := json.Marshal(s.records)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			for _, str := range s.expected {
+				if !strings.Contains(rawStr, str) {
+					t.Fatalf("Expected\n%q\nin\n%v", str, rawStr)
+				}
+			}
+
+			for _, str := range s.notExpected {
+				if strings.Contains(rawStr, str) {
+					t.Fatalf("Didn't expected\n%q\nin\n%v", str, rawStr)
+				}
+			}
+		})
+	}
+}
+
+func TestRecordAuthResponseAuthRuleCheck(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	event := new(core.RequestEvent)
+	event.App = app
+	event.Request = httptest.NewRequest(http.MethodGet, "/", nil)
+	event.Response = httptest.NewRecorder()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		rule        *string
+		expectError bool
+	}{
+		{
+			"admin only rule",
+			nil,
+			true,
+		},
+		{
+			"empty rule",
+			types.Pointer(""),
+			false,
+		},
+		{
+			"false rule",
+			types.Pointer("1=2"),
+			true,
+		},
+		{
+			"true rule",
+			types.Pointer("1=1"),
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			user.Collection().AuthRule = s.rule
+
+			err := apis.RecordAuthResponse(event, user, "", nil)
+
+			hasErr := err != nil
+			if s.expectError != hasErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			// in all cases login alert shouldn't be send because of the empty auth method
+			if app.TestMailer.TotalSend() != 0 {
+				t.Fatalf("Expected no emails send, got %d:\n%v", app.TestMailer.TotalSend(), app.TestMailer.LastMessage().HTML)
+			}
+
+			if !hasErr {
+				return
+			}
+
+			apiErr, ok := err.(*router.ApiError)
+
+			if !ok || apiErr == nil {
+				t.Fatalf("Expected ApiError, got %v", apiErr)
+			}
+
+			if apiErr.Status != http.StatusForbidden {
+				t.Fatalf("Expected ApiError.Status %d, got %d", http.StatusForbidden, apiErr.Status)
+			}
+		})
+	}
+}
+
+func TestRecordAuthResponseAuthAlertCheck(t *testing.T) {
+	const testFingerprint = "d0f88d6c87767262ba8e93d6acccd784"
+
+	scenarios := []struct {
+		name          string
+		devices       []string // mock existing device fingerprints
+		expectDevices []string
+		enabled       bool
+		expectEmail   bool
+	}{
+		{
+			name:          "first login",
+			devices:       nil,
+			expectDevices: []string{testFingerprint},
+			enabled:       true,
+			expectEmail:   false,
+		},
+		{
+			name:          "existing device",
+			devices:       []string{"1", testFingerprint},
+			expectDevices: []string{"1", testFingerprint},
+			enabled:       true,
+			expectEmail:   false,
+		},
+		{
+			name:          "new device (< 5)",
+			devices:       []string{"1", "2"},
+			expectDevices: []string{"1", "2", testFingerprint},
+			enabled:       true,
+			expectEmail:   true,
+		},
+		{
+			name:          "new device (>= 5)",
+			devices:       []string{"1", "2", "3", "4", "5"},
+			expectDevices: []string{"2", "3", "4", "5", testFingerprint},
+			enabled:       true,
+			expectEmail:   true,
+		},
+		{
+			name:          "with disabled auth alert collection flag",
+			devices:       []string{"1", "2"},
+			expectDevices: []string{"1", "2"},
+			enabled:       false,
+			expectEmail:   false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			event := new(core.RequestEvent)
+			event.App = app
+			event.Request = httptest.NewRequest(http.MethodGet, "/", nil)
+			event.Response = httptest.NewRecorder()
+
+			user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			user.Collection().MFA.Enabled = false
+			user.Collection().AuthRule = types.Pointer("")
+			user.Collection().AuthAlert.Enabled = s.enabled
+
+			// ensure that there are no other auth origins
+			err = app.DeleteAllAuthOriginsByRecord(user)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			mockCreated := types.NowDateTime().Add(-time.Duration(len(s.devices)+1) * time.Second)
+			// insert the mock devices
+			for _, fingerprint := range s.devices {
+				mockCreated = mockCreated.Add(1 * time.Second)
+				d := core.NewAuthOrigin(app)
+				d.SetCollectionRef(user.Collection().Id)
+				d.SetRecordRef(user.Id)
+				d.SetFingerprint(fingerprint)
+				d.SetRaw("created", mockCreated)
+				d.SetRaw("updated", mockCreated)
+				if err = app.Save(d); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			err = apis.RecordAuthResponse(event, user, "example", nil)
+			if err != nil {
+				t.Fatalf("Failed to resolve auth response: %v", err)
+			}
+
+			var expectTotalSend int
+			if s.expectEmail {
+				expectTotalSend = 1
+			}
+			if total := app.TestMailer.TotalSend(); total != expectTotalSend {
+				t.Fatalf("Expected %d sent emails, got %d", expectTotalSend, total)
+			}
+
+			devices, err := app.FindAllAuthOriginsByRecord(user)
+			if err != nil {
+				t.Fatalf("Failed to retrieve auth origins: %v", err)
+			}
+
+			if len(devices) != len(s.expectDevices) {
+				t.Fatalf("Expected %d devices, got %d", len(s.expectDevices), len(devices))
+			}
+
+			for _, fingerprint := range s.expectDevices {
+				var exists bool
+				fingerprints := make([]string, 0, len(devices))
+				for _, d := range devices {
+					if d.Fingerprint() == fingerprint {
+						exists = true
+						break
+					}
+					fingerprints = append(fingerprints, d.Fingerprint())
+				}
+				if !exists {
+					t.Fatalf("Missing device with fingerprint %q:\n%v", fingerprint, fingerprints)
+				}
+			}
+		})
+	}
+}
+
+func TestRecordAuthResponseMFACheck(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user2, err := app.FindAuthRecordByEmail("users", "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rec := httptest.NewRecorder()
+
+	event := new(core.RequestEvent)
+	event.App = app
+	event.Request = httptest.NewRequest(http.MethodGet, "/", nil)
+	event.Response = rec
+
+	resetMFAs := func(authRecord *core.Record) {
+		// ensure that mfa is enabled
+		user.Collection().MFA.Enabled = true
+		user.Collection().MFA.Duration = 5
+		user.Collection().MFA.Rule = ""
+
+		mfas, err := app.FindAllMFAsByRecord(authRecord)
+		if err != nil {
+			t.Fatalf("Failed to retrieve mfas: %v", err)
+		}
+		for _, mfa := range mfas {
+			if err := app.Delete(mfa); err != nil {
+				t.Fatalf("Failed to delete mfa %q: %v", mfa.Id, err)
+			}
+		}
+
+		// reset response
+		rec = httptest.NewRecorder()
+		event.Response = rec
+	}
+
+	totalMFAs := func(authRecord *core.Record) int {
+		mfas, err := app.FindAllMFAsByRecord(authRecord)
+		if err != nil {
+			t.Fatalf("Failed to retrieve mfas: %v", err)
+		}
+		return len(mfas)
+	}
+
+	t.Run("no collection MFA enabled", func(t *testing.T) {
+		resetMFAs(user)
+
+		user.Collection().MFA.Enabled = false
+
+		err = apis.RecordAuthResponse(event, user, "example", nil)
+		if err != nil {
+			t.Fatalf("Expected nil, got error: %v", err)
+		}
+
+		body := rec.Body.String()
+		if strings.Contains(body, "mfaId") {
+			t.Fatalf("Expected no mfaId in the response body, got\n%v", body)
+		}
+		if !strings.Contains(body, "token") {
+			t.Fatalf("Expected auth token in the response body, got\n%v", body)
+		}
+
+		if total := totalMFAs(user); total != 0 {
+			t.Fatalf("Expected no mfa records to be created, got %d", total)
+		}
+	})
+
+	t.Run("no explicit auth method", func(t *testing.T) {
+		resetMFAs(user)
+
+		err = apis.RecordAuthResponse(event, user, "", nil)
+		if err != nil {
+			t.Fatalf("Expected nil, got error: %v", err)
+		}
+
+		body := rec.Body.String()
+		if strings.Contains(body, "mfaId") {
+			t.Fatalf("Expected no mfaId in the response body, got\n%v", body)
+		}
+		if !strings.Contains(body, "token") {
+			t.Fatalf("Expected auth token in the response body, got\n%v", body)
+		}
+
+		if total := totalMFAs(user); total != 0 {
+			t.Fatalf("Expected no mfa records to be created, got %d", total)
+		}
+	})
+
+	t.Run("no mfa wanted (mfa rule check failure)", func(t *testing.T) {
+		resetMFAs(user)
+		user.Collection().MFA.Rule = "1=2"
+
+		err = apis.RecordAuthResponse(event, user, "example", nil)
+		if err != nil {
+			t.Fatalf("Expected nil, got error: %v", err)
+		}
+
+		body := rec.Body.String()
+		if strings.Contains(body, "mfaId") {
+			t.Fatalf("Expected no mfaId in the response body, got\n%v", body)
+		}
+		if !strings.Contains(body, "token") {
+			t.Fatalf("Expected auth token in the response body, got\n%v", body)
+		}
+
+		if total := totalMFAs(user); total != 0 {
+			t.Fatalf("Expected no mfa records to be created, got %d", total)
+		}
+	})
+
+	t.Run("mfa wanted (mfa rule check success)", func(t *testing.T) {
+		resetMFAs(user)
+		user.Collection().MFA.Rule = "1=1"
+
+		err = apis.RecordAuthResponse(event, user, "example", nil)
+		if !errors.Is(err, apis.ErrMFA) {
+			t.Fatalf("Expected ErrMFA, got: %v", err)
+		}
+
+		body := rec.Body.String()
+		if !strings.Contains(body, "mfaId") {
+			t.Fatalf("Expected the created mfaId to be returned in the response body, got\n%v", body)
+		}
+
+		if total := totalMFAs(user); total != 1 {
+			t.Fatalf("Expected a single mfa record to be created, got %d", total)
+		}
+	})
+
+	t.Run("mfa first-time", func(t *testing.T) {
+		resetMFAs(user)
+
+		err = apis.RecordAuthResponse(event, user, "example", nil)
+		if !errors.Is(err, apis.ErrMFA) {
+			t.Fatalf("Expected ErrMFA, got: %v", err)
+		}
+
+		body := rec.Body.String()
+		if !strings.Contains(body, "mfaId") {
+			t.Fatalf("Expected the created mfaId to be returned in the response body, got\n%v", body)
+		}
+
+		if total := totalMFAs(user); total != 1 {
+			t.Fatalf("Expected a single mfa record to be created, got %d", total)
+		}
+	})
+
+	t.Run("mfa second-time with the same auth method", func(t *testing.T) {
+		resetMFAs(user)
+
+		// create a dummy mfa record
+		mfa := core.NewMFA(app)
+		mfa.SetCollectionRef(user.Collection().Id)
+		mfa.SetRecordRef(user.Id)
+		mfa.SetMethod("example")
+		if err = app.Save(mfa); err != nil {
+			t.Fatal(err)
+		}
+
+		event.Request = httptest.NewRequest(http.MethodGet, "/?mfaId="+mfa.Id, nil)
+
+		err = apis.RecordAuthResponse(event, user, "example", nil)
+		if err == nil {
+			t.Fatal("Expected error, got nil")
+		}
+
+		if total := totalMFAs(user); total != 1 {
+			t.Fatalf("Expected only 1 mfa record (the existing one), got %d", total)
+		}
+	})
+
+	t.Run("mfa second-time with the different auth method (query param)", func(t *testing.T) {
+		resetMFAs(user)
+
+		// create a dummy mfa record
+		mfa := core.NewMFA(app)
+		mfa.SetCollectionRef(user.Collection().Id)
+		mfa.SetRecordRef(user.Id)
+		mfa.SetMethod("example1")
+		if err = app.Save(mfa); err != nil {
+			t.Fatal(err)
+		}
+
+		event.Request = httptest.NewRequest(http.MethodGet, "/?mfaId="+mfa.Id, nil)
+
+		err = apis.RecordAuthResponse(event, user, "example2", nil)
+		if err != nil {
+			t.Fatalf("Expected nil, got error: %v", err)
+		}
+
+		if total := totalMFAs(user); total != 0 {
+			t.Fatalf("Expected the dummy mfa record to be deleted, found %d", total)
+		}
+	})
+
+	t.Run("mfa second-time with the different auth method (body param)", func(t *testing.T) {
+		resetMFAs(user)
+
+		// create a dummy mfa record
+		mfa := core.NewMFA(app)
+		mfa.SetCollectionRef(user.Collection().Id)
+		mfa.SetRecordRef(user.Id)
+		mfa.SetMethod("example1")
+		if err = app.Save(mfa); err != nil {
+			t.Fatal(err)
+		}
+
+		event.Request = httptest.NewRequest(http.MethodGet, "/", strings.NewReader(`{"mfaId":"`+mfa.Id+`"}`))
+		event.Request.Header.Add("content-type", "application/json")
+
+		err = apis.RecordAuthResponse(event, user, "example2", nil)
+		if err != nil {
+			t.Fatalf("Expected nil, got error: %v", err)
+		}
+
+		if total := totalMFAs(user); total != 0 {
+			t.Fatalf("Expected the dummy mfa record to be deleted, found %d", total)
+		}
+	})
+
+	t.Run("missing mfa", func(t *testing.T) {
+		resetMFAs(user)
+
+		event.Request = httptest.NewRequest(http.MethodGet, "/?mfaId=missing", nil)
+
+		err = apis.RecordAuthResponse(event, user, "example2", nil)
+		if err == nil {
+			t.Fatal("Expected error, got nil")
+		}
+
+		if total := totalMFAs(user); total != 0 {
+			t.Fatalf("Expected 0 mfa records, got %d", total)
+		}
+	})
+
+	t.Run("expired mfa", func(t *testing.T) {
+		resetMFAs(user)
+
+		// create a dummy expired mfa record
+		mfa := core.NewMFA(app)
+		mfa.SetCollectionRef(user.Collection().Id)
+		mfa.SetRecordRef(user.Id)
+		mfa.SetMethod("example1")
+		mfa.SetRaw("created", types.NowDateTime().Add(-1*time.Hour))
+		mfa.SetRaw("updated", types.NowDateTime().Add(-1*time.Hour))
+		if err = app.Save(mfa); err != nil {
+			t.Fatal(err)
+		}
+
+		event.Request = httptest.NewRequest(http.MethodGet, "/?mfaId="+mfa.Id, nil)
+
+		err = apis.RecordAuthResponse(event, user, "example2", nil)
+		if err == nil {
+			t.Fatal("Expected error, got nil")
+		}
+
+		if totalMFAs(user) != 0 {
+			t.Fatal("Expected the expired mfa record to be deleted")
+		}
+	})
+
+	t.Run("mfa for different auth record", func(t *testing.T) {
+		resetMFAs(user)
+
+		// create a dummy expired mfa record
+		mfa := core.NewMFA(app)
+		mfa.SetCollectionRef(user2.Collection().Id)
+		mfa.SetRecordRef(user2.Id)
+		mfa.SetMethod("example1")
+		if err = app.Save(mfa); err != nil {
+			t.Fatal(err)
+		}
+
+		event.Request = httptest.NewRequest(http.MethodGet, "/?mfaId="+mfa.Id, nil)
+
+		err = apis.RecordAuthResponse(event, user, "example2", nil)
+		if err == nil {
+			t.Fatal("Expected error, got nil")
+		}
+
+		if total := totalMFAs(user); total != 0 {
+			t.Fatalf("Expected no user mfas, got %d", total)
+		}
+
+		if total := totalMFAs(user2); total != 1 {
+			t.Fatalf("Expected only 1 user2 mfa, got %d", total)
+		}
+	})
+}
diff --git a/server/core_backend-server/apis/serve.go b/server/core_backend-server/apis/serve.go
new file mode 100644
index 0000000..2c4e7e2
--- /dev/null
+++ b/server/core_backend-server/apis/serve.go
@@ -0,0 +1,335 @@
+package apis
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"log"
+	"net"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/ui"
+	"golang.org/x/crypto/acme"
+	"golang.org/x/crypto/acme/autocert"
+)
+
+// ServeConfig defines a configuration struct for apis.Serve().
+type ServeConfig struct {
+	// ShowStartBanner indicates whether to show or hide the server start console message.
+	ShowStartBanner bool
+
+	// HttpAddr is the TCP address to listen for the HTTP server (eg. "127.0.0.1:80").
+	HttpAddr string
+
+	// HttpsAddr is the TCP address to listen for the HTTPS server (eg. "127.0.0.1:443").
+	HttpsAddr string
+
+	// PathPrefix is an optional prefix to use for the API and dashboard routes.
+	PathPrefix string
+
+	// Optional domains list to use when issuing the TLS certificate.
+	//
+	// If not set, the host from the bound server address will be used.
+	//
+	// For convenience, for each "non-www" domain a "www" entry and
+	// redirect will be automatically added.
+	CertificateDomains []string
+
+	// AllowedOrigins is an optional list of CORS origins (default to "*").
+	AllowedOrigins []string
+
+	// HideAdminUI indicates whether to hide the admin UI dashboard routes.
+	HideAdminUI bool
+}
+
+// Serve starts a new app web server.
+//
+// NB! The app should be bootstrapped before starting the web server.
+//
+// Example:
+//
+//	app.Bootstrap()
+//	apis.Serve(app, apis.ServeConfig{
+//		HttpAddr:        "127.0.0.1:8080",
+//		ShowStartBanner: false,
+//	})
+func Serve(app core.App, config ServeConfig) error {
+	if len(config.AllowedOrigins) == 0 {
+		config.AllowedOrigins = []string{"*"}
+	}
+
+	// ensure that the latest migrations are applied before starting the server
+	err := app.RunAllMigrations()
+	if err != nil {
+		return err
+	}
+
+	pbRouter, err := NewRouter(app)
+	if err != nil {
+		return err
+	}
+
+	pbRouter.Bind(CORS(CORSConfig{
+		AllowOrigins: config.AllowedOrigins,
+		AllowMethods: []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPatch, http.MethodPost, http.MethodDelete},
+	}))
+
+	if !config.HideAdminUI && ui.DistDirFS != nil {
+		pbRouter.GET("/_/{path...}", Static(ui.DistDirFS, false)).
+			BindFunc(func(e *core.RequestEvent) error {
+				// ignore root path
+				if e.Request.PathValue(StaticWildcardParam) != "" {
+					e.Response.Header().Set("Cache-Control", "max-age=1209600, stale-while-revalidate=86400")
+				}
+
+				// add a default CSP
+				if e.Response.Header().Get("Content-Security-Policy") == "" {
+					e.Response.Header().Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' http://127.0.0.1:* https://tile.openstreetmap.org data: blob:; connect-src 'self' http://127.0.0.1:* https://nominatim.openstreetmap.org; script-src 'self' 'sha256-GRUzBA7PzKYug7pqxv5rJaec5bwDCw1Vo6/IXwvD3Tc='")
+				}
+
+				return e.Next()
+			}).
+			Bind(Gzip())
+	}
+
+	// start http server
+	// ---
+	mainAddr := config.HttpAddr
+	if config.HttpsAddr != "" {
+		mainAddr = config.HttpsAddr
+	}
+
+	var wwwRedirects []string
+
+	// extract the host names for the certificate host policy
+	hostNames := config.CertificateDomains
+	if len(hostNames) == 0 {
+		host, _, _ := net.SplitHostPort(mainAddr)
+		hostNames = append(hostNames, host)
+	}
+	for _, host := range hostNames {
+		if strings.HasPrefix(host, "www.") {
+			continue // explicitly set www host
+		}
+
+		wwwHost := "www." + host
+		if !list.ExistInSlice(wwwHost, hostNames) {
+			hostNames = append(hostNames, wwwHost)
+			wwwRedirects = append(wwwRedirects, wwwHost)
+		}
+	}
+
+	// implicit www->non-www redirect(s)
+	if len(wwwRedirects) > 0 {
+		pbRouter.Bind(wwwRedirect(wwwRedirects))
+	}
+
+	certManager := &autocert.Manager{
+		Prompt:     autocert.AcceptTOS,
+		Cache:      autocert.DirCache(filepath.Join(app.DataDir(), core.LocalAutocertCacheDirName)),
+		HostPolicy: autocert.HostWhitelist(hostNames...),
+	}
+
+	// base request context used for cancelling long running requests
+	// like the SSE connections
+	baseCtx, cancelBaseCtx := context.WithCancel(context.Background())
+	defer cancelBaseCtx()
+
+	server := &http.Server{
+		TLSConfig: &tls.Config{
+			MinVersion:     tls.VersionTLS12,
+			GetCertificate: certManager.GetCertificate,
+			NextProtos:     []string{acme.ALPNProto},
+		},
+		// higher defaults to accommodate large file uploads/downloads
+		WriteTimeout:      5 * time.Minute,
+		ReadTimeout:       5 * time.Minute,
+		ReadHeaderTimeout: 1 * time.Minute,
+		Addr:              mainAddr,
+		BaseContext: func(l net.Listener) context.Context {
+			return baseCtx
+		},
+		ErrorLog: log.New(&serverErrorLogWriter{app: app}, "", 0),
+	}
+
+	var listener net.Listener
+
+	// graceful shutdown
+	// ---------------------------------------------------------------
+	// WaitGroup to block until server.ShutDown() returns because Serve and similar methods exit immediately.
+	// Note that the WaitGroup would do nothing if the app.OnTerminate() hook isn't triggered.
+	var wg sync.WaitGroup
+
+	// try to gracefully shutdown the server on app termination
+	app.OnTerminate().Bind(&hook.Handler[*core.TerminateEvent]{
+		Id: "pbGracefulShutdown",
+		Func: func(te *core.TerminateEvent) error {
+			cancelBaseCtx()
+
+			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+			defer cancel()
+
+			wg.Add(1)
+
+			_ = server.Shutdown(ctx)
+
+			if te.IsRestart {
+				// wait for execve and other handlers up to 3 seconds before exit
+				time.AfterFunc(3*time.Second, func() {
+					wg.Done()
+				})
+			} else {
+				wg.Done()
+			}
+
+			return te.Next()
+		},
+		Priority: -9999,
+	})
+
+	// wait for the graceful shutdown to complete before exit
+	defer func() {
+		wg.Wait()
+
+		if listener != nil {
+			_ = listener.Close()
+		}
+	}()
+	// ---------------------------------------------------------------
+
+	var baseURL string
+
+	serveEvent := new(core.ServeEvent)
+	serveEvent.App = app
+	serveEvent.Router = pbRouter
+	serveEvent.Server = server
+	serveEvent.CertManager = certManager
+	serveEvent.InstallerFunc = DefaultInstallerFunc
+
+	// trigger the OnServe hook and start the tcp listener
+	serveHookErr := app.OnServe().Trigger(serveEvent, func(e *core.ServeEvent) error {
+		// Support path prefix for the API and dashboard routes.
+		if config.PathPrefix != "" {
+			e.Router.Prefix = config.PathPrefix
+		}
+
+		handler, err := e.Router.BuildMux()
+		if err != nil {
+			return err
+		}
+
+		e.Server.Handler = handler
+
+		if config.HttpsAddr == "" {
+			baseURL = "http://" + serverAddrToHost(serveEvent.Server.Addr)
+		} else {
+			baseURL = "https://"
+			if len(config.CertificateDomains) > 0 {
+				baseURL += config.CertificateDomains[0]
+			} else {
+				baseURL += serverAddrToHost(serveEvent.Server.Addr)
+			}
+		}
+
+		addr := e.Server.Addr
+		if addr == "" {
+			// fallback similar to the std Server.ListenAndServe/ListenAndServeTLS
+			if config.HttpsAddr != "" {
+				addr = ":https"
+			} else {
+				addr = ":http"
+			}
+		}
+
+		if e.Listener == nil {
+			listener, err = net.Listen("tcp", addr)
+			if err != nil {
+				return err
+			}
+		} else {
+			listener = e.Listener
+		}
+
+		if e.InstallerFunc != nil {
+			app := e.App
+			installerFunc := e.InstallerFunc
+			routine.FireAndForget(func() {
+				if err := loadInstaller(app, baseURL, installerFunc); err != nil {
+					app.Logger().Warn("Failed to initialize installer", "error", err)
+				}
+			})
+		}
+
+		return nil
+	})
+	if serveHookErr != nil {
+		return serveHookErr
+	}
+
+	if listener == nil {
+		//nolint:staticcheck
+		return errors.New("The OnServe listener was not initialized. Did you forget to call the ServeEvent.Next() method?")
+	}
+
+	if config.ShowStartBanner {
+		date := new(strings.Builder)
+		log.New(date, "", log.LstdFlags).Print()
+
+		bold := color.New(color.Bold).Add(color.FgGreen)
+		bold.Printf(
+			"%s Server started at %s\n",
+			strings.TrimSpace(date.String()),
+			color.CyanString("%s", baseURL),
+		)
+
+		regular := color.New()
+		regular.Printf("├─ REST API:  %s\n", color.CyanString("%s/api/", strings.ReplaceAll(baseURL, "0.0.0.0", "127.0.0.1")+config.PathPrefix))
+		regular.Printf("└─ Dashboard: %s\n", color.CyanString("%s/_/", strings.ReplaceAll(baseURL, "0.0.0.0", "127.0.0.1")+config.PathPrefix))
+	}
+
+	var serveErr error
+	if config.HttpsAddr != "" {
+		if config.HttpAddr != "" {
+			// start an additional HTTP server for redirecting the traffic to the HTTPS version
+			go http.ListenAndServe(config.HttpAddr, certManager.HTTPHandler(nil))
+		}
+
+		// start HTTPS server
+		serveErr = serveEvent.Server.ServeTLS(listener, "", "")
+	} else {
+		// OR start HTTP server
+		serveErr = serveEvent.Server.Serve(listener)
+	}
+	if serveErr != nil && !errors.Is(serveErr, http.ErrServerClosed) {
+		return serveErr
+	}
+
+	return nil
+}
+
+// serverAddrToHost loosely converts http.Server.Addr string into a host to print.
+func serverAddrToHost(addr string) string {
+	if addr == "" || strings.HasSuffix(addr, ":http") || strings.HasSuffix(addr, ":https") {
+		return "127.0.0.1"
+	}
+	return addr
+}
+
+type serverErrorLogWriter struct {
+	app core.App
+}
+
+func (s *serverErrorLogWriter) Write(p []byte) (int, error) {
+	s.app.Logger().Debug(strings.TrimSpace(string(p)))
+
+	return len(p), nil
+}
diff --git a/server/core_backend-server/apis/settings.go b/server/core_backend-server/apis/settings.go
new file mode 100644
index 0000000..d6d609c
--- /dev/null
+++ b/server/core_backend-server/apis/settings.go
@@ -0,0 +1,143 @@
+package apis
+
+import (
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+// bindSettingsApi registers the settings api endpoints.
+func bindSettingsApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	subGroup := rg.Group("/settings").Bind(RequireSuperuserAuth())
+	subGroup.GET("", settingsList)
+	subGroup.PATCH("", settingsSet)
+	subGroup.POST("/test/s3", settingsTestS3)
+	subGroup.POST("/test/email", settingsTestEmail)
+	subGroup.POST("/apple/generate-client-secret", settingsGenerateAppleClientSecret)
+}
+
+func settingsList(e *core.RequestEvent) error {
+	clone, err := e.App.Settings().Clone()
+	if err != nil {
+		return e.InternalServerError("", err)
+	}
+
+	event := new(core.SettingsListRequestEvent)
+	event.RequestEvent = e
+	event.Settings = clone
+
+	return e.App.OnSettingsListRequest().Trigger(event, func(e *core.SettingsListRequestEvent) error {
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, e.Settings)
+		})
+	})
+}
+
+func settingsSet(e *core.RequestEvent) error {
+	event := new(core.SettingsUpdateRequestEvent)
+	event.RequestEvent = e
+
+	if clone, err := e.App.Settings().Clone(); err == nil {
+		event.OldSettings = clone
+	} else {
+		return e.BadRequestError("", err)
+	}
+
+	if clone, err := e.App.Settings().Clone(); err == nil {
+		event.NewSettings = clone
+	} else {
+		return e.BadRequestError("", err)
+	}
+
+	if err := e.BindBody(&event.NewSettings); err != nil {
+		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	return e.App.OnSettingsUpdateRequest().Trigger(event, func(e *core.SettingsUpdateRequestEvent) error {
+		err := e.App.Save(e.NewSettings)
+		if err != nil {
+			return e.BadRequestError("An error occurred while saving the new settings.", err)
+		}
+
+		appSettings, err := e.App.Settings().Clone()
+		if err != nil {
+			return e.InternalServerError("Failed to clone app settings.", err)
+		}
+
+		return execAfterSuccessTx(true, e.App, func() error {
+			return e.JSON(http.StatusOK, appSettings)
+		})
+	})
+}
+
+func settingsTestS3(e *core.RequestEvent) error {
+	form := forms.NewTestS3Filesystem(e.App)
+
+	// load request
+	if err := e.BindBody(form); err != nil {
+		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	// send
+	if err := form.Submit(); err != nil {
+		// form error
+		if fErr, ok := err.(validation.Errors); ok {
+			return e.BadRequestError("Failed to test the S3 filesystem.", fErr)
+		}
+
+		// mailer error
+		return e.BadRequestError("Failed to test the S3 filesystem. Raw error: \n"+err.Error(), nil)
+	}
+
+	return e.NoContent(http.StatusNoContent)
+}
+
+func settingsTestEmail(e *core.RequestEvent) error {
+	form := forms.NewTestEmailSend(e.App)
+
+	// load request
+	if err := e.BindBody(form); err != nil {
+		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	// send
+	if err := form.Submit(); err != nil {
+		// form error
+		if fErr, ok := err.(validation.Errors); ok {
+			return e.BadRequestError("Failed to send the test email.", fErr)
+		}
+
+		// mailer error
+		return e.BadRequestError("Failed to send the test email. Raw error: \n"+err.Error(), nil)
+	}
+
+	return e.NoContent(http.StatusNoContent)
+}
+
+func settingsGenerateAppleClientSecret(e *core.RequestEvent) error {
+	form := forms.NewAppleClientSecretCreate(e.App)
+
+	// load request
+	if err := e.BindBody(form); err != nil {
+		return e.BadRequestError("An error occurred while loading the submitted data.", err)
+	}
+
+	// generate
+	secret, err := form.Submit()
+	if err != nil {
+		// form error
+		if fErr, ok := err.(validation.Errors); ok {
+			return e.BadRequestError("Invalid client secret data.", fErr)
+		}
+
+		// secret generation error
+		return e.BadRequestError("Failed to generate client secret. Raw error: \n"+err.Error(), nil)
+	}
+
+	return e.JSON(http.StatusOK, map[string]string{
+		"secret": secret,
+	})
+}
diff --git a/server/core_backend-server/apis/settings_test.go b/server/core_backend-server/apis/settings_test.go
new file mode 100644
index 0000000..3c20a75
--- /dev/null
+++ b/server/core_backend-server/apis/settings_test.go
@@ -0,0 +1,641 @@
+package apis_test
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestSettingsList(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodGet,
+			URL:             "/api/settings",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodGet,
+			URL:    "/api/settings",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser",
+			Method: http.MethodGet,
+			URL:    "/api/settings",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"meta":{`,
+				`"logs":{`,
+				`"smtp":{`,
+				`"s3":{`,
+				`"backups":{`,
+				`"batch":{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnSettingsListRequest": 1,
+			},
+		},
+		{
+			Name:   "OnSettingsListRequest tx body write check",
+			Method: http.MethodGet,
+			URL:    "/api/settings",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnSettingsListRequest().BindFunc(func(e *core.SettingsListRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnSettingsListRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestSettingsSet(t *testing.T) {
+	t.Parallel()
+
+	validData := `{
+		"meta":{"appName":"update_test"},
+		"s3":{"secret": "s3_secret"},
+		"backups":{"s3":{"secret":"backups_s3_secret"}}
+	}`
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPatch,
+			URL:             "/api/settings",
+			Body:            strings.NewReader(validData),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPatch,
+			URL:    "/api/settings",
+			Body:   strings.NewReader(validData),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser submitting empty data",
+			Method: http.MethodPatch,
+			URL:    "/api/settings",
+			Body:   strings.NewReader(``),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"meta":{`,
+				`"logs":{`,
+				`"smtp":{`,
+				`"s3":{`,
+				`"backups":{`,
+				`"batch":{`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                         0,
+				"OnSettingsUpdateRequest":   1,
+				"OnModelUpdate":             1,
+				"OnModelUpdateExecute":      1,
+				"OnModelAfterUpdateSuccess": 1,
+				"OnModelValidate":           1,
+				"OnSettingsReload":          1,
+			},
+		},
+		{
+			Name:   "authorized as superuser submitting invalid data",
+			Method: http.MethodPatch,
+			URL:    "/api/settings",
+			Body:   strings.NewReader(`{"meta":{"appName":""}}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"meta":{"appName":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{
+				"*":                       0,
+				"OnModelUpdate":           1,
+				"OnModelAfterUpdateError": 1,
+				"OnModelValidate":         1,
+				"OnSettingsUpdateRequest": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser submitting valid data",
+			Method: http.MethodPatch,
+			URL:    "/api/settings",
+			Body:   strings.NewReader(validData),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"meta":{`,
+				`"logs":{`,
+				`"smtp":{`,
+				`"s3":{`,
+				`"backups":{`,
+				`"batch":{`,
+				`"appName":"update_test"`,
+			},
+			NotExpectedContent: []string{
+				"secret",
+				"password",
+			},
+			ExpectedEvents: map[string]int{
+				"*":                         0,
+				"OnSettingsUpdateRequest":   1,
+				"OnModelUpdate":             1,
+				"OnModelUpdateExecute":      1,
+				"OnModelAfterUpdateSuccess": 1,
+				"OnModelValidate":           1,
+				"OnSettingsReload":          1,
+			},
+		},
+		{
+			Name:   "OnSettingsUpdateRequest tx body write check",
+			Method: http.MethodPatch,
+			URL:    "/api/settings",
+			Body:   strings.NewReader(validData),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
+				app.OnSettingsUpdateRequest().BindFunc(func(e *core.SettingsUpdateRequestEvent) error {
+					original := e.App
+					return e.App.RunInTransaction(func(txApp core.App) error {
+						e.App = txApp
+						defer func() { e.App = original }()
+
+						if err := e.Next(); err != nil {
+							return err
+						}
+
+						return e.BadRequestError("TX_ERROR", nil)
+					})
+				})
+			},
+			ExpectedStatus:  400,
+			ExpectedEvents:  map[string]int{"OnSettingsUpdateRequest": 1},
+			ExpectedContent: []string{"TX_ERROR"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestSettingsTestS3(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/settings/test/s3",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/s3",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (missing body + no s3)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/s3",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"filesystem":{`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (invalid filesystem)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/s3",
+			Body:   strings.NewReader(`{"filesystem":"invalid"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{`,
+				`"filesystem":{`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (valid filesystem and no s3)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/s3",
+			Body:   strings.NewReader(`{"filesystem":"storage"}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"data":{}`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestSettingsTestEmail(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:   "unauthorized",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (invalid body)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/email",
+			Body:   strings.NewReader(`{`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (empty json)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/email",
+			Body:   strings.NewReader(`{}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"email":{"code":"validation_required"`,
+				`"template":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (verifiation template)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "verification",
+				"email": "test@example.com"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 1 {
+					t.Fatalf("[verification] Expected 1 sent email, got %d", app.TestMailer.TotalSend())
+				}
+
+				if len(app.TestMailer.LastMessage().To) != 1 {
+					t.Fatalf("[verification] Expected 1 recipient, got %v", app.TestMailer.LastMessage().To)
+				}
+
+				if app.TestMailer.LastMessage().To[0].Address != "test@example.com" {
+					t.Fatalf("[verification] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage().To[0].Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastMessage().HTML, "Verify") {
+					t.Fatalf("[verification] Expected to sent a verification email, got \n%v\n%v", app.TestMailer.LastMessage().Subject, app.TestMailer.LastMessage().HTML)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"*":                              0,
+				"OnMailerSend":                   1,
+				"OnMailerRecordVerificationSend": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser (password reset template)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "password-reset",
+				"email": "test@example.com"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 1 {
+					t.Fatalf("[password-reset] Expected 1 sent email, got %d", app.TestMailer.TotalSend())
+				}
+
+				if len(app.TestMailer.LastMessage().To) != 1 {
+					t.Fatalf("[password-reset] Expected 1 recipient, got %v", app.TestMailer.LastMessage().To)
+				}
+
+				if app.TestMailer.LastMessage().To[0].Address != "test@example.com" {
+					t.Fatalf("[password-reset] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage().To[0].Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastMessage().HTML, "Reset password") {
+					t.Fatalf("[password-reset] Expected to sent a password-reset email, got \n%v\n%v", app.TestMailer.LastMessage().Subject, app.TestMailer.LastMessage().HTML)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"*":                               0,
+				"OnMailerSend":                    1,
+				"OnMailerRecordPasswordResetSend": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser (email change)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "email-change",
+				"email": "test@example.com"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 1 {
+					t.Fatalf("[email-change] Expected 1 sent email, got %d", app.TestMailer.TotalSend())
+				}
+
+				if len(app.TestMailer.LastMessage().To) != 1 {
+					t.Fatalf("[email-change] Expected 1 recipient, got %v", app.TestMailer.LastMessage().To)
+				}
+
+				if app.TestMailer.LastMessage().To[0].Address != "test@example.com" {
+					t.Fatalf("[email-change] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage().To[0].Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastMessage().HTML, "Confirm new email") {
+					t.Fatalf("[email-change] Expected to sent a confirm new email email, got \n%v\n%v", app.TestMailer.LastMessage().Subject, app.TestMailer.LastMessage().HTML)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"*":                             0,
+				"OnMailerSend":                  1,
+				"OnMailerRecordEmailChangeSend": 1,
+			},
+		},
+		{
+			Name:   "authorized as superuser (otp)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/test/email",
+			Body: strings.NewReader(`{
+				"template": "otp",
+				"email": "test@example.com"
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			AfterTestFunc: func(t testing.TB, app *tests.TestApp, res *http.Response) {
+				if app.TestMailer.TotalSend() != 1 {
+					t.Fatalf("[otp] Expected 1 sent email, got %d", app.TestMailer.TotalSend())
+				}
+
+				if len(app.TestMailer.LastMessage().To) != 1 {
+					t.Fatalf("[otp] Expected 1 recipient, got %v", app.TestMailer.LastMessage().To)
+				}
+
+				if app.TestMailer.LastMessage().To[0].Address != "test@example.com" {
+					t.Fatalf("[otp] Expected the email to be sent to %s, got %s", "test@example.com", app.TestMailer.LastMessage().To[0].Address)
+				}
+
+				if !strings.Contains(app.TestMailer.LastMessage().HTML, "one-time password") {
+					t.Fatalf("[otp] Expected to sent OTP email, got \n%v\n%v", app.TestMailer.LastMessage().Subject, app.TestMailer.LastMessage().HTML)
+				}
+			},
+			ExpectedStatus:  204,
+			ExpectedContent: []string{},
+			ExpectedEvents: map[string]int{
+				"*":                     0,
+				"OnMailerSend":          1,
+				"OnMailerRecordOTPSend": 1,
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestGenerateAppleClientSecret(t *testing.T) {
+	t.Parallel()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	encodedKey, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	privatePem := pem.EncodeToMemory(
+		&pem.Block{
+			Type:  "PRIVATE KEY",
+			Bytes: encodedKey,
+		},
+	)
+
+	scenarios := []tests.ApiScenario{
+		{
+			Name:            "unauthorized",
+			Method:          http.MethodPost,
+			URL:             "/api/settings/apple/generate-client-secret",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as regular user",
+			Method: http.MethodPost,
+			URL:    "/api/settings/apple/generate-client-secret",
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (invalid body)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/apple/generate-client-secret",
+			Body:   strings.NewReader(`{`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{`"data":{}`},
+			ExpectedEvents:  map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (empty json)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/apple/generate-client-secret",
+			Body:   strings.NewReader(`{}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"clientId":{"code":"validation_required"`,
+				`"teamId":{"code":"validation_required"`,
+				`"keyId":{"code":"validation_required"`,
+				`"privateKey":{"code":"validation_required"`,
+				`"duration":{"code":"validation_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (invalid data)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/apple/generate-client-secret",
+			Body: strings.NewReader(`{
+				"clientId": "",
+				"teamId": "123456789",
+				"keyId": "123456789",
+				"privateKey": "invalid",
+				"duration": -1
+			}`),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 400,
+			ExpectedContent: []string{
+				`"clientId":{"code":"validation_required"`,
+				`"teamId":{"code":"validation_length_invalid"`,
+				`"keyId":{"code":"validation_length_invalid"`,
+				`"privateKey":{"code":"validation_match_invalid"`,
+				`"duration":{"code":"validation_min_greater_equal_than_required"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+		{
+			Name:   "authorized as superuser (valid data)",
+			Method: http.MethodPost,
+			URL:    "/api/settings/apple/generate-client-secret",
+			Body: strings.NewReader(fmt.Sprintf(`{
+				"clientId": "123",
+				"teamId": "1234567890",
+				"keyId": "1234567891",
+				"privateKey": %q,
+				"duration": 1
+			}`, privatePem)),
+			Headers: map[string]string{
+				"Authorization": "eyJhbGciOiJIUzI1NiJ9.eyJpZCI6InN5d2JoZWNuaDQ2cmhtMCIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoicGJjXzMxNDI2MzU4MjMiLCJleHAiOjI1MjQ2MDQ0NjEsInJlZnJlc2hhYmxlIjp0cnVlfQ.UXgO3j-0BumcugrFjbd7j0M4MQvbrLggLlcu_YNGjoY",
+			},
+			ExpectedStatus: 200,
+			ExpectedContent: []string{
+				`"secret":"`,
+			},
+			ExpectedEvents: map[string]int{"*": 0},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
diff --git a/server/core_backend-server/apis/sql_editor.go b/server/core_backend-server/apis/sql_editor.go
new file mode 100644
index 0000000..b03c249
--- /dev/null
+++ b/server/core_backend-server/apis/sql_editor.go
@@ -0,0 +1,73 @@
+package apis
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+// bindSqlEditorApi registers the SQL editor API routes.
+func bindSqlEditorApi(app core.App, rg *router.RouterGroup[*core.RequestEvent]) {
+	subGroup := rg.Group("/sql").Bind(RequireSuperuserAuth())
+
+	subGroup.POST("/query", func(e *core.RequestEvent) error {
+		data := struct {
+			Query string `json:"query" form:"query"`
+		}{}
+
+		if err := e.BindBody(&data); err != nil {
+			return e.BadRequestError("Failed to parse request body.", err)
+		}
+
+		query := strings.TrimSpace(data.Query)
+		if query == "" {
+			return e.BadRequestError("Query cannot be empty.", nil)
+		}
+
+		// Basic security: only allow SELECT queries
+		upperQuery := strings.ToUpper(query)
+		if !strings.HasPrefix(upperQuery, "SELECT") {
+			return e.BadRequestError("Only SELECT queries are allowed.", nil)
+		}
+
+		// Disallow potentially dangerous operations
+		disallowed := []string{"INSERT", "UPDATE", "DELETE", "DROP", "ALTER", "CREATE", "TRUNCATE", "EXEC", "EXECUTE"}
+		for _, keyword := range disallowed {
+			if strings.Contains(upperQuery, " "+keyword+" ") || strings.HasPrefix(upperQuery, keyword+" ") {
+				return e.BadRequestError("Query contains disallowed keyword: "+keyword, nil)
+			}
+		}
+
+		// Remove trailing semicolons
+		query = strings.TrimSuffix(query, ";")
+
+		// Execute the query using NullStringMap which works with any database
+		var rows []dbx.NullStringMap
+		err := e.App.DB().NewQuery(query).All(&rows)
+		if err != nil {
+			e.App.Logger().Error("SQL query failed", "query", query, "error", err.Error())
+			return e.BadRequestError("Failed to execute query: "+err.Error(), nil)
+		}
+
+		// Convert NullStringMap to regular maps for JSON
+		result := make([]map[string]any, len(rows))
+		for i, row := range rows {
+			result[i] = make(map[string]any)
+			for k, v := range row {
+				if v.Valid {
+					result[i][k] = v.String
+				} else {
+					result[i][k] = nil
+				}
+			}
+		}
+
+		return e.JSON(http.StatusOK, map[string]any{
+			"rows":  result,
+			"count": len(result),
+		})
+	})
+}
diff --git a/server/core_backend-server/cmd/serve.go b/server/core_backend-server/cmd/serve.go
new file mode 100644
index 0000000..06422eb
--- /dev/null
+++ b/server/core_backend-server/cmd/serve.go
@@ -0,0 +1,96 @@
+package cmd
+
+import (
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/spf13/cobra"
+)
+
+// NewServeCommand creates and returns new command responsible for
+// starting the default PocketBase web server.
+func NewServeCommand(app core.App, showStartBanner bool, hideAdminUI bool) *cobra.Command {
+	var allowedOrigins []string
+	var httpAddr string
+	var httpsAddr string
+	var pathPrefix string
+
+	command := &cobra.Command{
+		Use:          "serve [domain(s)]",
+		Args:         cobra.ArbitraryArgs,
+		Short:        "Starts the web server (default to 127.0.0.1:8198 if no domain is specified)",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			// set default listener addresses if at least one domain is specified
+			if len(args) > 0 {
+				if httpAddr == "" {
+					httpAddr = "0.0.0.0:80"
+				}
+				if httpsAddr == "" {
+					httpsAddr = "0.0.0.0:443"
+				}
+			} else {
+				if httpAddr == "" {
+					httpAddr = "127.0.0.1:8198"
+				}
+			}
+
+			err := apis.Serve(app, apis.ServeConfig{
+				HttpAddr:           httpAddr,
+				HttpsAddr:          httpsAddr,
+				PathPrefix:         pathPrefix,
+				ShowStartBanner:    showStartBanner,
+				AllowedOrigins:     allowedOrigins,
+				CertificateDomains: args,
+				HideAdminUI:        hideAdminUI,
+			})
+
+			if errors.Is(err, http.ErrServerClosed) {
+				return nil
+			}
+
+			return err
+		},
+	}
+
+	var origins []string
+	if os.Getenv("PB_ALLOWED_ORIGINS") != "" {
+		origins = strings.Split(os.Getenv("PB_ALLOWED_ORIGINS"), ",")
+	} else {
+		origins = []string{"*"}
+	}
+
+	command.PersistentFlags().StringSliceVar(
+		&allowedOrigins,
+		"origins",
+		origins,
+		"CORS allowed domain origins list",
+	)
+
+	command.PersistentFlags().StringVar(
+		&httpAddr,
+		"http",
+		os.Getenv("PB_HTTP_ADDR"),
+		"TCP address to listen for the HTTP server\n(if domain args are specified - default to 0.0.0.0:80, otherwise - default to 127.0.0.1:8198)",
+	)
+
+	command.PersistentFlags().StringVar(
+		&httpsAddr,
+		"https",
+		os.Getenv("PB_HTTPS_ADDR"),
+		"TCP address to listen for the HTTPS server\n(if domain args are specified - default to 0.0.0.0:443, otherwise - default to empty string, aka. no TLS)\nThe incoming HTTP traffic also will be auto redirected to the HTTPS version",
+	)
+
+	command.PersistentFlags().StringVar(
+		&pathPrefix,
+		"pathPrefix",
+		os.Getenv("PB_PATH_PREFIX"),
+		"URL path prefix for the server routes. Must start with a slash (eg. /pb). Useful when reuse same domain for diffrent sites behind nginx",
+	)
+
+	return command
+}
diff --git a/server/core_backend-server/cmd/superuser.go b/server/core_backend-server/cmd/superuser.go
new file mode 100644
index 0000000..523fa53
--- /dev/null
+++ b/server/core_backend-server/cmd/superuser.go
@@ -0,0 +1,211 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/fatih/color"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cobra"
+)
+
+// NewSuperuserCommand creates and returns new command for managing
+// superuser accounts (create, update, upsert, delete).
+func NewSuperuserCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:   "superuser",
+		Short: "Manage superusers",
+	}
+
+	command.AddCommand(superuserUpsertCommand(app))
+	command.AddCommand(superuserCreateCommand(app))
+	command.AddCommand(superuserUpdateCommand(app))
+	command.AddCommand(superuserDeleteCommand(app))
+	command.AddCommand(superuserOTPCommand(app))
+
+	return command
+}
+
+func superuserUpsertCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "upsert",
+		Example:      "superuser upsert test@example.com 1234567890",
+		Short:        "Creates, or updates if email exists, a single superuser",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) != 2 {
+				return errors.New("missing email and password arguments")
+			}
+
+			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("missing or invalid email address")
+			}
+
+			superusersCol, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
+			if err != nil {
+				return fmt.Errorf("failed to fetch %q collection: %w", core.CollectionNameSuperusers, err)
+			}
+
+			superuser, err := app.FindAuthRecordByEmail(superusersCol, args[0])
+			if err != nil {
+				superuser = core.NewRecord(superusersCol)
+			}
+
+			superuser.SetEmail(args[0])
+			superuser.SetPassword(args[1])
+
+			if err := app.Save(superuser); err != nil {
+				return fmt.Errorf("failed to upsert superuser account: %w", err)
+			}
+
+			color.Green("Successfully saved superuser %q!", superuser.Email())
+			return nil
+		},
+	}
+
+	return command
+}
+
+func superuserCreateCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "create",
+		Example:      "superuser create test@example.com 1234567890",
+		Short:        "Creates a new superuser",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) != 2 {
+				return errors.New("missing email and password arguments")
+			}
+
+			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("missing or invalid email address")
+			}
+
+			superusersCol, err := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
+			if err != nil {
+				return fmt.Errorf("failed to fetch %q collection: %w", core.CollectionNameSuperusers, err)
+			}
+
+			superuser := core.NewRecord(superusersCol)
+			superuser.SetEmail(args[0])
+			superuser.SetPassword(args[1])
+
+			if err := app.Save(superuser); err != nil {
+				return fmt.Errorf("failed to create new superuser account: %w", err)
+			}
+
+			color.Green("Successfully created new superuser %q!", superuser.Email())
+			return nil
+		},
+	}
+
+	return command
+}
+
+func superuserUpdateCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "update",
+		Example:      "superuser update test@example.com 1234567890",
+		Short:        "Changes the password of a single superuser",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) != 2 {
+				return errors.New("missing email and password arguments")
+			}
+
+			if args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("missing or invalid email address")
+			}
+
+			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
+			if err != nil {
+				return fmt.Errorf("superuser with email %q doesn't exist", args[0])
+			}
+
+			superuser.SetPassword(args[1])
+
+			if err := app.Save(superuser); err != nil {
+				return fmt.Errorf("failed to change superuser %q password: %w", superuser.Email(), err)
+			}
+
+			color.Green("Successfully changed superuser %q password!", superuser.Email())
+			return nil
+		},
+	}
+
+	return command
+}
+
+func superuserDeleteCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "delete",
+		Example:      "superuser delete test@example.com",
+		Short:        "Deletes an existing superuser",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("invalid or missing email address")
+			}
+
+			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
+			if err != nil {
+				color.Yellow("superuser %q is missing or already deleted", args[0])
+				return nil
+			}
+
+			if err := app.Delete(superuser); err != nil {
+				return fmt.Errorf("failed to delete superuser %q: %w", superuser.Email(), err)
+			}
+
+			color.Green("Successfully deleted superuser %q!", superuser.Email())
+			return nil
+		},
+	}
+
+	return command
+}
+
+func superuserOTPCommand(app core.App) *cobra.Command {
+	command := &cobra.Command{
+		Use:          "otp",
+		Example:      "superuser otp test@example.com",
+		Short:        "Creates a new OTP for the specified superuser",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			if len(args) == 0 || args[0] == "" || is.EmailFormat.Validate(args[0]) != nil {
+				return errors.New("invalid or missing email address")
+			}
+
+			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, args[0])
+			if err != nil {
+				return fmt.Errorf("superuser with email %q doesn't exist", args[0])
+			}
+
+			if !superuser.Collection().OTP.Enabled {
+				return errors.New("OTP auth is not enabled for the _superusers collection")
+			}
+
+			pass := security.RandomStringWithAlphabet(superuser.Collection().OTP.Length, "1234567890")
+
+			otp := core.NewOTP(app)
+			otp.SetCollectionRef(superuser.Collection().Id)
+			otp.SetRecordRef(superuser.Id)
+			otp.SetPassword(pass)
+
+			err = app.Save(otp)
+			if err != nil {
+				return fmt.Errorf("failed to create OTP: %w", err)
+			}
+
+			color.New(color.BgGreen, color.FgBlack).Printf("Successfully created OTP for superuser %q:", superuser.Email())
+			color.Green("\n├─ Id:    %s", otp.Id)
+			color.Green("├─ Pass:  %s", pass)
+			color.Green("└─ Valid: %ds\n\n", superuser.Collection().OTP.Duration)
+			return nil
+		},
+	}
+
+	return command
+}
diff --git a/server/core_backend-server/cmd/superuser_test.go b/server/core_backend-server/cmd/superuser_test.go
new file mode 100644
index 0000000..dd3681d
--- /dev/null
+++ b/server/core_backend-server/cmd/superuser_test.go
@@ -0,0 +1,403 @@
+package cmd_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/cmd"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestSuperuserUpsertCommand(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		password    string
+		expectError bool
+	}{
+		{
+			"empty email and password",
+			"",
+			"",
+			true,
+		},
+		{
+			"empty email",
+			"",
+			"1234567890",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			"1234567890",
+			true,
+		},
+		{
+			"empty password",
+			"test@example.com",
+			"",
+			true,
+		},
+		{
+			"short password",
+			"test_new@example.com",
+			"1234567",
+			true,
+		},
+		{
+			"existing user",
+			"test@example.com",
+			"1234567890!",
+			false,
+		},
+		{
+			"new user",
+			"test_new@example.com",
+			"1234567890!",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			command := cmd.NewSuperuserCommand(app)
+			command.SetArgs([]string{"upsert", s.email, s.password})
+
+			err := command.Execute()
+
+			hasErr := err != nil
+			if s.expectError != hasErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			// check whether the superuser account was actually upserted
+			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, s.email)
+			if err != nil {
+				t.Fatalf("Failed to fetch superuser %s: %v", s.email, err)
+			} else if !superuser.ValidatePassword(s.password) {
+				t.Fatal("Expected the superuser password to match")
+			}
+		})
+	}
+}
+
+func TestSuperuserCreateCommand(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		password    string
+		expectError bool
+	}{
+		{
+			"empty email and password",
+			"",
+			"",
+			true,
+		},
+		{
+			"empty email",
+			"",
+			"1234567890",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			"1234567890",
+			true,
+		},
+		{
+			"duplicated email",
+			"test@example.com",
+			"1234567890",
+			true,
+		},
+		{
+			"empty password",
+			"test@example.com",
+			"",
+			true,
+		},
+		{
+			"short password",
+			"test_new@example.com",
+			"1234567",
+			true,
+		},
+		{
+			"valid email and password",
+			"test_new@example.com",
+			"12345678",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			command := cmd.NewSuperuserCommand(app)
+			command.SetArgs([]string{"create", s.email, s.password})
+
+			err := command.Execute()
+
+			hasErr := err != nil
+			if s.expectError != hasErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			// check whether the superuser account was actually created
+			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, s.email)
+			if err != nil {
+				t.Fatalf("Failed to fetch created superuser %s: %v", s.email, err)
+			} else if !superuser.ValidatePassword(s.password) {
+				t.Fatal("Expected the superuser password to match")
+			}
+		})
+	}
+}
+
+func TestSuperuserUpdateCommand(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		password    string
+		expectError bool
+	}{
+		{
+			"empty email and password",
+			"",
+			"",
+			true,
+		},
+		{
+			"empty email",
+			"",
+			"1234567890",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			"1234567890",
+			true,
+		},
+		{
+			"nonexisting superuser",
+			"test_missing@example.com",
+			"1234567890",
+			true,
+		},
+		{
+			"empty password",
+			"test@example.com",
+			"",
+			true,
+		},
+		{
+			"short password",
+			"test_new@example.com",
+			"1234567",
+			true,
+		},
+		{
+			"valid email and password",
+			"test@example.com",
+			"12345678",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			command := cmd.NewSuperuserCommand(app)
+			command.SetArgs([]string{"update", s.email, s.password})
+
+			err := command.Execute()
+
+			hasErr := err != nil
+			if s.expectError != hasErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			// check whether the superuser password was actually changed
+			superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, s.email)
+			if err != nil {
+				t.Fatalf("Failed to fetch superuser %s: %v", s.email, err)
+			} else if !superuser.ValidatePassword(s.password) {
+				t.Fatal("Expected the superuser password to match")
+			}
+		})
+	}
+}
+
+func TestSuperuserDeleteCommand(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		email       string
+		expectError bool
+	}{
+		{
+			"empty email",
+			"",
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			true,
+		},
+		{
+			"nonexisting superuser",
+			"test_missing@example.com",
+			false,
+		},
+		{
+			"existing superuser",
+			"test@example.com",
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			command := cmd.NewSuperuserCommand(app)
+			command.SetArgs([]string{"delete", s.email})
+
+			err := command.Execute()
+
+			hasErr := err != nil
+			if s.expectError != hasErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if _, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, s.email); err == nil {
+				t.Fatal("Expected the superuser account to be deleted")
+			}
+		})
+	}
+}
+
+func TestSuperuserOTPCommand(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	superusersCollection, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// remove all existing otps
+	otps, err := app.FindAllOTPsByCollection(superusersCollection)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, otp := range otps {
+		err = app.Delete(otp)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	scenarios := []struct {
+		name        string
+		email       string
+		enabled     bool
+		expectError bool
+	}{
+		{
+			"empty email",
+			"",
+			true,
+			true,
+		},
+		{
+			"invalid email",
+			"invalid",
+			true,
+			true,
+		},
+		{
+			"nonexisting superuser",
+			"test_missing@example.com",
+			true,
+			true,
+		},
+		{
+			"existing superuser",
+			"test@example.com",
+			true,
+			false,
+		},
+		{
+			"existing superuser with disabled OTP",
+			"test@example.com",
+			false,
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			command := cmd.NewSuperuserCommand(app)
+			command.SetArgs([]string{"otp", s.email})
+
+			superusersCollection.OTP.Enabled = s.enabled
+			if err = app.SaveNoValidate(superusersCollection); err != nil {
+				t.Fatal(err)
+			}
+
+			err := command.Execute()
+
+			hasErr := err != nil
+			if s.expectError != hasErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			superuser, err := app.FindAuthRecordByEmail(superusersCollection, s.email)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			otps, _ := app.FindAllOTPsByRecord(superuser)
+			if total := len(otps); total != 1 {
+				t.Fatalf("Expected 1 OTP, got %d", total)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/app.go b/server/core_backend-server/core/app.go
new file mode 100644
index 0000000..8f305cc
--- /dev/null
+++ b/server/core_backend-server/core/app.go
@@ -0,0 +1,1543 @@
+// Package core is the backbone of PocketBase.
+//
+// It defines the main PocketBase App interface and its base implementation.
+package core
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/cron"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+// App defines the main PocketBase app interface.
+//
+// Note that the interface is not intended to be implemented manually by users
+// and instead they should use core.BaseApp (either directly or as embedded field in a custom struct).
+//
+// This interface exists to make testing easier and to allow users to
+// create common and pluggable helpers and methods that doesn't rely
+// on a specific wrapped app struct (hence the large interface size).
+type App interface {
+	// UnsafeWithoutHooks returns a shallow copy of the current app WITHOUT any registered hooks.
+	//
+	// NB! Note that using the returned app instance may cause data integrity errors
+	// since the Record validations and data normalizations (including files uploads)
+	// rely on the app hooks to work.
+	UnsafeWithoutHooks() App
+
+	// Logger returns the default app logger.
+	//
+	// If the application is not bootstrapped yet, fallbacks to slog.Default().
+	Logger() *slog.Logger
+
+	// IsBootstrapped checks if the application was initialized
+	// (aka. whether Bootstrap() was called).
+	IsBootstrapped() bool
+
+	// IsTransactional checks if the current app instance is part of a transaction.
+	IsTransactional() bool
+
+	// TxInfo returns the transaction associated with the current app instance (if any).
+	//
+	// Could be used if you want to execute indirectly a function after
+	// the related app transaction completes using `app.TxInfo().OnAfterFunc(callback)`.
+	TxInfo() *TxAppInfo
+
+	// Bootstrap initializes the application
+	// (aka. create data dir, open db connections, load settings, etc.).
+	//
+	// It will call ResetBootstrapState() if the application was already bootstrapped.
+	Bootstrap() error
+
+	// ResetBootstrapState releases the initialized core app resources
+	// (closing db connections, stopping cron ticker, etc.).
+	ResetBootstrapState() error
+
+	// DataDir returns the app data directory path.
+	DataDir() string
+
+	// EncryptionEnv returns the name of the app secret env key
+	// (currently used primarily for optional settings encryption but this may change in the future).
+	EncryptionEnv() string
+
+	// IsRealtimeBridgeEnabled returns whether the app is in realtime bridge mode.
+	// If you need both realtime feature and horizontal scale support, you could
+	// enable it. We will use Postgres's LISTEN/NOTIFY feature to sync realtime events.
+	IsRealtimeBridgeEnabled() bool
+
+	// IsDev returns whether the app is in dev mode.
+	//
+	// When enabled logs, executed sql statements, etc. are printed to the stderr.
+	IsDev() bool
+
+	// Settings returns the loaded app settings.
+	Settings() *Settings
+
+	// Store returns the app runtime store.
+	Store() *store.Store[string, any]
+
+	// Cron returns the app cron instance.
+	Cron() *cron.Cron
+
+	// SubscriptionsBroker returns the app realtime subscriptions broker instance.
+	SubscriptionsBroker() *subscriptions.Broker
+
+	// NewMailClient creates and returns a new SMTP or Sendmail client
+	// based on the current app settings.
+	NewMailClient() mailer.Mailer
+
+	// NewFilesystem creates a new local or S3 filesystem instance
+	// for managing regular app files (ex. record uploads)
+	// based on the current app settings.
+	//
+	// NB! Make sure to call Close() on the returned result
+	// after you are done working with it.
+	NewFilesystem() (*filesystem.System, error)
+
+	// NewBackupsFilesystem creates a new local or S3 filesystem instance
+	// for managing app backups based on the current app settings.
+	//
+	// NB! Make sure to call Close() on the returned result
+	// after you are done working with it.
+	NewBackupsFilesystem() (*filesystem.System, error)
+
+	// ReloadSettings reinitializes and reloads the stored application settings.
+	ReloadSettings() error
+
+	// CreateBackup creates a new backup of the current app pb_data directory.
+	//
+	// Backups can be stored on S3 if it is configured in app.Settings().Backups.
+	//
+	// Please refer to the godoc of the specific core.App implementation
+	// for details on the backup procedures.
+	CreateBackup(ctx context.Context, name string) error
+
+	// RestoreBackup restores the backup with the specified name and restarts
+	// the current running application process.
+	//
+	// The safely perform the restore it is recommended to have free disk space
+	// for at least 2x the size of the restored pb_data backup.
+	//
+	// Please refer to the godoc of the specific core.App implementation
+	// for details on the restore procedures.
+	//
+	// NB! This feature is experimental and currently is expected to work only on UNIX based systems.
+	RestoreBackup(ctx context.Context, name string) error
+
+	// Restart restarts (aka. replaces) the current running application process.
+	//
+	// NB! It relies on execve which is supported only on UNIX based systems.
+	Restart() error
+
+	// RunSystemMigrations applies all new migrations registered in the [core.SystemMigrations] list.
+	RunSystemMigrations() error
+
+	// RunAppMigrations applies all new migrations registered in the [core.AppMigrations] list.
+	RunAppMigrations() error
+
+	// RunAllMigrations applies all system and app migrations
+	// (aka. from both [core.SystemMigrations] and [core.AppMigrations]).
+	RunAllMigrations() error
+
+	// ---------------------------------------------------------------
+	// DB methods
+	// ---------------------------------------------------------------
+
+	// DB returns the default app data.db builder instance.
+	//
+	// To minimize SQLITE_BUSY errors, it automatically routes the
+	// SELECT queries to the underlying concurrent db pool and everything else
+	// to the nonconcurrent one.
+	//
+	// For more finer control over the used connections pools you can
+	// call directly ConcurrentDB() or NonconcurrentDB().
+	DB() dbx.Builder
+
+	// ConcurrentDB returns the concurrent app data.db builder instance.
+	//
+	// This method is used mainly internally for executing db read
+	// operations in a concurrent/non-blocking manner.
+	//
+	// Most users should use simply DB() as it will automatically
+	// route the query execution to ConcurrentDB() or NonconcurrentDB().
+	//
+	// In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+	ConcurrentDB() dbx.Builder
+
+	// NonconcurrentDB returns the nonconcurrent app data.db builder instance.
+	//
+	// The returned db instance is limited only to a single open connection,
+	// meaning that it can process only 1 db operation at a time (other queries queue up).
+	//
+	// This method is used mainly internally and in the tests to execute write
+	// (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+	//
+	// Most users should use simply DB() as it will automatically
+	// route the query execution to ConcurrentDB() or NonconcurrentDB().
+	//
+	// In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+	NonconcurrentDB() dbx.Builder
+
+	// AuxDB returns the app auxiliary.db builder instance.
+	//
+	// To minimize SQLITE_BUSY errors, it automatically routes the
+	// SELECT queries to the underlying concurrent db pool and everything else
+	// to the nonconcurrent one.
+	//
+	// For more finer control over the used connections pools you can
+	// call directly AuxConcurrentDB() or AuxNonconcurrentDB().
+	AuxDB() dbx.Builder
+
+	// AuxConcurrentDB returns the concurrent app auxiliary.db builder instance.
+	//
+	// This method is used mainly internally for executing db read
+	// operations in a concurrent/non-blocking manner.
+	//
+	// Most users should use simply AuxDB() as it will automatically
+	// route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+	//
+	// In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+	AuxConcurrentDB() dbx.Builder
+
+	// AuxNonconcurrentDB returns the nonconcurrent app auxiliary.db builder instance.
+	//
+	// The returned db instance is limited only to a single open connection,
+	// meaning that it can process only 1 db operation at a time (other queries queue up).
+	//
+	// This method is used mainly internally and in the tests to execute write
+	// (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+	//
+	// Most users should use simply AuxDB() as it will automatically
+	// route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+	//
+	// In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+	AuxNonconcurrentDB() dbx.Builder
+
+	// HasTable checks if a table (or view) with the provided name exists (case insensitive).
+	// in the data.db.
+	HasTable(tableName string) bool
+
+	// AuxHasTable checks if a table (or view) with the provided name exists (case insensitive)
+	// in the auxiliary.db.
+	AuxHasTable(tableName string) bool
+
+	// TableColumns returns all column names of a single table by its name.
+	TableColumns(tableName string) ([]string, error)
+
+	// TableInfo returns the "table_info" pragma result for the specified table.
+	TableInfo(tableName string) ([]*TableInfoRow, error)
+
+	// TableIndexes returns a name grouped map with all non empty index of the specified table.
+	//
+	// Note: This method doesn't return an error on nonexisting table.
+	TableIndexes(tableName string) (map[string]string, error)
+
+	// DeleteTable drops the specified table.
+	//
+	// This method is a no-op if a table with the provided name doesn't exist.
+	//
+	// NB! Be aware that this method is vulnerable to SQL injection and the
+	// "tableName" argument must come only from trusted input!
+	DeleteTable(tableName string) error
+
+	// DeleteView drops the specified view name.
+	//
+	// This method is a no-op if a view with the provided name doesn't exist.
+	//
+	// NB! Be aware that this method is vulnerable to SQL injection and the
+	// "name" argument must come only from trusted input!
+	DeleteView(name string) error
+
+	// SaveView creates (or updates already existing) persistent SQL view.
+	//
+	// NB! Be aware that this method is vulnerable to SQL injection and the
+	// "selectQuery" argument must come only from trusted input!
+	SaveView(name string, selectQuery string) error
+
+	// CreateViewFields creates a new FieldsList from the provided select query.
+	//
+	// There are some caveats:
+	// - The select query must have an "id" column.
+	// - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
+	CreateViewFields(selectQuery string) (FieldsList, error)
+
+	// FindRecordByViewFile returns the original Record of the provided view collection file.
+	FindRecordByViewFile(viewCollectionModelOrIdentifier any, fileFieldName string, filename string) (*Record, error)
+
+	// Vacuum executes VACUUM on the data.db in order to reclaim unused data db disk space.
+	Vacuum() error
+
+	// AuxVacuum executes VACUUM on the auxiliary.db in order to reclaim unused auxiliary db disk space.
+	AuxVacuum() error
+
+	// ---------------------------------------------------------------
+
+	// ModelQuery creates a new preconfigured select data.db query with preset
+	// SELECT, FROM and other common fields based on the provided model.
+	ModelQuery(model Model) *dbx.SelectQuery
+
+	// AuxModelQuery creates a new preconfigured select auxiliary.db query with preset
+	// SELECT, FROM and other common fields based on the provided model.
+	AuxModelQuery(model Model) *dbx.SelectQuery
+
+	// Delete deletes the specified model from the regular app database.
+	Delete(model Model) error
+
+	// Delete deletes the specified model from the regular app database
+	// (the context could be used to limit the query execution).
+	DeleteWithContext(ctx context.Context, model Model) error
+
+	// AuxDelete deletes the specified model from the auxiliary database.
+	AuxDelete(model Model) error
+
+	// AuxDeleteWithContext deletes the specified model from the auxiliary database
+	// (the context could be used to limit the query execution).
+	AuxDeleteWithContext(ctx context.Context, model Model) error
+
+	// Save validates and saves the specified model into the regular app database.
+	//
+	// If you don't want to run validations, use [App.SaveNoValidate()].
+	Save(model Model) error
+
+	// SaveWithContext is the same as [App.Save()] but allows specifying a context to limit the db execution.
+	//
+	// If you don't want to run validations, use [App.SaveNoValidateWithContext()].
+	SaveWithContext(ctx context.Context, model Model) error
+
+	// SaveNoValidate saves the specified model into the regular app database without performing validations.
+	//
+	// If you want to also run validations before persisting, use [App.Save()].
+	SaveNoValidate(model Model) error
+
+	// SaveNoValidateWithContext is the same as [App.SaveNoValidate()]
+	// but allows specifying a context to limit the db execution.
+	//
+	// If you want to also run validations before persisting, use [App.SaveWithContext()].
+	SaveNoValidateWithContext(ctx context.Context, model Model) error
+
+	// AuxSave validates and saves the specified model into the auxiliary app database.
+	//
+	// If you don't want to run validations, use [App.AuxSaveNoValidate()].
+	AuxSave(model Model) error
+
+	// AuxSaveWithContext is the same as [App.AuxSave()] but allows specifying a context to limit the db execution.
+	//
+	// If you don't want to run validations, use [App.AuxSaveNoValidateWithContext()].
+	AuxSaveWithContext(ctx context.Context, model Model) error
+
+	// AuxSaveNoValidate saves the specified model into the auxiliary app database without performing validations.
+	//
+	// If you want to also run validations before persisting, use [App.AuxSave()].
+	AuxSaveNoValidate(model Model) error
+
+	// AuxSaveNoValidateWithContext is the same as [App.AuxSaveNoValidate()]
+	// but allows specifying a context to limit the db execution.
+	//
+	// If you want to also run validations before persisting, use [App.AuxSaveWithContext()].
+	AuxSaveNoValidateWithContext(ctx context.Context, model Model) error
+
+	// Validate triggers the OnModelValidate hook for the specified model.
+	Validate(model Model) error
+
+	// ValidateWithContext is the same as Validate but allows specifying the ModelEvent context.
+	ValidateWithContext(ctx context.Context, model Model) error
+
+	// RunInTransaction wraps fn into a transaction for the regular app database.
+	//
+	// It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+	RunInTransaction(fn func(txApp App) error) error
+
+	// AuxRunInTransaction wraps fn into a transaction for the auxiliary app database.
+	//
+	// It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+	AuxRunInTransaction(fn func(txApp App) error) error
+
+	// ---------------------------------------------------------------
+
+	// LogQuery returns a new Log select query.
+	LogQuery() *dbx.SelectQuery
+
+	// FindLogById finds a single Log entry by its id.
+	FindLogById(id string) (*Log, error)
+
+	// LogsStatsItem returns hourly grouped logs statistics.
+	LogsStats(expr dbx.Expression) ([]*LogsStatsItem, error)
+
+	// DeleteOldLogs delete all logs that are created before createdBefore.
+	DeleteOldLogs(createdBefore time.Time) error
+
+	// ---------------------------------------------------------------
+
+	// CollectionQuery returns a new Collection select query.
+	CollectionQuery() *dbx.SelectQuery
+
+	// FindCollections finds all collections by the given type(s).
+	//
+	// If collectionTypes is not set, it returns all collections.
+	//
+	// Example:
+	//
+	//	app.FindAllCollections() // all collections
+	//	app.FindAllCollections("auth", "view") // only auth and view collections
+	FindAllCollections(collectionTypes ...string) ([]*Collection, error)
+
+	// ReloadCachedCollections fetches all collections and caches them into the app store.
+	ReloadCachedCollections() error
+
+	// FindCollectionByNameOrId finds a single collection by its name (case insensitive) or id.s
+	FindCollectionByNameOrId(nameOrId string) (*Collection, error)
+
+	// FindCachedCollectionByNameOrId is similar to [App.FindCollectionByNameOrId]
+	// but retrieves the Collection from the app cache instead of making a db call.
+	//
+	// NB! This method is suitable for read-only Collection operations.
+	//
+	// Returns [sql.ErrNoRows] if no Collection is found for consistency
+	// with the [App.FindCollectionByNameOrId] method.
+	//
+	// If you plan making changes to the returned Collection model,
+	// use [App.FindCollectionByNameOrId] instead.
+	//
+	// Caveats:
+	//
+	//   - The returned Collection should be used only for read-only operations.
+	//     Avoid directly modifying the returned cached Collection as it will affect
+	//     the global cached value even if you don't persist the changes in the database!
+	//   - If you are updating a Collection in a transaction and then call this method before commit,
+	//     it'll return the cached Collection state and not the one from the uncommitted transaction.
+	//   - The cache is automatically updated on collections db change (create/update/delete).
+	//     To manually reload the cache you can call [App.ReloadCachedCollections]
+	FindCachedCollectionByNameOrId(nameOrId string) (*Collection, error)
+
+	// FindCollectionReferences returns information for all relation
+	// fields referencing the provided collection.
+	//
+	// If the provided collection has reference to itself then it will be
+	// also included in the result. To exclude it, pass the collection id
+	// as the excludeIds argument.
+	FindCollectionReferences(collection *Collection, excludeIds ...string) (map[*Collection][]Field, error)
+
+	// FindCachedCollectionReferences is similar to [App.FindCollectionReferences]
+	// but retrieves the Collection from the app cache instead of making a db call.
+	//
+	// NB! This method is suitable for read-only Collection operations.
+	//
+	// If you plan making changes to the returned Collection model,
+	// use [App.FindCollectionReferences] instead.
+	//
+	// Caveats:
+	//
+	//   - The returned Collection should be used only for read-only operations.
+	//     Avoid directly modifying the returned cached Collection as it will affect
+	//     the global cached value even if you don't persist the changes in the database!
+	//   - If you are updating a Collection in a transaction and then call this method before commit,
+	//     it'll return the cached Collection state and not the one from the uncommitted transaction.
+	//   - The cache is automatically updated on collections db change (create/update/delete).
+	//     To manually reload the cache you can call [App.ReloadCachedCollections].
+	FindCachedCollectionReferences(collection *Collection, excludeIds ...string) (map[*Collection][]Field, error)
+
+	// IsCollectionNameUnique checks that there is no existing collection
+	// with the provided name (case insensitive!).
+	//
+	// Note: case insensitive check because the name is used also as
+	// table name for the records.
+	IsCollectionNameUnique(name string, excludeIds ...string) bool
+
+	// TruncateCollection deletes all records associated with the provided collection.
+	//
+	// The truncate operation is executed in a single transaction,
+	// aka. either everything is deleted or none.
+	//
+	// Note that this method will also trigger the records related
+	// cascade and file delete actions.
+	TruncateCollection(collection *Collection) error
+
+	// ImportCollections imports the provided collections data in a single transaction.
+	//
+	// For existing matching collections, the imported data is unmarshaled on top of the existing model.
+	//
+	// NB! If deleteMissing is true, ALL NON-SYSTEM COLLECTIONS AND SCHEMA FIELDS,
+	// that are not present in the imported configuration, WILL BE DELETED
+	// (this includes their related records data).
+	ImportCollections(toImport []map[string]any, deleteMissing bool) error
+
+	// ImportCollectionsByMarshaledJSON is the same as [ImportCollections]
+	// but accept marshaled json array as import data (usually used for the autogenerated snapshots).
+	ImportCollectionsByMarshaledJSON(rawSliceOfMaps []byte, deleteMissing bool) error
+
+	// SyncRecordTableSchema compares the two provided collections
+	// and applies the necessary related record table changes.
+	//
+	// If oldCollection is null, then only newCollection is used to create the record table.
+	//
+	// This method is automatically invoked as part of a collection create/update/delete operation.
+	SyncRecordTableSchema(newCollection *Collection, oldCollection *Collection) error
+
+	// ---------------------------------------------------------------
+
+	// FindAllExternalAuthsByRecord returns all ExternalAuth models
+	// linked to the provided auth record.
+	FindAllExternalAuthsByRecord(authRecord *Record) ([]*ExternalAuth, error)
+
+	// FindAllExternalAuthsByCollection returns all ExternalAuth models
+	// linked to the provided auth collection.
+	FindAllExternalAuthsByCollection(collection *Collection) ([]*ExternalAuth, error)
+
+	// FindFirstExternalAuthByExpr returns the first available (the most recent created)
+	// ExternalAuth model that satisfies the non-nil expression.
+	FindFirstExternalAuthByExpr(expr dbx.Expression) (*ExternalAuth, error)
+
+	// ---------------------------------------------------------------
+
+	// FindAllMFAsByRecord returns all MFA models linked to the provided auth record.
+	FindAllMFAsByRecord(authRecord *Record) ([]*MFA, error)
+
+	// FindAllMFAsByCollection returns all MFA models linked to the provided collection.
+	FindAllMFAsByCollection(collection *Collection) ([]*MFA, error)
+
+	// FindMFAById returns a single MFA model by its id.
+	FindMFAById(id string) (*MFA, error)
+
+	// DeleteAllMFAsByRecord deletes all MFA models associated with the provided record.
+	//
+	// Returns a combined error with the failed deletes.
+	DeleteAllMFAsByRecord(authRecord *Record) error
+
+	// DeleteExpiredMFAs deletes the expired MFAs for all auth collections.
+	DeleteExpiredMFAs() error
+
+	// ---------------------------------------------------------------
+
+	// FindAllOTPsByRecord returns all OTP models linked to the provided auth record.
+	FindAllOTPsByRecord(authRecord *Record) ([]*OTP, error)
+
+	// FindAllOTPsByCollection returns all OTP models linked to the provided collection.
+	FindAllOTPsByCollection(collection *Collection) ([]*OTP, error)
+
+	// FindOTPById returns a single OTP model by its id.
+	FindOTPById(id string) (*OTP, error)
+
+	// DeleteAllOTPsByRecord deletes all OTP models associated with the provided record.
+	//
+	// Returns a combined error with the failed deletes.
+	DeleteAllOTPsByRecord(authRecord *Record) error
+
+	// DeleteExpiredOTPs deletes the expired OTPs for all auth collections.
+	DeleteExpiredOTPs() error
+
+	// ---------------------------------------------------------------
+
+	// FindAllAuthOriginsByRecord returns all AuthOrigin models linked to the provided auth record (in DESC order).
+	FindAllAuthOriginsByRecord(authRecord *Record) ([]*AuthOrigin, error)
+
+	// FindAllAuthOriginsByCollection returns all AuthOrigin models linked to the provided collection (in DESC order).
+	FindAllAuthOriginsByCollection(collection *Collection) ([]*AuthOrigin, error)
+
+	// FindAuthOriginById returns a single AuthOrigin model by its id.
+	FindAuthOriginById(id string) (*AuthOrigin, error)
+
+	// FindAuthOriginByRecordAndFingerprint returns a single AuthOrigin model
+	// by its authRecord relation and fingerprint.
+	FindAuthOriginByRecordAndFingerprint(authRecord *Record, fingerprint string) (*AuthOrigin, error)
+
+	// DeleteAllAuthOriginsByRecord deletes all AuthOrigin models associated with the provided record.
+	//
+	// Returns a combined error with the failed deletes.
+	DeleteAllAuthOriginsByRecord(authRecord *Record) error
+
+	// ---------------------------------------------------------------
+
+	// RecordQuery returns a new Record select query from a collection model, id or name.
+	//
+	// In case a collection id or name is provided and that collection doesn't
+	// actually exists, the generated query will be created with a cancelled context
+	// and will fail once an executor (Row(), One(), All(), etc.) is called.
+	RecordQuery(collectionModelOrIdentifier any) *dbx.SelectQuery
+
+	// FindRecordById finds the Record model by its id.
+	FindRecordById(collectionModelOrIdentifier any, recordId string, optFilters ...func(q *dbx.SelectQuery) error) (*Record, error)
+
+	// FindRecordsByIds finds all records by the specified ids.
+	// If no records are found, returns an empty slice.
+	FindRecordsByIds(collectionModelOrIdentifier any, recordIds []string, optFilters ...func(q *dbx.SelectQuery) error) ([]*Record, error)
+
+	// FindAllRecords finds all records matching specified db expressions.
+	//
+	// Returns all collection records if no expression is provided.
+	//
+	// Returns an empty slice if no records are found.
+	//
+	// Example:
+	//
+	//	// no extra expressions
+	//	app.FindAllRecords("example")
+	//
+	//	// with extra expressions
+	//	expr1 := dbx.HashExp{"email": "test@example.com"}
+	//	expr2 := dbx.NewExp("LOWER(username) = {:username}", dbx.Params{"username": "test"})
+	//	app.FindAllRecords("example", expr1, expr2)
+	FindAllRecords(collectionModelOrIdentifier any, exprs ...dbx.Expression) ([]*Record, error)
+
+	// FindFirstRecordByData returns the first found record matching
+	// the provided key-value pair.
+	FindFirstRecordByData(collectionModelOrIdentifier any, key string, value any) (*Record, error)
+
+	// FindRecordsByFilter returns limit number of records matching the
+	// provided string filter.
+	//
+	// NB! Use the last "params" argument to bind untrusted user variables!
+	//
+	// The filter argument is optional and can be empty string to target
+	// all available records.
+	//
+	// The sort argument is optional and can be empty string OR the same format
+	// used in the web APIs, ex. "-created,title".
+	//
+	// If the limit argument is <= 0, no limit is applied to the query and
+	// all matching records are returned.
+	//
+	// Returns an empty slice if no records are found.
+	//
+	// Example:
+	//
+	//	app.FindRecordsByFilter(
+	//		"posts",
+	//		"title ~ {:title} && visible = {:visible}",
+	//		"-created",
+	//		10,
+	//		0,
+	//		dbx.Params{"title": "lorem ipsum", "visible": true}
+	//	)
+	FindRecordsByFilter(
+		collectionModelOrIdentifier any,
+		filter string,
+		sort string,
+		limit int,
+		offset int,
+		params ...dbx.Params,
+	) ([]*Record, error)
+
+	// FindFirstRecordByFilter returns the first available record matching the provided filter (if any).
+	//
+	// NB! Use the last params argument to bind untrusted user variables!
+	//
+	// Returns sql.ErrNoRows if no record is found.
+	//
+	// Example:
+	//
+	//	app.FindFirstRecordByFilter("posts", "")
+	//	app.FindFirstRecordByFilter("posts", "slug={:slug} && status='public'", dbx.Params{"slug": "test"})
+	FindFirstRecordByFilter(
+		collectionModelOrIdentifier any,
+		filter string,
+		params ...dbx.Params,
+	) (*Record, error)
+
+	// CountRecords returns the total number of records in a collection.
+	CountRecords(collectionModelOrIdentifier any, exprs ...dbx.Expression) (int64, error)
+
+	// FindAuthRecordByToken finds the auth record associated with the provided JWT
+	// (auth, file, verifyEmail, changeEmail, passwordReset types).
+	//
+	// Optionally specify a list of validTypes to check tokens only from those types.
+	//
+	// Returns an error if the JWT is invalid, expired or not associated to an auth collection record.
+	FindAuthRecordByToken(token string, validTypes ...string) (*Record, error)
+
+	// FindAuthRecordByEmail finds the auth record associated with the provided email.
+	//
+	// Returns an error if it is not an auth collection or the record is not found.
+	FindAuthRecordByEmail(collectionModelOrIdentifier any, email string) (*Record, error)
+
+	// CanAccessRecord checks if a record is allowed to be accessed by the
+	// specified requestInfo and accessRule.
+	//
+	// Rule and db checks are ignored in case requestInfo.Auth is a superuser.
+	//
+	// The returned error indicate that something unexpected happened during
+	// the check (eg. invalid rule or db query error).
+	//
+	// The method always return false on invalid rule or db query error.
+	//
+	// Example:
+	//
+	//	requestInfo, _ := e.RequestInfo()
+	//	record, _ := app.FindRecordById("example", "RECORD_ID")
+	//	rule := types.Pointer("@request.auth.id != '' || status = 'public'")
+	//	// ... or use one of the record collection's rule, eg. record.Collection().ViewRule
+	//
+	//	if ok, _ := app.CanAccessRecord(record, requestInfo, rule); ok { ... }
+	CanAccessRecord(record *Record, requestInfo *RequestInfo, accessRule *string) (bool, error)
+
+	// ExpandRecord expands the relations of a single Record model.
+	//
+	// If optFetchFunc is not set, then a default function will be used
+	// that returns all relation records.
+	//
+	// Returns a map with the failed expand parameters and their errors.
+	ExpandRecord(record *Record, expands []string, optFetchFunc ExpandFetchFunc) map[string]error
+
+	// ExpandRecords expands the relations of the provided Record models list.
+	//
+	// If optFetchFunc is not set, then a default function will be used
+	// that returns all relation records.
+	//
+	// Returns a map with the failed expand parameters and their errors.
+	ExpandRecords(records []*Record, expands []string, optFetchFunc ExpandFetchFunc) map[string]error
+
+	// ---------------------------------------------------------------
+	// App event hooks
+	// ---------------------------------------------------------------
+
+	// OnBootstrap hook is triggered when initializing the main application
+	// resources (db, app settings, etc).
+	OnBootstrap() *hook.Hook[*BootstrapEvent]
+
+	// OnServe hook is triggered when the app web server is started
+	// (after starting the TCP listener but before initializing the blocking serve task),
+	// allowing you to adjust its options and attach new routes or middlewares.
+	OnServe() *hook.Hook[*ServeEvent]
+
+	// OnTerminate hook is triggered when the app is in the process
+	// of being terminated (ex. on SIGTERM signal).
+	//
+	// Note that the app could be terminated abruptly without awaiting the hook completion.
+	OnTerminate() *hook.Hook[*TerminateEvent]
+
+	// OnBackupCreate hook is triggered on each [App.CreateBackup] call.
+	OnBackupCreate() *hook.Hook[*BackupEvent]
+
+	// OnBackupRestore hook is triggered before app backup restore (aka. [App.RestoreBackup] call).
+	//
+	// Note that by default on success the application is restarted and the after state of the hook is ignored.
+	OnBackupRestore() *hook.Hook[*BackupEvent]
+
+	// ---------------------------------------------------------------
+	// DB models event hooks
+	// ---------------------------------------------------------------
+
+	// OnModelValidate is triggered every time when a model is being validated
+	// (e.g. triggered by App.Validate() or App.Save()).
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelValidate(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnModelCreate is triggered every time when a new model is being created
+	// (e.g. triggered by App.Save()).
+	//
+	// Operations BEFORE the e.Next() execute before the model validation
+	// and the INSERT DB statement.
+	//
+	// Operations AFTER the e.Next() execute after the model validation
+	// and the INSERT DB statement.
+	//
+	// Note that successful execution doesn't guarantee that the model
+	// is persisted in the database since its wrapping transaction may
+	// not have been committed yet.
+	// If you want to listen to only the actual persisted events, you can
+	// bind to [OnModelAfterCreateSuccess] or [OnModelAfterCreateError] hooks.
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelCreate(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelCreateExecute is triggered after successful Model validation
+	// and right before the model INSERT DB statement execution.
+	//
+	// Usually it is triggered as part of the App.Save() in the following firing order:
+	// OnModelCreate {
+	//    -> OnModelValidate (skipped with App.SaveNoValidate())
+	//    -> OnModelCreateExecute
+	// }
+	//
+	// Note that successful execution doesn't guarantee that the model
+	// is persisted in the database since its wrapping transaction may have been
+	// committed yet.
+	// If you want to listen to only the actual persisted events,
+	// you can bind to [OnModelAfterCreateSuccess] or [OnModelAfterCreateError] hooks.
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelCreateExecute(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelAfterCreateSuccess is triggered after each successful
+	// Model DB create persistence.
+	//
+	// Note that when a Model is persisted as part of a transaction,
+	// this hook is delayed and executed only AFTER the transaction has been committed.
+	// This hook is NOT triggered in case the transaction rollbacks
+	// (aka. when the model wasn't persisted).
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelAfterCreateSuccess(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelAfterCreateError is triggered after each failed
+	// Model DB create persistence.
+	//
+	// Note that the execution of this hook is either immediate or delayed
+	// depending on the error:
+	//   - "immediate" on App.Save() failure
+	//   - "delayed" on transaction rollback
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelAfterCreateError(tags ...string) *hook.TaggedHook[*ModelErrorEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnModelUpdate is triggered every time when a new model is being updated
+	// (e.g. triggered by App.Save()).
+	//
+	// Operations BEFORE the e.Next() execute before the model validation
+	// and the UPDATE DB statement.
+	//
+	// Operations AFTER the e.Next() execute after the model validation
+	// and the UPDATE DB statement.
+	//
+	// Note that successful execution doesn't guarantee that the model
+	// is persisted in the database since its wrapping transaction may
+	// not have been committed yet.
+	// If you want to listen to only the actual persisted events, you can
+	// bind to [OnModelAfterUpdateSuccess] or [OnModelAfterUpdateError] hooks.
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelUpdate(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelUpdateExecute is triggered after successful Model validation
+	// and right before the model UPDATE DB statement execution.
+	//
+	// Usually it is triggered as part of the App.Save() in the following firing order:
+	// OnModelUpdate {
+	//    -> OnModelValidate (skipped with App.SaveNoValidate())
+	//    -> OnModelUpdateExecute
+	// }
+	//
+	// Note that successful execution doesn't guarantee that the model
+	// is persisted in the database since its wrapping transaction may have been
+	// committed yet.
+	// If you want to listen to only the actual persisted events,
+	// you can bind to [OnModelAfterUpdateSuccess] or [OnModelAfterUpdateError] hooks.
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelUpdateExecute(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelAfterUpdateSuccess is triggered after each successful
+	// Model DB update persistence.
+	//
+	// Note that when a Model is persisted as part of a transaction,
+	// this hook is delayed and executed only AFTER the transaction has been committed.
+	// This hook is NOT triggered in case the transaction rollbacks
+	// (aka. when the model changes weren't persisted).
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelAfterUpdateSuccess(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelAfterUpdateError is triggered after each failed
+	// Model DB update persistence.
+	//
+	// Note that the execution of this hook is either immediate or delayed
+	// depending on the error:
+	//   - "immediate" on App.Save() failure
+	//   - "delayed" on transaction rollback
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelAfterUpdateError(tags ...string) *hook.TaggedHook[*ModelErrorEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnModelDelete is triggered every time when a new model is being deleted
+	// (e.g. triggered by App.Delete()).
+	//
+	// Note that successful execution doesn't guarantee that the model
+	// is deleted from the database since its wrapping transaction may
+	// not have been committed yet.
+	// If you want to listen to only the actual persisted deleted events, you can
+	// bind to [OnModelAfterDeleteSuccess] or [OnModelAfterDeleteError] hooks.
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelDelete(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelUpdateExecute is triggered right before the model
+	// DELETE DB statement execution.
+	//
+	// Usually it is triggered as part of the App.Delete() in the following firing order:
+	// OnModelDelete {
+	//    -> (internal delete checks)
+	//    -> OnModelDeleteExecute
+	// }
+	//
+	// Note that successful execution doesn't guarantee that the model
+	// is deleted from the database since its wrapping transaction may
+	// not have been committed yet.
+	// If you want to listen to only the actual persisted deleted events, you can
+	// bind to [OnModelAfterDeleteSuccess] or [OnModelAfterDeleteError] hooks.
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelDeleteExecute(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelAfterDeleteSuccess is triggered after each successful
+	// Model DB delete persistence.
+	//
+	// Note that when a Model is deleted as part of a transaction,
+	// this hook is delayed and executed only AFTER the transaction has been committed.
+	// This hook is NOT triggered in case the transaction rollbacks
+	// (aka. when the model delete wasn't persisted).
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelAfterDeleteSuccess(tags ...string) *hook.TaggedHook[*ModelEvent]
+
+	// OnModelAfterDeleteError is triggered after each failed
+	// Model DB delete persistence.
+	//
+	// Note that the execution of this hook is either immediate or delayed
+	// depending on the error:
+	//   - "immediate" on App.Delete() failure
+	//   - "delayed" on transaction rollback
+	//
+	// For convenience, if you want to listen to only the Record models
+	// events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+	//
+	// If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnModelAfterDeleteError(tags ...string) *hook.TaggedHook[*ModelErrorEvent]
+
+	// ---------------------------------------------------------------
+	// Record models event hooks
+	// ---------------------------------------------------------------
+
+	// OnRecordEnrich is triggered every time when a record is enriched
+	// (as part of the builtin Record responses, during realtime message seriazation, or when [apis.EnrichRecord] is invoked).
+	//
+	// It could be used for example to redact/hide or add computed temporary
+	// Record model props only for the specific request info. For example:
+	//
+	//  app.OnRecordEnrich("posts").BindFunc(func(e core.*RecordEnrichEvent) {
+	//      // hide one or more fields
+	//      e.Record.Hide("role")
+	//
+	//      // add new custom field for registered users
+	//      if e.RequestInfo.Auth != nil && e.RequestInfo.Auth.Collection().Name == "users" {
+	//          e.Record.WithCustomData(true) // for security requires explicitly allowing it
+	//          e.Record.Set("computedScore", e.Record.GetInt("score") * e.RequestInfo.Auth.GetInt("baseScore"))
+	//      }
+	//
+	//      return e.Next()
+	//  })
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordEnrich(tags ...string) *hook.TaggedHook[*RecordEnrichEvent]
+
+	// OnRecordValidate is a Record proxy model hook of [OnModelValidate].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordValidate(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnRecordCreate is a Record proxy model hook of [OnModelCreate].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordCreate(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordCreateExecute is a Record proxy model hook of [OnModelCreateExecute].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordCreateExecute(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordAfterCreateSuccess is a Record proxy model hook of [OnModelAfterCreateSuccess].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterCreateSuccess(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordAfterCreateError is a Record proxy model hook of [OnModelAfterCreateError].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterCreateError(tags ...string) *hook.TaggedHook[*RecordErrorEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnRecordUpdate is a Record proxy model hook of [OnModelUpdate].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordUpdate(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordUpdateExecute is a Record proxy model hook of [OnModelUpdateExecute].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordUpdateExecute(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordAfterUpdateSuccess is a Record proxy model hook of [OnModelAfterUpdateSuccess].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterUpdateSuccess(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordAfterUpdateError is a Record proxy model hook of [OnModelAfterUpdateError].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterUpdateError(tags ...string) *hook.TaggedHook[*RecordErrorEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnRecordDelete is a Record proxy model hook of [OnModelDelete].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordDelete(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordDeleteExecute is a Record proxy model hook of [OnModelDeleteExecute].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordDeleteExecute(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordAfterDeleteSuccess is a Record proxy model hook of [OnModelAfterDeleteSuccess].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterDeleteSuccess(tags ...string) *hook.TaggedHook[*RecordEvent]
+
+	// OnRecordAfterDeleteError is a Record proxy model hook of [OnModelAfterDeleteError].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAfterDeleteError(tags ...string) *hook.TaggedHook[*RecordErrorEvent]
+
+	// ---------------------------------------------------------------
+	// Collection models event hooks
+	// ---------------------------------------------------------------
+
+	// OnCollectionValidate is a Collection proxy model hook of [OnModelValidate].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionValidate(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnCollectionCreate is a Collection proxy model hook of [OnModelCreate].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionCreate(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionCreateExecute is a Collection proxy model hook of [OnModelCreateExecute].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionCreateExecute(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionAfterCreateSuccess is a Collection proxy model hook of [OnModelAfterCreateSuccess].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionAfterCreateSuccess(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionAfterCreateError is a Collection proxy model hook of [OnModelAfterCreateError].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionAfterCreateError(tags ...string) *hook.TaggedHook[*CollectionErrorEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnCollectionUpdate is a Collection proxy model hook of [OnModelUpdate].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionUpdate(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionUpdateExecute is a Collection proxy model hook of [OnModelUpdateExecute].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionUpdateExecute(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionAfterUpdateSuccess is a Collection proxy model hook of [OnModelAfterUpdateSuccess].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionAfterUpdateSuccess(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionAfterUpdateError is a Collection proxy model hook of [OnModelAfterUpdateError].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionAfterUpdateError(tags ...string) *hook.TaggedHook[*CollectionErrorEvent]
+
+	// ---------------------------------------------------------------
+
+	// OnCollectionDelete is a Collection proxy model hook of [OnModelDelete].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionDelete(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionDeleteExecute is a Collection proxy model hook of [OnModelDeleteExecute].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionDeleteExecute(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionAfterDeleteSuccess is a Collection proxy model hook of [OnModelAfterDeleteSuccess].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionAfterDeleteSuccess(tags ...string) *hook.TaggedHook[*CollectionEvent]
+
+	// OnCollectionAfterDeleteError is a Collection proxy model hook of [OnModelAfterDeleteError].
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnCollectionAfterDeleteError(tags ...string) *hook.TaggedHook[*CollectionErrorEvent]
+
+	// ---------------------------------------------------------------
+	// Mailer event hooks
+	// ---------------------------------------------------------------
+
+	// OnMailerSend hook is triggered every time when a new email is
+	// being sent using the [App.NewMailClient()] instance.
+	//
+	// It allows intercepting the email message or to use a custom mailer client.
+	OnMailerSend() *hook.Hook[*MailerEvent]
+
+	// OnMailerRecordAuthAlertSend hook is triggered when
+	// sending a new device login auth alert email, allowing you to
+	// intercept and customize the email message that is being sent.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerRecordAuthAlertSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
+
+	// OnMailerBeforeRecordResetPasswordSend hook is triggered when
+	// sending a password reset email to an auth record, allowing
+	// you to intercept and customize the email message that is being sent.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerRecordPasswordResetSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
+
+	// OnMailerBeforeRecordVerificationSend hook is triggered when
+	// sending a verification email to an auth record, allowing
+	// you to intercept and customize the email message that is being sent.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerRecordVerificationSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
+
+	// OnMailerRecordEmailChangeSend hook is triggered when sending a
+	// confirmation new address email to an auth record, allowing
+	// you to intercept and customize the email message that is being sent.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerRecordEmailChangeSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
+
+	// OnMailerRecordOTPSend hook is triggered when sending an OTP email
+	// to an auth record, allowing you to intercept and customize the
+	// email message that is being sent.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnMailerRecordOTPSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent]
+
+	// ---------------------------------------------------------------
+	// Realtime API event hooks
+	// ---------------------------------------------------------------
+
+	// OnRealtimeConnectRequest hook is triggered when establishing the SSE client connection.
+	//
+	// Any execution after e.Next() of a hook handler happens after the client disconnects.
+	OnRealtimeConnectRequest() *hook.Hook[*RealtimeConnectRequestEvent]
+
+	// OnRealtimeMessageSend hook is triggered when sending an SSE message to a client.
+	OnRealtimeMessageSend() *hook.Hook[*RealtimeMessageEvent]
+
+	// OnRealtimeSubscribeRequest hook is triggered when updating the
+	// client subscriptions, allowing you to further validate and
+	// modify the submitted change.
+	OnRealtimeSubscribeRequest() *hook.Hook[*RealtimeSubscribeRequestEvent]
+
+	// ---------------------------------------------------------------
+	// Settings API event hooks
+	// ---------------------------------------------------------------
+
+	// OnSettingsListRequest hook is triggered on each API Settings list request.
+	//
+	// Could be used to validate or modify the response before returning it to the client.
+	OnSettingsListRequest() *hook.Hook[*SettingsListRequestEvent]
+
+	// OnSettingsUpdateRequest hook is triggered on each API Settings update request.
+	//
+	// Could be used to additionally validate the request data or
+	// implement completely different persistence behavior.
+	OnSettingsUpdateRequest() *hook.Hook[*SettingsUpdateRequestEvent]
+
+	// OnSettingsReload hook is triggered every time when the App.Settings()
+	// is being replaced with a new state.
+	//
+	// Calling App.Settings() after e.Next() returns the new state.
+	OnSettingsReload() *hook.Hook[*SettingsReloadEvent]
+
+	// ---------------------------------------------------------------
+	// File API event hooks
+	// ---------------------------------------------------------------
+
+	// OnFileDownloadRequest hook is triggered before each API File download request.
+	//
+	// Could be used to validate or modify the file response before
+	// returning it to the client.
+	OnFileDownloadRequest(tags ...string) *hook.TaggedHook[*FileDownloadRequestEvent]
+
+	// OnFileBeforeTokenRequest hook is triggered on each auth file token API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnFileTokenRequest(tags ...string) *hook.TaggedHook[*FileTokenRequestEvent]
+
+	// ---------------------------------------------------------------
+	// Record Auth API event hooks
+	// ---------------------------------------------------------------
+
+	// OnRecordAuthRequest hook is triggered on each successful API
+	// record authentication request (sign-in, token refresh, etc.).
+	//
+	// Could be used to additionally validate or modify the authenticated
+	// record data and token.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAuthRequest(tags ...string) *hook.TaggedHook[*RecordAuthRequestEvent]
+
+	// OnRecordAuthWithPasswordRequest hook is triggered on each
+	// Record auth with password API request.
+	//
+	// [RecordAuthWithPasswordRequestEvent.Record] could be nil if no matching identity is found, allowing
+	// you to manually locate a different Record model (by reassigning [RecordAuthWithPasswordRequestEvent.Record]).
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAuthWithPasswordRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithPasswordRequestEvent]
+
+	// OnRecordAuthWithOAuth2Request hook is triggered on each Record
+	// OAuth2 sign-in/sign-up API request (after token exchange and before external provider linking).
+	//
+	// If [RecordAuthWithOAuth2RequestEvent.Record] is not set, then the OAuth2
+	// request will try to create a new auth Record.
+	//
+	// To assign or link a different existing record model you can
+	// change the [RecordAuthWithOAuth2RequestEvent.Record] field.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAuthWithOAuth2Request(tags ...string) *hook.TaggedHook[*RecordAuthWithOAuth2RequestEvent]
+
+	// OnRecordAuthRefreshRequest hook is triggered on each Record
+	// auth refresh API request (right before generating a new auth token).
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different auth refresh behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAuthRefreshRequest(tags ...string) *hook.TaggedHook[*RecordAuthRefreshRequestEvent]
+
+	// OnRecordRequestPasswordResetRequest hook is triggered on
+	// each Record request password reset API request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different password reset behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordRequestPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordRequestPasswordResetRequestEvent]
+
+	// OnRecordConfirmPasswordResetRequest hook is triggered on
+	// each Record confirm password reset API request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordConfirmPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordConfirmPasswordResetRequestEvent]
+
+	// OnRecordRequestVerificationRequest hook is triggered on
+	// each Record request verification API request.
+	//
+	// Could be used to additionally validate the loaded request data or implement
+	// completely different verification behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordRequestVerificationRequest(tags ...string) *hook.TaggedHook[*RecordRequestVerificationRequestEvent]
+
+	// OnRecordConfirmVerificationRequest hook is triggered on each
+	// Record confirm verification API request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordConfirmVerificationRequest(tags ...string) *hook.TaggedHook[*RecordConfirmVerificationRequestEvent]
+
+	// OnRecordRequestEmailChangeRequest hook is triggered on each
+	// Record request email change API request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different request email change behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordRequestEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordRequestEmailChangeRequestEvent]
+
+	// OnRecordConfirmEmailChangeRequest hook is triggered on each
+	// Record confirm email change API request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordConfirmEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordConfirmEmailChangeRequestEvent]
+
+	// OnRecordRequestOTPRequest hook is triggered on each Record
+	// request OTP API request.
+	//
+	// [RecordCreateOTPRequestEvent.Record] could be nil if no matching identity is found, allowing
+	// you to manually create or locate a different Record model (by reassigning [RecordCreateOTPRequestEvent.Record]).
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordRequestOTPRequest(tags ...string) *hook.TaggedHook[*RecordCreateOTPRequestEvent]
+
+	// OnRecordAuthWithOTPRequest hook is triggered on each Record
+	// auth with OTP API request.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordAuthWithOTPRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithOTPRequestEvent]
+
+	// ---------------------------------------------------------------
+	// Record CRUD API event hooks
+	// ---------------------------------------------------------------
+
+	// OnRecordsListRequest hook is triggered on each API Records list request.
+	//
+	// Could be used to validate or modify the response before returning it to the client.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordsListRequest(tags ...string) *hook.TaggedHook[*RecordsListRequestEvent]
+
+	// OnRecordViewRequest hook is triggered on each API Record view request.
+	//
+	// Could be used to validate or modify the response before returning it to the client.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordViewRequest(tags ...string) *hook.TaggedHook[*RecordRequestEvent]
+
+	// OnRecordCreateRequest hook is triggered on each API Record create request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordCreateRequest(tags ...string) *hook.TaggedHook[*RecordRequestEvent]
+
+	// OnRecordUpdateRequest hook is triggered on each API Record update request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordUpdateRequest(tags ...string) *hook.TaggedHook[*RecordRequestEvent]
+
+	// OnRecordDeleteRequest hook is triggered on each API Record delete request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different delete behavior.
+	//
+	// If the optional "tags" list (Collection ids or names) is specified,
+	// then all event handlers registered via the created hook will be
+	// triggered and called only if their event data origin matches the tags.
+	OnRecordDeleteRequest(tags ...string) *hook.TaggedHook[*RecordRequestEvent]
+
+	// ---------------------------------------------------------------
+	// Collection API event hooks
+	// ---------------------------------------------------------------
+
+	// OnCollectionsListRequest hook is triggered on each API Collections list request.
+	//
+	// Could be used to validate or modify the response before returning it to the client.
+	OnCollectionsListRequest() *hook.Hook[*CollectionsListRequestEvent]
+
+	// OnCollectionViewRequest hook is triggered on each API Collection view request.
+	//
+	// Could be used to validate or modify the response before returning it to the client.
+	OnCollectionViewRequest() *hook.Hook[*CollectionRequestEvent]
+
+	// OnCollectionCreateRequest hook is triggered on each API Collection create request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	OnCollectionCreateRequest() *hook.Hook[*CollectionRequestEvent]
+
+	// OnCollectionUpdateRequest hook is triggered on each API Collection update request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different persistence behavior.
+	OnCollectionUpdateRequest() *hook.Hook[*CollectionRequestEvent]
+
+	// OnCollectionDeleteRequest hook is triggered on each API Collection delete request.
+	//
+	// Could be used to additionally validate the request data or implement
+	// completely different delete behavior.
+	OnCollectionDeleteRequest() *hook.Hook[*CollectionRequestEvent]
+
+	// OnCollectionsBeforeImportRequest hook is triggered on each API
+	// collections import request.
+	//
+	// Could be used to additionally validate the imported collections or
+	// to implement completely different import behavior.
+	OnCollectionsImportRequest() *hook.Hook[*CollectionsImportRequestEvent]
+
+	// ---------------------------------------------------------------
+	// Batch API event hooks
+	// ---------------------------------------------------------------
+
+	// OnBatchRequest hook is triggered on each API batch request.
+	//
+	// Could be used to additionally validate or modify the submitted batch requests.
+	OnBatchRequest() *hook.Hook[*BatchRequestEvent]
+}
diff --git a/server/core_backend-server/core/auth_origin_model.go b/server/core_backend-server/core/auth_origin_model.go
new file mode 100644
index 0000000..103ae93
--- /dev/null
+++ b/server/core_backend-server/core/auth_origin_model.go
@@ -0,0 +1,239 @@
+package core
+
+import (
+	"context"
+	"errors"
+	"slices"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+const CollectionNameAuthOrigins = "_authOrigins"
+
+var (
+	_ Model        = (*AuthOrigin)(nil)
+	_ PreValidator = (*AuthOrigin)(nil)
+	_ RecordProxy  = (*AuthOrigin)(nil)
+)
+
+// AuthOrigin defines a Record proxy for working with the authOrigins collection.
+type AuthOrigin struct {
+	*Record
+}
+
+// NewAuthOrigin instantiates and returns a new blank *AuthOrigin model.
+//
+// Example usage:
+//
+//	origin := core.NewOrigin(app)
+//	origin.SetRecordRef(user.Id)
+//	origin.SetCollectionRef(user.Collection().Id)
+//	origin.SetFingerprint("...")
+//	app.Save(origin)
+func NewAuthOrigin(app App) *AuthOrigin {
+	m := &AuthOrigin{}
+
+	c, err := app.FindCachedCollectionByNameOrId(CollectionNameAuthOrigins)
+	if err != nil {
+		// this is just to make tests easier since authOrigins is a system collection and it is expected to be always accessible
+		// (note: the loaded record is further checked on AuthOrigin.PreValidate())
+		c = NewBaseCollection("@___invalid___")
+	}
+
+	m.Record = NewRecord(c)
+
+	return m
+}
+
+// PreValidate implements the [PreValidator] interface and checks
+// whether the proxy is properly loaded.
+func (m *AuthOrigin) PreValidate(ctx context.Context, app App) error {
+	if m.Record == nil || m.Record.Collection().Name != CollectionNameAuthOrigins {
+		return errors.New("missing or invalid AuthOrigin ProxyRecord")
+	}
+
+	return nil
+}
+
+// ProxyRecord returns the proxied Record model.
+func (m *AuthOrigin) ProxyRecord() *Record {
+	return m.Record
+}
+
+// SetProxyRecord loads the specified record model into the current proxy.
+func (m *AuthOrigin) SetProxyRecord(record *Record) {
+	m.Record = record
+}
+
+// CollectionRef returns the "collectionRef" field value.
+func (m *AuthOrigin) CollectionRef() string {
+	return m.GetString("collectionRef")
+}
+
+// SetCollectionRef updates the "collectionRef" record field value.
+func (m *AuthOrigin) SetCollectionRef(collectionId string) {
+	m.Set("collectionRef", collectionId)
+}
+
+// RecordRef returns the "recordRef" record field value.
+func (m *AuthOrigin) RecordRef() string {
+	return m.GetString("recordRef")
+}
+
+// SetRecordRef updates the "recordRef" record field value.
+func (m *AuthOrigin) SetRecordRef(recordId string) {
+	m.Set("recordRef", recordId)
+}
+
+// Fingerprint returns the "fingerprint" record field value.
+func (m *AuthOrigin) Fingerprint() string {
+	return m.GetString("fingerprint")
+}
+
+// SetFingerprint updates the "fingerprint" record field value.
+func (m *AuthOrigin) SetFingerprint(fingerprint string) {
+	m.Set("fingerprint", fingerprint)
+}
+
+// Created returns the "created" record field value.
+func (m *AuthOrigin) Created() types.DateTime {
+	return m.GetDateTime("created")
+}
+
+// Updated returns the "updated" record field value.
+func (m *AuthOrigin) Updated() types.DateTime {
+	return m.GetDateTime("updated")
+}
+
+func (app *BaseApp) registerAuthOriginHooks() {
+	recordRefHooks[*AuthOrigin](app, CollectionNameAuthOrigins, CollectionTypeAuth)
+
+	// delete existing auth origins on password change
+	app.OnRecordUpdate().Bind(&hook.Handler[*RecordEvent]{
+		Func: func(e *RecordEvent) error {
+			err := e.Next()
+			if err != nil || !e.Record.Collection().IsAuth() {
+				return err
+			}
+
+			old := e.Record.Original().GetString(FieldNamePassword + ":hash")
+			new := e.Record.GetString(FieldNamePassword + ":hash")
+			if old != new {
+				err = e.App.DeleteAllAuthOriginsByRecord(e.Record)
+				if err != nil {
+					e.App.Logger().Warn(
+						"Failed to delete all previous auth origin fingerprints",
+						"error", err,
+						"recordId", e.Record.Id,
+						"collectionId", e.Record.Collection().Id,
+					)
+				}
+			}
+
+			return nil
+		},
+		Priority: 99,
+	})
+}
+
+// -------------------------------------------------------------------
+
+// recordRefHooks registers common hooks that are usually used with record proxies
+// that have polymorphic record relations (aka. "collectionRef" and "recordRef" fields).
+func recordRefHooks[T RecordProxy](app App, collectionName string, optCollectionTypes ...string) {
+	app.OnRecordValidate(collectionName).Bind(&hook.Handler[*RecordEvent]{
+		Func: func(e *RecordEvent) error {
+			collectionId := e.Record.GetString("collectionRef")
+			err := validation.Validate(collectionId, validation.Required, validation.By(validateCollectionId(e.App, optCollectionTypes...)))
+			if err != nil {
+				return validation.Errors{"collectionRef": err}
+			}
+
+			recordId := e.Record.GetString("recordRef")
+			err = validation.Validate(recordId, validation.Required, validation.By(validateRecordId(e.App, collectionId)))
+			if err != nil {
+				return validation.Errors{"recordRef": err}
+			}
+
+			return e.Next()
+		},
+		Priority: 99,
+	})
+
+	// delete on collection ref delete
+	app.OnCollectionDeleteExecute().Bind(&hook.Handler[*CollectionEvent]{
+		Func: func(e *CollectionEvent) error {
+			if e.Collection.Name == collectionName || (len(optCollectionTypes) > 0 && !slices.Contains(optCollectionTypes, e.Collection.Type)) {
+				return e.Next()
+			}
+
+			originalApp := e.App
+			txErr := e.App.RunInTransaction(func(txApp App) error {
+				e.App = txApp
+
+				if err := e.Next(); err != nil {
+					return err
+				}
+
+				rels, err := txApp.FindAllRecords(collectionName, dbx.HashExp{"collectionRef": e.Collection.Id})
+				if err != nil {
+					return err
+				}
+
+				for _, mfa := range rels {
+					if err := txApp.Delete(mfa); err != nil {
+						return err
+					}
+				}
+
+				return nil
+			})
+			e.App = originalApp
+
+			return txErr
+		},
+		Priority: 99,
+	})
+
+	// delete on record ref delete
+	app.OnRecordDeleteExecute().Bind(&hook.Handler[*RecordEvent]{
+		Func: func(e *RecordEvent) error {
+			if e.Record.Collection().Name == collectionName ||
+				(len(optCollectionTypes) > 0 && !slices.Contains(optCollectionTypes, e.Record.Collection().Type)) {
+				return e.Next()
+			}
+
+			originalApp := e.App
+			txErr := e.App.RunInTransaction(func(txApp App) error {
+				e.App = txApp
+
+				if err := e.Next(); err != nil {
+					return err
+				}
+
+				rels, err := txApp.FindAllRecords(collectionName, dbx.HashExp{
+					"collectionRef": e.Record.Collection().Id,
+					"recordRef":     e.Record.Id,
+				})
+				if err != nil {
+					return err
+				}
+
+				for _, rel := range rels {
+					if err := txApp.Delete(rel); err != nil {
+						return err
+					}
+				}
+
+				return nil
+			})
+			e.App = originalApp
+
+			return txErr
+		},
+		Priority: 99,
+	})
+}
diff --git a/server/core_backend-server/core/auth_origin_model_test.go b/server/core_backend-server/core/auth_origin_model_test.go
new file mode 100644
index 0000000..2d06a2d
--- /dev/null
+++ b/server/core_backend-server/core/auth_origin_model_test.go
@@ -0,0 +1,332 @@
+package core_test
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestNewAuthOrigin(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	origin := core.NewAuthOrigin(app)
+
+	if origin.Collection().Name != core.CollectionNameAuthOrigins {
+		t.Fatalf("Expected record with %q collection, got %q", core.CollectionNameAuthOrigins, origin.Collection().Name)
+	}
+}
+
+func TestAuthOriginProxyRecord(t *testing.T) {
+	t.Parallel()
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+	record.Id = "test_id"
+
+	origin := core.AuthOrigin{}
+	origin.SetProxyRecord(record)
+
+	if origin.ProxyRecord() == nil || origin.ProxyRecord().Id != record.Id {
+		t.Fatalf("Expected proxy record with id %q, got %v", record.Id, origin.ProxyRecord())
+	}
+}
+
+func TestAuthOriginRecordRef(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	origin := core.NewAuthOrigin(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			origin.SetRecordRef(testValue)
+
+			if v := origin.RecordRef(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := origin.GetString("recordRef"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestAuthOriginCollectionRef(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	origin := core.NewAuthOrigin(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			origin.SetCollectionRef(testValue)
+
+			if v := origin.CollectionRef(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := origin.GetString("collectionRef"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestAuthOriginFingerprint(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	origin := core.NewAuthOrigin(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			origin.SetFingerprint(testValue)
+
+			if v := origin.Fingerprint(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := origin.GetString("fingerprint"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestAuthOriginCreated(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	origin := core.NewAuthOrigin(app)
+
+	if v := origin.Created().String(); v != "" {
+		t.Fatalf("Expected empty created, got %q", v)
+	}
+
+	now := types.NowDateTime()
+	origin.SetRaw("created", now)
+
+	if v := origin.Created().String(); v != now.String() {
+		t.Fatalf("Expected %q created, got %q", now.String(), v)
+	}
+}
+
+func TestAuthOriginUpdated(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	origin := core.NewAuthOrigin(app)
+
+	if v := origin.Updated().String(); v != "" {
+		t.Fatalf("Expected empty updated, got %q", v)
+	}
+
+	now := types.NowDateTime()
+	origin.SetRaw("updated", now)
+
+	if v := origin.Updated().String(); v != now.String() {
+		t.Fatalf("Expected %q updated, got %q", now.String(), v)
+	}
+}
+
+func TestAuthOriginPreValidate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	originsCol, err := app.FindCollectionByNameOrId(core.CollectionNameAuthOrigins)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("no proxy record", func(t *testing.T) {
+		origin := &core.AuthOrigin{}
+
+		if err := app.Validate(origin); err == nil {
+			t.Fatal("Expected collection validation error")
+		}
+	})
+
+	t.Run("non-AuthOrigin collection", func(t *testing.T) {
+		origin := &core.AuthOrigin{}
+		origin.SetProxyRecord(core.NewRecord(core.NewBaseCollection("invalid")))
+		origin.SetRecordRef(user.Id)
+		origin.SetCollectionRef(user.Collection().Id)
+		origin.SetFingerprint("abc")
+
+		if err := app.Validate(origin); err == nil {
+			t.Fatal("Expected collection validation error")
+		}
+	})
+
+	t.Run("AuthOrigin collection", func(t *testing.T) {
+		origin := &core.AuthOrigin{}
+		origin.SetProxyRecord(core.NewRecord(originsCol))
+		origin.SetRecordRef(user.Id)
+		origin.SetCollectionRef(user.Collection().Id)
+		origin.SetFingerprint("abc")
+
+		if err := app.Validate(origin); err != nil {
+			t.Fatalf("Expected nil validation error, got %v", err)
+		}
+	})
+}
+
+func TestAuthOriginValidateHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name         string
+		origin       func() *core.AuthOrigin
+		expectErrors []string
+	}{
+		{
+			"empty",
+			func() *core.AuthOrigin {
+				return core.NewAuthOrigin(app)
+			},
+			[]string{"collectionRef", "recordRef", "fingerprint"},
+		},
+		{
+			"non-auth collection",
+			func() *core.AuthOrigin {
+				origin := core.NewAuthOrigin(app)
+				origin.SetCollectionRef(demo1.Collection().Id)
+				origin.SetRecordRef(demo1.Id)
+				origin.SetFingerprint("abc")
+				return origin
+			},
+			[]string{"collectionRef"},
+		},
+		{
+			"missing record id",
+			func() *core.AuthOrigin {
+				origin := core.NewAuthOrigin(app)
+				origin.SetCollectionRef(user.Collection().Id)
+				origin.SetRecordRef("missing")
+				origin.SetFingerprint("abc")
+				return origin
+			},
+			[]string{"recordRef"},
+		},
+		{
+			"valid ref",
+			func() *core.AuthOrigin {
+				origin := core.NewAuthOrigin(app)
+				origin.SetCollectionRef(user.Collection().Id)
+				origin.SetRecordRef(user.Id)
+				origin.SetFingerprint("abc")
+				return origin
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := app.Validate(s.origin())
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestAuthOriginPasswordChangeDeletion(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	// no auth origin associated with it
+	user1, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser2, err := testApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client1, err := testApp.FindAuthRecordByEmail("clients", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record     *core.Record
+		deletedIds []string
+	}{
+		{user1, nil},
+		{superuser2, []string{"5798yh833k6w6w0", "ic55o70g4f8pcl4", "dmy260k6ksjr4ib"}},
+		{client1, []string{"9r2j0m74260ur8i"}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.record.Collection().Name, s.record.Id), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			deletedIds := []string{}
+			app.OnRecordDelete().BindFunc(func(e *core.RecordEvent) error {
+				deletedIds = append(deletedIds, e.Record.Id)
+				return e.Next()
+			})
+
+			s.record.SetPassword("new_password")
+
+			err := app.Save(s.record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(deletedIds) != len(s.deletedIds) {
+				t.Fatalf("Expected deleted ids\n%v\ngot\n%v", s.deletedIds, deletedIds)
+			}
+
+			for _, id := range s.deletedIds {
+				if !slices.Contains(deletedIds, id) {
+					t.Errorf("Expected to find deleted id %q in %v", id, deletedIds)
+				}
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/auth_origin_query.go b/server/core_backend-server/core/auth_origin_query.go
new file mode 100644
index 0000000..c8fd20d
--- /dev/null
+++ b/server/core_backend-server/core/auth_origin_query.go
@@ -0,0 +1,101 @@
+package core
+
+import (
+	"errors"
+
+	"github.com/pocketbase/dbx"
+)
+
+// FindAllAuthOriginsByRecord returns all AuthOrigin models linked to the provided auth record (in DESC order).
+func (app *BaseApp) FindAllAuthOriginsByRecord(authRecord *Record) ([]*AuthOrigin, error) {
+	result := []*AuthOrigin{}
+
+	err := app.RecordQuery(CollectionNameAuthOrigins).
+		AndWhere(dbx.HashExp{
+			"collectionRef": authRecord.Collection().Id,
+			"recordRef":     authRecord.Id,
+		}).
+		OrderBy("created DESC").
+		All(&result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// FindAllAuthOriginsByCollection returns all AuthOrigin models linked to the provided collection (in DESC order).
+func (app *BaseApp) FindAllAuthOriginsByCollection(collection *Collection) ([]*AuthOrigin, error) {
+	result := []*AuthOrigin{}
+
+	err := app.RecordQuery(CollectionNameAuthOrigins).
+		AndWhere(dbx.HashExp{"collectionRef": collection.Id}).
+		OrderBy("created DESC").
+		All(&result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// FindAuthOriginById returns a single AuthOrigin model by its id.
+func (app *BaseApp) FindAuthOriginById(id string) (*AuthOrigin, error) {
+	result := &AuthOrigin{}
+
+	err := app.RecordQuery(CollectionNameAuthOrigins).
+		AndWhere(dbx.HashExp{"id": id}).
+		Limit(1).
+		One(result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// FindAuthOriginByRecordAndFingerprint returns a single AuthOrigin model
+// by its authRecord relation and fingerprint.
+func (app *BaseApp) FindAuthOriginByRecordAndFingerprint(authRecord *Record, fingerprint string) (*AuthOrigin, error) {
+	result := &AuthOrigin{}
+
+	err := app.RecordQuery(CollectionNameAuthOrigins).
+		AndWhere(dbx.HashExp{
+			"collectionRef": authRecord.Collection().Id,
+			"recordRef":     authRecord.Id,
+			"fingerprint":   fingerprint,
+		}).
+		Limit(1).
+		One(result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// DeleteAllAuthOriginsByRecord deletes all AuthOrigin models associated with the provided record.
+//
+// Returns a combined error with the failed deletes.
+func (app *BaseApp) DeleteAllAuthOriginsByRecord(authRecord *Record) error {
+	models, err := app.FindAllAuthOriginsByRecord(authRecord)
+	if err != nil {
+		return err
+	}
+
+	var errs []error
+	for _, m := range models {
+		if err := app.Delete(m); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	if len(errs) > 0 {
+		return errors.Join(errs...)
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/core/auth_origin_query_test.go b/server/core_backend-server/core/auth_origin_query_test.go
new file mode 100644
index 0000000..eec036a
--- /dev/null
+++ b/server/core_backend-server/core/auth_origin_query_test.go
@@ -0,0 +1,268 @@
+package core_test
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestFindAllAuthOriginsByRecord(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser2, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser4, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test4@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client1, err := app.FindAuthRecordByEmail("clients", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record   *core.Record
+		expected []string
+	}{
+		{demo1, nil},
+		{superuser2, []string{"5798yh833k6w6w0", "ic55o70g4f8pcl4", "dmy260k6ksjr4ib"}},
+		{superuser4, nil},
+		{client1, []string{"9r2j0m74260ur8i"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.record.Collection().Name+"_"+s.record.Id, func(t *testing.T) {
+			result, err := app.FindAllAuthOriginsByRecord(s.record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected total origins %d, got %d", len(s.expected), len(result))
+			}
+
+			for i, id := range s.expected {
+				if result[i].Id != id {
+					t.Errorf("[%d] Expected id %q, got %q", i, id, result[i].Id)
+				}
+			}
+		})
+	}
+}
+
+func TestFindAllAuthOriginsByCollection(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superusers, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	clients, err := app.FindCollectionByNameOrId("clients")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		collection *core.Collection
+		expected   []string
+	}{
+		{demo1, nil},
+		{superusers, []string{"5798yh833k6w6w0", "ic55o70g4f8pcl4", "dmy260k6ksjr4ib", "5f29jy38bf5zm3f"}},
+		{clients, []string{"9r2j0m74260ur8i"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.collection.Name, func(t *testing.T) {
+			result, err := app.FindAllAuthOriginsByCollection(s.collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected total origins %d, got %d", len(s.expected), len(result))
+			}
+
+			for i, id := range s.expected {
+				if result[i].Id != id {
+					t.Errorf("[%d] Expected id %q, got %q", i, id, result[i].Id)
+				}
+			}
+		})
+	}
+}
+
+func TestFindAuthOriginById(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		id          string
+		expectError bool
+	}{
+		{"", true},
+		{"84nmscqy84lsi1t", true}, // non-origin id
+		{"9r2j0m74260ur8i", false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.id, func(t *testing.T) {
+			result, err := app.FindAuthOriginById(s.id)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if result.Id != s.id {
+				t.Fatalf("Expected record with id %q, got %q", s.id, result.Id)
+			}
+		})
+	}
+}
+
+func TestFindAuthOriginByRecordAndFingerprint(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser2, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record      *core.Record
+		fingerprint string
+		expectError bool
+	}{
+		{demo1, "6afbfe481c31c08c55a746cccb88ece0", true},
+		{superuser2, "", true},
+		{superuser2, "abc", true},
+		{superuser2, "22bbbcbed36e25321f384ccf99f60057", false}, // fingerprint from different origin
+		{superuser2, "6afbfe481c31c08c55a746cccb88ece0", false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.record.Id, s.fingerprint), func(t *testing.T) {
+			result, err := app.FindAuthOriginByRecordAndFingerprint(s.record, s.fingerprint)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if result.Fingerprint() != s.fingerprint {
+				t.Fatalf("Expected origin with fingerprint %q, got %q", s.fingerprint, result.Fingerprint())
+			}
+
+			if result.RecordRef() != s.record.Id || result.CollectionRef() != s.record.Collection().Id {
+				t.Fatalf("Expected record %q (%q), got %q (%q)", s.record.Id, s.record.Collection().Id, result.RecordRef(), result.CollectionRef())
+			}
+		})
+	}
+}
+
+func TestDeleteAllAuthOriginsByRecord(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	demo1, err := testApp.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser2, err := testApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser4, err := testApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test4@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client1, err := testApp.FindAuthRecordByEmail("clients", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record     *core.Record
+		deletedIds []string
+	}{
+		{demo1, nil}, // non-auth record
+		{superuser2, []string{"5798yh833k6w6w0", "ic55o70g4f8pcl4", "dmy260k6ksjr4ib"}},
+		{superuser4, nil},
+		{client1, []string{"9r2j0m74260ur8i"}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.record.Collection().Name, s.record.Id), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			deletedIds := []string{}
+			app.OnRecordDelete().BindFunc(func(e *core.RecordEvent) error {
+				deletedIds = append(deletedIds, e.Record.Id)
+				return e.Next()
+			})
+
+			err := app.DeleteAllAuthOriginsByRecord(s.record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(deletedIds) != len(s.deletedIds) {
+				t.Fatalf("Expected deleted ids\n%v\ngot\n%v", s.deletedIds, deletedIds)
+			}
+
+			for _, id := range s.deletedIds {
+				if !slices.Contains(deletedIds, id) {
+					t.Errorf("Expected to find deleted id %q in %v", id, deletedIds)
+				}
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/base.go b/server/core_backend-server/core/base.go
new file mode 100644
index 0000000..6f77fb5
--- /dev/null
+++ b/server/core_backend-server/core/base.go
@@ -0,0 +1,1641 @@
+package core
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"log"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/cron"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/logger"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+	"golang.org/x/sync/semaphore"
+)
+
+const (
+	/* SQLite:
+	DefaultDataMaxOpenConns int           = 120
+	*/
+	// PostgreSQL:
+	// Note: the default server side max connections limit in PostgreSQL is 100.
+	// Now: 20 Aux connections + 70 Data connections = 90 total connections.
+	// Leave some room for other connections (ex. pgAdmin, etc.).
+	DefaultDataMaxOpenConns int           = 70
+	DefaultDataMaxIdleConns int           = 15
+	DefaultAuxMaxOpenConns  int           = 20
+	DefaultAuxMaxIdleConns  int           = 3
+	DefaultQueryTimeout     time.Duration = 30 * time.Second
+
+	LocalStorageDirName       string = "storage"
+	LocalBackupsDirName       string = "backups"
+	LocalTempDirName          string = ".pb_temp_to_delete" // temp pb_data sub directory that will be deleted on each app.Bootstrap()
+	LocalAutocertCacheDirName string = ".autocert_cache"
+
+	// @todo consider removing after backups refactoring
+	lostFoundDirName string = "lost+found"
+)
+
+// FilesManager defines an interface with common methods that files manager models should implement.
+type FilesManager interface {
+	// BaseFilesPath returns the storage dir path used by the interface instance.
+	BaseFilesPath() string
+}
+
+// DBConnectFunc defines a database connection initialization function.
+type DBConnectFunc func(dbPath string) (*dbx.DB, error)
+
+// BaseAppConfig defines a BaseApp configuration option
+type BaseAppConfig struct {
+	DBConnect        DBConnectFunc
+	DataDir          string
+	EncryptionEnv    string
+	QueryTimeout     time.Duration
+	DataMaxOpenConns int
+	DataMaxIdleConns int
+	AuxMaxOpenConns  int
+	AuxMaxIdleConns  int
+	PostgresURL      string // eg: "postgres://user:pass@localhost:6432?sslmode=disable"
+	PostgresDataDB   string // eg: "pb-data"
+	PostgresAuxDB    string // eg: "pb-auxiliary"
+	IsRealtimeBridge bool
+	IsDev            bool
+}
+
+// ensures that the BaseApp implements the App interface.
+var _ App = (*BaseApp)(nil)
+
+// BaseApp implements core.App and defines the base PocketBase app structure.
+type BaseApp struct {
+	config              *BaseAppConfig
+	txInfo              *TxAppInfo
+	store               *store.Store[string, any]
+	cron                *cron.Cron
+	settings            *Settings
+	subscriptionsBroker *subscriptions.Broker
+	logger              *slog.Logger
+	concurrentDB        dbx.Builder
+	nonconcurrentDB     dbx.Builder
+	auxConcurrentDB     dbx.Builder
+	auxNonconcurrentDB  dbx.Builder
+	driverName          string
+
+	// app event hooks
+	onBootstrap     *hook.Hook[*BootstrapEvent]
+	onServe         *hook.Hook[*ServeEvent]
+	onTerminate     *hook.Hook[*TerminateEvent]
+	onBackupCreate  *hook.Hook[*BackupEvent]
+	onBackupRestore *hook.Hook[*BackupEvent]
+
+	// db model hooks
+	onModelValidate           *hook.Hook[*ModelEvent]
+	onModelCreate             *hook.Hook[*ModelEvent]
+	onModelCreateExecute      *hook.Hook[*ModelEvent]
+	onModelAfterCreateSuccess *hook.Hook[*ModelEvent]
+	onModelAfterCreateError   *hook.Hook[*ModelErrorEvent]
+	onModelUpdate             *hook.Hook[*ModelEvent]
+	onModelUpdateWrite        *hook.Hook[*ModelEvent]
+	onModelAfterUpdateSuccess *hook.Hook[*ModelEvent]
+	onModelAfterUpdateError   *hook.Hook[*ModelErrorEvent]
+	onModelDelete             *hook.Hook[*ModelEvent]
+	onModelDeleteExecute      *hook.Hook[*ModelEvent]
+	onModelAfterDeleteSuccess *hook.Hook[*ModelEvent]
+	onModelAfterDeleteError   *hook.Hook[*ModelErrorEvent]
+
+	// db record hooks
+	onRecordEnrich             *hook.Hook[*RecordEnrichEvent]
+	onRecordValidate           *hook.Hook[*RecordEvent]
+	onRecordCreate             *hook.Hook[*RecordEvent]
+	onRecordCreateExecute      *hook.Hook[*RecordEvent]
+	onRecordAfterCreateSuccess *hook.Hook[*RecordEvent]
+	onRecordAfterCreateError   *hook.Hook[*RecordErrorEvent]
+	onRecordUpdate             *hook.Hook[*RecordEvent]
+	onRecordUpdateExecute      *hook.Hook[*RecordEvent]
+	onRecordAfterUpdateSuccess *hook.Hook[*RecordEvent]
+	onRecordAfterUpdateError   *hook.Hook[*RecordErrorEvent]
+	onRecordDelete             *hook.Hook[*RecordEvent]
+	onRecordDeleteExecute      *hook.Hook[*RecordEvent]
+	onRecordAfterDeleteSuccess *hook.Hook[*RecordEvent]
+	onRecordAfterDeleteError   *hook.Hook[*RecordErrorEvent]
+
+	// db collection hooks
+	onCollectionValidate           *hook.Hook[*CollectionEvent]
+	onCollectionCreate             *hook.Hook[*CollectionEvent]
+	onCollectionCreateExecute      *hook.Hook[*CollectionEvent]
+	onCollectionAfterCreateSuccess *hook.Hook[*CollectionEvent]
+	onCollectionAfterCreateError   *hook.Hook[*CollectionErrorEvent]
+	onCollectionUpdate             *hook.Hook[*CollectionEvent]
+	onCollectionUpdateExecute      *hook.Hook[*CollectionEvent]
+	onCollectionAfterUpdateSuccess *hook.Hook[*CollectionEvent]
+	onCollectionAfterUpdateError   *hook.Hook[*CollectionErrorEvent]
+	onCollectionDelete             *hook.Hook[*CollectionEvent]
+	onCollectionDeleteExecute      *hook.Hook[*CollectionEvent]
+	onCollectionAfterDeleteSuccess *hook.Hook[*CollectionEvent]
+	onCollectionAfterDeleteError   *hook.Hook[*CollectionErrorEvent]
+
+	// mailer event hooks
+	onMailerSend                    *hook.Hook[*MailerEvent]
+	onMailerRecordPasswordResetSend *hook.Hook[*MailerRecordEvent]
+	onMailerRecordVerificationSend  *hook.Hook[*MailerRecordEvent]
+	onMailerRecordEmailChangeSend   *hook.Hook[*MailerRecordEvent]
+	onMailerRecordOTPSend           *hook.Hook[*MailerRecordEvent]
+	onMailerRecordAuthAlertSend     *hook.Hook[*MailerRecordEvent]
+
+	// realtime api event hooks
+	onRealtimeConnectRequest   *hook.Hook[*RealtimeConnectRequestEvent]
+	onRealtimeMessageSend      *hook.Hook[*RealtimeMessageEvent]
+	onRealtimeSubscribeRequest *hook.Hook[*RealtimeSubscribeRequestEvent]
+
+	// settings event hooks
+	onSettingsListRequest   *hook.Hook[*SettingsListRequestEvent]
+	onSettingsUpdateRequest *hook.Hook[*SettingsUpdateRequestEvent]
+	onSettingsReload        *hook.Hook[*SettingsReloadEvent]
+
+	// file api event hooks
+	onFileDownloadRequest *hook.Hook[*FileDownloadRequestEvent]
+	onFileTokenRequest    *hook.Hook[*FileTokenRequestEvent]
+
+	// record auth API event hooks
+	onRecordAuthRequest                 *hook.Hook[*RecordAuthRequestEvent]
+	onRecordAuthWithPasswordRequest     *hook.Hook[*RecordAuthWithPasswordRequestEvent]
+	onRecordAuthWithOAuth2Request       *hook.Hook[*RecordAuthWithOAuth2RequestEvent]
+	onRecordAuthRefreshRequest          *hook.Hook[*RecordAuthRefreshRequestEvent]
+	onRecordRequestPasswordResetRequest *hook.Hook[*RecordRequestPasswordResetRequestEvent]
+	onRecordConfirmPasswordResetRequest *hook.Hook[*RecordConfirmPasswordResetRequestEvent]
+	onRecordRequestVerificationRequest  *hook.Hook[*RecordRequestVerificationRequestEvent]
+	onRecordConfirmVerificationRequest  *hook.Hook[*RecordConfirmVerificationRequestEvent]
+	onRecordRequestEmailChangeRequest   *hook.Hook[*RecordRequestEmailChangeRequestEvent]
+	onRecordConfirmEmailChangeRequest   *hook.Hook[*RecordConfirmEmailChangeRequestEvent]
+	onRecordRequestOTPRequest           *hook.Hook[*RecordCreateOTPRequestEvent]
+	onRecordAuthWithOTPRequest          *hook.Hook[*RecordAuthWithOTPRequestEvent]
+
+	// record crud API event hooks
+	onRecordsListRequest  *hook.Hook[*RecordsListRequestEvent]
+	onRecordViewRequest   *hook.Hook[*RecordRequestEvent]
+	onRecordCreateRequest *hook.Hook[*RecordRequestEvent]
+	onRecordUpdateRequest *hook.Hook[*RecordRequestEvent]
+	onRecordDeleteRequest *hook.Hook[*RecordRequestEvent]
+
+	// collection API event hooks
+	onCollectionsListRequest   *hook.Hook[*CollectionsListRequestEvent]
+	onCollectionViewRequest    *hook.Hook[*CollectionRequestEvent]
+	onCollectionCreateRequest  *hook.Hook[*CollectionRequestEvent]
+	onCollectionUpdateRequest  *hook.Hook[*CollectionRequestEvent]
+	onCollectionDeleteRequest  *hook.Hook[*CollectionRequestEvent]
+	onCollectionsImportRequest *hook.Hook[*CollectionsImportRequestEvent]
+
+	onBatchRequest *hook.Hook[*BatchRequestEvent]
+}
+
+// NewBaseApp creates and returns a new BaseApp instance
+// configured with the provided arguments.
+//
+// To initialize the app, you need to call `app.Bootstrap()`.
+func NewBaseApp(config BaseAppConfig) *BaseApp {
+	app := &BaseApp{
+		settings:            newDefaultSettings(),
+		store:               store.New[string, any](nil),
+		cron:                cron.New(),
+		subscriptionsBroker: subscriptions.NewBroker(),
+		config:              &config,
+	}
+
+	// apply config defaults
+	if app.config.DBConnect == nil {
+		app.config.DBConnect = PostgresDBConnectFunc(app.config.PostgresURL)
+	}
+	if app.config.DataMaxOpenConns <= 0 {
+		app.config.DataMaxOpenConns = DefaultDataMaxOpenConns
+	}
+	if app.config.DataMaxIdleConns <= 0 {
+		app.config.DataMaxIdleConns = DefaultDataMaxIdleConns
+	}
+	if app.config.AuxMaxOpenConns <= 0 {
+		app.config.AuxMaxOpenConns = DefaultAuxMaxOpenConns
+	}
+	if app.config.AuxMaxIdleConns <= 0 {
+		app.config.AuxMaxIdleConns = DefaultAuxMaxIdleConns
+	}
+	if app.config.QueryTimeout <= 0 {
+		app.config.QueryTimeout = DefaultQueryTimeout
+	}
+
+	app.initHooks()
+	app.registerBaseHooks()
+
+	return app
+}
+
+func NewBaseAppForTest(config BaseAppConfig) (*BaseApp, func()) {
+	var randomStr = security.RandomString(4)
+	var testAuxDB = "pb_test_" + randomStr + "_auxiliary_db"
+	var testDataDB = "pb_test_" + randomStr + "_data_db"
+
+	exec.Command("sh", "-c", "PGPASSWORD=pass dropdb -h localhost -p 6432 -U user "+testAuxDB).Run()
+	exec.Command("sh", "-c", "PGPASSWORD=pass dropdb -h localhost -p 6432 -U user "+testDataDB).Run()
+	exec.Command("sh", "-c", "PGPASSWORD=pass createdb -h localhost -p 6432 -U user "+testAuxDB).Run()
+	exec.Command("sh", "-c", "PGPASSWORD=pass createdb -h localhost -p 6432 -U user "+testDataDB).Run()
+
+	config.PostgresURL = "postgres://user:pass@localhost:6432/postgres?sslmode=disable"
+	config.PostgresAuxDB = testAuxDB
+	config.PostgresDataDB = testDataDB
+
+	app := NewBaseApp(config)
+
+	cleanup := func() {
+		defer app.ResetBootstrapState()
+		defer exec.Command("sh", "-c", "PGPASSWORD=pass dropdb -h localhost -p 6432 -U user "+app.config.PostgresDataDB).Run()
+		defer exec.Command("sh", "-c", "PGPASSWORD=pass dropdb -h localhost -p 6432 -U user "+app.config.PostgresAuxDB).Run()
+	}
+
+	return app, cleanup
+}
+
+// initHooks initializes all app hook handlers.
+func (app *BaseApp) initHooks() {
+	// app event hooks
+	app.onBootstrap = &hook.Hook[*BootstrapEvent]{}
+	app.onServe = &hook.Hook[*ServeEvent]{}
+	app.onTerminate = &hook.Hook[*TerminateEvent]{}
+	app.onBackupCreate = &hook.Hook[*BackupEvent]{}
+	app.onBackupRestore = &hook.Hook[*BackupEvent]{}
+
+	// db model hooks
+	app.onModelValidate = &hook.Hook[*ModelEvent]{}
+	app.onModelCreate = &hook.Hook[*ModelEvent]{}
+	app.onModelCreateExecute = &hook.Hook[*ModelEvent]{}
+	app.onModelAfterCreateSuccess = &hook.Hook[*ModelEvent]{}
+	app.onModelAfterCreateError = &hook.Hook[*ModelErrorEvent]{}
+	app.onModelUpdate = &hook.Hook[*ModelEvent]{}
+	app.onModelUpdateWrite = &hook.Hook[*ModelEvent]{}
+	app.onModelAfterUpdateSuccess = &hook.Hook[*ModelEvent]{}
+	app.onModelAfterUpdateError = &hook.Hook[*ModelErrorEvent]{}
+	app.onModelDelete = &hook.Hook[*ModelEvent]{}
+	app.onModelDeleteExecute = &hook.Hook[*ModelEvent]{}
+	app.onModelAfterDeleteSuccess = &hook.Hook[*ModelEvent]{}
+	app.onModelAfterDeleteError = &hook.Hook[*ModelErrorEvent]{}
+
+	// db record hooks
+	app.onRecordEnrich = &hook.Hook[*RecordEnrichEvent]{}
+	app.onRecordValidate = &hook.Hook[*RecordEvent]{}
+	app.onRecordCreate = &hook.Hook[*RecordEvent]{}
+	app.onRecordCreateExecute = &hook.Hook[*RecordEvent]{}
+	app.onRecordAfterCreateSuccess = &hook.Hook[*RecordEvent]{}
+	app.onRecordAfterCreateError = &hook.Hook[*RecordErrorEvent]{}
+	app.onRecordUpdate = &hook.Hook[*RecordEvent]{}
+	app.onRecordUpdateExecute = &hook.Hook[*RecordEvent]{}
+	app.onRecordAfterUpdateSuccess = &hook.Hook[*RecordEvent]{}
+	app.onRecordAfterUpdateError = &hook.Hook[*RecordErrorEvent]{}
+	app.onRecordDelete = &hook.Hook[*RecordEvent]{}
+	app.onRecordDeleteExecute = &hook.Hook[*RecordEvent]{}
+	app.onRecordAfterDeleteSuccess = &hook.Hook[*RecordEvent]{}
+	app.onRecordAfterDeleteError = &hook.Hook[*RecordErrorEvent]{}
+
+	// db collection hooks
+	app.onCollectionValidate = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionCreate = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionCreateExecute = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionAfterCreateSuccess = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionAfterCreateError = &hook.Hook[*CollectionErrorEvent]{}
+	app.onCollectionUpdate = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionUpdateExecute = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionAfterUpdateSuccess = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionAfterUpdateError = &hook.Hook[*CollectionErrorEvent]{}
+	app.onCollectionDelete = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionAfterDeleteSuccess = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionDeleteExecute = &hook.Hook[*CollectionEvent]{}
+	app.onCollectionAfterDeleteError = &hook.Hook[*CollectionErrorEvent]{}
+
+	// mailer event hooks
+	app.onMailerSend = &hook.Hook[*MailerEvent]{}
+	app.onMailerRecordPasswordResetSend = &hook.Hook[*MailerRecordEvent]{}
+	app.onMailerRecordVerificationSend = &hook.Hook[*MailerRecordEvent]{}
+	app.onMailerRecordEmailChangeSend = &hook.Hook[*MailerRecordEvent]{}
+	app.onMailerRecordOTPSend = &hook.Hook[*MailerRecordEvent]{}
+	app.onMailerRecordAuthAlertSend = &hook.Hook[*MailerRecordEvent]{}
+
+	// realtime API event hooks
+	app.onRealtimeConnectRequest = &hook.Hook[*RealtimeConnectRequestEvent]{}
+	app.onRealtimeMessageSend = &hook.Hook[*RealtimeMessageEvent]{}
+	app.onRealtimeSubscribeRequest = &hook.Hook[*RealtimeSubscribeRequestEvent]{}
+
+	// settings event hooks
+	app.onSettingsListRequest = &hook.Hook[*SettingsListRequestEvent]{}
+	app.onSettingsUpdateRequest = &hook.Hook[*SettingsUpdateRequestEvent]{}
+	app.onSettingsReload = &hook.Hook[*SettingsReloadEvent]{}
+
+	// file API event hooks
+	app.onFileDownloadRequest = &hook.Hook[*FileDownloadRequestEvent]{}
+	app.onFileTokenRequest = &hook.Hook[*FileTokenRequestEvent]{}
+
+	// record auth API event hooks
+	app.onRecordAuthRequest = &hook.Hook[*RecordAuthRequestEvent]{}
+	app.onRecordAuthWithPasswordRequest = &hook.Hook[*RecordAuthWithPasswordRequestEvent]{}
+	app.onRecordAuthWithOAuth2Request = &hook.Hook[*RecordAuthWithOAuth2RequestEvent]{}
+	app.onRecordAuthRefreshRequest = &hook.Hook[*RecordAuthRefreshRequestEvent]{}
+	app.onRecordRequestPasswordResetRequest = &hook.Hook[*RecordRequestPasswordResetRequestEvent]{}
+	app.onRecordConfirmPasswordResetRequest = &hook.Hook[*RecordConfirmPasswordResetRequestEvent]{}
+	app.onRecordRequestVerificationRequest = &hook.Hook[*RecordRequestVerificationRequestEvent]{}
+	app.onRecordConfirmVerificationRequest = &hook.Hook[*RecordConfirmVerificationRequestEvent]{}
+	app.onRecordRequestEmailChangeRequest = &hook.Hook[*RecordRequestEmailChangeRequestEvent]{}
+	app.onRecordConfirmEmailChangeRequest = &hook.Hook[*RecordConfirmEmailChangeRequestEvent]{}
+	app.onRecordRequestOTPRequest = &hook.Hook[*RecordCreateOTPRequestEvent]{}
+	app.onRecordAuthWithOTPRequest = &hook.Hook[*RecordAuthWithOTPRequestEvent]{}
+
+	// record crud API event hooks
+	app.onRecordsListRequest = &hook.Hook[*RecordsListRequestEvent]{}
+	app.onRecordViewRequest = &hook.Hook[*RecordRequestEvent]{}
+	app.onRecordCreateRequest = &hook.Hook[*RecordRequestEvent]{}
+	app.onRecordUpdateRequest = &hook.Hook[*RecordRequestEvent]{}
+	app.onRecordDeleteRequest = &hook.Hook[*RecordRequestEvent]{}
+
+	// collection API event hooks
+	app.onCollectionsListRequest = &hook.Hook[*CollectionsListRequestEvent]{}
+	app.onCollectionViewRequest = &hook.Hook[*CollectionRequestEvent]{}
+	app.onCollectionCreateRequest = &hook.Hook[*CollectionRequestEvent]{}
+	app.onCollectionUpdateRequest = &hook.Hook[*CollectionRequestEvent]{}
+	app.onCollectionDeleteRequest = &hook.Hook[*CollectionRequestEvent]{}
+	app.onCollectionsImportRequest = &hook.Hook[*CollectionsImportRequestEvent]{}
+
+	app.onBatchRequest = &hook.Hook[*BatchRequestEvent]{}
+}
+
+// UnsafeWithoutHooks returns a shallow copy of the current app WITHOUT any registered hooks.
+//
+// NB! Note that using the returned app instance may cause data integrity errors
+// since the Record validations and data normalizations (including files uploads)
+// rely on the app hooks to work.
+func (app *BaseApp) UnsafeWithoutHooks() App {
+	clone := *app
+
+	// reset all hook handlers
+	clone.initHooks()
+
+	return &clone
+}
+
+// Logger returns the default app logger.
+//
+// If the application is not bootstrapped yet, fallbacks to slog.Default().
+func (app *BaseApp) Logger() *slog.Logger {
+	if app.logger == nil {
+		return slog.Default()
+	}
+
+	return app.logger
+}
+
+// TxInfo returns the transaction associated with the current app instance (if any).
+//
+// Could be used if you want to execute indirectly a function after
+// the related app transaction completes using `app.TxInfo().OnAfterFunc(callback)`.
+func (app *BaseApp) TxInfo() *TxAppInfo {
+	return app.txInfo
+}
+
+// IsTransactional checks if the current app instance is part of a transaction.
+func (app *BaseApp) IsTransactional() bool {
+	return app.TxInfo() != nil
+}
+
+// IsBootstrapped checks if the application was initialized
+// (aka. whether Bootstrap() was called).
+func (app *BaseApp) IsBootstrapped() bool {
+	return app.concurrentDB != nil && app.auxConcurrentDB != nil
+}
+
+// Bootstrap initializes the application
+// (aka. create data dir, open db connections, load settings, etc.).
+//
+// It will call ResetBootstrapState() if the application was already bootstrapped.
+func (app *BaseApp) Bootstrap() error {
+	event := &BootstrapEvent{}
+	event.App = app
+
+	err := app.OnBootstrap().Trigger(event, func(e *BootstrapEvent) error {
+		// clear resources of previous core state (if any)
+		if err := app.ResetBootstrapState(); err != nil {
+			return err
+		}
+
+		// ensure that data dir exist
+		if err := os.MkdirAll(app.DataDir(), os.ModePerm); err != nil {
+			return err
+		}
+
+		if err := app.initDataDB(); err != nil {
+			return err
+		}
+
+		if err := app.initAuxDB(); err != nil {
+			return err
+		}
+
+		if err := app.initLogger(); err != nil {
+			return err
+		}
+
+		if err := app.RunSystemMigrations(); err != nil {
+			return err
+		}
+
+		if err := app.ReloadCachedCollections(); err != nil {
+			return err
+		}
+
+		if err := app.ReloadSettings(); err != nil {
+			return err
+		}
+
+		// try to cleanup the pb_data temp directory (if any)
+		_ = os.RemoveAll(filepath.Join(app.DataDir(), LocalTempDirName))
+
+		return nil
+	})
+
+	// add a more user friendly message in case users forgot to call
+	// e.Next() as part of their bootstrap hook
+	if err == nil && !app.IsBootstrapped() {
+		app.Logger().Warn("OnBootstrap hook didn't fail but the app is still not bootstrapped - maybe missing e.Next()?")
+	}
+
+	return err
+}
+
+type closer interface {
+	Close() error
+}
+
+// ResetBootstrapState releases the initialized core app resources
+// (closing db connections, stopping cron ticker, etc.).
+func (app *BaseApp) ResetBootstrapState() error {
+	app.Cron().Stop()
+
+	var errs []error
+
+	dbs := []*dbx.Builder{
+		&app.concurrentDB,
+		&app.nonconcurrentDB,
+		&app.auxConcurrentDB,
+		&app.auxNonconcurrentDB,
+	}
+
+	for _, db := range dbs {
+		if db == nil {
+			continue
+		}
+		if v, ok := (*db).(closer); ok {
+			if err := v.Close(); err != nil {
+				errs = append(errs, err)
+			}
+		}
+		*db = nil
+	}
+
+	if len(errs) > 0 {
+		return errors.Join(errs...)
+	}
+
+	return nil
+}
+
+// IsRealtimeBridgeEnabled returns whether the app is in realtime bridge mode.
+// If you need both realtime feature and horizontal scale support, you could
+// enable it. We will use Postgres's LISTEN/NOTIFY feature to sync realtime events.
+func (app *BaseApp) IsRealtimeBridgeEnabled() bool {
+	return app.config.IsRealtimeBridge
+}
+
+// DB returns the default app data.db builder instance.
+//
+// To minimize SQLITE_BUSY errors, it automatically routes the
+// SELECT queries to the underlying concurrent db pool and everything
+// else to the nonconcurrent one.
+//
+// For more finer control over the used connections pools you can
+// call directly ConcurrentDB() or NonconcurrentDB().
+func (app *BaseApp) DB() dbx.Builder {
+	// transactional or both are nil
+	if app.concurrentDB == app.nonconcurrentDB {
+		return app.concurrentDB
+	}
+
+	return &dualDBBuilder{
+		concurrentDB:    app.concurrentDB,
+		nonconcurrentDB: app.nonconcurrentDB,
+	}
+}
+
+// ConcurrentDB returns the concurrent app data.db builder instance.
+//
+// This method is used mainly internally for executing db read
+// operations in a concurrent/non-blocking manner.
+//
+// Most users should use simply DB() as it will automatically
+// route the query execution to ConcurrentDB() or NonconcurrentDB().
+//
+// In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+func (app *BaseApp) ConcurrentDB() dbx.Builder {
+	return app.concurrentDB
+}
+
+// NonconcurrentDB returns the nonconcurrent app data.db builder instance.
+//
+// The returned db instance is limited only to a single open connection,
+// meaning that it can process only 1 db operation at a time (other queries queue up).
+//
+// This method is used mainly internally and in the tests to execute write
+// (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+//
+// Most users should use simply DB() as it will automatically
+// route the query execution to ConcurrentDB() or NonconcurrentDB().
+//
+// In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+func (app *BaseApp) NonconcurrentDB() dbx.Builder {
+	return app.nonconcurrentDB
+}
+
+// AuxDB returns the app auxiliary.db builder instance.
+//
+// To minimize SQLITE_BUSY errors, it automatically routes the
+// SELECT queries to the underlying concurrent db pool and everything
+// else to the nonconcurrent one.
+//
+// For more finer control over the used connections pools you can
+// call directly AuxConcurrentDB() or AuxNonconcurrentDB().
+func (app *BaseApp) AuxDB() dbx.Builder {
+	// transactional or both are nil
+	if app.auxConcurrentDB == app.auxNonconcurrentDB {
+		return app.auxConcurrentDB
+	}
+
+	return &dualDBBuilder{
+		concurrentDB:    app.auxConcurrentDB,
+		nonconcurrentDB: app.auxNonconcurrentDB,
+	}
+}
+
+// AuxConcurrentDB returns the concurrent app auxiliary.db builder instance.
+//
+// This method is used mainly internally for executing db read
+// operations in a concurrent/non-blocking manner.
+//
+// Most users should use simply AuxDB() as it will automatically
+// route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+//
+// In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+func (app *BaseApp) AuxConcurrentDB() dbx.Builder {
+	return app.auxConcurrentDB
+}
+
+// AuxNonconcurrentDB returns the nonconcurrent app auxiliary.db builder instance.
+//
+// The returned db instance is limited only to a single open connection,
+// meaning that it can process only 1 db operation at a time (other queries queue up).
+//
+// This method is used mainly internally and in the tests to execute write
+// (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+//
+// Most users should use simply AuxDB() as it will automatically
+// route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+//
+// In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+func (app *BaseApp) AuxNonconcurrentDB() dbx.Builder {
+	return app.auxNonconcurrentDB
+}
+
+// DataDir returns the app data directory path.
+func (app *BaseApp) DataDir() string {
+	return app.config.DataDir
+}
+
+// PostgresDataDB returns the name of the main data db (default `data`) used by the app.
+func (app *BaseApp) PostgresDataDB() string {
+	return app.config.PostgresDataDB
+}
+
+// PostgresAuxDB returns the name of the auxiliary db (default `auxiliary`) used by the app.
+func (app *BaseApp) PostgresAuxDB() string {
+	return app.config.PostgresAuxDB
+}
+
+// EncryptionEnv returns the name of the app secret env key
+// (currently used primarily for optional settings encryption but this may change in the future).
+func (app *BaseApp) EncryptionEnv() string {
+	return app.config.EncryptionEnv
+}
+
+// IsDev returns whether the app is in dev mode.
+//
+// When enabled logs, executed sql statements, etc. are printed to the stderr.
+func (app *BaseApp) IsDev() bool {
+	return app.config.IsDev
+}
+
+// Settings returns the loaded app settings.
+func (app *BaseApp) Settings() *Settings {
+	return app.settings
+}
+
+// Store returns the app runtime store.
+func (app *BaseApp) Store() *store.Store[string, any] {
+	return app.store
+}
+
+// Cron returns the app cron instance.
+func (app *BaseApp) Cron() *cron.Cron {
+	return app.cron
+}
+
+// SubscriptionsBroker returns the app realtime subscriptions broker instance.
+func (app *BaseApp) SubscriptionsBroker() *subscriptions.Broker {
+	return app.subscriptionsBroker
+}
+
+// NewMailClient creates and returns a new SMTP or Sendmail client
+// based on the current app settings.
+func (app *BaseApp) NewMailClient() mailer.Mailer {
+	var client mailer.Mailer
+
+	// init mailer client
+	if app.Settings().SMTP.Enabled {
+		client = &mailer.SMTPClient{
+			Host:       app.Settings().SMTP.Host,
+			Port:       app.Settings().SMTP.Port,
+			Username:   app.Settings().SMTP.Username,
+			Password:   app.Settings().SMTP.Password,
+			TLS:        app.Settings().SMTP.TLS,
+			AuthMethod: app.Settings().SMTP.AuthMethod,
+			LocalName:  app.Settings().SMTP.LocalName,
+		}
+	} else {
+		client = &mailer.Sendmail{}
+	}
+
+	// register the app level hook
+	if h, ok := client.(mailer.SendInterceptor); ok {
+		h.OnSend().Bind(&hook.Handler[*mailer.SendEvent]{
+			Id: "__pbMailerOnSend__",
+			Func: func(e *mailer.SendEvent) error {
+				appEvent := new(MailerEvent)
+				appEvent.App = app
+				appEvent.Mailer = client
+				appEvent.Message = e.Message
+
+				return app.OnMailerSend().Trigger(appEvent, func(ae *MailerEvent) error {
+					e.Message = ae.Message
+
+					// print the mail in the console to assist with the debugging
+					if app.IsDev() {
+						logDate := new(strings.Builder)
+						log.New(logDate, "", log.LstdFlags).Print()
+
+						mailLog := new(strings.Builder)
+						mailLog.WriteString(strings.TrimSpace(logDate.String()))
+						mailLog.WriteString(" Mail sent\n")
+						fmt.Fprintf(mailLog, "├─ From: %v\n", ae.Message.From)
+						fmt.Fprintf(mailLog, "├─ To: %v\n", ae.Message.To)
+						fmt.Fprintf(mailLog, "├─ Cc: %v\n", ae.Message.Cc)
+						fmt.Fprintf(mailLog, "├─ Bcc: %v\n", ae.Message.Bcc)
+						fmt.Fprintf(mailLog, "├─ Subject: %v\n", ae.Message.Subject)
+
+						if len(ae.Message.Attachments) > 0 {
+							attachmentKeys := make([]string, 0, len(ae.Message.Attachments))
+							for k := range ae.Message.Attachments {
+								attachmentKeys = append(attachmentKeys, k)
+							}
+							fmt.Fprintf(mailLog, "├─ Attachments: %v\n", attachmentKeys)
+						}
+
+						if len(ae.Message.InlineAttachments) > 0 {
+							attachmentKeys := make([]string, 0, len(ae.Message.InlineAttachments))
+							for k := range ae.Message.InlineAttachments {
+								attachmentKeys = append(attachmentKeys, k)
+							}
+							fmt.Fprintf(mailLog, "├─ InlineAttachments: %v\n", attachmentKeys)
+						}
+
+						const indentation = "        "
+						if ae.Message.Text != "" {
+							textParts := strings.Split(strings.TrimSpace(ae.Message.Text), "\n")
+							textIndented := indentation + strings.Join(textParts, "\n"+indentation)
+							fmt.Fprintf(mailLog, "└─ Text:\n%s", textIndented)
+						} else {
+							htmlParts := strings.Split(strings.TrimSpace(ae.Message.HTML), "\n")
+							htmlIndented := indentation + strings.Join(htmlParts, "\n"+indentation)
+							fmt.Fprintf(mailLog, "└─ HTML:\n%s", htmlIndented)
+						}
+
+						color.HiBlack("%s", mailLog.String())
+					}
+
+					// send the email with the new mailer in case it was replaced
+					if client != ae.Mailer {
+						return ae.Mailer.Send(e.Message)
+					}
+
+					return e.Next()
+				})
+			},
+		})
+	}
+
+	return client
+}
+
+// NewFilesystem creates a new local or S3 filesystem instance
+// for managing regular app files (ex. record uploads)
+// based on the current app settings.
+//
+// NB! Make sure to call Close() on the returned result
+// after you are done working with it.
+func (app *BaseApp) NewFilesystem() (*filesystem.System, error) {
+	if app.settings != nil && app.settings.S3.Enabled {
+		return filesystem.NewS3(
+			app.settings.S3.Bucket,
+			app.settings.S3.Region,
+			app.settings.S3.Endpoint,
+			app.settings.S3.AccessKey,
+			app.settings.S3.Secret,
+			app.settings.S3.ForcePathStyle,
+		)
+	}
+
+	// fallback to local filesystem
+	return filesystem.NewLocal(filepath.Join(app.DataDir(), LocalStorageDirName))
+}
+
+// NewBackupsFilesystem creates a new local or S3 filesystem instance
+// for managing app backups based on the current app settings.
+//
+// NB! Make sure to call Close() on the returned result
+// after you are done working with it.
+func (app *BaseApp) NewBackupsFilesystem() (*filesystem.System, error) {
+	if app.settings != nil && app.settings.Backups.S3.Enabled {
+		return filesystem.NewS3(
+			app.settings.Backups.S3.Bucket,
+			app.settings.Backups.S3.Region,
+			app.settings.Backups.S3.Endpoint,
+			app.settings.Backups.S3.AccessKey,
+			app.settings.Backups.S3.Secret,
+			app.settings.Backups.S3.ForcePathStyle,
+		)
+	}
+
+	// fallback to local filesystem
+	return filesystem.NewLocal(filepath.Join(app.DataDir(), LocalBackupsDirName))
+}
+
+// Restart restarts (aka. replaces) the current running application process.
+//
+// NB! It relies on execve which is supported only on UNIX based systems.
+func (app *BaseApp) Restart() error {
+	if runtime.GOOS == "windows" {
+		return errors.New("restart is not supported on windows")
+	}
+
+	execPath, err := os.Executable()
+	if err != nil {
+		return err
+	}
+
+	event := &TerminateEvent{}
+	event.App = app
+	event.IsRestart = true
+
+	return app.OnTerminate().Trigger(event, func(e *TerminateEvent) error {
+		_ = e.App.ResetBootstrapState()
+
+		// attempt to restart the bootstrap process in case execve returns an error for some reason
+		defer func() {
+			if err := e.App.Bootstrap(); err != nil {
+				app.Logger().Error("Failed to rebootstrap the application after failed app.Restart()", "error", err)
+			}
+		}()
+
+		return execve(execPath, os.Args, os.Environ())
+	})
+}
+
+// RunSystemMigrations applies all new migrations registered in the [core.SystemMigrations] list.
+func (app *BaseApp) RunSystemMigrations() error {
+	_, err := NewMigrationsRunner(app, SystemMigrations).Up()
+	return err
+}
+
+// RunAppMigrations applies all new migrations registered in the [core.AppMigrations] list.
+func (app *BaseApp) RunAppMigrations() error {
+	_, err := NewMigrationsRunner(app, AppMigrations).Up()
+	return err
+}
+
+// RunAllMigrations applies all system and app migrations
+// (aka. from both [core.SystemMigrations] and [core.AppMigrations]).
+func (app *BaseApp) RunAllMigrations() error {
+	list := MigrationsList{}
+	list.Copy(SystemMigrations)
+	list.Copy(AppMigrations)
+	_, err := NewMigrationsRunner(app, list).Up()
+	return err
+}
+
+// -------------------------------------------------------------------
+// App event hooks
+// -------------------------------------------------------------------
+
+func (app *BaseApp) OnBootstrap() *hook.Hook[*BootstrapEvent] {
+	return app.onBootstrap
+}
+
+func (app *BaseApp) OnServe() *hook.Hook[*ServeEvent] {
+	return app.onServe
+}
+
+func (app *BaseApp) OnTerminate() *hook.Hook[*TerminateEvent] {
+	return app.onTerminate
+}
+
+func (app *BaseApp) OnBackupCreate() *hook.Hook[*BackupEvent] {
+	return app.onBackupCreate
+}
+
+func (app *BaseApp) OnBackupRestore() *hook.Hook[*BackupEvent] {
+	return app.onBackupRestore
+}
+
+// ---------------------------------------------------------------
+
+func (app *BaseApp) OnModelCreate(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelCreate, tags...)
+}
+
+func (app *BaseApp) OnModelCreateExecute(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelCreateExecute, tags...)
+}
+
+func (app *BaseApp) OnModelAfterCreateSuccess(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelAfterCreateSuccess, tags...)
+}
+
+func (app *BaseApp) OnModelAfterCreateError(tags ...string) *hook.TaggedHook[*ModelErrorEvent] {
+	return hook.NewTaggedHook(app.onModelAfterCreateError, tags...)
+}
+
+func (app *BaseApp) OnModelUpdate(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelUpdate, tags...)
+}
+
+func (app *BaseApp) OnModelUpdateExecute(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelUpdateWrite, tags...)
+}
+
+func (app *BaseApp) OnModelAfterUpdateSuccess(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelAfterUpdateSuccess, tags...)
+}
+
+func (app *BaseApp) OnModelAfterUpdateError(tags ...string) *hook.TaggedHook[*ModelErrorEvent] {
+	return hook.NewTaggedHook(app.onModelAfterUpdateError, tags...)
+}
+
+func (app *BaseApp) OnModelValidate(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelValidate, tags...)
+}
+
+func (app *BaseApp) OnModelDelete(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelDelete, tags...)
+}
+
+func (app *BaseApp) OnModelDeleteExecute(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelDeleteExecute, tags...)
+}
+
+func (app *BaseApp) OnModelAfterDeleteSuccess(tags ...string) *hook.TaggedHook[*ModelEvent] {
+	return hook.NewTaggedHook(app.onModelAfterDeleteSuccess, tags...)
+}
+
+func (app *BaseApp) OnModelAfterDeleteError(tags ...string) *hook.TaggedHook[*ModelErrorEvent] {
+	return hook.NewTaggedHook(app.onModelAfterDeleteError, tags...)
+}
+
+func (app *BaseApp) OnRecordEnrich(tags ...string) *hook.TaggedHook[*RecordEnrichEvent] {
+	return hook.NewTaggedHook(app.onRecordEnrich, tags...)
+}
+
+func (app *BaseApp) OnRecordValidate(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordValidate, tags...)
+}
+
+func (app *BaseApp) OnRecordCreate(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordCreate, tags...)
+}
+
+func (app *BaseApp) OnRecordCreateExecute(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordCreateExecute, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterCreateSuccess(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterCreateSuccess, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterCreateError(tags ...string) *hook.TaggedHook[*RecordErrorEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterCreateError, tags...)
+}
+
+func (app *BaseApp) OnRecordUpdate(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordUpdate, tags...)
+}
+
+func (app *BaseApp) OnRecordUpdateExecute(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordUpdateExecute, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterUpdateSuccess(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterUpdateSuccess, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterUpdateError(tags ...string) *hook.TaggedHook[*RecordErrorEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterUpdateError, tags...)
+}
+
+func (app *BaseApp) OnRecordDelete(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordDelete, tags...)
+}
+
+func (app *BaseApp) OnRecordDeleteExecute(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordDeleteExecute, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterDeleteSuccess(tags ...string) *hook.TaggedHook[*RecordEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterDeleteSuccess, tags...)
+}
+
+func (app *BaseApp) OnRecordAfterDeleteError(tags ...string) *hook.TaggedHook[*RecordErrorEvent] {
+	return hook.NewTaggedHook(app.onRecordAfterDeleteError, tags...)
+}
+
+func (app *BaseApp) OnCollectionValidate(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionValidate, tags...)
+}
+
+func (app *BaseApp) OnCollectionCreate(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionCreate, tags...)
+}
+
+func (app *BaseApp) OnCollectionCreateExecute(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionCreateExecute, tags...)
+}
+
+func (app *BaseApp) OnCollectionAfterCreateSuccess(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionAfterCreateSuccess, tags...)
+}
+
+func (app *BaseApp) OnCollectionAfterCreateError(tags ...string) *hook.TaggedHook[*CollectionErrorEvent] {
+	return hook.NewTaggedHook(app.onCollectionAfterCreateError, tags...)
+}
+
+func (app *BaseApp) OnCollectionUpdate(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionUpdate, tags...)
+}
+
+func (app *BaseApp) OnCollectionUpdateExecute(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionUpdateExecute, tags...)
+}
+
+func (app *BaseApp) OnCollectionAfterUpdateSuccess(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionAfterUpdateSuccess, tags...)
+}
+
+func (app *BaseApp) OnCollectionAfterUpdateError(tags ...string) *hook.TaggedHook[*CollectionErrorEvent] {
+	return hook.NewTaggedHook(app.onCollectionAfterUpdateError, tags...)
+}
+
+func (app *BaseApp) OnCollectionDelete(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionDelete, tags...)
+}
+
+func (app *BaseApp) OnCollectionDeleteExecute(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionDeleteExecute, tags...)
+}
+
+func (app *BaseApp) OnCollectionAfterDeleteSuccess(tags ...string) *hook.TaggedHook[*CollectionEvent] {
+	return hook.NewTaggedHook(app.onCollectionAfterDeleteSuccess, tags...)
+}
+
+func (app *BaseApp) OnCollectionAfterDeleteError(tags ...string) *hook.TaggedHook[*CollectionErrorEvent] {
+	return hook.NewTaggedHook(app.onCollectionAfterDeleteError, tags...)
+}
+
+// -------------------------------------------------------------------
+// Mailer event hooks
+// -------------------------------------------------------------------
+
+func (app *BaseApp) OnMailerSend() *hook.Hook[*MailerEvent] {
+	return app.onMailerSend
+}
+
+func (app *BaseApp) OnMailerRecordPasswordResetSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerRecordPasswordResetSend, tags...)
+}
+
+func (app *BaseApp) OnMailerRecordVerificationSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerRecordVerificationSend, tags...)
+}
+
+func (app *BaseApp) OnMailerRecordEmailChangeSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerRecordEmailChangeSend, tags...)
+}
+
+func (app *BaseApp) OnMailerRecordOTPSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerRecordOTPSend, tags...)
+}
+
+func (app *BaseApp) OnMailerRecordAuthAlertSend(tags ...string) *hook.TaggedHook[*MailerRecordEvent] {
+	return hook.NewTaggedHook(app.onMailerRecordAuthAlertSend, tags...)
+}
+
+// -------------------------------------------------------------------
+// Realtime API event hooks
+// -------------------------------------------------------------------
+
+func (app *BaseApp) OnRealtimeConnectRequest() *hook.Hook[*RealtimeConnectRequestEvent] {
+	return app.onRealtimeConnectRequest
+}
+
+func (app *BaseApp) OnRealtimeMessageSend() *hook.Hook[*RealtimeMessageEvent] {
+	return app.onRealtimeMessageSend
+}
+
+func (app *BaseApp) OnRealtimeSubscribeRequest() *hook.Hook[*RealtimeSubscribeRequestEvent] {
+	return app.onRealtimeSubscribeRequest
+}
+
+// -------------------------------------------------------------------
+// Settings API event hooks
+// -------------------------------------------------------------------
+
+func (app *BaseApp) OnSettingsListRequest() *hook.Hook[*SettingsListRequestEvent] {
+	return app.onSettingsListRequest
+}
+
+func (app *BaseApp) OnSettingsUpdateRequest() *hook.Hook[*SettingsUpdateRequestEvent] {
+	return app.onSettingsUpdateRequest
+}
+
+func (app *BaseApp) OnSettingsReload() *hook.Hook[*SettingsReloadEvent] {
+	return app.onSettingsReload
+}
+
+// -------------------------------------------------------------------
+// File API event hooks
+// -------------------------------------------------------------------
+
+func (app *BaseApp) OnFileDownloadRequest(tags ...string) *hook.TaggedHook[*FileDownloadRequestEvent] {
+	return hook.NewTaggedHook(app.onFileDownloadRequest, tags...)
+}
+
+func (app *BaseApp) OnFileTokenRequest(tags ...string) *hook.TaggedHook[*FileTokenRequestEvent] {
+	return hook.NewTaggedHook(app.onFileTokenRequest, tags...)
+}
+
+// -------------------------------------------------------------------
+// Record auth API event hooks
+// -------------------------------------------------------------------
+
+func (app *BaseApp) OnRecordAuthRequest(tags ...string) *hook.TaggedHook[*RecordAuthRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordAuthRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordAuthWithPasswordRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithPasswordRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordAuthWithPasswordRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordAuthWithOAuth2Request(tags ...string) *hook.TaggedHook[*RecordAuthWithOAuth2RequestEvent] {
+	return hook.NewTaggedHook(app.onRecordAuthWithOAuth2Request, tags...)
+}
+
+func (app *BaseApp) OnRecordAuthRefreshRequest(tags ...string) *hook.TaggedHook[*RecordAuthRefreshRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordAuthRefreshRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordRequestPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordRequestPasswordResetRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordRequestPasswordResetRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordConfirmPasswordResetRequest(tags ...string) *hook.TaggedHook[*RecordConfirmPasswordResetRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordConfirmPasswordResetRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordRequestVerificationRequest(tags ...string) *hook.TaggedHook[*RecordRequestVerificationRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordRequestVerificationRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordConfirmVerificationRequest(tags ...string) *hook.TaggedHook[*RecordConfirmVerificationRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordConfirmVerificationRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordRequestEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordRequestEmailChangeRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordRequestEmailChangeRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordConfirmEmailChangeRequest(tags ...string) *hook.TaggedHook[*RecordConfirmEmailChangeRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordConfirmEmailChangeRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordRequestOTPRequest(tags ...string) *hook.TaggedHook[*RecordCreateOTPRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordRequestOTPRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordAuthWithOTPRequest(tags ...string) *hook.TaggedHook[*RecordAuthWithOTPRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordAuthWithOTPRequest, tags...)
+}
+
+// -------------------------------------------------------------------
+// Record CRUD API event hooks
+// -------------------------------------------------------------------
+
+func (app *BaseApp) OnRecordsListRequest(tags ...string) *hook.TaggedHook[*RecordsListRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordsListRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordViewRequest(tags ...string) *hook.TaggedHook[*RecordRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordViewRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordCreateRequest(tags ...string) *hook.TaggedHook[*RecordRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordCreateRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordUpdateRequest(tags ...string) *hook.TaggedHook[*RecordRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordUpdateRequest, tags...)
+}
+
+func (app *BaseApp) OnRecordDeleteRequest(tags ...string) *hook.TaggedHook[*RecordRequestEvent] {
+	return hook.NewTaggedHook(app.onRecordDeleteRequest, tags...)
+}
+
+// -------------------------------------------------------------------
+// Collection API event hooks
+// -------------------------------------------------------------------
+
+func (app *BaseApp) OnCollectionsListRequest() *hook.Hook[*CollectionsListRequestEvent] {
+	return app.onCollectionsListRequest
+}
+
+func (app *BaseApp) OnCollectionViewRequest() *hook.Hook[*CollectionRequestEvent] {
+	return app.onCollectionViewRequest
+}
+
+func (app *BaseApp) OnCollectionCreateRequest() *hook.Hook[*CollectionRequestEvent] {
+	return app.onCollectionCreateRequest
+}
+
+func (app *BaseApp) OnCollectionUpdateRequest() *hook.Hook[*CollectionRequestEvent] {
+	return app.onCollectionUpdateRequest
+}
+
+func (app *BaseApp) OnCollectionDeleteRequest() *hook.Hook[*CollectionRequestEvent] {
+	return app.onCollectionDeleteRequest
+}
+
+func (app *BaseApp) OnCollectionsImportRequest() *hook.Hook[*CollectionsImportRequestEvent] {
+	return app.onCollectionsImportRequest
+}
+
+func (app *BaseApp) OnBatchRequest() *hook.Hook[*BatchRequestEvent] {
+	return app.onBatchRequest
+}
+
+// -------------------------------------------------------------------
+// Helpers
+// -------------------------------------------------------------------
+
+func (app *BaseApp) initDataDB() error {
+	concurrentDB, err := app.config.DBConnect(app.config.PostgresDataDB)
+	if err != nil {
+		return err
+	}
+	app.concurrentDB = concurrentDB // fix: assign immediately to allow driver detection
+
+	concurrentDB.DB().SetMaxOpenConns(app.config.DataMaxOpenConns)
+	concurrentDB.DB().SetMaxIdleConns(app.config.DataMaxIdleConns)
+	concurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
+
+	var nonconcurrentDB *dbx.DB
+	if IsPostgres(app) {
+		nonconcurrentDB = concurrentDB
+	} else {
+		// SQLite:
+		// Note: SQLite does not allow multiple write connections at the same time.
+		// So we use a separate connection with max open connections limited to 1.
+		db, err := app.config.DBConnect(app.config.PostgresDataDB)
+		if err != nil {
+			return err
+		}
+		db.DB().SetMaxOpenConns(1)
+		db.DB().SetMaxIdleConns(1)
+		db.DB().SetConnMaxIdleTime(3 * time.Minute)
+		nonconcurrentDB = db
+	}
+
+	if app.IsDev() {
+		concurrentDB.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+			if err != nil {
+				color.HiRed("[%.2fms] %v, err: %v\n", float64(t.Milliseconds()), normalizeSQLLog(sql, IsPostgres(app)), err)
+			} else {
+				color.HiBlack("[%.2fms] %v\n", float64(t.Milliseconds()), normalizeSQLLog(sql, IsPostgres(app)))
+			}
+		}
+		nonconcurrentDB.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+			if err != nil {
+				color.HiRed("[%.2fms] %v, err: %v\n", float64(t.Milliseconds()), normalizeSQLLog(sql, IsPostgres(app)), err)
+			} else {
+				color.HiBlack("[%.2fms] %v\n", float64(t.Milliseconds()), normalizeSQLLog(sql, IsPostgres(app)))
+			}
+		}
+		concurrentDB.ExecLogFunc = nonconcurrentDB.ExecLogFunc
+		nonconcurrentDB.QueryLogFunc = concurrentDB.QueryLogFunc
+	}
+
+	app.concurrentDB = concurrentDB
+	app.nonconcurrentDB = nonconcurrentDB
+
+	return nil
+}
+
+var sqliteLogReplacements = []struct {
+	pattern     *regexp.Regexp
+	replacement string
+}{
+	{regexp.MustCompile(`\[\[([^\[\]\{\}\.]+)\.([^\[\]\{\}\.]+)\]\]`), "`$1`.`$2`"},
+	{regexp.MustCompile(`\{\{([^\[\]\{\}\.]+)\.([^\[\]\{\}\.]+)\}\}`), "`$1`.`$2`"},
+	{regexp.MustCompile(`([^'"])?\{\{`), "$1`"},
+	{regexp.MustCompile(`\}\}([^'"])?`), "`$1"},
+	{regexp.MustCompile(`([^'"])?\[\[`), "$1`"},
+	{regexp.MustCompile(`\]\]([^'"])?`), "`$1"},
+	{regexp.MustCompile(`<nil>`), "NULL"},
+}
+
+var postgresLogReplacements = []struct {
+	pattern     *regexp.Regexp
+	replacement string
+}{
+	{regexp.MustCompile(`\[\[([^\[\]\{\}\.]+)\.([^\[\]\{\}\.]+)\]\]`), `"$1"."$2"`},
+	{regexp.MustCompile(`\{\{([^\[\]\{\}\.]+)\.([^\[\]\{\}\.]+)\}\}`), `"$1"."$2"`},
+	{regexp.MustCompile(`([^'"])\{\{`), `$1"`},
+	{regexp.MustCompile(`\}\}([^'"])`), `"$1`},
+	{regexp.MustCompile(`([^'"])\[\[`), `$1"`},
+	{regexp.MustCompile(`\]\]([^'"])`), `"$1`},
+	{regexp.MustCompile(`<nil>`), "NULL"},
+}
+
+// normalizeSQLLog replaces common query builder charactes with their plain SQL version for easier debugging.
+// The query is still not suitable for execution and should be used only for log and debug purposes
+// (the normalization is done here to avoid breaking changes in dbx).
+func normalizeSQLLog(sql string, isPostgres bool) string {
+	replacements := sqliteLogReplacements
+	if isPostgres {
+		replacements = postgresLogReplacements
+	}
+
+	for _, item := range replacements {
+		sql = item.pattern.ReplaceAllString(sql, item.replacement)
+	}
+
+	return sql
+}
+
+func (app *BaseApp) initAuxDB() error {
+	// note: renamed to "auxiliary" because "aux" is a reserved Windows filename
+	// (see https://github.com/pocketbase/pocketbase/issues/5607)
+	concurrentDB, err := app.config.DBConnect(app.config.PostgresAuxDB)
+	if err != nil {
+		return err
+	}
+	app.auxConcurrentDB = concurrentDB // fix: assign immediately to allow driver detection
+
+	concurrentDB.DB().SetMaxOpenConns(app.config.AuxMaxOpenConns)
+	concurrentDB.DB().SetMaxIdleConns(app.config.AuxMaxIdleConns)
+	concurrentDB.DB().SetConnMaxIdleTime(3 * time.Minute)
+
+	var nonconcurrentDB *dbx.DB
+	if IsPostgres(app) {
+		nonconcurrentDB = concurrentDB
+	} else {
+		// SQLite:
+		// Note: SQLite does not allow multiple write connections at the same time.
+		// So we use a separate connection with max open connections limited to 1.
+		db, err := app.config.DBConnect(app.config.PostgresAuxDB)
+		if err != nil {
+			return err
+		}
+		db.DB().SetMaxOpenConns(1)
+		db.DB().SetMaxIdleConns(1)
+		db.DB().SetConnMaxIdleTime(3 * time.Minute)
+		nonconcurrentDB = db
+	}
+
+	app.auxConcurrentDB = concurrentDB
+	app.auxNonconcurrentDB = nonconcurrentDB
+
+	return nil
+}
+
+// @todo remove after refactoring the FilesManager interface
+func supportFiles(m Model) bool {
+	var collection *Collection
+	switch v := m.(type) {
+	case *Collection:
+		collection = v
+	case *Record:
+		collection = v.Collection()
+	case RecordProxy:
+		if v.ProxyRecord() != nil {
+			collection = v.ProxyRecord().Collection()
+		}
+	}
+
+	if collection == nil {
+		return true
+	}
+
+	for _, f := range collection.Fields {
+		if f.Type() == FieldTypeFile {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (app *BaseApp) registerBaseHooks() {
+	deletePrefix := func(prefix string) error {
+		fs, err := app.NewFilesystem()
+		if err != nil {
+			return err
+		}
+		defer fs.Close()
+
+		failed := fs.DeletePrefix(prefix)
+		if len(failed) > 0 {
+			return errors.New("failed to delete the files at " + prefix)
+		}
+
+		return nil
+	}
+
+	maxFilesDeleteWorkers := cast.ToInt64(os.Getenv("PB_FILES_DELETE_MAX_WORKERS"))
+	if maxFilesDeleteWorkers <= 0 {
+		maxFilesDeleteWorkers = 2000 // the value is arbitrary chosen and may change in the future
+	}
+
+	deleteSem := semaphore.NewWeighted(maxFilesDeleteWorkers)
+
+	// try to delete the storage files from deleted Collection, Records, etc. model
+	app.OnModelAfterDeleteSuccess().Bind(&hook.Handler[*ModelEvent]{
+		Id: "__pbFilesManagerDelete__",
+		Func: func(e *ModelEvent) error {
+			if m, ok := e.Model.(FilesManager); ok && m.BaseFilesPath() != "" && supportFiles(e.Model) {
+				// ensure that there is a trailing slash so that the list iterator could start walking from the prefix dir
+				// (https://github.com/pocketbase/pocketbase/discussions/5246#discussioncomment-10128955)
+				prefix := strings.TrimRight(m.BaseFilesPath(), "/") + "/"
+
+				// note: for now assume no context cancellation
+				err := deleteSem.Acquire(context.Background(), 1)
+				if err != nil {
+					app.Logger().Error(
+						"Failed to delete storage prefix (couldn't acquire a worker)",
+						slog.String("prefix", prefix),
+						slog.String("error", err.Error()),
+					)
+				} else {
+					// run in the background for "optimistic" delete to avoid blocking the delete transaction
+					routine.FireAndForget(func() {
+						defer deleteSem.Release(1)
+
+						if err := deletePrefix(prefix); err != nil {
+							app.Logger().Error(
+								"Failed to delete storage prefix (non critical error; usually could happen because of S3 api limits)",
+								slog.String("prefix", prefix),
+								slog.String("error", err.Error()),
+							)
+						}
+					})
+				}
+			}
+
+			return e.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnServe().Bind(&hook.Handler[*ServeEvent]{
+		Id: "__pbCronStart__",
+		Func: func(e *ServeEvent) error {
+			app.Cron().Start()
+
+			return e.Next()
+		},
+		Priority: 999,
+	})
+
+	app.Cron().Add("__pbDBOptimize__", "0 0 * * *", func() {
+		_, execErr := app.NonconcurrentDB().NewQuery("PRAGMA wal_checkpoint(TRUNCATE)").Execute()
+		if execErr != nil {
+			app.Logger().Warn("Failed to run periodic PRAGMA wal_checkpoint for the main DB", slog.String("error", execErr.Error()))
+		}
+
+		_, execErr = app.AuxNonconcurrentDB().NewQuery("PRAGMA wal_checkpoint(TRUNCATE)").Execute()
+		if execErr != nil {
+			app.Logger().Warn("Failed to run periodic PRAGMA wal_checkpoint for the auxiliary DB", slog.String("error", execErr.Error()))
+		}
+
+		_, execErr = app.NonconcurrentDB().NewQuery("PRAGMA optimize").Execute()
+		if execErr != nil {
+			app.Logger().Warn("Failed to run periodic PRAGMA optimize", slog.String("error", execErr.Error()))
+		}
+	})
+
+	app.registerSettingsHooks()
+	app.registerAutobackupHooks()
+	app.registerCollectionHooks()
+	app.registerRecordHooks()
+	app.registerSuperuserHooks()
+	app.registerExternalAuthHooks()
+	app.registerMFAHooks()
+	app.registerOTPHooks()
+	app.registerAuthOriginHooks()
+}
+
+// getLoggerMinLevel returns the logger min level based on the
+// app configurations (dev mode, settings, etc.).
+//
+// If not in dev mode - returns the level from the app settings.
+//
+// If the app is in dev mode it returns -9999 level allowing to print
+// practically all logs to the terminal.
+// In this case DB logs are still filtered but the checks for the min level are done
+// in the BatchOptions.BeforeAddFunc instead of the slog.Handler.Enabled() method.
+func getLoggerMinLevel(app App) slog.Level {
+	var minLevel slog.Level
+
+	if app.IsDev() {
+		minLevel = -99999
+	} else if app.Settings() != nil {
+		minLevel = slog.Level(app.Settings().Logs.MinLevel)
+	}
+
+	return minLevel
+}
+
+func (app *BaseApp) initLogger() error {
+	duration := 3 * time.Second
+	ticker := time.NewTicker(duration)
+	done := make(chan bool, 1)
+
+	handler := logger.NewBatchHandler(logger.BatchOptions{
+		Level:     getLoggerMinLevel(app),
+		BatchSize: 200,
+		BeforeAddFunc: func(ctx context.Context, log *logger.Log) bool {
+			if app.IsDev() {
+				printLog(log)
+
+				// manually check the log level and skip if necessary
+				if log.Level < slog.Level(app.Settings().Logs.MinLevel) {
+					return false
+				}
+			}
+
+			ticker.Reset(duration)
+
+			return app.Settings().Logs.MaxDays > 0
+		},
+		WriteFunc: func(ctx context.Context, logs []*logger.Log) error {
+			if !app.IsBootstrapped() || app.Settings().Logs.MaxDays == 0 {
+				return nil
+			}
+
+			// write the accumulated logs
+			// (note: based on several local tests there is no significant performance difference between small number of separate write queries vs 1 big INSERT)
+			app.AuxRunInTransaction(func(txApp App) error {
+				model := &Log{}
+				for _, l := range logs {
+					model.MarkAsNew()
+					model.Id = GenerateNewUUIDV7()
+					model.Level = int(l.Level)
+					model.Message = l.Message
+					model.Data = l.Data
+					model.Created, _ = types.ParseDateTime(l.Time)
+
+					if err := txApp.AuxSave(model); err != nil {
+						log.Println("Failed to write log", model, err)
+					}
+				}
+
+				return nil
+			})
+
+			return nil
+		},
+	})
+
+	go func() {
+		ctx := context.Background()
+
+		for {
+			select {
+			case <-done:
+				return
+			case <-ticker.C:
+				handler.WriteAll(ctx)
+			}
+		}
+	}()
+
+	app.logger = slog.New(handler)
+
+	// write all remaining logs before ticker.Stop to avoid races with ResetBootstrap user calls
+	app.OnTerminate().Bind(&hook.Handler[*TerminateEvent]{
+		Id: "__pbAppLoggerOnTerminate__",
+		Func: func(e *TerminateEvent) error {
+			handler.WriteAll(context.Background())
+
+			ticker.Stop()
+
+			// don't block in case OnTerminate is triggered more than once
+			select {
+			case done <- true:
+			default:
+			}
+
+			return e.Next()
+		},
+		Priority: -999,
+	})
+
+	// reload log handler level (if initialized)
+	app.OnSettingsReload().Bind(&hook.Handler[*SettingsReloadEvent]{
+		Id: "__pbAppLoggerOnSettingsReload__",
+		Func: func(e *SettingsReloadEvent) error {
+			err := e.Next()
+			if err != nil {
+				return err
+			}
+
+			if e.App.Logger() != nil {
+				if h, ok := e.App.Logger().Handler().(*logger.BatchHandler); ok {
+					h.SetLevel(getLoggerMinLevel(e.App))
+				}
+			}
+
+			// try to clear old logs not matching the new settings
+			createdBefore := types.NowDateTime().AddDate(0, 0, -1*e.App.Settings().Logs.MaxDays)
+			expr := dbx.NewExp("[[created]] <= {:date} OR [[level]] < {:level}", dbx.Params{
+				"date":  createdBefore.String(),
+				"level": e.App.Settings().Logs.MinLevel,
+			})
+			_, err = e.App.AuxNonconcurrentDB().Delete((&Log{}).TableName(), expr).Execute()
+			if err != nil {
+				e.App.Logger().Debug("Failed to cleanup old logs", "error", err)
+			}
+
+			// no logs are allowed -> try to reclaim preserved disk space after the previous delete operation
+			if e.App.Settings().Logs.MaxDays == 0 {
+				err = e.App.AuxVacuum()
+				if err != nil {
+					e.App.Logger().Debug("Failed to VACUUM aux database", "error", err)
+				}
+			}
+
+			return nil
+		},
+		Priority: -999,
+	})
+
+	// cleanup old logs
+	app.Cron().Add("__pbLogsCleanup__", "0 */6 * * *", func() {
+		deleteErr := app.DeleteOldLogs(time.Now().AddDate(0, 0, -1*app.Settings().Logs.MaxDays))
+		if deleteErr != nil {
+			app.Logger().Warn("Failed to delete old logs", "error", deleteErr)
+		}
+	})
+
+	return nil
+}
diff --git a/server/core_backend-server/core/base_backup.go b/server/core_backend-server/core/base_backup.go
new file mode 100644
index 0000000..b0b2f2d
--- /dev/null
+++ b/server/core_backend-server/core/base_backup.go
@@ -0,0 +1,403 @@
+package core
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sort"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/archive"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+const (
+	StoreKeyActiveBackup = "@activeBackup"
+)
+
+// CreateBackup creates a new backup of the current app pb_data directory.
+//
+// If name is empty, it will be autogenerated.
+// If backup with the same name exists, the new backup file will replace it.
+//
+// The backup is executed within a transaction, meaning that new writes
+// will be temporary "blocked" until the backup file is generated.
+//
+// To safely perform the backup, it is recommended to have free disk space
+// for at least 2x the size of the pb_data directory.
+//
+// By default backups are stored in pb_data/backups
+// (the backups directory itself is excluded from the generated backup).
+//
+// When using S3 storage for the uploaded collection files, you have to
+// take care manually to backup those since they are not part of the pb_data.
+//
+// Backups can be stored on S3 if it is configured in app.Settings().Backups.
+func (app *BaseApp) CreateBackup(ctx context.Context, name string) error {
+	if app.Store().Has(StoreKeyActiveBackup) {
+		return errors.New("try again later - another backup/restore operation has already been started")
+	}
+
+	app.Store().Set(StoreKeyActiveBackup, name)
+	defer app.Store().Remove(StoreKeyActiveBackup)
+
+	event := new(BackupEvent)
+	event.App = app
+	event.Context = ctx
+	event.Name = name
+	// default root dir entries to exclude from the backup generation
+	event.Exclude = []string{LocalBackupsDirName, LocalTempDirName, LocalAutocertCacheDirName, lostFoundDirName}
+
+	return app.OnBackupCreate().Trigger(event, func(e *BackupEvent) error {
+		// generate a default name if missing
+		if e.Name == "" {
+			e.Name = generateBackupName(e.App, "pb_backup_")
+		}
+
+		// make sure that the special temp directory exists
+		// note: it needs to be inside the current pb_data to avoid "cross-device link" errors
+		localTempDir := filepath.Join(e.App.DataDir(), LocalTempDirName)
+		if err := os.MkdirAll(localTempDir, os.ModePerm); err != nil {
+			return fmt.Errorf("failed to create a temp dir: %w", err)
+		}
+
+		// archive pb_data in a temp directory, exluding the "backups" and the temp dirs
+		//
+		// run in transaction to temporary block other writes (transactions uses the NonconcurrentDB connection)
+		// ---
+		tempPath := filepath.Join(localTempDir, "pb_backup_"+security.PseudorandomString(6))
+		createErr := e.App.RunInTransaction(func(txApp App) error {
+			return txApp.AuxRunInTransaction(func(txApp App) error {
+				// run manual checkpoint and truncate the WAL files
+				// (errors are ignored because it is not that important and the PRAGMA may not be supported by the used driver)
+				txApp.DB().NewQuery("PRAGMA wal_checkpoint(TRUNCATE)").Execute()
+				txApp.AuxDB().NewQuery("PRAGMA wal_checkpoint(TRUNCATE)").Execute()
+
+				return archive.Create(txApp.DataDir(), tempPath, e.Exclude...)
+			})
+		})
+		if createErr != nil {
+			return createErr
+		}
+		defer os.Remove(tempPath)
+
+		// persist the backup in the backups filesystem
+		// ---
+		fsys, err := e.App.NewBackupsFilesystem()
+		if err != nil {
+			return err
+		}
+		defer fsys.Close()
+
+		fsys.SetContext(e.Context)
+
+		file, err := filesystem.NewFileFromPath(tempPath)
+		if err != nil {
+			return err
+		}
+		file.OriginalName = e.Name
+		file.Name = file.OriginalName
+
+		if err := fsys.UploadFile(file, file.Name); err != nil {
+			return err
+		}
+
+		return nil
+	})
+}
+
+// RestoreBackup restores the backup with the specified name and restarts
+// the current running application process.
+//
+// NB! This feature is experimental and currently is expected to work only on UNIX based systems.
+//
+// To safely perform the restore it is recommended to have free disk space
+// for at least 2x the size of the restored pb_data backup.
+//
+// The performed steps are:
+//
+//  1. Download the backup with the specified name in a temp location
+//     (this is in case of S3; otherwise it creates a temp copy of the zip)
+//
+//  2. Extract the backup in a temp directory inside the app "pb_data"
+//     (eg. "pb_data/.pb_temp_to_delete/pb_restore").
+//
+//  3. Move the current app "pb_data" content (excluding the local backups and the special temp dir)
+//     under another temp sub dir that will be deleted on the next app start up
+//     (eg. "pb_data/.pb_temp_to_delete/old_pb_data").
+//     This is because on some environments it may not be allowed
+//     to delete the currently open "pb_data" files.
+//
+//  4. Move the extracted dir content to the app "pb_data".
+//
+//  5. Restart the app (on successful app bootstap it will also remove the old pb_data).
+//
+// If a failure occure during the restore process the dir changes are reverted.
+// If for whatever reason the revert is not possible, it panics.
+//
+// Note that if your pb_data has custom network mounts as subdirectories, then
+// it is possible the restore to fail during the `os.Rename` operations
+// (see https://github.com/pocketbase/pocketbase/issues/4647).
+func (app *BaseApp) RestoreBackup(ctx context.Context, name string) error {
+	if app.Store().Has(StoreKeyActiveBackup) {
+		return errors.New("try again later - another backup/restore operation has already been started")
+	}
+
+	app.Store().Set(StoreKeyActiveBackup, name)
+	defer app.Store().Remove(StoreKeyActiveBackup)
+
+	event := new(BackupEvent)
+	event.App = app
+	event.Context = ctx
+	event.Name = name
+	// default root dir entries to exclude from the backup restore
+	event.Exclude = []string{LocalBackupsDirName, LocalTempDirName, LocalAutocertCacheDirName, lostFoundDirName}
+
+	return app.OnBackupRestore().Trigger(event, func(e *BackupEvent) error {
+		if runtime.GOOS == "windows" {
+			return errors.New("restore is not supported on Windows")
+		}
+
+		// make sure that the special temp directory exists
+		// note: it needs to be inside the current pb_data to avoid "cross-device link" errors
+		localTempDir := filepath.Join(e.App.DataDir(), LocalTempDirName)
+		if err := os.MkdirAll(localTempDir, os.ModePerm); err != nil {
+			return fmt.Errorf("failed to create a temp dir: %w", err)
+		}
+
+		fsys, err := e.App.NewBackupsFilesystem()
+		if err != nil {
+			return err
+		}
+		defer fsys.Close()
+
+		fsys.SetContext(e.Context)
+
+		if ok, _ := fsys.Exists(name); !ok {
+			return fmt.Errorf("missing or invalid backup file %q to restore", name)
+		}
+
+		extractedDataDir := filepath.Join(localTempDir, "pb_restore_"+security.PseudorandomString(8))
+		defer os.RemoveAll(extractedDataDir)
+
+		// extract the zip
+		if e.App.Settings().Backups.S3.Enabled {
+			br, err := fsys.GetReader(name)
+			if err != nil {
+				return err
+			}
+			defer br.Close()
+
+			// create a temp zip file from the blob.Reader and try to extract it
+			tempZip, err := os.CreateTemp(localTempDir, "pb_restore_zip")
+			if err != nil {
+				return err
+			}
+			defer os.Remove(tempZip.Name())
+			defer tempZip.Close() // note: this technically shouldn't be necessary but it is here to workaround platforms discrepancies
+
+			_, err = io.Copy(tempZip, br)
+			if err != nil {
+				return err
+			}
+
+			err = archive.Extract(tempZip.Name(), extractedDataDir)
+			if err != nil {
+				return err
+			}
+
+			// remove the temp zip file since we no longer need it
+			// (this is in case the app restarts and the defer calls are not called)
+			_ = tempZip.Close()
+			err = os.Remove(tempZip.Name())
+			if err != nil {
+				e.App.Logger().Warn(
+					"[RestoreBackup] Failed to remove the temp zip backup file",
+					slog.String("file", tempZip.Name()),
+					slog.String("error", err.Error()),
+				)
+			}
+		} else {
+			// manually construct the local path to avoid creating a copy of the zip file
+			// since the blob reader currently doesn't implement ReaderAt
+			zipPath := filepath.Join(e.App.DataDir(), LocalBackupsDirName, filepath.Base(name))
+
+			err = archive.Extract(zipPath, extractedDataDir)
+			if err != nil {
+				return err
+			}
+		}
+
+		// ensure that at least a database file exists
+		extractedDB := filepath.Join(extractedDataDir, "data.db")
+		if _, err := os.Stat(extractedDB); err != nil {
+			return fmt.Errorf("data.db file is missing or invalid: %w", err)
+		}
+
+		oldTempDataDir := filepath.Join(localTempDir, "old_pb_data_"+security.PseudorandomString(8))
+
+		replaceErr := e.App.RunInTransaction(func(txApp App) error {
+			return txApp.AuxRunInTransaction(func(txApp App) error {
+				// move the current pb_data content to a special temp location
+				// that will hold the old data between dirs replace
+				// (the temp dir will be automatically removed on the next app start)
+				if err := osutils.MoveDirContent(txApp.DataDir(), oldTempDataDir, e.Exclude...); err != nil {
+					return fmt.Errorf("failed to move the current pb_data content to a temp location: %w", err)
+				}
+
+				// move the extracted archive content to the app's pb_data
+				if err := osutils.MoveDirContent(extractedDataDir, txApp.DataDir(), e.Exclude...); err != nil {
+					return fmt.Errorf("failed to move the extracted archive content to pb_data: %w", err)
+				}
+
+				return nil
+			})
+		})
+		if replaceErr != nil {
+			return replaceErr
+		}
+
+		revertDataDirChanges := func() error {
+			return e.App.RunInTransaction(func(txApp App) error {
+				return txApp.AuxRunInTransaction(func(txApp App) error {
+					if err := osutils.MoveDirContent(txApp.DataDir(), extractedDataDir, e.Exclude...); err != nil {
+						return fmt.Errorf("failed to revert the extracted dir change: %w", err)
+					}
+
+					if err := osutils.MoveDirContent(oldTempDataDir, txApp.DataDir(), e.Exclude...); err != nil {
+						return fmt.Errorf("failed to revert old pb_data dir change: %w", err)
+					}
+
+					return nil
+				})
+			})
+		}
+
+		// restart the app
+		if err := e.App.Restart(); err != nil {
+			if revertErr := revertDataDirChanges(); revertErr != nil {
+				panic(revertErr)
+			}
+
+			return fmt.Errorf("failed to restart the app process: %w", err)
+		}
+
+		return nil
+	})
+}
+
+// registerAutobackupHooks registers the autobackup app serve hooks.
+func (app *BaseApp) registerAutobackupHooks() {
+	const jobId = "__pbAutoBackup__"
+
+	loadJob := func() {
+		rawSchedule := app.Settings().Backups.Cron
+		if rawSchedule == "" {
+			app.Cron().Remove(jobId)
+			return
+		}
+
+		app.Cron().Add(jobId, rawSchedule, func() {
+			const autoPrefix = "@auto_pb_backup_"
+
+			name := generateBackupName(app, autoPrefix)
+
+			if err := app.CreateBackup(context.Background(), name); err != nil {
+				app.Logger().Error(
+					"[Backup cron] Failed to create backup",
+					slog.String("name", name),
+					slog.String("error", err.Error()),
+				)
+			}
+
+			maxKeep := app.Settings().Backups.CronMaxKeep
+
+			if maxKeep == 0 {
+				return // no explicit limit
+			}
+
+			fsys, err := app.NewBackupsFilesystem()
+			if err != nil {
+				app.Logger().Error(
+					"[Backup cron] Failed to initialize the backup filesystem",
+					slog.String("error", err.Error()),
+				)
+				return
+			}
+			defer fsys.Close()
+
+			files, err := fsys.List(autoPrefix)
+			if err != nil {
+				app.Logger().Error(
+					"[Backup cron] Failed to list autogenerated backups",
+					slog.String("error", err.Error()),
+				)
+				return
+			}
+
+			if maxKeep >= len(files) {
+				return // nothing to remove
+			}
+
+			// sort desc
+			sort.Slice(files, func(i, j int) bool {
+				return files[i].ModTime.After(files[j].ModTime)
+			})
+
+			// keep only the most recent n auto backup files
+			toRemove := files[maxKeep:]
+
+			for _, f := range toRemove {
+				if err := fsys.Delete(f.Key); err != nil {
+					app.Logger().Error(
+						"[Backup cron] Failed to remove old autogenerated backup",
+						slog.String("key", f.Key),
+						slog.String("error", err.Error()),
+					)
+				}
+			}
+		})
+	}
+
+	app.OnBootstrap().BindFunc(func(e *BootstrapEvent) error {
+		if err := e.Next(); err != nil {
+			return err
+		}
+
+		loadJob()
+
+		return nil
+	})
+
+	app.OnSettingsReload().BindFunc(func(e *SettingsReloadEvent) error {
+		if err := e.Next(); err != nil {
+			return err
+		}
+
+		loadJob()
+
+		return nil
+	})
+}
+
+func generateBackupName(app App, prefix string) string {
+	appName := inflector.Snakecase(app.Settings().Meta.AppName)
+	if len(appName) > 50 {
+		appName = appName[:50]
+	}
+
+	return fmt.Sprintf(
+		"%s%s_%s.zip",
+		prefix,
+		appName,
+		time.Now().UTC().Format("20060102150405"),
+	)
+}
diff --git a/server/core_backend-server/core/base_backup_test.go b/server/core_backend-server/core/base_backup_test.go
new file mode 100644
index 0000000..b7cf6ed
--- /dev/null
+++ b/server/core_backend-server/core/base_backup_test.go
@@ -0,0 +1,170 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/archive"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+// Backup in SQLite just copies the data.db file.
+// But for PostgreSQL, there are many good tools: postgres-backup-s3 or pgbackrest
+// So we disable it.
+func disabled_TestCreateBackup(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// set some long app name with spaces and special characters
+	app.Settings().Meta.AppName = "test @! " + strings.Repeat("a", 100)
+
+	expectedAppNamePrefix := "test_" + strings.Repeat("a", 45)
+
+	// test pending error
+	app.Store().Set(core.StoreKeyActiveBackup, "")
+	if err := app.CreateBackup(context.Background(), "test.zip"); err == nil {
+		t.Fatal("Expected pending error, got nil")
+	}
+	app.Store().Remove(core.StoreKeyActiveBackup)
+
+	// create with auto generated name
+	if err := app.CreateBackup(context.Background(), ""); err != nil {
+		t.Fatal("Failed to create a backup with autogenerated name", err)
+	}
+
+	// create with custom name
+	if err := app.CreateBackup(context.Background(), "custom"); err != nil {
+		t.Fatal("Failed to create a backup with custom name")
+	}
+
+	// create new with the same name (aka. replace)
+	if err := app.CreateBackup(context.Background(), "custom"); err != nil {
+		t.Fatal("Failed to create and replace a backup with the same name")
+	}
+
+	backupsDir := filepath.Join(app.DataDir(), core.LocalBackupsDirName)
+
+	entries, err := os.ReadDir(backupsDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expectedFiles := []string{
+		`^pb_backup_` + expectedAppNamePrefix + `_\w+\.zip$`,
+		`^pb_backup_` + expectedAppNamePrefix + `_\w+\.zip.attrs$`,
+		"custom",
+		"custom.attrs",
+	}
+
+	if len(entries) != len(expectedFiles) {
+		names := getEntryNames(entries)
+		t.Fatalf("Expected %d backup files, got %d: \n%v", len(expectedFiles), len(entries), names)
+	}
+
+	for i, entry := range entries {
+		if !list.ExistInSliceWithRegex(entry.Name(), expectedFiles) {
+			t.Fatalf("[%d] Missing backup file %q", i, entry.Name())
+		}
+
+		if strings.HasSuffix(entry.Name(), ".attrs") {
+			continue
+		}
+
+		path := filepath.Join(backupsDir, entry.Name())
+
+		if err := verifyBackupContent(app, path); err != nil {
+			t.Fatalf("[%d] Failed to verify backup content: %v", i, err)
+		}
+	}
+}
+
+// Backup in SQLite just copies the data.db file.
+// But for PostgreSQL, there are many good tools: postgres-backup-s3 or pgbackrest
+// So we disable it.
+func disabled_TestRestoreBackup(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// create a initial test backup to ensure that there are at least 1
+	// backup file and that the generated zip doesn't contain the backups dir
+	if err := app.CreateBackup(context.Background(), "initial"); err != nil {
+		t.Fatal("Failed to create test initial backup")
+	}
+
+	// create test backup
+	if err := app.CreateBackup(context.Background(), "test"); err != nil {
+		t.Fatal("Failed to create test backup")
+	}
+
+	// test pending error
+	app.Store().Set(core.StoreKeyActiveBackup, "")
+	if err := app.RestoreBackup(context.Background(), "test"); err == nil {
+		t.Fatal("Expected pending error, got nil")
+	}
+	app.Store().Remove(core.StoreKeyActiveBackup)
+
+	// missing backup
+	if err := app.RestoreBackup(context.Background(), "missing"); err == nil {
+		t.Fatal("Expected missing error, got nil")
+	}
+}
+
+// -------------------------------------------------------------------
+
+func verifyBackupContent(app core.App, path string) error {
+	dir, err := os.MkdirTemp("", "backup_test")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(dir)
+
+	if err := archive.Extract(path, dir); err != nil {
+		return err
+	}
+
+	expectedRootEntries := []string{
+		"storage",
+		"data.db",
+		"data.db-shm",
+		"data.db-wal",
+		"auxiliary.db",
+		"auxiliary.db-shm",
+		"auxiliary.db-wal",
+		".gitignore",
+	}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return err
+	}
+
+	if len(entries) != len(expectedRootEntries) {
+		names := getEntryNames(entries)
+		return fmt.Errorf("Expected %d backup files, got %d: \n%v", len(expectedRootEntries), len(entries), names)
+	}
+
+	for _, entry := range entries {
+		if !list.ExistInSliceWithRegex(entry.Name(), expectedRootEntries) {
+			return fmt.Errorf("Didn't expect %q entry", entry.Name())
+		}
+	}
+
+	return nil
+}
+
+func getEntryNames(entries []fs.DirEntry) []string {
+	names := make([]string, len(entries))
+
+	for i, entry := range entries {
+		names[i] = entry.Name()
+	}
+
+	return names
+}
diff --git a/server/core_backend-server/core/base_test.go b/server/core_backend-server/core/base_test.go
new file mode 100644
index 0000000..f756b03
--- /dev/null
+++ b/server/core_backend-server/core/base_test.go
@@ -0,0 +1,588 @@
+package core_test
+
+import (
+	"context"
+	"database/sql"
+	"log/slog"
+	"os"
+	"slices"
+	"testing"
+	"time"
+
+	_ "unsafe"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/logger"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+)
+
+func TestNewBaseApp(t *testing.T) {
+	const testDataDir = "./pb_base_app_test_data_dir/"
+	defer os.RemoveAll(testDataDir)
+
+	app, cleanup := core.NewBaseAppForTest(core.BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "test_env",
+		IsDev:         true,
+	})
+	defer cleanup()
+
+	if app.DataDir() != testDataDir {
+		t.Fatalf("expected DataDir %q, got %q", testDataDir, app.DataDir())
+	}
+
+	if app.EncryptionEnv() != "test_env" {
+		t.Fatalf("expected EncryptionEnv test_env, got %q", app.EncryptionEnv())
+	}
+
+	if !app.IsDev() {
+		t.Fatalf("expected IsDev true, got %v", app.IsDev())
+	}
+
+	if app.Store() == nil {
+		t.Fatal("expected Store to be set, got nil")
+	}
+
+	if app.Settings() == nil {
+		t.Fatal("expected Settings to be set, got nil")
+	}
+
+	if app.SubscriptionsBroker() == nil {
+		t.Fatal("expected SubscriptionsBroker to be set, got nil")
+	}
+
+	if app.Cron() == nil {
+		t.Fatal("expected Cron to be set, got nil")
+	}
+}
+
+func TestBaseAppBootstrap(t *testing.T) {
+	const testDataDir = "./pb_base_app_test_data_dir/"
+	defer os.RemoveAll(testDataDir)
+
+	app, cleanup := core.NewBaseAppForTest(core.BaseAppConfig{
+		DataDir: testDataDir,
+	})
+	defer app.ResetBootstrapState()
+	defer cleanup()
+
+	if app.IsBootstrapped() {
+		t.Fatal("Didn't expect the application to be bootstrapped.")
+	}
+
+	if err := app.Bootstrap(); err != nil {
+		t.Fatal(err)
+	}
+
+	if !app.IsBootstrapped() {
+		t.Fatal("Expected the application to be bootstrapped.")
+	}
+
+	if stat, err := os.Stat(testDataDir); err != nil || !stat.IsDir() {
+		t.Fatal("Expected test data directory to be created.")
+	}
+
+	type nilCheck struct {
+		name      string
+		value     any
+		expectNil bool
+	}
+
+	runNilChecks := func(checks []nilCheck) {
+		for _, check := range checks {
+			t.Run(check.name, func(t *testing.T) {
+				isNil := check.value == nil
+				if isNil != check.expectNil {
+					t.Fatalf("Expected isNil %v, got %v", check.expectNil, isNil)
+				}
+			})
+		}
+	}
+
+	nilChecksBeforeReset := []nilCheck{
+		{"[before] db", app.DB(), false},
+		{"[before] concurrentDB", app.ConcurrentDB(), false},
+		{"[before] nonconcurrentDB", app.NonconcurrentDB(), false},
+		{"[before] auxDB", app.AuxDB(), false},
+		{"[before] auxConcurrentDB", app.AuxConcurrentDB(), false},
+		{"[before] auxNonconcurrentDB", app.AuxNonconcurrentDB(), false},
+		{"[before] settings", app.Settings(), false},
+		{"[before] logger", app.Logger(), false},
+		{"[before] cached collections", app.Store().Get(core.StoreKeyCachedCollections), false},
+	}
+
+	runNilChecks(nilChecksBeforeReset)
+
+	// reset
+	if err := app.ResetBootstrapState(); err != nil {
+		t.Fatal(err)
+	}
+
+	nilChecksAfterReset := []nilCheck{
+		{"[after] db", app.DB(), true},
+		{"[after] concurrentDB", app.ConcurrentDB(), true},
+		{"[after] nonconcurrentDB", app.NonconcurrentDB(), true},
+		{"[after] auxDB", app.AuxDB(), true},
+		{"[after] auxConcurrentDB", app.AuxConcurrentDB(), true},
+		{"[after] auxNonconcurrentDB", app.AuxNonconcurrentDB(), true},
+		{"[after] settings", app.Settings(), false},
+		{"[after] logger", app.Logger(), false},
+		{"[after] cached collections", app.Store().Get(core.StoreKeyCachedCollections), false},
+	}
+
+	runNilChecks(nilChecksAfterReset)
+}
+
+func TestNewBaseAppTx(t *testing.T) {
+	const testDataDir = "./pb_base_app_test_data_dir/"
+	defer os.RemoveAll(testDataDir)
+
+	app, cleanup := core.NewBaseAppForTest(core.BaseAppConfig{
+		DataDir: testDataDir,
+	})
+	defer cleanup()
+
+	if err := app.Bootstrap(); err != nil {
+		t.Fatal(err)
+	}
+
+	mustNotHaveTx := func(app core.App) {
+		if app.IsTransactional() {
+			t.Fatalf("Didn't expect the app to be transactional")
+		}
+
+		if app.TxInfo() != nil {
+			t.Fatalf("Didn't expect the app.txInfo to be loaded")
+		}
+	}
+
+	mustHaveTx := func(app core.App) {
+		if !app.IsTransactional() {
+			t.Fatalf("Expected the app to be transactional")
+		}
+
+		if app.TxInfo() == nil {
+			t.Fatalf("Expected the app.txInfo to be loaded")
+		}
+	}
+
+	mustNotHaveTx(app)
+
+	app.RunInTransaction(func(txApp core.App) error {
+		mustHaveTx(txApp)
+		return nil
+	})
+
+	mustNotHaveTx(app)
+}
+
+func TestBaseAppNewMailClient(t *testing.T) {
+	const testDataDir = "./pb_base_app_test_data_dir/"
+	defer os.RemoveAll(testDataDir)
+
+	app, cleanup := core.NewBaseAppForTest(core.BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+	})
+	defer cleanup()
+
+	client1 := app.NewMailClient()
+	m1, ok := client1.(*mailer.Sendmail)
+	if !ok {
+		t.Fatalf("Expected mailer.Sendmail instance, got %v", m1)
+	}
+	if m1.OnSend() == nil || m1.OnSend().Length() == 0 {
+		t.Fatal("Expected OnSend hook to be registered")
+	}
+
+	app.Settings().SMTP.Enabled = true
+
+	client2 := app.NewMailClient()
+	m2, ok := client2.(*mailer.SMTPClient)
+	if !ok {
+		t.Fatalf("Expected mailer.SMTPClient instance, got %v", m2)
+	}
+	if m2.OnSend() == nil || m2.OnSend().Length() == 0 {
+		t.Fatal("Expected OnSend hook to be registered")
+	}
+}
+
+func TestBaseAppNewFilesystem(t *testing.T) {
+	const testDataDir = "./pb_base_app_test_data_dir/"
+	defer os.RemoveAll(testDataDir)
+
+	app, cleanup := core.NewBaseAppForTest(core.BaseAppConfig{
+		DataDir: testDataDir,
+	})
+	defer cleanup()
+
+	// local
+	local, localErr := app.NewFilesystem()
+	if localErr != nil {
+		t.Fatal(localErr)
+	}
+	if local == nil {
+		t.Fatal("Expected local filesystem instance, got nil")
+	}
+
+	// misconfigured s3
+	app.Settings().S3.Enabled = true
+	s3, s3Err := app.NewFilesystem()
+	if s3Err == nil {
+		t.Fatal("Expected S3 error, got nil")
+	}
+	if s3 != nil {
+		t.Fatalf("Expected nil s3 filesystem, got %v", s3)
+	}
+}
+
+func TestBaseAppNewBackupsFilesystem(t *testing.T) {
+	const testDataDir = "./pb_base_app_test_data_dir/"
+	defer os.RemoveAll(testDataDir)
+
+	app, cleanup := core.NewBaseAppForTest(core.BaseAppConfig{
+		DataDir: testDataDir,
+	})
+	defer cleanup()
+
+	// local
+	local, localErr := app.NewBackupsFilesystem()
+	if localErr != nil {
+		t.Fatal(localErr)
+	}
+	if local == nil {
+		t.Fatal("Expected local backups filesystem instance, got nil")
+	}
+
+	// misconfigured s3
+	app.Settings().Backups.S3.Enabled = true
+	s3, s3Err := app.NewBackupsFilesystem()
+	if s3Err == nil {
+		t.Fatal("Expected S3 error, got nil")
+	}
+	if s3 != nil {
+		t.Fatalf("Expected nil s3 backups filesystem, got %v", s3)
+	}
+}
+
+func TestBaseAppLoggerWrites(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// reset
+	if err := app.DeleteOldLogs(time.Now()); err != nil {
+		t.Fatal(err)
+	}
+
+	const logsThreshold = 200
+
+	totalLogs := func(app core.App, t *testing.T) int {
+		var total int
+
+		err := app.LogQuery().Select("count(*)").Row(&total)
+		if err != nil {
+			t.Fatalf("Failed to fetch total logs: %v", err)
+		}
+
+		return total
+	}
+
+	t.Run("disabled logs retention", func(t *testing.T) {
+		app.Settings().Logs.MaxDays = 0
+
+		for i := 0; i < logsThreshold+1; i++ {
+			app.Logger().Error("test")
+		}
+
+		if total := totalLogs(app, t); total != 0 {
+			t.Fatalf("Expected no logs, got %d", total)
+		}
+	})
+
+	t.Run("test batch logs writes", func(t *testing.T) {
+		app.Settings().Logs.MaxDays = 1
+
+		for i := 0; i < logsThreshold-1; i++ {
+			app.Logger().Error("test")
+		}
+
+		if total := totalLogs(app, t); total != 0 {
+			t.Fatalf("Expected no logs, got %d", total)
+		}
+
+		// should trigger batch write
+		app.Logger().Error("test")
+
+		// should be added for the next batch write
+		app.Logger().Error("test")
+
+		if total := totalLogs(app, t); total != logsThreshold {
+			t.Fatalf("Expected %d logs, got %d", logsThreshold, total)
+		}
+
+		// wait for ~3 secs to check the timer trigger
+		time.Sleep(3200 * time.Millisecond)
+		if total := totalLogs(app, t); total != logsThreshold+1 {
+			t.Fatalf("Expected %d logs, got %d", logsThreshold+1, total)
+		}
+	})
+}
+
+func TestBaseAppRefreshSettingsLoggerMinLevelEnabled(t *testing.T) {
+	scenarios := []struct {
+		name  string
+		isDev bool
+		level int
+		// level->enabled map
+		expectations map[int]bool
+	}{
+		{
+			"dev mode",
+			true,
+			4,
+			map[int]bool{
+				3: true,
+				4: true,
+				5: true,
+			},
+		},
+		{
+			"nondev mode",
+			false,
+			4,
+			map[int]bool{
+				3: false,
+				4: true,
+				5: true,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			const testDataDir = "./pb_base_app_test_data_dir/"
+			defer os.RemoveAll(testDataDir)
+
+			app, cleanup := core.NewBaseAppForTest(core.BaseAppConfig{
+				DataDir: testDataDir,
+				IsDev:   s.isDev,
+			})
+			defer cleanup()
+
+			if err := app.Bootstrap(); err != nil {
+				t.Fatal(err)
+			}
+
+			// silence query logs
+			app.ConcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {}
+			app.ConcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {}
+			app.NonconcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {}
+			app.NonconcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {}
+
+			handler, ok := app.Logger().Handler().(*logger.BatchHandler)
+			if !ok {
+				t.Fatalf("Expected BatchHandler, got %v", app.Logger().Handler())
+			}
+
+			app.Settings().Logs.MinLevel = s.level
+
+			if err := app.Save(app.Settings()); err != nil {
+				t.Fatalf("Failed to save settings: %v", err)
+			}
+
+			for level, enabled := range s.expectations {
+				if v := handler.Enabled(context.Background(), slog.Level(level)); v != enabled {
+					t.Fatalf("Expected level %d Enabled() to be %v, got %v", level, enabled, v)
+				}
+			}
+		})
+	}
+}
+
+func TestBaseAppDBDualBuilder(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	concurrentQueries := []string{}
+	nonconcurrentQueries := []string{}
+	app.ConcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		concurrentQueries = append(concurrentQueries, sql)
+	}
+	app.ConcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		concurrentQueries = append(concurrentQueries, sql)
+	}
+	app.NonconcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		nonconcurrentQueries = append(nonconcurrentQueries, sql)
+	}
+	app.NonconcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		nonconcurrentQueries = append(nonconcurrentQueries, sql)
+	}
+
+	type testQuery struct {
+		query        string
+		isConcurrent bool
+	}
+
+	regularTests := []testQuery{
+		{"  \n  sEleCt 1", true},
+		{"With abc(x) AS (select 2) SELECT x FROM abc", true},
+		{"create table t1(x int)", false},
+		{"insert into t1(x) values(1)", false},
+		{"update t1 set x = 2", false},
+		{"delete from t1", false},
+	}
+
+	txTests := []testQuery{
+		{"select 3", false},
+		{" \n WITH abc(x) AS (select 4) SELECT x FROM abc", false},
+		{"create table t2(x int)", false},
+		{"insert into t2(x) values(1)", false},
+		{"update t2 set x = 2", false},
+		{"delete from t2", false},
+	}
+
+	for _, item := range regularTests {
+		_, err := app.DB().NewQuery(item.query).Execute()
+		if err != nil {
+			t.Fatalf("Failed to execute query %q error: %v", item.query, err)
+		}
+	}
+
+	app.RunInTransaction(func(txApp core.App) error {
+		for _, item := range txTests {
+			_, err := txApp.DB().NewQuery(item.query).Execute()
+			if err != nil {
+				t.Fatalf("Failed to execute query %q error: %v", item.query, err)
+			}
+		}
+
+		return nil
+	})
+
+	allTests := append(regularTests, txTests...)
+	for _, item := range allTests {
+		/* SQLite:
+		if item.isConcurrent {
+		*/
+		// PostgreSQL:
+		// Note:
+		// In SQLite, we have to seperate concurrent and nonconcurrent queries because
+		// SQLite does not allow connurrent write operations.
+		// But in PostgreSQL allows concurrent write operations.
+		if 1 == -1 {
+			if !slices.Contains(concurrentQueries, item.query) {
+				t.Fatalf("Expected concurrent query\n%q\ngot\nconcurrent:%v\nnonconcurrent:%v", item.query, concurrentQueries, nonconcurrentQueries)
+			}
+		} else {
+			if !slices.Contains(nonconcurrentQueries, item.query) {
+				t.Fatalf("Expected nonconcurrent query\n%q\ngot\nconcurrent:%v\nnonconcurrent:%v", item.query, concurrentQueries, nonconcurrentQueries)
+			}
+		}
+	}
+}
+
+func TestBaseAppAuxDBDualBuilder(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	concurrentQueries := []string{}
+	nonconcurrentQueries := []string{}
+	app.AuxConcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		concurrentQueries = append(concurrentQueries, sql)
+	}
+	app.AuxConcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		concurrentQueries = append(concurrentQueries, sql)
+	}
+	app.AuxNonconcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		nonconcurrentQueries = append(nonconcurrentQueries, sql)
+	}
+	app.AuxNonconcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		nonconcurrentQueries = append(nonconcurrentQueries, sql)
+	}
+
+	type testQuery struct {
+		query        string
+		isConcurrent bool
+	}
+
+	regularTests := []testQuery{
+		{"  \n  sEleCt 1", true},
+		{"With abc(x) AS (select 2) SELECT x FROM abc", true},
+		{"create table t1(x int)", false},
+		{"insert into t1(x) values(1)", false},
+		{"update t1 set x = 2", false},
+		{"delete from t1", false},
+	}
+
+	txTests := []testQuery{
+		{"select 3", false},
+		{" \n WITH abc(x) AS (select 4) SELECT x FROM abc", false},
+		{"create table t2(x int)", false},
+		{"insert into t2(x) values(1)", false},
+		{"update t2 set x = 2", false},
+		{"delete from t2", false},
+	}
+
+	for _, item := range regularTests {
+		_, err := app.AuxDB().NewQuery(item.query).Execute()
+		if err != nil {
+			t.Fatalf("Failed to execute query %q error: %v", item.query, err)
+		}
+	}
+
+	app.AuxRunInTransaction(func(txApp core.App) error {
+		for _, item := range txTests {
+			_, err := txApp.AuxDB().NewQuery(item.query).Execute()
+			if err != nil {
+				t.Fatalf("Failed to execute query %q error: %v", item.query, err)
+			}
+		}
+
+		return nil
+	})
+
+	allTests := append(regularTests, txTests...)
+	for _, item := range allTests {
+		/* SQLite:
+		if item.isConcurrent {
+		*/
+		// PostgreSQL:
+		// Note:
+		// In SQLite, we have to seperate concurrent and nonconcurrent queries because
+		// SQLite does not allow connurrent write operations.
+		// But in PostgreSQL allows concurrent write operations.
+		if 1 == -1 {
+			if !slices.Contains(concurrentQueries, item.query) {
+				t.Fatalf("Expected concurrent query\n%q\ngot\nconcurrent:%v\nnonconcurrent:%v", item.query, concurrentQueries, nonconcurrentQueries)
+			}
+		} else {
+			if !slices.Contains(nonconcurrentQueries, item.query) {
+				t.Fatalf("Expected nonconcurrent query\n%q\ngot\nconcurrent:%v\nnonconcurrent:%v", item.query, concurrentQueries, nonconcurrentQueries)
+			}
+		}
+	}
+}
+
+func TestBaseAppTriggerOnTerminate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	event := new(core.TerminateEvent)
+	event.App = app
+
+	// trigger OnTerminate multiple times to ensure that it doesn't deadlock
+	// https://github.com/pocketbase/pocketbase/pull/7305
+	app.OnTerminate().Trigger(event)
+	app.OnTerminate().Trigger(event)
+	app.OnTerminate().Trigger(event)
+}
diff --git a/server/core_backend-server/core/collection_import.go b/server/core_backend-server/core/collection_import.go
new file mode 100644
index 0000000..7359bc6
--- /dev/null
+++ b/server/core_backend-server/core/collection_import.go
@@ -0,0 +1,213 @@
+package core
+
+import (
+	"cmp"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/spf13/cast"
+)
+
+// ImportCollectionsByMarshaledJSON is the same as [ImportCollections]
+// but accept marshaled json array as import data (usually used for the autogenerated snapshots).
+func (app *BaseApp) ImportCollectionsByMarshaledJSON(rawSliceOfMaps []byte, deleteMissing bool) error {
+	data := []map[string]any{}
+
+	err := json.Unmarshal(rawSliceOfMaps, &data)
+	if err != nil {
+		return err
+	}
+
+	return app.ImportCollections(data, deleteMissing)
+}
+
+// ImportCollections imports the provided collections data in a single transaction.
+//
+// For existing matching collections, the imported data is unmarshaled on top of the existing model.
+//
+// NB! If deleteMissing is true, ALL NON-SYSTEM COLLECTIONS AND SCHEMA FIELDS,
+// that are not present in the imported configuration, WILL BE DELETED
+// (this includes their related records data).
+func (app *BaseApp) ImportCollections(toImport []map[string]any, deleteMissing bool) error {
+	if len(toImport) == 0 {
+		// prevent accidentally deleting all collections
+		return errors.New("no collections to import")
+	}
+
+	importedCollections := make([]*Collection, len(toImport))
+	mappedImported := make(map[string]*Collection, len(toImport))
+
+	// normalize imported collections data to ensure that all
+	// collection fields are present and properly initialized
+	for i, data := range toImport {
+		var imported *Collection
+
+		identifier := cast.ToString(data["id"])
+		if identifier == "" {
+			identifier = cast.ToString(data["name"])
+		}
+
+		existing, err := app.FindCollectionByNameOrId(identifier)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			return err
+		}
+
+		if existing != nil {
+			// refetch for deep copy
+			imported, err = app.FindCollectionByNameOrId(existing.Id)
+			if err != nil {
+				return err
+			}
+
+			// ensure that the fields will be cleared
+			if data["fields"] == nil && deleteMissing {
+				data["fields"] = []map[string]any{}
+			}
+
+			rawData, err := json.Marshal(data)
+			if err != nil {
+				return err
+			}
+
+			// load the imported data
+			err = json.Unmarshal(rawData, imported)
+			if err != nil {
+				return err
+			}
+
+			// extend with the existing fields if necessary
+			for _, f := range existing.Fields {
+				if !f.GetSystem() && deleteMissing {
+					continue
+				}
+				if imported.Fields.GetById(f.GetId()) == nil {
+					// replace with the existing id to prevent accidental column deletion
+					// since otherwise the imported field will be treated as a new one
+					found := imported.Fields.GetByName(f.GetName())
+					if found != nil && found.Type() == f.Type() {
+						found.SetId(f.GetId())
+					}
+					imported.Fields.Add(f)
+				}
+			}
+		} else {
+			imported = &Collection{}
+
+			rawData, err := json.Marshal(data)
+			if err != nil {
+				return err
+			}
+
+			// load the imported data
+			err = json.Unmarshal(rawData, imported)
+			if err != nil {
+				return err
+			}
+		}
+
+		imported.IntegrityChecks(false)
+
+		importedCollections[i] = imported
+		mappedImported[imported.Id] = imported
+	}
+
+	// reorder views last since the view query could depend on some of the other collections
+	slices.SortStableFunc(importedCollections, func(a, b *Collection) int {
+		cmpA := -1
+		if a.IsView() {
+			cmpA = 1
+		}
+
+		cmpB := -1
+		if b.IsView() {
+			cmpB = 1
+		}
+
+		res := cmp.Compare(cmpA, cmpB)
+		if res == 0 {
+			res = a.Created.Compare(b.Created)
+			if res == 0 {
+				res = a.Updated.Compare(b.Updated)
+			}
+		}
+		return res
+	})
+
+	return app.RunInTransaction(func(txApp App) error {
+		existingCollections := []*Collection{}
+		if err := txApp.CollectionQuery().OrderBy("updated ASC").All(&existingCollections); err != nil {
+			return err
+		}
+		mappedExisting := make(map[string]*Collection, len(existingCollections))
+		for _, existing := range existingCollections {
+			existing.IntegrityChecks(false)
+			mappedExisting[existing.Id] = existing
+		}
+
+		// delete old collections not available in the new configuration
+		// (before saving the imports in case a deleted collection name is being reused)
+		if deleteMissing {
+			for _, existing := range existingCollections {
+				if mappedImported[existing.Id] != nil || existing.System {
+					continue // exist or system
+				}
+
+				// PostgreSQL Only:
+				// Note: since postgres won't allow dropping a table/view if they are referenced
+				// by another view, we need to drop the dependent views first.
+				dependentViews, err := findDependentViews(txApp, existing.Name)
+				if err != nil {
+					return err
+				}
+				for i := len(dependentViews) - 1; i >= 0; i-- {
+					if err := txApp.DeleteView(dependentViews[i].Name); err != nil {
+						return fmt.Errorf("failed to drop view %q: %w", dependentViews[i].Name, err)
+					}
+				}
+
+				// delete collection
+				if err := txApp.Delete(existing); err != nil {
+					return err
+				}
+			}
+		}
+
+		// upsert imported collections
+		for _, imported := range importedCollections {
+			if err := txApp.SaveNoValidate(imported); err != nil {
+				return fmt.Errorf("failed to save collection %q: %w", imported.Name, err)
+			}
+		}
+
+		// run validations
+		for _, imported := range importedCollections {
+			original := mappedExisting[imported.Id]
+			if original == nil {
+				original = imported
+			}
+
+			validator := newCollectionValidator(
+				context.Background(),
+				txApp,
+				imported,
+				original,
+			)
+			if err := validator.run(); err != nil {
+				// serialize the validation error(s)
+				serializedErr, _ := json.MarshalIndent(err, "", "  ")
+
+				return validation.Errors{"collections": validation.NewError(
+					"validation_collections_import_failure",
+					fmt.Sprintf("Data validations failed for collection %q (%s):\n%s", imported.Name, imported.Id, serializedErr),
+				)}
+			}
+		}
+
+		return nil
+	})
+}
diff --git a/server/core_backend-server/core/collection_import_test.go b/server/core_backend-server/core/collection_import_test.go
new file mode 100644
index 0000000..5f3aac5
--- /dev/null
+++ b/server/core_backend-server/core/collection_import_test.go
@@ -0,0 +1,479 @@
+package core_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestImportCollections(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	var regularCollections []*core.Collection
+	err := testApp.CollectionQuery().AndWhere(dbx.HashExp{"system": false}).All(&regularCollections)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var systemCollections []*core.Collection
+	err = testApp.CollectionQuery().AndWhere(dbx.HashExp{"system": true}).All(&systemCollections)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	totalRegularCollections := len(regularCollections)
+	totalSystemCollections := len(systemCollections)
+	totalCollections := totalRegularCollections + totalSystemCollections
+
+	scenarios := []struct {
+		name                   string
+		data                   []map[string]any
+		deleteMissing          bool
+		expectError            bool
+		expectCollectionsCount int
+		afterTestFunc          func(testApp *tests.TestApp, resultCollections []*core.Collection)
+	}{
+		{
+			name:                   "empty collections",
+			data:                   []map[string]any{},
+			expectError:            true,
+			expectCollectionsCount: totalCollections,
+		},
+		{
+			name: "minimal collection import (with missing system fields)",
+			data: []map[string]any{
+				{"name": "import_test1", "type": "auth"},
+				{
+					"name": "import_test2", "fields": []map[string]any{
+						{"name": "test", "type": "text"},
+					},
+				},
+			},
+			deleteMissing:          false,
+			expectError:            false,
+			expectCollectionsCount: totalCollections + 2,
+		},
+		{
+			name: "minimal collection import (trigger collection model validations)",
+			data: []map[string]any{
+				{"name": ""},
+				{
+					"name": "import_test2", "fields": []map[string]any{
+						{"name": "test", "type": "text"},
+					},
+				},
+			},
+			deleteMissing:          false,
+			expectError:            true,
+			expectCollectionsCount: totalCollections,
+		},
+		{
+			name: "minimal collection import (trigger field settings validation)",
+			data: []map[string]any{
+				{"name": "import_test", "fields": []map[string]any{{"name": "test", "type": "text", "min": -1}}},
+			},
+			deleteMissing:          false,
+			expectError:            true,
+			expectCollectionsCount: totalCollections,
+		},
+		{
+			name: "new + update + delete (system collections delete should be ignored)",
+			data: []map[string]any{
+				{
+					"id":   "wsmn24bux7wo113",
+					"name": "demo",
+					"fields": []map[string]any{
+						{
+							"id":       "_2hlxbmp",
+							"name":     "title",
+							"type":     "text",
+							"system":   false,
+							"required": true,
+							"min":      3,
+							"max":      nil,
+							"pattern":  "",
+						},
+					},
+					"indexes": []string{},
+				},
+				{
+					"name": "import1",
+					"fields": []map[string]any{
+						{
+							"name": "active",
+							"type": "bool",
+						},
+					},
+				},
+			},
+			deleteMissing:          true,
+			expectError:            false,
+			expectCollectionsCount: totalSystemCollections + 2,
+		},
+		{
+			name: "test with deleteMissing: false",
+			data: []map[string]any{
+				{
+					// "id":   "wsmn24bux7wo113", // test update with only name as identifier
+					"name": "demo1",
+					"fields": []map[string]any{
+						{
+							"id":       "_2hlxbmp",
+							"name":     "title",
+							"type":     "text",
+							"system":   false,
+							"required": true,
+							"min":      3,
+							"max":      nil,
+							"pattern":  "",
+						},
+						{
+							"id":       "_2hlxbmp",
+							"name":     "field_with_duplicate_id",
+							"type":     "text",
+							"system":   false,
+							"required": true,
+							"unique":   false,
+							"min":      4,
+							"max":      nil,
+							"pattern":  "",
+						},
+						{
+							"id":   "abcd_import",
+							"name": "new_field",
+							"type": "text",
+						},
+					},
+				},
+				{
+					"name": "new_import",
+					"fields": []map[string]any{
+						{
+							"id":   "abcd_import",
+							"name": "active",
+							"type": "bool",
+						},
+					},
+				},
+			},
+			deleteMissing:          false,
+			expectError:            false,
+			expectCollectionsCount: totalCollections + 1,
+			afterTestFunc: func(testApp *tests.TestApp, resultCollections []*core.Collection) {
+				expectedCollectionFields := map[string]int{
+					core.CollectionNameAuthOrigins: 6,
+					"nologin":                      10,
+					"demo1":                        19,
+					"demo2":                        5,
+					"demo3":                        5,
+					"demo4":                        16,
+					"demo5":                        9,
+					"new_import":                   2,
+				}
+				for name, expectedCount := range expectedCollectionFields {
+					collection, err := testApp.FindCollectionByNameOrId(name)
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					if totalFields := len(collection.Fields); totalFields != expectedCount {
+						t.Errorf("Expected %d %q fields, got %d", expectedCount, collection.Name, totalFields)
+					}
+				}
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
+
+			err := testApp.ImportCollections(s.data, s.deleteMissing)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			// check collections count
+			collections := []*core.Collection{}
+			if err := testApp.CollectionQuery().All(&collections); err != nil {
+				t.Fatal(err)
+			}
+			for _, collection := range collections {
+				println(collection.Name, collection.Id)
+			}
+			if len(collections) != s.expectCollectionsCount {
+				t.Fatalf("Expected %d collections, got %d", s.expectCollectionsCount, len(collections))
+			}
+
+			if s.afterTestFunc != nil {
+				s.afterTestFunc(testApp, collections)
+			}
+		})
+	}
+}
+
+func TestImportCollectionsByMarshaledJSON(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	var regularCollections []*core.Collection
+	err := testApp.CollectionQuery().AndWhere(dbx.HashExp{"system": false}).All(&regularCollections)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var systemCollections []*core.Collection
+	err = testApp.CollectionQuery().AndWhere(dbx.HashExp{"system": true}).All(&systemCollections)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	totalRegularCollections := len(regularCollections)
+	totalSystemCollections := len(systemCollections)
+	totalCollections := totalRegularCollections + totalSystemCollections
+
+	scenarios := []struct {
+		name                   string
+		data                   string
+		deleteMissing          bool
+		expectError            bool
+		expectCollectionsCount int
+		afterTestFunc          func(testApp *tests.TestApp, resultCollections []*core.Collection)
+	}{
+		{
+			name:                   "invalid json array",
+			data:                   `{"test":123}`,
+			expectError:            true,
+			expectCollectionsCount: totalCollections,
+		},
+		{
+			name: "new + update + delete (system collections delete should be ignored)",
+			data: `[
+				{
+					"id":   "wsmn24bux7wo113",
+					"name": "demo",
+					"fields": [
+						{
+							"id":       "_2hlxbmp",
+							"name":     "title",
+							"type":     "text",
+							"system":   false,
+							"required": true,
+							"min":      3,
+							"max":      null,
+							"pattern":  ""
+						}
+					],
+					"indexes": []
+				},
+				{
+					"name": "import1",
+					"fields": [
+						{
+							"name": "active",
+							"type": "bool"
+						}
+					]
+				}
+			]`,
+			deleteMissing:          true,
+			expectError:            false,
+			expectCollectionsCount: totalSystemCollections + 2,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
+
+			err := testApp.ImportCollectionsByMarshaledJSON([]byte(s.data), s.deleteMissing)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			// check collections count
+			collections := []*core.Collection{}
+			if err := testApp.CollectionQuery().All(&collections); err != nil {
+				t.Fatal(err)
+			}
+			if len(collections) != s.expectCollectionsCount {
+				t.Fatalf("Expected %d collections, got %d", s.expectCollectionsCount, len(collections))
+			}
+
+			if s.afterTestFunc != nil {
+				s.afterTestFunc(testApp, collections)
+			}
+		})
+	}
+}
+
+func TestImportCollectionsUpdateRules(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name          string
+		data          map[string]any
+		deleteMissing bool
+	}{
+		{
+			"extend existing by name (without deleteMissing)",
+			map[string]any{"name": "clients", "authToken": map[string]any{"duration": 100}, "fields": []map[string]any{{"name": "test", "type": "text"}}},
+			false,
+		},
+		{
+			"extend existing by id (without deleteMissing)",
+			map[string]any{"id": "v851q4r790rhknl", "authToken": map[string]any{"duration": 100}, "fields": []map[string]any{{"name": "test", "type": "text"}}},
+			false,
+		},
+		{
+			"extend with delete missing",
+			map[string]any{
+				"id":           "v851q4r790rhknl",
+				"authToken":    map[string]any{"duration": 100},
+				"fields":       []map[string]any{{"name": "test", "type": "text"}},
+				"passwordAuth": map[string]any{"identityFields": []string{"email"}},
+				"indexes": []string{
+					// min required system fields indexes
+					"CREATE UNIQUE INDEX `_v851q4r790rhknl_email_idx` ON `clients` (email) WHERE email != ''",
+					"CREATE UNIQUE INDEX `_v851q4r790rhknl_tokenKey_idx` ON `clients` (tokenKey)",
+				},
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
+
+			beforeCollection, err := testApp.FindCollectionByNameOrId("clients")
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			err = testApp.ImportCollections([]map[string]any{s.data}, s.deleteMissing)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			afterCollection, err := testApp.FindCollectionByNameOrId("clients")
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if afterCollection.AuthToken.Duration != 100 {
+				t.Fatalf("Expected AuthToken duration to be %d, got %d", 100, afterCollection.AuthToken.Duration)
+			}
+			if beforeCollection.AuthToken.Secret != afterCollection.AuthToken.Secret {
+				t.Fatalf("Expected AuthToken secrets to remain the same, got\n%q\nVS\n%q", beforeCollection.AuthToken.Secret, afterCollection.AuthToken.Secret)
+			}
+			if beforeCollection.Name != afterCollection.Name {
+				t.Fatalf("Expected Name to remain the same, got\n%q\nVS\n%q", beforeCollection.Name, afterCollection.Name)
+			}
+			if beforeCollection.Id != afterCollection.Id {
+				t.Fatalf("Expected Id to remain the same, got\n%q\nVS\n%q", beforeCollection.Id, afterCollection.Id)
+			}
+
+			if !s.deleteMissing {
+				totalExpectedFields := len(beforeCollection.Fields) + 1
+				if v := len(afterCollection.Fields); v != totalExpectedFields {
+					t.Fatalf("Expected %d total fields, got %d", totalExpectedFields, v)
+				}
+
+				if afterCollection.Fields.GetByName("test") == nil {
+					t.Fatalf("Missing new field %q", "test")
+				}
+
+				// ensure that the old fields still exist
+				oldFields := beforeCollection.Fields.FieldNames()
+				for _, name := range oldFields {
+					if afterCollection.Fields.GetByName(name) == nil {
+						t.Fatalf("Missing expected old field %q", name)
+					}
+				}
+			} else {
+				totalExpectedFields := 1
+				for _, f := range beforeCollection.Fields {
+					if f.GetSystem() {
+						totalExpectedFields++
+					}
+				}
+
+				if v := len(afterCollection.Fields); v != totalExpectedFields {
+					t.Fatalf("Expected %d total fields, got %d", totalExpectedFields, v)
+				}
+
+				if afterCollection.Fields.GetByName("test") == nil {
+					t.Fatalf("Missing new field %q", "test")
+				}
+
+				// ensure that the old system fields still exist
+				for _, f := range beforeCollection.Fields {
+					if f.GetSystem() && afterCollection.Fields.GetByName(f.GetName()) == nil {
+						t.Fatalf("Missing expected old field %q", f.GetName())
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestImportCollectionsCreateRules(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	err := testApp.ImportCollections([]map[string]any{
+		{"name": "new_test", "type": "auth", "authToken": map[string]any{"duration": 123}, "fields": []map[string]any{{"name": "test", "type": "text"}}},
+	}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	collection, err := testApp.FindCollectionByNameOrId("new_test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	raw, err := json.Marshal(collection)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expectedParts := []string{
+		`"name":"new_test"`,
+		`"fields":[`,
+		`"name":"id"`,
+		`"name":"email"`,
+		`"name":"tokenKey"`,
+		`"name":"password"`,
+		`"name":"test"`,
+		`"indexes":[`,
+		`CREATE UNIQUE INDEX`,
+		`"duration":123`,
+	}
+
+	for _, part := range expectedParts {
+		if !strings.Contains(rawStr, part) {
+			t.Errorf("Missing %q in\n%s", part, rawStr)
+		}
+	}
+}
diff --git a/server/core_backend-server/core/collection_model.go b/server/core_backend-server/core/collection_model.go
new file mode 100644
index 0000000..12b4ef9
--- /dev/null
+++ b/server/core_backend-server/core/collection_model.go
@@ -0,0 +1,1172 @@
+package core
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+var (
+	_ Model        = (*Collection)(nil)
+	_ DBExporter   = (*Collection)(nil)
+	_ FilesManager = (*Collection)(nil)
+)
+
+const (
+	CollectionTypeBase = "base"
+	CollectionTypeAuth = "auth"
+	CollectionTypeView = "view"
+)
+
+const systemHookIdCollection = "__pbCollectionSystemHook__"
+
+const defaultLowercaseRecordIdPattern = "^[a-z0-9]+$"
+
+func (app *BaseApp) registerCollectionHooks() {
+	app.OnModelValidate().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionValidate().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelCreate().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionCreate().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelCreateExecute().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionCreateExecute().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterCreateSuccess().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionAfterCreateSuccess().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterCreateError().Bind(&hook.Handler[*ModelErrorEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelErrorEvent) error {
+			if ce, ok := newCollectionErrorEventFromModelErrorEvent(me); ok {
+				err := me.App.OnCollectionAfterCreateError().Trigger(ce, func(ce *CollectionErrorEvent) error {
+					syncModelErrorEventWithCollectionErrorEvent(me, ce)
+					defer syncCollectionErrorEventWithModelErrorEvent(ce, me)
+					return me.Next()
+				})
+				syncModelErrorEventWithCollectionErrorEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelUpdate().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionUpdate().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelUpdateExecute().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionUpdateExecute().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterUpdateSuccess().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionAfterUpdateSuccess().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterUpdateError().Bind(&hook.Handler[*ModelErrorEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelErrorEvent) error {
+			if ce, ok := newCollectionErrorEventFromModelErrorEvent(me); ok {
+				err := me.App.OnCollectionAfterUpdateError().Trigger(ce, func(ce *CollectionErrorEvent) error {
+					syncModelErrorEventWithCollectionErrorEvent(me, ce)
+					defer syncCollectionErrorEventWithModelErrorEvent(ce, me)
+					return me.Next()
+				})
+				syncModelErrorEventWithCollectionErrorEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelDelete().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionDelete().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelDeleteExecute().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionDeleteExecute().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterDeleteSuccess().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelEvent) error {
+			if ce, ok := newCollectionEventFromModelEvent(me); ok {
+				err := me.App.OnCollectionAfterDeleteSuccess().Trigger(ce, func(ce *CollectionEvent) error {
+					syncModelEventWithCollectionEvent(me, ce)
+					defer syncCollectionEventWithModelEvent(ce, me)
+					return me.Next()
+				})
+				syncModelEventWithCollectionEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterDeleteError().Bind(&hook.Handler[*ModelErrorEvent]{
+		Id: systemHookIdCollection,
+		Func: func(me *ModelErrorEvent) error {
+			if ce, ok := newCollectionErrorEventFromModelErrorEvent(me); ok {
+				err := me.App.OnCollectionAfterDeleteError().Trigger(ce, func(ce *CollectionErrorEvent) error {
+					syncModelErrorEventWithCollectionErrorEvent(me, ce)
+					defer syncCollectionErrorEventWithModelErrorEvent(ce, me)
+					return me.Next()
+				})
+				syncModelErrorEventWithCollectionErrorEvent(me, ce)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	//  --------------------------------------------------------------
+
+	app.OnCollectionValidate().Bind(&hook.Handler[*CollectionEvent]{
+		Id:       systemHookIdCollection,
+		Func:     onCollectionValidate,
+		Priority: 99,
+	})
+
+	app.OnCollectionCreate().Bind(&hook.Handler[*CollectionEvent]{
+		Id:       systemHookIdCollection,
+		Func:     onCollectionSave,
+		Priority: -99,
+	})
+
+	app.OnCollectionUpdate().Bind(&hook.Handler[*CollectionEvent]{
+		Id:       systemHookIdCollection,
+		Func:     onCollectionSave,
+		Priority: -99,
+	})
+
+	app.OnCollectionCreateExecute().Bind(&hook.Handler[*CollectionEvent]{
+		Id:   systemHookIdCollection,
+		Func: onCollectionSaveExecute,
+		// execute as latest as possible, aka. closer to the db action to minimize the transactions lock time
+		Priority: 99,
+	})
+
+	app.OnCollectionUpdateExecute().Bind(&hook.Handler[*CollectionEvent]{
+		Id:       systemHookIdCollection,
+		Func:     onCollectionSaveExecute,
+		Priority: 99, // execute as latest as possible, aka. closer to the db action to minimize the transactions lock time
+	})
+
+	app.OnCollectionDeleteExecute().Bind(&hook.Handler[*CollectionEvent]{
+		Id:       systemHookIdCollection,
+		Func:     onCollectionDeleteExecute,
+		Priority: 99, // execute as latest as possible, aka. closer to the db action to minimize the transactions lock time
+	})
+
+	// reload cache on failure
+	// ---
+	onErrorReloadCachedCollections := func(ce *CollectionErrorEvent) error {
+		if err := ce.App.ReloadCachedCollections(); err != nil {
+			ce.App.Logger().Warn("Failed to reload collections cache after collection change error", "error", err)
+		}
+
+		return ce.Next()
+	}
+	app.OnCollectionAfterCreateError().Bind(&hook.Handler[*CollectionErrorEvent]{
+		Id:       systemHookIdCollection,
+		Func:     onErrorReloadCachedCollections,
+		Priority: -99,
+	})
+	app.OnCollectionAfterUpdateError().Bind(&hook.Handler[*CollectionErrorEvent]{
+		Id:       systemHookIdCollection,
+		Func:     onErrorReloadCachedCollections,
+		Priority: -99,
+	})
+	app.OnCollectionAfterDeleteError().Bind(&hook.Handler[*CollectionErrorEvent]{
+		Id:       systemHookIdCollection,
+		Func:     onErrorReloadCachedCollections,
+		Priority: -99,
+	})
+	// ---
+
+	app.OnBootstrap().Bind(&hook.Handler[*BootstrapEvent]{
+		Id: systemHookIdCollection,
+		Func: func(e *BootstrapEvent) error {
+			if err := e.Next(); err != nil {
+				return err
+			}
+
+			if err := e.App.ReloadCachedCollections(); err != nil {
+				return fmt.Errorf("failed to load collections cache: %w", err)
+			}
+
+			return nil
+		},
+		Priority: 99, // execute as latest as possible
+	})
+}
+
+// @todo experiment eventually replacing the rules *string with a struct?
+type baseCollection struct {
+	BaseModel
+
+	disableIntegrityChecks bool
+	autogeneratedId        string
+
+	ListRule   *string `db:"listRule" json:"listRule" form:"listRule"`
+	ViewRule   *string `db:"viewRule" json:"viewRule" form:"viewRule"`
+	CreateRule *string `db:"createRule" json:"createRule" form:"createRule"`
+	UpdateRule *string `db:"updateRule" json:"updateRule" form:"updateRule"`
+	DeleteRule *string `db:"deleteRule" json:"deleteRule" form:"deleteRule"`
+
+	// RawOptions represents the raw serialized collection option loaded from the DB.
+	// NB! This field shouldn't be modified manually. It is automatically updated
+	// with the collection type specific option before save.
+	RawOptions types.JSONRaw `db:"options" json:"-" xml:"-" form:"-"`
+
+	Name    string                  `db:"name" json:"name" form:"name"`
+	Type    string                  `db:"type" json:"type" form:"type"`
+	Fields  FieldsList              `db:"fields" json:"fields" form:"fields"`
+	Indexes types.JSONArray[string] `db:"indexes" json:"indexes" form:"indexes"`
+	Created types.DateTime          `db:"created" json:"created"`
+	Updated types.DateTime          `db:"updated" json:"updated"`
+
+	// System prevents the collection rename, deletion and rules change.
+	// It is used primarily for internal purposes for collections like "_superusers", "_externalAuths", etc.
+	System bool `db:"system" json:"system" form:"system"`
+}
+
+// Collection defines the table, fields and various options related to a set of records.
+type Collection struct {
+	baseCollection
+	collectionAuthOptions
+	collectionViewOptions
+}
+
+// NewCollection initializes and returns a new Collection model with the specified type and name.
+//
+// It also loads the minimal default configuration for the collection
+// (eg. system fields, indexes, type specific options, etc.).
+func NewCollection(typ, name string, optId ...string) *Collection {
+	switch typ {
+	case CollectionTypeAuth:
+		return NewAuthCollection(name, optId...)
+	case CollectionTypeView:
+		return NewViewCollection(name, optId...)
+	default:
+		return NewBaseCollection(name, optId...)
+	}
+}
+
+// NewBaseCollection initializes and returns a new "base" Collection model.
+//
+// It also loads the minimal default configuration for the collection
+// (eg. system fields, indexes, type specific options, etc.).
+func NewBaseCollection(name string, optId ...string) *Collection {
+	m := &Collection{}
+	m.Name = name
+	m.Type = CollectionTypeBase
+
+	// @todo consider removing once inferred composite literals are supported
+	if len(optId) > 0 {
+		m.Id = optId[0]
+	}
+
+	m.initDefaultId()
+	m.initDefaultFields()
+
+	return m
+}
+
+// NewViewCollection initializes and returns a new "view" Collection model.
+//
+// It also loads the minimal default configuration for the collection
+// (eg. system fields, indexes, type specific options, etc.).
+func NewViewCollection(name string, optId ...string) *Collection {
+	m := &Collection{}
+	m.Name = name
+	m.Type = CollectionTypeView
+
+	// @todo consider removing once inferred composite literals are supported
+	if len(optId) > 0 {
+		m.Id = optId[0]
+	}
+
+	m.initDefaultId()
+	m.initDefaultFields()
+
+	return m
+}
+
+// NewAuthCollection initializes and returns a new "auth" Collection model.
+//
+// It also loads the minimal default configuration for the collection
+// (eg. system fields, indexes, type specific options, etc.).
+func NewAuthCollection(name string, optId ...string) *Collection {
+	m := &Collection{}
+	m.Name = name
+	m.Type = CollectionTypeAuth
+
+	// @todo consider removing once inferred composite literals are supported
+	if len(optId) > 0 {
+		m.Id = optId[0]
+	}
+
+	m.initDefaultId()
+	m.initDefaultFields()
+	m.setDefaultAuthOptions()
+
+	return m
+}
+
+// TableName returns the Collection model SQL table name.
+func (m *Collection) TableName() string {
+	return "_collections"
+}
+
+// BaseFilesPath returns the storage dir path used by the collection.
+func (m *Collection) BaseFilesPath() string {
+	return m.Id
+}
+
+// IsBase checks if the current collection has "base" type.
+func (m *Collection) IsBase() bool {
+	return m.Type == CollectionTypeBase
+}
+
+// IsAuth checks if the current collection has "auth" type.
+func (m *Collection) IsAuth() bool {
+	return m.Type == CollectionTypeAuth
+}
+
+// IsView checks if the current collection has "view" type.
+func (m *Collection) IsView() bool {
+	return m.Type == CollectionTypeView
+}
+
+// IntegrityChecks toggles the current collection integrity checks (ex. checking references on delete).
+func (m *Collection) IntegrityChecks(enable bool) {
+	m.disableIntegrityChecks = !enable
+}
+
+// PostScan implements the [dbx.PostScanner] interface to auto unmarshal
+// the raw serialized options into the concrete type specific fields.
+func (m *Collection) PostScan() error {
+	if err := m.BaseModel.PostScan(); err != nil {
+		return err
+	}
+
+	return m.unmarshalRawOptions()
+}
+
+func (m *Collection) unmarshalRawOptions() error {
+	raw, err := m.RawOptions.MarshalJSON()
+	if err != nil {
+		return nil
+	}
+
+	switch m.Type {
+	case CollectionTypeView:
+		return json.Unmarshal(raw, &m.collectionViewOptions)
+	case CollectionTypeAuth:
+		return json.Unmarshal(raw, &m.collectionAuthOptions)
+	}
+
+	return nil
+}
+
+// UnmarshalJSON implements the [json.Unmarshaler] interface.
+//
+// For new/"blank" Collection models it replaces the model with a factory
+// instance and then unmarshal the provided data one on top of it.
+func (m *Collection) UnmarshalJSON(b []byte) error {
+	type alias *Collection
+
+	// initialize the default fields
+	// (e.g. in case the collection was NOT created using the designated factories)
+	if m.IsNew() && m.Type == "" {
+		minimal := &struct {
+			Type string `json:"type"`
+			Name string `json:"name"`
+			Id   string `json:"id"`
+		}{}
+		if err := json.Unmarshal(b, minimal); err != nil {
+			return err
+		}
+
+		blank := NewCollection(minimal.Type, minimal.Name, minimal.Id)
+		*m = *blank
+	}
+
+	return json.Unmarshal(b, alias(m))
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+//
+// Note that non-type related fields are ignored from the serialization
+// (ex. for "view" colections the "auth" fields are skipped).
+func (m Collection) MarshalJSON() ([]byte, error) {
+	switch m.Type {
+	case CollectionTypeView:
+		return json.Marshal(struct {
+			baseCollection
+			collectionViewOptions
+		}{m.baseCollection, m.collectionViewOptions})
+	case CollectionTypeAuth:
+		alias := struct {
+			baseCollection
+			collectionAuthOptions
+		}{m.baseCollection, m.collectionAuthOptions}
+
+		// ensure that it is always returned as array
+		if alias.OAuth2.Providers == nil {
+			alias.OAuth2.Providers = []OAuth2ProviderConfig{}
+		}
+
+		// hide secret keys from the serialization
+		alias.AuthToken.Secret = ""
+		alias.FileToken.Secret = ""
+		alias.PasswordResetToken.Secret = ""
+		alias.EmailChangeToken.Secret = ""
+		alias.VerificationToken.Secret = ""
+		for i := range alias.OAuth2.Providers {
+			alias.OAuth2.Providers[i].ClientSecret = ""
+		}
+
+		return json.Marshal(alias)
+	default:
+		return json.Marshal(m.baseCollection)
+	}
+}
+
+// String returns a string representation of the current collection.
+func (m Collection) String() string {
+	raw, _ := json.Marshal(m)
+	return string(raw)
+}
+
+// DBExport prepares and exports the current collection data for db persistence.
+func (m *Collection) DBExport(app App) (map[string]any, error) {
+	result := map[string]any{
+		"id":         m.Id,
+		"type":       m.Type,
+		"listRule":   m.ListRule,
+		"viewRule":   m.ViewRule,
+		"createRule": m.CreateRule,
+		"updateRule": m.UpdateRule,
+		"deleteRule": m.DeleteRule,
+		"name":       m.Name,
+		"fields":     m.Fields,
+		"indexes":    m.Indexes,
+		"system":     m.System,
+		"created":    m.Created,
+		"updated":    m.Updated,
+		"options":    `{}`,
+	}
+
+	switch m.Type {
+	case CollectionTypeView:
+		if raw, err := types.ParseJSONRaw(m.collectionViewOptions); err == nil {
+			result["options"] = raw
+		} else {
+			return nil, err
+		}
+	case CollectionTypeAuth:
+		if raw, err := types.ParseJSONRaw(m.collectionAuthOptions); err == nil {
+			result["options"] = raw
+		} else {
+			return nil, err
+		}
+	}
+
+	return result, nil
+}
+
+// GetIndex returns s single Collection index expression by its name.
+func (m *Collection) GetIndex(name string) string {
+	for _, idx := range m.Indexes {
+		if strings.EqualFold(dbutils.ParseIndex(idx).IndexName, name) {
+			return idx
+		}
+	}
+
+	return ""
+}
+
+// AddIndex adds a new index into the current collection.
+//
+// If the collection has an existing index matching the new name it will be replaced with the new one.
+func (m *Collection) AddIndex(name string, unique bool, columnsExpr string, optWhereExpr string) {
+	m.RemoveIndex(name)
+
+	var idx strings.Builder
+
+	dbType := os.Getenv("DB_TYPE")
+	if dbType == "mysql" {
+		// MySQL (with ANSI_QUOTES):
+		idx.WriteString("CREATE ")
+		if unique {
+			idx.WriteString("UNIQUE ")
+		}
+		idx.WriteString("INDEX \"")
+		idx.WriteString(name)
+		idx.WriteString("\" ON \"")
+		idx.WriteString(m.Name)
+		idx.WriteString("\" (")
+		idx.WriteString(columnsExpr)
+		idx.WriteString(")")
+		// MySQL doesn't support partial index WHERE clause
+	} else if dbType == "postgres" {
+		// PostgreSQL:
+		idx.WriteString("CREATE ")
+		if unique {
+			idx.WriteString("UNIQUE ")
+		}
+		idx.WriteString("INDEX \"")
+		idx.WriteString(name)
+		idx.WriteString("\" ON \"")
+		idx.WriteString(m.Name)
+		idx.WriteString("\" (")
+		idx.WriteString(columnsExpr)
+		idx.WriteString(")")
+		if optWhereExpr != "" {
+			idx.WriteString(" WHERE ")
+			idx.WriteString(optWhereExpr)
+		}
+	} else {
+		// SQLite (default):
+		idx.WriteString("CREATE ")
+		if unique {
+			idx.WriteString("UNIQUE ")
+		}
+		idx.WriteString("INDEX `")
+		idx.WriteString(name)
+		idx.WriteString("` ON `")
+		idx.WriteString(m.Name)
+		idx.WriteString("` (")
+		idx.WriteString(columnsExpr)
+		idx.WriteString(")")
+		if optWhereExpr != "" {
+			idx.WriteString(" WHERE ")
+			idx.WriteString(optWhereExpr)
+		}
+	}
+
+	m.Indexes = append(m.Indexes, idx.String())
+}
+
+// RemoveIndex removes a single index with the specified name from the current collection.
+func (m *Collection) RemoveIndex(name string) {
+	for i, idx := range m.Indexes {
+		if strings.EqualFold(dbutils.ParseIndex(idx).IndexName, name) {
+			m.Indexes = append(m.Indexes[:i], m.Indexes[i+1:]...)
+			return
+		}
+	}
+}
+
+// delete hook
+// -------------------------------------------------------------------
+
+func onCollectionDeleteExecute(e *CollectionEvent) error {
+	if e.Collection.System {
+		return fmt.Errorf("[%s] system collections cannot be deleted", e.Collection.Name)
+	}
+
+	defer func() {
+		if err := e.App.ReloadCachedCollections(); err != nil {
+			e.App.Logger().Warn("Failed to reload collections cache", "error", err)
+		}
+	}()
+
+	if !e.Collection.disableIntegrityChecks {
+		// ensure that there aren't any existing references.
+		// note: the select is outside of the transaction to prevent SQLITE_LOCKED error when mixing read&write in a single transaction
+		references, err := e.App.FindCollectionReferences(e.Collection, e.Collection.Id)
+		if err != nil {
+			return fmt.Errorf("[%s] failed to check collection references: %w", e.Collection.Name, err)
+		}
+		if total := len(references); total > 0 {
+			names := make([]string, 0, len(references))
+			for ref := range references {
+				names = append(names, ref.Name)
+			}
+			return fmt.Errorf("[%s] failed to delete due to existing relation references: %s", e.Collection.Name, strings.Join(names, ", "))
+		}
+	}
+
+	originalApp := e.App
+
+	txErr := e.App.RunInTransaction(func(txApp App) error {
+		e.App = txApp
+
+		// protect against deleting a collection that is depended on by other views
+		// Unlike SQLite, PostgreSQL doesn't allow deleting a table if there are any dependencies on it.
+		dependentViews, err := findDependentViews(txApp, e.Collection.Name)
+		if err != nil {
+			return err
+		}
+		if e.Collection.disableIntegrityChecks {
+			// drop the dependent views to bypass PostgreSQL's dependency check
+			// Note: In SQLite, we don't have to delete the dependent views because SQLite allows dangling views.
+			// These views will be created by [resaveViewsWithChangedFields] if the collection is recreated.
+			// Users can still manually edit the views through UI.
+			for i := len(dependentViews) - 1; i >= 0; i-- {
+				if err := txApp.DeleteView(dependentViews[i].Name); err != nil {
+					return err
+				}
+			}
+		} else if len(dependentViews) > 0 {
+			names := make([]string, 0, len(dependentViews))
+			for _, view := range dependentViews {
+				names = append(names, view.Name)
+			}
+			return fmt.Errorf("[%s] failed to delete due to existing view dependencies: %s. Try delete them first.", e.Collection.Name, strings.Join(names, ", "))
+		}
+
+		// delete the related view or records table
+		if e.Collection.IsView() {
+			if err := txApp.DeleteView(e.Collection.Name); err != nil {
+				return err
+			}
+		} else {
+			if err := txApp.DeleteTable(e.Collection.Name); err != nil {
+				return err
+			}
+		}
+
+		// PostgreSQL.
+		// The disable integrity checks is not possible in PostgreSQL.
+		// Because we can't delete a table if there are any dependencies on it.
+		// Instead, we use `findDependentViews()` to check for dependencies.
+		// This checks all view dependencies in the database, which is more
+		// strict than the original integrity check that only checks for PocketBase
+		// view collection dependencies.
+		// The `disableIntegrityChecks` seems unnecessary because we already
+		if !e.Collection.disableIntegrityChecks {
+			// trigger views resave to check for dependencies
+			if err := resaveViewsWithChangedFields(txApp, e.Collection.Id); err != nil {
+				return fmt.Errorf("[%s] failed to delete due to existing view dependency: %w", e.Collection.Name, err)
+			}
+		}
+
+		// delete
+		return e.Next()
+	})
+
+	e.App = originalApp
+
+	return txErr
+}
+
+// save hook
+// -------------------------------------------------------------------
+
+func (c *Collection) idChecksum() string {
+	return "obc_" + crc32Checksum(c.Type+c.Name)
+}
+
+func (c *Collection) initDefaultId() {
+	if c.Id == "" {
+		c.Id = c.idChecksum()
+		c.autogeneratedId = c.Id
+	}
+}
+
+func (c *Collection) updateGeneratedIdIfExists(app App) {
+	if !c.IsNew() ||
+		// the id was explicitly cleared
+		c.Id == "" ||
+		// the id was manually set
+		c.Id != c.autogeneratedId {
+		return
+	}
+
+	// generate an up-to-date checksum
+	newId := c.idChecksum()
+
+	// add a number to the current id (if already exists)
+	for i := 2; i < 1000; i++ {
+		var exists int
+		_ = app.CollectionQuery().Select("(1)").AndWhere(dbx.HashExp{"id": newId}).Limit(1).Row(&exists)
+		if exists == 0 {
+			break
+		}
+		newId = c.idChecksum() + strconv.Itoa(i)
+	}
+
+	// no change
+	if c.Id == newId {
+		return
+	}
+
+	// replace the old id in the index names (if any)
+	for i, idx := range c.Indexes {
+		parsed := dbutils.ParseIndex(idx)
+		original := parsed.IndexName
+		parsed.IndexName = strings.ReplaceAll(parsed.IndexName, c.Id, newId)
+		if parsed.IndexName != original {
+			c.Indexes[i] = parsed.Build()
+		}
+	}
+
+	// update model id
+	c.Id = newId
+}
+
+func onCollectionSave(e *CollectionEvent) error {
+	if e.Collection.Type == "" {
+		e.Collection.Type = CollectionTypeBase
+	}
+
+	if e.Collection.IsNew() {
+		e.Collection.initDefaultId()
+		e.Collection.Created = types.NowDateTime()
+	}
+
+	e.Collection.Updated = types.NowDateTime()
+
+	// recreate the fields list to ensure that all normalizations
+	// like default field id are applied
+	e.Collection.Fields = NewFieldsList(e.Collection.Fields...)
+
+	e.Collection.initDefaultFields()
+
+	if e.Collection.IsAuth() {
+		e.Collection.unsetMissingOAuth2MappedFields()
+	}
+
+	e.Collection.updateGeneratedIdIfExists(e.App)
+
+	return e.Next()
+}
+
+func onCollectionSaveExecute(e *CollectionEvent) error {
+	defer func() {
+		if err := e.App.ReloadCachedCollections(); err != nil {
+			e.App.Logger().Warn("Failed to reload collections cache", "error", err)
+		}
+	}()
+
+	var oldCollection *Collection
+	if !e.Collection.IsNew() {
+		var err error
+		oldCollection, err = e.App.FindCachedCollectionByNameOrId(e.Collection.Id)
+		if err != nil {
+			return err
+		}
+
+		// invalidate previously issued auth tokens on auth rule change
+		if oldCollection.AuthRule != e.Collection.AuthRule &&
+			cast.ToString(oldCollection.AuthRule) != cast.ToString(e.Collection.AuthRule) {
+			e.Collection.AuthToken.Secret = security.RandomString(50)
+		}
+	}
+
+	originalApp := e.App
+	txErr := e.App.RunInTransaction(func(txApp App) error {
+		e.App = txApp
+
+		isView := e.Collection.IsView()
+
+		// ensures that the view collection shema is properly loaded
+		if isView {
+			query := e.Collection.ViewQuery
+
+			// generate collection fields list from the query
+			viewFields, err := e.App.CreateViewFields(query)
+			if err != nil {
+				return err
+			}
+
+			if !IsPostgres(txApp) {
+				// SQLite: delete old renamed view
+				if oldCollection != nil && oldCollection.Name != e.Collection.Name {
+					if err := txApp.DeleteView(oldCollection.Name); err != nil {
+						return err
+					}
+				}
+			} else {
+				// PostgreSQL:
+				// Instead of deleting the old view, we must rename it to make all the dependent views get updated
+				// automatically.
+				if oldCollection != nil && oldCollection.Name != e.Collection.Name {
+					if _, err := txApp.DB().RenameTable(oldCollection.Name, e.Collection.Name).Execute(); err != nil {
+						return err
+					}
+				}
+			}
+
+			// wrap view query if necessary
+			query, err = normalizeViewQueryId(e.App, query)
+			if err != nil {
+				return fmt.Errorf("failed to normalize view query id: %w", err)
+			}
+
+			// (re)create the view
+			if err := e.App.SaveView(e.Collection.Name, query); err != nil {
+				return err
+			}
+
+			// updates newCollection.Fields based on the generated view table info and query
+			e.Collection.Fields = viewFields
+		}
+
+		// save the Collection model
+		if err := e.Next(); err != nil {
+			return err
+		}
+
+		// sync the changes with the related records table
+		if !isView {
+			if err := e.App.SyncRecordTableSchema(e.Collection, oldCollection); err != nil {
+				// note: don't wrap to allow propagating indexes validation.Errors
+				return err
+			}
+		}
+
+		return nil
+	})
+	e.App = originalApp
+
+	if txErr != nil {
+		return txErr
+	}
+
+	// trigger an update for all views with changed fields as a result of the current collection save
+	// (ignoring view errors to allow users to update the query from the UI)
+	resaveViewsWithChangedFields(e.App, e.Collection.Id)
+
+	return nil
+}
+
+func (c *Collection) initDefaultFields() {
+	switch c.Type {
+	case CollectionTypeBase:
+		c.initIdField()
+	case CollectionTypeAuth:
+		c.initIdField()
+		c.initPasswordField()
+		c.initTokenKeyField()
+		c.initEmailField()
+		c.initEmailVisibilityField()
+		c.initVerifiedField()
+	case CollectionTypeView:
+		// view fields are autogenerated
+	}
+}
+
+func (c *Collection) initIdField() {
+	field, _ := c.Fields.GetByName(FieldNameId).(*TextField)
+	if field == nil {
+		// create default field
+		field = &TextField{
+			Name:                FieldNameId,
+			System:              true,
+			PrimaryKey:          true,
+			Required:            true,
+			Min:                 15,
+			Max:                 15,
+			Pattern:             defaultLowercaseRecordIdPattern,
+			AutogeneratePattern: `[a-z0-9]{15}`,
+		}
+
+		// prepend it
+		c.Fields = NewFieldsList(append([]Field{field}, c.Fields...)...)
+	} else {
+		// enforce system defaults
+		field.System = true
+		field.Required = true
+		field.PrimaryKey = true
+		field.Hidden = false
+		if field.Pattern == "" {
+			if field.AutogeneratePattern == security.PredefinedAutoGeneratePattern_uuidv7 {
+				field.Pattern = security.PredefinedAutoGeneratePattern_uuidv7
+			} else {
+				field.Pattern = defaultLowercaseRecordIdPattern
+			}
+		}
+	}
+}
+
+func (c *Collection) initPasswordField() {
+	field, _ := c.Fields.GetByName(FieldNamePassword).(*PasswordField)
+	if field == nil {
+		// load default field
+		c.Fields.Add(&PasswordField{
+			Name:     FieldNamePassword,
+			System:   true,
+			Hidden:   true,
+			Required: true,
+			Min:      8,
+		})
+	} else {
+		// enforce system defaults
+		field.System = true
+		field.Hidden = true
+		field.Required = true
+	}
+}
+
+func (c *Collection) initTokenKeyField() {
+	field, _ := c.Fields.GetByName(FieldNameTokenKey).(*TextField)
+	if field == nil {
+		// load default field
+		c.Fields.Add(&TextField{
+			Name:                FieldNameTokenKey,
+			System:              true,
+			Hidden:              true,
+			Min:                 30,
+			Max:                 60,
+			Required:            true,
+			AutogeneratePattern: `[a-zA-Z0-9]{50}`,
+		})
+	} else {
+		// enforce system defaults
+		field.System = true
+		field.Hidden = true
+		field.Required = true
+	}
+
+	// ensure that there is a unique index for the field
+	if _, ok := dbutils.FindSingleColumnUniqueIndex(c.Indexes, FieldNameTokenKey); !ok {
+		format := `CREATE UNIQUE INDEX "%s" ON "%s" ("%s")`
+		dbType := os.Getenv("DB_TYPE")
+		if dbType == "mysql" {
+			format = `CREATE UNIQUE INDEX "%s" ON "%s" ("%s")`
+		} else if dbType != "postgres" {
+			format = "CREATE UNIQUE INDEX `%s` ON `%s` (`%s`)"
+		}
+		c.Indexes = append(c.Indexes, fmt.Sprintf(
+			format,
+			c.fieldIndexName(FieldNameTokenKey),
+			c.Name,
+			FieldNameTokenKey,
+		))
+	}
+}
+
+func (c *Collection) initEmailField() {
+	field, _ := c.Fields.GetByName(FieldNameEmail).(*EmailField)
+	if field == nil {
+		// load default field
+		c.Fields.Add(&EmailField{
+			Name:     FieldNameEmail,
+			System:   true,
+			Required: true,
+		})
+	} else {
+		// enforce system defaults
+		field.System = true
+		field.Hidden = false // managed by the emailVisibility flag
+	}
+
+	// ensure that there is a unique index for the email field
+	if _, ok := dbutils.FindSingleColumnUniqueIndex(c.Indexes, FieldNameEmail); !ok {
+		format := `CREATE UNIQUE INDEX "%s" ON "%s" ("%s") WHERE "%s" != ''`
+		dbType := os.Getenv("DB_TYPE")
+		var args []any = []any{
+			c.fieldIndexName(FieldNameEmail),
+			c.Name,
+			FieldNameEmail,
+		}
+		if dbType == "mysql" {
+			format = `CREATE UNIQUE INDEX "%s" ON "%s" ("%s")`
+		} else if dbType != "postgres" {
+			format = "CREATE UNIQUE INDEX `%s` ON `%s` (`%s`) WHERE `%s` != ''"
+			args = append(args, FieldNameEmail)
+		} else {
+			// postgres
+			args = append(args, FieldNameEmail)
+		}
+		c.Indexes = append(c.Indexes, fmt.Sprintf(format, args...))
+	}
+}
+
+func (c *Collection) initEmailVisibilityField() {
+	field, _ := c.Fields.GetByName(FieldNameEmailVisibility).(*BoolField)
+	if field == nil {
+		// load default field
+		c.Fields.Add(&BoolField{
+			Name:   FieldNameEmailVisibility,
+			System: true,
+		})
+	} else {
+		// enforce system defaults
+		field.System = true
+	}
+}
+
+func (c *Collection) initVerifiedField() {
+	field, _ := c.Fields.GetByName(FieldNameVerified).(*BoolField)
+	if field == nil {
+		// load default field
+		c.Fields.Add(&BoolField{
+			Name:   FieldNameVerified,
+			System: true,
+		})
+	} else {
+		// enforce system defaults
+		field.System = true
+	}
+}
+
+func (c *Collection) fieldIndexName(field string) string {
+	name := "idx_" + field + "_"
+
+	if c.Id != "" {
+		name += c.Id
+	} else if c.Name != "" {
+		name += c.Name
+	} else {
+		name += security.PseudorandomStringWithAlphabet(10, DefaultIdAlphabet)
+	}
+
+	if len(name) > 64 {
+		return name[:64]
+	}
+
+	return name
+}
diff --git a/server/core_backend-server/core/collection_model_auth_options.go b/server/core_backend-server/core/collection_model_auth_options.go
new file mode 100644
index 0000000..a0198d0
--- /dev/null
+++ b/server/core_backend-server/core/collection_model_auth_options.go
@@ -0,0 +1,543 @@
+package core
+
+import (
+	"strconv"
+	"strings"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+func (m *Collection) unsetMissingOAuth2MappedFields() {
+	if !m.IsAuth() {
+		return
+	}
+
+	if m.OAuth2.MappedFields.Id != "" {
+		if m.Fields.GetByName(m.OAuth2.MappedFields.Id) == nil {
+			m.OAuth2.MappedFields.Id = ""
+		}
+	}
+
+	if m.OAuth2.MappedFields.Name != "" {
+		if m.Fields.GetByName(m.OAuth2.MappedFields.Name) == nil {
+			m.OAuth2.MappedFields.Name = ""
+		}
+	}
+
+	if m.OAuth2.MappedFields.Username != "" {
+		if m.Fields.GetByName(m.OAuth2.MappedFields.Username) == nil {
+			m.OAuth2.MappedFields.Username = ""
+		}
+	}
+
+	if m.OAuth2.MappedFields.AvatarURL != "" {
+		if m.Fields.GetByName(m.OAuth2.MappedFields.AvatarURL) == nil {
+			m.OAuth2.MappedFields.AvatarURL = ""
+		}
+	}
+}
+
+func (m *Collection) setDefaultAuthOptions() {
+	m.collectionAuthOptions = collectionAuthOptions{
+		VerificationTemplate:       defaultVerificationTemplate,
+		ResetPasswordTemplate:      defaultResetPasswordTemplate,
+		ConfirmEmailChangeTemplate: defaultConfirmEmailChangeTemplate,
+		AuthRule:                   types.Pointer(""),
+		AuthAlert: AuthAlertConfig{
+			Enabled:       true,
+			EmailTemplate: defaultAuthAlertTemplate,
+		},
+		PasswordAuth: PasswordAuthConfig{
+			Enabled:        true,
+			IdentityFields: []string{FieldNameEmail},
+		},
+		MFA: MFAConfig{
+			Enabled:  false,
+			Duration: 1800, // 30min
+		},
+		OTP: OTPConfig{
+			Enabled:       false,
+			Duration:      180, // 3min
+			Length:        8,
+			EmailTemplate: defaultOTPTemplate,
+		},
+		AuthToken: TokenConfig{
+			Secret:   security.RandomString(50),
+			Duration: 604800, // 7 days
+		},
+		PasswordResetToken: TokenConfig{
+			Secret:   security.RandomString(50),
+			Duration: 1800, // 30min
+		},
+		EmailChangeToken: TokenConfig{
+			Secret:   security.RandomString(50),
+			Duration: 1800, // 30min
+		},
+		VerificationToken: TokenConfig{
+			Secret:   security.RandomString(50),
+			Duration: 259200, // 3days
+		},
+		FileToken: TokenConfig{
+			Secret:   security.RandomString(50),
+			Duration: 180, // 3min
+		},
+	}
+}
+
+var _ optionsValidator = (*collectionAuthOptions)(nil)
+
+// collectionAuthOptions defines the options for the "auth" type collection.
+type collectionAuthOptions struct {
+	// AuthRule could be used to specify additional record constraints
+	// applied after record authentication and right before returning the
+	// auth token response to the client.
+	//
+	// For example, to allow only verified users you could set it to
+	// "verified = true".
+	//
+	// Set it to empty string to allow any Auth collection record to authenticate.
+	//
+	// Set it to nil to disallow authentication altogether for the collection
+	// (that includes password, OAuth2, etc.).
+	AuthRule *string `form:"authRule" json:"authRule"`
+
+	// ManageRule gives admin-like permissions to allow fully managing
+	// the auth record(s), eg. changing the password without requiring
+	// to enter the old one, directly updating the verified state and email, etc.
+	//
+	// This rule is executed in addition to the Create and Update API rules.
+	ManageRule *string `form:"manageRule" json:"manageRule"`
+
+	// AuthAlert defines options related to the auth alerts on new device login.
+	AuthAlert AuthAlertConfig `form:"authAlert" json:"authAlert"`
+
+	// OAuth2 specifies whether OAuth2 auth is enabled for the collection
+	// and which OAuth2 providers are allowed.
+	OAuth2 OAuth2Config `form:"oauth2" json:"oauth2"`
+
+	// PasswordAuth defines options related to the collection password authentication.
+	PasswordAuth PasswordAuthConfig `form:"passwordAuth" json:"passwordAuth"`
+
+	// MFA defines options related to the Multi-factor authentication (MFA).
+	MFA MFAConfig `form:"mfa" json:"mfa"`
+
+	// OTP defines options related to the One-time password authentication (OTP).
+	OTP OTPConfig `form:"otp" json:"otp"`
+
+	// Various token configurations
+	// ---
+	AuthToken          TokenConfig `form:"authToken" json:"authToken"`
+	PasswordResetToken TokenConfig `form:"passwordResetToken" json:"passwordResetToken"`
+	EmailChangeToken   TokenConfig `form:"emailChangeToken" json:"emailChangeToken"`
+	VerificationToken  TokenConfig `form:"verificationToken" json:"verificationToken"`
+	FileToken          TokenConfig `form:"fileToken" json:"fileToken"`
+
+	// Default email templates
+	// ---
+	VerificationTemplate       EmailTemplate `form:"verificationTemplate" json:"verificationTemplate"`
+	ResetPasswordTemplate      EmailTemplate `form:"resetPasswordTemplate" json:"resetPasswordTemplate"`
+	ConfirmEmailChangeTemplate EmailTemplate `form:"confirmEmailChangeTemplate" json:"confirmEmailChangeTemplate"`
+}
+
+func (o *collectionAuthOptions) validate(cv *collectionValidator) error {
+	err := validation.ValidateStruct(o,
+		validation.Field(
+			&o.AuthRule,
+			validation.By(cv.checkRule),
+			validation.By(cv.ensureNoSystemRuleChange(cv.original.AuthRule)),
+		),
+		validation.Field(
+			&o.ManageRule,
+			validation.NilOrNotEmpty,
+			validation.By(cv.checkRule),
+			validation.By(cv.ensureNoSystemRuleChange(cv.original.ManageRule)),
+		),
+		validation.Field(&o.AuthAlert),
+		validation.Field(&o.PasswordAuth),
+		validation.Field(&o.OAuth2),
+		validation.Field(&o.OTP),
+		validation.Field(&o.MFA),
+		validation.Field(&o.AuthToken),
+		validation.Field(&o.PasswordResetToken),
+		validation.Field(&o.EmailChangeToken),
+		validation.Field(&o.VerificationToken),
+		validation.Field(&o.FileToken),
+		validation.Field(&o.VerificationTemplate, validation.Required),
+		validation.Field(&o.ResetPasswordTemplate, validation.Required),
+		validation.Field(&o.ConfirmEmailChangeTemplate, validation.Required),
+	)
+	if err != nil {
+		return err
+	}
+
+	if o.MFA.Enabled {
+		// if MFA is enabled require at least 2 auth methods
+		//
+		// @todo maybe consider disabling the check because if custom auth methods
+		// are registered it may fail since we don't have mechanism to detect them at the moment
+		authsEnabled := 0
+		if o.PasswordAuth.Enabled {
+			authsEnabled++
+		}
+		if o.OAuth2.Enabled {
+			authsEnabled++
+		}
+		if o.OTP.Enabled {
+			authsEnabled++
+		}
+		if authsEnabled < 2 {
+			return validation.Errors{
+				"mfa": validation.Errors{
+					"enabled": validation.NewError("validation_mfa_not_enough_auths", "MFA requires at least 2 auth methods to be enabled."),
+				},
+			}
+		}
+
+		if o.MFA.Rule != "" {
+			mfaRuleValidators := []validation.RuleFunc{
+				cv.checkRule,
+				cv.ensureNoSystemRuleChange(&cv.original.MFA.Rule),
+			}
+
+			for _, validator := range mfaRuleValidators {
+				err := validator(&o.MFA.Rule)
+				if err != nil {
+					return validation.Errors{
+						"mfa": validation.Errors{
+							"rule": err,
+						},
+					}
+				}
+			}
+		}
+	}
+
+	// extra check to ensure that only unique identity fields are used
+	if o.PasswordAuth.Enabled {
+		err = validation.Validate(o.PasswordAuth.IdentityFields, validation.By(cv.checkFieldsForUniqueIndex))
+		if err != nil {
+			return validation.Errors{
+				"passwordAuth": validation.Errors{
+					"identityFields": err,
+				},
+			}
+		}
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+type EmailTemplate struct {
+	Subject string `form:"subject" json:"subject"`
+	Body    string `form:"body" json:"body"`
+}
+
+// Validate makes EmailTemplate validatable by implementing [validation.Validatable] interface.
+func (t EmailTemplate) Validate() error {
+	return validation.ValidateStruct(&t,
+		validation.Field(&t.Subject, validation.Required),
+		validation.Field(&t.Body, validation.Required),
+	)
+}
+
+// Resolve replaces the placeholder parameters in the current email
+// template and returns its components as ready-to-use strings.
+func (t EmailTemplate) Resolve(placeholders map[string]any) (subject, body string) {
+	body = t.Body
+	subject = t.Subject
+
+	for k, v := range placeholders {
+		vStr := cast.ToString(v)
+
+		// replace subject placeholder params (if any)
+		subject = strings.ReplaceAll(subject, k, vStr)
+
+		// replace body placeholder params (if any)
+		body = strings.ReplaceAll(body, k, vStr)
+	}
+
+	return subject, body
+}
+
+// -------------------------------------------------------------------
+
+type AuthAlertConfig struct {
+	Enabled       bool          `form:"enabled" json:"enabled"`
+	EmailTemplate EmailTemplate `form:"emailTemplate" json:"emailTemplate"`
+}
+
+// Validate makes AuthAlertConfig validatable by implementing [validation.Validatable] interface.
+func (c AuthAlertConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		// note: for now always run the email template validations even
+		// if not enabled since it could be used separately
+		validation.Field(&c.EmailTemplate),
+	)
+}
+
+// -------------------------------------------------------------------
+
+type TokenConfig struct {
+	Secret string `form:"secret" json:"secret,omitempty"`
+
+	// Duration specifies how long an issued token to be valid (in seconds)
+	Duration int64 `form:"duration" json:"duration"`
+}
+
+// Validate makes TokenConfig validatable by implementing [validation.Validatable] interface.
+func (c TokenConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.Secret, validation.Required, validation.Length(30, 255)),
+		validation.Field(&c.Duration, validation.Required, validation.Min(10), validation.Max(94670856)), // ~3y max
+	)
+}
+
+// DurationTime returns the current Duration as [time.Duration].
+func (c TokenConfig) DurationTime() time.Duration {
+	return time.Duration(c.Duration) * time.Second
+}
+
+// -------------------------------------------------------------------
+
+type OTPConfig struct {
+	Enabled bool `form:"enabled" json:"enabled"`
+
+	// Duration specifies how long the OTP to be valid (in seconds)
+	Duration int64 `form:"duration" json:"duration"`
+
+	// Length specifies the auto generated password length.
+	Length int `form:"length" json:"length"`
+
+	// EmailTemplate is the default OTP email template that will be send to the auth record.
+	//
+	// In addition to the system placeholders you can also make use of
+	// [core.EmailPlaceholderOTPId] and [core.EmailPlaceholderOTP].
+	EmailTemplate EmailTemplate `form:"emailTemplate" json:"emailTemplate"`
+}
+
+// Validate makes OTPConfig validatable by implementing [validation.Validatable] interface.
+func (c OTPConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.Duration, validation.When(c.Enabled, validation.Required, validation.Min(10), validation.Max(86400))),
+		validation.Field(&c.Length, validation.When(c.Enabled, validation.Required, validation.Min(4))),
+		// note: for now always run the email template validations even
+		// if not enabled since it could be used separately
+		validation.Field(&c.EmailTemplate),
+	)
+}
+
+// DurationTime returns the current Duration as [time.Duration].
+func (c OTPConfig) DurationTime() time.Duration {
+	return time.Duration(c.Duration) * time.Second
+}
+
+// -------------------------------------------------------------------
+
+type MFAConfig struct {
+	Enabled bool `form:"enabled" json:"enabled"`
+
+	// Duration specifies how long an issued MFA to be valid (in seconds)
+	Duration int64 `form:"duration" json:"duration"`
+
+	// Rule is an optional field to restrict MFA only for the records that satisfy the rule.
+	//
+	// Leave it empty to enable MFA for everyone.
+	Rule string `form:"rule" json:"rule"`
+}
+
+// Validate makes MFAConfig validatable by implementing [validation.Validatable] interface.
+func (c MFAConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.Duration, validation.When(c.Enabled, validation.Required, validation.Min(10), validation.Max(86400))),
+	)
+}
+
+// DurationTime returns the current Duration as [time.Duration].
+func (c MFAConfig) DurationTime() time.Duration {
+	return time.Duration(c.Duration) * time.Second
+}
+
+// -------------------------------------------------------------------
+
+type PasswordAuthConfig struct {
+	Enabled bool `form:"enabled" json:"enabled"`
+
+	// IdentityFields is a list of field names that could be used as
+	// identity during password authentication.
+	//
+	// Usually only fields that has single column UNIQUE index are accepted as values.
+	IdentityFields []string `form:"identityFields" json:"identityFields"`
+}
+
+// Validate makes PasswordAuthConfig validatable by implementing [validation.Validatable] interface.
+func (c PasswordAuthConfig) Validate() error {
+	// strip duplicated values
+	c.IdentityFields = list.ToUniqueStringSlice(c.IdentityFields)
+
+	if !c.Enabled {
+		return nil // no need to validate
+	}
+
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.IdentityFields, validation.Required),
+	)
+}
+
+// -------------------------------------------------------------------
+
+type OAuth2KnownFields struct {
+	Id        string `form:"id" json:"id"`
+	Name      string `form:"name" json:"name"`
+	Username  string `form:"username" json:"username"`
+	AvatarURL string `form:"avatarURL" json:"avatarURL"`
+}
+
+type OAuth2Config struct {
+	Providers []OAuth2ProviderConfig `form:"providers" json:"providers"`
+
+	MappedFields OAuth2KnownFields `form:"mappedFields" json:"mappedFields"`
+
+	Enabled bool `form:"enabled" json:"enabled"`
+}
+
+// GetProviderConfig returns the first OAuth2ProviderConfig that matches the specified name.
+//
+// Returns false and zero config if no such provider is available in c.Providers.
+func (c OAuth2Config) GetProviderConfig(name string) (config OAuth2ProviderConfig, exists bool) {
+	for _, p := range c.Providers {
+		if p.Name == name {
+			return p, true
+		}
+	}
+	return
+}
+
+// Validate makes OAuth2Config validatable by implementing [validation.Validatable] interface.
+func (c OAuth2Config) Validate() error {
+	if !c.Enabled {
+		return nil // no need to validate
+	}
+
+	return validation.ValidateStruct(&c,
+		// note: don't require providers for now as they could be externally registered/removed
+		validation.Field(&c.Providers, validation.By(checkForDuplicatedProviders)),
+	)
+}
+
+func checkForDuplicatedProviders(value any) error {
+	configs, _ := value.([]OAuth2ProviderConfig)
+
+	existing := map[string]struct{}{}
+
+	for i, c := range configs {
+		if c.Name == "" {
+			continue // the name nonempty state is validated separately
+		}
+		if _, ok := existing[c.Name]; ok {
+			return validation.Errors{
+				strconv.Itoa(i): validation.Errors{
+					"name": validation.NewError("validation_duplicated_provider", "The provider {{.name}} is already registered.").
+						SetParams(map[string]any{"name": c.Name}),
+				},
+			}
+		}
+		existing[c.Name] = struct{}{}
+	}
+
+	return nil
+}
+
+type OAuth2ProviderConfig struct {
+	// PKCE overwrites the default provider PKCE config option.
+	//
+	// This usually shouldn't be needed but some OAuth2 vendors, like the LinkedIn OIDC,
+	// may require manual adjustment due to returning error if extra parameters are added to the request
+	// (https://github.com/pocketbase/pocketbase/discussions/3799#discussioncomment-7640312)
+	PKCE *bool `form:"pkce" json:"pkce"`
+
+	Name         string         `form:"name" json:"name"`
+	ClientId     string         `form:"clientId" json:"clientId"`
+	ClientSecret string         `form:"clientSecret" json:"clientSecret,omitempty"`
+	AuthURL      string         `form:"authURL" json:"authURL"`
+	TokenURL     string         `form:"tokenURL" json:"tokenURL"`
+	UserInfoURL  string         `form:"userInfoURL" json:"userInfoURL"`
+	DisplayName  string         `form:"displayName" json:"displayName"`
+	Extra        map[string]any `form:"extra" json:"extra"`
+}
+
+// Validate makes OAuth2ProviderConfig validatable by implementing [validation.Validatable] interface.
+func (c OAuth2ProviderConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.Name, validation.Required, validation.By(checkProviderName)),
+		validation.Field(&c.ClientId, validation.Required),
+		validation.Field(&c.ClientSecret, validation.Required),
+		validation.Field(&c.AuthURL, is.URL),
+		validation.Field(&c.TokenURL, is.URL),
+		validation.Field(&c.UserInfoURL, is.URL),
+	)
+}
+
+func checkProviderName(value any) error {
+	name, _ := value.(string)
+	if name == "" {
+		return nil // nothing to check
+	}
+
+	if _, err := auth.NewProviderByName(name); err != nil {
+		return validation.NewError("validation_missing_provider", "Invalid or missing provider with name {{.name}}.").
+			SetParams(map[string]any{"name": name})
+	}
+
+	return nil
+}
+
+// InitProvider returns a new auth.Provider instance loaded with the current OAuth2ProviderConfig options.
+func (c OAuth2ProviderConfig) InitProvider() (auth.Provider, error) {
+	provider, err := auth.NewProviderByName(c.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	if c.ClientId != "" {
+		provider.SetClientId(c.ClientId)
+	}
+
+	if c.ClientSecret != "" {
+		provider.SetClientSecret(c.ClientSecret)
+	}
+
+	if c.AuthURL != "" {
+		provider.SetAuthURL(c.AuthURL)
+	}
+
+	if c.UserInfoURL != "" {
+		provider.SetUserInfoURL(c.UserInfoURL)
+	}
+
+	if c.TokenURL != "" {
+		provider.SetTokenURL(c.TokenURL)
+	}
+
+	if c.DisplayName != "" {
+		provider.SetDisplayName(c.DisplayName)
+	}
+
+	if c.PKCE != nil {
+		provider.SetPKCE(*c.PKCE)
+	}
+
+	if c.Extra != nil {
+		provider.SetExtra(c.Extra)
+	}
+
+	return provider, nil
+}
diff --git a/server/core_backend-server/core/collection_model_auth_options_test.go b/server/core_backend-server/core/collection_model_auth_options_test.go
new file mode 100644
index 0000000..a0aaa3b
--- /dev/null
+++ b/server/core_backend-server/core/collection_model_auth_options_test.go
@@ -0,0 +1,1026 @@
+package core_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestCollectionAuthOptionsValidate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name           string
+		collection     func(app core.App) (*core.Collection, error)
+		expectedErrors []string
+	}{
+		// authRule
+		{
+			name: "nil authRule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.AuthRule = nil
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "empty authRule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.AuthRule = types.Pointer("")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "invalid authRule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.AuthRule = types.Pointer("missing != ''")
+				return c, nil
+			},
+			expectedErrors: []string{"authRule"},
+		},
+		{
+			name: "valid authRule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.AuthRule = types.Pointer("id != ''")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+
+		// manageRule
+		{
+			name: "nil manageRule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.ManageRule = nil
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "empty manageRule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.ManageRule = types.Pointer("")
+				return c, nil
+			},
+			expectedErrors: []string{"manageRule"},
+		},
+		{
+			name: "invalid manageRule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.ManageRule = types.Pointer("missing != ''")
+				return c, nil
+			},
+			expectedErrors: []string{"manageRule"},
+		},
+		{
+			name: "valid manageRule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.ManageRule = types.Pointer("id != ''")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+
+		// passwordAuth
+		{
+			name: "trigger passwordAuth validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.PasswordAuth = core.PasswordAuthConfig{
+					Enabled: true,
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"passwordAuth"},
+		},
+		{
+			name: "passwordAuth with non-unique identity fields",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(&core.TextField{Name: "test"})
+				c.PasswordAuth = core.PasswordAuthConfig{
+					Enabled:        true,
+					IdentityFields: []string{"email", "test"},
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"passwordAuth"},
+		},
+		{
+			name: "passwordAuth with non-unique identity fields",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(&core.TextField{Name: "test"})
+				c.AddIndex("auth_test_idx", true, "test", "")
+				c.PasswordAuth = core.PasswordAuthConfig{
+					Enabled:        true,
+					IdentityFields: []string{"email", "test"},
+				}
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+
+		// oauth2
+		{
+			name: "trigger oauth2 validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.OAuth2 = core.OAuth2Config{
+					Enabled: true,
+					Providers: []core.OAuth2ProviderConfig{
+						{Name: "missing"},
+					},
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"oauth2"},
+		},
+
+		// otp
+		{
+			name: "trigger otp validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.OTP = core.OTPConfig{
+					Enabled:  true,
+					Duration: -10,
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"otp"},
+		},
+
+		// mfa
+		{
+			name: "trigger mfa validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.MFA = core.MFAConfig{
+					Enabled:  true,
+					Duration: -10,
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"mfa"},
+		},
+		{
+			name: "mfa enabled with < 2 auth methods",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.MFA.Enabled = true
+				c.PasswordAuth.Enabled = true
+				c.OTP.Enabled = false
+				c.OAuth2.Enabled = false
+				return c, nil
+			},
+			expectedErrors: []string{"mfa"},
+		},
+		{
+			name: "mfa enabled with >= 2 auth methods",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.MFA.Enabled = true
+				c.PasswordAuth.Enabled = true
+				c.OTP.Enabled = true
+				c.OAuth2.Enabled = false
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "mfa disabled with invalid rule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.PasswordAuth.Enabled = true
+				c.OTP.Enabled = true
+				c.MFA.Enabled = false
+				c.MFA.Rule = "invalid"
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "mfa enabled with invalid rule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.PasswordAuth.Enabled = true
+				c.OTP.Enabled = true
+				c.MFA.Enabled = true
+				c.MFA.Rule = "invalid"
+				return c, nil
+			},
+			expectedErrors: []string{"mfa"},
+		},
+		{
+			name: "mfa enabled with valid rule",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.PasswordAuth.Enabled = true
+				c.OTP.Enabled = true
+				c.MFA.Enabled = true
+				c.MFA.Rule = "1=1"
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+
+		// tokens
+		{
+			name: "trigger authToken validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.AuthToken.Secret = ""
+				return c, nil
+			},
+			expectedErrors: []string{"authToken"},
+		},
+		{
+			name: "trigger passwordResetToken validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.PasswordResetToken.Secret = ""
+				return c, nil
+			},
+			expectedErrors: []string{"passwordResetToken"},
+		},
+		{
+			name: "trigger emailChangeToken validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.EmailChangeToken.Secret = ""
+				return c, nil
+			},
+			expectedErrors: []string{"emailChangeToken"},
+		},
+		{
+			name: "trigger verificationToken validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.VerificationToken.Secret = ""
+				return c, nil
+			},
+			expectedErrors: []string{"verificationToken"},
+		},
+		{
+			name: "trigger fileToken validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.FileToken.Secret = ""
+				return c, nil
+			},
+			expectedErrors: []string{"fileToken"},
+		},
+
+		// templates
+		{
+			name: "trigger verificationTemplate validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.VerificationTemplate.Body = ""
+				return c, nil
+			},
+			expectedErrors: []string{"verificationTemplate"},
+		},
+		{
+			name: "trigger resetPasswordTemplate validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.ResetPasswordTemplate.Body = ""
+				return c, nil
+			},
+			expectedErrors: []string{"resetPasswordTemplate"},
+		},
+		{
+			name: "trigger confirmEmailChangeTemplate validations",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.ConfirmEmailChangeTemplate.Body = ""
+				return c, nil
+			},
+			expectedErrors: []string{"confirmEmailChangeTemplate"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			collection, err := s.collection(app)
+			if err != nil {
+				t.Fatalf("Failed to retrieve test collection: %v", err)
+			}
+
+			result := app.Validate(collection)
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestEmailTemplateValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		template       core.EmailTemplate
+		expectedErrors []string
+	}{
+		{
+			"zero value",
+			core.EmailTemplate{},
+			[]string{"subject", "body"},
+		},
+		{
+			"non-empty data",
+			core.EmailTemplate{
+				Subject: "a",
+				Body:    "b",
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.template.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestEmailTemplateResolve(t *testing.T) {
+	template := core.EmailTemplate{
+		Subject: "test_subject {PARAM3} {PARAM1}-{PARAM2} repeat-{PARAM1}",
+		Body:    "test_body {PARAM3} {PARAM2}-{PARAM1} repeat-{PARAM2}",
+	}
+
+	scenarios := []struct {
+		name            string
+		placeholders    map[string]any
+		template        core.EmailTemplate
+		expectedSubject string
+		expectedBody    string
+	}{
+		{
+			"no placeholders",
+			nil,
+			template,
+			template.Subject,
+			template.Body,
+		},
+		{
+			"no matching placeholders",
+			map[string]any{"{A}": "abc", "{B}": 456},
+			template,
+			template.Subject,
+			template.Body,
+		},
+		{
+			"at least one matching placeholder",
+			map[string]any{"{PARAM1}": "abc", "{PARAM2}": 456},
+			template,
+			"test_subject {PARAM3} abc-456 repeat-abc",
+			"test_body {PARAM3} 456-abc repeat-456",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			subject, body := s.template.Resolve(s.placeholders)
+
+			if subject != s.expectedSubject {
+				t.Fatalf("Expected subject\n%v\ngot\n%v", s.expectedSubject, subject)
+			}
+
+			if body != s.expectedBody {
+				t.Fatalf("Expected body\n%v\ngot\n%v", s.expectedBody, body)
+			}
+		})
+	}
+}
+
+func TestTokenConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.TokenConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value",
+			core.TokenConfig{},
+			[]string{"secret", "duration"},
+		},
+		{
+			"invalid data",
+			core.TokenConfig{
+				Secret:   strings.Repeat("a", 29),
+				Duration: 9,
+			},
+			[]string{"secret", "duration"},
+		},
+		{
+			"valid data",
+			core.TokenConfig{
+				Secret:   strings.Repeat("a", 30),
+				Duration: 10,
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestTokenConfigDurationTime(t *testing.T) {
+	scenarios := []struct {
+		config   core.TokenConfig
+		expected time.Duration
+	}{
+		{core.TokenConfig{}, 0 * time.Second},
+		{core.TokenConfig{Duration: 1234}, 1234 * time.Second},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%d", i, s.config.Duration), func(t *testing.T) {
+			result := s.config.DurationTime()
+
+			if result != s.expected {
+				t.Fatalf("Expected duration %d, got %d", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestAuthAlertConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.AuthAlertConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value (disabled)",
+			core.AuthAlertConfig{},
+			[]string{"emailTemplate"},
+		},
+		{
+			"zero value (enabled)",
+			core.AuthAlertConfig{Enabled: true},
+			[]string{"emailTemplate"},
+		},
+		{
+			"invalid template",
+			core.AuthAlertConfig{
+				EmailTemplate: core.EmailTemplate{Body: "", Subject: "b"},
+			},
+			[]string{"emailTemplate"},
+		},
+		{
+			"valid data",
+			core.AuthAlertConfig{
+				EmailTemplate: core.EmailTemplate{Body: "a", Subject: "b"},
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestOTPConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.OTPConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value (disabled)",
+			core.OTPConfig{},
+			[]string{"emailTemplate"},
+		},
+		{
+			"zero value (enabled)",
+			core.OTPConfig{Enabled: true},
+			[]string{"duration", "length", "emailTemplate"},
+		},
+		{
+			"invalid length (< 3)",
+			core.OTPConfig{
+				Enabled:       true,
+				EmailTemplate: core.EmailTemplate{Body: "a", Subject: "b"},
+				Duration:      100,
+				Length:        3,
+			},
+			[]string{"length"},
+		},
+		{
+			"invalid duration (< 10)",
+			core.OTPConfig{
+				Enabled:       true,
+				EmailTemplate: core.EmailTemplate{Body: "a", Subject: "b"},
+				Duration:      9,
+				Length:        100,
+			},
+			[]string{"duration"},
+		},
+		{
+			"invalid duration (> 86400)",
+			core.OTPConfig{
+				Enabled:       true,
+				EmailTemplate: core.EmailTemplate{Body: "a", Subject: "b"},
+				Duration:      86401,
+				Length:        100,
+			},
+			[]string{"duration"},
+		},
+		{
+			"invalid template (triggering EmailTemplate validations)",
+			core.OTPConfig{
+				Enabled:       true,
+				EmailTemplate: core.EmailTemplate{Body: "", Subject: "b"},
+				Duration:      86400,
+				Length:        4,
+			},
+			[]string{"emailTemplate"},
+		},
+		{
+			"valid data",
+			core.OTPConfig{
+				Enabled:       true,
+				EmailTemplate: core.EmailTemplate{Body: "a", Subject: "b"},
+				Duration:      86400,
+				Length:        4,
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestOTPConfigDurationTime(t *testing.T) {
+	scenarios := []struct {
+		config   core.OTPConfig
+		expected time.Duration
+	}{
+		{core.OTPConfig{}, 0 * time.Second},
+		{core.OTPConfig{Duration: 1234}, 1234 * time.Second},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%d", i, s.config.Duration), func(t *testing.T) {
+			result := s.config.DurationTime()
+
+			if result != s.expected {
+				t.Fatalf("Expected duration %d, got %d", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestMFAConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.MFAConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value (disabled)",
+			core.MFAConfig{},
+			[]string{},
+		},
+		{
+			"zero value (enabled)",
+			core.MFAConfig{Enabled: true},
+			[]string{"duration"},
+		},
+		{
+			"invalid duration (< 10)",
+			core.MFAConfig{Enabled: true, Duration: 9},
+			[]string{"duration"},
+		},
+		{
+			"invalid duration (> 86400)",
+			core.MFAConfig{Enabled: true, Duration: 86401},
+			[]string{"duration"},
+		},
+		{
+			"valid data",
+			core.MFAConfig{Enabled: true, Duration: 86400},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestMFAConfigDurationTime(t *testing.T) {
+	scenarios := []struct {
+		config   core.MFAConfig
+		expected time.Duration
+	}{
+		{core.MFAConfig{}, 0 * time.Second},
+		{core.MFAConfig{Duration: 1234}, 1234 * time.Second},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%d", i, s.config.Duration), func(t *testing.T) {
+			result := s.config.DurationTime()
+
+			if result != s.expected {
+				t.Fatalf("Expected duration %d, got %d", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestPasswordAuthConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.PasswordAuthConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value (disabled)",
+			core.PasswordAuthConfig{},
+			[]string{},
+		},
+		{
+			"zero value (enabled)",
+			core.PasswordAuthConfig{Enabled: true},
+			[]string{"identityFields"},
+		},
+		{
+			"empty values",
+			core.PasswordAuthConfig{Enabled: true, IdentityFields: []string{"", ""}},
+			[]string{"identityFields"},
+		},
+		{
+			"valid data",
+			core.PasswordAuthConfig{Enabled: true, IdentityFields: []string{"abc"}},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestOAuth2ConfigGetProviderConfig(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		providerName   string
+		config         core.OAuth2Config
+		expectedExists bool
+	}{
+		{
+			"zero value",
+			"gitlab",
+			core.OAuth2Config{},
+			false,
+		},
+		{
+			"empty config with valid provider",
+			"gitlab",
+			core.OAuth2Config{},
+			false,
+		},
+		{
+			"non-empty config with missing provider",
+			"gitlab",
+			core.OAuth2Config{Providers: []core.OAuth2ProviderConfig{{Name: "google"}, {Name: "github"}}},
+			false,
+		},
+		{
+			"config with existing provider",
+			"github",
+			core.OAuth2Config{Providers: []core.OAuth2ProviderConfig{{Name: "google"}, {Name: "github"}}},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			config, exists := s.config.GetProviderConfig(s.providerName)
+
+			if exists != s.expectedExists {
+				t.Fatalf("Expected exists %v, got %v", s.expectedExists, exists)
+			}
+
+			if exists {
+				if config.Name != s.providerName {
+					t.Fatalf("Expected config with name %q, got %q", s.providerName, config.Name)
+				}
+			} else {
+				if config.Name != "" {
+					t.Fatalf("Expected empty config, got %v", config)
+				}
+			}
+		})
+	}
+}
+
+func TestOAuth2ConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.OAuth2Config
+		expectedErrors []string
+	}{
+		{
+			"zero value (disabled)",
+			core.OAuth2Config{},
+			[]string{},
+		},
+		{
+			"zero value (enabled)",
+			core.OAuth2Config{Enabled: true},
+			[]string{},
+		},
+		{
+			"unknown provider",
+			core.OAuth2Config{Enabled: true, Providers: []core.OAuth2ProviderConfig{
+				{Name: "missing", ClientId: "abc", ClientSecret: "456"},
+			}},
+			[]string{"providers"},
+		},
+		{
+			"known provider with invalid data",
+			core.OAuth2Config{Enabled: true, Providers: []core.OAuth2ProviderConfig{
+				{Name: "gitlab", ClientId: "abc", TokenURL: "!invalid!"},
+			}},
+			[]string{"providers"},
+		},
+		{
+			"known provider with valid data",
+			core.OAuth2Config{Enabled: true, Providers: []core.OAuth2ProviderConfig{
+				{Name: "gitlab", ClientId: "abc", ClientSecret: "456", TokenURL: "https://example.com"},
+			}},
+			[]string{},
+		},
+		{
+			"known provider with valid data (duplicated)",
+			core.OAuth2Config{Enabled: true, Providers: []core.OAuth2ProviderConfig{
+				{Name: "gitlab", ClientId: "abc1", ClientSecret: "1", TokenURL: "https://example1.com"},
+				{Name: "google", ClientId: "abc2", ClientSecret: "2", TokenURL: "https://example2.com"},
+				{Name: "gitlab", ClientId: "abc3", ClientSecret: "3", TokenURL: "https://example3.com"},
+			}},
+			[]string{"providers"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestOAuth2ProviderConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.OAuth2ProviderConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value",
+			core.OAuth2ProviderConfig{},
+			[]string{"name", "clientId", "clientSecret"},
+		},
+		{
+			"minimum valid data",
+			core.OAuth2ProviderConfig{Name: "gitlab", ClientId: "abc", ClientSecret: "456"},
+			[]string{},
+		},
+		{
+			"non-existing provider",
+			core.OAuth2ProviderConfig{Name: "missing", ClientId: "abc", ClientSecret: "456"},
+			[]string{"name"},
+		},
+		{
+			"invalid urls",
+			core.OAuth2ProviderConfig{
+				Name:         "gitlab",
+				ClientId:     "abc",
+				ClientSecret: "456",
+				AuthURL:      "!invalid!",
+				TokenURL:     "!invalid!",
+				UserInfoURL:  "!invalid!",
+			},
+			[]string{"authURL", "tokenURL", "userInfoURL"},
+		},
+		{
+			"valid urls",
+			core.OAuth2ProviderConfig{
+				Name:         "gitlab",
+				ClientId:     "abc",
+				ClientSecret: "456",
+				AuthURL:      "https://example.com/a",
+				TokenURL:     "https://example.com/b",
+				UserInfoURL:  "https://example.com/c",
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestOAuth2ProviderConfigInitProvider(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.OAuth2ProviderConfig
+		expectedConfig core.OAuth2ProviderConfig
+		expectedError  bool
+	}{
+		{
+			"empty config",
+			core.OAuth2ProviderConfig{},
+			core.OAuth2ProviderConfig{},
+			true,
+		},
+		{
+			"missing provider",
+			core.OAuth2ProviderConfig{
+				Name:         "missing",
+				ClientId:     "test_ClientId",
+				ClientSecret: "test_ClientSecret",
+				AuthURL:      "test_AuthURL",
+				TokenURL:     "test_TokenURL",
+				UserInfoURL:  "test_UserInfoURL",
+				DisplayName:  "test_DisplayName",
+				PKCE:         types.Pointer(true),
+			},
+			core.OAuth2ProviderConfig{
+				Name:         "missing",
+				ClientId:     "test_ClientId",
+				ClientSecret: "test_ClientSecret",
+				AuthURL:      "test_AuthURL",
+				TokenURL:     "test_TokenURL",
+				UserInfoURL:  "test_UserInfoURL",
+				DisplayName:  "test_DisplayName",
+				PKCE:         types.Pointer(true),
+			},
+			true,
+		},
+		{
+			"existing provider minimal",
+			core.OAuth2ProviderConfig{
+				Name: "gitlab",
+			},
+			core.OAuth2ProviderConfig{
+				Name:         "gitlab",
+				ClientId:     "",
+				ClientSecret: "",
+				AuthURL:      "https://gitlab.com/oauth/authorize",
+				TokenURL:     "https://gitlab.com/oauth/token",
+				UserInfoURL:  "https://gitlab.com/api/v4/user",
+				DisplayName:  "GitLab",
+				PKCE:         types.Pointer(true),
+			},
+			false,
+		},
+		{
+			"existing provider with all fields",
+			core.OAuth2ProviderConfig{
+				Name:         "gitlab",
+				ClientId:     "test_ClientId",
+				ClientSecret: "test_ClientSecret",
+				AuthURL:      "test_AuthURL",
+				TokenURL:     "test_TokenURL",
+				UserInfoURL:  "test_UserInfoURL",
+				DisplayName:  "test_DisplayName",
+				PKCE:         types.Pointer(true),
+				Extra:        map[string]any{"a": 1},
+			},
+			core.OAuth2ProviderConfig{
+				Name:         "gitlab",
+				ClientId:     "test_ClientId",
+				ClientSecret: "test_ClientSecret",
+				AuthURL:      "test_AuthURL",
+				TokenURL:     "test_TokenURL",
+				UserInfoURL:  "test_UserInfoURL",
+				DisplayName:  "test_DisplayName",
+				PKCE:         types.Pointer(true),
+				Extra:        map[string]any{"a": 1},
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			provider, err := s.config.InitProvider()
+
+			hasErr := err != nil
+			if hasErr != s.expectedError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectedError, hasErr)
+			}
+
+			if hasErr {
+				if provider != nil {
+					t.Fatalf("Expected nil provider, got %v", provider)
+				}
+				return
+			}
+
+			factory, ok := auth.Providers[s.expectedConfig.Name]
+			if !ok {
+				t.Fatalf("Missing factory for provider %q", s.expectedConfig.Name)
+			}
+
+			expectedType := fmt.Sprintf("%T", factory())
+			providerType := fmt.Sprintf("%T", provider)
+			if expectedType != providerType {
+				t.Fatalf("Expected provider instanceof %q, got %q", expectedType, providerType)
+			}
+
+			if provider.ClientId() != s.expectedConfig.ClientId {
+				t.Fatalf("Expected ClientId %q, got %q", s.expectedConfig.ClientId, provider.ClientId())
+			}
+
+			if provider.ClientSecret() != s.expectedConfig.ClientSecret {
+				t.Fatalf("Expected ClientSecret %q, got %q", s.expectedConfig.ClientSecret, provider.ClientSecret())
+			}
+
+			if provider.AuthURL() != s.expectedConfig.AuthURL {
+				t.Fatalf("Expected AuthURL %q, got %q", s.expectedConfig.AuthURL, provider.AuthURL())
+			}
+
+			if provider.UserInfoURL() != s.expectedConfig.UserInfoURL {
+				t.Fatalf("Expected UserInfoURL %q, got %q", s.expectedConfig.UserInfoURL, provider.UserInfoURL())
+			}
+
+			if provider.TokenURL() != s.expectedConfig.TokenURL {
+				t.Fatalf("Expected TokenURL %q, got %q", s.expectedConfig.TokenURL, provider.TokenURL())
+			}
+
+			if provider.DisplayName() != s.expectedConfig.DisplayName {
+				t.Fatalf("Expected DisplayName %q, got %q", s.expectedConfig.DisplayName, provider.DisplayName())
+			}
+
+			if provider.PKCE() != *s.expectedConfig.PKCE {
+				t.Fatalf("Expected PKCE %v, got %v", *s.expectedConfig.PKCE, provider.PKCE())
+			}
+
+			rawMeta, _ := json.Marshal(provider.Extra())
+			expectedMeta, _ := json.Marshal(s.expectedConfig.Extra)
+			if !bytes.Equal(rawMeta, expectedMeta) {
+				t.Fatalf("Expected PKCE %v, got %v", *s.expectedConfig.PKCE, provider.PKCE())
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/collection_model_auth_templates.go b/server/core_backend-server/core/collection_model_auth_templates.go
new file mode 100644
index 0000000..a0734bf
--- /dev/null
+++ b/server/core_backend-server/core/collection_model_auth_templates.go
@@ -0,0 +1,77 @@
+package core
+
+// Common settings placeholder tokens
+const (
+	EmailPlaceholderAppName   string = "{APP_NAME}"
+	EmailPlaceholderAppURL    string = "{APP_URL}"
+	EmailPlaceholderToken     string = "{TOKEN}"
+	EmailPlaceholderOTP       string = "{OTP}"
+	EmailPlaceholderOTPId     string = "{OTP_ID}"
+	EmailPlaceholderAlertInfo string = "{ALERT_INFO}"
+)
+
+var defaultVerificationTemplate = EmailTemplate{
+	Subject: "Verify your " + EmailPlaceholderAppName + " email",
+	Body: `<p>Hello,</p>
+<p>Thank you for joining us at ` + EmailPlaceholderAppName + `.</p>
+<p>Click on the button below to verify your email address.</p>
+<p>
+  <a class="btn" href="` + EmailPlaceholderAppURL + "/_/#/auth/confirm-verification/" + EmailPlaceholderToken + `" target="_blank" rel="noopener">Verify</a>
+</p>
+<p>
+  Thanks,<br/>
+  ` + EmailPlaceholderAppName + ` team
+</p>`,
+}
+
+var defaultResetPasswordTemplate = EmailTemplate{
+	Subject: "Reset your " + EmailPlaceholderAppName + " password",
+	Body: `<p>Hello,</p>
+<p>Click on the button below to reset your password.</p>
+<p>
+  <a class="btn" href="` + EmailPlaceholderAppURL + "/_/#/auth/confirm-password-reset/" + EmailPlaceholderToken + `" target="_blank" rel="noopener">Reset password</a>
+</p>
+<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>
+<p>
+  Thanks,<br/>
+  ` + EmailPlaceholderAppName + ` team
+</p>`,
+}
+
+var defaultConfirmEmailChangeTemplate = EmailTemplate{
+	Subject: "Confirm your " + EmailPlaceholderAppName + " new email address",
+	Body: `<p>Hello,</p>
+<p>Click on the button below to confirm your new email address.</p>
+<p>
+  <a class="btn" href="` + EmailPlaceholderAppURL + "/_/#/auth/confirm-email-change/" + EmailPlaceholderToken + `" target="_blank" rel="noopener">Confirm new email</a>
+</p>
+<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>
+<p>
+  Thanks,<br/>
+  ` + EmailPlaceholderAppName + ` team
+</p>`,
+}
+
+var defaultOTPTemplate = EmailTemplate{
+	Subject: "OTP for " + EmailPlaceholderAppName,
+	Body: `<p>Hello,</p>
+<p>Your one-time password is: <strong>` + EmailPlaceholderOTP + `</strong></p>
+<p><i>If you didn't ask for the one-time password, you can ignore this email.</i></p>
+<p>
+  Thanks,<br/>
+  ` + EmailPlaceholderAppName + ` team
+</p>`,
+}
+
+var defaultAuthAlertTemplate = EmailTemplate{
+	Subject: "Login from a new location",
+	Body: `<p>Hello,</p>
+<p>We noticed a login to your ` + EmailPlaceholderAppName + ` account from a new location:</p>
+<p><em>` + EmailPlaceholderAlertInfo + `</em></p>
+<p><strong>If this wasn't you, you should immediately change your ` + EmailPlaceholderAppName + ` account password to revoke access from all other locations.</strong></p>
+<p>If this was you, you may disregard this email.</p>
+<p>
+  Thanks,<br/>
+  ` + EmailPlaceholderAppName + ` team
+</p>`,
+}
diff --git a/server/core_backend-server/core/collection_model_base_options.go b/server/core_backend-server/core/collection_model_base_options.go
new file mode 100644
index 0000000..924312b
--- /dev/null
+++ b/server/core_backend-server/core/collection_model_base_options.go
@@ -0,0 +1,11 @@
+package core
+
+var _ optionsValidator = (*collectionBaseOptions)(nil)
+
+// collectionBaseOptions defines the options for the "base" type collection.
+type collectionBaseOptions struct {
+}
+
+func (o *collectionBaseOptions) validate(cv *collectionValidator) error {
+	return nil
+}
diff --git a/server/core_backend-server/core/collection_model_test.go b/server/core_backend-server/core/collection_model_test.go
new file mode 100644
index 0000000..68d1c75
--- /dev/null
+++ b/server/core_backend-server/core/collection_model_test.go
@@ -0,0 +1,1704 @@
+package core_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestNewCollection(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		typ      string
+		name     string
+		expected []string
+	}{
+		{
+			"",
+			"",
+			[]string{
+				`"id":"pbc_`,
+				`"name":""`,
+				`"type":"base"`,
+				`"system":false`,
+				`"indexes":[]`,
+				`"fields":[{`,
+				`"name":"id"`,
+				`"type":"text"`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+			},
+		},
+		{
+			"unknown",
+			"test",
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"base"`,
+				`"system":false`,
+				`"indexes":[]`,
+				`"fields":[{`,
+				`"name":"id"`,
+				`"type":"text"`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+			},
+		},
+		{
+			"base",
+			"test",
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"base"`,
+				`"system":false`,
+				`"indexes":[]`,
+				`"fields":[{`,
+				`"name":"id"`,
+				`"type":"text"`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+			},
+		},
+		{
+			"view",
+			"test",
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"view"`,
+				`"indexes":[]`,
+				`"fields":[]`,
+				`"system":false`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+			},
+		},
+		{
+			"auth",
+			"test",
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"auth"`,
+				`"fields":[{`,
+				`"system":false`,
+				`"type":"text"`,
+				`"type":"email"`,
+				`"name":"id"`,
+				`"name":"email"`,
+				`"name":"password"`,
+				`"name":"tokenKey"`,
+				`"name":"emailVisibility"`,
+				`"name":"verified"`,
+				`idx_email`,
+				`idx_tokenKey`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+				`"identityFields":["email"]`,
+			},
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.typ, s.name), func(t *testing.T) {
+			result := core.NewCollection(s.typ, s.name).String()
+
+			for _, part := range s.expected {
+				if !strings.Contains(result, part) {
+					t.Fatalf("Missing part %q in\n%v", part, result)
+				}
+			}
+		})
+	}
+}
+
+func TestNewBaseCollection(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name     string
+		expected []string
+	}{
+		{
+			"",
+			[]string{
+				`"id":"pbc_`,
+				`"name":""`,
+				`"type":"base"`,
+				`"system":false`,
+				`"indexes":[]`,
+				`"fields":[{`,
+				`"name":"id"`,
+				`"type":"text"`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+			},
+		},
+		{
+			"test",
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"base"`,
+				`"system":false`,
+				`"indexes":[]`,
+				`"fields":[{`,
+				`"name":"id"`,
+				`"type":"text"`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+			},
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.name), func(t *testing.T) {
+			result := core.NewBaseCollection(s.name).String()
+
+			for _, part := range s.expected {
+				if !strings.Contains(result, part) {
+					t.Fatalf("Missing part %q in\n%v", part, result)
+				}
+			}
+		})
+	}
+}
+
+func TestNewViewCollection(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name     string
+		expected []string
+	}{
+		{
+			"",
+			[]string{
+				`"id":"pbc_`,
+				`"name":""`,
+				`"type":"view"`,
+				`"indexes":[]`,
+				`"fields":[]`,
+				`"system":false`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+			},
+		},
+		{
+			"test",
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"view"`,
+				`"indexes":[]`,
+				`"fields":[]`,
+				`"system":false`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+			},
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.name), func(t *testing.T) {
+			result := core.NewViewCollection(s.name).String()
+
+			for _, part := range s.expected {
+				if !strings.Contains(result, part) {
+					t.Fatalf("Missing part %q in\n%v", part, result)
+				}
+			}
+		})
+	}
+}
+
+func TestNewAuthCollection(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name     string
+		expected []string
+	}{
+		{
+			"",
+			[]string{
+				`"id":""`,
+				`"name":""`,
+				`"type":"auth"`,
+				`"fields":[{`,
+				`"system":false`,
+				`"type":"text"`,
+				`"type":"email"`,
+				`"name":"id"`,
+				`"name":"email"`,
+				`"name":"password"`,
+				`"name":"tokenKey"`,
+				`"name":"emailVisibility"`,
+				`"name":"verified"`,
+				`idx_email`,
+				`idx_tokenKey`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+				`"identityFields":["email"]`,
+			},
+		},
+		{
+			"test",
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"auth"`,
+				`"fields":[{`,
+				`"system":false`,
+				`"type":"text"`,
+				`"type":"email"`,
+				`"name":"id"`,
+				`"name":"email"`,
+				`"name":"password"`,
+				`"name":"tokenKey"`,
+				`"name":"emailVisibility"`,
+				`"name":"verified"`,
+				`idx_email`,
+				`idx_tokenKey`,
+				`"listRule":null`,
+				`"viewRule":null`,
+				`"createRule":null`,
+				`"updateRule":null`,
+				`"deleteRule":null`,
+				`"identityFields":["email"]`,
+			},
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.name), func(t *testing.T) {
+			result := core.NewAuthCollection(s.name).String()
+
+			for _, part := range s.expected {
+				if !strings.Contains(result, part) {
+					t.Fatalf("Missing part %q in\n%v", part, result)
+				}
+			}
+		})
+	}
+}
+
+func TestCollectionTableName(t *testing.T) {
+	t.Parallel()
+
+	c := core.NewBaseCollection("test")
+	if c.TableName() != "_collections" {
+		t.Fatalf("Expected tableName %q, got %q", "_collections", c.TableName())
+	}
+}
+
+func TestCollectionBaseFilesPath(t *testing.T) {
+	t.Parallel()
+
+	c := core.Collection{}
+
+	if c.BaseFilesPath() != "" {
+		t.Fatalf("Expected empty string, got %q", c.BaseFilesPath())
+	}
+
+	c.Id = "test"
+
+	if c.BaseFilesPath() != c.Id {
+		t.Fatalf("Expected %q, got %q", c.Id, c.BaseFilesPath())
+	}
+}
+
+func TestCollectionIsBase(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		typ      string
+		expected bool
+	}{
+		{"unknown", false},
+		{core.CollectionTypeBase, true},
+		{core.CollectionTypeView, false},
+		{core.CollectionTypeAuth, false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.typ, func(t *testing.T) {
+			c := core.Collection{}
+			c.Type = s.typ
+
+			if v := c.IsBase(); v != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestCollectionIsView(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		typ      string
+		expected bool
+	}{
+		{"unknown", false},
+		{core.CollectionTypeBase, false},
+		{core.CollectionTypeView, true},
+		{core.CollectionTypeAuth, false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.typ, func(t *testing.T) {
+			c := core.Collection{}
+			c.Type = s.typ
+
+			if v := c.IsView(); v != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestCollectionIsAuth(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		typ      string
+		expected bool
+	}{
+		{"unknown", false},
+		{core.CollectionTypeBase, false},
+		{core.CollectionTypeView, false},
+		{core.CollectionTypeAuth, true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.typ, func(t *testing.T) {
+			c := core.Collection{}
+			c.Type = s.typ
+
+			if v := c.IsAuth(); v != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestCollectionPostScan(t *testing.T) {
+	t.Parallel()
+
+	rawOptions := types.JSONRaw(`{
+		"viewQuery":"select 1",
+		"authRule":"1=2"
+	}`)
+
+	scenarios := []struct {
+		typ        string
+		rawOptions types.JSONRaw
+		expected   []string
+	}{
+		{
+			core.CollectionTypeBase,
+			rawOptions,
+			[]string{
+				`lastSavedPK:"test"`,
+				`ViewQuery:""`,
+				`AuthRule:(*string)(nil)`,
+			},
+		},
+		{
+			core.CollectionTypeView,
+			rawOptions,
+			[]string{
+				`lastSavedPK:"test"`,
+				`ViewQuery:"select 1"`,
+				`AuthRule:(*string)(nil)`,
+			},
+		},
+		{
+			core.CollectionTypeAuth,
+			rawOptions,
+			[]string{
+				`lastSavedPK:"test"`,
+				`ViewQuery:""`,
+				`AuthRule:(*string)(0x`,
+			},
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.typ), func(t *testing.T) {
+			c := core.Collection{}
+			c.Id = "test"
+			c.Type = s.typ
+			c.RawOptions = s.rawOptions
+
+			err := c.PostScan()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if c.IsNew() {
+				t.Fatal("Expected the collection to be marked as not new")
+			}
+
+			rawModel := fmt.Sprintf("%#v", c)
+
+			for _, part := range s.expected {
+				if !strings.Contains(rawModel, part) {
+					t.Fatalf("Missing part %q in\n%v", part, rawModel)
+				}
+			}
+		})
+	}
+}
+
+func TestCollectionUnmarshalJSON(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name        string
+		raw         string
+		collection  func() *core.Collection
+		expected    []string
+		notExpected []string
+	}{
+		{
+			"base new empty",
+			`{"type":"base","name":"test","listRule":"1=2","authRule":"1=3","viewQuery":"abc"}`,
+			func() *core.Collection {
+				return &core.Collection{}
+			},
+			[]string{
+				`"type":"base"`,
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"listRule":"1=2"`,
+				`"fields":[`,
+				`"name":"id"`,
+				`"indexes":[]`,
+			},
+			[]string{
+				`"authRule":"1=3"`,
+				`"viewQuery":"abc"`,
+			},
+		},
+		{
+			"view new empty",
+			`{"type":"view","name":"test","listRule":"1=2","authRule":"1=3","viewQuery":"abc"}`,
+			func() *core.Collection {
+				return &core.Collection{}
+			},
+			[]string{
+				`"type":"view"`,
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"listRule":"1=2"`,
+				`"fields":[]`,
+				`"viewQuery":"abc"`,
+				`"indexes":[]`,
+			},
+			[]string{
+				`"authRule":"1=3"`,
+			},
+		},
+		{
+			"auth new empty",
+			`{"type":"auth","name":"test","listRule":"1=2","authRule":"1=3","viewQuery":"abc"}`,
+			func() *core.Collection {
+				return &core.Collection{}
+			},
+			[]string{
+				`"type":"auth"`,
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"listRule":"1=2"`,
+				`"authRule":"1=3"`,
+				`"fields":[`,
+				`"name":"id"`,
+			},
+			[]string{
+				`"indexes":[]`,
+				`"viewQuery":"abc"`,
+			},
+		},
+		{
+			"new but with set type (no default fields load)",
+			`{"type":"base","name":"test","listRule":"1=2","authRule":"1=3","viewQuery":"abc"}`,
+			func() *core.Collection {
+				c := &core.Collection{}
+				c.Type = core.CollectionTypeBase
+				return c
+			},
+			[]string{
+				`"type":"base"`,
+				`"id":""`,
+				`"name":"test"`,
+				`"listRule":"1=2"`,
+				`"fields":[]`,
+			},
+			[]string{
+				`"authRule":"1=3"`,
+				`"viewQuery":"abc"`,
+			},
+		},
+		{
+			"existing (no default fields load)",
+			`{"type":"auth","name":"test","listRule":"1=2","authRule":"1=3","viewQuery":"abc"}`,
+			func() *core.Collection {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				return c
+			},
+			[]string{
+				`"type":"auth"`,
+				`"name":"test"`,
+				`"listRule":"1=2"`,
+				`"authRule":"1=3"`,
+				`"fields":[`,
+				`"name":"id"`,
+			},
+			[]string{
+				`"name":"tokenKey"`,
+				`"viewQuery":"abc"`,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := s.collection()
+
+			err := json.Unmarshal([]byte(s.raw), collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			rawResult, err := json.Marshal(collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawResultStr := string(rawResult)
+
+			for _, part := range s.expected {
+				if !strings.Contains(rawResultStr, part) {
+					t.Fatalf("Missing expected %q in\n%v", part, rawResultStr)
+				}
+			}
+
+			for _, part := range s.notExpected {
+				if strings.Contains(rawResultStr, part) {
+					t.Fatalf("Didn't expected %q in\n%v", part, rawResultStr)
+				}
+			}
+		})
+	}
+}
+
+func TestCollectionSerialize(t *testing.T) {
+	scenarios := []struct {
+		name        string
+		collection  func() *core.Collection
+		expected    []string
+		notExpected []string
+	}{
+		{
+			"base",
+			func() *core.Collection {
+				c := core.NewCollection(core.CollectionTypeBase, "test")
+				c.ViewQuery = "1=1"
+				c.OAuth2.Providers = []core.OAuth2ProviderConfig{
+					{Name: "test1", ClientId: "test_client_id1", ClientSecret: "test_client_secret1"},
+					{Name: "test2", ClientId: "test_client_id2", ClientSecret: "test_client_secret2"},
+				}
+
+				return c
+			},
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"base"`,
+			},
+			[]string{
+				"verificationTemplate",
+				"manageRule",
+				"authRule",
+				"secret",
+				"oauth2",
+				"clientId",
+				"clientSecret",
+				"viewQuery",
+			},
+		},
+		{
+			"view",
+			func() *core.Collection {
+				c := core.NewCollection(core.CollectionTypeView, "test")
+				c.ViewQuery = "1=1"
+				c.OAuth2.Providers = []core.OAuth2ProviderConfig{
+					{Name: "test1", ClientId: "test_client_id1", ClientSecret: "test_client_secret1"},
+					{Name: "test2", ClientId: "test_client_id2", ClientSecret: "test_client_secret2"},
+				}
+
+				return c
+			},
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"view"`,
+				`"viewQuery":"1=1"`,
+			},
+			[]string{
+				"verificationTemplate",
+				"manageRule",
+				"authRule",
+				"secret",
+				"oauth2",
+				"clientId",
+				"clientSecret",
+			},
+		},
+		{
+			"auth",
+			func() *core.Collection {
+				c := core.NewCollection(core.CollectionTypeAuth, "test")
+				c.ViewQuery = "1=1"
+				c.OAuth2.Providers = []core.OAuth2ProviderConfig{
+					{Name: "test1", ClientId: "test_client_id1", ClientSecret: "test_client_secret1"},
+					{Name: "test2", ClientId: "test_client_id2", ClientSecret: "test_client_secret2"},
+				}
+
+				return c
+			},
+			[]string{
+				`"id":"pbc_`,
+				`"name":"test"`,
+				`"type":"auth"`,
+				`"oauth2":{`,
+				`"providers":[{`,
+				`"clientId":"test_client_id1"`,
+				`"clientId":"test_client_id2"`,
+			},
+			[]string{
+				"viewQuery",
+				"secret",
+				"clientSecret",
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := s.collection()
+
+			raw, err := collection.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != collection.String() {
+				t.Fatalf("Expected the same serialization, got\n%v\nVS\n%v", collection.String(), rawStr)
+			}
+
+			for _, part := range s.expected {
+				if !strings.Contains(rawStr, part) {
+					t.Fatalf("Missing part %q in\n%v", part, rawStr)
+				}
+			}
+
+			for _, part := range s.notExpected {
+				if strings.Contains(rawStr, part) {
+					t.Fatalf("Didn't expect part %q in\n%v", part, rawStr)
+				}
+			}
+		})
+	}
+}
+
+func TestCollectionDBExport(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	date, err := types.ParseDateTime("2024-07-01 01:02:03.456Z")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		typ      string
+		expected string
+	}{
+		{
+			"unknown",
+			`{"createRule":"1=3","created":"2024-07-01 01:02:03.456Z","deleteRule":"1=5","fields":[{"hidden":false,"id":"f1_id","name":"f1","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"f2_id","name":"f2","presentable":false,"required":true,"system":false,"type":"bool"}],"id":"test_id","indexes":["CREATE INDEX idx1 on test_name(id)","CREATE INDEX idx2 on test_name(id)"],"listRule":"1=1","name":"test_name","options":"{}","system":true,"type":"unknown","updateRule":"1=4","updated":"2024-07-01 01:02:03.456Z","viewRule":"1=7"}`,
+		},
+		{
+			core.CollectionTypeBase,
+			`{"createRule":"1=3","created":"2024-07-01 01:02:03.456Z","deleteRule":"1=5","fields":[{"hidden":false,"id":"f1_id","name":"f1","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"f2_id","name":"f2","presentable":false,"required":true,"system":false,"type":"bool"}],"id":"test_id","indexes":["CREATE INDEX idx1 on test_name(id)","CREATE INDEX idx2 on test_name(id)"],"listRule":"1=1","name":"test_name","options":"{}","system":true,"type":"base","updateRule":"1=4","updated":"2024-07-01 01:02:03.456Z","viewRule":"1=7"}`,
+		},
+		{
+			core.CollectionTypeView,
+			`{"createRule":"1=3","created":"2024-07-01 01:02:03.456Z","deleteRule":"1=5","fields":[{"hidden":false,"id":"f1_id","name":"f1","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"f2_id","name":"f2","presentable":false,"required":true,"system":false,"type":"bool"}],"id":"test_id","indexes":["CREATE INDEX idx1 on test_name(id)","CREATE INDEX idx2 on test_name(id)"],"listRule":"1=1","name":"test_name","options":{"viewQuery":"select 1"},"system":true,"type":"view","updateRule":"1=4","updated":"2024-07-01 01:02:03.456Z","viewRule":"1=7"}`,
+		},
+		{
+			core.CollectionTypeAuth,
+			`{"createRule":"1=3","created":"2024-07-01 01:02:03.456Z","deleteRule":"1=5","fields":[{"hidden":false,"id":"f1_id","name":"f1","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"f2_id","name":"f2","presentable":false,"required":true,"system":false,"type":"bool"}],"id":"test_id","indexes":["CREATE INDEX idx1 on test_name(id)","CREATE INDEX idx2 on test_name(id)"],"listRule":"1=1","name":"test_name","options":{"authRule":null,"manageRule":"1=6","authAlert":{"enabled":false,"emailTemplate":{"subject":"","body":""}},"oauth2":{"providers":null,"mappedFields":{"id":"","name":"","username":"","avatarURL":""},"enabled":false},"passwordAuth":{"enabled":false,"identityFields":null},"mfa":{"enabled":false,"duration":0,"rule":""},"otp":{"enabled":false,"duration":0,"length":0,"emailTemplate":{"subject":"","body":""}},"authToken":{"duration":0},"passwordResetToken":{"duration":0},"emailChangeToken":{"duration":0},"verificationToken":{"duration":0},"fileToken":{"duration":0},"verificationTemplate":{"subject":"","body":""},"resetPasswordTemplate":{"subject":"","body":""},"confirmEmailChangeTemplate":{"subject":"","body":""}},"system":true,"type":"auth","updateRule":"1=4","updated":"2024-07-01 01:02:03.456Z","viewRule":"1=7"}`,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.typ), func(t *testing.T) {
+			c := core.Collection{}
+			c.Type = s.typ
+			c.Id = "test_id"
+			c.Name = "test_name"
+			c.System = true
+			c.ListRule = types.Pointer("1=1")
+			c.ViewRule = types.Pointer("1=2")
+			c.CreateRule = types.Pointer("1=3")
+			c.UpdateRule = types.Pointer("1=4")
+			c.DeleteRule = types.Pointer("1=5")
+			c.ManageRule = types.Pointer("1=6")
+			c.ViewRule = types.Pointer("1=7")
+			c.Created = date
+			c.Updated = date
+			c.Indexes = types.JSONArray[string]{"CREATE INDEX idx1 on test_name(id)", "CREATE INDEX idx2 on test_name(id)"}
+			c.ViewQuery = "select 1"
+			c.Fields.Add(&core.BoolField{Id: "f1_id", Name: "f1", System: true})
+			c.Fields.Add(&core.BoolField{Id: "f2_id", Name: "f2", Required: true})
+			c.RawOptions = types.JSONRaw(`{"viewQuery": "select 2"}`) // should be ignored
+
+			result, err := c.DBExport(app)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := json.Marshal(result)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if str := string(raw); str != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestCollectionIndexHelpers(t *testing.T) {
+	t.Parallel()
+
+	checkIndexes := func(t *testing.T, indexes, expectedIndexes []string) {
+		if len(indexes) != len(expectedIndexes) {
+			t.Fatalf("Expected %d indexes, got %d\n%v", len(expectedIndexes), len(indexes), indexes)
+		}
+
+		for _, idx := range expectedIndexes {
+			if !slices.Contains(indexes, idx) {
+				t.Fatalf("Missing index\n%v\nin\n%v", idx, indexes)
+			}
+		}
+	}
+
+	c := core.NewBaseCollection("test")
+	checkIndexes(t, c.Indexes, nil)
+
+	c.AddIndex("idx1", false, "colA,colB", "colA != 1")
+	c.AddIndex("idx2", true, "colA", "")
+	c.AddIndex("idx3", false, "colA", "")
+	c.AddIndex("idx3", false, "colB", "") // should overwrite the previous one
+
+	/* SQLite:
+	idx1 := "CREATE INDEX `idx1` ON `test` (colA,colB) WHERE colA != 1"
+	idx2 := "CREATE UNIQUE INDEX `idx2` ON `test` (colA)"
+	idx3 := "CREATE INDEX `idx3` ON `test` (colB)"
+	*/
+	// PostgreSQL:
+	idx1 := `CREATE INDEX "idx1" ON "test" (colA,colB) WHERE colA != 1`
+	idx2 := `CREATE UNIQUE INDEX "idx2" ON "test" (colA)`
+	idx3 := `CREATE INDEX "idx3" ON "test" (colB)`
+
+	checkIndexes(t, c.Indexes, []string{idx1, idx2, idx3})
+
+	c.RemoveIndex("iDx2")    // case-insensitive
+	c.RemoveIndex("missing") // noop
+
+	checkIndexes(t, c.Indexes, []string{idx1, idx3})
+
+	expectedIndexes := map[string]string{
+		"missing": "",
+		"idx1":    idx1,
+		// the name is case insensitive
+		"iDX3": idx3,
+	}
+	for key, expectedIdx := range expectedIndexes {
+		idx := c.GetIndex(key)
+		if idx != expectedIdx {
+			t.Errorf("Expected index %q to be\n%v\ngot\n%v", key, expectedIdx, idx)
+		}
+	}
+}
+
+// -------------------------------------------------------------------
+
+func TestCollectionDelete(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name                   string
+		collection             string
+		disableIntegrityChecks bool
+		expectError            bool
+	}{
+		{
+			name:        "unsaved",
+			collection:  "",
+			expectError: true,
+		},
+		{
+			name:        "system",
+			collection:  core.CollectionNameSuperusers,
+			expectError: true,
+		},
+		{
+			name:        "base with references",
+			collection:  "demo1",
+			expectError: true,
+		},
+		{
+			name:                   "base with references with disabled integrity checks",
+			collection:             "demo1",
+			disableIntegrityChecks: true,
+			expectError:            false,
+		},
+		{
+			name:        "base without references",
+			collection:  "demo1",
+			expectError: true,
+		},
+		{
+			name:        "view with reference",
+			collection:  "view1",
+			expectError: true,
+		},
+		{
+			name:                   "view with references with disabled integrity checks",
+			collection:             "view1",
+			disableIntegrityChecks: true,
+			expectError:            false,
+		},
+		{
+			name:                   "view without references",
+			collection:             "view2",
+			disableIntegrityChecks: true,
+			expectError:            false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			var col *core.Collection
+
+			if s.collection == "" {
+				col = core.NewBaseCollection("test")
+			} else {
+				var err error
+				col, err = app.FindCollectionByNameOrId(s.collection)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			if s.disableIntegrityChecks {
+				col.IntegrityChecks(!s.disableIntegrityChecks)
+			}
+
+			err := app.Delete(col)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			exists := app.HasTable(col.Name)
+
+			if !col.IsNew() && exists != hasErr {
+				t.Fatalf("Expected HasTable %v, got %v", hasErr, exists)
+			}
+
+			if !hasErr {
+				cache, _ := app.FindCachedCollectionByNameOrId(col.Id)
+				if cache != nil {
+					t.Fatal("Expected the collection to be removed from the cache.")
+				}
+			}
+		})
+	}
+}
+
+func TestCollectionModelEventSync(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	testCollections := make([]*core.Collection, 4)
+	for i := 0; i < 4; i++ {
+		testCollections[i] = core.NewBaseCollection("sync_test_" + strconv.Itoa(i))
+		if err := app.Save(testCollections[i]); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	createModelEvent := func() *core.ModelEvent {
+		event := new(core.ModelEvent)
+		event.App = app
+		event.Context = context.Background()
+		event.Type = "test_a"
+		event.Model = testCollections[0]
+		return event
+	}
+
+	createModelErrorEvent := func() *core.ModelErrorEvent {
+		event := new(core.ModelErrorEvent)
+		event.ModelEvent = *createModelEvent()
+		event.Error = errors.New("error_a")
+		return event
+	}
+
+	changeCollectionEventBefore := func(e *core.CollectionEvent) {
+		e.Type = "test_b"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 123)
+		e.Collection = testCollections[1]
+	}
+
+	modelEventFinalizerChange := func(e *core.ModelEvent) {
+		e.Type = "test_c"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 456)
+		e.Model = testCollections[2]
+	}
+
+	changeCollectionEventAfter := func(e *core.CollectionEvent) {
+		e.Type = "test_d"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 789)
+		e.Collection = testCollections[3]
+	}
+
+	expectedBeforeModelEventHandlerChecks := func(t *testing.T, e *core.ModelEvent) {
+		if e.Type != "test_a" {
+			t.Fatalf("Expected type %q, got %q", "test_a", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != nil {
+			t.Fatalf("Expected context value %v, got %v", nil, v)
+		}
+
+		if e.Model.PK() != testCollections[0].Id {
+			t.Fatalf("Expected collection with id %q, got %q (%d)", testCollections[0].Id, e.Model.PK(), 0)
+		}
+	}
+
+	expectedAfterModelEventHandlerChecks := func(t *testing.T, e *core.ModelEvent) {
+		if e.Type != "test_d" {
+			t.Fatalf("Expected type %q, got %q", "test_d", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != 789 {
+			t.Fatalf("Expected context value %v, got %v", 789, v)
+		}
+
+		if e.Model.PK() != testCollections[3].Id {
+			t.Fatalf("Expected collection with id %q, got %q (%d)", testCollections[3].Id, e.Model.PK(), 3)
+		}
+	}
+
+	expectedBeforeCollectionEventHandlerChecks := func(t *testing.T, e *core.CollectionEvent) {
+		if e.Type != "test_a" {
+			t.Fatalf("Expected type %q, got %q", "test_a", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != nil {
+			t.Fatalf("Expected context value %v, got %v", nil, v)
+		}
+
+		if e.Collection.Id != testCollections[0].Id {
+			t.Fatalf("Expected collection with id %q, got %q (%d)", testCollections[0].Id, e.Collection.Id, 0)
+		}
+	}
+
+	expectedAfterCollectionEventHandlerChecks := func(t *testing.T, e *core.CollectionEvent) {
+		if e.Type != "test_c" {
+			t.Fatalf("Expected type %q, got %q", "test_c", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != 456 {
+			t.Fatalf("Expected context value %v, got %v", 456, v)
+		}
+
+		if e.Collection.Id != testCollections[2].Id {
+			t.Fatalf("Expected collection with id %q, got %q (%d)", testCollections[2].Id, e.Collection.Id, 2)
+		}
+	}
+
+	modelEventFinalizer := func(e *core.ModelEvent) error {
+		modelEventFinalizerChange(e)
+		return nil
+	}
+
+	modelErrorEventFinalizer := func(e *core.ModelErrorEvent) error {
+		modelEventFinalizerChange(&e.ModelEvent)
+		e.Error = errors.New("error_c")
+		return nil
+	}
+
+	modelEventHandler := &hook.Handler[*core.ModelEvent]{
+		Priority: -999,
+		Func: func(e *core.ModelEvent) error {
+			t.Run("before model", func(t *testing.T) {
+				expectedBeforeModelEventHandlerChecks(t, e)
+			})
+
+			_ = e.Next()
+
+			t.Run("after model", func(t *testing.T) {
+				expectedAfterModelEventHandlerChecks(t, e)
+			})
+
+			return nil
+		},
+	}
+
+	modelErrorEventHandler := &hook.Handler[*core.ModelErrorEvent]{
+		Priority: -999,
+		Func: func(e *core.ModelErrorEvent) error {
+			t.Run("before model error", func(t *testing.T) {
+				expectedBeforeModelEventHandlerChecks(t, &e.ModelEvent)
+				if v := e.Error.Error(); v != "error_a" {
+					t.Fatalf("Expected error %q, got %q", "error_a", v)
+				}
+			})
+
+			_ = e.Next()
+
+			t.Run("after model error", func(t *testing.T) {
+				expectedAfterModelEventHandlerChecks(t, &e.ModelEvent)
+				if v := e.Error.Error(); v != "error_d" {
+					t.Fatalf("Expected error %q, got %q", "error_d", v)
+				}
+			})
+
+			return nil
+		},
+	}
+
+	recordEventHandler := &hook.Handler[*core.CollectionEvent]{
+		Priority: -999,
+		Func: func(e *core.CollectionEvent) error {
+			t.Run("before collection", func(t *testing.T) {
+				expectedBeforeCollectionEventHandlerChecks(t, e)
+			})
+
+			changeCollectionEventBefore(e)
+
+			_ = e.Next()
+
+			t.Run("after collection", func(t *testing.T) {
+				expectedAfterCollectionEventHandlerChecks(t, e)
+			})
+
+			changeCollectionEventAfter(e)
+
+			return nil
+		},
+	}
+
+	collectionErrorEventHandler := &hook.Handler[*core.CollectionErrorEvent]{
+		Priority: -999,
+		Func: func(e *core.CollectionErrorEvent) error {
+			t.Run("before collection error", func(t *testing.T) {
+				expectedBeforeCollectionEventHandlerChecks(t, &e.CollectionEvent)
+				if v := e.Error.Error(); v != "error_a" {
+					t.Fatalf("Expected error %q, got %q", "error_c", v)
+				}
+			})
+
+			changeCollectionEventBefore(&e.CollectionEvent)
+			e.Error = errors.New("error_b")
+
+			_ = e.Next()
+
+			t.Run("after collection error", func(t *testing.T) {
+				expectedAfterCollectionEventHandlerChecks(t, &e.CollectionEvent)
+				if v := e.Error.Error(); v != "error_c" {
+					t.Fatalf("Expected error %q, got %q", "error_c", v)
+				}
+			})
+
+			changeCollectionEventAfter(&e.CollectionEvent)
+			e.Error = errors.New("error_d")
+
+			return nil
+		},
+	}
+
+	// OnModelValidate
+	app.OnCollectionValidate().Bind(recordEventHandler)
+	app.OnModelValidate().Bind(modelEventHandler)
+	app.OnModelValidate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelCreate
+	app.OnCollectionCreate().Bind(recordEventHandler)
+	app.OnModelCreate().Bind(modelEventHandler)
+	app.OnModelCreate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelCreateExecute
+	app.OnCollectionCreateExecute().Bind(recordEventHandler)
+	app.OnModelCreateExecute().Bind(modelEventHandler)
+	app.OnModelCreateExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterCreateSuccess
+	app.OnCollectionAfterCreateSuccess().Bind(recordEventHandler)
+	app.OnModelAfterCreateSuccess().Bind(modelEventHandler)
+	app.OnModelAfterCreateSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterCreateError
+	app.OnCollectionAfterCreateError().Bind(collectionErrorEventHandler)
+	app.OnModelAfterCreateError().Bind(modelErrorEventHandler)
+	app.OnModelAfterCreateError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+
+	// OnModelUpdate
+	app.OnCollectionUpdate().Bind(recordEventHandler)
+	app.OnModelUpdate().Bind(modelEventHandler)
+	app.OnModelUpdate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelUpdateExecute
+	app.OnCollectionUpdateExecute().Bind(recordEventHandler)
+	app.OnModelUpdateExecute().Bind(modelEventHandler)
+	app.OnModelUpdateExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterUpdateSuccess
+	app.OnCollectionAfterUpdateSuccess().Bind(recordEventHandler)
+	app.OnModelAfterUpdateSuccess().Bind(modelEventHandler)
+	app.OnModelAfterUpdateSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterUpdateError
+	app.OnCollectionAfterUpdateError().Bind(collectionErrorEventHandler)
+	app.OnModelAfterUpdateError().Bind(modelErrorEventHandler)
+	app.OnModelAfterUpdateError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+
+	// OnModelDelete
+	app.OnCollectionDelete().Bind(recordEventHandler)
+	app.OnModelDelete().Bind(modelEventHandler)
+	app.OnModelDelete().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelDeleteExecute
+	app.OnCollectionDeleteExecute().Bind(recordEventHandler)
+	app.OnModelDeleteExecute().Bind(modelEventHandler)
+	app.OnModelDeleteExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterDeleteSuccess
+	app.OnCollectionAfterDeleteSuccess().Bind(recordEventHandler)
+	app.OnModelAfterDeleteSuccess().Bind(modelEventHandler)
+	app.OnModelAfterDeleteSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterDeleteError
+	app.OnCollectionAfterDeleteError().Bind(collectionErrorEventHandler)
+	app.OnModelAfterDeleteError().Bind(modelErrorEventHandler)
+	app.OnModelAfterDeleteError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+}
+
+func TestCollectionSaveModel(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name          string
+		collection    func(app core.App) (*core.Collection, error)
+		expectError   bool
+		expectColumns []string
+	}{
+		// trigger validators
+		{
+			name: "create - trigger validators",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("!invalid")
+				c.Fields.Add(&core.TextField{Name: "example"})
+				c.AddIndex("test_save_idx", false, "example", "")
+				return c, nil
+			},
+			expectError: true,
+		},
+		{
+			name: "update - trigger validators",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo5")
+				c.Name = "demo1"
+				c.Fields.Add(&core.TextField{Name: "example"})
+				c.Fields.RemoveByName("file")
+				c.AddIndex("test_save_idx", false, "example", "")
+				return c, nil
+			},
+			expectError: true,
+		},
+
+		// create
+		{
+			name: "create base collection",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new")
+				c.Type = ""                 // should be auto set to "base"
+				c.Fields.RemoveByName("id") // ensure that the default fields will be loaded
+				c.Fields.Add(&core.TextField{Name: "example"})
+				c.AddIndex("test_save_idx", false, "example", "")
+				return c, nil
+			},
+			expectError: false,
+			expectColumns: []string{
+				"id", "example",
+			},
+		},
+		{
+			name: "create auth collection",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new")
+				c.Fields.RemoveByName("id")    // ensure that the default fields will be loaded
+				c.Fields.RemoveByName("email") // ensure that the default fields will be loaded
+				c.Fields.Add(&core.TextField{Name: "example"})
+				c.AddIndex("test_save_idx", false, "example", "")
+				return c, nil
+			},
+			expectError: false,
+			expectColumns: []string{
+				"id", "email", "tokenKey", "password",
+				"verified", "emailVisibility", "example",
+			},
+		},
+		{
+			name: "create view collection",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("new")
+				c.Fields.Add(&core.TextField{Name: "ignored"}) // should be ignored
+				c.ViewQuery = "select 1 as id, 2 as example"
+				return c, nil
+			},
+			expectError: false,
+			expectColumns: []string{
+				"id", "example",
+			},
+		},
+
+		// update
+		{
+			name: "update base collection",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo5")
+				c.Fields.Add(&core.TextField{Name: "example"})
+				c.Fields.RemoveByName("file")
+				c.Fields.GetByName("total").SetName("total_updated")
+				c.AddIndex("test_save_idx", false, "example", "")
+				return c, nil
+			},
+			expectError: false,
+			expectColumns: []string{
+				"id", "select_one", "select_many", "rel_one", "rel_many",
+				"total_updated", "created", "updated", "example",
+			},
+		},
+		{
+			name: "update auth collection",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("clients")
+				c.Fields.Add(&core.TextField{Name: "example"})
+				c.Fields.RemoveByName("file")
+				c.Fields.GetByName("name").SetName("name_updated")
+				c.AddIndex("test_save_idx", false, "example", "")
+				return c, nil
+			},
+			expectError: false,
+			expectColumns: []string{
+				"id", "email", "emailVisibility", "password", "tokenKey",
+				"verified", "username", "name_updated", "created", "updated", "example",
+			},
+		},
+		{
+			name: "update view collection",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("view2")
+				c.Fields.Add(&core.TextField{Name: "example"}) // should be ignored
+				c.ViewQuery = "select 1 as id, 2 as example"
+				return c, nil
+			},
+			expectError: false,
+			expectColumns: []string{
+				"id", "example",
+			},
+		},
+
+		// auth normalization
+		{
+			name: "unset missing oauth2 mapped fields",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new")
+				c.OAuth2.Enabled = true
+				// shouldn't fail
+				c.OAuth2.MappedFields = core.OAuth2KnownFields{
+					Id:        "missing",
+					Name:      "missing",
+					Username:  "missing",
+					AvatarURL: "missing",
+				}
+				return c, nil
+			},
+			expectError: false,
+			expectColumns: []string{
+				"id", "email", "emailVisibility", "password", "tokenKey", "verified",
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			collection, err := s.collection(app)
+			if err != nil {
+				t.Fatalf("Failed to retrieve test collection: %v", err)
+			}
+
+			saveErr := app.Save(collection)
+
+			hasErr := saveErr != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", hasErr, s.expectError, saveErr)
+			}
+
+			if hasErr {
+				return
+			}
+
+			// the collection should always have an id after successful Save
+			if collection.Id == "" {
+				t.Fatal("Expected collection id to be set")
+			}
+
+			// the timestamp fields should be non-empty after successful Save
+			if collection.Created.String() == "" {
+				t.Fatal("Expected collection created to be set")
+			}
+			if collection.Updated.String() == "" {
+				t.Fatal("Expected collection updated to be set")
+			}
+
+			// check if the records table was synced
+			hasTable := app.HasTable(collection.Name)
+			if !hasTable {
+				t.Fatalf("Expected records table %s to be created", collection.Name)
+			}
+
+			// check if the records table has the fields fields
+			columns, err := app.TableColumns(collection.Name)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(columns) != len(s.expectColumns) {
+				t.Fatalf("Expected columns\n%v\ngot\n%v", s.expectColumns, columns)
+			}
+			for i, c := range columns {
+				if !slices.Contains(s.expectColumns, c) {
+					t.Fatalf("[%d] Didn't expect record column %q", i, c)
+				}
+			}
+
+			// make sure that all collection indexes exists
+			indexes, err := app.TableIndexes(collection.Name)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(indexes) != len(collection.Indexes) {
+				t.Fatalf("Expected %d indexes, got %d", len(collection.Indexes), len(indexes))
+			}
+			for _, idx := range collection.Indexes {
+				parsed := dbutils.ParseIndex(idx)
+				if _, ok := indexes[parsed.IndexName]; !ok {
+					t.Fatalf("Missing index %q in\n%v", idx, indexes)
+				}
+			}
+		})
+	}
+}
+
+// indirect update of a field used in view should cause view(s) update
+func TestCollectionSaveIndirectViewsUpdate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// update MaxSelect fields
+	{
+		relMany := collection.Fields.GetByName("rel_many").(*core.RelationField)
+		relMany.MaxSelect = 1
+
+		fileOne := collection.Fields.GetByName("file_one").(*core.FileField)
+		fileOne.MaxSelect = 10
+
+		if err := app.Save(collection); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// check view1 fields
+	{
+		view1, err := app.FindCollectionByNameOrId("view1")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		relMany := view1.Fields.GetByName("rel_many").(*core.RelationField)
+		if relMany.MaxSelect != 1 {
+			t.Fatalf("Expected view1.rel_many MaxSelect to be %d, got %v", 1, relMany.MaxSelect)
+		}
+
+		fileOne := view1.Fields.GetByName("file_one").(*core.FileField)
+		if fileOne.MaxSelect != 10 {
+			t.Fatalf("Expected view1.file_one MaxSelect to be %d, got %v", 10, fileOne.MaxSelect)
+		}
+	}
+
+	// check view2 fields
+	{
+		view2, err := app.FindCollectionByNameOrId("view2")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		relMany := view2.Fields.GetByName("rel_many").(*core.RelationField)
+		if relMany.MaxSelect != 1 {
+			t.Fatalf("Expected view2.rel_many MaxSelect to be %d, got %v", 1, relMany.MaxSelect)
+		}
+	}
+}
+
+func TestCollectionSaveViewWrapping(t *testing.T) {
+	t.Parallel()
+
+	viewName := "test_wrapping"
+
+	scenarios := []struct {
+		name     string
+		query    string
+		expected string
+	}{
+		{
+			"no wrapping - text field",
+			"select text as id, bool from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select text as id, bool from demo1)",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, bool FROM ( SELECT demo1.text AS id, demo1.bool FROM demo1) unnamed_subquery;`,
+		},
+		{
+			"no wrapping - id field",
+			"select text as id, bool from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select text as id, bool from demo1)",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, bool FROM ( SELECT demo1.text AS id, demo1.bool FROM demo1) unnamed_subquery;`,
+		},
+		{
+			"no wrapping - relation field",
+			"select rel_one as id, bool from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select rel_one as id, bool from demo1)",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, bool FROM ( SELECT demo1.rel_one AS id, demo1.bool FROM demo1) unnamed_subquery;`,
+		},
+		{
+			"no wrapping - select field",
+			"select select_many as id, bool from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select select_many as id, bool from demo1)",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, bool FROM ( SELECT demo1.select_many AS id, demo1.bool FROM demo1) unnamed_subquery;`,
+		},
+		{
+			"no wrapping - email field",
+			"select email as id, bool from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select email as id, bool from demo1)",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, bool FROM ( SELECT demo1.email AS id, demo1.bool FROM demo1) unnamed_subquery;`,
+		},
+		{
+			"no wrapping - datetime field",
+			"select datetime as id, bool from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select datetime as id, bool from demo1)",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, bool FROM ( SELECT demo1.datetime AS id, demo1.bool FROM demo1) unnamed_subquery;`,
+		},
+		{
+			"no wrapping - url field",
+			"select url as id, bool from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select url as id, bool from demo1)",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, bool FROM ( SELECT demo1.url AS id, demo1.bool FROM demo1) unnamed_subquery;`,
+		},
+		{
+			"wrapping - bool field",
+			"select bool as id, text as txt, url from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT CAST(`id` as TEXT) `id`,`txt`,`url` FROM (select bool as id, text as txt, url from demo1))",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, txt, url FROM ( SELECT (unnamed_subquery_1.id)::text AS id, unnamed_subquery_1.txt, unnamed_subquery_1.url FROM ( SELECT demo1.bool AS id, demo1.text AS txt, demo1.url FROM demo1) unnamed_subquery_1) unnamed_subquery;`,
+		},
+		{
+			"wrapping - bool field (different order)",
+			"select text as txt, url, bool as id from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT `txt`,`url`,CAST(`id` as TEXT) `id` FROM (select text as txt, url, bool as id from demo1))",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT txt, url, id FROM ( SELECT unnamed_subquery_1.txt, unnamed_subquery_1.url, (unnamed_subquery_1.id)::text AS id FROM ( SELECT demo1.text AS txt, demo1.url, demo1.bool AS id FROM demo1) unnamed_subquery_1) unnamed_subquery;`,
+		},
+		{
+			"wrapping - json field",
+			"select json as id, text, url from demo1",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT CAST(`id` as TEXT) `id`,`text`,`url` FROM (select json as id, text, url from demo1))",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id, text, url FROM ( SELECT (unnamed_subquery_1.id)::text AS id, unnamed_subquery_1.text, unnamed_subquery_1.url FROM ( SELECT demo1."json" AS id, demo1.text, demo1.url FROM demo1) unnamed_subquery_1) unnamed_subquery;`,
+		},
+		{
+			"wrapping - numeric id",
+			"select 1 as id",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT CAST(`id` as TEXT) `id` FROM (select 1 as id))",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id FROM ( SELECT (unnamed_subquery_1.id)::text AS id FROM ( SELECT 1 AS id) unnamed_subquery_1) unnamed_subquery;`,
+		},
+		{
+			"wrapping - expresion",
+			"select ('test') as id",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (SELECT CAST(`id` as TEXT) `id` FROM (select ('test') as id))",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id FROM ( SELECT 'test'::text AS id) unnamed_subquery;`,
+		},
+		{
+			"no wrapping - cast as text",
+			"select cast('test' as text) as id",
+			/* SQLite:
+			"CREATE VIEW `test_wrapping` AS SELECT * FROM (select cast('test' as text) as id)",
+			*/
+			// PostgreSQL:
+			`CREATE VIEW "test_wrapping" AS  SELECT id FROM ( SELECT 'test'::text AS id) unnamed_subquery;`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			collection := core.NewViewCollection(viewName)
+			collection.ViewQuery = s.query
+
+			err := app.Save(collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			var sql string
+
+			/* SQLite:
+			rowErr := app.ConcurrentDB().NewQuery("SELECT sql FROM sqlite_master WHERE type='view' AND name={:name}").
+				Bind(dbx.Params{"name": viewName}).
+				Row(&sql)
+			*/
+			// PostgreSQL:
+			rowErr := app.ConcurrentDB().NewQuery("SELECT definition AS sql FROM pg_views WHERE viewname={:name} and schemaname=current_schema()").
+				Bind(dbx.Params{"name": viewName}).
+				Row(&sql)
+			if rowErr != nil {
+				t.Fatalf("Failed to retrieve view sql: %v", rowErr)
+			}
+			sql = fmt.Sprintf(`CREATE VIEW "%s" AS %s`, viewName, regexp.MustCompile(`\s+`).ReplaceAllString(sql, " "))
+
+			if sql != s.expected {
+				t.Fatalf("Expected query \n%v, \ngot \n%v", s.expected, sql)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/collection_model_view_options.go b/server/core_backend-server/core/collection_model_view_options.go
new file mode 100644
index 0000000..ffe2859
--- /dev/null
+++ b/server/core_backend-server/core/collection_model_view_options.go
@@ -0,0 +1,18 @@
+package core
+
+import (
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+)
+
+var _ optionsValidator = (*collectionViewOptions)(nil)
+
+// collectionViewOptions defines the options for the "view" type collection.
+type collectionViewOptions struct {
+	ViewQuery string `form:"viewQuery" json:"viewQuery"`
+}
+
+func (o *collectionViewOptions) validate(cv *collectionValidator) error {
+	return validation.ValidateStruct(o,
+		validation.Field(&o.ViewQuery, validation.Required, validation.By(cv.checkViewQuery)),
+	)
+}
diff --git a/server/core_backend-server/core/collection_model_view_options_test.go b/server/core_backend-server/core/collection_model_view_options_test.go
new file mode 100644
index 0000000..c7da1ef
--- /dev/null
+++ b/server/core_backend-server/core/collection_model_view_options_test.go
@@ -0,0 +1,79 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestCollectionViewOptionsValidate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name           string
+		collection     func(app core.App) (*core.Collection, error)
+		expectedErrors []string
+	}{
+		{
+			name: "view with empty query",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("new_auth")
+				return c, nil
+			},
+			expectedErrors: []string{"fields", "viewQuery"},
+		},
+		{
+			name: "view with invalid query",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("new_auth")
+				c.ViewQuery = "invalid"
+				return c, nil
+			},
+			expectedErrors: []string{"fields", "viewQuery"},
+		},
+		{
+			name: "view with valid query but missing id",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("new_auth")
+				c.ViewQuery = "select 1"
+				return c, nil
+			},
+			expectedErrors: []string{"fields", "viewQuery"},
+		},
+		{
+			name: "view with valid query",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("new_auth")
+				c.ViewQuery = "select demo1.id, text as example from demo1"
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "update view query ",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("view2")
+				c.ViewQuery = "select demo1.id, text as example from demo1"
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			collection, err := s.collection(app)
+			if err != nil {
+				t.Fatalf("Failed to retrieve test collection: %v", err)
+			}
+
+			result := app.Validate(collection)
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/collection_query.go b/server/core_backend-server/core/collection_query.go
new file mode 100644
index 0000000..78fc619
--- /dev/null
+++ b/server/core_backend-server/core/collection_query.go
@@ -0,0 +1,450 @@
+package core
+
+import (
+	"bytes"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+const StoreKeyCachedCollections = "pbAppCachedCollections"
+
+// CollectionQuery returns a new Collection select query.
+func (app *BaseApp) CollectionQuery() *dbx.SelectQuery {
+	return app.ModelQuery(&Collection{})
+}
+
+// FindCollections finds all collections by the given type(s).
+//
+// If collectionTypes is not set, it returns all collections.
+//
+// Example:
+//
+//	app.FindAllCollections() // all collections
+//	app.FindAllCollections("auth", "view") // only auth and view collections
+func (app *BaseApp) FindAllCollections(collectionTypes ...string) ([]*Collection, error) {
+	collections := []*Collection{}
+
+	q := app.CollectionQuery()
+
+	types := list.NonzeroUniques(collectionTypes)
+	if len(types) > 0 {
+		q.AndWhere(dbx.In("type", list.ToInterfaceSlice(types)...))
+	}
+
+	if IsPostgres(app) {
+		// PostgreSQL: Sorting by ctid to provide a relatively more stable result.
+		q.OrderBy("ctid ASC")
+	} else if IsMysql(app) {
+		// MySQL: Sorting by id.
+		q.OrderBy("id ASC")
+	} else {
+		// SQLite: Sorting by rowid.
+		q.OrderBy("rowid ASC")
+	}
+
+	err := q.All(&collections)
+	if err != nil {
+		return nil, err
+	}
+
+	return collections, nil
+}
+
+// ReloadCachedCollections fetches all collections and caches them into the app store.
+func (app *BaseApp) ReloadCachedCollections() error {
+	collections, err := app.FindAllCollections()
+	if err != nil {
+		return err
+	}
+
+	app.Store().Set(StoreKeyCachedCollections, collections)
+
+	return nil
+}
+
+// FindCollectionByNameOrId finds a single collection by its name (case insensitive) or id.
+func (app *BaseApp) FindCollectionByNameOrId(nameOrId string) (*Collection, error) {
+	m := &Collection{}
+
+	err := app.CollectionQuery().
+		AndWhere(dbx.NewExp("[[id]]={:id} OR LOWER([[name]])={:name}", dbx.Params{
+			"id":   nameOrId,
+			"name": strings.ToLower(nameOrId),
+		})).
+		Limit(1).
+		One(m)
+
+	if err != nil && errors.Is(err, sql.ErrNoRows) && strings.HasPrefix(nameOrId, "pbc_") {
+		// try with obc_ prefix for compatibility
+		altId := "obc_" + nameOrId[4:]
+		err = app.CollectionQuery().
+			AndWhere(dbx.NewExp("[[id]]={:id}", dbx.Params{"id": altId})).
+			Limit(1).
+			One(m)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return m, nil
+}
+
+// FindCachedCollectionByNameOrId is similar to [BaseApp.FindCollectionByNameOrId]
+// but retrieves the Collection from the app cache instead of making a db call.
+//
+// NB! This method is suitable for read-only Collection operations.
+//
+// Returns [sql.ErrNoRows] if no Collection is found for consistency
+// with the [BaseApp.FindCollectionByNameOrId] method.
+//
+// If you plan making changes to the returned Collection model,
+// use [BaseApp.FindCollectionByNameOrId] instead.
+//
+// Caveats:
+//
+//   - The returned Collection should be used only for read-only operations.
+//     Avoid directly modifying the returned cached Collection as it will affect
+//     the global cached value even if you don't persist the changes in the database!
+//   - If you are updating a Collection in a transaction and then call this method before commit,
+//     it'll return the cached Collection state and not the one from the uncommitted transaction.
+//   - The cache is automatically updated on collections db change (create/update/delete).
+//     To manually reload the cache you can call [BaseApp.ReloadCachedCollections].
+func (app *BaseApp) FindCachedCollectionByNameOrId(nameOrId string) (*Collection, error) {
+	collections, _ := app.Store().Get(StoreKeyCachedCollections).([]*Collection)
+	if collections == nil {
+		// cache is not initialized yet (eg. run in a system migration)
+		return app.FindCollectionByNameOrId(nameOrId)
+	}
+
+	for _, c := range collections {
+		if strings.EqualFold(c.Name, nameOrId) || c.Id == nameOrId {
+			return c, nil
+		}
+	}
+
+	if strings.HasPrefix(nameOrId, "pbc_") {
+		altId := "obc_" + nameOrId[4:]
+		for _, c := range collections {
+			if c.Id == altId {
+				return c, nil
+			}
+		}
+	}
+
+	return nil, sql.ErrNoRows
+}
+
+// FindCollectionReferences returns information for all relation fields
+// referencing the provided collection.
+//
+// If the provided collection has reference to itself then it will be
+// also included in the result. To exclude it, pass the collection id
+// as the excludeIds argument.
+func (app *BaseApp) FindCollectionReferences(collection *Collection, excludeIds ...string) (map[*Collection][]Field, error) {
+	collections := []*Collection{}
+
+	query := app.CollectionQuery()
+
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
+		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
+	}
+
+	if err := query.All(&collections); err != nil {
+		return nil, err
+	}
+
+	result := map[*Collection][]Field{}
+
+	for _, c := range collections {
+		for _, rawField := range c.Fields {
+			f, ok := rawField.(*RelationField)
+			if ok && f.CollectionId == collection.Id {
+				result[c] = append(result[c], f)
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// FindCachedCollectionReferences is similar to [BaseApp.FindCollectionReferences]
+// but retrieves the Collection from the app cache instead of making a db call.
+//
+// NB! This method is suitable for read-only Collection operations.
+//
+// If you plan making changes to the returned Collection model,
+// use [BaseApp.FindCollectionReferences] instead.
+//
+// Caveats:
+//
+//   - The returned Collection should be used only for read-only operations.
+//     Avoid directly modifying the returned cached Collection as it will affect
+//     the global cached value even if you don't persist the changes in the database!
+//   - If you are updating a Collection in a transaction and then call this method before commit,
+//     it'll return the cached Collection state and not the one from the uncommitted transaction.
+//   - The cache is automatically updated on collections db change (create/update/delete).
+//     To manually reload the cache you can call [BaseApp.ReloadCachedCollections].
+func (app *BaseApp) FindCachedCollectionReferences(collection *Collection, excludeIds ...string) (map[*Collection][]Field, error) {
+	collections, _ := app.Store().Get(StoreKeyCachedCollections).([]*Collection)
+	if collections == nil {
+		// cache is not initialized yet (eg. run in a system migration)
+		return app.FindCollectionReferences(collection, excludeIds...)
+	}
+
+	result := map[*Collection][]Field{}
+
+	for _, c := range collections {
+		if slices.Contains(excludeIds, c.Id) {
+			continue
+		}
+
+		for _, rawField := range c.Fields {
+			f, ok := rawField.(*RelationField)
+			if ok && f.CollectionId == collection.Id {
+				result[c] = append(result[c], f)
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// IsCollectionNameUnique checks that there is no existing collection
+// with the provided name (case insensitive!).
+//
+// Note: case insensitive check because the name is used also as
+// table name for the records.
+func (app *BaseApp) IsCollectionNameUnique(name string, excludeIds ...string) bool {
+	if name == "" {
+		return false
+	}
+
+	query := app.CollectionQuery().
+		Select("count(*)").
+		AndWhere(dbx.NewExp("LOWER([[name]])={:name}", dbx.Params{"name": strings.ToLower(name)})).
+		Limit(1)
+
+	if uniqueExcludeIds := list.NonzeroUniques(excludeIds); len(uniqueExcludeIds) > 0 {
+		query.AndWhere(dbx.NotIn("id", list.ToInterfaceSlice(uniqueExcludeIds)...))
+	}
+
+	var total int
+
+	return query.Row(&total) == nil && total == 0
+}
+
+// TruncateCollection deletes all records associated with the provided collection.
+//
+// The truncate operation is executed in a single transaction,
+// aka. either everything is deleted or none.
+//
+// Note that this method will also trigger the records related
+// cascade and file delete actions.
+func (app *BaseApp) TruncateCollection(collection *Collection) error {
+	if collection.IsView() {
+		return errors.New("view collections cannot be truncated since they don't store their own records")
+	}
+
+	return app.RunInTransaction(func(txApp App) error {
+		records := make([]*Record, 0, 500)
+
+		for {
+			err := txApp.RecordQuery(collection).Limit(500).All(&records)
+			if err != nil {
+				return err
+			}
+
+			if len(records) == 0 {
+				return nil
+			}
+
+			for _, record := range records {
+				err = txApp.Delete(record)
+				if err != nil && !errors.Is(err, sql.ErrNoRows) {
+					return err
+				}
+			}
+
+			records = records[:0]
+		}
+	})
+}
+
+// -------------------------------------------------------------------
+
+// saveViewCollection persists the provided View collection changes:
+//   - deletes the old related SQL view (if any)
+//   - creates a new SQL view with the latest newCollection.Options.Query
+//   - generates new feilds list  based on newCollection.Options.Query
+//   - updates newCollection.Fields based on the generated view table info and query
+//   - saves the newCollection
+//
+// This method returns an error if newCollection is not a "view".
+func saveViewCollection(app App, newCollection, oldCollection *Collection) error {
+	if !newCollection.IsView() {
+		return errors.New("not a view collection")
+	}
+
+	return app.RunInTransaction(func(txApp App) error {
+		query := newCollection.ViewQuery
+
+		// generate collection fields from the query
+		viewFields, err := txApp.CreateViewFields(query)
+		if err != nil {
+			return err
+		}
+
+		if !IsPostgres(txApp) {
+			// SQLite: delete old renamed view
+			if oldCollection != nil && oldCollection.Name != newCollection.Name {
+				if err := txApp.DeleteView(oldCollection.Name); err != nil {
+					return err
+				}
+			}
+		} else {
+			// PostgreSQL:
+			// Note:
+			// 1. When we rename a table or a view, both SQLite and PostgreSQL will update
+			//    all other views that depends on it by modifier their DDL SQL.
+			// 2. Why do we need to rename the old view? Because we need to find all the dependent views
+			//    and their DDL SQL by running `findDependentViews` function. If we don't rename
+			// 	  before getting the DDL SQL, then these DDL will still reference the old view name.
+			// 3. In SQLite we don't have the problem, because we won't drop all the dependent views when
+			// 	  we modify a view. But in PostgreSQL we will drop all the dependent views and then restore it.
+			// 4. Why do we need to drop all dependent views in PostgreSQL? Because we need to update the view,
+			//    although there is a `CREATE OR REPLACE VIEW` statement, but it forbids us to remove any column
+			//    from the view. So we need to drop the view. And we we drop the view, we also need to drop all
+			//    the dependent views otherwise PostgreSQL will complain too.
+			if oldCollection != nil && oldCollection.Name != newCollection.Name {
+				if _, err := txApp.DB().RenameTable(oldCollection.Name, newCollection.Name).Execute(); err != nil {
+					return err
+				}
+			}
+		}
+
+		// wrap view query if necessary
+		query, err = normalizeViewQueryId(txApp, query)
+		if err != nil {
+			return fmt.Errorf("failed to normalize view query id: %w", err)
+		}
+
+		// (re)create the view
+		if err := txApp.SaveView(newCollection.Name, query); err != nil {
+			return err
+		}
+
+		newCollection.Fields = viewFields
+
+		return txApp.Save(newCollection)
+	})
+}
+
+// normalizeViewQueryId wraps (if necessary) the provided view query
+// with a subselect to ensure that the id column is a text since
+// currently we don't support non-string model ids
+// (see https://github.com/pocketbase/pocketbase/issues/3110).
+func normalizeViewQueryId(app App, query string) (string, error) {
+	query = strings.Trim(strings.TrimSpace(query), ";")
+
+	info, err := getQueryTableInfo(app, query)
+	if err != nil {
+		return "", err
+	}
+
+	for _, row := range info {
+		if strings.EqualFold(row.Name, FieldNameId) && strings.EqualFold(row.Type, "TEXT") {
+			return query, nil // no wrapping needed
+		}
+	}
+
+	// raw parse to preserve the columns order
+	rawParsed := new(identifiersParser)
+	if err := rawParsed.parse(app, query); err != nil {
+		return "", err
+	}
+
+	columns := make([]string, 0, len(rawParsed.columns))
+	for _, col := range rawParsed.columns {
+		if col.alias == FieldNameId {
+			columns = append(columns, fmt.Sprintf("CAST([[%s]] as TEXT) [[%s]]", col.alias, col.alias))
+		} else {
+			columns = append(columns, "[["+col.alias+"]]")
+		}
+	}
+
+	query = fmt.Sprintf("SELECT %s FROM (%s)", strings.Join(columns, ","), query)
+
+	return query, nil
+}
+
+// resaveViewsWithChangedFields updates all view collections with changed fields.
+// This function is called in two hooks:
+// - onCollectionDeleteExecute, when deleting a collection
+// - onCollectionSaveExecute:
+func resaveViewsWithChangedFields(app App, excludeIds ...string) error {
+	collections, err := app.FindAllCollections(CollectionTypeView)
+	if err != nil {
+		return err
+	}
+
+	return app.RunInTransaction(func(txApp App) error {
+		for _, collection := range collections {
+			if len(excludeIds) > 0 && list.ExistInSlice(collection.Id, excludeIds) {
+				continue
+			}
+
+			// clone the existing fields for temp modifications
+			oldFields, err := collection.Fields.Clone()
+			if err != nil {
+				return err
+			}
+
+			// generate new fields from the query
+			// Note:
+			// dry run the query by creating a temp view. If it succeeds,
+			// and somehow the view fields are different than existing view,
+			// we will save the temp view as the new view.
+			// If it a dependent table/view does not exist, it will throw an error.
+			newFields, err := txApp.CreateViewFields(collection.ViewQuery)
+			if err != nil {
+				return err
+			}
+
+			// unset the fields' ids to exclude from the comparison
+			for _, f := range oldFields {
+				f.SetId("")
+			}
+			for _, f := range newFields {
+				f.SetId("")
+			}
+
+			encodedNewFields, err := json.Marshal(newFields)
+			if err != nil {
+				return err
+			}
+
+			encodedOldFields, err := json.Marshal(oldFields)
+			if err != nil {
+				return err
+			}
+
+			if bytes.EqualFold(encodedNewFields, encodedOldFields) {
+				continue // no changes
+			}
+
+			if err := saveViewCollection(txApp, collection, nil); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
diff --git a/server/core_backend-server/core/collection_query_test.go b/server/core_backend-server/core/collection_query_test.go
new file mode 100644
index 0000000..5c7aff9
--- /dev/null
+++ b/server/core_backend-server/core/collection_query_test.go
@@ -0,0 +1,478 @@
+package core_test
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestCollectionQuery(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	/* SQLite:
+	expected := "SELECT {{_collections}}.* FROM `_collections`"
+	*/
+	// PostgreSQL:
+	expected := `SELECT {{_collections}}.* FROM "_collections"`
+
+	sql := app.CollectionQuery().Build().SQL()
+	if sql != expected {
+		t.Errorf("Expected sql %s, got %s", expected, sql)
+	}
+}
+
+func TestReloadCachedCollections(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	err := app.ReloadCachedCollections()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cached := app.Store().Get(core.StoreKeyCachedCollections)
+
+	cachedCollections, ok := cached.([]*core.Collection)
+	if !ok {
+		t.Fatalf("Expected []*core.Collection, got %T", cached)
+	}
+
+	collections, err := app.FindAllCollections()
+	if err != nil {
+		t.Fatalf("Failed to retrieve all collections: %v", err)
+	}
+
+	if len(cachedCollections) != len(collections) {
+		t.Fatalf("Expected %d collections, got %d", len(collections), len(cachedCollections))
+	}
+
+	for _, c := range collections {
+		var exists bool
+		for _, cc := range cachedCollections {
+			if cc.Id == c.Id {
+				exists = true
+				break
+			}
+		}
+		if !exists {
+			t.Fatalf("The collections cache is missing collection %q", c.Name)
+		}
+	}
+}
+
+func TestFindAllCollections(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		collectionTypes []string
+		expectTotal     int
+	}{
+		{nil, 16},
+		{[]string{}, 16},
+		{[]string{""}, 16},
+		{[]string{"unknown"}, 0},
+		{[]string{"unknown", core.CollectionTypeAuth}, 4},
+		{[]string{core.CollectionTypeAuth, core.CollectionTypeView}, 7},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, strings.Join(s.collectionTypes, "_")), func(t *testing.T) {
+			collections, err := app.FindAllCollections(s.collectionTypes...)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(collections) != s.expectTotal {
+				t.Fatalf("Expected %d collections, got %d", s.expectTotal, len(collections))
+			}
+
+			expectedTypes := list.NonzeroUniques(s.collectionTypes)
+			if len(expectedTypes) > 0 {
+				for _, c := range collections {
+					if !slices.Contains(expectedTypes, c.Type) {
+						t.Fatalf("Unexpected collection type %s\n%v", c.Type, c)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestFindCollectionByNameOrId(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		nameOrId    string
+		expectError bool
+	}{
+		{"", true},
+		{"missing", true},
+		{"wsmn24bux7wo113", false},
+		{"demo1", false},
+		{"DEMO1", false}, // case insensitive
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.nameOrId), func(t *testing.T) {
+			model, err := app.FindCollectionByNameOrId(s.nameOrId)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if model != nil && model.Id != s.nameOrId && !strings.EqualFold(model.Name, s.nameOrId) {
+				t.Fatalf("Expected model with identifier %s, got %v", s.nameOrId, model)
+			}
+		})
+	}
+}
+
+func TestFindCachedCollectionByNameOrId(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	totalQueries := 0
+	app.ConcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		totalQueries++
+	}
+
+	run := func(withCache bool) {
+		scenarios := []struct {
+			nameOrId    string
+			expectError bool
+		}{
+			{"", true},
+			{"missing", true},
+			{"wsmn24bux7wo113", false},
+			{"demo1", false},
+			{"DEMO1", false}, // case insensitive
+		}
+
+		var expectedTotalQueries int
+
+		if withCache {
+			err := app.ReloadCachedCollections()
+			if err != nil {
+				t.Fatal(err)
+			}
+		} else {
+			app.Store().Reset(nil)
+			expectedTotalQueries = len(scenarios)
+		}
+
+		totalQueries = 0
+
+		for i, s := range scenarios {
+			t.Run(fmt.Sprintf("%d_%s", i, s.nameOrId), func(t *testing.T) {
+				model, err := app.FindCachedCollectionByNameOrId(s.nameOrId)
+
+				hasErr := err != nil
+				if hasErr != s.expectError {
+					t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+				}
+
+				if model != nil && model.Id != s.nameOrId && !strings.EqualFold(model.Name, s.nameOrId) {
+					t.Fatalf("Expected model with identifier %s, got %v", s.nameOrId, model)
+				}
+			})
+		}
+
+		if totalQueries != expectedTotalQueries {
+			t.Fatalf("Expected %d totalQueries, got %d", expectedTotalQueries, totalQueries)
+		}
+	}
+
+	run(true)
+
+	run(false)
+}
+
+func TestFindCollectionReferences(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	result, err := app.FindCollectionReferences(
+		collection,
+		collection.Id,
+		// test whether "nonempty" exclude ids condition will be skipped
+		"",
+		"",
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(result) != 1 {
+		t.Fatalf("Expected 1 collection, got %d: %v", len(result), result)
+	}
+
+	expectedFields := []string{
+		"rel_one_no_cascade",
+		"rel_one_no_cascade_required",
+		"rel_one_cascade",
+		"rel_one_unique",
+		"rel_many_no_cascade",
+		"rel_many_no_cascade_required",
+		"rel_many_cascade",
+		"rel_many_unique",
+	}
+
+	for col, fields := range result {
+		if col.Name != "demo4" {
+			t.Fatalf("Expected collection demo4, got %s", col.Name)
+		}
+		if len(fields) != len(expectedFields) {
+			t.Fatalf("Expected fields %v, got %v", expectedFields, fields)
+		}
+		for i, f := range fields {
+			if !slices.Contains(expectedFields, f.GetName()) {
+				t.Fatalf("[%d] Didn't expect field %v", i, f)
+			}
+		}
+	}
+}
+
+func TestFindCachedCollectionReferences(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	totalQueries := 0
+	app.ConcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		totalQueries++
+	}
+
+	run := func(withCache bool) {
+		var expectedTotalQueries int
+
+		if withCache {
+			err := app.ReloadCachedCollections()
+			if err != nil {
+				t.Fatal(err)
+			}
+		} else {
+			app.Store().Reset(nil)
+			expectedTotalQueries = 1
+		}
+
+		totalQueries = 0
+
+		result, err := app.FindCachedCollectionReferences(
+			collection,
+			collection.Id,
+			// test whether "nonempty" exclude ids condition will be skipped
+			"",
+			"",
+		)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if len(result) != 1 {
+			t.Fatalf("Expected 1 collection, got %d: %v", len(result), result)
+		}
+
+		expectedFields := []string{
+			"rel_one_no_cascade",
+			"rel_one_no_cascade_required",
+			"rel_one_cascade",
+			"rel_one_unique",
+			"rel_many_no_cascade",
+			"rel_many_no_cascade_required",
+			"rel_many_cascade",
+			"rel_many_unique",
+		}
+
+		for col, fields := range result {
+			if col.Name != "demo4" {
+				t.Fatalf("Expected collection demo4, got %s", col.Name)
+			}
+			if len(fields) != len(expectedFields) {
+				t.Fatalf("Expected fields %v, got %v", expectedFields, fields)
+			}
+			for i, f := range fields {
+				if !slices.Contains(expectedFields, f.GetName()) {
+					t.Fatalf("[%d] Didn't expect field %v", i, f)
+				}
+			}
+		}
+
+		if totalQueries != expectedTotalQueries {
+			t.Fatalf("Expected %d totalQueries, got %d", expectedTotalQueries, totalQueries)
+		}
+	}
+
+	run(true)
+
+	run(false)
+}
+
+func TestIsCollectionNameUnique(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name      string
+		excludeId string
+		expected  bool
+	}{
+		{"", "", false},
+		{"demo1", "", false},
+		{"Demo1", "", false},
+		{"new", "", true},
+		{"demo1", "wsmn24bux7wo113", true},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.name), func(t *testing.T) {
+			result := app.IsCollectionNameUnique(s.name, s.excludeId)
+			if result != s.expected {
+				t.Errorf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestFindCollectionTruncate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	countFiles := func(collectionId string) (int, error) {
+		entries, err := os.ReadDir(filepath.Join(app.DataDir(), "storage", collectionId))
+		return len(entries), err
+	}
+
+	t.Run("truncate view", func(t *testing.T) {
+		view2, err := app.FindCollectionByNameOrId("view2")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		err = app.TruncateCollection(view2)
+		if err == nil {
+			t.Fatalf("Expected truncate to fail because view collections can't be truncated")
+		}
+	})
+
+	t.Run("truncate failure", func(t *testing.T) {
+		demo3, err := app.FindCollectionByNameOrId("demo3")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		originalTotalRecords, err := app.CountRecords(demo3)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		originalTotalFiles, err := countFiles(demo3.Id)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		err = app.TruncateCollection(demo3)
+		if err == nil {
+			t.Fatalf("Expected truncate to fail due to cascade delete failed required constraint")
+		}
+
+		// short delay to ensure that the file delete goroutine has been executed
+		time.Sleep(100 * time.Millisecond)
+
+		totalRecords, err := app.CountRecords(demo3)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if totalRecords != originalTotalRecords {
+			t.Fatalf("Expected %d records, got %d", originalTotalRecords, totalRecords)
+		}
+
+		totalFiles, err := countFiles(demo3.Id)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if totalFiles != originalTotalFiles {
+			t.Fatalf("Expected %d files, got %d", originalTotalFiles, totalFiles)
+		}
+	})
+
+	t.Run("truncate success", func(t *testing.T) {
+		demo5, err := app.FindCollectionByNameOrId("demo5")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		err = app.TruncateCollection(demo5)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// short delay to ensure that the file delete goroutine has been executed
+		time.Sleep(100 * time.Millisecond)
+
+		total, err := app.CountRecords(demo5)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if total != 0 {
+			t.Fatalf("Expected all records to be deleted, got %v", total)
+		}
+
+		totalFiles, err := countFiles(demo5.Id)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if totalFiles != 0 {
+			t.Fatalf("Expected truncated record files to be deleted, got %d", totalFiles)
+		}
+
+		// try to truncate again (shouldn't return an error)
+		err = app.TruncateCollection(demo5)
+		if err != nil {
+			t.Fatal(err)
+		}
+	})
+}
diff --git a/server/core_backend-server/core/collection_record_table_sync.go b/server/core_backend-server/core/collection_record_table_sync.go
new file mode 100644
index 0000000..c7b06f2
--- /dev/null
+++ b/server/core_backend-server/core/collection_record_table_sync.go
@@ -0,0 +1,475 @@
+package core
+
+import (
+	"fmt"
+	"log/slog"
+	"strconv"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// SyncRecordTableSchema compares the two provided collections
+// and applies the necessary related record table changes.
+//
+// If oldCollection is null, then only newCollection is used to create the record table.
+//
+// This method is automatically invoked as part of a collection create/update/delete operation.
+func (app *BaseApp) SyncRecordTableSchema(newCollection *Collection, oldCollection *Collection) error {
+	if newCollection.IsView() {
+		return nil // nothing to sync since views don't have records table
+	}
+
+	txErr := app.RunInTransaction(func(txApp App) error {
+		// create
+		// -----------------------------------------------------------
+		if oldCollection == nil || !app.HasTable(oldCollection.Name) {
+			tableName := newCollection.Name
+
+			fields := newCollection.Fields
+
+			cols := make(map[string]string, len(fields))
+
+			// add fields definition
+			for _, field := range fields {
+				cols[field.GetName()] = field.ColumnType(app)
+			}
+
+			// create table
+			if _, err := txApp.DB().CreateTable(tableName, cols).Execute(); err != nil {
+				return err
+			}
+
+			return createCollectionIndexes(txApp, newCollection)
+		}
+
+		// update
+		// -----------------------------------------------------------
+		oldTableName := oldCollection.Name
+		newTableName := newCollection.Name
+		oldFields := oldCollection.Fields
+		newFields := newCollection.Fields
+
+		needTableRename := !strings.EqualFold(oldTableName, newTableName)
+
+		var needIndexesUpdate bool
+		if needTableRename ||
+			oldFields.String() != newFields.String() ||
+			oldCollection.Indexes.String() != newCollection.Indexes.String() {
+			needIndexesUpdate = true
+		}
+
+		if needIndexesUpdate {
+			// drop old indexes (if any)
+			if err := dropCollectionIndexes(txApp, oldCollection); err != nil {
+				return err
+			}
+		}
+
+		// check for renamed table
+		if needTableRename {
+			_, err := txApp.DB().RenameTable("{{"+oldTableName+"}}", "{{"+newTableName+"}}").Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		// check for deleted columns
+		for _, oldField := range oldFields {
+			if f := newFields.GetById(oldField.GetId()); f != nil {
+				continue // exist
+			}
+
+			_, err := txApp.DB().DropColumn(newTableName, oldField.GetName()).Execute()
+			if err != nil {
+				return fmt.Errorf("failed to drop column %s - %w", oldField.GetName(), err)
+			}
+		}
+
+		// check for new or renamed columns
+		toRename := map[string]string{}
+		for _, field := range newFields {
+			oldField := oldFields.GetById(field.GetId())
+			// Note:
+			// We are using a temporary column name when adding or renaming columns
+			// to ensure that there are no name collisions in case there is
+			// names switch/reuse of existing columns (eg. name, title -> title, name).
+			// This way we are always doing 1 more rename operation but it provides better less ambiguous experience.
+
+			if oldField == nil {
+				tempName := field.GetName() + security.PseudorandomString(5)
+				toRename[tempName] = field.GetName()
+
+				// add
+				_, err := txApp.DB().AddColumn(newTableName, tempName, field.ColumnType(txApp)).Execute()
+				if err != nil {
+					return fmt.Errorf("failed to add column %s - %w", field.GetName(), err)
+				}
+			} else if oldField.GetName() != field.GetName() {
+				tempName := field.GetName() + security.PseudorandomString(5)
+				toRename[tempName] = field.GetName()
+
+				// rename
+				_, err := txApp.DB().RenameColumn(newTableName, oldField.GetName(), tempName).Execute()
+				if err != nil {
+					return fmt.Errorf("failed to rename column %s - %w", oldField.GetName(), err)
+				}
+			}
+		}
+
+		// set the actual columns name
+		for tempName, actualName := range toRename {
+			_, err := txApp.DB().RenameColumn(newTableName, tempName, actualName).Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		if err := normalizeSingleVsMultipleFieldChanges(txApp, newCollection, oldCollection); err != nil {
+			return err
+		}
+
+		if needIndexesUpdate {
+			return createCollectionIndexes(txApp, newCollection)
+		}
+
+		return nil
+	})
+	if txErr != nil {
+		return txErr
+	}
+
+	if !IsPostgres(app) && !IsMysql(app) {
+		// run optimize per the SQLite recommendations
+		// (https://www.sqlite.org/pragma.html#pragma_optimize)
+		_, optimizeErr := app.NonconcurrentDB().NewQuery("PRAGMA optimize").Execute()
+		if optimizeErr != nil {
+			app.Logger().Warn("Failed to run PRAGMA optimize after record table sync", slog.String("error", optimizeErr.Error()))
+		}
+	}
+
+	return nil
+}
+
+func normalizeSingleVsMultipleFieldChanges(app App, newCollection *Collection, oldCollection *Collection) error {
+	if newCollection.IsView() || oldCollection == nil {
+		return nil // view or not an update
+	}
+
+	return app.RunInTransaction(func(txApp App) error {
+		for _, newField := range newCollection.Fields {
+			// allow to continue even if there is no old field for the cases
+			// when a new field is added and there are already inserted data
+			var isOldMultiple bool
+			if oldField := oldCollection.Fields.GetById(newField.GetId()); oldField != nil {
+				if mv, ok := oldField.(MultiValuer); ok {
+					isOldMultiple = mv.IsMultiple()
+				}
+			}
+
+			var isNewMultiple bool
+			if mv, ok := newField.(MultiValuer); ok {
+				isNewMultiple = mv.IsMultiple()
+			}
+
+			if isOldMultiple == isNewMultiple {
+				continue // no change
+			}
+
+			// -------------------------------------------------------
+			// update the field column definition
+			// -------------------------------------------------------
+
+			// temporary drop all views to prevent reference errors during the columns renaming
+			// (this is used as an "alternative" to the writable_schema PRAGMA)
+			var views []viewDef
+			var err error
+			if IsMysql(txApp) {
+				// MySQL:
+				err = txApp.DB().NewQuery(`
+					SELECT TABLE_NAME AS name, VIEW_DEFINITION AS sql
+					FROM information_schema.views
+					WHERE TABLE_SCHEMA = DATABASE()
+				`).All(&views)
+			} else if IsPostgres(txApp) {
+				views, err = findAllViewsInDependencyOrder(txApp)
+			} else {
+				// SQLite:
+				err = txApp.DB().Select("name", "sql").
+					From("sqlite_master").
+					AndWhere(dbx.NewExp("sql is not null")).
+					AndWhere(dbx.HashExp{"type": "view"}).
+					All(&views)
+			}
+			if err != nil {
+				return err
+			}
+
+			for i := len(views) - 1; i >= 0; i-- {
+				err = txApp.DeleteView(views[i].Name)
+				if err != nil {
+					return err
+				}
+			}
+
+			originalName := newField.GetName()
+			oldTempName := "_" + newField.GetName() + security.PseudorandomString(5)
+
+			// rename temporary the original column to something else to allow inserting a new one in its place
+			_, err = txApp.DB().RenameColumn(newCollection.Name, originalName, oldTempName).Execute()
+			if err != nil {
+				return err
+			}
+
+			// reinsert the field column with the new type
+			_, err = txApp.DB().AddColumn(newCollection.Name, originalName, newField.ColumnType(txApp)).Execute()
+			if err != nil {
+				return err
+			}
+
+			var copyQuery *dbx.Query
+
+			if IsMysql(txApp) {
+				if !isOldMultiple && isNewMultiple {
+					// single -> multiple (convert to array)
+					copyQuery = txApp.DB().NewQuery(fmt.Sprintf(
+						`UPDATE {{%s}} set [[%s]] = (
+							CASE
+								WHEN COALESCE([[%s]], '') = ''
+								THEN JSON_ARRAY()
+								ELSE (
+									CASE
+										WHEN JSON_VALID([[%s]]) AND JSON_TYPE([[%s]]) = 'ARRAY'
+										THEN [[%s]]
+										ELSE JSON_ARRAY([[%s]])
+									END
+								)
+							END
+						)`,
+						newCollection.Name,
+						originalName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+					))
+				} else {
+					// multiple -> single (keep only the last element)
+					copyQuery = txApp.DB().NewQuery(fmt.Sprintf(
+						`UPDATE {{%s}} set [[%s]] = (
+						CASE
+							WHEN COALESCE([[%s]], '[]') = '[]'
+							THEN ''
+							ELSE (
+								CASE
+									WHEN JSON_VALID([[%s]]) AND JSON_TYPE([[%s]]) = 'ARRAY'
+									THEN COALESCE(JSON_UNQUOTE(JSON_EXTRACT([[%s]], CONCAT('$[', JSON_LENGTH([[%s]]) - 1, ']'))), '')
+									ELSE [[%s]]
+								END
+							)
+						END
+					)`,
+						newCollection.Name,
+						originalName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+					))
+				}
+			} else if IsPostgres(txApp) {
+				if !isOldMultiple && isNewMultiple {
+					// single -> multiple (convert to array)
+					copyQuery = txApp.DB().NewQuery(fmt.Sprintf(
+						`UPDATE {{%s}} set [[%s]] = (
+							CASE
+								WHEN COALESCE([[%s]]::text, '') = ''
+									THEN '[]'::jsonb
+								WHEN json_valid([[%s]]::text) AND jsonb_typeof([[%s]]::jsonb) = 'array'
+									THEN [[%s]]::jsonb
+								ELSE jsonb_build_array([[%s]])
+							END
+						)`,
+						newCollection.Name,
+						originalName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+					))
+				} else {
+					// multiple -> single (keep only the last element)
+					copyQuery = txApp.DB().NewQuery(fmt.Sprintf(
+						`UPDATE {{%s}} set [[%s]] = (
+						CASE
+							WHEN COALESCE([[%s]]::text, '[]') = '[]'
+								THEN ''
+							WHEN jsonb_typeof([[%s]]::jsonb) = 'array'
+								THEN COALESCE([[%s]]::jsonb->>(jsonb_array_length([[%s]]::jsonb) - 1), '')
+							ELSE [[%s]]::text
+						END
+					)`,
+						newCollection.Name,
+						originalName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+					))
+				}
+			} else {
+				// SQLite:
+				if !isOldMultiple && isNewMultiple {
+					// single -> multiple (convert to array)
+					copyQuery = txApp.DB().NewQuery(fmt.Sprintf(
+						`UPDATE {{%s}} set [[%s]] = (
+							CASE
+								WHEN COALESCE([[%s]], '') = ''
+								THEN '[]'
+								ELSE (
+									CASE
+										WHEN json_valid([[%s]]) AND json_type([[%s]]) == 'array'
+										THEN [[%s]]
+										ELSE json_array([[%s]])
+									END
+								)
+							END
+						)`,
+						newCollection.Name,
+						originalName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+					))
+				} else {
+					// multiple -> single (keep only the last element)
+					copyQuery = txApp.DB().NewQuery(fmt.Sprintf(
+						`UPDATE {{%s}} set [[%s]] = (
+						CASE
+							WHEN COALESCE([[%s]], '[]') = '[]'
+							THEN ''
+							ELSE (
+								CASE
+									WHEN json_valid([[%s]]) AND json_type([[%s]]) == 'array'
+									THEN COALESCE(json_extract([[%s]], '$[#-1]'), '')
+									ELSE [[%s]]
+								END
+							)
+						END
+					)`,
+						newCollection.Name,
+						originalName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+						oldTempName,
+					))
+				}
+			}
+
+			// copy the normalized values
+			_, err = copyQuery.Execute()
+			if err != nil {
+				return err
+			}
+
+			// drop the original column
+			_, err = txApp.DB().DropColumn(newCollection.Name, oldTempName).Execute()
+			if err != nil {
+				return err
+			}
+
+			// restore views
+			for _, view := range views {
+				_, err = txApp.DB().NewQuery(view.SQL).Execute()
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
+func dropCollectionIndexes(app App, collection *Collection) error {
+	if collection.IsView() {
+		return nil // views don't have indexes
+	}
+
+	return app.RunInTransaction(func(txApp App) error {
+		for _, raw := range collection.Indexes {
+			parsed := dbutils.ParseIndex(raw)
+
+			if !parsed.IsValid() {
+				continue
+			}
+
+			_, err := txApp.DB().NewQuery(fmt.Sprintf("DROP INDEX IF EXISTS [[%s]]", parsed.IndexName)).Execute()
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
+func createCollectionIndexes(app App, collection *Collection) error {
+	if collection.IsView() {
+		return nil // views don't have indexes
+	}
+
+	return app.RunInTransaction(func(txApp App) error {
+		// upsert new indexes
+		//
+		// note: we are returning validation errors because the indexes cannot be
+		//       easily validated in a form, aka. before persisting the related
+		//       collection record table changes
+		errs := validation.Errors{}
+		for i, idx := range collection.Indexes {
+			parsed := dbutils.ParseIndex(idx)
+
+			// ensure that the index is always for the current collection
+			parsed.TableName = collection.Name
+
+			if !parsed.IsValid() {
+				errs[strconv.Itoa(i)] = validation.NewError(
+					"validation_invalid_index_expression",
+					"Invalid CREATE INDEX expression.",
+				)
+				continue
+			}
+
+			if _, err := txApp.DB().NewQuery(parsed.Build()).Execute(); err != nil {
+				errs[strconv.Itoa(i)] = validation.NewError(
+					"validation_invalid_index_expression",
+					fmt.Sprintf("Failed to create index %s - %v.", parsed.IndexName, err.Error()),
+				)
+				continue
+			}
+		}
+
+		if len(errs) > 0 {
+			return validation.Errors{"indexes": errs}
+		}
+
+		return nil
+	})
+}
+
+type viewDef struct {
+	Name string `db:"name"`
+	SQL  string `db:"sql"`
+}
diff --git a/server/core_backend-server/core/collection_record_table_sync_test.go b/server/core_backend-server/core/collection_record_table_sync_test.go
new file mode 100644
index 0000000..593909f
--- /dev/null
+++ b/server/core_backend-server/core/collection_record_table_sync_test.go
@@ -0,0 +1,314 @@
+package core_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestSyncRecordTableSchema(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	oldCollection, err := app.FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	updatedCollection, err := app.FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	updatedCollection.Name = "demo_renamed"
+	updatedCollection.Fields.RemoveByName("active")
+	updatedCollection.Fields.Add(&core.EmailField{
+		Name: "new_field",
+	})
+	updatedCollection.Fields.Add(&core.EmailField{
+		Id:   updatedCollection.Fields.GetByName("title").GetId(),
+		Name: "title_renamed",
+	})
+	updatedCollection.Indexes = types.JSONArray[string]{"create index idx_title_renamed on anything (title_renamed)"}
+
+	baseCol := core.NewBaseCollection("new_base")
+	baseCol.Fields.Add(&core.TextField{Name: "test"})
+
+	authCol := core.NewAuthCollection("new_auth")
+	authCol.Fields.Add(&core.TextField{Name: "test"})
+	authCol.AddIndex("idx_auth_test", false, "email, id", "")
+
+	scenarios := []struct {
+		name                 string
+		newCollection        *core.Collection
+		oldCollection        *core.Collection
+		expectedColumns      []string
+		expectedIndexesCount int
+	}{
+		{
+			"new base collection",
+			baseCol,
+			nil,
+			[]string{"id", "test"},
+			0,
+		},
+		{
+			"new auth collection",
+			authCol,
+			nil,
+			[]string{
+				"id", "test", "email", "verified",
+				"emailVisibility", "tokenKey", "password",
+			},
+			3,
+		},
+		{
+			"no changes",
+			oldCollection,
+			oldCollection,
+			[]string{"id", "created", "updated", "title", "active"},
+			3,
+		},
+		{
+			"renamed table, deleted column, renamed columnd and new column",
+			updatedCollection,
+			oldCollection,
+			[]string{"id", "created", "updated", "title_renamed", "new_field"},
+			1,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := app.SyncRecordTableSchema(s.newCollection, s.oldCollection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if !app.HasTable(s.newCollection.Name) {
+				t.Fatalf("Expected table %s to exist", s.newCollection.Name)
+			}
+
+			cols, _ := app.TableColumns(s.newCollection.Name)
+			if len(cols) != len(s.expectedColumns) {
+				t.Fatalf("Expected columns %v, got %v", s.expectedColumns, cols)
+			}
+
+			for _, col := range cols {
+				if !list.ExistInSlice(col, s.expectedColumns) {
+					t.Fatalf("Couldn't find column %s in %v", col, s.expectedColumns)
+				}
+			}
+
+			indexes, _ := app.TableIndexes(s.newCollection.Name)
+
+			if totalIndexes := len(indexes); totalIndexes != s.expectedIndexesCount {
+				t.Fatalf("Expected %d indexes, got %d:\n%v", s.expectedIndexesCount, totalIndexes, indexes)
+			}
+		})
+	}
+}
+
+func getTotalViews(app core.App) (int, error) {
+	var total int
+
+	/* SQLite:
+	err := app.DB().Select("count(*)").
+		From("sqlite_master").
+		AndWhere(dbx.NewExp("sql is not null")).
+		AndWhere(dbx.HashExp{"type": "view"}).
+		Row(&total)
+	*/
+	// PostgreSQL:
+	// count user created views.
+	err := app.DB().Select("count(*)").
+		From("information_schema.views").
+		AndWhere(dbx.NotIn("table_schema", "pg_catalog", "information_schema")).
+		Row(&total)
+
+	return total, err
+}
+
+func TestSingleVsMultipleValuesNormalization(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	beforeTotalViews, err := getTotalViews(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// mock field changes
+	collection.Fields.GetByName("select_one").(*core.SelectField).MaxSelect = 2
+	collection.Fields.GetByName("select_many").(*core.SelectField).MaxSelect = 1
+	collection.Fields.GetByName("file_one").(*core.FileField).MaxSelect = 2
+	collection.Fields.GetByName("file_many").(*core.FileField).MaxSelect = 1
+	collection.Fields.GetByName("rel_one").(*core.RelationField).MaxSelect = 2
+	collection.Fields.GetByName("rel_many").(*core.RelationField).MaxSelect = 1
+
+	// new multivaluer field to check whether the array normalization
+	// will be applied for already inserted data
+	collection.Fields.Add(&core.SelectField{
+		Name:      "new_multiple",
+		Values:    []string{"a", "b", "c"},
+		MaxSelect: 3,
+	})
+
+	if err := app.Save(collection); err != nil {
+		t.Fatal(err)
+	}
+
+	// ensure that the views were reinserted
+	afterTotalViews, err := getTotalViews(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if afterTotalViews != beforeTotalViews {
+		t.Fatalf("Expected total views %d, got %d", beforeTotalViews, afterTotalViews)
+	}
+
+	// check whether the columns DEFAULT definition was updated
+	// ---------------------------------------------------------------
+	tableInfo, err := app.TableInfo(collection.Name)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tableInfoExpectations := map[string]string{
+		/* SQLite:
+		"select_one":   `'[]'`,
+		"select_many":  `''`,
+		"file_one":     `'[]'`,
+		"file_many":    `''`,
+		"rel_one":      `'[]'`,
+		"rel_many":     `''`,
+		"new_multiple": `'[]'`,
+		*/
+		// PostgreSQL:
+		"select_one":   `'[]'::jsonb`, // maxSelect=2, json type
+		"select_many":  `''::text`,    // maxSelect=1, text type
+		"file_one":     `'[]'::jsonb`, // maxSelect=2, json type
+		"file_many":    `''::text`,    // maxSelect=1, text type
+		"rel_one":      `'[]'::jsonb`, // maxSelect=2, json type
+		"rel_many":     `''::text`,    // maxSelect=1, text type
+		"new_multiple": `'[]'::jsonb`, // maxSelect=3, json type
+	}
+	for col, dflt := range tableInfoExpectations {
+		t.Run("check default for "+col, func(t *testing.T) {
+			var row *core.TableInfoRow
+			for _, r := range tableInfo {
+				if r.Name == col {
+					row = r
+					break
+				}
+			}
+			if row == nil {
+				t.Fatalf("Missing info for column %q", col)
+			}
+
+			if v := row.DefaultValue.String; v != dflt {
+				t.Fatalf("Expected default value %q, got %q", dflt, v)
+			}
+		})
+	}
+
+	// check whether the values were normalized
+	// ---------------------------------------------------------------
+	type fieldsExpectation struct {
+		SelectOne   string `db:"select_one"`
+		SelectMany  string `db:"select_many"`
+		FileOne     string `db:"file_one"`
+		FileMany    string `db:"file_many"`
+		RelOne      string `db:"rel_one"`
+		RelMany     string `db:"rel_many"`
+		NewMultiple string `db:"new_multiple"`
+	}
+
+	fieldsScenarios := []struct {
+		recordId string
+		expected fieldsExpectation
+	}{
+		{
+			"imy661ixudk5izi",
+			fieldsExpectation{
+				SelectOne:   `[]`,
+				SelectMany:  ``,
+				FileOne:     `[]`,
+				FileMany:    ``,
+				RelOne:      `[]`,
+				RelMany:     ``,
+				NewMultiple: `[]`,
+			},
+		},
+		{
+			"al1h9ijdeojtsjy",
+			fieldsExpectation{
+				SelectOne:   `["optionB"]`,
+				SelectMany:  `optionB`,
+				FileOne:     `["300_Jsjq7RdBgA.png"]`,
+				FileMany:    ``,
+				RelOne:      `["84nmscqy84lsi1t"]`,
+				RelMany:     `oap640cot4yru2s`,
+				NewMultiple: `[]`,
+			},
+		},
+		{
+			"84nmscqy84lsi1t",
+			fieldsExpectation{
+				SelectOne:   `["optionB"]`,
+				SelectMany:  `optionC`,
+				FileOne:     `["test_d61b33QdDU.txt"]`,
+				FileMany:    `test_tC1Yc87DfC.txt`,
+				RelOne:      `[]`,
+				RelMany:     `oap640cot4yru2s`,
+				NewMultiple: `[]`,
+			},
+		},
+	}
+
+	for _, s := range fieldsScenarios {
+		t.Run("check fields for record "+s.recordId, func(t *testing.T) {
+			result := new(fieldsExpectation)
+
+			err := app.DB().Select(
+				"select_one",
+				"select_many",
+				"file_one",
+				"file_many",
+				"rel_one",
+				"rel_many",
+				"new_multiple",
+			).From(collection.Name).Where(dbx.HashExp{"id": s.recordId}).One(result)
+			if err != nil {
+				t.Fatalf("Failed to load record: %v", err)
+			}
+
+			encodedResult, err := json.Marshal(result)
+			if err != nil {
+				t.Fatalf("Failed to encode result: %v", err)
+			}
+
+			encodedExpectation, err := json.Marshal(s.expected)
+			if err != nil {
+				t.Fatalf("Failed to encode expectation: %v", err)
+			}
+
+			if !bytes.EqualFold(encodedExpectation, encodedResult) {
+				t.Fatalf("Expected \n%s, \ngot \n%s", encodedExpectation, encodedResult)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/collection_validate.go b/server/core_backend-server/core/collection_validate.go
new file mode 100644
index 0000000..10ec194
--- /dev/null
+++ b/server/core_backend-server/core/collection_validate.go
@@ -0,0 +1,704 @@
+package core
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+var collectionNameRegex = regexp.MustCompile(`^\w+$`)
+
+func onCollectionValidate(e *CollectionEvent) error {
+	var original *Collection
+	if !e.Collection.IsNew() {
+		original = &Collection{}
+		if err := e.App.ModelQuery(original).Model(e.Collection.LastSavedPK(), original); err != nil {
+			return fmt.Errorf("failed to fetch old collection state: %w", err)
+		}
+	}
+
+	validator := newCollectionValidator(
+		e.Context,
+		e.App,
+		e.Collection,
+		original,
+	)
+
+	if err := validator.run(); err != nil {
+		return err
+	}
+
+	return e.Next()
+}
+
+func newCollectionValidator(ctx context.Context, app App, new, original *Collection) *collectionValidator {
+	validator := &collectionValidator{
+		ctx:      ctx,
+		app:      app,
+		new:      new,
+		original: original,
+	}
+
+	// load old/original collection
+	if validator.original == nil {
+		validator.original = NewCollection(validator.new.Type, "")
+	}
+
+	return validator
+}
+
+type collectionValidator struct {
+	original *Collection
+	new      *Collection
+	app      App
+	ctx      context.Context
+}
+
+type optionsValidator interface {
+	validate(cv *collectionValidator) error
+}
+
+func (validator *collectionValidator) run() error {
+	if validator.original.IsNew() {
+		validator.new.updateGeneratedIdIfExists(validator.app)
+	}
+
+	// generate fields from the query (overwriting any explicit user defined fields)
+	if validator.new.IsView() {
+		validator.new.Fields, _ = validator.app.CreateViewFields(validator.new.ViewQuery)
+	}
+
+	// validate base fields
+	baseErr := validation.ValidateStruct(validator.new,
+		validation.Field(
+			&validator.new.Id,
+			validation.Required,
+			validation.When(
+				validator.original.IsNew(),
+				validation.Length(1, 100),
+				validation.Match(DefaultIdRegex),
+				validation.By(validators.UniqueId(validator.app.ConcurrentDB(), validator.new.TableName())),
+			).Else(
+				validation.By(validators.Equal(validator.original.Id)),
+			),
+		),
+		validation.Field(
+			&validator.new.System,
+			validation.By(validator.ensureNoSystemFlagChange),
+		),
+		validation.Field(
+			&validator.new.Type,
+			validation.Required,
+			validation.In(
+				CollectionTypeBase,
+				CollectionTypeAuth,
+				CollectionTypeView,
+			),
+			validation.By(validator.ensureNoTypeChange),
+		),
+		validation.Field(
+			&validator.new.Name,
+			validation.Required,
+			validation.Length(1, 255),
+			validation.By(checkForVia),
+			validation.Match(collectionNameRegex),
+			validation.By(validator.ensureNoSystemNameChange),
+			validation.By(validator.checkUniqueName),
+		),
+		validation.Field(
+			&validator.new.Fields,
+			validation.By(validator.checkFieldDuplicates),
+			validation.By(validator.checkMinFields),
+			validation.When(
+				!validator.new.IsView(),
+				validation.By(validator.ensureNoSystemFieldsChange),
+				validation.By(validator.ensureNoFieldsTypeChange),
+			),
+			validation.When(validator.new.IsAuth(), validation.By(validator.checkReservedAuthKeys)),
+			validation.By(validator.checkFieldValidators),
+		),
+		validation.Field(
+			&validator.new.ListRule,
+			validation.By(validator.checkRule),
+			validation.By(validator.ensureNoSystemRuleChange(validator.original.ListRule)),
+		),
+		validation.Field(
+			&validator.new.ViewRule,
+			validation.By(validator.checkRule),
+			validation.By(validator.ensureNoSystemRuleChange(validator.original.ViewRule)),
+		),
+		validation.Field(
+			&validator.new.CreateRule,
+			validation.When(validator.new.IsView(), validation.Nil),
+			validation.By(validator.checkRule),
+			validation.By(validator.ensureNoSystemRuleChange(validator.original.CreateRule)),
+		),
+		validation.Field(
+			&validator.new.UpdateRule,
+			validation.When(validator.new.IsView(), validation.Nil),
+			validation.By(validator.checkRule),
+			validation.By(validator.ensureNoSystemRuleChange(validator.original.UpdateRule)),
+		),
+		validation.Field(
+			&validator.new.DeleteRule,
+			validation.When(validator.new.IsView(), validation.Nil),
+			validation.By(validator.checkRule),
+			validation.By(validator.ensureNoSystemRuleChange(validator.original.DeleteRule)),
+		),
+		validation.Field(&validator.new.Indexes, validation.By(validator.checkIndexes)),
+	)
+
+	optionsErr := validator.validateOptions()
+
+	return validators.JoinValidationErrors(baseErr, optionsErr)
+}
+
+func (validator *collectionValidator) checkUniqueName(value any) error {
+	v, _ := value.(string)
+
+	// ensure unique collection name
+	if !validator.app.IsCollectionNameUnique(v, validator.original.Id) {
+		return validation.NewError("validation_collection_name_exists", "Collection name must be unique (case insensitive).")
+	}
+
+	// ensure that the collection name doesn't collide with the id of any collection
+	dummyCollection := &Collection{}
+	if validator.app.ModelQuery(dummyCollection).Model(v, dummyCollection) == nil {
+		return validation.NewError("validation_collection_name_id_duplicate", "The name must not match an existing collection id.")
+	}
+
+	// ensure that there is no existing internal table with the provided name
+	if validator.original.Name != v && // has changed
+		validator.app.IsCollectionNameUnique(v) && // is not a collection (in case it was presaved)
+		validator.app.HasTable(v) {
+		return validation.NewError("validation_collection_name_invalid", "The name shouldn't match with an existing internal table.")
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) ensureNoSystemNameChange(value any) error {
+	v, _ := value.(string)
+
+	if !validator.original.IsNew() && validator.original.System && v != validator.original.Name {
+		return validation.NewError("validation_collection_system_name_change", "System collection name cannot be changed.")
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) ensureNoSystemFlagChange(value any) error {
+	v, _ := value.(bool)
+
+	if !validator.original.IsNew() && v != validator.original.System {
+		return validation.NewError("validation_collection_system_flag_change", "System collection state cannot be changed.")
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) ensureNoTypeChange(value any) error {
+	v, _ := value.(string)
+
+	if !validator.original.IsNew() && v != validator.original.Type {
+		return validation.NewError("validation_collection_type_change", "Collection type cannot be changed.")
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) ensureNoFieldsTypeChange(value any) error {
+	v, ok := value.(FieldsList)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	errs := validation.Errors{}
+
+	for i, field := range v {
+		oldField := validator.original.Fields.GetById(field.GetId())
+
+		if oldField != nil && oldField.Type() != field.Type() {
+			errs[strconv.Itoa(i)] = validation.NewError(
+				"validation_field_type_change",
+				"Field type cannot be changed.",
+			)
+		}
+	}
+	if len(errs) > 0 {
+		return errs
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) checkFieldDuplicates(value any) error {
+	fields, ok := value.(FieldsList)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	totalFields := len(fields)
+	ids := make([]string, 0, totalFields)
+	names := make([]string, 0, totalFields)
+
+	for i, field := range fields {
+		if list.ExistInSlice(field.GetId(), ids) {
+			return validation.Errors{
+				strconv.Itoa(i): validation.Errors{
+					"id": validation.NewError(
+						"validation_duplicated_field_id",
+						fmt.Sprintf("Duplicated or invalid field id %q", field.GetId()),
+					),
+				},
+			}
+		}
+
+		// field names are used as db columns and should be case insensitive
+		nameLower := strings.ToLower(field.GetName())
+
+		if list.ExistInSlice(nameLower, names) {
+			return validation.Errors{
+				strconv.Itoa(i): validation.Errors{
+					"name": validation.NewError(
+						"validation_duplicated_field_name",
+						"Duplicated or invalid field name {{.fieldName}}",
+					).SetParams(map[string]any{
+						"fieldName": field.GetName(),
+					}),
+				},
+			}
+		}
+
+		ids = append(ids, field.GetId())
+		names = append(names, nameLower)
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) checkFieldValidators(value any) error {
+	fields, ok := value.(FieldsList)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	errs := validation.Errors{}
+
+	for i, field := range fields {
+		if err := field.ValidateSettings(validator.ctx, validator.app, validator.new); err != nil {
+			errs[strconv.Itoa(i)] = err
+		}
+	}
+
+	if len(errs) > 0 {
+		return errs
+	}
+
+	return nil
+}
+
+func (cv *collectionValidator) checkViewQuery(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil // nothing to check
+	}
+
+	if _, err := cv.app.CreateViewFields(v); err != nil {
+		return validation.NewError(
+			"validation_invalid_view_query",
+			fmt.Sprintf("Invalid query - %s", err.Error()),
+		)
+	}
+
+	return nil
+}
+
+var reservedAuthKeys = []string{"passwordConfirm", "oldPassword"}
+
+func (cv *collectionValidator) checkReservedAuthKeys(value any) error {
+	fields, ok := value.(FieldsList)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if !cv.new.IsAuth() {
+		return nil // not an auth collection
+	}
+
+	errs := validation.Errors{}
+	for i, field := range fields {
+		if list.ExistInSlice(field.GetName(), reservedAuthKeys) {
+			errs[strconv.Itoa(i)] = validation.Errors{
+				"name": validation.NewError(
+					"validation_reserved_field_name",
+					"The field name is reserved and cannot be used.",
+				),
+			}
+		}
+	}
+	if len(errs) > 0 {
+		return errs
+	}
+
+	return nil
+}
+
+func (cv *collectionValidator) checkMinFields(value any) error {
+	fields, ok := value.(FieldsList)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if len(fields) == 0 {
+		return validation.ErrRequired
+	}
+
+	// all collections must have an "id" PK field
+	idField, _ := fields.GetByName(FieldNameId).(*TextField)
+	if idField == nil || !idField.PrimaryKey {
+		return validation.NewError("validation_missing_primary_key", `Missing or invalid "id" PK field.`)
+	}
+
+	switch cv.new.Type {
+	case CollectionTypeAuth:
+		passwordField, _ := fields.GetByName(FieldNamePassword).(*PasswordField)
+		if passwordField == nil {
+			return validation.NewError("validation_missing_password_field", `System "password" field is required.`)
+		}
+		if !passwordField.Hidden || !passwordField.System {
+			return validation.Errors{FieldNamePassword: ErrMustBeSystemAndHidden}
+		}
+
+		tokenKeyField, _ := fields.GetByName(FieldNameTokenKey).(*TextField)
+		if tokenKeyField == nil {
+			return validation.NewError("validation_missing_tokenKey_field", `System "tokenKey" field is required.`)
+		}
+		if !tokenKeyField.Hidden || !tokenKeyField.System {
+			return validation.Errors{FieldNameTokenKey: ErrMustBeSystemAndHidden}
+		}
+
+		emailField, _ := fields.GetByName(FieldNameEmail).(*EmailField)
+		if emailField == nil {
+			return validation.NewError("validation_missing_email_field", `System "email" field is required.`)
+		}
+		if !emailField.System {
+			return validation.Errors{FieldNameEmail: ErrMustBeSystem}
+		}
+
+		emailVisibilityField, _ := fields.GetByName(FieldNameEmailVisibility).(*BoolField)
+		if emailVisibilityField == nil {
+			return validation.NewError("validation_missing_emailVisibility_field", `System "emailVisibility" field is required.`)
+		}
+		if !emailVisibilityField.System {
+			return validation.Errors{FieldNameEmailVisibility: ErrMustBeSystem}
+		}
+
+		verifiedField, _ := fields.GetByName(FieldNameVerified).(*BoolField)
+		if verifiedField == nil {
+			return validation.NewError("validation_missing_verified_field", `System "verified" field is required.`)
+		}
+		if !verifiedField.System {
+			return validation.Errors{FieldNameVerified: ErrMustBeSystem}
+		}
+
+		return nil
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) ensureNoSystemFieldsChange(value any) error {
+	fields, ok := value.(FieldsList)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if validator.original.IsNew() {
+		return nil // not an update
+	}
+
+	for _, oldField := range validator.original.Fields {
+		if !oldField.GetSystem() {
+			continue
+		}
+
+		newField := fields.GetById(oldField.GetId())
+
+		if newField == nil || oldField.GetName() != newField.GetName() {
+			return validation.NewError("validation_system_field_change", "System fields cannot be deleted or renamed.")
+		}
+	}
+
+	return nil
+}
+
+func (cv *collectionValidator) checkFieldsForUniqueIndex(value any) error {
+	names, ok := value.([]string)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if len(names) == 0 {
+		return nil // nothing to check
+	}
+
+	for _, name := range names {
+		field := cv.new.Fields.GetByName(name)
+		if field == nil {
+			return validation.NewError("validation_missing_field", "Invalid or missing field {{.fieldName}}").
+				SetParams(map[string]any{"fieldName": name})
+		}
+
+		if _, ok := dbutils.FindSingleColumnUniqueIndex(cv.new.Indexes, name); !ok {
+			return validation.NewError("validation_missing_unique_constraint", "The field {{.fieldName}} doesn't have a UNIQUE constraint.").
+				SetParams(map[string]any{"fieldName": name})
+		}
+	}
+
+	return nil
+}
+
+// note: value could be either *string or string
+func (validator *collectionValidator) checkRule(value any) error {
+	var vStr string
+
+	v, ok := value.(*string)
+	if ok {
+		if v != nil {
+			vStr = *v
+		}
+	} else {
+		vStr, ok = value.(string)
+	}
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if vStr == "" {
+		return nil // nothing to check
+	}
+
+	r := NewRecordFieldResolver(validator.app, validator.new, &RequestInfo{}, true)
+	_, err := search.FilterData(vStr).BuildExpr(r)
+	if err != nil {
+		return validation.NewError("validation_invalid_rule", "Invalid rule. Raw error: "+err.Error())
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) ensureNoSystemRuleChange(oldRule *string) validation.RuleFunc {
+	return func(value any) error {
+		if validator.original.IsNew() || !validator.original.System {
+			return nil // not an update of a system collection
+		}
+
+		rule, ok := value.(*string)
+		if !ok {
+			return validators.ErrUnsupportedValueType
+		}
+
+		if (rule == nil && oldRule == nil) ||
+			(rule != nil && oldRule != nil && *rule == *oldRule) {
+			return nil
+		}
+
+		return validation.NewError("validation_collection_system_rule_change", "System collection API rule cannot be changed.")
+	}
+}
+
+func (cv *collectionValidator) checkIndexes(value any) error {
+	indexes, _ := value.(types.JSONArray[string])
+
+	if cv.new.IsView() && len(indexes) > 0 {
+		return validation.NewError(
+			"validation_indexes_not_supported",
+			"View collections don't support indexes.",
+		)
+	}
+
+	duplicatedNames := make(map[string]struct{}, len(indexes))
+	duplicatedDefinitions := make(map[string]struct{}, len(indexes))
+
+	for i, rawIndex := range indexes {
+		parsed := dbutils.ParseIndex(rawIndex)
+
+		// always set a table name because it is ignored anyway in order to keep it in sync with the collection name
+		parsed.TableName = "validator"
+
+		if !parsed.IsValid() {
+			return validation.Errors{
+				strconv.Itoa(i): validation.NewError(
+					"validation_invalid_index_expression",
+					"Invalid CREATE INDEX expression.",
+				),
+			}
+		}
+
+		if _, isDuplicated := duplicatedNames[strings.ToLower(parsed.IndexName)]; isDuplicated {
+			return validation.Errors{
+				strconv.Itoa(i): validation.NewError(
+					"validation_duplicated_index_name",
+					"The index name already exists.",
+				),
+			}
+		}
+		duplicatedNames[strings.ToLower(parsed.IndexName)] = struct{}{}
+
+		// ensure that the index name is not used in another collection
+		var usedTblName string
+		/* SQLite:
+		_ = cv.app.ConcurrentDB().Select("tbl_name").
+			From("sqlite_master").
+			AndWhere(dbx.HashExp{"type": "index"}).
+			AndWhere(dbx.NewExp("LOWER([[tbl_name]])!=LOWER({:oldName})", dbx.Params{"oldName": cv.original.Name})).
+			AndWhere(dbx.NewExp("LOWER([[tbl_name]])!=LOWER({:newName})", dbx.Params{"newName": cv.new.Name})).
+			AndWhere(dbx.NewExp("LOWER([[name]])=LOWER({:indexName})", dbx.Params{"indexName": parsed.IndexName})).
+			Limit(1).
+			Row(&usedTblName)
+		*/
+		// PostgreSQL:
+		_ = cv.app.ConcurrentDB().Select("tablename").
+			From("pg_indexes").
+			AndWhere(dbx.NewExp("LOWER([[tablename]])!=LOWER({:oldName})", dbx.Params{"oldName": cv.original.Name})).
+			AndWhere(dbx.NewExp("LOWER([[tablename]])!=LOWER({:newName})", dbx.Params{"newName": cv.new.Name})).
+			AndWhere(dbx.NewExp("LOWER([[indexname]])=LOWER({:indexName})", dbx.Params{"indexName": parsed.IndexName})).
+			Limit(1).
+			Row(&usedTblName)
+		if usedTblName != "" {
+			return validation.Errors{
+				strconv.Itoa(i): validation.NewError(
+					"validation_existing_index_name",
+					"The index name is already used in {{.usedTableName}} collection.",
+				).SetParams(map[string]any{"usedTableName": usedTblName}),
+			}
+		}
+
+		// reset non-important identifiers
+		parsed.SchemaName = "validator"
+		parsed.IndexName = "validator"
+		parsedDef := parsed.Build()
+
+		if _, isDuplicated := duplicatedDefinitions[parsedDef]; isDuplicated {
+			return validation.Errors{
+				strconv.Itoa(i): validation.NewError(
+					"validation_duplicated_index_definition",
+					"The index definition already exists.",
+				),
+			}
+		}
+		duplicatedDefinitions[parsedDef] = struct{}{}
+
+		// note: we don't check the index table name because it is always
+		// overwritten by the SyncRecordTableSchema to allow
+		// easier partial modifications (eg. changing only the collection name).
+		// if !strings.EqualFold(parsed.TableName, form.Name) {
+		// 	return validation.Errors{
+		// 		strconv.Itoa(i): validation.NewError(
+		// 			"validation_invalid_index_table",
+		// 			fmt.Sprintf("The index table must be the same as the collection name."),
+		// 		),
+		// 	}
+		// }
+	}
+
+	// ensure that unique indexes on system fields are not changed or removed
+	if !cv.original.IsNew() {
+	OLD_INDEXES_LOOP:
+		for _, oldIndex := range cv.original.Indexes {
+			oldParsed := dbutils.ParseIndex(oldIndex)
+			if !oldParsed.Unique {
+				continue
+			}
+
+			// reset collate and sort since they are not important for the unique constraint
+			for i := range oldParsed.Columns {
+				oldParsed.Columns[i].Collate = ""
+				oldParsed.Columns[i].Sort = ""
+			}
+
+			oldParsedStr := oldParsed.Build()
+
+			for _, column := range oldParsed.Columns {
+				for _, f := range cv.original.Fields {
+					if !f.GetSystem() || !strings.EqualFold(column.Name, f.GetName()) {
+						continue
+					}
+
+					var hasMatch bool
+					for _, newIndex := range cv.new.Indexes {
+						newParsed := dbutils.ParseIndex(newIndex)
+
+						// exclude the non-important identifiers from the check
+						newParsed.SchemaName = oldParsed.SchemaName
+						newParsed.IndexName = oldParsed.IndexName
+						newParsed.TableName = oldParsed.TableName
+
+						// exclude partial constraints
+						newParsed.Where = oldParsed.Where
+
+						// reset collate and sort
+						for i := range newParsed.Columns {
+							newParsed.Columns[i].Collate = ""
+							newParsed.Columns[i].Sort = ""
+						}
+
+						if oldParsedStr == newParsed.Build() {
+							hasMatch = true
+							break
+						}
+					}
+
+					if !hasMatch {
+						return validation.NewError(
+							"validation_invalid_unique_system_field_index",
+							"Unique index definition on system fields ({{.fieldName}}) is invalid or missing.",
+						).SetParams(map[string]any{"fieldName": f.GetName()})
+					}
+
+					continue OLD_INDEXES_LOOP
+				}
+			}
+		}
+	}
+
+	// check for required indexes
+	//
+	// note: this is in case the indexes were removed manually when creating/importing new auth collections
+	// and technically it is not necessary because on app.Save() the missing indexes will be reinserted by the system collection hook
+	if cv.new.IsAuth() {
+		requiredNames := []string{FieldNameTokenKey, FieldNameEmail}
+		for _, name := range requiredNames {
+			if _, ok := dbutils.FindSingleColumnUniqueIndex(indexes, name); !ok {
+				return validation.NewError(
+					"validation_missing_required_unique_index",
+					`Missing required unique index for field "{{.fieldName}}".`,
+				).SetParams(map[string]any{"fieldName": name})
+			}
+		}
+	}
+
+	return nil
+}
+
+func (validator *collectionValidator) validateOptions() error {
+	switch validator.new.Type {
+	case CollectionTypeAuth:
+		return validator.new.collectionAuthOptions.validate(validator)
+	case CollectionTypeView:
+		return validator.new.collectionViewOptions.validate(validator)
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/core/collection_validate_test.go b/server/core_backend-server/core/collection_validate_test.go
new file mode 100644
index 0000000..9f0ef34
--- /dev/null
+++ b/server/core_backend-server/core/collection_validate_test.go
@@ -0,0 +1,909 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestCollectionValidate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name           string
+		collection     func(app core.App) (*core.Collection, error)
+		expectedErrors []string
+	}{
+		{
+			name: "empty collection",
+			collection: func(app core.App) (*core.Collection, error) {
+				return &core.Collection{}, nil
+			},
+			expectedErrors: []string{
+				"id", "name", "type", "fields", // no default fields because the type is unknown
+			},
+		},
+		{
+			name: "unknown type with all invalid fields",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := &core.Collection{}
+				c.Id = "invalid_id ?!@#$"
+				c.Name = "invalid_name ?!@#$"
+				c.Type = "invalid_type"
+				c.ListRule = types.Pointer("missing = '123'")
+				c.ViewRule = types.Pointer("missing = '123'")
+				c.CreateRule = types.Pointer("missing = '123'")
+				c.UpdateRule = types.Pointer("missing = '123'")
+				c.DeleteRule = types.Pointer("missing = '123'")
+				c.Indexes = []string{"create index '' on '' ()"}
+
+				// type specific fields
+				c.ViewQuery = "invalid"                       // should be ignored
+				c.AuthRule = types.Pointer("missing = '123'") // should be ignored
+
+				return c, nil
+			},
+			expectedErrors: []string{
+				"id", "name", "type", "indexes",
+				"listRule", "viewRule", "createRule", "updateRule", "deleteRule",
+				"fields", // no default fields because the type is unknown
+			},
+		},
+		{
+			name: "base with invalid fields",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("invalid_name ?!@#$")
+				c.Indexes = []string{"create index '' on '' ()"}
+
+				// type specific fields
+				c.ViewQuery = "invalid"                       // should be ignored
+				c.AuthRule = types.Pointer("missing = '123'") // should be ignored
+
+				return c, nil
+			},
+			expectedErrors: []string{"name", "indexes"},
+		},
+		{
+			name: "view with invalid fields",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("invalid_name ?!@#$")
+				c.Indexes = []string{"create index '' on '' ()"}
+
+				// type specific fields
+				c.ViewQuery = "invalid"
+				c.AuthRule = types.Pointer("missing = '123'") // should be ignored
+
+				return c, nil
+			},
+			expectedErrors: []string{"indexes", "name", "fields", "viewQuery"},
+		},
+		{
+			name: "auth with invalid fields",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("invalid_name ?!@#$")
+				c.Indexes = []string{"create index '' on '' ()"}
+
+				// type specific fields
+				c.ViewQuery = "invalid" // should be ignored
+				c.AuthRule = types.Pointer("missing = '123'")
+
+				return c, nil
+			},
+			expectedErrors: []string{"indexes", "name", "authRule"},
+		},
+
+		// type checks
+		{
+			name: "empty type",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test")
+				c.Type = ""
+				return c, nil
+			},
+			expectedErrors: []string{"type"},
+		},
+		{
+			name: "unknown type",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test")
+				c.Type = "unknown"
+				return c, nil
+			},
+			expectedErrors: []string{"type"},
+		},
+		{
+			name: "base type",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "view type",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("test")
+				c.ViewQuery = "select 1 as id"
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "auth type",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("test")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "changing type",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("users")
+				c.Type = core.CollectionTypeBase
+				return c, nil
+			},
+			expectedErrors: []string{"type"},
+		},
+
+		// system checks
+		{
+			name: "change from system to regular",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+				c.System = false
+				return c, nil
+			},
+			expectedErrors: []string{"system"},
+		},
+		{
+			name: "change from regular to system",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.System = true
+				return c, nil
+			},
+			expectedErrors: []string{"system"},
+		},
+		{
+			name: "create system",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new_system")
+				c.System = true
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+
+		// id checks
+		{
+			name: "empty id",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test")
+				c.Id = ""
+				return c, nil
+			},
+			expectedErrors: []string{"id"},
+		},
+		{
+			name: "invalid id",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test")
+				c.Id = "!invalid"
+				return c, nil
+			},
+			expectedErrors: []string{"id"},
+		},
+		{
+			name: "existing id",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test")
+				c.Id = "_pb_users_auth_"
+				return c, nil
+			},
+			expectedErrors: []string{"id"},
+		},
+		{
+			name: "changing id",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo3")
+				c.Id = "anything"
+				return c, nil
+			},
+			expectedErrors: []string{"id"},
+		},
+		{
+			name: "valid id",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test")
+				c.Id = "anything"
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+
+		// name checks
+		{
+			name: "empty name",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("")
+				c.Id = "test"
+				return c, nil
+			},
+			expectedErrors: []string{"name"},
+		},
+		{
+			name: "invalid name",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("!invalid")
+				return c, nil
+			},
+			expectedErrors: []string{"name"},
+		},
+		{
+			name: "name with _via_",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("a_via_b")
+				return c, nil
+			},
+			expectedErrors: []string{"name"},
+		},
+		{
+			name: "create with existing collection name",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("demo1")
+				return c, nil
+			},
+			expectedErrors: []string{"name"},
+		},
+		{
+			name: "create with existing internal table name",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("_collections")
+				return c, nil
+			},
+			expectedErrors: []string{"name"},
+		},
+		{
+			name: "update with existing collection name",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("users")
+				c.Name = "demo1"
+				return c, nil
+			},
+			expectedErrors: []string{"name"},
+		},
+		{
+			name: "update with existing internal table name",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("users")
+				c.Name = "_collections"
+				return c, nil
+			},
+			expectedErrors: []string{"name"},
+		},
+		{
+			name: "system collection name change",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+				c.Name = "superusers_new"
+				return c, nil
+			},
+			expectedErrors: []string{"name"},
+		},
+		{
+			name: "create with valid name",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new_col")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "update with valid name",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.Name = "demo1_new"
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+
+		// rule checks
+		{
+			name: "invalid base rules",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new")
+				c.ListRule = types.Pointer("!invalid")
+				c.ViewRule = types.Pointer("missing = 123")
+				c.CreateRule = types.Pointer("id = 123 && missing = 456")
+				c.UpdateRule = types.Pointer("@request.body.missing:changed = false")
+				c.DeleteRule = types.Pointer("(id=123")
+				return c, nil
+			},
+			expectedErrors: []string{"listRule", "viewRule", "createRule", "updateRule", "deleteRule"},
+		},
+		{
+			name: "valid base rules",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new")
+				c.Fields.Add(&core.TextField{Name: "f1"}) // dummy field to ensure that new fields can be referenced
+				c.ListRule = types.Pointer("")
+				c.ViewRule = types.Pointer("f1 = 123")
+				c.CreateRule = types.Pointer("id = 123 && f1 = 456")
+				c.UpdateRule = types.Pointer("(id = 123 && @request.body.f1:changed = false)")
+				c.DeleteRule = types.Pointer("f1 = 123")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "view with non-nil create/update/delete rules",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("new")
+				c.ViewQuery = "select 1 as id, 'text' as f1"
+				c.ListRule = types.Pointer("id = 123")
+				c.ViewRule = types.Pointer("f1 = 456")
+				c.CreateRule = types.Pointer("")
+				c.UpdateRule = types.Pointer("")
+				c.DeleteRule = types.Pointer("")
+				return c, nil
+			},
+			expectedErrors: []string{"createRule", "updateRule", "deleteRule"},
+		},
+		{
+			name: "view with nil create/update/delete rules",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewViewCollection("new")
+				c.ViewQuery = "select 1 as id, 'text' as f1"
+				c.ListRule = types.Pointer("id = 1")
+				c.ViewRule = types.Pointer("f1 = 456")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "changing api rules",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("users")
+				c.Fields.Add(&core.TextField{Name: "f1"}) // dummy field to ensure that new fields can be referenced
+				c.ListRule = types.Pointer("id = 1")
+				c.ViewRule = types.Pointer("f1 = 456")
+				c.CreateRule = types.Pointer("id = 123 && f1 = 456")
+				c.UpdateRule = types.Pointer("(id = 123)")
+				c.DeleteRule = types.Pointer("f1 = 123")
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "changing system collection api rules",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+				c.ListRule = types.Pointer("1 = 1")
+				c.ViewRule = types.Pointer("1 = 1")
+				c.CreateRule = types.Pointer("1 = 1")
+				c.UpdateRule = types.Pointer("1 = 1")
+				c.DeleteRule = types.Pointer("1 = 1")
+				c.ManageRule = types.Pointer("1 = 1")
+				c.AuthRule = types.Pointer("1 = 1")
+				return c, nil
+			},
+			expectedErrors: []string{
+				"listRule", "viewRule", "createRule", "updateRule",
+				"deleteRule", "manageRule", "authRule",
+			},
+		},
+
+		// indexes checks
+		{
+			name: "invalid index expression",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.Indexes = []string{
+					"create index invalid",
+					"create index idx_test_demo2 on anything (text)", // the name of table shouldn't matter
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"indexes"},
+		},
+		{
+			name: "index name used in other table",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.Indexes = []string{
+					"create index `idx_test_demo1` on demo1 (id)",
+					"create index `__pb_USERS_auth__username_idx` on anything (text)", // should be case-insensitive
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"indexes"},
+		},
+		{
+			name: "duplicated index names",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.Indexes = []string{
+					"create index idx_test_demo1 on demo1 (id)",
+					"create index idx_test_demo1 on anything (text)",
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"indexes"},
+		},
+		{
+			name: "duplicated index definitions",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.Indexes = []string{
+					"create index idx_test_demo1 on demo1 (id)",
+					"create index idx_test_demo2 on demo1 (id)",
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"indexes"},
+		},
+		{
+			name: "try to add index to a view collection",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("view1")
+				c.Indexes = []string{"create index idx_test_view1 on view1 (id)"}
+				return c, nil
+			},
+			expectedErrors: []string{"indexes"},
+		},
+		{
+			name: "replace old with new indexes",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.Indexes = []string{
+					"create index idx_test_demo1 on demo1 (id)",
+					"create index idx_test_demo2 on anything (text)", // the name of table shouldn't matter
+				}
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "old + new indexes",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.Indexes = []string{
+					"CREATE INDEX `_wsmn24bux7wo113_created_idx` ON `demo1` (`created`)",
+					"create index idx_test_demo1 on anything (id)",
+				}
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "index for missing field",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				c.Indexes = []string{
+					"create index idx_test_demo1 on anything (missing)", // still valid because it is checked on db persist
+				}
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "auth collection with missing required unique indexes",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Indexes = []string{}
+				return c, nil
+			},
+			expectedErrors: []string{"indexes", "passwordAuth"},
+		},
+		{
+			name: "auth collection with non-unique required indexes",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Indexes = []string{
+					"create index test_idx1 on new_auth (tokenKey)",
+					"create index test_idx2 on new_auth (email)",
+				}
+				return c, nil
+			},
+			expectedErrors: []string{"indexes", "passwordAuth"},
+		},
+		{
+			name: "auth collection with unique required indexes",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Indexes = []string{
+					"create unique index test_idx1 on new_auth (tokenKey)",
+					"create unique index test_idx2 on new_auth (email)",
+				}
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "removing index on system field",
+			collection: func(app core.App) (*core.Collection, error) {
+				demo2, err := app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// mark the title field as system
+				demo2.Fields.GetByName("title").SetSystem(true)
+				if err = app.Save(demo2); err != nil {
+					return nil, err
+				}
+
+				// refresh
+				demo2, err = app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				demo2.RemoveIndex("idx_unique_demo2_title")
+
+				return demo2, nil
+			},
+			expectedErrors: []string{"indexes"},
+		},
+		{
+			name: "changing partial constraint of existing index on system field",
+			collection: func(app core.App) (*core.Collection, error) {
+				demo2, err := app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// mark the title field as system
+				demo2.Fields.GetByName("title").SetSystem(true)
+				if err = app.Save(demo2); err != nil {
+					return nil, err
+				}
+
+				// refresh
+				demo2, err = app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// replace the index with a partial one
+				demo2.RemoveIndex("idx_unique_demo2_title")
+				demo2.AddIndex("idx_new_demo2_title", true, "title", "1 = 1")
+
+				return demo2, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "changing column sort and collate of existing index on system field",
+			collection: func(app core.App) (*core.Collection, error) {
+				demo2, err := app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// mark the title field as system
+				demo2.Fields.GetByName("title").SetSystem(true)
+				if err = app.Save(demo2); err != nil {
+					return nil, err
+				}
+
+				// refresh
+				demo2, err = app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// replace the index with a new one for the same column but with collate and sort
+				demo2.RemoveIndex("idx_unique_demo2_title")
+				demo2.AddIndex("idx_new_demo2_title", true, "title COLLATE test ASC", "")
+
+				return demo2, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "adding new column to index on system field",
+			collection: func(app core.App) (*core.Collection, error) {
+				demo2, err := app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// mark the title field as system
+				demo2.Fields.GetByName("title").SetSystem(true)
+				if err = app.Save(demo2); err != nil {
+					return nil, err
+				}
+
+				// refresh
+				demo2, err = app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// replace the index with a non-unique one
+				demo2.RemoveIndex("idx_unique_demo2_title")
+				demo2.AddIndex("idx_new_title", false, "title, id", "")
+
+				return demo2, nil
+			},
+			expectedErrors: []string{"indexes"},
+		},
+		{
+			name: "changing index type on system field",
+			collection: func(app core.App) (*core.Collection, error) {
+				demo2, err := app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// mark the title field as system
+				demo2.Fields.GetByName("title").SetSystem(true)
+				if err = app.Save(demo2); err != nil {
+					return nil, err
+				}
+
+				// refresh
+				demo2, err = app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// replace the index with a non-unique one (partial constraints are ignored)
+				demo2.RemoveIndex("idx_unique_demo2_title")
+				demo2.AddIndex("idx_new_title", false, "title", "1=1")
+
+				return demo2, nil
+			},
+			expectedErrors: []string{"indexes"},
+		},
+		{
+			name: "changing index on non-system field",
+			collection: func(app core.App) (*core.Collection, error) {
+				demo2, err := app.FindCollectionByNameOrId("demo2")
+				if err != nil {
+					return nil, err
+				}
+
+				// replace the index with a partial one
+				demo2.RemoveIndex("idx_demo2_active")
+				demo2.AddIndex("idx_demo2_active", true, "active", "1 = 1")
+
+				return demo2, nil
+			},
+			expectedErrors: []string{},
+		},
+
+		// fields list checks
+		{
+			name: "empty fields",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new_auth")
+				c.Fields = nil // the minimum fields should auto added
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "no id primay key field",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new_auth")
+				c.Fields = core.NewFieldsList(
+					&core.TextField{Name: "id"},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "with id primay key field",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new_auth")
+				c.Fields = core.NewFieldsList(
+					&core.TextField{Name: "id", PrimaryKey: true, Required: true, Pattern: `\w+`},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "duplicated field names",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("new_auth")
+				c.Fields = core.NewFieldsList(
+					&core.TextField{Name: "id", PrimaryKey: true, Required: true, Pattern: `\w+`},
+					&core.TextField{Id: "f1", Name: "Test"}, // case-insensitive
+					&core.BoolField{Id: "f2", Name: "test"},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "changing field type",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("demo1")
+				f := c.Fields.GetByName("text")
+				c.Fields.Add(&core.BoolField{Id: f.GetId(), Name: f.GetName()})
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "renaming system field",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId(core.CollectionNameAuthOrigins)
+				f := c.Fields.GetByName("fingerprint")
+				f.SetName("fingerprint_new")
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "deleting system field",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId(core.CollectionNameAuthOrigins)
+				c.Fields.RemoveByName("fingerprint")
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "invalid field setting",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test_new")
+				c.Fields.Add(&core.TextField{Name: "f1", Min: -10})
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "valid field setting",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewBaseCollection("test_new")
+				c.Fields.Add(&core.TextField{Name: "f1", Min: 10})
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "fields view changes should be ignored",
+			collection: func(app core.App) (*core.Collection, error) {
+				c, _ := app.FindCollectionByNameOrId("view1")
+				c.Fields = nil
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "with reserved auth only field name (passwordConfirm)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.TextField{Name: "passwordConfirm"},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "with reserved auth only field name (oldPassword)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.TextField{Name: "oldPassword"},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "with invalid password auth field options (1)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.TextField{Name: "password", System: true, Hidden: true}, // should be PasswordField
+				)
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "with valid password auth field options (2)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.PasswordField{Name: "password", System: true, Hidden: true},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "with invalid tokenKey auth field options (1)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.TextField{Name: "tokenKey", System: true}, // should be also hidden
+				)
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "with valid tokenKey auth field options (2)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.TextField{Name: "tokenKey", System: true, Hidden: true},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "with invalid email auth field options (1)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.TextField{Name: "email", System: true}, // should be EmailField
+				)
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "with valid email auth field options (2)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.EmailField{Name: "email", System: true},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name: "with invalid verified auth field options (1)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.TextField{Name: "verified", System: true}, // should be BoolField
+				)
+				return c, nil
+			},
+			expectedErrors: []string{"fields"},
+		},
+		{
+			name: "with valid verified auth field options (2)",
+			collection: func(app core.App) (*core.Collection, error) {
+				c := core.NewAuthCollection("new_auth")
+				c.Fields.Add(
+					&core.BoolField{Name: "verified", System: true},
+				)
+				return c, nil
+			},
+			expectedErrors: []string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			collection, err := s.collection(app)
+			if err != nil {
+				t.Fatalf("Failed to retrieve test collection: %v", err)
+			}
+
+			result := app.Validate(collection)
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/db.go b/server/core_backend-server/core/db.go
new file mode 100644
index 0000000..3198d33
--- /dev/null
+++ b/server/core_backend-server/core/db.go
@@ -0,0 +1,555 @@
+package core
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"hash/crc32"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/google/uuid"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+const (
+	idColumn string = "id"
+
+	// DefaultIdLength is the default length of the generated model id.
+	DefaultIdLength int = 15
+
+	// DefaultIdAlphabet is the default characters set used for generating the model id.
+	DefaultIdAlphabet string = "abcdefghijklmnopqrstuvwxyz0123456789"
+)
+
+// DefaultIdRegex specifies the default regex pattern for an id value.
+var DefaultIdRegex = regexp.MustCompile(`^\w+$`)
+
+// IsPostgres checks if the current app database is PostgreSQL.
+func IsPostgres(app App) bool {
+	if base, ok := app.(*BaseApp); ok {
+		if base.driverName != "" {
+			return base.driverName == "postgres"
+		}
+		detectDriver(base)
+		return base.driverName == "postgres"
+	}
+
+	var version string
+	err := app.DB().NewQuery("SELECT version()").Row(&version)
+	return err == nil && strings.Contains(strings.ToLower(version), "postgres")
+}
+
+// IsMysql checks if the current app database is MySQL.
+func IsMysql(app App) bool {
+	if base, ok := app.(*BaseApp); ok {
+		if base.driverName != "" {
+			return base.driverName == "mysql"
+		}
+		detectDriver(base)
+		return base.driverName == "mysql"
+	}
+
+	var version string
+	err := app.DB().NewQuery("SELECT version()").Row(&version)
+	return err == nil && !strings.Contains(strings.ToLower(version), "postgres")
+}
+
+func detectDriver(app *BaseApp) {
+	if app.concurrentDB == nil {
+		return
+	}
+
+	var version string
+	err := app.concurrentDB.NewQuery("SELECT version()").Row(&version)
+	if err != nil {
+		app.driverName = "sqlite"
+		return
+	}
+
+	if strings.Contains(strings.ToLower(version), "postgres") {
+		app.driverName = "postgres"
+	} else {
+		app.driverName = "mysql"
+	}
+}
+
+// DBExporter defines an interface for custom DB data export.
+// Usually used as part of [App.Save].
+type DBExporter interface {
+	// DBExport returns a key-value map with the data to be used when saving the struct in the database.
+	DBExport(app App) (map[string]any, error)
+}
+
+// PreValidator defines an optional model interface for registering a
+// function that will run BEFORE firing the validation hooks (see [App.ValidateWithContext]).
+type PreValidator interface {
+	// PreValidate defines a function that runs BEFORE the validation hooks.
+	PreValidate(ctx context.Context, app App) error
+}
+
+// PostValidator defines an optional model interface for registering a
+// function that will run AFTER executing the validation hooks (see [App.ValidateWithContext]).
+type PostValidator interface {
+	// PostValidate defines a function that runs AFTER the successful
+	// execution of the validation hooks.
+	PostValidate(ctx context.Context, app App) error
+}
+
+// GenerateDefaultRandomId generates a default random id string
+// (note: the generated random string is not intended for security purposes).
+func GenerateDefaultRandomId() string {
+	return security.PseudorandomStringWithAlphabet(DefaultIdLength, DefaultIdAlphabet)
+}
+
+// GenerateNewUUIDV7 generates a uuid in v7 format.
+func GenerateNewUUIDV7() string {
+	id, _ := uuid.NewV7()
+	return id.String()
+}
+
+// crc32Checksum generates a stringified crc32 checksum from the provided plain string.
+func crc32Checksum(str string) string {
+	return strconv.FormatInt(int64(crc32.ChecksumIEEE([]byte(str))), 10)
+}
+
+// ModelQuery creates a new preconfigured select data.db query with preset
+// SELECT, FROM and other common fields based on the provided model.
+func (app *BaseApp) ModelQuery(m Model) *dbx.SelectQuery {
+	return app.modelQuery(app.ConcurrentDB(), m)
+}
+
+// AuxModelQuery creates a new preconfigured select auxiliary.db query with preset
+// SELECT, FROM and other common fields based on the provided model.
+func (app *BaseApp) AuxModelQuery(m Model) *dbx.SelectQuery {
+	return app.modelQuery(app.AuxConcurrentDB(), m)
+}
+
+func (app *BaseApp) modelQuery(db dbx.Builder, m Model) *dbx.SelectQuery {
+	tableName := m.TableName()
+
+	return db.
+		Select("{{" + tableName + "}}.*").
+		From(tableName).
+		WithBuildHook(func(query *dbx.Query) {
+			query.WithExecHook(execLockRetry(app.config.QueryTimeout, defaultMaxLockRetries))
+		})
+}
+
+// Delete deletes the specified model from the regular app database.
+func (app *BaseApp) Delete(model Model) error {
+	return app.DeleteWithContext(context.Background(), model)
+}
+
+// Delete deletes the specified model from the regular app database
+// (the context could be used to limit the query execution).
+func (app *BaseApp) DeleteWithContext(ctx context.Context, model Model) error {
+	return app.delete(ctx, model, false)
+}
+
+// AuxDelete deletes the specified model from the auxiliary database.
+func (app *BaseApp) AuxDelete(model Model) error {
+	return app.AuxDeleteWithContext(context.Background(), model)
+}
+
+// AuxDeleteWithContext deletes the specified model from the auxiliary database
+// (the context could be used to limit the query execution).
+func (app *BaseApp) AuxDeleteWithContext(ctx context.Context, model Model) error {
+	return app.delete(ctx, model, true)
+}
+
+func (app *BaseApp) delete(ctx context.Context, model Model, isForAuxDB bool) error {
+	event := new(ModelEvent)
+	event.App = app
+	event.Type = ModelEventTypeDelete
+	event.Context = ctx
+	event.Model = model
+
+	deleteErr := app.OnModelDelete().Trigger(event, func(e *ModelEvent) error {
+		pk := cast.ToString(e.Model.LastSavedPK())
+		if pk == "" {
+			return errors.New("the model can be deleted only if it is existing and has a non-empty primary key")
+		}
+
+		// db write
+		return e.App.OnModelDeleteExecute().Trigger(event, func(e *ModelEvent) error {
+			var db dbx.Builder
+			if isForAuxDB {
+				db = e.App.AuxNonconcurrentDB()
+			} else {
+				db = e.App.NonconcurrentDB()
+			}
+
+			return baseLockRetry(func(attempt int) error {
+				_, err := db.Delete(e.Model.TableName(), dbx.HashExp{
+					idColumn: pk,
+				}).WithContext(e.Context).Execute()
+
+				return err
+			}, defaultMaxLockRetries)
+		})
+	})
+	if deleteErr != nil {
+		errEvent := &ModelErrorEvent{ModelEvent: *event, Error: deleteErr}
+		errEvent.App = app // replace with the initial app in case it was changed by the hook
+		hookErr := app.OnModelAfterDeleteError().Trigger(errEvent)
+		if hookErr != nil {
+			return errors.Join(deleteErr, hookErr)
+		}
+
+		return deleteErr
+	}
+
+	if app.txInfo != nil {
+		// execute later after the transaction has completed
+		app.txInfo.OnComplete(func(txErr error) error {
+			if app.txInfo != nil && app.txInfo.parent != nil {
+				event.App = app.txInfo.parent
+			}
+
+			if txErr != nil {
+				return app.OnModelAfterDeleteError().Trigger(&ModelErrorEvent{
+					ModelEvent: *event,
+					Error:      txErr,
+				})
+			}
+
+			return app.OnModelAfterDeleteSuccess().Trigger(event)
+		})
+	} else if err := event.App.OnModelAfterDeleteSuccess().Trigger(event); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Save validates and saves the specified model into the regular app database.
+//
+// If you don't want to run validations, use [App.SaveNoValidate()].
+func (app *BaseApp) Save(model Model) error {
+	return app.SaveWithContext(context.Background(), model)
+}
+
+// SaveWithContext is the same as [App.Save()] but allows specifying a context to limit the db execution.
+//
+// If you don't want to run validations, use [App.SaveNoValidateWithContext()].
+func (app *BaseApp) SaveWithContext(ctx context.Context, model Model) error {
+	return app.save(ctx, model, true, false)
+}
+
+// SaveNoValidate saves the specified model into the regular app database without performing validations.
+//
+// If you want to also run validations before persisting, use [App.Save()].
+func (app *BaseApp) SaveNoValidate(model Model) error {
+	return app.SaveNoValidateWithContext(context.Background(), model)
+}
+
+// SaveNoValidateWithContext is the same as [App.SaveNoValidate()]
+// but allows specifying a context to limit the db execution.
+//
+// If you want to also run validations before persisting, use [App.SaveWithContext()].
+func (app *BaseApp) SaveNoValidateWithContext(ctx context.Context, model Model) error {
+	return app.save(ctx, model, false, false)
+}
+
+// AuxSave validates and saves the specified model into the auxiliary app database.
+//
+// If you don't want to run validations, use [App.AuxSaveNoValidate()].
+func (app *BaseApp) AuxSave(model Model) error {
+	return app.AuxSaveWithContext(context.Background(), model)
+}
+
+// AuxSaveWithContext is the same as [App.AuxSave()] but allows specifying a context to limit the db execution.
+//
+// If you don't want to run validations, use [App.AuxSaveNoValidateWithContext()].
+func (app *BaseApp) AuxSaveWithContext(ctx context.Context, model Model) error {
+	return app.save(ctx, model, true, true)
+}
+
+// AuxSaveNoValidate saves the specified model into the auxiliary app database without performing validations.
+//
+// If you want to also run validations before persisting, use [App.AuxSave()].
+func (app *BaseApp) AuxSaveNoValidate(model Model) error {
+	return app.AuxSaveNoValidateWithContext(context.Background(), model)
+}
+
+// AuxSaveNoValidateWithContext is the same as [App.AuxSaveNoValidate()]
+// but allows specifying a context to limit the db execution.
+//
+// If you want to also run validations before persisting, use [App.AuxSaveWithContext()].
+func (app *BaseApp) AuxSaveNoValidateWithContext(ctx context.Context, model Model) error {
+	return app.save(ctx, model, false, true)
+}
+
+// Validate triggers the OnModelValidate hook for the specified model.
+func (app *BaseApp) Validate(model Model) error {
+	return app.ValidateWithContext(context.Background(), model)
+}
+
+// ValidateWithContext is the same as Validate but allows specifying the ModelEvent context.
+func (app *BaseApp) ValidateWithContext(ctx context.Context, model Model) error {
+	if m, ok := model.(PreValidator); ok {
+		if err := m.PreValidate(ctx, app); err != nil {
+			return err
+		}
+	}
+
+	event := new(ModelEvent)
+	event.App = app
+	event.Context = ctx
+	event.Type = ModelEventTypeValidate
+	event.Model = model
+
+	return event.App.OnModelValidate().Trigger(event, func(e *ModelEvent) error {
+		if m, ok := e.Model.(PostValidator); ok {
+			if err := m.PostValidate(ctx, e.App); err != nil {
+				return err
+			}
+		}
+
+		return e.Next()
+	})
+}
+
+// -------------------------------------------------------------------
+
+func (app *BaseApp) save(ctx context.Context, model Model, withValidations bool, isForAuxDB bool) error {
+	if model.IsNew() {
+		return app.create(ctx, model, withValidations, isForAuxDB)
+	}
+
+	return app.update(ctx, model, withValidations, isForAuxDB)
+}
+
+func (app *BaseApp) create(ctx context.Context, model Model, withValidations bool, isForAuxDB bool) error {
+	event := new(ModelEvent)
+	event.App = app
+	event.Context = ctx
+	event.Type = ModelEventTypeCreate
+	event.Model = model
+
+	saveErr := app.OnModelCreate().Trigger(event, func(e *ModelEvent) error {
+		// run validations (if any)
+		if withValidations {
+			validateErr := e.App.ValidateWithContext(e.Context, e.Model)
+			if validateErr != nil {
+				return validateErr
+			}
+		}
+
+		// db write
+		return e.App.OnModelCreateExecute().Trigger(event, func(e *ModelEvent) error {
+			var db dbx.Builder
+			if isForAuxDB {
+				db = e.App.AuxNonconcurrentDB()
+			} else {
+				db = e.App.NonconcurrentDB()
+			}
+
+			dbErr := baseLockRetry(func(attempt int) error {
+				if m, ok := e.Model.(DBExporter); ok {
+					data, err := m.DBExport(e.App)
+					if err != nil {
+						return err
+					}
+
+					// manually add the id to the data if missing
+					if _, ok := data[idColumn]; !ok {
+						data[idColumn] = e.Model.PK()
+					}
+
+					if cast.ToString(data[idColumn]) == "" {
+						return errors.New("empty primary key is not allowed when using the DBExporter interface")
+					}
+
+					_, err = db.Insert(e.Model.TableName(), data).WithContext(e.Context).Execute()
+
+					return err
+				}
+
+				return db.Model(e.Model).WithContext(e.Context).Insert()
+			}, defaultMaxLockRetries)
+			if dbErr != nil {
+				return dbErr
+			}
+
+			e.Model.MarkAsNotNew()
+
+			return nil
+		})
+	})
+	if saveErr != nil {
+		event.Model.MarkAsNew() // reset "new" state
+
+		errEvent := &ModelErrorEvent{ModelEvent: *event, Error: saveErr}
+		errEvent.App = app // replace with the initial app in case it was changed by the hook
+		hookErr := app.OnModelAfterCreateError().Trigger(errEvent)
+		if hookErr != nil {
+			return errors.Join(saveErr, hookErr)
+		}
+
+		return saveErr
+	}
+
+	if app.txInfo != nil {
+		// execute later after the transaction has completed
+		app.txInfo.OnComplete(func(txErr error) error {
+			if app.txInfo != nil && app.txInfo.parent != nil {
+				event.App = app.txInfo.parent
+			}
+
+			if txErr != nil {
+				event.Model.MarkAsNew() // reset "new" state
+
+				return app.OnModelAfterCreateError().Trigger(&ModelErrorEvent{
+					ModelEvent: *event,
+					Error:      txErr,
+				})
+			}
+
+			return app.OnModelAfterCreateSuccess().Trigger(event)
+		})
+	} else if err := event.App.OnModelAfterCreateSuccess().Trigger(event); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (app *BaseApp) update(ctx context.Context, model Model, withValidations bool, isForAuxDB bool) error {
+	event := new(ModelEvent)
+	event.App = app
+	event.Context = ctx
+	event.Type = ModelEventTypeUpdate
+	event.Model = model
+
+	saveErr := app.OnModelUpdate().Trigger(event, func(e *ModelEvent) error {
+		// run validations (if any)
+		if withValidations {
+			validateErr := e.App.ValidateWithContext(e.Context, e.Model)
+			if validateErr != nil {
+				return validateErr
+			}
+		}
+
+		// db write
+		return e.App.OnModelUpdateExecute().Trigger(event, func(e *ModelEvent) error {
+			var db dbx.Builder
+			if isForAuxDB {
+				db = e.App.AuxNonconcurrentDB()
+			} else {
+				db = e.App.NonconcurrentDB()
+			}
+
+			return baseLockRetry(func(attempt int) error {
+				if m, ok := e.Model.(DBExporter); ok {
+					data, err := m.DBExport(e.App)
+					if err != nil {
+						return err
+					}
+
+					// note: for now disallow primary key change for consistency with dbx.ModelQuery.Update()
+					if data[idColumn] != e.Model.LastSavedPK() {
+						return errors.New("primary key change is not allowed")
+					}
+
+					_, err = db.Update(e.Model.TableName(), data, dbx.HashExp{
+						idColumn: e.Model.LastSavedPK(),
+					}).WithContext(e.Context).Execute()
+
+					return err
+				}
+
+				return db.Model(e.Model).WithContext(e.Context).Update()
+			}, defaultMaxLockRetries)
+		})
+	})
+	if saveErr != nil {
+		errEvent := &ModelErrorEvent{ModelEvent: *event, Error: saveErr}
+		errEvent.App = app // replace with the initial app in case it was changed by the hook
+		hookErr := app.OnModelAfterUpdateError().Trigger(errEvent)
+		if hookErr != nil {
+			return errors.Join(saveErr, hookErr)
+		}
+
+		return saveErr
+	}
+
+	if app.txInfo != nil {
+		// execute later after the transaction has completed
+		app.txInfo.OnComplete(func(txErr error) error {
+			if app.txInfo != nil && app.txInfo.parent != nil {
+				event.App = app.txInfo.parent
+			}
+
+			if txErr != nil {
+				return app.OnModelAfterUpdateError().Trigger(&ModelErrorEvent{
+					ModelEvent: *event,
+					Error:      txErr,
+				})
+			}
+
+			return app.OnModelAfterUpdateSuccess().Trigger(event)
+		})
+	} else if err := event.App.OnModelAfterUpdateSuccess().Trigger(event); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func validateCollectionId(app App, optTypes ...string) validation.RuleFunc {
+	return func(value any) error {
+		id, _ := value.(string)
+		if id == "" {
+			return nil
+		}
+
+		collection := &Collection{}
+		if err := app.ModelQuery(collection).Model(id, collection); err != nil {
+			return validation.NewError("validation_invalid_collection_id", "Missing or invalid collection.")
+		}
+
+		if len(optTypes) > 0 && !slices.Contains(optTypes, collection.Type) {
+			return validation.NewError(
+				"validation_invalid_collection_type",
+				fmt.Sprintf("Invalid collection type - must be %s.", strings.Join(optTypes, ", ")),
+			)
+		}
+
+		return nil
+	}
+}
+
+func validateRecordId(app App, collectionNameOrId string) validation.RuleFunc {
+	return func(value any) error {
+		id, _ := value.(string)
+		if id == "" {
+			return nil
+		}
+
+		collection, err := app.FindCachedCollectionByNameOrId(collectionNameOrId)
+		if err != nil {
+			return validation.NewError("validation_invalid_collection", "Missing or invalid collection.")
+		}
+
+		var exists int
+
+		rowErr := app.ConcurrentDB().Select("(1)").
+			From(collection.Name).
+			AndWhere(dbx.HashExp{"id": id}).
+			Limit(1).
+			Row(&exists)
+
+		if rowErr != nil || exists == 0 {
+			return validation.NewError("validation_invalid_record", "Missing or invalid record.")
+		}
+
+		return nil
+	}
+}
diff --git a/server/core_backend-server/core/db_builder.go b/server/core_backend-server/core/db_builder.go
new file mode 100644
index 0000000..021e9c9
--- /dev/null
+++ b/server/core_backend-server/core/db_builder.go
@@ -0,0 +1,187 @@
+package core
+
+import (
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/pocketbase/dbx"
+)
+
+var _ dbx.Builder = (*dualDBBuilder)(nil)
+
+// note: expects both builder to use the same driver
+type dualDBBuilder struct {
+	concurrentDB    dbx.Builder
+	nonconcurrentDB dbx.Builder
+}
+
+// Select implements the [dbx.Builder.Select] interface method.
+func (b *dualDBBuilder) Select(cols ...string) *dbx.SelectQuery {
+	return b.concurrentDB.Select(cols...)
+}
+
+// Model implements the [dbx.Builder.Model] interface method.
+func (b *dualDBBuilder) Model(data interface{}) *dbx.ModelQuery {
+	return b.nonconcurrentDB.Model(data)
+}
+
+// GeneratePlaceholder implements the [dbx.Builder.GeneratePlaceholder] interface method.
+func (b *dualDBBuilder) GeneratePlaceholder(i int) string {
+	return b.concurrentDB.GeneratePlaceholder(i)
+}
+
+// Quote implements the [dbx.Builder.Quote] interface method.
+func (b *dualDBBuilder) Quote(str string) string {
+	return b.concurrentDB.Quote(str)
+}
+
+// QuoteSimpleTableName implements the [dbx.Builder.QuoteSimpleTableName] interface method.
+func (b *dualDBBuilder) QuoteSimpleTableName(table string) string {
+	return b.concurrentDB.QuoteSimpleTableName(table)
+}
+
+// QuoteSimpleColumnName implements the [dbx.Builder.QuoteSimpleColumnName] interface method.
+func (b *dualDBBuilder) QuoteSimpleColumnName(col string) string {
+	return b.concurrentDB.QuoteSimpleColumnName(col)
+}
+
+// QueryBuilder implements the [dbx.Builder.QueryBuilder] interface method.
+func (b *dualDBBuilder) QueryBuilder() dbx.QueryBuilder {
+	return b.concurrentDB.QueryBuilder()
+}
+
+// Insert implements the [dbx.Builder.Insert] interface method.
+func (b *dualDBBuilder) Insert(table string, cols dbx.Params) *dbx.Query {
+	return b.nonconcurrentDB.Insert(table, cols)
+}
+
+// Upsert implements the [dbx.Builder.Upsert] interface method.
+func (b *dualDBBuilder) Upsert(table string, cols dbx.Params, constraints ...string) *dbx.Query {
+	return b.nonconcurrentDB.Upsert(table, cols, constraints...)
+}
+
+// Update implements the [dbx.Builder.Update] interface method.
+func (b *dualDBBuilder) Update(table string, cols dbx.Params, where dbx.Expression) *dbx.Query {
+	return b.nonconcurrentDB.Update(table, cols, where)
+}
+
+// Delete implements the [dbx.Builder.Delete] interface method.
+func (b *dualDBBuilder) Delete(table string, where dbx.Expression) *dbx.Query {
+	return b.nonconcurrentDB.Delete(table, where)
+}
+
+// CreateTable implements the [dbx.Builder.CreateTable] interface method.
+func (b *dualDBBuilder) CreateTable(table string, cols map[string]string, options ...string) *dbx.Query {
+	return b.nonconcurrentDB.CreateTable(table, cols, options...)
+}
+
+// RenameTable implements the [dbx.Builder.RenameTable] interface method.
+func (b *dualDBBuilder) RenameTable(oldName, newName string) *dbx.Query {
+	return b.nonconcurrentDB.RenameTable(oldName, newName)
+}
+
+// DropTable implements the [dbx.Builder.DropTable] interface method.
+func (b *dualDBBuilder) DropTable(table string) *dbx.Query {
+	return b.nonconcurrentDB.DropTable(table)
+}
+
+// TruncateTable implements the [dbx.Builder.TruncateTable] interface method.
+func (b *dualDBBuilder) TruncateTable(table string) *dbx.Query {
+	return b.nonconcurrentDB.TruncateTable(table)
+}
+
+// AddColumn implements the [dbx.Builder.AddColumn] interface method.
+func (b *dualDBBuilder) AddColumn(table, col, typ string) *dbx.Query {
+	return b.nonconcurrentDB.AddColumn(table, col, typ)
+}
+
+// DropColumn implements the [dbx.Builder.DropColumn] interface method.
+func (b *dualDBBuilder) DropColumn(table, col string) *dbx.Query {
+	return b.nonconcurrentDB.DropColumn(table, col)
+}
+
+// RenameColumn implements the [dbx.Builder.RenameColumn] interface method.
+func (b *dualDBBuilder) RenameColumn(table, oldName, newName string) *dbx.Query {
+	return b.nonconcurrentDB.RenameColumn(table, oldName, newName)
+}
+
+// AlterColumn implements the [dbx.Builder.AlterColumn] interface method.
+func (b *dualDBBuilder) AlterColumn(table, col, typ string) *dbx.Query {
+	return b.nonconcurrentDB.AlterColumn(table, col, typ)
+}
+
+// AddPrimaryKey implements the [dbx.Builder.AddPrimaryKey] interface method.
+func (b *dualDBBuilder) AddPrimaryKey(table, name string, cols ...string) *dbx.Query {
+	return b.nonconcurrentDB.AddPrimaryKey(table, name, cols...)
+}
+
+// DropPrimaryKey implements the [dbx.Builder.DropPrimaryKey] interface method.
+func (b *dualDBBuilder) DropPrimaryKey(table, name string) *dbx.Query {
+	return b.nonconcurrentDB.DropPrimaryKey(table, name)
+}
+
+// AddForeignKey implements the [dbx.Builder.AddForeignKey] interface method.
+func (b *dualDBBuilder) AddForeignKey(table, name string, cols, refCols []string, refTable string, options ...string) *dbx.Query {
+	return b.nonconcurrentDB.AddForeignKey(table, name, cols, refCols, refTable, options...)
+}
+
+// DropForeignKey implements the [dbx.Builder.DropForeignKey] interface method.
+func (b *dualDBBuilder) DropForeignKey(table, name string) *dbx.Query {
+	return b.nonconcurrentDB.DropForeignKey(table, name)
+}
+
+// CreateIndex implements the [dbx.Builder.CreateIndex] interface method.
+func (b *dualDBBuilder) CreateIndex(table, name string, cols ...string) *dbx.Query {
+	return b.nonconcurrentDB.CreateIndex(table, name, cols...)
+}
+
+// CreateUniqueIndex implements the [dbx.Builder.CreateUniqueIndex] interface method.
+func (b *dualDBBuilder) CreateUniqueIndex(table, name string, cols ...string) *dbx.Query {
+	return b.nonconcurrentDB.CreateUniqueIndex(table, name, cols...)
+}
+
+// DropIndex implements the [dbx.Builder.DropIndex] interface method.
+func (b *dualDBBuilder) DropIndex(table, name string) *dbx.Query {
+	return b.nonconcurrentDB.DropIndex(table, name)
+}
+
+// NewQuery implements the [dbx.Builder.NewQuery] interface method by
+// routing the SELECT queries to the concurrent builder instance.
+func (b *dualDBBuilder) NewQuery(str string) *dbx.Query {
+	// note: technically INSERT/UPDATE/DELETE could also have CTE but since
+	// it is rare for now this scase is ignored to avoid unnecessary complicating the checks
+	trimmed := trimLeftSpaces(str)
+	if hasPrefixFold(trimmed, "SELECT") || hasPrefixFold(trimmed, "WITH") {
+		return b.concurrentDB.NewQuery(str)
+	}
+
+	return b.nonconcurrentDB.NewQuery(str)
+}
+
+var asciiSpace = [256]uint8{'\t': 1, '\n': 1, '\v': 1, '\f': 1, '\r': 1, ' ': 1}
+
+// note: similar to strings.Space() but without the right trim because it is not needed in our case
+func trimLeftSpaces(str string) string {
+	start := 0
+	for ; start < len(str); start++ {
+		c := str[start]
+		if c >= utf8.RuneSelf {
+			return strings.TrimLeftFunc(str[start:], unicode.IsSpace)
+		}
+		if asciiSpace[c] == 0 {
+			break
+		}
+	}
+
+	return str[start:]
+}
+
+// note: the prefix is expected to be ASCII
+func hasPrefixFold(str, prefix string) bool {
+	if len(str) < len(prefix) {
+		return false
+	}
+
+	return strings.EqualFold(str[:len(prefix)], prefix)
+}
diff --git a/server/core_backend-server/core/db_connect.go b/server/core_backend-server/core/db_connect.go
new file mode 100644
index 0000000..bc4b375
--- /dev/null
+++ b/server/core_backend-server/core/db_connect.go
@@ -0,0 +1,132 @@
+//go:build !no_default_driver
+
+package core
+
+import (
+	"fmt"
+	"net/url"
+	"regexp"
+	"strings"
+
+	_ "github.com/go-sql-driver/mysql"
+	_ "github.com/jackc/pgx/v5/stdlib"
+	"github.com/pocketbase/dbx"
+	_ "modernc.org/sqlite"
+)
+
+func DefaultDBConnect(dbPath string) (*dbx.DB, error) {
+	// Note: the busy_timeout pragma must be first because
+	// the connection needs to be set to block on busy before WAL mode
+	// is set in case it hasn't been already set by another connection.
+	pragmas := "?_pragma=busy_timeout(10000)&_pragma=journal_mode(WAL)&_pragma=journal_size_limit(200000000)&_pragma=synchronous(NORMAL)&_pragma=foreign_keys(ON)&_pragma=temp_store(MEMORY)&_pragma=cache_size(-32000)"
+
+	db, err := dbx.Open("sqlite", dbPath+pragmas)
+	if err != nil {
+		return nil, err
+	}
+
+	return db, nil
+}
+
+// Sample Connection String: "postgres://<username>:<password>@127.0.0.1:<port>"
+func PostgresDBConnectFunc(connectionString string) DBConnectFunc {
+	url, err := url.Parse(connectionString)
+	if err != nil {
+		panic(fmt.Errorf("invalid connection string: %s", err))
+	}
+	if url.Scheme != "postgres" && url.Scheme != "postgresql" {
+		panic(fmt.Errorf("invalid connection string scheme: [%s], must be [postgres] or [postgresql]", url.Scheme))
+	}
+
+	return func(dbName string) (*dbx.DB, error) {
+		fmt.Println("Connecting to DB:", dbName)
+		// clone url and replace the db name
+		urlClone := *url
+		urlClone.Path = dbName
+		db, err := dbx.MustOpen("pgx", urlClone.String())
+		if err != nil && regexp.MustCompile(`database ".+" does not exist`).MatchString(err.Error()) {
+			fmt.Println("Database not found, creating:", dbName)
+			if err := createDatabase(connectionString, dbName); err != nil {
+				return nil, fmt.Errorf("Failed to create database [%s]: %s, please create it manually", dbName, err)
+			}
+			fmt.Println("Database created, reconnecting:", dbName)
+			db, err = dbx.MustOpen("pgx", urlClone.String())
+		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to connect to Postgres: %s", err)
+		}
+
+		return db, nil
+	}
+}
+
+func createDatabase(connectionString string, dbName string) error {
+	initDB, err := dbx.MustOpen("pgx", connectionString)
+	if err != nil {
+		return err
+	}
+	_, err = initDB.NewQuery(fmt.Sprintf(`CREATE DATABASE "%s"`, dbName)).Execute()
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// MysqlDBConnectFunc returns a DBConnectFunc for MySQL connection.
+// Sample Connection String: "user:password@tcp(127.0.0.1:3306)/"
+func MysqlDBConnectFunc(connectionString string) DBConnectFunc {
+	return func(dbName string) (*dbx.DB, error) {
+		fmt.Println("Connecting to MySQL DB:", dbName)
+
+		baseDSN := connectionString
+		if !strings.HasSuffix(baseDSN, "/") {
+			if strings.Contains(baseDSN, "?") {
+				fmt.Println("Warning: MySQL connection string should preferably end with /")
+			} else {
+				baseDSN += "/"
+			}
+		}
+
+		fullDSN := baseDSN + dbName + "?parseTime=true&loc=Local&multiStatements=true&sql_mode='ANSI_QUOTES'"
+
+		db, err := dbx.Open("mysql", fullDSN)
+		if err != nil {
+			// This usually doesn't fail immediately, validation happens on Ping
+		}
+
+		// Ping to check connection and database existence
+		if err := db.DB().Ping(); err != nil {
+			// Check if error is "Unknown database" (Error 1049)
+			if strings.Contains(err.Error(), "Unknown database") {
+				fmt.Println("Database not found, creating:", dbName)
+				if err := createMysqlDatabase(baseDSN, dbName); err != nil {
+					return nil, fmt.Errorf("Failed to create database [%s]: %s", dbName, err)
+				}
+				fmt.Println("Database created, reconnecting:", dbName)
+				// Reconnect
+				db, err = dbx.Open("mysql", fullDSN)
+			} else {
+				return nil, fmt.Errorf("failed to connect to MySQL: %s", err)
+			}
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		return db, nil
+	}
+}
+
+func createMysqlDatabase(baseDSN string, dbName string) error {
+	// Connect without DB name to creates it
+	// baseDSN ends with / usually
+	initDB, err := dbx.Open("mysql", baseDSN)
+	if err != nil {
+		return err
+	}
+	defer initDB.Close()
+
+	_, err = initDB.NewQuery(fmt.Sprintf("CREATE DATABASE IF NOT EXISTS `%s` CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci", dbName)).Execute()
+	return err
+}
diff --git a/server/core_backend-server/core/db_connect_nodefaultdriver.go b/server/core_backend-server/core/db_connect_nodefaultdriver.go
new file mode 100644
index 0000000..34e7a41
--- /dev/null
+++ b/server/core_backend-server/core/db_connect_nodefaultdriver.go
@@ -0,0 +1,9 @@
+//go:build no_default_driver
+
+package core
+
+import "github.com/pocketbase/dbx"
+
+func DefaultDBConnect(dbPath string) (*dbx.DB, error) {
+	panic("DBConnect config option must be set when the no_default_driver tag is used!")
+}
diff --git a/server/core_backend-server/core/db_model.go b/server/core_backend-server/core/db_model.go
new file mode 100644
index 0000000..9649e1a
--- /dev/null
+++ b/server/core_backend-server/core/db_model.go
@@ -0,0 +1,59 @@
+package core
+
+// Model defines an interface with common methods that all db models should have.
+//
+// Note: for simplicity composite pk are not supported.
+type Model interface {
+	TableName() string
+	PK() any
+	LastSavedPK() any
+	IsNew() bool
+	MarkAsNew()
+	MarkAsNotNew()
+}
+
+// BaseModel defines a base struct that is intended to be embedded into other custom models.
+type BaseModel struct {
+	lastSavedPK string
+
+	// Id is the primary key of the model.
+	// It is usually autogenerated by the parent model implementation.
+	Id string `db:"id" json:"id" form:"id" xml:"id"`
+}
+
+// LastSavedPK returns the last saved primary key of the model.
+//
+// Its value is updated to the latest PK value after MarkAsNotNew() or PostScan() calls.
+func (m *BaseModel) LastSavedPK() any {
+	return m.lastSavedPK
+}
+
+func (m *BaseModel) PK() any {
+	return m.Id
+}
+
+// IsNew indicates what type of db query (insert or update)
+// should be used with the model instance.
+func (m *BaseModel) IsNew() bool {
+	return m.lastSavedPK == ""
+}
+
+// MarkAsNew clears the pk field and marks the current model as "new"
+// (aka. forces m.IsNew() to be true).
+func (m *BaseModel) MarkAsNew() {
+	m.lastSavedPK = ""
+}
+
+// MarkAsNew set the pk field to the Id value and marks the current model
+// as NOT "new" (aka. forces m.IsNew() to be false).
+func (m *BaseModel) MarkAsNotNew() {
+	m.lastSavedPK = m.Id
+}
+
+// PostScan implements the [dbx.PostScanner] interface.
+//
+// It is usually executed right after the model is populated with the db row values.
+func (m *BaseModel) PostScan() error {
+	m.MarkAsNotNew()
+	return nil
+}
diff --git a/server/core_backend-server/core/db_model_test.go b/server/core_backend-server/core/db_model_test.go
new file mode 100644
index 0000000..1771a77
--- /dev/null
+++ b/server/core_backend-server/core/db_model_test.go
@@ -0,0 +1,70 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func TestBaseModel(t *testing.T) {
+	id := "test_id"
+
+	m := core.BaseModel{Id: id}
+
+	if m.PK() != id {
+		t.Fatalf("[before PostScan] Expected PK %q, got %q", "", m.PK())
+	}
+
+	if m.LastSavedPK() != "" {
+		t.Fatalf("[before PostScan] Expected LastSavedPK %q, got %q", "", m.LastSavedPK())
+	}
+
+	if !m.IsNew() {
+		t.Fatalf("[before PostScan] Expected IsNew %v, got %v", true, m.IsNew())
+	}
+
+	if err := m.PostScan(); err != nil {
+		t.Fatal(err)
+	}
+
+	if m.PK() != id {
+		t.Fatalf("[after PostScan] Expected PK %q, got %q", "", m.PK())
+	}
+
+	if m.LastSavedPK() != id {
+		t.Fatalf("[after PostScan] Expected LastSavedPK %q, got %q", id, m.LastSavedPK())
+	}
+
+	if m.IsNew() {
+		t.Fatalf("[after PostScan] Expected IsNew %v, got %v", false, m.IsNew())
+	}
+
+	m.MarkAsNew()
+
+	if m.PK() != id {
+		t.Fatalf("[after MarkAsNew] Expected PK %q, got %q", id, m.PK())
+	}
+
+	if m.LastSavedPK() != "" {
+		t.Fatalf("[after MarkAsNew] Expected LastSavedPK %q, got %q", "", m.LastSavedPK())
+	}
+
+	if !m.IsNew() {
+		t.Fatalf("[after MarkAsNew] Expected IsNew %v, got %v", true, m.IsNew())
+	}
+
+	// mark as not new without id
+	m.MarkAsNotNew()
+
+	if m.PK() != id {
+		t.Fatalf("[after MarkAsNotNew] Expected PK %q, got %q", id, m.PK())
+	}
+
+	if m.LastSavedPK() != id {
+		t.Fatalf("[after MarkAsNotNew] Expected LastSavedPK %q, got %q", id, m.LastSavedPK())
+	}
+
+	if m.IsNew() {
+		t.Fatalf("[after MarkAsNotNew] Expected IsNew %v, got %v", false, m.IsNew())
+	}
+}
diff --git a/server/core_backend-server/core/db_retry.go b/server/core_backend-server/core/db_retry.go
new file mode 100644
index 0000000..0c83d64
--- /dev/null
+++ b/server/core_backend-server/core/db_retry.go
@@ -0,0 +1,70 @@
+package core
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/dbx"
+)
+
+// default retries intervals (in ms)
+var defaultRetryIntervals = []int{50, 100, 150, 200, 300, 400, 500, 700, 1000}
+
+// default max retry attempts
+const defaultMaxLockRetries = 12
+
+func execLockRetry(timeout time.Duration, maxRetries int) dbx.ExecHookFunc {
+	return func(q *dbx.Query, op func() error) error {
+		if q.Context() == nil {
+			cancelCtx, cancel := context.WithTimeout(context.Background(), timeout)
+			defer func() {
+				cancel()
+				//nolint:staticcheck
+				q.WithContext(nil) // reset
+			}()
+			q.WithContext(cancelCtx)
+		}
+
+		execErr := baseLockRetry(func(attempt int) error {
+			return op()
+		}, maxRetries)
+		if execErr != nil && !errors.Is(execErr, sql.ErrNoRows) {
+			execErr = fmt.Errorf("%w; failed query: %s", execErr, q.SQL())
+		}
+
+		return execErr
+	}
+}
+
+func baseLockRetry(op func(attempt int) error, maxRetries int) error {
+	attempt := 1
+
+Retry:
+	err := op(attempt)
+
+	if err != nil && attempt <= maxRetries {
+		errStr := err.Error()
+		// we are checking the error against the plain error texts since the codes could vary between drivers
+		if strings.Contains(errStr, "database is locked") ||
+			strings.Contains(errStr, "table is locked") {
+			// wait and retry
+			time.Sleep(getDefaultRetryInterval(attempt))
+			attempt++
+			goto Retry
+		}
+	}
+
+	return err
+}
+
+func getDefaultRetryInterval(attempt int) time.Duration {
+	if attempt < 0 || attempt > len(defaultRetryIntervals)-1 {
+		return time.Duration(defaultRetryIntervals[len(defaultRetryIntervals)-1]) * time.Millisecond
+	}
+
+	return time.Duration(defaultRetryIntervals[attempt]) * time.Millisecond
+}
diff --git a/server/core_backend-server/core/db_retry_test.go b/server/core_backend-server/core/db_retry_test.go
new file mode 100644
index 0000000..838902f
--- /dev/null
+++ b/server/core_backend-server/core/db_retry_test.go
@@ -0,0 +1,66 @@
+package core
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+)
+
+func TestGetDefaultRetryInterval(t *testing.T) {
+	t.Parallel()
+
+	if i := getDefaultRetryInterval(-1); i.Milliseconds() != 1000 {
+		t.Fatalf("Expected 1000ms, got %v", i)
+	}
+
+	if i := getDefaultRetryInterval(999); i.Milliseconds() != 1000 {
+		t.Fatalf("Expected 1000ms, got %v", i)
+	}
+
+	if i := getDefaultRetryInterval(3); i.Milliseconds() != 200 {
+		t.Fatalf("Expected 500ms, got %v", i)
+	}
+}
+
+func TestBaseLockRetry(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		err              error
+		failUntilAttempt int
+		expectedAttempts int
+	}{
+		{nil, 3, 1},
+		{errors.New("test"), 3, 1},
+		{errors.New("database is locked"), 3, 3},
+		{errors.New("table is locked"), 3, 3},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.err), func(t *testing.T) {
+			lastAttempt := 0
+
+			err := baseLockRetry(func(attempt int) error {
+				lastAttempt = attempt
+
+				if attempt < s.failUntilAttempt {
+					return s.err
+				}
+
+				return nil
+			}, s.failUntilAttempt+2)
+
+			if lastAttempt != s.expectedAttempts {
+				t.Errorf("Expected lastAttempt to be %d, got %d", s.expectedAttempts, lastAttempt)
+			}
+
+			if s.failUntilAttempt == s.expectedAttempts && err != nil {
+				t.Fatalf("Expected nil, got err %v", err)
+			}
+
+			if s.failUntilAttempt != s.expectedAttempts && s.err != nil && err == nil {
+				t.Fatalf("Expected error %q, got nil", s.err)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/db_table.go b/server/core_backend-server/core/db_table.go
new file mode 100644
index 0000000..58201d4
--- /dev/null
+++ b/server/core_backend-server/core/db_table.go
@@ -0,0 +1,276 @@
+package core
+
+import (
+	"database/sql"
+	"fmt"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+)
+
+// TableColumns returns all column names of a single table by its name.
+func (app *BaseApp) TableColumns(tableName string) ([]string, error) {
+	columns := []string{}
+	var err error
+
+	if IsMysql(app) {
+		// MySQL:
+		err = app.ConcurrentDB().NewQuery(`
+			SELECT column_name
+			FROM information_schema.columns
+			WHERE table_name = {:tableName}
+			  AND table_schema = DATABASE()
+		`).Bind(dbx.Params{"tableName": tableName}).Column(&columns)
+	} else if IsPostgres(app) {
+		// PostgreSQL:
+		err = app.ConcurrentDB().NewQuery(`
+			SELECT column_name
+			FROM information_schema.columns
+			WHERE table_name = {:tableName}
+			  AND table_schema = current_schema()
+		`).Bind(dbx.Params{"tableName": tableName}).Column(&columns)
+	} else {
+		// SQLite:
+		err = app.ConcurrentDB().NewQuery("SELECT name FROM PRAGMA_TABLE_INFO({:tableName})").
+			Bind(dbx.Params{"tableName": tableName}).
+			Column(&columns)
+	}
+
+	return columns, err
+}
+
+type TableInfoRow struct {
+	// the `db:"pk"` tag has special semantic so we cannot rename
+	// the original field without specifying a custom mapper
+	PK int
+
+	Index        int            `db:"cid"`
+	Name         string         `db:"name"`
+	Type         string         `db:"type"`
+	NotNull      bool           `db:"notnull"`
+	DefaultValue sql.NullString `db:"dflt_value"`
+}
+
+// TableInfo returns the "table_info" pragma result for the specified table.
+func (app *BaseApp) TableInfo(tableName string) ([]*TableInfoRow, error) {
+	info := []*TableInfoRow{}
+	var err error
+
+	if IsMysql(app) {
+		// MySQL:
+		err = app.ConcurrentDB().NewQuery(`
+			SELECT 
+				ORDINAL_POSITION - 1 AS cid,
+				COLUMN_NAME AS name,
+				DATA_TYPE AS type,
+				CASE WHEN IS_NULLABLE = 'NO' THEN 1 ELSE 0 END AS notnull,
+				COLUMN_DEFAULT AS dflt_value,
+				CASE WHEN COLUMN_KEY = 'PRI' THEN 1 ELSE 0 END AS pk
+			FROM information_schema.columns
+			WHERE table_name = {:tableName}
+			  AND table_schema = DATABASE()
+			ORDER BY ORDINAL_POSITION
+		`).Bind(dbx.Params{"tableName": tableName}).All(&info)
+	} else if IsPostgres(app) {
+		// PostgreSQL:
+		// TODO: Consider simplifying this query because not all result columns are used in the app.
+		sql := `
+			SELECT 
+				ordinal_position - 1 AS cid,
+				c.column_name AS name,
+				data_type AS type,
+				CASE WHEN is_nullable = 'NO' THEN 1 ELSE 0 END AS notnull,
+				column_default AS dflt_value,
+				CASE WHEN pk.constraint_type = 'PRIMARY KEY' THEN 1 ELSE 0 END AS pk
+			FROM 
+				information_schema.columns c
+			LEFT JOIN (
+				SELECT 
+					ccu.column_name,
+					tc.constraint_type
+				FROM 
+					information_schema.table_constraints tc
+				JOIN 
+					information_schema.constraint_column_usage ccu ON tc.constraint_name = ccu.constraint_name
+				WHERE 
+					tc.constraint_type = 'PRIMARY KEY' AND 
+					tc.table_name = {:table_name} AND 
+					tc.table_schema = 'public'
+			) pk ON c.column_name = pk.column_name
+			WHERE 
+				c.table_name = {:table_name} AND 
+				c.table_schema = current_schema()
+			ORDER BY 
+				c.ordinal_position;	
+		`
+		err = app.ConcurrentDB().NewQuery(sql).Bind(dbx.Params{"table_name": tableName}).All(&info)
+	} else {
+		// SQLite:
+		err = app.ConcurrentDB().NewQuery("SELECT * FROM PRAGMA_TABLE_INFO({:tableName})").
+			Bind(dbx.Params{"tableName": tableName}).
+			All(&info)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	// mattn/go-sqlite3 doesn't throw an error on invalid or missing table
+	// so we additionally have to check whether the loaded info result is nonempty
+	if len(info) == 0 {
+		return nil, fmt.Errorf("empty table info probably due to invalid or missing table %s", tableName)
+	}
+
+	return info, nil
+}
+
+// TableIndexes returns a name grouped map with all non empty index of the specified table.
+//
+// Note: This method doesn't return an error on nonexisting table.
+func (app *BaseApp) TableIndexes(tableName string) (map[string]string, error) {
+	indexes := []struct {
+		Name string `db:"indexname"`
+		Sql  string `db:"indexdef"`
+	}{}
+
+	var err error
+	if IsMysql(app) {
+		// MySQL:
+		// Note: constructing the CREATE INDEX statement from information_schema is complex.
+		// For now returning empty indexdef.
+		err = app.ConcurrentDB().NewQuery(`
+			SELECT INDEX_NAME as indexname, '' as indexdef
+			FROM information_schema.statistics
+			WHERE table_name = {:tableName}
+			  AND table_schema = DATABASE()
+			GROUP BY INDEX_NAME
+		`).Bind(dbx.Params{"tableName": tableName}).All(&indexes)
+	} else if IsPostgres(app) {
+		// PostgreSQL:
+		// Note: `sql is not null` is for filtering auto created primary indexes in SQLite.
+		// In PostgreSQL, we have to make subquery in 'pg_constraint` for the same purpose.
+		err = app.ConcurrentDB().NewQuery(`
+			SELECT indexname, indexdef
+			FROM pg_indexes
+			WHERE tablename = {:tableName}
+			AND indexname NOT IN (
+				SELECT conname
+				FROM pg_constraint
+				WHERE contype = 'p' AND conrelid = {:tableName}::regclass
+			);
+		`).Bind(dbx.Params{"tableName": tableName}).All(&indexes)
+	} else {
+		// SQLite:
+		err = app.ConcurrentDB().Select("name indexname", "sql indexdef").
+			From("sqlite_master").
+			AndWhere(dbx.NewExp("sql is not null")).
+			AndWhere(dbx.HashExp{
+				"type":     "index",
+				"tbl_name": tableName,
+			}).
+			All(&indexes)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[string]string, len(indexes))
+
+	for _, idx := range indexes {
+		result[idx.Name] = idx.Sql
+	}
+
+	return result, nil
+}
+
+// DeleteTable drops the specified table.
+//
+// This method is a no-op if a table with the provided name doesn't exist.
+//
+// NB! Be aware that this method is vulnerable to SQL injection and the
+// "tableName" argument must come only from trusted input!
+func (app *BaseApp) DeleteTable(tableName string) error {
+	if strings.TrimSpace(tableName) == "" {
+		return fmt.Errorf("invalid table name")
+	}
+
+	var err error
+	if !IsPostgres(app) {
+		// SQLite:
+		_, err = app.NonconcurrentDB().NewQuery(fmt.Sprintf(
+			"DROP TABLE IF EXISTS {{%s}}",
+			tableName,
+		)).Execute()
+	} else {
+		// PostgreSQL:
+		// Note: We use "CASCADE" to drop all dependent objects (e.g. views, etc.) in PostgreSQL.
+		_, err = app.ConcurrentDB().NewQuery(fmt.Sprintf(
+			"DROP TABLE IF EXISTS {{%s}} CASCADE",
+			tableName,
+		)).Execute()
+	}
+
+	return err
+}
+
+// HasTable checks if a table (or view) with the provided name exists (case insensitive).
+// in the data.db.
+func (app *BaseApp) HasTable(tableName string) bool {
+	return app.hasTable(app.ConcurrentDB(), tableName)
+}
+
+// AuxHasTable checks if a table (or view) with the provided name exists (case insensitive)
+// in the auixiliary.db.
+func (app *BaseApp) AuxHasTable(tableName string) bool {
+	return app.hasTable(app.AuxConcurrentDB(), tableName)
+}
+
+func (app *BaseApp) hasTable(db dbx.Builder, tableName string) bool {
+	var exists int
+	var err error
+
+	if IsMysql(app) {
+		// MySQL:
+		err = db.NewQuery(`
+			SELECT count(*)
+			FROM information_schema.tables
+			WHERE table_schema = DATABASE()
+			  AND lower(table_name) = lower({:tableName})
+		`).Bind(dbx.Params{"tableName": tableName}).Row(&exists)
+	} else if IsPostgres(app) {
+		// PostgreSQL:
+		// Notes: both views and tables are included in `information_schema.tables`.
+		err = db.NewQuery(`
+			SELECT count(*)
+			FROM information_schema.tables
+			WHERE table_schema = current_schema()
+			  AND lower(table_name) = lower({:tableName})
+		`).Bind(dbx.Params{"tableName": tableName}).Row(&exists)
+	} else {
+		// SQLite:
+		err = db.Select("count(*)").
+			From("sqlite_master").
+			AndWhere(dbx.HashExp{"type": []any{"table", "view"}}).
+			AndWhere(dbx.NewExp("LOWER([[name]])=LOWER({:tableName})", dbx.Params{"tableName": tableName})).
+			Row(&exists)
+	}
+
+	return err == nil && exists > 0
+}
+
+// Vacuum executes VACUUM on the data.db in order to reclaim unused data db disk space.
+func (app *BaseApp) Vacuum() error {
+	return app.vacuum(app.NonconcurrentDB())
+}
+
+// AuxVacuum executes VACUUM on the auxiliary.db in order to reclaim unused auxiliary db disk space.
+func (app *BaseApp) AuxVacuum() error {
+	return app.vacuum(app.AuxNonconcurrentDB())
+}
+
+func (app *BaseApp) vacuum(db dbx.Builder) error {
+	_, err := db.NewQuery("VACUUM").Execute()
+
+	return err
+}
diff --git a/server/core_backend-server/core/db_table_test.go b/server/core_backend-server/core/db_table_test.go
new file mode 100644
index 0000000..1ba728b
--- /dev/null
+++ b/server/core_backend-server/core/db_table_test.go
@@ -0,0 +1,254 @@
+package core_test
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestHasTable(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		tableName string
+		expected  bool
+	}{
+		{"", false},
+		{"test", false},
+		{core.CollectionNameSuperusers, true},
+		{"demo3", true},
+		{"DEMO3", true}, // table names are case insensitives by default
+		{"view1", true}, // view
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.tableName, func(t *testing.T) {
+			result := app.HasTable(s.tableName)
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestAuxHasTable(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		tableName string
+		expected  bool
+	}{
+		{"", false},
+		{"test", false},
+		{"_lOGS", true}, // table names are case insensitives by default
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.tableName, func(t *testing.T) {
+			result := app.AuxHasTable(s.tableName)
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestTableColumns(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		tableName string
+		expected  []string
+	}{
+		{"", nil},
+		{"_params", []string{"id", "value", "created", "updated"}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.tableName), func(t *testing.T) {
+			columns, _ := app.TableColumns(s.tableName)
+
+			if len(columns) != len(s.expected) {
+				t.Fatalf("Expected columns %v, got %v", s.expected, columns)
+			}
+
+			for _, c := range columns {
+				if !slices.Contains(s.expected, c) {
+					t.Errorf("Didn't expect column %s", c)
+				}
+			}
+		})
+	}
+}
+
+func TestTableInfo(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		tableName string
+		expected  string
+	}{
+		{"", "null"},
+		{"missing", "null"},
+		{
+			"_params",
+			/* SQLite:
+			`[{"PK":0,"Index":0,"Name":"created","Type":"TEXT","NotNull":true,"DefaultValue":{"String":"''","Valid":true}},{"PK":1,"Index":1,"Name":"id","Type":"TEXT","NotNull":true,"DefaultValue":{"String":"'r'||lower(hex(randomblob(7)))","Valid":true}},{"PK":0,"Index":2,"Name":"updated","Type":"TEXT","NotNull":true,"DefaultValue":{"String":"''","Valid":true}},{"PK":0,"Index":3,"Name":"value","Type":"JSON","NotNull":false,"DefaultValue":{"String":"NULL","Valid":true}}]`,
+			*/
+			// PostgreSQL:
+			`[{"PK":0,"Index":0,"Name":"created","Type":"text","NotNull":true,"DefaultValue":{"String":"''::text","Valid":true}},{"PK":1,"Index":1,"Name":"id","Type":"text","NotNull":true,"DefaultValue":{"String":"'''r''||lower(hex(randomblob(7)))'::text","Valid":true}},{"PK":0,"Index":2,"Name":"updated","Type":"text","NotNull":true,"DefaultValue":{"String":"''::text","Valid":true}},{"PK":0,"Index":3,"Name":"value","Type":"text","NotNull":false,"DefaultValue":{"String":"","Valid":false}}]`,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.tableName), func(t *testing.T) {
+			rows, _ := app.TableInfo(s.tableName)
+
+			raw, err := json.Marshal(rows)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if str := string(raw); str != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestTableIndexes(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		tableName string
+		expected  []string
+	}{
+		{"", nil},
+		{"missing", nil},
+		{
+			core.CollectionNameSuperusers,
+			[]string{"idx_email__pbc_3323866339", "idx_tokenKey__pbc_3323866339"},
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.tableName), func(t *testing.T) {
+			indexes, _ := app.TableIndexes(s.tableName)
+
+			if len(indexes) != len(s.expected) {
+				t.Fatalf("Expected %d indexes, got %d\n%v", len(s.expected), len(indexes), indexes)
+			}
+
+			for _, name := range s.expected {
+				if v, ok := indexes[name]; !ok || v == "" {
+					t.Fatalf("Expected non-empty index %q in \n%v", name, indexes)
+				}
+			}
+		})
+	}
+}
+
+func TestDeleteTable(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		tableName   string
+		expectError bool
+	}{
+		{"", true},
+		{"test", false}, // missing tables are ignored
+		{"_admins", false},
+		{"demo3", false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.tableName), func(t *testing.T) {
+			err := app.DeleteTable(s.tableName)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+		})
+	}
+}
+
+func TestVacuum(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	calledQueries := []string{}
+	app.NonconcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.NonconcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+
+	if err := app.Vacuum(); err != nil {
+		t.Fatal(err)
+	}
+
+	if total := len(calledQueries); total != 1 {
+		t.Fatalf("Expected 1 query, got %d", total)
+	}
+
+	if calledQueries[0] != "VACUUM" {
+		t.Fatalf("Expected VACUUM query, got %s", calledQueries[0])
+	}
+}
+
+func TestAuxVacuum(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	calledQueries := []string{}
+	app.AuxNonconcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.AuxNonconcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+
+	if err := app.AuxVacuum(); err != nil {
+		t.Fatal(err)
+	}
+
+	if total := len(calledQueries); total != 1 {
+		t.Fatalf("Expected 1 query, got %d", total)
+	}
+
+	if calledQueries[0] != "VACUUM" {
+		t.Fatalf("Expected VACUUM query, got %s", calledQueries[0])
+	}
+}
diff --git a/server/core_backend-server/core/db_test.go b/server/core_backend-server/core/db_test.go
new file mode 100644
index 0000000..4095ab7
--- /dev/null
+++ b/server/core_backend-server/core/db_test.go
@@ -0,0 +1,113 @@
+package core_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestGenerateDefaultRandomId(t *testing.T) {
+	t.Parallel()
+
+	id1 := core.GenerateDefaultRandomId()
+	id2 := core.GenerateDefaultRandomId()
+
+	if id1 == id2 {
+		t.Fatalf("Expected id1 and id2 to differ, got %q", id1)
+	}
+
+	if l := len(id1); l != 15 {
+		t.Fatalf("Expected id1 length %d, got %d", 15, l)
+	}
+
+	if l := len(id2); l != 15 {
+		t.Fatalf("Expected id2 length %d, got %d", 15, l)
+	}
+}
+
+func TestModelQuery(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	modelsQuery := app.ModelQuery(&core.Collection{})
+	logsModelQuery := app.AuxModelQuery(&core.Collection{})
+
+	if app.ConcurrentDB() == modelsQuery.Info().Builder {
+		t.Fatalf("ModelQuery() is not using app.ConcurrentDB()")
+	}
+
+	if app.AuxConcurrentDB() == logsModelQuery.Info().Builder {
+		t.Fatalf("AuxModelQuery() is not using app.AuxConcurrentDB()")
+	}
+
+	expectedSQL := `SELECT {{_collections}}.* FROM "_collections"`
+	for i, q := range []*dbx.SelectQuery{modelsQuery, logsModelQuery} {
+		sql := q.Build().SQL()
+		if sql != expectedSQL {
+			t.Fatalf("[%d] Expected select\n%s\ngot\n%s", i, expectedSQL, sql)
+		}
+	}
+}
+
+func TestValidate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	u := &mockSuperusers{}
+
+	testErr := errors.New("test")
+
+	app.OnModelValidate().BindFunc(func(e *core.ModelEvent) error {
+		return testErr
+	})
+
+	err := app.Validate(u)
+	if err != testErr {
+		t.Fatalf("Expected error %v, got %v", testErr, err)
+	}
+}
+
+func TestValidateWithContext(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	u := &mockSuperusers{}
+
+	testErr := errors.New("test")
+
+	app.OnModelValidate().BindFunc(func(e *core.ModelEvent) error {
+		if v := e.Context.Value("test"); v != 123 {
+			t.Fatalf("Expected 'test' context value %#v, got %#v", 123, v)
+		}
+		return testErr
+	})
+
+	//nolint:staticcheck
+	ctx := context.WithValue(context.Background(), "test", 123)
+
+	err := app.ValidateWithContext(ctx, u)
+	if err != testErr {
+		t.Fatalf("Expected error %v, got %v", testErr, err)
+	}
+}
+
+// -------------------------------------------------------------------
+
+type mockSuperusers struct {
+	core.BaseModel
+	Email string `db:"email"`
+}
+
+func (m *mockSuperusers) TableName() string {
+	return core.CollectionNameSuperusers
+}
diff --git a/server/core_backend-server/core/db_tx.go b/server/core_backend-server/core/db_tx.go
new file mode 100644
index 0000000..3f08228
--- /dev/null
+++ b/server/core_backend-server/core/db_tx.go
@@ -0,0 +1,112 @@
+package core
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+
+	"github.com/pocketbase/dbx"
+)
+
+// RunInTransaction wraps fn into a transaction for the regular app database.
+//
+// It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+func (app *BaseApp) RunInTransaction(fn func(txApp App) error) error {
+	return app.runInTransaction(app.NonconcurrentDB(), fn, false)
+}
+
+// AuxRunInTransaction wraps fn into a transaction for the auxiliary app database.
+//
+// It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+func (app *BaseApp) AuxRunInTransaction(fn func(txApp App) error) error {
+	return app.runInTransaction(app.AuxNonconcurrentDB(), fn, true)
+}
+
+func (app *BaseApp) runInTransaction(db dbx.Builder, fn func(txApp App) error, isForAuxDB bool) error {
+	switch txOrDB := db.(type) {
+	case *dbx.Tx:
+		// run as part of the already existing transaction
+		return fn(app)
+	case *dbx.DB:
+		var txApp *BaseApp
+		txErr := txOrDB.Transactional(func(tx *dbx.Tx) error {
+			txApp = app.createTxApp(tx, isForAuxDB)
+			return fn(txApp)
+		})
+
+		// execute all after event calls on transaction complete
+		if txApp != nil && txApp.txInfo != nil {
+			afterFuncErr := txApp.txInfo.runAfterFuncs(txErr)
+			if afterFuncErr != nil {
+				return errors.Join(txErr, afterFuncErr)
+			}
+		}
+
+		return txErr
+	default:
+		return errors.New("failed to start transaction (unknown db type)")
+	}
+}
+
+// createTxApp shallow clones the current app and assigns a new tx state.
+func (app *BaseApp) createTxApp(tx *dbx.Tx, isForAuxDB bool) *BaseApp {
+	clone := *app
+
+	if isForAuxDB {
+		clone.auxConcurrentDB = tx
+		clone.auxNonconcurrentDB = tx
+	} else {
+		clone.concurrentDB = tx
+		clone.nonconcurrentDB = tx
+	}
+
+	clone.txInfo = &TxAppInfo{
+		parent:     app,
+		isForAuxDB: isForAuxDB,
+	}
+
+	return &clone
+}
+
+// TxAppInfo represents an active transaction context associated to an existing app instance.
+type TxAppInfo struct {
+	parent     *BaseApp
+	afterFuncs []func(txErr error) error
+	mu         sync.Mutex
+	isForAuxDB bool
+}
+
+// OnComplete registers the provided callback that will be invoked
+// once the related transaction ends (either completes successfully or rollbacked with an error).
+//
+// The callback receives the transaction error (if any) as its argument.
+// Any additional errors returned by the OnComplete callbacks will be
+// joined together with txErr when returning the final transaction result.
+func (a *TxAppInfo) OnComplete(fn func(txErr error) error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	a.afterFuncs = append(a.afterFuncs, fn)
+}
+
+// note: can be called only once because TxAppInfo is cleared
+func (a *TxAppInfo) runAfterFuncs(txErr error) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	var errs []error
+
+	for _, call := range a.afterFuncs {
+		if err := call(txErr); err != nil {
+			errs = append(errs, err)
+		}
+	}
+
+	a.afterFuncs = nil
+
+	if len(errs) > 0 {
+		return fmt.Errorf("transaction afterFunc errors: %w", errors.Join(errs...))
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/core/db_tx_test.go b/server/core_backend-server/core/db_tx_test.go
new file mode 100644
index 0000000..d83f126
--- /dev/null
+++ b/server/core_backend-server/core/db_tx_test.go
@@ -0,0 +1,413 @@
+package core_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRunInTransaction(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	t.Run("failed nested transaction", func(t *testing.T) {
+		app.RunInTransaction(func(txApp core.App) error {
+			superuser, _ := txApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+
+			return txApp.RunInTransaction(func(tx2Dao core.App) error {
+				if err := tx2Dao.Delete(superuser); err != nil {
+					t.Fatal(err)
+				}
+				return errors.New("test error")
+			})
+		})
+
+		// superuser should still exist
+		superuser, _ := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+		if superuser == nil {
+			t.Fatal("Expected superuser test@example.com to not be deleted")
+		}
+	})
+
+	t.Run("successful nested transaction", func(t *testing.T) {
+		app.RunInTransaction(func(txApp core.App) error {
+			superuser, _ := txApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+
+			return txApp.RunInTransaction(func(tx2Dao core.App) error {
+				return tx2Dao.Delete(superuser)
+			})
+		})
+
+		// superuser should have been deleted
+		superuser, _ := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+		if superuser != nil {
+			t.Fatalf("Expected superuser test@example.com to be deleted, found %v", superuser)
+		}
+	})
+}
+
+func TestTransactionHooksCallsOnFailure(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	createHookCalls := 0
+	updateHookCalls := 0
+	deleteHookCalls := 0
+	afterCreateHookCalls := 0
+	afterUpdateHookCalls := 0
+	afterDeleteHookCalls := 0
+
+	app.OnModelCreate().BindFunc(func(e *core.ModelEvent) error {
+		createHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelUpdate().BindFunc(func(e *core.ModelEvent) error {
+		updateHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelDelete().BindFunc(func(e *core.ModelEvent) error {
+		deleteHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelAfterCreateSuccess().BindFunc(func(e *core.ModelEvent) error {
+		afterCreateHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelAfterUpdateSuccess().BindFunc(func(e *core.ModelEvent) error {
+		afterUpdateHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelAfterDeleteSuccess().BindFunc(func(e *core.ModelEvent) error {
+		afterDeleteHookCalls++
+		return e.Next()
+	})
+
+	existingModel, _ := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+
+	app.RunInTransaction(func(txApp1 core.App) error {
+		return txApp1.RunInTransaction(func(txApp2 core.App) error {
+			// test create
+			// ---
+			newModel := core.NewRecord(existingModel.Collection())
+			newModel.SetEmail("test_new1@example.com")
+			newModel.SetPassword("1234567890")
+			if err := txApp2.Save(newModel); err != nil {
+				t.Fatal(err)
+			}
+
+			// test update (twice)
+			// ---
+			if err := txApp2.Save(existingModel); err != nil {
+				t.Fatal(err)
+			}
+			if err := txApp2.Save(existingModel); err != nil {
+				t.Fatal(err)
+			}
+
+			// test delete
+			// ---
+			if err := txApp2.Delete(newModel); err != nil {
+				t.Fatal(err)
+			}
+
+			return errors.New("test_tx_error")
+		})
+	})
+
+	if createHookCalls != 1 {
+		t.Errorf("Expected createHookCalls to be called 1 time, got %d", createHookCalls)
+	}
+	if updateHookCalls != 2 {
+		t.Errorf("Expected updateHookCalls to be called 2 times, got %d", updateHookCalls)
+	}
+	if deleteHookCalls != 1 {
+		t.Errorf("Expected deleteHookCalls to be called 1 time, got %d", deleteHookCalls)
+	}
+	if afterCreateHookCalls != 0 {
+		t.Errorf("Expected afterCreateHookCalls to be called 0 times, got %d", afterCreateHookCalls)
+	}
+	if afterUpdateHookCalls != 0 {
+		t.Errorf("Expected afterUpdateHookCalls to be called 0 times, got %d", afterUpdateHookCalls)
+	}
+	if afterDeleteHookCalls != 0 {
+		t.Errorf("Expected afterDeleteHookCalls to be called 0 times, got %d", afterDeleteHookCalls)
+	}
+}
+
+func TestTransactionHooksCallsOnSuccess(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	createHookCalls := 0
+	updateHookCalls := 0
+	deleteHookCalls := 0
+	afterCreateHookCalls := 0
+	afterUpdateHookCalls := 0
+	afterDeleteHookCalls := 0
+
+	app.OnModelCreate().BindFunc(func(e *core.ModelEvent) error {
+		createHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelUpdate().BindFunc(func(e *core.ModelEvent) error {
+		updateHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelDelete().BindFunc(func(e *core.ModelEvent) error {
+		deleteHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelAfterCreateSuccess().BindFunc(func(e *core.ModelEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		afterCreateHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelAfterUpdateSuccess().BindFunc(func(e *core.ModelEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		afterUpdateHookCalls++
+		return e.Next()
+	})
+
+	app.OnModelAfterDeleteSuccess().BindFunc(func(e *core.ModelEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		afterDeleteHookCalls++
+		return e.Next()
+	})
+
+	existingModel, _ := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+
+	app.RunInTransaction(func(txApp1 core.App) error {
+		return txApp1.RunInTransaction(func(txApp2 core.App) error {
+			// test create
+			// ---
+			newModel := core.NewRecord(existingModel.Collection())
+			newModel.SetEmail("test_new1@example.com")
+			newModel.SetPassword("1234567890")
+			if err := txApp2.Save(newModel); err != nil {
+				t.Fatal(err)
+			}
+
+			// test update (twice)
+			// ---
+			if err := txApp2.Save(existingModel); err != nil {
+				t.Fatal(err)
+			}
+			if err := txApp2.Save(existingModel); err != nil {
+				t.Fatal(err)
+			}
+
+			// test delete
+			// ---
+			if err := txApp2.Delete(newModel); err != nil {
+				t.Fatal(err)
+			}
+
+			return nil
+		})
+	})
+
+	if createHookCalls != 1 {
+		t.Errorf("Expected createHookCalls to be called 1 time, got %d", createHookCalls)
+	}
+	if updateHookCalls != 2 {
+		t.Errorf("Expected updateHookCalls to be called 2 times, got %d", updateHookCalls)
+	}
+	if deleteHookCalls != 1 {
+		t.Errorf("Expected deleteHookCalls to be called 1 time, got %d", deleteHookCalls)
+	}
+	if afterCreateHookCalls != 1 {
+		t.Errorf("Expected afterCreateHookCalls to be called 1 time, got %d", afterCreateHookCalls)
+	}
+	if afterUpdateHookCalls != 2 {
+		t.Errorf("Expected afterUpdateHookCalls to be called 2 times, got %d", afterUpdateHookCalls)
+	}
+	if afterDeleteHookCalls != 1 {
+		t.Errorf("Expected afterDeleteHookCalls to be called 1 time, got %d", afterDeleteHookCalls)
+	}
+}
+
+func TestTransactionFromInnerCreateHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.OnRecordCreateExecute("demo2").BindFunc(func(e *core.RecordEvent) error {
+		originalApp := e.App
+		return e.App.RunInTransaction(func(txApp core.App) error {
+			e.App = txApp
+			defer func() {
+				e.App = originalApp
+			}()
+
+			nextErr := e.Next()
+
+			return nextErr
+		})
+	})
+
+	app.OnRecordAfterCreateSuccess("demo2").BindFunc(func(e *core.RecordEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		// perform a db query with the app instance to ensure that it is still valid
+		_, err := e.App.FindFirstRecordByFilter("demo2", "1=1")
+		if err != nil {
+			t.Fatalf("Failed to perform a db query after tx success: %v", err)
+		}
+
+		return e.Next()
+	})
+
+	collection, err := app.FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record := core.NewRecord(collection)
+
+	record.Set("title", "test_inner_tx")
+
+	if err = app.Save(record); err != nil {
+		t.Fatalf("Create failed: %v", err)
+	}
+
+	expectedHookCalls := map[string]int{
+		"OnRecordCreateExecute":      1,
+		"OnRecordAfterCreateSuccess": 1,
+	}
+	for k, total := range expectedHookCalls {
+		if found, ok := app.EventCalls[k]; !ok || total != found {
+			t.Fatalf("Expected %q %d calls, got %d", k, total, found)
+		}
+	}
+}
+
+func TestTransactionFromInnerUpdateHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.OnRecordUpdateExecute("demo2").BindFunc(func(e *core.RecordEvent) error {
+		originalApp := e.App
+		return e.App.RunInTransaction(func(txApp core.App) error {
+			e.App = txApp
+			defer func() {
+				e.App = originalApp
+			}()
+
+			nextErr := e.Next()
+
+			return nextErr
+		})
+	})
+
+	app.OnRecordAfterUpdateSuccess("demo2").BindFunc(func(e *core.RecordEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		// perform a db query with the app instance to ensure that it is still valid
+		_, err := e.App.FindFirstRecordByFilter("demo2", "1=1")
+		if err != nil {
+			t.Fatalf("Failed to perform a db query after tx success: %v", err)
+		}
+
+		return e.Next()
+	})
+
+	existingModel, err := app.FindFirstRecordByFilter("demo2", "1=1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = app.Save(existingModel); err != nil {
+		t.Fatalf("Update failed: %v", err)
+	}
+
+	expectedHookCalls := map[string]int{
+		"OnRecordUpdateExecute":      1,
+		"OnRecordAfterUpdateSuccess": 1,
+	}
+	for k, total := range expectedHookCalls {
+		if found, ok := app.EventCalls[k]; !ok || total != found {
+			t.Fatalf("Expected %q %d calls, got %d", k, total, found)
+		}
+	}
+}
+
+func TestTransactionFromInnerDeleteHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.OnRecordDeleteExecute("demo2").BindFunc(func(e *core.RecordEvent) error {
+		originalApp := e.App
+		return e.App.RunInTransaction(func(txApp core.App) error {
+			e.App = txApp
+			defer func() {
+				e.App = originalApp
+			}()
+
+			nextErr := e.Next()
+
+			return nextErr
+		})
+	})
+
+	app.OnRecordAfterDeleteSuccess("demo2").BindFunc(func(e *core.RecordEvent) error {
+		if e.App.IsTransactional() {
+			t.Fatal("Expected e.App to be non-transactional")
+		}
+
+		// perform a db query with the app instance to ensure that it is still valid
+		_, err := e.App.FindFirstRecordByFilter("demo2", "1=1")
+		if err != nil {
+			t.Fatalf("Failed to perform a db query after tx success: %v", err)
+		}
+
+		return e.Next()
+	})
+
+	existingModel, err := app.FindFirstRecordByFilter("demo2", "1=1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = app.Delete(existingModel); err != nil {
+		t.Fatalf("Delete failed: %v", err)
+	}
+
+	expectedHookCalls := map[string]int{
+		"OnRecordDeleteExecute":      1,
+		"OnRecordAfterDeleteSuccess": 1,
+	}
+	for k, total := range expectedHookCalls {
+		if found, ok := app.EventCalls[k]; !ok || total != found {
+			t.Fatalf("Expected %q %d calls, got %d", k, total, found)
+		}
+	}
+}
diff --git a/server/core_backend-server/core/event_request.go b/server/core_backend-server/core/event_request.go
new file mode 100644
index 0000000..11a80f7
--- /dev/null
+++ b/server/core_backend-server/core/event_request.go
@@ -0,0 +1,197 @@
+package core
+
+import (
+	"maps"
+	"net/netip"
+	"strings"
+	"sync"
+
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+// Common request store keys used by the middlewares and api handlers.
+const (
+	RequestEventKeyInfoContext = "infoContext"
+)
+
+// RequestEvent defines the PocketBase router handler event.
+type RequestEvent struct {
+	App App
+
+	cachedRequestInfo *RequestInfo
+
+	Auth *Record
+
+	router.Event
+
+	mu sync.Mutex
+}
+
+// RealIP returns the "real" IP address from the configured trusted proxy headers.
+//
+// If Settings.TrustedProxy is not configured or the found IP is empty,
+// it fallbacks to e.RemoteIP().
+//
+// NB!
+// Be careful when used in a security critical context as it relies on
+// the trusted proxy to be properly configured and your app to be accessible only through it.
+// If you are not sure, use e.RemoteIP().
+func (e *RequestEvent) RealIP() string {
+	settings := e.App.Settings()
+
+	for _, h := range settings.TrustedProxy.Headers {
+		headerValues := e.Request.Header.Values(h)
+		if len(headerValues) == 0 {
+			continue
+		}
+
+		// extract the last header value as it is expected to be the one controlled by the proxy
+		ipsList := headerValues[len(headerValues)-1]
+		if ipsList == "" {
+			continue
+		}
+
+		ips := strings.Split(ipsList, ",")
+
+		if settings.TrustedProxy.UseLeftmostIP {
+			for _, ip := range ips {
+				parsed, err := netip.ParseAddr(strings.TrimSpace(ip))
+				if err == nil {
+					return parsed.StringExpanded()
+				}
+			}
+		} else {
+			for i := len(ips) - 1; i >= 0; i-- {
+				parsed, err := netip.ParseAddr(strings.TrimSpace(ips[i]))
+				if err == nil {
+					return parsed.StringExpanded()
+				}
+			}
+		}
+	}
+
+	return e.RemoteIP()
+}
+
+// HasSuperuserAuth checks whether the current RequestEvent has superuser authentication loaded.
+func (e *RequestEvent) HasSuperuserAuth() bool {
+	return e.Auth != nil && e.Auth.IsSuperuser()
+}
+
+// RequestInfo parses the current request into RequestInfo instance.
+//
+// Note that the returned result is cached to avoid copying the request data multiple times
+// but the auth state and other common store items are always refreshed in case they were changed by another handler.
+func (e *RequestEvent) RequestInfo() (*RequestInfo, error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	if e.cachedRequestInfo != nil {
+		e.cachedRequestInfo.Auth = e.Auth
+
+		infoCtx, _ := e.Get(RequestEventKeyInfoContext).(string)
+		if infoCtx != "" {
+			e.cachedRequestInfo.Context = infoCtx
+		} else {
+			e.cachedRequestInfo.Context = RequestInfoContextDefault
+		}
+	} else {
+		// (re)init e.cachedRequestInfo based on the current request event
+		if err := e.initRequestInfo(); err != nil {
+			return nil, err
+		}
+	}
+
+	return e.cachedRequestInfo, nil
+}
+
+func (e *RequestEvent) initRequestInfo() error {
+	infoCtx, _ := e.Get(RequestEventKeyInfoContext).(string)
+	if infoCtx == "" {
+		infoCtx = RequestInfoContextDefault
+	}
+
+	info := &RequestInfo{
+		Context: infoCtx,
+		Method:  e.Request.Method,
+		Query:   map[string]string{},
+		Headers: map[string]string{},
+		Body:    map[string]any{},
+	}
+
+	if err := e.BindBody(&info.Body); err != nil {
+		return err
+	}
+
+	// extract the first value of all query params
+	query := e.Request.URL.Query()
+	for k, v := range query {
+		if len(v) > 0 {
+			info.Query[k] = v[0]
+		}
+	}
+
+	// extract the first value of all headers and normalizes the keys
+	// ("X-Token" is converted to "x_token")
+	for k, v := range e.Request.Header {
+		if len(v) > 0 {
+			info.Headers[inflector.Snakecase(k)] = v[0]
+		}
+	}
+
+	info.Auth = e.Auth
+
+	e.cachedRequestInfo = info
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+const (
+	RequestInfoContextDefault       = "default"
+	RequestInfoContextExpand        = "expand"
+	RequestInfoContextRealtime      = "realtime"
+	RequestInfoContextProtectedFile = "protectedFile"
+	RequestInfoContextBatch         = "batch"
+	RequestInfoContextOAuth2        = "oauth2"
+	RequestInfoContextOTP           = "otp"
+	RequestInfoContextPasswordAuth  = "password"
+)
+
+// RequestInfo defines a HTTP request data struct, usually used
+// as part of the `@request.*` filter resolver.
+//
+// The Query and Headers fields contains only the first value for each found entry.
+type RequestInfo struct {
+	Query   map[string]string `json:"query"`
+	Headers map[string]string `json:"headers"`
+	Body    map[string]any    `json:"body"`
+	Auth    *Record           `json:"auth"`
+	Method  string            `json:"method"`
+	Context string            `json:"context"`
+}
+
+// HasSuperuserAuth checks whether the current RequestInfo instance
+// has superuser authentication loaded.
+func (info *RequestInfo) HasSuperuserAuth() bool {
+	return info.Auth != nil && info.Auth.IsSuperuser()
+}
+
+// Clone creates a new shallow copy of the current RequestInfo and its Auth record (if any).
+func (info *RequestInfo) Clone() *RequestInfo {
+	clone := &RequestInfo{
+		Method:  info.Method,
+		Context: info.Context,
+		Query:   maps.Clone(info.Query),
+		Body:    maps.Clone(info.Body),
+		Headers: maps.Clone(info.Headers),
+	}
+
+	if info.Auth != nil {
+		clone.Auth = info.Auth.Fresh()
+	}
+
+	return clone
+}
diff --git a/server/core_backend-server/core/event_request_batch.go b/server/core_backend-server/core/event_request_batch.go
new file mode 100644
index 0000000..240c880
--- /dev/null
+++ b/server/core_backend-server/core/event_request_batch.go
@@ -0,0 +1,33 @@
+package core
+
+import (
+	"net/http"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+type BatchRequestEvent struct {
+	hook.Event
+	*RequestEvent
+
+	Batch []*InternalRequest
+}
+
+type InternalRequest struct {
+	// note: for uploading files the value must be either *filesystem.File or []*filesystem.File
+	Body map[string]any `form:"body" json:"body"`
+
+	Headers map[string]string `form:"headers" json:"headers"`
+
+	Method string `form:"method" json:"method"`
+
+	URL string `form:"url" json:"url"`
+}
+
+func (br InternalRequest) Validate() error {
+	return validation.ValidateStruct(&br,
+		validation.Field(&br.Method, validation.Required, validation.In(http.MethodGet, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete)),
+		validation.Field(&br.URL, validation.Required, validation.Length(0, 2000)),
+	)
+}
diff --git a/server/core_backend-server/core/event_request_batch_test.go b/server/core_backend-server/core/event_request_batch_test.go
new file mode 100644
index 0000000..6feaf40
--- /dev/null
+++ b/server/core_backend-server/core/event_request_batch_test.go
@@ -0,0 +1,74 @@
+package core_test
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestInternalRequestValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		request        core.InternalRequest
+		expectedErrors []string
+	}{
+		{
+			"empty struct",
+			core.InternalRequest{},
+			[]string{"method", "url"},
+		},
+
+		// method
+		{
+			"GET method",
+			core.InternalRequest{URL: "test", Method: http.MethodGet},
+			[]string{},
+		},
+		{
+			"POST method",
+			core.InternalRequest{URL: "test", Method: http.MethodPost},
+			[]string{},
+		},
+		{
+			"PUT method",
+			core.InternalRequest{URL: "test", Method: http.MethodPut},
+			[]string{},
+		},
+		{
+			"PATCH method",
+			core.InternalRequest{URL: "test", Method: http.MethodPatch},
+			[]string{},
+		},
+		{
+			"DELETE method",
+			core.InternalRequest{URL: "test", Method: http.MethodDelete},
+			[]string{},
+		},
+		{
+			"unknown method",
+			core.InternalRequest{URL: "test", Method: "unknown"},
+			[]string{"method"},
+		},
+
+		// url
+		{
+			"url <= 2000",
+			core.InternalRequest{URL: strings.Repeat("a", 2000), Method: http.MethodGet},
+			[]string{},
+		},
+		{
+			"url > 2000",
+			core.InternalRequest{URL: strings.Repeat("a", 2001), Method: http.MethodGet},
+			[]string{"url"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			tests.TestValidationErrors(t, s.request.Validate(), s.expectedErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/event_request_test.go b/server/core_backend-server/core/event_request_test.go
new file mode 100644
index 0000000..6cfc3dc
--- /dev/null
+++ b/server/core_backend-server/core/event_request_test.go
@@ -0,0 +1,334 @@
+package core_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestEventRequestRealIP(t *testing.T) {
+	t.Parallel()
+
+	headers := map[string][]string{
+		"CF-Connecting-IP": {"1.2.3.4", "1.1.1.1"},
+		"Fly-Client-IP":    {"1.2.3.4", "1.1.1.2"},
+		"X-Real-IP":        {"1.2.3.4", "1.1.1.3,1.1.1.4"},
+		"X-Forwarded-For":  {"1.2.3.4", "invalid,1.1.1.5,1.1.1.6,invalid"},
+	}
+
+	scenarios := []struct {
+		name           string
+		headers        map[string][]string
+		trustedHeaders []string
+		useLeftmostIP  bool
+		expected       string
+	}{
+		{
+			"no trusted headers",
+			headers,
+			nil,
+			false,
+			"127.0.0.1",
+		},
+		{
+			"non-matching trusted header",
+			headers,
+			[]string{"header1", "header2"},
+			false,
+			"127.0.0.1",
+		},
+		{
+			"trusted X-Real-IP (rightmost)",
+			headers,
+			[]string{"header1", "x-real-ip", "x-forwarded-for"},
+			false,
+			"1.1.1.4",
+		},
+		{
+			"trusted X-Real-IP (leftmost)",
+			headers,
+			[]string{"header1", "x-real-ip", "x-forwarded-for"},
+			true,
+			"1.1.1.3",
+		},
+		{
+			"trusted X-Forwarded-For (rightmost)",
+			headers,
+			[]string{"header1", "x-forwarded-for"},
+			false,
+			"1.1.1.6",
+		},
+		{
+			"trusted X-Forwarded-For (leftmost)",
+			headers,
+			[]string{"header1", "x-forwarded-for"},
+			true,
+			"1.1.1.5",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, err := tests.NewTestApp()
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer app.Cleanup()
+
+			app.Settings().TrustedProxy.Headers = s.trustedHeaders
+			app.Settings().TrustedProxy.UseLeftmostIP = s.useLeftmostIP
+
+			event := core.RequestEvent{}
+			event.App = app
+
+			event.Request, err = http.NewRequest(http.MethodGet, "/", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			event.Request.RemoteAddr = "127.0.0.1:80" // fallback
+
+			for k, values := range s.headers {
+				for _, v := range values {
+					event.Request.Header.Add(k, v)
+				}
+			}
+
+			result := event.RealIP()
+
+			if result != s.expected {
+				t.Fatalf("Expected ip %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestEventRequestHasSuperUserAuth(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name     string
+		record   *core.Record
+		expected bool
+	}{
+		{"nil record", nil, false},
+		{"regular user record", user, false},
+		{"superuser record", superuser, true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			e := core.RequestEvent{}
+			e.Auth = s.record
+
+			result := e.HasSuperuserAuth()
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestRequestEventRequestInfo(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	userCol, err := app.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user1 := core.NewRecord(userCol)
+	user1.Id = "user1"
+	user1.SetEmail("test1@example.com")
+
+	user2 := core.NewRecord(userCol)
+	user2.Id = "user2"
+	user2.SetEmail("test2@example.com")
+
+	testBody := `{"a":123,"b":"test"}`
+
+	event := core.RequestEvent{}
+	event.Request, err = http.NewRequest("POST", "/test?q1=123&q2=456", strings.NewReader(testBody))
+	if err != nil {
+		t.Fatal(err)
+	}
+	event.Request.Header.Add("content-type", "application/json")
+	event.Request.Header.Add("x-test", "test")
+	event.Set(core.RequestEventKeyInfoContext, "test")
+	event.Auth = user1
+
+	t.Run("init", func(t *testing.T) {
+		info, err := event.RequestInfo()
+		if err != nil {
+			t.Fatalf("Failed to resolve request info: %v", err)
+		}
+
+		raw, err := json.Marshal(info)
+		if err != nil {
+			t.Fatalf("Failed to serialize request info: %v", err)
+		}
+		rawStr := string(raw)
+
+		expected := `{"query":{"q1":"123","q2":"456"},"headers":{"content_type":"application/json","x_test":"test"},"body":{"a":123,"b":"test"},"auth":{"avatar":"","collectionId":"_pb_users_auth_","collectionName":"users","created":"","emailVisibility":false,"file":[],"id":"user1","name":"","rel":"","updated":"","username":"","verified":false},"method":"POST","context":"test"}`
+
+		if expected != rawStr {
+			t.Fatalf("Expected\n%v\ngot\n%v", expected, rawStr)
+		}
+	})
+
+	t.Run("change user and context", func(t *testing.T) {
+		event.Set(core.RequestEventKeyInfoContext, "test2")
+		event.Auth = user2
+
+		info, err := event.RequestInfo()
+		if err != nil {
+			t.Fatalf("Failed to resolve request info: %v", err)
+		}
+
+		raw, err := json.Marshal(info)
+		if err != nil {
+			t.Fatalf("Failed to serialize request info: %v", err)
+		}
+		rawStr := string(raw)
+
+		expected := `{"query":{"q1":"123","q2":"456"},"headers":{"content_type":"application/json","x_test":"test"},"body":{"a":123,"b":"test"},"auth":{"avatar":"","collectionId":"_pb_users_auth_","collectionName":"users","created":"","emailVisibility":false,"file":[],"id":"user2","name":"","rel":"","updated":"","username":"","verified":false},"method":"POST","context":"test2"}`
+
+		if expected != rawStr {
+			t.Fatalf("Expected\n%v\ngot\n%v", expected, rawStr)
+		}
+	})
+}
+
+func TestRequestInfoHasSuperuserAuth(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	event := core.RequestEvent{}
+	event.Request, err = http.NewRequest("POST", "/test?q1=123&q2=456", strings.NewReader(`{"a":123,"b":"test"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	event.Request.Header.Add("content-type", "application/json")
+
+	scenarios := []struct {
+		name     string
+		record   *core.Record
+		expected bool
+	}{
+		{"nil record", nil, false},
+		{"regular user record", user, false},
+		{"superuser record", superuser, true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			event.Auth = s.record
+
+			info, err := event.RequestInfo()
+			if err != nil {
+				t.Fatalf("Failed to resolve request info: %v", err)
+			}
+
+			result := info.HasSuperuserAuth()
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestRequestInfoClone(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	userCol, err := app.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user := core.NewRecord(userCol)
+	user.Id = "user1"
+	user.SetEmail("test1@example.com")
+
+	event := core.RequestEvent{}
+	event.Request, err = http.NewRequest("POST", "/test?q1=123&q2=456", strings.NewReader(`{"a":123,"b":"test"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	event.Request.Header.Add("content-type", "application/json")
+	event.Auth = user
+
+	info, err := event.RequestInfo()
+	if err != nil {
+		t.Fatalf("Failed to resolve request info: %v", err)
+	}
+
+	clone := info.Clone()
+
+	// modify the clone fields to ensure that it is a shallow copy
+	clone.Headers["new_header"] = "test"
+	clone.Query["new_query"] = "test"
+	clone.Body["new_body"] = "test"
+	clone.Auth.Id = "user2" // should be a Fresh copy of the record
+
+	// check the original data
+	// ---
+	originalRaw, err := json.Marshal(info)
+	if err != nil {
+		t.Fatalf("Failed to serialize original request info: %v", err)
+	}
+	originalRawStr := string(originalRaw)
+
+	expectedRawStr := `{"query":{"q1":"123","q2":"456"},"headers":{"content_type":"application/json"},"body":{"a":123,"b":"test"},"auth":{"avatar":"","collectionId":"_pb_users_auth_","collectionName":"users","created":"","emailVisibility":false,"file":[],"id":"user1","name":"","rel":"","updated":"","username":"","verified":false},"method":"POST","context":"default"}`
+	if expectedRawStr != originalRawStr {
+		t.Fatalf("Expected original info\n%v\ngot\n%v", expectedRawStr, originalRawStr)
+	}
+
+	// check the clone data
+	// ---
+	cloneRaw, err := json.Marshal(clone)
+	if err != nil {
+		t.Fatalf("Failed to serialize clone request info: %v", err)
+	}
+	cloneRawStr := string(cloneRaw)
+
+	expectedCloneStr := `{"query":{"new_query":"test","q1":"123","q2":"456"},"headers":{"content_type":"application/json","new_header":"test"},"body":{"a":123,"b":"test","new_body":"test"},"auth":{"avatar":"","collectionId":"_pb_users_auth_","collectionName":"users","created":"","emailVisibility":false,"file":[],"id":"user2","name":"","rel":"","updated":"","username":"","verified":false},"method":"POST","context":"default"}`
+	if expectedCloneStr != cloneRawStr {
+		t.Fatalf("Expected clone info\n%v\ngot\n%v", expectedCloneStr, cloneRawStr)
+	}
+}
diff --git a/server/core_backend-server/core/events.go b/server/core_backend-server/core/events.go
new file mode 100644
index 0000000..4a03af6
--- /dev/null
+++ b/server/core_backend-server/core/events.go
@@ -0,0 +1,595 @@
+package core
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"golang.org/x/crypto/acme/autocert"
+)
+
+type HookTagger interface {
+	HookTags() []string
+}
+
+// -------------------------------------------------------------------
+
+type baseModelEventData struct {
+	Model Model
+}
+
+func (e *baseModelEventData) Tags() []string {
+	if e.Model == nil {
+		return nil
+	}
+
+	if ht, ok := e.Model.(HookTagger); ok {
+		return ht.HookTags()
+	}
+
+	return []string{e.Model.TableName()}
+}
+
+// -------------------------------------------------------------------
+
+type baseRecordEventData struct {
+	Record *Record
+}
+
+func (e *baseRecordEventData) Tags() []string {
+	if e.Record == nil {
+		return nil
+	}
+
+	return e.Record.HookTags()
+}
+
+// -------------------------------------------------------------------
+
+type baseCollectionEventData struct {
+	Collection *Collection
+}
+
+func (e *baseCollectionEventData) Tags() []string {
+	if e.Collection == nil {
+		return nil
+	}
+
+	tags := make([]string, 0, 2)
+
+	if e.Collection.Id != "" {
+		tags = append(tags, e.Collection.Id)
+	}
+
+	if e.Collection.Name != "" {
+		tags = append(tags, e.Collection.Name)
+	}
+
+	return tags
+}
+
+// -------------------------------------------------------------------
+// App events data
+// -------------------------------------------------------------------
+
+type BootstrapEvent struct {
+	hook.Event
+	App App
+}
+
+type TerminateEvent struct {
+	hook.Event
+	App       App
+	IsRestart bool
+}
+
+type BackupEvent struct {
+	hook.Event
+	App     App
+	Context context.Context
+	Name    string   // the name of the backup to create/restore.
+	Exclude []string // list of dir entries to exclude from the backup create/restore.
+}
+
+type ServeEvent struct {
+	hook.Event
+	App         App
+	Router      *router.Router[*RequestEvent]
+	Server      *http.Server
+	CertManager *autocert.Manager
+
+	// Listener allow specifying a custom network listener.
+	//
+	// Leave it nil to use the default net.Listen("tcp", e.Server.Addr).
+	Listener net.Listener
+
+	// InstallerFunc is the "installer" function that is called after
+	// successful server tcp bind but only if there is no explicit
+	// superuser record created yet.
+	//
+	// It runs in a separate goroutine and its default value is [apis.DefaultInstallerFunc].
+	//
+	// It receives a system superuser record as argument that you can use to generate
+	// a short-lived auth token (e.g. systemSuperuser.NewStaticAuthToken(30 * time.Minute))
+	// and concatenate it as query param for your installer page
+	// (if you are using the client-side SDKs, you can then load the
+	// token with pb.authStore.save(token) and perform any Web API request
+	// e.g. creating a new superuser).
+	//
+	// Set it to nil if you want to skip the installer.
+	InstallerFunc func(app App, systemSuperuser *Record, baseURL string) error
+}
+
+// -------------------------------------------------------------------
+// Settings events data
+// -------------------------------------------------------------------
+
+type SettingsListRequestEvent struct {
+	hook.Event
+	*RequestEvent
+
+	Settings *Settings
+}
+
+type SettingsUpdateRequestEvent struct {
+	hook.Event
+	*RequestEvent
+
+	OldSettings *Settings
+	NewSettings *Settings
+}
+
+type SettingsReloadEvent struct {
+	hook.Event
+	App App
+}
+
+// -------------------------------------------------------------------
+// Mailer events data
+// -------------------------------------------------------------------
+
+type MailerEvent struct {
+	hook.Event
+	App App
+
+	Mailer  mailer.Mailer
+	Message *mailer.Message
+}
+
+type MailerRecordEvent struct {
+	MailerEvent
+	baseRecordEventData
+	Meta map[string]any
+}
+
+// -------------------------------------------------------------------
+// Model events data
+// -------------------------------------------------------------------
+
+const (
+	ModelEventTypeCreate   = "create"
+	ModelEventTypeUpdate   = "update"
+	ModelEventTypeDelete   = "delete"
+	ModelEventTypeValidate = "validate"
+)
+
+type ModelEvent struct {
+	hook.Event
+	App App
+	baseModelEventData
+	Context context.Context
+
+	// Could be any of the ModelEventType* constants, like:
+	// - create
+	// - update
+	// - delete
+	// - validate
+	Type string
+}
+
+type ModelErrorEvent struct {
+	Error error
+	ModelEvent
+}
+
+// -------------------------------------------------------------------
+// Record events data
+// -------------------------------------------------------------------
+
+type RecordEvent struct {
+	hook.Event
+	App App
+	baseRecordEventData
+	Context context.Context
+
+	// Could be any of the ModelEventType* constants, like:
+	// - create
+	// - update
+	// - delete
+	// - validate
+	Type string
+}
+
+type RecordErrorEvent struct {
+	Error error
+	RecordEvent
+}
+
+func syncModelEventWithRecordEvent(me *ModelEvent, re *RecordEvent) {
+	me.App = re.App
+	me.Context = re.Context
+	me.Type = re.Type
+
+	// @todo enable if after profiling doesn't have significant impact
+	// 		 skip for now to avoid excessive checks and assume that the
+	// 		 Model and the Record fields still points to the same instance
+	//
+	// if _, ok := me.Model.(*Record); ok {
+	// 	me.Model = re.Record
+	// } else if proxy, ok := me.Model.(RecordProxy); ok {
+	// 	proxy.SetProxyRecord(re.Record)
+	// }
+}
+
+func syncRecordEventWithModelEvent(re *RecordEvent, me *ModelEvent) {
+	re.App = me.App
+	re.Context = me.Context
+	re.Type = me.Type
+}
+
+func newRecordEventFromModelEvent(me *ModelEvent) (*RecordEvent, bool) {
+	record, ok := me.Model.(*Record)
+	if !ok {
+		proxy, ok := me.Model.(RecordProxy)
+		if !ok {
+			return nil, false
+		}
+		record = proxy.ProxyRecord()
+	}
+
+	re := new(RecordEvent)
+	re.App = me.App
+	re.Context = me.Context
+	re.Type = me.Type
+	re.Record = record
+
+	return re, true
+}
+
+func newRecordErrorEventFromModelErrorEvent(me *ModelErrorEvent) (*RecordErrorEvent, bool) {
+	recordEvent, ok := newRecordEventFromModelEvent(&me.ModelEvent)
+	if !ok {
+		return nil, false
+	}
+
+	re := new(RecordErrorEvent)
+	re.RecordEvent = *recordEvent
+	re.Error = me.Error
+
+	return re, true
+}
+
+func syncModelErrorEventWithRecordErrorEvent(me *ModelErrorEvent, re *RecordErrorEvent) {
+	syncModelEventWithRecordEvent(&me.ModelEvent, &re.RecordEvent)
+	me.Error = re.Error
+}
+
+func syncRecordErrorEventWithModelErrorEvent(re *RecordErrorEvent, me *ModelErrorEvent) {
+	syncRecordEventWithModelEvent(&re.RecordEvent, &me.ModelEvent)
+	re.Error = me.Error
+}
+
+// -------------------------------------------------------------------
+// Collection events data
+// -------------------------------------------------------------------
+
+type CollectionEvent struct {
+	hook.Event
+	App App
+	baseCollectionEventData
+	Context context.Context
+
+	// Could be any of the ModelEventType* constants, like:
+	// - create
+	// - update
+	// - delete
+	// - validate
+	Type string
+}
+
+type CollectionErrorEvent struct {
+	Error error
+	CollectionEvent
+}
+
+func syncModelEventWithCollectionEvent(me *ModelEvent, ce *CollectionEvent) {
+	me.App = ce.App
+	me.Context = ce.Context
+	me.Type = ce.Type
+	me.Model = ce.Collection
+}
+
+func syncCollectionEventWithModelEvent(ce *CollectionEvent, me *ModelEvent) {
+	ce.App = me.App
+	ce.Context = me.Context
+	ce.Type = me.Type
+	if c, ok := me.Model.(*Collection); ok {
+		ce.Collection = c
+	}
+}
+
+func newCollectionEventFromModelEvent(me *ModelEvent) (*CollectionEvent, bool) {
+	record, ok := me.Model.(*Collection)
+	if !ok {
+		return nil, false
+	}
+
+	ce := new(CollectionEvent)
+	ce.App = me.App
+	ce.Context = me.Context
+	ce.Type = me.Type
+	ce.Collection = record
+
+	return ce, true
+}
+
+func newCollectionErrorEventFromModelErrorEvent(me *ModelErrorEvent) (*CollectionErrorEvent, bool) {
+	collectionevent, ok := newCollectionEventFromModelEvent(&me.ModelEvent)
+	if !ok {
+		return nil, false
+	}
+
+	ce := new(CollectionErrorEvent)
+	ce.CollectionEvent = *collectionevent
+	ce.Error = me.Error
+
+	return ce, true
+}
+
+func syncModelErrorEventWithCollectionErrorEvent(me *ModelErrorEvent, ce *CollectionErrorEvent) {
+	syncModelEventWithCollectionEvent(&me.ModelEvent, &ce.CollectionEvent)
+	me.Error = ce.Error
+}
+
+func syncCollectionErrorEventWithModelErrorEvent(ce *CollectionErrorEvent, me *ModelErrorEvent) {
+	syncCollectionEventWithModelEvent(&ce.CollectionEvent, &me.ModelEvent)
+	ce.Error = me.Error
+}
+
+// -------------------------------------------------------------------
+// File API events data
+// -------------------------------------------------------------------
+
+type FileTokenRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseRecordEventData
+
+	Token string
+}
+
+type FileDownloadRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record     *Record
+	FileField  *FileField
+	ServedPath string
+	ServedName string
+
+	// ThumbError indicates the a thumb wasn't able to be generated
+	// (e.g. because it didn't satisfy the support image formats or it timed out).
+	//
+	// Note that PocketBase fallbacks to the original file in case of a thumb error,
+	// but developers can check the field and provide their own custom thumb generation if necessary.
+	ThumbError error
+}
+
+// -------------------------------------------------------------------
+// Collection API events data
+// -------------------------------------------------------------------
+
+type CollectionsListRequestEvent struct {
+	hook.Event
+	*RequestEvent
+
+	Collections []*Collection
+	Result      *search.Result
+}
+
+type CollectionsImportRequestEvent struct {
+	hook.Event
+	*RequestEvent
+
+	CollectionsData []map[string]any
+	DeleteMissing   bool
+}
+
+type CollectionRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+}
+
+// -------------------------------------------------------------------
+// Realtime API events data
+// -------------------------------------------------------------------
+
+type RealtimeConnectRequestEvent struct {
+	hook.Event
+	*RequestEvent
+
+	Client subscriptions.Client
+
+	// note: modifying it after the connect has no effect
+	IdleTimeout time.Duration
+}
+
+type RealtimeMessageEvent struct {
+	hook.Event
+	*RequestEvent
+
+	Client  subscriptions.Client
+	Message *subscriptions.Message
+}
+
+type RealtimeSubscribeRequestEvent struct {
+	hook.Event
+	*RequestEvent
+
+	Client        subscriptions.Client
+	Subscriptions []string
+}
+
+// -------------------------------------------------------------------
+// Record CRUD API events data
+// -------------------------------------------------------------------
+
+type RecordsListRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	// @todo consider removing and maybe add as generic to the search.Result?
+	Records []*Record
+	Result  *search.Result
+}
+
+type RecordRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record *Record
+}
+
+type RecordEnrichEvent struct {
+	hook.Event
+	App App
+	baseRecordEventData
+
+	RequestInfo *RequestInfo
+}
+
+// -------------------------------------------------------------------
+// Auth Record API events data
+// -------------------------------------------------------------------
+
+type RecordCreateOTPRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record   *Record
+	Password string
+}
+
+type RecordAuthWithOTPRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record *Record
+	OTP    *OTP
+}
+
+type RecordAuthRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record     *Record
+	Token      string
+	Meta       any
+	AuthMethod string
+}
+
+type RecordAuthWithPasswordRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record        *Record
+	Identity      string
+	IdentityField string
+	Password      string
+}
+
+type RecordAuthWithOAuth2RequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	ProviderName   string
+	ProviderClient auth.Provider
+	Record         *Record
+	OAuth2User     *auth.AuthUser
+	CreateData     map[string]any
+	IsNewRecord    bool
+}
+
+type RecordAuthRefreshRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record *Record
+}
+
+type RecordRequestPasswordResetRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record *Record
+}
+
+type RecordConfirmPasswordResetRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record *Record
+}
+
+type RecordRequestVerificationRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record *Record
+}
+
+type RecordConfirmVerificationRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record *Record
+}
+
+type RecordRequestEmailChangeRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record   *Record
+	NewEmail string
+}
+
+type RecordConfirmEmailChangeRequestEvent struct {
+	hook.Event
+	*RequestEvent
+	baseCollectionEventData
+
+	Record   *Record
+	NewEmail string
+}
diff --git a/server/core_backend-server/core/external_auth_model.go b/server/core_backend-server/core/external_auth_model.go
new file mode 100644
index 0000000..3623dfa
--- /dev/null
+++ b/server/core_backend-server/core/external_auth_model.go
@@ -0,0 +1,140 @@
+package core
+
+import (
+	"context"
+	"errors"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/auth"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+var (
+	_ Model        = (*ExternalAuth)(nil)
+	_ PreValidator = (*ExternalAuth)(nil)
+	_ RecordProxy  = (*ExternalAuth)(nil)
+)
+
+const CollectionNameExternalAuths = "_externalAuths"
+
+// ExternalAuth defines a Record proxy for working with the externalAuths collection.
+type ExternalAuth struct {
+	*Record
+}
+
+// NewExternalAuth instantiates and returns a new blank *ExternalAuth model.
+//
+// Example usage:
+//
+//	ea := core.NewExternalAuth(app)
+//	ea.SetRecordRef(user.Id)
+//	ea.SetCollectionRef(user.Collection().Id)
+//	ea.SetProvider("google")
+//	ea.SetProviderId("...")
+//	app.Save(ea)
+func NewExternalAuth(app App) *ExternalAuth {
+	m := &ExternalAuth{}
+
+	c, err := app.FindCachedCollectionByNameOrId(CollectionNameExternalAuths)
+	if err != nil {
+		// this is just to make tests easier since it is a system collection and it is expected to be always accessible
+		// (note: the loaded record is further checked on ExternalAuth.PreValidate())
+		c = NewBaseCollection("@__invalid__")
+	}
+
+	m.Record = NewRecord(c)
+
+	return m
+}
+
+// PreValidate implements the [PreValidator] interface and checks
+// whether the proxy is properly loaded.
+func (m *ExternalAuth) PreValidate(ctx context.Context, app App) error {
+	if m.Record == nil || m.Record.Collection().Name != CollectionNameExternalAuths {
+		return errors.New("missing or invalid ExternalAuth ProxyRecord")
+	}
+
+	return nil
+}
+
+// ProxyRecord returns the proxied Record model.
+func (m *ExternalAuth) ProxyRecord() *Record {
+	return m.Record
+}
+
+// SetProxyRecord loads the specified record model into the current proxy.
+func (m *ExternalAuth) SetProxyRecord(record *Record) {
+	m.Record = record
+}
+
+// CollectionRef returns the "collectionRef" field value.
+func (m *ExternalAuth) CollectionRef() string {
+	return m.GetString("collectionRef")
+}
+
+// SetCollectionRef updates the "collectionRef" record field value.
+func (m *ExternalAuth) SetCollectionRef(collectionId string) {
+	m.Set("collectionRef", collectionId)
+}
+
+// RecordRef returns the "recordRef" record field value.
+func (m *ExternalAuth) RecordRef() string {
+	return m.GetString("recordRef")
+}
+
+// SetRecordRef updates the "recordRef" record field value.
+func (m *ExternalAuth) SetRecordRef(recordId string) {
+	m.Set("recordRef", recordId)
+}
+
+// Provider returns the "provider" record field value.
+func (m *ExternalAuth) Provider() string {
+	return m.GetString("provider")
+}
+
+// SetProvider updates the "provider" record field value.
+func (m *ExternalAuth) SetProvider(provider string) {
+	m.Set("provider", provider)
+}
+
+// Provider returns the "providerId" record field value.
+func (m *ExternalAuth) ProviderId() string {
+	return m.GetString("providerId")
+}
+
+// SetProvider updates the "providerId" record field value.
+func (m *ExternalAuth) SetProviderId(providerId string) {
+	m.Set("providerId", providerId)
+}
+
+// Created returns the "created" record field value.
+func (m *ExternalAuth) Created() types.DateTime {
+	return m.GetDateTime("created")
+}
+
+// Updated returns the "updated" record field value.
+func (m *ExternalAuth) Updated() types.DateTime {
+	return m.GetDateTime("updated")
+}
+
+func (app *BaseApp) registerExternalAuthHooks() {
+	recordRefHooks[*ExternalAuth](app, CollectionNameExternalAuths, CollectionTypeAuth)
+
+	app.OnRecordValidate(CollectionNameExternalAuths).Bind(&hook.Handler[*RecordEvent]{
+		Func: func(e *RecordEvent) error {
+			providerNames := make([]any, 0, len(auth.Providers))
+			for name := range auth.Providers {
+				providerNames = append(providerNames, name)
+			}
+
+			provider := e.Record.GetString("provider")
+			if err := validation.Validate(provider, validation.Required, validation.In(providerNames...)); err != nil {
+				return validation.Errors{"provider": err}
+			}
+
+			return e.Next()
+		},
+		Priority: 99,
+	})
+}
diff --git a/server/core_backend-server/core/external_auth_model_test.go b/server/core_backend-server/core/external_auth_model_test.go
new file mode 100644
index 0000000..512f677
--- /dev/null
+++ b/server/core_backend-server/core/external_auth_model_test.go
@@ -0,0 +1,310 @@
+package core_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestNewExternalAuth(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	ea := core.NewExternalAuth(app)
+
+	if ea.Collection().Name != core.CollectionNameExternalAuths {
+		t.Fatalf("Expected record with %q collection, got %q", core.CollectionNameExternalAuths, ea.Collection().Name)
+	}
+}
+
+func TestExternalAuthProxyRecord(t *testing.T) {
+	t.Parallel()
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+	record.Id = "test_id"
+
+	ea := core.ExternalAuth{}
+	ea.SetProxyRecord(record)
+
+	if ea.ProxyRecord() == nil || ea.ProxyRecord().Id != record.Id {
+		t.Fatalf("Expected proxy record with id %q, got %v", record.Id, ea.ProxyRecord())
+	}
+}
+
+func TestExternalAuthRecordRef(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	ea := core.NewExternalAuth(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			ea.SetRecordRef(testValue)
+
+			if v := ea.RecordRef(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := ea.GetString("recordRef"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestExternalAuthCollectionRef(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	ea := core.NewExternalAuth(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			ea.SetCollectionRef(testValue)
+
+			if v := ea.CollectionRef(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := ea.GetString("collectionRef"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestExternalAuthProvider(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	ea := core.NewExternalAuth(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			ea.SetProvider(testValue)
+
+			if v := ea.Provider(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := ea.GetString("provider"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestExternalAuthProviderId(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	ea := core.NewExternalAuth(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			ea.SetProviderId(testValue)
+
+			if v := ea.ProviderId(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := ea.GetString("providerId"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestExternalAuthCreated(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	ea := core.NewExternalAuth(app)
+
+	if v := ea.Created().String(); v != "" {
+		t.Fatalf("Expected empty created, got %q", v)
+	}
+
+	now := types.NowDateTime()
+	ea.SetRaw("created", now)
+
+	if v := ea.Created().String(); v != now.String() {
+		t.Fatalf("Expected %q created, got %q", now.String(), v)
+	}
+}
+
+func TestExternalAuthUpdated(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	ea := core.NewExternalAuth(app)
+
+	if v := ea.Updated().String(); v != "" {
+		t.Fatalf("Expected empty updated, got %q", v)
+	}
+
+	now := types.NowDateTime()
+	ea.SetRaw("updated", now)
+
+	if v := ea.Updated().String(); v != now.String() {
+		t.Fatalf("Expected %q updated, got %q", now.String(), v)
+	}
+}
+
+func TestExternalAuthPreValidate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	externalAuthsCol, err := app.FindCollectionByNameOrId(core.CollectionNameExternalAuths)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("no proxy record", func(t *testing.T) {
+		externalAuth := &core.ExternalAuth{}
+
+		if err := app.Validate(externalAuth); err == nil {
+			t.Fatal("Expected collection validation error")
+		}
+	})
+
+	t.Run("non-ExternalAuth collection", func(t *testing.T) {
+		externalAuth := &core.ExternalAuth{}
+		externalAuth.SetProxyRecord(core.NewRecord(core.NewBaseCollection("invalid")))
+		externalAuth.SetRecordRef(user.Id)
+		externalAuth.SetCollectionRef(user.Collection().Id)
+		externalAuth.SetProvider("gitlab")
+		externalAuth.SetProviderId("test123")
+
+		if err := app.Validate(externalAuth); err == nil {
+			t.Fatal("Expected collection validation error")
+		}
+	})
+
+	t.Run("ExternalAuth collection", func(t *testing.T) {
+		externalAuth := &core.ExternalAuth{}
+		externalAuth.SetProxyRecord(core.NewRecord(externalAuthsCol))
+		externalAuth.SetRecordRef(user.Id)
+		externalAuth.SetCollectionRef(user.Collection().Id)
+		externalAuth.SetProvider("gitlab")
+		externalAuth.SetProviderId("test123")
+
+		if err := app.Validate(externalAuth); err != nil {
+			t.Fatalf("Expected nil validation error, got %v", err)
+		}
+	})
+}
+
+func TestExternalAuthValidateHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name         string
+		externalAuth func() *core.ExternalAuth
+		expectErrors []string
+	}{
+		{
+			"empty",
+			func() *core.ExternalAuth {
+				return core.NewExternalAuth(app)
+			},
+			[]string{"collectionRef", "recordRef", "provider", "providerId"},
+		},
+		{
+			"non-auth collection",
+			func() *core.ExternalAuth {
+				ea := core.NewExternalAuth(app)
+				ea.SetCollectionRef(demo1.Collection().Id)
+				ea.SetRecordRef(demo1.Id)
+				ea.SetProvider("gitlab")
+				ea.SetProviderId("test123")
+				return ea
+			},
+			[]string{"collectionRef"},
+		},
+		{
+			"disabled provider",
+			func() *core.ExternalAuth {
+				ea := core.NewExternalAuth(app)
+				ea.SetCollectionRef(user.Collection().Id)
+				ea.SetRecordRef("missing")
+				ea.SetProvider("apple")
+				ea.SetProviderId("test123")
+				return ea
+			},
+			[]string{"recordRef"},
+		},
+		{
+			"missing record id",
+			func() *core.ExternalAuth {
+				ea := core.NewExternalAuth(app)
+				ea.SetCollectionRef(user.Collection().Id)
+				ea.SetRecordRef("missing")
+				ea.SetProvider("gitlab")
+				ea.SetProviderId("test123")
+				return ea
+			},
+			[]string{"recordRef"},
+		},
+		{
+			"valid ref",
+			func() *core.ExternalAuth {
+				ea := core.NewExternalAuth(app)
+				ea.SetCollectionRef(user.Collection().Id)
+				ea.SetRecordRef(user.Id)
+				ea.SetProvider("gitlab")
+				ea.SetProviderId("test123")
+				return ea
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := app.Validate(s.externalAuth())
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/external_auth_query.go b/server/core_backend-server/core/external_auth_query.go
new file mode 100644
index 0000000..9331cfd
--- /dev/null
+++ b/server/core_backend-server/core/external_auth_query.go
@@ -0,0 +1,61 @@
+package core
+
+import (
+	"github.com/pocketbase/dbx"
+)
+
+// FindAllExternalAuthsByRecord returns all ExternalAuth models
+// linked to the provided auth record.
+func (app *BaseApp) FindAllExternalAuthsByRecord(authRecord *Record) ([]*ExternalAuth, error) {
+	auths := []*ExternalAuth{}
+
+	err := app.RecordQuery(CollectionNameExternalAuths).
+		AndWhere(dbx.HashExp{
+			"collectionRef": authRecord.Collection().Id,
+			"recordRef":     authRecord.Id,
+		}).
+		OrderBy("created DESC").
+		All(&auths)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return auths, nil
+}
+
+// FindAllExternalAuthsByCollection returns all ExternalAuth models
+// linked to the provided auth collection.
+func (app *BaseApp) FindAllExternalAuthsByCollection(collection *Collection) ([]*ExternalAuth, error) {
+	auths := []*ExternalAuth{}
+
+	err := app.RecordQuery(CollectionNameExternalAuths).
+		AndWhere(dbx.HashExp{"collectionRef": collection.Id}).
+		OrderBy("created DESC").
+		All(&auths)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return auths, nil
+}
+
+// FindFirstExternalAuthByExpr returns the first available (the most recent created)
+// ExternalAuth model that satisfies the non-nil expression.
+func (app *BaseApp) FindFirstExternalAuthByExpr(expr dbx.Expression) (*ExternalAuth, error) {
+	model := &ExternalAuth{}
+
+	err := app.RecordQuery(CollectionNameExternalAuths).
+		AndWhere(dbx.Not(dbx.HashExp{"providerId": ""})). // exclude empty providerIds
+		AndWhere(expr).
+		OrderBy("created DESC").
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
diff --git a/server/core_backend-server/core/external_auth_query_test.go b/server/core_backend-server/core/external_auth_query_test.go
new file mode 100644
index 0000000..868ba66
--- /dev/null
+++ b/server/core_backend-server/core/external_auth_query_test.go
@@ -0,0 +1,176 @@
+package core_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestFindAllExternalAuthsByRecord(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser1, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user1, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user2, err := app.FindAuthRecordByEmail("users", "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user3, err := app.FindAuthRecordByEmail("users", "test3@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	client1, err := app.FindAuthRecordByEmail("clients", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record   *core.Record
+		expected []string
+	}{
+		{demo1, nil},
+		{superuser1, nil},
+		{client1, []string{"f1z5b3843pzc964"}},
+		{user1, []string{"clmflokuq1xl341", "dlmflokuq1xl342"}},
+		{user2, nil},
+		{user3, []string{"5eto7nmys833164"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.record.Collection().Name+"_"+s.record.Id, func(t *testing.T) {
+			result, err := app.FindAllExternalAuthsByRecord(s.record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected total models %d, got %d", len(s.expected), len(result))
+			}
+
+			for i, id := range s.expected {
+				if result[i].Id != id {
+					t.Errorf("[%d] Expected id %q, got %q", i, id, result[i].Id)
+				}
+			}
+		})
+	}
+}
+
+func TestFindAllExternalAuthsByCollection(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superusers, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	clients, err := app.FindCollectionByNameOrId("clients")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	users, err := app.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		collection *core.Collection
+		expected   []string
+	}{
+		{demo1, nil},
+		{superusers, nil},
+		{clients, []string{
+			"f1z5b3843pzc964",
+		}},
+		{users, []string{
+			"5eto7nmys833164",
+			"clmflokuq1xl341",
+			"dlmflokuq1xl342",
+		}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.collection.Name, func(t *testing.T) {
+			result, err := app.FindAllExternalAuthsByCollection(s.collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected total models %d, got %d", len(s.expected), len(result))
+			}
+
+			for i, id := range s.expected {
+				if result[i].Id != id {
+					t.Errorf("[%d] Expected id %q, got %q", i, id, result[i].Id)
+				}
+			}
+		})
+	}
+}
+
+func TestFindFirstExternalAuthByExpr(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		expr       dbx.Expression
+		expectedId string
+	}{
+		{dbx.HashExp{"collectionRef": "invalid"}, ""},
+		{dbx.HashExp{"collectionRef": "_pb_users_auth_"}, "5eto7nmys833164"},
+		{dbx.HashExp{"collectionRef": "_pb_users_auth_", "provider": "gitlab"}, "dlmflokuq1xl342"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%v", i, s.expr.Build(app.ConcurrentDB().(*dbx.DB), dbx.Params{})), func(t *testing.T) {
+			result, err := app.FindFirstExternalAuthByExpr(s.expr)
+
+			hasErr := err != nil
+			expectErr := s.expectedId == ""
+			if hasErr != expectErr {
+				t.Fatalf("Expected hasErr %v, got %v", expectErr, hasErr)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if result.Id != s.expectedId {
+				t.Errorf("Expected id %q, got %q", s.expectedId, result.Id)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field.go b/server/core_backend-server/core/field.go
new file mode 100644
index 0000000..a2f47be
--- /dev/null
+++ b/server/core_backend-server/core/field.go
@@ -0,0 +1,255 @@
+package core
+
+import (
+	"context"
+	"database/sql/driver"
+	"regexp"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+var fieldNameRegex = regexp.MustCompile(`^\w+$`)
+
+const maxSafeJSONInt int64 = 1<<53 - 1
+
+// Commonly used field names.
+const (
+	FieldNameId              = "id"
+	FieldNameCollectionId    = "collectionId"
+	FieldNameCollectionName  = "collectionName"
+	FieldNameExpand          = "expand"
+	FieldNameEmail           = "email"
+	FieldNameEmailVisibility = "emailVisibility"
+	FieldNameVerified        = "verified"
+	FieldNameTokenKey        = "tokenKey"
+	FieldNamePassword        = "password"
+)
+
+// SystemFields returns special internal field names that are usually readonly.
+var SystemDynamicFieldNames = []string{
+	FieldNameCollectionId,
+	FieldNameCollectionName,
+	FieldNameExpand,
+}
+
+// Common RecordInterceptor action names.
+const (
+	InterceptorActionValidate         = "validate"
+	InterceptorActionDelete           = "delete"
+	InterceptorActionDeleteExecute    = "deleteExecute"
+	InterceptorActionAfterDelete      = "afterDelete"
+	InterceptorActionAfterDeleteError = "afterDeleteError"
+	InterceptorActionCreate           = "create"
+	InterceptorActionCreateExecute    = "createExecute"
+	InterceptorActionAfterCreate      = "afterCreate"
+	InterceptorActionAfterCreateError = "afterCreateFailure"
+	InterceptorActionUpdate           = "update"
+	InterceptorActionUpdateExecute    = "updateExecute"
+	InterceptorActionAfterUpdate      = "afterUpdate"
+	InterceptorActionAfterUpdateError = "afterUpdateError"
+)
+
+// Common field errors.
+var (
+	ErrUnknownField          = validation.NewError("validation_unknown_field", "Unknown or invalid field.")
+	ErrInvalidFieldValue     = validation.NewError("validation_invalid_field_value", "Invalid field value.")
+	ErrMustBeSystemAndHidden = validation.NewError("validation_must_be_system_and_hidden", `The field must be marked as "System" and "Hidden".`)
+	ErrMustBeSystem          = validation.NewError("validation_must_be_system", `The field must be marked as "System".`)
+)
+
+// FieldFactoryFunc defines a simple function to construct a specific Field instance.
+type FieldFactoryFunc func() Field
+
+// Fields holds all available collection fields.
+var Fields = map[string]FieldFactoryFunc{}
+
+// Field defines a common interface that all Collection fields should implement.
+type Field interface {
+	// note: the getters has an explicit "Get" prefix to avoid conflicts with their related field members
+
+	// GetId returns the field id.
+	GetId() string
+
+	// SetId changes the field id.
+	SetId(id string)
+
+	// GetName returns the field name.
+	GetName() string
+
+	// SetName changes the field name.
+	SetName(name string)
+
+	// GetSystem returns the field system flag state.
+	GetSystem() bool
+
+	// SetSystem changes the field system flag state.
+	SetSystem(system bool)
+
+	// GetHidden returns the field hidden flag state.
+	GetHidden() bool
+
+	// SetHidden changes the field hidden flag state.
+	SetHidden(hidden bool)
+
+	// Type returns the unique type of the field.
+	Type() string
+
+	// ColumnType returns the DB column definition of the field.
+	ColumnType(app App) string
+
+	// PrepareValue returns a properly formatted field value based on the provided raw one.
+	//
+	// This method is also called on record construction to initialize its default field value.
+	PrepareValue(record *Record, raw any) (any, error)
+
+	// ValidateSettings validates the current field value associated with the provided record.
+	ValidateValue(ctx context.Context, app App, record *Record) error
+
+	// ValidateSettings validates the current field settings.
+	ValidateSettings(ctx context.Context, app App, collection *Collection) error
+}
+
+// MaxBodySizeCalculator defines an optional field interface for
+// specifying the max size of a field value.
+type MaxBodySizeCalculator interface {
+	// CalculateMaxBodySize returns the approximate max body size of a field value.
+	CalculateMaxBodySize() int64
+}
+
+type (
+	SetterFunc func(record *Record, raw any)
+
+	// SetterFinder defines a field interface for registering custom field value setters.
+	SetterFinder interface {
+		// FindSetter returns a single field value setter function
+		// by performing pattern-like field matching using the specified key.
+		//
+		// The key is usually just the field name but it could also
+		// contains "modifier" characters based on which you can perform custom set operations
+		// (ex. "users+" could be mapped to a function that will append new user to the existing field value).
+		//
+		// Return nil if you want to fallback to the default field value setter.
+		FindSetter(key string) SetterFunc
+	}
+)
+
+type (
+	GetterFunc func(record *Record) any
+
+	// GetterFinder defines a field interface for registering custom field value getters.
+	GetterFinder interface {
+		// FindGetter returns a single field value getter function
+		// by performing pattern-like field matching using the specified key.
+		//
+		// The key is usually just the field name but it could also
+		// contains "modifier" characters based on which you can perform custom get operations
+		// (ex. "description:excerpt" could be mapped to a function that will return an excerpt of the current field value).
+		//
+		// Return nil if you want to fallback to the default field value setter.
+		FindGetter(key string) GetterFunc
+	}
+)
+
+// DriverValuer defines a Field interface for exporting and formatting
+// a field value for the database.
+type DriverValuer interface {
+	// DriverValue exports a single field value for persistence in the database.
+	DriverValue(record *Record) (driver.Value, error)
+}
+
+// MultiValuer defines a field interface that every multi-valued (eg. with MaxSelect) field has.
+type MultiValuer interface {
+	// IsMultiple checks whether the field is configured to support multiple or single values.
+	IsMultiple() bool
+}
+
+// RecordInterceptor defines a field interface for reacting to various
+// Record related operations (create, delete, validate, etc.).
+type RecordInterceptor interface {
+	// Interceptor is invoked when a specific record action occurs
+	// allowing you to perform extra validations and normalization
+	// (ex. uploading or deleting files).
+	//
+	// Note that users must call actionFunc() manually if they want to
+	// execute the specific record action.
+	Intercept(
+		ctx context.Context,
+		app App,
+		record *Record,
+		actionName string,
+		actionFunc func() error,
+	) error
+}
+
+// DefaultFieldIdValidationRule performs base validation on a field id value.
+func DefaultFieldIdValidationRule(value any) error {
+	v, ok := value.(string)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	rules := []validation.Rule{
+		validation.Required,
+		validation.Length(1, 100),
+	}
+
+	for _, r := range rules {
+		if err := r.Validate(v); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// exclude special filter and system literals
+var excludeNames = append([]any{
+	/* SQLite:
+	"null", "true", "false", "_rowid_",
+	*/
+	"null", "true", "false", "ctid",
+}, list.ToInterfaceSlice(SystemDynamicFieldNames)...)
+
+// DefaultFieldIdValidationRule performs base validation on a field name value.
+func DefaultFieldNameValidationRule(value any) error {
+	v, ok := value.(string)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	rules := []validation.Rule{
+		validation.Required,
+		validation.Length(1, 100),
+		validation.Match(fieldNameRegex),
+		validation.NotIn(excludeNames...),
+		validation.By(checkForVia),
+	}
+
+	for _, r := range rules {
+		if err := r.Validate(v); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func checkForVia(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil
+	}
+
+	if strings.Contains(strings.ToLower(v), "_via_") {
+		return validation.NewError("validation_found_via", `The value cannot contain "_via_".`)
+	}
+
+	return nil
+}
+
+func noopSetter(record *Record, raw any) {
+	// do nothing
+}
diff --git a/server/core_backend-server/core/field_autodate.go b/server/core_backend-server/core/field_autodate.go
new file mode 100644
index 0000000..c3b8c77
--- /dev/null
+++ b/server/core_backend-server/core/field_autodate.go
@@ -0,0 +1,221 @@
+package core
+
+import (
+	"context"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func init() {
+	Fields[FieldTypeAutodate] = func() Field {
+		return &AutodateField{}
+	}
+}
+
+const FieldTypeAutodate = "autodate"
+
+// used to keep track of the last set autodate value
+const autodateLastKnownPrefix = internalCustomFieldKeyPrefix + "_last_autodate_"
+
+var (
+	_ Field             = (*AutodateField)(nil)
+	_ SetterFinder      = (*AutodateField)(nil)
+	_ RecordInterceptor = (*AutodateField)(nil)
+)
+
+// AutodateField defines an "autodate" type field, aka.
+// field which datetime value could be auto set on record create/update.
+//
+// This field is usually used for defining timestamp fields like "created" and "updated".
+//
+// Requires either both or at least one of the OnCreate or OnUpdate options to be set.
+type AutodateField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// OnCreate auto sets the current datetime as field value on record create.
+	OnCreate bool `form:"onCreate" json:"onCreate"`
+
+	// OnUpdate auto sets the current datetime as field value on record update.
+	OnUpdate bool `form:"onUpdate" json:"onUpdate"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *AutodateField) Type() string {
+	return FieldTypeAutodate
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *AutodateField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *AutodateField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *AutodateField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *AutodateField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *AutodateField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *AutodateField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *AutodateField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *AutodateField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *AutodateField) ColumnType(app App) string {
+	if IsMysql(app) {
+		return "VARCHAR(50) NOT NULL"
+	}
+	if IsPostgres(app) {
+		return "TIMESTAMP DEFAULT NOW() NOT NULL"
+	}
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *AutodateField) PrepareValue(record *Record, raw any) (any, error) {
+	val, _ := types.ParseDateTime(raw)
+	return val, nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *AutodateField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *AutodateField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	oldOnCreate := f.OnCreate
+	oldOnUpdate := f.OnUpdate
+
+	oldCollection, _ := app.FindCollectionByNameOrId(collection.Id)
+	if oldCollection != nil {
+		oldField, ok := oldCollection.Fields.GetById(f.Id).(*AutodateField)
+		if ok && oldField != nil {
+			oldOnCreate = oldField.OnCreate
+			oldOnUpdate = oldField.OnUpdate
+		}
+	}
+
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(
+			&f.OnCreate,
+			validation.When(f.System, validation.By(validators.Equal(oldOnCreate))),
+			validation.Required.Error("either onCreate or onUpdate must be enabled").When(!f.OnUpdate),
+		),
+		validation.Field(
+			&f.OnUpdate,
+			validation.When(f.System, validation.By(validators.Equal(oldOnUpdate))),
+			validation.Required.Error("either onCreate or onUpdate must be enabled").When(!f.OnCreate),
+		),
+	)
+}
+
+// FindSetter implements the [SetterFinder] interface.
+func (f *AutodateField) FindSetter(key string) SetterFunc {
+	switch key {
+	case f.Name:
+		// return noopSetter to disallow updating the value with record.Set()
+		return noopSetter
+	default:
+		return nil
+	}
+}
+
+// Intercept implements the [RecordInterceptor] interface.
+func (f *AutodateField) Intercept(
+	ctx context.Context,
+	app App,
+	record *Record,
+	actionName string,
+	actionFunc func() error,
+) error {
+	switch actionName {
+	case InterceptorActionCreateExecute:
+		// ignore if a date different from the old one was manually set with SetRaw
+		if f.OnCreate && record.GetDateTime(f.Name).Equal(f.getLastKnownValue(record)) {
+			now := types.NowDateTime()
+			record.SetRaw(f.Name, now)
+			record.SetRaw(autodateLastKnownPrefix+f.Name, now) // eagerly set so that it can be renewed on resave after failure
+		}
+
+		if err := actionFunc(); err != nil {
+			return err
+		}
+
+		record.SetRaw(autodateLastKnownPrefix+f.Name, record.GetRaw(f.Name))
+
+		return nil
+	case InterceptorActionUpdateExecute:
+		// ignore if a date different from the old one was manually set with SetRaw
+		if f.OnUpdate && record.GetDateTime(f.Name).Equal(f.getLastKnownValue(record)) {
+			now := types.NowDateTime()
+			record.SetRaw(f.Name, now)
+			record.SetRaw(autodateLastKnownPrefix+f.Name, now) // eagerly set so that it can be renewed on resave after failure
+		}
+
+		if err := actionFunc(); err != nil {
+			return err
+		}
+
+		record.SetRaw(autodateLastKnownPrefix+f.Name, record.GetRaw(f.Name))
+
+		return nil
+	default:
+		return actionFunc()
+	}
+}
+
+func (f *AutodateField) getLastKnownValue(record *Record) types.DateTime {
+	v := record.GetDateTime(autodateLastKnownPrefix + f.Name)
+	if !v.IsZero() {
+		return v
+	}
+
+	return record.Original().GetDateTime(f.Name)
+}
diff --git a/server/core_backend-server/core/field_autodate_test.go b/server/core_backend-server/core/field_autodate_test.go
new file mode 100644
index 0000000..73f768d
--- /dev/null
+++ b/server/core_backend-server/core/field_autodate_test.go
@@ -0,0 +1,445 @@
+package core_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestAutodateFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeAutodate)
+}
+
+func TestAutodateFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.AutodateField{}
+
+	/* SQLite:
+	expected := "TEXT DEFAULT '' NOT NULL"
+	*/
+	// PostgreSQL:
+	expected := "TIMESTAMP DEFAULT NOW() NOT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestAutodateFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.AutodateField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{"", ""},
+		{"invalid", ""},
+		{"2024-01-01 00:11:22.345Z", "2024-01-01 00:11:22.345Z"},
+		{time.Date(2024, 1, 2, 3, 4, 5, 0, time.UTC), "2024-01-02 03:04:05.000Z"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vDate, ok := v.(types.DateTime)
+			if !ok {
+				t.Fatalf("Expected types.DateTime instance, got %T", v)
+			}
+
+			if vDate.String() != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestAutodateFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.AutodateField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.AutodateField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			false,
+		},
+		{
+			"missing field value",
+			&core.AutodateField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("abc", true)
+				return record
+			},
+			false,
+		},
+		{
+			"existing field value",
+			&core.AutodateField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.NowDateTime())
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestAutodateFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeAutodate)
+	testDefaultFieldNameValidation(t, core.FieldTypeAutodate)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	superusers, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.AutodateField
+		expectErrors []string
+	}{
+		{
+			"empty onCreate and onUpdate",
+			func() *core.AutodateField {
+				return &core.AutodateField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{"onCreate", "onUpdate"},
+		},
+		{
+			"with onCreate",
+			func() *core.AutodateField {
+				return &core.AutodateField{
+					Id:       "test",
+					Name:     "test",
+					OnCreate: true,
+				}
+			},
+			[]string{},
+		},
+		{
+			"with onUpdate",
+			func() *core.AutodateField {
+				return &core.AutodateField{
+					Id:       "test",
+					Name:     "test",
+					OnUpdate: true,
+				}
+			},
+			[]string{},
+		},
+		{
+			"change of a system autodate field",
+			func() *core.AutodateField {
+				created := superusers.Fields.GetByName("created").(*core.AutodateField)
+				created.OnCreate = !created.OnCreate
+				created.OnUpdate = !created.OnUpdate
+				return created
+			},
+			[]string{"onCreate", "onUpdate"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := s.field().ValidateSettings(context.Background(), app, superusers)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestAutodateFieldFindSetter(t *testing.T) {
+	field := &core.AutodateField{Name: "test"}
+
+	collection := core.NewBaseCollection("test_collection")
+	collection.Fields.Add(field)
+
+	initialDate, err := types.ParseDateTime("2024-01-02 03:04:05.789Z")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record := core.NewRecord(collection)
+	record.SetRaw("test", initialDate)
+
+	t.Run("no matching setter", func(t *testing.T) {
+		f := field.FindSetter("abc")
+		if f != nil {
+			t.Fatal("Expected nil setter")
+		}
+	})
+
+	t.Run("matching setter", func(t *testing.T) {
+		f := field.FindSetter("test")
+		if f == nil {
+			t.Fatal("Expected non-nil setter")
+		}
+
+		f(record, types.NowDateTime()) // should be ignored
+
+		if v := record.GetString("test"); v != "2024-01-02 03:04:05.789Z" {
+			t.Fatalf("Expected no value change, got %q", v)
+		}
+	})
+}
+
+func cutMilliseconds(datetime string) string {
+	if len(datetime) > 19 {
+		return datetime[:19]
+	}
+	return datetime
+}
+
+func TestAutodateFieldIntercept(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	initialDate, err := types.ParseDateTime("2024-01-02 03:04:05.789Z")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name       string
+		actionName string
+		field      *core.AutodateField
+		record     func() *core.Record
+		expected   string
+	}{
+		{
+			"non-matching action",
+			"test",
+			&core.AutodateField{Name: "test", OnCreate: true, OnUpdate: true},
+			func() *core.Record {
+				return core.NewRecord(collection)
+			},
+			"",
+		},
+		{
+			"create with zero value (disabled onCreate)",
+			core.InterceptorActionCreateExecute,
+			&core.AutodateField{Name: "test", OnCreate: false, OnUpdate: true},
+			func() *core.Record {
+				return core.NewRecord(collection)
+			},
+			"",
+		},
+		{
+			"create with zero value",
+			core.InterceptorActionCreateExecute,
+			&core.AutodateField{Name: "test", OnCreate: true, OnUpdate: true},
+			func() *core.Record {
+				return core.NewRecord(collection)
+			},
+			"{NOW}",
+		},
+		{
+			"create with non-zero value",
+			core.InterceptorActionCreateExecute,
+			&core.AutodateField{Name: "test", OnCreate: true, OnUpdate: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", initialDate)
+				return record
+			},
+			initialDate.String(),
+		},
+		{
+			"update with zero value (disabled onUpdate)",
+			core.InterceptorActionUpdateExecute,
+			&core.AutodateField{Name: "test", OnCreate: true, OnUpdate: false},
+			func() *core.Record {
+				return core.NewRecord(collection)
+			},
+			"",
+		},
+		{
+			"update with zero value",
+			core.InterceptorActionUpdateExecute,
+			&core.AutodateField{Name: "test", OnCreate: true, OnUpdate: true},
+			func() *core.Record {
+				return core.NewRecord(collection)
+			},
+			"{NOW}",
+		},
+		{
+			"update with non-zero value",
+			core.InterceptorActionUpdateExecute,
+			&core.AutodateField{Name: "test", OnCreate: true, OnUpdate: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", initialDate)
+				return record
+			},
+			initialDate.String(),
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			actionCalls := 0
+			record := s.record()
+
+			now := types.NowDateTime().String()
+			err := s.field.Intercept(context.Background(), app, record, s.actionName, func() error {
+				actionCalls++
+				return nil
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if actionCalls != 1 {
+				t.Fatalf("Expected actionCalls %d, got %d", 1, actionCalls)
+			}
+
+			expected := cutMilliseconds(strings.ReplaceAll(s.expected, "{NOW}", now))
+
+			v := cutMilliseconds(record.GetString(s.field.GetName()))
+			if v != expected {
+				t.Fatalf("Expected value %q, got %q", expected, v)
+			}
+		})
+	}
+}
+
+func TestAutodateRecordResave(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record, err := app.FindRecordById(collection, "llvuca81nly1qls")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	lastUpdated := record.GetDateTime("updated")
+
+	// save with autogenerated date
+	err = app.Save(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	newUpdated := record.GetDateTime("updated")
+	if newUpdated.Equal(lastUpdated) {
+		t.Fatalf("[0] Expected updated to change, got %v", newUpdated)
+	}
+	lastUpdated = newUpdated
+
+	// save with custom date
+	manualUpdated := lastUpdated.Add(-1 * time.Minute)
+	record.SetRaw("updated", manualUpdated)
+	err = app.Save(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	newUpdated = record.GetDateTime("updated")
+	if !newUpdated.Equal(manualUpdated) {
+		t.Fatalf("[1] Expected updated to be the manual set date %v, got %v", manualUpdated, newUpdated)
+	}
+	lastUpdated = newUpdated
+
+	// save again with autogenerated date
+	err = app.Save(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	newUpdated = record.GetDateTime("updated")
+	if newUpdated.Equal(lastUpdated) {
+		t.Fatalf("[2] Expected updated to change, got %v", newUpdated)
+	}
+	lastUpdated = newUpdated
+
+	// simulate save failure
+	app.OnRecordUpdateExecute(collection.Id).Bind(&hook.Handler[*core.RecordEvent]{
+		Id: "test_failure",
+		Func: func(*core.RecordEvent) error {
+			return errors.New("test")
+		},
+		Priority: 9999999999, // as latest as possible
+	})
+
+	// save again with autogenerated date (should fail)
+	err = app.Save(record)
+	if err == nil {
+		t.Fatal("Expected save failure")
+	}
+
+	// updated should still be set even after save failure
+	newUpdated = record.GetDateTime("updated")
+	if newUpdated.Equal(lastUpdated) {
+		t.Fatalf("[3] Expected updated to change, got %v", newUpdated)
+	}
+	lastUpdated = newUpdated
+
+	// cleanup the error and resave again
+	app.OnRecordUpdateExecute(collection.Id).Unbind("test_failure")
+
+	err = app.Save(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	newUpdated = record.GetDateTime("updated")
+	if newUpdated.Equal(lastUpdated) {
+		t.Fatalf("[4] Expected updated to change, got %v", newUpdated)
+	}
+}
diff --git a/server/core_backend-server/core/field_bool.go b/server/core_backend-server/core/field_bool.go
new file mode 100644
index 0000000..7be98c2
--- /dev/null
+++ b/server/core_backend-server/core/field_bool.go
@@ -0,0 +1,124 @@
+package core
+
+import (
+	"context"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/spf13/cast"
+)
+
+func init() {
+	Fields[FieldTypeBool] = func() Field {
+		return &BoolField{}
+	}
+}
+
+const FieldTypeBool = "bool"
+
+var _ Field = (*BoolField)(nil)
+
+// BoolField defines "bool" type field to store a single true/false value.
+//
+// The respective zero record field value is false.
+type BoolField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// Required will require the field value to be always "true".
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *BoolField) Type() string {
+	return FieldTypeBool
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *BoolField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *BoolField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *BoolField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *BoolField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *BoolField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *BoolField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *BoolField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *BoolField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *BoolField) ColumnType(app App) string {
+	return "BOOLEAN DEFAULT FALSE NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *BoolField) PrepareValue(record *Record, raw any) (any, error) {
+	return cast.ToBool(raw), nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *BoolField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	v, ok := record.GetRaw(f.Name).(bool)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if f.Required {
+		return validation.Required.Validate(v)
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *BoolField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+	)
+}
diff --git a/server/core_backend-server/core/field_bool_test.go b/server/core_backend-server/core/field_bool_test.go
new file mode 100644
index 0000000..6706099
--- /dev/null
+++ b/server/core_backend-server/core/field_bool_test.go
@@ -0,0 +1,150 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestBoolFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeBool)
+}
+
+func TestBoolFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.BoolField{}
+
+	expected := "BOOLEAN DEFAULT FALSE NOT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestBoolFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.BoolField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected bool
+	}{
+		{"", false},
+		{"f", false},
+		{"t", true},
+		{1, true},
+		{0, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if v != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestBoolFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.BoolField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.BoolField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"missing field value (non-required)",
+			&core.BoolField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("abc", true)
+				return record
+			},
+			true, // because of failed nil.(bool) cast
+		},
+		{
+			"missing field value (required)",
+			&core.BoolField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("abc", true)
+				return record
+			},
+			true,
+		},
+		{
+			"false field value (non-required)",
+			&core.BoolField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", false)
+				return record
+			},
+			false,
+		},
+		{
+			"false field value (required)",
+			&core.BoolField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", false)
+				return record
+			},
+			true,
+		},
+		{
+			"true field value (required)",
+			&core.BoolField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", true)
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestBoolFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeBool)
+	testDefaultFieldNameValidation(t, core.FieldTypeBool)
+}
diff --git a/server/core_backend-server/core/field_date.go b/server/core_backend-server/core/field_date.go
new file mode 100644
index 0000000..922fb56
--- /dev/null
+++ b/server/core_backend-server/core/field_date.go
@@ -0,0 +1,180 @@
+package core
+
+import (
+	"context"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func init() {
+	Fields[FieldTypeDate] = func() Field {
+		return &DateField{}
+	}
+}
+
+const FieldTypeDate = "date"
+
+var _ Field = (*DateField)(nil)
+
+// DateField defines "date" type field to store a single [types.DateTime] value.
+//
+// The respective zero record field value is the zero [types.DateTime].
+type DateField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// Min specifies the min allowed field value.
+	//
+	// Leave it empty to skip the validator.
+	Min types.DateTime `form:"min" json:"min"`
+
+	// Max specifies the max allowed field value.
+	//
+	// Leave it empty to skip the validator.
+	Max types.DateTime `form:"max" json:"max"`
+
+	// Required will require the field value to be non-zero [types.DateTime].
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *DateField) Type() string {
+	return FieldTypeDate
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *DateField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *DateField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *DateField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *DateField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *DateField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *DateField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *DateField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *DateField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *DateField) ColumnType(app App) string {
+	if IsMysql(app) {
+		return "VARCHAR(50) DEFAULT '' NOT NULL"
+	}
+	if IsPostgres(app) {
+		return "TIMESTAMP" // Allow it to be nullable
+	}
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *DateField) PrepareValue(record *Record, raw any) (any, error) {
+	// ignore scan errors since the format may change between versions
+	// and to allow running db adjusting migrations
+	val, _ := types.ParseDateTime(raw)
+	return val, nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *DateField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	val, ok := record.GetRaw(f.Name).(types.DateTime)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if val.IsZero() {
+		if f.Required {
+			return validation.ErrRequired
+		}
+		return nil // nothing to check
+	}
+
+	if !f.Min.IsZero() {
+		if err := validation.Min(f.Min.Time()).Validate(val.Time()); err != nil {
+			return err
+		}
+	}
+
+	if !f.Max.IsZero() {
+		if err := validation.Max(f.Max.Time()).Validate(val.Time()); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *DateField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(&f.Max, validation.By(f.checkRange(f.Min, f.Max))),
+	)
+}
+
+func (f *DateField) checkRange(min types.DateTime, max types.DateTime) validation.RuleFunc {
+	return func(value any) error {
+		v, _ := value.(types.DateTime)
+		if v.IsZero() {
+			return nil // nothing to check
+		}
+
+		dr := validation.Date(types.DefaultDateLayout)
+
+		if !min.IsZero() {
+			dr.Min(min.Time())
+		}
+
+		if !max.IsZero() {
+			dr.Max(max.Time())
+		}
+
+		return dr.Validate(v.String())
+	}
+}
diff --git a/server/core_backend-server/core/field_date_test.go b/server/core_backend-server/core/field_date_test.go
new file mode 100644
index 0000000..057ffff
--- /dev/null
+++ b/server/core_backend-server/core/field_date_test.go
@@ -0,0 +1,233 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestDateFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeDate)
+}
+
+func TestDateFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.DateField{}
+
+	/* SQLite:
+	expected := "TEXT DEFAULT '' NOT NULL"
+	*/
+	// PostgreSQL:
+	expected := "TIMESTAMP"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestDateFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.DateField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{"", ""},
+		{"invalid", ""},
+		{"2024-01-01 00:11:22.345Z", "2024-01-01 00:11:22.345Z"},
+		{time.Date(2024, 1, 2, 3, 4, 5, 0, time.UTC), "2024-01-02 03:04:05.000Z"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vDate, ok := v.(types.DateTime)
+			if !ok {
+				t.Fatalf("Expected types.DateTime instance, got %T", v)
+			}
+
+			if vDate.String() != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestDateFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.DateField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.DateField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (not required)",
+			&core.DateField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.DateTime{})
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.DateField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.DateTime{})
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero field value (required)",
+			&core.DateField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.NowDateTime())
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestDateFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeDate)
+	testDefaultFieldNameValidation(t, core.FieldTypeDate)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.DateField
+		expectErrors []string
+	}{
+		{
+			"zero Min/Max",
+			func() *core.DateField {
+				return &core.DateField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"non-empty Min with empty Max",
+			func() *core.DateField {
+				return &core.DateField{
+					Id:   "test",
+					Name: "test",
+					Min:  types.NowDateTime(),
+				}
+			},
+			[]string{},
+		},
+		{
+			"empty Min non-empty Max",
+			func() *core.DateField {
+				return &core.DateField{
+					Id:   "test",
+					Name: "test",
+					Max:  types.NowDateTime(),
+				}
+			},
+			[]string{},
+		},
+		{
+			"Min = Max",
+			func() *core.DateField {
+				date := types.NowDateTime()
+				return &core.DateField{
+					Id:   "test",
+					Name: "test",
+					Min:  date,
+					Max:  date,
+				}
+			},
+			[]string{},
+		},
+		{
+			"Min > Max",
+			func() *core.DateField {
+				min := types.NowDateTime()
+				max := min.Add(-5 * time.Second)
+				return &core.DateField{
+					Id:   "test",
+					Name: "test",
+					Min:  min,
+					Max:  max,
+				}
+			},
+			[]string{},
+		},
+		{
+			"Min < Max",
+			func() *core.DateField {
+				max := types.NowDateTime()
+				min := max.Add(-5 * time.Second)
+				return &core.DateField{
+					Id:   "test",
+					Name: "test",
+					Min:  min,
+					Max:  max,
+				}
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := s.field().ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_editor.go b/server/core_backend-server/core/field_editor.go
new file mode 100644
index 0000000..9965561
--- /dev/null
+++ b/server/core_backend-server/core/field_editor.go
@@ -0,0 +1,165 @@
+package core
+
+import (
+	"context"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/spf13/cast"
+)
+
+func init() {
+	Fields[FieldTypeEditor] = func() Field {
+		return &EditorField{}
+	}
+}
+
+const FieldTypeEditor = "editor"
+
+const DefaultEditorFieldMaxSize int64 = 5 << 20
+
+var (
+	_ Field                 = (*EditorField)(nil)
+	_ MaxBodySizeCalculator = (*EditorField)(nil)
+)
+
+// EditorField defines "editor" type field to store HTML formatted text.
+//
+// The respective zero record field value is empty string.
+type EditorField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// MaxSize specifies the maximum size of the allowed field value (in bytes and up to 2^53-1).
+	//
+	// If zero, a default limit of ~5MB is applied.
+	MaxSize int64 `form:"maxSize" json:"maxSize"`
+
+	// ConvertURLs is usually used to instruct the editor whether to
+	// apply url conversion (eg. stripping the domain name in case the
+	// urls are using the same domain as the one where the editor is loaded).
+	//
+	// (see also https://www.tiny.cloud/docs/tinymce/6/url-handling/#convert_urls)
+	ConvertURLs bool `form:"convertURLs" json:"convertURLs"`
+
+	// Required will require the field value to be non-empty string.
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *EditorField) Type() string {
+	return FieldTypeEditor
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *EditorField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *EditorField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *EditorField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *EditorField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *EditorField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *EditorField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *EditorField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *EditorField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *EditorField) ColumnType(app App) string {
+	if IsMysql(app) {
+		return "TEXT"
+	}
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *EditorField) PrepareValue(record *Record, raw any) (any, error) {
+	return cast.ToString(raw), nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *EditorField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	val, ok := record.GetRaw(f.Name).(string)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if f.Required {
+		if err := validation.Required.Validate(val); err != nil {
+			return err
+		}
+	}
+
+	maxSize := f.CalculateMaxBodySize()
+
+	if int64(len(val)) > maxSize {
+		return validation.NewError(
+			"validation_content_size_limit",
+			"The maximum allowed content size is {{.maxSize}} bytes",
+		).SetParams(map[string]any{"maxSize": maxSize})
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *EditorField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(&f.MaxSize, validation.Min(0), validation.Max(maxSafeJSONInt)),
+	)
+}
+
+// CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+func (f *EditorField) CalculateMaxBodySize() int64 {
+	if f.MaxSize <= 0 {
+		return DefaultEditorFieldMaxSize
+	}
+
+	return f.MaxSize
+}
diff --git a/server/core_backend-server/core/field_editor_test.go b/server/core_backend-server/core/field_editor_test.go
new file mode 100644
index 0000000..8bcebcd
--- /dev/null
+++ b/server/core_backend-server/core/field_editor_test.go
@@ -0,0 +1,252 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestEditorFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeEditor)
+}
+
+func TestEditorFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.EditorField{}
+
+	expected := "TEXT DEFAULT '' NOT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestEditorFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.EditorField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{"", ""},
+		{"test", "test"},
+		{false, "false"},
+		{true, "true"},
+		{123.456, "123.456"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vStr, ok := v.(string)
+			if !ok {
+				t.Fatalf("Expected string instance, got %T", v)
+			}
+
+			if vStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestEditorFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.EditorField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.EditorField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (not required)",
+			&core.EditorField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.EditorField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero field value (required)",
+			&core.EditorField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc")
+				return record
+			},
+			false,
+		},
+		{
+			"> default MaxSize",
+			&core.EditorField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", strings.Repeat("a", 1+(5<<20)))
+				return record
+			},
+			true,
+		},
+		{
+			"> MaxSize",
+			&core.EditorField{Name: "test", Required: true, MaxSize: 5},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abcdef")
+				return record
+			},
+			true,
+		},
+		{
+			"<= MaxSize",
+			&core.EditorField{Name: "test", Required: true, MaxSize: 5},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abcde")
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestEditorFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeEditor)
+	testDefaultFieldNameValidation(t, core.FieldTypeEditor)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.EditorField
+		expectErrors []string
+	}{
+		{
+			"< 0 MaxSize",
+			func() *core.EditorField {
+				return &core.EditorField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: -1,
+				}
+			},
+			[]string{"maxSize"},
+		},
+		{
+			"= 0 MaxSize",
+			func() *core.EditorField {
+				return &core.EditorField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"> 0 MaxSize",
+			func() *core.EditorField {
+				return &core.EditorField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: 1,
+				}
+			},
+			[]string{},
+		},
+		{
+			"MaxSize > safe json int",
+			func() *core.EditorField {
+				return &core.EditorField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: 1 << 53,
+				}
+			},
+			[]string{"maxSize"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := s.field().ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestEditorFieldCalculateMaxBodySize(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	scenarios := []struct {
+		field    *core.EditorField
+		expected int64
+	}{
+		{&core.EditorField{}, core.DefaultEditorFieldMaxSize},
+		{&core.EditorField{MaxSize: 10}, 10},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%d", i, s.field.MaxSize), func(t *testing.T) {
+			result := s.field.CalculateMaxBodySize()
+
+			if result != s.expected {
+				t.Fatalf("Expected %d, got %d", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_email.go b/server/core_backend-server/core/field_email.go
new file mode 100644
index 0000000..9bbced9
--- /dev/null
+++ b/server/core_backend-server/core/field_email.go
@@ -0,0 +1,170 @@
+package core
+
+import (
+	"context"
+	"slices"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/spf13/cast"
+)
+
+func init() {
+	Fields[FieldTypeEmail] = func() Field {
+		return &EmailField{}
+	}
+}
+
+const FieldTypeEmail = "email"
+
+var _ Field = (*EmailField)(nil)
+
+// EmailField defines "email" type field for storing a single email string address.
+//
+// The respective zero record field value is empty string.
+type EmailField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// ExceptDomains will require the email domain to NOT be included in the listed ones.
+	//
+	// This validator can be set only if OnlyDomains is empty.
+	ExceptDomains []string `form:"exceptDomains" json:"exceptDomains"`
+
+	// OnlyDomains will require the email domain to be included in the listed ones.
+	//
+	// This validator can be set only if ExceptDomains is empty.
+	OnlyDomains []string `form:"onlyDomains" json:"onlyDomains"`
+
+	// Required will require the field value to be non-empty email string.
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *EmailField) Type() string {
+	return FieldTypeEmail
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *EmailField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *EmailField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *EmailField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *EmailField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *EmailField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *EmailField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *EmailField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *EmailField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *EmailField) ColumnType(app App) string {
+	if IsMysql(app) {
+		return "VARCHAR(255)"
+	}
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *EmailField) PrepareValue(record *Record, raw any) (any, error) {
+	return cast.ToString(raw), nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *EmailField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	val, ok := record.GetRaw(f.Name).(string)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if f.Required {
+		if err := validation.Required.Validate(val); err != nil {
+			return err
+		}
+	}
+
+	if val == "" {
+		return nil // nothing to check
+	}
+
+	if err := is.EmailFormat.Validate(val); err != nil {
+		return err
+	}
+
+	domain := val[strings.LastIndex(val, "@")+1:]
+
+	// only domains check
+	if len(f.OnlyDomains) > 0 && !slices.Contains(f.OnlyDomains, domain) {
+		return validation.NewError("validation_email_domain_not_allowed", "Email domain is not allowed")
+	}
+
+	// except domains check
+	if len(f.ExceptDomains) > 0 && slices.Contains(f.ExceptDomains, domain) {
+		return validation.NewError("validation_email_domain_not_allowed", "Email domain is not allowed")
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *EmailField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(
+			&f.ExceptDomains,
+			validation.When(len(f.OnlyDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
+		),
+		validation.Field(
+			&f.OnlyDomains,
+			validation.When(len(f.ExceptDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
+		),
+	)
+}
diff --git a/server/core_backend-server/core/field_email_test.go b/server/core_backend-server/core/field_email_test.go
new file mode 100644
index 0000000..600f2c2
--- /dev/null
+++ b/server/core_backend-server/core/field_email_test.go
@@ -0,0 +1,271 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestEmailFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeEmail)
+}
+
+func TestEmailFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.EmailField{}
+
+	expected := "TEXT DEFAULT '' NOT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestEmailFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.EmailField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{"", ""},
+		{"test", "test"},
+		{false, "false"},
+		{true, "true"},
+		{123.456, "123.456"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vStr, ok := v.(string)
+			if !ok {
+				t.Fatalf("Expected string instance, got %T", v)
+			}
+
+			if vStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestEmailFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.EmailField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.EmailField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (not required)",
+			&core.EmailField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.EmailField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero field value (required)",
+			&core.EmailField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "test@example.com")
+				return record
+			},
+			false,
+		},
+		{
+			"invalid email",
+			&core.EmailField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "invalid")
+				return record
+			},
+			true,
+		},
+		{
+			"failed onlyDomains",
+			&core.EmailField{Name: "test", OnlyDomains: []string{"example.org", "example.net"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "test@example.com")
+				return record
+			},
+			true,
+		},
+		{
+			"success onlyDomains",
+			&core.EmailField{Name: "test", OnlyDomains: []string{"example.org", "example.com"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "test@example.com")
+				return record
+			},
+			false,
+		},
+		{
+			"failed exceptDomains",
+			&core.EmailField{Name: "test", ExceptDomains: []string{"example.org", "example.com"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "test@example.com")
+				return record
+			},
+			true,
+		},
+		{
+			"success exceptDomains",
+			&core.EmailField{Name: "test", ExceptDomains: []string{"example.org", "example.net"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "test@example.com")
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestEmailFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeEmail)
+	testDefaultFieldNameValidation(t, core.FieldTypeEmail)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.EmailField
+		expectErrors []string
+	}{
+		{
+			"zero minimal",
+			func() *core.EmailField {
+				return &core.EmailField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"both onlyDomains and exceptDomains",
+			func() *core.EmailField {
+				return &core.EmailField{
+					Id:            "test",
+					Name:          "test",
+					OnlyDomains:   []string{"example.com"},
+					ExceptDomains: []string{"example.org"},
+				}
+			},
+			[]string{"onlyDomains", "exceptDomains"},
+		},
+		{
+			"invalid onlyDomains",
+			func() *core.EmailField {
+				return &core.EmailField{
+					Id:          "test",
+					Name:        "test",
+					OnlyDomains: []string{"example.com", "invalid"},
+				}
+			},
+			[]string{"onlyDomains"},
+		},
+		{
+			"valid onlyDomains",
+			func() *core.EmailField {
+				return &core.EmailField{
+					Id:          "test",
+					Name:        "test",
+					OnlyDomains: []string{"example.com", "example.org"},
+				}
+			},
+			[]string{},
+		},
+		{
+			"invalid exceptDomains",
+			func() *core.EmailField {
+				return &core.EmailField{
+					Id:            "test",
+					Name:          "test",
+					ExceptDomains: []string{"example.com", "invalid"},
+				}
+			},
+			[]string{"exceptDomains"},
+		},
+		{
+			"valid exceptDomains",
+			func() *core.EmailField {
+				return &core.EmailField{
+					Id:            "test",
+					Name:          "test",
+					ExceptDomains: []string{"example.com", "example.org"},
+				}
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := s.field().ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_file.go b/server/core_backend-server/core/field_file.go
new file mode 100644
index 0000000..0aff60e
--- /dev/null
+++ b/server/core_backend-server/core/field_file.go
@@ -0,0 +1,830 @@
+package core
+
+import (
+	"context"
+	"database/sql/driver"
+	"errors"
+	"fmt"
+	"log"
+	"regexp"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+func init() {
+	Fields[FieldTypeFile] = func() Field {
+		return &FileField{}
+	}
+}
+
+const FieldTypeFile = "file"
+
+const DefaultFileFieldMaxSize int64 = 5 << 20
+
+var looseFilenameRegex = regexp.MustCompile(`^[^\./\\][^/\\]+$`)
+
+const (
+	deletedFilesPrefix  = internalCustomFieldKeyPrefix + "_deletedFilesPrefix_"
+	uploadedFilesPrefix = internalCustomFieldKeyPrefix + "_uploadedFilesPrefix_"
+)
+
+var (
+	_ Field                 = (*FileField)(nil)
+	_ MultiValuer           = (*FileField)(nil)
+	_ DriverValuer          = (*FileField)(nil)
+	_ GetterFinder          = (*FileField)(nil)
+	_ SetterFinder          = (*FileField)(nil)
+	_ RecordInterceptor     = (*FileField)(nil)
+	_ MaxBodySizeCalculator = (*FileField)(nil)
+)
+
+// FileField defines "file" type field for managing record file(s).
+//
+// Only the file name is stored as part of the record value.
+// New files (aka. files to upload) are expected to be of *filesytem.File.
+//
+// If MaxSelect is not set or <= 1, then the field value is expected to be a single record id.
+//
+// If MaxSelect is > 1, then the field value is expected to be a slice of record ids.
+//
+// The respective zero record field value is either empty string (single) or empty string slice (multiple).
+//
+// ---
+//
+// The following additional setter keys are available:
+//
+//   - "fieldName+" - append one or more files to the existing record one. For example:
+//
+//     // []string{"old1.txt", "old2.txt", "new1_ajkvass.txt", "new2_klhfnwd.txt"}
+//     record.Set("documents+", []*filesystem.File{new1, new2})
+//
+//   - "+fieldName" - prepend one or more files to the existing record one. For example:
+//
+//     // []string{"new1_ajkvass.txt", "new2_klhfnwd.txt", "old1.txt", "old2.txt",}
+//     record.Set("+documents", []*filesystem.File{new1, new2})
+//
+//   - "fieldName-" - subtract/delete one or more files from the existing record one. For example:
+//
+//     // []string{"old2.txt",}
+//     record.Set("documents-", "old1.txt")
+type FileField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// MaxSize specifies the maximum size of a single uploaded file (in bytes and up to 2^53-1).
+	//
+	// If zero, a default limit of 5MB is applied.
+	MaxSize int64 `form:"maxSize" json:"maxSize"`
+
+	// MaxSelect specifies the max allowed files.
+	//
+	// For multiple files the value must be > 1, otherwise fallbacks to single (default).
+	MaxSelect int `form:"maxSelect" json:"maxSelect"`
+
+	// MimeTypes specifies an optional list of the allowed file mime types.
+	//
+	// Leave it empty to disable the validator.
+	MimeTypes []string `form:"mimeTypes" json:"mimeTypes"`
+
+	// Thumbs specifies an optional list of the supported thumbs for image based files.
+	//
+	// Each entry must be in one of the following formats:
+	//
+	//   - WxH  (eg. 100x300) - crop to WxH viewbox (from center)
+	//   - WxHt (eg. 100x300t) - crop to WxH viewbox (from top)
+	//   - WxHb (eg. 100x300b) - crop to WxH viewbox (from bottom)
+	//   - WxHf (eg. 100x300f) - fit inside a WxH viewbox (without cropping)
+	//   - 0xH  (eg. 0x300)    - resize to H height preserving the aspect ratio
+	//   - Wx0  (eg. 100x0)    - resize to W width preserving the aspect ratio
+	Thumbs []string `form:"thumbs" json:"thumbs"`
+
+	// Protected will require the users to provide a special file token to access the file.
+	//
+	// Note that by default all files are publicly accessible.
+	//
+	// For the majority of the cases this is fine because by default
+	// all file names have random part appended to their name which
+	// need to be known by the user before accessing the file.
+	Protected bool `form:"protected" json:"protected"`
+
+	// Required will require the field value to have at least one file.
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *FileField) Type() string {
+	return FieldTypeFile
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *FileField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *FileField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *FileField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *FileField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *FileField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *FileField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *FileField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *FileField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// IsMultiple implements MultiValuer interface and checks whether the
+// current field options support multiple values.
+func (f *FileField) IsMultiple() bool {
+	return f.MaxSelect > 1
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *FileField) ColumnType(app App) string {
+	if f.IsMultiple() {
+		if IsMysql(app) {
+			return "JSON"
+		}
+		if IsPostgres(app) {
+			return "JSONB DEFAULT '[]' NOT NULL"
+		}
+		return "JSON DEFAULT '[]' NOT NULL"
+	}
+
+	if IsMysql(app) {
+		return "TEXT"
+	}
+
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *FileField) PrepareValue(record *Record, raw any) (any, error) {
+	return f.normalizeValue(raw), nil
+}
+
+// DriverValue implements the [DriverValuer] interface.
+func (f *FileField) DriverValue(record *Record) (driver.Value, error) {
+	files := f.toSliceValue(record.GetRaw(f.Name))
+
+	if f.IsMultiple() {
+		ja := make(types.JSONArray[string], len(files))
+		for i, v := range files {
+			ja[i] = f.getFileName(v)
+		}
+		return ja, nil
+	}
+
+	if len(files) == 0 {
+		return "", nil
+	}
+
+	return f.getFileName(files[len(files)-1]), nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *FileField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(&f.MaxSelect, validation.Min(0), validation.Max(maxSafeJSONInt)),
+		validation.Field(&f.MaxSize, validation.Min(0), validation.Max(maxSafeJSONInt)),
+		validation.Field(&f.Thumbs, validation.Each(
+			validation.NotIn("0x0", "0x0t", "0x0b", "0x0f"),
+			validation.Match(filesystem.ThumbSizeRegex),
+		)),
+	)
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *FileField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	files := f.toSliceValue(record.GetRaw(f.Name))
+	if len(files) == 0 {
+		if f.Required {
+			return validation.ErrRequired
+		}
+		return nil // nothing to check
+	}
+
+	// validate existing and disallow new plain string filenames submission
+	// (new files must be *filesystem.File)
+	// ---
+	oldExistingStrings := f.toSliceValue(f.getLatestOldValue(app, record))
+	existingStrings := list.ToInterfaceSlice(f.extractPlainStrings(files))
+	addedStrings := f.excludeFiles(existingStrings, oldExistingStrings)
+
+	if len(addedStrings) > 0 {
+		invalidFiles := make([]string, len(addedStrings))
+		for i, invalid := range addedStrings {
+			invalidStr := cast.ToString(invalid)
+			if len(invalidStr) > 250 {
+				invalidStr = invalidStr[:250]
+			}
+			invalidFiles[i] = invalidStr
+		}
+
+		return validation.NewError("validation_invalid_file", "Invalid new files: {{.invalidFiles}}.").
+			SetParams(map[string]any{"invalidFiles": invalidFiles})
+	}
+
+	maxSelect := f.maxSelect()
+	if len(files) > maxSelect {
+		return validation.NewError("validation_too_many_files", "The maximum allowed files is {{.maxSelect}}").
+			SetParams(map[string]any{"maxSelect": maxSelect})
+	}
+
+	// validate uploaded
+	// ---
+	uploads := f.extractUploadableFiles(files)
+	for _, upload := range uploads {
+		// loosely check the filename just in case it was manually changed after the normalization
+		err := validation.Length(1, 150).Validate(upload.Name)
+		if err != nil {
+			return err
+		}
+		err = validation.Match(looseFilenameRegex).Validate(upload.Name)
+		if err != nil {
+			return err
+		}
+
+		// check size
+		err = validators.UploadedFileSize(f.maxSize())(upload)
+		if err != nil {
+			return err
+		}
+
+		// check type
+		if len(f.MimeTypes) > 0 {
+			err = validators.UploadedFileMimeType(f.MimeTypes)(upload)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (f *FileField) maxSize() int64 {
+	if f.MaxSize <= 0 {
+		return DefaultFileFieldMaxSize
+	}
+
+	return f.MaxSize
+}
+
+func (f *FileField) maxSelect() int {
+	if f.MaxSelect <= 1 {
+		return 1
+	}
+
+	return f.MaxSelect
+}
+
+// CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+func (f *FileField) CalculateMaxBodySize() int64 {
+	return f.maxSize() * int64(f.maxSelect())
+}
+
+// Interceptors
+// -------------------------------------------------------------------
+
+// Intercept implements the [RecordInterceptor] interface.
+//
+// note: files delete after records deletion is handled globally by the app FileManager hook
+func (f *FileField) Intercept(
+	ctx context.Context,
+	app App,
+	record *Record,
+	actionName string,
+	actionFunc func() error,
+) error {
+	switch actionName {
+	case InterceptorActionCreateExecute, InterceptorActionUpdateExecute:
+		oldValue := f.getLatestOldValue(app, record)
+
+		err := f.processFilesToUpload(ctx, app, record)
+		if err != nil {
+			return err
+		}
+
+		err = actionFunc()
+		if err != nil {
+			return errors.Join(err, f.afterRecordExecuteFailure(newContextIfInvalid(ctx), app, record))
+		}
+
+		f.rememberFilesToDelete(app, record, oldValue)
+
+		f.afterRecordExecuteSuccess(newContextIfInvalid(ctx), app, record)
+
+		return nil
+	case InterceptorActionAfterCreateError, InterceptorActionAfterUpdateError:
+		// when in transaction we assume that the error was handled by afterRecordExecuteFailure
+		if app.IsTransactional() {
+			return actionFunc()
+		}
+
+		failedToDelete, deleteErr := f.deleteNewlyUploadedFiles(newContextIfInvalid(ctx), app, record)
+		if deleteErr != nil {
+			app.Logger().Warn(
+				"Failed to cleanup all new files after record commit failure",
+				"error", deleteErr,
+				"failedToDelete", failedToDelete,
+			)
+		}
+
+		record.SetRaw(deletedFilesPrefix+f.Name, nil)
+
+		if record.IsNew() {
+			// try to delete the record directory if there are no other files
+			//
+			// note: executed only on create failure to avoid accidentally
+			// deleting a concurrently updating directory due to the
+			// eventual consistent nature of some storage providers
+			err := f.deleteEmptyRecordDir(newContextIfInvalid(ctx), app, record)
+			if err != nil {
+				app.Logger().Warn("Failed to delete empty dir after new record commit failure", "error", err)
+			}
+		}
+
+		return actionFunc()
+	case InterceptorActionAfterCreate, InterceptorActionAfterUpdate:
+		record.SetRaw(uploadedFilesPrefix+f.Name, nil)
+
+		err := f.processFilesToDelete(ctx, app, record)
+		if err != nil {
+			return err
+		}
+
+		return actionFunc()
+	default:
+		return actionFunc()
+	}
+}
+func (f *FileField) getLatestOldValue(app App, record *Record) any {
+	if !record.IsNew() {
+		latestOriginal, err := app.FindRecordById(record.Collection(), cast.ToString(record.LastSavedPK()))
+		if err == nil {
+			return latestOriginal.GetRaw(f.Name)
+		}
+	}
+
+	return record.Original().GetRaw(f.Name)
+}
+
+func (f *FileField) afterRecordExecuteSuccess(ctx context.Context, app App, record *Record) {
+	uploaded, _ := record.GetRaw(uploadedFilesPrefix + f.Name).([]*filesystem.File)
+
+	// replace the uploaded file objects with their plain string names
+	newValue := f.toSliceValue(record.GetRaw(f.Name))
+	for i, v := range newValue {
+		if file, ok := v.(*filesystem.File); ok {
+			uploaded = append(uploaded, file)
+			newValue[i] = file.Name
+		}
+	}
+	f.setValue(record, newValue)
+
+	record.SetRaw(uploadedFilesPrefix+f.Name, uploaded)
+}
+
+func (f *FileField) afterRecordExecuteFailure(ctx context.Context, app App, record *Record) error {
+	uploaded := f.extractUploadableFiles(f.toSliceValue(record.GetRaw(f.Name)))
+
+	toDelete := make([]string, len(uploaded))
+	for i, file := range uploaded {
+		toDelete[i] = file.Name
+	}
+
+	// delete previously uploaded files
+	failedToDelete, deleteErr := f.deleteFilesByNamesList(ctx, app, record, list.ToUniqueStringSlice(toDelete))
+
+	if len(failedToDelete) > 0 {
+		app.Logger().Warn(
+			"Failed to cleanup the new uploaded file after record db write failure",
+			"error", deleteErr,
+			"failedToDelete", failedToDelete,
+		)
+	}
+
+	return deleteErr
+}
+
+func (f *FileField) deleteEmptyRecordDir(ctx context.Context, app App, record *Record) error {
+	fsys, err := app.NewFilesystem()
+	if err != nil {
+		return err
+	}
+	defer fsys.Close()
+	fsys.SetContext(newContextIfInvalid(ctx))
+
+	dir := record.BaseFilesPath()
+
+	if !fsys.IsEmptyDir(dir) {
+		return nil // no-op
+	}
+
+	err = fsys.Delete(dir)
+	if err != nil && !errors.Is(err, filesystem.ErrNotFound) {
+		return err
+	}
+
+	return nil
+}
+
+func (f *FileField) processFilesToDelete(ctx context.Context, app App, record *Record) error {
+	markedForDelete, _ := record.GetRaw(deletedFilesPrefix + f.Name).([]string)
+	if len(markedForDelete) == 0 {
+		return nil
+	}
+
+	old := list.ToInterfaceSlice(markedForDelete)
+	new := list.ToInterfaceSlice(f.extractPlainStrings(f.toSliceValue(record.GetRaw(f.Name))))
+	diff := f.excludeFiles(old, new)
+
+	toDelete := make([]string, len(diff))
+	for i, del := range diff {
+		toDelete[i] = f.getFileName(del)
+	}
+
+	failedToDelete, err := f.deleteFilesByNamesList(ctx, app, record, list.ToUniqueStringSlice(toDelete))
+
+	record.SetRaw(deletedFilesPrefix+f.Name, failedToDelete)
+
+	return err
+}
+
+func (f *FileField) rememberFilesToDelete(app App, record *Record, oldValue any) {
+	old := list.ToInterfaceSlice(f.extractPlainStrings(f.toSliceValue(oldValue)))
+	new := list.ToInterfaceSlice(f.extractPlainStrings(f.toSliceValue(record.GetRaw(f.Name))))
+	diff := f.excludeFiles(old, new)
+
+	toDelete, _ := record.GetRaw(deletedFilesPrefix + f.Name).([]string)
+
+	for _, del := range diff {
+		toDelete = append(toDelete, f.getFileName(del))
+	}
+
+	record.SetRaw(deletedFilesPrefix+f.Name, toDelete)
+}
+
+func (f *FileField) processFilesToUpload(ctx context.Context, app App, record *Record) error {
+	uploads := f.extractUploadableFiles(f.toSliceValue(record.GetRaw(f.Name)))
+	if len(uploads) == 0 {
+		return nil
+	}
+
+	if record.Id == "" {
+		return errors.New("uploading files requires the record to have a valid nonempty id")
+	}
+
+	fsys, err := app.NewFilesystem()
+	if err != nil {
+		return err
+	}
+	defer fsys.Close()
+	fsys.SetContext(ctx)
+
+	var failed []error     // list of upload errors
+	var succeeded []string // list of uploaded file names
+
+	for _, upload := range uploads {
+		path := record.BaseFilesPath() + "/" + upload.Name
+		if err := fsys.UploadFile(upload, path); err == nil {
+			succeeded = append(succeeded, upload.Name)
+		} else {
+			failed = append(failed, fmt.Errorf("%q: %w", upload.Name, err))
+			break // for now stop on the first error since we currently don't allow partial uploads
+		}
+	}
+
+	if len(failed) > 0 {
+		// cleanup - try to delete the successfully uploaded files (if any)
+		_, cleanupErr := f.deleteFilesByNamesList(newContextIfInvalid(ctx), app, record, succeeded)
+
+		failed = append(failed, cleanupErr)
+
+		return fmt.Errorf("failed to upload all files: %w", errors.Join(failed...))
+	}
+
+	return nil
+}
+
+func (f *FileField) deleteNewlyUploadedFiles(ctx context.Context, app App, record *Record) ([]string, error) {
+	uploaded, _ := record.GetRaw(uploadedFilesPrefix + f.Name).([]*filesystem.File)
+	if len(uploaded) == 0 {
+		return nil, nil
+	}
+
+	names := make([]string, len(uploaded))
+	for i, file := range uploaded {
+		names[i] = file.Name
+	}
+
+	failed, err := f.deleteFilesByNamesList(ctx, app, record, list.ToUniqueStringSlice(names))
+	if err != nil {
+		return failed, err
+	}
+
+	record.SetRaw(uploadedFilesPrefix+f.Name, nil)
+
+	return nil, nil
+}
+
+// deleteFiles deletes a list of record files by their names.
+// Returns the failed/remaining files.
+func (f *FileField) deleteFilesByNamesList(ctx context.Context, app App, record *Record, filenames []string) ([]string, error) {
+	if len(filenames) == 0 {
+		return nil, nil // nothing to delete
+	}
+
+	if record.Id == "" {
+		return filenames, errors.New("the record doesn't have an id")
+	}
+
+	fsys, err := app.NewFilesystem()
+	if err != nil {
+		return filenames, err
+	}
+	defer fsys.Close()
+	fsys.SetContext(ctx)
+
+	var failures []error
+
+	for i := len(filenames) - 1; i >= 0; i-- {
+		filename := filenames[i]
+		if filename == "" || strings.ContainsAny(filename, "/\\") {
+			continue // empty or not a plain filename
+		}
+
+		path := record.BaseFilesPath() + "/" + filename
+
+		err := fsys.Delete(path)
+		if err != nil && !errors.Is(err, filesystem.ErrNotFound) {
+			// store the delete error
+			failures = append(failures, fmt.Errorf("file %d (%q): %w", i, filename, err))
+		} else {
+			// remove the deleted file from the list
+			filenames = append(filenames[:i], filenames[i+1:]...)
+
+			// try to delete the related file thumbs (if any)
+			thumbsErr := fsys.DeletePrefix(record.BaseFilesPath() + "/thumbs_" + filename + "/")
+			if len(thumbsErr) > 0 {
+				app.Logger().Warn("Failed to delete file thumbs", "error", errors.Join(thumbsErr...))
+			}
+		}
+	}
+
+	if len(failures) > 0 {
+		return filenames, fmt.Errorf("failed to delete all files: %w", errors.Join(failures...))
+	}
+
+	return nil, nil
+}
+
+// newContextIfInvalid returns a new Background context if the provided one was cancelled.
+func newContextIfInvalid(ctx context.Context) context.Context {
+	if ctx.Err() == nil {
+		return ctx
+	}
+
+	return context.Background()
+}
+
+// -------------------------------------------------------------------
+
+// FindGetter implements the [GetterFinder] interface.
+func (f *FileField) FindGetter(key string) GetterFunc {
+	switch key {
+	case f.Name:
+		return func(record *Record) any {
+			return record.GetRaw(f.Name)
+		}
+	case f.Name + ":unsaved":
+		return func(record *Record) any {
+			return f.extractUploadableFiles(f.toSliceValue(record.GetRaw(f.Name)))
+		}
+	case f.Name + ":uploaded":
+		// deprecated
+		log.Println("[file field getter] please replace :uploaded with :unsaved")
+		return func(record *Record) any {
+			return f.extractUploadableFiles(f.toSliceValue(record.GetRaw(f.Name)))
+		}
+	default:
+		return nil
+	}
+}
+
+// -------------------------------------------------------------------
+
+// FindSetter implements the [SetterFinder] interface.
+func (f *FileField) FindSetter(key string) SetterFunc {
+	switch key {
+	case f.Name:
+		return f.setValue
+	case "+" + f.Name:
+		return f.prependValue
+	case f.Name + "+":
+		return f.appendValue
+	case f.Name + "-":
+		return f.subtractValue
+	default:
+		return nil
+	}
+}
+
+func (f *FileField) setValue(record *Record, raw any) {
+	val := f.normalizeValue(raw)
+
+	record.SetRaw(f.Name, val)
+}
+
+func (f *FileField) prependValue(record *Record, toPrepend any) {
+	files := f.toSliceValue(record.GetRaw(f.Name))
+	prepends := f.toSliceValue(toPrepend)
+
+	if len(prepends) > 0 {
+		files = append(prepends, files...)
+	}
+
+	f.setValue(record, files)
+}
+
+func (f *FileField) appendValue(record *Record, toAppend any) {
+	files := f.toSliceValue(record.GetRaw(f.Name))
+	appends := f.toSliceValue(toAppend)
+
+	if len(appends) > 0 {
+		files = append(files, appends...)
+	}
+
+	f.setValue(record, files)
+}
+
+func (f *FileField) subtractValue(record *Record, toRemove any) {
+	files := f.excludeFiles(
+		f.toSliceValue(record.GetRaw(f.Name)),
+		f.toSliceValue(toRemove),
+	)
+
+	f.setValue(record, files)
+}
+
+func (f *FileField) normalizeValue(raw any) any {
+	files := f.toSliceValue(raw)
+
+	if f.IsMultiple() {
+		return files
+	}
+
+	if len(files) > 0 {
+		return files[len(files)-1] // the last selected
+	}
+
+	return ""
+}
+
+func (f *FileField) toSliceValue(raw any) []any {
+	var result []any
+
+	switch value := raw.(type) {
+	case nil:
+		// nothing to cast
+	case *filesystem.File:
+		result = append(result, value)
+	case filesystem.File:
+		result = append(result, &value)
+	case []*filesystem.File:
+		for _, v := range value {
+			result = append(result, v)
+		}
+	case []filesystem.File:
+		for _, v := range value {
+			result = append(result, &v)
+		}
+	case []any:
+		for _, v := range value {
+			casted := f.toSliceValue(v)
+			if len(casted) == 1 {
+				result = append(result, casted[0])
+			}
+		}
+	default:
+		result = list.ToInterfaceSlice(list.ToUniqueStringSlice(value))
+	}
+
+	return f.uniqueFiles(result)
+}
+
+func (f *FileField) uniqueFiles(files []any) []any {
+	found := make(map[string]struct{}, len(files))
+	result := make([]any, 0, len(files))
+
+	for _, fv := range files {
+		name := f.getFileName(fv)
+		if _, ok := found[name]; !ok {
+			result = append(result, fv)
+			found[name] = struct{}{}
+		}
+	}
+
+	return result
+}
+
+func (f *FileField) extractPlainStrings(files []any) []string {
+	result := []string{}
+
+	for _, raw := range files {
+		if f, ok := raw.(string); ok {
+			result = append(result, f)
+		}
+	}
+
+	return result
+}
+
+func (f *FileField) extractUploadableFiles(files []any) []*filesystem.File {
+	result := []*filesystem.File{}
+
+	for _, raw := range files {
+		if upload, ok := raw.(*filesystem.File); ok {
+			result = append(result, upload)
+		}
+	}
+
+	return result
+}
+
+func (f *FileField) excludeFiles(base []any, toExclude []any) []any {
+	result := make([]any, 0, len(base))
+
+SUBTRACT_LOOP:
+	for _, fv := range base {
+		for _, exclude := range toExclude {
+			if f.getFileName(exclude) == f.getFileName(fv) {
+				continue SUBTRACT_LOOP // skip
+			}
+		}
+
+		result = append(result, fv)
+	}
+
+	return result
+}
+
+func (f *FileField) getFileName(file any) string {
+	switch v := file.(type) {
+	case string:
+		return v
+	case *filesystem.File:
+		return v.Name
+	default:
+		return ""
+	}
+}
diff --git a/server/core_backend-server/core/field_file_test.go b/server/core_backend-server/core/field_file_test.go
new file mode 100644
index 0000000..8bee8f5
--- /dev/null
+++ b/server/core_backend-server/core/field_file_test.go
@@ -0,0 +1,1156 @@
+package core_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestFileFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeFile)
+}
+
+func TestFileFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name     string
+		field    *core.FileField
+		expected string
+	}{
+		{
+			"single (zero)",
+			&core.FileField{},
+			"TEXT DEFAULT '' NOT NULL",
+		},
+		{
+			"single",
+			&core.FileField{MaxSelect: 1},
+			"TEXT DEFAULT '' NOT NULL",
+		},
+		{
+			"multiple",
+			&core.FileField{MaxSelect: 2},
+			/* SQLite:
+			"JSON DEFAULT '[]' NOT NULL",
+			*/
+			// PostgreSQL:
+			"JSONB DEFAULT '[]' NOT NULL",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			if v := s.field.ColumnType(app); v != s.expected {
+				t.Fatalf("Expected\n%q\ngot\n%q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestFileFieldIsMultiple(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		field    *core.FileField
+		expected bool
+	}{
+		{
+			"zero",
+			&core.FileField{},
+			false,
+		},
+		{
+			"single",
+			&core.FileField{MaxSelect: 1},
+			false,
+		},
+		{
+			"multiple",
+			&core.FileField{MaxSelect: 2},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			if v := s.field.IsMultiple(); v != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestFileFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test"), "test1.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f1Raw, err := json.Marshal(f1)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		raw      any
+		field    *core.FileField
+		expected string
+	}{
+		// single
+		{nil, &core.FileField{MaxSelect: 1}, `""`},
+		{"", &core.FileField{MaxSelect: 1}, `""`},
+		{123, &core.FileField{MaxSelect: 1}, `"123"`},
+		{"a", &core.FileField{MaxSelect: 1}, `"a"`},
+		{`["a"]`, &core.FileField{MaxSelect: 1}, `"a"`},
+		{*f1, &core.FileField{MaxSelect: 1}, string(f1Raw)},
+		{f1, &core.FileField{MaxSelect: 1}, string(f1Raw)},
+		{[]string{}, &core.FileField{MaxSelect: 1}, `""`},
+		{[]string{"a", "b"}, &core.FileField{MaxSelect: 1}, `"b"`},
+
+		// multiple
+		{nil, &core.FileField{MaxSelect: 2}, `[]`},
+		{"", &core.FileField{MaxSelect: 2}, `[]`},
+		{123, &core.FileField{MaxSelect: 2}, `["123"]`},
+		{"a", &core.FileField{MaxSelect: 2}, `["a"]`},
+		{`["a"]`, &core.FileField{MaxSelect: 2}, `["a"]`},
+		{[]any{f1}, &core.FileField{MaxSelect: 2}, `[` + string(f1Raw) + `]`},
+		{[]*filesystem.File{f1}, &core.FileField{MaxSelect: 2}, `[` + string(f1Raw) + `]`},
+		{[]filesystem.File{*f1}, &core.FileField{MaxSelect: 2}, `[` + string(f1Raw) + `]`},
+		{[]string{}, &core.FileField{MaxSelect: 2}, `[]`},
+		{[]string{"a", "b", "c"}, &core.FileField{MaxSelect: 2}, `["a","b","c"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v_%v", i, s.raw, s.field.IsMultiple()), func(t *testing.T) {
+			v, err := s.field.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vRaw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(vRaw) != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, vRaw)
+			}
+		})
+	}
+}
+
+func TestFileFieldDriverValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test"), "test.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		raw      any
+		field    *core.FileField
+		expected string
+	}{
+		// single
+		{nil, &core.FileField{MaxSelect: 1}, `""`},
+		{"", &core.FileField{MaxSelect: 1}, `""`},
+		{123, &core.FileField{MaxSelect: 1}, `"123"`},
+		{"a", &core.FileField{MaxSelect: 1}, `"a"`},
+		{`["a"]`, &core.FileField{MaxSelect: 1}, `"a"`},
+		{f1, &core.FileField{MaxSelect: 1}, `"` + f1.Name + `"`},
+		{[]string{}, &core.FileField{MaxSelect: 1}, `""`},
+		{[]string{"a", "b"}, &core.FileField{MaxSelect: 1}, `"b"`},
+
+		// multiple
+		{nil, &core.FileField{MaxSelect: 2}, `[]`},
+		{"", &core.FileField{MaxSelect: 2}, `[]`},
+		{123, &core.FileField{MaxSelect: 2}, `["123"]`},
+		{"a", &core.FileField{MaxSelect: 2}, `["a"]`},
+		{`["a"]`, &core.FileField{MaxSelect: 2}, `["a"]`},
+		{[]any{"a", f1}, &core.FileField{MaxSelect: 2}, `["a","` + f1.Name + `"]`},
+		{[]string{}, &core.FileField{MaxSelect: 2}, `[]`},
+		{[]string{"a", "b", "c"}, &core.FileField{MaxSelect: 2}, `["a","b","c"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v_%v", i, s.raw, s.field.IsMultiple()), func(t *testing.T) {
+			record := core.NewRecord(core.NewBaseCollection("test"))
+			record.SetRaw(s.field.GetName(), s.raw)
+
+			v, err := s.field.DriverValue(record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if s.field.IsMultiple() {
+				_, ok := v.(types.JSONArray[string])
+				if !ok {
+					t.Fatalf("Expected types.JSONArray value, got %T", v)
+				}
+			} else {
+				_, ok := v.(string)
+				if !ok {
+					t.Fatalf("Expected string value, got %T", v)
+				}
+			}
+
+			vRaw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(vRaw) != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, vRaw)
+			}
+		})
+	}
+}
+
+func TestFileFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test"), "test1.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f2, err := filesystem.NewFileFromBytes([]byte("test"), "test2.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f3, err := filesystem.NewFileFromBytes([]byte("test_abc"), "test3.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f4, err := filesystem.NewFileFromBytes(make([]byte, core.DefaultFileFieldMaxSize+1), "test4.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f5, err := filesystem.NewFileFromBytes(make([]byte, core.DefaultFileFieldMaxSize), "test5.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		field       *core.FileField
+		record      func() *core.Record
+		expectError bool
+	}{
+		// single
+		{
+			"zero field value (not required)",
+			&core.FileField{Name: "test", MaxSize: 9999, MaxSelect: 1},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.FileField{Name: "test", MaxSize: 9999, MaxSelect: 1, Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			true,
+		},
+		{
+			"new plain filename", // new files must be *filesystem.File
+			&core.FileField{Name: "test", MaxSize: 9999, MaxSelect: 1},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "a")
+				return record
+			},
+			true,
+		},
+		{
+			"new file",
+			&core.FileField{Name: "test", MaxSize: 9999, MaxSelect: 1},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", f1)
+				return record
+			},
+			false,
+		},
+		{
+			"new files > MaxSelect",
+			&core.FileField{Name: "test", MaxSize: 9999, MaxSelect: 1},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []any{f1, f2})
+				return record
+			},
+			true,
+		},
+		{
+			"new files <= MaxSelect",
+			&core.FileField{Name: "test", MaxSize: 9999, MaxSelect: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []any{f1, f2})
+				return record
+			},
+			false,
+		},
+		{
+			"> default MaxSize",
+			&core.FileField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", f4)
+				return record
+			},
+			true,
+		},
+		{
+			"<= default MaxSize",
+			&core.FileField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", f5)
+				return record
+			},
+			false,
+		},
+		{
+			"> MaxSize",
+			&core.FileField{Name: "test", MaxSize: 4, MaxSelect: 3},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []any{f1, f2, f3}) // f3=8
+				return record
+			},
+			true,
+		},
+		{
+			"<= MaxSize",
+			&core.FileField{Name: "test", MaxSize: 8, MaxSelect: 3},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []any{f1, f2, f3})
+				return record
+			},
+			false,
+		},
+		{
+			"non-matching MimeType",
+			&core.FileField{Name: "test", MaxSize: 999, MaxSelect: 3, MimeTypes: []string{"a", "b"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []any{f1, f2})
+				return record
+			},
+			true,
+		},
+		{
+			"matching MimeType",
+			&core.FileField{Name: "test", MaxSize: 999, MaxSelect: 3, MimeTypes: []string{"text/plain", "b"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []any{f1, f2})
+				return record
+			},
+			false,
+		},
+		{
+			"existing files > MaxSelect",
+			&core.FileField{Name: "file_many", MaxSize: 999, MaxSelect: 2},
+			func() *core.Record {
+				record, _ := app.FindRecordById("demo1", "84nmscqy84lsi1t") // 5 files
+				return record
+			},
+			true,
+		},
+		{
+			"existing files should ignore the MaxSize and Mimetypes checks",
+			&core.FileField{Name: "file_many", MaxSize: 1, MaxSelect: 5, MimeTypes: []string{"a", "b"}},
+			func() *core.Record {
+				record, _ := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+				return record
+			},
+			false,
+		},
+		{
+			"existing + new file > MaxSelect (5+2)",
+			&core.FileField{Name: "file_many", MaxSize: 999, MaxSelect: 6},
+			func() *core.Record {
+				record, _ := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+				record.Set("file_many+", []any{f1, f2})
+				return record
+			},
+			true,
+		},
+		{
+			"existing + new file <= MaxSelect (5+2)",
+			&core.FileField{Name: "file_many", MaxSize: 999, MaxSelect: 7},
+			func() *core.Record {
+				record, _ := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+				record.Set("file_many+", []any{f1, f2})
+				return record
+			},
+			false,
+		},
+		{
+			"existing + new filename",
+			&core.FileField{Name: "file_many", MaxSize: 999, MaxSelect: 99},
+			func() *core.Record {
+				record, _ := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+				record.Set("file_many+", "test123.png")
+				return record
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestFileFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeFile)
+	testDefaultFieldNameValidation(t, core.FieldTypeFile)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.FileField
+		expectErrors []string
+	}{
+		{
+			"zero minimal",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"0x0 thumb",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSelect: 1,
+					Thumbs:    []string{"100x200", "0x0"},
+				}
+			},
+			[]string{"thumbs"},
+		},
+		{
+			"0x0t thumb",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSize:   1,
+					MaxSelect: 1,
+					Thumbs:    []string{"100x200", "0x0t"},
+				}
+			},
+			[]string{"thumbs"},
+		},
+		{
+			"0x0b thumb",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSize:   1,
+					MaxSelect: 1,
+					Thumbs:    []string{"100x200", "0x0b"},
+				}
+			},
+			[]string{"thumbs"},
+		},
+		{
+			"0x0f thumb",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSize:   1,
+					MaxSelect: 1,
+					Thumbs:    []string{"100x200", "0x0f"},
+				}
+			},
+			[]string{"thumbs"},
+		},
+		{
+			"invalid format",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSize:   1,
+					MaxSelect: 1,
+					Thumbs:    []string{"100x200", "100x"},
+				}
+			},
+			[]string{"thumbs"},
+		},
+		{
+			"valid thumbs",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSize:   1,
+					MaxSelect: 1,
+					Thumbs:    []string{"100x200", "100x40", "100x200"},
+				}
+			},
+			[]string{},
+		},
+		{
+			"MaxSize > safe json int",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: 1 << 53,
+				}
+			},
+			[]string{"maxSize"},
+		},
+		{
+			"MaxSize < 0",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: -1,
+				}
+			},
+			[]string{"maxSize"},
+		},
+		{
+			"MaxSelect > safe json int",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSelect: 1 << 53,
+				}
+			},
+			[]string{"maxSelect"},
+		},
+		{
+			"MaxSelect < 0",
+			func() *core.FileField {
+				return &core.FileField{
+					Id:        "test",
+					Name:      "test",
+					MaxSelect: -1,
+				}
+			},
+			[]string{"maxSelect"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			field := s.field()
+
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.Add(field)
+
+			errs := field.ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestFileFieldCalculateMaxBodySize(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	scenarios := []struct {
+		field    *core.FileField
+		expected int64
+	}{
+		{&core.FileField{}, core.DefaultFileFieldMaxSize},
+		{&core.FileField{MaxSelect: 2}, 2 * core.DefaultFileFieldMaxSize},
+		{&core.FileField{MaxSize: 10}, 10},
+		{&core.FileField{MaxSize: 10, MaxSelect: 1}, 10},
+		{&core.FileField{MaxSize: 10, MaxSelect: 2}, 20},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%d_%d", i, s.field.MaxSelect, s.field.MaxSize), func(t *testing.T) {
+			result := s.field.CalculateMaxBodySize()
+
+			if result != s.expected {
+				t.Fatalf("Expected %d, got %d", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestFileFieldFindGetter(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test"), "f1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f1.Name = "f1"
+
+	f2, err := filesystem.NewFileFromBytes([]byte("test"), "f2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f2.Name = "f2"
+
+	record, err := app.FindRecordById("demo3", "lcl9d87w22ml6jy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	record.Set("files+", []any{f1, f2})
+	record.Set("files-", "test_FLurQTgrY8.txt")
+
+	field, ok := record.Collection().Fields.GetByName("files").(*core.FileField)
+	if !ok {
+		t.Fatalf("Expected *core.FileField, got %T", record.Collection().Fields.GetByName("files"))
+	}
+
+	scenarios := []struct {
+		name      string
+		key       string
+		hasGetter bool
+		expected  string
+	}{
+		{
+			"no match",
+			"example",
+			false,
+			"",
+		},
+		{
+			"exact match",
+			field.GetName(),
+			true,
+			`["300_UhLKX91HVb.png",{"name":"f1","originalName":"f1","size":4},{"name":"f2","originalName":"f2","size":4}]`,
+		},
+		{
+			"unsaved",
+			field.GetName() + ":unsaved",
+			true,
+			`[{"name":"f1","originalName":"f1","size":4},{"name":"f2","originalName":"f2","size":4}]`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			getter := field.FindGetter(s.key)
+
+			hasGetter := getter != nil
+			if hasGetter != s.hasGetter {
+				t.Fatalf("Expected hasGetter %v, got %v", s.hasGetter, hasGetter)
+			}
+
+			if !hasGetter {
+				return
+			}
+
+			v := getter(record)
+
+			raw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestFileFieldFindSetter(t *testing.T) {
+	scenarios := []struct {
+		name      string
+		key       string
+		value     any
+		field     *core.FileField
+		hasSetter bool
+		expected  string
+	}{
+		{
+			"no match",
+			"example",
+			"b",
+			&core.FileField{Name: "test", MaxSelect: 1},
+			false,
+			"",
+		},
+		{
+			"exact match (single)",
+			"test",
+			"b",
+			&core.FileField{Name: "test", MaxSelect: 1},
+			true,
+			`"b"`,
+		},
+		{
+			"exact match (multiple)",
+			"test",
+			[]string{"a", "b", "b"},
+			&core.FileField{Name: "test", MaxSelect: 2},
+			true,
+			`["a","b"]`,
+		},
+		{
+			"append (single)",
+			"test+",
+			"b",
+			&core.FileField{Name: "test", MaxSelect: 1},
+			true,
+			`"b"`,
+		},
+		{
+			"append (multiple)",
+			"test+",
+			[]string{"a"},
+			&core.FileField{Name: "test", MaxSelect: 2},
+			true,
+			`["c","d","a"]`,
+		},
+		{
+			"prepend (single)",
+			"+test",
+			"b",
+			&core.FileField{Name: "test", MaxSelect: 1},
+			true,
+			`"d"`, // the last of the existing values
+		},
+		{
+			"prepend (multiple)",
+			"+test",
+			[]string{"a"},
+			&core.FileField{Name: "test", MaxSelect: 2},
+			true,
+			`["a","c","d"]`,
+		},
+		{
+			"subtract (single)",
+			"test-",
+			"d",
+			&core.FileField{Name: "test", MaxSelect: 1},
+			true,
+			`"c"`,
+		},
+		{
+			"subtract (multiple)",
+			"test-",
+			[]string{"unknown", "c"},
+			&core.FileField{Name: "test", MaxSelect: 2},
+			true,
+			`["d"]`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.Add(s.field)
+
+			setter := s.field.FindSetter(s.key)
+
+			hasSetter := setter != nil
+			if hasSetter != s.hasSetter {
+				t.Fatalf("Expected hasSetter %v, got %v", s.hasSetter, hasSetter)
+			}
+
+			if !hasSetter {
+				return
+			}
+
+			record := core.NewRecord(collection)
+			record.SetRaw(s.field.GetName(), []string{"c", "d"})
+
+			setter(record, s.value)
+
+			raw, err := json.Marshal(record.Get(s.field.GetName()))
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestFileFieldIntercept(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	demo1, err := testApp.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	demo1.Fields.GetByName("text").(*core.TextField).Required = true // trigger validation error
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test"), "new1.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f2, err := filesystem.NewFileFromBytes([]byte("test"), "new2.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f3, err := filesystem.NewFileFromBytes([]byte("test"), "new3.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f4, err := filesystem.NewFileFromBytes([]byte("test"), "new4.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record := core.NewRecord(demo1)
+
+	ok := t.Run("1. create - with validation error", func(t *testing.T) {
+		record.Set("file_many", []any{f1, f2})
+
+		err := testApp.Save(record)
+
+		tests.TestValidationErrors(t, err, []string{"text"})
+
+		value, _ := record.GetRaw("file_many").([]any)
+		if len(value) != 2 {
+			t.Fatalf("Expected the file field value to be unchanged, got %v", value)
+		}
+	})
+	if !ok {
+		return
+	}
+
+	ok = t.Run("2. create - fixing the validation error", func(t *testing.T) {
+		record.Set("text", "abc")
+
+		err := testApp.Save(record)
+		if err != nil {
+			t.Fatalf("Expected save to succeed, got %v", err)
+		}
+
+		expectedKeys := []string{f1.Name, f2.Name}
+
+		raw := record.GetRaw("file_many")
+
+		// ensure that the value was replaced with the file names
+		value := list.ToUniqueStringSlice(raw)
+		if len(value) != len(expectedKeys) {
+			t.Fatalf("Expected the file field to be updated with the %d file names, got\n%v", len(expectedKeys), raw)
+		}
+		for _, name := range expectedKeys {
+			if !slices.Contains(value, name) {
+				t.Fatalf("Missing file %q in %v", name, value)
+			}
+		}
+
+		checkRecordFiles(t, testApp, record, expectedKeys)
+	})
+	if !ok {
+		return
+	}
+
+	ok = t.Run("3. update - validation error", func(t *testing.T) {
+		record.Set("text", "")
+		record.Set("file_many+", f3)
+		record.Set("file_many-", f2.Name)
+
+		err := testApp.Save(record)
+
+		tests.TestValidationErrors(t, err, []string{"text"})
+
+		raw, _ := json.Marshal(record.GetRaw("file_many"))
+		expectedRaw, _ := json.Marshal([]any{f1.Name, f3})
+		if !bytes.Equal(expectedRaw, raw) {
+			t.Fatalf("Expected file field value\n%s\ngot\n%s", expectedRaw, raw)
+		}
+
+		checkRecordFiles(t, testApp, record, []string{f1.Name, f2.Name})
+	})
+	if !ok {
+		return
+	}
+
+	ok = t.Run("4. update - fixing the validation error", func(t *testing.T) {
+		record.Set("text", "abc2")
+
+		err := testApp.Save(record)
+		if err != nil {
+			t.Fatalf("Expected save to succeed, got %v", err)
+		}
+
+		raw, _ := json.Marshal(record.GetRaw("file_many"))
+		expectedRaw, _ := json.Marshal([]any{f1.Name, f3.Name})
+		if !bytes.Equal(expectedRaw, raw) {
+			t.Fatalf("Expected file field value\n%s\ngot\n%s", expectedRaw, raw)
+		}
+
+		checkRecordFiles(t, testApp, record, []string{f1.Name, f3.Name})
+	})
+	if !ok {
+		return
+	}
+
+	t.Run("5. update - second time update", func(t *testing.T) {
+		record.Set("file_many-", f1.Name)
+		record.Set("file_many+", f4)
+
+		err := testApp.Save(record)
+		if err != nil {
+			t.Fatalf("Expected save to succeed, got %v", err)
+		}
+
+		raw, _ := json.Marshal(record.GetRaw("file_many"))
+		expectedRaw, _ := json.Marshal([]any{f3.Name, f4.Name})
+		if !bytes.Equal(expectedRaw, raw) {
+			t.Fatalf("Expected file field value\n%s\ngot\n%s", expectedRaw, raw)
+		}
+
+		checkRecordFiles(t, testApp, record, []string{f3.Name, f4.Name})
+	})
+}
+
+func TestFileFieldInterceptTx(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	demo1, err := testApp.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	demo1.Fields.GetByName("text").(*core.TextField).Required = true // trigger validation error
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test"), "new1.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f2, err := filesystem.NewFileFromBytes([]byte("test"), "new2.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f3, err := filesystem.NewFileFromBytes([]byte("test"), "new3.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f4, err := filesystem.NewFileFromBytes([]byte("test"), "new4.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var record *core.Record
+
+	tx := func(succeed bool) func(txApp core.App) error {
+		var txErr error
+		if !succeed {
+			txErr = errors.New("tx error")
+		}
+
+		return func(txApp core.App) error {
+			record = core.NewRecord(demo1)
+			ok := t.Run(fmt.Sprintf("[tx_%v] create with validation error", succeed), func(t *testing.T) {
+				record.Set("text", "")
+				record.Set("file_many", []any{f1, f2})
+
+				err := txApp.Save(record)
+				tests.TestValidationErrors(t, err, []string{"text"})
+
+				checkRecordFiles(t, txApp, record, []string{}) // no uploaded files
+			})
+			if !ok {
+				return txErr
+			}
+
+			// ---
+
+			ok = t.Run(fmt.Sprintf("[tx_%v] create with fixed validation error", succeed), func(t *testing.T) {
+				record.Set("text", "abc")
+
+				err = txApp.Save(record)
+				if err != nil {
+					t.Fatalf("Expected save to succeed, got %v", err)
+				}
+
+				checkRecordFiles(t, txApp, record, []string{f1.Name, f2.Name})
+			})
+			if !ok {
+				return txErr
+			}
+
+			// ---
+
+			ok = t.Run(fmt.Sprintf("[tx_%v] update with validation error", succeed), func(t *testing.T) {
+				record.Set("text", "")
+				record.Set("file_many+", f3)
+				record.Set("file_many-", f2.Name)
+
+				err = txApp.Save(record)
+				tests.TestValidationErrors(t, err, []string{"text"})
+
+				raw, _ := json.Marshal(record.GetRaw("file_many"))
+				expectedRaw, _ := json.Marshal([]any{f1.Name, f3})
+				if !bytes.Equal(expectedRaw, raw) {
+					t.Fatalf("Expected file field value\n%s\ngot\n%s", expectedRaw, raw)
+				}
+
+				checkRecordFiles(t, txApp, record, []string{f1.Name, f2.Name}) // no file changes
+			})
+			if !ok {
+				return txErr
+			}
+
+			// ---
+
+			ok = t.Run(fmt.Sprintf("[tx_%v] update with fixed validation error", succeed), func(t *testing.T) {
+				record.Set("text", "abc2")
+
+				err = txApp.Save(record)
+				if err != nil {
+					t.Fatalf("Expected save to succeed, got %v", err)
+				}
+
+				raw, _ := json.Marshal(record.GetRaw("file_many"))
+				expectedRaw, _ := json.Marshal([]any{f1.Name, f3.Name})
+				if !bytes.Equal(expectedRaw, raw) {
+					t.Fatalf("Expected file field value\n%s\ngot\n%s", expectedRaw, raw)
+				}
+
+				checkRecordFiles(t, txApp, record, []string{f1.Name, f3.Name, f2.Name}) // f2 shouldn't be deleted yet
+			})
+			if !ok {
+				return txErr
+			}
+
+			// ---
+
+			ok = t.Run(fmt.Sprintf("[tx_%v] second time update", succeed), func(t *testing.T) {
+				record.Set("file_many-", f1.Name)
+				record.Set("file_many+", f4)
+
+				err := txApp.Save(record)
+				if err != nil {
+					t.Fatalf("Expected save to succeed, got %v", err)
+				}
+
+				raw, _ := json.Marshal(record.GetRaw("file_many"))
+				expectedRaw, _ := json.Marshal([]any{f3.Name, f4.Name})
+				if !bytes.Equal(expectedRaw, raw) {
+					t.Fatalf("Expected file field value\n%s\ngot\n%s", expectedRaw, raw)
+				}
+
+				checkRecordFiles(t, txApp, record, []string{f3.Name, f4.Name, f1.Name, f2.Name}) // f1 and f2 shouldn't be deleted yet
+			})
+			if !ok {
+				return txErr
+			}
+
+			// ---
+
+			return txErr
+		}
+	}
+
+	// failed transaction
+	txErr := testApp.RunInTransaction(tx(false))
+	if txErr == nil {
+		t.Fatal("Expected transaction error")
+	}
+	// there shouldn't be any fails associated with the record id
+	checkRecordFiles(t, testApp, record, []string{})
+
+	txErr = testApp.RunInTransaction(tx(true))
+	if txErr != nil {
+		t.Fatalf("Expected transaction to succeed, got %v", txErr)
+	}
+	// only the last updated files should remain
+	checkRecordFiles(t, testApp, record, []string{f3.Name, f4.Name})
+}
+
+// -------------------------------------------------------------------
+
+func checkRecordFiles(t *testing.T, testApp core.App, record *core.Record, expectedKeys []string) {
+	fsys, err := testApp.NewFilesystem()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	objects, err := fsys.List(record.BaseFilesPath() + "/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	objectKeys := make([]string, 0, len(objects))
+	for _, obj := range objects {
+		// exclude thumbs
+		if !strings.Contains(obj.Key, "/thumbs_") {
+			objectKeys = append(objectKeys, obj.Key)
+		}
+	}
+
+	if len(objectKeys) != len(expectedKeys) {
+		t.Fatalf("Expected files:\n%v\ngot\n%v", expectedKeys, objectKeys)
+	}
+	for _, key := range expectedKeys {
+		fullKey := record.BaseFilesPath() + "/" + key
+		if !slices.Contains(objectKeys, fullKey) {
+			t.Fatalf("Missing expected file key\n%q\nin\n%v", fullKey, objectKeys)
+		}
+	}
+}
diff --git a/server/core_backend-server/core/field_geo_point.go b/server/core_backend-server/core/field_geo_point.go
new file mode 100644
index 0000000..c698df8
--- /dev/null
+++ b/server/core_backend-server/core/field_geo_point.go
@@ -0,0 +1,151 @@
+package core
+
+import (
+	"context"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func init() {
+	Fields[FieldTypeGeoPoint] = func() Field {
+		return &GeoPointField{}
+	}
+}
+
+const FieldTypeGeoPoint = "geoPoint"
+
+var (
+	_ Field = (*GeoPointField)(nil)
+)
+
+// GeoPointField defines "geoPoint" type field for storing latitude and longitude GPS coordinates.
+//
+// You can set the record field value as [types.GeoPoint], map or serialized json object with lat-lon props.
+// The stored value is always converted to [types.GeoPoint].
+// Nil, empty map, empty bytes slice, etc. results in zero [types.GeoPoint].
+//
+// Examples of updating a record's GeoPointField value programmatically:
+//
+//	record.Set("location", types.GeoPoint{Lat: 123, Lon: 456})
+//	record.Set("location", map[string]any{"lat":123, "lon":456})
+//	record.Set("location", []byte(`{"lat":123, "lon":456}`)
+type GeoPointField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// Required will require the field coordinates to be non-zero (aka. not "Null Island").
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *GeoPointField) Type() string {
+	return FieldTypeGeoPoint
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *GeoPointField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *GeoPointField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *GeoPointField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *GeoPointField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *GeoPointField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *GeoPointField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *GeoPointField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *GeoPointField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *GeoPointField) ColumnType(app App) string {
+	if IsPostgres(app) {
+		return `JSONB DEFAULT '{"lon":0,"lat":0}' NOT NULL`
+	}
+	return `JSON DEFAULT '{"lon":0,"lat":0}' NOT NULL`
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *GeoPointField) PrepareValue(record *Record, raw any) (any, error) {
+	point := types.GeoPoint{}
+	err := point.Scan(raw)
+	return point, err
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *GeoPointField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	val, ok := record.GetRaw(f.Name).(types.GeoPoint)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	// zero value
+	if val.Lat == 0 && val.Lon == 0 {
+		if f.Required {
+			return validation.ErrRequired
+		}
+		return nil
+	}
+
+	if val.Lat < -90 || val.Lat > 90 {
+		return validation.NewError("validation_invalid_latitude", "Latitude must be between -90 and 90 degrees.")
+	}
+
+	if val.Lon < -180 || val.Lon > 180 {
+		return validation.NewError("validation_invalid_longitude", "Longitude must be between -180 and 180 degrees.")
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *GeoPointField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+	)
+}
diff --git a/server/core_backend-server/core/field_geo_point_test.go b/server/core_backend-server/core/field_geo_point_test.go
new file mode 100644
index 0000000..d7640d7
--- /dev/null
+++ b/server/core_backend-server/core/field_geo_point_test.go
@@ -0,0 +1,206 @@
+package core_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestGeoPointFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeGeoPoint)
+}
+
+func TestGeoPointFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.GeoPointField{}
+
+	/* SQLite:
+	expected := `JSON DEFAULT '{"lon":0,"lat":0}' NOT NULL`
+	*/
+	// PostgreSQL:
+	expected := `JSONB DEFAULT '{"lon":0,"lat":0}' NOT NULL`
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestGeoPointFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.GeoPointField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{nil, `{"lon":0,"lat":0}`},
+		{"", `{"lon":0,"lat":0}`},
+		{[]byte{}, `{"lon":0,"lat":0}`},
+		{map[string]any{}, `{"lon":0,"lat":0}`},
+		{types.GeoPoint{Lon: 10, Lat: 20}, `{"lon":10,"lat":20}`},
+		{&types.GeoPoint{Lon: 10, Lat: 20}, `{"lon":10,"lat":20}`},
+		{[]byte(`{"lon": 10, "lat": 20}`), `{"lon":10,"lat":20}`},
+		{map[string]any{"lon": 10, "lat": 20}, `{"lon":10,"lat":20}`},
+		{map[string]float64{"lon": 10, "lat": 20}, `{"lon":10,"lat":20}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestGeoPointFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.GeoPointField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (non-required)",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{})
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.GeoPointField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{})
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero Lat field value (required)",
+			&core.GeoPointField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lat: 1})
+				return record
+			},
+			false,
+		},
+		{
+			"non-zero Lon field value (required)",
+			&core.GeoPointField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lon: 1})
+				return record
+			},
+			false,
+		},
+		{
+			"non-zero Lat-Lon field value (required)",
+			&core.GeoPointField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lon: -1, Lat: -2})
+				return record
+			},
+			false,
+		},
+		{
+			"lat < -90",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lat: -90.1})
+				return record
+			},
+			true,
+		},
+		{
+			"lat > 90",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lat: 90.1})
+				return record
+			},
+			true,
+		},
+		{
+			"lon < -180",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lon: -180.1})
+				return record
+			},
+			true,
+		},
+		{
+			"lon > 180",
+			&core.GeoPointField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.GeoPoint{Lon: 180.1})
+				return record
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestGeoPointFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeGeoPoint)
+	testDefaultFieldNameValidation(t, core.FieldTypeGeoPoint)
+}
diff --git a/server/core_backend-server/core/field_json.go b/server/core_backend-server/core/field_json.go
new file mode 100644
index 0000000..f05d1f9
--- /dev/null
+++ b/server/core_backend-server/core/field_json.go
@@ -0,0 +1,201 @@
+package core
+
+import (
+	"context"
+	"slices"
+	"strconv"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func init() {
+	Fields[FieldTypeJSON] = func() Field {
+		return &JSONField{}
+	}
+}
+
+const FieldTypeJSON = "json"
+
+const DefaultJSONFieldMaxSize int64 = 1 << 20
+
+var (
+	_ Field                 = (*JSONField)(nil)
+	_ MaxBodySizeCalculator = (*JSONField)(nil)
+)
+
+// JSONField defines "json" type field for storing any serialized JSON value.
+//
+// The respective zero record field value is the zero [types.JSONRaw].
+type JSONField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// MaxSize specifies the maximum size of the allowed field value (in bytes and up to 2^53-1).
+	//
+	// If zero, a default limit of 1MB is applied.
+	MaxSize int64 `form:"maxSize" json:"maxSize"`
+
+	// Required will require the field value to be non-empty JSON value
+	// (aka. not "null", `""`, "[]", "{}").
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *JSONField) Type() string {
+	return FieldTypeJSON
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *JSONField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *JSONField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *JSONField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *JSONField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *JSONField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *JSONField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *JSONField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *JSONField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *JSONField) ColumnType(app App) string {
+	if IsMysql(app) {
+		return "JSON"
+	}
+	if IsPostgres(app) {
+		return "JSONB DEFAULT NULL"
+	}
+	return "JSON DEFAULT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *JSONField) PrepareValue(record *Record, raw any) (any, error) {
+	if str, ok := raw.(string); ok {
+		// in order to support seamlessly both json and multipart/form-data requests,
+		// the following normalization rules are applied for plain string values:
+		// - "true" is converted to the json `true`
+		// - "false" is converted to the json `false`
+		// - "null" is converted to the json `null`
+		// - "[1,2,3]" is converted to the json `[1,2,3]`
+		// - "{\"a\":1,\"b\":2}" is converted to the json `{"a":1,"b":2}`
+		// - numeric strings are converted to json number
+		// - double quoted strings are left as they are (aka. without normalizations)
+		// - any other string (empty string too) is double quoted
+		if str == "" {
+			raw = strconv.Quote(str)
+		} else if str == "null" || str == "true" || str == "false" {
+			raw = str
+		} else if ((str[0] >= '0' && str[0] <= '9') ||
+			str[0] == '-' ||
+			str[0] == '"' ||
+			str[0] == '[' ||
+			str[0] == '{') &&
+			is.JSON.Validate(str) == nil {
+			raw = str
+		} else {
+			raw = strconv.Quote(str)
+		}
+	}
+
+	return types.ParseJSONRaw(raw)
+}
+
+var emptyJSONValues = []string{
+	"null", `""`, "[]", "{}", "",
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *JSONField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	raw, ok := record.GetRaw(f.Name).(types.JSONRaw)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	maxSize := f.CalculateMaxBodySize()
+
+	if int64(len(raw)) > maxSize {
+		return validation.NewError(
+			"validation_json_size_limit",
+			"The maximum allowed JSON size is {{.maxSize}} bytes",
+		).SetParams(map[string]any{"maxSize": maxSize})
+	}
+
+	if is.JSON.Validate(raw) != nil {
+		return validation.NewError("validation_invalid_json", "Must be a valid json value")
+	}
+
+	rawStr := strings.TrimSpace(raw.String())
+
+	if f.Required && slices.Contains(emptyJSONValues, rawStr) {
+		return validation.ErrRequired
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *JSONField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(&f.MaxSize, validation.Min(0), validation.Max(maxSafeJSONInt)),
+	)
+}
+
+// CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+func (f *JSONField) CalculateMaxBodySize() int64 {
+	if f.MaxSize <= 0 {
+		return DefaultJSONFieldMaxSize
+	}
+
+	return f.MaxSize
+}
diff --git a/server/core_backend-server/core/field_json_test.go b/server/core_backend-server/core/field_json_test.go
new file mode 100644
index 0000000..979dd08
--- /dev/null
+++ b/server/core_backend-server/core/field_json_test.go
@@ -0,0 +1,367 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestJSONFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeJSON)
+}
+
+func TestJSONFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.JSONField{}
+
+	/* SQLite:
+	expected := "JSON DEFAULT NULL"
+	*/
+	// PostgreSQL:
+	expected := "JSONB DEFAULT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestJSONFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.JSONField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{"null", `null`},
+		{"", `""`},
+		{"true", `true`},
+		{"false", `false`},
+		{"test", `"test"`},
+		{"123", `123`},
+		{"-456", `-456`},
+		{"[1,2,3]", `[1,2,3]`},
+		{"[1,2,3", `"[1,2,3"`},
+		{`{"a":1,"b":2}`, `{"a":1,"b":2}`},
+		{`{"a":1,"b":2`, `"{\"a\":1,\"b\":2"`},
+		{[]int{1, 2, 3}, `[1,2,3]`},
+		{map[string]int{"a": 1, "b": 2}, `{"a":1,"b":2}`},
+		{nil, `null`},
+		{false, `false`},
+		{true, `true`},
+		{-78, `-78`},
+		{123.456, `123.456`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, ok := v.(types.JSONRaw)
+			if !ok {
+				t.Fatalf("Expected string instance, got %T", v)
+			}
+			rawStr := raw.String()
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected\n%#v\ngot\n%#v", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestJSONFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.JSONField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.JSONField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (not required)",
+			&core.JSONField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.JSONRaw{})
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.JSONField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.JSONRaw{})
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero field value (required)",
+			&core.JSONField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.JSONRaw("[1,2,3]"))
+				return record
+			},
+			false,
+		},
+		{
+			"non-zero field value (required)",
+			&core.JSONField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.JSONRaw(`"aaa"`))
+				return record
+			},
+			false,
+		},
+		{
+			"> default MaxSize",
+			&core.JSONField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.JSONRaw(`"`+strings.Repeat("a", (1<<20))+`"`))
+				return record
+			},
+			true,
+		},
+		{
+			"> MaxSize",
+			&core.JSONField{Name: "test", MaxSize: 5},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.JSONRaw(`"aaaa"`))
+				return record
+			},
+			true,
+		},
+		{
+			"<= MaxSize",
+			&core.JSONField{Name: "test", MaxSize: 5},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", types.JSONRaw(`"aaa"`))
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestJSONFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeJSON)
+	testDefaultFieldNameValidation(t, core.FieldTypeJSON)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.JSONField
+		expectErrors []string
+	}{
+		{
+			"MaxSize < 0",
+			func() *core.JSONField {
+				return &core.JSONField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: -1,
+				}
+			},
+			[]string{"maxSize"},
+		},
+		{
+			"MaxSize = 0",
+			func() *core.JSONField {
+				return &core.JSONField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"MaxSize > 0",
+			func() *core.JSONField {
+				return &core.JSONField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: 1,
+				}
+			},
+			[]string{},
+		},
+		{
+			"MaxSize > safe json int",
+			func() *core.JSONField {
+				return &core.JSONField{
+					Id:      "test",
+					Name:    "test",
+					MaxSize: 1 << 53,
+				}
+			},
+			[]string{"maxSize"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := s.field().ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestJSONFieldCalculateMaxBodySize(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	scenarios := []struct {
+		field    *core.JSONField
+		expected int64
+	}{
+		{&core.JSONField{}, core.DefaultJSONFieldMaxSize},
+		{&core.JSONField{MaxSize: 10}, 10},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%d", i, s.field.MaxSize), func(t *testing.T) {
+			result := s.field.CalculateMaxBodySize()
+
+			if result != s.expected {
+				t.Fatalf("Expected %d, got %d", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJsonFilter_TypeCasting(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	jsonField := &core.JSONField{Name: "json_col"}
+	boolField := &core.BoolField{Name: "bool_col"}
+	collection := core.NewBaseCollection("test")
+	collection.Fields.Add(jsonField, boolField)
+	resolver := core.NewRecordFieldResolver(testApp, collection, nil, false)
+
+	// Append 5 rows data to the db
+	sql := `
+		CREATE TABLE test (
+			id		 INTEGER,
+			text_col TEXT,
+			bool_col BOOLEAN,
+			json_col JSON
+		);
+		INSERT INTO test (id, text_col, bool_col, json_col) VALUES
+			(0, 'text a', true, '{"string_key": "value a", "int_key": 0, "bool_key": true}'),
+			(1, 'test b', false, '{"string_key": "value b", "int_key": 1, "bool_key": false}'),
+			(2, 'test c', true, '{"string_key": "value c", "int_key": 2, "bool_key": true}'),
+			(3, 'test d', false, '{"string_key": "value d", "int_key": 3, "bool_key": false}'),
+			(4, '123', true, '{"string_key": "value e", "int_key": 4, "bool_key": true}')
+	`
+	_, err := testApp.DB().NewQuery(sql).Execute()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name           string
+		filterData     search.FilterData
+		expectedRowIds []int
+	}{
+		{
+			name:           "bool filters",
+			filterData:     search.FilterData(`bool_col = true`),
+			expectedRowIds: []int{0, 2, 4},
+		},
+		{
+			name:           "json filter type cast to string",
+			filterData:     search.FilterData(`json_col.string_key = 'value a'`),
+			expectedRowIds: []int{0},
+		},
+		{
+			name:           "json filter type cast to number",
+			filterData:     search.FilterData(`json_col.int_key = 1`),
+			expectedRowIds: []int{1},
+		},
+		{
+			name:           "json filter type cast to boolean",
+			filterData:     search.FilterData(`json_col.bool_key = true`),
+			expectedRowIds: []int{0, 2, 4},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		t.Run(scenario.name, func(t *testing.T) {
+			expr, err := scenario.filterData.BuildExpr(resolver)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			var rows []struct {
+				ID int `db:"id"`
+			}
+			err = testApp.DB().Select("id").From("test").Where(expr).OrderBy("id").All(&rows)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			rowIds := make([]int, len(rows))
+			for i, row := range rows {
+				rowIds[i] = row.ID
+			}
+
+			if !reflect.DeepEqual(rowIds, scenario.expectedRowIds) {
+				t.Fatalf("Expected rows %v, got %v", scenario.expectedRowIds, rowIds)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_number.go b/server/core_backend-server/core/field_number.go
new file mode 100644
index 0000000..d11e175
--- /dev/null
+++ b/server/core_backend-server/core/field_number.go
@@ -0,0 +1,222 @@
+package core
+
+import (
+	"context"
+	"fmt"
+	"math"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/spf13/cast"
+)
+
+func init() {
+	Fields[FieldTypeNumber] = func() Field {
+		return &NumberField{}
+	}
+}
+
+const FieldTypeNumber = "number"
+
+var (
+	_ Field        = (*NumberField)(nil)
+	_ SetterFinder = (*NumberField)(nil)
+)
+
+// NumberField defines "number" type field for storing numeric (float64) value.
+//
+// The respective zero record field value is 0.
+//
+// The following additional setter keys are available:
+//
+//   - "fieldName+" - appends to the existing record value. For example:
+//     record.Set("total+", 5)
+//   - "fieldName-" - subtracts from the existing record value. For example:
+//     record.Set("total-", 5)
+type NumberField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// Min specifies the min allowed field value.
+	//
+	// Leave it nil to skip the validator.
+	Min *float64 `form:"min" json:"min"`
+
+	// Max specifies the max allowed field value.
+	//
+	// Leave it nil to skip the validator.
+	Max *float64 `form:"max" json:"max"`
+
+	// OnlyInt will require the field value to be integer.
+	OnlyInt bool `form:"onlyInt" json:"onlyInt"`
+
+	// Required will require the field value to be non-zero.
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *NumberField) Type() string {
+	return FieldTypeNumber
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *NumberField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *NumberField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *NumberField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *NumberField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *NumberField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *NumberField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *NumberField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *NumberField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *NumberField) ColumnType(app App) string {
+	return "NUMERIC DEFAULT 0 NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *NumberField) PrepareValue(record *Record, raw any) (any, error) {
+	return cast.ToFloat64(raw), nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *NumberField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	val, ok := record.GetRaw(f.Name).(float64)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if math.IsInf(val, 0) || math.IsNaN(val) {
+		return validation.NewError("validation_not_a_number", "The submitted number is not properly formatted")
+	}
+
+	if val == 0 {
+		if f.Required {
+			if err := validation.Required.Validate(val); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	if f.OnlyInt && val != float64(int64(val)) {
+		return validation.NewError("validation_only_int_constraint", "Decimal numbers are not allowed")
+	}
+
+	if f.Min != nil && val < *f.Min {
+		return validation.NewError("validation_min_number_constraint", fmt.Sprintf("Must be larger than %f", *f.Min))
+	}
+
+	if f.Max != nil && val > *f.Max {
+		return validation.NewError("validation_max_number_constraint", fmt.Sprintf("Must be less than %f", *f.Max))
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *NumberField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	maxRules := []validation.Rule{
+		validation.By(f.checkOnlyInt),
+	}
+	if f.Min != nil && f.Max != nil {
+		maxRules = append(maxRules, validation.Min(*f.Min))
+	}
+
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(&f.Min, validation.By(f.checkOnlyInt)),
+		validation.Field(&f.Max, maxRules...),
+	)
+}
+
+func (f *NumberField) checkOnlyInt(value any) error {
+	v, _ := value.(*float64)
+	if v == nil || !f.OnlyInt {
+		return nil // nothing to check
+	}
+
+	if *v != float64(int64(*v)) {
+		return validation.NewError("validation_only_int_constraint", "Decimal numbers are not allowed.")
+	}
+
+	return nil
+}
+
+// FindSetter implements the [SetterFinder] interface.
+func (f *NumberField) FindSetter(key string) SetterFunc {
+	switch key {
+	case f.Name:
+		return f.setValue
+	case f.Name + "+":
+		return f.addValue
+	case f.Name + "-":
+		return f.subtractValue
+	default:
+		return nil
+	}
+}
+
+func (f *NumberField) setValue(record *Record, raw any) {
+	record.SetRaw(f.Name, cast.ToFloat64(raw))
+}
+
+func (f *NumberField) addValue(record *Record, raw any) {
+	val := cast.ToFloat64(record.GetRaw(f.Name))
+
+	record.SetRaw(f.Name, val+cast.ToFloat64(raw))
+}
+
+func (f *NumberField) subtractValue(record *Record, raw any) {
+	val := cast.ToFloat64(record.GetRaw(f.Name))
+
+	record.SetRaw(f.Name, val-cast.ToFloat64(raw))
+}
diff --git a/server/core_backend-server/core/field_number_test.go b/server/core_backend-server/core/field_number_test.go
new file mode 100644
index 0000000..a9117d6
--- /dev/null
+++ b/server/core_backend-server/core/field_number_test.go
@@ -0,0 +1,403 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestNumberFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeNumber)
+}
+
+func TestNumberFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.NumberField{}
+
+	expected := "NUMERIC DEFAULT 0 NOT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestNumberFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.NumberField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected float64
+	}{
+		{"", 0},
+		{"test", 0},
+		{false, 0},
+		{true, 1},
+		{-2, -2},
+		{123.456, 123.456},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			vRaw, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			v, ok := vRaw.(float64)
+			if !ok {
+				t.Fatalf("Expected float64 instance, got %T", v)
+			}
+
+			if v != s.expected {
+				t.Fatalf("Expected %f, got %f", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestNumberFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.NumberField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.NumberField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "123")
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (not required)",
+			&core.NumberField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 0.0)
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.NumberField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 0.0)
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero field value (required)",
+			&core.NumberField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123.0)
+				return record
+			},
+			false,
+		},
+		{
+			"decimal with onlyInt",
+			&core.NumberField{Name: "test", OnlyInt: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123.456)
+				return record
+			},
+			true,
+		},
+		{
+			"int with onlyInt",
+			&core.NumberField{Name: "test", OnlyInt: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123.0)
+				return record
+			},
+			false,
+		},
+		{
+			"< min",
+			&core.NumberField{Name: "test", Min: types.Pointer(2.0)},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 1.0)
+				return record
+			},
+			true,
+		},
+		{
+			">= min",
+			&core.NumberField{Name: "test", Min: types.Pointer(2.0)},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 2.0)
+				return record
+			},
+			false,
+		},
+		{
+			"> max",
+			&core.NumberField{Name: "test", Max: types.Pointer(2.0)},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 3.0)
+				return record
+			},
+			true,
+		},
+		{
+			"<= max",
+			&core.NumberField{Name: "test", Max: types.Pointer(2.0)},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 2.0)
+				return record
+			},
+			false,
+		},
+		{
+			"infinity",
+			&core.NumberField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.Set("test", "Inf")
+				return record
+			},
+			true,
+		},
+		{
+			"NaN",
+			&core.NumberField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.Set("test", "NaN")
+				return record
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestNumberFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeNumber)
+	testDefaultFieldNameValidation(t, core.FieldTypeNumber)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.NumberField
+		expectErrors []string
+	}{
+		{
+			"zero",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"decumal min",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:   "test",
+					Name: "test",
+					Min:  types.Pointer(1.2),
+				}
+			},
+			[]string{},
+		},
+		{
+			"decumal min (onlyInt)",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:      "test",
+					Name:    "test",
+					OnlyInt: true,
+					Min:     types.Pointer(1.2),
+				}
+			},
+			[]string{"min"},
+		},
+		{
+			"int min (onlyInt)",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:      "test",
+					Name:    "test",
+					OnlyInt: true,
+					Min:     types.Pointer(1.0),
+				}
+			},
+			[]string{},
+		},
+		{
+			"decumal max",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:   "test",
+					Name: "test",
+					Max:  types.Pointer(1.2),
+				}
+			},
+			[]string{},
+		},
+		{
+			"decumal max (onlyInt)",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:      "test",
+					Name:    "test",
+					OnlyInt: true,
+					Max:     types.Pointer(1.2),
+				}
+			},
+			[]string{"max"},
+		},
+		{
+			"int max (onlyInt)",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:      "test",
+					Name:    "test",
+					OnlyInt: true,
+					Max:     types.Pointer(1.0),
+				}
+			},
+			[]string{},
+		},
+		{
+			"min > max",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:   "test",
+					Name: "test",
+					Min:  types.Pointer(2.0),
+					Max:  types.Pointer(1.0),
+				}
+			},
+			[]string{"max"},
+		},
+		{
+			"min <= max",
+			func() *core.NumberField {
+				return &core.NumberField{
+					Id:   "test",
+					Name: "test",
+					Min:  types.Pointer(2.0),
+					Max:  types.Pointer(2.0),
+				}
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := s.field().ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestNumberFieldFindSetter(t *testing.T) {
+	field := &core.NumberField{Name: "test"}
+
+	collection := core.NewBaseCollection("test_collection")
+	collection.Fields.Add(field)
+
+	t.Run("no match", func(t *testing.T) {
+		f := field.FindSetter("abc")
+		if f != nil {
+			t.Fatal("Expected nil setter")
+		}
+	})
+
+	t.Run("direct name match", func(t *testing.T) {
+		f := field.FindSetter("test")
+		if f == nil {
+			t.Fatal("Expected non-nil setter")
+		}
+
+		record := core.NewRecord(collection)
+		record.SetRaw("test", 2.0)
+
+		f(record, "123.456") // should be casted
+
+		if v := record.Get("test"); v != 123.456 {
+			t.Fatalf("Expected %f, got %f", 123.456, v)
+		}
+	})
+
+	t.Run("name+ match", func(t *testing.T) {
+		f := field.FindSetter("test+")
+		if f == nil {
+			t.Fatal("Expected non-nil setter")
+		}
+
+		record := core.NewRecord(collection)
+		record.SetRaw("test", 2.0)
+
+		f(record, "1.5") // should be casted and appended to the existing value
+
+		if v := record.Get("test"); v != 3.5 {
+			t.Fatalf("Expected %f, got %f", 3.5, v)
+		}
+	})
+
+	t.Run("name- match", func(t *testing.T) {
+		f := field.FindSetter("test-")
+		if f == nil {
+			t.Fatal("Expected non-nil setter")
+		}
+
+		record := core.NewRecord(collection)
+		record.SetRaw("test", 2.0)
+
+		f(record, "1.5") // should be casted and subtracted from the existing value
+
+		if v := record.Get("test"); v != 0.5 {
+			t.Fatalf("Expected %f, got %f", 0.5, v)
+		}
+	})
+}
diff --git a/server/core_backend-server/core/field_password.go b/server/core_backend-server/core/field_password.go
new file mode 100644
index 0000000..69b9942
--- /dev/null
+++ b/server/core_backend-server/core/field_password.go
@@ -0,0 +1,321 @@
+package core
+
+import (
+	"context"
+	"database/sql/driver"
+	"fmt"
+	"regexp"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/spf13/cast"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func init() {
+	Fields[FieldTypePassword] = func() Field {
+		return &PasswordField{}
+	}
+}
+
+const FieldTypePassword = "password"
+
+var (
+	_ Field             = (*PasswordField)(nil)
+	_ GetterFinder      = (*PasswordField)(nil)
+	_ SetterFinder      = (*PasswordField)(nil)
+	_ DriverValuer      = (*PasswordField)(nil)
+	_ RecordInterceptor = (*PasswordField)(nil)
+)
+
+// PasswordField defines "password" type field for storing bcrypt hashed strings
+// (usually used only internally for the "password" auth collection system field).
+//
+// If you want to set a direct bcrypt hash as record field value you can use the SetRaw method, for example:
+//
+//	// generates a bcrypt hash of "123456" and set it as field value
+//	// (record.GetString("password") returns the plain password until persisted, otherwise empty string)
+//	record.Set("password", "123456")
+//
+//	// set directly a bcrypt hash of "123456" as field value
+//	// (record.GetString("password") returns empty string)
+//	record.SetRaw("password", "$2a$10$.5Elh8fgxypNUWhpUUr/xOa2sZm0VIaE0qWuGGl9otUfobb46T1Pq")
+//
+// The following additional getter keys are available:
+//
+//   - "fieldName:hash" - returns the bcrypt hash string of the record field value (if any). For example:
+//     record.GetString("password:hash")
+type PasswordField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// Pattern specifies an optional regex pattern to match against the field value.
+	//
+	// Leave it empty to skip the pattern check.
+	Pattern string `form:"pattern" json:"pattern"`
+
+	// Min specifies an optional required field string length.
+	Min int `form:"min" json:"min"`
+
+	// Max specifies an optional required field string length.
+	//
+	// If zero, fallback to max 71 bytes.
+	Max int `form:"max" json:"max"`
+
+	// Cost specifies the cost/weight/iteration/etc. bcrypt factor.
+	//
+	// If zero, fallback to [bcrypt.DefaultCost].
+	//
+	// If explicitly set, must be between [bcrypt.MinCost] and [bcrypt.MaxCost].
+	Cost int `form:"cost" json:"cost"`
+
+	// Required will require the field value to be non-empty string.
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *PasswordField) Type() string {
+	return FieldTypePassword
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *PasswordField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *PasswordField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *PasswordField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *PasswordField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *PasswordField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *PasswordField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *PasswordField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *PasswordField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *PasswordField) ColumnType(app App) string {
+	if IsMysql(app) {
+		return "TEXT"
+	}
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// DriverValue implements the [DriverValuer] interface.
+func (f *PasswordField) DriverValue(record *Record) (driver.Value, error) {
+	fp := f.getPasswordValue(record)
+	return fp.Hash, fp.LastError
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *PasswordField) PrepareValue(record *Record, raw any) (any, error) {
+	return &PasswordFieldValue{
+		Hash: cast.ToString(raw),
+	}, nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *PasswordField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	fp, ok := record.GetRaw(f.Name).(*PasswordFieldValue)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if fp.LastError != nil {
+		return fp.LastError
+	}
+
+	if f.Required {
+		if err := validation.Required.Validate(fp.Hash); err != nil {
+			return err
+		}
+	}
+
+	if fp.Plain == "" {
+		return nil // nothing to check
+	}
+
+	// note: casted to []rune to count multi-byte chars as one for the
+	// sake of more intuitive UX and clearer user error messages
+	//
+	// note2: technically multi-byte strings could produce bigger length than the bcrypt limit
+	// but it should be fine as it will be just truncated (even if it cuts a byte sequence in the middle)
+	length := len([]rune(fp.Plain))
+
+	if length < f.Min {
+		return validation.NewError("validation_min_text_constraint", fmt.Sprintf("Must be at least %d character(s)", f.Min))
+	}
+
+	maxLength := f.Max
+	if maxLength <= 0 {
+		maxLength = 71
+	}
+	if length > maxLength {
+		return validation.NewError("validation_max_text_constraint", fmt.Sprintf("Must be less than %d character(s)", maxLength))
+	}
+
+	if f.Pattern != "" {
+		match, _ := regexp.MatchString(f.Pattern, fp.Plain)
+		if !match {
+			return validation.NewError("validation_invalid_format", "Invalid value format")
+		}
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *PasswordField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(&f.Min, validation.Min(1), validation.Max(71)),
+		validation.Field(&f.Max, validation.Min(f.Min), validation.Max(71)),
+		validation.Field(&f.Cost, validation.Min(bcrypt.MinCost), validation.Max(bcrypt.MaxCost)),
+		validation.Field(&f.Pattern, validation.By(validators.IsRegex)),
+	)
+}
+
+func (f *PasswordField) getPasswordValue(record *Record) *PasswordFieldValue {
+	raw := record.GetRaw(f.Name)
+
+	switch v := raw.(type) {
+	case *PasswordFieldValue:
+		return v
+	case string:
+		// we assume that any raw string starting with $2 is bcrypt hash
+		if strings.HasPrefix(v, "$2") {
+			return &PasswordFieldValue{Hash: v}
+		}
+	}
+
+	return &PasswordFieldValue{}
+}
+
+// Intercept implements the [RecordInterceptor] interface.
+func (f *PasswordField) Intercept(
+	ctx context.Context,
+	app App,
+	record *Record,
+	actionName string,
+	actionFunc func() error,
+) error {
+	switch actionName {
+	case InterceptorActionAfterCreate, InterceptorActionAfterUpdate:
+		// unset the plain field value after successful create/update
+		fp := f.getPasswordValue(record)
+		fp.Plain = ""
+	}
+
+	return actionFunc()
+}
+
+// FindGetter implements the [GetterFinder] interface.
+func (f *PasswordField) FindGetter(key string) GetterFunc {
+	switch key {
+	case f.Name:
+		return func(record *Record) any {
+			return f.getPasswordValue(record).Plain
+		}
+	case f.Name + ":hash":
+		return func(record *Record) any {
+			return f.getPasswordValue(record).Hash
+		}
+	default:
+		return nil
+	}
+}
+
+// FindSetter implements the [SetterFinder] interface.
+func (f *PasswordField) FindSetter(key string) SetterFunc {
+	switch key {
+	case f.Name:
+		return f.setValue
+	default:
+		return nil
+	}
+}
+
+func (f *PasswordField) setValue(record *Record, raw any) {
+	fv := &PasswordFieldValue{
+		Plain: cast.ToString(raw),
+	}
+
+	// hash the password
+	if fv.Plain != "" {
+		cost := f.Cost
+		if cost <= 0 {
+			cost = bcrypt.DefaultCost
+		}
+
+		hash, err := bcrypt.GenerateFromPassword([]byte(fv.Plain), cost)
+		if err != nil {
+			fv.LastError = err
+		}
+
+		fv.Hash = string(hash)
+	}
+
+	record.SetRaw(f.Name, fv)
+}
+
+// -------------------------------------------------------------------
+
+type PasswordFieldValue struct {
+	LastError error
+	Hash      string
+	Plain     string
+}
+
+func (pv PasswordFieldValue) Validate(pass string) bool {
+	if pv.Hash == "" || pv.LastError != nil {
+		return false
+	}
+
+	err := bcrypt.CompareHashAndPassword([]byte(pv.Hash), []byte(pass))
+
+	return err == nil
+}
diff --git a/server/core_backend-server/core/field_password_test.go b/server/core_backend-server/core/field_password_test.go
new file mode 100644
index 0000000..31a1113
--- /dev/null
+++ b/server/core_backend-server/core/field_password_test.go
@@ -0,0 +1,568 @@
+package core_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestPasswordFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypePassword)
+}
+
+func TestPasswordFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.PasswordField{}
+
+	expected := "TEXT DEFAULT '' NOT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestPasswordFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.PasswordField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{"", ""},
+		{"test", "test"},
+		{false, "false"},
+		{true, "true"},
+		{123.456, "123.456"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			pv, ok := v.(*core.PasswordFieldValue)
+			if !ok {
+				t.Fatalf("Expected PasswordFieldValue instance, got %T", v)
+			}
+
+			if pv.Hash != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestPasswordFieldDriverValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.PasswordField{Name: "test"}
+
+	err := errors.New("example_err")
+
+	scenarios := []struct {
+		raw      any
+		expected *core.PasswordFieldValue
+	}{
+		{123, &core.PasswordFieldValue{}},
+		{"abc", &core.PasswordFieldValue{}},
+		{"$2abc", &core.PasswordFieldValue{Hash: "$2abc"}},
+		{&core.PasswordFieldValue{Hash: "test", LastError: err}, &core.PasswordFieldValue{Hash: "test", LastError: err}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%v", i, s.raw), func(t *testing.T) {
+			record := core.NewRecord(core.NewBaseCollection("test"))
+			record.SetRaw(f.GetName(), s.raw)
+
+			v, err := f.DriverValue(record)
+
+			vStr, ok := v.(string)
+			if !ok {
+				t.Fatalf("Expected string instance, got %T", v)
+			}
+
+			var errStr string
+			if err != nil {
+				errStr = err.Error()
+			}
+
+			var expectedErrStr string
+			if s.expected.LastError != nil {
+				expectedErrStr = s.expected.LastError.Error()
+			}
+
+			if errStr != expectedErrStr {
+				t.Fatalf("Expected error %q, got %q", expectedErrStr, errStr)
+			}
+
+			if vStr != s.expected.Hash {
+				t.Fatalf("Expected hash %q, got %q", s.expected.Hash, vStr)
+			}
+		})
+	}
+}
+
+func TestPasswordFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.PasswordField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.PasswordField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "123")
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (not required)",
+			&core.PasswordField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{})
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.PasswordField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{})
+				return record
+			},
+			true,
+		},
+		{
+			"empty hash but non-empty plain password (required)",
+			&core.PasswordField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: "test"})
+				return record
+			},
+			true,
+		},
+		{
+			"non-empty hash (required)",
+			&core.PasswordField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Hash: "test"})
+				return record
+			},
+			false,
+		},
+		{
+			"with LastError",
+			&core.PasswordField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{LastError: errors.New("test")})
+				return record
+			},
+			true,
+		},
+		{
+			"< Min",
+			&core.PasswordField{Name: "test", Min: 3},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: "аб"}) // multi-byte chars test
+				return record
+			},
+			true,
+		},
+		{
+			">= Min",
+			&core.PasswordField{Name: "test", Min: 3},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: "абв"}) // multi-byte chars test
+				return record
+			},
+			false,
+		},
+		{
+			"> default Max",
+			&core.PasswordField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: strings.Repeat("a", 72)})
+				return record
+			},
+			true,
+		},
+		{
+			"<= default Max",
+			&core.PasswordField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: strings.Repeat("a", 71)})
+				return record
+			},
+			false,
+		},
+		{
+			"> Max",
+			&core.PasswordField{Name: "test", Max: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: "абв"}) // multi-byte chars test
+				return record
+			},
+			true,
+		},
+		{
+			"<= Max",
+			&core.PasswordField{Name: "test", Max: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: "аб"}) // multi-byte chars test
+				return record
+			},
+			false,
+		},
+		{
+			"non-matching pattern",
+			&core.PasswordField{Name: "test", Pattern: `\d+`},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: "abc"})
+				return record
+			},
+			true,
+		},
+		{
+			"matching pattern",
+			&core.PasswordField{Name: "test", Pattern: `\d+`},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", &core.PasswordFieldValue{Plain: "123"})
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestPasswordFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypePassword)
+	testDefaultFieldNameValidation(t, core.FieldTypePassword)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name         string
+		field        func(col *core.Collection) *core.PasswordField
+		expectErrors []string
+	}{
+		{
+			"zero minimal",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"invalid pattern",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:      "test",
+					Name:    "test",
+					Pattern: "(invalid",
+				}
+			},
+			[]string{"pattern"},
+		},
+		{
+			"valid pattern",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:      "test",
+					Name:    "test",
+					Pattern: `\d+`,
+				}
+			},
+			[]string{},
+		},
+		{
+			"Min < 0",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Min:  -1,
+				}
+			},
+			[]string{"min"},
+		},
+		{
+			"Min > 71",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Min:  72,
+				}
+			},
+			[]string{"min"},
+		},
+		{
+			"valid Min",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Min:  5,
+				}
+			},
+			[]string{},
+		},
+		{
+			"Max < Min",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Min:  2,
+					Max:  1,
+				}
+			},
+			[]string{"max"},
+		},
+		{
+			"Min > Min",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Min:  2,
+					Max:  3,
+				}
+			},
+			[]string{},
+		},
+		{
+			"Max > 71",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Max:  72,
+				}
+			},
+			[]string{"max"},
+		},
+		{
+			"cost < bcrypt.MinCost",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Cost: bcrypt.MinCost - 1,
+				}
+			},
+			[]string{"cost"},
+		},
+		{
+			"cost > bcrypt.MaxCost",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Cost: bcrypt.MaxCost + 1,
+				}
+			},
+			[]string{"cost"},
+		},
+		{
+			"valid cost",
+			func(col *core.Collection) *core.PasswordField {
+				return &core.PasswordField{
+					Id:   "test",
+					Name: "test",
+					Cost: 12,
+				}
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.GetByName("id").SetId("test") // set a dummy known id so that it can be replaced
+
+			field := s.field(collection)
+
+			collection.Fields.Add(field)
+
+			errs := field.ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestPasswordFieldFindSetter(t *testing.T) {
+	scenarios := []struct {
+		name      string
+		key       string
+		value     any
+		field     *core.PasswordField
+		hasSetter bool
+		expected  string
+	}{
+		{
+			"no match",
+			"example",
+			"abc",
+			&core.PasswordField{Name: "test"},
+			false,
+			"",
+		},
+		{
+			"exact match",
+			"test",
+			"abc",
+			&core.PasswordField{Name: "test"},
+			true,
+			`"abc"`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.Add(s.field)
+
+			setter := s.field.FindSetter(s.key)
+
+			hasSetter := setter != nil
+			if hasSetter != s.hasSetter {
+				t.Fatalf("Expected hasSetter %v, got %v", s.hasSetter, hasSetter)
+			}
+
+			if !hasSetter {
+				return
+			}
+
+			record := core.NewRecord(collection)
+			record.SetRaw(s.field.GetName(), []string{"c", "d"})
+
+			setter(record, s.value)
+
+			raw, err := json.Marshal(record.Get(s.field.GetName()))
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestPasswordFieldFindGetter(t *testing.T) {
+	scenarios := []struct {
+		name      string
+		key       string
+		field     *core.PasswordField
+		hasGetter bool
+		expected  string
+	}{
+		{
+			"no match",
+			"example",
+			&core.PasswordField{Name: "test"},
+			false,
+			"",
+		},
+		{
+			"field name match",
+			"test",
+			&core.PasswordField{Name: "test"},
+			true,
+			"test_plain",
+		},
+		{
+			"field name hash modifier",
+			"test:hash",
+			&core.PasswordField{Name: "test"},
+			true,
+			"test_hash",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.Add(s.field)
+
+			getter := s.field.FindGetter(s.key)
+
+			hasGetter := getter != nil
+			if hasGetter != s.hasGetter {
+				t.Fatalf("Expected hasGetter %v, got %v", s.hasGetter, hasGetter)
+			}
+
+			if !hasGetter {
+				return
+			}
+
+			record := core.NewRecord(collection)
+			record.SetRaw(s.field.GetName(), &core.PasswordFieldValue{Hash: "test_hash", Plain: "test_plain"})
+
+			result := getter(record)
+
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %#v", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_relation.go b/server/core_backend-server/core/field_relation.go
new file mode 100644
index 0000000..0225180
--- /dev/null
+++ b/server/core_backend-server/core/field_relation.go
@@ -0,0 +1,360 @@
+package core
+
+import (
+	"context"
+	"database/sql/driver"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func init() {
+	Fields[FieldTypeRelation] = func() Field {
+		return &RelationField{}
+	}
+}
+
+const FieldTypeRelation = "relation"
+
+var (
+	_ Field        = (*RelationField)(nil)
+	_ MultiValuer  = (*RelationField)(nil)
+	_ DriverValuer = (*RelationField)(nil)
+	_ SetterFinder = (*RelationField)(nil)
+)
+
+// RelationField defines "relation" type field for storing single or
+// multiple collection record references.
+//
+// Requires the CollectionId option to be set.
+//
+// If MaxSelect is not set or <= 1, then the field value is expected to be a single record id.
+//
+// If MaxSelect is > 1, then the field value is expected to be a slice of record ids.
+//
+// The respective zero record field value is either empty string (single) or empty string slice (multiple).
+//
+// ---
+//
+// The following additional setter keys are available:
+//
+//   - "fieldName+" - append one or more values to the existing record one. For example:
+//
+//     record.Set("categories+", []string{"new1", "new2"}) // []string{"old1", "old2", "new1", "new2"}
+//
+//   - "+fieldName" - prepend one or more values to the existing record one. For example:
+//
+//     record.Set("+categories", []string{"new1", "new2"}) // []string{"new1", "new2", "old1", "old2"}
+//
+//   - "fieldName-" - subtract one or more values from the existing record one. For example:
+//
+//     record.Set("categories-", "old1") // []string{"old2"}
+type RelationField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// CollectionId is the id of the related collection.
+	CollectionId string `form:"collectionId" json:"collectionId"`
+
+	// CascadeDelete indicates whether the root model should be deleted
+	// in case of delete of all linked relations.
+	CascadeDelete bool `form:"cascadeDelete" json:"cascadeDelete"`
+
+	// MinSelect indicates the min number of allowed relation records
+	// that could be linked to the main model.
+	//
+	// No min limit is applied if it is zero or negative value.
+	MinSelect int `form:"minSelect" json:"minSelect"`
+
+	// MaxSelect indicates the max number of allowed relation records
+	// that could be linked to the main model.
+	//
+	// For multiple select the value must be > 1, otherwise fallbacks to single (default).
+	//
+	// If MinSelect is set, MaxSelect must be at least >= MinSelect.
+	MaxSelect int `form:"maxSelect" json:"maxSelect"`
+
+	// Required will require the field value to be non-empty.
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *RelationField) Type() string {
+	return FieldTypeRelation
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *RelationField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *RelationField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *RelationField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *RelationField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *RelationField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *RelationField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *RelationField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *RelationField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// IsMultiple implements [MultiValuer] interface and checks whether the
+// current field options support multiple values.
+func (f *RelationField) IsMultiple() bool {
+	return f.MaxSelect > 1
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *RelationField) ColumnType(app App) string {
+	if f.IsMultiple() {
+		if IsMysql(app) {
+			return "JSON"
+		}
+		if IsPostgres(app) {
+			return "JSONB DEFAULT '[]' NOT NULL"
+		}
+		return "JSON DEFAULT '[]' NOT NULL"
+	}
+
+	if IsMysql(app) {
+		return "VARCHAR(255)"
+	}
+
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *RelationField) PrepareValue(record *Record, raw any) (any, error) {
+	return f.normalizeValue(raw), nil
+}
+
+func (f *RelationField) normalizeValue(raw any) any {
+	val := list.ToUniqueStringSlice(raw)
+
+	if !f.IsMultiple() {
+		if len(val) > 0 {
+			return val[len(val)-1] // the last selected
+		}
+		return ""
+	}
+
+	return val
+}
+
+// DriverValue implements the [DriverValuer] interface.
+func (f *RelationField) DriverValue(record *Record) (driver.Value, error) {
+	val := list.ToUniqueStringSlice(record.GetRaw(f.Name))
+
+	if !f.IsMultiple() {
+		if len(val) > 0 {
+			return val[len(val)-1], nil // the last selected
+		}
+		return "", nil
+	}
+
+	// serialize as json string array
+	return append(types.JSONArray[string]{}, val...), nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *RelationField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	ids := list.ToUniqueStringSlice(record.GetRaw(f.Name))
+	if len(ids) == 0 {
+		if f.Required {
+			return validation.ErrRequired
+		}
+		return nil // nothing to check
+	}
+
+	if f.MinSelect > 0 && len(ids) < f.MinSelect {
+		return validation.NewError("validation_not_enough_values", "Select at least {{.minSelect}}").
+			SetParams(map[string]any{"minSelect": f.MinSelect})
+	}
+
+	maxSelect := max(f.MaxSelect, 1)
+	if len(ids) > maxSelect {
+		return validation.NewError("validation_too_many_values", "Select no more than {{.maxSelect}}").
+			SetParams(map[string]any{"maxSelect": maxSelect})
+	}
+
+	// check if the related records exist
+	// ---
+	relCollection, err := app.FindCachedCollectionByNameOrId(f.CollectionId)
+	if err != nil {
+		return validation.NewError("validation_missing_rel_collection", "Relation connection is missing or cannot be accessed")
+	}
+
+	var total int
+	_ = app.ConcurrentDB().
+		Select("count(*)").
+		From(relCollection.Name).
+		AndWhere(dbx.In("id", list.ToInterfaceSlice(ids)...)).
+		Row(&total)
+	if total != len(ids) {
+		return validation.NewError("validation_missing_rel_records", "Failed to find all relation records with the provided ids")
+	}
+	// ---
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *RelationField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(&f.CollectionId, validation.Required, validation.By(f.checkCollectionId(app, collection))),
+		validation.Field(&f.MinSelect, validation.Min(0)),
+		validation.Field(&f.MaxSelect, validation.When(f.MinSelect > 0, validation.Required), validation.Min(f.MinSelect)),
+	)
+}
+
+func (f *RelationField) checkCollectionId(app App, collection *Collection) validation.RuleFunc {
+	return func(value any) error {
+		v, _ := value.(string)
+		if v == "" {
+			return nil // nothing to check
+		}
+
+		var oldCollection *Collection
+
+		if !collection.IsNew() {
+			var err error
+			oldCollection, err = app.FindCachedCollectionByNameOrId(collection.Id)
+			if err != nil {
+				return err
+			}
+		}
+
+		// prevent collectionId change
+		if oldCollection != nil {
+			oldField, _ := oldCollection.Fields.GetById(f.Id).(*RelationField)
+			if oldField != nil && oldField.CollectionId != v {
+				return validation.NewError(
+					"validation_field_relation_change",
+					"The relation collection cannot be changed.",
+				)
+			}
+		}
+
+		relCollection, _ := app.FindCachedCollectionByNameOrId(v)
+
+		// validate collectionId
+		if relCollection == nil || relCollection.Id != v {
+			return validation.NewError(
+				"validation_field_relation_missing_collection",
+				"The relation collection doesn't exist.",
+			)
+		}
+
+		// allow only views to have relations to other views
+		// (see https://github.com/pocketbase/pocketbase/issues/3000)
+		if !collection.IsView() && relCollection.IsView() {
+			return validation.NewError(
+				"validation_relation_field_non_view_base_collection",
+				"Only view collections are allowed to have relations to other views.",
+			)
+		}
+
+		return nil
+	}
+}
+
+// ---
+
+// FindSetter implements [SetterFinder] interface method.
+func (f *RelationField) FindSetter(key string) SetterFunc {
+	switch key {
+	case f.Name:
+		return f.setValue
+	case "+" + f.Name:
+		return f.prependValue
+	case f.Name + "+":
+		return f.appendValue
+	case f.Name + "-":
+		return f.subtractValue
+	default:
+		return nil
+	}
+}
+
+func (f *RelationField) setValue(record *Record, raw any) {
+	record.SetRaw(f.Name, f.normalizeValue(raw))
+}
+
+func (f *RelationField) appendValue(record *Record, modifierValue any) {
+	val := record.GetRaw(f.Name)
+
+	val = append(
+		list.ToUniqueStringSlice(val),
+		list.ToUniqueStringSlice(modifierValue)...,
+	)
+
+	f.setValue(record, val)
+}
+
+func (f *RelationField) prependValue(record *Record, modifierValue any) {
+	val := record.GetRaw(f.Name)
+
+	val = append(
+		list.ToUniqueStringSlice(modifierValue),
+		list.ToUniqueStringSlice(val)...,
+	)
+
+	f.setValue(record, val)
+}
+
+func (f *RelationField) subtractValue(record *Record, modifierValue any) {
+	val := record.GetRaw(f.Name)
+
+	val = list.SubtractSlice(
+		list.ToUniqueStringSlice(val),
+		list.ToUniqueStringSlice(modifierValue),
+	)
+
+	f.setValue(record, val)
+}
diff --git a/server/core_backend-server/core/field_relation_test.go b/server/core_backend-server/core/field_relation_test.go
new file mode 100644
index 0000000..8ab4531
--- /dev/null
+++ b/server/core_backend-server/core/field_relation_test.go
@@ -0,0 +1,607 @@
+package core_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestRelationFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeRelation)
+}
+
+func TestRelationFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name     string
+		field    *core.RelationField
+		expected string
+	}{
+		{
+			"single (zero)",
+			&core.RelationField{},
+			"TEXT DEFAULT '' NOT NULL",
+		},
+		{
+			"single",
+			&core.RelationField{MaxSelect: 1},
+			"TEXT DEFAULT '' NOT NULL",
+		},
+		{
+			"multiple",
+			&core.RelationField{MaxSelect: 2},
+			/* SQLite:
+			"JSON DEFAULT '[]' NOT NULL",
+			*/
+			// PostgreSQL:
+			"JSONB DEFAULT '[]' NOT NULL",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			if v := s.field.ColumnType(app); v != s.expected {
+				t.Fatalf("Expected\n%q\ngot\n%q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestRelationFieldIsMultiple(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		field    *core.RelationField
+		expected bool
+	}{
+		{
+			"zero",
+			&core.RelationField{},
+			false,
+		},
+		{
+			"single",
+			&core.RelationField{MaxSelect: 1},
+			false,
+		},
+		{
+			"multiple",
+			&core.RelationField{MaxSelect: 2},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			if v := s.field.IsMultiple(); v != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestRelationFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		field    *core.RelationField
+		expected string
+	}{
+		// single
+		{nil, &core.RelationField{MaxSelect: 1}, `""`},
+		{"", &core.RelationField{MaxSelect: 1}, `""`},
+		{123, &core.RelationField{MaxSelect: 1}, `"123"`},
+		{"a", &core.RelationField{MaxSelect: 1}, `"a"`},
+		{`["a"]`, &core.RelationField{MaxSelect: 1}, `"a"`},
+		{[]string{}, &core.RelationField{MaxSelect: 1}, `""`},
+		{[]string{"a", "b"}, &core.RelationField{MaxSelect: 1}, `"b"`},
+
+		// multiple
+		{nil, &core.RelationField{MaxSelect: 2}, `[]`},
+		{"", &core.RelationField{MaxSelect: 2}, `[]`},
+		{123, &core.RelationField{MaxSelect: 2}, `["123"]`},
+		{"a", &core.RelationField{MaxSelect: 2}, `["a"]`},
+		{`["a"]`, &core.RelationField{MaxSelect: 2}, `["a"]`},
+		{[]string{}, &core.RelationField{MaxSelect: 2}, `[]`},
+		{[]string{"a", "b", "c"}, &core.RelationField{MaxSelect: 2}, `["a","b","c"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v_%v", i, s.raw, s.field.IsMultiple()), func(t *testing.T) {
+			v, err := s.field.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vRaw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(vRaw) != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, vRaw)
+			}
+		})
+	}
+}
+
+func TestRelationFieldDriverValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		raw      any
+		field    *core.RelationField
+		expected string
+	}{
+		// single
+		{nil, &core.RelationField{MaxSelect: 1}, `""`},
+		{"", &core.RelationField{MaxSelect: 1}, `""`},
+		{123, &core.RelationField{MaxSelect: 1}, `"123"`},
+		{"a", &core.RelationField{MaxSelect: 1}, `"a"`},
+		{`["a"]`, &core.RelationField{MaxSelect: 1}, `"a"`},
+		{[]string{}, &core.RelationField{MaxSelect: 1}, `""`},
+		{[]string{"a", "b"}, &core.RelationField{MaxSelect: 1}, `"b"`},
+
+		// multiple
+		{nil, &core.RelationField{MaxSelect: 2}, `[]`},
+		{"", &core.RelationField{MaxSelect: 2}, `[]`},
+		{123, &core.RelationField{MaxSelect: 2}, `["123"]`},
+		{"a", &core.RelationField{MaxSelect: 2}, `["a"]`},
+		{`["a"]`, &core.RelationField{MaxSelect: 2}, `["a"]`},
+		{[]string{}, &core.RelationField{MaxSelect: 2}, `[]`},
+		{[]string{"a", "b", "c"}, &core.RelationField{MaxSelect: 2}, `["a","b","c"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v_%v", i, s.raw, s.field.IsMultiple()), func(t *testing.T) {
+			record := core.NewRecord(core.NewBaseCollection("test"))
+			record.SetRaw(s.field.GetName(), s.raw)
+
+			v, err := s.field.DriverValue(record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if s.field.IsMultiple() {
+				_, ok := v.(types.JSONArray[string])
+				if !ok {
+					t.Fatalf("Expected types.JSONArray value, got %T", v)
+				}
+			} else {
+				_, ok := v.(string)
+				if !ok {
+					t.Fatalf("Expected string value, got %T", v)
+				}
+			}
+
+			vRaw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(vRaw) != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, vRaw)
+			}
+		})
+	}
+}
+
+func TestRelationFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		field       *core.RelationField
+		record      func() *core.Record
+		expectError bool
+	}{
+		// single
+		{
+			"[single] zero field value (not required)",
+			&core.RelationField{Name: "test", MaxSelect: 1, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", "")
+				return record
+			},
+			false,
+		},
+		{
+			"[single] zero field value (required)",
+			&core.RelationField{Name: "test", MaxSelect: 1, CollectionId: demo1.Id, Required: true},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", "")
+				return record
+			},
+			true,
+		},
+		{
+			"[single] id from other collection",
+			&core.RelationField{Name: "test", MaxSelect: 1, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", "achvryl401bhse3")
+				return record
+			},
+			true,
+		},
+		{
+			"[single] valid id",
+			&core.RelationField{Name: "test", MaxSelect: 1, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", "84nmscqy84lsi1t")
+				return record
+			},
+			false,
+		},
+		{
+			"[single] > MaxSelect",
+			&core.RelationField{Name: "test", MaxSelect: 1, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", []string{"84nmscqy84lsi1t", "al1h9ijdeojtsjy"})
+				return record
+			},
+			true,
+		},
+
+		// multiple
+		{
+			"[multiple] zero field value (not required)",
+			&core.RelationField{Name: "test", MaxSelect: 2, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", []string{})
+				return record
+			},
+			false,
+		},
+		{
+			"[multiple] zero field value (required)",
+			&core.RelationField{Name: "test", MaxSelect: 2, CollectionId: demo1.Id, Required: true},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", []string{})
+				return record
+			},
+			true,
+		},
+		{
+			"[multiple] id from other collection",
+			&core.RelationField{Name: "test", MaxSelect: 2, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", []string{"84nmscqy84lsi1t", "achvryl401bhse3"})
+				return record
+			},
+			true,
+		},
+		{
+			"[multiple] valid id",
+			&core.RelationField{Name: "test", MaxSelect: 2, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", []string{"84nmscqy84lsi1t", "al1h9ijdeojtsjy"})
+				return record
+			},
+			false,
+		},
+		{
+			"[multiple] > MaxSelect",
+			&core.RelationField{Name: "test", MaxSelect: 2, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", []string{"84nmscqy84lsi1t", "al1h9ijdeojtsjy", "imy661ixudk5izi"})
+				return record
+			},
+			true,
+		},
+		{
+			"[multiple] < MinSelect",
+			&core.RelationField{Name: "test", MinSelect: 2, MaxSelect: 99, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", []string{"84nmscqy84lsi1t"})
+				return record
+			},
+			true,
+		},
+		{
+			"[multiple] >= MinSelect",
+			&core.RelationField{Name: "test", MinSelect: 2, MaxSelect: 99, CollectionId: demo1.Id},
+			func() *core.Record {
+				record := core.NewRecord(core.NewBaseCollection("test_collection"))
+				record.SetRaw("test", []string{"84nmscqy84lsi1t", "al1h9ijdeojtsjy", "imy661ixudk5izi"})
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestRelationFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeRelation)
+	testDefaultFieldNameValidation(t, core.FieldTypeRelation)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name         string
+		field        func(col *core.Collection) *core.RelationField
+		expectErrors []string
+	}{
+		{
+			"zero minimal",
+			func(col *core.Collection) *core.RelationField {
+				return &core.RelationField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{"collectionId"},
+		},
+		{
+			"invalid collectionId",
+			func(col *core.Collection) *core.RelationField {
+				return &core.RelationField{
+					Id:           "test",
+					Name:         "test",
+					CollectionId: demo1.Name,
+				}
+			},
+			[]string{"collectionId"},
+		},
+		{
+			"valid collectionId",
+			func(col *core.Collection) *core.RelationField {
+				return &core.RelationField{
+					Id:           "test",
+					Name:         "test",
+					CollectionId: demo1.Id,
+				}
+			},
+			[]string{},
+		},
+		{
+			"base->view",
+			func(col *core.Collection) *core.RelationField {
+				return &core.RelationField{
+					Id:           "test",
+					Name:         "test",
+					CollectionId: "v9gwnfh02gjq1q0",
+				}
+			},
+			[]string{"collectionId"},
+		},
+		{
+			"view->view",
+			func(col *core.Collection) *core.RelationField {
+				col.Type = core.CollectionTypeView
+				return &core.RelationField{
+					Id:           "test",
+					Name:         "test",
+					CollectionId: "v9gwnfh02gjq1q0",
+				}
+			},
+			[]string{},
+		},
+		{
+			"MinSelect < 0",
+			func(col *core.Collection) *core.RelationField {
+				return &core.RelationField{
+					Id:           "test",
+					Name:         "test",
+					CollectionId: demo1.Id,
+					MinSelect:    -1,
+				}
+			},
+			[]string{"minSelect"},
+		},
+		{
+			"MinSelect > 0",
+			func(col *core.Collection) *core.RelationField {
+				return &core.RelationField{
+					Id:           "test",
+					Name:         "test",
+					CollectionId: demo1.Id,
+					MinSelect:    1,
+				}
+			},
+			[]string{"maxSelect"},
+		},
+		{
+			"MaxSelect < MinSelect",
+			func(col *core.Collection) *core.RelationField {
+				return &core.RelationField{
+					Id:           "test",
+					Name:         "test",
+					CollectionId: demo1.Id,
+					MinSelect:    2,
+					MaxSelect:    1,
+				}
+			},
+			[]string{"maxSelect"},
+		},
+		{
+			"MaxSelect >= MinSelect",
+			func(col *core.Collection) *core.RelationField {
+				return &core.RelationField{
+					Id:           "test",
+					Name:         "test",
+					CollectionId: demo1.Id,
+					MinSelect:    2,
+					MaxSelect:    2,
+				}
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.GetByName("id").SetId("test") // set a dummy known id so that it can be replaced
+
+			field := s.field(collection)
+
+			collection.Fields.Add(field)
+
+			errs := field.ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestRelationFieldFindSetter(t *testing.T) {
+	scenarios := []struct {
+		name      string
+		key       string
+		value     any
+		field     *core.RelationField
+		hasSetter bool
+		expected  string
+	}{
+		{
+			"no match",
+			"example",
+			"b",
+			&core.RelationField{Name: "test", MaxSelect: 1},
+			false,
+			"",
+		},
+		{
+			"exact match (single)",
+			"test",
+			"b",
+			&core.RelationField{Name: "test", MaxSelect: 1},
+			true,
+			`"b"`,
+		},
+		{
+			"exact match (multiple)",
+			"test",
+			[]string{"a", "b"},
+			&core.RelationField{Name: "test", MaxSelect: 2},
+			true,
+			`["a","b"]`,
+		},
+		{
+			"append (single)",
+			"test+",
+			"b",
+			&core.RelationField{Name: "test", MaxSelect: 1},
+			true,
+			`"b"`,
+		},
+		{
+			"append (multiple)",
+			"test+",
+			[]string{"a"},
+			&core.RelationField{Name: "test", MaxSelect: 2},
+			true,
+			`["c","d","a"]`,
+		},
+		{
+			"prepend (single)",
+			"+test",
+			"b",
+			&core.RelationField{Name: "test", MaxSelect: 1},
+			true,
+			`"d"`, // the last of the existing values
+		},
+		{
+			"prepend (multiple)",
+			"+test",
+			[]string{"a"},
+			&core.RelationField{Name: "test", MaxSelect: 2},
+			true,
+			`["a","c","d"]`,
+		},
+		{
+			"subtract (single)",
+			"test-",
+			"d",
+			&core.RelationField{Name: "test", MaxSelect: 1},
+			true,
+			`"c"`,
+		},
+		{
+			"subtract (multiple)",
+			"test-",
+			[]string{"unknown", "c"},
+			&core.RelationField{Name: "test", MaxSelect: 2},
+			true,
+			`["d"]`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.Add(s.field)
+
+			setter := s.field.FindSetter(s.key)
+
+			hasSetter := setter != nil
+			if hasSetter != s.hasSetter {
+				t.Fatalf("Expected hasSetter %v, got %v", s.hasSetter, hasSetter)
+			}
+
+			if !hasSetter {
+				return
+			}
+
+			record := core.NewRecord(collection)
+			record.SetRaw(s.field.GetName(), []string{"c", "d"})
+
+			setter(record, s.value)
+
+			raw, err := json.Marshal(record.Get(s.field.GetName()))
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, rawStr)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_select.go b/server/core_backend-server/core/field_select.go
new file mode 100644
index 0000000..693d873
--- /dev/null
+++ b/server/core_backend-server/core/field_select.go
@@ -0,0 +1,285 @@
+package core
+
+import (
+	"context"
+	"database/sql/driver"
+	"slices"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func init() {
+	Fields[FieldTypeSelect] = func() Field {
+		return &SelectField{}
+	}
+}
+
+const FieldTypeSelect = "select"
+
+var (
+	_ Field        = (*SelectField)(nil)
+	_ MultiValuer  = (*SelectField)(nil)
+	_ DriverValuer = (*SelectField)(nil)
+	_ SetterFinder = (*SelectField)(nil)
+)
+
+// SelectField defines "select" type field for storing single or
+// multiple string values from a predefined list.
+//
+// Requires the Values option to be set.
+//
+// If MaxSelect is not set or <= 1, then the field value is expected to be a single Values element.
+//
+// If MaxSelect is > 1, then the field value is expected to be a subset of Values slice.
+//
+// The respective zero record field value is either empty string (single) or empty string slice (multiple).
+//
+// ---
+//
+// The following additional setter keys are available:
+//
+//   - "fieldName+" - append one or more values to the existing record one. For example:
+//
+//     record.Set("roles+", []string{"new1", "new2"}) // []string{"old1", "old2", "new1", "new2"}
+//
+//   - "+fieldName" - prepend one or more values to the existing record one. For example:
+//
+//     record.Set("+roles", []string{"new1", "new2"}) // []string{"new1", "new2", "old1", "old2"}
+//
+//   - "fieldName-" - subtract one or more values from the existing record one. For example:
+//
+//     record.Set("roles-", "old1") // []string{"old2"}
+type SelectField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// Values specifies the list of accepted values.
+	Values []string `form:"values" json:"values"`
+
+	// MaxSelect specifies the max allowed selected values.
+	//
+	// For multiple select the value must be > 1, otherwise fallbacks to single (default).
+	MaxSelect int `form:"maxSelect" json:"maxSelect"`
+
+	// Required will require the field value to be non-empty.
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *SelectField) Type() string {
+	return FieldTypeSelect
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *SelectField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *SelectField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *SelectField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *SelectField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *SelectField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *SelectField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *SelectField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *SelectField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// IsMultiple implements [MultiValuer] interface and checks whether the
+// current field options support multiple values.
+func (f *SelectField) IsMultiple() bool {
+	return f.MaxSelect > 1
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *SelectField) ColumnType(app App) string {
+	if f.IsMultiple() {
+		if IsMysql(app) {
+			return "JSON"
+		}
+		if IsPostgres(app) {
+			return "JSONB DEFAULT '[]' NOT NULL"
+		}
+		return "JSON DEFAULT '[]' NOT NULL"
+	}
+
+	if IsMysql(app) {
+		return "VARCHAR(255)"
+	}
+
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *SelectField) PrepareValue(record *Record, raw any) (any, error) {
+	return f.normalizeValue(raw), nil
+}
+
+func (f *SelectField) normalizeValue(raw any) any {
+	val := list.ToUniqueStringSlice(raw)
+
+	if !f.IsMultiple() {
+		if len(val) > 0 {
+			return val[len(val)-1] // the last selected
+		}
+		return ""
+	}
+
+	return val
+}
+
+// DriverValue implements the [DriverValuer] interface.
+func (f *SelectField) DriverValue(record *Record) (driver.Value, error) {
+	val := list.ToUniqueStringSlice(record.GetRaw(f.Name))
+
+	if !f.IsMultiple() {
+		if len(val) > 0 {
+			return val[len(val)-1], nil // the last selected
+		}
+		return "", nil
+	}
+
+	// serialize as json string array
+	return append(types.JSONArray[string]{}, val...), nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *SelectField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	normalizedVal := list.ToUniqueStringSlice(record.GetRaw(f.Name))
+	if len(normalizedVal) == 0 {
+		if f.Required {
+			return validation.ErrRequired
+		}
+		return nil // nothing to check
+	}
+
+	maxSelect := max(f.MaxSelect, 1)
+
+	// check max selected items
+	if len(normalizedVal) > maxSelect {
+		return validation.NewError("validation_too_many_values", "Select no more than {{.maxSelect}}").
+			SetParams(map[string]any{"maxSelect": maxSelect})
+	}
+
+	// check against the allowed values
+	for _, val := range normalizedVal {
+		if !slices.Contains(f.Values, val) {
+			return validation.NewError("validation_invalid_value", "Invalid value {{.value}}").
+				SetParams(map[string]any{"value": val})
+		}
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *SelectField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	max := len(f.Values)
+	if max == 0 {
+		max = 1
+	}
+
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(&f.Values, validation.Required),
+		validation.Field(&f.MaxSelect, validation.Min(0), validation.Max(max)),
+	)
+}
+
+// FindSetter implements the [SetterFinder] interface.
+func (f *SelectField) FindSetter(key string) SetterFunc {
+	switch key {
+	case f.Name:
+		return f.setValue
+	case "+" + f.Name:
+		return f.prependValue
+	case f.Name + "+":
+		return f.appendValue
+	case f.Name + "-":
+		return f.subtractValue
+	default:
+		return nil
+	}
+}
+
+func (f *SelectField) setValue(record *Record, raw any) {
+	record.SetRaw(f.Name, f.normalizeValue(raw))
+}
+
+func (f *SelectField) appendValue(record *Record, modifierValue any) {
+	val := record.GetRaw(f.Name)
+
+	val = append(
+		list.ToUniqueStringSlice(val),
+		list.ToUniqueStringSlice(modifierValue)...,
+	)
+
+	f.setValue(record, val)
+}
+
+func (f *SelectField) prependValue(record *Record, modifierValue any) {
+	val := record.GetRaw(f.Name)
+
+	val = append(
+		list.ToUniqueStringSlice(modifierValue),
+		list.ToUniqueStringSlice(val)...,
+	)
+
+	f.setValue(record, val)
+}
+
+func (f *SelectField) subtractValue(record *Record, modifierValue any) {
+	val := record.GetRaw(f.Name)
+
+	val = list.SubtractSlice(
+		list.ToUniqueStringSlice(val),
+		list.ToUniqueStringSlice(modifierValue),
+	)
+
+	f.setValue(record, val)
+}
diff --git a/server/core_backend-server/core/field_select_test.go b/server/core_backend-server/core/field_select_test.go
new file mode 100644
index 0000000..4e47cf8
--- /dev/null
+++ b/server/core_backend-server/core/field_select_test.go
@@ -0,0 +1,520 @@
+package core_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestSelectFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeSelect)
+}
+
+func TestSelectFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name     string
+		field    *core.SelectField
+		expected string
+	}{
+		{
+			"single (zero)",
+			&core.SelectField{},
+			"TEXT DEFAULT '' NOT NULL",
+		},
+		{
+			"single",
+			&core.SelectField{MaxSelect: 1},
+			"TEXT DEFAULT '' NOT NULL",
+		},
+		{
+			"multiple",
+			&core.SelectField{MaxSelect: 2},
+			/* SQLite:
+			"JSON DEFAULT '[]' NOT NULL",
+			*/
+			// PostgreSQL:
+			"JSONB DEFAULT '[]' NOT NULL",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			if v := s.field.ColumnType(app); v != s.expected {
+				t.Fatalf("Expected\n%q\ngot\n%q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestSelectFieldIsMultiple(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		field    *core.SelectField
+		expected bool
+	}{
+		{
+			"single (zero)",
+			&core.SelectField{},
+			false,
+		},
+		{
+			"single",
+			&core.SelectField{MaxSelect: 1},
+			false,
+		},
+		{
+			"multiple (>1)",
+			&core.SelectField{MaxSelect: 2},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			if v := s.field.IsMultiple(); v != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestSelectFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		field    *core.SelectField
+		expected string
+	}{
+		// single
+		{nil, &core.SelectField{}, `""`},
+		{"", &core.SelectField{}, `""`},
+		{123, &core.SelectField{}, `"123"`},
+		{"a", &core.SelectField{}, `"a"`},
+		{`["a"]`, &core.SelectField{}, `"a"`},
+		{[]string{}, &core.SelectField{}, `""`},
+		{[]string{"a", "b"}, &core.SelectField{}, `"b"`},
+
+		// multiple
+		{nil, &core.SelectField{MaxSelect: 2}, `[]`},
+		{"", &core.SelectField{MaxSelect: 2}, `[]`},
+		{123, &core.SelectField{MaxSelect: 2}, `["123"]`},
+		{"a", &core.SelectField{MaxSelect: 2}, `["a"]`},
+		{`["a"]`, &core.SelectField{MaxSelect: 2}, `["a"]`},
+		{[]string{}, &core.SelectField{MaxSelect: 2}, `[]`},
+		{[]string{"a", "b", "c"}, &core.SelectField{MaxSelect: 2}, `["a","b","c"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v_%v", i, s.raw, s.field.IsMultiple()), func(t *testing.T) {
+			v, err := s.field.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vRaw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(vRaw) != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, vRaw)
+			}
+		})
+	}
+}
+
+func TestSelectFieldDriverValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		raw      any
+		field    *core.SelectField
+		expected string
+	}{
+		// single
+		{nil, &core.SelectField{}, `""`},
+		{"", &core.SelectField{}, `""`},
+		{123, &core.SelectField{}, `"123"`},
+		{"a", &core.SelectField{}, `"a"`},
+		{`["a"]`, &core.SelectField{}, `"a"`},
+		{[]string{}, &core.SelectField{}, `""`},
+		{[]string{"a", "b"}, &core.SelectField{}, `"b"`},
+
+		// multiple
+		{nil, &core.SelectField{MaxSelect: 2}, `[]`},
+		{"", &core.SelectField{MaxSelect: 2}, `[]`},
+		{123, &core.SelectField{MaxSelect: 2}, `["123"]`},
+		{"a", &core.SelectField{MaxSelect: 2}, `["a"]`},
+		{`["a"]`, &core.SelectField{MaxSelect: 2}, `["a"]`},
+		{[]string{}, &core.SelectField{MaxSelect: 2}, `[]`},
+		{[]string{"a", "b", "c"}, &core.SelectField{MaxSelect: 2}, `["a","b","c"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v_%v", i, s.raw, s.field.IsMultiple()), func(t *testing.T) {
+			record := core.NewRecord(core.NewBaseCollection("test"))
+			record.SetRaw(s.field.GetName(), s.raw)
+
+			v, err := s.field.DriverValue(record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if s.field.IsMultiple() {
+				_, ok := v.(types.JSONArray[string])
+				if !ok {
+					t.Fatalf("Expected types.JSONArray value, got %T", v)
+				}
+			} else {
+				_, ok := v.(string)
+				if !ok {
+					t.Fatalf("Expected string value, got %T", v)
+				}
+			}
+
+			vRaw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(vRaw) != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, vRaw)
+			}
+		})
+	}
+}
+
+func TestSelectFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	values := []string{"a", "b", "c"}
+
+	scenarios := []struct {
+		name        string
+		field       *core.SelectField
+		record      func() *core.Record
+		expectError bool
+	}{
+		// single
+		{
+			"[single] zero field value (not required)",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 1},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			false,
+		},
+		{
+			"[single] zero field value (required)",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 1, Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			true,
+		},
+		{
+			"[single] unknown value",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 1},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "unknown")
+				return record
+			},
+			true,
+		},
+		{
+			"[single] known value",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 1},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "a")
+				return record
+			},
+			false,
+		},
+		{
+			"[single] > MaxSelect",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 1},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []string{"a", "b"})
+				return record
+			},
+			true,
+		},
+
+		// multiple
+		{
+			"[multiple] zero field value (not required)",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []string{})
+				return record
+			},
+			false,
+		},
+		{
+			"[multiple] zero field value (required)",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 2, Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []string{})
+				return record
+			},
+			true,
+		},
+		{
+			"[multiple] unknown value",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []string{"a", "unknown"})
+				return record
+			},
+			true,
+		},
+		{
+			"[multiple] known value",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []string{"a", "b"})
+				return record
+			},
+			false,
+		},
+		{
+			"[multiple] > MaxSelect",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []string{"a", "b", "c"})
+				return record
+			},
+			true,
+		},
+		{
+			"[multiple] > MaxSelect (duplicated values)",
+			&core.SelectField{Name: "test", Values: values, MaxSelect: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", []string{"a", "b", "b", "a"})
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestSelectFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeSelect)
+	testDefaultFieldNameValidation(t, core.FieldTypeSelect)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.SelectField
+		expectErrors []string
+	}{
+		{
+			"zero minimal",
+			func() *core.SelectField {
+				return &core.SelectField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{"values"},
+		},
+		{
+			"MaxSelect > Values length",
+			func() *core.SelectField {
+				return &core.SelectField{
+					Id:        "test",
+					Name:      "test",
+					Values:    []string{"a", "b"},
+					MaxSelect: 3,
+				}
+			},
+			[]string{"maxSelect"},
+		},
+		{
+			"MaxSelect <= Values length",
+			func() *core.SelectField {
+				return &core.SelectField{
+					Id:        "test",
+					Name:      "test",
+					Values:    []string{"a", "b"},
+					MaxSelect: 2,
+				}
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			field := s.field()
+
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.Add(field)
+
+			errs := field.ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestSelectFieldFindSetter(t *testing.T) {
+	values := []string{"a", "b", "c", "d"}
+
+	scenarios := []struct {
+		name      string
+		key       string
+		value     any
+		field     *core.SelectField
+		hasSetter bool
+		expected  string
+	}{
+		{
+			"no match",
+			"example",
+			"b",
+			&core.SelectField{Name: "test", MaxSelect: 1, Values: values},
+			false,
+			"",
+		},
+		{
+			"exact match (single)",
+			"test",
+			"b",
+			&core.SelectField{Name: "test", MaxSelect: 1, Values: values},
+			true,
+			`"b"`,
+		},
+		{
+			"exact match (multiple)",
+			"test",
+			[]string{"a", "b"},
+			&core.SelectField{Name: "test", MaxSelect: 2, Values: values},
+			true,
+			`["a","b"]`,
+		},
+		{
+			"append (single)",
+			"test+",
+			"b",
+			&core.SelectField{Name: "test", MaxSelect: 1, Values: values},
+			true,
+			`"b"`,
+		},
+		{
+			"append (multiple)",
+			"test+",
+			[]string{"a"},
+			&core.SelectField{Name: "test", MaxSelect: 2, Values: values},
+			true,
+			`["c","d","a"]`,
+		},
+		{
+			"prepend (single)",
+			"+test",
+			"b",
+			&core.SelectField{Name: "test", MaxSelect: 1, Values: values},
+			true,
+			`"d"`, // the last of the existing values
+		},
+		{
+			"prepend (multiple)",
+			"+test",
+			[]string{"a"},
+			&core.SelectField{Name: "test", MaxSelect: 2, Values: values},
+			true,
+			`["a","c","d"]`,
+		},
+		{
+			"subtract (single)",
+			"test-",
+			"d",
+			&core.SelectField{Name: "test", MaxSelect: 1, Values: values},
+			true,
+			`"c"`,
+		},
+		{
+			"subtract (multiple)",
+			"test-",
+			[]string{"unknown", "c"},
+			&core.SelectField{Name: "test", MaxSelect: 2, Values: values},
+			true,
+			`["d"]`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.Add(s.field)
+
+			setter := s.field.FindSetter(s.key)
+
+			hasSetter := setter != nil
+			if hasSetter != s.hasSetter {
+				t.Fatalf("Expected hasSetter %v, got %v", s.hasSetter, hasSetter)
+			}
+
+			if !hasSetter {
+				return
+			}
+
+			record := core.NewRecord(collection)
+			record.SetRaw(s.field.GetName(), []string{"c", "d"})
+
+			setter(record, s.value)
+
+			raw, err := json.Marshal(record.Get(s.field.GetName()))
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, rawStr)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_test.go b/server/core_backend-server/core/field_test.go
new file mode 100644
index 0000000..2ee47aa
--- /dev/null
+++ b/server/core_backend-server/core/field_test.go
@@ -0,0 +1,265 @@
+package core_test
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func testFieldBaseMethods(t *testing.T, fieldType string) {
+	factory, ok := core.Fields[fieldType]
+	if !ok {
+		t.Fatalf("Missing %q field factory", fieldType)
+	}
+
+	f := factory()
+	if f == nil {
+		t.Fatal("Expected non-nil Field instance")
+	}
+
+	t.Run("type", func(t *testing.T) {
+		if v := f.Type(); v != fieldType {
+			t.Fatalf("Expected type %q, got %q", fieldType, v)
+		}
+	})
+
+	t.Run("id", func(t *testing.T) {
+		testValues := []string{"new_id", ""}
+		for _, expected := range testValues {
+			f.SetId(expected)
+			if v := f.GetId(); v != expected {
+				t.Fatalf("Expected id %q, got %q", expected, v)
+			}
+		}
+	})
+
+	t.Run("name", func(t *testing.T) {
+		testValues := []string{"new_name", ""}
+		for _, expected := range testValues {
+			f.SetName(expected)
+			if v := f.GetName(); v != expected {
+				t.Fatalf("Expected name %q, got %q", expected, v)
+			}
+		}
+	})
+
+	t.Run("system", func(t *testing.T) {
+		testValues := []bool{false, true}
+		for _, expected := range testValues {
+			f.SetSystem(expected)
+			if v := f.GetSystem(); v != expected {
+				t.Fatalf("Expected system %v, got %v", expected, v)
+			}
+		}
+	})
+
+	t.Run("hidden", func(t *testing.T) {
+		testValues := []bool{false, true}
+		for _, expected := range testValues {
+			f.SetHidden(expected)
+			if v := f.GetHidden(); v != expected {
+				t.Fatalf("Expected hidden %v, got %v", expected, v)
+			}
+		}
+	})
+}
+
+func testDefaultFieldIdValidation(t *testing.T, fieldType string) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       func() core.Field
+		expectError bool
+	}{
+		{
+			"empty value",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				return f
+			},
+			true,
+		},
+		{
+			"invalid length",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetId(strings.Repeat("a", 101))
+				return f
+			},
+			true,
+		},
+		{
+			"valid length",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetId(strings.Repeat("a", 100))
+				return f
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run("[id] "+s.name, func(t *testing.T) {
+			errs, _ := s.field().ValidateSettings(context.Background(), app, collection).(validation.Errors)
+
+			hasErr := errs["id"] != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+		})
+	}
+}
+
+func testDefaultFieldNameValidation(t *testing.T, fieldType string) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       func() core.Field
+		expectError bool
+	}{
+		{
+			"empty value",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				return f
+			},
+			true,
+		},
+		{
+			"invalid length",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName(strings.Repeat("a", 101))
+				return f
+			},
+			true,
+		},
+		{
+			"valid length",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName(strings.Repeat("a", 100))
+				return f
+			},
+			false,
+		},
+		{
+			"invalid regex",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("test(")
+				return f
+			},
+			true,
+		},
+		{
+			"valid regex",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("test_123")
+				return f
+			},
+			false,
+		},
+		{
+			"_via_",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("a_via_b")
+				return f
+			},
+			true,
+		},
+		{
+			"system reserved - null",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("null")
+				return f
+			},
+			true,
+		},
+		{
+			"system reserved - false",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("false")
+				return f
+			},
+			true,
+		},
+		{
+			"system reserved - true",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("true")
+				return f
+			},
+			true,
+		},
+		{
+			"system reserved - _rowid_",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				/* SQLite:
+				f.SetName("_rowid_")
+				*/
+				// PostgreSQL:
+				f.SetName("ctid")
+				return f
+			},
+			true,
+		},
+		{
+			"system reserved - expand",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("expand")
+				return f
+			},
+			true,
+		},
+		{
+			"system reserved - collectionId",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("collectionId")
+				return f
+			},
+			true,
+		},
+		{
+			"system reserved - collectionName",
+			func() core.Field {
+				f := core.Fields[fieldType]()
+				f.SetName("collectionName")
+				return f
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run("[name] "+s.name, func(t *testing.T) {
+			errs, _ := s.field().ValidateSettings(context.Background(), app, collection).(validation.Errors)
+
+			hasErr := errs["name"] != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_text.go b/server/core_backend-server/core/field_text.go
new file mode 100644
index 0000000..be6ee90
--- /dev/null
+++ b/server/core_backend-server/core/field_text.go
@@ -0,0 +1,416 @@
+package core
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/google/uuid"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+func init() {
+	Fields[FieldTypeText] = func() Field {
+		return &TextField{}
+	}
+}
+
+const FieldTypeText = "text"
+
+const autogenerateModifier = ":autogenerate"
+
+var (
+	_ Field             = (*TextField)(nil)
+	_ SetterFinder      = (*TextField)(nil)
+	_ RecordInterceptor = (*TextField)(nil)
+)
+
+var forbiddenPKCharacters = []string{
+	".", "/", `\`, "|", `"`, "'", "`",
+	"<", ">", ":", "?", "*", "%", "$",
+	"\000", "\t", "\n", "\r", " ",
+}
+
+// (see largestReservedPKLength)
+var caseInsensitiveReservedPKs = []string{
+	// reserved Windows files names
+	"CON", "PRN", "AUX", "NUL",
+	"COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9",
+	"LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
+}
+
+const largestReservedPKLength = 4
+
+// TextField defines "text" type field for storing any string value.
+//
+// The respective zero record field value is empty string.
+//
+// The following additional setter keys are available:
+//
+// - "fieldName:autogenerate" - autogenerate field value if AutogeneratePattern is set. For example:
+//
+//	record.Set("slug:autogenerate", "") // [random value]
+//	record.Set("slug:autogenerate", "abc-") // abc-[random value]
+type TextField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// Min specifies the minimum required string characters.
+	//
+	// if zero value, no min limit is applied.
+	Min int `form:"min" json:"min"`
+
+	// Max specifies the maximum allowed string characters.
+	//
+	// If zero, a default limit of 5000 is applied.
+	Max int `form:"max" json:"max"`
+
+	// Pattern specifies an optional regex pattern to match against the field value.
+	//
+	// Leave it empty to skip the pattern check.
+	Pattern string `form:"pattern" json:"pattern"`
+
+	// AutogeneratePattern specifies an optional regex pattern that could
+	// be used to generate random string from it and set it automatically
+	// on record create if no explicit value is set or when the `:autogenerate` modifier is used.
+	//
+	// Note: the generated value still needs to satisfy min, max, pattern (if set)
+	AutogeneratePattern string `form:"autogeneratePattern" json:"autogeneratePattern"`
+
+	// Required will require the field value to be non-empty string.
+	Required bool `form:"required" json:"required"`
+
+	// PrimaryKey will mark the field as primary key.
+	//
+	// A single collection can have only 1 field marked as primary key.
+	PrimaryKey bool `form:"primaryKey" json:"primaryKey"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *TextField) Type() string {
+	return FieldTypeText
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *TextField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *TextField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *TextField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *TextField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *TextField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *TextField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *TextField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *TextField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *TextField) ColumnType(app App) string {
+	if f.PrimaryKey {
+		// note: the default is just a last resort fallback to avoid empty
+		// string values in case the record was inserted with raw sql and
+		// it is not actually used when operating with the db abstraction
+		if IsPostgres(app) {
+			if f.Pattern == security.PredefinedAutoGeneratePattern_uuidv7 {
+				return "UUID PRIMARY KEY DEFAULT uuid_generate_v7() NOT NULL"
+			}
+		}
+		if IsMysql(app) {
+			return "VARCHAR(50) PRIMARY KEY NOT NULL"
+		}
+		return "TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL"
+	}
+
+	if IsMysql(app) {
+		if f.Max > 0 && f.Max <= 255 {
+			return fmt.Sprintf("VARCHAR(%d)", f.Max)
+		}
+		return "VARCHAR(255)"
+	}
+
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *TextField) PrepareValue(record *Record, raw any) (any, error) {
+	return cast.ToString(raw), nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *TextField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	newVal, ok := record.GetRaw(f.Name).(string)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if f.PrimaryKey {
+		// disallow PK change
+		if !record.IsNew() {
+			oldVal := record.LastSavedPK()
+			if oldVal != newVal {
+				return validation.NewError("validation_pk_change", "The record primary key cannot be changed.")
+			}
+			if oldVal != "" {
+				// no need to further validate because the id can't be updated
+				// and because the id could have been inserted manually by migration from another system
+				// that may not comply with the user defined PocketBase validations
+				return nil
+			}
+		} else {
+			// this technically shouldn't be necessarily but again to
+			// minimize misuse of the Pattern validator that could cause
+			// side-effects on some platforms check for duplicates in a case-insensitive manner
+			//
+			// (@todo eventually may get replaced in the future with a system unique constraint to avoid races or wrapping the request in a transaction)
+			if f.Pattern != defaultLowercaseRecordIdPattern {
+				var exists int
+				err := app.ConcurrentDB().
+					Select("(1)").
+					From(record.TableName()).
+					Where(dbx.NewExp("id = {:id} COLLATE NOCASE", dbx.Params{"id": newVal})).
+					Limit(1).
+					Row(&exists)
+				if exists > 0 || (err != nil && !errors.Is(err, sql.ErrNoRows)) {
+					return validation.NewError("validation_pk_invalid", "The record primary key is invalid or already exists.")
+				}
+			}
+		}
+	}
+
+	return f.ValidatePlainValue(newVal)
+}
+
+// ValidatePlainValue validates the provided string against the field options.
+func (f *TextField) ValidatePlainValue(value string) error {
+	if f.Required || f.PrimaryKey {
+		if err := validation.Required.Validate(value); err != nil {
+			return err
+		}
+	}
+
+	if value == "" {
+		return nil // nothing to check
+	}
+
+	// note: casted to []rune to count multi-byte chars as one
+	length := len([]rune(value))
+
+	if f.Min > 0 && length < f.Min {
+		return validation.NewError("validation_min_text_constraint", "Must be at least {{.min}} character(s).").
+			SetParams(map[string]any{"min": f.Min})
+	}
+
+	max := f.Max
+	if max == 0 {
+		max = 5000
+	}
+
+	if max > 0 && length > max {
+		return validation.NewError("validation_max_text_constraint", "Must be no more than {{.max}} character(s).").
+			SetParams(map[string]any{"max": max})
+	}
+
+	if f.Pattern != "" {
+		switch f.Pattern {
+		case security.PredefinedAutoGeneratePattern_uuidv7:
+			// validate uuid v7 format
+			if _, err := uuid.Parse(value); err != nil {
+				return validation.NewError("validation_invalid_format", "Invalid UUID format")
+			}
+		default:
+			match, _ := regexp.MatchString(f.Pattern, value)
+			if !match {
+				return validation.NewError("validation_invalid_format", "Invalid value format")
+			}
+		}
+	}
+
+	// additional primary key checks to minimize eventual filesystem compatibility issues
+	// because the primary key is often used as a file/directory name
+	if f.PrimaryKey && f.Pattern != defaultLowercaseRecordIdPattern {
+		for _, ch := range forbiddenPKCharacters {
+			if strings.Contains(value, ch) {
+				return validation.NewError("validation_forbidden_pk_character", "'{{.ch}}' is not a valid primary key character.").
+					SetParams(map[string]any{"ch": ch})
+			}
+		}
+
+		if largestReservedPKLength >= length {
+			for _, reserved := range caseInsensitiveReservedPKs {
+				if strings.EqualFold(value, reserved) {
+					return validation.NewError("validation_reserved_pk", "The primary key '{{.reserved}}' is reserved and cannot be used.").
+						SetParams(map[string]any{"reserved": reserved})
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *TextField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name,
+			validation.By(DefaultFieldNameValidationRule),
+			validation.When(f.PrimaryKey, validation.In(idColumn).Error(`The primary key must be named "id".`)),
+		),
+		validation.Field(&f.PrimaryKey, validation.By(f.checkOtherFieldsForPK(collection))),
+		validation.Field(&f.Min, validation.Min(0), validation.Max(maxSafeJSONInt)),
+		validation.Field(&f.Max, validation.Min(f.Min), validation.Max(maxSafeJSONInt)),
+		validation.Field(&f.Pattern, validation.When(f.PrimaryKey, validation.Required), validation.By(validators.IsRegex)),
+		validation.Field(&f.Hidden, validation.When(f.PrimaryKey, validation.Empty)),
+		validation.Field(&f.Required, validation.When(f.PrimaryKey, validation.Required)),
+		validation.Field(&f.AutogeneratePattern, validation.By(validators.IsRegex), validation.By(f.checkAutogeneratePattern)),
+	)
+}
+
+func (f *TextField) checkOtherFieldsForPK(collection *Collection) validation.RuleFunc {
+	return func(value any) error {
+		v, _ := value.(bool)
+		if !v {
+			return nil // not a pk
+		}
+
+		totalPrimaryKeys := 0
+		for _, field := range collection.Fields {
+			if text, ok := field.(*TextField); ok && text.PrimaryKey {
+				totalPrimaryKeys++
+			}
+
+			if totalPrimaryKeys > 1 {
+				return validation.NewError("validation_unsupported_composite_pk", "Composite PKs are not supported and the collection must have only 1 PK.")
+			}
+		}
+
+		return nil
+	}
+}
+
+func (f *TextField) checkAutogeneratePattern(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil // nothing to check
+	}
+
+	// run 10 tests to check for conflicts with the other field validators
+	for i := 0; i < 10; i++ {
+		generated, err := security.RandomStringByRegex(v)
+		if err != nil {
+			return validation.NewError("validation_invalid_autogenerate_pattern", err.Error())
+		}
+
+		// (loosely) check whether the generated pattern satisfies the current field settings
+		if err := f.ValidatePlainValue(generated); err != nil {
+			return validation.NewError(
+				"validation_invalid_autogenerate_pattern_value",
+				fmt.Sprintf("The provided autogenerate pattern could produce invalid field values, ex.: %q. Error: %v", generated, err),
+			)
+		}
+	}
+
+	return nil
+}
+
+// Intercept implements the [RecordInterceptor] interface.
+func (f *TextField) Intercept(
+	ctx context.Context,
+	app App,
+	record *Record,
+	actionName string,
+	actionFunc func() error,
+) error {
+	// set autogenerated value if missing for new records
+	switch actionName {
+	case InterceptorActionValidate, InterceptorActionCreate:
+		if f.AutogeneratePattern != "" && f.hasZeroValue(record) && record.IsNew() {
+			v, err := security.RandomStringByRegex(f.AutogeneratePattern)
+			if err != nil {
+				return fmt.Errorf("failed to autogenerate %q value: %w", f.Name, err)
+			}
+			record.SetRaw(f.Name, v)
+		}
+	}
+
+	return actionFunc()
+}
+
+func (f *TextField) hasZeroValue(record *Record) bool {
+	v, _ := record.GetRaw(f.Name).(string)
+	return v == ""
+}
+
+// FindSetter implements the [SetterFinder] interface.
+func (f *TextField) FindSetter(key string) SetterFunc {
+	switch key {
+	case f.Name:
+		return func(record *Record, raw any) {
+			record.SetRaw(f.Name, cast.ToString(raw))
+		}
+	case f.Name + autogenerateModifier:
+		return func(record *Record, raw any) {
+			v := cast.ToString(raw)
+
+			if f.AutogeneratePattern != "" {
+				generated, _ := security.RandomStringByRegex(f.AutogeneratePattern)
+				v += generated
+			}
+
+			record.SetRaw(f.Name, v)
+		}
+	default:
+		return nil
+	}
+}
diff --git a/server/core_backend-server/core/field_text_test.go b/server/core_backend-server/core/field_text_test.go
new file mode 100644
index 0000000..94357d1
--- /dev/null
+++ b/server/core_backend-server/core/field_text_test.go
@@ -0,0 +1,744 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestTextFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeText)
+}
+
+func TestTextFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.TextField{}
+
+	expected := "TEXT DEFAULT '' NOT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestTextFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.TextField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{"", ""},
+		{"test", "test"},
+		{false, "false"},
+		{true, "true"},
+		{123.456, "123.456"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vStr, ok := v.(string)
+			if !ok {
+				t.Fatalf("Expected string instance, got %T", v)
+			}
+
+			if vStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestTextFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	existingRecord, err := app.FindFirstRecordByFilter(collection, "id != ''")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		field       *core.TextField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.TextField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (not required)",
+			&core.TextField{Name: "test", Pattern: `\d+`, Min: 10, Max: 100}, // other fields validators should be ignored
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.TextField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero field value (required)",
+			&core.TextField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character / (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc/")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character \\ (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc\\")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character . (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc.")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character ' ' (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "ab c")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character * (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc*")
+				return record
+			},
+			false,
+		},
+		{
+			"special forbidden character / (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc/")
+				return record
+			},
+			true,
+		},
+		{
+			"special forbidden character \\ (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc\\")
+				return record
+			},
+			true,
+		},
+		{
+			"special forbidden character . (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc.")
+				return record
+			},
+			true,
+		},
+		{
+			"special forbidden character ' ' (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "ab c")
+				return record
+			},
+			true,
+		},
+		{
+			"special forbidden character * (primaryKey; used in the realtime events too)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc*")
+				return record
+			},
+			true,
+		},
+		{
+			"reserved pk literal (non-primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: false},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "aUx")
+				return record
+			},
+			false,
+		},
+		{
+			"reserved pk literal (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "aUx")
+				return record
+			},
+			true,
+		},
+		{
+			"reserved pk literal (non-exact match, primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "aUx-")
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero field value (primaryKey)",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abcd")
+				return record
+			},
+			false,
+		},
+		{
+			"case-insensitive duplicated primary key check",
+			&core.TextField{Name: "test", PrimaryKey: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", strings.ToUpper(existingRecord.Id))
+				return record
+			},
+			true,
+		},
+		{
+			"< min",
+			&core.TextField{Name: "test", Min: 4},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "абв") // multi-byte
+				return record
+			},
+			true,
+		},
+		{
+			">= min",
+			&core.TextField{Name: "test", Min: 3},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "абв") // multi-byte
+				return record
+			},
+			false,
+		},
+		{
+			"> default max",
+			&core.TextField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", strings.Repeat("a", 5001))
+				return record
+			},
+			true,
+		},
+		{
+			"<= default max",
+			&core.TextField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", strings.Repeat("a", 500))
+				return record
+			},
+			false,
+		},
+		{
+			"> max",
+			&core.TextField{Name: "test", Max: 2},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "абв") // multi-byte
+				return record
+			},
+			true,
+		},
+		{
+			"<= max",
+			&core.TextField{Name: "test", Min: 3},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "абв") // multi-byte
+				return record
+			},
+			false,
+		},
+		{
+			"mismatched pattern",
+			&core.TextField{Name: "test", Pattern: `\d+`},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "abc")
+				return record
+			},
+			true,
+		},
+		{
+			"matched pattern",
+			&core.TextField{Name: "test", Pattern: `\d+`},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "123")
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestTextFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeText)
+	testDefaultFieldNameValidation(t, core.FieldTypeText)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.TextField
+		expectErrors []string
+	}{
+		{
+			"zero minimal",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"primaryKey without required",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:         "test",
+					Name:       "id",
+					PrimaryKey: true,
+					Pattern:    `\d+`,
+				}
+			},
+			[]string{"required"},
+		},
+		{
+			"primaryKey without pattern",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:         "test",
+					Name:       "id",
+					PrimaryKey: true,
+					Required:   true,
+				}
+			},
+			[]string{"pattern"},
+		},
+		{
+			"primaryKey with hidden",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:         "test",
+					Name:       "id",
+					Required:   true,
+					PrimaryKey: true,
+					Hidden:     true,
+					Pattern:    `\d+`,
+				}
+			},
+			[]string{"hidden"},
+		},
+		{
+			"primaryKey with name != id",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:         "test",
+					Name:       "test",
+					PrimaryKey: true,
+					Required:   true,
+					Pattern:    `\d+`,
+				}
+			},
+			[]string{"name"},
+		},
+		{
+			"multiple primaryKey fields",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:         "test2",
+					Name:       "id",
+					PrimaryKey: true,
+					Pattern:    `\d+`,
+					Required:   true,
+				}
+			},
+			[]string{"primaryKey"},
+		},
+		{
+			"invalid pattern",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:      "test2",
+					Name:    "id",
+					Pattern: `(invalid`,
+				}
+			},
+			[]string{"pattern"},
+		},
+		{
+			"valid pattern",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:      "test2",
+					Name:    "id",
+					Pattern: `\d+`,
+				}
+			},
+			[]string{},
+		},
+		{
+			"invalid autogeneratePattern",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:                  "test2",
+					Name:                "id",
+					AutogeneratePattern: `(invalid`,
+				}
+			},
+			[]string{"autogeneratePattern"},
+		},
+		{
+			"valid autogeneratePattern",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:                  "test2",
+					Name:                "id",
+					AutogeneratePattern: `[a-z]+`,
+				}
+			},
+			[]string{},
+		},
+		{
+			"conflicting pattern and autogeneratePattern",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:                  "test2",
+					Name:                "id",
+					Pattern:             `\d+`,
+					AutogeneratePattern: `[a-z]+`,
+				}
+			},
+			[]string{"autogeneratePattern"},
+		},
+		{
+			"Max > safe json int",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+					Max:  1 << 53,
+				}
+			},
+			[]string{"max"},
+		},
+		{
+			"Max < 0",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+					Max:  -1,
+				}
+			},
+			[]string{"max"},
+		},
+		{
+			"Min > safe json int",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+					Min:  1 << 53,
+				}
+			},
+			[]string{"min"},
+		},
+		{
+			"Min < 0",
+			func() *core.TextField {
+				return &core.TextField{
+					Id:   "test",
+					Name: "test",
+					Min:  -1,
+				}
+			},
+			[]string{"min"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			field := s.field()
+
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.GetByName("id").SetId("test") // set a dummy known id so that it can be replaced
+			collection.Fields.Add(field)
+
+			errs := field.ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
+
+func TestTextFieldAutogenerate(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name       string
+		actionName string
+		field      *core.TextField
+		record     func() *core.Record
+		expected   string
+	}{
+		{
+			"non-matching action",
+			core.InterceptorActionUpdate,
+			&core.TextField{Name: "test", AutogeneratePattern: "abc"},
+			func() *core.Record {
+				return core.NewRecord(collection)
+			},
+			"",
+		},
+		{
+			"matching action (create)",
+			core.InterceptorActionCreate,
+			&core.TextField{Name: "test", AutogeneratePattern: "abc"},
+			func() *core.Record {
+				return core.NewRecord(collection)
+			},
+			"abc",
+		},
+		{
+			"matching action (validate)",
+			core.InterceptorActionValidate,
+			&core.TextField{Name: "test", AutogeneratePattern: "abc"},
+			func() *core.Record {
+				return core.NewRecord(collection)
+			},
+			"abc",
+		},
+		{
+			"existing non-zero value",
+			core.InterceptorActionCreate,
+			&core.TextField{Name: "test", AutogeneratePattern: "abc"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "123")
+				return record
+			},
+			"123",
+		},
+		{
+			"non-new record",
+			core.InterceptorActionValidate,
+			&core.TextField{Name: "test", AutogeneratePattern: "abc"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.Id = "test"
+				record.PostScan()
+				return record
+			},
+			"",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			actionCalls := 0
+			record := s.record()
+
+			err := s.field.Intercept(context.Background(), app, record, s.actionName, func() error {
+				actionCalls++
+				return nil
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if actionCalls != 1 {
+				t.Fatalf("Expected actionCalls %d, got %d", 1, actionCalls)
+			}
+
+			v := record.GetString(s.field.GetName())
+			if v != s.expected {
+				t.Fatalf("Expected value %q, got %q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestTextFieldFindSetter(t *testing.T) {
+	scenarios := []struct {
+		name      string
+		key       string
+		value     any
+		field     *core.TextField
+		hasSetter bool
+		expected  string
+	}{
+		{
+			"no match",
+			"example",
+			"abc",
+			&core.TextField{Name: "test", AutogeneratePattern: "test"},
+			false,
+			"",
+		},
+		{
+			"exact match",
+			"test",
+			"abc",
+			&core.TextField{Name: "test", AutogeneratePattern: "test"},
+			true,
+			"abc",
+		},
+		{
+			"autogenerate modifier",
+			"test:autogenerate",
+			"abc",
+			&core.TextField{Name: "test", AutogeneratePattern: "test"},
+			true,
+			"abctest",
+		},
+		{
+			"autogenerate modifier without AutogeneratePattern option",
+			"test:autogenerate",
+			"abc",
+			&core.TextField{Name: "test"},
+			true,
+			"abc",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection := core.NewBaseCollection("test_collection")
+			collection.Fields.Add(s.field)
+
+			setter := s.field.FindSetter(s.key)
+
+			hasSetter := setter != nil
+			if hasSetter != s.hasSetter {
+				t.Fatalf("Expected hasSetter %v, got %v", s.hasSetter, hasSetter)
+			}
+
+			if !hasSetter {
+				return
+			}
+
+			record := core.NewRecord(collection)
+
+			setter(record, s.value)
+
+			result := record.GetString(s.field.Name)
+
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/field_url.go b/server/core_backend-server/core/field_url.go
new file mode 100644
index 0000000..eabe081
--- /dev/null
+++ b/server/core_backend-server/core/field_url.go
@@ -0,0 +1,171 @@
+package core
+
+import (
+	"context"
+	"net/url"
+	"slices"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/spf13/cast"
+)
+
+func init() {
+	Fields[FieldTypeURL] = func() Field {
+		return &URLField{}
+	}
+}
+
+const FieldTypeURL = "url"
+
+var _ Field = (*URLField)(nil)
+
+// URLField defines "url" type field for storing a single URL string value.
+//
+// The respective zero record field value is empty string.
+type URLField struct {
+	// Name (required) is the unique name of the field.
+	Name string `form:"name" json:"name"`
+
+	// Id is the unique stable field identifier.
+	//
+	// It is automatically generated from the name when adding to a collection FieldsList.
+	Id string `form:"id" json:"id"`
+
+	// System prevents the renaming and removal of the field.
+	System bool `form:"system" json:"system"`
+
+	// Hidden hides the field from the API response.
+	Hidden bool `form:"hidden" json:"hidden"`
+
+	// Presentable hints the Dashboard UI to use the underlying
+	// field record value in the relation preview label.
+	Presentable bool `form:"presentable" json:"presentable"`
+
+	// ---
+
+	// ExceptDomains will require the URL domain to NOT be included in the listed ones.
+	//
+	// This validator can be set only if OnlyDomains is empty.
+	ExceptDomains []string `form:"exceptDomains" json:"exceptDomains"`
+
+	// OnlyDomains will require the URL domain to be included in the listed ones.
+	//
+	// This validator can be set only if ExceptDomains is empty.
+	OnlyDomains []string `form:"onlyDomains" json:"onlyDomains"`
+
+	// Required will require the field value to be non-empty URL string.
+	Required bool `form:"required" json:"required"`
+}
+
+// Type implements [Field.Type] interface method.
+func (f *URLField) Type() string {
+	return FieldTypeURL
+}
+
+// GetId implements [Field.GetId] interface method.
+func (f *URLField) GetId() string {
+	return f.Id
+}
+
+// SetId implements [Field.SetId] interface method.
+func (f *URLField) SetId(id string) {
+	f.Id = id
+}
+
+// GetName implements [Field.GetName] interface method.
+func (f *URLField) GetName() string {
+	return f.Name
+}
+
+// SetName implements [Field.SetName] interface method.
+func (f *URLField) SetName(name string) {
+	f.Name = name
+}
+
+// GetSystem implements [Field.GetSystem] interface method.
+func (f *URLField) GetSystem() bool {
+	return f.System
+}
+
+// SetSystem implements [Field.SetSystem] interface method.
+func (f *URLField) SetSystem(system bool) {
+	f.System = system
+}
+
+// GetHidden implements [Field.GetHidden] interface method.
+func (f *URLField) GetHidden() bool {
+	return f.Hidden
+}
+
+// SetHidden implements [Field.SetHidden] interface method.
+func (f *URLField) SetHidden(hidden bool) {
+	f.Hidden = hidden
+}
+
+// ColumnType implements [Field.ColumnType] interface method.
+func (f *URLField) ColumnType(app App) string {
+	if IsMysql(app) {
+		return "TEXT"
+	}
+	return "TEXT DEFAULT '' NOT NULL"
+}
+
+// PrepareValue implements [Field.PrepareValue] interface method.
+func (f *URLField) PrepareValue(record *Record, raw any) (any, error) {
+	return cast.ToString(raw), nil
+}
+
+// ValidateValue implements [Field.ValidateValue] interface method.
+func (f *URLField) ValidateValue(ctx context.Context, app App, record *Record) error {
+	val, ok := record.GetRaw(f.Name).(string)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if f.Required {
+		if err := validation.Required.Validate(val); err != nil {
+			return err
+		}
+	}
+
+	if val == "" {
+		return nil // nothing to check
+	}
+
+	if is.URL.Validate(val) != nil {
+		return validation.NewError("validation_invalid_url", "Must be a valid url")
+	}
+
+	// extract host/domain
+	u, _ := url.Parse(val)
+
+	// only domains check
+	if len(f.OnlyDomains) > 0 && !slices.Contains(f.OnlyDomains, u.Host) {
+		return validation.NewError("validation_url_domain_not_allowed", "Url domain is not allowed")
+	}
+
+	// except domains check
+	if len(f.ExceptDomains) > 0 && slices.Contains(f.ExceptDomains, u.Host) {
+		return validation.NewError("validation_url_domain_not_allowed", "Url domain is not allowed")
+	}
+
+	return nil
+}
+
+// ValidateSettings implements [Field.ValidateSettings] interface method.
+func (f *URLField) ValidateSettings(ctx context.Context, app App, collection *Collection) error {
+	return validation.ValidateStruct(f,
+		validation.Field(&f.Id, validation.By(DefaultFieldIdValidationRule)),
+		validation.Field(&f.Name, validation.By(DefaultFieldNameValidationRule)),
+		validation.Field(
+			&f.ExceptDomains,
+			validation.When(len(f.OnlyDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
+		),
+		validation.Field(
+			&f.OnlyDomains,
+			validation.When(len(f.ExceptDomains) > 0, validation.Empty).Else(validation.Each(is.Domain)),
+		),
+	)
+}
diff --git a/server/core_backend-server/core/field_url_test.go b/server/core_backend-server/core/field_url_test.go
new file mode 100644
index 0000000..0b2db39
--- /dev/null
+++ b/server/core_backend-server/core/field_url_test.go
@@ -0,0 +1,271 @@
+package core_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestURLFieldBaseMethods(t *testing.T) {
+	testFieldBaseMethods(t, core.FieldTypeURL)
+}
+
+func TestURLFieldColumnType(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.URLField{}
+
+	expected := "TEXT DEFAULT '' NOT NULL"
+
+	if v := f.ColumnType(app); v != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, v)
+	}
+}
+
+func TestURLFieldPrepareValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f := &core.URLField{}
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	scenarios := []struct {
+		raw      any
+		expected string
+	}{
+		{"", ""},
+		{"test", "test"},
+		{false, "false"},
+		{true, "true"},
+		{123.456, "123.456"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.raw), func(t *testing.T) {
+			v, err := f.PrepareValue(record, s.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			vStr, ok := v.(string)
+			if !ok {
+				t.Fatalf("Expected string instance, got %T", v)
+			}
+
+			if vStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestURLFieldValidateValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name        string
+		field       *core.URLField
+		record      func() *core.Record
+		expectError bool
+	}{
+		{
+			"invalid raw value",
+			&core.URLField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", 123)
+				return record
+			},
+			true,
+		},
+		{
+			"zero field value (not required)",
+			&core.URLField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			false,
+		},
+		{
+			"zero field value (required)",
+			&core.URLField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "")
+				return record
+			},
+			true,
+		},
+		{
+			"non-zero field value (required)",
+			&core.URLField{Name: "test", Required: true},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "https://example.com")
+				return record
+			},
+			false,
+		},
+		{
+			"invalid url",
+			&core.URLField{Name: "test"},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "invalid")
+				return record
+			},
+			true,
+		},
+		{
+			"failed onlyDomains",
+			&core.URLField{Name: "test", OnlyDomains: []string{"example.org", "example.net"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "https://example.com")
+				return record
+			},
+			true,
+		},
+		{
+			"success onlyDomains",
+			&core.URLField{Name: "test", OnlyDomains: []string{"example.org", "example.com"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "https://example.com")
+				return record
+			},
+			false,
+		},
+		{
+			"failed exceptDomains",
+			&core.URLField{Name: "test", ExceptDomains: []string{"example.org", "example.com"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "https://example.com")
+				return record
+			},
+			true,
+		},
+		{
+			"success exceptDomains",
+			&core.URLField{Name: "test", ExceptDomains: []string{"example.org", "example.net"}},
+			func() *core.Record {
+				record := core.NewRecord(collection)
+				record.SetRaw("test", "https://example.com")
+				return record
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.field.ValidateValue(context.Background(), app, s.record())
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestURLFieldValidateSettings(t *testing.T) {
+	testDefaultFieldIdValidation(t, core.FieldTypeURL)
+	testDefaultFieldNameValidation(t, core.FieldTypeURL)
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_collection")
+
+	scenarios := []struct {
+		name         string
+		field        func() *core.URLField
+		expectErrors []string
+	}{
+		{
+			"zero minimal",
+			func() *core.URLField {
+				return &core.URLField{
+					Id:   "test",
+					Name: "test",
+				}
+			},
+			[]string{},
+		},
+		{
+			"both onlyDomains and exceptDomains",
+			func() *core.URLField {
+				return &core.URLField{
+					Id:            "test",
+					Name:          "test",
+					OnlyDomains:   []string{"example.com"},
+					ExceptDomains: []string{"example.org"},
+				}
+			},
+			[]string{"onlyDomains", "exceptDomains"},
+		},
+		{
+			"invalid onlyDomains",
+			func() *core.URLField {
+				return &core.URLField{
+					Id:          "test",
+					Name:        "test",
+					OnlyDomains: []string{"example.com", "invalid"},
+				}
+			},
+			[]string{"onlyDomains"},
+		},
+		{
+			"valid onlyDomains",
+			func() *core.URLField {
+				return &core.URLField{
+					Id:          "test",
+					Name:        "test",
+					OnlyDomains: []string{"example.com", "example.org"},
+				}
+			},
+			[]string{},
+		},
+		{
+			"invalid exceptDomains",
+			func() *core.URLField {
+				return &core.URLField{
+					Id:            "test",
+					Name:          "test",
+					ExceptDomains: []string{"example.com", "invalid"},
+				}
+			},
+			[]string{"exceptDomains"},
+		},
+		{
+			"valid exceptDomains",
+			func() *core.URLField {
+				return &core.URLField{
+					Id:            "test",
+					Name:          "test",
+					ExceptDomains: []string{"example.com", "example.org"},
+				}
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := s.field().ValidateSettings(context.Background(), app, collection)
+
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/fields_list.go b/server/core_backend-server/core/fields_list.go
new file mode 100644
index 0000000..1708a05
--- /dev/null
+++ b/server/core_backend-server/core/fields_list.go
@@ -0,0 +1,388 @@
+package core
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+	"slices"
+	"strconv"
+)
+
+// NewFieldsList creates a new FieldsList instance with the provided fields.
+func NewFieldsList(fields ...Field) FieldsList {
+	l := make(FieldsList, 0, len(fields))
+
+	for _, f := range fields {
+		l.add(-1, f)
+	}
+
+	return l
+}
+
+// FieldsList defines a Collection slice of fields.
+type FieldsList []Field
+
+// Clone creates a deep clone of the current list.
+func (l FieldsList) Clone() (FieldsList, error) {
+	copyRaw, err := json.Marshal(l)
+	if err != nil {
+		return nil, err
+	}
+
+	result := FieldsList{}
+	if err := json.Unmarshal(copyRaw, &result); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// FieldNames returns a slice with the name of all list fields.
+func (l FieldsList) FieldNames() []string {
+	result := make([]string, len(l))
+
+	for i, field := range l {
+		result[i] = field.GetName()
+	}
+
+	return result
+}
+
+// AsMap returns a map with all registered list field.
+// The returned map is indexed with each field name.
+func (l FieldsList) AsMap() map[string]Field {
+	result := make(map[string]Field, len(l))
+
+	for _, field := range l {
+		result[field.GetName()] = field
+	}
+
+	return result
+}
+
+// GetById returns a single field by its id.
+func (l FieldsList) GetById(fieldId string) Field {
+	for _, field := range l {
+		if field.GetId() == fieldId {
+			return field
+		}
+	}
+	return nil
+}
+
+// GetByName returns a single field by its name.
+func (l FieldsList) GetByName(fieldName string) Field {
+	for _, field := range l {
+		if field.GetName() == fieldName {
+			return field
+		}
+	}
+	return nil
+}
+
+// RemoveById removes a single field by its id.
+//
+// This method does nothing if field with the specified id doesn't exist.
+func (l *FieldsList) RemoveById(fieldId string) {
+	fields := *l
+	for i, field := range fields {
+		if field.GetId() == fieldId {
+			*l = append(fields[:i], fields[i+1:]...)
+			return
+		}
+	}
+}
+
+// RemoveByName removes a single field by its name.
+//
+// This method does nothing if field with the specified name doesn't exist.
+func (l *FieldsList) RemoveByName(fieldName string) {
+	fields := *l
+	for i, field := range fields {
+		if field.GetName() == fieldName {
+			*l = append(fields[:i], fields[i+1:]...)
+			return
+		}
+	}
+}
+
+// Add adds one or more fields to the current list.
+//
+// By default this method will try to REPLACE existing fields with
+// the new ones by their id or by their name if the new field doesn't have an explicit id.
+//
+// If no matching existing field is found, it will APPEND the field to the end of the list.
+//
+// In all cases, if any of the new fields don't have an explicit id it will auto generate a default one for them
+// (the id value doesn't really matter and it is mostly used as a stable identifier in case of a field rename).
+func (l *FieldsList) Add(fields ...Field) {
+	for _, f := range fields {
+		l.add(-1, f)
+	}
+}
+
+// AddAt is the same as Add but insert/move the fields at the specific position.
+//
+// If pos < 0, then this method acts the same as calling Add.
+//
+// If pos > FieldsList total items, then the specified fields are inserted/moved at the end of the list.
+func (l *FieldsList) AddAt(pos int, fields ...Field) {
+	total := len(*l)
+
+	for i, f := range fields {
+		if pos < 0 {
+			l.add(-1, f)
+		} else if pos > total {
+			l.add(total+i, f)
+		} else {
+			l.add(pos+i, f)
+		}
+	}
+}
+
+// AddMarshaledJSON parses the provided raw json data and adds the
+// found fields into the current list (following the same rule as the Add method).
+//
+// The rawJSON argument could be one of:
+//   - serialized array of field objects
+//   - single field object.
+//
+// Example:
+//
+//	l.AddMarshaledJSON([]byte{`{"type":"text", name: "test"}`})
+//	l.AddMarshaledJSON([]byte{`[{"type":"text", name: "test1"}, {"type":"text", name: "test2"}]`})
+func (l *FieldsList) AddMarshaledJSON(rawJSON []byte) error {
+	extractedFields, err := marshaledJSONtoFieldsList(rawJSON)
+	if err != nil {
+		return err
+	}
+
+	l.Add(extractedFields...)
+
+	return nil
+}
+
+// AddMarshaledJSONAt is the same as AddMarshaledJSON but insert/move the fields at the specific position.
+//
+// If pos < 0, then this method acts the same as calling AddMarshaledJSON.
+//
+// If pos > FieldsList total items, then the specified fields are inserted/moved at the end of the list.
+func (l *FieldsList) AddMarshaledJSONAt(pos int, rawJSON []byte) error {
+	extractedFields, err := marshaledJSONtoFieldsList(rawJSON)
+	if err != nil {
+		return err
+	}
+
+	l.AddAt(pos, extractedFields...)
+
+	return nil
+}
+
+func marshaledJSONtoFieldsList(rawJSON []byte) (FieldsList, error) {
+	extractedFields := FieldsList{}
+
+	// nothing to add
+	if len(rawJSON) == 0 {
+		return extractedFields, nil
+	}
+
+	// try to unmarshal first into a new fieds list
+	// (assuming that rawJSON is array of objects)
+	err := json.Unmarshal(rawJSON, &extractedFields)
+	if err != nil {
+		// try again but wrap the rawJSON in []
+		// (assuming that rawJSON is a single object)
+		wrapped := make([]byte, 0, len(rawJSON)+2)
+		wrapped = append(wrapped, '[')
+		wrapped = append(wrapped, rawJSON...)
+		wrapped = append(wrapped, ']')
+		err = json.Unmarshal(wrapped, &extractedFields)
+		if err != nil {
+			return nil, fmt.Errorf("failed to unmarshal the provided JSON - expects array of objects or just single object: %w", err)
+		}
+	}
+
+	return extractedFields, nil
+}
+
+func (l *FieldsList) add(pos int, newField Field) {
+	fields := *l
+
+	var replaceByName bool
+	var replaceInPlace bool
+
+	if pos < 0 {
+		replaceInPlace = true
+		pos = len(fields)
+	} else if pos > len(fields) {
+		pos = len(fields)
+	}
+
+	newFieldId := newField.GetId()
+
+	// set default id
+	if newFieldId == "" {
+		replaceByName = true
+
+		baseId := newField.Type() + crc32Checksum(newField.GetName())
+		newFieldId = baseId
+		for i := 2; i < 1000; i++ {
+			if l.GetById(newFieldId) == nil {
+				break // already unique
+			}
+			newFieldId = baseId + strconv.Itoa(i)
+		}
+		newField.SetId(newFieldId)
+	}
+
+	// try to replace existing
+	for i, field := range fields {
+		if replaceByName {
+			if name := newField.GetName(); name != "" && field.GetName() == name {
+				// reuse the original id
+				newField.SetId(field.GetId())
+
+				if replaceInPlace {
+					(*l)[i] = newField
+					return
+				} else {
+					// remove the current field and insert it later at the specific position
+					*l = slices.Delete(*l, i, i+1)
+					if total := len(*l); pos > total {
+						pos = total
+					}
+					break
+				}
+			}
+		} else {
+			if field.GetId() == newFieldId {
+				if replaceInPlace {
+					(*l)[i] = newField
+					return
+				} else {
+					// remove the current field and insert it later at the specific position
+					*l = slices.Delete(*l, i, i+1)
+					if total := len(*l); pos > total {
+						pos = total
+					}
+					break
+				}
+			}
+		}
+	}
+
+	// insert the new field
+	*l = slices.Insert(*l, pos, newField)
+}
+
+// String returns the string representation of the current list.
+func (l FieldsList) String() string {
+	v, _ := json.Marshal(l)
+	return string(v)
+}
+
+type onlyFieldType struct {
+	Type string `json:"type"`
+}
+
+type fieldWithType struct {
+	Field
+	Type string `json:"type"`
+}
+
+func (fwt *fieldWithType) UnmarshalJSON(data []byte) error {
+	// extract the field type to init a blank factory
+	t := &onlyFieldType{}
+	if err := json.Unmarshal(data, t); err != nil {
+		return fmt.Errorf("failed to unmarshal field type: %w", err)
+	}
+
+	factory, ok := Fields[t.Type]
+	if !ok {
+		return fmt.Errorf("missing or unknown field type in %s", data)
+	}
+
+	fwt.Type = t.Type
+	fwt.Field = factory()
+
+	// unmarshal the rest of the data into the created field
+	if err := json.Unmarshal(data, fwt.Field); err != nil {
+		return fmt.Errorf("failed to unmarshal field: %w", err)
+	}
+
+	return nil
+}
+
+// UnmarshalJSON implements [json.Unmarshaler] and
+// loads the provided json data into the current FieldsList.
+func (l *FieldsList) UnmarshalJSON(data []byte) error {
+	fwts := []fieldWithType{}
+
+	if err := json.Unmarshal(data, &fwts); err != nil {
+		return err
+	}
+
+	*l = []Field{} // reset
+
+	for _, fwt := range fwts {
+		l.add(-1, fwt.Field)
+	}
+
+	return nil
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+func (l FieldsList) MarshalJSON() ([]byte, error) {
+	if l == nil {
+		l = []Field{} // always init to ensure that it is serialized as empty array
+	}
+
+	wrapper := make([]map[string]any, 0, len(l))
+
+	for _, f := range l {
+		// precompute the json into a map so that we can append the type to a flatten object
+		raw, err := json.Marshal(f)
+		if err != nil {
+			return nil, err
+		}
+
+		data := map[string]any{}
+		if err := json.Unmarshal(raw, &data); err != nil {
+			return nil, err
+		}
+		data["type"] = f.Type()
+
+		wrapper = append(wrapper, data)
+	}
+
+	return json.Marshal(wrapper)
+}
+
+// Value implements the [driver.Valuer] interface.
+func (l FieldsList) Value() (driver.Value, error) {
+	data, err := json.Marshal(l)
+
+	return string(data), err
+}
+
+// Scan implements [sql.Scanner] interface to scan the provided value
+// into the current FieldsList instance.
+func (l *FieldsList) Scan(value any) error {
+	var data []byte
+	switch v := value.(type) {
+	case nil:
+		// no cast needed
+	case []byte:
+		data = v
+	case string:
+		data = []byte(v)
+	default:
+		return fmt.Errorf("failed to unmarshal FieldsList value %q", value)
+	}
+
+	if len(data) == 0 {
+		data = []byte("[]")
+	}
+
+	return l.UnmarshalJSON(data)
+}
diff --git a/server/core_backend-server/core/fields_list_test.go b/server/core_backend-server/core/fields_list_test.go
new file mode 100644
index 0000000..e667e76
--- /dev/null
+++ b/server/core_backend-server/core/fields_list_test.go
@@ -0,0 +1,558 @@
+package core_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func TestNewFieldsList(t *testing.T) {
+	fields := core.NewFieldsList(
+		&core.TextField{Id: "id1", Name: "test1"},
+		&core.TextField{Name: "test2"},
+		&core.TextField{Id: "id1", Name: "test1_new"}, // should replace the original id1 field
+	)
+
+	if len(fields) != 2 {
+		t.Fatalf("Expected 2 fields, got %d (%v)", len(fields), fields)
+	}
+
+	for _, f := range fields {
+		if f.GetId() == "" {
+			t.Fatalf("Expected field id to be set, found empty id for field %v", f)
+		}
+	}
+
+	if fields[0].GetName() != "test1_new" {
+		t.Fatalf("Expected field with name test1_new, got %s", fields[0].GetName())
+	}
+
+	if fields[1].GetName() != "test2" {
+		t.Fatalf("Expected field with name test2, got %s", fields[1].GetName())
+	}
+}
+
+func TestFieldsListClone(t *testing.T) {
+	f1 := &core.TextField{Name: "test1"}
+	f2 := &core.EmailField{Name: "test2"}
+	s1 := core.NewFieldsList(f1, f2)
+
+	s2, err := s1.Clone()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	s1Str := s1.String()
+	s2Str := s2.String()
+
+	if s1Str != s2Str {
+		t.Fatalf("Expected the cloned list to be equal, got \n%v\nVS\n%v", s1, s2)
+	}
+
+	// change in one list shouldn't result to change in the other
+	// (aka. check if it is a deep clone)
+	s1[0].SetName("test1_update")
+	if s2[0].GetName() != "test1" {
+		t.Fatalf("Expected s2 field name to not change, got %q", s2[0].GetName())
+	}
+}
+
+func TestFieldsListFieldNames(t *testing.T) {
+	f1 := &core.TextField{Name: "test1"}
+	f2 := &core.EmailField{Name: "test2"}
+	testFieldsList := core.NewFieldsList(f1, f2)
+
+	result := testFieldsList.FieldNames()
+
+	expected := []string{f1.Name, f2.Name}
+
+	if len(result) != len(expected) {
+		t.Fatalf("Expected %d slice elements, got %d\n%v", len(expected), len(result), result)
+	}
+
+	for _, name := range expected {
+		if !slices.Contains(result, name) {
+			t.Fatalf("Missing name %q in %v", name, result)
+		}
+	}
+}
+
+func TestFieldsListAsMap(t *testing.T) {
+	f1 := &core.TextField{Name: "test1"}
+	f2 := &core.EmailField{Name: "test2"}
+	testFieldsList := core.NewFieldsList(f1, f2)
+
+	result := testFieldsList.AsMap()
+
+	expectedIndexes := []string{f1.Name, f2.Name}
+
+	if len(result) != len(expectedIndexes) {
+		t.Fatalf("Expected %d map elements, got %d\n%v", len(expectedIndexes), len(result), result)
+	}
+
+	for _, index := range expectedIndexes {
+		if _, ok := result[index]; !ok {
+			t.Fatalf("Missing index %q", index)
+		}
+	}
+}
+
+func TestFieldsListGetById(t *testing.T) {
+	f1 := &core.TextField{Id: "id1", Name: "test1"}
+	f2 := &core.EmailField{Id: "id2", Name: "test2"}
+	testFieldsList := core.NewFieldsList(f1, f2)
+
+	// missing field id
+	result1 := testFieldsList.GetById("test1")
+	if result1 != nil {
+		t.Fatalf("Found unexpected field %v", result1)
+	}
+
+	// existing field id
+	result2 := testFieldsList.GetById("id2")
+	if result2 == nil || result2.GetId() != "id2" {
+		t.Fatalf("Cannot find field with id %q, got %v ", "id2", result2)
+	}
+}
+
+func TestFieldsListGetByName(t *testing.T) {
+	f1 := &core.TextField{Id: "id1", Name: "test1"}
+	f2 := &core.EmailField{Id: "id2", Name: "test2"}
+	testFieldsList := core.NewFieldsList(f1, f2)
+
+	// missing field name
+	result1 := testFieldsList.GetByName("id1")
+	if result1 != nil {
+		t.Fatalf("Found unexpected field %v", result1)
+	}
+
+	// existing field name
+	result2 := testFieldsList.GetByName("test2")
+	if result2 == nil || result2.GetName() != "test2" {
+		t.Fatalf("Cannot find field with name %q, got %v ", "test2", result2)
+	}
+}
+
+func TestFieldsListRemove(t *testing.T) {
+	testFieldsList := core.NewFieldsList(
+		&core.TextField{Id: "id1", Name: "test1"},
+		&core.TextField{Id: "id2", Name: "test2"},
+		&core.TextField{Id: "id3", Name: "test3"},
+		&core.TextField{Id: "id4", Name: "test4"},
+		&core.TextField{Id: "id5", Name: "test5"},
+		&core.TextField{Id: "id6", Name: "test6"},
+	)
+
+	// remove by id
+	testFieldsList.RemoveById("id2")
+	testFieldsList.RemoveById("test3") // should do nothing
+
+	// remove by name
+	testFieldsList.RemoveByName("test5")
+	testFieldsList.RemoveByName("id6") // should do nothing
+
+	expected := []string{"test1", "test3", "test4", "test6"}
+
+	if len(testFieldsList) != len(expected) {
+		t.Fatalf("Expected %d, got %d\n%v", len(expected), len(testFieldsList), testFieldsList)
+	}
+
+	for _, name := range expected {
+		if f := testFieldsList.GetByName(name); f == nil {
+			t.Fatalf("Missing field %q", name)
+		}
+	}
+}
+
+func TestFieldsListAdd(t *testing.T) {
+	f0 := &core.TextField{}
+	f1 := &core.TextField{Name: "test1"}
+	f2 := &core.TextField{Id: "f2Id", Name: "test2"}
+	f3 := &core.TextField{Id: "f3Id", Name: "test3"}
+	testFieldsList := core.NewFieldsList(f0, f1, f2, f3)
+
+	f2New := &core.EmailField{Id: "f2Id", Name: "test2_new"}
+	f4 := &core.URLField{Name: "test4"}
+
+	testFieldsList.Add(f2New)
+	testFieldsList.Add(f4)
+
+	if len(testFieldsList) != 5 {
+		t.Fatalf("Expected %d, got %d\n%v", 5, len(testFieldsList), testFieldsList)
+	}
+
+	// check if each field has id
+	for _, f := range testFieldsList {
+		if f.GetId() == "" {
+			t.Fatalf("Expected field id to be set, found empty id for field %v", f)
+		}
+	}
+
+	// check if f2 field was replaced
+	if f := testFieldsList.GetById("f2Id"); f == nil || f.Type() != core.FieldTypeEmail {
+		t.Fatalf("Expected f2 field to be replaced, found %v", f)
+	}
+
+	// check if f4 was added
+	if f := testFieldsList.GetByName("test4"); f == nil || f.GetName() != "test4" {
+		t.Fatalf("Expected f4 field to be added, found %v", f)
+	}
+}
+
+func TestFieldsListAddMarshaledJSON(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name           string
+		raw            []byte
+		expectError    bool
+		expectedFields map[string]string
+	}{
+		{
+			"nil",
+			nil,
+			false,
+			map[string]string{"abc": core.FieldTypeNumber},
+		},
+		{
+			"empty array",
+			[]byte(`[]`),
+			false,
+			map[string]string{"abc": core.FieldTypeNumber},
+		},
+		{
+			"empty object",
+			[]byte(`{}`),
+			true,
+			map[string]string{"abc": core.FieldTypeNumber},
+		},
+		{
+			"array with empty object",
+			[]byte(`[{}]`),
+			true,
+			map[string]string{"abc": core.FieldTypeNumber},
+		},
+		{
+			"single object with invalid type",
+			[]byte(`{"type":"missing","name":"test"}`),
+			true,
+			map[string]string{"abc": core.FieldTypeNumber},
+		},
+		{
+			"single object with valid type",
+			[]byte(`{"type":"text","name":"test"}`),
+			false,
+			map[string]string{
+				"abc":  core.FieldTypeNumber,
+				"test": core.FieldTypeText,
+			},
+		},
+		{
+			"array of object with valid types",
+			[]byte(`[{"type":"text","name":"test1"},{"type":"url","name":"test2"}]`),
+			false,
+			map[string]string{
+				"abc":   core.FieldTypeNumber,
+				"test1": core.FieldTypeText,
+				"test2": core.FieldTypeURL,
+			},
+		},
+		{
+			"fields with duplicated ids should replace existing fields",
+			[]byte(`[{"type":"text","name":"test1"},{"type":"url","name":"test2"},{"type":"text","name":"abc2", "id":"abc_id"}]`),
+			false,
+			map[string]string{
+				"abc2":  core.FieldTypeText,
+				"test1": core.FieldTypeText,
+				"test2": core.FieldTypeURL,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testList := core.NewFieldsList(&core.NumberField{Name: "abc", Id: "abc_id"})
+			err := testList.AddMarshaledJSON(s.raw)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+
+			if len(s.expectedFields) != len(testList) {
+				t.Fatalf("Expected %d fields, got %d", len(s.expectedFields), len(testList))
+			}
+
+			for fieldName, typ := range s.expectedFields {
+				f := testList.GetByName(fieldName)
+
+				if f == nil {
+					t.Errorf("Missing expected field %q", fieldName)
+					continue
+				}
+
+				if f.Type() != typ {
+					t.Errorf("Expect field %q to has type %q, got %q", fieldName, typ, f.Type())
+				}
+			}
+		})
+	}
+}
+
+func TestFieldsListAddAt(t *testing.T) {
+	scenarios := []struct {
+		position int
+		expected []string
+	}{
+		{-2, []string{"test1", "test2_new", "test3", "test4"}},
+		{-1, []string{"test1", "test2_new", "test3", "test4"}},
+		{0, []string{"test2_new", "test4", "test1", "test3"}},
+		{1, []string{"test1", "test2_new", "test4", "test3"}},
+		{2, []string{"test1", "test3", "test2_new", "test4"}},
+		{3, []string{"test1", "test3", "test2_new", "test4"}},
+		{4, []string{"test1", "test3", "test2_new", "test4"}},
+		{5, []string{"test1", "test3", "test2_new", "test4"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(strconv.Itoa(s.position), func(t *testing.T) {
+			f1 := &core.TextField{Id: "f1Id", Name: "test1"}
+			f2 := &core.TextField{Id: "f2Id", Name: "test2"}
+			f3 := &core.TextField{Id: "f3Id", Name: "test3"}
+			testFieldsList := core.NewFieldsList(f1, f2, f3)
+
+			f2New := &core.EmailField{Id: "f2Id", Name: "test2_new"}
+			f4 := &core.URLField{Name: "test4"}
+			testFieldsList.AddAt(s.position, f2New, f4)
+
+			rawNames, err := json.Marshal(testFieldsList.FieldNames())
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			rawExpected, err := json.Marshal(s.expected)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if !bytes.Equal(rawNames, rawExpected) {
+				t.Fatalf("Expected fields\n%s\ngot\n%s", rawExpected, rawNames)
+			}
+		})
+	}
+}
+
+func TestFieldsListAddMarshaledJSONAt(t *testing.T) {
+	scenarios := []struct {
+		position int
+		expected []string
+	}{
+		{-2, []string{"test1", "test2_new", "test3", "test4"}},
+		{-1, []string{"test1", "test2_new", "test3", "test4"}},
+		{0, []string{"test2_new", "test4", "test1", "test3"}},
+		{1, []string{"test1", "test2_new", "test4", "test3"}},
+		{2, []string{"test1", "test3", "test2_new", "test4"}},
+		{3, []string{"test1", "test3", "test2_new", "test4"}},
+		{4, []string{"test1", "test3", "test2_new", "test4"}},
+		{5, []string{"test1", "test3", "test2_new", "test4"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(strconv.Itoa(s.position), func(t *testing.T) {
+			f1 := &core.TextField{Id: "f1Id", Name: "test1"}
+			f2 := &core.TextField{Id: "f2Id", Name: "test2"}
+			f3 := &core.TextField{Id: "f3Id", Name: "test3"}
+			testFieldsList := core.NewFieldsList(f1, f2, f3)
+
+			err := testFieldsList.AddMarshaledJSONAt(s.position, []byte(`[
+				{"id":"f2Id", "name":"test2_new", "type": "text"},
+				{"name": "test4", "type": "text"}
+			]`))
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			rawNames, err := json.Marshal(testFieldsList.FieldNames())
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			rawExpected, err := json.Marshal(s.expected)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if !bytes.Equal(rawNames, rawExpected) {
+				t.Fatalf("Expected fields\n%s\ngot\n%s", rawExpected, rawNames)
+			}
+		})
+	}
+}
+
+func TestFieldsListStringAndValue(t *testing.T) {
+	t.Run("empty list", func(t *testing.T) {
+		testFieldsList := core.NewFieldsList()
+
+		str := testFieldsList.String()
+		if str != "[]" {
+			t.Fatalf("Expected empty slice, got\n%q", str)
+		}
+
+		v, err := testFieldsList.Value()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if v != str {
+			t.Fatalf("Expected String and Value to match")
+		}
+	})
+
+	t.Run("list with fields", func(t *testing.T) {
+		testFieldsList := core.NewFieldsList(
+			&core.TextField{Id: "f1id", Name: "test1"},
+			&core.BoolField{Id: "f2id", Name: "test2"},
+			&core.URLField{Id: "f3id", Name: "test3"},
+		)
+
+		str := testFieldsList.String()
+
+		v, err := testFieldsList.Value()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if v != str {
+			t.Fatalf("Expected String and Value to match")
+		}
+
+		expectedParts := []string{
+			`"type":"bool"`,
+			`"type":"url"`,
+			`"type":"text"`,
+			`"id":"f1id"`,
+			`"id":"f2id"`,
+			`"id":"f3id"`,
+			`"name":"test1"`,
+			`"name":"test2"`,
+			`"name":"test3"`,
+		}
+
+		for _, part := range expectedParts {
+			if !strings.Contains(str, part) {
+				t.Fatalf("Missing %q in\nn%v", part, str)
+			}
+		}
+	})
+}
+
+func TestFieldsListScan(t *testing.T) {
+	scenarios := []struct {
+		name        string
+		data        any
+		expectError bool
+		expectJSON  string
+	}{
+		{"nil", nil, false, "[]"},
+		{"empty string", "", false, "[]"},
+		{"empty byte", []byte{}, false, "[]"},
+		{"empty string array", "[]", false, "[]"},
+		{"invalid string", "invalid", true, "[]"},
+		{"non-string", 123, true, "[]"},
+		{"item with no field type", `[{}]`, true, "[]"},
+		{
+			"unknown field type",
+			`[{"id":"123","name":"test1","type":"unknown"},{"id":"456","name":"test2","type":"bool"}]`,
+			true,
+			`[]`,
+		},
+		{
+			"only the minimum field options",
+			`[{"id":"123","name":"test1","type":"text","required":true},{"id":"456","name":"test2","type":"bool"}]`,
+			false,
+			`[{"autogeneratePattern":"","hidden":false,"id":"123","max":0,"min":0,"name":"test1","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"hidden":false,"id":"456","name":"test2","presentable":false,"required":false,"system":false,"type":"bool"}]`,
+		},
+		{
+			"all field options",
+			`[{"autogeneratePattern":"","hidden":true,"id":"123","max":12,"min":0,"name":"test1","pattern":"","presentable":true,"primaryKey":false,"required":true,"system":false,"type":"text"},{"hidden":false,"id":"456","name":"test2","presentable":false,"required":false,"system":true,"type":"bool"}]`,
+			false,
+			`[{"autogeneratePattern":"","hidden":true,"id":"123","max":12,"min":0,"name":"test1","pattern":"","presentable":true,"primaryKey":false,"required":true,"system":false,"type":"text"},{"hidden":false,"id":"456","name":"test2","presentable":false,"required":false,"system":true,"type":"bool"}]`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testFieldsList := core.FieldsList{}
+
+			err := testFieldsList.Scan(s.data)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			str := testFieldsList.String()
+			if str != s.expectJSON {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expectJSON, str)
+			}
+		})
+	}
+}
+
+func TestFieldsListJSON(t *testing.T) {
+	scenarios := []struct {
+		name        string
+		data        string
+		expectError bool
+		expectJSON  string
+	}{
+		{"empty string", "", true, "[]"},
+		{"invalid string", "invalid", true, "[]"},
+		{"empty string array", "[]", false, "[]"},
+		{"item with no field type", `[{}]`, true, "[]"},
+		{
+			"unknown field type",
+			`[{"id":"123","name":"test1","type":"unknown"},{"id":"456","name":"test2","type":"bool"}]`,
+			true,
+			`[]`,
+		},
+		{
+			"only the minimum field options",
+			`[{"id":"123","name":"test1","type":"text","required":true},{"id":"456","name":"test2","type":"bool"}]`,
+			false,
+			`[{"autogeneratePattern":"","hidden":false,"id":"123","max":0,"min":0,"name":"test1","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"hidden":false,"id":"456","name":"test2","presentable":false,"required":false,"system":false,"type":"bool"}]`,
+		},
+		{
+			"all field options",
+			`[{"autogeneratePattern":"","hidden":true,"id":"123","max":12,"min":0,"name":"test1","pattern":"","presentable":true,"primaryKey":false,"required":true,"system":false,"type":"text"},{"hidden":false,"id":"456","name":"test2","presentable":false,"required":false,"system":true,"type":"bool"}]`,
+			false,
+			`[{"autogeneratePattern":"","hidden":true,"id":"123","max":12,"min":0,"name":"test1","pattern":"","presentable":true,"primaryKey":false,"required":true,"system":false,"type":"text"},{"hidden":false,"id":"456","name":"test2","presentable":false,"required":false,"system":true,"type":"bool"}]`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testFieldsList := core.FieldsList{}
+
+			err := testFieldsList.UnmarshalJSON([]byte(s.data))
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			raw, err := testFieldsList.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			str := string(raw)
+			if str != s.expectJSON {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expectJSON, str)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/log_model.go b/server/core_backend-server/core/log_model.go
new file mode 100644
index 0000000..c2c3e7a
--- /dev/null
+++ b/server/core_backend-server/core/log_model.go
@@ -0,0 +1,22 @@
+package core
+
+import "github.com/pocketbase/pocketbase/tools/types"
+
+var (
+	_ Model = (*Log)(nil)
+)
+
+const LogsTableName = "_logs"
+
+type Log struct {
+	BaseModel
+
+	Created types.DateTime     `db:"created" json:"created"`
+	Data    types.JSONMap[any] `db:"data" json:"data"`
+	Message string             `db:"message" json:"message"`
+	Level   int                `db:"level" json:"level"`
+}
+
+func (m *Log) TableName() string {
+	return LogsTableName
+}
diff --git a/server/core_backend-server/core/log_printer.go b/server/core_backend-server/core/log_printer.go
new file mode 100644
index 0000000..0f8eb3b
--- /dev/null
+++ b/server/core_backend-server/core/log_printer.go
@@ -0,0 +1,67 @@
+package core
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/tools/logger"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/spf13/cast"
+)
+
+var cachedColors = store.New[string, *color.Color](nil)
+
+// getColor returns [color.Color] object and cache it (if not already).
+func getColor(attrs ...color.Attribute) (c *color.Color) {
+	cacheKey := fmt.Sprint(attrs)
+	if c = cachedColors.Get(cacheKey); c == nil {
+		c = color.New(attrs...)
+		cachedColors.Set(cacheKey, c)
+	}
+	return
+}
+
+// printLog prints the provided log to the stderr.
+// (note: defined as variable to overwriting in the tests)
+var printLog = func(log *logger.Log) {
+	var str strings.Builder
+
+	switch log.Level {
+	case slog.LevelDebug:
+		str.WriteString(getColor(color.Bold, color.FgHiBlack).Sprint("DEBUG "))
+		str.WriteString(getColor(color.FgWhite).Sprint(log.Message))
+	case slog.LevelInfo:
+		str.WriteString(getColor(color.Bold, color.FgWhite).Sprint("INFO "))
+		str.WriteString(getColor(color.FgWhite).Sprint(log.Message))
+	case slog.LevelWarn:
+		str.WriteString(getColor(color.Bold, color.FgYellow).Sprint("WARN "))
+		str.WriteString(getColor(color.FgYellow).Sprint(log.Message))
+	case slog.LevelError:
+		str.WriteString(getColor(color.Bold, color.FgRed).Sprint("ERROR "))
+		str.WriteString(getColor(color.FgRed).Sprint(log.Message))
+	default:
+		str.WriteString(getColor(color.Bold, color.FgCyan).Sprintf("[%d] ", log.Level))
+		str.WriteString(getColor(color.FgCyan).Sprint(log.Message))
+	}
+
+	str.WriteString("\n")
+
+	if v, ok := log.Data["type"]; ok && cast.ToString(v) == "request" {
+		padding := 0
+		keys := []string{"error", "details"}
+		for _, k := range keys {
+			if v := log.Data[k]; v != nil {
+				str.WriteString(getColor(color.FgHiRed).Sprintf("%s└─ %v", strings.Repeat(" ", padding), v))
+				str.WriteString("\n")
+				padding += 3
+			}
+		}
+	} else if len(log.Data) > 0 {
+		str.WriteString(getColor(color.FgHiBlack).Sprintf("└─ %v", log.Data))
+		str.WriteString("\n")
+	}
+
+	fmt.Print(str.String())
+}
diff --git a/server/core_backend-server/core/log_printer_test.go b/server/core_backend-server/core/log_printer_test.go
new file mode 100644
index 0000000..f799804
--- /dev/null
+++ b/server/core_backend-server/core/log_printer_test.go
@@ -0,0 +1,125 @@
+package core
+
+import (
+	"context"
+	"database/sql"
+	"log/slog"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/logger"
+)
+
+func TestBaseAppLoggerLevelDevPrint(t *testing.T) {
+	testLogLevel := 4
+
+	scenarios := []struct {
+		name            string
+		isDev           bool
+		levels          []int
+		printedLevels   []int
+		persistedLevels []int
+	}{
+		{
+			"dev mode",
+			true,
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{testLogLevel, testLogLevel + 1},
+		},
+		{
+			"nondev mode",
+			false,
+			[]int{testLogLevel - 1, testLogLevel, testLogLevel + 1},
+			[]int{},
+			[]int{testLogLevel, testLogLevel + 1},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			const testDataDir = "./pb_base_app_test_data_dir/"
+			defer os.RemoveAll(testDataDir)
+
+			app, cleanup := NewBaseAppForTest(BaseAppConfig{
+				DataDir:     testDataDir,
+				PostgresURL: "postgres://user:pass@localhost:6432/postgres?sslmode=disable",
+				IsDev:       s.isDev,
+			})
+			defer cleanup()
+
+			if err := app.Bootstrap(); err != nil {
+				t.Fatal(err)
+			}
+
+			// silence query logs
+			app.concurrentDB.(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {}
+			app.concurrentDB.(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {}
+			app.nonconcurrentDB.(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {}
+			app.nonconcurrentDB.(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {}
+
+			app.Settings().Logs.MinLevel = testLogLevel
+			if err := app.Save(app.Settings()); err != nil {
+				t.Fatal(err)
+			}
+
+			var printedLevels []int
+			var persistedLevels []int
+
+			ctx := context.Background()
+
+			// track printed logs
+			originalPrintLog := printLog
+			defer func() {
+				printLog = originalPrintLog
+			}()
+			printLog = func(log *logger.Log) {
+				printedLevels = append(printedLevels, int(log.Level))
+			}
+
+			// track persisted logs
+			app.OnModelAfterCreateSuccess("_logs").BindFunc(func(e *ModelEvent) error {
+				l, ok := e.Model.(*Log)
+				if ok {
+					persistedLevels = append(persistedLevels, l.Level)
+				}
+				return e.Next()
+			})
+
+			// write and persist logs
+			for _, l := range s.levels {
+				app.Logger().Log(ctx, slog.Level(l), "test")
+			}
+			handler, ok := app.Logger().Handler().(*logger.BatchHandler)
+			if !ok {
+				t.Fatalf("Expected BatchHandler, got %v", app.Logger().Handler())
+			}
+			if err := handler.WriteAll(ctx); err != nil {
+				t.Fatalf("Failed to write all logs: %v", err)
+			}
+
+			// check persisted log levels
+			if len(s.persistedLevels) != len(persistedLevels) {
+				t.Fatalf("Expected persisted levels \n%v\ngot\n%v", s.persistedLevels, persistedLevels)
+			}
+			for _, l := range persistedLevels {
+				if !list.ExistInSlice(l, s.persistedLevels) {
+					t.Fatalf("Missing expected persisted level %v in %v", l, persistedLevels)
+				}
+			}
+
+			// check printed log levels
+			if len(s.printedLevels) != len(printedLevels) {
+				t.Fatalf("Expected printed levels \n%v\ngot\n%v", s.printedLevels, printedLevels)
+			}
+			for _, l := range printedLevels {
+				if !list.ExistInSlice(l, s.printedLevels) {
+					t.Fatalf("Missing expected printed level %v in %v", l, printedLevels)
+				}
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/log_query.go b/server/core_backend-server/core/log_query.go
new file mode 100644
index 0000000..be055e4
--- /dev/null
+++ b/server/core_backend-server/core/log_query.go
@@ -0,0 +1,71 @@
+package core
+
+import (
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// LogQuery returns a new Log select query.
+func (app *BaseApp) LogQuery() *dbx.SelectQuery {
+	return app.AuxModelQuery(&Log{})
+}
+
+// FindLogById finds a single Log entry by its id.
+func (app *BaseApp) FindLogById(id string) (*Log, error) {
+	model := &Log{}
+
+	err := app.LogQuery().
+		AndWhere(dbx.HashExp{"id": id}).
+		Limit(1).
+		One(model)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return model, nil
+}
+
+// LogsStatsItem defines the total number of logs for a specific time period.
+type LogsStatsItem struct {
+	Date  types.DateTime `db:"date" json:"date"`
+	Total int            `db:"total" json:"total"`
+}
+
+// LogsStats returns hourly grouped logs statistics.
+func (app *BaseApp) LogsStats(expr dbx.Expression) ([]*LogsStatsItem, error) {
+	result := []*LogsStatsItem{}
+
+	query := app.LogQuery()
+	if IsPostgres(app) {
+		// PostgreSQL:
+		query.Select("count(id) as total", "date_trunc('hour', created) as date")
+	} else {
+		// SQLite:
+		query.Select("count(id) as total", "strftime('%Y-%m-%d %H:00:00', created) as date")
+	}
+	query.GroupBy("date").OrderBy("date ASC")
+
+	if expr != nil {
+		query.AndWhere(expr)
+	}
+
+	err := query.All(&result)
+
+	return result, err
+}
+
+// DeleteOldLogs delete all logs that are created before createdBefore.
+//
+// For better performance the logs delete is executed as plain SQL statement,
+// aka. no delete model hook events will be fired.
+func (app *BaseApp) DeleteOldLogs(createdBefore time.Time) error {
+	formattedDate := createdBefore.UTC().Format(types.DefaultDateLayout)
+	expr := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": formattedDate})
+
+	_, err := app.auxNonconcurrentDB.Delete((&Log{}).TableName(), expr).Execute()
+
+	return err
+}
diff --git a/server/core_backend-server/core/log_query_test.go b/server/core_backend-server/core/log_query_test.go
new file mode 100644
index 0000000..93cd021
--- /dev/null
+++ b/server/core_backend-server/core/log_query_test.go
@@ -0,0 +1,117 @@
+package core_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestFindLogById(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	err := tests.StubLogsData(app)
+	if err != nil {
+		panic(err)
+	}
+
+	scenarios := []struct {
+		id          string
+		expectError bool
+	}{
+		{"", true},
+		{"invalid", true},
+		{"00000000-9f38-44fb-bf82-c8f53b310d91", true},
+		{"873f2133-9f38-44fb-bf82-c8f53b310d91", false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.id), func(t *testing.T) {
+			log, err := app.FindLogById(s.id)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if log != nil && log.Id != s.id {
+				t.Fatalf("Expected log with id %q, got %q", s.id, log.Id)
+			}
+		})
+	}
+}
+
+func TestLogsStats(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	tests.StubLogsData(app)
+
+	expected := `[{"date":"2022-05-01 10:00:00.000Z","total":1},{"date":"2022-05-02 10:00:00.000Z","total":1}]`
+
+	// now := time.Now().UTC().Format(types.DefaultDateLayout)
+	exp := dbx.NewExp("[[created]] <= {:date}", dbx.Params{"date": time.Now()})
+	result, err := app.LogsStats(exp)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	encoded, _ := json.Marshal(result)
+	if string(encoded) != expected {
+		t.Fatalf("Expected\n%q\ngot\n%q", expected, string(encoded))
+	}
+}
+
+func TestDeleteOldLogs(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	tests.StubLogsData(app)
+
+	scenarios := []struct {
+		date          string
+		expectedTotal int
+	}{
+		{"2022-01-01 10:00:00.000Z", 2}, // no logs to delete before that time
+		{"2022-05-01 11:00:00.000Z", 1}, // only 1 log should have left
+		{"2022-05-03 11:00:00.000Z", 0}, // no more logs should have left
+		{"2022-05-04 11:00:00.000Z", 0}, // no more logs should have left
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.date, func(t *testing.T) {
+			date, dateErr := time.Parse(types.DefaultDateLayout, s.date)
+			if dateErr != nil {
+				t.Fatalf("Date error %v", dateErr)
+			}
+
+			deleteErr := app.DeleteOldLogs(date)
+			if deleteErr != nil {
+				t.Fatalf("Delete error %v", deleteErr)
+			}
+
+			// check total remaining logs
+			var total int
+			countErr := app.AuxModelQuery(&core.Log{}).Select("count(*)").Row(&total)
+			if countErr != nil {
+				t.Errorf("Count error %v", countErr)
+			}
+
+			if total != s.expectedTotal {
+				t.Errorf("Expected %d remaining logs, got %d", s.expectedTotal, total)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/mfa_model.go b/server/core_backend-server/core/mfa_model.go
new file mode 100644
index 0000000..d2d2eb1
--- /dev/null
+++ b/server/core_backend-server/core/mfa_model.go
@@ -0,0 +1,157 @@
+package core
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+const (
+	MFAMethodPassword = "password"
+	MFAMethodOAuth2   = "oauth2"
+	MFAMethodOTP      = "otp"
+)
+
+const CollectionNameMFAs = "_mfas"
+
+var (
+	_ Model        = (*MFA)(nil)
+	_ PreValidator = (*MFA)(nil)
+	_ RecordProxy  = (*MFA)(nil)
+)
+
+// MFA defines a Record proxy for working with the mfas collection.
+type MFA struct {
+	*Record
+}
+
+// NewMFA instantiates and returns a new blank *MFA model.
+//
+// Example usage:
+//
+//	mfa := core.NewMFA(app)
+//	mfa.SetRecordRef(user.Id)
+//	mfa.SetCollectionRef(user.Collection().Id)
+//	mfa.SetMethod(core.MFAMethodPassword)
+//	app.Save(mfa)
+func NewMFA(app App) *MFA {
+	m := &MFA{}
+
+	c, err := app.FindCachedCollectionByNameOrId(CollectionNameMFAs)
+	if err != nil {
+		// this is just to make tests easier since mfa is a system collection and it is expected to be always accessible
+		// (note: the loaded record is further checked on MFA.PreValidate())
+		c = NewBaseCollection("@__invalid__")
+	}
+
+	m.Record = NewRecord(c)
+
+	return m
+}
+
+// PreValidate implements the [PreValidator] interface and checks
+// whether the proxy is properly loaded.
+func (m *MFA) PreValidate(ctx context.Context, app App) error {
+	if m.Record == nil || m.Record.Collection().Name != CollectionNameMFAs {
+		return errors.New("missing or invalid mfa ProxyRecord")
+	}
+
+	return nil
+}
+
+// ProxyRecord returns the proxied Record model.
+func (m *MFA) ProxyRecord() *Record {
+	return m.Record
+}
+
+// SetProxyRecord loads the specified record model into the current proxy.
+func (m *MFA) SetProxyRecord(record *Record) {
+	m.Record = record
+}
+
+// CollectionRef returns the "collectionRef" field value.
+func (m *MFA) CollectionRef() string {
+	return m.GetString("collectionRef")
+}
+
+// SetCollectionRef updates the "collectionRef" record field value.
+func (m *MFA) SetCollectionRef(collectionId string) {
+	m.Set("collectionRef", collectionId)
+}
+
+// RecordRef returns the "recordRef" record field value.
+func (m *MFA) RecordRef() string {
+	return m.GetString("recordRef")
+}
+
+// SetRecordRef updates the "recordRef" record field value.
+func (m *MFA) SetRecordRef(recordId string) {
+	m.Set("recordRef", recordId)
+}
+
+// Method returns the "method" record field value.
+func (m *MFA) Method() string {
+	return m.GetString("method")
+}
+
+// SetMethod updates the "method" record field value.
+func (m *MFA) SetMethod(method string) {
+	m.Set("method", method)
+}
+
+// Created returns the "created" record field value.
+func (m *MFA) Created() types.DateTime {
+	return m.GetDateTime("created")
+}
+
+// Updated returns the "updated" record field value.
+func (m *MFA) Updated() types.DateTime {
+	return m.GetDateTime("updated")
+}
+
+// HasExpired checks if the mfa is expired, aka. whether it has been
+// more than maxElapsed time since its creation.
+func (m *MFA) HasExpired(maxElapsed time.Duration) bool {
+	return time.Since(m.Created().Time()) > maxElapsed
+}
+
+func (app *BaseApp) registerMFAHooks() {
+	recordRefHooks[*MFA](app, CollectionNameMFAs, CollectionTypeAuth)
+
+	// run on every hour to cleanup expired mfa sessions
+	app.Cron().Add("__pbMFACleanup__", "0 * * * *", func() {
+		if err := app.DeleteExpiredMFAs(); err != nil {
+			app.Logger().Warn("Failed to delete expired MFA sessions", "error", err)
+		}
+	})
+
+	// delete existing mfas on password change
+	app.OnRecordUpdate().Bind(&hook.Handler[*RecordEvent]{
+		Func: func(e *RecordEvent) error {
+			err := e.Next()
+			if err != nil || !e.Record.Collection().IsAuth() {
+				return err
+			}
+
+			old := e.Record.Original().GetString(FieldNamePassword + ":hash")
+			new := e.Record.GetString(FieldNamePassword + ":hash")
+			if old != new {
+				err = e.App.DeleteAllMFAsByRecord(e.Record)
+				if err != nil {
+					e.App.Logger().Warn(
+						"Failed to delete all previous mfas",
+						"error", err,
+						"recordId", e.Record.Id,
+						"collectionId", e.Record.Collection().Id,
+					)
+				}
+			}
+
+			return nil
+		},
+		Priority: 99,
+	})
+}
diff --git a/server/core_backend-server/core/mfa_model_test.go b/server/core_backend-server/core/mfa_model_test.go
new file mode 100644
index 0000000..9766974
--- /dev/null
+++ b/server/core_backend-server/core/mfa_model_test.go
@@ -0,0 +1,302 @@
+package core_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestNewMFA(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	mfa := core.NewMFA(app)
+
+	if mfa.Collection().Name != core.CollectionNameMFAs {
+		t.Fatalf("Expected record with %q collection, got %q", core.CollectionNameMFAs, mfa.Collection().Name)
+	}
+}
+
+func TestMFAProxyRecord(t *testing.T) {
+	t.Parallel()
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+	record.Id = "test_id"
+
+	mfa := core.MFA{}
+	mfa.SetProxyRecord(record)
+
+	if mfa.ProxyRecord() == nil || mfa.ProxyRecord().Id != record.Id {
+		t.Fatalf("Expected proxy record with id %q, got %v", record.Id, mfa.ProxyRecord())
+	}
+}
+
+func TestMFARecordRef(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	mfa := core.NewMFA(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			mfa.SetRecordRef(testValue)
+
+			if v := mfa.RecordRef(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := mfa.GetString("recordRef"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestMFACollectionRef(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	mfa := core.NewMFA(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			mfa.SetCollectionRef(testValue)
+
+			if v := mfa.CollectionRef(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := mfa.GetString("collectionRef"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestMFAMethod(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	mfa := core.NewMFA(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			mfa.SetMethod(testValue)
+
+			if v := mfa.Method(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := mfa.GetString("method"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestMFACreated(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	mfa := core.NewMFA(app)
+
+	if v := mfa.Created().String(); v != "" {
+		t.Fatalf("Expected empty created, got %q", v)
+	}
+
+	now := types.NowDateTime()
+	mfa.SetRaw("created", now)
+
+	if v := mfa.Created().String(); v != now.String() {
+		t.Fatalf("Expected %q created, got %q", now.String(), v)
+	}
+}
+
+func TestMFAUpdated(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	mfa := core.NewMFA(app)
+
+	if v := mfa.Updated().String(); v != "" {
+		t.Fatalf("Expected empty updated, got %q", v)
+	}
+
+	now := types.NowDateTime()
+	mfa.SetRaw("updated", now)
+
+	if v := mfa.Updated().String(); v != now.String() {
+		t.Fatalf("Expected %q updated, got %q", now.String(), v)
+	}
+}
+
+func TestMFAHasExpired(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	now := types.NowDateTime()
+
+	mfa := core.NewMFA(app)
+	mfa.SetRaw("created", now.Add(-5*time.Minute))
+
+	scenarios := []struct {
+		maxElapsed time.Duration
+		expected   bool
+	}{
+		{0 * time.Minute, true},
+		{3 * time.Minute, true},
+		{5 * time.Minute, true},
+		{6 * time.Minute, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.maxElapsed.String()), func(t *testing.T) {
+			result := mfa.HasExpired(s.maxElapsed)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestMFAPreValidate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	mfasCol, err := app.FindCollectionByNameOrId(core.CollectionNameMFAs)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("no proxy record", func(t *testing.T) {
+		mfa := &core.MFA{}
+
+		if err := app.Validate(mfa); err == nil {
+			t.Fatal("Expected collection validation error")
+		}
+	})
+
+	t.Run("non-MFA collection", func(t *testing.T) {
+		mfa := &core.MFA{}
+		mfa.SetProxyRecord(core.NewRecord(core.NewBaseCollection("invalid")))
+		mfa.SetRecordRef(user.Id)
+		mfa.SetCollectionRef(user.Collection().Id)
+		mfa.SetMethod("test123")
+
+		if err := app.Validate(mfa); err == nil {
+			t.Fatal("Expected collection validation error")
+		}
+	})
+
+	t.Run("MFA collection", func(t *testing.T) {
+		mfa := &core.MFA{}
+		mfa.SetProxyRecord(core.NewRecord(mfasCol))
+		mfa.SetRecordRef(user.Id)
+		mfa.SetCollectionRef(user.Collection().Id)
+		mfa.SetMethod("test123")
+
+		if err := app.Validate(mfa); err != nil {
+			t.Fatalf("Expected nil validation error, got %v", err)
+		}
+	})
+}
+
+func TestMFAValidateHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name         string
+		mfa          func() *core.MFA
+		expectErrors []string
+	}{
+		{
+			"empty",
+			func() *core.MFA {
+				return core.NewMFA(app)
+			},
+			[]string{"collectionRef", "recordRef", "method"},
+		},
+		{
+			"non-auth collection",
+			func() *core.MFA {
+				mfa := core.NewMFA(app)
+				mfa.SetCollectionRef(demo1.Collection().Id)
+				mfa.SetRecordRef(demo1.Id)
+				mfa.SetMethod("test123")
+				return mfa
+			},
+			[]string{"collectionRef"},
+		},
+		{
+			"missing record id",
+			func() *core.MFA {
+				mfa := core.NewMFA(app)
+				mfa.SetCollectionRef(user.Collection().Id)
+				mfa.SetRecordRef("missing")
+				mfa.SetMethod("test123")
+				return mfa
+			},
+			[]string{"recordRef"},
+		},
+		{
+			"valid ref",
+			func() *core.MFA {
+				mfa := core.NewMFA(app)
+				mfa.SetCollectionRef(user.Collection().Id)
+				mfa.SetRecordRef(user.Id)
+				mfa.SetMethod("test123")
+				return mfa
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := app.Validate(s.mfa())
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/mfa_query.go b/server/core_backend-server/core/mfa_query.go
new file mode 100644
index 0000000..1ccfd45
--- /dev/null
+++ b/server/core_backend-server/core/mfa_query.go
@@ -0,0 +1,117 @@
+package core
+
+import (
+	"errors"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// FindAllMFAsByRecord returns all MFA models linked to the provided auth record.
+func (app *BaseApp) FindAllMFAsByRecord(authRecord *Record) ([]*MFA, error) {
+	result := []*MFA{}
+
+	err := app.RecordQuery(CollectionNameMFAs).
+		AndWhere(dbx.HashExp{
+			"collectionRef": authRecord.Collection().Id,
+			"recordRef":     authRecord.Id,
+		}).
+		OrderBy("created DESC").
+		All(&result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// FindAllMFAsByCollection returns all MFA models linked to the provided collection.
+func (app *BaseApp) FindAllMFAsByCollection(collection *Collection) ([]*MFA, error) {
+	result := []*MFA{}
+
+	err := app.RecordQuery(CollectionNameMFAs).
+		AndWhere(dbx.HashExp{"collectionRef": collection.Id}).
+		OrderBy("created DESC").
+		All(&result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// FindMFAById returns a single MFA model by its id.
+func (app *BaseApp) FindMFAById(id string) (*MFA, error) {
+	result := &MFA{}
+
+	err := app.RecordQuery(CollectionNameMFAs).
+		AndWhere(dbx.HashExp{"id": id}).
+		Limit(1).
+		One(result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// DeleteAllMFAsByRecord deletes all MFA models associated with the provided record.
+//
+// Returns a combined error with the failed deletes.
+func (app *BaseApp) DeleteAllMFAsByRecord(authRecord *Record) error {
+	models, err := app.FindAllMFAsByRecord(authRecord)
+	if err != nil {
+		return err
+	}
+
+	var errs []error
+	for _, m := range models {
+		if err := app.Delete(m); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	if len(errs) > 0 {
+		return errors.Join(errs...)
+	}
+
+	return nil
+}
+
+// DeleteExpiredMFAs deletes the expired MFAs for all auth collections.
+func (app *BaseApp) DeleteExpiredMFAs() error {
+	authCollections, err := app.FindAllCollections(CollectionTypeAuth)
+	if err != nil {
+		return err
+	}
+
+	// note: perform even if MFA is disabled to ensure that there are no dangling old records
+	for _, collection := range authCollections {
+		minValidDate, err := types.ParseDateTime(time.Now().Add(-1 * collection.MFA.DurationTime()))
+		if err != nil {
+			return err
+		}
+
+		items := []*Record{}
+
+		err = app.RecordQuery(CollectionNameMFAs).
+			AndWhere(dbx.HashExp{"collectionRef": collection.Id}).
+			AndWhere(dbx.NewExp("[[created]] < {:date}", dbx.Params{"date": minValidDate})).
+			All(&items)
+		if err != nil {
+			return err
+		}
+
+		for _, item := range items {
+			err = app.Delete(item)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/core/mfa_query_test.go b/server/core_backend-server/core/mfa_query_test.go
new file mode 100644
index 0000000..e26e2b3
--- /dev/null
+++ b/server/core_backend-server/core/mfa_query_test.go
@@ -0,0 +1,311 @@
+package core_test
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestFindAllMFAsByRecord(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	if err := tests.StubMFARecords(app); err != nil {
+		t.Fatal(err)
+	}
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser2, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser4, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test4@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user1, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record   *core.Record
+		expected []string
+	}{
+		{demo1, nil},
+		{superuser2, []string{"superuser2_0", "superuser2_3", "superuser2_2", "superuser2_1", "superuser2_4"}},
+		{superuser4, nil},
+		{user1, []string{"user1_0"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.record.Collection().Name+"_"+s.record.Id, func(t *testing.T) {
+			result, err := app.FindAllMFAsByRecord(s.record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected total mfas %d, got %d", len(s.expected), len(result))
+			}
+
+			for i, id := range s.expected {
+				if result[i].Id != id {
+					t.Errorf("[%d] Expected id %q, got %q", i, id, result[i].Id)
+				}
+			}
+		})
+	}
+}
+
+func TestFindAllMFAsByCollection(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	if err := tests.StubMFARecords(app); err != nil {
+		t.Fatal(err)
+	}
+
+	demo1, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superusers, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	clients, err := app.FindCollectionByNameOrId("clients")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	users, err := app.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		collection *core.Collection
+		expected   []string
+	}{
+		{demo1, nil},
+		{superusers, []string{
+			"superuser2_0",
+			"superuser2_3",
+			"superuser3_0",
+			"superuser2_2",
+			"superuser3_1",
+			"superuser2_1",
+			"superuser2_4",
+		}},
+		{clients, nil},
+		{users, []string{"user1_0"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.collection.Name, func(t *testing.T) {
+			result, err := app.FindAllMFAsByCollection(s.collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected total mfas %d, got %d", len(s.expected), len(result))
+			}
+
+			for i, id := range s.expected {
+				if result[i].Id != id {
+					t.Errorf("[%d] Expected id %q, got %q", i, id, result[i].Id)
+				}
+			}
+		})
+	}
+}
+
+func TestFindMFAById(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	if err := tests.StubMFARecords(app); err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		id          string
+		expectError bool
+	}{
+		{"", true},
+		{"84nmscqy84lsi1t", true}, // non-mfa id
+		{"superuser2_0", false},
+		{"superuser2_4", false}, // expired
+		{"user1_0", false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.id, func(t *testing.T) {
+			result, err := app.FindMFAById(s.id)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if result.Id != s.id {
+				t.Fatalf("Expected record with id %q, got %q", s.id, result.Id)
+			}
+		})
+	}
+}
+
+func TestDeleteAllMFAsByRecord(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	demo1, err := testApp.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser2, err := testApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser4, err := testApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test4@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user1, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record     *core.Record
+		deletedIds []string
+	}{
+		{demo1, nil}, // non-auth record
+		{superuser2, []string{"superuser2_0", "superuser2_1", "superuser2_3", "superuser2_2", "superuser2_4"}},
+		{superuser4, nil},
+		{user1, []string{"user1_0"}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.record.Collection().Name, s.record.Id), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			if err := tests.StubMFARecords(app); err != nil {
+				t.Fatal(err)
+			}
+
+			deletedIds := []string{}
+			app.OnRecordAfterDeleteSuccess().BindFunc(func(e *core.RecordEvent) error {
+				deletedIds = append(deletedIds, e.Record.Id)
+				return e.Next()
+			})
+
+			err := app.DeleteAllMFAsByRecord(s.record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(deletedIds) != len(s.deletedIds) {
+				t.Fatalf("Expected deleted ids\n%v\ngot\n%v", s.deletedIds, deletedIds)
+			}
+
+			for _, id := range s.deletedIds {
+				if !slices.Contains(deletedIds, id) {
+					t.Errorf("Expected to find deleted id %q in %v", id, deletedIds)
+				}
+			}
+		})
+	}
+}
+
+func TestDeleteExpiredMFAs(t *testing.T) {
+	t.Parallel()
+
+	checkDeletedIds := func(app core.App, t *testing.T, expectedDeletedIds []string) {
+		if err := tests.StubMFARecords(app); err != nil {
+			t.Fatal(err)
+		}
+
+		deletedIds := []string{}
+		app.OnRecordDelete().BindFunc(func(e *core.RecordEvent) error {
+			deletedIds = append(deletedIds, e.Record.Id)
+			return e.Next()
+		})
+
+		if err := app.DeleteExpiredMFAs(); err != nil {
+			t.Fatal(err)
+		}
+
+		if len(deletedIds) != len(expectedDeletedIds) {
+			t.Fatalf("Expected deleted ids\n%v\ngot\n%v", expectedDeletedIds, deletedIds)
+		}
+
+		for _, id := range expectedDeletedIds {
+			if !slices.Contains(deletedIds, id) {
+				t.Errorf("Expected to find deleted id %q in %v", id, deletedIds)
+			}
+		}
+	}
+
+	t.Run("default test collections", func(t *testing.T) {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		checkDeletedIds(app, t, []string{
+			"user1_0",
+			"superuser2_1",
+			"superuser2_4",
+		})
+	})
+
+	t.Run("mfa collection duration mock", func(t *testing.T) {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		superusers, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+		if err != nil {
+			t.Fatal(err)
+		}
+		superusers.MFA.Duration = 60
+		if err := app.Save(superusers); err != nil {
+			t.Fatalf("Failed to mock superusers mfa duration: %v", err)
+		}
+
+		checkDeletedIds(app, t, []string{
+			"user1_0",
+			"superuser2_1",
+			"superuser2_2",
+			"superuser2_4",
+			"superuser3_1",
+		})
+	})
+}
diff --git a/server/core_backend-server/core/migrations_list.go b/server/core_backend-server/core/migrations_list.go
new file mode 100644
index 0000000..dc54181
--- /dev/null
+++ b/server/core_backend-server/core/migrations_list.go
@@ -0,0 +1,83 @@
+package core
+
+import (
+	"path/filepath"
+	"runtime"
+	"sort"
+)
+
+type Migration struct {
+	Up               func(txApp App) error
+	Down             func(txApp App) error
+	File             string
+	ReapplyCondition func(txApp App, runner *MigrationsRunner, fileName string) (bool, error)
+}
+
+// MigrationsList defines a list with migration definitions
+type MigrationsList struct {
+	list []*Migration
+}
+
+// Item returns a single migration from the list by its index.
+func (l *MigrationsList) Item(index int) *Migration {
+	return l.list[index]
+}
+
+// Items returns the internal migrations list slice.
+func (l *MigrationsList) Items() []*Migration {
+	return l.list
+}
+
+// Copy copies all provided list migrations into the current one.
+func (l *MigrationsList) Copy(list MigrationsList) {
+	for _, item := range list.Items() {
+		l.Register(item.Up, item.Down, item.File)
+	}
+}
+
+// Add adds adds an existing migration definition to the list.
+//
+// If m.File is not provided, it will try to get the name from its .go file.
+//
+// The list will be sorted automatically based on the migrations file name.
+func (l *MigrationsList) Add(m *Migration) {
+	if m.File == "" {
+		_, path, _, _ := runtime.Caller(1)
+		m.File = filepath.Base(path)
+	}
+
+	l.list = append(l.list, m)
+
+	sort.SliceStable(l.list, func(i int, j int) bool {
+		return l.list[i].File < l.list[j].File
+	})
+}
+
+// Register adds new migration definition to the list.
+//
+// If optFilename is not provided, it will try to get the name from its .go file.
+//
+// The list will be sorted automatically based on the migrations file name.
+func (l *MigrationsList) Register(
+	up func(txApp App) error,
+	down func(txApp App) error,
+	optFilename ...string,
+) {
+	var file string
+	if len(optFilename) > 0 {
+		file = optFilename[0]
+	} else {
+		_, path, _, _ := runtime.Caller(1)
+		file = filepath.Base(path)
+	}
+
+	l.list = append(l.list, &Migration{
+		File: file,
+		Up:   up,
+		Down: down,
+	})
+
+	sort.SliceStable(l.list, func(i int, j int) bool {
+		return l.list[i].File < l.list[j].File
+	})
+}
diff --git a/server/core_backend-server/core/migrations_list_test.go b/server/core_backend-server/core/migrations_list_test.go
new file mode 100644
index 0000000..36acd40
--- /dev/null
+++ b/server/core_backend-server/core/migrations_list_test.go
@@ -0,0 +1,48 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func TestMigrationsList(t *testing.T) {
+	l1 := core.MigrationsList{}
+	l1.Add(&core.Migration{File: "5_test.go"})
+	l1.Add(&core.Migration{ /* auto detect file name */ })
+	l1.Register(nil, nil, "3_test.go")
+	l1.Register(nil, nil, "1_test.go")
+	l1.Register(nil, nil, "2_test.go")
+	l1.Register(nil, nil /* auto detect file name */)
+
+	l2 := core.MigrationsList{}
+	l2.Register(nil, nil, "4_test.go")
+	l2.Copy(l1)
+
+	expected := []string{
+		"1_test.go",
+		"2_test.go",
+		"3_test.go",
+		"4_test.go",
+		"5_test.go",
+		// twice because there 2 test migrations with auto filename
+		"migrations_list_test.go",
+		"migrations_list_test.go",
+	}
+
+	items := l2.Items()
+	if len(items) != len(expected) {
+		names := make([]string, len(items))
+		for i, item := range items {
+			names[i] = item.File
+		}
+		t.Fatalf("Expected %d items, got %d:\n%v", len(expected), len(names), names)
+	}
+
+	for i, name := range expected {
+		item := l2.Item(i)
+		if item.File != name {
+			t.Fatalf("Expected name %s for index %d, got %s", name, i, item.File)
+		}
+	}
+}
diff --git a/server/core_backend-server/core/migrations_runner.go b/server/core_backend-server/core/migrations_runner.go
new file mode 100644
index 0000000..67f9cd8
--- /dev/null
+++ b/server/core_backend-server/core/migrations_runner.go
@@ -0,0 +1,328 @@
+package core
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"github.com/spf13/cast"
+)
+
+var AppMigrations MigrationsList
+var SystemMigrations MigrationsList
+
+const DefaultMigrationsTable = "_migrations"
+
+// MigrationsRunner defines a simple struct for managing the execution of db migrations.
+type MigrationsRunner struct {
+	app            App
+	tableName      string
+	migrationsList MigrationsList
+	inited         bool
+}
+
+// NewMigrationsRunner creates and initializes a new db migrations MigrationsRunner instance.
+func NewMigrationsRunner(app App, migrationsList MigrationsList) *MigrationsRunner {
+	return &MigrationsRunner{
+		app:            app,
+		migrationsList: migrationsList,
+		tableName:      DefaultMigrationsTable,
+	}
+}
+
+// Run interactively executes the current runner with the provided args.
+//
+// The following commands are supported:
+// - up           - applies all migrations
+// - down [n]     - reverts the last n (default 1) applied migrations
+// - history-sync - syncs the migrations table with the runner's migrations list
+func (r *MigrationsRunner) Run(args ...string) error {
+	if err := r.initMigrationsTable(); err != nil {
+		return err
+	}
+
+	cmd := "up"
+	if len(args) > 0 {
+		cmd = args[0]
+	}
+
+	switch cmd {
+	case "up":
+		applied, err := r.Up()
+		if err != nil {
+			return err
+		}
+
+		if len(applied) == 0 {
+			color.Green("No new migrations to apply.")
+		} else {
+			for _, file := range applied {
+				color.Green("Applied %s", file)
+			}
+		}
+
+		return nil
+	case "down":
+		toRevertCount := 1
+		if len(args) > 1 {
+			toRevertCount = cast.ToInt(args[1])
+			if toRevertCount < 0 {
+				// revert all applied migrations
+				toRevertCount = len(r.migrationsList.Items())
+			}
+		}
+
+		names, err := r.lastAppliedMigrations(toRevertCount)
+		if err != nil {
+			return err
+		}
+
+		confirm := osutils.YesNoPrompt(fmt.Sprintf(
+			"\n%v\nDo you really want to revert the last %d applied migration(s)?",
+			strings.Join(names, "\n"),
+			toRevertCount,
+		), false)
+		if !confirm {
+			fmt.Println("The command has been cancelled")
+			return nil
+		}
+
+		reverted, err := r.Down(toRevertCount)
+		if err != nil {
+			return err
+		}
+
+		if len(reverted) == 0 {
+			color.Green("No migrations to revert.")
+		} else {
+			for _, file := range reverted {
+				color.Green("Reverted %s", file)
+			}
+		}
+
+		return nil
+	case "history-sync":
+		if err := r.RemoveMissingAppliedMigrations(); err != nil {
+			return err
+		}
+
+		color.Green("The %s table was synced with the available migrations.", r.tableName)
+		return nil
+	default:
+		return fmt.Errorf("unsupported command: %q", cmd)
+	}
+}
+
+// Up executes all unapplied migrations for the provided runner.
+//
+// On success returns list with the applied migrations file names.
+func (r *MigrationsRunner) Up() ([]string, error) {
+	if err := r.initMigrationsTable(); err != nil {
+		return nil, err
+	}
+
+	applied := []string{}
+
+	err := r.app.AuxRunInTransaction(func(txApp App) error {
+		return txApp.RunInTransaction(func(txApp App) error {
+			for _, m := range r.migrationsList.Items() {
+				// applied migrations check
+				if r.isMigrationApplied(txApp, m.File) {
+					if m.ReapplyCondition == nil {
+						continue // no need to reapply
+					}
+
+					shouldReapply, err := m.ReapplyCondition(txApp, r, m.File)
+					if err != nil {
+						return err
+					}
+					if !shouldReapply {
+						continue
+					}
+
+					// clear previous history stored entry
+					// (it will be recreated after successful execution)
+					r.saveRevertedMigration(txApp, m.File)
+				}
+
+				// ignore empty Up action
+				if m.Up != nil {
+					if err := m.Up(txApp); err != nil {
+						return fmt.Errorf("failed to apply migration %s: %w", m.File, err)
+					}
+				}
+
+				if err := r.saveAppliedMigration(txApp, m.File); err != nil {
+					return fmt.Errorf("failed to save applied migration info for %s: %w", m.File, err)
+				}
+
+				applied = append(applied, m.File)
+			}
+
+			return nil
+		})
+	})
+
+	if err != nil {
+		return nil, err
+	}
+	return applied, nil
+}
+
+// Down reverts the last `toRevertCount` applied migrations
+// (in the order they were applied).
+//
+// On success returns list with the reverted migrations file names.
+func (r *MigrationsRunner) Down(toRevertCount int) ([]string, error) {
+	if err := r.initMigrationsTable(); err != nil {
+		return nil, err
+	}
+
+	reverted := make([]string, 0, toRevertCount)
+
+	names, appliedErr := r.lastAppliedMigrations(toRevertCount)
+	if appliedErr != nil {
+		return nil, appliedErr
+	}
+
+	err := r.app.AuxRunInTransaction(func(txApp App) error {
+		return txApp.RunInTransaction(func(txApp App) error {
+			for _, name := range names {
+				for _, m := range r.migrationsList.Items() {
+					if m.File != name {
+						continue
+					}
+
+					// revert limit reached
+					if toRevertCount-len(reverted) <= 0 {
+						return nil
+					}
+
+					// ignore empty Down action
+					if m.Down != nil {
+						if err := m.Down(txApp); err != nil {
+							return fmt.Errorf("failed to revert migration %s: %w", m.File, err)
+						}
+					}
+
+					if err := r.saveRevertedMigration(txApp, m.File); err != nil {
+						return fmt.Errorf("failed to save reverted migration info for %s: %w", m.File, err)
+					}
+
+					reverted = append(reverted, m.File)
+				}
+			}
+			return nil
+		})
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return reverted, nil
+}
+
+// RemoveMissingAppliedMigrations removes the db entries of all applied migrations
+// that are not listed in the runner's migrations list.
+func (r *MigrationsRunner) RemoveMissingAppliedMigrations() error {
+	loadedMigrations := r.migrationsList.Items()
+
+	names := make([]any, len(loadedMigrations))
+	for i, migration := range loadedMigrations {
+		names[i] = migration.File
+	}
+
+	_, err := r.app.DB().Delete(r.tableName, dbx.Not(dbx.HashExp{
+		"file": names,
+	})).Execute()
+
+	return err
+}
+
+func (r *MigrationsRunner) initMigrationsTable() error {
+	if r.inited {
+		return nil // already inited
+	}
+
+	var rawQuery string
+	if IsPostgres(r.app) || IsMysql(r.app) {
+		// PostgreSQL and MySQL:
+		// the column `applied` is a int64 so we have to use BIGINT
+		rawQuery = fmt.Sprintf(
+			`CREATE TABLE IF NOT EXISTS {{%s}} (file VARCHAR(255) PRIMARY KEY NOT NULL, applied BIGINT NOT NULL)`,
+			r.tableName,
+		)
+	} else {
+		// SQLite:
+		rawQuery = fmt.Sprintf(
+			"CREATE TABLE IF NOT EXISTS {{%s}} (file VARCHAR(255) PRIMARY KEY NOT NULL, applied INTEGER NOT NULL)",
+			r.tableName,
+		)
+	}
+
+	_, err := r.app.DB().NewQuery(rawQuery).Execute()
+
+	if err == nil {
+		r.inited = true
+	}
+
+	return err
+}
+
+func (r *MigrationsRunner) isMigrationApplied(txApp App, file string) bool {
+	var exists int
+
+	err := txApp.DB().Select("(1)").
+		From(r.tableName).
+		Where(dbx.HashExp{"file": file}).
+		Limit(1).
+		Row(&exists)
+
+	return err == nil && exists > 0
+}
+
+func (r *MigrationsRunner) saveAppliedMigration(txApp App, file string) error {
+	_, err := txApp.DB().Insert(r.tableName, dbx.Params{
+		"file":    file,
+		"applied": time.Now().UnixMicro(),
+	}).Execute()
+
+	return err
+}
+
+func (r *MigrationsRunner) saveRevertedMigration(txApp App, file string) error {
+	_, err := txApp.DB().Delete(r.tableName, dbx.HashExp{"file": file}).Execute()
+
+	return err
+}
+
+func (r *MigrationsRunner) lastAppliedMigrations(limit int) ([]string, error) {
+	var files = make([]string, 0, limit)
+
+	loadedMigrations := r.migrationsList.Items()
+
+	names := make([]any, len(loadedMigrations))
+	for i, migration := range loadedMigrations {
+		names[i] = migration.File
+	}
+
+	err := r.app.DB().Select("file").
+		From(r.tableName).
+		Where(dbx.Not(dbx.HashExp{"applied": nil})).
+		AndWhere(dbx.HashExp{"file": names}).
+		// unify microseconds and seconds applied time for backward compatibility
+		OrderBy("substr(applied||'0000000000000000', 0, 17) DESC").
+		AndOrderBy("file DESC").
+		Limit(int64(limit)).
+		Column(&files)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return files, nil
+}
diff --git a/server/core_backend-server/core/migrations_runner_test.go b/server/core_backend-server/core/migrations_runner_test.go
new file mode 100644
index 0000000..a4c0c93
--- /dev/null
+++ b/server/core_backend-server/core/migrations_runner_test.go
@@ -0,0 +1,212 @@
+package core_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestMigrationsRunnerUpAndDown(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	callsOrder := []string{}
+
+	l := core.MigrationsList{}
+	l.Register(func(app core.App) error {
+		callsOrder = append(callsOrder, "up2")
+		return nil
+	}, func(app core.App) error {
+		callsOrder = append(callsOrder, "down2")
+		return nil
+	}, "2_test")
+	l.Register(func(app core.App) error {
+		callsOrder = append(callsOrder, "up3")
+		return nil
+	}, func(app core.App) error {
+		callsOrder = append(callsOrder, "down3")
+		return nil
+	}, "3_test")
+	l.Register(func(app core.App) error {
+		callsOrder = append(callsOrder, "up1")
+		return nil
+	}, func(app core.App) error {
+		callsOrder = append(callsOrder, "down1")
+		return nil
+	}, "1_test")
+	l.Register(func(app core.App) error {
+		callsOrder = append(callsOrder, "up4")
+		return nil
+	}, func(app core.App) error {
+		callsOrder = append(callsOrder, "down4")
+		return nil
+	}, "4_test")
+	l.Add(&core.Migration{
+		Up: func(app core.App) error {
+			callsOrder = append(callsOrder, "up5")
+			return nil
+		},
+		Down: func(app core.App) error {
+			callsOrder = append(callsOrder, "down5")
+			return nil
+		},
+		File: "5_test",
+		ReapplyCondition: func(txApp core.App, runner *core.MigrationsRunner, fileName string) (bool, error) {
+			return true, nil
+		},
+	})
+
+	runner := core.NewMigrationsRunner(app, l)
+
+	// ---------------------------------------------------------------
+	// simulate partially out-of-order applied migration
+	// ---------------------------------------------------------------
+
+	_, err := app.DB().Insert(core.DefaultMigrationsTable, dbx.Params{
+		"file":    "4_test",
+		"applied": time.Now().UnixMicro() - 2,
+	}).Execute()
+	if err != nil {
+		t.Fatalf("Failed to insert 5_test migration: %v", err)
+	}
+
+	_, err = app.DB().Insert(core.DefaultMigrationsTable, dbx.Params{
+		"file":    "5_test",
+		"applied": time.Now().UnixMicro() - 1,
+	}).Execute()
+	if err != nil {
+		t.Fatalf("Failed to insert 5_test migration: %v", err)
+	}
+
+	_, err = app.DB().Insert(core.DefaultMigrationsTable, dbx.Params{
+		"file":    "2_test",
+		"applied": time.Now().UnixMicro(),
+	}).Execute()
+	if err != nil {
+		t.Fatalf("Failed to insert 2_test migration: %v", err)
+	}
+
+	// ---------------------------------------------------------------
+	// Up()
+	// ---------------------------------------------------------------
+
+	if _, err := runner.Up(); err != nil {
+		t.Fatal(err)
+	}
+
+	expectedUpCallsOrder := `["up1","up3","up5"]` // skip up2 and up4 since they were applied already (up5 has extra reapply condition)
+
+	upCallsOrder, err := json.Marshal(callsOrder)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if v := string(upCallsOrder); v != expectedUpCallsOrder {
+		t.Fatalf("Expected Up() calls order %s, got %s", expectedUpCallsOrder, upCallsOrder)
+	}
+
+	// ---------------------------------------------------------------
+
+	// reset callsOrder
+	callsOrder = []string{}
+
+	// simulate unrun migration
+	l.Register(nil, func(app core.App) error {
+		callsOrder = append(callsOrder, "down6")
+		return nil
+	}, "6_test")
+
+	// simulate applied migrations from different migrations list
+	_, err = app.DB().Insert(core.DefaultMigrationsTable, dbx.Params{
+		"file":    "from_different_list",
+		"applied": time.Now().UnixMicro(),
+	}).Execute()
+	if err != nil {
+		t.Fatalf("Failed to insert from_different_list migration: %v", err)
+	}
+
+	// ---------------------------------------------------------------
+
+	// ---------------------------------------------------------------
+	// Down()
+	// ---------------------------------------------------------------
+
+	if _, err := runner.Down(2); err != nil {
+		t.Fatal(err)
+	}
+
+	expectedDownCallsOrder := `["down5","down3"]` // revert in the applied order
+
+	downCallsOrder, err := json.Marshal(callsOrder)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if v := string(downCallsOrder); v != expectedDownCallsOrder {
+		t.Fatalf("Expected Down() calls order %s, got %s", expectedDownCallsOrder, downCallsOrder)
+	}
+}
+
+func TestMigrationsRunnerRemoveMissingAppliedMigrations(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// mock migrations history
+	for i := 1; i <= 3; i++ {
+		_, err := app.DB().Insert(core.DefaultMigrationsTable, dbx.Params{
+			"file":    fmt.Sprintf("%d_test", i),
+			"applied": time.Now().UnixMicro(),
+		}).Execute()
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	if !isMigrationApplied(app, "2_test") {
+		t.Fatalf("Expected 2_test migration to be applied")
+	}
+
+	// create a runner without 2_test to mock deleted migration
+	l := core.MigrationsList{}
+	l.Register(func(app core.App) error {
+		return nil
+	}, func(app core.App) error {
+		return nil
+	}, "1_test")
+	l.Register(func(app core.App) error {
+		return nil
+	}, func(app core.App) error {
+		return nil
+	}, "3_test")
+
+	r := core.NewMigrationsRunner(app, l)
+
+	if err := r.RemoveMissingAppliedMigrations(); err != nil {
+		t.Fatalf("Failed to remove missing applied migrations: %v", err)
+	}
+
+	if isMigrationApplied(app, "2_test") {
+		t.Fatalf("Expected 2_test migration to NOT be applied")
+	}
+}
+
+func isMigrationApplied(app core.App, file string) bool {
+	var exists int
+
+	err := app.DB().Select("(1)").
+		From(core.DefaultMigrationsTable).
+		Where(dbx.HashExp{"file": file}).
+		Limit(1).
+		Row(&exists)
+
+	return err == nil && exists > 0
+}
diff --git a/server/core_backend-server/core/otp_model.go b/server/core_backend-server/core/otp_model.go
new file mode 100644
index 0000000..589ce4a
--- /dev/null
+++ b/server/core_backend-server/core/otp_model.go
@@ -0,0 +1,127 @@
+package core
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+const CollectionNameOTPs = "_otps"
+
+var (
+	_ Model        = (*OTP)(nil)
+	_ PreValidator = (*OTP)(nil)
+	_ RecordProxy  = (*OTP)(nil)
+)
+
+// OTP defines a Record proxy for working with the otps collection.
+type OTP struct {
+	*Record
+}
+
+// NewOTP instantiates and returns a new blank *OTP model.
+//
+// Example usage:
+//
+//	otp := core.NewOTP(app)
+//	otp.SetRecordRef(user.Id)
+//	otp.SetCollectionRef(user.Collection().Id)
+//	otp.SetPassword(security.RandomStringWithAlphabet(6, "1234567890"))
+//	app.Save(otp)
+func NewOTP(app App) *OTP {
+	m := &OTP{}
+
+	c, err := app.FindCachedCollectionByNameOrId(CollectionNameOTPs)
+	if err != nil {
+		// this is just to make tests easier since otp is a system collection and it is expected to be always accessible
+		// (note: the loaded record is further checked on OTP.PreValidate())
+		c = NewBaseCollection("__invalid__")
+	}
+
+	m.Record = NewRecord(c)
+
+	return m
+}
+
+// PreValidate implements the [PreValidator] interface and checks
+// whether the proxy is properly loaded.
+func (m *OTP) PreValidate(ctx context.Context, app App) error {
+	if m.Record == nil || m.Record.Collection().Name != CollectionNameOTPs {
+		return errors.New("missing or invalid otp ProxyRecord")
+	}
+
+	return nil
+}
+
+// ProxyRecord returns the proxied Record model.
+func (m *OTP) ProxyRecord() *Record {
+	return m.Record
+}
+
+// SetProxyRecord loads the specified record model into the current proxy.
+func (m *OTP) SetProxyRecord(record *Record) {
+	m.Record = record
+}
+
+// CollectionRef returns the "collectionRef" field value.
+func (m *OTP) CollectionRef() string {
+	return m.GetString("collectionRef")
+}
+
+// SetCollectionRef updates the "collectionRef" record field value.
+func (m *OTP) SetCollectionRef(collectionId string) {
+	m.Set("collectionRef", collectionId)
+}
+
+// RecordRef returns the "recordRef" record field value.
+func (m *OTP) RecordRef() string {
+	return m.GetString("recordRef")
+}
+
+// SetRecordRef updates the "recordRef" record field value.
+func (m *OTP) SetRecordRef(recordId string) {
+	m.Set("recordRef", recordId)
+}
+
+// SentTo returns the "sentTo" record field value.
+//
+// It could be any string value (email, phone, message app id, etc.)
+// and usually is used as part of the auth flow to update the verified
+// user state in case for example the sentTo value matches with the user record email.
+func (m *OTP) SentTo() string {
+	return m.GetString("sentTo")
+}
+
+// SetSentTo updates the "sentTo" record field value.
+func (m *OTP) SetSentTo(val string) {
+	m.Set("sentTo", val)
+}
+
+// Created returns the "created" record field value.
+func (m *OTP) Created() types.DateTime {
+	return m.GetDateTime("created")
+}
+
+// Updated returns the "updated" record field value.
+func (m *OTP) Updated() types.DateTime {
+	return m.GetDateTime("updated")
+}
+
+// HasExpired checks if the otp is expired, aka. whether it has been
+// more than maxElapsed time since its creation.
+func (m *OTP) HasExpired(maxElapsed time.Duration) bool {
+	return time.Since(m.Created().Time()) > maxElapsed
+}
+
+func (app *BaseApp) registerOTPHooks() {
+	recordRefHooks[*OTP](app, CollectionNameOTPs, CollectionTypeAuth)
+
+	// run on every hour to cleanup expired otp sessions
+	app.Cron().Add("__pbOTPCleanup__", "0 * * * *", func() {
+		if err := app.DeleteExpiredOTPs(); err != nil {
+			app.Logger().Warn("Failed to delete expired OTP sessions", "error", err)
+		}
+	})
+}
diff --git a/server/core_backend-server/core/otp_model_test.go b/server/core_backend-server/core/otp_model_test.go
new file mode 100644
index 0000000..f0d5155
--- /dev/null
+++ b/server/core_backend-server/core/otp_model_test.go
@@ -0,0 +1,302 @@
+package core_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestNewOTP(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	otp := core.NewOTP(app)
+
+	if otp.Collection().Name != core.CollectionNameOTPs {
+		t.Fatalf("Expected record with %q collection, got %q", core.CollectionNameOTPs, otp.Collection().Name)
+	}
+}
+
+func TestOTPProxyRecord(t *testing.T) {
+	t.Parallel()
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+	record.Id = "test_id"
+
+	otp := core.OTP{}
+	otp.SetProxyRecord(record)
+
+	if otp.ProxyRecord() == nil || otp.ProxyRecord().Id != record.Id {
+		t.Fatalf("Expected proxy record with id %q, got %v", record.Id, otp.ProxyRecord())
+	}
+}
+
+func TestOTPRecordRef(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	otp := core.NewOTP(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			otp.SetRecordRef(testValue)
+
+			if v := otp.RecordRef(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := otp.GetString("recordRef"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestOTPCollectionRef(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	otp := core.NewOTP(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			otp.SetCollectionRef(testValue)
+
+			if v := otp.CollectionRef(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := otp.GetString("collectionRef"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestOTPSentTo(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	otp := core.NewOTP(app)
+
+	testValues := []string{"test_1", "test2", ""}
+	for i, testValue := range testValues {
+		t.Run(fmt.Sprintf("%d_%q", i, testValue), func(t *testing.T) {
+			otp.SetSentTo(testValue)
+
+			if v := otp.SentTo(); v != testValue {
+				t.Fatalf("Expected getter %q, got %q", testValue, v)
+			}
+
+			if v := otp.GetString("sentTo"); v != testValue {
+				t.Fatalf("Expected field value %q, got %q", testValue, v)
+			}
+		})
+	}
+}
+
+func TestOTPCreated(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	otp := core.NewOTP(app)
+
+	if v := otp.Created().String(); v != "" {
+		t.Fatalf("Expected empty created, got %q", v)
+	}
+
+	now := types.NowDateTime()
+	otp.SetRaw("created", now)
+
+	if v := otp.Created().String(); v != now.String() {
+		t.Fatalf("Expected %q created, got %q", now.String(), v)
+	}
+}
+
+func TestOTPUpdated(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	otp := core.NewOTP(app)
+
+	if v := otp.Updated().String(); v != "" {
+		t.Fatalf("Expected empty updated, got %q", v)
+	}
+
+	now := types.NowDateTime()
+	otp.SetRaw("updated", now)
+
+	if v := otp.Updated().String(); v != now.String() {
+		t.Fatalf("Expected %q updated, got %q", now.String(), v)
+	}
+}
+
+func TestOTPHasExpired(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	now := types.NowDateTime()
+
+	otp := core.NewOTP(app)
+	otp.SetRaw("created", now.Add(-5*time.Minute))
+
+	scenarios := []struct {
+		maxElapsed time.Duration
+		expected   bool
+	}{
+		{0 * time.Minute, true},
+		{3 * time.Minute, true},
+		{5 * time.Minute, true},
+		{6 * time.Minute, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.maxElapsed.String()), func(t *testing.T) {
+			result := otp.HasExpired(s.maxElapsed)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestOTPPreValidate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	otpsCol, err := app.FindCollectionByNameOrId(core.CollectionNameOTPs)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("no proxy record", func(t *testing.T) {
+		otp := &core.OTP{}
+
+		if err := app.Validate(otp); err == nil {
+			t.Fatal("Expected collection validation error")
+		}
+	})
+
+	t.Run("non-OTP collection", func(t *testing.T) {
+		otp := &core.OTP{}
+		otp.SetProxyRecord(core.NewRecord(core.NewBaseCollection("invalid")))
+		otp.SetRecordRef(user.Id)
+		otp.SetCollectionRef(user.Collection().Id)
+		otp.SetPassword("test123")
+
+		if err := app.Validate(otp); err == nil {
+			t.Fatal("Expected collection validation error")
+		}
+	})
+
+	t.Run("OTP collection", func(t *testing.T) {
+		otp := &core.OTP{}
+		otp.SetProxyRecord(core.NewRecord(otpsCol))
+		otp.SetRecordRef(user.Id)
+		otp.SetCollectionRef(user.Collection().Id)
+		otp.SetPassword("test123")
+
+		if err := app.Validate(otp); err != nil {
+			t.Fatalf("Expected nil validation error, got %v", err)
+		}
+	})
+}
+
+func TestOTPValidateHook(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name         string
+		otp          func() *core.OTP
+		expectErrors []string
+	}{
+		{
+			"empty",
+			func() *core.OTP {
+				return core.NewOTP(app)
+			},
+			[]string{"collectionRef", "recordRef", "password"},
+		},
+		{
+			"non-auth collection",
+			func() *core.OTP {
+				otp := core.NewOTP(app)
+				otp.SetCollectionRef(demo1.Collection().Id)
+				otp.SetRecordRef(demo1.Id)
+				otp.SetPassword("test123")
+				return otp
+			},
+			[]string{"collectionRef"},
+		},
+		{
+			"missing record id",
+			func() *core.OTP {
+				otp := core.NewOTP(app)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef("missing")
+				otp.SetPassword("test123")
+				return otp
+			},
+			[]string{"recordRef"},
+		},
+		{
+			"valid ref",
+			func() *core.OTP {
+				otp := core.NewOTP(app)
+				otp.SetCollectionRef(user.Collection().Id)
+				otp.SetRecordRef(user.Id)
+				otp.SetPassword("test123")
+				return otp
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			errs := app.Validate(s.otp())
+			tests.TestValidationErrors(t, errs, s.expectErrors)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/otp_query.go b/server/core_backend-server/core/otp_query.go
new file mode 100644
index 0000000..8b2b4a9
--- /dev/null
+++ b/server/core_backend-server/core/otp_query.go
@@ -0,0 +1,117 @@
+package core
+
+import (
+	"errors"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// FindAllOTPsByRecord returns all OTP models linked to the provided auth record.
+func (app *BaseApp) FindAllOTPsByRecord(authRecord *Record) ([]*OTP, error) {
+	result := []*OTP{}
+
+	err := app.RecordQuery(CollectionNameOTPs).
+		AndWhere(dbx.HashExp{
+			"collectionRef": authRecord.Collection().Id,
+			"recordRef":     authRecord.Id,
+		}).
+		OrderBy("created DESC").
+		All(&result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// FindAllOTPsByCollection returns all OTP models linked to the provided collection.
+func (app *BaseApp) FindAllOTPsByCollection(collection *Collection) ([]*OTP, error) {
+	result := []*OTP{}
+
+	err := app.RecordQuery(CollectionNameOTPs).
+		AndWhere(dbx.HashExp{"collectionRef": collection.Id}).
+		OrderBy("created DESC").
+		All(&result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// FindOTPById returns a single OTP model by its id.
+func (app *BaseApp) FindOTPById(id string) (*OTP, error) {
+	result := &OTP{}
+
+	err := app.RecordQuery(CollectionNameOTPs).
+		AndWhere(dbx.HashExp{"id": id}).
+		Limit(1).
+		One(result)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// DeleteAllOTPsByRecord deletes all OTP models associated with the provided record.
+//
+// Returns a combined error with the failed deletes.
+func (app *BaseApp) DeleteAllOTPsByRecord(authRecord *Record) error {
+	models, err := app.FindAllOTPsByRecord(authRecord)
+	if err != nil {
+		return err
+	}
+
+	var errs []error
+	for _, m := range models {
+		if err := app.Delete(m); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	if len(errs) > 0 {
+		return errors.Join(errs...)
+	}
+
+	return nil
+}
+
+// DeleteExpiredOTPs deletes the expired OTPs for all auth collections.
+func (app *BaseApp) DeleteExpiredOTPs() error {
+	authCollections, err := app.FindAllCollections(CollectionTypeAuth)
+	if err != nil {
+		return err
+	}
+
+	// note: perform even if OTP is disabled to ensure that there are no dangling old records
+	for _, collection := range authCollections {
+		minValidDate, err := types.ParseDateTime(time.Now().Add(-1 * collection.OTP.DurationTime()))
+		if err != nil {
+			return err
+		}
+
+		items := []*Record{}
+
+		err = app.RecordQuery(CollectionNameOTPs).
+			AndWhere(dbx.HashExp{"collectionRef": collection.Id}).
+			AndWhere(dbx.NewExp("[[created]] < {:date}", dbx.Params{"date": minValidDate})).
+			All(&items)
+		if err != nil {
+			return err
+		}
+
+		for _, item := range items {
+			err = app.Delete(item)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/core/otp_query_test.go b/server/core_backend-server/core/otp_query_test.go
new file mode 100644
index 0000000..440ffb9
--- /dev/null
+++ b/server/core_backend-server/core/otp_query_test.go
@@ -0,0 +1,310 @@
+package core_test
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestFindAllOTPsByRecord(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	if err := tests.StubOTPRecords(app); err != nil {
+		t.Fatal(err)
+	}
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser2, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser4, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test4@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user1, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record   *core.Record
+		expected []string
+	}{
+		{demo1, nil},
+		{superuser2, []string{"superuser2_0", "superuser2_1", "superuser2_3", "superuser2_2", "superuser2_4"}},
+		{superuser4, nil},
+		{user1, []string{"user1_0"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.record.Collection().Name+"_"+s.record.Id, func(t *testing.T) {
+			result, err := app.FindAllOTPsByRecord(s.record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected total otps %d, got %d", len(s.expected), len(result))
+			}
+
+			for i, id := range s.expected {
+				if result[i].Id != id {
+					t.Errorf("[%d] Expected id %q, got %q", i, id, result[i].Id)
+				}
+			}
+		})
+	}
+}
+
+func TestFindAllOTPsByCollection(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	if err := tests.StubOTPRecords(app); err != nil {
+		t.Fatal(err)
+	}
+
+	demo1, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superusers, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	clients, err := app.FindCollectionByNameOrId("clients")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	users, err := app.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		collection *core.Collection
+		expected   []string
+	}{
+		{demo1, nil},
+		{superusers, []string{
+			"superuser2_0",
+			"superuser2_1",
+			"superuser2_3",
+			"superuser3_0",
+			"superuser3_1",
+			"superuser2_2",
+			"superuser2_4",
+		}},
+		{clients, nil},
+		{users, []string{"user1_0"}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.collection.Name, func(t *testing.T) {
+			result, err := app.FindAllOTPsByCollection(s.collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected total otps %d, got %d", len(s.expected), len(result))
+			}
+
+			for i, id := range s.expected {
+				if result[i].Id != id {
+					t.Errorf("[%d] Expected id %q, got %q", i, id, result[i].Id)
+				}
+			}
+		})
+	}
+}
+
+func TestFindOTPById(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	if err := tests.StubOTPRecords(app); err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		id          string
+		expectError bool
+	}{
+		{"", true},
+		{"84nmscqy84lsi1t", true}, // non-otp id
+		{"superuser2_0", false},
+		{"superuser2_4", false}, // expired
+		{"user1_0", false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.id, func(t *testing.T) {
+			result, err := app.FindOTPById(s.id)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if result.Id != s.id {
+				t.Fatalf("Expected record with id %q, got %q", s.id, result.Id)
+			}
+		})
+	}
+}
+
+func TestDeleteAllOTPsByRecord(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	demo1, err := testApp.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser2, err := testApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser4, err := testApp.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test4@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user1, err := testApp.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record     *core.Record
+		deletedIds []string
+	}{
+		{demo1, nil}, // non-auth record
+		{superuser2, []string{"superuser2_0", "superuser2_1", "superuser2_3", "superuser2_2", "superuser2_4"}},
+		{superuser4, nil},
+		{user1, []string{"user1_0"}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.record.Collection().Name, s.record.Id), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			if err := tests.StubOTPRecords(app); err != nil {
+				t.Fatal(err)
+			}
+
+			deletedIds := []string{}
+			app.OnRecordAfterDeleteSuccess().BindFunc(func(e *core.RecordEvent) error {
+				deletedIds = append(deletedIds, e.Record.Id)
+				return e.Next()
+			})
+
+			err := app.DeleteAllOTPsByRecord(s.record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(deletedIds) != len(s.deletedIds) {
+				t.Fatalf("Expected deleted ids\n%v\ngot\n%v", s.deletedIds, deletedIds)
+			}
+
+			for _, id := range s.deletedIds {
+				if !slices.Contains(deletedIds, id) {
+					t.Errorf("Expected to find deleted id %q in %v", id, deletedIds)
+				}
+			}
+		})
+	}
+}
+
+func TestDeleteExpiredOTPs(t *testing.T) {
+	t.Parallel()
+
+	checkDeletedIds := func(app core.App, t *testing.T, expectedDeletedIds []string) {
+		if err := tests.StubOTPRecords(app); err != nil {
+			t.Fatal(err)
+		}
+
+		deletedIds := []string{}
+		app.OnRecordAfterDeleteSuccess().BindFunc(func(e *core.RecordEvent) error {
+			deletedIds = append(deletedIds, e.Record.Id)
+			return e.Next()
+		})
+
+		if err := app.DeleteExpiredOTPs(); err != nil {
+			t.Fatal(err)
+		}
+
+		if len(deletedIds) != len(expectedDeletedIds) {
+			t.Fatalf("Expected deleted ids\n%v\ngot\n%v", expectedDeletedIds, deletedIds)
+		}
+
+		for _, id := range expectedDeletedIds {
+			if !slices.Contains(deletedIds, id) {
+				t.Errorf("Expected to find deleted id %q in %v", id, deletedIds)
+			}
+		}
+	}
+
+	t.Run("default test collections", func(t *testing.T) {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		checkDeletedIds(app, t, []string{
+			"user1_0",
+			"superuser2_2",
+			"superuser2_4",
+		})
+	})
+
+	t.Run("otp collection duration mock", func(t *testing.T) {
+		app, _ := tests.NewTestApp()
+		defer app.Cleanup()
+
+		superusers, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+		if err != nil {
+			t.Fatal(err)
+		}
+		superusers.OTP.Duration = 60
+		if err := app.Save(superusers); err != nil {
+			t.Fatalf("Failed to mock superusers otp duration: %v", err)
+		}
+
+		checkDeletedIds(app, t, []string{
+			"user1_0",
+			"superuser2_2",
+			"superuser2_4",
+			"superuser3_1",
+		})
+	})
+}
diff --git a/server/core_backend-server/core/record_field_resolver.go b/server/core_backend-server/core/record_field_resolver.go
new file mode 100644
index 0000000..cd22c90
--- /dev/null
+++ b/server/core_backend-server/core/record_field_resolver.go
@@ -0,0 +1,508 @@
+package core
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+// filter modifiers
+const (
+	eachModifier    string = "each"
+	issetModifier   string = "isset"
+	lengthModifier  string = "length"
+	lowerModifier   string = "lower"
+	changedModifier string = "changed"
+)
+
+// ensure that `search.FieldResolver` interface is implemented
+var _ search.FieldResolver = (*RecordFieldResolver)(nil)
+
+// RecordFieldResolver defines a custom search resolver struct for
+// managing Record model search fields.
+//
+// Usually used together with `search.Provider`.
+// Example:
+//
+//	resolver := resolvers.NewRecordFieldResolver(
+//	    app,
+//	    myCollection,
+//	    &models.RequestInfo{...},
+//	    true,
+//	)
+//	provider := search.NewProvider(resolver)
+//	...
+type RecordFieldResolver struct {
+	app               App
+	baseCollection    *Collection
+	requestInfo       *RequestInfo
+	staticRequestInfo map[string]any
+	allowedFields     []string
+	joins             []*join
+	allowHiddenFields bool
+	// ---
+	listRuleJoins       map[string]*Collection // tableAlias->collection
+	joinAliasSuffix     string                 // used for uniqueness in the flatten collection list rule join
+	baseCollectionAlias string
+}
+
+// AllowedFields returns a copy of the resolver's allowed fields.
+func (r *RecordFieldResolver) AllowedFields() []string {
+	return slices.Clone(r.allowedFields)
+}
+
+// SetAllowedFields replaces the resolver's allowed fields with the new ones.
+func (r *RecordFieldResolver) SetAllowedFields(newAllowedFields []string) {
+	r.allowedFields = slices.Clone(newAllowedFields)
+}
+
+// AllowHiddenFields returns whether the current resolver allows filtering hidden fields.
+func (r *RecordFieldResolver) AllowHiddenFields() bool {
+	return r.allowHiddenFields
+}
+
+// SetAllowHiddenFields enables or disables hidden fields filtering.
+func (r *RecordFieldResolver) SetAllowHiddenFields(allowHiddenFields bool) {
+	r.allowHiddenFields = allowHiddenFields
+}
+
+// NewRecordFieldResolver creates and initializes a new `RecordFieldResolver`.
+func NewRecordFieldResolver(
+	app App,
+	baseCollection *Collection,
+	requestInfo *RequestInfo,
+	allowHiddenFields bool,
+) *RecordFieldResolver {
+	r := &RecordFieldResolver{
+		app:               app,
+		baseCollection:    baseCollection,
+		requestInfo:       requestInfo,
+		allowHiddenFields: allowHiddenFields, // note: it is not based only on the requestInfo.auth since it could be used by a non-request internal method
+		joins:             []*join{},
+		allowedFields: []string{
+			`^\w+[\w\.\:]*$`,
+			`^\@request\.context$`,
+			`^\@request\.method$`,
+			`^\@request\.auth\.[\w\.\:]*\w+$`,
+			`^\@request\.body\.[\w\.\:]*\w+$`,
+			`^\@request\.query\.[\w\.\:]*\w+$`,
+			`^\@request\.headers\.[\w\.\:]*\w+$`,
+			`^\@collection\.\w+(\:\w+)?\.[\w\.\:]*\w+$`,
+		},
+	}
+
+	r.staticRequestInfo = map[string]any{}
+	if r.requestInfo != nil {
+		r.staticRequestInfo["context"] = r.requestInfo.Context
+		r.staticRequestInfo["method"] = r.requestInfo.Method
+		r.staticRequestInfo["query"] = r.requestInfo.Query
+		r.staticRequestInfo["headers"] = r.requestInfo.Headers
+		r.staticRequestInfo["body"] = r.requestInfo.Body
+		r.staticRequestInfo["auth"] = nil
+		if r.requestInfo.Auth != nil {
+			authClone := r.requestInfo.Auth.Clone()
+			r.staticRequestInfo["auth"] = authClone.
+				Unhide(authClone.Collection().Fields.FieldNames()...).
+				IgnoreEmailVisibility(true).
+				PublicExport()
+		}
+	}
+
+	return r
+}
+
+// @todo think of a better a way how to call it automatically after BuildExpr
+//
+// UpdateQuery implements `search.FieldResolver` interface.
+//
+// Conditionally updates the provided search query based on the
+// resolved fields (eg. dynamically joining relations).
+func (r *RecordFieldResolver) UpdateQuery(query *dbx.SelectQuery) error {
+	if len(r.joins) > 0 {
+		query.Distinct(true)
+
+		for _, join := range r.joins {
+			query.LeftJoin(
+				(join.tableName + " " + join.tableAlias),
+				join.on,
+			)
+		}
+	}
+
+	// note: for now the joins are not applied for multi-match conditions to avoid excessive checks
+	if len(r.listRuleJoins) > 0 {
+		for alias, c := range r.listRuleJoins {
+			err := r.updateQueryWithCollectionListRule(c, alias, query)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (r *RecordFieldResolver) updateQueryWithCollectionListRule(c *Collection, tableAlias string, query *dbx.SelectQuery) error {
+	if r.allowHiddenFields || c == nil || c.ListRule == nil || *c.ListRule == "" {
+		return nil
+	}
+
+	cloneR := *r
+	cloneR.joins = []*join{}
+	cloneR.baseCollection = c
+	cloneR.baseCollectionAlias = tableAlias
+	cloneR.allowHiddenFields = true
+	cloneR.joinAliasSuffix = security.PseudorandomString(6)
+
+	expr, err := search.FilterData(*c.ListRule).BuildExpr(&cloneR)
+	if err != nil {
+		return fmt.Errorf("to buld %q list rule join subquery filter expression: %w", c.Name, err)
+	}
+
+	query.AndWhere(expr)
+
+	if len(cloneR.joins) > 0 {
+		query.Distinct(true)
+
+		for _, j := range cloneR.joins {
+			query.LeftJoin(
+				(j.tableName + " " + j.tableAlias),
+				j.on,
+			)
+		}
+	}
+
+	return nil
+}
+
+// Resolve implements `search.FieldResolver` interface.
+//
+// Example of some resolvable fieldName formats:
+//
+//	id
+//	someSelect.each
+//	project.screen.status
+//	screen.project_via_prototype.name
+//	@request.context
+//	@request.method
+//	@request.query.filter
+//	@request.headers.x_token
+//	@request.auth.someRelation.name
+//	@request.body.someRelation.name
+//	@request.body.someField
+//	@request.body.someSelect:each
+//	@request.body.someField:isset
+//	@collection.product.name
+func (r *RecordFieldResolver) Resolve(fieldName string) (*search.ResolverResult, error) {
+	return parseAndRun(fieldName, r)
+}
+
+func (r *RecordFieldResolver) resolveStaticRequestField(path ...string) (*search.ResolverResult, error) {
+	if len(path) == 0 {
+		return nil, errors.New("at least one path key should be provided")
+	}
+
+	lastProp, modifier, err := splitModifier(path[len(path)-1])
+	if err != nil {
+		return nil, err
+	}
+
+	path[len(path)-1] = lastProp
+
+	// extract value
+	resultVal, err := extractNestedVal(r.staticRequestInfo, path...)
+	if err != nil {
+		r.app.Logger().Debug("resolveStaticRequestField graceful fallback", "error", err.Error())
+	}
+
+	if modifier == issetModifier {
+		if err != nil {
+			return &search.ResolverResult{Identifier: "FALSE"}, nil
+		}
+		return &search.ResolverResult{Identifier: "TRUE"}, nil
+	}
+
+	// note: we are ignoring the error because requestInfo is dynamic
+	// and some of the lookup keys may not be defined for the request
+
+	switch v := resultVal.(type) {
+	case nil:
+		// no further processing is needed...
+	case string:
+		// check if it is a number field and explicitly try to cast to
+		// float in case of a numeric string value was used
+		// (this usually the case when the data is from a multipart/form-data request)
+		field := r.baseCollection.Fields.GetByName(path[len(path)-1])
+		if field != nil && field.Type() == FieldTypeNumber {
+			if nv, err := strconv.ParseFloat(v, 64); err == nil {
+				resultVal = nv
+			}
+		}
+		// otherwise - no further processing is needed...
+	case bool, int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64, float32, float64:
+		// no further processing is needed...
+	default:
+		// non-plain value
+		// try casting to string (in case for exampe fmt.Stringer is implemented)
+		val, castErr := cast.ToStringE(v)
+
+		// if that doesn't work, try encoding it
+		if castErr != nil {
+			encoded, jsonErr := json.Marshal(v)
+			if jsonErr == nil {
+				val = string(encoded)
+			}
+		}
+
+		resultVal = val
+	}
+
+	// unsupported modifier
+	// @todo consider deprecating with the introduction of filter functions
+	if modifier != "" && modifier != lowerModifier {
+		return nil, fmt.Errorf("invalid modifier sequence %s:%s", lastProp, modifier)
+	}
+
+	// no need to wrap as placeholder if we already know that it is null
+	if resultVal == nil {
+		return &search.ResolverResult{Identifier: "NULL"}, nil
+	}
+
+	// PostgreSQL Only:
+	// Expanded special empty string filter in advance
+	if resultVal == "" && (modifier == "" || modifier == lowerModifier) {
+		// note: LOWER('') is still ''
+		return &search.ResolverResult{Identifier: `''`}, nil
+	}
+
+	placeholder := "f" + security.PseudorandomString(8)
+
+	// @todo consider deprecating with the introduction of filter functions
+	if modifier == lowerModifier {
+		params := dbx.Params{placeholder: resultVal}
+
+		if IsPostgres(r.app) {
+			// PostgreSQL:
+			// `SELECT LOWER(1)` is valid in SQLite, but not in PostgreSQL
+			// so we need to explicitly cast the value to text
+			params[placeholder] = cast.ToString(resultVal)
+		}
+
+		return &search.ResolverResult{
+			Identifier: "LOWER({:" + placeholder + "})",
+			Params:     params,
+		}, nil
+	}
+
+	return &search.ResolverResult{
+		Identifier: "{:" + placeholder + "}",
+		Params:     dbx.Params{placeholder: resultVal},
+	}, nil
+}
+
+func (r *RecordFieldResolver) loadCollection(collectionNameOrId string) (*Collection, error) {
+	if collectionNameOrId == r.baseCollection.Name || collectionNameOrId == r.baseCollection.Id {
+		return r.baseCollection, nil
+	}
+
+	return getCollectionByModelOrIdentifier(r.app, collectionNameOrId)
+}
+
+func (r *RecordFieldResolver) registerJoin(tableName string, tableAlias string, on dbx.Expression) error {
+	// PostgreSQL only:
+	if on == nil {
+		// Note: SQLite allows join without `on` clause but PostgreSQL does not.
+		// Join without `on` clause is equivalent to `ON 1=1` clause.
+		on = dbx.NewExp("1=1")
+	}
+
+	newJoin := &join{
+		tableName:  tableName,
+		tableAlias: tableAlias,
+		on:         on,
+	}
+
+	// (see updateQueryWithCollectionListRule)
+	if !r.allowHiddenFields {
+		c, _ := r.loadCollection(tableName)
+
+		// ignore non-collections since the table name could be an expression (e.g. json) or some other subquery
+		if c != nil {
+			// treat all fields as if they are hidden
+			if c.ListRule == nil {
+				return fmt.Errorf("%q fields can be accessed only when allowHiddenFields is enabled or by superusers", c.Name)
+			}
+
+			if r.listRuleJoins == nil {
+				r.listRuleJoins = map[string]*Collection{}
+			}
+			r.listRuleJoins[newJoin.tableAlias] = c
+		}
+	}
+
+	// replace existing join
+	for i, j := range r.joins {
+		if j.tableAlias == newJoin.tableAlias {
+			r.joins[i] = newJoin
+			return nil
+		}
+	}
+
+	// register new join
+	r.joins = append(r.joins, newJoin)
+	return nil
+}
+
+type mapExtractor interface {
+	AsMap() map[string]any
+}
+
+func extractNestedVal(rawData any, keys ...string) (any, error) {
+	if len(keys) == 0 {
+		return nil, errors.New("at least one key should be provided")
+	}
+
+	switch m := rawData.(type) {
+	// maps
+	case map[string]any:
+		return mapVal(m, keys...)
+	case map[string]string:
+		return mapVal(m, keys...)
+	case map[string]bool:
+		return mapVal(m, keys...)
+	case map[string]float32:
+		return mapVal(m, keys...)
+	case map[string]float64:
+		return mapVal(m, keys...)
+	case map[string]int:
+		return mapVal(m, keys...)
+	case map[string]int8:
+		return mapVal(m, keys...)
+	case map[string]int16:
+		return mapVal(m, keys...)
+	case map[string]int32:
+		return mapVal(m, keys...)
+	case map[string]int64:
+		return mapVal(m, keys...)
+	case map[string]uint:
+		return mapVal(m, keys...)
+	case map[string]uint8:
+		return mapVal(m, keys...)
+	case map[string]uint16:
+		return mapVal(m, keys...)
+	case map[string]uint32:
+		return mapVal(m, keys...)
+	case map[string]uint64:
+		return mapVal(m, keys...)
+	case mapExtractor:
+		return mapVal(m.AsMap(), keys...)
+	case types.JSONRaw:
+		var raw any
+		err := json.Unmarshal(m, &raw)
+		if err != nil {
+			return nil, fmt.Errorf("failed to unmarshal raw JSON in order extract nested value from: %w", err)
+		}
+		return extractNestedVal(raw, keys...)
+
+	// slices
+	case []string:
+		return arrVal(m, keys...)
+	case []bool:
+		return arrVal(m, keys...)
+	case []float32:
+		return arrVal(m, keys...)
+	case []float64:
+		return arrVal(m, keys...)
+	case []int:
+		return arrVal(m, keys...)
+	case []int8:
+		return arrVal(m, keys...)
+	case []int16:
+		return arrVal(m, keys...)
+	case []int32:
+		return arrVal(m, keys...)
+	case []int64:
+		return arrVal(m, keys...)
+	case []uint:
+		return arrVal(m, keys...)
+	case []uint8:
+		return arrVal(m, keys...)
+	case []uint16:
+		return arrVal(m, keys...)
+	case []uint32:
+		return arrVal(m, keys...)
+	case []uint64:
+		return arrVal(m, keys...)
+	case []mapExtractor:
+		extracted := make([]any, len(m))
+		for i, v := range m {
+			extracted[i] = v.AsMap()
+		}
+		return arrVal(extracted, keys...)
+	case []any:
+		return arrVal(m, keys...)
+	case []types.JSONRaw:
+		return arrVal(m, keys...)
+	default:
+		return nil, fmt.Errorf("expected map or array, got %#v", rawData)
+	}
+}
+
+func mapVal[T any](m map[string]T, keys ...string) (any, error) {
+	result, ok := m[keys[0]]
+	if !ok {
+		return nil, fmt.Errorf("invalid key path - missing key %q", keys[0])
+	}
+
+	// end key reached
+	if len(keys) == 1 {
+		return result, nil
+	}
+
+	return extractNestedVal(result, keys[1:]...)
+}
+
+func arrVal[T any](m []T, keys ...string) (any, error) {
+	idx, err := strconv.Atoi(keys[0])
+	if err != nil || idx < 0 || idx >= len(m) {
+		return nil, fmt.Errorf("invalid key path - invalid or missing array index %q", keys[0])
+	}
+
+	result := m[idx]
+
+	// end key reached
+	if len(keys) == 1 {
+		return result, nil
+	}
+
+	return extractNestedVal(result, keys[1:]...)
+}
+
+func splitModifier(combined string) (string, string, error) {
+	parts := strings.Split(combined, ":")
+
+	if len(parts) != 2 {
+		return combined, "", nil
+	}
+
+	// validate modifier
+	switch parts[1] {
+	case issetModifier,
+		eachModifier,
+		lengthModifier,
+		lowerModifier,
+		changedModifier:
+		return parts[0], parts[1], nil
+	}
+
+	return "", "", fmt.Errorf("unknown modifier in %q", combined)
+}
diff --git a/server/core_backend-server/core/record_field_resolver_multi_match.go b/server/core_backend-server/core/record_field_resolver_multi_match.go
new file mode 100644
index 0000000..c2b2dcc
--- /dev/null
+++ b/server/core_backend-server/core/record_field_resolver_multi_match.go
@@ -0,0 +1,75 @@
+package core
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+)
+
+var _ dbx.Expression = (*multiMatchSubquery)(nil)
+
+// join defines the specification for a single SQL JOIN clause.
+type join struct {
+	tableName  string
+	tableAlias string
+	on         dbx.Expression
+}
+
+// multiMatchSubquery defines a record multi-match subquery expression.
+type multiMatchSubquery struct {
+	baseTableAlias  string
+	fromTableName   string
+	fromTableAlias  string
+	valueIdentifier string
+	joins           []*join
+	params          dbx.Params
+}
+
+// Build converts the expression into a SQL fragment.
+//
+// Implements [dbx.Expression] interface.
+func (m *multiMatchSubquery) Build(db *dbx.DB, params dbx.Params) string {
+	if m.baseTableAlias == "" || m.fromTableName == "" || m.fromTableAlias == "" {
+		return "0=1"
+	}
+
+	if params == nil {
+		params = m.params
+	} else {
+		// merge by updating the parent params
+		for k, v := range m.params {
+			params[k] = v
+		}
+	}
+
+	var mergedJoins strings.Builder
+	for i, j := range m.joins {
+		if i > 0 {
+			mergedJoins.WriteString(" ")
+		}
+		mergedJoins.WriteString("LEFT JOIN ")
+		mergedJoins.WriteString(db.QuoteTableName(j.tableName))
+		mergedJoins.WriteString(" ")
+		mergedJoins.WriteString(db.QuoteTableName(j.tableAlias))
+		if j.on != nil {
+			mergedJoins.WriteString(" ON ")
+			mergedJoins.WriteString(j.on.Build(db, params))
+		} else {
+			// PostgreSQL only:
+			// Note: SQLite allows join without `on` clause but PostgreSQL does not.
+			// Join without `on` is equivalent to `ON 1=1` clause.
+			mergedJoins.WriteString(" ON 1=1")
+		}
+	}
+
+	return fmt.Sprintf(
+		`SELECT %s as [[multiMatchValue]] FROM %s %s %s WHERE %s = %s`,
+		db.QuoteColumnName(m.valueIdentifier),
+		db.QuoteTableName(m.fromTableName),
+		db.QuoteTableName(m.fromTableAlias),
+		mergedJoins.String(),
+		db.QuoteColumnName(m.fromTableAlias+".id"),
+		db.QuoteColumnName(m.baseTableAlias+".id"),
+	)
+}
diff --git a/server/core_backend-server/core/record_field_resolver_replace_expr.go b/server/core_backend-server/core/record_field_resolver_replace_expr.go
new file mode 100644
index 0000000..9f4821c
--- /dev/null
+++ b/server/core_backend-server/core/record_field_resolver_replace_expr.go
@@ -0,0 +1,31 @@
+package core
+
+import (
+	"strings"
+
+	"github.com/pocketbase/dbx"
+)
+
+var _ dbx.Expression = (*replaceWithExpression)(nil)
+
+// replaceWithExpression defines a custom expression that will replace
+// a placeholder identifier found in "old" with the result of "new".
+type replaceWithExpression struct {
+	placeholder string
+	old         dbx.Expression
+	new         dbx.Expression
+}
+
+// Build converts the expression into a SQL fragment.
+//
+// Implements [dbx.Expression] interface.
+func (e *replaceWithExpression) Build(db *dbx.DB, params dbx.Params) string {
+	if e.placeholder == "" || e.old == nil || e.new == nil {
+		return "0=1"
+	}
+
+	oldResult := e.old.Build(db, params)
+	newResult := e.new.Build(db, params)
+
+	return strings.ReplaceAll(oldResult, e.placeholder, newResult)
+}
diff --git a/server/core_backend-server/core/record_field_resolver_runner.go b/server/core_backend-server/core/record_field_resolver_runner.go
new file mode 100644
index 0000000..9da2728
--- /dev/null
+++ b/server/core_backend-server/core/record_field_resolver_runner.go
@@ -0,0 +1,854 @@
+package core
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+// maxNestedRels defines the max allowed nested relations depth.
+const maxNestedRels = 6
+
+// list of auth filter fields that don't require join with the auth
+// collection or any other extra checks to be resolved.
+var plainRequestAuthFields = map[string]struct{}{
+	"@request.auth." + FieldNameId:              {},
+	"@request.auth." + FieldNameCollectionId:    {},
+	"@request.auth." + FieldNameCollectionName:  {},
+	"@request.auth." + FieldNameEmail:           {},
+	"@request.auth." + FieldNameEmailVisibility: {},
+	"@request.auth." + FieldNameVerified:        {},
+}
+
+// parseAndRun starts a new one-off RecordFieldResolver.Resolve execution.
+func parseAndRun(fieldName string, resolver *RecordFieldResolver) (*search.ResolverResult, error) {
+	r := &runner{
+		fieldName: fieldName,
+		resolver:  resolver,
+	}
+
+	return r.run()
+}
+
+type runner struct {
+	used      bool                 // indicates whether the runner was already executed
+	resolver  *RecordFieldResolver // resolver is the shared expression fields resolver
+	fieldName string               // the name of the single field expression the runner is responsible for
+
+	// shared processing state
+	// ---------------------------------------------------------------
+	activeProps                []string            // holds the active props that remains to be processed
+	activeCollectionName       string              // the last used collection name
+	activeTableAlias           string              // the last used table alias
+	nullifyMisingField         bool                // indicating whether to return null on missing field or return an error
+	withMultiMatch             bool                // indicates whether to attach a multiMatchSubquery condition to the ResolverResult
+	multiMatchActiveTableAlias string              // the last used multi-match table alias
+	multiMatch                 *multiMatchSubquery // the multi-match subquery expression generated from the fieldName
+}
+
+func (r *runner) run() (*search.ResolverResult, error) {
+	if r.used {
+		return nil, errors.New("the runner was already used")
+	}
+
+	if len(r.resolver.allowedFields) > 0 && !list.ExistInSliceWithRegex(r.fieldName, r.resolver.allowedFields) {
+		return nil, fmt.Errorf("failed to resolve field %q", r.fieldName)
+	}
+
+	defer func() {
+		r.used = true
+	}()
+
+	r.prepare()
+
+	// check for @collection field (aka. non-relational join)
+	// must be in the format "@collection.COLLECTION_NAME.FIELD[.FIELD2....]"
+	if r.activeProps[0] == "@collection" {
+		return r.processCollectionField()
+	}
+
+	if r.activeProps[0] == "@request" {
+		// @todo consider returning an error instead?
+		if r.resolver.requestInfo == nil {
+			return &search.ResolverResult{Identifier: "NULL"}, nil
+		}
+
+		if strings.HasPrefix(r.fieldName, "@request.auth.") {
+			return r.processRequestAuthField()
+		}
+
+		totalProps := len(r.activeProps)
+
+		if strings.HasPrefix(r.fieldName, "@request.body.") && totalProps > 2 {
+			name, modifier, err := splitModifier(r.activeProps[2])
+			if err != nil {
+				return nil, err
+			}
+
+			bodyField := r.resolver.baseCollection.Fields.GetByName(name)
+			if bodyField == nil {
+				return r.resolver.resolveStaticRequestField(r.activeProps[1:]...)
+			}
+
+			// check for body relation field
+			if bodyField.Type() == FieldTypeRelation && totalProps > 3 {
+				return r.processRequestBodyRelationField(bodyField)
+			}
+
+			if totalProps == 3 { // aka. last prop
+				switch modifier {
+				case eachModifier:
+					return r.processRequestBodyEachModifier(bodyField)
+				case lengthModifier:
+					return r.processRequestBodyLengthModifier(bodyField)
+				case lowerModifier:
+					return r.processRequestBodyLowerModifier(bodyField)
+				case changedModifier:
+					return r.processRequestBodyChangedModifier(bodyField)
+				}
+			}
+		}
+
+		// some other @request.* static field
+		return r.resolver.resolveStaticRequestField(r.activeProps[1:]...)
+	}
+
+	// regular field
+	return r.processActiveProps()
+}
+
+func (r *runner) prepare() {
+	r.activeProps = strings.Split(r.fieldName, ".")
+
+	r.activeCollectionName = r.resolver.baseCollection.Name
+	if r.resolver.baseCollectionAlias == "" {
+		r.activeTableAlias = inflector.Columnify(r.activeCollectionName)
+	} else {
+		r.activeTableAlias = r.resolver.baseCollectionAlias
+	}
+
+	// enable the ignore flag for missing @request.* fields for backward
+	// compatibility and consistency with all @request.* filter fields and types
+	r.nullifyMisingField = r.activeProps[0] == "@request"
+
+	// prepare a multi-match subquery
+	r.multiMatch = &multiMatchSubquery{
+		baseTableAlias: r.activeTableAlias,
+		params:         dbx.Params{},
+	}
+	r.multiMatch.fromTableName = inflector.Columnify(r.activeCollectionName)
+	r.multiMatch.fromTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatchActiveTableAlias = r.multiMatch.fromTableAlias
+	r.withMultiMatch = false
+}
+
+func (r *runner) processCollectionField() (*search.ResolverResult, error) {
+	if len(r.activeProps) < 3 {
+		return nil, fmt.Errorf("invalid @collection field path in %q", r.fieldName)
+	}
+
+	// nameOrId or nameOrId:alias
+	collectionParts := strings.SplitN(r.activeProps[1], ":", 2)
+
+	collection, err := r.resolver.loadCollection(collectionParts[0])
+	if err != nil {
+		return nil, fmt.Errorf("failed to load collection %q from field path %q", r.activeProps[1], r.fieldName)
+	}
+
+	r.activeCollectionName = collection.Name
+
+	if len(collectionParts) == 2 && collectionParts[1] != "" {
+		r.activeTableAlias = inflector.Columnify("__collection_alias_"+collectionParts[1]) + r.resolver.joinAliasSuffix
+	} else {
+		r.activeTableAlias = inflector.Columnify("__collection_"+r.activeCollectionName) + r.resolver.joinAliasSuffix
+	}
+
+	r.withMultiMatch = true
+
+	// join the collection to the main query
+	err = r.resolver.registerJoin(inflector.Columnify(collection.Name), r.activeTableAlias, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// join the collection to the multi-match subquery
+	r.multiMatchActiveTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatch.joins = append(r.multiMatch.joins, &join{
+		tableName:  inflector.Columnify(collection.Name),
+		tableAlias: r.multiMatchActiveTableAlias,
+	})
+
+	// leave only the collection fields
+	// aka. @collection.someCollection.fieldA.fieldB -> fieldA.fieldB
+	r.activeProps = r.activeProps[2:]
+
+	return r.processActiveProps()
+}
+
+func (r *runner) processRequestAuthField() (*search.ResolverResult, error) {
+	if r.resolver.requestInfo == nil || r.resolver.requestInfo.Auth == nil || r.resolver.requestInfo.Auth.Collection() == nil {
+		return &search.ResolverResult{Identifier: "NULL"}, nil
+	}
+
+	// plain auth field
+	// ---
+	if _, ok := plainRequestAuthFields[r.fieldName]; ok {
+		return r.resolver.resolveStaticRequestField(r.activeProps[1:]...)
+	}
+
+	// resolve the auth collection field
+	// ---
+	collection := r.resolver.requestInfo.Auth.Collection()
+
+	r.activeCollectionName = collection.Name
+	r.activeTableAlias = "__auth_" + inflector.Columnify(r.activeCollectionName) + r.resolver.joinAliasSuffix
+
+	// join the auth collection to the main query
+	err := r.resolver.registerJoin(
+		inflector.Columnify(r.activeCollectionName),
+		r.activeTableAlias,
+		dbx.HashExp{
+			// aka. __auth_users.id = :userId
+			(r.activeTableAlias + ".id"): r.resolver.requestInfo.Auth.Id,
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	// join the auth collection to the multi-match subquery
+	r.multiMatchActiveTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatch.joins = append(
+		r.multiMatch.joins,
+		&join{
+			tableName:  inflector.Columnify(r.activeCollectionName),
+			tableAlias: r.multiMatchActiveTableAlias,
+			on: dbx.HashExp{
+				(r.multiMatchActiveTableAlias + ".id"): r.resolver.requestInfo.Auth.Id,
+			},
+		},
+	)
+
+	// leave only the auth relation fields
+	// aka. @request.auth.fieldA.fieldB -> fieldA.fieldB
+	r.activeProps = r.activeProps[2:]
+
+	return r.processActiveProps()
+}
+
+// note: nil value is returned as empty slice
+func toSlice(value any) []any {
+	if value == nil {
+		return []any{}
+	}
+
+	rv := reflect.ValueOf(value)
+
+	kind := rv.Kind()
+	if kind != reflect.Slice && kind != reflect.Array {
+		return []any{value}
+	}
+
+	rvLen := rv.Len()
+
+	result := make([]interface{}, rvLen)
+
+	for i := 0; i < rvLen; i++ {
+		result[i] = rv.Index(i).Interface()
+	}
+
+	return result
+}
+
+func (r *runner) processRequestBodyChangedModifier(bodyField Field) (*search.ResolverResult, error) {
+	name := bodyField.GetName()
+
+	alias := search.FilterData(fmt.Sprintf("@request.body.%s:isset = true && @request.body.%s != %s", name, name, name))
+
+	aliasExpr, err := alias.BuildExpr(r.resolver)
+	if err != nil {
+		return nil, err
+	}
+
+	placeholder := "@changed@" + name + security.PseudorandomString(6)
+
+	result := &search.ResolverResult{
+		Identifier: placeholder,
+		NoCoalesce: true,
+		AfterBuild: func(expr dbx.Expression) dbx.Expression {
+			return &replaceWithExpression{
+				placeholder: placeholder,
+				old:         expr,
+				new:         aliasExpr,
+			}
+		},
+	}
+
+	return result, nil
+}
+
+func (r *runner) processRequestBodyLowerModifier(bodyField Field) (*search.ResolverResult, error) {
+	rawValue := cast.ToString(r.resolver.requestInfo.Body[bodyField.GetName()])
+
+	placeholder := "infoLower" + bodyField.GetName() + security.PseudorandomString(6)
+
+	result := &search.ResolverResult{
+		Identifier: "LOWER({:" + placeholder + "})",
+		Params:     dbx.Params{placeholder: rawValue},
+	}
+
+	return result, nil
+}
+
+func (r *runner) processRequestBodyLengthModifier(bodyField Field) (*search.ResolverResult, error) {
+	if _, ok := bodyField.(MultiValuer); !ok {
+		return nil, fmt.Errorf("field %q doesn't support multivalue operations", bodyField.GetName())
+	}
+
+	bodyItems := toSlice(r.resolver.requestInfo.Body[bodyField.GetName()])
+
+	result := &search.ResolverResult{
+		Identifier: strconv.Itoa(len(bodyItems)),
+	}
+
+	return result, nil
+}
+
+func (r *runner) processRequestBodyEachModifier(bodyField Field) (*search.ResolverResult, error) {
+	multiValuer, ok := bodyField.(MultiValuer)
+	if !ok {
+		return nil, fmt.Errorf("field %q doesn't support multivalue operations", bodyField.GetName())
+	}
+
+	bodyItems := toSlice(r.resolver.requestInfo.Body[bodyField.GetName()])
+	bodyItemsRaw, err := json.Marshal(bodyItems)
+	if err != nil {
+		return nil, fmt.Errorf("cannot serialize the data for field %q", r.activeProps[2])
+	}
+
+	placeholder := "dataEach" + security.PseudorandomString(6)
+	cleanFieldName := inflector.Columnify(bodyField.GetName())
+
+	jeTable := dbutils.JSONEachByPlaceholder(placeholder)
+	jeAlias := "__dataEach_je_" + cleanFieldName + r.resolver.joinAliasSuffix
+
+	err = r.resolver.registerJoin(jeTable, jeAlias, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	result := &search.ResolverResult{
+		Identifier: fmt.Sprintf("[[%s.value]]", jeAlias),
+		Params:     dbx.Params{placeholder: bodyItemsRaw},
+	}
+
+	if multiValuer.IsMultiple() {
+		r.withMultiMatch = true
+	}
+
+	if r.withMultiMatch {
+		placeholder2 := "mm" + placeholder
+
+		jeTable2 := dbutils.JSONEachByPlaceholder(placeholder2)
+		jeAlias2 := "__mm_" + jeAlias
+
+		r.multiMatch.joins = append(r.multiMatch.joins, &join{
+			tableName:  jeTable2,
+			tableAlias: jeAlias2,
+		})
+		r.multiMatch.params[placeholder2] = bodyItemsRaw
+		r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.value]]", jeAlias2)
+
+		result.MultiMatchSubQuery = r.multiMatch
+	}
+
+	return result, nil
+}
+
+func (r *runner) processRequestBodyRelationField(bodyField Field) (*search.ResolverResult, error) {
+	relField, ok := bodyField.(*RelationField)
+	if !ok {
+		return nil, fmt.Errorf("failed to initialize data relation field %q", bodyField.GetName())
+	}
+
+	dataRelCollection, err := r.resolver.loadCollection(relField.CollectionId)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load collection %q from data field %q", relField.CollectionId, relField.Name)
+	}
+
+	var dataRelIds []string
+	if r.resolver.requestInfo != nil && len(r.resolver.requestInfo.Body) != 0 {
+		dataRelIds = list.ToUniqueStringSlice(r.resolver.requestInfo.Body[relField.Name])
+	}
+	if len(dataRelIds) == 0 {
+		return &search.ResolverResult{Identifier: "NULL"}, nil
+	}
+
+	r.activeCollectionName = dataRelCollection.Name
+	r.activeTableAlias = inflector.Columnify("__data_"+dataRelCollection.Name+"_"+relField.Name) + r.resolver.joinAliasSuffix
+
+	// join the data rel collection to the main collection
+	err = r.resolver.registerJoin(
+		r.activeCollectionName,
+		r.activeTableAlias,
+		dbx.In(
+			fmt.Sprintf("[[%s.id]]", r.activeTableAlias),
+			list.ToInterfaceSlice(dataRelIds)...,
+		),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	if relField.IsMultiple() {
+		r.withMultiMatch = true
+	}
+
+	// join the data rel collection to the multi-match subquery
+	r.multiMatchActiveTableAlias = "__mm_" + r.activeTableAlias
+	r.multiMatch.joins = append(
+		r.multiMatch.joins,
+		&join{
+			tableName:  r.activeCollectionName,
+			tableAlias: r.multiMatchActiveTableAlias,
+			on: dbx.In(
+				fmt.Sprintf("[[%s.id]]", r.multiMatchActiveTableAlias),
+				list.ToInterfaceSlice(dataRelIds)...,
+			),
+		},
+	)
+
+	// leave only the data relation fields
+	// aka. @request.body.someRel.fieldA.fieldB -> fieldA.fieldB
+	r.activeProps = r.activeProps[3:]
+
+	return r.processActiveProps()
+}
+
+var viaRegex = regexp.MustCompile(`^(\w+)_via_(\w+)$`)
+
+// @todo refactor and abstract lastProp processing with the support of field plugins
+func (r *runner) processActiveProps() (*search.ResolverResult, error) {
+	totalProps := len(r.activeProps)
+
+	for i, prop := range r.activeProps {
+		collection, err := r.resolver.loadCollection(r.activeCollectionName)
+		if err != nil {
+			return nil, fmt.Errorf("failed to resolve field %q", prop)
+		}
+
+		// last prop
+		if i == totalProps-1 {
+			return r.finalizeActivePropsProcessing(collection, prop, i)
+		}
+
+		field := collection.Fields.GetByName(prop)
+
+		if field != nil && field.GetHidden() && !r.resolver.allowHiddenFields {
+			return nil, fmt.Errorf("non-filterable field %q", prop)
+		}
+
+		// @todo consider moving to the finalizer and converting to "JSONExtractable" interface with optional extra validation for the remaining props?
+		// json or geoPoint field -> treat the rest of the props as json path
+		if field != nil && (field.Type() == FieldTypeJSON || field.Type() == FieldTypeGeoPoint) {
+			var jsonPath strings.Builder
+			for j, p := range r.activeProps[i+1:] {
+				if _, err := strconv.Atoi(p); err == nil {
+					jsonPath.WriteString("[")
+					jsonPath.WriteString(inflector.Columnify(p))
+					jsonPath.WriteString("]")
+				} else {
+					if j > 0 {
+						jsonPath.WriteString(".")
+					}
+					jsonPath.WriteString(inflector.Columnify(p))
+				}
+			}
+			jsonPathStr := jsonPath.String()
+
+			result := &search.ResolverResult{
+				NoCoalesce: true,
+				Identifier: dbutils.JSONExtract(r.activeTableAlias+"."+inflector.Columnify(prop), jsonPathStr),
+			}
+
+			if r.withMultiMatch {
+				r.multiMatch.valueIdentifier = dbutils.JSONExtract(r.multiMatchActiveTableAlias+"."+inflector.Columnify(prop), jsonPathStr)
+				result.MultiMatchSubQuery = r.multiMatch
+			}
+
+			return result, nil
+		}
+
+		if i >= maxNestedRels {
+			return nil, fmt.Errorf("max nested relations reached for field %q", prop)
+		}
+
+		// check for back relation (eg. yourCollection_via_yourRelField)
+		// -----------------------------------------------------------
+		if field == nil {
+			parts := viaRegex.FindStringSubmatch(prop)
+			if len(parts) != 3 {
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("failed to resolve field %q", prop)
+			}
+
+			backCollection, err := r.resolver.loadCollection(parts[1])
+			if err != nil {
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("failed to load back relation field %q collection", prop)
+			}
+
+			backField := backCollection.Fields.GetByName(parts[2])
+			if backField == nil {
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("missing back relation field %q", parts[2])
+			}
+
+			if backField.Type() != FieldTypeRelation {
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("invalid back relation field %q", parts[2])
+			}
+
+			if backField.GetHidden() && !r.resolver.allowHiddenFields {
+				return nil, fmt.Errorf("non-filterable back relation field %q", backField.GetName())
+			}
+
+			backRelField, ok := backField.(*RelationField)
+			if !ok {
+				return nil, fmt.Errorf("failed to initialize back relation field %q", backField.GetName())
+			}
+			if backRelField.CollectionId != collection.Id {
+				// https://github.com/pocketbase/pocketbase/discussions/6590#discussioncomment-12496581
+				if r.nullifyMisingField {
+					return &search.ResolverResult{Identifier: "NULL"}, nil
+				}
+				return nil, fmt.Errorf("invalid collection reference of a back relation field %q", backField.GetName())
+			}
+
+			// join the back relation to the main query
+			// ---
+			cleanProp := inflector.Columnify(prop)
+			cleanBackFieldName := inflector.Columnify(backRelField.Name)
+			newTableAlias := r.activeTableAlias + "_" + cleanProp + r.resolver.joinAliasSuffix
+			newCollectionName := inflector.Columnify(backCollection.Name)
+
+			isBackRelMultiple := backRelField.IsMultiple()
+			if !isBackRelMultiple {
+				// additionally check if the rel field has a single column unique index
+				_, hasUniqueIndex := dbutils.FindSingleColumnUniqueIndex(backCollection.Indexes, backRelField.Name)
+				isBackRelMultiple = !hasUniqueIndex
+			}
+
+			if !isBackRelMultiple {
+				err := r.resolver.registerJoin(
+					newCollectionName,
+					newTableAlias,
+					dbx.NewExp(fmt.Sprintf("[[%s.%s]] = [[%s.id]]", newTableAlias, cleanBackFieldName, r.activeTableAlias)),
+				)
+				if err != nil {
+					return nil, err
+				}
+			} else {
+				jeAlias := "__je_" + newTableAlias
+				err := r.resolver.registerJoin(
+					newCollectionName,
+					newTableAlias,
+					dbx.NewExp(fmt.Sprintf(
+						"[[%s.id]] IN (SELECT [[%s.value]] FROM %s {{%s}})",
+						r.activeTableAlias,
+						jeAlias,
+						dbutils.JSONEach(newTableAlias+"."+cleanBackFieldName),
+						jeAlias,
+					)),
+				)
+				if err != nil {
+					return nil, err
+				}
+			}
+
+			r.activeCollectionName = newCollectionName
+			r.activeTableAlias = newTableAlias
+			// ---
+
+			// join the back relation to the multi-match subquery
+			// ---
+			if isBackRelMultiple {
+				r.withMultiMatch = true // enable multimatch if not already
+			}
+
+			newTableAlias2 := r.multiMatchActiveTableAlias + "_" + cleanProp + r.resolver.joinAliasSuffix
+
+			if !isBackRelMultiple {
+				r.multiMatch.joins = append(
+					r.multiMatch.joins,
+					&join{
+						tableName:  newCollectionName,
+						tableAlias: newTableAlias2,
+						on:         dbx.NewExp(fmt.Sprintf("[[%s.%s]] = [[%s.id]]", newTableAlias2, cleanBackFieldName, r.multiMatchActiveTableAlias)),
+					},
+				)
+			} else {
+				jeAlias2 := "__je_" + newTableAlias2
+				r.multiMatch.joins = append(
+					r.multiMatch.joins,
+					&join{
+						tableName:  newCollectionName,
+						tableAlias: newTableAlias2,
+						on: dbx.NewExp(fmt.Sprintf(
+							"[[%s.id]] IN (SELECT [[%s.value]] FROM %s {{%s}})",
+							r.multiMatchActiveTableAlias,
+							jeAlias2,
+							dbutils.JSONEach(newTableAlias2+"."+cleanBackFieldName),
+							jeAlias2,
+						)),
+					},
+				)
+			}
+
+			r.multiMatchActiveTableAlias = newTableAlias2
+			// ---
+
+			continue
+		}
+		// -----------------------------------------------------------
+
+		// check for direct relation
+		if field.Type() != FieldTypeRelation {
+			return nil, fmt.Errorf("field %q is not a valid relation", prop)
+		}
+
+		// join the relation to the main query
+		// ---
+		relField, ok := field.(*RelationField)
+		if !ok {
+			return nil, fmt.Errorf("failed to initialize relation field %q", prop)
+		}
+
+		relCollection, relErr := r.resolver.loadCollection(relField.CollectionId)
+		if relErr != nil {
+			return nil, fmt.Errorf("failed to load field %q collection", prop)
+		}
+
+		// "id" lookups optimization for single relations to avoid unnecessary joins,
+		// aka. "user.id" and "user" should produce the same query identifier
+		if !relField.IsMultiple() &&
+			// the penultimate prop is "id"
+			i == totalProps-2 && r.activeProps[i+1] == FieldNameId {
+			return r.finalizeActivePropsProcessing(collection, relField.Name, i)
+		}
+
+		cleanFieldName := inflector.Columnify(relField.Name)
+		prefixedFieldName := r.activeTableAlias + "." + cleanFieldName
+		newTableAlias := r.activeTableAlias + "_" + cleanFieldName + r.resolver.joinAliasSuffix
+		newCollectionName := relCollection.Name
+
+		if !relField.IsMultiple() {
+			err := r.resolver.registerJoin(
+				inflector.Columnify(newCollectionName),
+				newTableAlias,
+				dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s]]", newTableAlias, prefixedFieldName)),
+			)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			jeAlias := "__je_" + newTableAlias
+
+			err := r.resolver.registerJoin(dbutils.JSONEach(prefixedFieldName), jeAlias, nil)
+			if err != nil {
+				return nil, err
+			}
+
+			err = r.resolver.registerJoin(
+				inflector.Columnify(newCollectionName),
+				newTableAlias,
+				dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s.value]]", newTableAlias, jeAlias)),
+			)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		r.activeCollectionName = newCollectionName
+		r.activeTableAlias = newTableAlias
+		// ---
+
+		// join the relation to the multi-match subquery
+		// ---
+		if relField.IsMultiple() {
+			r.withMultiMatch = true // enable multimatch if not already
+		}
+
+		newTableAlias2 := r.multiMatchActiveTableAlias + "_" + cleanFieldName
+		prefixedFieldName2 := r.multiMatchActiveTableAlias + "." + cleanFieldName
+
+		if !relField.IsMultiple() {
+			r.multiMatch.joins = append(
+				r.multiMatch.joins,
+				&join{
+					tableName:  inflector.Columnify(newCollectionName),
+					tableAlias: newTableAlias2,
+					on:         dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s]]", newTableAlias2, prefixedFieldName2)),
+				},
+			)
+		} else {
+			jeAlias2 := r.multiMatchActiveTableAlias + "_" + cleanFieldName + "_je"
+			r.multiMatch.joins = append(
+				r.multiMatch.joins,
+				&join{
+					tableName:  dbutils.JSONEach(prefixedFieldName2),
+					tableAlias: jeAlias2,
+				},
+				&join{
+					tableName:  inflector.Columnify(newCollectionName),
+					tableAlias: newTableAlias2,
+					on:         dbx.NewExp(fmt.Sprintf("[[%s.id]] = [[%s.value]]", newTableAlias2, jeAlias2)),
+				},
+			)
+		}
+
+		r.multiMatchActiveTableAlias = newTableAlias2
+		// ---
+	}
+
+	return nil, fmt.Errorf("failed to resolve field %q", r.fieldName)
+}
+
+func (r *runner) finalizeActivePropsProcessing(collection *Collection, prop string, propDepth int) (*search.ResolverResult, error) {
+	name, modifier, err := splitModifier(prop)
+	if err != nil {
+		return nil, err
+	}
+
+	field := collection.Fields.GetByName(name)
+	if field == nil {
+		if r.nullifyMisingField {
+			return &search.ResolverResult{Identifier: "NULL"}, nil
+		}
+		return nil, fmt.Errorf("unknown field %q", name)
+	}
+
+	if field.GetHidden() && !r.resolver.allowHiddenFields {
+		return nil, fmt.Errorf("non-filterable field %q", name)
+	}
+
+	multvaluer, isMultivaluer := field.(MultiValuer)
+
+	cleanFieldName := inflector.Columnify(field.GetName())
+
+	// arrayable fields with ":length" modifier
+	// -------------------------------------------------------
+	if modifier == lengthModifier && isMultivaluer {
+		jePair := r.activeTableAlias + "." + cleanFieldName
+
+		result := &search.ResolverResult{
+			Identifier: dbutils.JSONArrayLength(jePair),
+		}
+
+		if r.withMultiMatch {
+			jePair2 := r.multiMatchActiveTableAlias + "." + cleanFieldName
+			r.multiMatch.valueIdentifier = dbutils.JSONArrayLength(jePair2)
+			result.MultiMatchSubQuery = r.multiMatch
+		}
+
+		return result, nil
+	}
+
+	// arrayable fields with ":each" modifier
+	// -------------------------------------------------------
+	if modifier == eachModifier && isMultivaluer {
+		jePair := r.activeTableAlias + "." + cleanFieldName
+		jeAlias := "__je_" + r.activeTableAlias + "_" + cleanFieldName + r.resolver.joinAliasSuffix
+
+		err := r.resolver.registerJoin(dbutils.JSONEach(jePair), jeAlias, nil)
+		if err != nil {
+			return nil, err
+		}
+
+		result := &search.ResolverResult{
+			Identifier: fmt.Sprintf("[[%s.value]]", jeAlias),
+		}
+
+		if multvaluer.IsMultiple() {
+			r.withMultiMatch = true
+		}
+
+		if r.withMultiMatch {
+			jePair2 := r.multiMatchActiveTableAlias + "." + cleanFieldName
+			jeAlias2 := "__je_" + r.multiMatchActiveTableAlias + "_" + cleanFieldName + r.resolver.joinAliasSuffix
+
+			r.multiMatch.joins = append(r.multiMatch.joins, &join{
+				tableName:  dbutils.JSONEach(jePair2),
+				tableAlias: jeAlias2,
+			})
+			r.multiMatch.valueIdentifier = fmt.Sprintf("[[%s.value]]", jeAlias2)
+
+			result.MultiMatchSubQuery = r.multiMatch
+		}
+
+		return result, nil
+	}
+
+	// default
+	// -------------------------------------------------------
+	result := &search.ResolverResult{
+		Identifier: "[[" + r.activeTableAlias + "." + cleanFieldName + "]]",
+	}
+
+	if r.withMultiMatch {
+		r.multiMatch.valueIdentifier = "[[" + r.multiMatchActiveTableAlias + "." + cleanFieldName + "]]"
+		result.MultiMatchSubQuery = r.multiMatch
+	}
+
+	// allow querying only auth records with emails marked as public
+	if field.GetName() == FieldNameEmail && !r.resolver.allowHiddenFields && collection.IsAuth() {
+		result.AfterBuild = func(expr dbx.Expression) dbx.Expression {
+			return dbx.Enclose(dbx.And(expr, dbx.NewExp(fmt.Sprintf(
+				"[[%s.%s]] = TRUE",
+				r.activeTableAlias,
+				FieldNameEmailVisibility,
+			))))
+		}
+	}
+
+	// wrap in json_extract to ensure that top-level primitives
+	// stored as json work correctly when compared to their SQL equivalent
+	// (https://github.com/pocketbase/pocketbase/issues/4068)
+	if field.Type() == FieldTypeJSON {
+		result.NoCoalesce = true
+		result.Identifier = dbutils.JSONExtract(r.activeTableAlias+"."+cleanFieldName, "")
+		if r.withMultiMatch {
+			r.multiMatch.valueIdentifier = dbutils.JSONExtract(r.multiMatchActiveTableAlias+"."+cleanFieldName, "")
+		}
+	}
+
+	// account for the ":lower" modifier
+	if modifier == lowerModifier {
+		result.Identifier = "LOWER(" + result.Identifier + ")"
+		if r.withMultiMatch {
+			r.multiMatch.valueIdentifier = "LOWER(" + r.multiMatch.valueIdentifier + ")"
+		}
+	}
+
+	return result, nil
+}
diff --git a/server/core_backend-server/core/record_field_resolver_test.go b/server/core_backend-server/core/record_field_resolver_test.go
new file mode 100644
index 0000000..f2f52a2
--- /dev/null
+++ b/server/core_backend-server/core/record_field_resolver_test.go
@@ -0,0 +1,1156 @@
+package core_test
+
+import (
+	"encoding/json"
+	"regexp"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestRecordFieldResolverAllowedFields(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := core.NewRecordFieldResolver(app, collection, nil, false)
+
+	fields := r.AllowedFields()
+	if len(fields) != 8 {
+		t.Fatalf("Expected %d original allowed fields, got %d", 8, len(fields))
+	}
+
+	// change the allowed fields
+	newFields := []string{"a", "b", "c"}
+	expected := slices.Clone(newFields)
+	r.SetAllowedFields(newFields)
+
+	// change the new fields to ensure that the slice was cloned
+	newFields[2] = "d"
+
+	fields = r.AllowedFields()
+	if len(fields) != len(expected) {
+		t.Fatalf("Expected %d changed allowed fields, got %d", len(expected), len(fields))
+	}
+
+	for i, v := range expected {
+		if fields[i] != v {
+			t.Errorf("[%d] Expected field %q", i, v)
+		}
+	}
+}
+
+func TestRecordFieldResolverAllowHiddenFields(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := core.NewRecordFieldResolver(app, collection, nil, false)
+
+	allowHiddenFields := r.AllowHiddenFields()
+	if allowHiddenFields {
+		t.Fatalf("Expected original allowHiddenFields %v, got %v", allowHiddenFields, !allowHiddenFields)
+	}
+
+	// change the flag
+	expected := !allowHiddenFields
+	r.SetAllowHiddenFields(expected)
+
+	allowHiddenFields = r.AllowHiddenFields()
+	if allowHiddenFields != expected {
+		t.Fatalf("Expected changed allowHiddenFields %v, got %v", expected, allowHiddenFields)
+	}
+}
+
+func TestRecordFieldResolverUpdateQuery(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	authRecord, err := app.FindRecordById("users", "4q1xlclmfloku33")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	requestInfo := &core.RequestInfo{
+		Context: "ctx",
+		Headers: map[string]string{
+			"a": "123",
+			"b": "456",
+		},
+		Query: map[string]string{
+			"a": "", // to ensure that :isset returns true because the key exists
+			"b": "123",
+		},
+		Body: map[string]any{
+			"a":                  nil, // to ensure that :isset returns true because the key exists
+			"b":                  123,
+			"number":             10,
+			"select_many":        []string{"optionA", "optionC"},
+			"rel_one":            "test",
+			"rel_many":           []string{"test1", "test2"},
+			"file_one":           "test",
+			"file_many":          []string{"test1", "test2", "test3"},
+			"self_rel_one":       "test",
+			"self_rel_many":      []string{"test1"},
+			"rel_many_cascade":   []string{"test1", "test2"},
+			"rel_one_cascade":    "test1",
+			"rel_one_no_cascade": "test1",
+		},
+		Auth: authRecord,
+	}
+
+	scenarios := []struct {
+		name               string
+		collectionIdOrName string
+		rule               string
+		allowHiddenFields  bool
+		expectQuery        string
+	}{
+		{
+			"non relation field (with all default operators)",
+			"demo4",
+			"title = true || title != 'test' || title ~ 'test1' || title !~ '%test2' || title > 1 || title >= 2 || title < 3 || title <= 4",
+			false,
+			/* SQLite:
+			"SELECT `demo4`.* FROM `demo4` WHERE ([[demo4.title]] = 1 OR [[demo4.title]] IS NOT {:TEST} OR [[demo4.title]] LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] > {:TEST} OR [[demo4.title]] >= {:TEST} OR [[demo4.title]] < {:TEST} OR [[demo4.title]] <= {:TEST})",
+			*/
+			// PostgreSQL:
+			`SELECT "demo4".* FROM "demo4" WHERE ([[demo4.title]] = TRUE OR [[demo4.title]] IS DISTINCT FROM {:TEST} OR [[demo4.title]] LIKE {:TEST} ESCAPE '\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\' OR [[demo4.title]] > 1 OR [[demo4.title]] >= 2 OR [[demo4.title]] < 3 OR [[demo4.title]] <= 4)`,
+		},
+		{
+			"non relation field (with all opt/any operators)",
+			"demo4",
+			"title ?= true || title ?!= 'test' || title ?~ 'test1' || title ?!~ '%test2' || title ?> 1 || title ?>= 2 || title ?< 3 || title ?<= 4",
+			false,
+			/* SQLite:
+			"SELECT `demo4`.* FROM `demo4` WHERE ([[demo4.title]] = 1 OR [[demo4.title]] IS NOT {:TEST} OR [[demo4.title]] LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\\' OR [[demo4.title]] > {:TEST} OR [[demo4.title]] >= {:TEST} OR [[demo4.title]] < {:TEST} OR [[demo4.title]] <= {:TEST})",
+			*/
+			// PostgreSQL:
+			`SELECT "demo4".* FROM "demo4" WHERE ([[demo4.title]] = TRUE OR [[demo4.title]] IS DISTINCT FROM {:TEST} OR [[demo4.title]] LIKE {:TEST} ESCAPE '\' OR [[demo4.title]] NOT LIKE {:TEST} ESCAPE '\' OR [[demo4.title]] > 1 OR [[demo4.title]] >= 2 OR [[demo4.title]] < 3 OR [[demo4.title]] <= 4)`,
+		},
+		{
+			"single direct rel",
+			"demo4",
+			"self_rel_one > true",
+			false,
+			/* SQLite:
+			"SELECT `demo4`.* FROM `demo4` WHERE [[demo4.self_rel_one]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT "demo4".* FROM "demo4" WHERE [[demo4.self_rel_one]] > TRUE`,
+		},
+		{
+			"single direct rel (with id)",
+			"demo4",
+			"self_rel_one.id > true", // should NOT have join
+			false,
+			/* SQLite:
+			"SELECT `demo4`.* FROM `demo4` WHERE [[demo4.self_rel_one]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT "demo4".* FROM "demo4" WHERE [[demo4.self_rel_one]] > TRUE`,
+		},
+		{
+			"multiple direct rel (with id)",
+			"demo4",
+			"self_rel_many.id ?> true", // should have join
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] WHERE [[demo4_self_rel_many.id]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] WHERE [[demo4_self_rel_many.id]] > TRUE`,
+		},
+		{
+			"rel to collection with empty list rule",
+			"demo4",
+			"self_rel_one.created > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] WHERE [[demo4_self_rel_one.created]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] WHERE [[demo4_self_rel_one.created]] > TRUE`,
+		},
+		{
+			"rel to collection with non-empty list rule",
+			"demo4",
+			"rel_one_cascade.created > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo3` `demo4_rel_one_cascade` ON [[demo4_rel_one_cascade.id]] = [[demo4.rel_one_cascade]] WHERE (({:TEST} IS NOT '' AND {:TEST} IS NOT {:TEST})) AND ([[demo4_rel_one_cascade.created]] > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo3" "demo4_rel_one_cascade" ON [[demo4_rel_one_cascade.id]] = [[demo4.rel_one_cascade]] WHERE (({:TEST} IS DISTINCT FROM '' AND {:TEST} IS DISTINCT FROM {:TEST})) AND ([[demo4_rel_one_cascade.created]] > TRUE)`,
+		},
+		{
+			"rel to collection with non-empty list rule (with allowHiddenFields)",
+			"demo4",
+			"rel_one_cascade.created > true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo3` `demo4_rel_one_cascade` ON [[demo4_rel_one_cascade.id]] = [[demo4.rel_one_cascade]] WHERE [[demo4_rel_one_cascade.created]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo3" "demo4_rel_one_cascade" ON [[demo4_rel_one_cascade.id]] = [[demo4.rel_one_cascade]] WHERE [[demo4_rel_one_cascade.created]] > TRUE`,
+		},
+		{
+			"rel to collection with superusers only list rule",
+			"demo1",
+			"rel_many.created ?> true",
+			false,
+			"",
+		},
+		{
+			"rel to collection with superusers only list rule (with allowHiddenFields)",
+			"demo1",
+			"rel_many.created ?> true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo1.rel_many]]), json_type([[demo1.rel_many]])='array', FALSE) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END) `__je_demo1_rel_many` LEFT JOIN `users` `demo1_rel_many` ON [[demo1_rel_many.id]] = [[__je_demo1_rel_many.value]] WHERE [[demo1_rel_many.created]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo1".* FROM "demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo1.rel_many]] IS JSON OR json_valid([[demo1.rel_many]]::text)) AND jsonb_typeof([[demo1.rel_many]]::jsonb) = 'array' THEN [[demo1.rel_many]]::jsonb ELSE jsonb_build_array([[demo1.rel_many]]) END) "__je_demo1_rel_many" ON 1=1 LEFT JOIN "users" "demo1_rel_many" ON [[demo1_rel_many.id]] = [[__je_demo1_rel_many.value]] WHERE [[demo1_rel_many.created]] > TRUE`,
+		},
+		{
+			"nested rels with all empty list rules",
+			"demo4",
+			"self_rel_one.self_rel_one.title > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN `demo4` `demo4_self_rel_one_self_rel_one` ON [[demo4_self_rel_one_self_rel_one.id]] = [[demo4_self_rel_one.self_rel_one]] WHERE [[demo4_self_rel_one_self_rel_one.title]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN "demo4" "demo4_self_rel_one_self_rel_one" ON [[demo4_self_rel_one_self_rel_one.id]] = [[demo4_self_rel_one.self_rel_one]] WHERE [[demo4_self_rel_one_self_rel_one.title]] > TRUE`,
+		},
+		{
+			"nested rels with non-empty list rule",
+			"demo4",
+			"self_rel_one.rel_one_cascade.created > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN `demo3` `demo4_self_rel_one_rel_one_cascade` ON [[demo4_self_rel_one_rel_one_cascade.id]] = [[demo4_self_rel_one.rel_one_cascade]] WHERE (({:TEST} IS NOT '' AND {:TEST} IS NOT {:TEST})) AND ([[demo4_self_rel_one_rel_one_cascade.created]] > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN "demo3" "demo4_self_rel_one_rel_one_cascade" ON [[demo4_self_rel_one_rel_one_cascade.id]] = [[demo4_self_rel_one.rel_one_cascade]] WHERE (({:TEST} IS DISTINCT FROM '' AND {:TEST} IS DISTINCT FROM {:TEST})) AND ([[demo4_self_rel_one_rel_one_cascade.created]] > TRUE)`,
+		},
+		{
+			"nested rels with non-empty list rule (joins reuse test)",
+			"demo4",
+			"self_rel_one.rel_one_cascade.created > true && self_rel_one.rel_one_cascade.updated > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN `demo3` `demo4_self_rel_one_rel_one_cascade` ON [[demo4_self_rel_one_rel_one_cascade.id]] = [[demo4_self_rel_one.rel_one_cascade]] WHERE (({:TEST} IS NOT '' AND {:TEST} IS NOT {:TEST})) AND (([[demo4_self_rel_one_rel_one_cascade.created]] > 1 AND [[demo4_self_rel_one_rel_one_cascade.updated]] > 1))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN "demo3" "demo4_self_rel_one_rel_one_cascade" ON [[demo4_self_rel_one_rel_one_cascade.id]] = [[demo4_self_rel_one.rel_one_cascade]] WHERE (({:TEST} IS DISTINCT FROM '' AND {:TEST} IS DISTINCT FROM {:TEST})) AND (([[demo4_self_rel_one_rel_one_cascade.created]] > TRUE AND [[demo4_self_rel_one_rel_one_cascade.updated]] > TRUE))`,
+		},
+		{
+			"nested rels with non-empty list rule (with allowHiddenFields)",
+			"demo4",
+			"self_rel_one.rel_one_cascade.created > true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN `demo3` `demo4_self_rel_one_rel_one_cascade` ON [[demo4_self_rel_one_rel_one_cascade.id]] = [[demo4_self_rel_one.rel_one_cascade]] WHERE [[demo4_self_rel_one_rel_one_cascade.created]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN "demo3" "demo4_self_rel_one_rel_one_cascade" ON [[demo4_self_rel_one_rel_one_cascade.id]] = [[demo4_self_rel_one.rel_one_cascade]] WHERE [[demo4_self_rel_one_rel_one_cascade.created]] > TRUE`,
+		},
+		{
+			"non-relation field + single rel",
+			"demo4",
+			"title > true || self_rel_one.title > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] WHERE ([[demo4.title]] > 1 OR [[demo4_self_rel_one.title]] > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] WHERE ([[demo4.title]] > TRUE OR [[demo4_self_rel_one.title]] > TRUE)`,
+		},
+		{
+			"nested incomplete relations (opt/any operator)",
+			"demo4",
+			"self_rel_many.self_rel_one ?> true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN json_valid([[demo4.self_rel_many]]) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `demo4_self_rel_many_je` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[demo4_self_rel_many_je.value]] WHERE [[demo4_self_rel_many.self_rel_one]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] WHERE [[demo4_self_rel_many.self_rel_one]] > TRUE`,
+		},
+		{
+			"nested incomplete relations (multi-match operator)",
+			"demo4",
+			"self_rel_many.self_rel_one > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] WHERE ((([[demo4_self_rel_many.self_rel_one]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many.self_rel_one]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4.self_rel_many]]), json_type([[__mm_demo4.self_rel_many]])='array', FALSE) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] WHERE ((([[demo4_self_rel_many.self_rel_one]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many.self_rel_one]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4.self_rel_many]] IS JSON OR json_valid([[__mm_demo4.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4.self_rel_many]]) END) "__mm_demo4_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many" ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))))`,
+		},
+		{
+			"nested complete relations (opt/any operator)",
+			"demo4",
+			"self_rel_many.self_rel_one.title ?> true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many.self_rel_one]] WHERE [[demo4_self_rel_many_self_rel_one.title]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN "demo4" "demo4_self_rel_many_self_rel_one" ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many.self_rel_one]] WHERE [[demo4_self_rel_many_self_rel_one.title]] > TRUE`,
+		},
+		{
+			"nested complete relations (multi-match operator)",
+			"demo4",
+			"self_rel_many.self_rel_one.title > true",
+			false,
+			/* SQLiet:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many.self_rel_one]] WHERE ((([[demo4_self_rel_many_self_rel_one.title]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many_self_rel_one.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4.self_rel_many]]), json_type([[__mm_demo4.self_rel_many]])='array', FALSE) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] LEFT JOIN `demo4` `__mm_demo4_self_rel_many_self_rel_one` ON [[__mm_demo4_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many.self_rel_one]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))))",
+			*/
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN "demo4" "demo4_self_rel_many_self_rel_one" ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many.self_rel_one]] WHERE ((([[demo4_self_rel_many_self_rel_one.title]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many_self_rel_one.title]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4.self_rel_many]] IS JSON OR json_valid([[__mm_demo4.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4.self_rel_many]]) END) "__mm_demo4_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many" ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] LEFT JOIN "demo4" "__mm_demo4_self_rel_many_self_rel_one" ON [[__mm_demo4_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many.self_rel_one]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))))`,
+		},
+		{
+			"repeated nested relations (opt/any operator)",
+			"demo4",
+			"self_rel_many.self_rel_one.self_rel_many.self_rel_one.title ?> true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many.self_rel_one]] LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4_self_rel_many_self_rel_one.self_rel_many]]), json_type([[demo4_self_rel_many_self_rel_one.self_rel_many]])='array', FALSE) THEN [[demo4_self_rel_many_self_rel_one.self_rel_many]] ELSE json_array([[demo4_self_rel_many_self_rel_one.self_rel_many]]) END) `__je_demo4_self_rel_many_self_rel_one_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many` ON [[demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[__je_demo4_self_rel_many_self_rel_one_self_rel_many.value]] LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] WHERE [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN "demo4" "demo4_self_rel_many_self_rel_one" ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many.self_rel_one]] LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4_self_rel_many_self_rel_one.self_rel_many]] IS JSON OR json_valid([[demo4_self_rel_many_self_rel_one.self_rel_many]]::text)) AND jsonb_typeof([[demo4_self_rel_many_self_rel_one.self_rel_many]]::jsonb) = 'array' THEN [[demo4_self_rel_many_self_rel_one.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4_self_rel_many_self_rel_one.self_rel_many]]) END) "__je_demo4_self_rel_many_self_rel_one_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many_self_rel_one_self_rel_many" ON [[demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[__je_demo4_self_rel_many_self_rel_one_self_rel_many.value]] LEFT JOIN "demo4" "demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one" ON [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] WHERE [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] > TRUE`,
+		},
+		{
+			"repeated nested relations (multi-match operator)",
+			"demo4",
+			"self_rel_many.self_rel_one.self_rel_many.self_rel_one.title > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many.self_rel_one]] LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4_self_rel_many_self_rel_one.self_rel_many]]), json_type([[demo4_self_rel_many_self_rel_one.self_rel_many]])='array', FALSE) THEN [[demo4_self_rel_many_self_rel_one.self_rel_many]] ELSE json_array([[demo4_self_rel_many_self_rel_one.self_rel_many]]) END) `__je_demo4_self_rel_many_self_rel_one_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many` ON [[demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[__je_demo4_self_rel_many_self_rel_one_self_rel_many.value]] LEFT JOIN `demo4` `demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one` ON [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] WHERE ((([[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4.self_rel_many]]), json_type([[__mm_demo4.self_rel_many]])='array', FALSE) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] LEFT JOIN `demo4` `__mm_demo4_self_rel_many_self_rel_one` ON [[__mm_demo4_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many.self_rel_one]] LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]]), json_type([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]])='array', FALSE) THEN [[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]] ELSE json_array([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]]) END) `__mm_demo4_self_rel_many_self_rel_one_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many_self_rel_one_self_rel_many` ON [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_je.value]] LEFT JOIN `demo4` `__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one` ON [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN "demo4" "demo4_self_rel_many_self_rel_one" ON [[demo4_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many.self_rel_one]] LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4_self_rel_many_self_rel_one.self_rel_many]] IS JSON OR json_valid([[demo4_self_rel_many_self_rel_one.self_rel_many]]::text)) AND jsonb_typeof([[demo4_self_rel_many_self_rel_one.self_rel_many]]::jsonb) = 'array' THEN [[demo4_self_rel_many_self_rel_one.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4_self_rel_many_self_rel_one.self_rel_many]]) END) "__je_demo4_self_rel_many_self_rel_one_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many_self_rel_one_self_rel_many" ON [[demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[__je_demo4_self_rel_many_self_rel_one_self_rel_many.value]] LEFT JOIN "demo4" "demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one" ON [[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] WHERE ((([[demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4.self_rel_many]] IS JSON OR json_valid([[__mm_demo4.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4.self_rel_many]]) END) "__mm_demo4_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many" ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] LEFT JOIN "demo4" "__mm_demo4_self_rel_many_self_rel_one" ON [[__mm_demo4_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many.self_rel_one]] LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]] IS JSON OR json_valid([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4_self_rel_many_self_rel_one.self_rel_many]]) END) "__mm_demo4_self_rel_many_self_rel_one_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many_self_rel_one_self_rel_many" ON [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many.id]] = [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_je.value]] LEFT JOIN "demo4" "__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one" ON [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.id]] = [[__mm_demo4_self_rel_many_self_rel_one_self_rel_many.self_rel_one]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))))`,
+		},
+		{
+			"multiple relations (opt/any operators)",
+			"demo4",
+			"self_rel_many.title ?= 'test' || self_rel_one.json_object.a ?> true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] WHERE ([[demo4_self_rel_many.title]] = {:TEST} OR (CASE WHEN json_valid([[demo4_self_rel_one.json_object]]) THEN JSON_EXTRACT([[demo4_self_rel_one.json_object]], '$.a') ELSE JSON_EXTRACT(json_object('pb', [[demo4_self_rel_one.json_object]]), '$.pb.a') END) > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] WHERE ([[demo4_self_rel_many.title]] = {:TEST} OR JSON_QUERY_OR_NULL([[demo4_self_rel_one.json_object]], '$.a')::jsonb::text > TRUE::text)`,
+		},
+		{
+			"multiple relations (multi-match operators)",
+			"demo4",
+			"self_rel_many.title = 'test' || self_rel_one.json_object.a > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] WHERE ((([[demo4_self_rel_many.title]] = {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4.self_rel_many]]), json_type([[__mm_demo4.self_rel_many]])='array', FALSE) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = {:TEST})))) OR (CASE WHEN json_valid([[demo4_self_rel_one.json_object]]) THEN JSON_EXTRACT([[demo4_self_rel_one.json_object]], '$.a') ELSE JSON_EXTRACT(json_object('pb', [[demo4_self_rel_one.json_object]]), '$.pb.a') END) > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] WHERE ((([[demo4_self_rel_many.title]] = {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo4_self_rel_many.title]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4.self_rel_many]] IS JSON OR json_valid([[__mm_demo4.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4.self_rel_many]]) END) "__mm_demo4_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many" ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = {:TEST})))) OR JSON_QUERY_OR_NULL([[demo4_self_rel_one.json_object]], '$.a')::jsonb::text > TRUE::text)`,
+		},
+		{
+			"back relations via single relation field (without unique index)",
+			"demo3",
+			"demo4_via_rel_one_cascade.id = true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo3`.* FROM `demo3` LEFT JOIN `demo4` `demo3_demo4_via_rel_one_cascade` ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_one_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[demo3_demo4_via_rel_one_cascade.rel_one_cascade]]), json_type([[demo3_demo4_via_rel_one_cascade.rel_one_cascade]])='array', FALSE) THEN [[demo3_demo4_via_rel_one_cascade.rel_one_cascade]] ELSE json_array([[demo3_demo4_via_rel_one_cascade.rel_one_cascade]]) END) {{__je_demo3_demo4_via_rel_one_cascade}}) WHERE ((([[demo3_demo4_via_rel_one_cascade.id]] = 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo3_demo4_via_rel_one_cascade.id]] as [[multiMatchValue]] FROM `demo3` `__mm_demo3` LEFT JOIN `demo4` `__mm_demo3_demo4_via_rel_one_cascade` ON [[__mm_demo3.id]] IN (SELECT [[__je___mm_demo3_demo4_via_rel_one_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]]), json_type([[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]])='array', FALSE) THEN [[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]] ELSE json_array([[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]]) END) {{__je___mm_demo3_demo4_via_rel_one_cascade}}) WHERE `__mm_demo3`.`id` = `demo3`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = 1)))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo3".* FROM "demo3" LEFT JOIN "demo4" "demo3_demo4_via_rel_one_cascade" ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_one_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo3_demo4_via_rel_one_cascade.rel_one_cascade]] IS JSON OR json_valid([[demo3_demo4_via_rel_one_cascade.rel_one_cascade]]::text)) AND jsonb_typeof([[demo3_demo4_via_rel_one_cascade.rel_one_cascade]]::jsonb) = 'array' THEN [[demo3_demo4_via_rel_one_cascade.rel_one_cascade]]::jsonb ELSE jsonb_build_array([[demo3_demo4_via_rel_one_cascade.rel_one_cascade]]) END) {{__je_demo3_demo4_via_rel_one_cascade}}) WHERE ((([[demo3_demo4_via_rel_one_cascade.id]] = TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo3_demo4_via_rel_one_cascade.id]] as [[multiMatchValue]] FROM "demo3" "__mm_demo3" LEFT JOIN "demo4" "__mm_demo3_demo4_via_rel_one_cascade" ON [[__mm_demo3.id]] IN (SELECT [[__je___mm_demo3_demo4_via_rel_one_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]] IS JSON OR json_valid([[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]]::text)) AND jsonb_typeof([[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]]::jsonb) = 'array' THEN [[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]]::jsonb ELSE jsonb_build_array([[__mm_demo3_demo4_via_rel_one_cascade.rel_one_cascade]]) END) {{__je___mm_demo3_demo4_via_rel_one_cascade}}) WHERE "__mm_demo3"."id" = "demo3"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = TRUE)))))`,
+		},
+		{
+			"back relations via single relation field (with unique index)",
+			"demo3",
+			"demo4_via_rel_one_unique.id = true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo3`.* FROM `demo3` LEFT JOIN `demo4` `demo3_demo4_via_rel_one_unique` ON [[demo3_demo4_via_rel_one_unique.rel_one_unique]] = [[demo3.id]] WHERE [[demo3_demo4_via_rel_one_unique.id]] = 1",
+			*/
+			`SELECT DISTINCT "demo3".* FROM "demo3" LEFT JOIN "demo4" "demo3_demo4_via_rel_one_unique" ON [[demo3_demo4_via_rel_one_unique.rel_one_unique]] = [[demo3.id]] WHERE [[demo3_demo4_via_rel_one_unique.id]] = TRUE`,
+		},
+		{
+			"back relations via multiple relation field (opt/any operators)",
+			"demo3",
+			"demo4_via_rel_many_cascade.id ?= true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo3`.* FROM `demo3` LEFT JOIN `demo4` `demo3_demo4_via_rel_many_cascade` ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]), json_type([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]])='array', FALSE) THEN [[demo3_demo4_via_rel_many_cascade.rel_many_cascade]] ELSE json_array([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade}}) WHERE [[demo3_demo4_via_rel_many_cascade.id]] = 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo3".* FROM "demo3" LEFT JOIN "demo4" "demo3_demo4_via_rel_many_cascade" ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]] IS JSON OR json_valid([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::text)) AND jsonb_typeof([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb) = 'array' THEN [[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade}}) WHERE [[demo3_demo4_via_rel_many_cascade.id]] = TRUE`,
+		},
+		{
+			"back relations via multiple relation field (multi-match operators)",
+			"demo3",
+			"demo4_via_rel_many_cascade.id = true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo3`.* FROM `demo3` LEFT JOIN `demo4` `demo3_demo4_via_rel_many_cascade` ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]), json_type([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]])='array', FALSE) THEN [[demo3_demo4_via_rel_many_cascade.rel_many_cascade]] ELSE json_array([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade}}) WHERE ((([[demo3_demo4_via_rel_many_cascade.id]] = 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo3_demo4_via_rel_many_cascade.id]] as [[multiMatchValue]] FROM `demo3` `__mm_demo3` LEFT JOIN `demo4` `__mm_demo3_demo4_via_rel_many_cascade` ON [[__mm_demo3.id]] IN (SELECT [[__je___mm_demo3_demo4_via_rel_many_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]]), json_type([[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]])='array', FALSE) THEN [[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]] ELSE json_array([[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je___mm_demo3_demo4_via_rel_many_cascade}}) WHERE `__mm_demo3`.`id` = `demo3`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = 1)))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo3".* FROM "demo3" LEFT JOIN "demo4" "demo3_demo4_via_rel_many_cascade" ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]] IS JSON OR json_valid([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::text)) AND jsonb_typeof([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb) = 'array' THEN [[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade}}) WHERE ((([[demo3_demo4_via_rel_many_cascade.id]] = TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo3_demo4_via_rel_many_cascade.id]] as [[multiMatchValue]] FROM "demo3" "__mm_demo3" LEFT JOIN "demo4" "__mm_demo3_demo4_via_rel_many_cascade" ON [[__mm_demo3.id]] IN (SELECT [[__je___mm_demo3_demo4_via_rel_many_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]] IS JSON OR json_valid([[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::text)) AND jsonb_typeof([[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb) = 'array' THEN [[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[__mm_demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je___mm_demo3_demo4_via_rel_many_cascade}}) WHERE "__mm_demo3"."id" = "demo3"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = TRUE)))))`,
+		},
+		{
+			"back relations via unique multiple relation field (should be the same as multi-match)",
+			"demo3",
+			"demo4_via_rel_many_unique.id = true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo3`.* FROM `demo3` LEFT JOIN `demo4` `demo3_demo4_via_rel_many_unique` ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_unique.value]] FROM json_each(CASE WHEN iif(json_valid([[demo3_demo4_via_rel_many_unique.rel_many_unique]]), json_type([[demo3_demo4_via_rel_many_unique.rel_many_unique]])='array', FALSE) THEN [[demo3_demo4_via_rel_many_unique.rel_many_unique]] ELSE json_array([[demo3_demo4_via_rel_many_unique.rel_many_unique]]) END) {{__je_demo3_demo4_via_rel_many_unique}}) WHERE ((([[demo3_demo4_via_rel_many_unique.id]] = 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo3_demo4_via_rel_many_unique.id]] as [[multiMatchValue]] FROM `demo3` `__mm_demo3` LEFT JOIN `demo4` `__mm_demo3_demo4_via_rel_many_unique` ON [[__mm_demo3.id]] IN (SELECT [[__je___mm_demo3_demo4_via_rel_many_unique.value]] FROM json_each(CASE WHEN iif(json_valid([[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]]), json_type([[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]])='array', FALSE) THEN [[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]] ELSE json_array([[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]]) END) {{__je___mm_demo3_demo4_via_rel_many_unique}}) WHERE `__mm_demo3`.`id` = `demo3`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = 1)))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo3".* FROM "demo3" LEFT JOIN "demo4" "demo3_demo4_via_rel_many_unique" ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_unique.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo3_demo4_via_rel_many_unique.rel_many_unique]] IS JSON OR json_valid([[demo3_demo4_via_rel_many_unique.rel_many_unique]]::text)) AND jsonb_typeof([[demo3_demo4_via_rel_many_unique.rel_many_unique]]::jsonb) = 'array' THEN [[demo3_demo4_via_rel_many_unique.rel_many_unique]]::jsonb ELSE jsonb_build_array([[demo3_demo4_via_rel_many_unique.rel_many_unique]]) END) {{__je_demo3_demo4_via_rel_many_unique}}) WHERE ((([[demo3_demo4_via_rel_many_unique.id]] = TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo3_demo4_via_rel_many_unique.id]] as [[multiMatchValue]] FROM "demo3" "__mm_demo3" LEFT JOIN "demo4" "__mm_demo3_demo4_via_rel_many_unique" ON [[__mm_demo3.id]] IN (SELECT [[__je___mm_demo3_demo4_via_rel_many_unique.value]] FROM jsonb_array_elements_text(CASE WHEN ([[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]] IS JSON OR json_valid([[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]]::text)) AND jsonb_typeof([[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]]::jsonb) = 'array' THEN [[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]]::jsonb ELSE jsonb_build_array([[__mm_demo3_demo4_via_rel_many_unique.rel_many_unique]]) END) {{__je___mm_demo3_demo4_via_rel_many_unique}}) WHERE "__mm_demo3"."id" = "demo3"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = TRUE)))))`,
+		},
+		{
+			"view back relation with non-empty and superusers list rules",
+			"demo1",
+			"view1_via_rel_one.rel_many.created ?> true",
+			false,
+			"",
+		},
+		{
+			"view back relation with non-empty and superusers list rules (with allowHiddenFields)",
+			"demo1",
+			"view1_via_rel_one.rel_many.created ?> true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN `view1` `demo1_view1_via_rel_one` ON [[demo1.id]] IN (SELECT [[__je_demo1_view1_via_rel_one.value]] FROM json_each(CASE WHEN iif(json_valid([[demo1_view1_via_rel_one.rel_one]]), json_type([[demo1_view1_via_rel_one.rel_one]])='array', FALSE) THEN [[demo1_view1_via_rel_one.rel_one]] ELSE json_array([[demo1_view1_via_rel_one.rel_one]]) END) {{__je_demo1_view1_via_rel_one}}) LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo1_view1_via_rel_one.rel_many]]), json_type([[demo1_view1_via_rel_one.rel_many]])='array', FALSE) THEN [[demo1_view1_via_rel_one.rel_many]] ELSE json_array([[demo1_view1_via_rel_one.rel_many]]) END) `__je_demo1_view1_via_rel_one_rel_many` LEFT JOIN `users` `demo1_view1_via_rel_one_rel_many` ON [[demo1_view1_via_rel_one_rel_many.id]] = [[__je_demo1_view1_via_rel_one_rel_many.value]] WHERE [[demo1_view1_via_rel_one_rel_many.created]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo1".* FROM "demo1" LEFT JOIN "view1" "demo1_view1_via_rel_one" ON [[demo1.id]] IN (SELECT [[__je_demo1_view1_via_rel_one.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo1_view1_via_rel_one.rel_one]] IS JSON OR json_valid([[demo1_view1_via_rel_one.rel_one]]::text)) AND jsonb_typeof([[demo1_view1_via_rel_one.rel_one]]::jsonb) = 'array' THEN [[demo1_view1_via_rel_one.rel_one]]::jsonb ELSE jsonb_build_array([[demo1_view1_via_rel_one.rel_one]]) END) {{__je_demo1_view1_via_rel_one}}) LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo1_view1_via_rel_one.rel_many]] IS JSON OR json_valid([[demo1_view1_via_rel_one.rel_many]]::text)) AND jsonb_typeof([[demo1_view1_via_rel_one.rel_many]]::jsonb) = 'array' THEN [[demo1_view1_via_rel_one.rel_many]]::jsonb ELSE jsonb_build_array([[demo1_view1_via_rel_one.rel_many]]) END) "__je_demo1_view1_via_rel_one_rel_many" ON 1=1 LEFT JOIN "users" "demo1_view1_via_rel_one_rel_many" ON [[demo1_view1_via_rel_one_rel_many.id]] = [[__je_demo1_view1_via_rel_one_rel_many.value]] WHERE [[demo1_view1_via_rel_one_rel_many.created]] > TRUE`,
+		},
+		{
+			"recursive back relations with non-empty list rule",
+			"demo3",
+			"demo4_via_rel_many_cascade.rel_one_cascade.demo4_via_rel_many_cascade.id ?= true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo3`.* FROM `demo3` LEFT JOIN `demo4` `demo3_demo4_via_rel_many_cascade` ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]), json_type([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]])='array', FALSE) THEN [[demo3_demo4_via_rel_many_cascade.rel_many_cascade]] ELSE json_array([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade}}) LEFT JOIN `demo3` `demo3_demo4_via_rel_many_cascade_rel_one_cascade` ON [[demo3_demo4_via_rel_many_cascade_rel_one_cascade.id]] = [[demo3_demo4_via_rel_many_cascade.rel_one_cascade]] LEFT JOIN `demo4` `demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade` ON [[demo3_demo4_via_rel_many_cascade_rel_one_cascade.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]), json_type([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]])='array', FALSE) THEN [[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]] ELSE json_array([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade}}) WHERE (({:TEST} IS NOT '' AND {:TEST} IS NOT {:TEST})) AND ([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.id]] = 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo3".* FROM "demo3" LEFT JOIN "demo4" "demo3_demo4_via_rel_many_cascade" ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]] IS JSON OR json_valid([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::text)) AND jsonb_typeof([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb) = 'array' THEN [[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade}}) LEFT JOIN "demo3" "demo3_demo4_via_rel_many_cascade_rel_one_cascade" ON [[demo3_demo4_via_rel_many_cascade_rel_one_cascade.id]] = [[demo3_demo4_via_rel_many_cascade.rel_one_cascade]] LEFT JOIN "demo4" "demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade" ON [[demo3_demo4_via_rel_many_cascade_rel_one_cascade.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]] IS JSON OR json_valid([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]::text)) AND jsonb_typeof([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb) = 'array' THEN [[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade}}) WHERE (({:TEST} IS DISTINCT FROM '' AND {:TEST} IS DISTINCT FROM {:TEST})) AND ([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.id]] = TRUE)`,
+		},
+		{
+			"recursive back relations with non-empty list rule (with allowHiddenFields)",
+			"demo3",
+			"demo4_via_rel_many_cascade.rel_one_cascade.demo4_via_rel_many_cascade.id ?= true",
+			true,
+			/* SQlite:
+			"SELECT DISTINCT `demo3`.* FROM `demo3` LEFT JOIN `demo4` `demo3_demo4_via_rel_many_cascade` ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]), json_type([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]])='array', FALSE) THEN [[demo3_demo4_via_rel_many_cascade.rel_many_cascade]] ELSE json_array([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade}}) LEFT JOIN `demo3` `demo3_demo4_via_rel_many_cascade_rel_one_cascade` ON [[demo3_demo4_via_rel_many_cascade_rel_one_cascade.id]] = [[demo3_demo4_via_rel_many_cascade.rel_one_cascade]] LEFT JOIN `demo4` `demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade` ON [[demo3_demo4_via_rel_many_cascade_rel_one_cascade.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.value]] FROM json_each(CASE WHEN iif(json_valid([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]), json_type([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]])='array', FALSE) THEN [[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]] ELSE json_array([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade}}) WHERE [[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.id]] = 1",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo3".* FROM "demo3" LEFT JOIN "demo4" "demo3_demo4_via_rel_many_cascade" ON [[demo3.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]] IS JSON OR json_valid([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::text)) AND jsonb_typeof([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb) = 'array' THEN [[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[demo3_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade}}) LEFT JOIN "demo3" "demo3_demo4_via_rel_many_cascade_rel_one_cascade" ON [[demo3_demo4_via_rel_many_cascade_rel_one_cascade.id]] = [[demo3_demo4_via_rel_many_cascade.rel_one_cascade]] LEFT JOIN "demo4" "demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade" ON [[demo3_demo4_via_rel_many_cascade_rel_one_cascade.id]] IN (SELECT [[__je_demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.value]] FROM jsonb_array_elements_text(CASE WHEN ([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]] IS JSON OR json_valid([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]::text)) AND jsonb_typeof([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb) = 'array' THEN [[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.rel_many_cascade]]) END) {{__je_demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade}}) WHERE [[demo3_demo4_via_rel_many_cascade_rel_one_cascade_demo4_via_rel_many_cascade.id]] = TRUE`,
+		},
+		{
+			"@collection join (opt/any operators)",
+			"demo4",
+			"@collection.demo1.text ?> true || @collection.demo2.active ?> true || @collection.demo1:demo1_alias.file_one ?> true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo1` `__collection_demo1` LEFT JOIN `demo2` `__collection_demo2` LEFT JOIN `demo1` `__collection_alias_demo1_alias` WHERE ([[__collection_demo1.text]] > 1 OR [[__collection_demo2.active]] > 1 OR [[__collection_alias_demo1_alias.file_one]] > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo1" "__collection_demo1" ON 1=1 LEFT JOIN "demo2" "__collection_demo2" ON 1=1 LEFT JOIN "demo1" "__collection_alias_demo1_alias" ON 1=1 WHERE ([[__collection_demo1.text]] > TRUE OR [[__collection_demo2.active]] > TRUE OR [[__collection_alias_demo1_alias.file_one]] > TRUE)`,
+		},
+		{
+			"@collection join (multi-match operators)",
+			"demo4",
+			"@collection.demo1.text > true || @collection.demo2.active > true || @collection.demo1.file_one > true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo1` `__collection_demo1` LEFT JOIN `demo2` `__collection_demo2` WHERE ((([[__collection_demo1.text]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo1.text]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo1` `__mm___collection_demo1` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) OR (([[__collection_demo2.active]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo2.active]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo2` `__mm___collection_demo2` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) OR (([[__collection_demo1.file_one]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo1.file_one]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo1` `__mm___collection_demo1` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo1" "__collection_demo1" ON 1=1 LEFT JOIN "demo2" "__collection_demo2" ON 1=1 WHERE ((([[__collection_demo1.text]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo1.text]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "demo1" "__mm___collection_demo1" ON 1=1 WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) OR (([[__collection_demo2.active]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo2.active]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "demo2" "__mm___collection_demo2" ON 1=1 WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) OR (([[__collection_demo1.file_one]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo1.file_one]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "demo1" "__mm___collection_demo1" ON 1=1 WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))))`,
+		},
+		{
+			"@request.auth fields",
+			"demo4",
+			"@request.auth.id > true || @request.auth.username > true || @request.auth.rel.title > true || @request.body.demo < true || @request.auth.missingA.missingB > false",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `users` `__auth_users` ON `__auth_users`.`id`={:p0} LEFT JOIN `demo2` `__auth_users_rel` ON [[__auth_users_rel.id]] = [[__auth_users.rel]] WHERE ({:TEST} > 1 OR [[__auth_users.username]] > 1 OR [[__auth_users_rel.title]] > 1 OR NULL < 1 OR NULL > 0)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "users" "__auth_users" ON "__auth_users"."id"={:p0} LEFT JOIN "demo2" "__auth_users_rel" ON [[__auth_users_rel.id]] = [[__auth_users.rel]] WHERE ({:TEST} > TRUE OR [[__auth_users.username]] > TRUE OR [[__auth_users_rel.title]] > TRUE OR NULL < TRUE OR NULL > FALSE)`,
+		},
+		{
+			"@request.* static fields",
+			"demo4",
+			"@request.context = true || @request.query.a = true || @request.query.b = true || @request.query.missing = true || @request.headers.a = true || @request.headers.missing = true",
+			true,
+			/* SQLite:
+			"SELECT `demo4`.* FROM `demo4` WHERE ({:TEST} = 1 OR '' = 1 OR {:TEST} = 1 OR '' = 1 OR {:TEST} = 1 OR '' = 1)",
+			*/
+			// PostgreSQL:
+			`SELECT "demo4".* FROM "demo4" WHERE ({:TEST} = TRUE OR '' = TRUE OR {:TEST} = TRUE OR NULL = TRUE OR {:TEST} = TRUE OR NULL = TRUE)`,
+		},
+		{
+			"direct hidden field (add emailVisibility)",
+			"users",
+			"email > true",
+			false,
+			/* SQLite:
+			"SELECT `users`.* FROM `users` WHERE ((([[users.email]] > 1) AND ([[users.emailVisibility]] = TRUE)))",
+			*/
+			// PostgreSQL:
+			`SELECT "users".* FROM "users" WHERE ((([[users.email]] > TRUE) AND ([[users.emailVisibility]] = TRUE)))`,
+		},
+		{
+			"direct hidden field (force ignore emailVisibility)",
+			"users",
+			"email > true",
+			true,
+			/* SQLite:
+			"SELECT `users`.* FROM `users` WHERE [[users.email]] > 1",
+			*/
+			// PostgreSQL:
+			`SELECT "users".* FROM "users" WHERE [[users.email]] > TRUE`,
+		},
+		{
+			"mixed regular with hidden field and modifier (add emailVisibility)",
+			"nologin",
+			"id > true || email > true || email:lower > false",
+			false,
+			/* SQLite:
+			"SELECT `nologin`.* FROM `nologin` WHERE ([[nologin.id]] > 1 OR (([[nologin.email]] > 1) AND ([[nologin.emailVisibility]] = TRUE)) OR ((LOWER([[nologin.email]]) > 0) AND ([[nologin.emailVisibility]] = TRUE)))",
+			*/
+			`SELECT "nologin".* FROM "nologin" WHERE ([[nologin.id]] > TRUE OR (([[nologin.email]] > TRUE) AND ([[nologin.emailVisibility]] = TRUE)) OR ((LOWER([[nologin.email]]) > FALSE) AND ([[nologin.emailVisibility]] = TRUE)))`,
+		},
+		{
+			"system filters in a public auth collection with hidden field and no allowHiddenFields (multi-match and add emailVisibility)",
+			"demo4",
+			"@collection.nologin.email > true || @request.auth.email > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `nologin` `__collection_nologin` WHERE ((((([[__collection_nologin.email]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_nologin.email]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `nologin` `__mm___collection_nologin` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1))))) AND ([[__collection_nologin.emailVisibility]] = TRUE)) OR {:TEST} > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "nologin" "__collection_nologin" ON 1=1 WHERE ((((([[__collection_nologin.email]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_nologin.email]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "nologin" "__mm___collection_nologin" ON 1=1 WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE))))) AND ([[__collection_nologin.emailVisibility]] = TRUE)) OR {:TEST} > TRUE)`,
+		},
+		{
+			"system filters in a superuser auth collection with hidden field and NO allowHiddenFields (multi-match and add emailVisibility)",
+			"demo4",
+			"@collection.users.email > true || @request.auth.email > true",
+			false,
+			"",
+		},
+		{
+			"system filters in a superuser auth collection with hidden field and allowHiddenFields (multi-match and add emailVisibility)",
+			"demo4",
+			"@collection.users.email > true || @request.auth.email > true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `users` `__collection_users` WHERE ((([[__collection_users.email]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_users.email]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `users` `__mm___collection_users` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) OR {:TEST} > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "users" "__collection_users" ON 1=1 WHERE ((([[__collection_users.email]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_users.email]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "users" "__mm___collection_users" ON 1=1 WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) OR {:TEST} > TRUE)`,
+		},
+		{
+			"collection filter in a non-empty list rule collection",
+			"demo4",
+			"@collection.demo3.title > true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo3` `__collection_demo3` WHERE (({:TEST} IS NOT '' AND {:TEST} IS NOT {:TEST})) AND (((([[__collection_demo3.title]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo3.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo3` `__mm___collection_demo3` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1))))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo3" "__collection_demo3" ON 1=1 WHERE (({:TEST} IS DISTINCT FROM '' AND {:TEST} IS DISTINCT FROM {:TEST})) AND (((([[__collection_demo3.title]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo3.title]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "demo3" "__mm___collection_demo3" ON 1=1 WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE))))))`,
+		},
+		{
+			"collection filter in a non-empty list rule collection (with allowHiddenFields)",
+			"demo4",
+			"@collection.demo3.title > true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo3` `__collection_demo3` WHERE ((([[__collection_demo3.title]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo3.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo3` `__mm___collection_demo3` WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo3" "__collection_demo3" ON 1=1 WHERE ((([[__collection_demo3.title]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo3.title]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "demo3" "__mm___collection_demo3" ON 1=1 WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))))`,
+		},
+		{
+			"collection fields with :lower modifier",
+			"demo1",
+			"@request.body.rel_one:lower > true ||" +
+				"@request.body.rel_many:lower > true ||" +
+				"@request.body.rel_many.email:lower > true ||" +
+				"text:lower > true ||" +
+				"bool:lower > true ||" +
+				"url:lower > true ||" +
+				"select_one:lower > true ||" +
+				"select_many:lower > true ||" +
+				"file_one:lower > true ||" +
+				"file_many:lower > true ||" +
+				"number:lower > true ||" +
+				"email:lower > true ||" +
+				"datetime:lower > true ||" +
+				"json:lower > true ||" +
+				"rel_one:lower > true ||" +
+				"rel_many:lower > true ||" +
+				"rel_many.name:lower > true ||" +
+				"created:lower > true",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN `users` `__data_users_rel_many` ON [[__data_users_rel_many.id]] IN ({:p0}, {:p1}) LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo1.rel_many]]), json_type([[demo1.rel_many]])='array', FALSE) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END) `__je_demo1_rel_many` LEFT JOIN `users` `demo1_rel_many` ON [[demo1_rel_many.id]] = [[__je_demo1_rel_many.value]] WHERE (LOWER({:infoLowerrel_oneTEST}) > 1 OR LOWER({:infoLowerrel_manyTEST}) > 1 OR ((LOWER([[__data_users_rel_many.email]]) > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT LOWER([[__mm___data_users_rel_many.email]]) as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__mm___data_users_rel_many` ON [[__mm___data_users_rel_many.id]] IN ({:p4}, {:p5}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) OR LOWER([[demo1.text]]) > 1 OR LOWER([[demo1.bool]]) > 1 OR LOWER([[demo1.url]]) > 1 OR LOWER([[demo1.select_one]]) > 1 OR LOWER([[demo1.select_many]]) > 1 OR LOWER([[demo1.file_one]]) > 1 OR LOWER([[demo1.file_many]]) > 1 OR LOWER([[demo1.number]]) > 1 OR LOWER([[demo1.email]]) > 1 OR LOWER([[demo1.datetime]]) > 1 OR LOWER((CASE WHEN json_valid([[demo1.json]]) THEN JSON_EXTRACT([[demo1.json]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo1.json]]), '$.pb') END)) > 1 OR LOWER([[demo1.rel_one]]) > 1 OR LOWER([[demo1.rel_many]]) > 1 OR ((LOWER([[demo1_rel_many.name]]) > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT LOWER([[__mm_demo1_rel_many.name]]) as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.rel_many]]), json_type([[__mm_demo1.rel_many]])='array', FALSE) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) OR LOWER([[demo1.created]]) > 1)",
+			*/
+			`SELECT DISTINCT "demo1".* FROM "demo1" LEFT JOIN "users" "__data_users_rel_many" ON [[__data_users_rel_many.id]] IN ({:p0}, {:p1}) LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo1.rel_many]] IS JSON OR json_valid([[demo1.rel_many]]::text)) AND jsonb_typeof([[demo1.rel_many]]::jsonb) = 'array' THEN [[demo1.rel_many]]::jsonb ELSE jsonb_build_array([[demo1.rel_many]]) END) "__je_demo1_rel_many" ON 1=1 LEFT JOIN "users" "demo1_rel_many" ON [[demo1_rel_many.id]] = [[__je_demo1_rel_many.value]] WHERE (LOWER({:infoLowerrel_oneTEST}) > TRUE OR LOWER({:infoLowerrel_manyTEST}) > TRUE OR ((LOWER([[__data_users_rel_many.email]]) > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT LOWER([[__mm___data_users_rel_many.email]]) as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN "users" "__mm___data_users_rel_many" ON [[__mm___data_users_rel_many.id]] IN ({:p4}, {:p5}) WHERE "__mm_demo1"."id" = "demo1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) OR LOWER([[demo1.text]]) > TRUE OR LOWER([[demo1.bool]]) > TRUE OR LOWER([[demo1.url]]) > TRUE OR LOWER([[demo1.select_one]]) > TRUE OR LOWER([[demo1.select_many]]) > TRUE OR LOWER([[demo1.file_one]]) > TRUE OR LOWER([[demo1.file_many]]) > TRUE OR LOWER([[demo1.number]]) > TRUE OR LOWER([[demo1.email]]) > TRUE OR LOWER([[demo1.datetime]]) > TRUE OR LOWER(JSON_QUERY_OR_NULL([[demo1.json]], '$')::jsonb) > TRUE OR LOWER([[demo1.rel_one]]) > TRUE OR LOWER([[demo1.rel_many]]) > TRUE OR ((LOWER([[demo1_rel_many.name]]) > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT LOWER([[__mm_demo1_rel_many.name]]) as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.rel_many]] IS JSON OR json_valid([[__mm_demo1.rel_many]]::text)) AND jsonb_typeof([[__mm_demo1.rel_many]]::jsonb) = 'array' THEN [[__mm_demo1.rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.rel_many]]) END) "__mm_demo1_rel_many_je" ON 1=1 LEFT JOIN "users" "__mm_demo1_rel_many" ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE "__mm_demo1"."id" = "demo1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) OR LOWER([[demo1.created]]) > TRUE)`,
+		},
+		{
+			"static @request fields with :lower modifier",
+			"demo1",
+			"@request.body.a:lower > true ||" +
+				"@request.body.b:lower > true ||" +
+				"@request.body.c:lower > true ||" +
+				"@request.query.a:lower > true ||" +
+				"@request.query.b:lower > true ||" +
+				"@request.query.c:lower > true ||" +
+				"@request.headers.a:lower > true ||" +
+				"@request.headers.c:lower > true",
+			false,
+			/* SQLite:
+			"SELECT `demo1`.* FROM `demo1` WHERE (NULL > 1 OR LOWER({:TEST}) > 1 OR NULL > 1 OR LOWER({:TEST}) > 1 OR LOWER({:TEST}) > 1 OR NULL > 1 OR LOWER({:TEST}) > 1 OR NULL > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT "demo1".* FROM "demo1" WHERE (NULL > TRUE OR LOWER({:TEST}) > TRUE OR NULL > TRUE OR '' > TRUE OR LOWER({:TEST}) > TRUE OR NULL > TRUE OR LOWER({:TEST}) > TRUE OR NULL > TRUE)`,
+		},
+		{
+			"isset modifier",
+			"demo1",
+			"@request.body.a:isset > true ||" +
+				"@request.body.b:isset > true ||" +
+				"@request.body.c:isset > true ||" +
+				"@request.query.a:isset > true ||" +
+				"@request.query.b:isset > true ||" +
+				"@request.query.c:isset > true ||" +
+				"@request.headers.a:isset > true ||" +
+				"@request.headers.c:isset > true",
+			false,
+			/* SQLite:
+			"SELECT `demo1`.* FROM `demo1` WHERE (TRUE > 1 OR TRUE > 1 OR FALSE > 1 OR TRUE > 1 OR TRUE > 1 OR FALSE > 1 OR TRUE > 1 OR FALSE > 1)",
+			*/
+			// PostgreSQL:
+			`SELECT "demo1".* FROM "demo1" WHERE (TRUE > TRUE OR TRUE > TRUE OR FALSE > TRUE OR TRUE > TRUE OR TRUE > TRUE OR FALSE > TRUE OR TRUE > TRUE OR FALSE > TRUE)`,
+		},
+		{
+			"@request.body.rel.* fields",
+			"demo4",
+			"@request.body.rel_one_cascade.title > true &&" +
+				// reference the same as rel_one_cascade collection but should use a different join alias
+				"@request.body.rel_one_no_cascade.title < true &&" +
+				// different collection
+				"@request.body.self_rel_many.title = true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo3` `__data_demo3_rel_one_cascade` ON [[__data_demo3_rel_one_cascade.id]]={:p0} LEFT JOIN `demo3` `__data_demo3_rel_one_no_cascade` ON [[__data_demo3_rel_one_no_cascade.id]]={:p1} LEFT JOIN `demo4` `__data_demo4_self_rel_many` ON [[__data_demo4_self_rel_many.id]]={:p2} WHERE ((({:TEST} IS NOT '' AND {:TEST} IS NOT {:TEST})) AND (({:TEST} IS NOT '' AND {:TEST} IS NOT {:TEST}))) AND (([[__data_demo3_rel_one_cascade.title]] > 1 AND [[__data_demo3_rel_one_no_cascade.title]] < 1 AND (([[__data_demo4_self_rel_many.title]] = 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___data_demo4_self_rel_many.title]] as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo4` `__mm___data_demo4_self_rel_many` ON [[__mm___data_demo4_self_rel_many.id]]={:p11} WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = 1))))))",
+			*/
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo3" "__data_demo3_rel_one_cascade" ON [[__data_demo3_rel_one_cascade.id]]={:p0} LEFT JOIN "demo3" "__data_demo3_rel_one_no_cascade" ON [[__data_demo3_rel_one_no_cascade.id]]={:p1} LEFT JOIN "demo4" "__data_demo4_self_rel_many" ON [[__data_demo4_self_rel_many.id]]={:p2} WHERE ((({:TEST} IS DISTINCT FROM '' AND {:TEST} IS DISTINCT FROM {:TEST})) AND (({:TEST} IS DISTINCT FROM '' AND {:TEST} IS DISTINCT FROM {:TEST}))) AND (([[__data_demo3_rel_one_cascade.title]] > TRUE AND [[__data_demo3_rel_one_no_cascade.title]] < TRUE AND (([[__data_demo4_self_rel_many.title]] = TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___data_demo4_self_rel_many.title]] as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "demo4" "__mm___data_demo4_self_rel_many" ON [[__mm___data_demo4_self_rel_many.id]]={:p9} WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] = TRUE))))))`,
+		},
+		{
+			"@request.body.arrayble:each fields",
+			"demo1",
+			"@request.body.select_one:each > true &&" +
+				"@request.body.select_one:each ?< true &&" +
+				"@request.body.select_many:each > true &&" +
+				"@request.body.select_many:each ?< true &&" +
+				"@request.body.file_one:each > true &&" +
+				"@request.body.file_one:each ?< true &&" +
+				"@request.body.file_many:each > true &&" +
+				"@request.body.file_many:each ?< true &&" +
+				"@request.body.rel_one:each > true &&" +
+				"@request.body.rel_one:each ?< true &&" +
+				"@request.body.rel_many:each > true &&" +
+				"@request.body.rel_many:each ?< true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each({:dataEachTEST}) `__dataEach_je_select_one` LEFT JOIN json_each({:dataEachTEST}) `__dataEach_je_select_many` LEFT JOIN json_each({:dataEachTEST}) `__dataEach_je_file_one` LEFT JOIN json_each({:dataEachTEST}) `__dataEach_je_file_many` LEFT JOIN json_each({:dataEachTEST}) `__dataEach_je_rel_one` LEFT JOIN json_each({:dataEachTEST}) `__dataEach_je_rel_many` WHERE ([[__dataEach_je_select_one.value]] > 1 AND [[__dataEach_je_select_one.value]] < 1 AND (([[__dataEach_je_select_many.value]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___dataEach_je_select_many.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:mmdataEachTEST}) `__mm___dataEach_je_select_many` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) AND [[__dataEach_je_select_many.value]] < 1 AND [[__dataEach_je_file_one.value]] > 1 AND [[__dataEach_je_file_one.value]] < 1 AND (([[__dataEach_je_file_many.value]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___dataEach_je_file_many.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:mmdataEachTEST}) `__mm___dataEach_je_file_many` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) AND [[__dataEach_je_file_many.value]] < 1 AND [[__dataEach_je_rel_one.value]] > 1 AND [[__dataEach_je_rel_one.value]] < 1 AND (([[__dataEach_je_rel_many.value]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___dataEach_je_rel_many.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:mmdataEachTEST}) `__mm___dataEach_je_rel_many` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) AND [[__dataEach_je_rel_many.value]] < 1)",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo1".* FROM "demo1" LEFT JOIN jsonb_array_elements({:dataEachTEST}::jsonb) "__dataEach_je_select_one" ON 1=1 LEFT JOIN jsonb_array_elements({:dataEachTEST}::jsonb) "__dataEach_je_select_many" ON 1=1 LEFT JOIN jsonb_array_elements({:dataEachTEST}::jsonb) "__dataEach_je_file_one" ON 1=1 LEFT JOIN jsonb_array_elements({:dataEachTEST}::jsonb) "__dataEach_je_file_many" ON 1=1 LEFT JOIN jsonb_array_elements({:dataEachTEST}::jsonb) "__dataEach_je_rel_one" ON 1=1 LEFT JOIN jsonb_array_elements({:dataEachTEST}::jsonb) "__dataEach_je_rel_many" ON 1=1 WHERE ([[__dataEach_je_select_one.value]] > TRUE AND [[__dataEach_je_select_one.value]] < TRUE AND (([[__dataEach_je_select_many.value]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___dataEach_je_select_many.value]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements({:mmdataEachTEST}::jsonb) "__mm___dataEach_je_select_many" ON 1=1 WHERE "__mm_demo1"."id" = "demo1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) AND [[__dataEach_je_select_many.value]] < TRUE AND [[__dataEach_je_file_one.value]] > TRUE AND [[__dataEach_je_file_one.value]] < TRUE AND (([[__dataEach_je_file_many.value]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___dataEach_je_file_many.value]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements({:mmdataEachTEST}::jsonb) "__mm___dataEach_je_file_many" ON 1=1 WHERE "__mm_demo1"."id" = "demo1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) AND [[__dataEach_je_file_many.value]] < TRUE AND [[__dataEach_je_rel_one.value]] > TRUE AND [[__dataEach_je_rel_one.value]] < TRUE AND (([[__dataEach_je_rel_many.value]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___dataEach_je_rel_many.value]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements({:mmdataEachTEST}::jsonb) "__mm___dataEach_je_rel_many" ON 1=1 WHERE "__mm_demo1"."id" = "demo1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) AND [[__dataEach_je_rel_many.value]] < TRUE)`,
+		},
+		{
+			"regular arrayble:each fields",
+			"view1",
+			"select_one:each > true &&" +
+				"select_one:each ?< true &&" +
+				"select_many:each > true &&" +
+				"select_many:each ?< true &&" +
+				"file_one:each > true &&" +
+				"file_one:each ?< true &&" +
+				"file_many:each > true &&" +
+				"file_many:each ?< true &&" +
+				"rel_one:each > true &&" +
+				"rel_one:each ?< true &&" +
+				"rel_many:each > true &&" +
+				"rel_many:each ?< true",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `view1`.* FROM `view1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[view1.select_one]]), json_type([[view1.select_one]])='array', FALSE) THEN [[view1.select_one]] ELSE json_array([[view1.select_one]]) END) `__je_view1_select_one` LEFT JOIN json_each(CASE WHEN iif(json_valid([[view1.select_many]]), json_type([[view1.select_many]])='array', FALSE) THEN [[view1.select_many]] ELSE json_array([[view1.select_many]]) END) `__je_view1_select_many` LEFT JOIN json_each(CASE WHEN iif(json_valid([[view1.file_one]]), json_type([[view1.file_one]])='array', FALSE) THEN [[view1.file_one]] ELSE json_array([[view1.file_one]]) END) `__je_view1_file_one` LEFT JOIN json_each(CASE WHEN iif(json_valid([[view1.file_many]]), json_type([[view1.file_many]])='array', FALSE) THEN [[view1.file_many]] ELSE json_array([[view1.file_many]]) END) `__je_view1_file_many` LEFT JOIN json_each(CASE WHEN iif(json_valid([[view1.rel_one]]), json_type([[view1.rel_one]])='array', FALSE) THEN [[view1.rel_one]] ELSE json_array([[view1.rel_one]]) END) `__je_view1_rel_one` LEFT JOIN json_each(CASE WHEN iif(json_valid([[view1.rel_many]]), json_type([[view1.rel_many]])='array', FALSE) THEN [[view1.rel_many]] ELSE json_array([[view1.rel_many]]) END) `__je_view1_rel_many` WHERE ([[__je_view1_select_one.value]] > 1 AND [[__je_view1_select_one.value]] < 1 AND (([[__je_view1_select_many.value]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_view1_select_many.value]] as [[multiMatchValue]] FROM `view1` `__mm_view1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_view1.select_many]]), json_type([[__mm_view1.select_many]])='array', FALSE) THEN [[__mm_view1.select_many]] ELSE json_array([[__mm_view1.select_many]]) END) `__je___mm_view1_select_many` WHERE `__mm_view1`.`id` = `view1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) AND [[__je_view1_select_many.value]] < 1 AND [[__je_view1_file_one.value]] > 1 AND [[__je_view1_file_one.value]] < 1 AND (([[__je_view1_file_many.value]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_view1_file_many.value]] as [[multiMatchValue]] FROM `view1` `__mm_view1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_view1.file_many]]), json_type([[__mm_view1.file_many]])='array', FALSE) THEN [[__mm_view1.file_many]] ELSE json_array([[__mm_view1.file_many]]) END) `__je___mm_view1_file_many` WHERE `__mm_view1`.`id` = `view1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) AND [[__je_view1_file_many.value]] < 1 AND [[__je_view1_rel_one.value]] > 1 AND [[__je_view1_rel_one.value]] < 1 AND (([[__je_view1_rel_many.value]] > 1) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_view1_rel_many.value]] as [[multiMatchValue]] FROM `view1` `__mm_view1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_view1.rel_many]]), json_type([[__mm_view1.rel_many]])='array', FALSE) THEN [[__mm_view1.rel_many]] ELSE json_array([[__mm_view1.rel_many]]) END) `__je___mm_view1_rel_many` WHERE `__mm_view1`.`id` = `view1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > 1)))) AND [[__je_view1_rel_many.value]] < 1)",
+			*/
+			`SELECT DISTINCT "view1".* FROM "view1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[view1.select_one]] IS JSON OR json_valid([[view1.select_one]]::text)) AND jsonb_typeof([[view1.select_one]]::jsonb) = 'array' THEN [[view1.select_one]]::jsonb ELSE jsonb_build_array([[view1.select_one]]) END) "__je_view1_select_one" ON 1=1 LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[view1.select_many]] IS JSON OR json_valid([[view1.select_many]]::text)) AND jsonb_typeof([[view1.select_many]]::jsonb) = 'array' THEN [[view1.select_many]]::jsonb ELSE jsonb_build_array([[view1.select_many]]) END) "__je_view1_select_many" ON 1=1 LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[view1.file_one]] IS JSON OR json_valid([[view1.file_one]]::text)) AND jsonb_typeof([[view1.file_one]]::jsonb) = 'array' THEN [[view1.file_one]]::jsonb ELSE jsonb_build_array([[view1.file_one]]) END) "__je_view1_file_one" ON 1=1 LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[view1.file_many]] IS JSON OR json_valid([[view1.file_many]]::text)) AND jsonb_typeof([[view1.file_many]]::jsonb) = 'array' THEN [[view1.file_many]]::jsonb ELSE jsonb_build_array([[view1.file_many]]) END) "__je_view1_file_many" ON 1=1 LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[view1.rel_one]] IS JSON OR json_valid([[view1.rel_one]]::text)) AND jsonb_typeof([[view1.rel_one]]::jsonb) = 'array' THEN [[view1.rel_one]]::jsonb ELSE jsonb_build_array([[view1.rel_one]]) END) "__je_view1_rel_one" ON 1=1 LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[view1.rel_many]] IS JSON OR json_valid([[view1.rel_many]]::text)) AND jsonb_typeof([[view1.rel_many]]::jsonb) = 'array' THEN [[view1.rel_many]]::jsonb ELSE jsonb_build_array([[view1.rel_many]]) END) "__je_view1_rel_many" ON 1=1 WHERE ([[__je_view1_select_one.value]] > TRUE AND [[__je_view1_select_one.value]] < TRUE AND (([[__je_view1_select_many.value]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_view1_select_many.value]] as [[multiMatchValue]] FROM "view1" "__mm_view1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_view1.select_many]] IS JSON OR json_valid([[__mm_view1.select_many]]::text)) AND jsonb_typeof([[__mm_view1.select_many]]::jsonb) = 'array' THEN [[__mm_view1.select_many]]::jsonb ELSE jsonb_build_array([[__mm_view1.select_many]]) END) "__je___mm_view1_select_many" ON 1=1 WHERE "__mm_view1"."id" = "view1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) AND [[__je_view1_select_many.value]] < TRUE AND [[__je_view1_file_one.value]] > TRUE AND [[__je_view1_file_one.value]] < TRUE AND (([[__je_view1_file_many.value]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_view1_file_many.value]] as [[multiMatchValue]] FROM "view1" "__mm_view1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_view1.file_many]] IS JSON OR json_valid([[__mm_view1.file_many]]::text)) AND jsonb_typeof([[__mm_view1.file_many]]::jsonb) = 'array' THEN [[__mm_view1.file_many]]::jsonb ELSE jsonb_build_array([[__mm_view1.file_many]]) END) "__je___mm_view1_file_many" ON 1=1 WHERE "__mm_view1"."id" = "view1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) AND [[__je_view1_file_many.value]] < TRUE AND [[__je_view1_rel_one.value]] > TRUE AND [[__je_view1_rel_one.value]] < TRUE AND (([[__je_view1_rel_many.value]] > TRUE) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_view1_rel_many.value]] as [[multiMatchValue]] FROM "view1" "__mm_view1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_view1.rel_many]] IS JSON OR json_valid([[__mm_view1.rel_many]]::text)) AND jsonb_typeof([[__mm_view1.rel_many]]::jsonb) = 'array' THEN [[__mm_view1.rel_many]]::jsonb ELSE jsonb_build_array([[__mm_view1.rel_many]]) END) "__je___mm_view1_rel_many" ON 1=1 WHERE "__mm_view1"."id" = "view1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > TRUE)))) AND [[__je_view1_rel_many.value]] < TRUE)`,
+		},
+		{
+			"arrayble:each vs arrayble:each",
+			"demo1",
+			"select_one:each != select_many:each &&" +
+				"select_many:each > select_one:each &&" +
+				"select_many:each ?< select_one:each &&" +
+				"select_many:each = @request.body.select_many:each",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo1.select_one]]), json_type([[demo1.select_one]])='array', FALSE) THEN [[demo1.select_one]] ELSE json_array([[demo1.select_one]]) END) `__je_demo1_select_one` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo1.select_many]]), json_type([[demo1.select_many]])='array', FALSE) THEN [[demo1.select_many]] ELSE json_array([[demo1.select_many]]) END) `__je_demo1_select_many` LEFT JOIN json_each({:dataEachTEST}) `__dataEach_je_select_many` WHERE (((COALESCE([[__je_demo1_select_one.value]], '') IS NOT COALESCE([[__je_demo1_select_many.value]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_demo1_select_many.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.select_many]]), json_type([[__mm_demo1.select_many]])='array', FALSE) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__je___mm_demo1_select_many` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT (COALESCE([[__je_demo1_select_one.value]], '') IS NOT COALESCE([[__smTEST.multiMatchValue]], ''))))) AND (([[__je_demo1_select_many.value]] > [[__je_demo1_select_one.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_demo1_select_many.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.select_many]]), json_type([[__mm_demo1.select_many]])='array', FALSE) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__je___mm_demo1_select_many` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > [[__je_demo1_select_one.value]])))) AND [[__je_demo1_select_many.value]] < [[__je_demo1_select_one.value]] AND (([[__je_demo1_select_many.value]] = [[__dataEach_je_select_many.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_demo1_select_many.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.select_many]]), json_type([[__mm_demo1.select_many]])='array', FALSE) THEN [[__mm_demo1.select_many]] ELSE json_array([[__mm_demo1.select_many]]) END) `__je___mm_demo1_select_many` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm___dataEach_je_select_many.value]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each({:mmdataEachTEST}) `__mm___dataEach_je_select_many` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') = COALESCE([[__mrTEST.multiMatchValue]], ''))))))",
+			*/
+			`SELECT DISTINCT "demo1".* FROM "demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo1.select_one]] IS JSON OR json_valid([[demo1.select_one]]::text)) AND jsonb_typeof([[demo1.select_one]]::jsonb) = 'array' THEN [[demo1.select_one]]::jsonb ELSE jsonb_build_array([[demo1.select_one]]) END) "__je_demo1_select_one" ON 1=1 LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo1.select_many]] IS JSON OR json_valid([[demo1.select_many]]::text)) AND jsonb_typeof([[demo1.select_many]]::jsonb) = 'array' THEN [[demo1.select_many]]::jsonb ELSE jsonb_build_array([[demo1.select_many]]) END) "__je_demo1_select_many" ON 1=1 LEFT JOIN jsonb_array_elements({:dataEachTEST}::jsonb) "__dataEach_je_select_many" ON 1=1 WHERE (((to_jsonb([[__je_demo1_select_one.value]]) IS DISTINCT FROM to_jsonb([[__je_demo1_select_many.value]])) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_demo1_select_many.value]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.select_many]] IS JSON OR json_valid([[__mm_demo1.select_many]]::text)) AND jsonb_typeof([[__mm_demo1.select_many]]::jsonb) = 'array' THEN [[__mm_demo1.select_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.select_many]]) END) "__je___mm_demo1_select_many" ON 1=1 WHERE "__mm_demo1"."id" = "demo1"."id") {{__smTEST}} WHERE NOT (to_jsonb([[__je_demo1_select_one.value]]) IS DISTINCT FROM to_jsonb([[__smTEST.multiMatchValue]]))))) AND (([[__je_demo1_select_many.value]] > [[__je_demo1_select_one.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_demo1_select_many.value]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.select_many]] IS JSON OR json_valid([[__mm_demo1.select_many]]::text)) AND jsonb_typeof([[__mm_demo1.select_many]]::jsonb) = 'array' THEN [[__mm_demo1.select_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.select_many]]) END) "__je___mm_demo1_select_many" ON 1=1 WHERE "__mm_demo1"."id" = "demo1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] > [[__je_demo1_select_one.value]])))) AND [[__je_demo1_select_many.value]] < [[__je_demo1_select_one.value]] AND (([[__je_demo1_select_many.value]] = [[__dataEach_je_select_many.value]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__je___mm_demo1_select_many.value]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.select_many]] IS JSON OR json_valid([[__mm_demo1.select_many]]::text)) AND jsonb_typeof([[__mm_demo1.select_many]]::jsonb) = 'array' THEN [[__mm_demo1.select_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.select_many]]) END) "__je___mm_demo1_select_many" ON 1=1 WHERE "__mm_demo1"."id" = "demo1"."id") {{__mlTEST}} LEFT JOIN (SELECT [[__mm___dataEach_je_select_many.value]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements({:mmdataEachTEST}::jsonb) "__mm___dataEach_je_select_many" ON 1=1 WHERE "__mm_demo1"."id" = "demo1"."id") {{__mrTEST}} ON 1 = 1 WHERE NOT (to_jsonb([[__mlTEST.multiMatchValue]]) IS NOT DISTINCT FROM to_jsonb([[__mrTEST.multiMatchValue]]))))))`,
+		},
+		{
+			"mixed multi-match vs multi-match in superuser only collections",
+			"demo1",
+			"rel_many.rel.active != rel_many.name &&" +
+				"rel_many.rel.active ?= rel_many.name &&" +
+				"rel_many.rel.title ~ rel_one.email &&" +
+				"@collection.demo2.active = rel_many.rel.active &&" +
+				"@collection.demo2.active ?= rel_many.rel.active &&" +
+				"rel_many.verified > @request.body.rel_many.verified",
+			false,
+			"",
+		},
+		{
+			"mixed multi-match vs multi-match in superuser only collections (with allowHiddenFields)",
+			"demo1",
+			"rel_many.rel.active != rel_many.name &&" +
+				"rel_many.rel.active ?= rel_many.name &&" +
+				"rel_many.rel.title ~ rel_one.email &&" +
+				"@collection.demo2.active = rel_many.rel.active &&" +
+				"@collection.demo2.active ?= rel_many.rel.active &&" +
+				"rel_many.verified > @request.body.rel_many.verified",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo1`.* FROM `demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo1.rel_many]]), json_type([[demo1.rel_many]])='array', FALSE) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END) `__je_demo1_rel_many` LEFT JOIN `users` `demo1_rel_many` ON [[demo1_rel_many.id]] = [[__je_demo1_rel_many.value]] LEFT JOIN `demo2` `demo1_rel_many_rel` ON [[demo1_rel_many_rel.id]] = [[demo1_rel_many.rel]] LEFT JOIN `demo1` `demo1_rel_one` ON [[demo1_rel_one.id]] = [[demo1.rel_one]] LEFT JOIN `demo2` `__collection_demo2` LEFT JOIN `users` `__data_users_rel_many` ON [[__data_users_rel_many.id]] IN ({:p0}, {:p1}) WHERE (((COALESCE([[demo1_rel_many_rel.active]], '') IS NOT COALESCE([[demo1_rel_many.name]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.rel_many]]), json_type([[__mm_demo1.rel_many]])='array', FALSE) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many.name]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.rel_many]]), json_type([[__mm_demo1.rel_many]])='array', FALSE) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') IS NOT COALESCE([[__mrTEST.multiMatchValue]], ''))))) AND COALESCE([[demo1_rel_many_rel.active]], '') = COALESCE([[demo1_rel_many.name]], '') AND (([[demo1_rel_many_rel.title]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\\') AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.title]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.rel_many]]), json_type([[__mm_demo1.rel_many]])='array', FALSE) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\\')))) AND ((COALESCE([[__collection_demo2.active]], '') = COALESCE([[demo1_rel_many_rel.active]], '')) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo2.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `demo2` `__mm___collection_demo2` WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.rel_many]]), json_type([[__mm_demo1.rel_many]])='array', FALSE) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN `demo2` `__mm_demo1_rel_many_rel` ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT (COALESCE([[__mlTEST.multiMatchValue]], '') = COALESCE([[__mrTEST.multiMatchValue]], ''))))) AND COALESCE([[__collection_demo2.active]], '') = COALESCE([[demo1_rel_many_rel.active]], '') AND (([[demo1_rel_many.verified]] > [[__data_users_rel_many.verified]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many.verified]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo1.rel_many]]), json_type([[__mm_demo1.rel_many]])='array', FALSE) THEN [[__mm_demo1.rel_many]] ELSE json_array([[__mm_demo1.rel_many]]) END) `__mm_demo1_rel_many_je` LEFT JOIN `users` `__mm_demo1_rel_many` ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mlTEST}} LEFT JOIN (SELECT [[__mm___data_users_rel_many.verified]] as [[multiMatchValue]] FROM `demo1` `__mm_demo1` LEFT JOIN `users` `__mm___data_users_rel_many` ON [[__mm___data_users_rel_many.id]] IN ({:p2}, {:p3}) WHERE `__mm_demo1`.`id` = `demo1`.`id`) {{__mrTEST}} WHERE NOT ([[__mlTEST.multiMatchValue]] > [[__mrTEST.multiMatchValue]])))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo1".* FROM "demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo1.rel_many]] IS JSON OR json_valid([[demo1.rel_many]]::text)) AND jsonb_typeof([[demo1.rel_many]]::jsonb) = 'array' THEN [[demo1.rel_many]]::jsonb ELSE jsonb_build_array([[demo1.rel_many]]) END) "__je_demo1_rel_many" ON 1=1 LEFT JOIN "users" "demo1_rel_many" ON [[demo1_rel_many.id]] = [[__je_demo1_rel_many.value]] LEFT JOIN "demo2" "demo1_rel_many_rel" ON [[demo1_rel_many_rel.id]] = [[demo1_rel_many.rel]] LEFT JOIN "demo1" "demo1_rel_one" ON [[demo1_rel_one.id]] = [[demo1.rel_one]] LEFT JOIN "demo2" "__collection_demo2" ON 1=1 LEFT JOIN "users" "__data_users_rel_many" ON [[__data_users_rel_many.id]] IN ({:p0}, {:p1}) WHERE (((to_jsonb([[demo1_rel_many_rel.active]]) IS DISTINCT FROM to_jsonb([[demo1_rel_many.name]])) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.rel_many]] IS JSON OR json_valid([[__mm_demo1.rel_many]]::text)) AND jsonb_typeof([[__mm_demo1.rel_many]]::jsonb) = 'array' THEN [[__mm_demo1.rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.rel_many]]) END) "__mm_demo1_rel_many_je" ON 1=1 LEFT JOIN "users" "__mm_demo1_rel_many" ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN "demo2" "__mm_demo1_rel_many_rel" ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE "__mm_demo1"."id" = "demo1"."id") {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many.name]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.rel_many]] IS JSON OR json_valid([[__mm_demo1.rel_many]]::text)) AND jsonb_typeof([[__mm_demo1.rel_many]]::jsonb) = 'array' THEN [[__mm_demo1.rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.rel_many]]) END) "__mm_demo1_rel_many_je" ON 1=1 LEFT JOIN "users" "__mm_demo1_rel_many" ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE "__mm_demo1"."id" = "demo1"."id") {{__mrTEST}} ON 1 = 1 WHERE NOT (to_jsonb([[__mlTEST.multiMatchValue]]) IS DISTINCT FROM to_jsonb([[__mrTEST.multiMatchValue]]))))) AND to_jsonb([[demo1_rel_many_rel.active]]) IS NOT DISTINCT FROM to_jsonb([[demo1_rel_many.name]]) AND (([[demo1_rel_many_rel.title]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\') AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many_rel.title]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.rel_many]] IS JSON OR json_valid([[__mm_demo1.rel_many]]::text)) AND jsonb_typeof([[__mm_demo1.rel_many]]::jsonb) = 'array' THEN [[__mm_demo1.rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.rel_many]]) END) "__mm_demo1_rel_many_je" ON 1=1 LEFT JOIN "users" "__mm_demo1_rel_many" ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN "demo2" "__mm_demo1_rel_many_rel" ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE "__mm_demo1"."id" = "demo1"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] LIKE ('%' || [[demo1_rel_one.email]] || '%') ESCAPE '\')))) AND ((to_jsonb([[__collection_demo2.active]]) IS NOT DISTINCT FROM to_jsonb([[demo1_rel_many_rel.active]])) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm___collection_demo2.active]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN "demo2" "__mm___collection_demo2" ON 1=1 WHERE "__mm_demo1"."id" = "demo1"."id") {{__mlTEST}} LEFT JOIN (SELECT [[__mm_demo1_rel_many_rel.active]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.rel_many]] IS JSON OR json_valid([[__mm_demo1.rel_many]]::text)) AND jsonb_typeof([[__mm_demo1.rel_many]]::jsonb) = 'array' THEN [[__mm_demo1.rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.rel_many]]) END) "__mm_demo1_rel_many_je" ON 1=1 LEFT JOIN "users" "__mm_demo1_rel_many" ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] LEFT JOIN "demo2" "__mm_demo1_rel_many_rel" ON [[__mm_demo1_rel_many_rel.id]] = [[__mm_demo1_rel_many.rel]] WHERE "__mm_demo1"."id" = "demo1"."id") {{__mrTEST}} ON 1 = 1 WHERE NOT (to_jsonb([[__mlTEST.multiMatchValue]]) IS NOT DISTINCT FROM to_jsonb([[__mrTEST.multiMatchValue]]))))) AND to_jsonb([[__collection_demo2.active]]) IS NOT DISTINCT FROM to_jsonb([[demo1_rel_many_rel.active]]) AND (([[demo1_rel_many.verified]] > [[__data_users_rel_many.verified]]) AND (NOT EXISTS (SELECT 1 FROM (SELECT [[__mm_demo1_rel_many.verified]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo1.rel_many]] IS JSON OR json_valid([[__mm_demo1.rel_many]]::text)) AND jsonb_typeof([[__mm_demo1.rel_many]]::jsonb) = 'array' THEN [[__mm_demo1.rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo1.rel_many]]) END) "__mm_demo1_rel_many_je" ON 1=1 LEFT JOIN "users" "__mm_demo1_rel_many" ON [[__mm_demo1_rel_many.id]] = [[__mm_demo1_rel_many_je.value]] WHERE "__mm_demo1"."id" = "demo1"."id") {{__mlTEST}} LEFT JOIN (SELECT [[__mm___data_users_rel_many.verified]] as [[multiMatchValue]] FROM "demo1" "__mm_demo1" LEFT JOIN "users" "__mm___data_users_rel_many" ON [[__mm___data_users_rel_many.id]] IN ({:p2}, {:p3}) WHERE "__mm_demo1"."id" = "demo1"."id") {{__mrTEST}} ON 1 = 1 WHERE NOT ([[__mlTEST.multiMatchValue]] > [[__mrTEST.multiMatchValue]])))))`,
+		},
+		{
+			"@request.body.arrayable:length fields",
+			"demo1",
+			"@request.body.select_one:length > 1 &&" +
+				"@request.body.select_one:length ?> 2 &&" +
+				"@request.body.select_many:length < 3 &&" +
+				"@request.body.select_many:length ?> 4 &&" +
+				"@request.body.rel_one:length = 5 &&" +
+				"@request.body.rel_one:length ?= 6 &&" +
+				"@request.body.rel_many:length != 7 &&" +
+				"@request.body.rel_many:length ?!= 8 &&" +
+				"@request.body.file_one:length = 9 &&" +
+				"@request.body.file_one:length ?= 0 &&" +
+				"@request.body.file_many:length != 1 &&" +
+				"@request.body.file_many:length ?!= 2",
+			false,
+			/* SQLite:
+			"SELECT `demo1`.* FROM `demo1` WHERE (0 > {:TEST} AND 0 > {:TEST} AND 2 < {:TEST} AND 2 > {:TEST} AND 1 = {:TEST} AND 1 = {:TEST} AND 2 IS NOT {:TEST} AND 2 IS NOT {:TEST} AND 1 = {:TEST} AND 1 = {:TEST} AND 3 IS NOT {:TEST} AND 3 IS NOT {:TEST})",
+			*/
+			// PostgreSQL:
+			`SELECT "demo1".* FROM "demo1" WHERE (0 > 1 AND 0 > 2 AND 2 < 3 AND 2 > 4 AND 1 = 5 AND 1 = 6 AND 2 IS DISTINCT FROM 7 AND 2 IS DISTINCT FROM 8 AND 1 = 9 AND 1 = 0 AND 3 IS DISTINCT FROM 1 AND 3 IS DISTINCT FROM 2)`,
+		},
+		{
+			"regular arrayable:length fields",
+			"demo4",
+			"@request.body.self_rel_one.self_rel_many:length > 1 &&" +
+				"@request.body.self_rel_one.self_rel_many:length ?> 2 &&" +
+				"@request.body.rel_many_cascade.files:length ?< 3 &&" +
+				"@request.body.rel_many_cascade.files:length < 4 &&" +
+				"@request.body.rel_one_cascade.files:length < 4.1 &&" + // to ensure that the join to the same as above table will be aliased
+				"self_rel_one.self_rel_many:length = 5 &&" +
+				"self_rel_one.self_rel_many:length ?= 6 &&" +
+				"self_rel_one.rel_many_cascade.files:length != 7 &&" +
+				"self_rel_one.rel_many_cascade.files:length ?!= 8",
+			true,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN `demo4` `__data_demo4_self_rel_one` ON [[__data_demo4_self_rel_one.id]]={:p0} LEFT JOIN `demo3` `__data_demo3_rel_many_cascade` ON [[__data_demo3_rel_many_cascade.id]] IN ({:p1}, {:p2}) LEFT JOIN `demo3` `__data_demo3_rel_one_cascade` ON [[__data_demo3_rel_one_cascade.id]]={:p3} LEFT JOIN `demo4` `demo4_self_rel_one` ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4_self_rel_one.rel_many_cascade]]), json_type([[demo4_self_rel_one.rel_many_cascade]])='array', FALSE) THEN [[demo4_self_rel_one.rel_many_cascade]] ELSE json_array([[demo4_self_rel_one.rel_many_cascade]]) END) `__je_demo4_self_rel_one_rel_many_cascade` LEFT JOIN `demo3` `demo4_self_rel_one_rel_many_cascade` ON [[demo4_self_rel_one_rel_many_cascade.id]] = [[__je_demo4_self_rel_one_rel_many_cascade.value]] WHERE (json_array_length(CASE WHEN iif(json_valid([[__data_demo4_self_rel_one.self_rel_many]]), json_type([[__data_demo4_self_rel_one.self_rel_many]])='array', FALSE) THEN [[__data_demo4_self_rel_one.self_rel_many]] ELSE (CASE WHEN [[__data_demo4_self_rel_one.self_rel_many]] = '' OR [[__data_demo4_self_rel_one.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[__data_demo4_self_rel_one.self_rel_many]]) END) END) > {:TEST} AND json_array_length(CASE WHEN iif(json_valid([[__data_demo4_self_rel_one.self_rel_many]]), json_type([[__data_demo4_self_rel_one.self_rel_many]])='array', FALSE) THEN [[__data_demo4_self_rel_one.self_rel_many]] ELSE (CASE WHEN [[__data_demo4_self_rel_one.self_rel_many]] = '' OR [[__data_demo4_self_rel_one.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[__data_demo4_self_rel_one.self_rel_many]]) END) END) > {:TEST} AND json_array_length(CASE WHEN iif(json_valid([[__data_demo3_rel_many_cascade.files]]), json_type([[__data_demo3_rel_many_cascade.files]])='array', FALSE) THEN [[__data_demo3_rel_many_cascade.files]] ELSE (CASE WHEN [[__data_demo3_rel_many_cascade.files]] = '' OR [[__data_demo3_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[__data_demo3_rel_many_cascade.files]]) END) END) < {:TEST} AND ((json_array_length(CASE WHEN iif(json_valid([[__data_demo3_rel_many_cascade.files]]), json_type([[__data_demo3_rel_many_cascade.files]])='array', FALSE) THEN [[__data_demo3_rel_many_cascade.files]] ELSE (CASE WHEN [[__data_demo3_rel_many_cascade.files]] = '' OR [[__data_demo3_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[__data_demo3_rel_many_cascade.files]]) END) END) < {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT json_array_length(CASE WHEN iif(json_valid([[__mm___data_demo3_rel_many_cascade.files]]), json_type([[__mm___data_demo3_rel_many_cascade.files]])='array', FALSE) THEN [[__mm___data_demo3_rel_many_cascade.files]] ELSE (CASE WHEN [[__mm___data_demo3_rel_many_cascade.files]] = '' OR [[__mm___data_demo3_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[__mm___data_demo3_rel_many_cascade.files]]) END) END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo3` `__mm___data_demo3_rel_many_cascade` ON [[__mm___data_demo3_rel_many_cascade.id]] IN ({:p8}, {:p9}) WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] < {:TEST})))) AND json_array_length(CASE WHEN iif(json_valid([[__data_demo3_rel_one_cascade.files]]), json_type([[__data_demo3_rel_one_cascade.files]])='array', FALSE) THEN [[__data_demo3_rel_one_cascade.files]] ELSE (CASE WHEN [[__data_demo3_rel_one_cascade.files]] = '' OR [[__data_demo3_rel_one_cascade.files]] IS NULL THEN json_array() ELSE json_array([[__data_demo3_rel_one_cascade.files]]) END) END) < {:TEST} AND json_array_length(CASE WHEN iif(json_valid([[demo4_self_rel_one.self_rel_many]]), json_type([[demo4_self_rel_one.self_rel_many]])='array', FALSE) THEN [[demo4_self_rel_one.self_rel_many]] ELSE (CASE WHEN [[demo4_self_rel_one.self_rel_many]] = '' OR [[demo4_self_rel_one.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one.self_rel_many]]) END) END) = {:TEST} AND json_array_length(CASE WHEN iif(json_valid([[demo4_self_rel_one.self_rel_many]]), json_type([[demo4_self_rel_one.self_rel_many]])='array', FALSE) THEN [[demo4_self_rel_one.self_rel_many]] ELSE (CASE WHEN [[demo4_self_rel_one.self_rel_many]] = '' OR [[demo4_self_rel_one.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one.self_rel_many]]) END) END) = {:TEST} AND ((json_array_length(CASE WHEN iif(json_valid([[demo4_self_rel_one_rel_many_cascade.files]]), json_type([[demo4_self_rel_one_rel_many_cascade.files]])='array', FALSE) THEN [[demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one_rel_many_cascade.files]]) END) END) IS NOT {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT json_array_length(CASE WHEN iif(json_valid([[__mm_demo4_self_rel_one_rel_many_cascade.files]]), json_type([[__mm_demo4_self_rel_one_rel_many_cascade.files]])='array', FALSE) THEN [[__mm_demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[__mm_demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[__mm_demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[__mm_demo4_self_rel_one_rel_many_cascade.files]]) END) END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN `demo4` `__mm_demo4_self_rel_one` ON [[__mm_demo4_self_rel_one.id]] = [[__mm_demo4.self_rel_one]] LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4_self_rel_one.rel_many_cascade]]), json_type([[__mm_demo4_self_rel_one.rel_many_cascade]])='array', FALSE) THEN [[__mm_demo4_self_rel_one.rel_many_cascade]] ELSE json_array([[__mm_demo4_self_rel_one.rel_many_cascade]]) END) `__mm_demo4_self_rel_one_rel_many_cascade_je` LEFT JOIN `demo3` `__mm_demo4_self_rel_one_rel_many_cascade` ON [[__mm_demo4_self_rel_one_rel_many_cascade.id]] = [[__mm_demo4_self_rel_one_rel_many_cascade_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] IS NOT {:TEST})))) AND json_array_length(CASE WHEN iif(json_valid([[demo4_self_rel_one_rel_many_cascade.files]]), json_type([[demo4_self_rel_one_rel_many_cascade.files]])='array', FALSE) THEN [[demo4_self_rel_one_rel_many_cascade.files]] ELSE (CASE WHEN [[demo4_self_rel_one_rel_many_cascade.files]] = '' OR [[demo4_self_rel_one_rel_many_cascade.files]] IS NULL THEN json_array() ELSE json_array([[demo4_self_rel_one_rel_many_cascade.files]]) END) END) IS NOT {:TEST})",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN "demo4" "__data_demo4_self_rel_one" ON [[__data_demo4_self_rel_one.id]]={:p0} LEFT JOIN "demo3" "__data_demo3_rel_many_cascade" ON [[__data_demo3_rel_many_cascade.id]] IN ({:p1}, {:p2}) LEFT JOIN "demo3" "__data_demo3_rel_one_cascade" ON [[__data_demo3_rel_one_cascade.id]]={:p3} LEFT JOIN "demo4" "demo4_self_rel_one" ON [[demo4_self_rel_one.id]] = [[demo4.self_rel_one]] LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4_self_rel_one.rel_many_cascade]] IS JSON OR json_valid([[demo4_self_rel_one.rel_many_cascade]]::text)) AND jsonb_typeof([[demo4_self_rel_one.rel_many_cascade]]::jsonb) = 'array' THEN [[demo4_self_rel_one.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[demo4_self_rel_one.rel_many_cascade]]) END) "__je_demo4_self_rel_one_rel_many_cascade" ON 1=1 LEFT JOIN "demo3" "demo4_self_rel_one_rel_many_cascade" ON [[demo4_self_rel_one_rel_many_cascade.id]] = [[__je_demo4_self_rel_one_rel_many_cascade.value]] WHERE ((CASE WHEN ([[__data_demo4_self_rel_one.self_rel_many]] IS JSON OR JSON_VALID([[__data_demo4_self_rel_one.self_rel_many]]::text)) AND jsonb_typeof([[__data_demo4_self_rel_one.self_rel_many]]::jsonb) = 'array' THEN jsonb_array_length([[__data_demo4_self_rel_one.self_rel_many]]::jsonb) ELSE 0 END) > 1 AND (CASE WHEN ([[__data_demo4_self_rel_one.self_rel_many]] IS JSON OR JSON_VALID([[__data_demo4_self_rel_one.self_rel_many]]::text)) AND jsonb_typeof([[__data_demo4_self_rel_one.self_rel_many]]::jsonb) = 'array' THEN jsonb_array_length([[__data_demo4_self_rel_one.self_rel_many]]::jsonb) ELSE 0 END) > 2 AND (CASE WHEN ([[__data_demo3_rel_many_cascade.files]] IS JSON OR JSON_VALID([[__data_demo3_rel_many_cascade.files]]::text)) AND jsonb_typeof([[__data_demo3_rel_many_cascade.files]]::jsonb) = 'array' THEN jsonb_array_length([[__data_demo3_rel_many_cascade.files]]::jsonb) ELSE 0 END) < 3 AND (((CASE WHEN ([[__data_demo3_rel_many_cascade.files]] IS JSON OR JSON_VALID([[__data_demo3_rel_many_cascade.files]]::text)) AND jsonb_typeof([[__data_demo3_rel_many_cascade.files]]::jsonb) = 'array' THEN jsonb_array_length([[__data_demo3_rel_many_cascade.files]]::jsonb) ELSE 0 END) < 4) AND (NOT EXISTS (SELECT 1 FROM (SELECT (CASE WHEN ([[__mm___data_demo3_rel_many_cascade.files]] IS JSON OR JSON_VALID([[__mm___data_demo3_rel_many_cascade.files]]::text)) AND jsonb_typeof([[__mm___data_demo3_rel_many_cascade.files]]::jsonb) = 'array' THEN jsonb_array_length([[__mm___data_demo3_rel_many_cascade.files]]::jsonb) ELSE 0 END) as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "demo3" "__mm___data_demo3_rel_many_cascade" ON [[__mm___data_demo3_rel_many_cascade.id]] IN ({:p4}, {:p5}) WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] < 4)))) AND (CASE WHEN ([[__data_demo3_rel_one_cascade.files]] IS JSON OR JSON_VALID([[__data_demo3_rel_one_cascade.files]]::text)) AND jsonb_typeof([[__data_demo3_rel_one_cascade.files]]::jsonb) = 'array' THEN jsonb_array_length([[__data_demo3_rel_one_cascade.files]]::jsonb) ELSE 0 END) < 4.1 AND (CASE WHEN ([[demo4_self_rel_one.self_rel_many]] IS JSON OR JSON_VALID([[demo4_self_rel_one.self_rel_many]]::text)) AND jsonb_typeof([[demo4_self_rel_one.self_rel_many]]::jsonb) = 'array' THEN jsonb_array_length([[demo4_self_rel_one.self_rel_many]]::jsonb) ELSE 0 END) = 5 AND (CASE WHEN ([[demo4_self_rel_one.self_rel_many]] IS JSON OR JSON_VALID([[demo4_self_rel_one.self_rel_many]]::text)) AND jsonb_typeof([[demo4_self_rel_one.self_rel_many]]::jsonb) = 'array' THEN jsonb_array_length([[demo4_self_rel_one.self_rel_many]]::jsonb) ELSE 0 END) = 6 AND (((CASE WHEN ([[demo4_self_rel_one_rel_many_cascade.files]] IS JSON OR JSON_VALID([[demo4_self_rel_one_rel_many_cascade.files]]::text)) AND jsonb_typeof([[demo4_self_rel_one_rel_many_cascade.files]]::jsonb) = 'array' THEN jsonb_array_length([[demo4_self_rel_one_rel_many_cascade.files]]::jsonb) ELSE 0 END) IS DISTINCT FROM 7) AND (NOT EXISTS (SELECT 1 FROM (SELECT (CASE WHEN ([[__mm_demo4_self_rel_one_rel_many_cascade.files]] IS JSON OR JSON_VALID([[__mm_demo4_self_rel_one_rel_many_cascade.files]]::text)) AND jsonb_typeof([[__mm_demo4_self_rel_one_rel_many_cascade.files]]::jsonb) = 'array' THEN jsonb_array_length([[__mm_demo4_self_rel_one_rel_many_cascade.files]]::jsonb) ELSE 0 END) as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN "demo4" "__mm_demo4_self_rel_one" ON [[__mm_demo4_self_rel_one.id]] = [[__mm_demo4.self_rel_one]] LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4_self_rel_one.rel_many_cascade]] IS JSON OR json_valid([[__mm_demo4_self_rel_one.rel_many_cascade]]::text)) AND jsonb_typeof([[__mm_demo4_self_rel_one.rel_many_cascade]]::jsonb) = 'array' THEN [[__mm_demo4_self_rel_one.rel_many_cascade]]::jsonb ELSE jsonb_build_array([[__mm_demo4_self_rel_one.rel_many_cascade]]) END) "__mm_demo4_self_rel_one_rel_many_cascade_je" ON 1=1 LEFT JOIN "demo3" "__mm_demo4_self_rel_one_rel_many_cascade" ON [[__mm_demo4_self_rel_one_rel_many_cascade.id]] = [[__mm_demo4_self_rel_one_rel_many_cascade_je.value]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] IS DISTINCT FROM 7)))) AND (CASE WHEN ([[demo4_self_rel_one_rel_many_cascade.files]] IS JSON OR JSON_VALID([[demo4_self_rel_one_rel_many_cascade.files]]::text)) AND jsonb_typeof([[demo4_self_rel_one_rel_many_cascade.files]]::jsonb) = 'array' THEN jsonb_array_length([[demo4_self_rel_one_rel_many_cascade.files]]::jsonb) ELSE 0 END) IS DISTINCT FROM 8)`,
+		},
+		{
+			"request body :changed modifier with non-existing collection field",
+			"demo1",
+			"@request.body.a:changed > 1",
+			true,
+			"",
+		},
+		{
+			"regular body :changed modifier",
+			"demo1",
+			"@request.body.number:changed = false &&" +
+				"@request.body.email:changed = true &&" +
+				"@request.body.number:changed = @request.body.select_many:changed",
+			true,
+			/* SQLite:
+			"SELECT `demo1`.* FROM `demo1` WHERE ((TRUE = 1 AND {:TEST} IS NOT [[demo1.number]]) IS 0 AND (FALSE = 1 AND ('' IS NOT [[demo1.email]] AND [[demo1.email]] IS NOT NULL)) IS 1 AND (TRUE = 1 AND {:TEST} IS NOT [[demo1.number]]) IS (TRUE = 1 AND {:TEST} IS NOT [[demo1.select_many]]))",
+			*/
+			// PostgreSQL:
+			`SELECT "demo1".* FROM "demo1" WHERE ((TRUE = TRUE AND {:TEST} IS DISTINCT FROM [[demo1.number]]) IS NOT DISTINCT FROM FALSE AND (FALSE = TRUE AND ('' IS DISTINCT FROM [[demo1.email]]::text AND [[demo1.email]] IS NOT NULL)) IS NOT DISTINCT FROM TRUE AND (TRUE = TRUE AND {:TEST} IS DISTINCT FROM [[demo1.number]]) IS NOT DISTINCT FROM (TRUE = TRUE AND {:TEST} IS DISTINCT FROM [[demo1.select_many]]))`,
+		},
+		{
+			"json_extract and json_array_length COALESCE equal normalizations",
+			"demo4",
+			"json_object.a.b = '' && self_rel_many:length != 2 && json_object.a.b > 3 && self_rel_many:length <= 4",
+			false,
+			/* SQLite:
+			"SELECT `demo4`.* FROM `demo4` WHERE ((CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$.a.b') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb.a.b') END) IS {:TEST} AND json_array_length(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE (CASE WHEN [[demo4.self_rel_many]] = '' OR [[demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4.self_rel_many]]) END) END) IS NOT {:TEST} AND (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$.a.b') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb.a.b') END) > {:TEST} AND json_array_length(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE (CASE WHEN [[demo4.self_rel_many]] = '' OR [[demo4.self_rel_many]] IS NULL THEN json_array() ELSE json_array([[demo4.self_rel_many]]) END) END) <= {:TEST})",
+			*/
+			// PostgreSQL:
+			`SELECT "demo4".* FROM "demo4" WHERE (JSON_QUERY_OR_NULL([[demo4.json_object]], '$.a.b')::jsonb IS NOT DISTINCT FROM to_jsonb(''::text) AND (CASE WHEN ([[demo4.self_rel_many]] IS JSON OR JSON_VALID([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN jsonb_array_length([[demo4.self_rel_many]]::jsonb) ELSE 0 END) IS DISTINCT FROM 2 AND JSON_QUERY_OR_NULL([[demo4.json_object]], '$.a.b')::jsonb::numeric > 3 AND (CASE WHEN ([[demo4.self_rel_many]] IS JSON OR JSON_VALID([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN jsonb_array_length([[demo4.self_rel_many]]::jsonb) ELSE 0 END) <= 4)`,
+		},
+		{
+			"json field equal normalization checks",
+			"demo4",
+			"json_object = '' || json_object != '' || '' = json_object || '' != json_object ||" +
+				"json_object = null || json_object != null || null = json_object || null != json_object ||" +
+				"json_object = true || json_object != true || true = json_object || true != json_object ||" +
+				"json_object = json_object || json_object != json_object ||" +
+				"json_object = title || title != json_object ||" +
+				// multimatch expressions
+				"self_rel_many.json_object = '' || null = self_rel_many.json_object ||" +
+				"self_rel_many.json_object = self_rel_many.json_object",
+			false,
+			/* SQLite:
+			"SELECT DISTINCT `demo4`.* FROM `demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[demo4.self_rel_many]]), json_type([[demo4.self_rel_many]])='array', FALSE) THEN [[demo4.self_rel_many]] ELSE json_array([[demo4.self_rel_many]]) END) `__je_demo4_self_rel_many` LEFT JOIN `demo4` `demo4_self_rel_many` ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] WHERE ((CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS {:TEST} OR (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS NOT {:TEST} OR {:TEST} IS (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR {:TEST} IS NOT (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS NULL OR (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS NOT NULL OR NULL IS (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR NULL IS NOT (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS 1 OR (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS NOT 1 OR 1 IS (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR 1 IS NOT (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS NOT (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) IS [[demo4.title]] OR [[demo4.title]] IS NOT (CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb') END) OR (((CASE WHEN json_valid([[demo4_self_rel_many.json_object]]) THEN JSON_EXTRACT([[demo4_self_rel_many.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4_self_rel_many.json_object]]), '$.pb') END) IS {:TEST}) AND (NOT EXISTS (SELECT 1 FROM (SELECT (CASE WHEN json_valid([[__mm_demo4_self_rel_many.json_object]]) THEN JSON_EXTRACT([[__mm_demo4_self_rel_many.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[__mm_demo4_self_rel_many.json_object]]), '$.pb') END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4.self_rel_many]]), json_type([[__mm_demo4.self_rel_many]])='array', FALSE) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] IS {:TEST})))) OR ((NULL IS (CASE WHEN json_valid([[demo4_self_rel_many.json_object]]) THEN JSON_EXTRACT([[demo4_self_rel_many.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4_self_rel_many.json_object]]), '$.pb') END)) AND (NOT EXISTS (SELECT 1 FROM (SELECT (CASE WHEN json_valid([[__mm_demo4_self_rel_many.json_object]]) THEN JSON_EXTRACT([[__mm_demo4_self_rel_many.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[__mm_demo4_self_rel_many.json_object]]), '$.pb') END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4.self_rel_many]]), json_type([[__mm_demo4.self_rel_many]])='array', FALSE) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__smTEST}} WHERE NOT (NULL IS [[__smTEST.multiMatchValue]])))) OR (((CASE WHEN json_valid([[demo4_self_rel_many.json_object]]) THEN JSON_EXTRACT([[demo4_self_rel_many.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4_self_rel_many.json_object]]), '$.pb') END) IS (CASE WHEN json_valid([[demo4_self_rel_many.json_object]]) THEN JSON_EXTRACT([[demo4_self_rel_many.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[demo4_self_rel_many.json_object]]), '$.pb') END)) AND (NOT EXISTS (SELECT 1 FROM (SELECT (CASE WHEN json_valid([[__mm_demo4_self_rel_many.json_object]]) THEN JSON_EXTRACT([[__mm_demo4_self_rel_many.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[__mm_demo4_self_rel_many.json_object]]), '$.pb') END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4.self_rel_many]]), json_type([[__mm_demo4.self_rel_many]])='array', FALSE) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__mlTEST}} LEFT JOIN (SELECT (CASE WHEN json_valid([[__mm_demo4_self_rel_many.json_object]]) THEN JSON_EXTRACT([[__mm_demo4_self_rel_many.json_object]], '$') ELSE JSON_EXTRACT(json_object('pb', [[__mm_demo4_self_rel_many.json_object]]), '$.pb') END) as [[multiMatchValue]] FROM `demo4` `__mm_demo4` LEFT JOIN json_each(CASE WHEN iif(json_valid([[__mm_demo4.self_rel_many]]), json_type([[__mm_demo4.self_rel_many]])='array', FALSE) THEN [[__mm_demo4.self_rel_many]] ELSE json_array([[__mm_demo4.self_rel_many]]) END) `__mm_demo4_self_rel_many_je` LEFT JOIN `demo4` `__mm_demo4_self_rel_many` ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE `__mm_demo4`.`id` = `demo4`.`id`) {{__mrTEST}} WHERE NOT ([[__mlTEST.multiMatchValue]] IS [[__mrTEST.multiMatchValue]])))))",
+			*/
+			// PostgreSQL:
+			`SELECT DISTINCT "demo4".* FROM "demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[demo4.self_rel_many]] IS JSON OR json_valid([[demo4.self_rel_many]]::text)) AND jsonb_typeof([[demo4.self_rel_many]]::jsonb) = 'array' THEN [[demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[demo4.self_rel_many]]) END) "__je_demo4_self_rel_many" ON 1=1 LEFT JOIN "demo4" "demo4_self_rel_many" ON [[demo4_self_rel_many.id]] = [[__je_demo4_self_rel_many.value]] WHERE (JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS NOT DISTINCT FROM to_jsonb(''::text) OR JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS DISTINCT FROM to_jsonb(''::text) OR to_jsonb(''::text) IS NOT DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR to_jsonb(''::text) IS DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS NOT DISTINCT FROM to_jsonb(NULL::text) OR JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS DISTINCT FROM to_jsonb(NULL::text) OR to_jsonb(NULL::text) IS NOT DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR to_jsonb(NULL::text) IS DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS NOT DISTINCT FROM to_jsonb(TRUE) OR JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS DISTINCT FROM to_jsonb(TRUE) OR to_jsonb(TRUE) IS NOT DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR to_jsonb(TRUE) IS DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS NOT DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb IS NOT DISTINCT FROM to_jsonb([[demo4.title]]) OR to_jsonb([[demo4.title]]) IS DISTINCT FROM JSON_QUERY_OR_NULL([[demo4.json_object]], '$')::jsonb OR ((JSON_QUERY_OR_NULL([[demo4_self_rel_many.json_object]], '$')::jsonb IS NOT DISTINCT FROM to_jsonb(''::text)) AND (NOT EXISTS (SELECT 1 FROM (SELECT JSON_QUERY_OR_NULL([[__mm_demo4_self_rel_many.json_object]], '$')::jsonb as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4.self_rel_many]] IS JSON OR json_valid([[__mm_demo4.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4.self_rel_many]]) END) "__mm_demo4_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many" ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT ([[__smTEST.multiMatchValue]] IS NOT DISTINCT FROM '')))) OR ((to_jsonb(NULL::text) IS NOT DISTINCT FROM JSON_QUERY_OR_NULL([[demo4_self_rel_many.json_object]], '$')::jsonb) AND (NOT EXISTS (SELECT 1 FROM (SELECT JSON_QUERY_OR_NULL([[__mm_demo4_self_rel_many.json_object]], '$')::jsonb as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4.self_rel_many]] IS JSON OR json_valid([[__mm_demo4.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4.self_rel_many]]) END) "__mm_demo4_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many" ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__smTEST}} WHERE NOT (NULL IS NOT DISTINCT FROM [[__smTEST.multiMatchValue]])))) OR ((JSON_QUERY_OR_NULL([[demo4_self_rel_many.json_object]], '$')::jsonb IS NOT DISTINCT FROM JSON_QUERY_OR_NULL([[demo4_self_rel_many.json_object]], '$')::jsonb) AND (NOT EXISTS (SELECT 1 FROM (SELECT JSON_QUERY_OR_NULL([[__mm_demo4_self_rel_many.json_object]], '$')::jsonb as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4.self_rel_many]] IS JSON OR json_valid([[__mm_demo4.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4.self_rel_many]]) END) "__mm_demo4_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many" ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__mlTEST}} LEFT JOIN (SELECT JSON_QUERY_OR_NULL([[__mm_demo4_self_rel_many.json_object]], '$')::jsonb as [[multiMatchValue]] FROM "demo4" "__mm_demo4" LEFT JOIN jsonb_array_elements_text(CASE WHEN ([[__mm_demo4.self_rel_many]] IS JSON OR json_valid([[__mm_demo4.self_rel_many]]::text)) AND jsonb_typeof([[__mm_demo4.self_rel_many]]::jsonb) = 'array' THEN [[__mm_demo4.self_rel_many]]::jsonb ELSE jsonb_build_array([[__mm_demo4.self_rel_many]]) END) "__mm_demo4_self_rel_many_je" ON 1=1 LEFT JOIN "demo4" "__mm_demo4_self_rel_many" ON [[__mm_demo4_self_rel_many.id]] = [[__mm_demo4_self_rel_many_je.value]] WHERE "__mm_demo4"."id" = "demo4"."id") {{__mrTEST}} ON 1 = 1 WHERE NOT ([[__mlTEST.multiMatchValue]] IS NOT DISTINCT FROM [[__mrTEST.multiMatchValue]])))))`,
+		},
+		{
+			"geoPoint props access",
+			"view1",
+			"point = '' || point.lat > 1 || point.lon < 2 || point.something > 3",
+			false,
+			/* SQLite:
+			"SELECT `view1`.* FROM `view1` WHERE (([[view1.point]] = '' OR [[view1.point]] IS NULL) OR (CASE WHEN json_valid([[view1.point]]) THEN JSON_EXTRACT([[view1.point]], '$.lat') ELSE JSON_EXTRACT(json_object('pb', [[view1.point]]), '$.pb.lat') END) > {:TEST} OR (CASE WHEN json_valid([[view1.point]]) THEN JSON_EXTRACT([[view1.point]], '$.lon') ELSE JSON_EXTRACT(json_object('pb', [[view1.point]]), '$.pb.lon') END) < {:TEST} OR (CASE WHEN json_valid([[view1.point]]) THEN JSON_EXTRACT([[view1.point]], '$.something') ELSE JSON_EXTRACT(json_object('pb', [[view1.point]]), '$.pb.something') END) > {:TEST})",
+			*/
+			// PostgreSQL:
+			`SELECT "view1".* FROM "view1" WHERE (([[view1.point]]::text = '' OR [[view1.point]] IS NULL) OR JSON_QUERY_OR_NULL([[view1.point]], '$.lat')::jsonb::numeric > 1 OR JSON_QUERY_OR_NULL([[view1.point]], '$.lon')::jsonb::numeric < 2 OR JSON_QUERY_OR_NULL([[view1.point]], '$.something')::jsonb::numeric > 3)`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection, err := app.FindCollectionByNameOrId(s.collectionIdOrName)
+			if err != nil {
+				t.Fatalf("Failed to load collection %s: %v", s.collectionIdOrName, err)
+			}
+
+			expectError := s.expectQuery == ""
+
+			query := app.RecordQuery(collection)
+
+			r := core.NewRecordFieldResolver(app, collection, requestInfo, s.allowHiddenFields)
+
+			expr, err := search.FilterData(s.rule).BuildExpr(r)
+			hasErr := err != nil
+			if hasErr != expectError {
+				t.Fatalf("BuildExpr failed: expected hasErr %v, got %v (%v)", expectError, hasErr, err)
+			}
+
+			err = r.UpdateQuery(query)
+			hasErr = err != nil
+			if hasErr && expectError {
+				t.Fatalf("UpdateQuery failed: expected hasErr %v, got %v (%v)", expectError, hasErr, err)
+			}
+
+			if expectError {
+				return
+			}
+
+			rawQuery := query.AndWhere(expr).Build().SQL()
+
+			// replace TEST placeholder with .+ regex pattern
+			expectQuery := strings.ReplaceAll(
+				"^"+regexp.QuoteMeta(s.expectQuery)+"$",
+				"TEST",
+				`\w+`,
+			)
+
+			if !list.ExistInSliceWithRegex(rawQuery, []string{expectQuery}) {
+				t.Fatalf("Expected query\n %v \ngot:\n %v", expectQuery, rawQuery)
+			}
+		})
+	}
+}
+
+func TestRecordFieldResolverResolveCollectionFields(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo4")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := app.FindRecordById("users", "4q1xlclmfloku33")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	requestInfo := &core.RequestInfo{
+		Auth: authRecord,
+	}
+
+	r := core.NewRecordFieldResolver(app, collection, requestInfo, true)
+
+	scenarios := []struct {
+		fieldName   string
+		expectError bool
+		expectName  string
+	}{
+		{"", true, ""},
+		{" ", true, ""},
+		{"unknown", true, ""},
+		{"invalid format", true, ""},
+		{"id", false, "[[demo4.id]]"},
+		{"created", false, "[[demo4.created]]"},
+		{"updated", false, "[[demo4.updated]]"},
+		{"title", false, "[[demo4.title]]"},
+		{"title.test", true, ""},
+		{"self_rel_many", false, "[[demo4.self_rel_many]]"},
+		{"self_rel_many.", true, ""},
+		{"self_rel_many.unknown", true, ""},
+		{"self_rel_many.title", false, "[[demo4_self_rel_many.title]]"},
+		{"self_rel_many.self_rel_one.self_rel_many.title", false, "[[demo4_self_rel_many_self_rel_one_self_rel_many.title]]"},
+
+		// max relations limit
+		{"self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.id", false, "[[demo4_self_rel_many_self_rel_many_self_rel_many_self_rel_many_self_rel_many_self_rel_many.id]]"},
+		{"self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.id", true, ""},
+
+		// back relations
+		{"rel_one_cascade.demo4_via_title.id", true, ""},        // not a relation field
+		{"rel_one_cascade.demo4_via_self_rel_one.id", true, ""}, // relation field but to a different collection
+		{"rel_one_cascade.demo4_via_rel_one_cascade.id", false, "[[demo4_rel_one_cascade_demo4_via_rel_one_cascade.id]]"},
+		{"rel_one_cascade.demo4_via_rel_one_cascade.rel_one_cascade.demo4_via_rel_one_cascade.id", false, "[[demo4_rel_one_cascade_demo4_via_rel_one_cascade_rel_one_cascade_demo4_via_rel_one_cascade.id]]"},
+
+		// json_extract
+		/* SQLite:
+		{"json_array.0", false, "(CASE WHEN json_valid([[demo4.json_array]]) THEN JSON_EXTRACT([[demo4.json_array]], '$[0]') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_array]]), '$.pb[0]') END)"},
+		{"json_object.a.b.c", false, "(CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$.a.b.c') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb.a.b.c') END)"},
+
+		// max relations limit shouldn't apply for json paths
+		{"json_object.a.b.c.e.f.g.h.i.j.k.l.m.n.o.p", false, "(CASE WHEN json_valid([[demo4.json_object]]) THEN JSON_EXTRACT([[demo4.json_object]], '$.a.b.c.e.f.g.h.i.j.k.l.m.n.o.p') ELSE JSON_EXTRACT(json_object('pb', [[demo4.json_object]]), '$.pb.a.b.c.e.f.g.h.i.j.k.l.m.n.o.p') END)"},
+		*/
+		// PostgreSQL:
+		{"json_array.0", false, "JSON_QUERY_OR_NULL([[demo4.json_array]], '$[0]')::jsonb"},
+		{"json_object.a.b.c", false, "JSON_QUERY_OR_NULL([[demo4.json_object]], '$.a.b.c')::jsonb"},
+		// max relations limit shouldn't apply for json paths
+		{"json_object.a.b.c.e.f.g.h.i.j.k.l.m.n.o.p", false, "JSON_QUERY_OR_NULL([[demo4.json_object]], '$.a.b.c.e.f.g.h.i.j.k.l.m.n.o.p')::jsonb"},
+
+		// @request.auth relation join
+		{"@request.auth.rel", false, "[[__auth_users.rel]]"},
+		{"@request.auth.rel.title", false, "[[__auth_users_rel.title]]"},
+		{"@request.auth.demo1_via_rel_many.id", false, "[[__auth_users_demo1_via_rel_many.id]]"},
+		{"@request.auth.rel.missing", false, "NULL"},
+		{"@request.auth.missing_via_rel", false, "NULL"},
+		{"@request.auth.demo1_via_file_one.id", false, "NULL"}, // not a relation field
+		{"@request.auth.demo1_via_rel_one.id", false, "NULL"},  // relation field but to a different collection
+
+		// @collection fieds
+		{"@collect", true, ""},
+		{"collection.demo4.title", true, ""},
+		{"@collection", true, ""},
+		{"@collection.unknown", true, ""},
+		{"@collection.demo2", true, ""},
+		{"@collection.demo2.", true, ""},
+		{"@collection.demo2:someAlias", true, ""},
+		{"@collection.demo2:someAlias.", true, ""},
+		{"@collection.demo2.title", false, "[[__collection_demo2.title]]"},
+		{"@collection.demo2:someAlias.title", false, "[[__collection_alias_someAlias.title]]"},
+		{"@collection.demo4.id", false, "[[__collection_demo4.id]]"},
+		{"@collection.demo4.created", false, "[[__collection_demo4.created]]"},
+		{"@collection.demo4.updated", false, "[[__collection_demo4.updated]]"},
+		{"@collection.demo4.self_rel_many.missing", true, ""},
+		{"@collection.demo4.self_rel_many.self_rel_one.self_rel_many.self_rel_one.title", false, "[[__collection_demo4_self_rel_many_self_rel_one_self_rel_many_self_rel_one.title]]"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.fieldName, func(t *testing.T) {
+			r, err := r.Resolve(s.fieldName)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if r.Identifier != s.expectName {
+				t.Fatalf("Expected r.Identifier\n%q\ngot\n%q", s.expectName, r.Identifier)
+			}
+
+			// params should be empty for non @request fields
+			if len(r.Params) != 0 {
+				t.Fatalf("Expected 0 r.Params, got\n%v", r.Params)
+			}
+		})
+	}
+}
+
+func TestRecordFieldResolverResolveStaticRequestInfoFields(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	authRecord, err := app.FindRecordById("users", "4q1xlclmfloku33")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	requestInfo := &core.RequestInfo{
+		Context: "ctx",
+		Method:  "get",
+		Query: map[string]string{
+			"a": "123",
+		},
+		Body: map[string]any{
+			"number":          "10",
+			"number_unknown":  "20",
+			"raw_json_obj":    types.JSONRaw(`{"a":123}`),
+			"raw_json_arr1":   types.JSONRaw(`[123, 456]`),
+			"raw_json_arr2":   types.JSONRaw(`[{"a":123},{"b":456}]`),
+			"raw_json_simple": types.JSONRaw(`123`),
+			"b":               456,
+			"c":               map[string]int{"sub": 1},
+		},
+		Headers: map[string]string{
+			"d": "789",
+		},
+		Auth: authRecord,
+	}
+
+	r := core.NewRecordFieldResolver(app, collection, requestInfo, true)
+
+	scenarios := []struct {
+		fieldName        string
+		expectError      bool
+		expectParamValue string // encoded json
+	}{
+		{"@request", true, ""},
+		{"@request.invalid format", true, ""},
+		{"@request.invalid_format2!", true, ""},
+		{"@request.missing", true, ""},
+		{"@request.context", false, `"ctx"`},
+		{"@request.method", false, `"get"`},
+		{"@request.query", true, ``},
+		{"@request.query.a", false, `"123"`},
+		{"@request.query.a.missing", false, ``},
+		{"@request.headers", true, ``},
+		{"@request.headers.missing", false, ``},
+		{"@request.headers.d", false, `"789"`},
+		{"@request.headers.d.sub", false, ``},
+		{"@request.body", true, ``},
+		{"@request.body.b", false, `456`},
+		{"@request.body.number", false, `10`},           // number field normalization
+		{"@request.body.number_unknown", false, `"20"`}, // no numeric normalizations for unknown fields
+		{"@request.body.b.missing", false, ``},
+		{"@request.body.c", false, `"{\"sub\":1}"`},
+		{"@request.auth", true, ""},
+		{"@request.auth.id", false, `"4q1xlclmfloku33"`},
+		{"@request.auth.collectionId", false, `"` + authRecord.Collection().Id + `"`},
+		{"@request.auth.collectionName", false, `"` + authRecord.Collection().Name + `"`},
+		{"@request.auth.verified", false, `false`},
+		{"@request.auth.emailVisibility", false, `false`},
+		{"@request.auth.email", false, `"test@example.com"`}, // should always be returned no matter of the emailVisibility state
+		{"@request.auth.missing", false, `NULL`},
+		{"@request.body.raw_json_simple", false, `"123"`},
+		{"@request.body.raw_json_simple.a", false, `NULL`},
+		{"@request.body.raw_json_obj.a", false, `123`},
+		{"@request.body.raw_json_obj.b", false, `NULL`},
+		{"@request.body.raw_json_arr1.1", false, `456`},
+		{"@request.body.raw_json_arr1.3", false, `NULL`},
+		{"@request.body.raw_json_arr2.0.a", false, `123`},
+		{"@request.body.raw_json_arr2.0.b", false, `NULL`},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.fieldName, func(t *testing.T) {
+			r, err := r.Resolve(s.fieldName)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			// missing key
+			// ---
+			if len(r.Params) == 0 {
+				if r.Identifier != "NULL" {
+					t.Fatalf("Expected 0 placeholder parameters for %v, got %v", r.Identifier, r.Params)
+				}
+				return
+			}
+
+			// existing key
+			// ---
+			if len(r.Params) != 1 {
+				t.Fatalf("Expected 1 placeholder parameter for %v, got %v", r.Identifier, r.Params)
+			}
+
+			var paramName string
+			var paramValue any
+			for k, v := range r.Params {
+				paramName = k
+				paramValue = v
+			}
+
+			if r.Identifier != ("{:" + paramName + "}") {
+				t.Fatalf("Expected parameter r.Identifier %q, got %q", paramName, r.Identifier)
+			}
+
+			encodedParamValue, _ := json.Marshal(paramValue)
+			if string(encodedParamValue) != s.expectParamValue {
+				t.Fatalf("Expected r.Params %#v for %s, got %#v", s.expectParamValue, r.Identifier, string(encodedParamValue))
+			}
+		})
+	}
+
+	// ensure that the original email visibility was restored
+	if authRecord.EmailVisibility() {
+		t.Fatal("Expected the original authRecord emailVisibility to remain unchanged")
+	}
+	if v, ok := authRecord.PublicExport()[core.FieldNameEmail]; ok {
+		t.Fatalf("Expected the original authRecord email to not be exported, got %q", v)
+	}
+}
diff --git a/server/core_backend-server/core/record_model.go b/server/core_backend-server/core/record_model.go
new file mode 100644
index 0000000..97594a3
--- /dev/null
+++ b/server/core_backend-server/core/record_model.go
@@ -0,0 +1,1630 @@
+package core
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"maps"
+	"slices"
+	"sort"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+// used as a workaround by some fields for persisting local state between various events
+// (for now is kept private and cannot be changed or cloned outside of the core package)
+const internalCustomFieldKeyPrefix = "@pbInternal"
+
+var (
+	_ Model        = (*Record)(nil)
+	_ HookTagger   = (*Record)(nil)
+	_ DBExporter   = (*Record)(nil)
+	_ FilesManager = (*Record)(nil)
+)
+
+type Record struct {
+	collection       *Collection
+	originalData     map[string]any
+	customVisibility *store.Store[string, bool]
+	data             *store.Store[string, any]
+	expand           *store.Store[string, any]
+
+	BaseModel
+
+	exportCustomData      bool
+	ignoreEmailVisibility bool
+	ignoreUnchangedFields bool
+}
+
+const systemHookIdRecord = "__pbRecordSystemHook__"
+
+func (app *BaseApp) registerRecordHooks() {
+	app.OnModelValidate().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordValidate().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelCreate().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordCreate().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelCreateExecute().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordCreateExecute().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterCreateSuccess().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordAfterCreateSuccess().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterCreateError().Bind(&hook.Handler[*ModelErrorEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelErrorEvent) error {
+			if re, ok := newRecordErrorEventFromModelErrorEvent(me); ok {
+				err := me.App.OnRecordAfterCreateError().Trigger(re, func(re *RecordErrorEvent) error {
+					syncModelErrorEventWithRecordErrorEvent(me, re)
+					defer syncRecordErrorEventWithModelErrorEvent(re, me)
+					return me.Next()
+				})
+				syncModelErrorEventWithRecordErrorEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelUpdate().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordUpdate().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelUpdateExecute().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordUpdateExecute().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterUpdateSuccess().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordAfterUpdateSuccess().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterUpdateError().Bind(&hook.Handler[*ModelErrorEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelErrorEvent) error {
+			if re, ok := newRecordErrorEventFromModelErrorEvent(me); ok {
+				err := me.App.OnRecordAfterUpdateError().Trigger(re, func(re *RecordErrorEvent) error {
+					syncModelErrorEventWithRecordErrorEvent(me, re)
+					defer syncRecordErrorEventWithModelErrorEvent(re, me)
+					return me.Next()
+				})
+				syncModelErrorEventWithRecordErrorEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelDelete().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordDelete().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelDeleteExecute().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordDeleteExecute().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterDeleteSuccess().Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelEvent) error {
+			if re, ok := newRecordEventFromModelEvent(me); ok {
+				err := me.App.OnRecordAfterDeleteSuccess().Trigger(re, func(re *RecordEvent) error {
+					syncModelEventWithRecordEvent(me, re)
+					defer syncRecordEventWithModelEvent(re, me)
+					return me.Next()
+				})
+				syncModelEventWithRecordEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	app.OnModelAfterDeleteError().Bind(&hook.Handler[*ModelErrorEvent]{
+		Id: systemHookIdRecord,
+		Func: func(me *ModelErrorEvent) error {
+			if re, ok := newRecordErrorEventFromModelErrorEvent(me); ok {
+				err := me.App.OnRecordAfterDeleteError().Trigger(re, func(re *RecordErrorEvent) error {
+					syncModelErrorEventWithRecordErrorEvent(me, re)
+					defer syncRecordErrorEventWithModelErrorEvent(re, me)
+					return me.Next()
+				})
+				syncModelErrorEventWithRecordErrorEvent(me, re)
+				return err
+			}
+
+			return me.Next()
+		},
+		Priority: -99,
+	})
+
+	// ---------------------------------------------------------------
+
+	app.OnRecordValidate().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionValidate,
+				func() error {
+					return onRecordValidate(e)
+				},
+			)
+		},
+		Priority: 99,
+	})
+
+	app.OnRecordCreate().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionCreate,
+				e.Next,
+			)
+		},
+		Priority: -99,
+	})
+
+	app.OnRecordCreateExecute().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionCreateExecute,
+				func() error {
+					return onRecordSaveExecute(e)
+				},
+			)
+		},
+		Priority: 99,
+	})
+
+	app.OnRecordAfterCreateSuccess().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionAfterCreate,
+				e.Next,
+			)
+		},
+		Priority: -99,
+	})
+
+	app.OnRecordAfterCreateError().Bind(&hook.Handler[*RecordErrorEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordErrorEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionAfterCreateError,
+				e.Next,
+			)
+		},
+		Priority: -99,
+	})
+
+	app.OnRecordUpdate().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionUpdate,
+				e.Next,
+			)
+		},
+		Priority: -99,
+	})
+
+	app.OnRecordUpdateExecute().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionUpdateExecute,
+				func() error {
+					return onRecordSaveExecute(e)
+				},
+			)
+		},
+		Priority: 99,
+	})
+
+	app.OnRecordAfterUpdateSuccess().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionAfterUpdate,
+				e.Next,
+			)
+		},
+		Priority: -99,
+	})
+
+	app.OnRecordAfterUpdateError().Bind(&hook.Handler[*RecordErrorEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordErrorEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionAfterUpdateError,
+				e.Next,
+			)
+		},
+		Priority: -99,
+	})
+
+	app.OnRecordDelete().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionDelete,
+				func() error {
+					if e.Record.Collection().IsView() {
+						return errors.New("view records cannot be deleted")
+					}
+
+					return e.Next()
+				},
+			)
+		},
+		Priority: -99,
+	})
+
+	app.OnRecordDeleteExecute().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionDeleteExecute,
+				func() error {
+					return onRecordDeleteExecute(e)
+				},
+			)
+		},
+		Priority: 99,
+	})
+
+	app.OnRecordAfterDeleteSuccess().Bind(&hook.Handler[*RecordEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionAfterDelete,
+				e.Next,
+			)
+		},
+		Priority: -99,
+	})
+
+	app.OnRecordAfterDeleteError().Bind(&hook.Handler[*RecordErrorEvent]{
+		Id: systemHookIdRecord,
+		Func: func(e *RecordErrorEvent) error {
+			return e.Record.callFieldInterceptors(
+				e.Context,
+				e.App,
+				InterceptorActionAfterDeleteError,
+				e.Next,
+			)
+		},
+		Priority: -99,
+	})
+}
+
+// -------------------------------------------------------------------
+
+// newRecordFromNullStringMap initializes a single new Record model
+// with data loaded from the provided NullStringMap.
+//
+// Note that this method is intended to load and Scan data from a database row result.
+func newRecordFromNullStringMap(collection *Collection, data dbx.NullStringMap) (*Record, error) {
+	record := NewRecord(collection)
+
+	var fieldName string
+	for _, field := range collection.Fields {
+		fieldName = field.GetName()
+
+		nullString, ok := data[fieldName]
+
+		var value any
+		var err error
+
+		if ok && nullString.Valid {
+			value, err = field.PrepareValue(record, nullString.String)
+		} else {
+			value, err = field.PrepareValue(record, nil)
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		// we load only the original data to avoid unnecessary copying the same data into the record.data store
+		// (it is also the reason why we don't invoke PostScan on the record itself)
+		record.originalData[fieldName] = value
+
+		if fieldName == FieldNameId {
+			record.Id = cast.ToString(value)
+		}
+	}
+
+	record.BaseModel.PostScan()
+
+	return record, nil
+}
+
+// newRecordsFromNullStringMaps initializes a new Record model for
+// each row in the provided NullStringMap slice.
+//
+// Note that this method is intended to load and Scan data from a database rows result.
+func newRecordsFromNullStringMaps(collection *Collection, rows []dbx.NullStringMap) ([]*Record, error) {
+	result := make([]*Record, len(rows))
+
+	var err error
+	for i, row := range rows {
+		result[i], err = newRecordFromNullStringMap(collection, row)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return result, nil
+}
+
+// -------------------------------------------------------------------
+
+// NewRecord initializes a new empty Record model.
+func NewRecord(collection *Collection) *Record {
+	record := &Record{
+		collection:       collection,
+		data:             store.New[string, any](nil),
+		customVisibility: store.New[string, bool](nil),
+		originalData:     make(map[string]any, len(collection.Fields)),
+	}
+
+	// initialize default field values
+	var fieldName string
+	for _, field := range collection.Fields {
+		fieldName = field.GetName()
+
+		if fieldName == FieldNameId {
+			continue
+		}
+
+		value, _ := field.PrepareValue(record, nil)
+		record.originalData[fieldName] = value
+	}
+
+	return record
+}
+
+// Collection returns the Collection model associated with the current Record model.
+//
+// NB! The returned collection is only for read purposes and it shouldn't be modified
+// because it could have unintended side-effects on other Record models from the same collection.
+func (m *Record) Collection() *Collection {
+	return m.collection
+}
+
+// TableName returns the table name associated with the current Record model.
+func (m *Record) TableName() string {
+	return m.collection.Name
+}
+
+// PostScan implements the [dbx.PostScanner] interface.
+//
+// It essentially refreshes/updates the current Record original state
+// as if the model was fetched from the databases for the first time.
+//
+// Or in other words, it means that m.Original().FieldsData() will have
+// the same values as m.Record().FieldsData().
+func (m *Record) PostScan() error {
+	if m.Id == "" {
+		return errors.New("missing record primary key")
+	}
+
+	if err := m.BaseModel.PostScan(); err != nil {
+		return err
+	}
+
+	m.originalData = m.FieldsData()
+
+	return nil
+}
+
+// HookTags returns the hook tags associated with the current record.
+func (m *Record) HookTags() []string {
+	return []string{m.collection.Name, m.collection.Id}
+}
+
+// BaseFilesPath returns the storage dir path used by the record.
+func (m *Record) BaseFilesPath() string {
+	id := cast.ToString(m.LastSavedPK())
+	if id == "" {
+		id = m.Id
+	}
+
+	return m.collection.BaseFilesPath() + "/" + id
+}
+
+// Original returns a shallow copy of the current record model populated
+// with its ORIGINAL db data state (aka. right after PostScan())
+// and everything else reset to the defaults.
+//
+// If record was created using NewRecord() the original will be always
+// a blank record (until PostScan() is invoked).
+func (m *Record) Original() *Record {
+	newRecord := NewRecord(m.collection)
+
+	newRecord.originalData = maps.Clone(m.originalData)
+
+	if newRecord.originalData[FieldNameId] != nil {
+		newRecord.lastSavedPK = cast.ToString(newRecord.originalData[FieldNameId])
+		newRecord.Id = newRecord.lastSavedPK
+	}
+
+	return newRecord
+}
+
+// Fresh returns a shallow copy of the current record model populated
+// with its LATEST data state and everything else reset to the defaults
+// (aka. no expand, no unknown fields and with default visibility flags).
+func (m *Record) Fresh() *Record {
+	newRecord := m.Original()
+
+	// note: this will also load the Id field through m.GetRaw
+	var fieldName string
+	for _, field := range m.collection.Fields {
+		fieldName = field.GetName()
+		newRecord.SetRaw(fieldName, m.GetRaw(fieldName))
+	}
+
+	return newRecord
+}
+
+// Clone returns a shallow copy of the current record model with all of
+// its collection and unknown fields data, expand and flags copied.
+//
+// use [Record.Fresh()] instead if you want a copy with only the latest
+// collection fields data and everything else reset to the defaults.
+func (m *Record) Clone() *Record {
+	newRecord := m.Original()
+
+	newRecord.Id = m.Id
+	newRecord.exportCustomData = m.exportCustomData
+	newRecord.ignoreEmailVisibility = m.ignoreEmailVisibility
+	newRecord.ignoreUnchangedFields = m.ignoreUnchangedFields
+	newRecord.customVisibility.Reset(m.customVisibility.GetAll())
+
+	data := m.data.GetAll()
+	for k, v := range data {
+		newRecord.SetRaw(k, v)
+	}
+
+	if m.expand != nil {
+		newRecord.SetExpand(m.expand.GetAll())
+	}
+
+	return newRecord
+}
+
+// Expand returns a shallow copy of the current Record model expand data (if any).
+func (m *Record) Expand() map[string]any {
+	if m.expand == nil {
+		// return a dummy initialized map to avoid assignment to nil map errors
+		return map[string]any{}
+	}
+
+	return m.expand.GetAll()
+}
+
+// SetExpand replaces the current Record's expand with the provided expand arg data (shallow copied).
+func (m *Record) SetExpand(expand map[string]any) {
+	if m.expand == nil {
+		m.expand = store.New[string, any](nil)
+	}
+
+	m.expand.Reset(expand)
+}
+
+// MergeExpand merges recursively the provided expand data into
+// the current model's expand (if any).
+//
+// Note that if an expanded prop with the same key is a slice (old or new expand)
+// then both old and new records will be merged into a new slice (aka. a :merge: [b,c] => [a,b,c]).
+// Otherwise the "old" expanded record will be replace with the "new" one (aka. a :merge: aNew => aNew).
+func (m *Record) MergeExpand(expand map[string]any) {
+	// nothing to merge
+	if len(expand) == 0 {
+		return
+	}
+
+	// no old expand
+	if m.expand == nil {
+		m.expand = store.New(expand)
+		return
+	}
+
+	oldExpand := m.expand.GetAll()
+
+	for key, new := range expand {
+		old, ok := oldExpand[key]
+		if !ok {
+			oldExpand[key] = new
+			continue
+		}
+
+		var wasOldSlice bool
+		var oldSlice []*Record
+		switch v := old.(type) {
+		case *Record:
+			oldSlice = []*Record{v}
+		case []*Record:
+			wasOldSlice = true
+			oldSlice = v
+		default:
+			// invalid old expand data -> assign directly the new
+			// (no matter whether new is valid or not)
+			oldExpand[key] = new
+			continue
+		}
+
+		var wasNewSlice bool
+		var newSlice []*Record
+		switch v := new.(type) {
+		case *Record:
+			newSlice = []*Record{v}
+		case []*Record:
+			wasNewSlice = true
+			newSlice = v
+		default:
+			// invalid new expand data -> skip
+			continue
+		}
+
+		oldIndexed := make(map[string]*Record, len(oldSlice))
+		for _, oldRecord := range oldSlice {
+			oldIndexed[oldRecord.Id] = oldRecord
+		}
+
+		for _, newRecord := range newSlice {
+			oldRecord := oldIndexed[newRecord.Id]
+			if oldRecord != nil {
+				// note: there is no need to update oldSlice since oldRecord is a reference
+				oldRecord.MergeExpand(newRecord.Expand())
+			} else {
+				// missing new entry
+				oldSlice = append(oldSlice, newRecord)
+			}
+		}
+
+		if wasOldSlice || wasNewSlice || len(oldSlice) == 0 {
+			oldExpand[key] = oldSlice
+		} else {
+			oldExpand[key] = oldSlice[0]
+		}
+	}
+
+	m.expand.Reset(oldExpand)
+}
+
+// FieldsData returns a shallow copy ONLY of the collection's fields record's data.
+func (m *Record) FieldsData() map[string]any {
+	result := make(map[string]any, len(m.collection.Fields))
+
+	var fieldName string
+	for _, field := range m.collection.Fields {
+		fieldName = field.GetName()
+		result[fieldName] = m.Get(fieldName)
+	}
+
+	return result
+}
+
+// CustomData returns a shallow copy ONLY of the custom record fields data,
+// aka. fields that are neither defined by the collection, nor special system ones.
+//
+// Note that custom fields prefixed with "@pbInternal" are always skipped.
+func (m *Record) CustomData() map[string]any {
+	if m.data == nil {
+		return nil
+	}
+
+	fields := m.Collection().Fields
+
+	knownFields := make(map[string]struct{}, len(fields))
+
+	for _, f := range fields {
+		knownFields[f.GetName()] = struct{}{}
+	}
+
+	result := map[string]any{}
+
+	rawData := m.data.GetAll()
+	for k, v := range rawData {
+		if _, ok := knownFields[k]; !ok {
+			// skip internal custom fields
+			if strings.HasPrefix(k, internalCustomFieldKeyPrefix) {
+				continue
+			}
+
+			result[k] = v
+		}
+	}
+
+	return result
+}
+
+// WithCustomData toggles the export/serialization of custom data fields
+// (false by default).
+func (m *Record) WithCustomData(state bool) *Record {
+	m.exportCustomData = state
+	return m
+}
+
+// IgnoreEmailVisibility toggles the flag to ignore the auth record email visibility check.
+func (m *Record) IgnoreEmailVisibility(state bool) *Record {
+	m.ignoreEmailVisibility = state
+	return m
+}
+
+// IgnoreUnchangedFields toggles the flag to ignore the unchanged fields
+// from the DB export for the UPDATE SQL query.
+//
+// This could be used if you want to save only the record fields that you've changed
+// without overwrite other untouched fields in case of concurrent update.
+//
+// Note that the fields change comparison is based on the current fields against m.Original()
+// (aka. if you have performed save on the same Record instance multiple times you may have to refetch it,
+// so that m.Original() could reflect the last saved change).
+func (m *Record) IgnoreUnchangedFields(state bool) *Record {
+	m.ignoreUnchangedFields = state
+	return m
+}
+
+// Set sets the provided key-value data pair into the current Record
+// model directly as it is WITHOUT NORMALIZATIONS.
+//
+// See also [Record.Set].
+func (m *Record) SetRaw(key string, value any) {
+	if key == FieldNameId {
+		m.Id = cast.ToString(value)
+	}
+
+	m.data.Set(key, value)
+}
+
+// SetIfFieldExists sets the provided key-value data pair into the current Record model
+// ONLY if key is existing Collection field name/modifier.
+//
+// This method does nothing if key is not a known Collection field name/modifier.
+//
+// On success returns the matched Field, otherwise - nil.
+//
+// To set any key-value, including custom/unknown fields, use the [Record.Set] method.
+func (m *Record) SetIfFieldExists(key string, value any) Field {
+	for _, field := range m.Collection().Fields {
+		ff, ok := field.(SetterFinder)
+		if ok {
+			setter := ff.FindSetter(key)
+			if setter != nil {
+				setter(m, value)
+				return field
+			}
+		}
+
+		// fallback to the default field PrepareValue method for direct match
+		if key == field.GetName() {
+			value, _ = field.PrepareValue(m, value)
+			m.SetRaw(key, value)
+			return field
+		}
+	}
+
+	return nil
+}
+
+// Set sets the provided key-value data pair into the current Record model.
+//
+// If the record collection has field with name matching the provided "key",
+// the value will be further normalized according to the field setter(s).
+func (m *Record) Set(key string, value any) {
+	switch key {
+	case FieldNameExpand: // for backward-compatibility with earlier versions
+		m.SetExpand(cast.ToStringMap(value))
+	default:
+		field := m.SetIfFieldExists(key, value)
+		if field == nil {
+			// custom key - set it without any transformations
+			m.SetRaw(key, value)
+		}
+	}
+}
+
+func (m *Record) GetRaw(key string) any {
+	if key == FieldNameId {
+		return m.Id
+	}
+
+	if v, ok := m.data.GetOk(key); ok {
+		return v
+	}
+
+	return m.originalData[key]
+}
+
+// Get returns a normalized single record model data value for "key".
+func (m *Record) Get(key string) any {
+	switch key {
+	case FieldNameExpand: // for backward-compatibility with earlier versions
+		return m.Expand()
+	default:
+		for _, field := range m.Collection().Fields {
+			gm, ok := field.(GetterFinder)
+			if !ok {
+				continue // no custom getters
+			}
+
+			getter := gm.FindGetter(key)
+			if getter != nil {
+				return getter(m)
+			}
+		}
+
+		return m.GetRaw(key)
+	}
+}
+
+// Load bulk loads the provided data into the current Record model.
+func (m *Record) Load(data map[string]any) {
+	for k, v := range data {
+		m.Set(k, v)
+	}
+}
+
+// GetBool returns the data value for "key" as a bool.
+func (m *Record) GetBool(key string) bool {
+	return cast.ToBool(m.Get(key))
+}
+
+// GetString returns the data value for "key" as a string.
+func (m *Record) GetString(key string) string {
+	return cast.ToString(m.Get(key))
+}
+
+// GetInt returns the data value for "key" as an int.
+func (m *Record) GetInt(key string) int {
+	return cast.ToInt(m.Get(key))
+}
+
+// GetFloat returns the data value for "key" as a float64.
+func (m *Record) GetFloat(key string) float64 {
+	return cast.ToFloat64(m.Get(key))
+}
+
+// GetDateTime returns the data value for "key" as a DateTime instance.
+func (m *Record) GetDateTime(key string) types.DateTime {
+	d, _ := types.ParseDateTime(m.Get(key))
+	return d
+}
+
+// GetGeoPoint returns the data value for "key" as a GeoPoint instance.
+func (m *Record) GetGeoPoint(key string) types.GeoPoint {
+	point := types.GeoPoint{}
+	_ = point.Scan(m.Get(key))
+	return point
+}
+
+// GetStringSlice returns the data value for "key" as a slice of non-zero unique strings.
+func (m *Record) GetStringSlice(key string) []string {
+	return list.ToUniqueStringSlice(m.Get(key))
+}
+
+// GetUnsavedFiles returns the uploaded files for the provided "file" field key,
+// (aka. the current [*filesytem.File] values) so that you can apply further
+// validations or modifications (including changing the file name or content before persisting).
+//
+// Example:
+//
+//	files := record.GetUnsavedFiles("documents")
+//	for _, f := range files {
+//	    f.Name = "doc_" + f.Name // add a prefix to each file name
+//	}
+//	app.Save(record) // the files are pointers so the applied changes will transparently reflect on the record value
+func (m *Record) GetUnsavedFiles(key string) []*filesystem.File {
+	if !strings.HasSuffix(key, ":unsaved") {
+		key += ":unsaved"
+	}
+
+	values, _ := m.Get(key).([]*filesystem.File)
+
+	return values
+}
+
+// Deprecated: replaced with GetUnsavedFiles.
+func (m *Record) GetUploadedFiles(key string) []*filesystem.File {
+	log.Println("Please replace GetUploadedFiles with GetUnsavedFiles")
+	return m.GetUnsavedFiles(key)
+}
+
+// Retrieves the "key" json field value and unmarshals it into "result".
+//
+// Example
+//
+//	result := struct {
+//	    FirstName string `json:"first_name"`
+//	}{}
+//	err := m.UnmarshalJSONField("my_field_name", &result)
+func (m *Record) UnmarshalJSONField(key string, result any) error {
+	return json.Unmarshal([]byte(m.GetString(key)), &result)
+}
+
+// ExpandedOne retrieves a single relation Record from the already
+// loaded expand data of the current model.
+//
+// If the requested expand relation is multiple, this method returns
+// only first available Record from the expanded relation.
+//
+// Returns nil if there is no such expand relation loaded.
+func (m *Record) ExpandedOne(relField string) *Record {
+	if m.expand == nil {
+		return nil
+	}
+
+	rel := m.expand.Get(relField)
+
+	switch v := rel.(type) {
+	case *Record:
+		return v
+	case []*Record:
+		if len(v) > 0 {
+			return v[0]
+		}
+	}
+
+	return nil
+}
+
+// ExpandedAll retrieves a slice of relation Records from the already
+// loaded expand data of the current model.
+//
+// If the requested expand relation is single, this method normalizes
+// the return result and will wrap the single model as a slice.
+//
+// Returns nil slice if there is no such expand relation loaded.
+func (m *Record) ExpandedAll(relField string) []*Record {
+	if m.expand == nil {
+		return nil
+	}
+
+	rel := m.expand.Get(relField)
+
+	switch v := rel.(type) {
+	case *Record:
+		return []*Record{v}
+	case []*Record:
+		return v
+	}
+
+	return nil
+}
+
+// FindFileFieldByFile returns the first file type field for which
+// any of the record's data contains the provided filename.
+func (m *Record) FindFileFieldByFile(filename string) *FileField {
+	for _, field := range m.Collection().Fields {
+		if field.Type() != FieldTypeFile {
+			continue
+		}
+
+		f, ok := field.(*FileField)
+		if !ok {
+			continue
+		}
+
+		filenames := m.GetStringSlice(f.GetName())
+		if slices.Contains(filenames, filename) {
+			return f
+		}
+	}
+
+	return nil
+}
+
+// DBExport implements the [DBExporter] interface and returns a key-value
+// map with the data to be persisted when saving the Record in the database.
+func (m *Record) DBExport(app App) (map[string]any, error) {
+	result, err := m.dbExport()
+	if err != nil {
+		return nil, err
+	}
+
+	// remove exported fields that haven't changed
+	// (with exception of the id column)
+	if !m.IsNew() && m.ignoreUnchangedFields {
+		oldResult, err := m.Original().dbExport()
+		if err != nil {
+			return nil, err
+		}
+
+		for oldK, oldV := range oldResult {
+			if oldK == idColumn {
+				continue
+			}
+			newV, ok := result[oldK]
+			if ok && areValuesEqual(newV, oldV) {
+				delete(result, oldK)
+			}
+		}
+	}
+
+	return result, nil
+}
+
+func (m *Record) dbExport() (map[string]any, error) {
+	fields := m.Collection().Fields
+
+	result := make(map[string]any, len(fields))
+
+	var fieldName string
+	for _, field := range fields {
+		fieldName = field.GetName()
+
+		if f, ok := field.(DriverValuer); ok {
+			v, err := f.DriverValue(m)
+			if err != nil {
+				return nil, err
+			}
+			result[fieldName] = v
+		} else {
+			result[fieldName] = m.GetRaw(fieldName)
+		}
+	}
+
+	return result, nil
+}
+
+func areValuesEqual(a any, b any) bool {
+	switch av := a.(type) {
+	case string:
+		bv, ok := b.(string)
+		return ok && bv == av
+	case bool:
+		bv, ok := b.(bool)
+		return ok && bv == av
+	case float32:
+		bv, ok := b.(float32)
+		return ok && bv == av
+	case float64:
+		bv, ok := b.(float64)
+		return ok && bv == av
+	case uint:
+		bv, ok := b.(uint)
+		return ok && bv == av
+	case uint8:
+		bv, ok := b.(uint8)
+		return ok && bv == av
+	case uint16:
+		bv, ok := b.(uint16)
+		return ok && bv == av
+	case uint32:
+		bv, ok := b.(uint32)
+		return ok && bv == av
+	case uint64:
+		bv, ok := b.(uint64)
+		return ok && bv == av
+	case int:
+		bv, ok := b.(int)
+		return ok && bv == av
+	case int8:
+		bv, ok := b.(int8)
+		return ok && bv == av
+	case int16:
+		bv, ok := b.(int16)
+		return ok && bv == av
+	case int32:
+		bv, ok := b.(int32)
+		return ok && bv == av
+	case int64:
+		bv, ok := b.(int64)
+		return ok && bv == av
+	case []byte:
+		bv, ok := b.([]byte)
+		return ok && bytes.Equal(av, bv)
+	case []string:
+		bv, ok := b.([]string)
+		return ok && slices.Equal(av, bv)
+	case []int:
+		bv, ok := b.([]int)
+		return ok && slices.Equal(av, bv)
+	case []int32:
+		bv, ok := b.([]int32)
+		return ok && slices.Equal(av, bv)
+	case []int64:
+		bv, ok := b.([]int64)
+		return ok && slices.Equal(av, bv)
+	case []float32:
+		bv, ok := b.([]float32)
+		return ok && slices.Equal(av, bv)
+	case []float64:
+		bv, ok := b.([]float64)
+		return ok && slices.Equal(av, bv)
+	case types.JSONArray[string]:
+		bv, ok := b.(types.JSONArray[string])
+		return ok && slices.Equal(av, bv)
+	case types.JSONRaw:
+		bv, ok := b.(types.JSONRaw)
+		return ok && bytes.Equal(av, bv)
+	default:
+		aRaw, err := json.Marshal(a)
+		if err != nil {
+			return false
+		}
+
+		bRaw, err := json.Marshal(b)
+		if err != nil {
+			return false
+		}
+
+		return bytes.Equal(aRaw, bRaw)
+	}
+}
+
+// Hide hides the specified fields from the public safe serialization of the record.
+func (record *Record) Hide(fieldNames ...string) *Record {
+	for _, name := range fieldNames {
+		record.customVisibility.Set(name, false)
+	}
+
+	return record
+}
+
+// Unhide forces to unhide the specified fields from the public safe serialization
+// of the record (even when the collection field itself is marked as hidden).
+func (record *Record) Unhide(fieldNames ...string) *Record {
+	for _, name := range fieldNames {
+		record.customVisibility.Set(name, true)
+	}
+
+	return record
+}
+
+// PublicExport exports only the record fields that are safe to be public.
+//
+// To export unknown data fields you need to set record.WithCustomData(true).
+//
+// For auth records, to force the export of the email field you need to set
+// record.IgnoreEmailVisibility(true).
+func (record *Record) PublicExport() map[string]any {
+	export := make(map[string]any, len(record.collection.Fields)+3)
+
+	var isVisible, hasCustomVisibility bool
+
+	customVisibility := record.customVisibility.GetAll()
+
+	// export schema fields
+	var fieldName string
+	for _, f := range record.collection.Fields {
+		fieldName = f.GetName()
+
+		isVisible, hasCustomVisibility = customVisibility[fieldName]
+		if !hasCustomVisibility {
+			isVisible = !f.GetHidden()
+		}
+
+		if !isVisible {
+			continue
+		}
+
+		export[fieldName] = record.Get(fieldName)
+	}
+
+	// export custom fields
+	if record.exportCustomData {
+		for k, v := range record.CustomData() {
+			isVisible, hasCustomVisibility = customVisibility[k]
+			if !hasCustomVisibility || isVisible {
+				export[k] = v
+			}
+		}
+	}
+
+	if record.Collection().IsAuth() {
+		// always hide the password and tokenKey fields
+		delete(export, FieldNamePassword)
+		delete(export, FieldNameTokenKey)
+
+		if !record.ignoreEmailVisibility && !record.GetBool(FieldNameEmailVisibility) {
+			delete(export, FieldNameEmail)
+		}
+	}
+
+	// add helper collection reference fields
+	isVisible, hasCustomVisibility = customVisibility[FieldNameCollectionId]
+	if !hasCustomVisibility || isVisible {
+		// Replace pbc_ prefix with obc_ for OrchBase branding
+		collectionId := record.collection.Id
+		if strings.HasPrefix(collectionId, "pbc_") {
+			collectionId = "obc_" + strings.TrimPrefix(collectionId, "pbc_")
+		}
+		export[FieldNameCollectionId] = collectionId
+	}
+	isVisible, hasCustomVisibility = customVisibility[FieldNameCollectionName]
+	if !hasCustomVisibility || isVisible {
+		export[FieldNameCollectionName] = record.collection.Name
+	}
+
+	// add expand (if non-nil)
+	isVisible, hasCustomVisibility = customVisibility[FieldNameExpand]
+	if (!hasCustomVisibility || isVisible) && record.expand != nil {
+		export[FieldNameExpand] = record.expand.GetAll()
+	}
+
+	return export
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+//
+// Only the data exported by `PublicExport()` will be serialized.
+func (m Record) MarshalJSON() ([]byte, error) {
+	return json.Marshal(m.PublicExport())
+}
+
+// UnmarshalJSON implements the [json.Unmarshaler] interface.
+func (m *Record) UnmarshalJSON(data []byte) error {
+	result := map[string]any{}
+
+	if err := json.Unmarshal(data, &result); err != nil {
+		return err
+	}
+
+	m.Load(result)
+
+	return nil
+}
+
+// ReplaceModifiers returns a new map with applied modifier
+// values based on the current record and the specified data.
+//
+// The resolved modifier keys will be removed.
+//
+// Multiple modifiers will be applied one after another,
+// while reusing the previous base key value result (ex. 1; -5; +2 => -2).
+//
+// Note that because Go doesn't guaranteed the iteration order of maps,
+// we would explicitly apply shorter keys first for a more consistent and reproducible behavior.
+//
+// Example usage:
+//
+//	 newData := record.ReplaceModifiers(data)
+//		// record: {"field": 10}
+//		// data:   {"field+": 5}
+//		// result: {"field": 15}
+func (m *Record) ReplaceModifiers(data map[string]any) map[string]any {
+	if len(data) == 0 {
+		return data
+	}
+
+	dataCopy := maps.Clone(data)
+
+	recordCopy := m.Fresh()
+
+	// key orders is not guaranteed so
+	sortedDataKeys := make([]string, 0, len(data))
+	for k := range data {
+		sortedDataKeys = append(sortedDataKeys, k)
+	}
+	sort.SliceStable(sortedDataKeys, func(i int, j int) bool {
+		return len(sortedDataKeys[i]) < len(sortedDataKeys[j])
+	})
+
+	for _, k := range sortedDataKeys {
+		field := recordCopy.SetIfFieldExists(k, data[k])
+		if field != nil {
+			// delete the original key in case it is with a modifer (ex. "items+")
+			delete(dataCopy, k)
+
+			// store the transformed value under the field name
+			dataCopy[field.GetName()] = recordCopy.Get(field.GetName())
+		}
+	}
+
+	return dataCopy
+}
+
+// -------------------------------------------------------------------
+
+func (m *Record) callFieldInterceptors(
+	ctx context.Context,
+	app App,
+	actionName string,
+	actionFunc func() error,
+) error {
+	// the firing order of the fields doesn't matter
+	for _, field := range m.Collection().Fields {
+		if f, ok := field.(RecordInterceptor); ok {
+			oldfn := actionFunc
+			actionFunc = func() error {
+				return f.Intercept(ctx, app, m, actionName, oldfn)
+			}
+		}
+	}
+
+	return actionFunc()
+}
+
+func onRecordValidate(e *RecordEvent) error {
+	errs := validation.Errors{}
+
+	for _, f := range e.Record.Collection().Fields {
+		if err := f.ValidateValue(e.Context, e.App, e.Record); err != nil {
+			errs[f.GetName()] = err
+		}
+	}
+
+	if len(errs) > 0 {
+		return errs
+	}
+
+	return e.Next()
+}
+
+func onRecordSaveExecute(e *RecordEvent) error {
+	if e.Record.Collection().IsAuth() {
+		// ensure that the token key is regenerated on password change or email change
+		if !e.Record.IsNew() {
+			lastSavedRecord, err := e.App.FindRecordById(e.Record.Collection(), e.Record.Id)
+			if err != nil {
+				return err
+			}
+
+			if lastSavedRecord.TokenKey() == e.Record.TokenKey() &&
+				(lastSavedRecord.Get(FieldNamePassword) != e.Record.Get(FieldNamePassword) ||
+					lastSavedRecord.Email() != e.Record.Email()) {
+				e.Record.RefreshTokenKey()
+			}
+		}
+
+		// cross-check that the auth record id is unique across all auth collections.
+		authCollections, err := e.App.FindAllCollections(CollectionTypeAuth)
+		if err != nil {
+			return fmt.Errorf("unable to fetch the auth collections for cross-id unique check: %w", err)
+		}
+		for _, collection := range authCollections {
+			if e.Record.Collection().Id == collection.Id {
+				continue // skip current collection (sqlite will do the check for us)
+			}
+			record, _ := e.App.FindRecordById(collection, e.Record.Id)
+			if record != nil {
+				return validation.Errors{
+					FieldNameId: validation.NewError("validation_invalid_auth_id", "Invalid or duplicated auth record id."),
+				}
+			}
+		}
+	}
+
+	err := e.Next()
+	if err == nil {
+		return nil
+	}
+
+	return validators.NormalizeUniqueIndexError(
+		err,
+		e.Record.Collection().Name,
+		e.Record.Collection().Fields.FieldNames(),
+	)
+}
+
+func onRecordDeleteExecute(e *RecordEvent) error {
+	// fetch rel references (if any)
+	//
+	// note: the select is outside of the transaction to minimize
+	// SQLITE_BUSY errors when mixing read&write in a single transaction
+	refs, err := e.App.FindCachedCollectionReferences(e.Record.Collection())
+	if err != nil {
+		return err
+	}
+
+	originalApp := e.App
+	txErr := e.App.RunInTransaction(func(txApp App) error {
+		e.App = txApp
+
+		// delete the record before the relation references to ensure that there
+		// will be no "A<->B" relations to prevent deadlock when calling DeleteRecord recursively
+		if err := e.Next(); err != nil {
+			return err
+		}
+
+		return cascadeRecordDelete(txApp, e.Record, refs)
+	})
+	e.App = originalApp
+
+	return txErr
+}
+
+// cascadeRecordDelete triggers cascade deletion for the provided references.
+//
+// NB! This method is expected to be called from inside of a transaction.
+func cascadeRecordDelete(app App, mainRecord *Record, refs map[*Collection][]Field) error {
+	// Sort the refs keys to ensure that the cascade events firing order is always the same.
+	// This is not necessary for the operation to function correctly but it helps having deterministic output during testing.
+	sortedRefKeys := make([]*Collection, 0, len(refs))
+	for k := range refs {
+		sortedRefKeys = append(sortedRefKeys, k)
+	}
+	sort.Slice(sortedRefKeys, func(i, j int) bool {
+		return sortedRefKeys[i].Name < sortedRefKeys[j].Name
+	})
+
+	for _, refCollection := range sortedRefKeys {
+		fields, ok := refs[refCollection]
+
+		if !ok || refCollection.IsView() {
+			continue // skip missing or view collections
+		}
+
+		recordTableName := inflector.Columnify(refCollection.Name)
+
+		for _, field := range fields {
+			prefixedFieldName := recordTableName + "." + inflector.Columnify(field.GetName())
+
+			query := app.RecordQuery(refCollection)
+
+			if opt, ok := field.(MultiValuer); !ok || !opt.IsMultiple() {
+				query.AndWhere(dbx.HashExp{prefixedFieldName: mainRecord.Id})
+			} else {
+				/* SQLite:
+				query.AndWhere(dbx.Exists(dbx.NewExp(fmt.Sprintf(
+					`SELECT 1 FROM json_each(CASE WHEN json_valid([[%s]]) THEN [[%s]] ELSE json_array([[%s]]) END) {{__je__}} WHERE [[__je__.value]]={:jevalue}`,
+					prefixedFieldName, prefixedFieldName, prefixedFieldName,
+				), dbx.Params{
+					"jevalue": mainRecord.Id,
+				})))
+				*/
+				// `SELECT 1 FROM %s {{__je__}} WHERE [[__je__.value]]::text={:jevalue}`,
+				// PostgreSQL:
+				query.AndWhere(dbutils.JsonArrayExistsStr(prefixedFieldName, mainRecord.Id))
+			}
+
+			if refCollection.Id == mainRecord.Collection().Id {
+				query.AndWhere(dbx.Not(dbx.HashExp{recordTableName + ".id": mainRecord.Id}))
+			}
+
+			// trigger cascade for each batchSize rel items until there is none
+			batchSize := 4000
+			rows := make([]*Record, 0, batchSize)
+			for {
+				if err := query.Limit(int64(batchSize)).All(&rows); err != nil {
+					return err
+				}
+
+				total := len(rows)
+				if total == 0 {
+					break
+				}
+
+				err := deleteRefRecords(app, mainRecord, rows, field)
+				if err != nil {
+					return err
+				}
+
+				if total < batchSize {
+					break // no more items
+				}
+
+				rows = rows[:0] // keep allocated memory
+			}
+		}
+	}
+
+	return nil
+}
+
+// deleteRefRecords checks if related records has to be deleted (if `CascadeDelete` is set)
+// OR
+// just unset the record id from any relation field values (if they are not required).
+//
+// NB! This method is expected to be called from inside of a transaction.
+func deleteRefRecords(app App, mainRecord *Record, refRecords []*Record, field Field) error {
+	relField, _ := field.(*RelationField)
+	if relField == nil {
+		return errors.New("only RelationField is supported at the moment, got " + field.Type())
+	}
+
+	for _, refRecord := range refRecords {
+		ids := refRecord.GetStringSlice(relField.Name)
+
+		// unset the record id
+		for i := len(ids) - 1; i >= 0; i-- {
+			if ids[i] == mainRecord.Id {
+				ids = append(ids[:i], ids[i+1:]...)
+				break
+			}
+		}
+
+		// cascade delete the reference
+		// (only if there are no other active references in case of multiple select)
+		if relField.CascadeDelete && len(ids) == 0 {
+			if err := app.Delete(refRecord); err != nil {
+				return err
+			}
+			// no further actions are needed (the reference is deleted)
+			continue
+		}
+
+		if relField.Required && len(ids) == 0 {
+			return fmt.Errorf("the record cannot be deleted because it is part of a required reference in record %s (%s collection)", refRecord.Id, refRecord.Collection().Name)
+		}
+
+		// save the reference changes
+		// (without validation because it is possible that another relation field to have a reference to a previous deleted record)
+		refRecord.Set(relField.Name, ids)
+		if err := app.SaveNoValidate(refRecord); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/core/record_model_auth.go b/server/core_backend-server/core/record_model_auth.go
new file mode 100644
index 0000000..07858f4
--- /dev/null
+++ b/server/core_backend-server/core/record_model_auth.go
@@ -0,0 +1,85 @@
+package core
+
+import "github.com/pocketbase/pocketbase/tools/security"
+
+// Email returns the "email" record field value (usually available with Auth collections).
+func (m *Record) Email() string {
+	return m.GetString(FieldNameEmail)
+}
+
+// SetEmail sets the "email" record field value (usually available with Auth collections).
+func (m *Record) SetEmail(email string) {
+	m.Set(FieldNameEmail, email)
+}
+
+// Verified returns the "emailVisibility" record field value (usually available with Auth collections).
+func (m *Record) EmailVisibility() bool {
+	return m.GetBool(FieldNameEmailVisibility)
+}
+
+// SetEmailVisibility sets the "emailVisibility" record field value (usually available with Auth collections).
+func (m *Record) SetEmailVisibility(visible bool) {
+	m.Set(FieldNameEmailVisibility, visible)
+}
+
+// Verified returns the "verified" record field value (usually available with Auth collections).
+func (m *Record) Verified() bool {
+	return m.GetBool(FieldNameVerified)
+}
+
+// SetVerified sets the "verified" record field value (usually available with Auth collections).
+func (m *Record) SetVerified(verified bool) {
+	m.Set(FieldNameVerified, verified)
+}
+
+// TokenKey returns the "tokenKey" record field value (usually available with Auth collections).
+func (m *Record) TokenKey() string {
+	return m.GetString(FieldNameTokenKey)
+}
+
+// SetTokenKey sets the "tokenKey" record field value (usually available with Auth collections).
+func (m *Record) SetTokenKey(key string) {
+	m.Set(FieldNameTokenKey, key)
+}
+
+// RefreshTokenKey generates and sets a new random auth record "tokenKey".
+func (m *Record) RefreshTokenKey() {
+	m.Set(FieldNameTokenKey+autogenerateModifier, "")
+}
+
+// SetPassword sets the "password" record field value (usually available with Auth collections).
+func (m *Record) SetPassword(password string) {
+	// note: the tokenKey will be auto changed if necessary before db write
+	m.Set(FieldNamePassword, password)
+}
+
+// SetRandomPassword sets the "password" auth record field to a random autogenerated value.
+//
+// The autogenerated password is ~30 characters and it is set directly as hash,
+// aka. the field plain password value validators (length, pattern, etc.) are ignored
+// (this is usually used as part of the auto created OTP or OAuth2 user flows).
+func (m *Record) SetRandomPassword() string {
+	pass := security.RandomString(30)
+
+	m.Set(FieldNamePassword, pass)
+	m.RefreshTokenKey() // manually refresh the token key because the plain password is resetted
+
+	// unset the plain value to skip the field validators
+	if raw, ok := m.GetRaw(FieldNamePassword).(*PasswordFieldValue); ok {
+		raw.Plain = ""
+	}
+
+	return pass
+}
+
+// ValidatePassword validates a plain password against the "password" record field.
+//
+// Returns false if the password is incorrect.
+func (m *Record) ValidatePassword(password string) bool {
+	pv, ok := m.GetRaw(FieldNamePassword).(*PasswordFieldValue)
+	if !ok {
+		return false
+	}
+
+	return pv.Validate(password)
+}
diff --git a/server/core_backend-server/core/record_model_auth_test.go b/server/core_backend-server/core/record_model_auth_test.go
new file mode 100644
index 0000000..f716850
--- /dev/null
+++ b/server/core_backend-server/core/record_model_auth_test.go
@@ -0,0 +1,160 @@
+package core_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestRecordEmail(t *testing.T) {
+	record := core.NewRecord(core.NewAuthCollection("test"))
+
+	if record.Email() != "" {
+		t.Fatalf("Expected email %q, got %q", "", record.Email())
+	}
+
+	email := "test@example.com"
+	record.SetEmail(email)
+
+	if record.Email() != email {
+		t.Fatalf("Expected email %q, got %q", email, record.Email())
+	}
+}
+
+func TestRecordEmailVisibility(t *testing.T) {
+	record := core.NewRecord(core.NewAuthCollection("test"))
+
+	if record.EmailVisibility() != false {
+		t.Fatalf("Expected emailVisibility %v, got %v", false, record.EmailVisibility())
+	}
+
+	record.SetEmailVisibility(true)
+
+	if record.EmailVisibility() != true {
+		t.Fatalf("Expected emailVisibility %v, got %v", true, record.EmailVisibility())
+	}
+}
+
+func TestRecordVerified(t *testing.T) {
+	record := core.NewRecord(core.NewAuthCollection("test"))
+
+	if record.Verified() != false {
+		t.Fatalf("Expected verified %v, got %v", false, record.Verified())
+	}
+
+	record.SetVerified(true)
+
+	if record.Verified() != true {
+		t.Fatalf("Expected verified %v, got %v", true, record.Verified())
+	}
+}
+
+func TestRecordTokenKey(t *testing.T) {
+	record := core.NewRecord(core.NewAuthCollection("test"))
+
+	if record.TokenKey() != "" {
+		t.Fatalf("Expected tokenKey %q, got %q", "", record.TokenKey())
+	}
+
+	tokenKey := "example"
+
+	record.SetTokenKey(tokenKey)
+
+	if record.TokenKey() != tokenKey {
+		t.Fatalf("Expected tokenKey %q, got %q", tokenKey, record.TokenKey())
+	}
+
+	record.RefreshTokenKey()
+
+	if record.TokenKey() == tokenKey {
+		t.Fatalf("Expected tokenKey to be random generated, got %q", tokenKey)
+	}
+
+	if len(record.TokenKey()) != 50 {
+		t.Fatalf("Expected %d characters, got %d", 50, len(record.TokenKey()))
+	}
+}
+
+func TestRecordPassword(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		password string
+		expected bool
+	}{
+		{
+			"empty password",
+			"",
+			false,
+		},
+		{
+			"non-empty password",
+			"123456",
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			record := core.NewRecord(core.NewAuthCollection("test"))
+
+			if record.ValidatePassword(s.password) {
+				t.Fatal("[before set] Expected password to be invalid")
+			}
+
+			record.SetPassword(s.password)
+
+			result := record.ValidatePassword(s.password)
+
+			if result != s.expected {
+				t.Fatalf("[after set] Expected ValidatePassword %v, got %v", result, s.expected)
+			}
+
+			// try with a random string to ensure that not any string validates
+			if record.ValidatePassword(security.PseudorandomString(5)) {
+				t.Fatal("[random] Expected password to be invalid")
+			}
+		})
+	}
+}
+
+func TestRecordSetRandomPassword(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	oldTokenKey := "old_tokenKey"
+	record := core.NewRecord(core.NewAuthCollection("test"))
+	record.SetTokenKey(oldTokenKey)
+
+	pass := record.SetRandomPassword()
+
+	if pass == "" {
+		t.Fatal("Expected non-empty generated random password")
+	}
+
+	if !record.ValidatePassword(pass) {
+		t.Fatal("Expected the generated random password to be valid")
+	}
+
+	if record.TokenKey() == oldTokenKey {
+		t.Fatal("Expected token key to change")
+	}
+
+	f, ok := record.Collection().Fields.GetByName(core.FieldNamePassword).(*core.PasswordField)
+	if !ok {
+		t.Fatal("Expected *core.PasswordField")
+	}
+
+	// ensure that the field validators will be ignored
+	f.Min = 1
+	f.Max = 2
+	f.Pattern = `\d+`
+
+	if err := f.ValidateValue(context.Background(), app, record); err != nil {
+		t.Fatalf("Expected password field plain value validators to be ignored, got %v", err)
+	}
+}
diff --git a/server/core_backend-server/core/record_model_superusers.go b/server/core_backend-server/core/record_model_superusers.go
new file mode 100644
index 0000000..8b1da48
--- /dev/null
+++ b/server/core_backend-server/core/record_model_superusers.go
@@ -0,0 +1,118 @@
+package core
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+const CollectionNameSuperusers = "_superusers"
+
+// DefaultInstallerEmail is the default superuser email address
+// for the initial autogenerated superuser account.
+const DefaultInstallerEmail = "__pbinstaller@example.com"
+
+func (app *BaseApp) registerSuperuserHooks() {
+	app.OnRecordDelete(CollectionNameSuperusers).Bind(&hook.Handler[*RecordEvent]{
+		Id: "pbSuperusersRecordDelete",
+		Func: func(e *RecordEvent) error {
+			originalApp := e.App
+			txErr := e.App.RunInTransaction(func(txApp App) error {
+				e.App = txApp
+
+				total, err := e.App.CountRecords(CollectionNameSuperusers)
+				if err != nil {
+					return fmt.Errorf("failed to fetch total superusers count: %w", err)
+				}
+
+				if total == 1 {
+					return router.NewBadRequestError("You can't delete the only existing superuser", nil)
+				}
+
+				return e.Next()
+			})
+			e.App = originalApp
+
+			return txErr
+		},
+		Priority: -99,
+	})
+
+	recordSaveHandler := &hook.Handler[*RecordEvent]{
+		Id: "pbSuperusersRecordSaveExec",
+		Func: func(e *RecordEvent) error {
+			e.Record.SetVerified(true) // always mark superusers as verified
+
+			if err := e.Next(); err != nil {
+				return err
+			}
+
+			// ensure that the installer superuser is deleted
+			if e.Type == ModelEventTypeCreate && e.Record.Email() != DefaultInstallerEmail {
+				record, err := app.FindAuthRecordByEmail(CollectionNameSuperusers, DefaultInstallerEmail)
+				if errors.Is(err, sql.ErrNoRows) {
+					// already deleted
+				} else if err != nil {
+					e.App.Logger().Warn("Failed to fetch installer superuser", "error", err)
+				} else {
+					err = e.App.Delete(record)
+					if err != nil {
+						e.App.Logger().Warn("Failed to delete installer superuser", "error", err)
+					}
+				}
+			}
+
+			return nil
+		},
+		Priority: -99,
+	}
+	app.OnRecordCreateExecute(CollectionNameSuperusers).Bind(recordSaveHandler)
+	app.OnRecordUpdateExecute(CollectionNameSuperusers).Bind(recordSaveHandler)
+
+	// prevent sending password reset emails to the installer address
+	app.OnMailerRecordPasswordResetSend(CollectionNameSuperusers).Bind(&hook.Handler[*MailerRecordEvent]{
+		Id: "pbSuperusersInstallerPasswordReset",
+		Func: func(e *MailerRecordEvent) error {
+			if e.Record.Email() == DefaultInstallerEmail {
+				return errors.New("cannot reset the password for the installer superuser")
+			}
+
+			return e.Next()
+		},
+	})
+
+	collectionSaveHandler := &hook.Handler[*CollectionEvent]{
+		Id: "pbSuperusersCollectionSaveExec",
+		Func: func(e *CollectionEvent) error {
+			// don't allow name change even if executed with SaveNoValidate
+			e.Collection.Name = CollectionNameSuperusers
+
+			// for now don't allow superusers OAuth2 since we don't want
+			// to accidentally create a new superuser by just OAuth2 signin
+			e.Collection.OAuth2.Enabled = false
+			e.Collection.OAuth2.Providers = nil
+
+			// force password auth
+			e.Collection.PasswordAuth.Enabled = true
+
+			// for superusers we don't allow for now standalone OTP auth and always require to be combined with MFA
+			if e.Collection.OTP.Enabled {
+				e.Collection.MFA.Enabled = true
+			}
+
+			return e.Next()
+		},
+		Priority: 99,
+	}
+	app.OnCollectionCreateExecute(CollectionNameSuperusers).Bind(collectionSaveHandler)
+	app.OnCollectionUpdateExecute(CollectionNameSuperusers).Bind(collectionSaveHandler)
+}
+
+// IsSuperuser returns whether the current record is a superuser, aka.
+// whether the record is from the _superusers collection.
+func (m *Record) IsSuperuser() bool {
+	return m.Collection().Name == CollectionNameSuperusers
+}
diff --git a/server/core_backend-server/core/record_model_superusers_test.go b/server/core_backend-server/core/record_model_superusers_test.go
new file mode 100644
index 0000000..db8a70a
--- /dev/null
+++ b/server/core_backend-server/core/record_model_superusers_test.go
@@ -0,0 +1,48 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestRecordIsSuperUser(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		record   *core.Record
+		expected bool
+	}{
+		{demo1, false},
+		{user, false},
+		{superuser, true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.record.Collection().Name, func(t *testing.T) {
+			result := s.record.IsSuperuser()
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/record_model_test.go b/server/core_backend-server/core/record_model_test.go
new file mode 100644
index 0000000..6b9a8a0
--- /dev/null
+++ b/server/core_backend-server/core/record_model_test.go
@@ -0,0 +1,2469 @@
+package core_test
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+func TestNewRecord(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+	collection.Fields.Add(&core.BoolField{Name: "status"})
+
+	m := core.NewRecord(collection)
+
+	rawData, err := json.Marshal(m.FieldsData()) // should be initialized with the defaults
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `{"id":"","status":false}`
+
+	if str := string(rawData); str != expected {
+		t.Fatalf("Expected schema data\n%v\ngot\n%v", expected, str)
+	}
+}
+
+func TestRecordCollection(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+
+	m := core.NewRecord(collection)
+
+	if m.Collection().Name != collection.Name {
+		t.Fatalf("Expected collection with name %q, got %q", collection.Name, m.Collection().Name)
+	}
+}
+
+func TestRecordTableName(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+
+	m := core.NewRecord(collection)
+
+	if m.TableName() != collection.Name {
+		t.Fatalf("Expected table %q, got %q", collection.Name, m.TableName())
+	}
+}
+
+func TestRecordPostScan(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test_collection")
+	collection.Fields.Add(&core.TextField{Name: "test"})
+
+	m := core.NewRecord(collection)
+
+	// calling PostScan without id
+	err := m.PostScan()
+	if err == nil {
+		t.Fatal("Expected PostScan id error, got nil")
+	}
+
+	m.Id = "test_id"
+	m.Set("test", "abc")
+
+	if v := m.IsNew(); v != true {
+		t.Fatalf("[before PostScan] Expected IsNew %v, got %v", true, v)
+	}
+	if v := m.Original().PK(); v != "" {
+		t.Fatalf("[before PostScan] Expected the original PK to be empty string, got %v", v)
+	}
+	if v := m.Original().Get("test"); v != "" {
+		t.Fatalf("[before PostScan] Expected the original 'test' field to be empty string, got %v", v)
+	}
+
+	err = m.PostScan()
+	if err != nil {
+		t.Fatalf("Expected PostScan nil error, got %v", err)
+	}
+
+	if v := m.IsNew(); v != false {
+		t.Fatalf("[after PostScan] Expected IsNew %v, got %v", false, v)
+	}
+	if v := m.Original().PK(); v != "test_id" {
+		t.Fatalf("[after PostScan] Expected the original PK to be %q, got %v", "test_id", v)
+	}
+	if v := m.Original().Get("test"); v != "abc" {
+		t.Fatalf("[after PostScan] Expected the original 'test' field to be %q, got %v", "abc", v)
+	}
+}
+
+func TestRecordHookTags(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+
+	m := core.NewRecord(collection)
+
+	tags := m.HookTags()
+
+	expectedTags := []string{collection.Id, collection.Name}
+
+	if len(tags) != len(expectedTags) {
+		t.Fatalf("Expected tags\n%v\ngot\n%v", expectedTags, tags)
+	}
+
+	for _, tag := range tags {
+		if !slices.Contains(expectedTags, tag) {
+			t.Errorf("Missing expected tag %q", tag)
+		}
+	}
+}
+
+func TestRecordBaseFilesPath(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+
+	m := core.NewRecord(collection)
+	m.Id = "abc"
+
+	result := m.BaseFilesPath()
+	expected := collection.BaseFilesPath() + "/" + m.Id
+	if result != expected {
+		t.Fatalf("Expected %q, got %q", expected, result)
+	}
+}
+
+func TestRecordOriginal(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	originalId := record.Id
+	originalName := record.GetString("name")
+
+	extraFieldsCheck := []string{`"email":`, `"custom":`}
+
+	// change the fields
+	record.Id = "changed"
+	record.Set("name", "name_new")
+	record.Set("custom", "test_custom")
+	record.SetExpand(map[string]any{"test": 123})
+	record.IgnoreEmailVisibility(true)
+	record.IgnoreUnchangedFields(true)
+	record.WithCustomData(true)
+	record.Unhide(record.Collection().Fields.FieldNames()...)
+
+	// ensure that the email visibility and the custom data toggles are active
+	raw, err := record.MarshalJSON()
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+	for _, f := range extraFieldsCheck {
+		if !strings.Contains(rawStr, f) {
+			t.Fatalf("Expected %s in\n%s", f, rawStr)
+		}
+	}
+
+	// check changes
+	if v := record.GetString("name"); v != "name_new" {
+		t.Fatalf("Expected name to be %q, got %q", "name_new", v)
+	}
+	if v := record.GetString("custom"); v != "test_custom" {
+		t.Fatalf("Expected custom to be %q, got %q", "test_custom", v)
+	}
+
+	// check original
+	if v := record.Original().PK(); v != originalId {
+		t.Fatalf("Expected the original PK to be %q, got %q", originalId, v)
+	}
+	if v := record.Original().Id; v != originalId {
+		t.Fatalf("Expected the original id to be %q, got %q", originalId, v)
+	}
+	if v := record.Original().GetString("name"); v != originalName {
+		t.Fatalf("Expected the original name to be %q, got %q", originalName, v)
+	}
+	if v := record.Original().GetString("custom"); v != "" {
+		t.Fatalf("Expected the original custom to be %q, got %q", "", v)
+	}
+	if v := record.Original().Expand(); len(v) != 0 {
+		t.Fatalf("Expected empty original expand, got\n%v", v)
+	}
+
+	// ensure that the email visibility and the custom flag toggles weren't copied
+	originalRaw, err := record.Original().MarshalJSON()
+	if err != nil {
+		t.Fatal(err)
+	}
+	originalRawStr := string(originalRaw)
+	for _, f := range extraFieldsCheck {
+		if strings.Contains(originalRawStr, f) {
+			t.Fatalf("Didn't expected %s in original\n%s", f, originalRawStr)
+		}
+	}
+
+	// loading new data shouldn't affect the original state
+	record.Load(map[string]any{"name": "name_new2"})
+
+	if v := record.GetString("name"); v != "name_new2" {
+		t.Fatalf("Expected name to be %q, got %q", "name_new2", v)
+	}
+
+	if v := record.Original().GetString("name"); v != originalName {
+		t.Fatalf("Expected the original name still to be %q, got %q", originalName, v)
+	}
+}
+
+func TestRecordFresh(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	originalId := record.Id
+
+	extraFieldsCheck := []string{`"email":`, `"custom":`}
+
+	autodateTest := types.NowDateTime()
+
+	// change the fields
+	record.Id = "changed"
+	record.Set("name", "name_new")
+	record.Set("custom", "test_custom")
+	record.SetRaw("created", autodateTest)
+	record.SetExpand(map[string]any{"test": 123})
+	record.IgnoreEmailVisibility(true)
+	record.IgnoreUnchangedFields(true)
+	record.WithCustomData(true)
+	record.Unhide(record.Collection().Fields.FieldNames()...)
+
+	// ensure that the email visibility and the custom data toggles are active
+	raw, err := record.MarshalJSON()
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+	for _, f := range extraFieldsCheck {
+		if !strings.Contains(rawStr, f) {
+			t.Fatalf("Expected %s in\n%s", f, rawStr)
+		}
+	}
+
+	// check changes
+	if v := record.GetString("name"); v != "name_new" {
+		t.Fatalf("Expected name to be %q, got %q", "name_new", v)
+	}
+	if v := record.GetDateTime("created").String(); v != autodateTest.String() {
+		t.Fatalf("Expected created to be %q, got %q", autodateTest.String(), v)
+	}
+	if v := record.GetString("custom"); v != "test_custom" {
+		t.Fatalf("Expected custom to be %q, got %q", "test_custom", v)
+	}
+
+	// check fresh
+	if v := record.Fresh().LastSavedPK(); v != originalId {
+		t.Fatalf("Expected the fresh LastSavedPK to be %q, got %q", originalId, v)
+	}
+	if v := record.Fresh().PK(); v != record.Id {
+		t.Fatalf("Expected the fresh PK to be %q, got %q", record.Id, v)
+	}
+	if v := record.Fresh().Id; v != record.Id {
+		t.Fatalf("Expected the fresh id to be %q, got %q", record.Id, v)
+	}
+	if v := record.Fresh().GetString("name"); v != record.GetString("name") {
+		t.Fatalf("Expected the fresh name to be %q, got %q", record.GetString("name"), v)
+	}
+	if v := record.Fresh().GetDateTime("created").String(); v != autodateTest.String() {
+		t.Fatalf("Expected the fresh created to be %q, got %q", autodateTest.String(), v)
+	}
+	if v := record.Fresh().GetDateTime("updated").String(); v != record.GetDateTime("updated").String() {
+		t.Fatalf("Expected the fresh updated to be %q, got %q", record.GetDateTime("updated").String(), v)
+	}
+	if v := record.Fresh().GetString("custom"); v != "" {
+		t.Fatalf("Expected the fresh custom to be %q, got %q", "", v)
+	}
+	if v := record.Fresh().Expand(); len(v) != 0 {
+		t.Fatalf("Expected empty fresh expand, got\n%v", v)
+	}
+
+	// ensure that the email visibility and the custom flag toggles weren't copied
+	freshRaw, err := record.Fresh().MarshalJSON()
+	if err != nil {
+		t.Fatal(err)
+	}
+	freshRawStr := string(freshRaw)
+	for _, f := range extraFieldsCheck {
+		if strings.Contains(freshRawStr, f) {
+			t.Fatalf("Didn't expected %s in fresh\n%s", f, freshRawStr)
+		}
+	}
+}
+
+func TestRecordClone(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	originalId := record.Id
+
+	extraFieldsCheck := []string{`"email":`, `"custom":`}
+
+	autodateTest := types.NowDateTime()
+
+	// change the fields
+	record.Id = "changed"
+	record.Set("name", "name_new")
+	record.Set("custom", "test_custom")
+	record.SetRaw("created", autodateTest)
+	record.SetExpand(map[string]any{"test": 123})
+	record.IgnoreEmailVisibility(true)
+	record.WithCustomData(true)
+	record.Unhide(record.Collection().Fields.FieldNames()...)
+
+	// ensure that the email visibility and the custom data toggles are active
+	raw, err := record.MarshalJSON()
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+	for _, f := range extraFieldsCheck {
+		if !strings.Contains(rawStr, f) {
+			t.Fatalf("Expected %s in\n%s", f, rawStr)
+		}
+	}
+
+	// check changes
+	if v := record.GetString("name"); v != "name_new" {
+		t.Fatalf("Expected name to be %q, got %q", "name_new", v)
+	}
+	if v := record.GetDateTime("created").String(); v != autodateTest.String() {
+		t.Fatalf("Expected created to be %q, got %q", autodateTest.String(), v)
+	}
+	if v := record.GetString("custom"); v != "test_custom" {
+		t.Fatalf("Expected custom to be %q, got %q", "test_custom", v)
+	}
+
+	// check clone
+	if v := record.Clone().LastSavedPK(); v != originalId {
+		t.Fatalf("Expected the clone LastSavedPK to be %q, got %q", originalId, v)
+	}
+	if v := record.Clone().PK(); v != record.Id {
+		t.Fatalf("Expected the clone PK to be %q, got %q", record.Id, v)
+	}
+	if v := record.Clone().Id; v != record.Id {
+		t.Fatalf("Expected the clone id to be %q, got %q", record.Id, v)
+	}
+	if v := record.Clone().GetString("name"); v != record.GetString("name") {
+		t.Fatalf("Expected the clone name to be %q, got %q", record.GetString("name"), v)
+	}
+	if v := record.Clone().GetDateTime("created").String(); v != autodateTest.String() {
+		t.Fatalf("Expected the clone created to be %q, got %q", autodateTest.String(), v)
+	}
+	if v := record.Clone().GetDateTime("updated").String(); v != record.GetDateTime("updated").String() {
+		t.Fatalf("Expected the clone updated to be %q, got %q", record.GetDateTime("updated").String(), v)
+	}
+	if v := record.Clone().GetString("custom"); v != "test_custom" {
+		t.Fatalf("Expected the clone custom to be %q, got %q", "test_custom", v)
+	}
+	if _, ok := record.Clone().Expand()["test"]; !ok {
+		t.Fatalf("Expected non-empty clone expand")
+	}
+
+	// ensure that the email visibility and the custom data toggles state were copied
+	cloneRaw, err := record.Clone().MarshalJSON()
+	if err != nil {
+		t.Fatal(err)
+	}
+	cloneRawStr := string(cloneRaw)
+	for _, f := range extraFieldsCheck {
+		if !strings.Contains(cloneRawStr, f) {
+			t.Fatalf("Expected %s in clone\n%s", f, cloneRawStr)
+		}
+	}
+}
+
+func TestRecordExpand(t *testing.T) {
+	t.Parallel()
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+
+	expand := record.Expand()
+	if expand == nil || len(expand) != 0 {
+		t.Fatalf("Expected empty map expand, got %v", expand)
+	}
+
+	data1 := map[string]any{"a": 123, "b": 456}
+	data2 := map[string]any{"c": 123}
+	record.SetExpand(data1)
+	record.SetExpand(data2) // should overwrite the previous call
+
+	// modify the expand map to check for shallow copy
+	data2["d"] = 456
+
+	expand = record.Expand()
+	if len(expand) != 1 {
+		t.Fatalf("Expected empty map expand, got %v", expand)
+	}
+	if v := expand["c"]; v != 123 {
+		t.Fatalf("Expected to find expand.c %v, got %v", 123, v)
+	}
+}
+
+func TestRecordMergeExpand(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+	collection.Id = "_pbc_123"
+
+	m := core.NewRecord(collection)
+	m.Id = "m"
+
+	// a
+	a := core.NewRecord(collection)
+	a.Id = "a"
+	a1 := core.NewRecord(collection)
+	a1.Id = "a1"
+	a2 := core.NewRecord(collection)
+	a2.Id = "a2"
+	a3 := core.NewRecord(collection)
+	a3.Id = "a3"
+	a31 := core.NewRecord(collection)
+	a31.Id = "a31"
+	a32 := core.NewRecord(collection)
+	a32.Id = "a32"
+	a.SetExpand(map[string]any{
+		"a1":  a1,
+		"a23": []*core.Record{a2, a3},
+	})
+	a3.SetExpand(map[string]any{
+		"a31": a31,
+		"a32": []*core.Record{a32},
+	})
+
+	// b
+	b := core.NewRecord(collection)
+	b.Id = "b"
+	b1 := core.NewRecord(collection)
+	b1.Id = "b1"
+	b.SetExpand(map[string]any{
+		"b1": b1,
+	})
+
+	// c
+	c := core.NewRecord(collection)
+	c.Id = "c"
+
+	// load initial expand
+	m.SetExpand(map[string]any{
+		"a": a,
+		"b": b,
+		"c": []*core.Record{c},
+	})
+
+	// a (new)
+	aNew := core.NewRecord(collection)
+	aNew.Id = a.Id
+	a3New := core.NewRecord(collection)
+	a3New.Id = a3.Id
+	a32New := core.NewRecord(collection)
+	a32New.Id = "a32New"
+	a33New := core.NewRecord(collection)
+	a33New.Id = "a33New"
+	a3New.SetExpand(map[string]any{
+		"a32":    []*core.Record{a32New},
+		"a33New": a33New,
+	})
+	aNew.SetExpand(map[string]any{
+		"a23": []*core.Record{a2, a3New},
+	})
+
+	// b (new)
+	bNew := core.NewRecord(collection)
+	bNew.Id = "bNew"
+	dNew := core.NewRecord(collection)
+	dNew.Id = "dNew"
+
+	// merge expands
+	m.MergeExpand(map[string]any{
+		"a":    aNew,
+		"b":    []*core.Record{bNew},
+		"dNew": dNew,
+	})
+
+	result := m.Expand()
+
+	raw, err := json.Marshal(result)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expected := `{"a":{"collectionId":"_pbc_123","collectionName":"test","expand":{"a1":{"collectionId":"_pbc_123","collectionName":"test","id":"a1"},"a23":[{"collectionId":"_pbc_123","collectionName":"test","id":"a2"},{"collectionId":"_pbc_123","collectionName":"test","expand":{"a31":{"collectionId":"_pbc_123","collectionName":"test","id":"a31"},"a32":[{"collectionId":"_pbc_123","collectionName":"test","id":"a32"},{"collectionId":"_pbc_123","collectionName":"test","id":"a32New"}],"a33New":{"collectionId":"_pbc_123","collectionName":"test","id":"a33New"}},"id":"a3"}]},"id":"a"},"b":[{"collectionId":"_pbc_123","collectionName":"test","expand":{"b1":{"collectionId":"_pbc_123","collectionName":"test","id":"b1"}},"id":"b"},{"collectionId":"_pbc_123","collectionName":"test","id":"bNew"}],"c":[{"collectionId":"_pbc_123","collectionName":"test","id":"c"}],"dNew":{"collectionId":"_pbc_123","collectionName":"test","id":"dNew"}}`
+
+	if expected != rawStr {
+		t.Fatalf("Expected \n%v, \ngot \n%v", expected, rawStr)
+	}
+}
+
+func TestRecordMergeExpandNilCheck(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+	collection.Id = "_pbc_123"
+
+	scenarios := []struct {
+		name     string
+		expand   map[string]any
+		expected string
+	}{
+		{
+			"nil expand",
+			nil,
+			`{"collectionId":"_pbc_123","collectionName":"test","id":""}`,
+		},
+		{
+			"empty expand",
+			map[string]any{},
+			`{"collectionId":"_pbc_123","collectionName":"test","id":""}`,
+		},
+		{
+			"non-empty expand",
+			map[string]any{"test": core.NewRecord(collection)},
+			`{"collectionId":"_pbc_123","collectionName":"test","expand":{"test":{"collectionId":"_pbc_123","collectionName":"test","id":""}},"id":""}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			m := core.NewRecord(collection)
+			m.MergeExpand(s.expand)
+
+			raw, err := json.Marshal(m)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected \n%v, \ngot \n%v", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestRecordExpandedOne(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+
+	main := core.NewRecord(collection)
+
+	single := core.NewRecord(collection)
+	single.Id = "single"
+
+	multiple1 := core.NewRecord(collection)
+	multiple1.Id = "multiple1"
+
+	multiple2 := core.NewRecord(collection)
+	multiple2.Id = "multiple2"
+
+	main.SetExpand(map[string]any{
+		"single":   single,
+		"multiple": []*core.Record{multiple1, multiple2},
+	})
+
+	if v := main.ExpandedOne("missing"); v != nil {
+		t.Fatalf("Expected nil, got %v", v)
+	}
+
+	if v := main.ExpandedOne("single"); v == nil || v.Id != "single" {
+		t.Fatalf("Expected record with id %q, got %v", "single", v)
+	}
+
+	if v := main.ExpandedOne("multiple"); v == nil || v.Id != "multiple1" {
+		t.Fatalf("Expected record with id %q, got %v", "multiple1", v)
+	}
+}
+
+func TestRecordExpandedAll(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+
+	main := core.NewRecord(collection)
+
+	single := core.NewRecord(collection)
+	single.Id = "single"
+
+	multiple1 := core.NewRecord(collection)
+	multiple1.Id = "multiple1"
+
+	multiple2 := core.NewRecord(collection)
+	multiple2.Id = "multiple2"
+
+	main.SetExpand(map[string]any{
+		"single":   single,
+		"multiple": []*core.Record{multiple1, multiple2},
+	})
+
+	if v := main.ExpandedAll("missing"); v != nil {
+		t.Fatalf("Expected nil, got %v", v)
+	}
+
+	if v := main.ExpandedAll("single"); len(v) != 1 || v[0].Id != "single" {
+		t.Fatalf("Expected [single] slice, got %v", v)
+	}
+
+	if v := main.ExpandedAll("multiple"); len(v) != 2 || v[0].Id != "multiple1" || v[1].Id != "multiple2" {
+		t.Fatalf("Expected [multiple1, multiple2] slice, got %v", v)
+	}
+}
+
+func TestRecordFieldsData(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewAuthCollection("test")
+	collection.Fields.Add(&core.TextField{Name: "field1"})
+	collection.Fields.Add(&core.TextField{Name: "field2"})
+
+	m := core.NewRecord(collection)
+	m.Id = "test_id" // direct id assignment
+	m.Set("email", "test@example.com")
+	m.Set("password", "123") // hidden fields should be also returned
+	m.Set("tokenKey", "789")
+	m.Set("field1", 123)
+	m.Set("field2", 456)
+	m.Set("unknown", 789)
+
+	raw, err := json.Marshal(m.FieldsData())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `{"email":"test@example.com","emailVisibility":false,"field1":"123","field2":"456","id":"test_id","password":"123","tokenKey":"789","verified":false}`
+
+	if v := string(raw); v != expected {
+		t.Fatalf("Expected\n%v\ngot\n%v", expected, v)
+	}
+}
+
+func TestRecordCustomData(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewAuthCollection("test")
+	collection.Fields.Add(&core.TextField{Name: "field1"})
+	collection.Fields.Add(&core.TextField{Name: "field2"})
+
+	m := core.NewRecord(collection)
+	m.Id = "test_id" // direct id assignment
+	m.Set("email", "test@example.com")
+	m.Set("password", "123") // hidden fields should be also returned
+	m.Set("tokenKey", "789")
+	m.Set("field1", 123)
+	m.Set("field2", 456)
+	m.Set("unknown", 789)
+
+	raw, err := json.Marshal(m.CustomData())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `{"unknown":789}`
+
+	if v := string(raw); v != expected {
+		t.Fatalf("Expected\n%v\ngot\n%v", expected, v)
+	}
+}
+
+func TestRecordSetGet(t *testing.T) {
+	t.Parallel()
+
+	f1 := &mockField{}
+	f1.Name = "mock1"
+
+	f2 := &mockField{}
+	f2.Name = "mock2"
+
+	f3 := &mockField{}
+	f3.Name = "mock3"
+
+	collection := core.NewBaseCollection("test")
+	collection.Fields.Add(&core.TextField{Name: "text1"})
+	collection.Fields.Add(&core.TextField{Name: "text2"})
+	collection.Fields.Add(f1)
+	collection.Fields.Add(f2)
+	collection.Fields.Add(f3)
+
+	record := core.NewRecord(collection)
+	record.Set("text1", 123) // should be converted to string using the ScanValue fallback
+	record.SetRaw("text2", 456)
+	record.Set("mock1", 1) // should be converted to string using the setter
+	record.SetRaw("mock2", 1)
+	record.Set("mock3:test", "abc")
+	record.Set("unknown", 789)
+
+	t.Run("GetRaw", func(t *testing.T) {
+		expected := map[string]any{
+			"text1":      "123",
+			"text2":      456,
+			"mock1":      "1",
+			"mock2":      1,
+			"mock3":      "modifier_set",
+			"mock3:test": nil,
+			"unknown":    789,
+		}
+
+		for k, v := range expected {
+			raw := record.GetRaw(k)
+			if raw != v {
+				t.Errorf("Expected %q to be %v, got %v", k, v, raw)
+			}
+		}
+	})
+
+	t.Run("Get", func(t *testing.T) {
+		expected := map[string]any{
+			"text1":      "123",
+			"text2":      456,
+			"mock1":      "1",
+			"mock2":      1,
+			"mock3":      "modifier_set",
+			"mock3:test": "modifier_get",
+			"unknown":    789,
+		}
+
+		for k, v := range expected {
+			get := record.Get(k)
+			if get != v {
+				t.Errorf("Expected %q to be %v, got %v", k, v, get)
+			}
+		}
+	})
+}
+
+func TestRecordLoad(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+	collection.Fields.Add(&core.TextField{Name: "text"})
+
+	record := core.NewRecord(collection)
+	record.Load(map[string]any{
+		"text":   123,
+		"custom": 456,
+	})
+
+	expected := map[string]any{
+		"text":   "123",
+		"custom": 456,
+	}
+
+	for k, v := range expected {
+		get := record.Get(k)
+		if get != v {
+			t.Errorf("Expected %q to be %#v, got %#v", k, v, get)
+		}
+	}
+}
+
+func TestRecordGetBool(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		value    any
+		expected bool
+	}{
+		{nil, false},
+		{"", false},
+		{0, false},
+		{1, true},
+		{[]string{"true"}, false},
+		{time.Now(), false},
+		{"test", false},
+		{"false", false},
+		{"true", true},
+		{false, false},
+		{true, true},
+	}
+
+	collection := core.NewBaseCollection("test")
+	record := core.NewRecord(collection)
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("test", s.value)
+
+			result := record.GetBool("test")
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestRecordGetString(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		value    any
+		expected string
+	}{
+		{nil, ""},
+		{"", ""},
+		{0, "0"},
+		{1.4, "1.4"},
+		{[]string{"true"}, ""},
+		{map[string]int{"test": 1}, ""},
+		{[]byte("abc"), "abc"},
+		{"test", "test"},
+		{false, "false"},
+		{true, "true"},
+	}
+
+	collection := core.NewBaseCollection("test")
+	record := core.NewRecord(collection)
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("test", s.value)
+
+			result := record.GetString("test")
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestRecordGetInt(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		value    any
+		expected int
+	}{
+		{nil, 0},
+		{"", 0},
+		{[]string{"true"}, 0},
+		{map[string]int{"test": 1}, 0},
+		{time.Now(), 0},
+		{"test", 0},
+		{123, 123},
+		{2.4, 2},
+		{"123", 123},
+		{"123.5", 123},
+		{false, 0},
+		{true, 1},
+	}
+
+	collection := core.NewBaseCollection("test")
+	record := core.NewRecord(collection)
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("test", s.value)
+
+			result := record.GetInt("test")
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestRecordGetFloat(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		value    any
+		expected float64
+	}{
+		{nil, 0},
+		{"", 0},
+		{[]string{"true"}, 0},
+		{map[string]int{"test": 1}, 0},
+		{time.Now(), 0},
+		{"test", 0},
+		{123, 123},
+		{2.4, 2.4},
+		{"123", 123},
+		{"123.5", 123.5},
+		{false, 0},
+		{true, 1},
+	}
+
+	collection := core.NewBaseCollection("test")
+	record := core.NewRecord(collection)
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("test", s.value)
+
+			result := record.GetFloat("test")
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestRecordGetDateTime(t *testing.T) {
+	t.Parallel()
+
+	nowTime := time.Now()
+	testTime, _ := time.Parse(types.DefaultDateLayout, "2022-01-01 08:00:40.000Z")
+
+	scenarios := []struct {
+		value    any
+		expected time.Time
+	}{
+		{nil, time.Time{}},
+		{"", time.Time{}},
+		{false, time.Time{}},
+		{true, time.Time{}},
+		{"test", time.Time{}},
+		{[]string{"true"}, time.Time{}},
+		{map[string]int{"test": 1}, time.Time{}},
+		{1641024040, testTime},
+		{"2022-01-01 08:00:40.000", testTime},
+		{nowTime, nowTime},
+	}
+
+	collection := core.NewBaseCollection("test")
+	record := core.NewRecord(collection)
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("test", s.value)
+
+			result := record.GetDateTime("test")
+			if !result.Time().Equal(s.expected) {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestRecordGetStringSlice(t *testing.T) {
+	t.Parallel()
+
+	nowTime := time.Now()
+
+	scenarios := []struct {
+		value    any
+		expected []string
+	}{
+		{nil, []string{}},
+		{"", []string{}},
+		{false, []string{"false"}},
+		{true, []string{"true"}},
+		{nowTime, []string{}},
+		{123, []string{"123"}},
+		{"test", []string{"test"}},
+		{map[string]int{"test": 1}, []string{}},
+		{`["test1", "test2"]`, []string{"test1", "test2"}},
+		{[]int{123, 123, 456}, []string{"123", "456"}},
+		{[]string{"test", "test", "123"}, []string{"test", "123"}},
+	}
+
+	collection := core.NewBaseCollection("test")
+	record := core.NewRecord(collection)
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("test", s.value)
+
+			result := record.GetStringSlice("test")
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected %d elements, got %d: %v", len(s.expected), len(result), result)
+			}
+
+			for _, v := range result {
+				if !slices.Contains(s.expected, v) {
+					t.Fatalf("Cannot find %v in %v", v, s.expected)
+				}
+			}
+		})
+	}
+}
+
+func TestRecordGetGeoPoint(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		value    any
+		expected string
+	}{
+		{nil, `{"lon":0,"lat":0}`},
+		{"", `{"lon":0,"lat":0}`},
+		{0, `{"lon":0,"lat":0}`},
+		{false, `{"lon":0,"lat":0}`},
+		{"{}", `{"lon":0,"lat":0}`},
+		{"[]", `{"lon":0,"lat":0}`},
+		{[]int{1, 2}, `{"lon":0,"lat":0}`},
+		{map[string]any{"lon": 1, "lat": 2}, `{"lon":1,"lat":2}`},
+		{[]byte(`{"lon":1,"lat":2}`), `{"lon":1,"lat":2}`},
+		{`{"lon":1,"lat":2}`, `{"lon":1,"lat":2}`},
+		{types.GeoPoint{Lon: 1, Lat: 2}, `{"lon":1,"lat":2}`},
+		{&types.GeoPoint{Lon: 1, Lat: 2}, `{"lon":1,"lat":2}`},
+	}
+
+	collection := core.NewBaseCollection("test")
+	record := core.NewRecord(collection)
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("test", s.value)
+
+			pointStr := record.GetGeoPoint("test").String()
+
+			if pointStr != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, pointStr)
+			}
+		})
+	}
+}
+
+func TestRecordGetUnsavedFiles(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f1, err := filesystem.NewFileFromBytes([]byte("test"), "f1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f1.Name = "f1"
+
+	f2, err := filesystem.NewFileFromBytes([]byte("test"), "f2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f2.Name = "f2"
+
+	record, err := app.FindRecordById("demo3", "lcl9d87w22ml6jy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	record.Set("files+", []any{f1, f2})
+
+	scenarios := []struct {
+		key      string
+		expected string
+	}{
+		{
+			"",
+			"null",
+		},
+		{
+			"title",
+			"null",
+		},
+		{
+			"files",
+			`[{"name":"f1","originalName":"f1","size":4},{"name":"f2","originalName":"f2","size":4}]`,
+		},
+		{
+			"files:unsaved",
+			`[{"name":"f1","originalName":"f1","size":4},{"name":"f2","originalName":"f2","size":4}]`,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.key), func(t *testing.T) {
+			v := record.GetUnsavedFiles(s.key)
+
+			raw, err := json.Marshal(v)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestRecordUnmarshalJSONField(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+	collection.Fields.Add(&core.JSONField{Name: "field"})
+
+	record := core.NewRecord(collection)
+
+	var testPointer *string
+	var testStr string
+	var testInt int
+	var testBool bool
+	var testSlice []int
+	var testMap map[string]any
+
+	scenarios := []struct {
+		value        any
+		destination  any
+		expectError  bool
+		expectedJSON string
+	}{
+		{nil, testPointer, false, `null`},
+		{nil, testStr, false, `""`},
+		{"", testStr, false, `""`},
+		{1, testInt, false, `1`},
+		{true, testBool, false, `true`},
+		{[]int{1, 2, 3}, testSlice, false, `[1,2,3]`},
+		{map[string]any{"test": 123}, testMap, false, `{"test":123}`},
+		// json encoded values
+		{`null`, testPointer, false, `null`},
+		{`true`, testBool, false, `true`},
+		{`456`, testInt, false, `456`},
+		{`"test"`, testStr, false, `"test"`},
+		{`[4,5,6]`, testSlice, false, `[4,5,6]`},
+		{`{"test":456}`, testMap, false, `{"test":456}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			record.Set("field", s.value)
+
+			err := record.UnmarshalJSONField("field", &s.destination)
+			hasErr := err != nil
+
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+
+			raw, _ := json.Marshal(s.destination)
+			if v := string(raw); v != s.expectedJSON {
+				t.Fatalf("Expected %q, got %q", s.expectedJSON, v)
+			}
+		})
+	}
+}
+
+func TestRecordFindFileFieldByFile(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+	collection.Fields.Add(
+		&core.TextField{Name: "field1"},
+		&core.FileField{Name: "field2", MaxSelect: 1, MaxSize: 1},
+		&core.FileField{Name: "field3", MaxSelect: 2, MaxSize: 1},
+	)
+
+	m := core.NewRecord(collection)
+	m.Set("field1", "test")
+	m.Set("field2", "test.png")
+	m.Set("field3", []string{"test1.png", "test2.png"})
+
+	scenarios := []struct {
+		filename    string
+		expectField string
+	}{
+		{"", ""},
+		{"test", ""},
+		{"test2", ""},
+		{"test.png", "field2"},
+		{"test2.png", "field3"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.filename), func(t *testing.T) {
+			result := m.FindFileFieldByFile(s.filename)
+
+			var fieldName string
+			if result != nil {
+				fieldName = result.Name
+			}
+
+			if s.expectField != fieldName {
+				t.Fatalf("Expected field %v, got %v", s.expectField, result)
+			}
+		})
+	}
+}
+
+func TestRecordDBExport(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	f1 := &core.TextField{Name: "field1"}
+	f2 := &core.FileField{Name: "field2", MaxSelect: 1, MaxSize: 1}
+	f3 := &core.SelectField{Name: "field3", MaxSelect: 2, Values: []string{"test1", "test2", "test3"}}
+	f4 := &core.RelationField{Name: "field4", MaxSelect: 2}
+
+	colBase := core.NewBaseCollection("test_base")
+	colBase.Fields.Add(f1, f2, f3, f4)
+
+	colAuth := core.NewAuthCollection("test_auth")
+	colAuth.Fields.Add(f1, f2, f3, f4)
+
+	scenarios := []struct {
+		collection *core.Collection
+		expected   string
+	}{
+		{
+			colBase,
+			`{"field1":"test","field2":"test.png","field3":["test1","test2"],"field4":["test11","test12"],"id":"test_id"}`,
+		},
+		{
+			colAuth,
+			`{"email":"test_email","emailVisibility":true,"field1":"test","field2":"test.png","field3":["test1","test2"],"field4":["test11","test12"],"id":"test_id","password":"_TEST_","tokenKey":"test_tokenKey","verified":false}`,
+		},
+	}
+
+	data := map[string]any{
+		"id":              "test_id",
+		"field1":          "test",
+		"field2":          "test.png",
+		"field3":          []string{"test1", "test2"},
+		"field4":          []string{"test11", "test12", "test11"}, // strip duplicate,
+		"unknown":         "test_unknown",
+		"password":        "test_passwordHash",
+		"username":        "test_username",
+		"emailVisibility": true,
+		"email":           "test_email",
+		"verified":        "invalid", // should be casted
+		"tokenKey":        "test_tokenKey",
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.collection.Type, s.collection.Name), func(t *testing.T) {
+			record := core.NewRecord(s.collection)
+
+			record.Load(data)
+
+			result, err := record.DBExport(app)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := json.Marshal(result)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			// replace _TEST_ placeholder with .+ regex pattern
+			pattern := regexp.MustCompile(strings.ReplaceAll(
+				"^"+regexp.QuoteMeta(s.expected)+"$",
+				"_TEST_",
+				`.+`,
+			))
+
+			if !pattern.MatchString(rawStr) {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+func TestRecordIgnoreUnchangedFields(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	col, err := app.FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	new := core.NewRecord(col)
+
+	existing, err := app.FindRecordById(col, "mk5fmymtx4wsprk")
+	if err != nil {
+		t.Fatal(err)
+	}
+	existing.Set("title", "test_new")
+	existing.Set("files", existing.Get("files")) // no change
+
+	scenarios := []struct {
+		ignoreUnchangedFields bool
+		record                *core.Record
+		expected              []string
+	}{
+		{
+			false,
+			new,
+			[]string{"id", "created", "updated", "title", "files"},
+		},
+		{
+			true,
+			new,
+			[]string{"id", "created", "updated", "title", "files"},
+		},
+		{
+			false,
+			existing,
+			[]string{"id", "created", "updated", "title", "files"},
+		},
+		{
+			true,
+			existing,
+			[]string{"id", "title"},
+		},
+	}
+
+	for i, s := range scenarios {
+		action := "create"
+		if !s.record.IsNew() {
+			action = "update"
+		}
+
+		t.Run(fmt.Sprintf("%d_%s_%v", i, action, s.ignoreUnchangedFields), func(t *testing.T) {
+			s.record.IgnoreUnchangedFields(s.ignoreUnchangedFields)
+
+			result, err := s.record.DBExport(app)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected %d keys, got %d:\n%v", len(s.expected), len(result), result)
+			}
+
+			for _, key := range s.expected {
+				if _, ok := result[key]; !ok {
+					t.Fatalf("Missing expected key %q in\n%v", key, result)
+				}
+			}
+		})
+	}
+}
+
+func TestRecordPublicExportAndMarshalJSON(t *testing.T) {
+	t.Parallel()
+
+	f1 := &core.TextField{Name: "field1"}
+	f2 := &core.FileField{Name: "field2", MaxSelect: 1, MaxSize: 1}
+	f3 := &core.SelectField{Name: "field3", MaxSelect: 2, Values: []string{"test1", "test2", "test3"}}
+	f4 := &core.TextField{Name: "field4", Hidden: true}
+	f5 := &core.TextField{Name: "field5", Hidden: true}
+
+	colBase := core.NewBaseCollection("test_base")
+	colBase.Id = "_pbc_base_123"
+	colBase.Fields.Add(f1, f2, f3, f4, f5)
+
+	colAuth := core.NewAuthCollection("test_auth")
+	colAuth.Id = "_pbc_auth_123"
+	colAuth.Fields.Add(f1, f2, f3, f4, f5)
+
+	scenarios := []struct {
+		name                  string
+		collection            *core.Collection
+		ignoreEmailVisibility bool
+		withCustomData        bool
+		hideFields            []string
+		unhideFields          []string
+		expectedJSON          string
+	}{
+		// base
+		{
+			"[base] no extra flags",
+			colBase,
+			false,
+			false,
+			nil,
+			nil,
+			`{"collectionId":"_pbc_base_123","collectionName":"test_base","expand":{"test":123},"field1":"field_1","field2":"field_2.png","field3":["test1","test2"],"id":"test_id"}`,
+		},
+		{
+			"[base] with email visibility",
+			colBase,
+			true, // should have no effect
+			false,
+			nil,
+			nil,
+			`{"collectionId":"_pbc_base_123","collectionName":"test_base","expand":{"test":123},"field1":"field_1","field2":"field_2.png","field3":["test1","test2"],"id":"test_id"}`,
+		},
+		{
+			"[base] with custom data",
+			colBase,
+			true, // should have no effect
+			true,
+			nil,
+			nil,
+			`{"collectionId":"_pbc_base_123","collectionName":"test_base","email":"test_email","emailVisibility":"test_invalid","expand":{"test":123},"field1":"field_1","field2":"field_2.png","field3":["test1","test2"],"id":"test_id","password":"test_passwordHash","tokenKey":"test_tokenKey","unknown":"test_unknown","verified":true}`,
+		},
+		{
+			"[base] with explicit hide and unhide fields",
+			colBase,
+			false,
+			true,
+			[]string{"field3", "field1", "expand", "collectionId", "collectionName", "email", "tokenKey", "unknown"},
+			[]string{"field4", "@pbInternalAbc"},
+			`{"emailVisibility":"test_invalid","field2":"field_2.png","field4":"field_4","id":"test_id","password":"test_passwordHash","verified":true}`,
+		},
+		{
+			"[base] trying to unhide custom fields without explicit WithCustomData",
+			colBase,
+			false,
+			true,
+			nil,
+			[]string{"field5", "@pbInternalAbc", "email", "tokenKey", "unknown"},
+			`{"collectionId":"_pbc_base_123","collectionName":"test_base","email":"test_email","emailVisibility":"test_invalid","expand":{"test":123},"field1":"field_1","field2":"field_2.png","field3":["test1","test2"],"field5":"field_5","id":"test_id","password":"test_passwordHash","tokenKey":"test_tokenKey","unknown":"test_unknown","verified":true}`,
+		},
+
+		// auth
+		{
+			"[auth] no extra flags",
+			colAuth,
+			false,
+			false,
+			nil,
+			nil,
+			`{"collectionId":"_pbc_auth_123","collectionName":"test_auth","emailVisibility":false,"expand":{"test":123},"field1":"field_1","field2":"field_2.png","field3":["test1","test2"],"id":"test_id","verified":true}`,
+		},
+		{
+			"[auth] with email visibility",
+			colAuth,
+			true,
+			false,
+			nil,
+			nil,
+			`{"collectionId":"_pbc_auth_123","collectionName":"test_auth","email":"test_email","emailVisibility":false,"expand":{"test":123},"field1":"field_1","field2":"field_2.png","field3":["test1","test2"],"id":"test_id","verified":true}`,
+		},
+		{
+			"[auth] with custom data",
+			colAuth,
+			false,
+			true,
+			nil,
+			nil,
+			`{"collectionId":"_pbc_auth_123","collectionName":"test_auth","emailVisibility":false,"expand":{"test":123},"field1":"field_1","field2":"field_2.png","field3":["test1","test2"],"id":"test_id","unknown":"test_unknown","verified":true}`,
+		},
+		{
+			"[auth] with explicit hide and unhide fields",
+			colAuth,
+			true,
+			true,
+			[]string{"field3", "field1", "expand", "collectionId", "collectionName", "email", "unknown"},
+			[]string{"field4", "@pbInternalAbc"},
+			`{"emailVisibility":false,"field2":"field_2.png","field4":"field_4","id":"test_id","verified":true}`,
+		},
+		{
+			"[auth] trying to unhide custom fields without explicit WithCustomData",
+			colAuth,
+			false,
+			true,
+			nil,
+			[]string{"field5", "@pbInternalAbc", "tokenKey", "unknown", "email"}, // emailVisibility:false has higher priority
+			`{"collectionId":"_pbc_auth_123","collectionName":"test_auth","emailVisibility":false,"expand":{"test":123},"field1":"field_1","field2":"field_2.png","field3":["test1","test2"],"field5":"field_5","id":"test_id","unknown":"test_unknown","verified":true}`,
+		},
+	}
+
+	data := map[string]any{
+		"id":              "test_id",
+		"field1":          "field_1",
+		"field2":          "field_2.png",
+		"field3":          []string{"test1", "test2"},
+		"field4":          "field_4",
+		"field5":          "field_5",
+		"expand":          map[string]any{"test": 123},
+		"collectionId":    "m_id",   // should be always ignored
+		"collectionName":  "m_name", // should be always ignored
+		"unknown":         "test_unknown",
+		"password":        "test_passwordHash",
+		"emailVisibility": "test_invalid", // for auth collections should be casted to bool
+		"email":           "test_email",
+		"verified":        true,
+		"tokenKey":        "test_tokenKey",
+		"@pbInternalAbc":  "test_custom_inter", // always hidden
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			m := core.NewRecord(s.collection)
+
+			m.Load(data)
+			m.IgnoreEmailVisibility(s.ignoreEmailVisibility)
+			m.WithCustomData(s.withCustomData)
+			m.Unhide(s.unhideFields...)
+			m.Hide(s.hideFields...)
+
+			exportResult, err := json.Marshal(m.PublicExport())
+			if err != nil {
+				t.Fatal(err)
+			}
+			exportResultStr := string(exportResult)
+
+			// MarshalJSON and PublicExport should return the same
+			marshalResult, err := m.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+			marshalResultStr := string(marshalResult)
+
+			if exportResultStr != marshalResultStr {
+				t.Fatalf("Expected the PublicExport to be the same as MarshalJSON, but got \n%v \nvs \n%v", exportResultStr, marshalResultStr)
+			}
+
+			if exportResultStr != s.expectedJSON {
+				t.Fatalf("Expected json \n%v \ngot \n%v", s.expectedJSON, exportResultStr)
+			}
+		})
+	}
+}
+
+func TestRecordUnmarshalJSON(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+	collection.Fields.Add(&core.TextField{Name: "text"})
+
+	record := core.NewRecord(collection)
+
+	data := map[string]any{
+		"text":   123,
+		"custom": 456.789,
+	}
+	rawData, err := json.Marshal(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = record.UnmarshalJSON(rawData)
+	if err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	expected := map[string]any{
+		"text":   "123",
+		"custom": 456.789,
+	}
+
+	for k, v := range expected {
+		get := record.Get(k)
+		if get != v {
+			t.Errorf("Expected %q to be %#v, got %#v", k, v, get)
+		}
+	}
+}
+
+func TestRecordReplaceModifiers(t *testing.T) {
+	t.Parallel()
+
+	collection := core.NewBaseCollection("test")
+	collection.Fields.Add(
+		&mockField{core.TextField{Name: "mock"}},
+		&core.NumberField{Name: "number"},
+	)
+
+	originalData := map[string]any{
+		"mock":   "a",
+		"number": 2.1,
+	}
+
+	record := core.NewRecord(collection)
+	for k, v := range originalData {
+		record.Set(k, v)
+	}
+
+	result := record.ReplaceModifiers(map[string]any{
+		"mock:test": "b",
+		"number+":   3,
+	})
+
+	expected := map[string]any{
+		"mock":   "modifier_set",
+		"number": 5.1,
+	}
+
+	if len(result) != len(expected) {
+		t.Fatalf("Expected\n%v\ngot\n%v", expected, result)
+	}
+
+	for k, v := range expected {
+		if result[k] != v {
+			t.Errorf("Expected %q %#v, got %#v", k, v, result[k])
+		}
+	}
+
+	// ensure that the original data hasn't changed
+	for k, v := range originalData {
+		rv := record.Get(k)
+		if rv != v {
+			t.Errorf("Expected original %q %#v, got %#v", k, v, rv)
+		}
+	}
+}
+
+func TestRecordValidate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// dummy collection to ensure that the specified field validators are triggered
+	collection := core.NewBaseCollection("validate_test")
+	collection.Fields.Add(
+		&core.TextField{Name: "f1", Min: 3},
+		&core.NumberField{Name: "f2", Required: true},
+	)
+	if err := app.Save(collection); err != nil {
+		t.Fatal(err)
+	}
+
+	record := core.NewRecord(collection)
+	record.Id = "!invalid"
+
+	t.Run("no data set", func(t *testing.T) {
+		tests.TestValidationErrors(t, app.Validate(record), []string{"id", "f2"})
+	})
+
+	t.Run("failing the text field min requirement", func(t *testing.T) {
+		record.Set("f1", "a")
+		tests.TestValidationErrors(t, app.Validate(record), []string{"id", "f1", "f2"})
+	})
+
+	t.Run("satisfying the fields validations", func(t *testing.T) {
+		record.Id = strings.Repeat("b", 15)
+		record.Set("f1", "abc")
+		record.Set("f2", 1)
+		tests.TestValidationErrors(t, app.Validate(record), nil)
+	})
+}
+
+func TestRecordModelEventSync(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	col, err := app.FindCollectionByNameOrId("demo3")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testRecords := make([]*core.Record, 4)
+	for i := 0; i < 4; i++ {
+		testRecords[i] = core.NewRecord(col)
+		testRecords[i].Set("title", "sync_test_"+strconv.Itoa(i))
+		if err := app.Save(testRecords[i]); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	createModelEvent := func() *core.ModelEvent {
+		event := new(core.ModelEvent)
+		event.App = app
+		event.Context = context.Background()
+		event.Type = "test_a"
+		event.Model = testRecords[0]
+		return event
+	}
+
+	createModelErrorEvent := func() *core.ModelErrorEvent {
+		event := new(core.ModelErrorEvent)
+		event.ModelEvent = *createModelEvent()
+		event.Error = errors.New("error_a")
+		return event
+	}
+
+	changeRecordEventBefore := func(e *core.RecordEvent) {
+		e.Type = "test_b"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 123)
+		e.Record = testRecords[1]
+	}
+
+	modelEventFinalizerChange := func(e *core.ModelEvent) {
+		e.Type = "test_c"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 456)
+		e.Model = testRecords[2]
+	}
+
+	changeRecordEventAfter := func(e *core.RecordEvent) {
+		e.Type = "test_d"
+		//nolint:staticcheck
+		e.Context = context.WithValue(context.Background(), "test", 789)
+		e.Record = testRecords[3]
+	}
+
+	expectedBeforeModelEventHandlerChecks := func(t *testing.T, e *core.ModelEvent) {
+		if e.Type != "test_a" {
+			t.Fatalf("Expected type %q, got %q", "test_a", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != nil {
+			t.Fatalf("Expected context value %v, got %v", nil, v)
+		}
+
+		if e.Model.PK() != testRecords[0].Id {
+			t.Fatalf("Expected record with id %q, got %q (%d)", testRecords[0].Id, e.Model.PK(), 0)
+		}
+	}
+
+	expectedAfterModelEventHandlerChecks := func(t *testing.T, e *core.ModelEvent) {
+		if e.Type != "test_d" {
+			t.Fatalf("Expected type %q, got %q", "test_d", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != 789 {
+			t.Fatalf("Expected context value %v, got %v", 789, v)
+		}
+
+		// note: currently the Model and Record values are not synced due to performance consideration
+		if e.Model.PK() != testRecords[2].Id {
+			t.Fatalf("Expected record with id %q, got %q (%d)", testRecords[2].Id, e.Model.PK(), 2)
+		}
+	}
+
+	expectedBeforeRecordEventHandlerChecks := func(t *testing.T, e *core.RecordEvent) {
+		if e.Type != "test_a" {
+			t.Fatalf("Expected type %q, got %q", "test_a", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != nil {
+			t.Fatalf("Expected context value %v, got %v", nil, v)
+		}
+
+		if e.Record.Id != testRecords[0].Id {
+			t.Fatalf("Expected record with id %q, got %q (%d)", testRecords[0].Id, e.Record.Id, 2)
+		}
+	}
+
+	expectedAfterRecordEventHandlerChecks := func(t *testing.T, e *core.RecordEvent) {
+		if e.Type != "test_c" {
+			t.Fatalf("Expected type %q, got %q", "test_c", e.Type)
+		}
+
+		if v := e.Context.Value("test"); v != 456 {
+			t.Fatalf("Expected context value %v, got %v", 456, v)
+		}
+
+		// note: currently the Model and Record values are not synced due to performance consideration
+		if e.Record.Id != testRecords[1].Id {
+			t.Fatalf("Expected record with id %q, got %q (%d)", testRecords[1].Id, e.Record.Id, 1)
+		}
+	}
+
+	modelEventFinalizer := func(e *core.ModelEvent) error {
+		modelEventFinalizerChange(e)
+		return nil
+	}
+
+	modelErrorEventFinalizer := func(e *core.ModelErrorEvent) error {
+		modelEventFinalizerChange(&e.ModelEvent)
+		e.Error = errors.New("error_c")
+		return nil
+	}
+
+	modelEventHandler := &hook.Handler[*core.ModelEvent]{
+		Priority: -999,
+		Func: func(e *core.ModelEvent) error {
+			t.Run("before model", func(t *testing.T) {
+				expectedBeforeModelEventHandlerChecks(t, e)
+			})
+
+			_ = e.Next()
+
+			t.Run("after model", func(t *testing.T) {
+				expectedAfterModelEventHandlerChecks(t, e)
+			})
+
+			return nil
+		},
+	}
+
+	modelErrorEventHandler := &hook.Handler[*core.ModelErrorEvent]{
+		Priority: -999,
+		Func: func(e *core.ModelErrorEvent) error {
+			t.Run("before model error", func(t *testing.T) {
+				expectedBeforeModelEventHandlerChecks(t, &e.ModelEvent)
+				if v := e.Error.Error(); v != "error_a" {
+					t.Fatalf("Expected error %q, got %q", "error_a", v)
+				}
+			})
+
+			_ = e.Next()
+
+			t.Run("after model error", func(t *testing.T) {
+				expectedAfterModelEventHandlerChecks(t, &e.ModelEvent)
+				if v := e.Error.Error(); v != "error_d" {
+					t.Fatalf("Expected error %q, got %q", "error_d", v)
+				}
+			})
+
+			return nil
+		},
+	}
+
+	recordEventHandler := &hook.Handler[*core.RecordEvent]{
+		Priority: -999,
+		Func: func(e *core.RecordEvent) error {
+			t.Run("before record", func(t *testing.T) {
+				expectedBeforeRecordEventHandlerChecks(t, e)
+			})
+
+			changeRecordEventBefore(e)
+
+			_ = e.Next()
+
+			t.Run("after record", func(t *testing.T) {
+				expectedAfterRecordEventHandlerChecks(t, e)
+			})
+
+			changeRecordEventAfter(e)
+
+			return nil
+		},
+	}
+
+	recordErrorEventHandler := &hook.Handler[*core.RecordErrorEvent]{
+		Priority: -999,
+		Func: func(e *core.RecordErrorEvent) error {
+			t.Run("before record error", func(t *testing.T) {
+				expectedBeforeRecordEventHandlerChecks(t, &e.RecordEvent)
+				if v := e.Error.Error(); v != "error_a" {
+					t.Fatalf("Expected error %q, got %q", "error_c", v)
+				}
+			})
+
+			changeRecordEventBefore(&e.RecordEvent)
+			e.Error = errors.New("error_b")
+
+			_ = e.Next()
+
+			t.Run("after record error", func(t *testing.T) {
+				expectedAfterRecordEventHandlerChecks(t, &e.RecordEvent)
+				if v := e.Error.Error(); v != "error_c" {
+					t.Fatalf("Expected error %q, got %q", "error_c", v)
+				}
+			})
+
+			changeRecordEventAfter(&e.RecordEvent)
+			e.Error = errors.New("error_d")
+
+			return nil
+		},
+	}
+
+	// OnModelValidate
+	app.OnRecordValidate().Bind(recordEventHandler)
+	app.OnModelValidate().Bind(modelEventHandler)
+	app.OnModelValidate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelCreate
+	app.OnRecordCreate().Bind(recordEventHandler)
+	app.OnModelCreate().Bind(modelEventHandler)
+	app.OnModelCreate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelCreateExecute
+	app.OnRecordCreateExecute().Bind(recordEventHandler)
+	app.OnModelCreateExecute().Bind(modelEventHandler)
+	app.OnModelCreateExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterCreateSuccess
+	app.OnRecordAfterCreateSuccess().Bind(recordEventHandler)
+	app.OnModelAfterCreateSuccess().Bind(modelEventHandler)
+	app.OnModelAfterCreateSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterCreateError
+	app.OnRecordAfterCreateError().Bind(recordErrorEventHandler)
+	app.OnModelAfterCreateError().Bind(modelErrorEventHandler)
+	app.OnModelAfterCreateError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+
+	// OnModelUpdate
+	app.OnRecordUpdate().Bind(recordEventHandler)
+	app.OnModelUpdate().Bind(modelEventHandler)
+	app.OnModelUpdate().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelUpdateExecute
+	app.OnRecordUpdateExecute().Bind(recordEventHandler)
+	app.OnModelUpdateExecute().Bind(modelEventHandler)
+	app.OnModelUpdateExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterUpdateSuccess
+	app.OnRecordAfterUpdateSuccess().Bind(recordEventHandler)
+	app.OnModelAfterUpdateSuccess().Bind(modelEventHandler)
+	app.OnModelAfterUpdateSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterUpdateError
+	app.OnRecordAfterUpdateError().Bind(recordErrorEventHandler)
+	app.OnModelAfterUpdateError().Bind(modelErrorEventHandler)
+	app.OnModelAfterUpdateError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+
+	// OnModelDelete
+	app.OnRecordDelete().Bind(recordEventHandler)
+	app.OnModelDelete().Bind(modelEventHandler)
+	app.OnModelDelete().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelDeleteExecute
+	app.OnRecordDeleteExecute().Bind(recordEventHandler)
+	app.OnModelDeleteExecute().Bind(modelEventHandler)
+	app.OnModelDeleteExecute().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterDeleteSuccess
+	app.OnRecordAfterDeleteSuccess().Bind(recordEventHandler)
+	app.OnModelAfterDeleteSuccess().Bind(modelEventHandler)
+	app.OnModelAfterDeleteSuccess().Trigger(createModelEvent(), modelEventFinalizer)
+
+	// OnModelAfterDeleteError
+	app.OnRecordAfterDeleteError().Bind(recordErrorEventHandler)
+	app.OnModelAfterDeleteError().Bind(modelErrorEventHandler)
+	app.OnModelAfterDeleteError().Trigger(createModelErrorEvent(), modelErrorEventFinalizer)
+}
+
+func TestRecordSave(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name        string
+		record      func(app core.App) (*core.Record, error)
+		expectError bool
+	}{
+		// trigger validators
+		{
+			name: "create - trigger validators",
+			record: func(app core.App) (*core.Record, error) {
+				c, _ := app.FindCollectionByNameOrId("demo2")
+				record := core.NewRecord(c)
+				return record, nil
+			},
+			expectError: true,
+		},
+		{
+			name: "update - trigger validators",
+			record: func(app core.App) (*core.Record, error) {
+				record, _ := app.FindFirstRecordByData("demo2", "title", "test1")
+				record.Set("title", "")
+				return record, nil
+			},
+			expectError: true,
+		},
+
+		// create
+		{
+			name: "create base record",
+			record: func(app core.App) (*core.Record, error) {
+				c, _ := app.FindCollectionByNameOrId("demo2")
+				record := core.NewRecord(c)
+				record.Set("title", "new_test")
+				return record, nil
+			},
+			expectError: false,
+		},
+		{
+			name: "create auth record",
+			record: func(app core.App) (*core.Record, error) {
+				c, _ := app.FindCollectionByNameOrId("nologin")
+				record := core.NewRecord(c)
+				record.Set("email", "test_new@example.com")
+				record.Set("password", "1234567890")
+				return record, nil
+			},
+			expectError: false,
+		},
+		{
+			name: "create view record",
+			record: func(app core.App) (*core.Record, error) {
+				c, _ := app.FindCollectionByNameOrId("view2")
+				record := core.NewRecord(c)
+				record.Set("state", true)
+				return record, nil
+			},
+			expectError: true, // view records are read-only
+		},
+
+		// update
+		{
+			name: "update base record",
+			record: func(app core.App) (*core.Record, error) {
+				record, _ := app.FindFirstRecordByData("demo2", "title", "test1")
+				record.Set("title", "test_new")
+				return record, nil
+			},
+			expectError: false,
+		},
+		{
+			name: "update auth record",
+			record: func(app core.App) (*core.Record, error) {
+				record, _ := app.FindAuthRecordByEmail("nologin", "test@example.com")
+				record.Set("name", "test_new")
+				record.Set("email", "test_new@example.com")
+				return record, nil
+			},
+			expectError: false,
+		},
+		{
+			name: "update view record",
+			record: func(app core.App) (*core.Record, error) {
+				record, _ := app.FindFirstRecordByData("view2", "state", true)
+				record.Set("state", false)
+				return record, nil
+			},
+			expectError: true, // view records are read-only
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			record, err := s.record(app)
+			if err != nil {
+				t.Fatalf("Failed to retrieve test record: %v", err)
+			}
+
+			saveErr := app.Save(record)
+
+			hasErr := saveErr != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", hasErr, s.expectError, saveErr)
+			}
+
+			if hasErr {
+				return
+			}
+
+			// the record should always have an id after successful Save
+			if record.Id == "" {
+				t.Fatal("Expected record id to be set")
+			}
+
+			if record.IsNew() {
+				t.Fatal("Expected the record to be marked as not new")
+			}
+
+			// refetch and compare the serialization
+			refreshed, err := app.FindRecordById(record.Collection(), record.Id)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			rawRefreshed, err := refreshed.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := record.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if !bytes.Equal(raw, rawRefreshed) {
+				t.Fatalf("Expected the refreshed record to be the same as the saved one, got\n%s\nVS\n%s", raw, rawRefreshed)
+			}
+		})
+	}
+}
+
+func TestRecordSaveIdFromOtherCollection(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	baseCollection, _ := app.FindCollectionByNameOrId("demo2")
+	authCollection, _ := app.FindCollectionByNameOrId("nologin")
+
+	// base collection test
+	r1 := core.NewRecord(baseCollection)
+	r1.Set("title", "test_new")
+	r1.Set("id", "mk5fmymtx4wsprk") // existing id of demo3 record
+	if err := app.Save(r1); err != nil {
+		t.Fatalf("Expected nil, got error %v", err)
+	}
+
+	// auth collection test
+	r2 := core.NewRecord(authCollection)
+	r2.SetEmail("test_new@example.com")
+	r2.SetPassword("1234567890")
+	r2.Set("id", "gk390qegs4y47wn") // existing id of "clients" record
+	if err := app.Save(r2); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	// try again with unique id
+	r2.Set("id", strings.Repeat("a", 15))
+	if err := app.Save(r2); err != nil {
+		t.Fatalf("Expected nil, got error %v", err)
+	}
+}
+
+func TestRecordSaveIdUpdateNoValidation(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	rec, err := app.FindRecordById("demo3", "7nwo8tuiatetxdm")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rec.Id = strings.Repeat("a", 15)
+
+	err = app.SaveNoValidate(rec)
+	if err == nil {
+		t.Fatal("Expected save to fail, got nil")
+	}
+
+	// no changes
+	rec.Load(rec.Original().FieldsData())
+	err = app.SaveNoValidate(rec)
+	if err != nil {
+		t.Fatalf("Expected save to succeed, got error %v", err)
+	}
+}
+
+func TestRecordSaveWithAutoTokenKeyRefresh(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name           string
+		payload        map[string]any
+		expectedChange bool
+	}{
+		{
+			"no email or password change",
+			map[string]any{"name": "example"},
+			false,
+		},
+		{
+			"password change",
+			map[string]any{"password": "1234567890"},
+			true,
+		},
+		{
+			"email change",
+			map[string]any{"email": "test_update@example.com"},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			record, err := app.FindFirstRecordByFilter("nologin", "1=1")
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			originalTokenKey := record.TokenKey()
+
+			record.Load(s.payload)
+
+			err = app.Save(record)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			newTokenKey := record.TokenKey()
+
+			hasChange := originalTokenKey != newTokenKey
+
+			if hasChange != s.expectedChange {
+				t.Fatalf("Expected hasChange %v, got %v", s.expectedChange, hasChange)
+			}
+		})
+	}
+}
+
+func TestRecordDelete(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demoCollection, _ := app.FindCollectionByNameOrId("demo2")
+
+	// delete unsaved record
+	// ---
+	newRec := core.NewRecord(demoCollection)
+	if err := app.Delete(newRec); err == nil {
+		t.Fatal("(newRec) Didn't expect to succeed deleting unsaved record")
+	}
+
+	// delete view record
+	// ---
+	viewRec, _ := app.FindRecordById("view2", "84nmscqy84lsi1t")
+	if err := app.Delete(viewRec); err == nil {
+		t.Fatal("(viewRec) Didn't expect to succeed deleting view record")
+	}
+	// check if it still exists
+	viewRec, _ = app.FindRecordById(viewRec.Collection().Id, viewRec.Id)
+	if viewRec == nil {
+		t.Fatal("(viewRec) Expected view record to still exists")
+	}
+
+	// delete existing record + external auths
+	// ---
+	rec1, err3 := app.FindRecordById("users", "4q1xlclmfloku33")
+	_ = err3
+	if err := app.Delete(rec1); err != nil {
+		t.Fatalf("(rec1) Expected nil, got error %v", err)
+	}
+	// check if it was really deleted
+	if refreshed, _ := app.FindRecordById(rec1.Collection().Id, rec1.Id); refreshed != nil {
+		t.Fatalf("(rec1) Expected record to be deleted, got %v", refreshed)
+	}
+	// check if the external auths were deleted
+	if auths, _ := app.FindAllExternalAuthsByRecord(rec1); len(auths) > 0 {
+		t.Fatalf("(rec1) Expected external auths to be deleted, got %v", auths)
+	}
+
+	// delete existing record while being part of a non-cascade required relation
+	// ---
+	rec2, _ := app.FindRecordById("demo3", "7nwo8tuiatetxdm")
+	if err := app.Delete(rec2); err == nil {
+		t.Fatalf("(rec2) Expected error, got nil")
+	}
+
+	// delete existing record + cascade
+	// ---
+	calledQueries := []string{}
+	app.NonconcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.ConcurrentDB().(*dbx.DB).QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.NonconcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	app.ConcurrentDB().(*dbx.DB).ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	rec3, _ := app.FindRecordById("users", "oap640cot4yru2s")
+	// delete
+	if err := app.Delete(rec3); err != nil {
+		t.Fatalf("(rec3) Expected nil, got error %v", err)
+	}
+	// check if it was really deleted
+	rec3, _ = app.FindRecordById(rec3.Collection().Id, rec3.Id)
+	if rec3 != nil {
+		t.Fatalf("(rec3) Expected record to be deleted, got %v", rec3)
+	}
+	// check if the operation cascaded
+	rel, _ := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if rel != nil {
+		t.Fatalf("(rec3) Expected the delete to cascade, found relation %v", rel)
+	}
+	// ensure that the json rel fields were prefixed
+	joinedQueries := strings.Join(calledQueries, " ")
+	/* SQLite:
+	expectedRelManyPart := "SELECT `demo1`.* FROM `demo1` WHERE EXISTS (SELECT 1 FROM json_each(CASE WHEN iif(json_valid([[demo1.rel_many]]), json_type([[demo1.rel_many]])='array', FALSE) THEN [[demo1.rel_many]] ELSE json_array([[demo1.rel_many]]) END) {{__je__}} WHERE [[__je__.value]]='"
+	*/
+	// PostgreSQL:
+	expectedRelManyPart := `SELECT "demo1".* FROM "demo1" WHERE [[demo1.rel_many]] ? `
+	if !strings.Contains(joinedQueries, expectedRelManyPart) {
+		t.Fatalf("(rec3) Expected the cascade delete to call the query \n%v, got \n%v", expectedRelManyPart, calledQueries)
+	}
+	/* SQLite:
+	expectedRelOnePart := "SELECT `demo1`.* FROM `demo1` WHERE (`demo1`.`rel_one`='"
+	*/
+	// PostgreSQL:
+	expectedRelOnePart := `SELECT "demo1".* FROM "demo1" WHERE ("demo1"."rel_one"='`
+	if !strings.Contains(joinedQueries, expectedRelOnePart) {
+		t.Fatalf("(rec3) Expected the cascade delete to call the query \n%v, got \n%v", expectedRelOnePart, calledQueries)
+	}
+}
+
+func TestRecordDeleteBatchProcessing(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	if err := createMockBatchProcessingData(app); err != nil {
+		t.Fatal(err)
+	}
+
+	// find and delete the first c1 record to trigger cascade
+	mainRecord, _ := app.FindRecordById("c1", "a")
+	if err := app.Delete(mainRecord); err != nil {
+		t.Fatal(err)
+	}
+
+	// check if the main record was deleted
+	_, err := app.FindRecordById(mainRecord.Collection().Id, mainRecord.Id)
+	if err == nil {
+		t.Fatal("The main record wasn't deleted")
+	}
+
+	// check if the c1 b rel field were updated
+	c1RecordB, err := app.FindRecordById("c1", "b")
+	if err != nil || c1RecordB.GetString("rel") != "" {
+		t.Fatalf("Expected c1RecordB.rel to be nil, got %v", c1RecordB.GetString("rel"))
+	}
+
+	// check if the c2 rel fields were updated
+	c2Records, err := app.FindAllRecords("c2", nil)
+	if err != nil || len(c2Records) == 0 {
+		t.Fatalf("Failed to fetch c2 records: %v", err)
+	}
+	for _, r := range c2Records {
+		ids := r.GetStringSlice("rel")
+		if len(ids) != 1 || ids[0] != "b" {
+			t.Fatalf("Expected only 'b' rel id, got %v", ids)
+		}
+	}
+
+	// check if all c3 relations were deleted
+	c3Records, err := app.FindAllRecords("c3", nil)
+	if err != nil {
+		t.Fatalf("Failed to fetch c3 records: %v", err)
+	}
+	if total := len(c3Records); total != 0 {
+		t.Fatalf("Expected c3 records to be deleted, found %d", total)
+	}
+}
+
+func createMockBatchProcessingData(app core.App) error {
+	// create mock collection without relation
+	c1 := core.NewBaseCollection("c1")
+	c1.Id = "c1"
+	c1.Fields.Add(
+		&core.TextField{Name: "text"},
+		&core.RelationField{
+			Name:          "rel",
+			MaxSelect:     1,
+			CollectionId:  "c1",
+			CascadeDelete: false, // should unset all rel fields
+		},
+	)
+	if err := app.SaveNoValidate(c1); err != nil {
+		return err
+	}
+
+	// create mock collection with a multi-rel field
+	c2 := core.NewBaseCollection("c2")
+	c2.Id = "c2"
+	c2.Fields.Add(
+		&core.TextField{Name: "text"},
+		&core.RelationField{
+			Name:          "rel",
+			MaxSelect:     10,
+			CollectionId:  "c1",
+			CascadeDelete: false, // should unset all rel fields
+		},
+	)
+	if err := app.SaveNoValidate(c2); err != nil {
+		return err
+	}
+
+	// create mock collection with a single-rel field
+	c3 := core.NewBaseCollection("c3")
+	c3.Id = "c3"
+	c3.Fields.Add(
+		&core.RelationField{
+			Name:          "rel",
+			MaxSelect:     1,
+			CollectionId:  "c1",
+			CascadeDelete: true, // should delete all c3 records
+		},
+	)
+	if err := app.SaveNoValidate(c3); err != nil {
+		return err
+	}
+
+	// insert mock records
+	c1RecordA := core.NewRecord(c1)
+	c1RecordA.Id = "a"
+	c1RecordA.Set("rel", c1RecordA.Id) // self reference
+	if err := app.SaveNoValidate(c1RecordA); err != nil {
+		return err
+	}
+	c1RecordB := core.NewRecord(c1)
+	c1RecordB.Id = "b"
+	c1RecordB.Set("rel", c1RecordA.Id) // rel to another record from the same collection
+	if err := app.SaveNoValidate(c1RecordB); err != nil {
+		return err
+	}
+	for i := 0; i < 4500; i++ {
+		c2Record := core.NewRecord(c2)
+		c2Record.Set("rel", []string{c1RecordA.Id, c1RecordB.Id})
+		if err := app.SaveNoValidate(c2Record); err != nil {
+			return err
+		}
+
+		c3Record := core.NewRecord(c3)
+		c3Record.Set("rel", c1RecordA.Id)
+		if err := app.SaveNoValidate(c3Record); err != nil {
+			return err
+		}
+	}
+
+	// set the same id as the relation for at least 1 record
+	// to check whether the correct condition will be added
+	c3Record := core.NewRecord(c3)
+	c3Record.Set("rel", c1RecordA.Id)
+	c3Record.Id = c1RecordA.Id
+	if err := app.SaveNoValidate(c3Record); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+type mockField struct {
+	core.TextField
+}
+
+func (f *mockField) FindGetter(key string) core.GetterFunc {
+	switch key {
+	case f.Name + ":test":
+		return func(record *core.Record) any {
+			return "modifier_get"
+		}
+	default:
+		return nil
+	}
+}
+
+func (f *mockField) FindSetter(key string) core.SetterFunc {
+	switch key {
+	case f.Name:
+		return func(record *core.Record, raw any) {
+			record.SetRaw(f.Name, cast.ToString(raw))
+		}
+	case f.Name + ":test":
+		return func(record *core.Record, raw any) {
+			record.SetRaw(f.Name, "modifier_set")
+		}
+	default:
+		return nil
+	}
+}
diff --git a/server/core_backend-server/core/record_proxy.go b/server/core_backend-server/core/record_proxy.go
new file mode 100644
index 0000000..644ede7
--- /dev/null
+++ b/server/core_backend-server/core/record_proxy.go
@@ -0,0 +1,32 @@
+package core
+
+// RecordProxy defines an interface for a Record proxy/project model,
+// aka. custom model struct that acts on behalve the proxied Record to
+// allow for example typed getter/setters for the Record fields.
+//
+// To implement the interface it is usually enough to embed the [BaseRecordProxy] struct.
+type RecordProxy interface {
+	// ProxyRecord returns the proxied Record model.
+	ProxyRecord() *Record
+
+	// SetProxyRecord loads the specified record model into the current proxy.
+	SetProxyRecord(record *Record)
+}
+
+var _ RecordProxy = (*BaseRecordProxy)(nil)
+
+// BaseRecordProxy implements the [RecordProxy] interface and it is intended
+// to be used as embed to custom user provided Record proxy structs.
+type BaseRecordProxy struct {
+	*Record
+}
+
+// ProxyRecord returns the proxied Record model.
+func (m *BaseRecordProxy) ProxyRecord() *Record {
+	return m.Record
+}
+
+// SetProxyRecord loads the specified record model into the current proxy.
+func (m *BaseRecordProxy) SetProxyRecord(record *Record) {
+	m.Record = record
+}
diff --git a/server/core_backend-server/core/record_proxy_test.go b/server/core_backend-server/core/record_proxy_test.go
new file mode 100644
index 0000000..bc8f004
--- /dev/null
+++ b/server/core_backend-server/core/record_proxy_test.go
@@ -0,0 +1,20 @@
+package core_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func TestBaseRecordProxy(t *testing.T) {
+	p := core.BaseRecordProxy{}
+
+	record := core.NewRecord(core.NewBaseCollection("test"))
+	record.Id = "test"
+
+	p.SetProxyRecord(record)
+
+	if p.ProxyRecord() == nil || p.ProxyRecord().Id != p.Id || p.Id != "test" {
+		t.Fatalf("Expected proxy record to be set")
+	}
+}
diff --git a/server/core_backend-server/core/record_query.go b/server/core_backend-server/core/record_query.go
new file mode 100644
index 0000000..20139e3
--- /dev/null
+++ b/server/core_backend-server/core/record_query.go
@@ -0,0 +1,629 @@
+package core
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+var recordProxyType = reflect.TypeOf((*RecordProxy)(nil)).Elem()
+
+// RecordQuery returns a new Record select query from a collection model, id or name.
+//
+// In case a collection id or name is provided and that collection doesn't
+// actually exists, the generated query will be created with a cancelled context
+// and will fail once an executor (Row(), One(), All(), etc.) is called.
+func (app *BaseApp) RecordQuery(collectionModelOrIdentifier any) *dbx.SelectQuery {
+	var tableName string
+
+	collection, collectionErr := getCollectionByModelOrIdentifier(app, collectionModelOrIdentifier)
+	if collection != nil {
+		tableName = collection.Name
+	}
+	if tableName == "" {
+		// update with some fake table name for easier debugging
+		tableName = "@@__invalidCollectionModelOrIdentifier"
+	}
+
+	query := app.ConcurrentDB().Select(app.ConcurrentDB().QuoteSimpleColumnName(tableName) + ".*").From(tableName)
+
+	// in case of an error attach a new context and cancel it immediately with the error
+	if collectionErr != nil {
+		ctx, cancelFunc := context.WithCancelCause(context.Background())
+		query.WithContext(ctx)
+		cancelFunc(collectionErr)
+	}
+
+	return query.WithBuildHook(func(q *dbx.Query) {
+		q.WithExecHook(execLockRetry(app.config.QueryTimeout, defaultMaxLockRetries)).
+			WithOneHook(func(q *dbx.Query, a any, op func(b any) error) error {
+				if a == nil {
+					return op(a)
+				}
+
+				switch v := a.(type) {
+				case *Record:
+					record, err := resolveRecordOneHook(collection, op)
+					if err != nil {
+						return err
+					}
+
+					*v = *record
+
+					return nil
+				case RecordProxy:
+					record, err := resolveRecordOneHook(collection, op)
+					if err != nil {
+						return err
+					}
+
+					v.SetProxyRecord(record)
+					return nil
+				default:
+					return op(a)
+				}
+			}).
+			WithAllHook(func(q *dbx.Query, sliceA any, op func(sliceB any) error) error {
+				if sliceA == nil {
+					return op(sliceA)
+				}
+
+				switch v := sliceA.(type) {
+				case *[]*Record:
+					records, err := resolveRecordAllHook(collection, op)
+					if err != nil {
+						return err
+					}
+
+					*v = records
+
+					return nil
+				case *[]Record:
+					records, err := resolveRecordAllHook(collection, op)
+					if err != nil {
+						return err
+					}
+
+					nonPointers := make([]Record, len(records))
+					for i, r := range records {
+						nonPointers[i] = *r
+					}
+
+					*v = nonPointers
+
+					return nil
+				default: // expects []RecordProxy slice
+					rv := reflect.ValueOf(v)
+					if rv.Kind() != reflect.Ptr || rv.IsNil() {
+						return errors.New("must be a pointer")
+					}
+
+					rv = dereference(rv)
+
+					if rv.Kind() != reflect.Slice {
+						return errors.New("must be a slice of RecordSetters")
+					}
+
+					et := rv.Type().Elem()
+
+					var isSliceOfPointers bool
+					if et.Kind() == reflect.Ptr {
+						isSliceOfPointers = true
+						et = et.Elem()
+					}
+
+					if !reflect.PointerTo(et).Implements(recordProxyType) {
+						return op(sliceA)
+					}
+
+					records, err := resolveRecordAllHook(collection, op)
+					if err != nil {
+						return err
+					}
+
+					// create an empty slice
+					if rv.IsNil() {
+						rv.Set(reflect.MakeSlice(rv.Type(), 0, len(records)))
+					}
+
+					for _, record := range records {
+						ev := reflect.New(et)
+
+						if !ev.CanInterface() {
+							continue
+						}
+
+						ps, ok := ev.Interface().(RecordProxy)
+						if !ok {
+							continue
+						}
+
+						ps.SetProxyRecord(record)
+
+						ev = ev.Elem()
+						if isSliceOfPointers {
+							ev = ev.Addr()
+						}
+
+						rv.Set(reflect.Append(rv, ev))
+					}
+
+					return nil
+				}
+			})
+	})
+}
+
+func resolveRecordOneHook(collection *Collection, op func(dst any) error) (*Record, error) {
+	data := dbx.NullStringMap{}
+	if err := op(&data); err != nil {
+		return nil, err
+	}
+	return newRecordFromNullStringMap(collection, data)
+}
+
+func resolveRecordAllHook(collection *Collection, op func(dst any) error) ([]*Record, error) {
+	data := []dbx.NullStringMap{}
+	if err := op(&data); err != nil {
+		return nil, err
+	}
+	return newRecordsFromNullStringMaps(collection, data)
+}
+
+// dereference returns the underlying value v points to.
+func dereference(v reflect.Value) reflect.Value {
+	for v.Kind() == reflect.Ptr {
+		if v.IsNil() {
+			// initialize with a new value and continue searching
+			v.Set(reflect.New(v.Type().Elem()))
+		}
+		v = v.Elem()
+	}
+	return v
+}
+
+func getCollectionByModelOrIdentifier(app App, collectionModelOrIdentifier any) (*Collection, error) {
+	switch c := collectionModelOrIdentifier.(type) {
+	case *Collection:
+		return c, nil
+	case Collection:
+		return &c, nil
+	case string:
+		return app.FindCachedCollectionByNameOrId(c)
+	default:
+		return nil, errors.New("unknown collection identifier - must be collection model, id or name")
+	}
+}
+
+// -------------------------------------------------------------------
+
+// FindRecordById finds the Record model by its id.
+func (app *BaseApp) FindRecordById(
+	collectionModelOrIdentifier any,
+	recordId string,
+	optFilters ...func(q *dbx.SelectQuery) error,
+) (*Record, error) {
+	collection, err := getCollectionByModelOrIdentifier(app, collectionModelOrIdentifier)
+	if err != nil {
+		return nil, err
+	}
+
+	record := &Record{}
+
+	query := app.RecordQuery(collection).
+		AndWhere(dbx.HashExp{collection.Name + ".id": recordId})
+
+	// apply filter funcs (if any)
+	for _, filter := range optFilters {
+		if filter == nil {
+			continue
+		}
+		if err = filter(query); err != nil {
+			return nil, err
+		}
+	}
+
+	err = query.Limit(1).One(record)
+	if err != nil {
+		return nil, err
+	}
+
+	return record, nil
+}
+
+// FindRecordsByIds finds all records by the specified ids.
+// If no records are found, returns an empty slice.
+func (app *BaseApp) FindRecordsByIds(
+	collectionModelOrIdentifier any,
+	recordIds []string,
+	optFilters ...func(q *dbx.SelectQuery) error,
+) ([]*Record, error) {
+	collection, err := getCollectionByModelOrIdentifier(app, collectionModelOrIdentifier)
+	if err != nil {
+		return nil, err
+	}
+
+	query := app.RecordQuery(collection).
+		AndWhere(dbx.In(
+			collection.Name+".id",
+			list.ToInterfaceSlice(recordIds)...,
+		))
+
+	for _, filter := range optFilters {
+		if filter == nil {
+			continue
+		}
+		if err = filter(query); err != nil {
+			return nil, err
+		}
+	}
+
+	records := make([]*Record, 0, len(recordIds))
+
+	err = query.All(&records)
+	if err != nil {
+		return nil, err
+	}
+
+	return records, nil
+}
+
+// FindAllRecords finds all records matching specified db expressions.
+//
+// Returns all collection records if no expression is provided.
+//
+// Returns an empty slice if no records are found.
+//
+// Example:
+//
+//	// no extra expressions
+//	app.FindAllRecords("example")
+//
+//	// with extra expressions
+//	expr1 := dbx.HashExp{"email": "test@example.com"}
+//	expr2 := dbx.NewExp("LOWER(username) = {:username}", dbx.Params{"username": "test"})
+//	app.FindAllRecords("example", expr1, expr2)
+func (app *BaseApp) FindAllRecords(collectionModelOrIdentifier any, exprs ...dbx.Expression) ([]*Record, error) {
+	query := app.RecordQuery(collectionModelOrIdentifier)
+
+	for _, expr := range exprs {
+		if expr != nil { // add only the non-nil expressions
+			query.AndWhere(expr)
+		}
+	}
+
+	var records []*Record
+
+	if err := query.All(&records); err != nil {
+		return nil, err
+	}
+
+	return records, nil
+}
+
+// FindFirstRecordByData returns the first found record matching
+// the provided key-value pair.
+func (app *BaseApp) FindFirstRecordByData(collectionModelOrIdentifier any, key string, value any) (*Record, error) {
+	record := &Record{}
+
+	err := app.RecordQuery(collectionModelOrIdentifier).
+		AndWhere(dbx.HashExp{inflector.Columnify(key): value}).
+		Limit(1).
+		One(record)
+	if err != nil {
+		return nil, err
+	}
+
+	return record, nil
+}
+
+// FindRecordsByFilter returns limit number of records matching the
+// provided string filter.
+//
+// NB! Use the last "params" argument to bind untrusted user variables!
+//
+// The filter argument is optional and can be empty string to target
+// all available records.
+//
+// The sort argument is optional and can be empty string OR the same format
+// used in the web APIs, ex. "-created,title".
+//
+// If the limit argument is <= 0, no limit is applied to the query and
+// all matching records are returned.
+//
+// Returns an empty slice if no records are found.
+//
+// Example:
+//
+//	app.FindRecordsByFilter(
+//		"posts",
+//		"title ~ {:title} && visible = {:visible}",
+//		"-created",
+//		10,
+//		0,
+//		dbx.Params{"title": "lorem ipsum", "visible": true}
+//	)
+func (app *BaseApp) FindRecordsByFilter(
+	collectionModelOrIdentifier any,
+	filter string,
+	sort string,
+	limit int,
+	offset int,
+	params ...dbx.Params,
+) ([]*Record, error) {
+	collection, err := getCollectionByModelOrIdentifier(app, collectionModelOrIdentifier)
+	if err != nil {
+		return nil, err
+	}
+
+	q := app.RecordQuery(collection)
+
+	// build a fields resolver and attach the generated conditions to the query
+	// ---
+	resolver := NewRecordFieldResolver(
+		app,
+		collection, // the base collection
+		nil,        // no request data
+		true,       // allow searching hidden/protected fields like "email"
+	)
+
+	if filter != "" {
+		expr, err := search.FilterData(filter).BuildExpr(resolver, params...)
+		if err != nil {
+			return nil, fmt.Errorf("invalid filter expression: %w", err)
+		}
+		q.AndWhere(expr)
+	}
+
+	if sort != "" {
+		for _, sortField := range search.ParseSortFromString(sort) {
+			expr, err := sortField.BuildExpr(resolver)
+			if err != nil {
+				return nil, err
+			}
+			if expr != "" {
+				q.AndOrderBy(expr)
+			}
+		}
+	}
+
+	err = resolver.UpdateQuery(q) // attaches any adhoc joins and aliases
+	if err != nil {
+		return nil, err
+	}
+	// ---
+
+	if offset > 0 {
+		q.Offset(int64(offset))
+	}
+
+	if limit > 0 {
+		q.Limit(int64(limit))
+	}
+
+	records := []*Record{}
+
+	if err := q.All(&records); err != nil {
+		return nil, err
+	}
+
+	return records, nil
+}
+
+// FindFirstRecordByFilter returns the first available record matching the provided filter (if any).
+//
+// NB! Use the last params argument to bind untrusted user variables!
+//
+// Returns sql.ErrNoRows if no record is found.
+//
+// Example:
+//
+//	app.FindFirstRecordByFilter("posts", "")
+//	app.FindFirstRecordByFilter("posts", "slug={:slug} && status='public'", dbx.Params{"slug": "test"})
+func (app *BaseApp) FindFirstRecordByFilter(
+	collectionModelOrIdentifier any,
+	filter string,
+	params ...dbx.Params,
+) (*Record, error) {
+	result, err := app.FindRecordsByFilter(collectionModelOrIdentifier, filter, "", 1, 0, params...)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(result) == 0 {
+		return nil, sql.ErrNoRows
+	}
+
+	return result[0], nil
+}
+
+// CountRecords returns the total number of records in a collection.
+func (app *BaseApp) CountRecords(collectionModelOrIdentifier any, exprs ...dbx.Expression) (int64, error) {
+	var total int64
+
+	q := app.RecordQuery(collectionModelOrIdentifier).Select("count(*)")
+
+	for _, expr := range exprs {
+		if expr != nil { // add only the non-nil expressions
+			q.AndWhere(expr)
+		}
+	}
+
+	err := q.Row(&total)
+
+	return total, err
+}
+
+// FindAuthRecordByToken finds the auth record associated with the provided JWT
+// (auth, file, verifyEmail, changeEmail, passwordReset types).
+//
+// Optionally specify a list of validTypes to check tokens only from those types.
+//
+// Returns an error if the JWT is invalid, expired or not associated to an auth collection record.
+func (app *BaseApp) FindAuthRecordByToken(token string, validTypes ...string) (*Record, error) {
+	if token == "" {
+		return nil, errors.New("missing token")
+	}
+
+	unverifiedClaims, err := security.ParseUnverifiedJWT(token)
+	if err != nil {
+		return nil, err
+	}
+
+	// check required claims
+	id, _ := unverifiedClaims[TokenClaimId].(string)
+	collectionId, _ := unverifiedClaims[TokenClaimCollectionId].(string)
+	tokenType, _ := unverifiedClaims[TokenClaimType].(string)
+	if id == "" || collectionId == "" || tokenType == "" {
+		return nil, errors.New("missing or invalid token claims")
+	}
+
+	// check types (if explicitly set)
+	if len(validTypes) > 0 && !list.ExistInSlice(tokenType, validTypes) {
+		return nil, fmt.Errorf("invalid token type %q, expects %q", tokenType, strings.Join(validTypes, ","))
+	}
+
+	record, err := app.FindRecordById(collectionId, id)
+	if err != nil {
+		return nil, err
+	}
+
+	if !record.Collection().IsAuth() {
+		return nil, errors.New("the token is not associated to an auth collection record")
+	}
+
+	var baseTokenKey string
+	switch tokenType {
+	case TokenTypeAuth:
+		baseTokenKey = record.Collection().AuthToken.Secret
+	case TokenTypeFile:
+		baseTokenKey = record.Collection().FileToken.Secret
+	case TokenTypeVerification:
+		baseTokenKey = record.Collection().VerificationToken.Secret
+	case TokenTypePasswordReset:
+		baseTokenKey = record.Collection().PasswordResetToken.Secret
+	case TokenTypeEmailChange:
+		baseTokenKey = record.Collection().EmailChangeToken.Secret
+	default:
+		return nil, errors.New("unknown token type " + tokenType)
+	}
+
+	secret := record.TokenKey() + baseTokenKey
+
+	// verify token signature
+	_, err = security.ParseJWT(token, secret)
+	if err != nil {
+		return nil, err
+	}
+
+	return record, nil
+}
+
+// FindAuthRecordByEmail finds the auth record associated with the provided email.
+//
+// The email check would be case-insensitive if the related collection
+// email unique index has COLLATE NOCASE specified for the email column.
+//
+// Returns an error if it is not an auth collection or the record is not found.
+func (app *BaseApp) FindAuthRecordByEmail(collectionModelOrIdentifier any, email string) (*Record, error) {
+	collection, err := getCollectionByModelOrIdentifier(app, collectionModelOrIdentifier)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch auth collection: %w", err)
+	}
+
+	if !collection.IsAuth() {
+		return nil, fmt.Errorf("%q is not an auth collection", collection.Name)
+	}
+
+	record := &Record{}
+
+	var expr dbx.Expression
+
+	index, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, FieldNameEmail)
+	if ok && strings.EqualFold(index.Columns[0].Collate, "nocase") {
+		// case-insensitive search
+		expr = dbx.NewExp("[["+FieldNameEmail+"]] = {:email} COLLATE NOCASE", dbx.Params{"email": email})
+	} else {
+		expr = dbx.HashExp{FieldNameEmail: email}
+	}
+
+	err = app.RecordQuery(collection).
+		AndWhere(expr).
+		Limit(1).
+		One(record)
+	if err != nil {
+		return nil, err
+	}
+
+	return record, nil
+}
+
+// CanAccessRecord checks if a record is allowed to be accessed by the
+// specified requestInfo and accessRule.
+//
+// Rule and db checks are ignored in case requestInfo.Auth is a superuser.
+//
+// The returned error indicate that something unexpected happened during
+// the check (eg. invalid rule or db query error).
+//
+// The method always return false on invalid rule or db query error.
+//
+// Example:
+//
+//	requestInfo, _ := e.RequestInfo()
+//	record, _ := app.FindRecordById("example", "RECORD_ID")
+//	rule := types.Pointer("@request.auth.id != '' || status = 'public'")
+//	// ... or use one of the record collection's rule, eg. record.Collection().ViewRule
+//
+//	if ok, _ := app.CanAccessRecord(record, requestInfo, rule); ok { ... }
+func (app *BaseApp) CanAccessRecord(record *Record, requestInfo *RequestInfo, accessRule *string) (bool, error) {
+	// superusers can access everything
+	if requestInfo.HasSuperuserAuth() {
+		return true, nil
+	}
+
+	// only superusers can access this record
+	if accessRule == nil {
+		return false, nil
+	}
+
+	// empty public rule, aka. everyone can access
+	if *accessRule == "" {
+		return true, nil
+	}
+
+	var exists int
+
+	query := app.RecordQuery(record.Collection()).
+		Select("(1)").
+		AndWhere(dbx.HashExp{record.Collection().Name + ".id": record.Id})
+
+	// parse and apply the access rule filter
+	resolver := NewRecordFieldResolver(app, record.Collection(), requestInfo, true)
+	expr, err := search.FilterData(*accessRule).BuildExpr(resolver)
+	if err != nil {
+		return false, err
+	}
+
+	err = resolver.UpdateQuery(query)
+	if err != nil {
+		return false, err
+	}
+
+	err = query.AndWhere(expr).Limit(1).Row(&exists)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return false, err
+	}
+
+	return exists > 0, nil
+}
diff --git a/server/core_backend-server/core/record_query_expand.go b/server/core_backend-server/core/record_query_expand.go
new file mode 100644
index 0000000..f9bf7d7
--- /dev/null
+++ b/server/core_backend-server/core/record_query_expand.go
@@ -0,0 +1,292 @@
+package core
+
+import (
+	"errors"
+	"fmt"
+	"log"
+	"regexp"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+// ExpandFetchFunc defines the function that is used to fetch the expanded relation records.
+type ExpandFetchFunc func(relCollection *Collection, relIds []string) ([]*Record, error)
+
+// ExpandRecord expands the relations of a single Record model.
+//
+// If optFetchFunc is not set, then a default function will be used
+// that returns all relation records.
+//
+// Returns a map with the failed expand parameters and their errors.
+func (app *BaseApp) ExpandRecord(record *Record, expands []string, optFetchFunc ExpandFetchFunc) map[string]error {
+	return app.ExpandRecords([]*Record{record}, expands, optFetchFunc)
+}
+
+// ExpandRecords expands the relations of the provided Record models list.
+//
+// If optFetchFunc is not set, then a default function will be used
+// that returns all relation records.
+//
+// Returns a map with the failed expand parameters and their errors.
+func (app *BaseApp) ExpandRecords(records []*Record, expands []string, optFetchFunc ExpandFetchFunc) map[string]error {
+	normalized := normalizeExpands(expands)
+
+	failed := map[string]error{}
+
+	for _, expand := range normalized {
+		if err := app.expandRecords(records, expand, optFetchFunc, 1); err != nil {
+			failed[expand] = err
+		}
+	}
+
+	return failed
+}
+
+// Deprecated
+var indirectExpandRegexOld = regexp.MustCompile(`^(\w+)\((\w+)\)$`)
+
+var indirectExpandRegex = regexp.MustCompile(`^(\w+)_via_(\w+)$`)
+
+// notes:
+// - if fetchFunc is nil, dao.FindRecordsByIds will be used
+// - all records are expected to be from the same collection
+// - if maxNestedRels(6) is reached, the function returns nil ignoring the remaining expand path
+func (app *BaseApp) expandRecords(records []*Record, expandPath string, fetchFunc ExpandFetchFunc, recursionLevel int) error {
+	if fetchFunc == nil {
+		// load a default fetchFunc
+		fetchFunc = func(relCollection *Collection, relIds []string) ([]*Record, error) {
+			return app.FindRecordsByIds(relCollection.Id, relIds)
+		}
+	}
+
+	if expandPath == "" || recursionLevel > maxNestedRels || len(records) == 0 {
+		return nil
+	}
+
+	mainCollection := records[0].Collection()
+
+	var relField *RelationField
+	var relCollection *Collection
+
+	parts := strings.SplitN(expandPath, ".", 2)
+	var matches []string
+
+	// @todo remove the old syntax support
+	if strings.Contains(parts[0], "(") {
+		matches = indirectExpandRegexOld.FindStringSubmatch(parts[0])
+		if len(matches) == 3 {
+			log.Printf(
+				"%s expand format is deprecated and will be removed in the future. Consider replacing it with %s_via_%s.\n",
+				matches[0],
+				matches[1],
+				matches[2],
+			)
+		}
+	} else {
+		matches = indirectExpandRegex.FindStringSubmatch(parts[0])
+	}
+
+	if len(matches) == 3 {
+		indirectRel, _ := getCollectionByModelOrIdentifier(app, matches[1])
+		if indirectRel == nil {
+			return fmt.Errorf("couldn't find back-related collection %q", matches[1])
+		}
+
+		indirectRelField, _ := indirectRel.Fields.GetByName(matches[2]).(*RelationField)
+		if indirectRelField == nil || indirectRelField.CollectionId != mainCollection.Id {
+			return fmt.Errorf("couldn't find back-relation field %q in collection %q", matches[2], indirectRel.Name)
+		}
+
+		// add the related id(s) as a dynamic relation field value to
+		// allow further expand checks at later stage in a more unified manner
+		prepErr := func() error {
+			q := app.ConcurrentDB().Select("id").
+				From(indirectRel.Name).
+				Limit(1000) // the limit is arbitrary chosen and may change in the future
+
+			if indirectRelField.IsMultiple() {
+				var subQuery string
+				if IsPostgres(app) {
+					// PostgreSQL:
+					// Note: manual type casting JSONStringValue to String in PostgreSQL.
+					subQuery = "SELECT 1 FROM %s je WHERE je.value = {:id}::text"
+				} else {
+					// SQLite:
+					subQuery = "SELECT 1 FROM %s je WHERE je.value = {:id}"
+				}
+
+				q.AndWhere(dbx.Exists(dbx.NewExp(fmt.Sprintf(
+					subQuery,
+					dbutils.JSONEach(indirectRelField.Name),
+				))))
+			} else {
+				q.AndWhere(dbx.NewExp("[[" + indirectRelField.Name + "]] = {:id}"))
+			}
+
+			pq := q.Build().Prepare()
+
+			for _, record := range records {
+				var relIds []string
+
+				err := pq.Bind(dbx.Params{"id": record.Id}).Column(&relIds)
+				if err != nil {
+					return errors.Join(err, pq.Close())
+				}
+
+				if len(relIds) > 0 {
+					record.Set(parts[0], relIds)
+				}
+			}
+
+			return pq.Close()
+		}()
+		if prepErr != nil {
+			return prepErr
+		}
+
+		// indirect/back relation
+		relField = &RelationField{
+			Name:         parts[0],
+			MaxSelect:    2147483647,
+			CollectionId: indirectRel.Id,
+		}
+		if _, ok := dbutils.FindSingleColumnUniqueIndex(indirectRel.Indexes, indirectRelField.GetName()); ok {
+			relField.MaxSelect = 1
+		}
+		relCollection = indirectRel
+	} else {
+		// direct relation
+		relField, _ = mainCollection.Fields.GetByName(parts[0]).(*RelationField)
+		if relField == nil {
+			return fmt.Errorf("couldn't find relation field %q in collection %q", parts[0], mainCollection.Name)
+		}
+
+		relCollection, _ = getCollectionByModelOrIdentifier(app, relField.CollectionId)
+		if relCollection == nil {
+			return fmt.Errorf("couldn't find related collection %q", relField.CollectionId)
+		}
+	}
+
+	// ---------------------------------------------------------------
+
+	// extract the id of the relations to expand
+	relIds := make([]string, 0, len(records))
+	for _, record := range records {
+		relIds = append(relIds, record.GetStringSlice(relField.Name)...)
+	}
+
+	// fetch rels
+	rels, relsErr := fetchFunc(relCollection, relIds)
+	if relsErr != nil {
+		return relsErr
+	}
+
+	// expand nested fields
+	if len(parts) > 1 {
+		err := app.expandRecords(rels, parts[1], fetchFunc, recursionLevel+1)
+		if err != nil {
+			return err
+		}
+	}
+
+	// reindex with the rel id
+	indexedRels := make(map[string]*Record, len(rels))
+	for _, rel := range rels {
+		indexedRels[rel.Id] = rel
+	}
+
+	for _, model := range records {
+		// init expand if not already
+		// (this is done to ensure that the "expand" key will be returned in the response even if empty)
+		if model.expand == nil {
+			model.SetExpand(nil)
+		}
+
+		relIds := model.GetStringSlice(relField.Name)
+
+		validRels := make([]*Record, 0, len(relIds))
+		for _, id := range relIds {
+			if rel, ok := indexedRels[id]; ok {
+				validRels = append(validRels, rel)
+			}
+		}
+
+		if len(validRels) == 0 {
+			continue // no valid relations
+		}
+
+		expandData := model.Expand()
+
+		// normalize access to the previously expanded rel records (if any)
+		var oldExpandedRels []*Record
+		switch v := expandData[relField.Name].(type) {
+		case nil:
+			// no old expands
+		case *Record:
+			oldExpandedRels = []*Record{v}
+		case []*Record:
+			oldExpandedRels = v
+		}
+
+		// merge expands
+		for _, oldExpandedRel := range oldExpandedRels {
+			// find a matching rel record
+			for _, rel := range validRels {
+				if rel.Id != oldExpandedRel.Id {
+					continue
+				}
+
+				rel.MergeExpand(oldExpandedRel.Expand())
+			}
+		}
+
+		// update the expanded data
+		if relField.IsMultiple() {
+			expandData[relField.Name] = validRels
+		} else {
+			expandData[relField.Name] = validRels[0]
+		}
+
+		model.SetExpand(expandData)
+	}
+
+	return nil
+}
+
+// normalizeExpands normalizes expand strings and merges self containing paths
+// (eg. ["a.b.c", "a.b", "   test  ", "  ", "test"] -> ["a.b.c", "test"]).
+func normalizeExpands(paths []string) []string {
+	// normalize paths
+	normalized := make([]string, 0, len(paths))
+	for _, p := range paths {
+		p = strings.ReplaceAll(p, " ", "") // replace spaces
+		p = strings.Trim(p, ".")           // trim incomplete paths
+		if p != "" {
+			normalized = append(normalized, p)
+		}
+	}
+
+	// merge containing paths
+	result := make([]string, 0, len(normalized))
+	for i, p1 := range normalized {
+		var skip bool
+		for j, p2 := range normalized {
+			if i == j {
+				continue
+			}
+			if strings.HasPrefix(p2, p1+".") {
+				// skip because there is more detailed expand path
+				skip = true
+				break
+			}
+		}
+		if !skip {
+			result = append(result, p1)
+		}
+	}
+
+	return list.ToUniqueStringSlice(result)
+}
diff --git a/server/core_backend-server/core/record_query_expand_test.go b/server/core_backend-server/core/record_query_expand_test.go
new file mode 100644
index 0000000..04b5cbf
--- /dev/null
+++ b/server/core_backend-server/core/record_query_expand_test.go
@@ -0,0 +1,486 @@
+package core_test
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestExpandRecords(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		testName                  string
+		collectionIdOrName        string
+		recordIds                 []string
+		expands                   []string
+		fetchFunc                 core.ExpandFetchFunc
+		expectNonemptyExpandProps int
+		expectExpandFailures      int
+	}{
+		{
+			"empty records",
+			"",
+			[]string{},
+			[]string{"self_rel_one", "self_rel_many.self_rel_one"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			0,
+		},
+		{
+			"empty expand",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			0,
+		},
+		{
+			"fetchFunc with error",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{"self_rel_one", "self_rel_many.self_rel_one"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return nil, errors.New("test error")
+			},
+			0,
+			2,
+		},
+		{
+			"missing relation field",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{"missing"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			1,
+		},
+		{
+			"existing, but non-relation type field",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{"title"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			1,
+		},
+		{
+			"invalid/missing second level expand",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{"rel_one_no_cascade.title"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			1,
+		},
+		{
+			"with nil fetchfunc",
+			"users",
+			[]string{
+				"bgs820n361vj1qd",
+				"4q1xlclmfloku33",
+				"oap640cot4yru2s", // no rels
+			},
+			[]string{"rel"},
+			nil,
+			2,
+			0,
+		},
+		{
+			"expand normalizations",
+			"demo4",
+			[]string{"i9naidtvr6qsgb4", "qzaqccwrmva4o1n"},
+			[]string{
+				"self_rel_one", "self_rel_many.self_rel_many.rel_one_no_cascade",
+				"self_rel_many.self_rel_one.self_rel_many.self_rel_one.rel_one_no_cascade",
+				"self_rel_many", "self_rel_many.",
+				"  self_rel_many  ", "",
+			},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			9,
+			0,
+		},
+		{
+			"single expand",
+			"users",
+			[]string{
+				"bgs820n361vj1qd",
+				"4q1xlclmfloku33",
+				"oap640cot4yru2s", // no rels
+			},
+			[]string{"rel"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			2,
+			0,
+		},
+		{
+			"with nil fetchfunc",
+			"users",
+			[]string{
+				"bgs820n361vj1qd",
+				"4q1xlclmfloku33",
+				"oap640cot4yru2s", // no rels
+			},
+			[]string{"rel"},
+			nil,
+			2,
+			0,
+		},
+		{
+			"maxExpandDepth reached",
+			"demo4",
+			[]string{"qzaqccwrmva4o1n"},
+			[]string{"self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			6,
+			0,
+		},
+		{
+			"simple back single relation field expand (deprecated syntax)",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{"demo4(rel_one_no_cascade_required)"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"simple back expand via single relation field",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{"demo4_via_rel_one_no_cascade_required"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"nested back expand via single relation field",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{
+				"demo4_via_rel_one_no_cascade_required.self_rel_many.self_rel_many.self_rel_one",
+			},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			5,
+			0,
+		},
+		{
+			"nested back expand via multiple relation field",
+			"demo3",
+			[]string{"lcl9d87w22ml6jy"},
+			[]string{
+				"demo4_via_rel_many_no_cascade_required.self_rel_many.rel_many_no_cascade_required.demo4_via_rel_many_no_cascade_required",
+			},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			7,
+			0,
+		},
+		{
+			"expand multiple relations sharing a common path",
+			"demo4",
+			[]string{"qzaqccwrmva4o1n"},
+			[]string{
+				"rel_one_no_cascade",
+				"rel_many_no_cascade",
+				"self_rel_many.self_rel_one.rel_many_cascade",
+				"self_rel_many.self_rel_one.rel_many_no_cascade_required",
+			},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			5,
+			0,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.testName, func(t *testing.T) {
+			ids := list.ToUniqueStringSlice(s.recordIds)
+			records, _ := app.FindRecordsByIds(s.collectionIdOrName, ids)
+			failed := app.ExpandRecords(records, s.expands, s.fetchFunc)
+
+			if len(failed) != s.expectExpandFailures {
+				t.Errorf("Expected %d failures, got %d\n%v", s.expectExpandFailures, len(failed), failed)
+			}
+
+			encoded, _ := json.Marshal(records)
+			encodedStr := string(encoded)
+			totalExpandProps := strings.Count(encodedStr, `"`+core.FieldNameExpand+`":`)
+			totalEmptyExpands := strings.Count(encodedStr, `"`+core.FieldNameExpand+`":{}`)
+			totalNonemptyExpands := totalExpandProps - totalEmptyExpands
+
+			if s.expectNonemptyExpandProps != totalNonemptyExpands {
+				t.Errorf("Expected %d expand props, got %d\n%v", s.expectNonemptyExpandProps, totalNonemptyExpands, encodedStr)
+			}
+		})
+	}
+}
+
+func TestExpandRecord(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		testName                  string
+		collectionIdOrName        string
+		recordId                  string
+		expands                   []string
+		fetchFunc                 core.ExpandFetchFunc
+		expectNonemptyExpandProps int
+		expectExpandFailures      int
+	}{
+		{
+			"empty expand",
+			"demo4",
+			"i9naidtvr6qsgb4",
+			[]string{},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			0,
+		},
+		{
+			"fetchFunc with error",
+			"demo4",
+			"i9naidtvr6qsgb4",
+			[]string{"self_rel_one", "self_rel_many.self_rel_one"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return nil, errors.New("test error")
+			},
+			0,
+			2,
+		},
+		{
+			"missing relation field",
+			"demo4",
+			"i9naidtvr6qsgb4",
+			[]string{"missing"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			1,
+		},
+		{
+			"existing, but non-relation type field",
+			"demo4",
+			"i9naidtvr6qsgb4",
+			[]string{"title"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			1,
+		},
+		{
+			"invalid/missing second level expand",
+			"demo4",
+			"qzaqccwrmva4o1n",
+			[]string{"rel_one_no_cascade.title"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			1,
+		},
+		{
+			"expand normalizations",
+			"demo4",
+			"qzaqccwrmva4o1n",
+			[]string{
+				"self_rel_one", "self_rel_many.self_rel_many.rel_one_no_cascade",
+				"self_rel_many.self_rel_one.self_rel_many.self_rel_one.rel_one_no_cascade",
+				"self_rel_many", "self_rel_many.",
+				"  self_rel_many  ", "",
+			},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			8,
+			0,
+		},
+		{
+			"no rels to expand",
+			"users",
+			"oap640cot4yru2s",
+			[]string{"rel"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			0,
+			0,
+		},
+		{
+			"maxExpandDepth reached",
+			"demo4",
+			"qzaqccwrmva4o1n",
+			[]string{"self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many.self_rel_many"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			6,
+			0,
+		},
+		{
+			"simple indirect expand via single relation field (deprecated syntax)",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{"demo4(rel_one_no_cascade_required)"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"simple indirect expand via single relation field",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{"demo4_via_rel_one_no_cascade_required"},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			1,
+			0,
+		},
+		{
+			"nested indirect expand via single relation field",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{
+				"demo4(rel_one_no_cascade_required).self_rel_many.self_rel_many.self_rel_one",
+			},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			5,
+			0,
+		},
+		{
+			"nested indirect expand via single relation field",
+			"demo3",
+			"lcl9d87w22ml6jy",
+			[]string{
+				"demo4_via_rel_many_no_cascade_required.self_rel_many.rel_many_no_cascade_required.demo4_via_rel_many_no_cascade_required",
+			},
+			func(c *core.Collection, ids []string) ([]*core.Record, error) {
+				return app.FindRecordsByIds(c.Id, ids, nil)
+			},
+			7,
+			0,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.testName, func(t *testing.T) {
+			record, _ := app.FindRecordById(s.collectionIdOrName, s.recordId)
+			failed := app.ExpandRecord(record, s.expands, s.fetchFunc)
+
+			if len(failed) != s.expectExpandFailures {
+				t.Errorf("Expected %d failures, got %d\n%v", s.expectExpandFailures, len(failed), failed)
+			}
+
+			encoded, _ := json.Marshal(record)
+			encodedStr := string(encoded)
+			totalExpandProps := strings.Count(encodedStr, `"`+core.FieldNameExpand+`":`)
+			totalEmptyExpands := strings.Count(encodedStr, `"`+core.FieldNameExpand+`":{}`)
+			totalNonemptyExpands := totalExpandProps - totalEmptyExpands
+
+			if s.expectNonemptyExpandProps != totalNonemptyExpands {
+				t.Errorf("Expected %d expand props, got %d\n%v", s.expectNonemptyExpandProps, totalNonemptyExpands, encodedStr)
+			}
+		})
+	}
+}
+
+func TestBackRelationExpandSingeVsArrayResult(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record, err := app.FindRecordById("demo3", "7nwo8tuiatetxdm")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// non-unique indirect expand
+	{
+		errs := app.ExpandRecord(record, []string{"demo4_via_rel_one_cascade"}, func(c *core.Collection, ids []string) ([]*core.Record, error) {
+			return app.FindRecordsByIds(c.Id, ids, nil)
+		})
+		if len(errs) > 0 {
+			t.Fatal(errs)
+		}
+
+		result, ok := record.Expand()["demo4_via_rel_one_cascade"].([]*core.Record)
+		if !ok {
+			t.Fatalf("Expected the expanded result to be a slice, got %v", result)
+		}
+	}
+
+	// unique indirect expand
+	{
+		// mock a unique constraint for the rel_one_cascade field
+		// ---
+		demo4, err := app.FindCollectionByNameOrId("demo4")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		demo4.Indexes = append(demo4.Indexes, "create unique index idx_unique_expand on demo4 (rel_one_cascade)")
+
+		if err := app.Save(demo4); err != nil {
+			t.Fatalf("Failed to mock unique constraint: %v", err)
+		}
+		// ---
+
+		errs := app.ExpandRecord(record, []string{"demo4_via_rel_one_cascade"}, func(c *core.Collection, ids []string) ([]*core.Record, error) {
+			return app.FindRecordsByIds(c.Id, ids, nil)
+		})
+		if len(errs) > 0 {
+			t.Fatal(errs)
+		}
+
+		result, ok := record.Expand()["demo4_via_rel_one_cascade"].(*core.Record)
+		if !ok {
+			t.Fatalf("Expected the expanded result to be a single model, got %v", result)
+		}
+	}
+}
diff --git a/server/core_backend-server/core/record_query_test.go b/server/core_backend-server/core/record_query_test.go
new file mode 100644
index 0000000..fe38b40
--- /dev/null
+++ b/server/core_backend-server/core/record_query_test.go
@@ -0,0 +1,1197 @@
+package core_test
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestRecordQueryWithDifferentCollectionValues(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name          string
+		collection    any
+		expectedTotal int
+		expectError   bool
+	}{
+		{"with nil value", nil, 0, true},
+		{"with invalid or missing collection id/name", "missing", 0, true},
+		{"with pointer model", collection, 3, false},
+		{"with value model", *collection, 3, false},
+		{"with name", "demo1", 3, false},
+		{"with id", "wsmn24bux7wo113", 3, false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			var records []*core.Record
+			err := app.RecordQuery(s.collection).All(&records)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasError %v, got %v", s.expectError, hasErr)
+			}
+
+			if total := len(records); total != s.expectedTotal {
+				t.Fatalf("Expected %d records, got %d", s.expectedTotal, total)
+			}
+		})
+	}
+}
+
+func TestRecordQueryOne(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name       string
+		collection string
+		recordId   string
+		model      any
+	}{
+		{
+			"record model",
+			"demo1",
+			"84nmscqy84lsi1t",
+			&core.Record{},
+		},
+		{
+			"record proxy",
+			"demo1",
+			"84nmscqy84lsi1t",
+			&struct {
+				core.BaseRecordProxy
+			}{},
+		},
+		{
+			"custom struct",
+			"demo1",
+			"84nmscqy84lsi1t",
+			&struct {
+				Id string `db:"id" json:"id"`
+			}{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection, err := app.FindCollectionByNameOrId(s.collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			q := app.RecordQuery(collection).
+				Where(dbx.HashExp{"id": s.recordId})
+
+			if err := q.One(s.model); err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := json.Marshal(s.model)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if !strings.Contains(rawStr, fmt.Sprintf(`"id":%q`, s.recordId)) {
+				t.Fatalf("Missing id %q in\n%s", s.recordId, rawStr)
+			}
+		})
+	}
+}
+
+func TestRecordQueryAll(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	type customStructs struct {
+		Id string `db:"id" json:"id"`
+	}
+
+	type mockRecordProxy struct {
+		core.BaseRecordProxy
+	}
+
+	scenarios := []struct {
+		name       string
+		collection string
+		recordIds  []any
+		result     any
+	}{
+		{
+			"slice of Record models",
+			"demo1",
+			[]any{"84nmscqy84lsi1t", "al1h9ijdeojtsjy"},
+			&[]core.Record{},
+		},
+		{
+			"slice of pointer Record models",
+			"demo1",
+			[]any{"84nmscqy84lsi1t", "al1h9ijdeojtsjy"},
+			&[]*core.Record{},
+		},
+		{
+			"slice of Record proxies",
+			"demo1",
+			[]any{"84nmscqy84lsi1t", "al1h9ijdeojtsjy"},
+			&[]mockRecordProxy{},
+		},
+		{
+			"slice of pointer Record proxies",
+			"demo1",
+			[]any{"84nmscqy84lsi1t", "al1h9ijdeojtsjy"},
+			&[]mockRecordProxy{},
+		},
+		{
+			"slice of custom structs",
+			"demo1",
+			[]any{"84nmscqy84lsi1t", "al1h9ijdeojtsjy"},
+			&[]customStructs{},
+		},
+		{
+			"slice of pointer custom structs",
+			"demo1",
+			[]any{"84nmscqy84lsi1t", "al1h9ijdeojtsjy"},
+			&[]customStructs{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			collection, err := app.FindCollectionByNameOrId(s.collection)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			q := app.RecordQuery(collection).
+				Where(dbx.HashExp{"id": s.recordIds})
+
+			if err := q.All(s.result); err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := json.Marshal(s.result)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			sliceOfMaps := []any{}
+			if err := json.Unmarshal(raw, &sliceOfMaps); err != nil {
+				t.Fatal(err)
+			}
+
+			if len(sliceOfMaps) != len(s.recordIds) {
+				t.Fatalf("Expected %d items, got %d", len(s.recordIds), len(sliceOfMaps))
+			}
+
+			for _, id := range s.recordIds {
+				if !strings.Contains(rawStr, fmt.Sprintf(`"id":%q`, id)) {
+					t.Fatalf("Missing id %q in\n%s", id, rawStr)
+				}
+			}
+		})
+	}
+}
+
+func TestFindRecordById(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		collectionIdOrName string
+		id                 string
+		filters            []func(q *dbx.SelectQuery) error
+		expectError        bool
+	}{
+		{"demo2", "missing", nil, true},
+		{"missing", "0yxhwia2amd8gec", nil, true},
+		{"demo2", "0yxhwia2amd8gec", nil, false},
+		{"demo2", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{}, false},
+		{"demo2", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{nil, nil}, false},
+		{"demo2", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{
+			nil,
+			func(q *dbx.SelectQuery) error { return nil },
+		}, false},
+		{"demo2", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{
+			func(q *dbx.SelectQuery) error {
+				q.AndWhere(dbx.HashExp{"title": "missing"})
+				return nil
+			},
+		}, true},
+		{"demo2", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{
+			func(q *dbx.SelectQuery) error {
+				return errors.New("test error")
+			},
+		}, true},
+		{"demo2", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{
+			func(q *dbx.SelectQuery) error {
+				q.AndWhere(dbx.HashExp{"title": "test3"})
+				return nil
+			},
+		}, false},
+		{"demo2", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{
+			func(q *dbx.SelectQuery) error {
+				q.AndWhere(dbx.HashExp{"title": "test3"})
+				return nil
+			},
+			nil,
+		}, false},
+		{"demo2", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{
+			func(q *dbx.SelectQuery) error {
+				q.AndWhere(dbx.HashExp{"title": "test3"})
+				return nil
+			},
+			func(q *dbx.SelectQuery) error {
+				q.AndWhere(dbx.HashExp{"active": false})
+				return nil
+			},
+		}, true},
+		{"sz5l5z67tg7gku0", "0yxhwia2amd8gec", []func(q *dbx.SelectQuery) error{
+			func(q *dbx.SelectQuery) error {
+				q.AndWhere(dbx.HashExp{"title": "test3"})
+				return nil
+			},
+			func(q *dbx.SelectQuery) error {
+				q.AndWhere(dbx.HashExp{"active": true})
+				return nil
+			},
+		}, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s_%d", i, s.collectionIdOrName, s.id, len(s.filters)), func(t *testing.T) {
+			record, err := app.FindRecordById(
+				s.collectionIdOrName,
+				s.id,
+				s.filters...,
+			)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if record != nil && record.Id != s.id {
+				t.Fatalf("Expected record with id %s, got %s", s.id, record.Id)
+			}
+		})
+	}
+}
+
+func TestFindRecordsByIds(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		collectionIdOrName string
+		ids                []string
+		filters            []func(q *dbx.SelectQuery) error
+		expectTotal        int
+		expectError        bool
+	}{
+		{"demo2", []string{}, nil, 0, false},
+		{"demo2", []string{""}, nil, 0, false},
+		{"demo2", []string{"missing"}, nil, 0, false},
+		{"missing", []string{"0yxhwia2amd8gec"}, nil, 0, true},
+		{"demo2", []string{"0yxhwia2amd8gec"}, nil, 1, false},
+		{"sz5l5z67tg7gku0", []string{"0yxhwia2amd8gec"}, nil, 1, false},
+		{
+			"demo2",
+			[]string{"0yxhwia2amd8gec", "llvuca81nly1qls"},
+			nil,
+			2,
+			false,
+		},
+		{
+			"demo2",
+			[]string{"0yxhwia2amd8gec", "llvuca81nly1qls"},
+			[]func(q *dbx.SelectQuery) error{},
+			2,
+			false,
+		},
+		{
+			"demo2",
+			[]string{"0yxhwia2amd8gec", "llvuca81nly1qls"},
+			[]func(q *dbx.SelectQuery) error{nil, nil},
+			2,
+			false,
+		},
+		{
+			"demo2",
+			[]string{"0yxhwia2amd8gec", "llvuca81nly1qls"},
+			[]func(q *dbx.SelectQuery) error{
+				func(q *dbx.SelectQuery) error {
+					return nil // empty filter
+				},
+			},
+			2,
+			false,
+		},
+		{
+			"demo2",
+			[]string{"0yxhwia2amd8gec", "llvuca81nly1qls"},
+			[]func(q *dbx.SelectQuery) error{
+				func(q *dbx.SelectQuery) error {
+					return nil // empty filter
+				},
+				func(q *dbx.SelectQuery) error {
+					return errors.New("test error")
+				},
+			},
+			0,
+			true,
+		},
+		{
+			"demo2",
+			[]string{"0yxhwia2amd8gec", "llvuca81nly1qls"},
+			[]func(q *dbx.SelectQuery) error{
+				func(q *dbx.SelectQuery) error {
+					q.AndWhere(dbx.HashExp{"active": true})
+					return nil
+				},
+				nil,
+			},
+			1,
+			false,
+		},
+		{
+			"sz5l5z67tg7gku0",
+			[]string{"0yxhwia2amd8gec", "llvuca81nly1qls"},
+			[]func(q *dbx.SelectQuery) error{
+				func(q *dbx.SelectQuery) error {
+					q.AndWhere(dbx.HashExp{"active": true})
+					return nil
+				},
+				func(q *dbx.SelectQuery) error {
+					q.AndWhere(dbx.Not(dbx.HashExp{"title": ""}))
+					return nil
+				},
+			},
+			1,
+			false,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%v_%d", i, s.collectionIdOrName, s.ids, len(s.filters)), func(t *testing.T) {
+			records, err := app.FindRecordsByIds(
+				s.collectionIdOrName,
+				s.ids,
+				s.filters...,
+			)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if len(records) != s.expectTotal {
+				t.Fatalf("Expected %d records, got %d", s.expectTotal, len(records))
+			}
+
+			for _, r := range records {
+				if !slices.Contains(s.ids, r.Id) {
+					t.Fatalf("Couldn't find id %s in %v", r.Id, s.ids)
+				}
+			}
+		})
+	}
+}
+
+func TestFindAllRecords(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		collectionIdOrName string
+		expressions        []dbx.Expression
+		expectIds          []string
+		expectError        bool
+	}{
+		{
+			"missing",
+			nil,
+			[]string{},
+			true,
+		},
+		{
+			"demo2",
+			nil,
+			[]string{
+				"achvryl401bhse3",
+				"llvuca81nly1qls",
+				"0yxhwia2amd8gec",
+			},
+			false,
+		},
+		{
+			"demo2",
+			[]dbx.Expression{
+				nil,
+				dbx.HashExp{"id": "123"},
+			},
+			[]string{},
+			false,
+		},
+		{
+			"sz5l5z67tg7gku0",
+			[]dbx.Expression{
+				dbx.Like("title", "test").Match(true, true),
+				dbx.HashExp{"active": true},
+			},
+			[]string{
+				"achvryl401bhse3",
+				"0yxhwia2amd8gec",
+			},
+			false,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.collectionIdOrName), func(t *testing.T) {
+			records, err := app.FindAllRecords(s.collectionIdOrName, s.expressions...)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if len(records) != len(s.expectIds) {
+				t.Fatalf("Expected %d records, got %d", len(s.expectIds), len(records))
+			}
+
+			for _, r := range records {
+				if !slices.Contains(s.expectIds, r.Id) {
+					t.Fatalf("Couldn't find id %s in %v", r.Id, s.expectIds)
+				}
+			}
+		})
+	}
+}
+
+func TestFindFirstRecordByData(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		collectionIdOrName string
+		key                string
+		value              any
+		expectId           string
+		expectError        bool
+	}{
+		{
+			"missing",
+			"id",
+			"llvuca81nly1qls",
+			"llvuca81nly1qls",
+			true,
+		},
+		{
+			"demo2",
+			"",
+			"llvuca81nly1qls",
+			"",
+			true,
+		},
+		{
+			"demo2",
+			"id",
+			"invalid",
+			"",
+			true,
+		},
+		{
+			"demo2",
+			"id",
+			"llvuca81nly1qls",
+			"llvuca81nly1qls",
+			false,
+		},
+		{
+			"sz5l5z67tg7gku0",
+			"title",
+			"test3",
+			"0yxhwia2amd8gec",
+			false,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s_%v", i, s.collectionIdOrName, s.key, s.value), func(t *testing.T) {
+			record, err := app.FindFirstRecordByData(s.collectionIdOrName, s.key, s.value)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if !s.expectError && record.Id != s.expectId {
+				t.Fatalf("Expected record with id %s, got %v", s.expectId, record.Id)
+			}
+		})
+	}
+}
+
+func TestFindRecordsByFilter(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name               string
+		collectionIdOrName string
+		filter             string
+		sort               string
+		limit              int
+		offset             int
+		params             []dbx.Params
+		expectError        bool
+		expectRecordIds    []string
+	}{
+		{
+			"missing collection",
+			"missing",
+			"id != ''",
+			"",
+			0,
+			0,
+			nil,
+			true,
+			nil,
+		},
+		{
+			"invalid filter",
+			"demo2",
+			"someMissingField > 1",
+			"",
+			0,
+			0,
+			nil,
+			true,
+			nil,
+		},
+		{
+			"empty filter",
+			"demo2",
+			"",
+			"",
+			0,
+			0,
+			nil,
+			false,
+			[]string{
+				"llvuca81nly1qls",
+				"achvryl401bhse3",
+				"0yxhwia2amd8gec",
+			},
+		},
+		{
+			"simple filter",
+			"demo2",
+			"id != ''",
+			"",
+			0,
+			0,
+			nil,
+			false,
+			[]string{
+				"llvuca81nly1qls",
+				"achvryl401bhse3",
+				"0yxhwia2amd8gec",
+			},
+		},
+		{
+			"multi-condition filter with sort",
+			"demo2",
+			"id != '' && active=true",
+			"-created,title",
+			-1, // should behave the same as 0
+			0,
+			nil,
+			false,
+			[]string{
+				"0yxhwia2amd8gec",
+				"achvryl401bhse3",
+			},
+		},
+		{
+			"with limit and offset",
+			"sz5l5z67tg7gku0",
+			"id != ''",
+			"title",
+			2,
+			1,
+			nil,
+			false,
+			[]string{
+				"achvryl401bhse3",
+				"0yxhwia2amd8gec",
+			},
+		},
+		{
+			"with placeholder params",
+			"demo2",
+			"active = {:active}",
+			"",
+			10,
+			0,
+			[]dbx.Params{{"active": false}},
+			false,
+			[]string{
+				"llvuca81nly1qls",
+			},
+		},
+		{
+			"with json filter and sort",
+			"demo4",
+			"json_object != null && json_object.a.b = 'test'",
+			"-json_object.a",
+			10,
+			0,
+			[]dbx.Params{{"active": false}},
+			false,
+			[]string{
+				"i9naidtvr6qsgb4",
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			records, err := app.FindRecordsByFilter(
+				s.collectionIdOrName,
+				s.filter,
+				s.sort,
+				s.limit,
+				s.offset,
+				s.params...,
+			)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if len(records) != len(s.expectRecordIds) {
+				t.Fatalf("Expected %d records, got %d", len(s.expectRecordIds), len(records))
+			}
+
+			for i, id := range s.expectRecordIds {
+				if id != records[i].Id {
+					t.Fatalf("Expected record with id %q, got %q at index %d", id, records[i].Id, i)
+				}
+			}
+		})
+	}
+}
+
+func TestFindFirstRecordByFilter(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name               string
+		collectionIdOrName string
+		filter             string
+		params             []dbx.Params
+		expectError        bool
+		expectRecordId     string
+	}{
+		{
+			"missing collection",
+			"missing",
+			"id != ''",
+			nil,
+			true,
+			"",
+		},
+		{
+			"invalid filter",
+			"demo2",
+			"someMissingField > 1",
+			nil,
+			true,
+			"",
+		},
+		{
+			"empty filter",
+			"demo2",
+			"",
+			nil,
+			false,
+			"llvuca81nly1qls",
+		},
+		{
+			"valid filter but no matches",
+			"demo2",
+			"id = 'test'",
+			nil,
+			true,
+			"",
+		},
+		{
+			"valid filter and multiple matches",
+			"sz5l5z67tg7gku0",
+			"id != ''",
+			nil,
+			false,
+			"llvuca81nly1qls",
+		},
+		{
+			"with placeholder params",
+			"demo2",
+			"active = {:active}",
+			[]dbx.Params{{"active": false}},
+			false,
+			"llvuca81nly1qls",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			record, err := app.FindFirstRecordByFilter(s.collectionIdOrName, s.filter, s.params...)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if record.Id != s.expectRecordId {
+				t.Fatalf("Expected record with id %q, got %q", s.expectRecordId, record.Id)
+			}
+		})
+	}
+}
+
+func TestCountRecords(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name               string
+		collectionIdOrName string
+		expressions        []dbx.Expression
+		expectTotal        int64
+		expectError        bool
+	}{
+		{
+			"missing collection",
+			"missing",
+			nil,
+			0,
+			true,
+		},
+		{
+			"valid collection name",
+			"demo2",
+			nil,
+			3,
+			false,
+		},
+		{
+			"valid collection id",
+			"sz5l5z67tg7gku0",
+			nil,
+			3,
+			false,
+		},
+		{
+			"nil expression",
+			"demo2",
+			[]dbx.Expression{nil},
+			3,
+			false,
+		},
+		{
+			"no matches",
+			"demo2",
+			[]dbx.Expression{
+				nil,
+				dbx.Like("title", "missing"),
+				dbx.HashExp{"active": true},
+			},
+			0,
+			false,
+		},
+		{
+			"with matches",
+			"demo2",
+			[]dbx.Expression{
+				nil,
+				dbx.Like("title", "test"),
+				dbx.HashExp{"active": true},
+			},
+			2,
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			total, err := app.CountRecords(s.collectionIdOrName, s.expressions...)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if total != s.expectTotal {
+				t.Fatalf("Expected total %d, got %d", s.expectTotal, total)
+			}
+		})
+	}
+}
+
+func TestFindAuthRecordByToken(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name       string
+		token      string
+		types      []string
+		expectedId string
+	}{
+		{
+			"empty token",
+			"",
+			nil,
+			"",
+		},
+		{
+			"invalid token",
+			"invalid",
+			nil,
+			"",
+		},
+		{
+			"expired token",
+			"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoxNjQwOTkxNjYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.2D3tmqPn3vc5LoqqCz8V-iCDVXo9soYiH0d32G7FQT4",
+			nil,
+			"",
+		},
+		{
+			"valid auth token",
+			"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			nil,
+			"4q1xlclmfloku33",
+		},
+		{
+			"valid verification token",
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRjNDlrNmpnZWpuNDBoMyIsImV4cCI6MjUyNDYwNDQ2MSwidHlwZSI6InZlcmlmaWNhdGlvbiIsImNvbGxlY3Rpb25JZCI6ImtwdjcwOXNrMmxxYnFrOCIsImVtYWlsIjoidGVzdEBleGFtcGxlLmNvbSJ9.5GmuZr4vmwk3Cb_3ZZWNxwbE75KZC-j71xxIPR9AsVw",
+			nil,
+			"dc49k6jgejn40h3",
+		},
+		{
+			"auth token with file type only check",
+			"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			[]string{core.TokenTypeFile},
+			"",
+		},
+		{
+			"auth token with file and auth type check",
+			"eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjRxMXhsY2xtZmxva3UzMyIsInR5cGUiOiJhdXRoIiwiY29sbGVjdGlvbklkIjoiX3BiX3VzZXJzX2F1dGhfIiwiZXhwIjoyNTI0NjA0NDYxLCJyZWZyZXNoYWJsZSI6dHJ1ZX0.ZT3F0Z3iM-xbGgSG3LEKiEzHrPHr8t8IuHLZGGNuxLo",
+			[]string{core.TokenTypeFile, core.TokenTypeAuth},
+			"4q1xlclmfloku33",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			record, err := app.FindAuthRecordByToken(s.token, s.types...)
+
+			hasErr := err != nil
+			expectErr := s.expectedId == ""
+			if hasErr != expectErr {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", expectErr, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if record.Id != s.expectedId {
+				t.Fatalf("Expected record with id %q, got %q", s.expectedId, record.Id)
+			}
+		})
+	}
+}
+
+func TestFindAuthRecordByEmail(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		collectionIdOrName string
+		email              string
+		nocaseIndex        bool
+		expectError        bool
+	}{
+		{"missing", "test@example.com", false, true},
+		{"demo2", "test@example.com", false, true},
+		{"users", "missing@example.com", false, true},
+		{"users", "test@example.com", false, false},
+		{"clients", "test2@example.com", false, false},
+		// case-insensitive tests
+		{"clients", "TeSt2@example.com", false, true},
+		{"clients", "TeSt2@example.com", true, false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("%s_%s", s.collectionIdOrName, s.email), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			collection, _ := app.FindCollectionByNameOrId(s.collectionIdOrName)
+			if collection != nil {
+				emailIndex, ok := dbutils.FindSingleColumnUniqueIndex(collection.Indexes, core.FieldNameEmail)
+				if ok {
+					if s.nocaseIndex {
+						emailIndex.Columns[0].Collate = "nocase"
+					} else {
+						emailIndex.Columns[0].Collate = ""
+					}
+
+					collection.RemoveIndex(emailIndex.IndexName)
+					collection.Indexes = append(collection.Indexes, emailIndex.Build())
+					err := app.Save(collection)
+					if err != nil {
+						t.Fatalf("Failed to update email index: %v", err)
+					}
+				}
+			}
+
+			record, err := app.FindAuthRecordByEmail(s.collectionIdOrName, s.email)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if !strings.EqualFold(record.Email(), s.email) {
+				t.Fatalf("Expected record with email %s, got %s", s.email, record.Email())
+			}
+		})
+	}
+}
+
+func TestCanAccessRecord(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	superuser, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record, err := app.FindRecordById("demo1", "imy661ixudk5izi")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		record      *core.Record
+		requestInfo *core.RequestInfo
+		rule        *string
+		expected    bool
+		expectError bool
+	}{
+		{
+			"as superuser with nil rule",
+			record,
+			&core.RequestInfo{
+				Auth: superuser,
+			},
+			nil,
+			true,
+			false,
+		},
+		{
+			"as superuser with non-empty rule",
+			record,
+			&core.RequestInfo{
+				Auth: superuser,
+			},
+			types.Pointer("id = ''"), // the filter rule should be ignored
+			true,
+			false,
+		},
+		{
+			"as superuser with invalid rule",
+			record,
+			&core.RequestInfo{
+				Auth: superuser,
+			},
+			types.Pointer("id ?!@ 1"), // the filter rule should be ignored
+			true,
+			false,
+		},
+		{
+			"as guest with nil rule",
+			record,
+			&core.RequestInfo{},
+			nil,
+			false,
+			false,
+		},
+		{
+			"as guest with empty rule",
+			record,
+			&core.RequestInfo{},
+			types.Pointer(""),
+			true,
+			false,
+		},
+		{
+			"as guest with invalid rule",
+			record,
+			&core.RequestInfo{},
+			types.Pointer("id ?!@ 1"),
+			false,
+			true,
+		},
+		{
+			"as guest with mismatched rule",
+			record,
+			&core.RequestInfo{},
+			types.Pointer("@request.auth.id != ''"),
+			false,
+			false,
+		},
+		{
+			"as guest with matched rule",
+			record,
+			&core.RequestInfo{
+				Body: map[string]any{"test": 1},
+			},
+			types.Pointer("@request.auth.id != '' || @request.body.test = 1"),
+			true,
+			false,
+		},
+		{
+			"as auth record with nil rule",
+			record,
+			&core.RequestInfo{
+				Auth: user,
+			},
+			nil,
+			false,
+			false,
+		},
+		{
+			"as auth record with empty rule",
+			record,
+			&core.RequestInfo{
+				Auth: user,
+			},
+			types.Pointer(""),
+			true,
+			false,
+		},
+		{
+			"as auth record with invalid rule",
+			record,
+			&core.RequestInfo{
+				Auth: user,
+			},
+			types.Pointer("id ?!@ 1"),
+			false,
+			true,
+		},
+		{
+			"as auth record with mismatched rule",
+			record,
+			&core.RequestInfo{
+				Auth: user,
+				Body: map[string]any{"test": 1},
+			},
+			types.Pointer("@request.auth.id != '' && @request.body.test > 1"),
+			false,
+			false,
+		},
+		{
+			"as auth record with matched rule",
+			record,
+			&core.RequestInfo{
+				Auth: user,
+				Body: map[string]any{"test": 2},
+			},
+			types.Pointer("@request.auth.id != '' && @request.body.test > 1"),
+			true,
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result, err := app.CanAccessRecord(s.record, s.requestInfo, s.rule)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/record_tokens.go b/server/core_backend-server/core/record_tokens.go
new file mode 100644
index 0000000..0eead2b
--- /dev/null
+++ b/server/core_backend-server/core/record_tokens.go
@@ -0,0 +1,165 @@
+package core
+
+import (
+	"errors"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// Supported record token types
+const (
+	TokenTypeAuth          = "auth"
+	TokenTypeFile          = "file"
+	TokenTypeVerification  = "verification"
+	TokenTypePasswordReset = "passwordReset"
+	TokenTypeEmailChange   = "emailChange"
+)
+
+// List with commonly used record token claims
+const (
+	TokenClaimId           = "id"
+	TokenClaimType         = "type"
+	TokenClaimCollectionId = "collectionId"
+	TokenClaimEmail        = "email"
+	TokenClaimNewEmail     = "newEmail"
+	TokenClaimRefreshable  = "refreshable"
+)
+
+// Common token related errors
+var (
+	ErrNotAuthRecord     = errors.New("not an auth collection record")
+	ErrMissingSigningKey = errors.New("missing or invalid signing key")
+)
+
+// NewStaticAuthToken generates and returns a new static record authentication token.
+//
+// Static auth tokens are similar to the regular auth tokens, but are
+// non-refreshable and support custom duration.
+//
+// Zero or negative duration will fallback to the duration from the auth collection settings.
+func (m *Record) NewStaticAuthToken(duration time.Duration) (string, error) {
+	return m.newAuthToken(duration, false)
+}
+
+// NewAuthToken generates and returns a new record authentication token.
+func (m *Record) NewAuthToken() (string, error) {
+	return m.newAuthToken(0, true)
+}
+
+func (m *Record) newAuthToken(duration time.Duration, refreshable bool) (string, error) {
+	if !m.Collection().IsAuth() {
+		return "", ErrNotAuthRecord
+	}
+
+	key := (m.TokenKey() + m.Collection().AuthToken.Secret)
+	if key == "" {
+		return "", ErrMissingSigningKey
+	}
+
+	claims := jwt.MapClaims{
+		TokenClaimType:         TokenTypeAuth,
+		TokenClaimId:           m.Id,
+		TokenClaimCollectionId: m.Collection().Id,
+		TokenClaimRefreshable:  refreshable,
+	}
+
+	if duration <= 0 {
+		duration = m.Collection().AuthToken.DurationTime()
+	}
+
+	return security.NewJWT(claims, key, duration)
+}
+
+// NewVerificationToken generates and returns a new record verification token.
+func (m *Record) NewVerificationToken() (string, error) {
+	if !m.Collection().IsAuth() {
+		return "", ErrNotAuthRecord
+	}
+
+	key := (m.TokenKey() + m.Collection().VerificationToken.Secret)
+	if key == "" {
+		return "", ErrMissingSigningKey
+	}
+
+	return security.NewJWT(
+		jwt.MapClaims{
+			TokenClaimType:         TokenTypeVerification,
+			TokenClaimId:           m.Id,
+			TokenClaimCollectionId: m.Collection().Id,
+			TokenClaimEmail:        m.Email(),
+		},
+		key,
+		m.Collection().VerificationToken.DurationTime(),
+	)
+}
+
+// NewPasswordResetToken generates and returns a new auth record password reset request token.
+func (m *Record) NewPasswordResetToken() (string, error) {
+	if !m.Collection().IsAuth() {
+		return "", ErrNotAuthRecord
+	}
+
+	key := (m.TokenKey() + m.Collection().PasswordResetToken.Secret)
+	if key == "" {
+		return "", ErrMissingSigningKey
+	}
+
+	return security.NewJWT(
+		jwt.MapClaims{
+			TokenClaimType:         TokenTypePasswordReset,
+			TokenClaimId:           m.Id,
+			TokenClaimCollectionId: m.Collection().Id,
+			TokenClaimEmail:        m.Email(),
+		},
+		key,
+		m.Collection().PasswordResetToken.DurationTime(),
+	)
+}
+
+// NewEmailChangeToken generates and returns a new auth record change email request token.
+func (m *Record) NewEmailChangeToken(newEmail string) (string, error) {
+	if !m.Collection().IsAuth() {
+		return "", ErrNotAuthRecord
+	}
+
+	key := (m.TokenKey() + m.Collection().EmailChangeToken.Secret)
+	if key == "" {
+		return "", ErrMissingSigningKey
+	}
+
+	return security.NewJWT(
+		jwt.MapClaims{
+			TokenClaimType:         TokenTypeEmailChange,
+			TokenClaimId:           m.Id,
+			TokenClaimCollectionId: m.Collection().Id,
+			TokenClaimEmail:        m.Email(),
+			TokenClaimNewEmail:     newEmail,
+		},
+		key,
+		m.Collection().EmailChangeToken.DurationTime(),
+	)
+}
+
+// NewFileToken generates and returns a new record private file access token.
+func (m *Record) NewFileToken() (string, error) {
+	if !m.Collection().IsAuth() {
+		return "", ErrNotAuthRecord
+	}
+
+	key := (m.TokenKey() + m.Collection().FileToken.Secret)
+	if key == "" {
+		return "", ErrMissingSigningKey
+	}
+
+	return security.NewJWT(
+		jwt.MapClaims{
+			TokenClaimType:         TokenTypeFile,
+			TokenClaimId:           m.Id,
+			TokenClaimCollectionId: m.Collection().Id,
+		},
+		key,
+		m.Collection().FileToken.DurationTime(),
+	)
+}
diff --git a/server/core_backend-server/core/record_tokens_test.go b/server/core_backend-server/core/record_tokens_test.go
new file mode 100644
index 0000000..34ad909
--- /dev/null
+++ b/server/core_backend-server/core/record_tokens_test.go
@@ -0,0 +1,176 @@
+package core_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+func TestNewStaticAuthToken(t *testing.T) {
+	t.Parallel()
+
+	testRecordToken(t, core.TokenTypeAuth, func(record *core.Record) (string, error) {
+		return record.NewStaticAuthToken(0)
+	}, map[string]any{
+		core.TokenClaimRefreshable: false,
+	})
+}
+
+func TestNewStaticAuthTokenWithCustomDuration(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var tolerance int64 = 1 // in sec
+
+	durations := []int64{-100, 0, 100}
+
+	for i, d := range durations {
+		t.Run(fmt.Sprintf("%d_%d", i, d), func(t *testing.T) {
+			now := time.Now()
+
+			duration := time.Duration(d) * time.Second
+
+			token, err := user.NewStaticAuthToken(duration)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			claims, err := security.ParseUnverifiedJWT(token)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			exp := cast.ToInt64(claims["exp"])
+
+			expectedDuration := duration
+			// should fallback to the collection setting
+			if expectedDuration <= 0 {
+				expectedDuration = user.Collection().AuthToken.DurationTime()
+			}
+			expectedMinExp := now.Add(expectedDuration).Unix() - tolerance
+			expectedMaxExp := now.Add(expectedDuration).Unix() + tolerance
+
+			if exp < expectedMinExp {
+				t.Fatalf("Expected token exp to be greater than %d, got %d", expectedMinExp, exp)
+			}
+
+			if exp > expectedMaxExp {
+				t.Fatalf("Expected token exp to be less than %d, got %d", expectedMaxExp, exp)
+			}
+		})
+	}
+}
+
+func TestNewAuthToken(t *testing.T) {
+	t.Parallel()
+
+	testRecordToken(t, core.TokenTypeAuth, func(record *core.Record) (string, error) {
+		return record.NewAuthToken()
+	}, map[string]any{
+		core.TokenClaimRefreshable: true,
+	})
+}
+
+func TestNewVerificationToken(t *testing.T) {
+	t.Parallel()
+
+	testRecordToken(t, core.TokenTypeVerification, func(record *core.Record) (string, error) {
+		return record.NewVerificationToken()
+	}, nil)
+}
+
+func TestNewPasswordResetToken(t *testing.T) {
+	t.Parallel()
+
+	testRecordToken(t, core.TokenTypePasswordReset, func(record *core.Record) (string, error) {
+		return record.NewPasswordResetToken()
+	}, nil)
+}
+
+func TestNewEmailChangeToken(t *testing.T) {
+	t.Parallel()
+
+	testRecordToken(t, core.TokenTypeEmailChange, func(record *core.Record) (string, error) {
+		return record.NewEmailChangeToken("new@example.com")
+	}, nil)
+}
+
+func TestNewFileToken(t *testing.T) {
+	t.Parallel()
+
+	testRecordToken(t, core.TokenTypeFile, func(record *core.Record) (string, error) {
+		return record.NewFileToken()
+	}, nil)
+}
+
+func testRecordToken(
+	t *testing.T,
+	tokenType string,
+	tokenFunc func(record *core.Record) (string, error),
+	expectedClaims map[string]any,
+) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo1, err := app.FindRecordById("demo1", "84nmscqy84lsi1t")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	user, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("non-auth record", func(t *testing.T) {
+		_, err = tokenFunc(demo1)
+		if err == nil {
+			t.Fatal("Expected error for non-auth records")
+		}
+	})
+
+	t.Run("auth record", func(t *testing.T) {
+		token, err := tokenFunc(user)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		tokenRecord, _ := app.FindAuthRecordByToken(token, tokenType)
+		if tokenRecord == nil || tokenRecord.Id != user.Id {
+			t.Fatalf("Expected auth record\n%v\ngot\n%v", user, tokenRecord)
+		}
+
+		if len(expectedClaims) > 0 {
+			claims, _ := security.ParseUnverifiedJWT(token)
+			for k, v := range expectedClaims {
+				if claims[k] != v {
+					t.Errorf("Expected claim %q with value %#v, got %#v", k, v, claims[k])
+				}
+			}
+		}
+	})
+
+	t.Run("empty signing key", func(t *testing.T) {
+		user.SetTokenKey("")
+		collection := user.Collection()
+		*collection = core.Collection{}
+		collection.Type = core.CollectionTypeAuth
+
+		_, err := tokenFunc(user)
+		if err == nil {
+			t.Fatal("Expected empty signing key error")
+		}
+	})
+}
diff --git a/server/core_backend-server/core/settings_model.go b/server/core_backend-server/core/settings_model.go
new file mode 100644
index 0000000..7e9e71e
--- /dev/null
+++ b/server/core_backend-server/core/settings_model.go
@@ -0,0 +1,721 @@
+package core
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/cron"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+const (
+	paramsTable = "_params"
+
+	paramsKeySettings = "settings"
+
+	systemHookIdSettings = "__pbSettingsSystemHook__"
+)
+
+func (app *BaseApp) registerSettingsHooks() {
+	saveFunc := func(me *ModelEvent) error {
+		if err := me.Next(); err != nil {
+			return err
+		}
+
+		if me.Model.PK() == paramsKeySettings {
+			// auto reload the app settings because we don't know whether
+			// the Settings model is the app one or a different one
+			return errors.Join(
+				me.App.Settings().PostScan(),
+				me.App.ReloadSettings(),
+			)
+		}
+
+		return nil
+	}
+
+	app.OnModelAfterCreateSuccess(paramsTable).Bind(&hook.Handler[*ModelEvent]{
+		Id:       systemHookIdSettings,
+		Func:     saveFunc,
+		Priority: -999,
+	})
+
+	app.OnModelAfterUpdateSuccess(paramsTable).Bind(&hook.Handler[*ModelEvent]{
+		Id:       systemHookIdSettings,
+		Func:     saveFunc,
+		Priority: -999,
+	})
+
+	app.OnModelDelete(paramsTable).Bind(&hook.Handler[*ModelEvent]{
+		Id: systemHookIdSettings,
+		Func: func(me *ModelEvent) error {
+			if me.Model.PK() == paramsKeySettings {
+				return errors.New("the app params settings cannot be deleted")
+			}
+
+			return me.Next()
+		},
+		Priority: -999,
+	})
+
+	app.OnCollectionUpdate().Bind(&hook.Handler[*CollectionEvent]{
+		Id: systemHookIdSettings,
+		Func: func(e *CollectionEvent) error {
+			oldCollection, err := e.App.FindCachedCollectionByNameOrId(e.Collection.Id)
+			if err != nil {
+				return fmt.Errorf("failed to retrieve old cached collection: %w", err)
+			}
+
+			err = e.Next()
+			if err != nil {
+				return err
+			}
+
+			// update existing rate limit rules on collection rename
+			if oldCollection.Name != e.Collection.Name {
+				var hasChange bool
+
+				rules := e.App.Settings().RateLimits.Rules
+				for i := 0; i < len(rules); i++ {
+					if strings.HasPrefix(rules[i].Label, oldCollection.Name+":") {
+						rules[i].Label = strings.Replace(rules[i].Label, oldCollection.Name+":", e.Collection.Name+":", 1)
+						hasChange = true
+					}
+				}
+
+				if hasChange {
+					e.App.Settings().RateLimits.Rules = rules
+					err = e.App.Save(e.App.Settings())
+					if err != nil {
+						return err
+					}
+				}
+			}
+
+			return nil
+		},
+		Priority: 99,
+	})
+}
+
+var (
+	_ Model         = (*Settings)(nil)
+	_ PostValidator = (*Settings)(nil)
+	_ DBExporter    = (*Settings)(nil)
+)
+
+type settings struct {
+	SMTP               SMTPConfig               `form:"smtp" json:"smtp"`
+	Backups            BackupsConfig            `form:"backups" json:"backups"`
+	S3                 S3Config                 `form:"s3" json:"s3"`
+	Meta               MetaConfig               `form:"meta" json:"meta"`
+	RateLimits         RateLimitsConfig         `form:"rateLimits" json:"rateLimits"`
+	TrustedProxy       TrustedProxyConfig       `form:"trustedProxy" json:"trustedProxy"`
+	Batch              BatchConfig              `form:"batch" json:"batch"`
+	Logs               LogsConfig               `form:"logs" json:"logs"`
+	SettingsEncryption SettingsEncryptionConfig `form:"settingsEncryption" json:"settingsEncryption"`
+}
+
+type SettingsEncryptionConfig struct {
+	Enabled bool `form:"enabled" json:"enabled"`
+}
+
+// Settings defines the PocketBase app settings.
+type Settings struct {
+	settings
+
+	mu    sync.RWMutex
+	isNew bool
+}
+
+func newDefaultSettings() *Settings {
+	return &Settings{
+		isNew: true,
+		settings: settings{
+			Meta: MetaConfig{
+				AppName:       "Acme",
+				AppURL:        "http://localhost:8198",
+				HideControls:  false,
+				SenderName:    "Support",
+				SenderAddress: "support@example.com",
+			},
+			Logs: LogsConfig{
+				MaxDays: 5,
+				LogIP:   true,
+			},
+			SMTP: SMTPConfig{
+				Enabled:  false,
+				Host:     "smtp.example.com",
+				Port:     587,
+				Username: "",
+				Password: "",
+				TLS:      false,
+			},
+			Backups: BackupsConfig{
+				CronMaxKeep: 3,
+			},
+			Batch: BatchConfig{
+				Enabled:     false,
+				MaxRequests: 50,
+				Timeout:     3,
+			},
+			RateLimits: RateLimitsConfig{
+				Enabled: false, // @todo once tested enough enable by default for new installations
+				Rules: []RateLimitRule{
+					{Label: "*:auth", MaxRequests: 2, Duration: 3},
+					{Label: "*:create", MaxRequests: 20, Duration: 5},
+					{Label: "/api/batch", MaxRequests: 3, Duration: 1},
+					{Label: "/api/", MaxRequests: 300, Duration: 10},
+				},
+			},
+		},
+	}
+}
+
+// TableName implements [Model.TableName] interface method.
+func (s *Settings) TableName() string {
+	return paramsTable
+}
+
+// PK implements [Model.LastSavedPK] interface method.
+func (s *Settings) LastSavedPK() any {
+	return paramsKeySettings
+}
+
+// PK implements [Model.PK] interface method.
+func (s *Settings) PK() any {
+	return paramsKeySettings
+}
+
+// IsNew implements [Model.IsNew] interface method.
+func (s *Settings) IsNew() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	return s.isNew
+}
+
+// MarkAsNew implements [Model.MarkAsNew] interface method.
+func (s *Settings) MarkAsNew() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.isNew = true
+}
+
+// MarkAsNew implements [Model.MarkAsNotNew] interface method.
+func (s *Settings) MarkAsNotNew() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.isNew = false
+}
+
+// PostScan implements [Model.PostScan] interface method.
+func (s *Settings) PostScan() error {
+	s.MarkAsNotNew()
+	return nil
+}
+
+// String returns a serialized string representation of the current settings.
+func (s *Settings) String() string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	raw, _ := json.Marshal(s)
+	return string(raw)
+}
+
+// DBExport prepares and exports the current settings for db persistence.
+func (s *Settings) DBExport(app App) (map[string]any, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	now := types.NowDateTime()
+
+	result := map[string]any{
+		"id": s.PK(),
+	}
+
+	if s.IsNew() {
+		result["created"] = now
+	}
+	result["updated"] = now
+
+	encoded, err := json.Marshal(s.settings)
+	if err != nil {
+		return nil, err
+	}
+
+	encryptionKey := os.Getenv(app.EncryptionEnv())
+	if encryptionKey != "" && s.settings.SettingsEncryption.Enabled {
+		encryptVal, encryptErr := security.Encrypt(encoded, encryptionKey)
+		if encryptErr != nil {
+			return nil, encryptErr
+		}
+
+		result["value"] = encryptVal
+	} else {
+		result["value"] = encoded
+	}
+
+	return result, nil
+}
+
+// PostValidate implements the [PostValidator] interface and defines
+// the Settings model validations.
+func (s *Settings) PostValidate(ctx context.Context, app App) error {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	return validation.ValidateStructWithContext(ctx, s,
+		validation.Field(&s.Meta),
+		validation.Field(&s.Logs),
+		validation.Field(&s.SMTP),
+		validation.Field(&s.S3),
+		validation.Field(&s.Backups),
+		validation.Field(&s.Batch),
+		validation.Field(&s.RateLimits),
+		validation.Field(&s.TrustedProxy),
+	)
+}
+
+// Merge merges the "other" settings into the current one.
+func (s *Settings) Merge(other *Settings) error {
+	other.mu.RLock()
+	defer other.mu.RUnlock()
+
+	raw, err := json.Marshal(other.settings)
+	if err != nil {
+		return err
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return json.Unmarshal(raw, &s)
+}
+
+// Clone creates a new deep copy of the current settings.
+func (s *Settings) Clone() (*Settings, error) {
+	clone := &Settings{
+		isNew: s.isNew,
+	}
+
+	if err := clone.Merge(s); err != nil {
+		return nil, err
+	}
+
+	return clone, nil
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+//
+// Note that sensitive fields (S3 secret, SMTP password, etc.) are excluded.
+func (s *Settings) MarshalJSON() ([]byte, error) {
+	s.mu.RLock()
+	copy := s.settings
+	s.mu.RUnlock()
+
+	sensitiveFields := []*string{
+		&copy.SMTP.Password,
+		&copy.S3.Secret,
+		&copy.Backups.S3.Secret,
+	}
+
+	// mask all sensitive fields
+	for _, v := range sensitiveFields {
+		if v != nil && *v != "" {
+			*v = ""
+		}
+	}
+
+	return json.Marshal(copy)
+}
+
+// -------------------------------------------------------------------
+
+type SMTPConfig struct {
+	Enabled  bool   `form:"enabled" json:"enabled"`
+	Port     int    `form:"port" json:"port"`
+	Host     string `form:"host" json:"host"`
+	Username string `form:"username" json:"username"`
+	Password string `form:"password" json:"password,omitempty"`
+
+	// SMTP AUTH - PLAIN (default) or LOGIN
+	AuthMethod string `form:"authMethod" json:"authMethod"`
+
+	// Whether to enforce TLS encryption for the mail server connection.
+	//
+	// When set to false StartTLS command is send, leaving the server
+	// to decide whether to upgrade the connection or not.
+	TLS bool `form:"tls" json:"tls"`
+
+	// LocalName is optional domain name or IP address used for the
+	// EHLO/HELO exchange (if not explicitly set, defaults to "localhost").
+	//
+	// This is required only by some SMTP servers, such as Gmail SMTP-relay.
+	LocalName string `form:"localName" json:"localName"`
+}
+
+// Validate makes SMTPConfig validatable by implementing [validation.Validatable] interface.
+func (c SMTPConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(
+			&c.Host,
+			validation.When(c.Enabled, validation.Required),
+			is.Host,
+		),
+		validation.Field(
+			&c.Port,
+			validation.When(c.Enabled, validation.Required),
+			validation.Min(0),
+		),
+		validation.Field(
+			&c.AuthMethod,
+			// don't require it for backward compatibility
+			// (fallback internally to PLAIN)
+			// validation.When(c.Enabled, validation.Required),
+			validation.In(mailer.SMTPAuthLogin, mailer.SMTPAuthPlain),
+		),
+		validation.Field(&c.LocalName, is.Host),
+	)
+}
+
+// -------------------------------------------------------------------
+
+type S3Config struct {
+	Enabled        bool   `form:"enabled" json:"enabled"`
+	Bucket         string `form:"bucket" json:"bucket"`
+	Region         string `form:"region" json:"region"`
+	Endpoint       string `form:"endpoint" json:"endpoint"`
+	AccessKey      string `form:"accessKey" json:"accessKey"`
+	Secret         string `form:"secret" json:"secret,omitempty"`
+	ForcePathStyle bool   `form:"forcePathStyle" json:"forcePathStyle"`
+}
+
+// Validate makes S3Config validatable by implementing [validation.Validatable] interface.
+func (c S3Config) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.Endpoint, is.URL, validation.When(c.Enabled, validation.Required)),
+		validation.Field(&c.Bucket, validation.When(c.Enabled, validation.Required)),
+		validation.Field(&c.Region, validation.When(c.Enabled, validation.Required)),
+		validation.Field(&c.AccessKey, validation.When(c.Enabled, validation.Required)),
+		validation.Field(&c.Secret, validation.When(c.Enabled, validation.Required)),
+	)
+}
+
+// -------------------------------------------------------------------
+
+type BatchConfig struct {
+	Enabled bool `form:"enabled" json:"enabled"`
+
+	// MaxRequests is the maximum allowed batch request to execute.
+	MaxRequests int `form:"maxRequests" json:"maxRequests"`
+
+	// Timeout is the the max duration in seconds to wait before cancelling the batch transaction.
+	Timeout int64 `form:"timeout" json:"timeout"`
+
+	// MaxBodySize is the maximum allowed batch request body size in bytes.
+	//
+	// If not set, fallbacks to max ~128MB.
+	MaxBodySize int64 `form:"maxBodySize" json:"maxBodySize"`
+}
+
+// Validate makes BatchConfig validatable by implementing [validation.Validatable] interface.
+func (c BatchConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.MaxRequests, validation.When(c.Enabled, validation.Required), validation.Min(0)),
+		validation.Field(&c.Timeout, validation.When(c.Enabled, validation.Required), validation.Min(0)),
+		validation.Field(&c.MaxBodySize, validation.Min(0)),
+	)
+}
+
+// -------------------------------------------------------------------
+
+type BackupsConfig struct {
+	// Cron is a cron expression to schedule auto backups, eg. "* * * * *".
+	//
+	// Leave it empty to disable the auto backups functionality.
+	Cron string `form:"cron" json:"cron"`
+
+	// CronMaxKeep is the the max number of cron generated backups to
+	// keep before removing older entries.
+	//
+	// This field works only when the cron config has valid cron expression.
+	CronMaxKeep int `form:"cronMaxKeep" json:"cronMaxKeep"`
+
+	// S3 is an optional S3 storage config specifying where to store the app backups.
+	S3 S3Config `form:"s3" json:"s3"`
+}
+
+// Validate makes BackupsConfig validatable by implementing [validation.Validatable] interface.
+func (c BackupsConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.S3),
+		validation.Field(&c.Cron, validation.By(checkCronExpression)),
+		validation.Field(
+			&c.CronMaxKeep,
+			validation.When(c.Cron != "", validation.Required),
+			validation.Min(1),
+		),
+	)
+}
+
+func checkCronExpression(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil // nothing to check
+	}
+
+	_, err := cron.NewSchedule(v)
+	if err != nil {
+		return validation.NewError("validation_invalid_cron", err.Error())
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+type MetaConfig struct {
+	AppName       string `form:"appName" json:"appName"`
+	AppURL        string `form:"appURL" json:"appURL"`
+	SenderName    string `form:"senderName" json:"senderName"`
+	SenderAddress string `form:"senderAddress" json:"senderAddress"`
+	HideControls  bool   `form:"hideControls" json:"hideControls"`
+}
+
+// Validate makes MetaConfig validatable by implementing [validation.Validatable] interface.
+func (c MetaConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.AppName, validation.Required, validation.Length(1, 255)),
+		validation.Field(&c.AppURL, validation.Required, is.URL),
+		validation.Field(&c.SenderName, validation.Required, validation.Length(1, 255)),
+		validation.Field(&c.SenderAddress, is.EmailFormat, validation.Required),
+	)
+}
+
+// -------------------------------------------------------------------
+
+type LogsConfig struct {
+	MaxDays   int  `form:"maxDays" json:"maxDays"`
+	MinLevel  int  `form:"minLevel" json:"minLevel"`
+	LogIP     bool `form:"logIP" json:"logIP"`
+	LogAuthId bool `form:"logAuthId" json:"logAuthId"`
+}
+
+// Validate makes LogsConfig validatable by implementing [validation.Validatable] interface.
+func (c LogsConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.MaxDays, validation.Min(0)),
+	)
+}
+
+// -------------------------------------------------------------------
+
+type TrustedProxyConfig struct {
+	// Headers is a list of explicit trusted header(s) to check.
+	Headers []string `form:"headers" json:"headers"`
+
+	// UseLeftmostIP specifies to use the left-mostish IP from the trusted headers.
+	//
+	// Note that this could be insecure when used with X-Forwarded-For header
+	// because some proxies like AWS ELB allow users to prepend their own header value
+	// before appending the trusted ones.
+	UseLeftmostIP bool `form:"useLeftmostIP" json:"useLeftmostIP"`
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+func (c TrustedProxyConfig) MarshalJSON() ([]byte, error) {
+	type alias TrustedProxyConfig
+
+	// serialize as empty array
+	if c.Headers == nil {
+		c.Headers = []string{}
+	}
+
+	return json.Marshal(alias(c))
+}
+
+// Validate makes RateLimitRule validatable by implementing [validation.Validatable] interface.
+func (c TrustedProxyConfig) Validate() error {
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+type RateLimitsConfig struct {
+	Rules   []RateLimitRule `form:"rules" json:"rules"`
+	Enabled bool            `form:"enabled" json:"enabled"`
+}
+
+// FindRateLimitRule returns the first matching rule based on the provided labels.
+//
+// Optionally you can further specify a list of valid RateLimitRule.Audience values to further filter the matching rule
+// (aka. the rule Audience will have to exist in one of the specified options).
+func (c *RateLimitsConfig) FindRateLimitRule(searchLabels []string, optOnlyAudience ...string) (RateLimitRule, bool) {
+	var prefixRules []int
+
+	for i, label := range searchLabels {
+		// check for direct match
+		for j := range c.Rules {
+			if label == c.Rules[j].Label &&
+				(len(optOnlyAudience) == 0 || slices.Contains(optOnlyAudience, c.Rules[j].Audience)) {
+				return c.Rules[j], true
+			}
+
+			if i == 0 && strings.HasSuffix(c.Rules[j].Label, "/") {
+				prefixRules = append(prefixRules, j)
+			}
+		}
+
+		// check for prefix match
+		if len(prefixRules) > 0 {
+			for j := range prefixRules {
+				if strings.HasPrefix(label+"/", c.Rules[prefixRules[j]].Label) &&
+					(len(optOnlyAudience) == 0 || slices.Contains(optOnlyAudience, c.Rules[prefixRules[j]].Audience)) {
+					return c.Rules[prefixRules[j]], true
+				}
+			}
+		}
+	}
+
+	return RateLimitRule{}, false
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+func (c RateLimitsConfig) MarshalJSON() ([]byte, error) {
+	type alias RateLimitsConfig
+
+	// serialize as empty array
+	if c.Rules == nil {
+		c.Rules = []RateLimitRule{}
+	}
+
+	return json.Marshal(alias(c))
+}
+
+// Validate makes RateLimitsConfig validatable by implementing [validation.Validatable] interface.
+func (c RateLimitsConfig) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(
+			&c.Rules,
+			validation.When(c.Enabled, validation.Required),
+			validation.By(checkUniqueRuleLabel),
+		),
+	)
+}
+
+func checkUniqueRuleLabel(value any) error {
+	rules, ok := value.([]RateLimitRule)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	existing := make([]string, 0, len(rules))
+
+	for i, rule := range rules {
+		fullKey := rule.Label + "@@" + rule.Audience
+
+		var conflicts bool
+		for _, key := range existing {
+			if strings.HasPrefix(key, fullKey) || strings.HasPrefix(fullKey, key) {
+				conflicts = true
+				break
+			}
+		}
+
+		if conflicts {
+			return validation.Errors{
+				strconv.Itoa(i): validation.Errors{
+					"label": validation.NewError("validation_conflicting_rate_limit_rule", "Rate limit rule configuration with label {{.label}} already exists or conflicts with another rule.").
+						SetParams(map[string]any{"label": rule.Label}),
+				},
+			}
+		} else {
+			existing = append(existing, fullKey)
+		}
+	}
+
+	return nil
+}
+
+var rateLimitRuleLabelRegex = regexp.MustCompile(`^(\w+\ \/[\w\/-]*|\/[\w\/-]*|^\w+\:\w+|\*\:\w+|\w+)$`)
+
+// The allowed RateLimitRule.Audience values
+const (
+	RateLimitRuleAudienceAll   = ""
+	RateLimitRuleAudienceGuest = "@guest"
+	RateLimitRuleAudienceAuth  = "@auth"
+)
+
+type RateLimitRule struct {
+	// Label is the identifier of the current rule.
+	//
+	// It could be a tag, complete path or path prerefix (when ends with `/`).
+	//
+	// Example supported labels:
+	//   - test_a (plain text "tag")
+	//   - users:create
+	//   - *:create
+	//   - /
+	//   - /api
+	//   - POST /api/collections/
+	Label string `form:"label" json:"label"`
+
+	// Audience specifies the auth group the rule should apply for:
+	//   - ""      - both guests and authenticated users (default)
+	//   - "@guest" - only for guests
+	//   - "@auth"  - only for authenticated users
+	Audience string `form:"audience" json:"audience"`
+
+	// Duration specifies the interval (in seconds) per which to reset
+	// the counted/accumulated rate limiter tokens.
+	Duration int64 `form:"duration" json:"duration"`
+
+	// MaxRequests is the max allowed number of requests per Duration.
+	MaxRequests int `form:"maxRequests" json:"maxRequests"`
+}
+
+// Validate makes RateLimitRule validatable by implementing [validation.Validatable] interface.
+func (c RateLimitRule) Validate() error {
+	return validation.ValidateStruct(&c,
+		validation.Field(&c.Label, validation.Required, validation.Match(rateLimitRuleLabelRegex)),
+		validation.Field(&c.MaxRequests, validation.Required, validation.Min(1)),
+		validation.Field(&c.Duration, validation.Required, validation.Min(1)),
+		validation.Field(&c.Audience,
+			validation.In(RateLimitRuleAudienceAll, RateLimitRuleAudienceGuest, RateLimitRuleAudienceAuth),
+		),
+	)
+}
+
+// DurationTime returns the tag's Duration as [time.Duration].
+func (c RateLimitRule) DurationTime() time.Duration {
+	return time.Duration(c.Duration) * time.Second
+}
+
+// String returns a string representation of the rule.
+func (c RateLimitRule) String() string {
+	raw, err := json.Marshal(c)
+	if err != nil {
+		return c.Label // extremely rare case
+	}
+
+	return string(raw)
+}
diff --git a/server/core_backend-server/core/settings_model_test.go b/server/core_backend-server/core/settings_model_test.go
new file mode 100644
index 0000000..c004640
--- /dev/null
+++ b/server/core_backend-server/core/settings_model_test.go
@@ -0,0 +1,846 @@
+package core_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+)
+
+func TestSettingsDelete(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	err := app.Delete(app.Settings())
+	if err == nil {
+		t.Fatal("Exected settings delete to fail")
+	}
+}
+
+func TestSettingsMerge(t *testing.T) {
+	s1 := &core.Settings{}
+	s1.Meta.AppURL = "app_url" // should be unset
+
+	s2 := &core.Settings{}
+	s2.Meta.AppName = "test"
+	s2.Logs.MaxDays = 123
+	s2.SMTP.Host = "test"
+	s2.SMTP.Enabled = true
+	s2.S3.Enabled = true
+	s2.S3.Endpoint = "test"
+	s2.Backups.Cron = "* * * * *"
+	s2.Batch.Timeout = 15
+
+	if err := s1.Merge(s2); err != nil {
+		t.Fatal(err)
+	}
+
+	s1Encoded, err := json.Marshal(s1)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	s2Encoded, err := json.Marshal(s2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if string(s1Encoded) != string(s2Encoded) {
+		t.Fatalf("Expected the same serialization, got\n%v\nVS\n%v", string(s1Encoded), string(s2Encoded))
+	}
+}
+
+func TestSettingsClone(t *testing.T) {
+	s1 := &core.Settings{}
+	s1.Meta.AppName = "test_name"
+
+	s2, err := s1.Clone()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	s1Bytes, err := json.Marshal(s1)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	s2Bytes, err := json.Marshal(s2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if string(s1Bytes) != string(s2Bytes) {
+		t.Fatalf("Expected equivalent serialization, got %v VS %v", string(s1Bytes), string(s2Bytes))
+	}
+
+	// verify that it is a deep copy
+	s2.Meta.AppName = "new_test_name"
+	if s1.Meta.AppName == s2.Meta.AppName {
+		t.Fatalf("Expected s1 and s2 to have different Meta.AppName, got %s", s1.Meta.AppName)
+	}
+}
+
+func TestSettingsMarshalJSON(t *testing.T) {
+	settings := &core.Settings{}
+
+	// control fields
+	settings.Meta.AppName = "test123"
+	settings.SMTP.Username = "abc"
+
+	// secrets
+	testSecret := "test_secret"
+	settings.SMTP.Password = testSecret
+	settings.S3.Secret = testSecret
+	settings.Backups.S3.Secret = testSecret
+
+	raw, err := json.Marshal(settings)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expected := `{"smtp":{"enabled":false,"port":0,"host":"","username":"abc","authMethod":"","tls":false,"localName":""},"backups":{"cron":"","cronMaxKeep":0,"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","forcePathStyle":false}},"s3":{"enabled":false,"bucket":"","region":"","endpoint":"","accessKey":"","forcePathStyle":false},"meta":{"appName":"test123","appURL":"","senderName":"","senderAddress":"","hideControls":false},"rateLimits":{"rules":[],"enabled":false},"trustedProxy":{"headers":[],"useLeftmostIP":false},"batch":{"enabled":false,"maxRequests":0,"timeout":0,"maxBodySize":0},"logs":{"maxDays":0,"minLevel":0,"logIP":false,"logAuthId":false}}`
+
+	if rawStr != expected {
+		t.Fatalf("Expected\n%v\ngot\n%v", expected, rawStr)
+	}
+}
+
+func TestSettingsValidate(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	s := app.Settings()
+
+	// set invalid settings data
+	s.Meta.AppName = ""
+	s.Logs.MaxDays = -10
+	s.SMTP.Enabled = true
+	s.SMTP.Host = ""
+	s.S3.Enabled = true
+	s.S3.Endpoint = "invalid"
+	s.Backups.Cron = "invalid"
+	s.Backups.CronMaxKeep = -10
+	s.Batch.Enabled = true
+	s.Batch.MaxRequests = -1
+	s.Batch.Timeout = -1
+	s.RateLimits.Enabled = true
+	s.RateLimits.Rules = nil
+
+	// check if Validate() is triggering the members validate methods.
+	err := app.Validate(s)
+	if err == nil {
+		t.Fatalf("Expected error, got nil")
+	}
+
+	expectations := []string{
+		`"meta":{`,
+		`"logs":{`,
+		`"smtp":{`,
+		`"s3":{`,
+		`"backups":{`,
+		`"batch":{`,
+		`"rateLimits":{`,
+	}
+
+	errBytes, _ := json.Marshal(err)
+	jsonErr := string(errBytes)
+	for _, expected := range expectations {
+		if !strings.Contains(jsonErr, expected) {
+			t.Errorf("Expected error key %s in %v", expected, jsonErr)
+		}
+	}
+}
+
+func TestMetaConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.MetaConfig
+		expectedErrors []string
+	}{
+		{
+			"zero values",
+			core.MetaConfig{},
+			[]string{
+				"appName",
+				"appURL",
+				"senderName",
+				"senderAddress",
+			},
+		},
+		{
+			"invalid data",
+			core.MetaConfig{
+				AppName:       strings.Repeat("a", 300),
+				AppURL:        "test",
+				SenderName:    strings.Repeat("a", 300),
+				SenderAddress: "invalid_email",
+			},
+			[]string{
+				"appName",
+				"appURL",
+				"senderName",
+				"senderAddress",
+			},
+		},
+		{
+			"valid data",
+			core.MetaConfig{
+				AppName:       "test",
+				AppURL:        "https://example.com",
+				SenderName:    "test",
+				SenderAddress: "test@example.com",
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestLogsConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.LogsConfig
+		expectedErrors []string
+	}{
+		{
+			"zero values",
+			core.LogsConfig{},
+			[]string{},
+		},
+		{
+			"invalid data",
+			core.LogsConfig{MaxDays: -1},
+			[]string{"maxDays"},
+		},
+		{
+			"valid data",
+			core.LogsConfig{MaxDays: 2},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestSMTPConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.SMTPConfig
+		expectedErrors []string
+	}{
+		{
+			"zero values (disabled)",
+			core.SMTPConfig{},
+			[]string{},
+		},
+		{
+			"zero values (enabled)",
+			core.SMTPConfig{Enabled: true},
+			[]string{"host", "port"},
+		},
+		{
+			"invalid data",
+			core.SMTPConfig{
+				Enabled:    true,
+				Host:       "test:test:test",
+				Port:       -10,
+				LocalName:  "invalid!",
+				AuthMethod: "invalid",
+			},
+			[]string{"host", "port", "authMethod", "localName"},
+		},
+		{
+			"valid data (no explicit auth method and localName)",
+			core.SMTPConfig{
+				Enabled: true,
+				Host:    "example.com",
+				Port:    100,
+				TLS:     true,
+			},
+			[]string{},
+		},
+		{
+			"valid data (explicit auth method and localName)",
+			core.SMTPConfig{
+				Enabled:    true,
+				Host:       "example.com",
+				Port:       100,
+				AuthMethod: mailer.SMTPAuthLogin,
+				LocalName:  "example.com",
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestS3ConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.S3Config
+		expectedErrors []string
+	}{
+		{
+			"zero values (disabled)",
+			core.S3Config{},
+			[]string{},
+		},
+		{
+			"zero values (enabled)",
+			core.S3Config{Enabled: true},
+			[]string{
+				"bucket",
+				"region",
+				"endpoint",
+				"accessKey",
+				"secret",
+			},
+		},
+		{
+			"invalid data",
+			core.S3Config{
+				Enabled:  true,
+				Endpoint: "test:test:test",
+			},
+			[]string{
+				"bucket",
+				"region",
+				"endpoint",
+				"accessKey",
+				"secret",
+			},
+		},
+		{
+			"valid data (url endpoint)",
+			core.S3Config{
+				Enabled:   true,
+				Endpoint:  "https://localhost:8198",
+				Bucket:    "test",
+				Region:    "test",
+				AccessKey: "test",
+				Secret:    "test",
+			},
+			[]string{},
+		},
+		{
+			"valid data (hostname endpoint)",
+			core.S3Config{
+				Enabled:   true,
+				Endpoint:  "example.com",
+				Bucket:    "test",
+				Region:    "test",
+				AccessKey: "test",
+				Secret:    "test",
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestBackupsConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.BackupsConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value",
+			core.BackupsConfig{},
+			[]string{},
+		},
+		{
+			"invalid cron",
+			core.BackupsConfig{
+				Cron:        "invalid",
+				CronMaxKeep: 0,
+			},
+			[]string{"cron", "cronMaxKeep"},
+		},
+		{
+			"invalid enabled S3",
+			core.BackupsConfig{
+				S3: core.S3Config{
+					Enabled: true,
+				},
+			},
+			[]string{"s3"},
+		},
+		{
+			"valid data",
+			core.BackupsConfig{
+				S3: core.S3Config{
+					Enabled:   true,
+					Endpoint:  "example.com",
+					Bucket:    "test",
+					Region:    "test",
+					AccessKey: "test",
+					Secret:    "test",
+				},
+				Cron:        "*/10 * * * *",
+				CronMaxKeep: 1,
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestBatchConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.BatchConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value",
+			core.BatchConfig{},
+			[]string{},
+		},
+		{
+			"zero value (enabled)",
+			core.BatchConfig{Enabled: true},
+			[]string{"maxRequests", "timeout"},
+		},
+		{
+			"invalid data (negative values)",
+			core.BatchConfig{
+				MaxRequests: -1,
+				Timeout:     -1,
+				MaxBodySize: -1,
+			},
+			[]string{"maxRequests", "timeout", "maxBodySize"},
+		},
+		{
+			"min fields valid data",
+			core.BatchConfig{
+				Enabled:     true,
+				MaxRequests: 1,
+				Timeout:     1,
+			},
+			[]string{},
+		},
+		{
+			"all fields valid data",
+			core.BatchConfig{
+				Enabled:     true,
+				MaxRequests: 10,
+				Timeout:     1,
+				MaxBodySize: 1,
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestRateLimitsConfigValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		config         core.RateLimitsConfig
+		expectedErrors []string
+	}{
+		{
+			"zero value (disabled)",
+			core.RateLimitsConfig{},
+			[]string{},
+		},
+		{
+			"zero value (enabled)",
+			core.RateLimitsConfig{Enabled: true},
+			[]string{"rules"},
+		},
+		{
+			"invalid data",
+			core.RateLimitsConfig{
+				Enabled: true,
+				Rules: []core.RateLimitRule{
+					{
+						Label:       "/123abc/",
+						Duration:    1,
+						MaxRequests: 2,
+					},
+					{
+						Label:       "!abc",
+						Duration:    -1,
+						MaxRequests: -1,
+					},
+				},
+			},
+			[]string{"rules"},
+		},
+		{
+			"valid data",
+			core.RateLimitsConfig{
+				Enabled: true,
+				Rules: []core.RateLimitRule{
+					{
+						Label:       "123_abc",
+						Duration:    1,
+						MaxRequests: 2,
+					},
+					{
+						Label:       "/456-abc",
+						Duration:    1,
+						MaxRequests: 2,
+					},
+				},
+			},
+			[]string{},
+		},
+		{
+			"duplicated rules with the same audience",
+			core.RateLimitsConfig{
+				Enabled: true,
+				Rules: []core.RateLimitRule{
+					{
+						Label:       "/a",
+						Duration:    1,
+						MaxRequests: 2,
+					},
+					{
+						Label:       "/a",
+						Duration:    2,
+						MaxRequests: 3,
+					},
+				},
+			},
+			[]string{"rules"},
+		},
+		{
+			"duplicated rule with conflicting audience (A)",
+			core.RateLimitsConfig{
+				Enabled: true,
+				Rules: []core.RateLimitRule{
+					{
+						Label:       "/a",
+						Duration:    1,
+						MaxRequests: 2,
+					},
+					{
+						Label:       "/a",
+						Duration:    1,
+						MaxRequests: 2,
+						Audience:    core.RateLimitRuleAudienceGuest,
+					},
+				},
+			},
+			[]string{"rules"},
+		},
+		{
+			"duplicated rule with conflicting audience (B)",
+			core.RateLimitsConfig{
+				Enabled: true,
+				Rules: []core.RateLimitRule{
+					{
+						Label:       "/a",
+						Duration:    1,
+						MaxRequests: 2,
+						Audience:    core.RateLimitRuleAudienceAuth,
+					},
+					{
+						Label:       "/a",
+						Duration:    1,
+						MaxRequests: 2,
+					},
+				},
+			},
+			[]string{"rules"},
+		},
+		{
+			"duplicated rule with non-conflicting audience",
+			core.RateLimitsConfig{
+				Enabled: true,
+				Rules: []core.RateLimitRule{
+					{
+						Label:       "/a",
+						Duration:    1,
+						MaxRequests: 2,
+						Audience:    core.RateLimitRuleAudienceAuth,
+					},
+					{
+						Label:       "/a",
+						Duration:    1,
+						MaxRequests: 2,
+						Audience:    core.RateLimitRuleAudienceGuest,
+					},
+				},
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.config.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestRateLimitsFindRateLimitRule(t *testing.T) {
+	limits := core.RateLimitsConfig{
+		Rules: []core.RateLimitRule{
+			{Label: "abc"},
+			{Label: "def", Audience: core.RateLimitRuleAudienceGuest},
+			{Label: "/test/a", Audience: core.RateLimitRuleAudienceGuest},
+			{Label: "POST /test/a"},
+			{Label: "/test/a/", Audience: core.RateLimitRuleAudienceAuth},
+			{Label: "POST /test/a/"},
+		},
+	}
+
+	scenarios := []struct {
+		labels   []string
+		audience []string
+		expected string
+	}{
+		{[]string{}, []string{}, ""},
+		{[]string{"missing"}, []string{}, ""},
+		{[]string{"abc"}, []string{}, "abc"},
+		{[]string{"abc"}, []string{core.RateLimitRuleAudienceGuest}, ""},
+		{[]string{"abc"}, []string{core.RateLimitRuleAudienceAuth}, ""},
+		{[]string{"def"}, []string{core.RateLimitRuleAudienceGuest}, "def"},
+		{[]string{"def"}, []string{core.RateLimitRuleAudienceAuth}, ""},
+		{[]string{"/test"}, []string{}, ""},
+		{[]string{"/test/a"}, []string{}, "/test/a"},
+		{[]string{"/test/a"}, []string{core.RateLimitRuleAudienceAuth}, "/test/a/"},
+		{[]string{"/test/a"}, []string{core.RateLimitRuleAudienceGuest}, "/test/a"},
+		{[]string{"GET /test/a"}, []string{}, ""},
+		{[]string{"POST /test/a"}, []string{}, "POST /test/a"},
+		{[]string{"/test/a/b/c"}, []string{}, "/test/a/"},
+		{[]string{"/test/a/b/c"}, []string{core.RateLimitRuleAudienceAuth}, "/test/a/"},
+		{[]string{"/test/a/b/c"}, []string{core.RateLimitRuleAudienceGuest}, ""},
+		{[]string{"GET /test/a/b/c"}, []string{}, ""},
+		{[]string{"POST /test/a/b/c"}, []string{}, "POST /test/a/"},
+		{[]string{"/test/a", "abc"}, []string{}, "/test/a"}, // priority checks
+	}
+
+	for _, s := range scenarios {
+		t.Run(strings.Join(s.labels, "_")+":"+strings.Join(s.audience, "_"), func(t *testing.T) {
+			rule, ok := limits.FindRateLimitRule(s.labels, s.audience...)
+
+			hasLabel := rule.Label != ""
+			if hasLabel != ok {
+				t.Fatalf("Expected hasLabel %v, got %v", hasLabel, ok)
+			}
+
+			if rule.Label != s.expected {
+				t.Fatalf("Expected rule with label %q, got %q", s.expected, rule.Label)
+			}
+		})
+	}
+}
+
+func TestRateLimitRuleValidate(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		rule           core.RateLimitRule
+		expectedErrors []string
+	}{
+		{
+			"zero value",
+			core.RateLimitRule{},
+			[]string{"label", "duration", "maxRequests"},
+		},
+		{
+			"invalid data",
+			core.RateLimitRule{
+				Label:       "@abc",
+				Duration:    -1,
+				MaxRequests: -1,
+				Audience:    "invalid",
+			},
+			[]string{"label", "duration", "maxRequests", "audience"},
+		},
+		{
+			"valid data (name)",
+			core.RateLimitRule{
+				Label:       "abc:123",
+				Duration:    1,
+				MaxRequests: 1,
+			},
+			[]string{},
+		},
+		{
+			"valid data (name:action)",
+			core.RateLimitRule{
+				Label:       "abc:123",
+				Duration:    1,
+				MaxRequests: 1,
+			},
+			[]string{},
+		},
+		{
+			"valid data (*:action)",
+			core.RateLimitRule{
+				Label:       "*:123",
+				Duration:    1,
+				MaxRequests: 1,
+			},
+			[]string{},
+		},
+		{
+			"valid data (path /a/b)",
+			core.RateLimitRule{
+				Label:       "/a/b",
+				Duration:    1,
+				MaxRequests: 1,
+			},
+			[]string{},
+		},
+		{
+			"valid data (path POST /a/b)",
+			core.RateLimitRule{
+				Label:       "POST /a/b/",
+				Duration:    1,
+				MaxRequests: 1,
+			},
+			[]string{},
+		},
+		{
+			"invalid audience",
+			core.RateLimitRule{
+				Label:       "/a/b/",
+				Duration:    1,
+				MaxRequests: 1,
+				Audience:    "invalid",
+			},
+			[]string{"audience"},
+		},
+		{
+			"valid audience - " + core.RateLimitRuleAudienceGuest,
+			core.RateLimitRule{
+				Label:       "POST /a/b/",
+				Duration:    1,
+				MaxRequests: 1,
+				Audience:    core.RateLimitRuleAudienceGuest,
+			},
+			[]string{},
+		},
+		{
+			"valid audience - " + core.RateLimitRuleAudienceAuth,
+			core.RateLimitRule{
+				Label:       "POST /a/b/",
+				Duration:    1,
+				MaxRequests: 1,
+				Audience:    core.RateLimitRuleAudienceAuth,
+			},
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.rule.Validate()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestRateLimitRuleDurationTime(t *testing.T) {
+	scenarios := []struct {
+		rule     core.RateLimitRule
+		expected time.Duration
+	}{
+		{core.RateLimitRule{}, 0 * time.Second},
+		{core.RateLimitRule{Duration: 1234}, 1234 * time.Second},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%d", i, s.rule.Duration), func(t *testing.T) {
+			result := s.rule.DurationTime()
+
+			if result != s.expected {
+				t.Fatalf("Expected duration %d, got %d", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestRateLimitRuleString(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		rule     core.RateLimitRule
+		expected string
+	}{
+		{
+			"empty",
+			core.RateLimitRule{},
+			`{"label":"","audience":"","duration":0,"maxRequests":0}`,
+		},
+		{
+			"all fields",
+			core.RateLimitRule{
+				Label:       "POST /a/b/",
+				Duration:    1,
+				MaxRequests: 2,
+				Audience:    core.RateLimitRuleAudienceAuth,
+			},
+			`{"label":"POST /a/b/","audience":"@auth","duration":1,"maxRequests":2}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.rule.String()
+
+			if result != s.expected {
+				t.Fatalf("Expected string\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/settings_query.go b/server/core_backend-server/core/settings_query.go
new file mode 100644
index 0000000..f1fb9a9
--- /dev/null
+++ b/server/core_backend-server/core/settings_query.go
@@ -0,0 +1,91 @@
+package core
+
+import (
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+type Param struct {
+	BaseModel
+
+	Created types.DateTime `db:"created" json:"created"`
+	Updated types.DateTime `db:"updated" json:"updated"`
+	Value   types.JSONRaw  `db:"value" json:"value"`
+}
+
+func (m *Param) TableName() string {
+	return paramsTable
+}
+
+// ReloadSettings initializes and reloads the stored application settings.
+//
+// If no settings were stored it will persist the current app ones.
+func (app *BaseApp) ReloadSettings() error {
+	param := &Param{}
+	err := app.ModelQuery(param).Model(paramsKeySettings, param)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return err
+	}
+
+	// no settings were previously stored -> save
+	// (ReloadSettings() will be invoked again by a system hook after successful save)
+	if param.Id == "" {
+		// force insert in case the param entry was deleted manually after application start
+		app.Settings().MarkAsNew()
+		return app.Save(app.Settings())
+	}
+
+	event := new(SettingsReloadEvent)
+	event.App = app
+
+	return app.OnSettingsReload().Trigger(event, func(e *SettingsReloadEvent) error {
+		return e.App.Settings().loadParam(e.App, param)
+	})
+}
+
+// loadParam loads the settings from the stored param into the app ones.
+//
+// If settings are loaded as plain JSON and an encryption key is configured,
+// the settings will be automatically re-saved encrypted for security.
+func (s *Settings) loadParam(app App, param *Param) error {
+	encryptionKey := os.Getenv(app.EncryptionEnv())
+
+	// try first without decryption
+	s.mu.Lock()
+	plainDecodeErr := json.Unmarshal(param.Value, s)
+	s.mu.Unlock()
+
+	if plainDecodeErr != nil {
+		// failed to parse as plain JSON, try to decrypt
+		if encryptionKey == "" {
+			// load without decryption has failed and there is no encryption key to use for decrypt
+			return fmt.Errorf("invalid settings db data or missing encryption key %q", app.EncryptionEnv())
+		}
+
+		// decrypt
+		decrypted, decryptErr := security.Decrypt(string(param.Value), encryptionKey)
+		if decryptErr != nil {
+			return decryptErr
+		}
+
+		// decode again
+		s.mu.Lock()
+		decryptedDecodeErr := json.Unmarshal(decrypted, s)
+		s.mu.Unlock()
+		if decryptedDecodeErr != nil {
+			return decryptedDecodeErr
+		}
+	}
+
+	if err := s.PostScan(); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/core/settings_query_test.go b/server/core_backend-server/core/settings_query_test.go
new file mode 100644
index 0000000..a754288
--- /dev/null
+++ b/server/core_backend-server/core/settings_query_test.go
@@ -0,0 +1,159 @@
+package core_test
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestReloadSettings(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// cleanup all stored settings
+	// ---
+	if _, err := app.DB().NewQuery("DELETE from _params;").Execute(); err != nil {
+		t.Fatalf("Failed to delete all test settings: %v", err)
+	}
+
+	// check if the new settings are saved in the db
+	// ---
+	app.Settings().Meta.AppName = "test_name_after_delete"
+
+	app.ResetEventCalls()
+	if err := app.ReloadSettings(); err != nil {
+		t.Fatalf("Failed to reload the settings after delete: %v", err)
+	}
+	testEventCalls(t, app, map[string]int{
+		"OnModelCreate":             1,
+		"OnModelCreateExecute":      1,
+		"OnModelAfterCreateSuccess": 1,
+		"OnModelValidate":           1,
+		"OnSettingsReload":          1,
+	})
+
+	param := &core.Param{}
+	err := app.ModelQuery(param).Model("settings", param)
+	if err != nil {
+		t.Fatalf("Expected new settings to be persisted, got %v", err)
+	}
+
+	if !strings.Contains(param.Value.String(), "test_name_after_delete") {
+		t.Fatalf("Expected to find AppName test_name_after_delete in\n%s", param.Value.String())
+	}
+
+	// change the db entry and reload the app settings (ensure that there was no db update)
+	// ---
+	param.Value = types.JSONRaw([]byte(`{"meta": {"appName":"test_name_after_update"}}`))
+	if err := app.Save(param); err != nil {
+		t.Fatalf("Failed to update the test settings: %v", err)
+	}
+
+	app.ResetEventCalls()
+	if err := app.ReloadSettings(); err != nil {
+		t.Fatalf("Failed to reload app settings: %v", err)
+	}
+	testEventCalls(t, app, map[string]int{
+		"OnSettingsReload": 1,
+	})
+
+	// try to reload again without doing any changes
+	// ---
+	app.ResetEventCalls()
+	if err := app.ReloadSettings(); err != nil {
+		t.Fatalf("Failed to reload app settings without change: %v", err)
+	}
+	testEventCalls(t, app, map[string]int{
+		"OnSettingsReload": 1,
+	})
+
+	if app.Settings().Meta.AppName != "test_name_after_update" {
+		t.Fatalf("Expected AppName %q, got %q", "test_name_after_update", app.Settings().Meta.AppName)
+	}
+}
+
+func TestReloadSettingsWithEncryption(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	os.Setenv("pb_test_env", strings.Repeat("a", 32))
+
+	// cleanup all stored settings
+	// ---
+	if _, err := app.DB().NewQuery("DELETE from _params;").Execute(); err != nil {
+		t.Fatalf("Failed to delete all test settings: %v", err)
+	}
+
+	// check if the new settings are saved in the db
+	// ---
+	app.Settings().Meta.AppName = "test_name_after_delete"
+
+	app.ResetEventCalls()
+	if err := app.ReloadSettings(); err != nil {
+		t.Fatalf("Failed to reload the settings after delete: %v", err)
+	}
+	testEventCalls(t, app, map[string]int{
+		"OnModelCreate":             1,
+		"OnModelCreateExecute":      1,
+		"OnModelAfterCreateSuccess": 1,
+		"OnModelValidate":           1,
+		"OnSettingsReload":          1,
+	})
+
+	param := &core.Param{}
+	err := app.ModelQuery(param).Model("settings", param)
+	if err != nil {
+		t.Fatalf("Expected new settings to be persisted, got %v", err)
+	}
+	rawValue := param.Value.String()
+	if rawValue == "" || strings.Contains(rawValue, "test_name") {
+		t.Fatalf("Expected inserted settings to be encrypted, found\n%s", rawValue)
+	}
+
+	// change and reload the app settings (ensure that there was no db update)
+	// ---
+	app.Settings().Meta.AppName = "test_name_after_update"
+	if err := app.Save(app.Settings()); err != nil {
+		t.Fatalf("Failed to update app settings: %v", err)
+	}
+
+	// try to reload again without doing any changes
+	// ---
+	app.ResetEventCalls()
+	if err := app.ReloadSettings(); err != nil {
+		t.Fatalf("Failed to reload app settings: %v", err)
+	}
+	testEventCalls(t, app, map[string]int{
+		"OnSettingsReload": 1,
+	})
+
+	// refetch the settings param to ensure that the new value was stored encrypted
+	err = app.ModelQuery(param).Model("settings", param)
+	if err != nil {
+		t.Fatalf("Expected new settings to be persisted, got %v", err)
+	}
+	rawValue = param.Value.String()
+	if rawValue == "" || strings.Contains(rawValue, "test_name") {
+		t.Fatalf("Expected updated settings to be encrypted, found\n%s", rawValue)
+	}
+
+	if app.Settings().Meta.AppName != "test_name_after_update" {
+		t.Fatalf("Expected AppName %q, got %q", "test_name_after_update", app.Settings().Meta.AppName)
+	}
+}
+
+func testEventCalls(t *testing.T, app *tests.TestApp, events map[string]int) {
+	if len(events) != len(app.EventCalls) {
+		t.Fatalf("Expected events doesn't match:\n%v\ngot\n%v", events, app.EventCalls)
+	}
+
+	for name, total := range events {
+		if v, ok := app.EventCalls[name]; !ok || v != total {
+			t.Fatalf("Expected events doesn't exist or match:\n%v\ngot\n%v", events, app.EventCalls)
+		}
+	}
+}
diff --git a/server/core_backend-server/core/syscall.go b/server/core_backend-server/core/syscall.go
new file mode 100644
index 0000000..c4bb38d
--- /dev/null
+++ b/server/core_backend-server/core/syscall.go
@@ -0,0 +1,10 @@
+//go:build !(js && wasm)
+
+package core
+
+import "syscall"
+
+// execve invokes the execve(2) system call.
+func execve(argv0 string, argv []string, envv []string) error {
+	return syscall.Exec(argv0, argv, envv)
+}
diff --git a/server/core_backend-server/core/syscall_wasm.go b/server/core_backend-server/core/syscall_wasm.go
new file mode 100644
index 0000000..75c5a05
--- /dev/null
+++ b/server/core_backend-server/core/syscall_wasm.go
@@ -0,0 +1,10 @@
+//go:build js && wasm
+
+package core
+
+import "errors"
+
+// https://github.com/pocketbase/pocketbase/pull/7116
+func execve(argv0 string, argv []string, envv []string) error {
+	return errors.ErrUnsupported
+}
diff --git a/server/core_backend-server/core/validators/db.go b/server/core_backend-server/core/validators/db.go
new file mode 100644
index 0000000..8811299
--- /dev/null
+++ b/server/core_backend-server/core/validators/db.go
@@ -0,0 +1,143 @@
+package validators
+
+import (
+	"database/sql"
+	"errors"
+	"regexp"
+	"slices"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/pocketbase/dbx"
+)
+
+// UniqueId checks whether a field string id already exists in the specified table.
+//
+// Example:
+//
+//	validation.Field(&form.RelId, validation.By(validators.UniqueId(form.app.DB(), "tbl_example"))
+func UniqueId(db dbx.Builder, tableName string) validation.RuleFunc {
+	return func(value any) error {
+		v, _ := value.(string)
+		if v == "" {
+			return nil // nothing to check
+		}
+
+		var foundId string
+
+		err := db.
+			Select("id").
+			From(tableName).
+			Where(dbx.HashExp{"id": v}).
+			Limit(1).
+			Row(&foundId)
+
+		if (err != nil && !errors.Is(err, sql.ErrNoRows)) || foundId != "" {
+			return validation.NewError("validation_invalid_or_existing_id", "The model id is invalid or already exists.")
+		}
+
+		return nil
+	}
+}
+
+var regexViolateUniqueConstraint = regexp.MustCompile(`^Key \((.+)\)=.+ already exists\.$`)
+
+// Input: Key (col1, "col 2", col3)=("value1", "value2", "value3") already exists.
+// Output: col1, "col 2", col3
+func extractColumnsFromPgErrorUniqueViolation(errorDetail string) []string {
+	matches := regexViolateUniqueConstraint.FindStringSubmatch(errorDetail)
+	if len(matches) < 2 {
+		return nil // no match
+	}
+
+	var res []string
+	columns := strings.Split(matches[1], ", ") // eg: col1, "col 2", col3
+	for _, col := range columns {
+		col = strings.Trim(col, `"`) // remove double quotes if any
+		res = append(res, col)
+	}
+	return res
+}
+
+// NormalizeUniqueIndexError attempts to convert a
+// "unique constraint failed" error into a validation.Errors.
+//
+// The provided err is returned as it is without changes if:
+// - err is nil
+// - err is already validation.Errors
+// - err is not "unique constraint failed" error
+func NormalizeUniqueIndexError(err error, tableOrAlias string, fieldNames []string) error {
+	if err == nil {
+		return err
+	}
+
+	if _, ok := err.(validation.Errors); ok {
+		return err
+	}
+
+	// check for unique constraint failure
+	/* SQLite:
+	msg := strings.ToLower(err.Error())
+	if strings.Contains(msg, "unique constraint failed") {
+		// note: extra space to unify multi-columns lookup
+		msg = strings.ReplaceAll(strings.TrimSpace(msg), ",", " ") + " "
+
+		normalizedErrs := validation.Errors{}
+
+		for _, name := range fieldNames {
+			// note: extra spaces to exclude table name with suffix matching the current one
+			// 		 OR other fields starting with the current field name
+			if strings.Contains(msg, strings.ToLower(" "+tableOrAlias+"."+name+" ")) {
+				normalizedErrs[name] = validation.NewError("validation_not_unique", "Value must be unique")
+			}
+		}
+
+		if len(normalizedErrs) > 0 {
+			return normalizedErrs
+		}
+	}
+	*/
+
+	// check for unique constraint failure
+	// PostgreSQL:
+	if pgErr, ok := err.(*pgconn.PgError); ok {
+		// The PostgreSQL 23505 UNIQUE VIOLATION error occurs when a unique constraint is violated.
+		if pgErr.Code == "23505" {
+			normalizedErrs := validation.Errors{}
+
+			// extract the field name from pgError.Detail
+			columns := extractColumnsFromPgErrorUniqueViolation(pgErr.Detail)
+
+			for _, name := range fieldNames {
+				if slices.Contains(columns, name) {
+					normalizedErrs[name] = validation.NewError("validation_not_unique", "Value must be unique")
+				}
+			}
+
+			if len(normalizedErrs) > 0 {
+				return normalizedErrs
+			}
+		}
+	}
+
+	// MySQL:
+	if me, ok := err.(interface{ Number() uint16 }); ok && me.Number() == 1062 {
+		msg := strings.ToLower(err.Error())
+		normalizedErrs := validation.Errors{}
+
+		for _, name := range fieldNames {
+			// for MySQL we check if the index name or column name is in the error message
+			// (usually it contains the index name which by default in PocketBase includes the column name)
+			if strings.Contains(msg, strings.ToLower(name)) {
+				normalizedErrs[name] = validation.NewError("validation_not_unique", "Value must be unique")
+			}
+		}
+
+		if len(normalizedErrs) > 0 {
+			return normalizedErrs
+		}
+	}
+
+	return err
+}
diff --git a/server/core_backend-server/core/validators/db_test.go b/server/core_backend-server/core/validators/db_test.go
new file mode 100644
index 0000000..8fca8c9
--- /dev/null
+++ b/server/core_backend-server/core/validators/db_test.go
@@ -0,0 +1,140 @@
+package validators_test
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestUniqueId(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		id          string
+		tableName   string
+		expectError bool
+	}{
+		{"", "", false},
+		{"test", "", true},
+		{"wsmn24bux7wo113", "_collections", true},
+		{"test_unique_id", "unknown_table", true},
+		{"test_unique_id", "_collections", false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.id, s.tableName), func(t *testing.T) {
+			err := validators.UniqueId(app.DB(), s.tableName)(s.id)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestNormalizeUniqueIndexError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name         string
+		err          error
+		table        string
+		names        []string
+		expectedKeys []string
+	}{
+		{
+			"nil error (no changes)",
+			nil,
+			"test",
+			[]string{"a", "b"},
+			nil,
+		},
+		{
+			"non-unique index error (no changes)",
+			errors.New("abc"),
+			"test",
+			[]string{"a", "b"},
+			nil,
+		},
+		{
+			"validation error (no changes)",
+			validation.Errors{"c": errors.New("abc")},
+			"test",
+			[]string{"a", "b"},
+			[]string{"c"},
+		},
+		{
+			"unique index error but mismatched table name",
+			errors.New("UNIQUE constraint failed for fields test.a,test.b"),
+			"example",
+			[]string{"a", "b"},
+			nil,
+		},
+		{
+			"unique index error with table name suffix matching the specified one",
+			errors.New("UNIQUE constraint failed for fields test_suffix.a,test_suffix.b"),
+			"suffix",
+			[]string{"a", "b", "c"},
+			nil,
+		},
+		{
+			"unique index error but mismatched fields",
+			errors.New("UNIQUE constraint failed for fields test.a,test.b"),
+			"test",
+			[]string{"c", "d"},
+			nil,
+		},
+		{
+			"unique index error with matching table name and fields",
+			/* SQLite:
+			errors.New("UNIQUE constraint failed for fields test.a,test.b"),
+			*/
+			// PostgreSQL:
+			&pgconn.PgError{
+				Code:   "23505",
+				Detail: "Key (a, b)=(x, y) already exists.",
+			},
+			"test",
+			[]string{"a", "b", "c"},
+			[]string{"a", "b"},
+		},
+		{
+			"unique index error with matching table name and field starting with the name of another non-unique field",
+			/* SQLite:
+			errors.New("UNIQUE constraint failed for fields test.a_2,test.c"),
+			*/
+			// PostgreSQL:
+			&pgconn.PgError{
+				Code:   "23505",
+				Detail: "Key (a_2, c)=(x, y) already exists.",
+			},
+			"test",
+			[]string{"a", "a_2", "c"},
+			[]string{"a_2", "c"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := validators.NormalizeUniqueIndexError(s.err, s.table, s.names)
+
+			if len(s.expectedKeys) == 0 {
+				if result != s.err {
+					t.Fatalf("Expected no error change, got %v", result)
+				}
+				return
+			}
+
+			tests.TestValidationErrors(t, result, s.expectedKeys)
+		})
+	}
+}
diff --git a/server/core_backend-server/core/validators/equal.go b/server/core_backend-server/core/validators/equal.go
new file mode 100644
index 0000000..9ee673c
--- /dev/null
+++ b/server/core_backend-server/core/validators/equal.go
@@ -0,0 +1,85 @@
+package validators
+
+import (
+	"reflect"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+)
+
+// Equal checks whether the validated value matches another one from the same type.
+//
+// It expects the compared values to be from the same type and works
+// with booleans, numbers, strings and their pointer variants.
+//
+// If one of the value is pointer, the comparison is based on its
+// underlying value (when possible to determine).
+//
+// Note that empty/zero values are also compared (this differ from other validation.RuleFunc).
+//
+// Example:
+//
+//	validation.Field(&form.PasswordConfirm, validation.By(validators.Equal(form.Password)))
+func Equal[T comparable](valueToCompare T) validation.RuleFunc {
+	return func(value any) error {
+		if compareValues(value, valueToCompare) {
+			return nil
+		}
+
+		return validation.NewError("validation_values_mismatch", "Values don't match.")
+	}
+}
+
+func compareValues(a, b any) bool {
+	if a == b {
+		return true
+	}
+
+	if checkIsNil(a) && checkIsNil(b) {
+		return true
+	}
+
+	var result bool
+
+	defer func() {
+		if err := recover(); err != nil {
+			result = false
+		}
+	}()
+
+	reflectA := reflect.ValueOf(a)
+	reflectB := reflect.ValueOf(b)
+
+	dereferencedA := dereference(reflectA)
+	dereferencedB := dereference(reflectB)
+	if dereferencedA.CanInterface() && dereferencedB.CanInterface() {
+		result = dereferencedA.Interface() == dereferencedB.Interface()
+	}
+
+	return result
+}
+
+// note https://github.com/golang/go/issues/51649
+func checkIsNil(value any) bool {
+	if value == nil {
+		return true
+	}
+
+	var result bool
+
+	defer func() {
+		if err := recover(); err != nil {
+			result = false
+		}
+	}()
+
+	result = reflect.ValueOf(value).IsNil()
+
+	return result
+}
+
+func dereference(v reflect.Value) reflect.Value {
+	for v.Kind() == reflect.Pointer {
+		v = v.Elem()
+	}
+	return v
+}
diff --git a/server/core_backend-server/core/validators/equal_test.go b/server/core_backend-server/core/validators/equal_test.go
new file mode 100644
index 0000000..dedb376
--- /dev/null
+++ b/server/core_backend-server/core/validators/equal_test.go
@@ -0,0 +1,62 @@
+package validators_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core/validators"
+)
+
+func Equal(t *testing.T) {
+	t.Parallel()
+
+	strA := "abc"
+	strB := "abc"
+	strC := "123"
+	var strNilPtr *string
+	var strNilPtr2 *string
+
+	scenarios := []struct {
+		valA        any
+		valB        any
+		expectError bool
+	}{
+		{nil, nil, false},
+		{"", "", false},
+		{"", "456", true},
+		{"123", "", true},
+		{"123", "456", true},
+		{"123", "123", false},
+		{true, false, true},
+		{false, true, true},
+		{false, false, false},
+		{true, true, false},
+		{0, 0, false},
+		{0, 1, true},
+		{1, 2, true},
+		{1, 1, false},
+		{&strA, &strA, false},
+		{&strA, &strB, false},
+		{&strA, &strC, true},
+		{"abc", &strA, false},
+		{&strA, "abc", false},
+		{"abc", &strC, true},
+		{"test", 123, true},
+		{nil, 123, true},
+		{nil, strA, true},
+		{nil, &strA, true},
+		{nil, strNilPtr, false},
+		{strNilPtr, strNilPtr2, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%v_%v", i, s.valA, s.valB), func(t *testing.T) {
+			err := validators.Equal(s.valA)(s.valB)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/validators/file.go b/server/core_backend-server/core/validators/file.go
new file mode 100644
index 0000000..e3e556e
--- /dev/null
+++ b/server/core_backend-server/core/validators/file.go
@@ -0,0 +1,96 @@
+package validators
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gabriel-vasile/mimetype"
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+)
+
+// UploadedFileSize checks whether the validated [*filesystem.File]
+// size is no more than the provided maxBytes.
+//
+// Example:
+//
+//	validation.Field(&form.File, validation.By(validators.UploadedFileSize(1000)))
+func UploadedFileSize(maxBytes int64) validation.RuleFunc {
+	return func(value any) error {
+		v, ok := value.(*filesystem.File)
+		if !ok {
+			return ErrUnsupportedValueType
+		}
+
+		if v == nil {
+			return nil // nothing to validate
+		}
+
+		if v.Size > maxBytes {
+			return validation.NewError(
+				"validation_file_size_limit",
+				"Failed to upload {{.file}} - the maximum allowed file size is {{.maxSize}} bytes.",
+			).SetParams(map[string]any{
+				"file":    v.OriginalName,
+				"maxSize": maxBytes,
+			})
+		}
+
+		return nil
+	}
+}
+
+// UploadedFileMimeType checks whether the validated [*filesystem.File]
+// mimetype is within the provided allowed mime types.
+//
+// Example:
+//
+//	validMimeTypes := []string{"test/plain","image/jpeg"}
+//	validation.Field(&form.File, validation.By(validators.UploadedFileMimeType(validMimeTypes)))
+func UploadedFileMimeType(validTypes []string) validation.RuleFunc {
+	return func(value any) error {
+		v, ok := value.(*filesystem.File)
+		if !ok {
+			return ErrUnsupportedValueType
+		}
+
+		if v == nil {
+			return nil // nothing to validate
+		}
+
+		baseErr := validation.NewError(
+			"validation_invalid_mime_type",
+			fmt.Sprintf("Failed to upload %q due to unsupported file type.", v.OriginalName),
+		)
+
+		if len(validTypes) == 0 {
+			return baseErr
+		}
+
+		f, err := v.Reader.Open()
+		if err != nil {
+			return baseErr
+		}
+		defer f.Close()
+
+		filetype, err := mimetype.DetectReader(f)
+		if err != nil {
+			return baseErr
+		}
+
+		for _, t := range validTypes {
+			if filetype.Is(t) {
+				return nil // valid
+			}
+		}
+
+		return validation.NewError(
+			"validation_invalid_mime_type",
+			fmt.Sprintf(
+				"%q mime type must be one of: %s.",
+				v.Name,
+				strings.Join(validTypes, ", "),
+			),
+		)
+	}
+}
diff --git a/server/core_backend-server/core/validators/file_test.go b/server/core_backend-server/core/validators/file_test.go
new file mode 100644
index 0000000..3af6fe5
--- /dev/null
+++ b/server/core_backend-server/core/validators/file_test.go
@@ -0,0 +1,75 @@
+package validators_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+)
+
+func TestUploadedFileSize(t *testing.T) {
+	t.Parallel()
+
+	file, err := filesystem.NewFileFromBytes([]byte("test"), "test.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		maxBytes    int64
+		file        *filesystem.File
+		expectError bool
+	}{
+		{0, nil, false},
+		{4, nil, false},
+		{3, file, true}, // all test files have "test" as content
+		{4, file, false},
+		{5, file, false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("%d", s.maxBytes), func(t *testing.T) {
+			err := validators.UploadedFileSize(s.maxBytes)(s.file)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
+
+func TestUploadedFileMimeType(t *testing.T) {
+	t.Parallel()
+
+	file, err := filesystem.NewFileFromBytes([]byte("test"), "test.png") // the extension shouldn't matter
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		types       []string
+		file        *filesystem.File
+		expectError bool
+	}{
+		{nil, nil, false},
+		{[]string{"image/jpeg"}, nil, false},
+		{[]string{}, file, true},
+		{[]string{"image/jpeg"}, file, true},
+		// test files are detected as "text/plain; charset=utf-8" content type
+		{[]string{"image/jpeg", "text/plain; charset=utf-8"}, file, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, strings.Join(s.types, ";")), func(t *testing.T) {
+			err := validators.UploadedFileMimeType(s.types)(s.file)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/validators/string.go b/server/core_backend-server/core/validators/string.go
new file mode 100644
index 0000000..c0d885b
--- /dev/null
+++ b/server/core_backend-server/core/validators/string.go
@@ -0,0 +1,29 @@
+package validators
+
+import (
+	"regexp"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+)
+
+// IsRegex checks whether the validated value is a valid regular expression pattern.
+//
+// Example:
+//
+//	validation.Field(&form.Pattern, validation.By(validators.IsRegex))
+func IsRegex(value any) error {
+	v, ok := value.(string)
+	if !ok {
+		return ErrUnsupportedValueType
+	}
+
+	if v == "" {
+		return nil // nothing to check
+	}
+
+	if _, err := regexp.Compile(v); err != nil {
+		return validation.NewError("validation_invalid_regex", err.Error())
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/core/validators/string_test.go b/server/core_backend-server/core/validators/string_test.go
new file mode 100644
index 0000000..dead6df
--- /dev/null
+++ b/server/core_backend-server/core/validators/string_test.go
@@ -0,0 +1,33 @@
+package validators_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core/validators"
+)
+
+func TestIsRegex(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		val         string
+		expectError bool
+	}{
+		{"", false},
+		{`abc`, false},
+		{`\w+`, false},
+		{`\w*((abc+`, true},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.val), func(t *testing.T) {
+			err := validators.IsRegex(s.val)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/validators/validators.go b/server/core_backend-server/core/validators/validators.go
new file mode 100644
index 0000000..a4ce3a6
--- /dev/null
+++ b/server/core_backend-server/core/validators/validators.go
@@ -0,0 +1,40 @@
+// Package validators implements some common custom PocketBase validators.
+package validators
+
+import (
+	"errors"
+	"maps"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+)
+
+var ErrUnsupportedValueType = validation.NewError("validation_unsupported_value_type", "Invalid or unsupported value type.")
+
+// JoinValidationErrors attempts to join the provided [validation.Errors] arguments.
+//
+// If only one of the arguments is [validation.Errors], it returns the first non-empty [validation.Errors].
+//
+// If both arguments are not [validation.Errors] then it returns a combined [errors.Join] error.
+func JoinValidationErrors(errA, errB error) error {
+	vErrA, okA := errA.(validation.Errors)
+	vErrB, okB := errB.(validation.Errors)
+
+	// merge
+	if okA && okB {
+		result := maps.Clone(vErrA)
+		maps.Copy(result, vErrB)
+		if len(result) > 0 {
+			return result
+		}
+	}
+
+	if okA && len(vErrA) > 0 {
+		return vErrA
+	}
+
+	if okB && len(vErrB) > 0 {
+		return vErrB
+	}
+
+	return errors.Join(errA, errB)
+}
diff --git a/server/core_backend-server/core/validators/validators_test.go b/server/core_backend-server/core/validators/validators_test.go
new file mode 100644
index 0000000..0a54fa8
--- /dev/null
+++ b/server/core_backend-server/core/validators/validators_test.go
@@ -0,0 +1,39 @@
+package validators_test
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core/validators"
+)
+
+func TestJoinValidationErrors(t *testing.T) {
+	scenarios := []struct {
+		errA     error
+		errB     error
+		expected string
+	}{
+		{nil, nil, "<nil>"},
+		{errors.New("abc"), nil, "abc"},
+		{nil, errors.New("abc"), "abc"},
+		{errors.New("abc"), errors.New("456"), "abc\n456"},
+		{validation.Errors{"test1": errors.New("test1_err")}, nil, "test1: test1_err."},
+		{nil, validation.Errors{"test2": errors.New("test2_err")}, "test2: test2_err."},
+		{validation.Errors{}, errors.New("456"), "\n456"},
+		{errors.New("456"), validation.Errors{}, "456\n"},
+		{validation.Errors{"test1": errors.New("test1_err")}, errors.New("456"), "test1: test1_err."},
+		{errors.New("456"), validation.Errors{"test2": errors.New("test2_err")}, "test2: test2_err."},
+		{validation.Errors{"test1": errors.New("test1_err")}, validation.Errors{"test2": errors.New("test2_err")}, "test1: test1_err; test2: test2_err."},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#T_%T", i, s.errA, s.errB), func(t *testing.T) {
+			result := fmt.Sprintf("%v", validators.JoinValidationErrors(s.errA, s.errB))
+			if result != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/core/view.go b/server/core_backend-server/core/view.go
new file mode 100644
index 0000000..88c0b34
--- /dev/null
+++ b/server/core_backend-server/core/view.go
@@ -0,0 +1,856 @@
+package core
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"io"
+	"regexp"
+	"slices"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/sort"
+	"github.com/pocketbase/pocketbase/tools/tokenizer"
+)
+
+// DeleteView drops the specified view name.
+//
+// This method is a no-op if a view with the provided name doesn't exist.
+//
+// NB! Be aware that this method is vulnerable to SQL injection and the
+// "name" argument must come only from trusted input!
+func (app *BaseApp) DeleteView(name string) error {
+	_, err := app.DB().NewQuery(fmt.Sprintf(
+		"DROP VIEW IF EXISTS {{%s}}",
+		name,
+	)).Execute()
+
+	return err
+}
+
+// SaveView creates (or updates already existing) persistent SQL view.
+//
+// NB! Be aware that this method is vulnerable to SQL injection and the
+// "selectQuery" argument must come only from trusted input!
+//
+// Save view is called by:
+// 1. [onCollectionSaveExecute] -> app.SaveView()
+// 2. [getQueryTableInfo] -> app.SaveView()
+// 3. [onCollectionSaveExecute] -> [resaveViewsWithChangedFields] -> [saveViewCollection] -> app.SaveView()
+// 4. [onCollectionDeleteExecute] -> [resaveViewsWithChangedFields] -> [saveViewCollection] -> app.SaveView()
+func (app *BaseApp) SaveView(name string, selectQuery string) error {
+	return app.RunInTransaction(func(txApp App) error {
+		// PostgreSQL:
+		// Get dependent views before dropping the view and its dependencies.
+		// Note:
+		// 1. Calling `txApp.DeleteView()` will not only drop current view, but also all the dependent views.
+		// 2. Why do we need to drop all dependent views in PostgreSQL? Because we need to update the view,
+		//    although there is a `CREATE OR REPLACE VIEW` statement, but it forbids us to remove any column
+		//    from the view. So we need to drop the view. And we we drop the view, we also need to drop all
+		//    the dependent views otherwise PostgreSQL will throw an error.
+		// 3. By calling `findDependentViews()` before dropping the view, we can get all the dependent views
+		//    and recreate them after the current view is recreated.
+		dependentViews, err := findDependentViews(txApp, name)
+		if err != nil {
+			return err
+		}
+		for i := len(dependentViews) - 1; i >= 0; i-- {
+			if err := txApp.DeleteView(dependentViews[i].Name); err != nil {
+				return fmt.Errorf("failed to drop dependent view %q temporarily while saving view %q: %w", dependentViews[i].Name, name, err)
+			}
+		}
+
+		// delete old view (if exists)
+		if err := txApp.DeleteView(name); err != nil {
+			return err
+		}
+
+		selectQuery = strings.Trim(strings.TrimSpace(selectQuery), ";")
+
+		// try to loosely detect multiple inline statements
+		tk := tokenizer.NewFromString(selectQuery)
+		tk.Separators(';')
+		if queryParts, _ := tk.ScanAll(); len(queryParts) > 1 {
+			return errors.New("multiple statements are not supported")
+		}
+
+		// (re)create the view
+		//
+		// note: the query is wrapped in a secondary SELECT as a rudimentary
+		// measure to discourage multiple inline sql statements execution
+		viewQuery := fmt.Sprintf("CREATE VIEW {{%s}} AS SELECT * FROM (%s)", name, selectQuery)
+		if _, err := txApp.DB().NewQuery(viewQuery).Execute(); err != nil {
+			return err
+		}
+
+		// fetch the view table info to ensure that the view was created
+		// because missing tables or columns won't return an error
+		if _, err := txApp.TableInfo(name); err != nil {
+			// manually cleanup previously created view in case the func
+			// is called in a nested transaction and the error is discarded
+			txApp.DeleteView(name)
+
+			return err
+		}
+
+		// PostgreSQL:
+		// recreate the dependent views
+		for _, dependentView := range dependentViews {
+			if _, err := txApp.DB().NewQuery(dependentView.SQL).Execute(); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
+// CreateViewFields creates a new FieldsList from the provided select query.
+//
+// There are some caveats:
+// - The select query must have an "id" column.
+// - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
+func (app *BaseApp) CreateViewFields(selectQuery string) (FieldsList, error) {
+	result := NewFieldsList()
+
+	suggestedFields, err := parseQueryToFields(app, selectQuery)
+	if err != nil {
+		return result, err
+	}
+
+	// note wrap in a transaction in case the selectQuery contains
+	// multiple statements allowing us to rollback on any error
+	txErr := app.RunInTransaction(func(txApp App) error {
+		info, err := getQueryTableInfo(txApp, selectQuery)
+		if err != nil {
+			return err
+		}
+
+		var hasId bool
+
+		for _, row := range info {
+			if row.Name == FieldNameId {
+				hasId = true
+			}
+
+			var field Field
+
+			if f, ok := suggestedFields[row.Name]; ok {
+				field = f.field
+			} else {
+				field = defaultViewField(row.Name)
+			}
+
+			result.Add(field)
+		}
+
+		if !hasId {
+			return errors.New("missing required id column (you can use `(ROW_NUMBER() OVER()) as id` if you don't have one)")
+		}
+
+		return nil
+	})
+
+	return result, txErr
+}
+
+// FindRecordByViewFile returns the original Record of the provided view collection file.
+func (app *BaseApp) FindRecordByViewFile(viewCollectionModelOrIdentifier any, fileFieldName string, filename string) (*Record, error) {
+	view, err := getCollectionByModelOrIdentifier(app, viewCollectionModelOrIdentifier)
+	if err != nil {
+		return nil, err
+	}
+
+	if !view.IsView() {
+		return nil, errors.New("not a view collection")
+	}
+
+	var findFirstNonViewQueryFileField func(int) (*queryField, error)
+	findFirstNonViewQueryFileField = func(level int) (*queryField, error) {
+		// check the level depth to prevent infinite circular recursion
+		// (the limit is arbitrary and may change in the future)
+		if level > 5 {
+			return nil, errors.New("reached the max recursion level of view collection file field queries")
+		}
+
+		queryFields, err := parseQueryToFields(app, view.ViewQuery)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, item := range queryFields {
+			if item.collection == nil ||
+				item.original == nil ||
+				item.field.GetName() != fileFieldName {
+				continue
+			}
+
+			if item.collection.IsView() {
+				view = item.collection
+				fileFieldName = item.original.GetName()
+				return findFirstNonViewQueryFileField(level + 1)
+			}
+
+			return item, nil
+		}
+
+		return nil, errors.New("no query file field found")
+	}
+
+	qf, err := findFirstNonViewQueryFileField(1)
+	if err != nil {
+		return nil, err
+	}
+
+	cleanFieldName := inflector.Columnify(qf.original.GetName())
+
+	record := &Record{}
+
+	query := app.RecordQuery(qf.collection).Limit(1)
+
+	if opt, ok := qf.original.(MultiValuer); !ok || !opt.IsMultiple() {
+		query.AndWhere(dbx.HashExp{cleanFieldName: filename})
+	} else {
+		// Tip: user inner join here is much faster than using subquery by test results in PostgreSQL.
+		query.InnerJoin(
+			fmt.Sprintf(`%s as {{_je_file}}`, dbutils.JSONEach(cleanFieldName)),
+			dbx.HashExp{"_je_file.value": filename},
+		)
+	}
+
+	if err := query.One(record); err != nil {
+		return nil, err
+	}
+
+	return record, nil
+}
+
+// -------------------------------------------------------------------
+// Raw query to schema helpers
+// -------------------------------------------------------------------
+
+type queryField struct {
+	// field is the final resolved field.
+	field Field
+
+	// collection refers to the original field's collection model.
+	// It could be nil if the found query field is not from a collection
+	collection *Collection
+
+	// original is the original found collection field.
+	// It could be nil if the found query field is not from a collection
+	original Field
+}
+
+func defaultViewField(name string) Field {
+	return &JSONField{
+		Name:    name,
+		MaxSize: 1, // unused for views
+	}
+}
+
+// castRegex extracts casted type from an column expression.
+// It supports both the standard `CAST(...AS...)` and the PostgreSQL specific `::` syntax.
+// eg:
+// 1. (SELECT MAX(id)::TEXT FROM table)::INTEGER  -->  INTEGER
+// 2. CAST(123 AS TEXT) --> TEXT
+var castRegex = regexp.MustCompile(`(?is)^cast\s*\([\s\S]*\s+as\s+(\w+)\s*\)$`)
+var castRegex2 = regexp.MustCompile(`(?is)^[\s\S]*::(\w+)\s*$`)
+
+func getCastRegex(app App) *regexp.Regexp {
+	if IsPostgres(app) {
+		return castRegex
+	}
+	return regexp.MustCompile(`(?is)^cast\s*\(.*\s+as\s+(\w+)\s*\)$`)
+}
+
+func parseQueryToFields(app App, selectQuery string) (map[string]*queryField, error) {
+	p := new(identifiersParser)
+	if err := p.parse(app, selectQuery); err != nil {
+		return nil, err
+	}
+
+	collections, err := findCollectionsByIdentifiers(app, p.tables)
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[string]*queryField, len(p.columns))
+
+	var mainTable identifier
+
+	if len(p.tables) > 0 {
+		mainTable = p.tables[0]
+	}
+
+	for _, col := range p.columns {
+		colLower := strings.ToLower(col.original)
+
+		// pk (always assume text field for now)
+		if col.alias == FieldNameId {
+			result[col.alias] = &queryField{
+				field: &TextField{
+					Name:       col.alias,
+					System:     true,
+					Required:   true,
+					PrimaryKey: true,
+					Pattern:    `^[a-z0-9]+$`,
+				},
+			}
+			continue
+		}
+
+		// numeric aggregations
+		if strings.HasPrefix(colLower, "count(") || strings.HasPrefix(colLower, "total(") {
+			result[col.alias] = &queryField{
+				field: &NumberField{
+					Name: col.alias,
+				},
+			}
+			continue
+		}
+
+		castMatch := getCastRegex(app).FindStringSubmatch(colLower)
+		if castMatch == nil && IsPostgres(app) {
+			castMatch = castRegex2.FindStringSubmatch(colLower)
+		}
+
+		// numeric casts
+		if len(castMatch) == 2 {
+			if !IsPostgres(app) {
+				switch castMatch[1] {
+				case "real", "integer", "int", "decimal", "numeric":
+					result[col.alias] = &queryField{
+						field: &NumberField{
+							Name: col.alias,
+						},
+					}
+					continue
+				}
+			} else {
+				// PostgreSQL:
+				// Note: PostgreSQL's `double precision` is not supported here because it contains whitespace and won't be catched by the regex. Use `numeric` instead.
+				switch castMatch[1] {
+				case "real", "integer", "int", "smallint", "bigint", "decimal", "numeric", "serial", "smallserial", "bigserial", "double":
+					result[col.alias] = &queryField{
+						field: &NumberField{
+							Name: col.alias,
+						},
+					}
+					continue
+				case "text":
+					result[col.alias] = &queryField{
+						field: &TextField{
+							Name: col.alias,
+						},
+					}
+					continue
+				case "boolean", "bool":
+					result[col.alias] = &queryField{
+						field: &BoolField{
+							Name: col.alias,
+						},
+					}
+					continue
+				}
+			}
+		}
+
+		parts := strings.Split(col.original, ".")
+
+		var fieldName string
+		var collection *Collection
+
+		if len(parts) == 2 {
+			fieldName = parts[1]
+			collection = collections[parts[0]]
+		} else {
+			fieldName = parts[0]
+			collection = collections[mainTable.alias]
+		}
+
+		// fallback to the default field
+		if collection == nil {
+			result[col.alias] = &queryField{
+				field: defaultViewField(col.alias),
+			}
+			continue
+		}
+
+		if fieldName == "*" {
+			return nil, errors.New("dynamic column names are not supported")
+		}
+
+		// find the first field by name (case insensitive)
+		var field Field
+		for _, f := range collection.Fields {
+			if strings.EqualFold(f.GetName(), fieldName) {
+				field = f
+				break
+			}
+		}
+
+		// fallback to the default field
+		if field == nil {
+			result[col.alias] = &queryField{
+				field:      defaultViewField(col.alias),
+				collection: collection,
+			}
+			continue
+		}
+
+		// convert to relation since it is an id reference
+		if strings.EqualFold(fieldName, FieldNameId) {
+			result[col.alias] = &queryField{
+				field: &RelationField{
+					Name:         col.alias,
+					MaxSelect:    1,
+					CollectionId: collection.Id,
+				},
+				collection: collection,
+			}
+			continue
+		}
+
+		// we fetch a brand new collection object to avoid using reflection
+		// or having a dedicated Clone method for each field type
+		tempCollection, err := app.FindCollectionByNameOrId(collection.Id)
+		if err != nil {
+			return nil, err
+		}
+
+		clone := tempCollection.Fields.GetById(field.GetId())
+		if clone == nil {
+			return nil, fmt.Errorf("missing expected field %q (%q) in collection %q", field.GetName(), field.GetId(), tempCollection.Name)
+		}
+		// set new random id to prevent duplications if the same field is aliased multiple times
+		clone.SetId("_clone_" + security.PseudorandomString(4))
+		clone.SetName(col.alias)
+
+		result[col.alias] = &queryField{
+			original:   field,
+			field:      clone,
+			collection: collection,
+		}
+	}
+
+	return result, nil
+}
+
+func findCollectionsByIdentifiers(app App, tables []identifier) (map[string]*Collection, error) {
+	names := make([]any, 0, len(tables))
+
+	for _, table := range tables {
+		if strings.Contains(table.alias, "(") {
+			continue // skip expressions
+		}
+		names = append(names, table.original)
+	}
+
+	if len(names) == 0 {
+		return nil, nil
+	}
+
+	result := make(map[string]*Collection, len(names))
+	collections := make([]*Collection, 0, len(names))
+
+	err := app.CollectionQuery().
+		AndWhere(dbx.In("name", names...)).
+		All(&collections)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, table := range tables {
+		for _, collection := range collections {
+			if collection.Name == table.original {
+				result[table.alias] = collection
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// dry run the query and parse the standard column info.
+func getQueryTableInfo(app App, selectQuery string) ([]*TableInfoRow, error) {
+	tempView := "_temp_" + security.PseudorandomString(6)
+
+	var info []*TableInfoRow
+
+	txErr := app.RunInTransaction(func(txApp App) error {
+		// create a temp view with the provided query
+		err := txApp.SaveView(tempView, selectQuery)
+		if err != nil {
+			return err
+		}
+
+		// extract the generated view table info
+		info, err = txApp.TableInfo(tempView)
+
+		return errors.Join(err, txApp.DeleteView(tempView))
+	})
+
+	if txErr != nil {
+		return nil, txErr
+	}
+
+	return info, nil
+}
+
+// -------------------------------------------------------------------
+// Raw query identifiers parser
+// -------------------------------------------------------------------
+
+var (
+	joinReplaceRegex     = regexp.MustCompile(`(?im)\s+(full\s+outer\s+join|left\s+outer\s+join|right\s+outer\s+join|full\s+join|cross\s+join|inner\s+join|outer\s+join|left\s+join|right\s+join|join)\s+?`)
+	discardReplaceRegex  = regexp.MustCompile(`(?im)\s+(where|group\s+by|having|order|limit|with)\s+?`)
+	commentsReplaceRegex = regexp.MustCompile(`(?m)(\/\*[\s\S]*?\*\/)|(--.+$)`)
+)
+
+type identifier struct {
+	original string
+	alias    string
+}
+
+type identifiersParser struct {
+	columns []identifier
+	tables  []identifier
+}
+
+func (p *identifiersParser) parse(app App, selectQuery string) error {
+	str := strings.Trim(strings.TrimSpace(selectQuery), ";")
+	str = commentsReplaceRegex.ReplaceAllString(str, " ")
+	str = joinReplaceRegex.ReplaceAllString(str, " __pb_join__ ")
+	str = discardReplaceRegex.ReplaceAllString(str, " __pb_discard__ ")
+
+	tk := tokenizer.NewFromString(str)
+	tk.Separators(',', ' ', '\n', '\t')
+	tk.KeepSeparator(true)
+
+	var skip bool
+	var partType string
+	var activeBuilder *strings.Builder
+	var selectParts strings.Builder
+	var fromParts strings.Builder
+	var joinParts strings.Builder
+
+	for {
+		token, err := tk.Scan()
+		if err != nil {
+			if err != io.EOF {
+				return err
+			}
+			break
+		}
+
+		trimmed := strings.ToLower(strings.TrimSpace(token))
+
+		switch trimmed {
+		case "select":
+			skip = false
+			partType = "select"
+			activeBuilder = &selectParts
+		case "distinct":
+			continue // ignore as it is not important for the identifiers parsing
+		case "from":
+			skip = false
+			partType = "from"
+			activeBuilder = &fromParts
+		case "__pb_join__":
+			skip = false
+
+			// the previous part was also a join
+			if partType == "join" {
+				joinParts.WriteString(",")
+			}
+
+			partType = "join"
+			activeBuilder = &joinParts
+		case "__pb_discard__":
+			// skip following tokens
+			skip = true
+		default:
+			isJoin := partType == "join"
+
+			if isJoin && trimmed == "on" {
+				skip = true
+			}
+
+			if !skip && activeBuilder != nil {
+				activeBuilder.WriteString(" ")
+				activeBuilder.WriteString(token)
+			}
+		}
+	}
+
+	selects, err := extractIdentifiers(app, selectParts.String())
+	if err != nil {
+		return err
+	}
+
+	froms, err := extractIdentifiers(app, fromParts.String())
+	if err != nil {
+		return err
+	}
+
+	joins, err := extractIdentifiers(app, joinParts.String())
+	if err != nil {
+		return err
+	}
+
+	p.columns = selects
+	p.tables = froms
+	p.tables = append(p.tables, joins...)
+
+	return nil
+}
+
+func extractIdentifiers(app App, rawExpression string) ([]identifier, error) {
+	rawTk := tokenizer.NewFromString(rawExpression)
+	rawTk.Separators(',')
+
+	rawIdentifiers, err := rawTk.ScanAll()
+	if err != nil {
+		return nil, err
+	}
+
+	result := make([]identifier, 0, len(rawIdentifiers))
+
+	for _, rawIdentifier := range rawIdentifiers {
+		tk := tokenizer.NewFromString(rawIdentifier)
+		tk.Separators(' ', '\n', '\t')
+
+		parts, err := tk.ScanAll()
+		if err != nil {
+			return nil, err
+		}
+
+		resolved, err := identifierFromParts(app, parts)
+		if err != nil {
+			return nil, err
+		}
+
+		result = append(result, resolved)
+	}
+
+	return result, nil
+}
+
+func identifierFromParts(app App, parts []string) (identifier, error) {
+	if !IsPostgres(app) {
+		return identifierFromParts_sqlite(parts)
+	}
+	return identifierFromParts_postgres(parts)
+}
+
+// SQLite:
+func identifierFromParts_sqlite(parts []string) (identifier, error) {
+	var result identifier
+
+	switch len(parts) {
+	case 3:
+		if !strings.EqualFold(parts[1], "as") {
+			return result, fmt.Errorf(`invalid identifier part - expected "as", got %v`, parts[1])
+		}
+
+		result.original = parts[0]
+		result.alias = parts[2]
+	case 2:
+		result.original = parts[0]
+		result.alias = parts[1]
+	case 1:
+		subParts := strings.Split(parts[0], ".")
+		result.original = parts[0]
+		result.alias = subParts[len(subParts)-1]
+	default:
+		return result, fmt.Errorf(`invalid identifier parts %v`, parts)
+	}
+
+	result.original = trimRawIdentifier(result.original)
+
+	// we trim the single quote even though it is not a valid column quote character
+	// because SQLite allows it if the context expects an identifier and not string literal
+	// (https://www.sqlite.org/lang_keywords.html)
+	result.alias = trimRawIdentifier(result.alias, "'")
+
+	return result, nil
+}
+
+// PostgreSQL:
+func identifierFromParts_postgres(parts []string) (identifier, error) {
+	if len(parts) == 1 {
+		// eg: `id`, `table_1.id`
+		subParts := strings.Split(parts[0], ".")
+		alias := subParts[len(subParts)-1]
+		return identifierFromParts_postgres([]string{parts[0], alias})
+	}
+
+	// eg:
+	// - `count(*) count`
+	// - `count(*) as count`
+	// - `ROW_NUMBER() OVER (PARTITION BY id ORDER BY created DESC) row_number`
+	// - `ROW_NUMBER() OVER (PARTITION BY id ORDER BY created DESC) as row_number`
+	var result identifier
+	result.alias = parts[len(parts)-1]
+	result.original = strings.TrimSuffix(strings.Join(parts[:len(parts)-1], " "), " as")
+
+	result.alias = trimRawIdentifier(result.alias)
+	result.original = trimRawIdentifier(result.original)
+
+	return result, nil
+}
+
+func trimRawIdentifier(rawIdentifier string, extraTrimChars ...string) string {
+	trimChars := "`\"[];"
+	if len(extraTrimChars) > 0 {
+		trimChars += strings.Join(extraTrimChars, "")
+	}
+
+	parts := strings.Split(rawIdentifier, ".")
+
+	for i := range parts {
+		parts[i] = strings.Trim(parts[i], trimChars)
+	}
+
+	return strings.Join(parts, ".")
+}
+
+func findDependentViews(app App, tableOrViewName string) ([]viewDef, error) {
+	if !IsPostgres(app) {
+		return nil, nil
+	}
+
+	// Note: this is a PostgreSQL specific query to find all views that depend on the provided view.
+	// It uses the pg_views system catalog to get the view definition and then filters by the view name.
+	query := `
+		select
+			u.view_name,
+			u.table_name referenced_table_name,
+			v.view_definition
+		from information_schema.view_table_usage u
+		join information_schema.views v on u.view_schema = v.table_schema
+			and u.view_name = v.table_name
+		where u.table_schema = current_schema()
+		order by u.view_name;
+	`
+
+	var rows []struct {
+		ViewName            string `db:"view_name"`
+		ReferencedTableName string `db:"referenced_table_name"`
+		ViewDefinition      string `db:"view_definition"`
+	}
+	err := app.DB().NewQuery(query).All(&rows)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	// Topological sort this DAG graph
+	nodes := make(map[string]viewDef)
+	graph := make(map[string][]string)
+	for _, row := range rows {
+		if def, ok := nodes[row.ViewName]; !ok || def.SQL == "[TABLE]" {
+			nodes[row.ViewName] = viewDef{
+				Name: row.ViewName,
+				SQL:  fmt.Sprintf(`CREATE VIEW "%s" AS %s`, row.ViewName, row.ViewDefinition),
+			}
+		}
+		if !slices.Contains(graph[row.ReferencedTableName], row.ViewName) {
+			graph[row.ReferencedTableName] = append(graph[row.ReferencedTableName], row.ViewName)
+			if _, ok := nodes[row.ReferencedTableName]; !ok {
+				nodes[row.ReferencedTableName] = viewDef{
+					Name: row.ReferencedTableName,
+					SQL:  "[TABLE]",
+				}
+			}
+		}
+	}
+
+	// No one depends on the provided view
+	if _, ok := graph[tableOrViewName]; !ok {
+		return nil, nil
+	}
+
+	sorted, err := sort.TopologicalSortReachable(nodes, graph, tableOrViewName)
+	if err != nil {
+		return nil, err
+	}
+
+	// exclude self from the sorted result.
+	return sorted[1:], nil
+}
+
+func findAllViewsInDependencyOrder(app App) ([]viewDef, error) {
+	if !IsPostgres(app) {
+		return nil, nil
+	}
+
+	// Note: this is a PostgreSQL specific query to find all views that depend on the provided view.
+	// It uses the pg_views system catalog to get the view definition and then filters by the view name.
+	query := `
+		select
+			u.view_name,
+			u.table_name referenced_table_name,
+			v.view_definition
+		from information_schema.view_table_usage u
+		join information_schema.views v on u.view_schema = v.table_schema
+			and u.view_name = v.table_name
+		where u.table_schema = current_schema()
+		order by u.view_name;
+	`
+
+	var rows []struct {
+		ViewName            string `db:"view_name"`
+		ReferencedTableName string `db:"referenced_table_name"`
+		ViewDefinition      string `db:"view_definition"`
+	}
+	err := app.DB().NewQuery(query).All(&rows)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	// Topological sort this DAG graph
+	nodes := make(map[string]viewDef)
+	graph := make(map[string][]string)
+	for _, row := range rows {
+		if def, ok := nodes[row.ViewName]; !ok || def.SQL == "[TABLE]" {
+			nodes[row.ViewName] = viewDef{
+				Name: row.ViewName,
+				SQL:  fmt.Sprintf(`CREATE VIEW "%s" AS %s`, row.ViewName, row.ViewDefinition),
+			}
+		}
+		if !slices.Contains(graph[row.ReferencedTableName], row.ViewName) {
+			graph[row.ReferencedTableName] = append(graph[row.ReferencedTableName], row.ViewName)
+			if _, ok := nodes[row.ReferencedTableName]; !ok {
+				nodes[row.ReferencedTableName] = viewDef{
+					Name: row.ReferencedTableName,
+					SQL:  "[TABLE]",
+				}
+			}
+		}
+	}
+
+	sorted, err := sort.TopologicalSortAll(nodes, graph)
+	if err != nil {
+		return nil, err
+	}
+
+	// exclude tables from the sorted result.
+	var views []viewDef
+	for _, node := range sorted {
+		if node.SQL != "[TABLE]" {
+			views = append(views, node)
+		}
+	}
+	return views, nil
+}
diff --git a/server/core_backend-server/core/view_test.go b/server/core_backend-server/core/view_test.go
new file mode 100644
index 0000000..743519e
--- /dev/null
+++ b/server/core_backend-server/core/view_test.go
@@ -0,0 +1,817 @@
+package core_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func ensureNoTempViews(app core.App, t *testing.T) {
+	var total int
+
+	/* SQLite:
+	err := app.DB().Select("count(*)").
+		From("sqlite_schema").
+		AndWhere(dbx.HashExp{"type": "view"}).
+		AndWhere(dbx.NewExp(`[[name]] LIKE '%\_temp\_%' ESCAPE '\'`)).
+		Limit(1).
+		Row(&total)
+	*/
+	// PostgreSQL:
+	err := app.DB().Select("count(*)").
+		From("information_schema.views").
+		AndWhere(dbx.HashExp{"table_schema": "current_schema()"}).
+		AndWhere(dbx.NewExp(`lower(table_name) LIKE lower('%\_temp\_%')`)).
+		Limit(1).
+		Row(&total)
+	if err != nil {
+		t.Fatalf("Failed to check for temp views: %v", err)
+	}
+
+	if total > 0 {
+		t.Fatalf("Expected all temp views to be deleted, got %d", total)
+	}
+}
+
+func TestDeleteView(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		viewName    string
+		expectError bool
+	}{
+		{"", true},
+		{"demo1", true},    // not a view table
+		{"missing", false}, // missing or already deleted
+		/* SQLite:
+		{"view1", false},   // existing
+		*/
+		// PostgreSQL:
+		{"view1", true},  // could not drop because view2 depends on view1
+		{"view2", false}, // existing
+		// PostgreSQL:
+		{"VieW1", false}, // view names are case insensitives
+	}
+
+	for i, s := range scenarios {
+		err := app.DeleteView(s.viewName)
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("[%d - %q] Expected hasErr %v, got %v (%v)", i, s.viewName, s.expectError, hasErr, err)
+		}
+	}
+
+	ensureNoTempViews(app, t)
+}
+
+func TestSaveView(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		scenarioName  string
+		viewName      string
+		query         string
+		expectError   bool
+		expectColumns []string
+	}{
+		{
+			"empty name and query",
+			"",
+			"",
+			true,
+			nil,
+		},
+		{
+			"empty name",
+			"",
+			"select * from " + core.CollectionNameSuperusers,
+			true,
+			nil,
+		},
+		{
+			"empty query",
+			"123Test",
+			"",
+			true,
+			nil,
+		},
+		{
+			"invalid query",
+			"123Test",
+			"123 456",
+			true,
+			nil,
+		},
+		{
+			"missing table",
+			"123Test",
+			"select id from missing",
+			true,
+			nil,
+		},
+		{
+			"non select query",
+			"123Test",
+			"drop table " + core.CollectionNameSuperusers,
+			true,
+			nil,
+		},
+		{
+			"multiple select queries",
+			"123Test",
+			"select *, count(id) as c  from " + core.CollectionNameSuperusers + "; select * from demo1;",
+			true,
+			nil,
+		},
+		{
+			"try to break the parent parenthesis",
+			"123Test",
+			"select *, count(id) as c  from `" + core.CollectionNameSuperusers + "`)",
+			true,
+			nil,
+		},
+		{
+			"simple select query (+ trimmed semicolon)",
+			"123Test",
+			";select *, count(id) over () as c  from " + core.CollectionNameSuperusers + ";",
+			false,
+			[]string{
+				"id", "created", "updated",
+				"password", "tokenKey", "email",
+				"emailVisibility", "verified",
+				"c",
+			},
+		},
+		{
+			"update old view with new query",
+			"123Test",
+			"select 1 as test from " + core.CollectionNameSuperusers,
+			false,
+			[]string{"test"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.scenarioName, func(t *testing.T) {
+			err := app.SaveView(s.viewName, s.query)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			infoRows, err := app.TableInfo(s.viewName)
+			if err != nil {
+				t.Fatalf("Failed to fetch table info for %s: %v", s.viewName, err)
+			}
+
+			if len(s.expectColumns) != len(infoRows) {
+				t.Fatalf("Expected %d columns, got %d", len(s.expectColumns), len(infoRows))
+			}
+
+			for _, row := range infoRows {
+				if !slices.Contains(s.expectColumns, row.Name) {
+					t.Fatalf("Missing %q column in %v", row.Name, s.expectColumns)
+				}
+			}
+		})
+	}
+
+	ensureNoTempViews(app, t)
+}
+
+func TestCreateViewFieldsWithDiscardedNestedTransaction(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	app.RunInTransaction(func(txApp core.App) error {
+		_, err := txApp.CreateViewFields("select id from missing")
+		if err == nil {
+			t.Fatal("Expected error, got nil")
+		}
+
+		return nil
+	})
+
+	ensureNoTempViews(app, t)
+}
+
+func TestCreateViewFields(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	scenarios := []struct {
+		name         string
+		query        string
+		expectError  bool
+		expectFields map[string]string // name-type pairs
+	}{
+		{
+			"empty query",
+			"",
+			true,
+			nil,
+		},
+		{
+			"invalid query",
+			"test 123456",
+			true,
+			nil,
+		},
+		{
+			"missing table",
+			"select id from missing",
+			true,
+			nil,
+		},
+		{
+			"query with wildcard column",
+			"select a.id, a.* from demo1 a",
+			true,
+			nil,
+		},
+		{
+			"query without id",
+			"select text, url, created, updated from demo1",
+			true,
+			nil,
+		},
+		{
+			"query with comments",
+			`
+				select
+				-- test single line
+				demo1.id,
+				demo1.text,
+				/* multi
+				 * line comment block */
+				demo1.url, demo1.created, demo1.updated from/* inline comment block with no spaces between the identifiers */demo1
+				-- comment before join
+				join demo2 ON (
+					-- comment inside join
+					demo2.id = demo1.id
+				)
+				-- comment before where
+				where (
+					-- comment inside where
+					demo2.id = demo1.id
+				)
+			`,
+			false,
+			map[string]string{
+				"id":      core.FieldTypeText,
+				"text":    core.FieldTypeText,
+				"url":     core.FieldTypeURL,
+				"created": core.FieldTypeAutodate,
+				"updated": core.FieldTypeAutodate,
+			},
+		},
+		{
+			"query with all fields and quoted identifiers",
+			/* SQLite:
+			`
+				select
+					"id",
+					"created",
+					"updated",
+					[text],
+					` + "`bool`" + `,
+					"url",
+					"select_one",
+					"select_many",
+					"file_one",
+					"demo1"."file_many",
+					` + "`demo1`." + "`number`" + ` number_alias,
+					"email",
+					"datetime",
+					"json",
+					"rel_one",
+					"rel_many",
+					'single_quoted_custom_literal' as 'single_quoted_column'
+				from demo1
+			`,
+			*/
+			// PostgreSQL:
+			`
+				select
+					"id",
+					"created",
+					"updated",
+					"text",
+					"bool",
+					"url",
+					"select_one",
+					"select_many",
+					"file_one",
+					"demo1"."file_many",
+					"demo1"."number" number_alias,
+					"email",
+					"datetime",
+					"json",
+					"rel_one",
+					"rel_many",
+					'single_quoted_custom_literal' as "single_quoted_column"
+				from demo1
+			`,
+			false,
+			map[string]string{
+				"id":                   core.FieldTypeText,
+				"created":              core.FieldTypeAutodate,
+				"updated":              core.FieldTypeAutodate,
+				"text":                 core.FieldTypeText,
+				"bool":                 core.FieldTypeBool,
+				"url":                  core.FieldTypeURL,
+				"select_one":           core.FieldTypeSelect,
+				"select_many":          core.FieldTypeSelect,
+				"file_one":             core.FieldTypeFile,
+				"file_many":            core.FieldTypeFile,
+				"number_alias":         core.FieldTypeNumber,
+				"email":                core.FieldTypeEmail,
+				"datetime":             core.FieldTypeDate,
+				"json":                 core.FieldTypeJSON,
+				"rel_one":              core.FieldTypeRelation,
+				"rel_many":             core.FieldTypeRelation,
+				"single_quoted_column": core.FieldTypeJSON,
+			},
+		},
+		{
+			"query with indirect relations fields",
+			"select a.id, b.id as bid, b.created from demo1 as a left join demo2 b on 1=1",
+			false,
+			map[string]string{
+				"id":      core.FieldTypeText,
+				"bid":     core.FieldTypeRelation,
+				"created": core.FieldTypeAutodate,
+			},
+		},
+		{
+			"query with multiple froms, joins and style of aliasses",
+			/* SQLite:
+			`
+				select
+					a.id as id,
+					b.id as bid,
+					lj.id cid,
+					ij.id as did,
+					a.bool,
+					` + core.CollectionNameSuperusers + `.id as eid,
+					` + core.CollectionNameSuperusers + `.email
+				from demo1 a, demo2 as b
+				left join demo3 lj on lj.id = 123
+				inner join demo4 as ij on ij.id = 123
+				join ` + core.CollectionNameSuperusers + `
+				where 1=1
+				group by a.id
+				limit 10
+			`,
+			*/
+			// PostgreSQL:
+			`
+				select distinct on(a.id)
+					a.id as id,
+					b.id as bid,
+					lj.id cid,
+					ij.id as did,
+					a.bool,
+					` + core.CollectionNameSuperusers + `.id as eid,
+					` + core.CollectionNameSuperusers + `.email
+				from demo1 a, demo2 as b
+				left join demo3 lj on lj.id = '123'
+				inner join demo4 as ij on ij.id = '123'
+				join ` + core.CollectionNameSuperusers + ` on 1 = 1
+				where 1=1
+				limit 10
+			`,
+			false,
+			map[string]string{
+				"id":    core.FieldTypeText,
+				"bid":   core.FieldTypeRelation,
+				"cid":   core.FieldTypeRelation,
+				"did":   core.FieldTypeRelation,
+				"bool":  core.FieldTypeBool,
+				"eid":   core.FieldTypeRelation,
+				"email": core.FieldTypeEmail,
+			},
+		},
+		/* SQLite:
+		{
+			"query with casts",
+			`select
+				a.id,
+				count(a.id) count,
+				cast(a.id as int) cast_int,
+				cast(a.id as integer) cast_integer,
+				cast(a.id as real) cast_real,
+				cast(a.id as decimal) cast_decimal,
+				cast(a.id as numeric) cast_numeric,
+				cast(a.id as text) cast_text,
+				cast(a.id as bool) cast_bool,
+				cast(a.id as boolean) cast_boolean,
+				avg(a.id) avg,
+				sum(a.id) sum,
+				total(a.id) total,
+				min(a.id) min,
+				max(a.id) max
+			from demo1 a`,
+			false,
+			map[string]string{
+				"id":           core.FieldTypeText,
+				"count":        core.FieldTypeNumber,
+				"total":        core.FieldTypeNumber,
+				"cast_int":     core.FieldTypeNumber,
+				"cast_integer": core.FieldTypeNumber,
+				"cast_real":    core.FieldTypeNumber,
+				"cast_decimal": core.FieldTypeNumber,
+				"cast_numeric": core.FieldTypeNumber,
+				"cast_text":    core.FieldTypeText,
+				"cast_bool":    core.FieldTypeBool,
+				"cast_boolean": core.FieldTypeBool,
+				// json because they are nullable
+				"sum": core.FieldTypeJSON,
+				"avg": core.FieldTypeJSON,
+				"min": core.FieldTypeJSON,
+				"max": core.FieldTypeJSON,
+			},
+		},
+		*/
+		// PostgreSQL:
+		{
+			"query with casts",
+			`select
+				a.id id,
+				count(a.id) over () count,
+				count(a.id) over() count2,
+				cast(count(a.id) over() as int) cast_int,
+				cast(count(a.id) over() as integer) cast_integer,
+				cast(count(a.id) over() as real) cast_real,
+				cast(count(a.id) over() as decimal) cast_decimal,
+				cast(count(a.id) over() as numeric) cast_numeric,
+				cast(a.id as text) cast_text,
+				cast((a.id != NULL) as bool) cast_bool,
+				cast((a.id != NULL) as boolean) cast_boolean,
+				avg(a.number) over() avg,
+				sum(a.number) over() sum,
+				min(a.number) over() min,
+				max(a.number) over() max,
+				(count(a.id) over())::int cast_int_2,
+				(count(a.id) over())::integer cast_integer_2,
+				(count(a.id) over())::real cast_real_2,
+				(count(a.id) over())::decimal cast_decimal_2,
+				(count(a.id) over())::numeric cast_numeric_2,
+				a.id::text cast_text_2,
+				(a.id != NULL)::bool cast_bool_2,
+				(a.id != NULL)::boolean cast_boolean_2,
+				(avg(a.number) over())::int avg_2,
+				(sum(a.number) over())::int sum_2,
+				(min(a.number) over())::int min_2,
+				(max(a.number) over())::int max_2
+			from demo1 a`,
+			false,
+			map[string]string{
+				"id":             core.FieldTypeText,
+				"count":          core.FieldTypeNumber,
+				"count2":         core.FieldTypeNumber,
+				"cast_int":       core.FieldTypeNumber,
+				"cast_integer":   core.FieldTypeNumber,
+				"cast_real":      core.FieldTypeNumber,
+				"cast_decimal":   core.FieldTypeNumber,
+				"cast_numeric":   core.FieldTypeNumber,
+				"cast_text":      core.FieldTypeText,
+				"cast_bool":      core.FieldTypeBool,
+				"cast_boolean":   core.FieldTypeBool,
+				"avg":            core.FieldTypeJSON,
+				"sum":            core.FieldTypeJSON,
+				"min":            core.FieldTypeJSON,
+				"max":            core.FieldTypeJSON,
+				"cast_int_2":     core.FieldTypeNumber,
+				"cast_integer_2": core.FieldTypeNumber,
+				"cast_real_2":    core.FieldTypeNumber,
+				"cast_decimal_2": core.FieldTypeNumber,
+				"cast_numeric_2": core.FieldTypeNumber,
+				"cast_text_2":    core.FieldTypeText,
+				"cast_bool_2":    core.FieldTypeBool,
+				"cast_boolean_2": core.FieldTypeBool,
+				"avg_2":          core.FieldTypeNumber,
+				"sum_2":          core.FieldTypeNumber,
+				"min_2":          core.FieldTypeNumber,
+				"max_2":          core.FieldTypeNumber,
+			},
+		},
+		{
+			"query with multiline cast",
+			`select
+				id,
+				cast(
+					(
+						case
+							when count(a.id) = 1 then 21
+							when count(a.id) = 2 then 18
+							else 0
+						end
+					) as int
+				) as cast_int
+			from demo1 a
+			group by 1`,
+			false,
+			map[string]string{
+				"id":       core.FieldTypeText,
+				"cast_int": core.FieldTypeNumber,
+			},
+		},
+		{
+			"query with case-insensitive and extra-spaced cast",
+			`select
+				id,
+				CaSt( a.id  aS iNt ) as cast_int
+			from demo1 a`,
+			false,
+			map[string]string{
+				"id":       core.FieldTypeText,
+				"cast_int": core.FieldTypeNumber,
+			},
+		},
+		{
+			"query with reserved auth collection fields",
+			/* SQLite:
+			`
+				select
+					a.id,
+					a.username,
+					a.email,
+					a.emailVisibility,
+					a.verified,
+					demo1.id relid
+				from users a
+				left join demo1 on 1 = 1
+			`,
+			*/
+			// PostgreSQL:
+			`
+			select
+				a.id,
+				a.username,
+				a.email,
+				a."emailVisibility",
+				a.verified,
+				demo1.id relid
+			from users a
+			left join demo1 on 1 = 1
+			`,
+			false,
+			map[string]string{
+				"id":              core.FieldTypeText,
+				"username":        core.FieldTypeText,
+				"email":           core.FieldTypeEmail,
+				"emailVisibility": core.FieldTypeBool,
+				"verified":        core.FieldTypeBool,
+				"relid":           core.FieldTypeRelation,
+			},
+		},
+		{
+			"query with unknown fields and aliases",
+			`select
+				id,
+				id as id2,
+				text as text_alias,
+				url as url_alias,
+				"demo1"."bool" as bool_alias,
+				number as number_alias,
+				created created_alias,
+				updated updated_alias,
+				123 as custom
+			from demo1`,
+			false,
+			map[string]string{
+				"id":            core.FieldTypeText,
+				"id2":           core.FieldTypeRelation,
+				"text_alias":    core.FieldTypeText,
+				"url_alias":     core.FieldTypeURL,
+				"bool_alias":    core.FieldTypeBool,
+				"number_alias":  core.FieldTypeNumber,
+				"created_alias": core.FieldTypeAutodate,
+				"updated_alias": core.FieldTypeAutodate,
+				"custom":        core.FieldTypeJSON,
+			},
+		},
+		{
+			"query with distinct and reordered id column",
+			`select distinct
+				id as id2,
+				id,
+				123 as custom
+			from demo1`,
+			false,
+			map[string]string{
+				"id2":    core.FieldTypeRelation,
+				"id":     core.FieldTypeText,
+				"custom": core.FieldTypeJSON,
+			},
+		},
+		{
+			"query with aliasing the same field multiple times",
+			`select
+				a.id as id,
+				a.text as alias1,
+				a.text as alias2,
+				b.text as alias3,
+				b.text as alias4
+			from demo1 a
+			left join demo1 as b on 1 = 1`,
+			false,
+			map[string]string{
+				"id":     core.FieldTypeText,
+				"alias1": core.FieldTypeText,
+				"alias2": core.FieldTypeText,
+				"alias3": core.FieldTypeText,
+				"alias4": core.FieldTypeText,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result, err := app.CreateViewFields(s.query)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if len(s.expectFields) != len(result) {
+				serialized, _ := json.Marshal(result)
+				t.Fatalf("Expected %d fields, got %d: \n%s", len(s.expectFields), len(result), serialized)
+			}
+
+			for name, typ := range s.expectFields {
+				field := result.GetByName(name)
+
+				if field == nil {
+					t.Fatalf("Expected to find field %s, got nil", name)
+				}
+
+				if field.Type() != typ {
+					t.Fatalf("Expected field %s to be %q, got %q", name, typ, field.Type())
+				}
+			}
+		})
+	}
+
+	ensureNoTempViews(app, t)
+}
+
+func TestFindRecordByViewFile(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	prevCollection, err := app.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	totalLevels := 6
+
+	// create collection view mocks
+	fileOneAlias := "file_one one0"
+	fileManyAlias := "file_many many0"
+	mockCollections := make([]*core.Collection, 0, totalLevels)
+	for i := 0; i <= totalLevels; i++ {
+		view := new(core.Collection)
+		view.Type = core.CollectionTypeView
+		view.Name = fmt.Sprintf("_test_view%d", i)
+		view.ViewQuery = fmt.Sprintf(
+			"select id, %s, %s from %s",
+			fileOneAlias,
+			fileManyAlias,
+			prevCollection.Name,
+		)
+
+		// save view
+		if err := app.Save(view); err != nil {
+			t.Fatalf("Failed to save view%d: %v", i, err)
+		}
+
+		mockCollections = append(mockCollections, view)
+		prevCollection = view
+		fileOneAlias = fmt.Sprintf("one%d one%d", i, i+1)
+		fileManyAlias = fmt.Sprintf("many%d many%d", i, i+1)
+	}
+
+	fileOneName := "test_d61b33QdDU.txt"
+	fileManyName := "test_QZFjKjXchk.txt"
+	expectedRecordId := "84nmscqy84lsi1t"
+
+	scenarios := []struct {
+		name               string
+		collectionNameOrId string
+		fileFieldName      string
+		filename           string
+		expectError        bool
+		expectRecordId     string
+	}{
+		{
+			"missing collection",
+			"missing",
+			"a",
+			fileOneName,
+			true,
+			"",
+		},
+		{
+			"non-view collection",
+			"demo1",
+			"file_one",
+			fileOneName,
+			true,
+			"",
+		},
+		{
+			"view collection after the max recursion limit",
+			mockCollections[totalLevels-1].Name,
+			fmt.Sprintf("one%d", totalLevels-1),
+			fileOneName,
+			true,
+			"",
+		},
+		{
+			"first view collection (single file)",
+			mockCollections[0].Name,
+			"one0",
+			fileOneName,
+			false,
+			expectedRecordId,
+		},
+		{
+			"first view collection (many files)",
+			mockCollections[0].Name,
+			"many0",
+			fileManyName,
+			false,
+			expectedRecordId,
+		},
+		{
+			"last view collection before the recursion limit (single file)",
+			mockCollections[totalLevels-2].Name,
+			fmt.Sprintf("one%d", totalLevels-2),
+			fileOneName,
+			false,
+			expectedRecordId,
+		},
+		{
+			"last view collection before the recursion limit (many files)",
+			mockCollections[totalLevels-2].Name,
+			fmt.Sprintf("many%d", totalLevels-2),
+			fileManyName,
+			false,
+			expectedRecordId,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			record, err := app.FindRecordByViewFile(
+				s.collectionNameOrId,
+				s.fileFieldName,
+				s.filename,
+			)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if record.Id != s.expectRecordId {
+				t.Fatalf("Expected recordId %q, got %q", s.expectRecordId, record.Id)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/examples/base/.env.example b/server/core_backend-server/examples/base/.env.example
new file mode 100644
index 0000000..eabdd0d
--- /dev/null
+++ b/server/core_backend-server/examples/base/.env.example
@@ -0,0 +1,70 @@
+# Orchbase Environment Variables
+# Copy this file to .env and customize the values
+#
+# ⚠️  NOTE: This is a PostgreSQL fork of PocketBase.
+#     SQLite is NOT supported by this codebase.
+#     Use the original PocketBase for SQLite support.
+
+# ============================================================
+# DATABASE CONFIGURATION (PostgreSQL Only)
+# ============================================================
+# Database type: "sqlite", "postgres" or "mysql"
+DB_TYPE=postgres
+# PostgreSQL connection URL (REQUIRED)
+# Format: postgres://user:password@host:port/database?sslmode=disable
+POSTGRES_URL=postgres://user:pass@127.0.0.1:6432/postgres?sslmode=disable
+
+# PostgreSQL database names
+# These databases will be created automatically if they don't exist
+POSTGRES_DATA_DB=pb-data
+POSTGRES_AUX_DB=pb-auxiliary
+
+# MySQL Configuration (used when DB_TYPE=mysql)
+MYSQL_DSN="root:password@tcp(127.0.0.1:3306)/"
+MYSQL_DATA_DB=pb_data
+MYSQL_AUX_DB=pb_auxiliary
+
+# Data directory for file storage (also used for SQLite db files)
+#PB_DATA_DIR=./pb_data
+
+# ============================================================
+# SECURITY CONFIGURATION
+# ============================================================
+
+# Encryption key for app settings (including S3 credentials)
+# IMPORTANT: This must be EXACTLY 32 characters for AES-256 encryption
+# 
+# To generate a secure key, run one of these commands:
+#   openssl rand -base64 32 | head -c 32
+#   head -c 32 /dev/urandom | base64 | head -c 32
+#
+# WARNING: 
+# - Keep this key secret and never commit it to version control
+# - If you lose this key, you will not be able to decrypt your settings
+# - Changing this key will require re-entering all encrypted settings
+#
+# Example (DO NOT use this in production):
+# PB_ENCRYPTION_KEY=your-32-character-secret-key123
+
+# ============================================================
+# OPTIONAL CONFIGURATION
+# ============================================================
+
+# Data directory path for file storage (default: ./pb_data)
+# Note: Even with PostgreSQL, files are still stored locally
+PB_DATA_DIR=./pb_data
+
+# Public directory for static files (default: ./pb_public)
+# PB_PUBLIC_DIR=./pb_public
+
+# Hooks directory for JavaScript hooks (default: ./pb_hooks)
+# PB_HOOKS_DIR=./pb_hooks
+
+# Enable realtime bridge for horizontal scaling (default: true)
+# PB_REALTIME_BRIDGE=true
+
+# Debug mode - prints database configuration on startup
+# PB_DEBUG=true
+
+# Set to false to disable the admin UI dashboard
+# PB_ADMIN_UI_ENABLED=true
diff --git a/server/core_backend-server/examples/base/.gitignore b/server/core_backend-server/examples/base/.gitignore
new file mode 100644
index 0000000..9a84f8f
--- /dev/null
+++ b/server/core_backend-server/examples/base/.gitignore
@@ -0,0 +1,7 @@
+# ignore everything
+/*
+
+# exclude from the ignore filter
+!.gitignore
+!.env.example
+!main.go
diff --git a/server/core_backend-server/examples/base/main.go b/server/core_backend-server/examples/base/main.go
new file mode 100644
index 0000000..c18f464
--- /dev/null
+++ b/server/core_backend-server/examples/base/main.go
@@ -0,0 +1,181 @@
+package main
+
+import (
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+
+	"github.com/joho/godotenv"
+	"github.com/pocketbase/pocketbase"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/plugins/ghupdate"
+	"github.com/pocketbase/pocketbase/plugins/jsvm"
+	"github.com/pocketbase/pocketbase/plugins/migratecmd"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+
+	// Import migrations to ensure they are registered
+	_ "github.com/pocketbase/pocketbase/migrations"
+)
+
+// EncryptionEnvName is the name of the environment variable that holds the 32-char encryption key
+const EncryptionEnvName = "PB_ENCRYPTION_KEY"
+
+func main() {
+	// Load .env file if it exists
+	// This allows configuration through a .env file
+	godotenv.Load()
+
+	// Get database configuration from environment variables
+	dbConfig := GetDBConfigFromEnv()
+
+	// Print the configuration (useful for debugging)
+	if os.Getenv("PB_DEBUG") == "true" {
+		dbConfig.PrintConfig()
+	}
+
+	// Build PocketBase configuration
+	pbConfig := pocketbase.Config{
+		DefaultEncryptionEnv: EncryptionEnvName,
+		DefaultDataDir:       dbConfig.GetDataDir(),
+		DBConnect:            dbConfig.GetDBConnectFunc(),
+	}
+
+	// If using PostgreSQL or MySQL, also set the auxiliary settings
+	if dbConfig.Type == DBTypePostgres {
+		pbConfig.DefaultPostgresURL = dbConfig.PostgresURL
+		pbConfig.DefaultPostgresDataDb = dbConfig.PostgresDataDB
+		pbConfig.DefaultPostgresAuxDb = dbConfig.PostgresAuxDB
+	} else if dbConfig.Type == DBTypeMysql {
+		// Pass MySQL DB names via the existing structure fields
+		pbConfig.DefaultPostgresDataDb = dbConfig.MysqlDataDB
+		pbConfig.DefaultPostgresAuxDb = dbConfig.MysqlAuxDB
+	}
+
+	// Initialize app with the configuration
+	app := pocketbase.NewWithConfig(pbConfig)
+
+	// ---------------------------------------------------------------
+	// Optional plugin flags:
+	// ---------------------------------------------------------------
+
+	var hooksDir string
+	app.RootCmd.PersistentFlags().StringVar(
+		&hooksDir,
+		"hooksDir",
+		os.Getenv("PB_HOOKS_DIR"),
+		"the directory with the JS app hooks",
+	)
+
+	var hooksWatch bool
+	app.RootCmd.PersistentFlags().BoolVar(
+		&hooksWatch,
+		"hooksWatch",
+		true,
+		"auto restart the app on pb_hooks file change; it has no effect on Windows",
+	)
+
+	var hooksPool int
+	app.RootCmd.PersistentFlags().IntVar(
+		&hooksPool,
+		"hooksPool",
+		15,
+		"the total prewarm goja.Runtime instances for the JS app hooks execution",
+	)
+
+	var migrationsDir string
+	app.RootCmd.PersistentFlags().StringVar(
+		&migrationsDir,
+		"migrationsDir",
+		"",
+		"the directory with the user defined migrations",
+	)
+
+	var automigrate bool
+	app.RootCmd.PersistentFlags().BoolVar(
+		&automigrate,
+		"automigrate",
+		true,
+		"enable/disable auto migrations",
+	)
+
+	var publicDir string
+	app.RootCmd.PersistentFlags().StringVar(
+		&publicDir,
+		"publicDir",
+		defaultPublicDir(),
+		"the directory to serve static files",
+	)
+
+	var indexFallback bool
+	app.RootCmd.PersistentFlags().BoolVar(
+		&indexFallback,
+		"indexFallback",
+		true,
+		"fallback the request to index.html on missing static path, e.g. when pretty urls are used with SPA",
+	)
+
+	app.RootCmd.ParseFlags(os.Args[1:])
+
+	// ---------------------------------------------------------------
+	// Plugins and hooks:
+	// ---------------------------------------------------------------
+
+	// load jsvm (pb_hooks and pb_migrations)
+	jsvm.MustRegister(app, jsvm.Config{
+		MigrationsDir: migrationsDir,
+		HooksDir:      hooksDir,
+		HooksWatch:    hooksWatch,
+		HooksPoolSize: hooksPool,
+	})
+
+	// migrate command (with js templates)
+	migratecmd.MustRegister(app, app.RootCmd, migratecmd.Config{
+		TemplateLang: migratecmd.TemplateLangJS,
+		Automigrate:  automigrate,
+		Dir:          migrationsDir,
+	})
+
+	// GitHub selfupdate
+	ghupdate.MustRegister(app, app.RootCmd, ghupdate.Config{})
+
+	// static route to serves files from the provided public dir
+	// (if publicDir exists and the route path is not already defined)
+	app.OnServe().Bind(&hook.Handler[*core.ServeEvent]{
+		Func: func(e *core.ServeEvent) error {
+			if !e.Router.HasRoute(http.MethodGet, "/{path...}") {
+				e.Router.GET("/{path...}", apis.Static(os.DirFS(publicDir), indexFallback))
+			}
+
+			return e.Next()
+		},
+		Priority: 999, // execute as latest as possible to allow users to provide their own route
+	})
+
+	// Print database info on startup
+	app.OnServe().Bind(&hook.Handler[*core.ServeEvent]{
+		Func: func(e *core.ServeEvent) error {
+			log.Printf("Starting with database type: %s", dbConfig.Type)
+			return e.Next()
+		},
+		Priority: -999,
+	})
+
+	if err := app.Start(); err != nil {
+		log.Fatal(err)
+	}
+}
+
+// the default pb_public dir location is relative to the executable
+func defaultPublicDir() string {
+	if os.Getenv("PB_PUBLIC_DIR") != "" {
+		return os.Getenv("PB_PUBLIC_DIR")
+	}
+	if osutils.IsProbablyGoRun() {
+		return "./pb_public"
+	}
+
+	return filepath.Join(os.Args[0], "../pb_public")
+}
diff --git a/server/core_backend-server/forms/apple_client_secret_create.go b/server/core_backend-server/forms/apple_client_secret_create.go
new file mode 100644
index 0000000..f07166e
--- /dev/null
+++ b/server/core_backend-server/forms/apple_client_secret_create.go
@@ -0,0 +1,87 @@
+package forms
+
+import (
+	"regexp"
+	"strings"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+var privateKeyRegex = regexp.MustCompile(`(?m)-----BEGIN PRIVATE KEY----[\s\S]+-----END PRIVATE KEY-----`)
+
+// AppleClientSecretCreate is a form struct to generate a new Apple Client Secret.
+//
+// Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
+type AppleClientSecretCreate struct {
+	app core.App
+
+	// ClientId is the identifier of your app (aka. Service ID).
+	ClientId string `form:"clientId" json:"clientId"`
+
+	// TeamId is a 10-character string associated with your developer account
+	// (usually could be found next to your name in the Apple Developer site).
+	TeamId string `form:"teamId" json:"teamId"`
+
+	// KeyId is a 10-character key identifier generated for the "Sign in with Apple"
+	// private key associated with your developer account.
+	KeyId string `form:"keyId" json:"keyId"`
+
+	// PrivateKey is the private key associated to your app.
+	// Usually wrapped within -----BEGIN PRIVATE KEY----- X -----END PRIVATE KEY-----.
+	PrivateKey string `form:"privateKey" json:"privateKey"`
+
+	// Duration specifies how long the generated JWT should be considered valid.
+	// The specified value must be in seconds and max 15777000 (~6months).
+	Duration int `form:"duration" json:"duration"`
+}
+
+// NewAppleClientSecretCreate creates a new [AppleClientSecretCreate] form with initializer
+// config created from the provided [core.App] instances.
+func NewAppleClientSecretCreate(app core.App) *AppleClientSecretCreate {
+	form := &AppleClientSecretCreate{
+		app: app,
+	}
+
+	return form
+}
+
+// Validate makes the form validatable by implementing [validation.Validatable] interface.
+func (form *AppleClientSecretCreate) Validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(&form.ClientId, validation.Required),
+		validation.Field(&form.TeamId, validation.Required, validation.Length(10, 10)),
+		validation.Field(&form.KeyId, validation.Required, validation.Length(10, 10)),
+		validation.Field(&form.PrivateKey, validation.Required, validation.Match(privateKeyRegex)),
+		validation.Field(&form.Duration, validation.Required, validation.Min(1), validation.Max(15777000)),
+	)
+}
+
+// Submit validates the form and returns a new Apple Client Secret JWT.
+func (form *AppleClientSecretCreate) Submit() (string, error) {
+	if err := form.Validate(); err != nil {
+		return "", err
+	}
+
+	signKey, err := jwt.ParseECPrivateKeyFromPEM([]byte(strings.TrimSpace(form.PrivateKey)))
+	if err != nil {
+		return "", err
+	}
+
+	now := time.Now()
+
+	claims := &jwt.RegisteredClaims{
+		Audience:  jwt.ClaimStrings{"https://appleid.apple.com"},
+		Subject:   form.ClientId,
+		Issuer:    form.TeamId,
+		IssuedAt:  jwt.NewNumericDate(now),
+		ExpiresAt: jwt.NewNumericDate(now.Add(time.Duration(form.Duration) * time.Second)),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
+	token.Header["kid"] = form.KeyId
+
+	return token.SignedString(signKey)
+}
diff --git a/server/core_backend-server/forms/apple_client_secret_create_test.go b/server/core_backend-server/forms/apple_client_secret_create_test.go
new file mode 100644
index 0000000..4778d48
--- /dev/null
+++ b/server/core_backend-server/forms/apple_client_secret_create_test.go
@@ -0,0 +1,119 @@
+package forms_test
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"testing"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestAppleClientSecretCreateValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	encodedKey, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	privatePem := pem.EncodeToMemory(
+		&pem.Block{
+			Type:  "PRIVATE KEY",
+			Bytes: encodedKey,
+		},
+	)
+
+	scenarios := []struct {
+		name        string
+		formData    map[string]any
+		expectError bool
+	}{
+		{
+			"empty data",
+			map[string]any{},
+			true,
+		},
+		{
+			"invalid data",
+			map[string]any{
+				"clientId":   "",
+				"teamId":     "123456789",
+				"keyId":      "123456789",
+				"privateKey": "-----BEGIN PRIVATE KEY----- invalid -----END PRIVATE KEY-----",
+				"duration":   -1,
+			},
+			true,
+		},
+		{
+			"valid data",
+			map[string]any{
+				"clientId":   "123",
+				"teamId":     "1234567890",
+				"keyId":      "1234567891",
+				"privateKey": string(privatePem),
+				"duration":   1,
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		form := forms.NewAppleClientSecretCreate(app)
+
+		rawData, marshalErr := json.Marshal(s.formData)
+		if marshalErr != nil {
+			t.Errorf("[%s] Failed to marshalize the scenario data: %v", s.name, marshalErr)
+			continue
+		}
+
+		// load data
+		loadErr := json.Unmarshal(rawData, form)
+		if loadErr != nil {
+			t.Errorf("[%s] Failed to load form data: %v", s.name, loadErr)
+			continue
+		}
+
+		secret, err := form.Submit()
+
+		hasErr := err != nil
+		if hasErr != s.expectError {
+			t.Errorf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+		}
+
+		if hasErr {
+			continue
+		}
+
+		if secret == "" {
+			t.Errorf("[%s] Expected non-empty secret", s.name)
+		}
+
+		claims := jwt.MapClaims{}
+		token, _, err := jwt.NewParser().ParseUnverified(secret, claims)
+		if err != nil {
+			t.Errorf("[%s] Failed to parse token: %v", s.name, err)
+		}
+
+		if alg := token.Header["alg"]; alg != "ES256" {
+			t.Errorf("[%s] Expected %q alg header, got %q", s.name, "ES256", alg)
+		}
+
+		if kid := token.Header["kid"]; kid != form.KeyId {
+			t.Errorf("[%s] Expected %q kid header, got %q", s.name, form.KeyId, kid)
+		}
+	}
+}
diff --git a/server/core_backend-server/forms/record_upsert.go b/server/core_backend-server/forms/record_upsert.go
new file mode 100644
index 0000000..02b6508
--- /dev/null
+++ b/server/core_backend-server/forms/record_upsert.go
@@ -0,0 +1,316 @@
+package forms
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/core/validators"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+const (
+	accessLevelDefault = iota
+	accessLevelManager
+	accessLevelSuperuser
+)
+
+type RecordUpsert struct {
+	ctx         context.Context
+	app         core.App
+	record      *core.Record
+	accessLevel int
+
+	// extra password fields
+	disablePasswordValidations bool
+	password                   string
+	passwordConfirm            string
+	oldPassword                string
+}
+
+// NewRecordUpsert creates a new [RecordUpsert] form from the provided [core.App] and [core.Record] instances
+// (for create you could pass a pointer to an empty Record - core.NewRecord(collection)).
+func NewRecordUpsert(app core.App, record *core.Record) *RecordUpsert {
+	form := &RecordUpsert{
+		ctx:    context.Background(),
+		app:    app,
+		record: record,
+	}
+
+	return form
+}
+
+// SetContext assigns ctx as context of the current form.
+func (form *RecordUpsert) SetContext(ctx context.Context) {
+	form.ctx = ctx
+}
+
+// SetApp replaces the current form app instance.
+//
+// This could be used for example if you want to change at later stage
+// before submission to change from regular -> transactional app instance.
+func (form *RecordUpsert) SetApp(app core.App) {
+	form.app = app
+}
+
+// SetRecord replaces the current form record instance.
+func (form *RecordUpsert) SetRecord(record *core.Record) {
+	form.record = record
+}
+
+// ResetAccess resets the form access level to the accessLevelDefault.
+func (form *RecordUpsert) ResetAccess() {
+	form.accessLevel = accessLevelDefault
+}
+
+// GrantManagerAccess updates the form access level to "manager" allowing
+// directly changing some system record fields (often used with auth collection records).
+func (form *RecordUpsert) GrantManagerAccess() {
+	form.accessLevel = accessLevelManager
+}
+
+// GrantSuperuserAccess updates the form access level to "superuser" allowing
+// directly changing all system record fields, including those marked as "Hidden".
+func (form *RecordUpsert) GrantSuperuserAccess() {
+	form.accessLevel = accessLevelSuperuser
+}
+
+// HasManageAccess reports whether the form has "manager" or "superuser" level access.
+func (form *RecordUpsert) HasManageAccess() bool {
+	return form.accessLevel == accessLevelManager || form.accessLevel == accessLevelSuperuser
+}
+
+// Load loads the provided data into the form and the related record.
+func (form *RecordUpsert) Load(data map[string]any) {
+	excludeFields := []string{core.FieldNameExpand}
+
+	isAuth := form.record.Collection().IsAuth()
+
+	// load the special auth form fields
+	if isAuth {
+		if v, ok := data["password"]; ok {
+			form.password = cast.ToString(v)
+		}
+		if v, ok := data["passwordConfirm"]; ok {
+			form.passwordConfirm = cast.ToString(v)
+		}
+		if v, ok := data["oldPassword"]; ok {
+			form.oldPassword = cast.ToString(v)
+		}
+
+		excludeFields = append(excludeFields, "passwordConfirm", "oldPassword") // skip non-schema password fields
+	}
+
+	for k, v := range data {
+		if slices.Contains(excludeFields, k) {
+			continue
+		}
+
+		// set only known collection fields
+		field := form.record.SetIfFieldExists(k, v)
+
+		// restore original value if hidden field (with exception of the auth "password")
+		//
+		// note: this is an extra measure against loading hidden fields
+		// but usually is not used by the default route handlers since
+		// they filter additionally the data before calling Load
+		if form.accessLevel != accessLevelSuperuser && field != nil && field.GetHidden() && (!isAuth || field.GetName() != core.FieldNamePassword) {
+			form.record.SetRaw(field.GetName(), form.record.Original().GetRaw(field.GetName()))
+		}
+	}
+}
+
+func (form *RecordUpsert) validateFormFields() error {
+	isAuth := form.record.Collection().IsAuth()
+	if !isAuth {
+		return nil
+	}
+
+	form.syncPasswordFields()
+
+	isNew := form.record.IsNew()
+
+	original := form.record.Original()
+
+	validateData := map[string]any{
+		"email":           form.record.Email(),
+		"verified":        form.record.Verified(),
+		"password":        form.password,
+		"passwordConfirm": form.passwordConfirm,
+		"oldPassword":     form.oldPassword,
+	}
+
+	return validation.Validate(validateData,
+		validation.Map(
+			validation.Key(
+				"email",
+				// don't allow direct email updates if the form doesn't have manage access permissions
+				// (aka. allow only admin or authorized auth models to directly update the field)
+				validation.When(
+					!isNew && !form.HasManageAccess(),
+					validation.By(validators.Equal(original.Email())),
+				),
+			),
+			validation.Key(
+				"verified",
+				// don't allow changing verified if the form doesn't have manage access permissions
+				// (aka. allow only admin or authorized auth models to directly change the field)
+				validation.When(
+					!form.HasManageAccess(),
+					validation.By(validators.Equal(original.Verified())),
+				),
+			),
+			validation.Key(
+				"password",
+				validation.When(
+					!form.disablePasswordValidations && (isNew || form.passwordConfirm != "" || form.oldPassword != ""),
+					validation.Required,
+				),
+			),
+			validation.Key(
+				"passwordConfirm",
+				validation.When(
+					!form.disablePasswordValidations && (isNew || form.password != "" || form.oldPassword != ""),
+					validation.Required,
+				),
+				validation.When(!form.disablePasswordValidations, validation.By(validators.Equal(form.password))),
+			),
+			validation.Key(
+				"oldPassword",
+				// require old password only on update when:
+				// - form.HasManageAccess() is not satisfied
+				// - changing the existing password
+				validation.When(
+					!form.disablePasswordValidations && !isNew && !form.HasManageAccess() && (form.password != "" || form.passwordConfirm != ""),
+					validation.Required,
+					validation.By(form.checkOldPassword),
+				),
+			),
+		),
+	)
+}
+
+func (form *RecordUpsert) checkOldPassword(value any) error {
+	v, ok := value.(string)
+	if !ok {
+		return validators.ErrUnsupportedValueType
+	}
+
+	if !form.record.Original().ValidatePassword(v) {
+		return validation.NewError("validation_invalid_old_password", "Missing or invalid old password.")
+	}
+
+	return nil
+}
+
+// Deprecated: It was previously used as part of the record create action but it is not needed anymore and will be removed in the future.
+//
+// DrySubmit performs a temp form submit within a transaction and reverts it at the end.
+// For actual record persistence, check the [RecordUpsert.Submit()] method.
+//
+// This method doesn't perform validations, handle file uploads/deletes or trigger app save events!
+func (form *RecordUpsert) DrySubmit(callback func(txApp core.App, drySavedRecord *core.Record) error) error {
+	isNew := form.record.IsNew()
+
+	clone := form.record.Clone()
+
+	// set an id if it doesn't have already
+	// (the value doesn't matter; it is used only during the manual delete/update rollback)
+	if clone.IsNew() && clone.Id == "" {
+		clone.Id = "_temp_" + security.PseudorandomString(15)
+	}
+
+	app := form.app.UnsafeWithoutHooks()
+
+	isTransactional := app.IsTransactional()
+	if !isTransactional {
+		return app.RunInTransaction(func(txApp core.App) error {
+			tx, ok := txApp.DB().(*dbx.Tx)
+			if !ok {
+				return errors.New("failed to get transaction db")
+			}
+			defer tx.Rollback()
+
+			if err := txApp.SaveNoValidateWithContext(form.ctx, clone); err != nil {
+				return validators.NormalizeUniqueIndexError(err, clone.Collection().Name, clone.Collection().Fields.FieldNames())
+			}
+
+			if callback != nil {
+				return callback(txApp, clone)
+			}
+
+			return nil
+		})
+	}
+
+	// already in a transaction
+	// (manual rollback to avoid starting another transaction)
+	// ---------------------------------------------------------------
+	err := app.SaveNoValidateWithContext(form.ctx, clone)
+	if err != nil {
+		return validators.NormalizeUniqueIndexError(err, clone.Collection().Name, clone.Collection().Fields.FieldNames())
+	}
+
+	manualRollback := func() error {
+		if isNew {
+			err = app.DeleteWithContext(form.ctx, clone)
+			if err != nil {
+				return fmt.Errorf("failed to rollback dry submit created record: %w", err)
+			}
+		} else {
+			clone.Load(clone.Original().FieldsData())
+			err = app.SaveNoValidateWithContext(form.ctx, clone)
+			if err != nil {
+				return fmt.Errorf("failed to rollback dry submit updated record: %w", err)
+			}
+		}
+
+		return nil
+	}
+
+	if callback != nil {
+		return errors.Join(callback(app, clone), manualRollback())
+	}
+
+	return manualRollback()
+}
+
+// Submit validates the form specific validations and attempts to save the form record.
+func (form *RecordUpsert) Submit() error {
+	err := form.validateFormFields()
+	if err != nil {
+		return err
+	}
+
+	// run record validations and persist in db
+	return form.app.SaveWithContext(form.ctx, form.record)
+}
+
+// syncPasswordFields syncs the form's auth password fields with their
+// corresponding record field values.
+//
+// This could be useful in case the password fields were programmatically set
+// directly by modifying the related record model.
+func (form *RecordUpsert) syncPasswordFields() {
+	if !form.record.Collection().IsAuth() {
+		return // not an auth collection
+	}
+
+	form.disablePasswordValidations = false
+
+	rawPassword := form.record.GetRaw(core.FieldNamePassword)
+	if v, ok := rawPassword.(*core.PasswordFieldValue); ok && v != nil {
+		if
+		// programmatically set custom plain password value
+		(v.Plain != "" && v.Plain != form.password) ||
+			// random generated password for new record
+			(v.Plain == "" && v.Hash != "" && form.record.IsNew()) {
+			form.disablePasswordValidations = true
+		}
+	}
+}
diff --git a/server/core_backend-server/forms/record_upsert_test.go b/server/core_backend-server/forms/record_upsert_test.go
new file mode 100644
index 0000000..d02344f
--- /dev/null
+++ b/server/core_backend-server/forms/record_upsert_test.go
@@ -0,0 +1,1012 @@
+package forms_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"maps"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+)
+
+func TestRecordUpsertLoad(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	demo1Col, err := testApp.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	usersCol, err := testApp.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	file, err := filesystem.NewFileFromBytes([]byte("test"), "test.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name                 string
+		data                 map[string]any
+		record               *core.Record
+		managerAccessLevel   bool
+		superuserAccessLevel bool
+		expected             []string
+		notExpected          []string
+	}{
+		{
+			name: "base collection record",
+			data: map[string]any{
+				"text":         "test_text",
+				"custom":       "123",                          // should be ignored
+				"number":       "456",                          // should be normalized by the setter
+				"select_many+": []string{"optionB", "optionC"}, // test modifier fields
+				"created":      "2022-01:01 10:00:00.000Z",     // should be ignored
+				// ignore special auth fields
+				"oldPassword":     "123",
+				"password":        "456",
+				"passwordConfirm": "789",
+			},
+			record: core.NewRecord(demo1Col),
+			expected: []string{
+				`"text":"test_text"`,
+				`"number":456`,
+				`"select_many":["optionB","optionC"]`,
+				`"created":""`,
+				`"updated":""`,
+				`"json":null`,
+			},
+			notExpected: []string{
+				`"custom"`,
+				`"password"`,
+				`"oldPassword"`,
+				`"passwordConfirm"`,
+				`"select_many-"`,
+				`"select_many+"`,
+			},
+		},
+		{
+			name: "auth collection record",
+			data: map[string]any{
+				"email": "test@example.com",
+				// special auth fields
+				"oldPassword":     "123",
+				"password":        "456",
+				"passwordConfirm": "789",
+			},
+			record: core.NewRecord(usersCol),
+			expected: []string{
+				`"email":"test@example.com"`,
+				`"password":"456"`,
+			},
+			notExpected: []string{
+				`"oldPassword"`,
+				`"passwordConfirm"`,
+			},
+		},
+		{
+			name: "hidden fields (manager)",
+			data: map[string]any{
+				"email":    "test@example.com",
+				"tokenKey": "abc", // should be ignored
+				// special auth fields
+				"password":        "456",
+				"oldPassword":     "123",
+				"passwordConfirm": "789",
+			},
+			managerAccessLevel: true,
+			record:             core.NewRecord(usersCol),
+			expected: []string{
+				`"email":"test@example.com"`,
+				`"tokenKey":""`,
+				`"password":"456"`,
+			},
+			notExpected: []string{
+				`"oldPassword"`,
+				`"passwordConfirm"`,
+			},
+		},
+		{
+			name: "hidden fields (superuser)",
+			data: map[string]any{
+				"email":    "test@example.com",
+				"tokenKey": "abc",
+				// special auth fields
+				"password":        "456",
+				"oldPassword":     "123",
+				"passwordConfirm": "789",
+			},
+			superuserAccessLevel: true,
+			record:               core.NewRecord(usersCol),
+			expected: []string{
+				`"email":"test@example.com"`,
+				`"tokenKey":"abc"`,
+				`"password":"456"`,
+			},
+			notExpected: []string{
+				`"oldPassword"`,
+				`"passwordConfirm"`,
+			},
+		},
+		{
+			name: "with file field",
+			data: map[string]any{
+				"file_one": file,
+				"url":      file, // should be ignored for non-file fields
+			},
+			record: core.NewRecord(demo1Col),
+			expected: []string{
+				`"file_one":{`,
+				`"originalName":"test.txt"`,
+				`"url":""`,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			form := forms.NewRecordUpsert(testApp, s.record)
+
+			if s.managerAccessLevel {
+				form.GrantManagerAccess()
+			}
+
+			if s.superuserAccessLevel {
+				form.GrantSuperuserAccess()
+			}
+
+			// ensure that the form access level was updated
+			if !form.HasManageAccess() && (s.superuserAccessLevel || s.managerAccessLevel) {
+				t.Fatalf("Expected the form to have manage access level (manager or superuser)")
+			}
+
+			form.Load(s.data)
+
+			loaded := map[string]any{}
+			maps.Copy(loaded, s.record.FieldsData())
+			maps.Copy(loaded, s.record.CustomData())
+
+			raw, err := json.Marshal(loaded)
+			if err != nil {
+				t.Fatalf("Failed to serialize data: %v", err)
+			}
+
+			rawStr := string(raw)
+
+			for _, str := range s.expected {
+				if !strings.Contains(rawStr, str) {
+					t.Fatalf("Couldn't find %q in \n%v", str, rawStr)
+				}
+			}
+
+			for _, str := range s.notExpected {
+				if strings.Contains(rawStr, str) {
+					t.Fatalf("Didn't expect %q in \n%v", str, rawStr)
+				}
+			}
+		})
+	}
+}
+
+func TestRecordUpsertDrySubmitFailure(t *testing.T) {
+	runTest := func(t *testing.T, testApp core.App) {
+		col, err := testApp.FindCollectionByNameOrId("demo1")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		originalId := "imy661ixudk5izi"
+
+		record, err := testApp.FindRecordById(col, originalId)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		oldRaw, err := json.Marshal(record)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		file, err := filesystem.NewFileFromBytes([]byte("test"), "test.txt")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		form := forms.NewRecordUpsert(testApp, record)
+		form.Load(map[string]any{
+			"text":       "test_update",
+			"file_one":   file,
+			"select_one": "!invalid", // should be allowed even if invalid since validations are not executed
+		})
+
+		calls := ""
+		testApp.OnRecordValidate(col.Name).BindFunc(func(e *core.RecordEvent) error {
+			calls += "a" // shouldn't be called
+			return e.Next()
+		})
+
+		result := form.DrySubmit(func(txApp core.App, drySavedRecord *core.Record) error {
+			calls += "b"
+			return errors.New("error...")
+		})
+
+		if result == nil {
+			t.Fatal("Expected DrySubmit error, got nil")
+		}
+
+		if calls != "b" {
+			t.Fatalf("Expected calls %q, got %q", "ab", calls)
+		}
+
+		// refresh the record to ensure that the changes weren't persisted
+		record, err = testApp.FindRecordById(col, originalId)
+		if err != nil {
+			t.Fatalf("Expected record with the original id %q to exist, got\n%v", originalId, record.PublicExport())
+		}
+
+		newRaw, err := json.Marshal(record)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if !bytes.Equal(oldRaw, newRaw) {
+			t.Fatalf("Expected record\n%s\ngot\n%s", oldRaw, newRaw)
+		}
+
+		testFilesCount(t, testApp, record, 0)
+	}
+
+	t.Run("without parent transaction", func(t *testing.T) {
+		testApp, _ := tests.NewTestApp()
+		defer testApp.Cleanup()
+
+		runTest(t, testApp)
+	})
+
+	t.Run("with parent transaction", func(t *testing.T) {
+		testApp, _ := tests.NewTestApp()
+		defer testApp.Cleanup()
+
+		testApp.RunInTransaction(func(txApp core.App) error {
+			runTest(t, txApp)
+			return nil
+		})
+	})
+}
+
+func TestRecordUpsertDrySubmitCreateSuccess(t *testing.T) {
+	runTest := func(t *testing.T, testApp core.App) {
+		col, err := testApp.FindCollectionByNameOrId("demo1")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		record := core.NewRecord(col)
+
+		file, err := filesystem.NewFileFromBytes([]byte("test"), "test.txt")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		form := forms.NewRecordUpsert(testApp, record)
+		form.Load(map[string]any{
+			"id":         "test",
+			"text":       "test_update",
+			"file_one":   file,
+			"select_one": "!invalid", // should be allowed even if invalid since validations are not executed
+		})
+
+		calls := ""
+		testApp.OnRecordValidate(col.Name).BindFunc(func(e *core.RecordEvent) error {
+			calls += "a" // shouldn't be called
+			return e.Next()
+		})
+
+		result := form.DrySubmit(func(txApp core.App, drySavedRecord *core.Record) error {
+			calls += "b"
+			return nil
+		})
+
+		if result != nil {
+			t.Fatalf("Expected DrySubmit success, got error: %v", result)
+		}
+
+		if calls != "b" {
+			t.Fatalf("Expected calls %q, got %q", "ab", calls)
+		}
+
+		// refresh the record to ensure that the changes weren't persisted
+		_, err = testApp.FindRecordById(col, record.Id)
+		if err == nil {
+			t.Fatal("Expected the created record to be deleted")
+		}
+
+		testFilesCount(t, testApp, record, 0)
+	}
+
+	t.Run("without parent transaction", func(t *testing.T) {
+		testApp, _ := tests.NewTestApp()
+		defer testApp.Cleanup()
+
+		runTest(t, testApp)
+	})
+
+	t.Run("with parent transaction", func(t *testing.T) {
+		testApp, _ := tests.NewTestApp()
+		defer testApp.Cleanup()
+
+		testApp.RunInTransaction(func(txApp core.App) error {
+			runTest(t, txApp)
+			return nil
+		})
+	})
+}
+
+func TestRecordUpsertDrySubmitUpdateSuccess(t *testing.T) {
+	runTest := func(t *testing.T, testApp core.App) {
+		col, err := testApp.FindCollectionByNameOrId("demo1")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		record, err := testApp.FindRecordById(col, "imy661ixudk5izi")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		oldRaw, err := json.Marshal(record)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		file, err := filesystem.NewFileFromBytes([]byte("test"), "test.txt")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		form := forms.NewRecordUpsert(testApp, record)
+		form.Load(map[string]any{
+			"text":     "test_update",
+			"file_one": file,
+		})
+
+		calls := ""
+		testApp.OnRecordValidate(col.Name).BindFunc(func(e *core.RecordEvent) error {
+			calls += "a" // shouldn't be called
+			return e.Next()
+		})
+
+		result := form.DrySubmit(func(txApp core.App, drySavedRecord *core.Record) error {
+			calls += "b"
+			return nil
+		})
+
+		if result != nil {
+			t.Fatalf("Expected DrySubmit success, got error: %v", result)
+		}
+
+		if calls != "b" {
+			t.Fatalf("Expected calls %q, got %q", "ab", calls)
+		}
+
+		// refresh the record to ensure that the changes weren't persisted
+		record, err = testApp.FindRecordById(col, record.Id)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		newRaw, err := json.Marshal(record)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if !bytes.Equal(oldRaw, newRaw) {
+			t.Fatalf("Expected record\n%s\ngot\n%s", oldRaw, newRaw)
+		}
+
+		testFilesCount(t, testApp, record, 0)
+	}
+
+	t.Run("without parent transaction", func(t *testing.T) {
+		testApp, _ := tests.NewTestApp()
+		defer testApp.Cleanup()
+
+		runTest(t, testApp)
+	})
+
+	t.Run("with parent transaction", func(t *testing.T) {
+		testApp, _ := tests.NewTestApp()
+		defer testApp.Cleanup()
+
+		testApp.RunInTransaction(func(txApp core.App) error {
+			runTest(t, txApp)
+			return nil
+		})
+	})
+}
+
+func TestRecordUpsertSubmitValidations(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	demo2Col, err := app.FindCollectionByNameOrId("demo2")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	demo2Rec, err := app.FindRecordById(demo2Col, "llvuca81nly1qls")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	usersCol, err := app.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	userRec, err := app.FindRecordById(usersCol, "4q1xlclmfloku33")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name           string
+		record         *core.Record
+		data           map[string]any
+		managerAccess  bool
+		expectedErrors []string
+	}{
+		// base
+		{
+			name:           "new base collection record with empty data",
+			record:         core.NewRecord(demo2Col),
+			data:           map[string]any{},
+			expectedErrors: []string{"title"},
+		},
+		{
+			name:   "new base collection record with invalid data",
+			record: core.NewRecord(demo2Col),
+			data: map[string]any{
+				"title": "",
+				// should be ignored
+				"custom":          "abc",
+				"oldPassword":     "123",
+				"password":        "456",
+				"passwordConfirm": "789",
+			},
+			expectedErrors: []string{"title"},
+		},
+		{
+			name:   "new base collection record with valid data",
+			record: core.NewRecord(demo2Col),
+			data: map[string]any{
+				"title": "abc",
+				// should be ignored
+				"custom":          "abc",
+				"oldPassword":     "123",
+				"password":        "456",
+				"passwordConfirm": "789",
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name:           "existing base collection record with empty data",
+			record:         demo2Rec,
+			data:           map[string]any{},
+			expectedErrors: []string{},
+		},
+		{
+			name:   "existing base collection record with invalid data",
+			record: demo2Rec,
+			data: map[string]any{
+				"title": "",
+			},
+			expectedErrors: []string{"title"},
+		},
+		{
+			name:   "existing base collection record with valid data",
+			record: demo2Rec,
+			data: map[string]any{
+				"title": "abc",
+			},
+			expectedErrors: []string{},
+		},
+
+		// auth
+		{
+			name:           "new auth collection record with empty data",
+			record:         core.NewRecord(usersCol),
+			data:           map[string]any{},
+			expectedErrors: []string{"password", "passwordConfirm"},
+		},
+		{
+			name:   "new auth collection record with invalid record and invalid form data (without manager acess)",
+			record: core.NewRecord(usersCol),
+			data: map[string]any{
+				"verified":        true,
+				"emailVisibility": true,
+				"email":           "test@example.com",
+				"password":        "456",
+				"passwordConfirm": "789",
+				"username":        "!invalid",
+				// should be ignored (custom or hidden fields)
+				"tokenKey":    strings.Repeat("a", 2),
+				"custom":      "abc",
+				"oldPassword": "123",
+			},
+			// fail the form validator
+			expectedErrors: []string{"verified", "passwordConfirm"},
+		},
+		{
+			name:   "new auth collection record with invalid record and valid form data (without manager acess)",
+			record: core.NewRecord(usersCol),
+			data: map[string]any{
+				"verified":        false,
+				"emailVisibility": true,
+				"email":           "test@example.com",
+				"password":        "456",
+				"passwordConfirm": "456",
+				"username":        "!invalid",
+				// should be ignored (custom or hidden fields)
+				"tokenKey":    strings.Repeat("a", 2),
+				"custom":      "abc",
+				"oldPassword": "123",
+			},
+			// fail the record fields validator
+			expectedErrors: []string{"password", "username"},
+		},
+		{
+			name:          "new auth collection record with invalid record and invalid form data (with manager acess)",
+			record:        core.NewRecord(usersCol),
+			managerAccess: true,
+			data: map[string]any{
+				"verified":        true,
+				"emailVisibility": true,
+				"email":           "test@example.com",
+				"password":        "456",
+				"passwordConfirm": "789",
+				"username":        "!invalid",
+				// should be ignored (custom or hidden fields)
+				"tokenKey":    strings.Repeat("a", 2),
+				"custom":      "abc",
+				"oldPassword": "123",
+			},
+			// fail the form validator
+			expectedErrors: []string{"passwordConfirm"},
+		},
+		{
+			name:          "new auth collection record with invalid record and valid form data (with manager acess)",
+			record:        core.NewRecord(usersCol),
+			managerAccess: true,
+			data: map[string]any{
+				"verified":        true,
+				"emailVisibility": true,
+				"email":           "test@example.com",
+				"password":        "456",
+				"passwordConfirm": "456",
+				"username":        "!invalid",
+				// should be ignored (custom or hidden fields)
+				"tokenKey":    strings.Repeat("a", 2),
+				"custom":      "abc",
+				"oldPassword": "123",
+			},
+			// fail the record fields validator
+			expectedErrors: []string{"password", "username"},
+		},
+		{
+			name:   "new auth collection record with valid data",
+			record: core.NewRecord(usersCol),
+			data: map[string]any{
+				"emailVisibility": true,
+				"email":           "test_new@example.com",
+				"password":        "1234567890",
+				"passwordConfirm": "1234567890",
+				// should be ignored (custom or hidden fields)
+				"tokenKey":    strings.Repeat("a", 2),
+				"custom":      "abc",
+				"oldPassword": "123",
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name:   "new auth collection record with valid data and duplicated email",
+			record: core.NewRecord(usersCol),
+			data: map[string]any{
+				"email":           "test@example.com",
+				"password":        "1234567890",
+				"passwordConfirm": "1234567890",
+				// should be ignored (custom or hidden fields)
+				"tokenKey":    strings.Repeat("a", 2),
+				"custom":      "abc",
+				"oldPassword": "123",
+			},
+			// fail the unique db validator
+			expectedErrors: []string{"email"},
+		},
+		{
+			name:           "existing auth collection record with empty data",
+			record:         userRec,
+			data:           map[string]any{},
+			expectedErrors: []string{},
+		},
+		{
+			name:   "existing auth collection record with invalid record data and invalid form data (without manager access)",
+			record: userRec,
+			data: map[string]any{
+				"verified":        true,
+				"email":           "test_new@example.com", // not allowed to change
+				"oldPassword":     "123",
+				"password":        "456",
+				"passwordConfirm": "789",
+				"username":        "!invalid",
+				// should be ignored (custom or hidden fields)
+				"tokenKey": strings.Repeat("a", 2),
+				"custom":   "abc",
+			},
+			// fail form validator
+			expectedErrors: []string{"verified", "email", "oldPassword", "passwordConfirm"},
+		},
+		{
+			name:   "existing auth collection record with invalid record data and valid form data (without manager access)",
+			record: userRec,
+			data: map[string]any{
+				"oldPassword":     "1234567890",
+				"password":        "12345678901",
+				"passwordConfirm": "12345678901",
+				"username":        "!invalid",
+				// should be ignored (custom or hidden fields)
+				"tokenKey": strings.Repeat("a", 2),
+				"custom":   "abc",
+			},
+			// fail record fields validator
+			expectedErrors: []string{"username"},
+		},
+		{
+			name:          "existing auth collection record with invalid record data and invalid form data (with manager access)",
+			record:        userRec,
+			managerAccess: true,
+			data: map[string]any{
+				"verified":        true,
+				"email":           "test_new@example.com",
+				"oldPassword":     "123", // should be ignored
+				"password":        "456",
+				"passwordConfirm": "789",
+				"username":        "!invalid",
+				// should be ignored (custom or hidden fields)
+				"tokenKey": strings.Repeat("a", 2),
+				"custom":   "abc",
+			},
+			// fail form validator
+			expectedErrors: []string{"passwordConfirm"},
+		},
+		{
+			name:          "existing auth collection record with invalid record data and valid form data (with manager access)",
+			record:        userRec,
+			managerAccess: true,
+			data: map[string]any{
+				"verified":        true,
+				"email":           "test_new@example.com",
+				"oldPassword":     "1234567890",
+				"password":        "12345678901",
+				"passwordConfirm": "12345678901",
+				"username":        "!invalid",
+				// should be ignored (custom or hidden fields)
+				"tokenKey": strings.Repeat("a", 2),
+				"custom":   "abc",
+			},
+			// fail record fields validator
+			expectedErrors: []string{"username"},
+		},
+		{
+			name:   "existing auth collection record with base valid data",
+			record: userRec,
+			data: map[string]any{
+				"name": "test",
+			},
+			expectedErrors: []string{},
+		},
+		{
+			name:   "existing auth collection record with valid password and invalid oldPassword data",
+			record: userRec,
+			data: map[string]any{
+				"name":            "test",
+				"oldPassword":     "invalid",
+				"password":        "1234567890",
+				"passwordConfirm": "1234567890",
+			},
+			expectedErrors: []string{"oldPassword"},
+		},
+		{
+			name:   "existing auth collection record with valid password data",
+			record: userRec,
+			data: map[string]any{
+				"name":            "test",
+				"oldPassword":     "1234567890",
+				"password":        "0987664321",
+				"passwordConfirm": "0987664321",
+			},
+			expectedErrors: []string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testApp, _ := tests.NewTestApp()
+			defer testApp.Cleanup()
+
+			form := forms.NewRecordUpsert(testApp, s.record.Original())
+			if s.managerAccess {
+				form.GrantManagerAccess()
+			}
+			form.Load(s.data)
+
+			result := form.Submit()
+
+			tests.TestValidationErrors(t, result, s.expectedErrors)
+		})
+	}
+}
+
+func TestRecordUpsertSubmitFailure(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	col, err := testApp.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record, err := testApp.FindRecordById(col, "imy661ixudk5izi")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	file, err := filesystem.NewFileFromBytes([]byte("test"), "test.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordUpsert(testApp, record)
+	form.Load(map[string]any{
+		"text":       "test_update",
+		"file_one":   file,
+		"select_one": "invalid",
+	})
+
+	validateCalls := 0
+	testApp.OnRecordValidate(col.Name).BindFunc(func(e *core.RecordEvent) error {
+		validateCalls++
+		return e.Next()
+	})
+
+	result := form.Submit()
+
+	if result == nil {
+		t.Fatal("Expected Submit error, got nil")
+	}
+
+	if validateCalls != 1 {
+		t.Fatalf("Expected validateCalls %d, got %d", 1, validateCalls)
+	}
+
+	// refresh the record to ensure that the changes weren't persisted
+	record, err = testApp.FindRecordById(col, record.Id)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if v := record.GetString("text"); v == "test_update" {
+		t.Fatalf("Expected record.text to remain the same, got %q", v)
+	}
+
+	if v := record.GetString("select_one"); v != "" {
+		t.Fatalf("Expected record.select_one to remain the same, got %q", v)
+	}
+
+	if v := record.GetString("file_one"); v != "" {
+		t.Fatalf("Expected record.file_one to remain the same, got %q", v)
+	}
+
+	testFilesCount(t, testApp, record, 0)
+}
+
+func TestRecordUpsertSubmitSuccess(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	col, err := testApp.FindCollectionByNameOrId("demo1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record, err := testApp.FindRecordById(col, "imy661ixudk5izi")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	file, err := filesystem.NewFileFromBytes([]byte("test"), "test.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	form := forms.NewRecordUpsert(testApp, record)
+	form.Load(map[string]any{
+		"text":       "test_update",
+		"file_one":   file,
+		"select_one": "optionC",
+	})
+
+	validateCalls := 0
+	testApp.OnRecordValidate(col.Name).BindFunc(func(e *core.RecordEvent) error {
+		validateCalls++
+		return e.Next()
+	})
+
+	result := form.Submit()
+
+	if result != nil {
+		t.Fatalf("Expected Submit success, got error: %v", result)
+	}
+
+	if validateCalls != 1 {
+		t.Fatalf("Expected validateCalls %d, got %d", 1, validateCalls)
+	}
+
+	// refresh the record to ensure that the changes were persisted
+	record, err = testApp.FindRecordById(col, record.Id)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if v := record.GetString("text"); v != "test_update" {
+		t.Fatalf("Expected record.text %q, got %q", "test_update", v)
+	}
+
+	if v := record.GetString("select_one"); v != "optionC" {
+		t.Fatalf("Expected record.select_one %q, got %q", "optionC", v)
+	}
+
+	if v := record.GetString("file_one"); v != file.Name {
+		t.Fatalf("Expected record.file_one %q, got %q", file.Name, v)
+	}
+
+	testFilesCount(t, testApp, record, 2) // the file + attrs
+}
+
+func TestRecordUpsertPasswordsSync(t *testing.T) {
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	users, err := testApp.FindCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("new user without password", func(t *testing.T) {
+		record := core.NewRecord(users)
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		err := form.Submit()
+
+		tests.TestValidationErrors(t, err, []string{"password", "passwordConfirm"})
+	})
+
+	t.Run("new user with manual password", func(t *testing.T) {
+		record := core.NewRecord(users)
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		record.SetPassword("1234567890")
+
+		err := form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+	})
+
+	t.Run("new user with random password", func(t *testing.T) {
+		record := core.NewRecord(users)
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		record.SetRandomPassword()
+
+		err := form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+	})
+
+	t.Run("update user with no password change", func(t *testing.T) {
+		record, err := testApp.FindAuthRecordByEmail(users, "test@example.com")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		oldHash := record.GetString("password:hash")
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		err = form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+
+		newHash := record.GetString("password:hash")
+		if newHash == "" || newHash != oldHash {
+			t.Fatal("Expected no password change")
+		}
+	})
+
+	t.Run("update user with manual password change", func(t *testing.T) {
+		record, err := testApp.FindAuthRecordByEmail(users, "test@example.com")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		oldHash := record.GetString("password:hash")
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		record.SetPassword("1234567890")
+
+		err = form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+
+		newHash := record.GetString("password:hash")
+		if newHash == "" || newHash == oldHash {
+			t.Fatal("Expected password change")
+		}
+	})
+
+	t.Run("update user with random password change", func(t *testing.T) {
+		record, err := testApp.FindAuthRecordByEmail(users, "test@example.com")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		oldHash := record.GetString("password:hash")
+
+		form := forms.NewRecordUpsert(testApp, record)
+
+		record.SetRandomPassword()
+
+		err = form.Submit()
+		if err != nil {
+			t.Fatalf("Expected no errors, got %v", err)
+		}
+
+		newHash := record.GetString("password:hash")
+		if newHash == "" || newHash == oldHash {
+			t.Fatal("Expected password change")
+		}
+	})
+}
+
+// -------------------------------------------------------------------
+
+func testFilesCount(t *testing.T, app core.App, record *core.Record, count int) {
+	storageDir := filepath.Join(app.DataDir(), "storage", record.Collection().Id, record.Id)
+
+	entries, _ := os.ReadDir(storageDir)
+	if len(entries) != count {
+		t.Errorf("Expected %d entries, got %d\n%v", count, len(entries), entries)
+	}
+}
diff --git a/server/core_backend-server/forms/test_email_send.go b/server/core_backend-server/forms/test_email_send.go
new file mode 100644
index 0000000..ddc3035
--- /dev/null
+++ b/server/core_backend-server/forms/test_email_send.go
@@ -0,0 +1,118 @@
+package forms
+
+import (
+	"errors"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+const (
+	TestTemplateVerification  = "verification"
+	TestTemplatePasswordReset = "password-reset"
+	TestTemplateEmailChange   = "email-change"
+	TestTemplateOTP           = "otp"
+	TestTemplateAuthAlert     = "login-alert"
+)
+
+// TestEmailSend is a email template test request form.
+type TestEmailSend struct {
+	app core.App
+
+	Email      string `form:"email" json:"email"`
+	Template   string `form:"template" json:"template"`
+	Collection string `form:"collection" json:"collection"` // optional, fallbacks to _superusers
+}
+
+// NewTestEmailSend creates and initializes new TestEmailSend form.
+func NewTestEmailSend(app core.App) *TestEmailSend {
+	return &TestEmailSend{app: app}
+}
+
+// Validate makes the form validatable by implementing [validation.Validatable] interface.
+func (form *TestEmailSend) Validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(
+			&form.Collection,
+			validation.Length(1, 255),
+			validation.By(form.checkAuthCollection),
+		),
+		validation.Field(
+			&form.Email,
+			validation.Required,
+			validation.Length(1, 255),
+			is.EmailFormat,
+		),
+		validation.Field(
+			&form.Template,
+			validation.Required,
+			validation.In(
+				TestTemplateVerification,
+				TestTemplatePasswordReset,
+				TestTemplateEmailChange,
+				TestTemplateOTP,
+				TestTemplateAuthAlert,
+			),
+		),
+	)
+}
+
+func (form *TestEmailSend) checkAuthCollection(value any) error {
+	v, _ := value.(string)
+	if v == "" {
+		return nil // nothing to check
+	}
+
+	c, _ := form.app.FindCollectionByNameOrId(v)
+	if c == nil || !c.IsAuth() {
+		return validation.NewError("validation_invalid_auth_collection", "Must be a valid auth collection id or name.")
+	}
+
+	return nil
+}
+
+// Submit validates and sends a test email to the form.Email address.
+func (form *TestEmailSend) Submit() error {
+	if err := form.Validate(); err != nil {
+		return err
+	}
+
+	collectionIdOrName := form.Collection
+	if collectionIdOrName == "" {
+		collectionIdOrName = core.CollectionNameSuperusers
+	}
+
+	collection, err := form.app.FindCollectionByNameOrId(collectionIdOrName)
+	if err != nil {
+		return err
+	}
+
+	record := core.NewRecord(collection)
+	for _, field := range collection.Fields {
+		if field.GetHidden() {
+			continue
+		}
+		record.Set(field.GetName(), "__pb_test_"+field.GetName()+"__")
+	}
+	record.RefreshTokenKey()
+	record.SetEmail(form.Email)
+
+	switch form.Template {
+	case TestTemplateVerification:
+		return mails.SendRecordVerification(form.app, record)
+	case TestTemplatePasswordReset:
+		return mails.SendRecordPasswordReset(form.app, record)
+	case TestTemplateEmailChange:
+		return mails.SendRecordChangeEmail(form.app, record, form.Email)
+	case TestTemplateOTP:
+		return mails.SendRecordOTP(form.app, record, "_PB_TEST_OTP_ID_", "123456")
+	case TestTemplateAuthAlert:
+		testEvent := types.NowDateTime().String() + " - TEST_IP TEST_USER_AGENT"
+		return mails.SendRecordAuthAlert(form.app, record, testEvent)
+	default:
+		return errors.New("unknown template " + form.Template)
+	}
+}
diff --git a/server/core_backend-server/forms/test_email_send_test.go b/server/core_backend-server/forms/test_email_send_test.go
new file mode 100644
index 0000000..0d58595
--- /dev/null
+++ b/server/core_backend-server/forms/test_email_send_test.go
@@ -0,0 +1,96 @@
+package forms_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestEmailSendValidateAndSubmit(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		template       string
+		email          string
+		collection     string
+		expectedErrors []string
+	}{
+		{"", "", "", []string{"template", "email"}},
+		{"invalid", "test@example.com", "", []string{"template"}},
+		{forms.TestTemplateVerification, "invalid", "", []string{"email"}},
+		{forms.TestTemplateVerification, "test@example.com", "invalid", []string{"collection"}},
+		{forms.TestTemplateVerification, "test@example.com", "demo1", []string{"collection"}},
+		{forms.TestTemplateVerification, "test@example.com", "users", nil},
+		{forms.TestTemplatePasswordReset, "test@example.com", "", nil},
+		{forms.TestTemplateEmailChange, "test@example.com", "", nil},
+		{forms.TestTemplateOTP, "test@example.com", "", nil},
+		{forms.TestTemplateAuthAlert, "test@example.com", "", nil},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.template), func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			form := forms.NewTestEmailSend(app)
+			form.Email = s.email
+			form.Template = s.template
+			form.Collection = s.collection
+
+			result := form.Submit()
+
+			// parse errors
+			errs, ok := result.(validation.Errors)
+			if !ok && result != nil {
+				t.Fatalf("Failed to parse errors %v", result)
+			}
+
+			// check errors
+			if len(errs) > len(s.expectedErrors) {
+				t.Fatalf("Expected error keys %v, got %v", s.expectedErrors, errs)
+			}
+			for _, k := range s.expectedErrors {
+				if _, ok := errs[k]; !ok {
+					t.Fatalf("Missing expected error key %q in %v", k, errs)
+				}
+			}
+
+			expectedEmails := 1
+			if len(s.expectedErrors) > 0 {
+				expectedEmails = 0
+			}
+
+			if app.TestMailer.TotalSend() != expectedEmails {
+				t.Fatalf("Expected %d email(s) to be sent, got %d", expectedEmails, app.TestMailer.TotalSend())
+			}
+
+			if len(s.expectedErrors) > 0 {
+				return
+			}
+
+			var expectedContent string
+			switch s.template {
+			case forms.TestTemplatePasswordReset:
+				expectedContent = "Reset password"
+			case forms.TestTemplateEmailChange:
+				expectedContent = "Confirm new email"
+			case forms.TestTemplateVerification:
+				expectedContent = "Verify"
+			case forms.TestTemplateOTP:
+				expectedContent = "one-time password"
+			case forms.TestTemplateAuthAlert:
+				expectedContent = "from a new location"
+			default:
+				expectedContent = "__UNKNOWN_TEMPLATE__"
+			}
+
+			if !strings.Contains(app.TestMailer.LastMessage().HTML, expectedContent) {
+				t.Errorf("Expected the email to contains %q, got\n%v", expectedContent, app.TestMailer.LastMessage().HTML)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/forms/test_s3_filesystem.go b/server/core_backend-server/forms/test_s3_filesystem.go
new file mode 100644
index 0000000..298a9e4
--- /dev/null
+++ b/server/core_backend-server/forms/test_s3_filesystem.go
@@ -0,0 +1,120 @@
+package forms
+
+import (
+	"errors"
+	"fmt"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+const (
+	s3FilesystemStorage = "storage"
+	s3FilesystemBackups = "backups"
+)
+
+// TestS3Filesystem defines a S3 filesystem connection test.
+type TestS3Filesystem struct {
+	app core.App
+
+	// The name of the filesystem - storage or backups
+	Filesystem string `form:"filesystem" json:"filesystem"`
+
+	// Optional S3 config fields to test unsaved settings
+	// If provided, these override the saved settings for testing
+	Bucket         string `form:"bucket" json:"bucket"`
+	Region         string `form:"region" json:"region"`
+	Endpoint       string `form:"endpoint" json:"endpoint"`
+	AccessKey      string `form:"accessKey" json:"accessKey"`
+	Secret         string `form:"secret" json:"secret"`
+	ForcePathStyle bool   `form:"forcePathStyle" json:"forcePathStyle"`
+}
+
+// NewTestS3Filesystem creates and initializes new TestS3Filesystem form.
+func NewTestS3Filesystem(app core.App) *TestS3Filesystem {
+	return &TestS3Filesystem{app: app}
+}
+
+// Validate makes the form validatable by implementing [validation.Validatable] interface.
+func (form *TestS3Filesystem) Validate() error {
+	return validation.ValidateStruct(form,
+		validation.Field(
+			&form.Filesystem,
+			validation.Required,
+			validation.In(s3FilesystemStorage, s3FilesystemBackups),
+		),
+	)
+}
+
+// Submit validates and performs a S3 filesystem connection test.
+func (form *TestS3Filesystem) Submit() error {
+	if err := form.Validate(); err != nil {
+		return err
+	}
+
+	var s3Config core.S3Config
+
+	// Check if form fields are provided (for testing unsaved settings)
+	if form.Endpoint != "" {
+		// Use the form fields directly
+		s3Config = core.S3Config{
+			Enabled:        true,
+			Bucket:         form.Bucket,
+			Region:         form.Region,
+			Endpoint:       form.Endpoint,
+			AccessKey:      form.AccessKey,
+			Secret:         form.Secret,
+			ForcePathStyle: form.ForcePathStyle,
+		}
+
+		// If secret is not provided, use the saved secret from settings
+		if s3Config.Secret == "" {
+			if form.Filesystem == s3FilesystemBackups {
+				s3Config.Secret = form.app.Settings().Backups.S3.Secret
+			} else {
+				s3Config.Secret = form.app.Settings().S3.Secret
+			}
+		}
+	} else {
+		// Fall back to saved settings
+		if form.Filesystem == s3FilesystemBackups {
+			s3Config = form.app.Settings().Backups.S3
+		} else {
+			s3Config = form.app.Settings().S3
+		}
+	}
+
+	if !s3Config.Enabled {
+		return errors.New("S3 storage filesystem is not enabled")
+	}
+
+	fsys, err := filesystem.NewS3(
+		s3Config.Bucket,
+		s3Config.Region,
+		s3Config.Endpoint,
+		s3Config.AccessKey,
+		s3Config.Secret,
+		s3Config.ForcePathStyle,
+	)
+	if err != nil {
+		return fmt.Errorf("failed to initialize the S3 filesystem: %w", err)
+	}
+	defer fsys.Close()
+
+	testPrefix := "pb_settings_test_" + security.PseudorandomString(5)
+	testFileKey := testPrefix + "/test.txt"
+
+	// try to upload a test file
+	if err := fsys.Upload([]byte("test"), testFileKey); err != nil {
+		return fmt.Errorf("failed to upload a test file: %w", err)
+	}
+
+	// test prefix deletion (ensures that both bucket list and delete works)
+	if errs := fsys.DeletePrefix(testPrefix); len(errs) > 0 {
+		return fmt.Errorf("failed to delete a test file: %w", errs[0])
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/forms/test_s3_filesystem_test.go b/server/core_backend-server/forms/test_s3_filesystem_test.go
new file mode 100644
index 0000000..391cef7
--- /dev/null
+++ b/server/core_backend-server/forms/test_s3_filesystem_test.go
@@ -0,0 +1,107 @@
+package forms_test
+
+import (
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestS3FilesystemValidate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name           string
+		filesystem     string
+		expectedErrors []string
+	}{
+		{
+			"empty filesystem",
+			"",
+			[]string{"filesystem"},
+		},
+		{
+			"invalid filesystem",
+			"something",
+			[]string{"filesystem"},
+		},
+		{
+			"backups filesystem",
+			"backups",
+			[]string{},
+		},
+		{
+			"storage filesystem",
+			"storage",
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			form := forms.NewTestS3Filesystem(app)
+			form.Filesystem = s.filesystem
+
+			result := form.Validate()
+
+			// parse errors
+			errs, ok := result.(validation.Errors)
+			if !ok && result != nil {
+				t.Fatalf("Failed to parse errors %v", result)
+			}
+
+			// check errors
+			if len(errs) > len(s.expectedErrors) {
+				t.Fatalf("Expected error keys %v, got %v", s.expectedErrors, errs)
+			}
+			for _, k := range s.expectedErrors {
+				if _, ok := errs[k]; !ok {
+					t.Fatalf("Missing expected error key %q in %v", k, errs)
+				}
+			}
+		})
+	}
+}
+
+func TestS3FilesystemSubmitFailure(t *testing.T) {
+	t.Parallel()
+
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// check if validate was called
+	{
+		form := forms.NewTestS3Filesystem(app)
+		form.Filesystem = ""
+
+		result := form.Submit()
+
+		if result == nil {
+			t.Fatal("Expected error, got nil")
+		}
+
+		if _, ok := result.(validation.Errors); !ok {
+			t.Fatalf("Expected validation.Error, got %v", result)
+		}
+	}
+
+	// check with valid storage and disabled s3
+	{
+		form := forms.NewTestS3Filesystem(app)
+		form.Filesystem = "storage"
+
+		result := form.Submit()
+
+		if result == nil {
+			t.Fatal("Expected error, got nil")
+		}
+
+		if _, ok := result.(validation.Error); ok {
+			t.Fatalf("Didn't expect validation.Error, got %v", result)
+		}
+	}
+}
diff --git a/server/core_backend-server/go.mod b/server/core_backend-server/go.mod
new file mode 100644
index 0000000..114b2c1
--- /dev/null
+++ b/server/core_backend-server/go.mod
@@ -0,0 +1,59 @@
+module github.com/pocketbase/pocketbase
+
+go 1.24.0
+
+require (
+	github.com/disintegration/imaging v1.6.2
+	github.com/domodwyer/mailyak/v3 v3.6.2
+	github.com/dop251/goja v0.0.0-20251201205617-2bb4c724c0f9
+	github.com/dop251/goja_nodejs v0.0.0-20251015164255-5e94316bedaf
+	github.com/fatih/color v1.18.0
+	github.com/fsnotify/fsnotify v1.7.0
+	github.com/gabriel-vasile/mimetype v1.4.12
+	github.com/ganigeorgiev/fexpr v0.5.0
+	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
+	github.com/go-sql-driver/mysql v1.9.3
+	github.com/golang-jwt/jwt/v5 v5.3.0
+	github.com/google/uuid v1.6.0
+	github.com/jackc/pgx/v5 v5.7.6
+	github.com/joho/godotenv v1.5.1
+	github.com/pocketbase/dbx v1.11.0
+	github.com/pocketbase/tygoja v0.0.0-20250812183945-97ffe055281f
+	github.com/spf13/cast v1.10.0
+	github.com/spf13/cobra v1.10.2
+	golang.org/x/crypto v0.46.0
+	golang.org/x/image v0.34.0
+	golang.org/x/net v0.48.0
+	golang.org/x/oauth2 v0.34.0
+	golang.org/x/sync v0.19.0
+	modernc.org/sqlite v1.41.0
+)
+
+require (
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
+	github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
+	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
+	golang.org/x/mod v0.31.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
+	modernc.org/libc v1.66.10 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
+)
+
+replace github.com/pocketbase/dbx v1.11.0 => github.com/fondoger/dbx v0.0.0-20250428115856-688aa3631781
diff --git a/server/core_backend-server/go.sum b/server/core_backend-server/go.sum
new file mode 100644
index 0000000..747a37b
--- /dev/null
+++ b/server/core_backend-server/go.sum
@@ -0,0 +1,160 @@
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
+github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
+github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
+github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
+github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
+github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217 h1:16iT9CBDOniJwFGPI41MbUDfEk74hFaKTqudrX8kenY=
+github.com/dop251/base64dec v0.0.0-20231022112746-c6c9f9a96217/go.mod h1:eIb+f24U+eWQCIsj9D/ah+MD9UP+wdxuqzsdLD+mhGM=
+github.com/dop251/goja v0.0.0-20251201205617-2bb4c724c0f9 h1:3uSSOd6mVlwcX3k5OYOpiDqFgRmaE2dBfLvVIFWWHrw=
+github.com/dop251/goja v0.0.0-20251201205617-2bb4c724c0f9/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
+github.com/dop251/goja_nodejs v0.0.0-20251015164255-5e94316bedaf h1:gbmvliZnCut4NjaPSNOQlfqBoZ9C5Dpf72mHMMYhgVE=
+github.com/dop251/goja_nodejs v0.0.0-20251015164255-5e94316bedaf/go.mod h1:Tb7Xxye4LX7cT3i8YLvmPMGCV92IOi4CDZvm/V8ylc0=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fondoger/dbx v0.0.0-20250428115856-688aa3631781 h1:BwmwKDpKfwHyo8gH+hSNHPIGo5UFvChCJ5+6NTreDsA=
+github.com/fondoger/dbx v0.0.0-20250428115856-688aa3631781/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
+github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
+github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
+github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
+github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
+github.com/go-sourcemap/sourcemap v2.1.4+incompatible h1:a+iTbH5auLKxaNwQFg0B+TCYl6lbukKPc7b5x0n1s6Q=
+github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
+github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
+github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pocketbase/tygoja v0.0.0-20250812183945-97ffe055281f h1:ahrn66FNJYsFkO0EOTStYs+jdBKBop/anp9hoQSzZjI=
+github.com/pocketbase/tygoja v0.0.0-20250812183945-97ffe055281f/go.mod h1:hKJWPGFqavk3cdTa47Qvs8g37lnfI57OYdVVbIqW5aE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
+golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
+golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.34.0 h1:33gCkyw9hmwbZJeZkct8XyR11yH889EQt/QH4VmXMn8=
+golang.org/x/image v0.34.0/go.mod h1:2RNFBZRB+vnwwFil8GkMdRvrJOFd1AzdZI6vOY+eJVU=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+modernc.org/cc/v4 v4.26.5 h1:xM3bX7Mve6G8K8b+T11ReenJOT+BmVqQj0FY5T4+5Y4=
+modernc.org/cc/v4 v4.26.5/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.28.1 h1:wPKYn5EC/mYTqBO373jKjvX2n+3+aK7+sICCv4Fjy1A=
+modernc.org/ccgo/v4 v4.28.1/go.mod h1:uD+4RnfrVgE6ec9NGguUNdhqzNIeeomeXf6CL0GTE5Q=
+modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
+modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.66.10 h1:yZkb3YeLx4oynyR+iUsXsybsX4Ubx7MQlSYEw4yj59A=
+modernc.org/libc v1.66.10/go.mod h1:8vGSEwvoUoltr4dlywvHqjtAqHBaw0j1jI7iFBTAr2I=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.41.0 h1:bJXddp4ZpsqMsNN1vS0jWo4IJTZzb8nWpcgvyCFG9Ck=
+modernc.org/sqlite v1.41.0/go.mod h1:9fjQZ0mB1LLP0GYrp39oOJXx/I2sxEnZtzCmEQIKvGE=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
diff --git a/server/core_backend-server/golangci.yml b/server/core_backend-server/golangci.yml
new file mode 100644
index 0000000..7eef299
--- /dev/null
+++ b/server/core_backend-server/golangci.yml
@@ -0,0 +1,26 @@
+version: "2"
+run:
+  concurrency: 4
+  timeout: 10m
+linters:
+  default: none
+  enable:
+    - asasalint
+    - asciicheck
+    - gomodguard
+    - goprintffuncname
+    - govet
+    - ineffassign
+    - misspell
+    - nakedret
+    - nolintlint
+    - prealloc
+    - reassign
+    - staticcheck
+    - unconvert
+    - unused
+    - whitespace
+formatters:
+  enable:
+    - gofmt
+    - goimports
diff --git a/server/core_backend-server/mails/base.go b/server/core_backend-server/mails/base.go
new file mode 100644
index 0000000..df34c94
--- /dev/null
+++ b/server/core_backend-server/mails/base.go
@@ -0,0 +1,33 @@
+// Package mails implements various helper methods for sending common
+// emails like forgotten password, verification, etc.
+package mails
+
+import (
+	"bytes"
+	"text/template"
+)
+
+// resolveTemplateContent resolves inline html template strings.
+func resolveTemplateContent(data any, content ...string) (string, error) {
+	if len(content) == 0 {
+		return "", nil
+	}
+
+	t := template.New("inline_template")
+
+	var parseErr error
+	for _, v := range content {
+		t, parseErr = t.Parse(v)
+		if parseErr != nil {
+			return "", parseErr
+		}
+	}
+
+	var wr bytes.Buffer
+
+	if executeErr := t.Execute(&wr, data); executeErr != nil {
+		return "", executeErr
+	}
+
+	return wr.String(), nil
+}
diff --git a/server/core_backend-server/mails/record.go b/server/core_backend-server/mails/record.go
new file mode 100644
index 0000000..5091691
--- /dev/null
+++ b/server/core_backend-server/mails/record.go
@@ -0,0 +1,303 @@
+package mails
+
+import (
+	"html"
+	"html/template"
+	"net/mail"
+	"slices"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/mails/templates"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+)
+
+// SendRecordAuthAlert sends a new device login alert to the specified auth record.
+func SendRecordAuthAlert(app core.App, authRecord *core.Record, info string) error {
+	mailClient := app.NewMailClient()
+
+	info = html.EscapeString(info)
+
+	subject, body, err := resolveEmailTemplate(app, authRecord, authRecord.Collection().AuthAlert.EmailTemplate, map[string]any{
+		core.EmailPlaceholderAlertInfo: info,
+	})
+	if err != nil {
+		return err
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      []mail.Address{{Address: authRecord.Email()}},
+		Subject: subject,
+		HTML:    body,
+	}
+
+	event := new(core.MailerRecordEvent)
+	event.App = app
+	event.Mailer = mailClient
+	event.Message = message
+	event.Record = authRecord
+	event.Meta = map[string]any{
+		"info": info,
+	}
+
+	return app.OnMailerRecordAuthAlertSend().Trigger(event, func(e *core.MailerRecordEvent) error {
+		return e.Mailer.Send(e.Message)
+	})
+}
+
+// SendRecordOTP sends OTP email to the specified auth record.
+//
+// This method will also update the "sentTo" field of the related OTP record to the mail sent To address (if the OTP exists and not already assigned).
+func SendRecordOTP(app core.App, authRecord *core.Record, otpId string, pass string) error {
+	mailClient := app.NewMailClient()
+
+	subject, body, err := resolveEmailTemplate(app, authRecord, authRecord.Collection().OTP.EmailTemplate, map[string]any{
+		core.EmailPlaceholderOTPId: otpId,
+		core.EmailPlaceholderOTP:   pass,
+	})
+	if err != nil {
+		return err
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      []mail.Address{{Address: authRecord.Email()}},
+		Subject: subject,
+		HTML:    body,
+	}
+
+	event := new(core.MailerRecordEvent)
+	event.App = app
+	event.Mailer = mailClient
+	event.Message = message
+	event.Record = authRecord
+	event.Meta = map[string]any{
+		"otpId":    otpId,
+		"password": pass,
+	}
+
+	return app.OnMailerRecordOTPSend().Trigger(event, func(e *core.MailerRecordEvent) error {
+		err := e.Mailer.Send(e.Message)
+		if err != nil {
+			return err
+		}
+
+		var toAddress string
+		if len(e.Message.To) > 0 {
+			toAddress = e.Message.To[0].Address
+		}
+		if toAddress == "" {
+			return nil
+		}
+
+		otp, err := e.App.FindOTPById(otpId)
+		if err != nil {
+			e.App.Logger().Warn(
+				"Unable to find OTP to update its sentTo field (either it was already deleted or the id is nonexisting)",
+				"error", err,
+				"otpId", otpId,
+			)
+			return nil
+		}
+
+		if otp.SentTo() != "" {
+			return nil // was already sent to another target
+		}
+
+		otp.SetSentTo(toAddress)
+		if err = e.App.Save(otp); err != nil {
+			e.App.Logger().Error(
+				"Failed to update OTP sentTo field",
+				"error", err,
+				"otpId", otpId,
+				"to", toAddress,
+			)
+		}
+
+		return nil
+	})
+}
+
+// SendRecordPasswordReset sends a password reset request email to the specified auth record.
+func SendRecordPasswordReset(app core.App, authRecord *core.Record) error {
+	token, tokenErr := authRecord.NewPasswordResetToken()
+	if tokenErr != nil {
+		return tokenErr
+	}
+
+	mailClient := app.NewMailClient()
+
+	subject, body, err := resolveEmailTemplate(app, authRecord, authRecord.Collection().ResetPasswordTemplate, map[string]any{
+		core.EmailPlaceholderToken: token,
+	})
+	if err != nil {
+		return err
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      []mail.Address{{Address: authRecord.Email()}},
+		Subject: subject,
+		HTML:    body,
+	}
+
+	event := new(core.MailerRecordEvent)
+	event.App = app
+	event.Mailer = mailClient
+	event.Message = message
+	event.Record = authRecord
+	event.Meta = map[string]any{"token": token}
+
+	return app.OnMailerRecordPasswordResetSend().Trigger(event, func(e *core.MailerRecordEvent) error {
+		return e.Mailer.Send(e.Message)
+	})
+}
+
+// SendRecordVerification sends a verification request email to the specified auth record.
+func SendRecordVerification(app core.App, authRecord *core.Record) error {
+	token, tokenErr := authRecord.NewVerificationToken()
+	if tokenErr != nil {
+		return tokenErr
+	}
+
+	mailClient := app.NewMailClient()
+
+	subject, body, err := resolveEmailTemplate(app, authRecord, authRecord.Collection().VerificationTemplate, map[string]any{
+		core.EmailPlaceholderToken: token,
+	})
+	if err != nil {
+		return err
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      []mail.Address{{Address: authRecord.Email()}},
+		Subject: subject,
+		HTML:    body,
+	}
+
+	event := new(core.MailerRecordEvent)
+	event.App = app
+	event.Mailer = mailClient
+	event.Message = message
+	event.Record = authRecord
+	event.Meta = map[string]any{"token": token}
+
+	return app.OnMailerRecordVerificationSend().Trigger(event, func(e *core.MailerRecordEvent) error {
+		return e.Mailer.Send(e.Message)
+	})
+}
+
+// SendRecordChangeEmail sends a change email confirmation email to the specified auth record.
+func SendRecordChangeEmail(app core.App, authRecord *core.Record, newEmail string) error {
+	token, tokenErr := authRecord.NewEmailChangeToken(newEmail)
+	if tokenErr != nil {
+		return tokenErr
+	}
+
+	mailClient := app.NewMailClient()
+
+	subject, body, err := resolveEmailTemplate(app, authRecord, authRecord.Collection().ConfirmEmailChangeTemplate, map[string]any{
+		core.EmailPlaceholderToken: token,
+	})
+	if err != nil {
+		return err
+	}
+
+	message := &mailer.Message{
+		From: mail.Address{
+			Name:    app.Settings().Meta.SenderName,
+			Address: app.Settings().Meta.SenderAddress,
+		},
+		To:      []mail.Address{{Address: newEmail}},
+		Subject: subject,
+		HTML:    body,
+	}
+
+	event := new(core.MailerRecordEvent)
+	event.App = app
+	event.Mailer = mailClient
+	event.Message = message
+	event.Record = authRecord
+	event.Meta = map[string]any{
+		"token":    token,
+		"newEmail": newEmail,
+	}
+
+	return app.OnMailerRecordEmailChangeSend().Trigger(event, func(e *core.MailerRecordEvent) error {
+		return e.Mailer.Send(e.Message)
+	})
+}
+
+var nonescapeTypes = []string{
+	core.FieldTypeAutodate,
+	core.FieldTypeDate,
+	core.FieldTypeBool,
+	core.FieldTypeNumber,
+}
+
+func resolveEmailTemplate(
+	app core.App,
+	authRecord *core.Record,
+	emailTemplate core.EmailTemplate,
+	placeholders map[string]any,
+) (subject string, body string, err error) {
+	if placeholders == nil {
+		placeholders = map[string]any{}
+	}
+
+	// register default system placeholders
+	if _, ok := placeholders[core.EmailPlaceholderAppName]; !ok {
+		placeholders[core.EmailPlaceholderAppName] = app.Settings().Meta.AppName
+	}
+	if _, ok := placeholders[core.EmailPlaceholderAppURL]; !ok {
+		placeholders[core.EmailPlaceholderAppURL] = app.Settings().Meta.AppURL
+	}
+
+	// register default auth record placeholders
+	for _, field := range authRecord.Collection().Fields {
+		if field.GetHidden() {
+			continue
+		}
+
+		fieldPlacehodler := "{RECORD:" + field.GetName() + "}"
+		if _, ok := placeholders[fieldPlacehodler]; !ok {
+			val := authRecord.GetString(field.GetName())
+
+			// note: the escaping is not strictly necessary but for just in case
+			// the user decide to store and render the email as plain html
+			if !slices.Contains(nonescapeTypes, field.Type()) {
+				val = html.EscapeString(val)
+			}
+
+			placeholders[fieldPlacehodler] = val
+		}
+	}
+
+	subject, rawBody := emailTemplate.Resolve(placeholders)
+
+	params := struct {
+		HTMLContent template.HTML
+	}{
+		HTMLContent: template.HTML(rawBody),
+	}
+
+	body, err = resolveTemplateContent(params, templates.Layout, templates.HTMLBody)
+	if err != nil {
+		return "", "", err
+	}
+
+	return subject, body, nil
+}
diff --git a/server/core_backend-server/mails/record_test.go b/server/core_backend-server/mails/record_test.go
new file mode 100644
index 0000000..c6f6ba1
--- /dev/null
+++ b/server/core_backend-server/mails/record_test.go
@@ -0,0 +1,171 @@
+package mails_test
+
+import (
+	"html"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+func TestSendRecordAuthAlert(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	info := "<p>test_info</p>"
+
+	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
+
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
+	err := mails.SendRecordAuthAlert(testApp, user, info)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if testApp.TestMailer.TotalSend() != 1 {
+		t.Fatalf("Expected one email to be sent, got %d", testApp.TestMailer.TotalSend())
+	}
+
+	expectedParts := []string{
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // public and private record placeholder checks
+		"login to your " + testApp.Settings().Meta.AppName + " account from a new location",
+		"If this was you",
+		"If this wasn't you",
+		html.EscapeString(info),
+	}
+	for _, part := range expectedParts {
+		if !strings.Contains(testApp.TestMailer.LastMessage().HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage().HTML)
+		}
+	}
+}
+
+func TestSendRecordPasswordReset(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
+
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
+	err := mails.SendRecordPasswordReset(testApp, user)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if testApp.TestMailer.TotalSend() != 1 {
+		t.Fatalf("Expected one email to be sent, got %d", testApp.TestMailer.TotalSend())
+	}
+
+	expectedParts := []string{
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // the record name as {RECORD:name}
+		"http://localhost:8198/_/#/auth/confirm-password-reset/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
+	}
+	for _, part := range expectedParts {
+		if !strings.Contains(testApp.TestMailer.LastMessage().HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage().HTML)
+		}
+	}
+}
+
+func TestSendRecordVerification(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
+
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
+	err := mails.SendRecordVerification(testApp, user)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if testApp.TestMailer.TotalSend() != 1 {
+		t.Fatalf("Expected one email to be sent, got %d", testApp.TestMailer.TotalSend())
+	}
+
+	expectedParts := []string{
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // the record name as {RECORD:name}
+		"http://localhost:8198/_/#/auth/confirm-verification/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
+	}
+	for _, part := range expectedParts {
+		if !strings.Contains(testApp.TestMailer.LastMessage().HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage().HTML)
+		}
+	}
+}
+
+func TestSendRecordChangeEmail(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
+
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
+	err := mails.SendRecordChangeEmail(testApp, user, "new_test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if testApp.TestMailer.TotalSend() != 1 {
+		t.Fatalf("Expected one email to be sent, got %d", testApp.TestMailer.TotalSend())
+	}
+
+	expectedParts := []string{
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // the record name as {RECORD:name}
+		"http://localhost:8198/_/#/auth/confirm-email-change/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.",
+	}
+	for _, part := range expectedParts {
+		if !strings.Contains(testApp.TestMailer.LastMessage().HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage().HTML)
+		}
+	}
+}
+
+func TestSendRecordOTP(t *testing.T) {
+	t.Parallel()
+
+	testApp, _ := tests.NewTestApp()
+	defer testApp.Cleanup()
+
+	user, _ := testApp.FindFirstRecordByData("users", "email", "test@example.com")
+
+	// to test that it is escaped
+	user.Set("name", "<p>"+user.GetString("name")+"</p>")
+
+	err := mails.SendRecordOTP(testApp, user, "test_otp_id", "test_otp_code")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if testApp.TestMailer.TotalSend() != 1 {
+		t.Fatalf("Expected one email to be sent, got %d", testApp.TestMailer.TotalSend())
+	}
+
+	expectedParts := []string{
+		html.EscapeString(user.GetString("name")) + "{RECORD:tokenKey}", // the record name as {RECORD:name}
+		"one-time password",
+		"test_otp_code",
+	}
+	for _, part := range expectedParts {
+		if !strings.Contains(testApp.TestMailer.LastMessage().HTML, part) {
+			t.Fatalf("Couldn't find %s \nin\n %s", part, testApp.TestMailer.LastMessage().HTML)
+		}
+	}
+}
diff --git a/server/core_backend-server/mails/templates/html_content.go b/server/core_backend-server/mails/templates/html_content.go
new file mode 100644
index 0000000..34d5845
--- /dev/null
+++ b/server/core_backend-server/mails/templates/html_content.go
@@ -0,0 +1,8 @@
+package templates
+
+// Available variables:
+//
+// ```
+// HTMLContent template.HTML
+// ```
+const HTMLBody = `{{define "content"}}{{.HTMLContent}}{{end}}`
diff --git a/server/core_backend-server/mails/templates/layout.go b/server/core_backend-server/mails/templates/layout.go
new file mode 100644
index 0000000..7a43ad9
--- /dev/null
+++ b/server/core_backend-server/mails/templates/layout.go
@@ -0,0 +1,79 @@
+package templates
+
+const Layout = `
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+    <meta name="viewport" content="width=device-width,initial-scale=1" />
+    <style>
+        body, html {
+            padding: 0;
+            margin: 0;
+            border: 0;
+            color: #16161a;
+            background: #fff;
+            font-size: 14px;
+            line-height: 20px;
+            font-weight: normal;
+            font-family: Source Sans Pro, sans-serif, emoji;
+        }
+        body {
+            padding: 20px 30px;
+        }
+        strong {
+            font-weight: bold;
+        }
+        em, i {
+            font-style: italic;
+        }
+        p {
+            display: block;
+            margin: 10px 0;
+            font-family: inherit;
+        }
+        small {
+            font-size: 12px;
+            line-height: 16px;
+        }
+        hr {
+            display: block;
+            height: 1px;
+            border: 0;
+            width: 100%;
+            background: #e1e6ea;
+            margin: 10px 0;
+        }
+        a {
+            color: inherit;
+        }
+        .hidden {
+            display: none !important;
+        }
+        .btn {
+            display: inline-block;
+            vertical-align: top;
+            border: 0;
+            cursor: pointer;
+            color: #fff !important;
+            background: #16161a !important;
+            text-decoration: none !important;
+            line-height: 40px;
+            width: auto;
+            min-width: 150px;
+            text-align: center;
+            padding: 0 20px;
+            margin: 5px 0;
+            font-family: Source Sans Pro, sans-serif, emoji;;
+            font-size: 14px;
+            font-weight: bold;
+            border-radius: 6px;
+            box-sizing: border-box;
+        }
+    </style>
+</head>
+<body>
+    {{template "content" .}}
+</body>
+</html>
+`
diff --git a/server/core_backend-server/migrations/1640988000_aux_init.go b/server/core_backend-server/migrations/1640988000_aux_init.go
new file mode 100644
index 0000000..7f6efad
--- /dev/null
+++ b/server/core_backend-server/migrations/1640988000_aux_init.go
@@ -0,0 +1,94 @@
+package migrations
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func init() {
+	core.SystemMigrations.Add(&core.Migration{
+		Up: func(txApp core.App) error {
+			if err := createSQLiteEquivalentFunctions(txApp.AuxDB()); err != nil {
+				return err
+			}
+			driver := getDriverName(txApp.AuxDB())
+
+			var logsSql string
+			if driver == "mysql" {
+				fmt.Println("DEBUG: Running MySQL aux init migration for _logs table")
+				_, err := txApp.AuxDB().NewQuery(`
+					CREATE TABLE IF NOT EXISTS {{_logs}} (
+						[[id]]      VARCHAR(100) PRIMARY KEY NOT NULL,
+						[[level]]   INT DEFAULT 0 NOT NULL,
+						[[message]] TEXT NOT NULL,
+						[[data]]    JSON NOT NULL,
+						[[created]] VARCHAR(50) NOT NULL
+					);`).Execute()
+				if err != nil {
+					return err
+				}
+
+				// Create indices separately
+				fmt.Println("DEBUG: Creating index idx_logs_level")
+				_, err = txApp.AuxDB().NewQuery("CREATE INDEX idx_logs_level on {{_logs}} ([[level]]);").Execute()
+				if err != nil {
+					if strings.Contains(err.Error(), "Duplicate key name") {
+						fmt.Println("DEBUG: Index idx_logs_level already exists, ignoring error")
+					} else {
+						return err
+					}
+				}
+				fmt.Println("DEBUG: Creating index idx_logs_message")
+				_, err = txApp.AuxDB().NewQuery("CREATE INDEX idx_logs_message on {{_logs}} (message(255));").Execute()
+				if err != nil {
+					if strings.Contains(err.Error(), "Duplicate key name") {
+						fmt.Println("DEBUG: Index idx_logs_message already exists, ignoring error")
+					} else {
+						return err
+					}
+				}
+				fmt.Println("DEBUG: Creating index idx_logs_created_hour")
+				_, err = txApp.AuxDB().NewQuery("CREATE INDEX idx_logs_created_hour on {{_logs}} ((DATE_FORMAT([[created]], '%Y-%m-%d %H:00:00')));").Execute()
+				return err
+			} else if driver == "postgres" {
+				logsSql = `
+					CREATE TABLE IF NOT EXISTS {{_logs}} (
+						[[id]]      UUID PRIMARY KEY DEFAULT uuid_generate_v7() NOT NULL,
+						[[level]]   INTEGER DEFAULT 0 NOT NULL,
+						[[message]] TEXT DEFAULT '' NOT NULL,
+						[[data]]    JSONB DEFAULT '{}' NOT NULL,
+						[[created]] TIMESTAMP DEFAULT now() NOT NULL
+					);
+					CREATE INDEX IF NOT EXISTS idx_logs_level on {{_logs}} ([[level]]);
+					CREATE INDEX IF NOT EXISTS idx_logs_message on {{_logs}} ([[message]]);
+					CREATE INDEX IF NOT EXISTS idx_logs_created_hour on {{_logs}} (date_trunc('hour', [[created]]));`
+			} else {
+				logsSql = `
+					CREATE TABLE IF NOT EXISTS {{_logs}} (
+						[[id]]      TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL,
+						[[level]]   INTEGER DEFAULT 0 NOT NULL,
+						[[message]] TEXT DEFAULT "" NOT NULL,
+						[[data]]    JSON DEFAULT "{}" NOT NULL,
+						[[created]] TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL
+					);
+					CREATE INDEX IF NOT EXISTS idx_logs_level on {{_logs}} ([[level]]);
+					CREATE INDEX IF NOT EXISTS idx_logs_message on {{_logs}} ([[message]]);
+					CREATE INDEX IF NOT EXISTS idx_logs_created_hour on {{_logs}} (strftime('%Y-%m-%d %H:00:00', [[created]]));`
+			}
+
+			_, execErr := txApp.AuxDB().NewQuery(logsSql).Execute()
+			return execErr
+		},
+		Down: func(txApp core.App) error {
+			_, err := txApp.AuxDB().DropTable("_logs").Execute()
+			return err
+		},
+		ReapplyCondition: func(txApp core.App, runner *core.MigrationsRunner, fileName string) (bool, error) {
+			// reapply only if the _logs table doesn't exist
+			exists := txApp.AuxHasTable("_logs")
+			return !exists, nil
+		},
+	})
+}
diff --git a/server/core_backend-server/migrations/1640988000_init.go b/server/core_backend-server/migrations/1640988000_init.go
new file mode 100644
index 0000000..b23eb44
--- /dev/null
+++ b/server/core_backend-server/migrations/1640988000_init.go
@@ -0,0 +1,432 @@
+package migrations
+
+import (
+	"fmt"
+	"path/filepath"
+	"runtime"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// Register is a short alias for `AppMigrations.Register()`
+// that is usually used in external/user defined migrations.
+func Register(
+	up func(app core.App) error,
+	down func(app core.App) error,
+	optFilename ...string,
+) {
+	var optFiles []string
+	if len(optFilename) > 0 {
+		optFiles = optFilename
+	} else {
+		_, path, _, _ := runtime.Caller(1)
+		optFiles = append(optFiles, filepath.Base(path))
+	}
+	core.AppMigrations.Register(up, down, optFiles...)
+}
+
+func init() {
+	core.SystemMigrations.Register(func(txApp core.App) error {
+		if err := createSQLiteEquivalentFunctions(txApp.DB()); err != nil {
+			return fmt.Errorf("createSQLiteEquivalentFunctions error: %w", err)
+		}
+
+		if err := createParamsTable(txApp); err != nil {
+			return fmt.Errorf("_params exec error: %w", err)
+		}
+
+		// -----------------------------------------------------------
+		driver := getDriverName(txApp.DB())
+
+		var collectionsSql string
+		if driver == "postgres" {
+			collectionsSql = `
+				CREATE TABLE {{_collections}} (
+					[[id]]         TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL,
+					[[system]]     BOOLEAN DEFAULT FALSE NOT NULL,
+					[[type]]       TEXT DEFAULT 'base' NOT NULL,
+					[[name]]       TEXT UNIQUE NOT NULL,
+					[[fields]]     JSONB DEFAULT '[]' NOT NULL,
+					[[indexes]]    JSONB DEFAULT '[]' NOT NULL,
+					[[listRule]]   TEXT DEFAULT NULL,
+					[[viewRule]]   TEXT DEFAULT NULL,
+					[[createRule]] TEXT DEFAULT NULL,
+					[[updateRule]] TEXT DEFAULT NULL,
+					[[deleteRule]] TEXT DEFAULT NULL,
+					[[options]]    JSONB DEFAULT '{}' NOT NULL,
+					[[created]]    TIMESTAMP DEFAULT now() NOT NULL,
+					[[updated]]    TIMESTAMP DEFAULT now() NOT NULL
+				);
+				CREATE INDEX IF NOT EXISTS idx__collections_type on {{_collections}} ([[type]]);`
+		} else if driver == "mysql" {
+			collectionsSql = `
+				CREATE TABLE {{_collections}} (
+					[[id]]         VARCHAR(15) PRIMARY KEY NOT NULL,
+					[[system]]     BOOLEAN DEFAULT FALSE NOT NULL,
+					[[type]]       VARCHAR(30) DEFAULT 'base' NOT NULL,
+					[[name]]       VARCHAR(255) UNIQUE NOT NULL,
+					[[fields]]     JSON NOT NULL,
+					[[indexes]]    JSON NOT NULL,
+					[[listRule]]   TEXT,
+					[[viewRule]]   TEXT,
+					[[createRule]] TEXT,
+					[[updateRule]] TEXT,
+					[[deleteRule]] TEXT,
+					[[options]]    JSON NOT NULL,
+					[[created]]    VARCHAR(50) NOT NULL,
+					[[updated]]    VARCHAR(50) NOT NULL,
+					CONSTRAINT idx__collections_name UNIQUE ([[name]])
+				);`
+
+			// Execute table creation
+			_, err := txApp.DB().NewQuery(collectionsSql).Execute()
+			if err != nil {
+				return fmt.Errorf("_collections create error: %w", err)
+			}
+
+			// Execute index creation
+			_, err = txApp.DB().NewQuery("CREATE INDEX idx__collections_type on {{_collections}} ([[type]]);").Execute()
+			if err != nil {
+				return fmt.Errorf("_collections index error: %w", err)
+			}
+
+			// Set collectionsSql to empty or nil to skip the execute below?
+			// Refactor: move execution inside blocks or skip if handled.
+			collectionsSql = ""
+		} else {
+			collectionsSql = `
+				CREATE TABLE {{_collections}} (
+					[[id]]         TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL,
+					[[system]]     BOOLEAN DEFAULT FALSE NOT NULL,
+					[[type]]       TEXT DEFAULT 'base' NOT NULL,
+					[[name]]       TEXT UNIQUE NOT NULL,
+					[[fields]]     JSON DEFAULT '[]' NOT NULL,
+					[[indexes]]    JSON DEFAULT '[]' NOT NULL,
+					[[listRule]]   TEXT DEFAULT NULL,
+					[[viewRule]]   TEXT DEFAULT NULL,
+					[[createRule]] TEXT DEFAULT NULL,
+					[[updateRule]] TEXT DEFAULT NULL,
+					[[deleteRule]] TEXT DEFAULT NULL,
+					[[options]]    JSON DEFAULT '{}' NOT NULL,
+					[[created]]    TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL,
+					[[updated]]    TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL
+				);
+				CREATE INDEX IF NOT EXISTS idx__collections_type on {{_collections}} ([[type]]);`
+		}
+
+		if collectionsSql != "" {
+			_, execerr := txApp.DB().NewQuery(collectionsSql).Execute()
+			if execerr != nil {
+				return fmt.Errorf("_collections exec error: %w", execerr)
+			}
+		}
+
+		if err := createMFAsCollection(txApp); err != nil {
+			return fmt.Errorf("_mfas error: %w", err)
+		}
+
+		if err := createOTPsCollection(txApp); err != nil {
+			return fmt.Errorf("_otps error: %w", err)
+		}
+
+		if err := createExternalAuthsCollection(txApp); err != nil {
+			return fmt.Errorf("_externalAuths error: %w", err)
+		}
+
+		if err := createAuthOriginsCollection(txApp); err != nil {
+			return fmt.Errorf("_authOrigins error: %w", err)
+		}
+
+		if err := createSuperusersCollection(txApp); err != nil {
+			return fmt.Errorf("_superusers error: %w", err)
+		}
+
+		if err := createUsersCollection(txApp); err != nil {
+			return fmt.Errorf("users error: %w", err)
+		}
+
+		return nil
+	}, func(txApp core.App) error {
+		tables := []string{
+			"users",
+			core.CollectionNameSuperusers,
+			core.CollectionNameMFAs,
+			core.CollectionNameOTPs,
+			core.CollectionNameAuthOrigins,
+			"_params",
+			"_collections",
+		}
+
+		for _, name := range tables {
+			if _, err := txApp.DB().DropTable(name).Execute(); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
+func createParamsTable(txApp core.App) error {
+	driver := getDriverName(txApp.DB())
+
+	var sql string
+	if driver == "postgres" {
+		sql = `
+			CREATE TABLE {{_params}} (
+				[[id]]      TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL,
+				[[value]]   TEXT DEFAULT NULL,  -- Use TEXT because we need to cover encrypted values, which is not a valid JSON.
+				[[created]] TIMESTAMP DEFAULT NOW() NOT NULL,
+				[[updated]] TIMESTAMP DEFAULT NOW() NOT NULL
+			);`
+	} else if driver == "mysql" {
+		sql = `
+			CREATE TABLE {{_params}} (
+				[[id]]      VARCHAR(15) PRIMARY KEY NOT NULL,
+				[[value]]   TEXT,
+				[[created]] VARCHAR(50) NOT NULL,
+				[[updated]] VARCHAR(50) NOT NULL
+			);`
+	} else {
+		sql = `
+			CREATE TABLE {{_params}} (
+				[[id]]      TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL,
+				[[value]]   JSON DEFAULT NULL,
+				[[created]] TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL,
+				[[updated]] TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL
+			);`
+	}
+
+	_, execErr := txApp.DB().NewQuery(sql).Execute()
+	return execErr
+}
+
+func createMFAsCollection(txApp core.App) error {
+	col := core.NewBaseCollection(core.CollectionNameMFAs)
+	col.System = true
+
+	ownerRule := "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId"
+	col.ListRule = types.Pointer(ownerRule)
+	col.ViewRule = types.Pointer(ownerRule)
+
+	col.Fields.Add(&core.TextField{
+		Name:     "collectionRef",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.TextField{
+		Name:     "recordRef",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.TextField{
+		Name:     "method",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.AutodateField{
+		Name:     "created",
+		System:   true,
+		OnCreate: true,
+	})
+	col.Fields.Add(&core.AutodateField{
+		Name:     "updated",
+		System:   true,
+		OnCreate: true,
+		OnUpdate: true,
+	})
+	col.AddIndex("idx_mfas_collectionRef_recordRef", false, "collectionRef,recordRef", "")
+
+	return txApp.Save(col)
+}
+
+func createOTPsCollection(txApp core.App) error {
+	col := core.NewBaseCollection(core.CollectionNameOTPs)
+	col.System = true
+
+	ownerRule := "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId"
+	col.ListRule = types.Pointer(ownerRule)
+	col.ViewRule = types.Pointer(ownerRule)
+
+	col.Fields.Add(&core.TextField{
+		Name:     "collectionRef",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.TextField{
+		Name:     "recordRef",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.PasswordField{
+		Name:     "password",
+		System:   true,
+		Hidden:   true,
+		Required: true,
+		Cost:     8, // low cost for better performance and because it is not critical
+	})
+	col.Fields.Add(&core.TextField{
+		Name:   "sentTo",
+		System: true,
+		Hidden: true,
+	})
+	col.Fields.Add(&core.AutodateField{
+		Name:     "created",
+		System:   true,
+		OnCreate: true,
+	})
+	col.Fields.Add(&core.AutodateField{
+		Name:     "updated",
+		System:   true,
+		OnCreate: true,
+		OnUpdate: true,
+	})
+	col.AddIndex("idx_otps_collectionRef_recordRef", false, "collectionRef, recordRef", "")
+
+	return txApp.Save(col)
+}
+
+func createAuthOriginsCollection(txApp core.App) error {
+	col := core.NewBaseCollection(core.CollectionNameAuthOrigins)
+	col.System = true
+
+	ownerRule := "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId"
+	col.ListRule = types.Pointer(ownerRule)
+	col.ViewRule = types.Pointer(ownerRule)
+	col.DeleteRule = types.Pointer(ownerRule)
+
+	col.Fields.Add(&core.TextField{
+		Name:     "collectionRef",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.TextField{
+		Name:     "recordRef",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.TextField{
+		Name:     "fingerprint",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.AutodateField{
+		Name:     "created",
+		System:   true,
+		OnCreate: true,
+	})
+	col.Fields.Add(&core.AutodateField{
+		Name:     "updated",
+		System:   true,
+		OnCreate: true,
+		OnUpdate: true,
+	})
+	col.AddIndex("idx_authOrigins_unique_pairs", true, "collectionRef, recordRef, fingerprint", "")
+
+	return txApp.Save(col)
+}
+
+func createExternalAuthsCollection(txApp core.App) error {
+	col := core.NewBaseCollection(core.CollectionNameExternalAuths)
+	col.System = true
+
+	ownerRule := "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId"
+	col.ListRule = types.Pointer(ownerRule)
+	col.ViewRule = types.Pointer(ownerRule)
+	col.DeleteRule = types.Pointer(ownerRule)
+
+	col.Fields.Add(&core.TextField{
+		Name:     "collectionRef",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.TextField{
+		Name:     "recordRef",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.TextField{
+		Name:     "provider",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.TextField{
+		Name:     "providerId",
+		System:   true,
+		Required: true,
+	})
+	col.Fields.Add(&core.AutodateField{
+		Name:     "created",
+		System:   true,
+		OnCreate: true,
+	})
+	col.Fields.Add(&core.AutodateField{
+		Name:     "updated",
+		System:   true,
+		OnCreate: true,
+		OnUpdate: true,
+	})
+	col.AddIndex("idx_externalAuths_record_provider", true, "collectionRef, recordRef, provider", "")
+	col.AddIndex("idx_externalAuths_collection_provider", true, "collectionRef, provider, providerId", "")
+
+	return txApp.Save(col)
+}
+
+func createSuperusersCollection(txApp core.App) error {
+	superusers := core.NewAuthCollection(core.CollectionNameSuperusers)
+	superusers.System = true
+	superusers.Fields.Add(&core.EmailField{
+		Name:     "email",
+		System:   true,
+		Required: true,
+	})
+	superusers.Fields.Add(&core.AutodateField{
+		Name:     "created",
+		System:   true,
+		OnCreate: true,
+	})
+	superusers.Fields.Add(&core.AutodateField{
+		Name:     "updated",
+		System:   true,
+		OnCreate: true,
+		OnUpdate: true,
+	})
+	superusers.AuthToken.Duration = 86400 // 1 day
+
+	return txApp.Save(superusers)
+}
+
+func createUsersCollection(txApp core.App) error {
+	users := core.NewAuthCollection("users", "_pb_users_auth_")
+
+	ownerRule := "id = @request.auth.id"
+	users.ListRule = types.Pointer(ownerRule)
+	users.ViewRule = types.Pointer(ownerRule)
+	users.CreateRule = types.Pointer("")
+	users.UpdateRule = types.Pointer(ownerRule)
+	users.DeleteRule = types.Pointer(ownerRule)
+
+	users.Fields.Add(&core.TextField{
+		Name: "name",
+		Max:  255,
+	})
+	users.Fields.Add(&core.FileField{
+		Name:      "avatar",
+		MaxSelect: 1,
+		MimeTypes: []string{"image/jpeg", "image/png", "image/svg+xml", "image/gif", "image/webp"},
+	})
+	users.Fields.Add(&core.AutodateField{
+		Name:     "created",
+		OnCreate: true,
+	})
+	users.Fields.Add(&core.AutodateField{
+		Name:     "updated",
+		OnCreate: true,
+		OnUpdate: true,
+	})
+	users.OAuth2.MappedFields.Name = "name"
+	users.OAuth2.MappedFields.AvatarURL = "avatar"
+
+	return txApp.Save(users)
+}
diff --git a/server/core_backend-server/migrations/1717233556_v0.23_migrate.go b/server/core_backend-server/migrations/1717233556_v0.23_migrate.go
new file mode 100644
index 0000000..84168e0
--- /dev/null
+++ b/server/core_backend-server/migrations/1717233556_v0.23_migrate.go
@@ -0,0 +1,912 @@
+package migrations
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// note: this migration will be deleted in future version
+
+func init_disabled3() {
+	core.SystemMigrations.Register(func(txApp core.App) error {
+		// note: mfas and authOrigins tables are available only with v0.23
+		hasUpgraded := txApp.HasTable(core.CollectionNameMFAs) && txApp.HasTable(core.CollectionNameAuthOrigins)
+		if hasUpgraded {
+			return nil
+		}
+
+		oldSettings, err := loadOldSettings(txApp)
+		if err != nil {
+			return fmt.Errorf("failed to fetch old settings: %w", err)
+		}
+
+		if err = migrateOldCollections(txApp, oldSettings); err != nil {
+			return err
+		}
+
+		if err = migrateSuperusers(txApp, oldSettings); err != nil {
+			return fmt.Errorf("failed to migrate admins->superusers: %w", err)
+		}
+
+		if err = migrateSettings(txApp, oldSettings); err != nil {
+			return fmt.Errorf("failed to migrate settings: %w", err)
+		}
+
+		if err = migrateExternalAuths(txApp); err != nil {
+			return fmt.Errorf("failed to migrate externalAuths: %w", err)
+		}
+
+		if err = createMFAsCollection(txApp); err != nil {
+			return fmt.Errorf("failed to create mfas collection: %w", err)
+		}
+
+		if err = createOTPsCollection(txApp); err != nil {
+			return fmt.Errorf("failed to create otps collection: %w", err)
+		}
+
+		if err = createAuthOriginsCollection(txApp); err != nil {
+			return fmt.Errorf("failed to create authOrigins collection: %w", err)
+		}
+
+		err = os.Remove(filepath.Join(txApp.DataDir(), "logs.db"))
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			txApp.Logger().Warn("Failed to delete old logs.db file", "error", err)
+		}
+
+		return nil
+	}, nil)
+}
+
+// -------------------------------------------------------------------
+
+func migrateSuperusers(txApp core.App, oldSettings *oldSettingsModel) error {
+	// create new superusers collection and table
+	err := createSuperusersCollection(txApp)
+	if err != nil {
+		return err
+	}
+
+	// update with the token options from the old settings
+	superusersCollection, err := txApp.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		return err
+	}
+
+	superusersCollection.AuthToken.Secret = zeroFallback(
+		cast.ToString(getMapVal(oldSettings.Value, "adminAuthToken", "secret")),
+		superusersCollection.AuthToken.Secret,
+	)
+	superusersCollection.AuthToken.Duration = zeroFallback(
+		cast.ToInt64(getMapVal(oldSettings.Value, "adminAuthToken", "duration")),
+		superusersCollection.AuthToken.Duration,
+	)
+	superusersCollection.PasswordResetToken.Secret = zeroFallback(
+		cast.ToString(getMapVal(oldSettings.Value, "adminPasswordResetToken", "secret")),
+		superusersCollection.PasswordResetToken.Secret,
+	)
+	superusersCollection.PasswordResetToken.Duration = zeroFallback(
+		cast.ToInt64(getMapVal(oldSettings.Value, "adminPasswordResetToken", "duration")),
+		superusersCollection.PasswordResetToken.Duration,
+	)
+	superusersCollection.FileToken.Secret = zeroFallback(
+		cast.ToString(getMapVal(oldSettings.Value, "adminFileToken", "secret")),
+		superusersCollection.FileToken.Secret,
+	)
+	superusersCollection.FileToken.Duration = zeroFallback(
+		cast.ToInt64(getMapVal(oldSettings.Value, "adminFileToken", "duration")),
+		superusersCollection.FileToken.Duration,
+	)
+	if err = txApp.Save(superusersCollection); err != nil {
+		return fmt.Errorf("failed to migrate token configs: %w", err)
+	}
+
+	// copy old admins records into the new one
+	_, err = txApp.DB().NewQuery(`
+		INSERT INTO {{` + core.CollectionNameSuperusers + `}} ([[id]], [[verified]], [[email]], [[password]], [[tokenKey]],  [[created]], [[updated]])
+		SELECT [[id]], true, [[email]], [[passwordHash]], [[tokenKey]], [[created]], [[updated]] FROM {{_admins}};
+	`).Execute()
+	if err != nil {
+		return err
+	}
+
+	// remove old admins table
+	_, err = txApp.DB().DropTable("_admins").Execute()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+type oldSettingsModel struct {
+	Id       string         `db:"id" json:"id"`
+	Key      string         `db:"key" json:"key"`
+	RawValue types.JSONRaw  `db:"value" json:"value"`
+	Value    map[string]any `db:"-" json:"-"`
+}
+
+func loadOldSettings(txApp core.App) (*oldSettingsModel, error) {
+	oldSettings := &oldSettingsModel{Value: map[string]any{}}
+	err := txApp.DB().Select().From("_params").Where(dbx.HashExp{"key": "settings"}).One(oldSettings)
+	if err != nil {
+		return nil, err
+	}
+
+	// try without decrypt
+	plainDecodeErr := json.Unmarshal(oldSettings.RawValue, &oldSettings.Value)
+
+	// failed, try to decrypt
+	if plainDecodeErr != nil {
+		encryptionKey := os.Getenv(txApp.EncryptionEnv())
+
+		// load without decryption has failed and there is no encryption key to use for decrypt
+		if encryptionKey == "" {
+			return nil, fmt.Errorf("invalid settings db data or missing encryption key %q", txApp.EncryptionEnv())
+		}
+
+		// decrypt
+		decrypted, decryptErr := security.Decrypt(string(oldSettings.RawValue), encryptionKey)
+		if decryptErr != nil {
+			return nil, decryptErr
+		}
+
+		// decode again
+		decryptedDecodeErr := json.Unmarshal(decrypted, &oldSettings.Value)
+		if decryptedDecodeErr != nil {
+			return nil, decryptedDecodeErr
+		}
+	}
+
+	return oldSettings, nil
+}
+
+func migrateSettings(txApp core.App, oldSettings *oldSettingsModel) error {
+	// renamed old params collection
+	_, err := txApp.DB().RenameTable("_params", "_params_old").Execute()
+	if err != nil {
+		return err
+	}
+
+	// create new params table
+	err = createParamsTable(txApp)
+	if err != nil {
+		return err
+	}
+
+	// migrate old settings
+	newSettings := txApp.Settings()
+	// ---
+	newSettings.Meta.AppName = cast.ToString(getMapVal(oldSettings.Value, "meta", "appName"))
+	newSettings.Meta.AppURL = strings.TrimSuffix(cast.ToString(getMapVal(oldSettings.Value, "meta", "appUrl")), "/")
+	newSettings.Meta.HideControls = cast.ToBool(getMapVal(oldSettings.Value, "meta", "hideControls"))
+	newSettings.Meta.SenderName = cast.ToString(getMapVal(oldSettings.Value, "meta", "senderName"))
+	newSettings.Meta.SenderAddress = cast.ToString(getMapVal(oldSettings.Value, "meta", "senderAddress"))
+	// ---
+	newSettings.Logs.MaxDays = cast.ToInt(getMapVal(oldSettings.Value, "logs", "maxDays"))
+	newSettings.Logs.MinLevel = cast.ToInt(getMapVal(oldSettings.Value, "logs", "minLevel"))
+	newSettings.Logs.LogIP = cast.ToBool(getMapVal(oldSettings.Value, "logs", "logIp"))
+	// ---
+	newSettings.SMTP.Enabled = cast.ToBool(getMapVal(oldSettings.Value, "smtp", "enabled"))
+	newSettings.SMTP.Port = cast.ToInt(getMapVal(oldSettings.Value, "smtp", "port"))
+	newSettings.SMTP.Host = cast.ToString(getMapVal(oldSettings.Value, "smtp", "host"))
+	newSettings.SMTP.Username = cast.ToString(getMapVal(oldSettings.Value, "smtp", "username"))
+	newSettings.SMTP.Password = cast.ToString(getMapVal(oldSettings.Value, "smtp", "password"))
+	newSettings.SMTP.AuthMethod = cast.ToString(getMapVal(oldSettings.Value, "smtp", "authMethod"))
+	newSettings.SMTP.TLS = cast.ToBool(getMapVal(oldSettings.Value, "smtp", "tls"))
+	newSettings.SMTP.LocalName = cast.ToString(getMapVal(oldSettings.Value, "smtp", "localName"))
+	// ---
+	newSettings.Backups.Cron = cast.ToString(getMapVal(oldSettings.Value, "backups", "cron"))
+	newSettings.Backups.CronMaxKeep = cast.ToInt(getMapVal(oldSettings.Value, "backups", "cronMaxKeep"))
+	newSettings.Backups.S3 = core.S3Config{
+		Enabled:        cast.ToBool(getMapVal(oldSettings.Value, "backups", "s3", "enabled")),
+		Bucket:         cast.ToString(getMapVal(oldSettings.Value, "backups", "s3", "bucket")),
+		Region:         cast.ToString(getMapVal(oldSettings.Value, "backups", "s3", "region")),
+		Endpoint:       cast.ToString(getMapVal(oldSettings.Value, "backups", "s3", "endpoint")),
+		AccessKey:      cast.ToString(getMapVal(oldSettings.Value, "backups", "s3", "accessKey")),
+		Secret:         cast.ToString(getMapVal(oldSettings.Value, "backups", "s3", "secret")),
+		ForcePathStyle: cast.ToBool(getMapVal(oldSettings.Value, "backups", "s3", "forcePathStyle")),
+	}
+	// ---
+	newSettings.S3 = core.S3Config{
+		Enabled:        cast.ToBool(getMapVal(oldSettings.Value, "s3", "enabled")),
+		Bucket:         cast.ToString(getMapVal(oldSettings.Value, "s3", "bucket")),
+		Region:         cast.ToString(getMapVal(oldSettings.Value, "s3", "region")),
+		Endpoint:       cast.ToString(getMapVal(oldSettings.Value, "s3", "endpoint")),
+		AccessKey:      cast.ToString(getMapVal(oldSettings.Value, "s3", "accessKey")),
+		Secret:         cast.ToString(getMapVal(oldSettings.Value, "s3", "secret")),
+		ForcePathStyle: cast.ToBool(getMapVal(oldSettings.Value, "s3", "forcePathStyle")),
+	}
+	// ---
+	err = txApp.Save(newSettings)
+	if err != nil {
+		return err
+	}
+
+	// remove old params table
+	_, err = txApp.DB().DropTable("_params_old").Execute()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+func migrateExternalAuths(txApp core.App) error {
+	// renamed old externalAuths table
+	_, err := txApp.DB().RenameTable("_externalAuths", "_externalAuths_old").Execute()
+	if err != nil {
+		return err
+	}
+
+	// create new externalAuths collection and table
+	err = createExternalAuthsCollection(txApp)
+	if err != nil {
+		return err
+	}
+
+	// copy old externalAuths records into the new one
+	_, err = txApp.DB().NewQuery(`
+		INSERT INTO {{` + core.CollectionNameExternalAuths + `}} ([[id]], [[collectionRef]], [[recordRef]], [[provider]], [[providerId]], [[created]], [[updated]])
+		SELECT [[id]], [[collectionId]], [[recordId]], [[provider]], [[providerId]], [[created]], [[updated]] FROM {{_externalAuths_old}};
+	`).Execute()
+	if err != nil {
+		return err
+	}
+
+	// remove old externalAuths table
+	_, err = txApp.DB().DropTable("_externalAuths_old").Execute()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+func migrateOldCollections(txApp core.App, oldSettings *oldSettingsModel) error {
+	oldCollections := []*OldCollectionModel{}
+	err := txApp.DB().Select().From("_collections").All(&oldCollections)
+	if err != nil {
+		return err
+	}
+
+	for _, c := range oldCollections {
+		dummyAuthCollection := core.NewAuthCollection("test")
+
+		options := c.Options
+		c.Options = types.JSONMap[any]{} // reset
+
+		// update rules
+		// ---
+		c.ListRule = migrateRule(c.ListRule)
+		c.ViewRule = migrateRule(c.ViewRule)
+		c.CreateRule = migrateRule(c.CreateRule)
+		c.UpdateRule = migrateRule(c.UpdateRule)
+		c.DeleteRule = migrateRule(c.DeleteRule)
+
+		// migrate fields
+		// ---
+		for i, field := range c.Schema {
+			switch cast.ToString(field["type"]) {
+			case "bool":
+				field = toBoolField(field)
+			case "number":
+				field = toNumberField(field)
+			case "text":
+				field = toTextField(field)
+			case "url":
+				field = toURLField(field)
+			case "email":
+				field = toEmailField(field)
+			case "editor":
+				field = toEditorField(field)
+			case "date":
+				field = toDateField(field)
+			case "select":
+				field = toSelectField(field)
+			case "json":
+				field = toJSONField(field)
+			case "relation":
+				field = toRelationField(field)
+			case "file":
+				field = toFileField(field)
+			}
+			c.Schema[i] = field
+		}
+
+		// type specific changes
+		switch c.Type {
+		case "auth":
+			// token configs
+			// ---
+			c.Options["authToken"] = map[string]any{
+				"secret":   zeroFallback(cast.ToString(getMapVal(oldSettings.Value, "recordAuthToken", "secret")), dummyAuthCollection.AuthToken.Secret),
+				"duration": zeroFallback(cast.ToInt64(getMapVal(oldSettings.Value, "recordAuthToken", "duration")), dummyAuthCollection.AuthToken.Duration),
+			}
+			c.Options["passwordResetToken"] = map[string]any{
+				"secret":   zeroFallback(cast.ToString(getMapVal(oldSettings.Value, "recordPasswordResetToken", "secret")), dummyAuthCollection.PasswordResetToken.Secret),
+				"duration": zeroFallback(cast.ToInt64(getMapVal(oldSettings.Value, "recordPasswordResetToken", "duration")), dummyAuthCollection.PasswordResetToken.Duration),
+			}
+			c.Options["emailChangeToken"] = map[string]any{
+				"secret":   zeroFallback(cast.ToString(getMapVal(oldSettings.Value, "recordEmailChangeToken", "secret")), dummyAuthCollection.EmailChangeToken.Secret),
+				"duration": zeroFallback(cast.ToInt64(getMapVal(oldSettings.Value, "recordEmailChangeToken", "duration")), dummyAuthCollection.EmailChangeToken.Duration),
+			}
+			c.Options["verificationToken"] = map[string]any{
+				"secret":   zeroFallback(cast.ToString(getMapVal(oldSettings.Value, "recordVerificationToken", "secret")), dummyAuthCollection.VerificationToken.Secret),
+				"duration": zeroFallback(cast.ToInt64(getMapVal(oldSettings.Value, "recordVerificationToken", "duration")), dummyAuthCollection.VerificationToken.Duration),
+			}
+			c.Options["fileToken"] = map[string]any{
+				"secret":   zeroFallback(cast.ToString(getMapVal(oldSettings.Value, "recordFileToken", "secret")), dummyAuthCollection.FileToken.Secret),
+				"duration": zeroFallback(cast.ToInt64(getMapVal(oldSettings.Value, "recordFileToken", "duration")), dummyAuthCollection.FileToken.Duration),
+			}
+
+			onlyVerified := cast.ToBool(options["onlyVerified"])
+			if onlyVerified {
+				c.Options["authRule"] = "verified=true"
+			} else {
+				c.Options["authRule"] = ""
+			}
+
+			c.Options["manageRule"] = nil
+			if options["manageRule"] != nil {
+				manageRule, err := cast.ToStringE(options["manageRule"])
+				if err == nil && manageRule != "" {
+					c.Options["manageRule"] = migrateRule(&manageRule)
+				}
+			}
+
+			// passwordAuth
+			identityFields := []string{}
+			if cast.ToBool(options["allowEmailAuth"]) {
+				identityFields = append(identityFields, "email")
+			}
+			if cast.ToBool(options["allowUsernameAuth"]) {
+				identityFields = append(identityFields, "username")
+			}
+			c.Options["passwordAuth"] = map[string]any{
+				"enabled":        len(identityFields) > 0,
+				"identityFields": identityFields,
+			}
+
+			// oauth2
+			// ---
+			oauth2Providers := []map[string]any{}
+			providerNames := []string{
+				"googleAuth",
+				"facebookAuth",
+				"githubAuth",
+				"gitlabAuth",
+				"discordAuth",
+				"twitterAuth",
+				"microsoftAuth",
+				"spotifyAuth",
+				"kakaoAuth",
+				"twitchAuth",
+				"stravaAuth",
+				"giteeAuth",
+				"livechatAuth",
+				"giteaAuth",
+				"oidcAuth",
+				"oidc2Auth",
+				"oidc3Auth",
+				"appleAuth",
+				"instagramAuth",
+				"vkAuth",
+				"yandexAuth",
+				"patreonAuth",
+				"mailcowAuth",
+				"bitbucketAuth",
+				"planningcenterAuth",
+			}
+			for _, name := range providerNames {
+				if !cast.ToBool(getMapVal(oldSettings.Value, name, "enabled")) {
+					continue
+				}
+				oauth2Providers = append(oauth2Providers, map[string]any{
+					"name":         strings.TrimSuffix(name, "Auth"),
+					"clientId":     cast.ToString(getMapVal(oldSettings.Value, name, "clientId")),
+					"clientSecret": cast.ToString(getMapVal(oldSettings.Value, name, "clientSecret")),
+					"authURL":      cast.ToString(getMapVal(oldSettings.Value, name, "authUrl")),
+					"tokenURL":     cast.ToString(getMapVal(oldSettings.Value, name, "tokenUrl")),
+					"userInfoURL":  cast.ToString(getMapVal(oldSettings.Value, name, "userApiUrl")),
+					"displayName":  cast.ToString(getMapVal(oldSettings.Value, name, "displayName")),
+					"pkce":         getMapVal(oldSettings.Value, name, "pkce"),
+				})
+			}
+
+			c.Options["oauth2"] = map[string]any{
+				"enabled":   cast.ToBool(options["allowOAuth2Auth"]) && len(oauth2Providers) > 0,
+				"providers": oauth2Providers,
+				"mappedFields": map[string]string{
+					"username": "username",
+				},
+			}
+
+			// default email templates
+			// ---
+			emailTemplates := map[string]core.EmailTemplate{
+				"verificationTemplate":       dummyAuthCollection.VerificationTemplate,
+				"resetPasswordTemplate":      dummyAuthCollection.ResetPasswordTemplate,
+				"confirmEmailChangeTemplate": dummyAuthCollection.ConfirmEmailChangeTemplate,
+			}
+			for name, fallback := range emailTemplates {
+				c.Options[name] = map[string]any{
+					"subject": zeroFallback(
+						cast.ToString(getMapVal(oldSettings.Value, "meta", name, "subject")),
+						fallback.Subject,
+					),
+					"body": zeroFallback(
+						strings.ReplaceAll(
+							cast.ToString(getMapVal(oldSettings.Value, "meta", name, "body")),
+							"{ACTION_URL}",
+							cast.ToString(getMapVal(oldSettings.Value, "meta", name, "actionUrl")),
+						),
+						fallback.Body,
+					),
+				}
+			}
+
+			// mfa
+			// ---
+			c.Options["mfa"] = map[string]any{
+				"enabled":  dummyAuthCollection.MFA.Enabled,
+				"duration": dummyAuthCollection.MFA.Duration,
+				"rule":     dummyAuthCollection.MFA.Rule,
+			}
+
+			// otp
+			// ---
+			c.Options["otp"] = map[string]any{
+				"enabled":  dummyAuthCollection.OTP.Enabled,
+				"duration": dummyAuthCollection.OTP.Duration,
+				"length":   dummyAuthCollection.OTP.Length,
+				"emailTemplate": map[string]any{
+					"subject": dummyAuthCollection.OTP.EmailTemplate.Subject,
+					"body":    dummyAuthCollection.OTP.EmailTemplate.Body,
+				},
+			}
+
+			// auth alerts
+			// ---
+			c.Options["authAlert"] = map[string]any{
+				"enabled": dummyAuthCollection.AuthAlert.Enabled,
+				"emailTemplate": map[string]any{
+					"subject": dummyAuthCollection.AuthAlert.EmailTemplate.Subject,
+					"body":    dummyAuthCollection.AuthAlert.EmailTemplate.Body,
+				},
+			}
+
+			// add system field indexes
+			// ---
+			c.Indexes = append(types.JSONArray[string]{
+				fmt.Sprintf("CREATE UNIQUE INDEX `_%s_username_idx` ON `%s` (username COLLATE NOCASE)", c.Id, c.Name),
+				fmt.Sprintf("CREATE UNIQUE INDEX `_%s_email_idx` ON `%s` (`email`) WHERE `email` != ''", c.Id, c.Name),
+				fmt.Sprintf("CREATE UNIQUE INDEX `_%s_tokenKey_idx` ON `%s` (`tokenKey`)", c.Id, c.Name),
+			}, c.Indexes...)
+
+			// prepend the auth system fields
+			// ---
+			tokenKeyField := map[string]any{
+				"id":                  fieldIdChecksum("text", "tokenKey"),
+				"type":                "text",
+				"name":                "tokenKey",
+				"system":              true,
+				"hidden":              true,
+				"required":            true,
+				"presentable":         false,
+				"primaryKey":          false,
+				"min":                 30,
+				"max":                 60,
+				"pattern":             "",
+				"autogeneratePattern": "[a-zA-Z0-9_]{50}",
+			}
+			passwordField := map[string]any{
+				"id":          fieldIdChecksum("password", "password"),
+				"type":        "password",
+				"name":        "password",
+				"presentable": false,
+				"system":      true,
+				"hidden":      true,
+				"required":    true,
+				"pattern":     "",
+				"min":         cast.ToInt(options["minPasswordLength"]),
+				"cost":        bcrypt.DefaultCost, // new default
+			}
+			emailField := map[string]any{
+				"id":            fieldIdChecksum("email", "email"),
+				"type":          "email",
+				"name":          "email",
+				"system":        true,
+				"hidden":        false,
+				"presentable":   false,
+				"required":      cast.ToBool(options["requireEmail"]),
+				"exceptDomains": cast.ToStringSlice(options["exceptEmailDomains"]),
+				"onlyDomains":   cast.ToStringSlice(options["onlyEmailDomains"]),
+			}
+			emailVisibilityField := map[string]any{
+				"id":          fieldIdChecksum("bool", "emailVisibility"),
+				"type":        "bool",
+				"name":        "emailVisibility",
+				"system":      true,
+				"hidden":      false,
+				"presentable": false,
+				"required":    false,
+			}
+			verifiedField := map[string]any{
+				"id":          fieldIdChecksum("bool", "verified"),
+				"type":        "bool",
+				"name":        "verified",
+				"system":      true,
+				"hidden":      false,
+				"presentable": false,
+				"required":    false,
+			}
+			usernameField := map[string]any{
+				"id":                  fieldIdChecksum("text", "username"),
+				"type":                "text",
+				"name":                "username",
+				"system":              false,
+				"hidden":              false,
+				"required":            true,
+				"presentable":         false,
+				"primaryKey":          false,
+				"min":                 3,
+				"max":                 150,
+				"pattern":             `^[\w][\w\.\-]*$`,
+				"autogeneratePattern": "users[0-9]{6}",
+			}
+			c.Schema = append(types.JSONArray[types.JSONMap[any]]{
+				passwordField,
+				tokenKeyField,
+				emailField,
+				emailVisibilityField,
+				verifiedField,
+				usernameField,
+			}, c.Schema...)
+
+			// rename passwordHash records rable column to password
+			// ---
+			_, err = txApp.DB().RenameColumn(c.Name, "passwordHash", "password").Execute()
+			if err != nil {
+				return err
+			}
+
+			// delete unnecessary auth columns
+			dropColumns := []string{"lastResetSentAt", "lastVerificationSentAt", "lastLoginAlertSentAt"}
+			for _, drop := range dropColumns {
+				// ignore errors in case the columns don't exist
+				_, _ = txApp.DB().DropColumn(c.Name, drop).Execute()
+			}
+		case "view":
+			c.Options["viewQuery"] = cast.ToString(options["query"])
+		}
+
+		// prepend the id field
+		idField := map[string]any{
+			"id":                  fieldIdChecksum("text", "id"),
+			"type":                "text",
+			"name":                "id",
+			"system":              true,
+			"required":            true,
+			"presentable":         false,
+			"hidden":              false,
+			"primaryKey":          true,
+			"min":                 15,
+			"max":                 15,
+			"pattern":             "^[a-z0-9]+$",
+			"autogeneratePattern": "[a-z0-9]{15}",
+		}
+		c.Schema = append(types.JSONArray[types.JSONMap[any]]{idField}, c.Schema...)
+
+		var addCreated, addUpdated bool
+
+		if c.Type == "view" {
+			// manually check if the view has created/updated columns
+			columns, _ := txApp.TableColumns(c.Name)
+			for _, c := range columns {
+				if strings.EqualFold(c, "created") {
+					addCreated = true
+				} else if strings.EqualFold(c, "updated") {
+					addUpdated = true
+				}
+			}
+		} else {
+			addCreated = true
+			addUpdated = true
+		}
+
+		if addCreated {
+			createdField := map[string]any{
+				"id":          fieldIdChecksum("autodate", "created"),
+				"type":        "autodate",
+				"name":        "created",
+				"system":      false,
+				"presentable": false,
+				"hidden":      false,
+				"onCreate":    true,
+				"onUpdate":    false,
+			}
+			c.Schema = append(c.Schema, createdField)
+		}
+
+		if addUpdated {
+			updatedField := map[string]any{
+				"id":          fieldIdChecksum("autodate", "updated"),
+				"type":        "autodate",
+				"name":        "updated",
+				"system":      false,
+				"presentable": false,
+				"hidden":      false,
+				"onCreate":    true,
+				"onUpdate":    true,
+			}
+			c.Schema = append(c.Schema, updatedField)
+		}
+
+		if err = txApp.DB().Model(c).Update(); err != nil {
+			return err
+		}
+	}
+
+	_, err = txApp.DB().RenameColumn("_collections", "schema", "fields").Execute()
+	if err != nil {
+		return err
+	}
+
+	// run collection validations
+	collections, err := txApp.FindAllCollections()
+	if err != nil {
+		return fmt.Errorf("failed to retrieve all collections: %w", err)
+	}
+	for _, c := range collections {
+		err = txApp.Validate(c)
+		if err != nil {
+			return fmt.Errorf("migrated collection %q validation failure: %w", c.Name, err)
+		}
+	}
+
+	return nil
+}
+
+type OldCollectionModel struct {
+	Id         string                              `db:"id" json:"id"`
+	Created    types.DateTime                      `db:"created" json:"created"`
+	Updated    types.DateTime                      `db:"updated" json:"updated"`
+	Name       string                              `db:"name" json:"name"`
+	Type       string                              `db:"type" json:"type"`
+	System     bool                                `db:"system" json:"system"`
+	Schema     types.JSONArray[types.JSONMap[any]] `db:"schema" json:"schema"`
+	Indexes    types.JSONArray[string]             `db:"indexes" json:"indexes"`
+	ListRule   *string                             `db:"listRule" json:"listRule"`
+	ViewRule   *string                             `db:"viewRule" json:"viewRule"`
+	CreateRule *string                             `db:"createRule" json:"createRule"`
+	UpdateRule *string                             `db:"updateRule" json:"updateRule"`
+	DeleteRule *string                             `db:"deleteRule" json:"deleteRule"`
+	Options    types.JSONMap[any]                  `db:"options" json:"options"`
+}
+
+func (c OldCollectionModel) TableName() string {
+	return "_collections"
+}
+
+func migrateRule(rule *string) *string {
+	if rule == nil {
+		return nil
+	}
+
+	str := strings.ReplaceAll(*rule, "@request.data", "@request.body")
+
+	return &str
+}
+
+func toBoolField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":        "bool",
+		"id":          cast.ToString(data["id"]),
+		"name":        cast.ToString(data["name"]),
+		"system":      cast.ToBool(data["system"]),
+		"required":    cast.ToBool(data["required"]),
+		"presentable": cast.ToBool(data["presentable"]),
+		"hidden":      false,
+	}
+}
+
+func toNumberField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":        "number",
+		"id":          cast.ToString(data["id"]),
+		"name":        cast.ToString(data["name"]),
+		"system":      cast.ToBool(data["system"]),
+		"required":    cast.ToBool(data["required"]),
+		"presentable": cast.ToBool(data["presentable"]),
+		"hidden":      false,
+		"onlyInt":     cast.ToBool(getMapVal(data, "options", "noDecimal")),
+		"min":         getMapVal(data, "options", "min"),
+		"max":         getMapVal(data, "options", "max"),
+	}
+}
+
+func toTextField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":                "text",
+		"id":                  cast.ToString(data["id"]),
+		"name":                cast.ToString(data["name"]),
+		"system":              cast.ToBool(data["system"]),
+		"primaryKey":          cast.ToBool(data["primaryKey"]),
+		"hidden":              cast.ToBool(data["hidden"]),
+		"presentable":         cast.ToBool(data["presentable"]),
+		"required":            cast.ToBool(data["required"]),
+		"min":                 cast.ToInt(getMapVal(data, "options", "min")),
+		"max":                 cast.ToInt(getMapVal(data, "options", "max")),
+		"pattern":             cast.ToString(getMapVal(data, "options", "pattern")),
+		"autogeneratePattern": cast.ToString(getMapVal(data, "options", "autogeneratePattern")),
+	}
+}
+
+func toEmailField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":          "email",
+		"id":            cast.ToString(data["id"]),
+		"name":          cast.ToString(data["name"]),
+		"system":        cast.ToBool(data["system"]),
+		"required":      cast.ToBool(data["required"]),
+		"presentable":   cast.ToBool(data["presentable"]),
+		"hidden":        false,
+		"exceptDomains": cast.ToStringSlice(getMapVal(data, "options", "exceptDomains")),
+		"onlyDomains":   cast.ToStringSlice(getMapVal(data, "options", "onlyDomains")),
+	}
+}
+
+func toURLField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":          "url",
+		"id":            cast.ToString(data["id"]),
+		"name":          cast.ToString(data["name"]),
+		"system":        cast.ToBool(data["system"]),
+		"required":      cast.ToBool(data["required"]),
+		"presentable":   cast.ToBool(data["presentable"]),
+		"hidden":        false,
+		"exceptDomains": cast.ToStringSlice(getMapVal(data, "options", "exceptDomains")),
+		"onlyDomains":   cast.ToStringSlice(getMapVal(data, "options", "onlyDomains")),
+	}
+}
+
+func toEditorField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":        "editor",
+		"id":          cast.ToString(data["id"]),
+		"name":        cast.ToString(data["name"]),
+		"system":      cast.ToBool(data["system"]),
+		"required":    cast.ToBool(data["required"]),
+		"presentable": cast.ToBool(data["presentable"]),
+		"hidden":      false,
+		"convertURLs": cast.ToBool(getMapVal(data, "options", "convertUrls")),
+	}
+}
+
+func toDateField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":        "date",
+		"id":          cast.ToString(data["id"]),
+		"name":        cast.ToString(data["name"]),
+		"system":      cast.ToBool(data["system"]),
+		"required":    cast.ToBool(data["required"]),
+		"presentable": cast.ToBool(data["presentable"]),
+		"hidden":      false,
+		"min":         cast.ToString(getMapVal(data, "options", "min")),
+		"max":         cast.ToString(getMapVal(data, "options", "max")),
+	}
+}
+
+func toJSONField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":        "json",
+		"id":          cast.ToString(data["id"]),
+		"name":        cast.ToString(data["name"]),
+		"system":      cast.ToBool(data["system"]),
+		"required":    cast.ToBool(data["required"]),
+		"presentable": cast.ToBool(data["presentable"]),
+		"hidden":      false,
+		"maxSize":     cast.ToInt64(getMapVal(data, "options", "maxSize")),
+	}
+}
+
+func toSelectField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":        "select",
+		"id":          cast.ToString(data["id"]),
+		"name":        cast.ToString(data["name"]),
+		"system":      cast.ToBool(data["system"]),
+		"required":    cast.ToBool(data["required"]),
+		"presentable": cast.ToBool(data["presentable"]),
+		"hidden":      false,
+		"values":      cast.ToStringSlice(getMapVal(data, "options", "values")),
+		"maxSelect":   cast.ToInt(getMapVal(data, "options", "maxSelect")),
+	}
+}
+
+func toRelationField(data map[string]any) map[string]any {
+	maxSelect := cast.ToInt(getMapVal(data, "options", "maxSelect"))
+	if maxSelect <= 0 {
+		maxSelect = 2147483647
+	}
+
+	return map[string]any{
+		"type":          "relation",
+		"id":            cast.ToString(data["id"]),
+		"name":          cast.ToString(data["name"]),
+		"system":        cast.ToBool(data["system"]),
+		"required":      cast.ToBool(data["required"]),
+		"presentable":   cast.ToBool(data["presentable"]),
+		"hidden":        false,
+		"collectionId":  cast.ToString(getMapVal(data, "options", "collectionId")),
+		"cascadeDelete": cast.ToBool(getMapVal(data, "options", "cascadeDelete")),
+		"minSelect":     cast.ToInt(getMapVal(data, "options", "minSelect")),
+		"maxSelect":     maxSelect,
+	}
+}
+
+func toFileField(data map[string]any) map[string]any {
+	return map[string]any{
+		"type":        "file",
+		"id":          cast.ToString(data["id"]),
+		"name":        cast.ToString(data["name"]),
+		"system":      cast.ToBool(data["system"]),
+		"required":    cast.ToBool(data["required"]),
+		"presentable": cast.ToBool(data["presentable"]),
+		"hidden":      false,
+		"maxSelect":   cast.ToInt(getMapVal(data, "options", "maxSelect")),
+		"maxSize":     cast.ToInt64(getMapVal(data, "options", "maxSize")),
+		"thumbs":      cast.ToStringSlice(getMapVal(data, "options", "thumbs")),
+		"mimeTypes":   cast.ToStringSlice(getMapVal(data, "options", "mimeTypes")),
+		"protected":   cast.ToBool(getMapVal(data, "options", "protected")),
+	}
+}
+
+func getMapVal(m map[string]any, keys ...string) any {
+	if len(keys) == 0 {
+		return nil
+	}
+
+	result, ok := m[keys[0]]
+	if !ok {
+		return nil
+	}
+
+	// end key reached
+	if len(keys) == 1 {
+		return result
+	}
+
+	if m, ok = result.(map[string]any); !ok {
+		return nil
+	}
+
+	return getMapVal(m, keys[1:]...)
+}
+
+func zeroFallback[T comparable](v T, fallback T) T {
+	var zero T
+
+	if v == zero {
+		return fallback
+	}
+
+	return v
+}
diff --git a/server/core_backend-server/migrations/1717233557_v0.23_migrate2.go b/server/core_backend-server/migrations/1717233557_v0.23_migrate2.go
new file mode 100644
index 0000000..63df74a
--- /dev/null
+++ b/server/core_backend-server/migrations/1717233557_v0.23_migrate2.go
@@ -0,0 +1,35 @@
+package migrations
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// note: this migration will be deleted in future version
+
+func init_disabled4() {
+	core.SystemMigrations.Register(func(txApp core.App) error {
+		_, err := txApp.DB().NewQuery("CREATE INDEX IF NOT EXISTS idx__collections_type on {{_collections}} ([[type]]);").Execute()
+		if err != nil {
+			return err
+		}
+
+		// reset mfas and otps delete rule
+		collectionNames := []string{core.CollectionNameMFAs, core.CollectionNameOTPs}
+		for _, name := range collectionNames {
+			col, err := txApp.FindCollectionByNameOrId(name)
+			if err != nil {
+				return err
+			}
+
+			if col.DeleteRule != nil {
+				col.DeleteRule = nil
+				err = txApp.SaveNoValidate(col)
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	}, nil)
+}
diff --git a/server/core_backend-server/migrations/1717233558_v0.23_migrate3.go b/server/core_backend-server/migrations/1717233558_v0.23_migrate3.go
new file mode 100644
index 0000000..76fd266
--- /dev/null
+++ b/server/core_backend-server/migrations/1717233558_v0.23_migrate3.go
@@ -0,0 +1,145 @@
+package migrations
+
+import (
+	"hash/crc32"
+	"strconv"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// note: this migration will be deleted in future version
+
+func collectionIdChecksum(typ, name string) string {
+	return "obc_" + strconv.FormatInt(int64(crc32.ChecksumIEEE([]byte(typ+name))), 10)
+}
+
+func fieldIdChecksum(typ, name string) string {
+	return typ + strconv.FormatInt(int64(crc32.ChecksumIEEE([]byte(name))), 10)
+}
+
+// normalize system collection and field ids
+func init_disabled5() {
+	core.SystemMigrations.Register(func(txApp core.App) error {
+		collections := []*core.Collection{}
+		err := txApp.CollectionQuery().
+			AndWhere(dbx.In(
+				"name",
+				core.CollectionNameMFAs,
+				core.CollectionNameOTPs,
+				core.CollectionNameExternalAuths,
+				core.CollectionNameAuthOrigins,
+				core.CollectionNameSuperusers,
+			)).
+			All(&collections)
+		if err != nil {
+			return err
+		}
+
+		for _, c := range collections {
+			var needUpdate bool
+
+			references, err := txApp.FindCollectionReferences(c, c.Id)
+			if err != nil {
+				return err
+			}
+
+			authOrigins, err := txApp.FindAllAuthOriginsByCollection(c)
+			if err != nil {
+				return err
+			}
+
+			mfas, err := txApp.FindAllMFAsByCollection(c)
+			if err != nil {
+				return err
+			}
+
+			otps, err := txApp.FindAllOTPsByCollection(c)
+			if err != nil {
+				return err
+			}
+
+			originalId := c.Id
+
+			// normalize collection id
+			if checksum := collectionIdChecksum(c.Type, c.Name); c.Id != checksum {
+				c.Id = checksum
+				needUpdate = true
+			}
+
+			// normalize system fields
+			for _, f := range c.Fields {
+				if !f.GetSystem() {
+					continue
+				}
+
+				if checksum := fieldIdChecksum(f.Type(), f.GetName()); f.GetId() != checksum {
+					f.SetId(checksum)
+					needUpdate = true
+				}
+			}
+
+			if !needUpdate {
+				continue
+			}
+
+			rawExport, err := c.DBExport(txApp)
+			if err != nil {
+				return err
+			}
+
+			_, err = txApp.DB().Update("_collections", rawExport, dbx.HashExp{"id": originalId}).Execute()
+			if err != nil {
+				return err
+			}
+
+			// make sure that the cached collection id is also updated
+			cached, err := txApp.FindCachedCollectionByNameOrId(c.Name)
+			if err != nil {
+				return err
+			}
+			cached.Id = c.Id
+
+			// update collection references
+			for refCollection, fields := range references {
+				for _, f := range fields {
+					relationField, ok := f.(*core.RelationField)
+					if !ok || relationField.CollectionId == originalId {
+						continue
+					}
+
+					relationField.CollectionId = c.Id
+				}
+				if err = txApp.SaveNoValidate(refCollection); err != nil {
+					return err
+				}
+			}
+
+			// update mfas references
+			for _, item := range mfas {
+				item.SetCollectionRef(c.Id)
+				if err = txApp.SaveNoValidate(item); err != nil {
+					return err
+				}
+			}
+
+			// update otps references
+			for _, item := range otps {
+				item.SetCollectionRef(c.Id)
+				if err = txApp.SaveNoValidate(item); err != nil {
+					return err
+				}
+			}
+
+			// update authOrigins references
+			for _, item := range authOrigins {
+				item.SetCollectionRef(c.Id)
+				if err = txApp.SaveNoValidate(item); err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	}, nil)
+}
diff --git a/server/core_backend-server/migrations/1717233559_v0.23_migrate4.go b/server/core_backend-server/migrations/1717233559_v0.23_migrate4.go
new file mode 100644
index 0000000..92d7c92
--- /dev/null
+++ b/server/core_backend-server/migrations/1717233559_v0.23_migrate4.go
@@ -0,0 +1,30 @@
+package migrations
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// note: this migration will be deleted in future version
+
+// add new OTP sentTo text field (if not already)
+func init_disabled6() {
+	core.SystemMigrations.Register(func(txApp core.App) error {
+		otpCollection, err := txApp.FindCollectionByNameOrId(core.CollectionNameOTPs)
+		if err != nil {
+			return err
+		}
+
+		field := otpCollection.Fields.GetByName("sentTo")
+		if field != nil {
+			return nil // already exists
+		}
+
+		otpCollection.Fields.Add(&core.TextField{
+			Name:   "sentTo",
+			System: true,
+			Hidden: true,
+		})
+
+		return txApp.Save(otpCollection)
+	}, nil)
+}
diff --git a/server/core_backend-server/migrations/1763020353_update_default_auth_alert_templates.go b/server/core_backend-server/migrations/1763020353_update_default_auth_alert_templates.go
new file mode 100644
index 0000000..ca93667
--- /dev/null
+++ b/server/core_backend-server/migrations/1763020353_update_default_auth_alert_templates.go
@@ -0,0 +1,62 @@
+package migrations
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+)
+
+const oldAuthAlertTemplate = `<p>Hello,</p>
+<p>We noticed a login to your {APP_NAME} account from a new location.</p>
+<p>If this was you, you may disregard this email.</p>
+<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>
+<p>
+  Thanks,<br/>
+  {APP_NAME} team
+</p>`
+
+func init() {
+	core.SystemMigrations.Register(func(txApp core.App) error {
+		collections, err := txApp.FindAllCollections(core.CollectionTypeAuth)
+		if err != nil {
+			return err
+		}
+
+		newTemplate := core.NewAuthCollection("up").AuthAlert.EmailTemplate.Body
+
+		for _, c := range collections {
+			if c.AuthAlert.EmailTemplate.Body != oldAuthAlertTemplate {
+				continue
+			}
+
+			c.AuthAlert.EmailTemplate.Body = newTemplate
+
+			err = txApp.Save(c)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}, func(txApp core.App) error {
+		collections, err := txApp.FindAllCollections(core.CollectionTypeAuth)
+		if err != nil {
+			return err
+		}
+
+		newTemplate := core.NewAuthCollection("down").AuthAlert.EmailTemplate.Body
+
+		for _, c := range collections {
+			if c.AuthAlert.EmailTemplate.Body != newTemplate {
+				continue
+			}
+
+			c.AuthAlert.EmailTemplate.Body = oldAuthAlertTemplate
+
+			err = txApp.Save(c)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
diff --git a/server/core_backend-server/migrations/db_driver.go b/server/core_backend-server/migrations/db_driver.go
new file mode 100644
index 0000000..369e7d6
--- /dev/null
+++ b/server/core_backend-server/migrations/db_driver.go
@@ -0,0 +1,51 @@
+package migrations
+
+import (
+	"strings"
+
+	"github.com/pocketbase/dbx"
+)
+
+// isPostgres checks if the provided database builder is using the PostgreSQL driver.
+func isPostgres(db dbx.Builder) bool {
+	// We check if the table pg_proc exists, which is a system table in PostgreSQL.
+	// This is a reliable way to detect PostgreSQL at runtime without needing
+	// access to the unexported driver name in dbx.
+	var exists bool
+	err := db.NewQuery("SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'pg_proc')").Row(&exists)
+	if err != nil {
+		// If the query fails, it's likely not PostgreSQL (e.g. SQLite doesn't have information_schema.tables)
+		return false
+	}
+	// Note: in PostgreSQL specifically, pg_proc is in pg_catalog, but information_schema works too
+	// Actually, let's try a simpler one:
+	_, err = db.NewQuery("SELECT version()").Execute()
+	if err != nil {
+		return false
+	}
+	return true
+}
+
+// getDriverName returns the driver name for the provided database builder.
+func getDriverName(db dbx.Builder) string {
+	// PostgreSQL supports 'SELECT version()'
+	var version string
+	err := db.NewQuery("SELECT version()").Row(&version)
+	if err == nil {
+		if strings.Contains(strings.ToLower(version), "postgres") {
+			return "postgres"
+		}
+		// Assume MySQL if version() works but not postgres
+		// (MariaDB also returns version string usually without postgres)
+		return "mysql"
+	}
+
+	// SQLite supports 'SELECT sqlite_version()'
+	var sqliteVersion string
+	err = db.NewQuery("SELECT sqlite_version()").Row(&sqliteVersion)
+	if err == nil {
+		return "sqlite"
+	}
+
+	return "unknown"
+}
diff --git a/server/core_backend-server/migrations/postgres_functions.go b/server/core_backend-server/migrations/postgres_functions.go
new file mode 100644
index 0000000..10209ad
--- /dev/null
+++ b/server/core_backend-server/migrations/postgres_functions.go
@@ -0,0 +1,103 @@
+package migrations
+
+import "github.com/pocketbase/dbx"
+
+func createSQLiteEquivalentFunctions(db dbx.Builder) error {
+	if getDriverName(db) != "postgres" {
+		return nil
+	}
+
+	//PostgreSQL:
+	// 1. Check existance
+	sql := `SELECT EXISTS (SELECT 1 FROM pg_proc WHERE proname = 'uuid_generate_v7');`
+	var exists bool
+	if err := db.NewQuery(sql).Row(&exists); err != nil {
+		return err
+	} else if exists {
+		// The function already exists, no need to create it again
+		return nil
+	}
+
+	// Postgres:
+	// 2. Create function
+	funcDef := `
+	-- Enable built-in pgcrypto extension to use gen_random_bytes function
+	CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+	-- Adding "nocase" collation to be compatible with SQLite's built-in "nocase" collation
+	CREATE COLLATION IF NOT EXISTS "nocase" (
+		provider = icu,          -- Specify ICU as the provider
+		locale = 'und-u-ks-level2', -- Undetermined locale, Unicode extension (-u-), collation strength (ks) level 2 (level2)
+		deterministic = false    -- Case-insensitive collations are typically non-deterministic
+	);
+
+	-- Alias [hex] to encode(..., 'hex')
+	CREATE OR REPLACE FUNCTION hex(data bytea)
+	RETURNS text
+	LANGUAGE SQL
+	IMMUTABLE
+	AS $$
+	SELECT encode(data, 'hex')
+	$$;
+
+	-- Alias [randomblob] to gen_random_bytes(...)
+	CREATE OR REPLACE FUNCTION randomblob(length integer)
+	RETURNS bytea
+	LANGUAGE SQL
+	IMMUTABLE
+	AS $$
+	SELECT gen_random_bytes(length)
+	$$;
+
+	-- Create the uuid_generate_v7 function
+	create or replace function uuid_generate_v7()
+		returns uuid
+		as $$
+		begin
+		-- use random v4 uuid as starting point (which has the same variant we need)
+		-- then overlay timestamp
+		-- then set version 7 by flipping the 2 and 1 bit in the version 4 string
+		return encode(
+			set_bit(
+			set_bit(
+				overlay(uuid_send(gen_random_uuid())
+						placing substring(int8send(floor(extract(epoch from clock_timestamp()) * 1000)::bigint) from 3)
+						from 1 for 6
+				),
+				52, 1
+			),
+			53, 1
+			),
+			'hex')::uuid;
+		end
+		$$
+		language plpgsql
+		volatile;
+	
+	-- Create json_valid function
+	CREATE OR REPLACE FUNCTION json_valid(text) RETURNS boolean AS $$
+	BEGIN
+		PERFORM $1::jsonb;
+		RETURN TRUE;
+	EXCEPTION WHEN others THEN
+		RETURN FALSE;
+	END;
+	$$ LANGUAGE plpgsql IMMUTABLE;
+
+	-- Create a json_query_or_null function that handles any types.
+	CREATE OR REPLACE FUNCTION json_query_or_null(p_input jsonb, p_query text) RETURNS jsonb AS $$
+		SELECT JSON_QUERY(p_input, p_query)
+	$$ LANGUAGE sql IMMUTABLE;
+
+	-- Create a json_query_or_null function that handles any types.
+	CREATE OR REPLACE FUNCTION json_query_or_null(p_input anyelement, p_query text) RETURNS jsonb AS $$
+	BEGIN
+		RETURN JSON_QUERY(p_input::text::jsonb, p_query);
+	EXCEPTION WHEN others THEN
+		RETURN NULL;
+	END;
+	$$ LANGUAGE plpgsql STABLE;
+	`
+	_, err := db.NewQuery(funcDef).Execute()
+	return err
+}
diff --git a/server/core_backend-server/modernc_versions_check.go b/server/core_backend-server/modernc_versions_check.go
new file mode 100644
index 0000000..fad8080
--- /dev/null
+++ b/server/core_backend-server/modernc_versions_check.go
@@ -0,0 +1,83 @@
+package pocketbase
+
+import (
+	"fmt"
+	"log/slog"
+	"runtime/debug"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+const (
+	expectedDriverVersion = "v1.41.0"
+	expectedLibcVersion   = "v1.66.10"
+
+	// ModerncDepsCheckHookId is the id of the hook that performs the modernc.org/* deps checks.
+	// It could be used for removing/unbinding the hook if you don't want the checks.
+	ModerncDepsCheckHookId = "pbModerncDepsCheck"
+)
+
+// checkModerncDeps checks whether the current binary was buit with the
+// expected and tested modernc driver dependencies.
+//
+// This is needed because modernc.org/libc doesn't follow semantic versioning
+// and using a version different from the one in the go.mod of modernc.org/sqlite
+// could have unintended side-effects and cause obscure build and runtime bugs
+// (https://github.com/pocketbase/pocketbase/issues/6136).
+func checkModerncDeps(app core.App) {
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return // no build info (probably compiled without module support)
+	}
+
+	var driverVersion, libcVersion string
+
+	for _, dep := range info.Deps {
+		switch dep.Path {
+		case "modernc.org/libc":
+			libcVersion = dep.Version
+		case "modernc.org/sqlite":
+			driverVersion = dep.Version
+		}
+
+		// no need to further search if both deps are located
+		if driverVersion != "" && libcVersion != "" {
+			break
+		}
+	}
+
+	// not using the default driver
+	if driverVersion == "" {
+		return
+	}
+
+	var msg string
+	if driverVersion != expectedDriverVersion {
+		msg = fmt.Sprintf(
+			"You are using modernc.org/sqlite %s which differs from the expected and tested %s.\n"+
+				"Make sure to either manually update in your go.mod the dependency version to the expected one OR if you want to keep yours "+
+				"ensure that its indirect modernc.org/libc dependency has the same version as in the https://gitlab.com/cznic/sqlite/-/blob/master/go.mod, "+
+				"otherwise it could result in unexpected build or runtime errors.",
+			driverVersion,
+			expectedDriverVersion,
+		)
+		app.Logger().Warn(msg, slog.String("current", driverVersion), slog.String("expected", expectedDriverVersion))
+	} else if libcVersion != expectedLibcVersion {
+		msg = fmt.Sprintf(
+			"You are using modernc.org/libc %s which differs from the expected and tested %s.\n"+
+				"Please update your go.mod and manually set modernc.org/libc to %s, otherwise it could result in unexpected build or runtime errors "+
+				"(you may have to also run 'go clean -modcache' to clear the cache if the warning persists).",
+			libcVersion,
+			expectedLibcVersion,
+			expectedLibcVersion,
+		)
+		app.Logger().Warn(msg, slog.String("current", libcVersion), slog.String("expected", expectedLibcVersion))
+	}
+
+	// ensure that the message is printed to the default stderr too
+	// (when in dev mode this is not needed because we print all logs)
+	if msg != "" && !app.IsDev() {
+		color.Yellow("\nWARN " + msg + "\n\n")
+	}
+}
diff --git a/server/core_backend-server/pb_data/types.d.ts b/server/core_backend-server/pb_data/types.d.ts
new file mode 100644
index 0000000..2503831
--- /dev/null
+++ b/server/core_backend-server/pb_data/types.d.ts
@@ -0,0 +1,23030 @@
+// 1746911627
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+// -------------------------------------------------------------------
+// cronBinds
+// -------------------------------------------------------------------
+
+/**
+ * CronAdd registers a new cron job.
+ *
+ * If a cron job with the specified name already exist, it will be
+ * replaced with the new one.
+ *
+ * Example:
+ *
+ * ```js
+ * // prints "Hello world!" on every 30 minutes
+ * cronAdd("hello", "*\/30 * * * *", () => {
+ *     console.log("Hello world!")
+ * })
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function cronAdd(
+  jobId:    string,
+  cronExpr: string,
+  handler:  () => void,
+): void;
+
+/**
+ * CronRemove removes a single registered cron job by its name.
+ *
+ * Example:
+ *
+ * ```js
+ * cronRemove("hello")
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function cronRemove(jobId: string): void;
+
+// -------------------------------------------------------------------
+// routerBinds
+// -------------------------------------------------------------------
+
+/**
+ * RouterAdd registers a new route definition.
+ *
+ * Example:
+ *
+ * ```js
+ * routerAdd("GET", "/hello", (e) => {
+ *     return e.json(200, {"message": "Hello!"})
+ * }, $apis.requireAuth())
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function routerAdd(
+  method: string,
+  path: string,
+  handler: (e: core.RequestEvent) => void,
+  ...middlewares: Array<string|((e: core.RequestEvent) => void)|Middleware>,
+): void;
+
+/**
+ * RouterUse registers one or more global middlewares that are executed
+ * along the handler middlewares after a matching route is found.
+ *
+ * Example:
+ *
+ * ```js
+ * routerUse((e) => {
+ *   console.log(e.request.url.path)
+ *   return e.next()
+ * })
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function routerUse(...middlewares: Array<string|((e: core.RequestEvent) => void)|Middleware>): void;
+
+// -------------------------------------------------------------------
+// baseBinds
+// -------------------------------------------------------------------
+
+/**
+ * Global helper variable that contains the absolute path to the app pb_hooks directory.
+ *
+ * @group PocketBase
+ */
+declare var __hooks: string
+
+// Utility type to exclude the on* hook methods from a type
+// (hooks are separately generated as global methods).
+//
+// See https://www.typescriptlang.org/docs/handbook/2/mapped-types.html#key-remapping-via-as
+type excludeHooks<Type> = {
+    [Property in keyof Type as Exclude<Property, `on${string}`|'cron'>]: Type[Property]
+};
+
+// CoreApp without the on* hook methods
+type CoreApp = excludeHooks<core.App>
+
+// PocketBase without the on* hook methods
+type PocketBase = excludeHooks<pocketbase.PocketBase>
+
+/**
+ * `$app` is the current running PocketBase instance that is globally
+ * available in each .pb.js file.
+ *
+ * _Note that this variable is available only in pb_hooks context._
+ *
+ * @namespace
+ * @group PocketBase
+ */
+declare var $app: PocketBase
+
+/**
+ * `$template` is a global helper to load and cache HTML templates on the fly.
+ *
+ * The templates uses the standard Go [html/template](https://pkg.go.dev/html/template)
+ * and [text/template](https://pkg.go.dev/text/template) package syntax.
+ *
+ * Example:
+ *
+ * ```js
+ * const html = $template.loadFiles(
+ *     "views/layout.html",
+ *     "views/content.html",
+ * ).render({"name": "John"})
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @namespace
+ * @group PocketBase
+ */
+declare var $template: template.Registry
+
+/**
+ * This method is superseded by toString.
+ *
+ * @deprecated
+ * @group PocketBase
+ */
+declare function readerToString(reader: any, maxBytes?: number): string;
+
+/**
+ * toString stringifies the specified value.
+ *
+ * Support optional second maxBytes argument to limit the max read bytes
+ * when the value is a io.Reader (default to 32MB).
+ *
+ * Types that don't have explicit string representation are json serialized.
+ *
+ * Example:
+ *
+ * ```js
+ * // io.Reader
+ * const ex1 = toString(e.request.body)
+ *
+ * // slice of bytes ("hello")
+ * const ex2 = toString([104 101 108 108 111])
+ * ```
+ *
+ * @group PocketBase
+ */
+declare function toString(val: any, maxBytes?: number): string;
+
+/**
+ * sleep pauses the current goroutine for at least the specified user duration (in ms).
+ * A zero or negative duration returns immediately.
+ *
+ * Example:
+ *
+ * ```js
+ * sleep(250) // sleeps for 250ms
+ * ```
+ *
+ * @group PocketBase
+ */
+declare function sleep(milliseconds: number): void;
+
+/**
+ * arrayOf creates a placeholder array of the specified models.
+ * Usually used to populate DB result into an array of models.
+ *
+ * Example:
+ *
+ * ```js
+ * const records = arrayOf(new Record)
+ *
+ * $app.recordQuery("articles").limit(10).all(records)
+ * ```
+ *
+ * @group PocketBase
+ */
+declare function arrayOf<T>(model: T): Array<T>;
+
+/**
+ * DynamicModel creates a new dynamic model with fields from the provided data shape.
+ *
+ * Note that in order to use 0 as double/float initialization number you have to use negative zero (`-0`).
+ *
+ * Example:
+ *
+ * ```js
+ * const model = new DynamicModel({
+ *     name:       ""
+ *     age:        0,  // int64
+ *     totalSpent: -0, // float64
+ *     active:     false,
+ *     roles:      [],
+ *     meta:       {}
+ * })
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class DynamicModel {
+  constructor(shape?: { [key:string]: any })
+}
+
+interface Context extends context.Context{} // merge
+/**
+ * Context creates a new empty Go context.Context.
+ *
+ * This is usually used as part of some Go transitive bindings.
+ *
+ * Example:
+ *
+ * ```js
+ * const blank = new Context()
+ *
+ * // with single key-value pair
+ * const base = new Context(null, "a", 123)
+ * console.log(base.value("a")) // 123
+ *
+ * // extend with additional key-value pair
+ * const sub = new Context(base, "b", 456)
+ * console.log(sub.value("a")) // 123
+ * console.log(sub.value("b")) // 456
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Context implements context.Context {
+  constructor(parentCtx?: Context, key?: any, value?: any)
+}
+
+/**
+ * Record model class.
+ *
+ * ```js
+ * const collection = $app.findCollectionByNameOrId("article")
+ *
+ * const record = new Record(collection, {
+ *     title: "Lorem ipsum"
+ * })
+ *
+ * // or set field values after the initialization
+ * record.set("description", "...")
+ * ```
+ *
+ * @group PocketBase
+ */
+declare const Record: {
+  new(collection?: core.Collection, data?: { [key:string]: any }): core.Record
+
+  // note: declare as "newable" const due to conflict with the Record TS utility type
+}
+
+interface Collection extends core.Collection{
+  type: "base" | "view" | "auth"
+} // merge
+/**
+ * Collection model class.
+ *
+ * ```js
+ * const collection = new Collection({
+ *     type:       "base",
+ *     name:       "article",
+ *     listRule:   "@request.auth.id != '' || status = 'public'",
+ *     viewRule:   "@request.auth.id != '' || status = 'public'",
+ *     deleteRule: "@request.auth.id != ''",
+ *     fields: [
+ *         {
+ *             name: "title",
+ *             type: "text",
+ *             required: true,
+ *             min: 6,
+ *             max: 100,
+ *         },
+ *         {
+ *             name: "description",
+ *             type: "text",
+ *         },
+ *     ]
+ * })
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Collection implements core.Collection {
+  constructor(data?: Partial<Collection>)
+}
+
+interface FieldsList extends core.FieldsList{} // merge
+/**
+ * FieldsList model class, usually used to define the Collection.fields.
+ *
+ * @group PocketBase
+ */
+declare class FieldsList implements core.FieldsList {
+  constructor(data?: Partial<core.FieldsList>)
+}
+
+interface Field extends core.Field{} // merge
+/**
+ * Field model class, usually used as part of the FieldsList model.
+ *
+ * @group PocketBase
+ */
+declare class Field implements core.Field {
+  constructor(data?: Partial<core.Field>)
+}
+
+interface NumberField extends core.NumberField{} // merge
+/**
+ * {@inheritDoc core.NumberField}
+ *
+ * @group PocketBase
+ */
+declare class NumberField implements core.NumberField {
+  constructor(data?: Partial<core.NumberField>)
+}
+
+interface BoolField extends core.BoolField{} // merge
+/**
+ * {@inheritDoc core.BoolField}
+ *
+ * @group PocketBase
+ */
+declare class BoolField implements core.BoolField {
+  constructor(data?: Partial<core.BoolField>)
+}
+
+interface TextField extends core.TextField{} // merge
+/**
+ * {@inheritDoc core.TextField}
+ *
+ * @group PocketBase
+ */
+declare class TextField implements core.TextField {
+  constructor(data?: Partial<core.TextField>)
+}
+
+interface URLField extends core.URLField{} // merge
+/**
+ * {@inheritDoc core.URLField}
+ *
+ * @group PocketBase
+ */
+declare class URLField implements core.URLField {
+  constructor(data?: Partial<core.URLField>)
+}
+
+interface EmailField extends core.EmailField{} // merge
+/**
+ * {@inheritDoc core.EmailField}
+ *
+ * @group PocketBase
+ */
+declare class EmailField implements core.EmailField {
+  constructor(data?: Partial<core.EmailField>)
+}
+
+interface EditorField extends core.EditorField{} // merge
+/**
+ * {@inheritDoc core.EditorField}
+ *
+ * @group PocketBase
+ */
+declare class EditorField implements core.EditorField {
+  constructor(data?: Partial<core.EditorField>)
+}
+
+interface PasswordField extends core.PasswordField{} // merge
+/**
+ * {@inheritDoc core.PasswordField}
+ *
+ * @group PocketBase
+ */
+declare class PasswordField implements core.PasswordField {
+  constructor(data?: Partial<core.PasswordField>)
+}
+
+interface DateField extends core.DateField{} // merge
+/**
+ * {@inheritDoc core.DateField}
+ *
+ * @group PocketBase
+ */
+declare class DateField implements core.DateField {
+  constructor(data?: Partial<core.DateField>)
+}
+
+interface AutodateField extends core.AutodateField{} // merge
+/**
+ * {@inheritDoc core.AutodateField}
+ *
+ * @group PocketBase
+ */
+declare class AutodateField implements core.AutodateField {
+  constructor(data?: Partial<core.AutodateField>)
+}
+
+interface JSONField extends core.JSONField{} // merge
+/**
+ * {@inheritDoc core.JSONField}
+ *
+ * @group PocketBase
+ */
+declare class JSONField implements core.JSONField {
+  constructor(data?: Partial<core.JSONField>)
+}
+
+interface RelationField extends core.RelationField{} // merge
+/**
+ * {@inheritDoc core.RelationField}
+ *
+ * @group PocketBase
+ */
+declare class RelationField implements core.RelationField {
+  constructor(data?: Partial<core.RelationField>)
+}
+
+interface SelectField extends core.SelectField{} // merge
+/**
+ * {@inheritDoc core.SelectField}
+ *
+ * @group PocketBase
+ */
+declare class SelectField implements core.SelectField {
+  constructor(data?: Partial<core.SelectField>)
+}
+
+interface FileField extends core.FileField{} // merge
+/**
+ * {@inheritDoc core.FileField}
+ *
+ * @group PocketBase
+ */
+declare class FileField implements core.FileField {
+  constructor(data?: Partial<core.FileField>)
+}
+
+interface GeoPointField extends core.GeoPointField{} // merge
+/**
+ * {@inheritDoc core.GeoPointField}
+ *
+ * @group PocketBase
+ */
+declare class GeoPointField implements core.GeoPointField {
+  constructor(data?: Partial<core.GeoPointField>)
+}
+
+interface MailerMessage extends mailer.Message{} // merge
+/**
+ * MailerMessage defines a single email message.
+ *
+ * ```js
+ * const message = new MailerMessage({
+ *     from: {
+ *         address: $app.settings().meta.senderAddress,
+ *         name:    $app.settings().meta.senderName,
+ *     },
+ *     to:      [{address: "test@example.com"}],
+ *     subject: "YOUR_SUBJECT...",
+ *     html:    "YOUR_HTML_BODY...",
+ * })
+ *
+ * $app.newMailClient().send(message)
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class MailerMessage implements mailer.Message {
+  constructor(message?: Partial<mailer.Message>)
+}
+
+interface Command extends cobra.Command{} // merge
+/**
+ * Command defines a single console command.
+ *
+ * Example:
+ *
+ * ```js
+ * const command = new Command({
+ *     use: "hello",
+ *     run: (cmd, args) => { console.log("Hello world!") },
+ * })
+ *
+ * $app.rootCmd.addCommand(command);
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Command implements cobra.Command {
+  constructor(cmd?: Partial<cobra.Command>)
+}
+
+/**
+ * RequestInfo defines a single core.RequestInfo instance, usually used
+ * as part of various filter checks.
+ *
+ * Example:
+ *
+ * ```js
+ * const authRecord = $app.findAuthRecordByEmail("users", "test@example.com")
+ *
+ * const info = new RequestInfo({
+ *     auth:    authRecord,
+ *     body:    {"name": 123},
+ *     headers: {"x-token": "..."},
+ * })
+ *
+ * const record = $app.findFirstRecordByData("articles", "slug", "hello")
+ *
+ * const canAccess = $app.canAccessRecord(record, info, "@request.auth.id != '' && @request.body.name = 123")
+ * ```
+ *
+ * @group PocketBase
+ */
+declare const RequestInfo: {
+  new(info?: Partial<core.RequestInfo>): core.RequestInfo
+
+ // note: declare as "newable" const due to conflict with the RequestInfo TS node type
+}
+
+/**
+ * Middleware defines a single request middleware handler.
+ *
+ * This class is usually used when you want to explicitly specify a priority to your custom route middleware.
+ *
+ * Example:
+ *
+ * ```js
+ * routerUse(new Middleware((e) => {
+ *   console.log(e.request.url.path)
+ *   return e.next()
+ * }, -10))
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Middleware {
+  constructor(
+    func: string|((e: core.RequestEvent) => void),
+    priority?: number,
+    id?: string,
+  )
+}
+
+interface Timezone extends time.Location{} // merge
+/**
+ * Timezone returns the timezone location with the given name.
+ *
+ * The name is expected to be a location name corresponding to a file
+ * in the IANA Time Zone database, such as "America/New_York".
+ *
+ * If the name is "Local", LoadLocation returns Local.
+ *
+ * If the name is "", invalid or "UTC", returns UTC.
+ *
+ * The constructor is equivalent to calling the Go `time.LoadLocation(name)` method.
+ *
+ * Example:
+ *
+ * ```js
+ * const zone = new Timezone("America/New_York")
+ * $app.cron().setTimezone(zone)
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Timezone implements time.Location {
+  constructor(name?: string)
+}
+
+interface DateTime extends types.DateTime{} // merge
+/**
+ * DateTime defines a single DateTime type instance.
+ * The returned date is always represented in UTC.
+ *
+ * Example:
+ *
+ * ```js
+ * const dt0 = new DateTime() // now
+ *
+ * // full datetime string
+ * const dt1 = new DateTime('2023-07-01 00:00:00.000Z')
+ *
+ * // datetime string with default "parse in" timezone location
+ * //
+ * // similar to new DateTime('2023-07-01 00:00:00 +01:00') or new DateTime('2023-07-01 00:00:00 +02:00')
+ * // but accounts for the daylight saving time (DST)
+ * const dt2 = new DateTime('2023-07-01 00:00:00', 'Europe/Amsterdam')
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class DateTime implements types.DateTime {
+  constructor(date?: string, defaultParseInLocation?: string)
+}
+
+interface ValidationError extends ozzo_validation.Error{} // merge
+/**
+ * ValidationError defines a single formatted data validation error,
+ * usually used as part of an error response.
+ *
+ * ```js
+ * new ValidationError("invalid_title", "Title is not valid")
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class ValidationError implements ozzo_validation.Error {
+  constructor(code?: string, message?: string)
+}
+
+interface Cookie extends http.Cookie{} // merge
+/**
+ * A Cookie represents an HTTP cookie as sent in the Set-Cookie header of an
+ * HTTP response.
+ *
+ * Example:
+ *
+ * ```js
+ * routerAdd("POST", "/example", (c) => {
+ *     c.setCookie(new Cookie({
+ *         name:     "example_name",
+ *         value:    "example_value",
+ *         path:     "/",
+ *         domain:   "example.com",
+ *         maxAge:   10,
+ *         secure:   true,
+ *         httpOnly: true,
+ *         sameSite: 3,
+ *     }))
+ *
+ *     return c.redirect(200, "/");
+ * })
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Cookie implements http.Cookie {
+  constructor(options?: Partial<http.Cookie>)
+}
+
+interface SubscriptionMessage extends subscriptions.Message{} // merge
+/**
+ * SubscriptionMessage defines a realtime subscription payload.
+ *
+ * Example:
+ *
+ * ```js
+ * onRealtimeConnectRequest((e) => {
+ *     e.client.send(new SubscriptionMessage({
+ *         name: "example",
+ *         data: '{"greeting": "Hello world"}'
+ *     }))
+ * })
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class SubscriptionMessage implements subscriptions.Message {
+  constructor(options?: Partial<subscriptions.Message>)
+}
+
+// -------------------------------------------------------------------
+// dbxBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$dbx` defines common utility for working with the DB abstraction.
+ * For examples and guides please check the [Database guide](https://pocketbase.io/docs/js-database).
+ *
+ * @group PocketBase
+ */
+declare namespace $dbx {
+  /**
+   * {@inheritDoc dbx.HashExp}
+   */
+  export function hashExp(pairs: { [key:string]: any }): dbx.Expression
+
+  let _in: dbx._in
+  export { _in as in }
+
+  export let exp:        dbx.newExp
+  export let not:        dbx.not
+  export let and:        dbx.and
+  export let or:         dbx.or
+  export let notIn:      dbx.notIn
+  export let like:       dbx.like
+  export let orLike:     dbx.orLike
+  export let notLike:    dbx.notLike
+  export let orNotLike:  dbx.orNotLike
+  export let exists:     dbx.exists
+  export let notExists:  dbx.notExists
+  export let between:    dbx.between
+  export let notBetween: dbx.notBetween
+}
+
+// -------------------------------------------------------------------
+// mailsBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$mails` defines helpers to send common
+ * auth records emails like verification, password reset, etc.
+ *
+ * @group PocketBase
+ */
+declare namespace $mails {
+  let sendRecordPasswordReset: mails.sendRecordPasswordReset
+  let sendRecordVerification:  mails.sendRecordVerification
+  let sendRecordChangeEmail:   mails.sendRecordChangeEmail
+  let sendRecordOTP:           mails.sendRecordOTP
+}
+
+// -------------------------------------------------------------------
+// securityBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$security` defines low level helpers for creating
+ * and parsing JWTs, random string generation, AES encryption, etc.
+ *
+ * @group PocketBase
+ */
+declare namespace $security {
+  let randomString:                   security.randomString
+  let randomStringWithAlphabet:       security.randomStringWithAlphabet
+  let randomStringByRegex:            security.randomStringByRegex
+  let pseudorandomString:             security.pseudorandomString
+  let pseudorandomStringWithAlphabet: security.pseudorandomStringWithAlphabet
+  let encrypt:                        security.encrypt
+  let decrypt:                        security.decrypt
+  let hs256:                          security.hs256
+  let hs512:                          security.hs512
+  let equal:                          security.equal
+  let md5:                            security.md5
+  let sha256:                         security.sha256
+  let sha512:                         security.sha512
+
+  /**
+   * {@inheritDoc security.newJWT}
+   */
+  export function createJWT(payload: { [key:string]: any }, signingKey: string, secDuration: number): string
+
+  /**
+   * {@inheritDoc security.parseUnverifiedJWT}
+   */
+  export function parseUnverifiedJWT(token: string): _TygojaDict
+
+  /**
+   * {@inheritDoc security.parseJWT}
+   */
+  export function parseJWT(token: string, verificationKey: string): _TygojaDict
+}
+
+// -------------------------------------------------------------------
+// filesystemBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$filesystem` defines common helpers for working
+ * with the PocketBase filesystem abstraction.
+ *
+ * @group PocketBase
+ */
+declare namespace $filesystem {
+  let fileFromPath:      filesystem.newFileFromPath
+  let fileFromBytes:     filesystem.newFileFromBytes
+  let fileFromMultipart: filesystem.newFileFromMultipart
+
+  /**
+   * fileFromURL creates a new File from the provided url by
+   * downloading the resource and creating a BytesReader.
+   *
+   * Example:
+   *
+   * ```js
+   * // with default max timeout of 120sec
+   * const file1 = $filesystem.fileFromURL("https://...")
+   *
+   * // with custom timeout of 15sec
+   * const file2 = $filesystem.fileFromURL("https://...", 15)
+   * ```
+   */
+  export function fileFromURL(url: string, secTimeout?: number): filesystem.File
+}
+
+// -------------------------------------------------------------------
+// filepathBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$filepath` defines common helpers for manipulating filename
+ * paths in a way compatible with the target operating system-defined file paths.
+ *
+ * @group PocketBase
+ */
+declare namespace $filepath {
+  export let base:      filepath.base
+  export let clean:     filepath.clean
+  export let dir:       filepath.dir
+  export let ext:       filepath.ext
+  export let fromSlash: filepath.fromSlash
+  export let glob:      filepath.glob
+  export let isAbs:     filepath.isAbs
+  export let join:      filepath.join
+  export let match:     filepath.match
+  export let rel:       filepath.rel
+  export let split:     filepath.split
+  export let splitList: filepath.splitList
+  export let toSlash:   filepath.toSlash
+  export let walk:      filepath.walk
+  export let walkDir:   filepath.walkDir
+}
+
+// -------------------------------------------------------------------
+// osBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$os` defines common helpers for working with the OS level primitives
+ * (eg. deleting directories, executing shell commands, etc.).
+ *
+ * @group PocketBase
+ */
+declare namespace $os {
+  /**
+   * Legacy alias for $os.cmd().
+   */
+  export let exec: exec.command
+
+  /**
+   * Prepares an external OS command.
+   *
+   * Example:
+   *
+   * ```js
+   * // prepare the command to execute
+   * const cmd = $os.cmd('ls', '-sl')
+   *
+   * // execute the command and return its standard output as string
+   * const output = toString(cmd.output());
+   * ```
+   */
+  export let cmd: exec.command
+
+  /**
+   * Args hold the command-line arguments, starting with the program name.
+   */
+  export let args: Array<string>
+
+  export let exit:      os.exit
+  export let getenv:    os.getenv
+  export let dirFS:     os.dirFS
+  export let readFile:  os.readFile
+  export let writeFile: os.writeFile
+  export let stat:      os.stat
+  export let readDir:   os.readDir
+  export let tempDir:   os.tempDir
+  export let truncate:  os.truncate
+  export let getwd:     os.getwd
+  export let mkdir:     os.mkdir
+  export let mkdirAll:  os.mkdirAll
+  export let rename:    os.rename
+  export let remove:    os.remove
+  export let removeAll: os.removeAll
+}
+
+// -------------------------------------------------------------------
+// formsBinds
+// -------------------------------------------------------------------
+
+interface AppleClientSecretCreateForm extends forms.AppleClientSecretCreate{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class AppleClientSecretCreateForm implements forms.AppleClientSecretCreate {
+  constructor(app: CoreApp)
+}
+
+interface RecordUpsertForm extends forms.RecordUpsert{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class RecordUpsertForm implements forms.RecordUpsert {
+  constructor(app: CoreApp, record: core.Record)
+}
+
+interface TestEmailSendForm extends forms.TestEmailSend{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class TestEmailSendForm implements forms.TestEmailSend {
+  constructor(app: CoreApp)
+}
+
+interface TestS3FilesystemForm extends forms.TestS3Filesystem{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class TestS3FilesystemForm implements forms.TestS3Filesystem {
+  constructor(app: CoreApp)
+}
+
+// -------------------------------------------------------------------
+// apisBinds
+// -------------------------------------------------------------------
+
+interface ApiError extends router.ApiError{} // merge
+/**
+ * @inheritDoc
+ *
+ * @group PocketBase
+ */
+declare class ApiError implements router.ApiError {
+  constructor(status?: number, message?: string, data?: any)
+}
+
+interface NotFoundError extends router.ApiError{} // merge
+/**
+ * NotFounderor returns 404 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class NotFoundError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface BadRequestError extends router.ApiError{} // merge
+/**
+ * BadRequestError returns 400 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class BadRequestError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface ForbiddenError extends router.ApiError{} // merge
+/**
+ * ForbiddenError returns 403 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class ForbiddenError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface UnauthorizedError extends router.ApiError{} // merge
+/**
+ * UnauthorizedError returns 401 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class UnauthorizedError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface TooManyRequestsError extends router.ApiError{} // merge
+/**
+ * TooManyRequestsError returns 429 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class TooManyRequestsError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface InternalServerError extends router.ApiError{} // merge
+/**
+ * InternalServerError returns 429 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class InternalServerError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+/**
+ * `$apis` defines commonly used PocketBase api helpers and middlewares.
+ *
+ * @group PocketBase
+ */
+declare namespace $apis {
+  /**
+   * Route handler to serve static directory content (html, js, css, etc.).
+   *
+   * If a file resource is missing and indexFallback is set, the request
+   * will be forwarded to the base index.html (useful for SPA).
+   */
+  export function static(dir: string, indexFallback: boolean): (e: core.RequestEvent) => void
+
+  let requireGuestOnly:              apis.requireGuestOnly
+  let requireAuth:                   apis.requireAuth
+  let requireSuperuserAuth:          apis.requireSuperuserAuth
+  let requireSuperuserOrOwnerAuth:   apis.requireSuperuserOrOwnerAuth
+  let skipSuccessActivityLog:        apis.skipSuccessActivityLog
+  let gzip:                          apis.gzip
+  let bodyLimit:                     apis.bodyLimit
+  let enrichRecord:                  apis.enrichRecord
+  let enrichRecords:                 apis.enrichRecords
+
+  /**
+   * RecordAuthResponse writes standardized json record auth response
+   * into the specified request event.
+   *
+   * The authMethod argument specify the name of the current authentication method (eg. password, oauth2, etc.)
+   * that it is used primarily as an auth identifier during MFA and for login alerts.
+   *
+   * Set authMethod to empty string if you want to ignore the MFA checks and the login alerts
+   * (can be also adjusted additionally via the onRecordAuthRequest hook).
+   */
+  export function recordAuthResponse(e: core.RequestEvent, authRecord: core.Record, authMethod: string, meta?: any): void
+}
+
+// -------------------------------------------------------------------
+// httpClientBinds
+// -------------------------------------------------------------------
+
+// extra FormData overload to prevent TS warnings when used with non File/Blob value.
+interface FormData {
+  append(key:string, value:any): void
+  set(key:string, value:any): void
+}
+
+/**
+ * `$http` defines common methods for working with HTTP requests.
+ *
+ * @group PocketBase
+ */
+declare namespace $http {
+  /**
+   * Sends a single HTTP request.
+   *
+   * Example:
+   *
+   * ```js
+   * const res = $http.send({
+   *     method:  "POST",
+   *     url:     "https://example.com",
+   *     body:    JSON.stringify({"title": "test"}),
+   *     headers: { 'Content-Type': 'application/json' }
+   * })
+   *
+   * console.log(res.statusCode) // the response HTTP status code
+   * console.log(res.headers)    // the response headers (eg. res.headers['X-Custom'][0])
+   * console.log(res.cookies)    // the response cookies (eg. res.cookies.sessionId.value)
+   * console.log(res.body)       // the response body as raw bytes slice
+   * console.log(res.json)       // the response body as parsed json array or map
+   * ```
+   */
+  function send(config: {
+    url:      string,
+    body?:    string|FormData,
+    method?:  string, // default to "GET"
+    headers?: { [key:string]: string },
+    timeout?: number, // default to 120
+
+    // @deprecated please use body instead
+    data?: { [key:string]: any },
+  }): {
+    statusCode: number,
+    headers:    { [key:string]: Array<string> },
+    cookies:    { [key:string]: http.Cookie },
+    json:       any,
+    body:       Array<number>,
+
+    // @deprecated please use toString(result.body) instead
+    raw: string,
+  };
+}
+
+// -------------------------------------------------------------------
+// migrate only
+// -------------------------------------------------------------------
+
+/**
+ * Migrate defines a single migration upgrade/downgrade action.
+ *
+ * _Note that this method is available only in pb_migrations context._
+ *
+ * @group PocketBase
+ */
+declare function migrate(
+  up: (txApp: CoreApp) => void,
+  down?: (txApp: CoreApp) => void
+): void;
+/** @group PocketBase */declare function onBackupCreate(handler: (e: core.BackupEvent) => void): void
+/** @group PocketBase */declare function onBackupRestore(handler: (e: core.BackupEvent) => void): void
+/** @group PocketBase */declare function onBatchRequest(handler: (e: core.BatchRequestEvent) => void): void
+/** @group PocketBase */declare function onBootstrap(handler: (e: core.BootstrapEvent) => void): void
+/** @group PocketBase */declare function onCollectionAfterCreateError(handler: (e: core.CollectionErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterCreateSuccess(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterDeleteError(handler: (e: core.CollectionErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterDeleteSuccess(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterUpdateError(handler: (e: core.CollectionErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterUpdateSuccess(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionCreate(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionCreateExecute(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionCreateRequest(handler: (e: core.CollectionRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionDelete(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionDeleteExecute(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionDeleteRequest(handler: (e: core.CollectionRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionUpdate(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionUpdateExecute(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionUpdateRequest(handler: (e: core.CollectionRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionValidate(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionViewRequest(handler: (e: core.CollectionRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionsImportRequest(handler: (e: core.CollectionsImportRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionsListRequest(handler: (e: core.CollectionsListRequestEvent) => void): void
+/** @group PocketBase */declare function onFileDownloadRequest(handler: (e: core.FileDownloadRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onFileTokenRequest(handler: (e: core.FileTokenRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordAuthAlertSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordEmailChangeSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordOTPSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordPasswordResetSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordVerificationSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerSend(handler: (e: core.MailerEvent) => void): void
+/** @group PocketBase */declare function onModelAfterCreateError(handler: (e: core.ModelErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterCreateSuccess(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterDeleteError(handler: (e: core.ModelErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterDeleteSuccess(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterUpdateError(handler: (e: core.ModelErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterUpdateSuccess(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelCreate(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelCreateExecute(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelDelete(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelDeleteExecute(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelUpdate(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelUpdateExecute(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelValidate(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRealtimeConnectRequest(handler: (e: core.RealtimeConnectRequestEvent) => void): void
+/** @group PocketBase */declare function onRealtimeMessageSend(handler: (e: core.RealtimeMessageEvent) => void): void
+/** @group PocketBase */declare function onRealtimeSubscribeRequest(handler: (e: core.RealtimeSubscribeRequestEvent) => void): void
+/** @group PocketBase */declare function onRecordAfterCreateError(handler: (e: core.RecordErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterCreateSuccess(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterDeleteError(handler: (e: core.RecordErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterDeleteSuccess(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterUpdateError(handler: (e: core.RecordErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterUpdateSuccess(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthRefreshRequest(handler: (e: core.RecordAuthRefreshRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthRequest(handler: (e: core.RecordAuthRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthWithOAuth2Request(handler: (e: core.RecordAuthWithOAuth2RequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthWithOTPRequest(handler: (e: core.RecordAuthWithOTPRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthWithPasswordRequest(handler: (e: core.RecordAuthWithPasswordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordConfirmEmailChangeRequest(handler: (e: core.RecordConfirmEmailChangeRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordConfirmPasswordResetRequest(handler: (e: core.RecordConfirmPasswordResetRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordConfirmVerificationRequest(handler: (e: core.RecordConfirmVerificationRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordCreate(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordCreateExecute(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordCreateRequest(handler: (e: core.RecordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordDelete(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordDeleteExecute(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordDeleteRequest(handler: (e: core.RecordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordEnrich(handler: (e: core.RecordEnrichEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordRequestEmailChangeRequest(handler: (e: core.RecordRequestEmailChangeRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordRequestOTPRequest(handler: (e: core.RecordCreateOTPRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordRequestPasswordResetRequest(handler: (e: core.RecordRequestPasswordResetRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordRequestVerificationRequest(handler: (e: core.RecordRequestVerificationRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordUpdate(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordUpdateExecute(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordUpdateRequest(handler: (e: core.RecordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordValidate(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordViewRequest(handler: (e: core.RecordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordsListRequest(handler: (e: core.RecordsListRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onSettingsListRequest(handler: (e: core.SettingsListRequestEvent) => void): void
+/** @group PocketBase */declare function onSettingsReload(handler: (e: core.SettingsReloadEvent) => void): void
+/** @group PocketBase */declare function onSettingsUpdateRequest(handler: (e: core.SettingsUpdateRequestEvent) => void): void
+/** @group PocketBase */declare function onTerminate(handler: (e: core.TerminateEvent) => void): void
+type _TygojaDict = { [key:string | number | symbol]: any; }
+type _TygojaAny = any
+
+/**
+ * Package os provides a platform-independent interface to operating system
+ * functionality. The design is Unix-like, although the error handling is
+ * Go-like; failing calls return values of type error rather than error numbers.
+ * Often, more information is available within the error. For example,
+ * if a call that takes a file name fails, such as [Open] or [Stat], the error
+ * will include the failing file name when printed and will be of type
+ * [*PathError], which may be unpacked for more information.
+ * 
+ * The os interface is intended to be uniform across all operating systems.
+ * Features not generally available appear in the system-specific package syscall.
+ * 
+ * Here is a simple example, opening a file and reading some of it.
+ * 
+ * ```
+ * 	file, err := os.Open("file.go") // For read access.
+ * 	if err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * ```
+ * 
+ * If the open fails, the error string will be self-explanatory, like
+ * 
+ * ```
+ * 	open file.go: no such file or directory
+ * ```
+ * 
+ * The file's data can then be read into a slice of bytes. Read and
+ * Write take their byte counts from the length of the argument slice.
+ * 
+ * ```
+ * 	data := make([]byte, 100)
+ * 	count, err := file.Read(data)
+ * 	if err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * 	fmt.Printf("read %d bytes: %q\n", count, data[:count])
+ * ```
+ * 
+ * # Concurrency
+ * 
+ * The methods of [File] correspond to file system operations. All are
+ * safe for concurrent use. The maximum number of concurrent
+ * operations on a File may be limited by the OS or the system. The
+ * number should be high, but exceeding it may degrade performance or
+ * cause other issues.
+ */
+namespace os {
+ interface readdirMode extends Number{}
+ interface File {
+  /**
+   * Readdir reads the contents of the directory associated with file and
+   * returns a slice of up to n [FileInfo] values, as would be returned
+   * by [Lstat], in directory order. Subsequent calls on the same file will yield
+   * further FileInfos.
+   * 
+   * If n > 0, Readdir returns at most n FileInfo structures. In this case, if
+   * Readdir returns an empty slice, it will return a non-nil error
+   * explaining why. At the end of a directory, the error is [io.EOF].
+   * 
+   * If n <= 0, Readdir returns all the FileInfo from the directory in
+   * a single slice. In this case, if Readdir succeeds (reads all
+   * the way to the end of the directory), it returns the slice and a
+   * nil error. If it encounters an error before the end of the
+   * directory, Readdir returns the FileInfo read until that point
+   * and a non-nil error.
+   * 
+   * Most clients are better served by the more efficient ReadDir method.
+   */
+  readdir(n: number): Array<FileInfo>
+ }
+ interface File {
+  /**
+   * Readdirnames reads the contents of the directory associated with file
+   * and returns a slice of up to n names of files in the directory,
+   * in directory order. Subsequent calls on the same file will yield
+   * further names.
+   * 
+   * If n > 0, Readdirnames returns at most n names. In this case, if
+   * Readdirnames returns an empty slice, it will return a non-nil error
+   * explaining why. At the end of a directory, the error is [io.EOF].
+   * 
+   * If n <= 0, Readdirnames returns all the names from the directory in
+   * a single slice. In this case, if Readdirnames succeeds (reads all
+   * the way to the end of the directory), it returns the slice and a
+   * nil error. If it encounters an error before the end of the
+   * directory, Readdirnames returns the names read until that point and
+   * a non-nil error.
+   */
+  readdirnames(n: number): Array<string>
+ }
+ /**
+  * A DirEntry is an entry read from a directory
+  * (using the [ReadDir] function or a [File.ReadDir] method).
+  */
+ interface DirEntry extends fs.DirEntry{}
+ interface File {
+  /**
+   * ReadDir reads the contents of the directory associated with the file f
+   * and returns a slice of [DirEntry] values in directory order.
+   * Subsequent calls on the same file will yield later DirEntry records in the directory.
+   * 
+   * If n > 0, ReadDir returns at most n DirEntry records.
+   * In this case, if ReadDir returns an empty slice, it will return an error explaining why.
+   * At the end of a directory, the error is [io.EOF].
+   * 
+   * If n <= 0, ReadDir returns all the DirEntry records remaining in the directory.
+   * When it succeeds, it returns a nil error (not io.EOF).
+   */
+  readDir(n: number): Array<DirEntry>
+ }
+ interface readDir {
+  /**
+   * ReadDir reads the named directory,
+   * returning all its directory entries sorted by filename.
+   * If an error occurs reading the directory,
+   * ReadDir returns the entries it was able to read before the error,
+   * along with the error.
+   */
+  (name: string): Array<DirEntry>
+ }
+ interface copyFS {
+  /**
+   * CopyFS copies the file system fsys into the directory dir,
+   * creating dir if necessary.
+   * 
+   * Files are created with mode 0o666 plus any execute permissions
+   * from the source, and directories are created with mode 0o777
+   * (before umask).
+   * 
+   * CopyFS will not overwrite existing files. If a file name in fsys
+   * already exists in the destination, CopyFS will return an error
+   * such that errors.Is(err, fs.ErrExist) will be true.
+   * 
+   * Symbolic links in fsys are not supported. A *PathError with Err set
+   * to ErrInvalid is returned when copying from a symbolic link.
+   * 
+   * Symbolic links in dir are followed.
+   * 
+   * Copying stops at and returns the first error encountered.
+   */
+  (dir: string, fsys: fs.FS): void
+ }
+ /**
+  * Auxiliary information if the File describes a directory
+  */
+ interface dirInfo {
+ }
+ interface expand {
+  /**
+   * Expand replaces ${var} or $var in the string based on the mapping function.
+   * For example, [os.ExpandEnv](s) is equivalent to [os.Expand](s, [os.Getenv]).
+   */
+  (s: string, mapping: (_arg0: string) => string): string
+ }
+ interface expandEnv {
+  /**
+   * ExpandEnv replaces ${var} or $var in the string according to the values
+   * of the current environment variables. References to undefined
+   * variables are replaced by the empty string.
+   */
+  (s: string): string
+ }
+ interface getenv {
+  /**
+   * Getenv retrieves the value of the environment variable named by the key.
+   * It returns the value, which will be empty if the variable is not present.
+   * To distinguish between an empty value and an unset value, use [LookupEnv].
+   */
+  (key: string): string
+ }
+ interface lookupEnv {
+  /**
+   * LookupEnv retrieves the value of the environment variable named
+   * by the key. If the variable is present in the environment the
+   * value (which may be empty) is returned and the boolean is true.
+   * Otherwise the returned value will be empty and the boolean will
+   * be false.
+   */
+  (key: string): [string, boolean]
+ }
+ interface setenv {
+  /**
+   * Setenv sets the value of the environment variable named by the key.
+   * It returns an error, if any.
+   */
+  (key: string, value: string): void
+ }
+ interface unsetenv {
+  /**
+   * Unsetenv unsets a single environment variable.
+   */
+  (key: string): void
+ }
+ interface clearenv {
+  /**
+   * Clearenv deletes all environment variables.
+   */
+  (): void
+ }
+ interface environ {
+  /**
+   * Environ returns a copy of strings representing the environment,
+   * in the form "key=value".
+   */
+  (): Array<string>
+ }
+ interface timeout {
+  [key:string]: any;
+  timeout(): boolean
+ }
+ /**
+  * PathError records an error and the operation and file path that caused it.
+  */
+ interface PathError extends fs.PathError{}
+ /**
+  * SyscallError records an error from a specific system call.
+  */
+ interface SyscallError {
+  syscall: string
+  err: Error
+ }
+ interface SyscallError {
+  error(): string
+ }
+ interface SyscallError {
+  unwrap(): void
+ }
+ interface SyscallError {
+  /**
+   * Timeout reports whether this error represents a timeout.
+   */
+  timeout(): boolean
+ }
+ interface newSyscallError {
+  /**
+   * NewSyscallError returns, as an error, a new [SyscallError]
+   * with the given system call name and error details.
+   * As a convenience, if err is nil, NewSyscallError returns nil.
+   */
+  (syscall: string, err: Error): void
+ }
+ interface isExist {
+  /**
+   * IsExist returns a boolean indicating whether its argument is known to report
+   * that a file or directory already exists. It is satisfied by [ErrExist] as
+   * well as some syscall errors.
+   * 
+   * This function predates [errors.Is]. It only supports errors returned by
+   * the os package. New code should use errors.Is(err, fs.ErrExist).
+   */
+  (err: Error): boolean
+ }
+ interface isNotExist {
+  /**
+   * IsNotExist returns a boolean indicating whether its argument is known to
+   * report that a file or directory does not exist. It is satisfied by
+   * [ErrNotExist] as well as some syscall errors.
+   * 
+   * This function predates [errors.Is]. It only supports errors returned by
+   * the os package. New code should use errors.Is(err, fs.ErrNotExist).
+   */
+  (err: Error): boolean
+ }
+ interface isPermission {
+  /**
+   * IsPermission returns a boolean indicating whether its argument is known to
+   * report that permission is denied. It is satisfied by [ErrPermission] as well
+   * as some syscall errors.
+   * 
+   * This function predates [errors.Is]. It only supports errors returned by
+   * the os package. New code should use errors.Is(err, fs.ErrPermission).
+   */
+  (err: Error): boolean
+ }
+ interface isTimeout {
+  /**
+   * IsTimeout returns a boolean indicating whether its argument is known
+   * to report that a timeout occurred.
+   * 
+   * This function predates [errors.Is], and the notion of whether an
+   * error indicates a timeout can be ambiguous. For example, the Unix
+   * error EWOULDBLOCK sometimes indicates a timeout and sometimes does not.
+   * New code should use errors.Is with a value appropriate to the call
+   * returning the error, such as [os.ErrDeadlineExceeded].
+   */
+  (err: Error): boolean
+ }
+ interface syscallErrorType extends syscall.Errno{}
+ interface processMode extends Number{}
+ interface processStatus extends Number{}
+ /**
+  * Process stores the information about a process created by [StartProcess].
+  */
+ interface Process {
+  pid: number
+ }
+ /**
+  * ProcAttr holds the attributes that will be applied to a new process
+  * started by StartProcess.
+  */
+ interface ProcAttr {
+  /**
+   * If Dir is non-empty, the child changes into the directory before
+   * creating the process.
+   */
+  dir: string
+  /**
+   * If Env is non-nil, it gives the environment variables for the
+   * new process in the form returned by Environ.
+   * If it is nil, the result of Environ will be used.
+   */
+  env: Array<string>
+  /**
+   * Files specifies the open files inherited by the new process. The
+   * first three entries correspond to standard input, standard output, and
+   * standard error. An implementation may support additional entries,
+   * depending on the underlying operating system. A nil entry corresponds
+   * to that file being closed when the process starts.
+   * On Unix systems, StartProcess will change these File values
+   * to blocking mode, which means that SetDeadline will stop working
+   * and calling Close will not interrupt a Read or Write.
+   */
+  files: Array<(File | undefined)>
+  /**
+   * Operating system-specific process creation attributes.
+   * Note that setting this field means that your program
+   * may not execute properly or even compile on some
+   * operating systems.
+   */
+  sys?: syscall.SysProcAttr
+ }
+ /**
+  * A Signal represents an operating system signal.
+  * The usual underlying implementation is operating system-dependent:
+  * on Unix it is syscall.Signal.
+  */
+ interface Signal {
+  [key:string]: any;
+  string(): string
+  signal(): void // to distinguish from other Stringers
+ }
+ interface getpid {
+  /**
+   * Getpid returns the process id of the caller.
+   */
+  (): number
+ }
+ interface getppid {
+  /**
+   * Getppid returns the process id of the caller's parent.
+   */
+  (): number
+ }
+ interface findProcess {
+  /**
+   * FindProcess looks for a running process by its pid.
+   * 
+   * The [Process] it returns can be used to obtain information
+   * about the underlying operating system process.
+   * 
+   * On Unix systems, FindProcess always succeeds and returns a Process
+   * for the given pid, regardless of whether the process exists. To test whether
+   * the process actually exists, see whether p.Signal(syscall.Signal(0)) reports
+   * an error.
+   */
+  (pid: number): (Process)
+ }
+ interface startProcess {
+  /**
+   * StartProcess starts a new process with the program, arguments and attributes
+   * specified by name, argv and attr. The argv slice will become [os.Args] in the
+   * new process, so it normally starts with the program name.
+   * 
+   * If the calling goroutine has locked the operating system thread
+   * with [runtime.LockOSThread] and modified any inheritable OS-level
+   * thread state (for example, Linux or Plan 9 name spaces), the new
+   * process will inherit the caller's thread state.
+   * 
+   * StartProcess is a low-level interface. The [os/exec] package provides
+   * higher-level interfaces.
+   * 
+   * If there is an error, it will be of type [*PathError].
+   */
+  (name: string, argv: Array<string>, attr: ProcAttr): (Process)
+ }
+ interface Process {
+  /**
+   * Release releases any resources associated with the [Process] p,
+   * rendering it unusable in the future.
+   * Release only needs to be called if [Process.Wait] is not.
+   */
+  release(): void
+ }
+ interface Process {
+  /**
+   * Kill causes the [Process] to exit immediately. Kill does not wait until
+   * the Process has actually exited. This only kills the Process itself,
+   * not any other processes it may have started.
+   */
+  kill(): void
+ }
+ interface Process {
+  /**
+   * Wait waits for the [Process] to exit, and then returns a
+   * ProcessState describing its status and an error, if any.
+   * Wait releases any resources associated with the Process.
+   * On most operating systems, the Process must be a child
+   * of the current process or an error will be returned.
+   */
+  wait(): (ProcessState)
+ }
+ interface Process {
+  /**
+   * Signal sends a signal to the [Process].
+   * Sending [Interrupt] on Windows is not implemented.
+   */
+  signal(sig: Signal): void
+ }
+ interface ProcessState {
+  /**
+   * UserTime returns the user CPU time of the exited process and its children.
+   */
+  userTime(): time.Duration
+ }
+ interface ProcessState {
+  /**
+   * SystemTime returns the system CPU time of the exited process and its children.
+   */
+  systemTime(): time.Duration
+ }
+ interface ProcessState {
+  /**
+   * Exited reports whether the program has exited.
+   * On Unix systems this reports true if the program exited due to calling exit,
+   * but false if the program terminated due to a signal.
+   */
+  exited(): boolean
+ }
+ interface ProcessState {
+  /**
+   * Success reports whether the program exited successfully,
+   * such as with exit status 0 on Unix.
+   */
+  success(): boolean
+ }
+ interface ProcessState {
+  /**
+   * Sys returns system-dependent exit information about
+   * the process. Convert it to the appropriate underlying
+   * type, such as [syscall.WaitStatus] on Unix, to access its contents.
+   */
+  sys(): any
+ }
+ interface ProcessState {
+  /**
+   * SysUsage returns system-dependent resource usage information about
+   * the exited process. Convert it to the appropriate underlying
+   * type, such as [*syscall.Rusage] on Unix, to access its contents.
+   * (On Unix, *syscall.Rusage matches struct rusage as defined in the
+   * getrusage(2) manual page.)
+   */
+  sysUsage(): any
+ }
+ /**
+  * ProcessState stores information about a process, as reported by Wait.
+  */
+ interface ProcessState {
+ }
+ interface ProcessState {
+  /**
+   * Pid returns the process id of the exited process.
+   */
+  pid(): number
+ }
+ interface ProcessState {
+  string(): string
+ }
+ interface ProcessState {
+  /**
+   * ExitCode returns the exit code of the exited process, or -1
+   * if the process hasn't exited or was terminated by a signal.
+   */
+  exitCode(): number
+ }
+ interface executable {
+  /**
+   * Executable returns the path name for the executable that started
+   * the current process. There is no guarantee that the path is still
+   * pointing to the correct executable. If a symlink was used to start
+   * the process, depending on the operating system, the result might
+   * be the symlink or the path it pointed to. If a stable result is
+   * needed, [path/filepath.EvalSymlinks] might help.
+   * 
+   * Executable returns an absolute path unless an error occurred.
+   * 
+   * The main use case is finding resources located relative to an
+   * executable.
+   */
+  (): string
+ }
+ interface File {
+  /**
+   * Name returns the name of the file as presented to Open.
+   * 
+   * It is safe to call Name after [Close].
+   */
+  name(): string
+ }
+ /**
+  * LinkError records an error during a link or symlink or rename
+  * system call and the paths that caused it.
+  */
+ interface LinkError {
+  op: string
+  old: string
+  new: string
+  err: Error
+ }
+ interface LinkError {
+  error(): string
+ }
+ interface LinkError {
+  unwrap(): void
+ }
+ interface File {
+  /**
+   * Read reads up to len(b) bytes from the File and stores them in b.
+   * It returns the number of bytes read and any error encountered.
+   * At end of file, Read returns 0, io.EOF.
+   */
+  read(b: string|Array<number>): number
+ }
+ interface File {
+  /**
+   * ReadAt reads len(b) bytes from the File starting at byte offset off.
+   * It returns the number of bytes read and the error, if any.
+   * ReadAt always returns a non-nil error when n < len(b).
+   * At end of file, that error is io.EOF.
+   */
+  readAt(b: string|Array<number>, off: number): number
+ }
+ interface File {
+  /**
+   * ReadFrom implements io.ReaderFrom.
+   */
+  readFrom(r: io.Reader): number
+ }
+ /**
+  * noReadFrom can be embedded alongside another type to
+  * hide the ReadFrom method of that other type.
+  */
+ interface noReadFrom {
+ }
+ interface noReadFrom {
+  /**
+   * ReadFrom hides another ReadFrom method.
+   * It should never be called.
+   */
+  readFrom(_arg0: io.Reader): number
+ }
+ /**
+  * fileWithoutReadFrom implements all the methods of *File other
+  * than ReadFrom. This is used to permit ReadFrom to call io.Copy
+  * without leading to a recursive call to ReadFrom.
+  */
+ type _snLnyFf = noReadFrom&File
+ interface fileWithoutReadFrom extends _snLnyFf {
+ }
+ interface File {
+  /**
+   * Write writes len(b) bytes from b to the File.
+   * It returns the number of bytes written and an error, if any.
+   * Write returns a non-nil error when n != len(b).
+   */
+  write(b: string|Array<number>): number
+ }
+ interface File {
+  /**
+   * WriteAt writes len(b) bytes to the File starting at byte offset off.
+   * It returns the number of bytes written and an error, if any.
+   * WriteAt returns a non-nil error when n != len(b).
+   * 
+   * If file was opened with the O_APPEND flag, WriteAt returns an error.
+   */
+  writeAt(b: string|Array<number>, off: number): number
+ }
+ interface File {
+  /**
+   * WriteTo implements io.WriterTo.
+   */
+  writeTo(w: io.Writer): number
+ }
+ /**
+  * noWriteTo can be embedded alongside another type to
+  * hide the WriteTo method of that other type.
+  */
+ interface noWriteTo {
+ }
+ interface noWriteTo {
+  /**
+   * WriteTo hides another WriteTo method.
+   * It should never be called.
+   */
+  writeTo(_arg0: io.Writer): number
+ }
+ /**
+  * fileWithoutWriteTo implements all the methods of *File other
+  * than WriteTo. This is used to permit WriteTo to call io.Copy
+  * without leading to a recursive call to WriteTo.
+  */
+ type _syNvbJl = noWriteTo&File
+ interface fileWithoutWriteTo extends _syNvbJl {
+ }
+ interface File {
+  /**
+   * Seek sets the offset for the next Read or Write on file to offset, interpreted
+   * according to whence: 0 means relative to the origin of the file, 1 means
+   * relative to the current offset, and 2 means relative to the end.
+   * It returns the new offset and an error, if any.
+   * The behavior of Seek on a file opened with O_APPEND is not specified.
+   */
+  seek(offset: number, whence: number): number
+ }
+ interface File {
+  /**
+   * WriteString is like Write, but writes the contents of string s rather than
+   * a slice of bytes.
+   */
+  writeString(s: string): number
+ }
+ interface mkdir {
+  /**
+   * Mkdir creates a new directory with the specified name and permission
+   * bits (before umask).
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string, perm: FileMode): void
+ }
+ interface chdir {
+  /**
+   * Chdir changes the current working directory to the named directory.
+   * If there is an error, it will be of type *PathError.
+   */
+  (dir: string): void
+ }
+ interface open {
+  /**
+   * Open opens the named file for reading. If successful, methods on
+   * the returned file can be used for reading; the associated file
+   * descriptor has mode O_RDONLY.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string): (File)
+ }
+ interface create {
+  /**
+   * Create creates or truncates the named file. If the file already exists,
+   * it is truncated. If the file does not exist, it is created with mode 0o666
+   * (before umask). If successful, methods on the returned File can
+   * be used for I/O; the associated file descriptor has mode O_RDWR.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string): (File)
+ }
+ interface openFile {
+  /**
+   * OpenFile is the generalized open call; most users will use Open
+   * or Create instead. It opens the named file with specified flag
+   * (O_RDONLY etc.). If the file does not exist, and the O_CREATE flag
+   * is passed, it is created with mode perm (before umask). If successful,
+   * methods on the returned File can be used for I/O.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string, flag: number, perm: FileMode): (File)
+ }
+ interface rename {
+  /**
+   * Rename renames (moves) oldpath to newpath.
+   * If newpath already exists and is not a directory, Rename replaces it.
+   * OS-specific restrictions may apply when oldpath and newpath are in different directories.
+   * Even within the same directory, on non-Unix platforms Rename is not an atomic operation.
+   * If there is an error, it will be of type *LinkError.
+   */
+  (oldpath: string, newpath: string): void
+ }
+ interface readlink {
+  /**
+   * Readlink returns the destination of the named symbolic link.
+   * If there is an error, it will be of type *PathError.
+   * 
+   * If the link destination is relative, Readlink returns the relative path
+   * without resolving it to an absolute one.
+   */
+  (name: string): string
+ }
+ interface tempDir {
+  /**
+   * TempDir returns the default directory to use for temporary files.
+   * 
+   * On Unix systems, it returns $TMPDIR if non-empty, else /tmp.
+   * On Windows, it uses GetTempPath, returning the first non-empty
+   * value from %TMP%, %TEMP%, %USERPROFILE%, or the Windows directory.
+   * On Plan 9, it returns /tmp.
+   * 
+   * The directory is neither guaranteed to exist nor have accessible
+   * permissions.
+   */
+  (): string
+ }
+ interface userCacheDir {
+  /**
+   * UserCacheDir returns the default root directory to use for user-specific
+   * cached data. Users should create their own application-specific subdirectory
+   * within this one and use that.
+   * 
+   * On Unix systems, it returns $XDG_CACHE_HOME as specified by
+   * https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html if
+   * non-empty, else $HOME/.cache.
+   * On Darwin, it returns $HOME/Library/Caches.
+   * On Windows, it returns %LocalAppData%.
+   * On Plan 9, it returns $home/lib/cache.
+   * 
+   * If the location cannot be determined (for example, $HOME is not defined),
+   * then it will return an error.
+   */
+  (): string
+ }
+ interface userConfigDir {
+  /**
+   * UserConfigDir returns the default root directory to use for user-specific
+   * configuration data. Users should create their own application-specific
+   * subdirectory within this one and use that.
+   * 
+   * On Unix systems, it returns $XDG_CONFIG_HOME as specified by
+   * https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html if
+   * non-empty, else $HOME/.config.
+   * On Darwin, it returns $HOME/Library/Application Support.
+   * On Windows, it returns %AppData%.
+   * On Plan 9, it returns $home/lib.
+   * 
+   * If the location cannot be determined (for example, $HOME is not defined),
+   * then it will return an error.
+   */
+  (): string
+ }
+ interface userHomeDir {
+  /**
+   * UserHomeDir returns the current user's home directory.
+   * 
+   * On Unix, including macOS, it returns the $HOME environment variable.
+   * On Windows, it returns %USERPROFILE%.
+   * On Plan 9, it returns the $home environment variable.
+   * 
+   * If the expected variable is not set in the environment, UserHomeDir
+   * returns either a platform-specific default value or a non-nil error.
+   */
+  (): string
+ }
+ interface chmod {
+  /**
+   * Chmod changes the mode of the named file to mode.
+   * If the file is a symbolic link, it changes the mode of the link's target.
+   * If there is an error, it will be of type *PathError.
+   * 
+   * A different subset of the mode bits are used, depending on the
+   * operating system.
+   * 
+   * On Unix, the mode's permission bits, ModeSetuid, ModeSetgid, and
+   * ModeSticky are used.
+   * 
+   * On Windows, only the 0o200 bit (owner writable) of mode is used; it
+   * controls whether the file's read-only attribute is set or cleared.
+   * The other bits are currently unused. For compatibility with Go 1.12
+   * and earlier, use a non-zero mode. Use mode 0o400 for a read-only
+   * file and 0o600 for a readable+writable file.
+   * 
+   * On Plan 9, the mode's permission bits, ModeAppend, ModeExclusive,
+   * and ModeTemporary are used.
+   */
+  (name: string, mode: FileMode): void
+ }
+ interface File {
+  /**
+   * Chmod changes the mode of the file to mode.
+   * If there is an error, it will be of type *PathError.
+   */
+  chmod(mode: FileMode): void
+ }
+ interface File {
+  /**
+   * SetDeadline sets the read and write deadlines for a File.
+   * It is equivalent to calling both SetReadDeadline and SetWriteDeadline.
+   * 
+   * Only some kinds of files support setting a deadline. Calls to SetDeadline
+   * for files that do not support deadlines will return ErrNoDeadline.
+   * On most systems ordinary files do not support deadlines, but pipes do.
+   * 
+   * A deadline is an absolute time after which I/O operations fail with an
+   * error instead of blocking. The deadline applies to all future and pending
+   * I/O, not just the immediately following call to Read or Write.
+   * After a deadline has been exceeded, the connection can be refreshed
+   * by setting a deadline in the future.
+   * 
+   * If the deadline is exceeded a call to Read or Write or to other I/O
+   * methods will return an error that wraps ErrDeadlineExceeded.
+   * This can be tested using errors.Is(err, os.ErrDeadlineExceeded).
+   * That error implements the Timeout method, and calling the Timeout
+   * method will return true, but there are other possible errors for which
+   * the Timeout will return true even if the deadline has not been exceeded.
+   * 
+   * An idle timeout can be implemented by repeatedly extending
+   * the deadline after successful Read or Write calls.
+   * 
+   * A zero value for t means I/O operations will not time out.
+   */
+  setDeadline(t: time.Time): void
+ }
+ interface File {
+  /**
+   * SetReadDeadline sets the deadline for future Read calls and any
+   * currently-blocked Read call.
+   * A zero value for t means Read will not time out.
+   * Not all files support setting deadlines; see SetDeadline.
+   */
+  setReadDeadline(t: time.Time): void
+ }
+ interface File {
+  /**
+   * SetWriteDeadline sets the deadline for any future Write calls and any
+   * currently-blocked Write call.
+   * Even if Write times out, it may return n > 0, indicating that
+   * some of the data was successfully written.
+   * A zero value for t means Write will not time out.
+   * Not all files support setting deadlines; see SetDeadline.
+   */
+  setWriteDeadline(t: time.Time): void
+ }
+ interface File {
+  /**
+   * SyscallConn returns a raw file.
+   * This implements the syscall.Conn interface.
+   */
+  syscallConn(): syscall.RawConn
+ }
+ interface dirFS {
+  /**
+   * DirFS returns a file system (an fs.FS) for the tree of files rooted at the directory dir.
+   * 
+   * Note that DirFS("/prefix") only guarantees that the Open calls it makes to the
+   * operating system will begin with "/prefix": DirFS("/prefix").Open("file") is the
+   * same as os.Open("/prefix/file"). So if /prefix/file is a symbolic link pointing outside
+   * the /prefix tree, then using DirFS does not stop the access any more than using
+   * os.Open does. Additionally, the root of the fs.FS returned for a relative path,
+   * DirFS("prefix"), will be affected by later calls to Chdir. DirFS is therefore not
+   * a general substitute for a chroot-style security mechanism when the directory tree
+   * contains arbitrary content.
+   * 
+   * The directory dir must not be "".
+   * 
+   * The result implements [io/fs.StatFS], [io/fs.ReadFileFS] and
+   * [io/fs.ReadDirFS].
+   */
+  (dir: string): fs.FS
+ }
+ interface dirFS extends String{}
+ interface dirFS {
+  open(name: string): fs.File
+ }
+ interface dirFS {
+  /**
+   * The ReadFile method calls the [ReadFile] function for the file
+   * with the given name in the directory. The function provides
+   * robust handling for small files and special file systems.
+   * Through this method, dirFS implements [io/fs.ReadFileFS].
+   */
+  readFile(name: string): string|Array<number>
+ }
+ interface dirFS {
+  /**
+   * ReadDir reads the named directory, returning all its directory entries sorted
+   * by filename. Through this method, dirFS implements [io/fs.ReadDirFS].
+   */
+  readDir(name: string): Array<DirEntry>
+ }
+ interface dirFS {
+  stat(name: string): fs.FileInfo
+ }
+ interface readFile {
+  /**
+   * ReadFile reads the named file and returns the contents.
+   * A successful call returns err == nil, not err == EOF.
+   * Because ReadFile reads the whole file, it does not treat an EOF from Read
+   * as an error to be reported.
+   */
+  (name: string): string|Array<number>
+ }
+ interface writeFile {
+  /**
+   * WriteFile writes data to the named file, creating it if necessary.
+   * If the file does not exist, WriteFile creates it with permissions perm (before umask);
+   * otherwise WriteFile truncates it before writing, without changing permissions.
+   * Since WriteFile requires multiple system calls to complete, a failure mid-operation
+   * can leave the file in a partially written state.
+   */
+  (name: string, data: string|Array<number>, perm: FileMode): void
+ }
+ interface File {
+  /**
+   * Close closes the [File], rendering it unusable for I/O.
+   * On files that support [File.SetDeadline], any pending I/O operations will
+   * be canceled and return immediately with an [ErrClosed] error.
+   * Close will return an error if it has already been called.
+   */
+  close(): void
+ }
+ interface chown {
+  /**
+   * Chown changes the numeric uid and gid of the named file.
+   * If the file is a symbolic link, it changes the uid and gid of the link's target.
+   * A uid or gid of -1 means to not change that value.
+   * If there is an error, it will be of type [*PathError].
+   * 
+   * On Windows or Plan 9, Chown always returns the [syscall.EWINDOWS] or
+   * EPLAN9 error, wrapped in *PathError.
+   */
+  (name: string, uid: number, gid: number): void
+ }
+ interface lchown {
+  /**
+   * Lchown changes the numeric uid and gid of the named file.
+   * If the file is a symbolic link, it changes the uid and gid of the link itself.
+   * If there is an error, it will be of type [*PathError].
+   * 
+   * On Windows, it always returns the [syscall.EWINDOWS] error, wrapped
+   * in *PathError.
+   */
+  (name: string, uid: number, gid: number): void
+ }
+ interface File {
+  /**
+   * Chown changes the numeric uid and gid of the named file.
+   * If there is an error, it will be of type [*PathError].
+   * 
+   * On Windows, it always returns the [syscall.EWINDOWS] error, wrapped
+   * in *PathError.
+   */
+  chown(uid: number, gid: number): void
+ }
+ interface File {
+  /**
+   * Truncate changes the size of the file.
+   * It does not change the I/O offset.
+   * If there is an error, it will be of type [*PathError].
+   */
+  truncate(size: number): void
+ }
+ interface File {
+  /**
+   * Sync commits the current contents of the file to stable storage.
+   * Typically, this means flushing the file system's in-memory copy
+   * of recently written data to disk.
+   */
+  sync(): void
+ }
+ interface chtimes {
+  /**
+   * Chtimes changes the access and modification times of the named
+   * file, similar to the Unix utime() or utimes() functions.
+   * A zero [time.Time] value will leave the corresponding file time unchanged.
+   * 
+   * The underlying filesystem may truncate or round the values to a
+   * less precise time unit.
+   * If there is an error, it will be of type [*PathError].
+   */
+  (name: string, atime: time.Time, mtime: time.Time): void
+ }
+ interface File {
+  /**
+   * Chdir changes the current working directory to the file,
+   * which must be a directory.
+   * If there is an error, it will be of type [*PathError].
+   */
+  chdir(): void
+ }
+ /**
+  * file is the real representation of *File.
+  * The extra level of indirection ensures that no clients of os
+  * can overwrite this data, which could cause the finalizer
+  * to close the wrong file descriptor.
+  */
+ interface file {
+ }
+ interface File {
+  /**
+   * Fd returns the integer Unix file descriptor referencing the open file.
+   * If f is closed, the file descriptor becomes invalid.
+   * If f is garbage collected, a finalizer may close the file descriptor,
+   * making it invalid; see [runtime.SetFinalizer] for more information on when
+   * a finalizer might be run. On Unix systems this will cause the [File.SetDeadline]
+   * methods to stop working.
+   * Because file descriptors can be reused, the returned file descriptor may
+   * only be closed through the [File.Close] method of f, or by its finalizer during
+   * garbage collection. Otherwise, during garbage collection the finalizer
+   * may close an unrelated file descriptor with the same (reused) number.
+   * 
+   * As an alternative, see the f.SyscallConn method.
+   */
+  fd(): number
+ }
+ interface newFile {
+  /**
+   * NewFile returns a new File with the given file descriptor and
+   * name. The returned value will be nil if fd is not a valid file
+   * descriptor. On Unix systems, if the file descriptor is in
+   * non-blocking mode, NewFile will attempt to return a pollable File
+   * (one for which the SetDeadline methods work).
+   * 
+   * After passing it to NewFile, fd may become invalid under the same
+   * conditions described in the comments of the Fd method, and the same
+   * constraints apply.
+   */
+  (fd: number, name: string): (File)
+ }
+ /**
+  * newFileKind describes the kind of file to newFile.
+  */
+ interface newFileKind extends Number{}
+ interface truncate {
+  /**
+   * Truncate changes the size of the named file.
+   * If the file is a symbolic link, it changes the size of the link's target.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string, size: number): void
+ }
+ interface remove {
+  /**
+   * Remove removes the named file or (empty) directory.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string): void
+ }
+ interface link {
+  /**
+   * Link creates newname as a hard link to the oldname file.
+   * If there is an error, it will be of type *LinkError.
+   */
+  (oldname: string, newname: string): void
+ }
+ interface symlink {
+  /**
+   * Symlink creates newname as a symbolic link to oldname.
+   * On Windows, a symlink to a non-existent oldname creates a file symlink;
+   * if oldname is later created as a directory the symlink will not work.
+   * If there is an error, it will be of type *LinkError.
+   */
+  (oldname: string, newname: string): void
+ }
+ interface unixDirent {
+ }
+ interface unixDirent {
+  name(): string
+ }
+ interface unixDirent {
+  isDir(): boolean
+ }
+ interface unixDirent {
+  type(): FileMode
+ }
+ interface unixDirent {
+  info(): FileInfo
+ }
+ interface unixDirent {
+  string(): string
+ }
+ interface getwd {
+  /**
+   * Getwd returns a rooted path name corresponding to the
+   * current directory. If the current directory can be
+   * reached via multiple paths (due to symbolic links),
+   * Getwd may return any one of them.
+   */
+  (): string
+ }
+ interface mkdirAll {
+  /**
+   * MkdirAll creates a directory named path,
+   * along with any necessary parents, and returns nil,
+   * or else returns an error.
+   * The permission bits perm (before umask) are used for all
+   * directories that MkdirAll creates.
+   * If path is already a directory, MkdirAll does nothing
+   * and returns nil.
+   */
+  (path: string, perm: FileMode): void
+ }
+ interface removeAll {
+  /**
+   * RemoveAll removes path and any children it contains.
+   * It removes everything it can but returns the first error
+   * it encounters. If the path does not exist, RemoveAll
+   * returns nil (no error).
+   * If there is an error, it will be of type [*PathError].
+   */
+  (path: string): void
+ }
+ interface isPathSeparator {
+  /**
+   * IsPathSeparator reports whether c is a directory separator character.
+   */
+  (c: number): boolean
+ }
+ interface pipe {
+  /**
+   * Pipe returns a connected pair of Files; reads from r return bytes written to w.
+   * It returns the files and an error, if any.
+   */
+  (): [(File), (File)]
+ }
+ interface getuid {
+  /**
+   * Getuid returns the numeric user id of the caller.
+   * 
+   * On Windows, it returns -1.
+   */
+  (): number
+ }
+ interface geteuid {
+  /**
+   * Geteuid returns the numeric effective user id of the caller.
+   * 
+   * On Windows, it returns -1.
+   */
+  (): number
+ }
+ interface getgid {
+  /**
+   * Getgid returns the numeric group id of the caller.
+   * 
+   * On Windows, it returns -1.
+   */
+  (): number
+ }
+ interface getegid {
+  /**
+   * Getegid returns the numeric effective group id of the caller.
+   * 
+   * On Windows, it returns -1.
+   */
+  (): number
+ }
+ interface getgroups {
+  /**
+   * Getgroups returns a list of the numeric ids of groups that the caller belongs to.
+   * 
+   * On Windows, it returns [syscall.EWINDOWS]. See the [os/user] package
+   * for a possible alternative.
+   */
+  (): Array<number>
+ }
+ interface exit {
+  /**
+   * Exit causes the current program to exit with the given status code.
+   * Conventionally, code zero indicates success, non-zero an error.
+   * The program terminates immediately; deferred functions are not run.
+   * 
+   * For portability, the status code should be in the range [0, 125].
+   */
+  (code: number): void
+ }
+ /**
+  * rawConn implements syscall.RawConn.
+  */
+ interface rawConn {
+ }
+ interface rawConn {
+  control(f: (_arg0: number) => void): void
+ }
+ interface rawConn {
+  read(f: (_arg0: number) => boolean): void
+ }
+ interface rawConn {
+  write(f: (_arg0: number) => boolean): void
+ }
+ interface stat {
+  /**
+   * Stat returns a [FileInfo] describing the named file.
+   * If there is an error, it will be of type [*PathError].
+   */
+  (name: string): FileInfo
+ }
+ interface lstat {
+  /**
+   * Lstat returns a [FileInfo] describing the named file.
+   * If the file is a symbolic link, the returned FileInfo
+   * describes the symbolic link. Lstat makes no attempt to follow the link.
+   * If there is an error, it will be of type [*PathError].
+   * 
+   * On Windows, if the file is a reparse point that is a surrogate for another
+   * named entity (such as a symbolic link or mounted folder), the returned
+   * FileInfo describes the reparse point, and makes no attempt to resolve it.
+   */
+  (name: string): FileInfo
+ }
+ interface File {
+  /**
+   * Stat returns the [FileInfo] structure describing file.
+   * If there is an error, it will be of type [*PathError].
+   */
+  stat(): FileInfo
+ }
+ interface hostname {
+  /**
+   * Hostname returns the host name reported by the kernel.
+   */
+  (): string
+ }
+ interface createTemp {
+  /**
+   * CreateTemp creates a new temporary file in the directory dir,
+   * opens the file for reading and writing, and returns the resulting file.
+   * The filename is generated by taking pattern and adding a random string to the end.
+   * If pattern includes a "*", the random string replaces the last "*".
+   * The file is created with mode 0o600 (before umask).
+   * If dir is the empty string, CreateTemp uses the default directory for temporary files, as returned by [TempDir].
+   * Multiple programs or goroutines calling CreateTemp simultaneously will not choose the same file.
+   * The caller can use the file's Name method to find the pathname of the file.
+   * It is the caller's responsibility to remove the file when it is no longer needed.
+   */
+  (dir: string, pattern: string): (File)
+ }
+ interface mkdirTemp {
+  /**
+   * MkdirTemp creates a new temporary directory in the directory dir
+   * and returns the pathname of the new directory.
+   * The new directory's name is generated by adding a random string to the end of pattern.
+   * If pattern includes a "*", the random string replaces the last "*" instead.
+   * The directory is created with mode 0o700 (before umask).
+   * If dir is the empty string, MkdirTemp uses the default directory for temporary files, as returned by TempDir.
+   * Multiple programs or goroutines calling MkdirTemp simultaneously will not choose the same directory.
+   * It is the caller's responsibility to remove the directory when it is no longer needed.
+   */
+  (dir: string, pattern: string): string
+ }
+ interface getpagesize {
+  /**
+   * Getpagesize returns the underlying system's memory page size.
+   */
+  (): number
+ }
+ /**
+  * File represents an open file descriptor.
+  * 
+  * The methods of File are safe for concurrent use.
+  */
+ type _sDzXOPD = file
+ interface File extends _sDzXOPD {
+ }
+ /**
+  * A FileInfo describes a file and is returned by [Stat] and [Lstat].
+  */
+ interface FileInfo extends fs.FileInfo{}
+ /**
+  * A FileMode represents a file's mode and permission bits.
+  * The bits have the same definition on all systems, so that
+  * information about files can be moved from one system
+  * to another portably. Not all bits apply to all systems.
+  * The only required bit is [ModeDir] for directories.
+  */
+ interface FileMode extends fs.FileMode{}
+ interface fileStat {
+  name(): string
+ }
+ interface fileStat {
+  isDir(): boolean
+ }
+ interface sameFile {
+  /**
+   * SameFile reports whether fi1 and fi2 describe the same file.
+   * For example, on Unix this means that the device and inode fields
+   * of the two underlying structures are identical; on other systems
+   * the decision may be based on the path names.
+   * SameFile only applies to results returned by this package's [Stat].
+   * It returns false in other cases.
+   */
+  (fi1: FileInfo, fi2: FileInfo): boolean
+ }
+ /**
+  * A fileStat is the implementation of FileInfo returned by Stat and Lstat.
+  */
+ interface fileStat {
+ }
+ interface fileStat {
+  size(): number
+ }
+ interface fileStat {
+  mode(): FileMode
+ }
+ interface fileStat {
+  modTime(): time.Time
+ }
+ interface fileStat {
+  sys(): any
+ }
+}
+
+/**
+ * Package filepath implements utility routines for manipulating filename paths
+ * in a way compatible with the target operating system-defined file paths.
+ * 
+ * The filepath package uses either forward slashes or backslashes,
+ * depending on the operating system. To process paths such as URLs
+ * that always use forward slashes regardless of the operating
+ * system, see the [path] package.
+ */
+namespace filepath {
+ interface match {
+  /**
+   * Match reports whether name matches the shell file name pattern.
+   * The pattern syntax is:
+   * 
+   * ```
+   * 	pattern:
+   * 		{ term }
+   * 	term:
+   * 		'*'         matches any sequence of non-Separator characters
+   * 		'?'         matches any single non-Separator character
+   * 		'[' [ '^' ] { character-range } ']'
+   * 		            character class (must be non-empty)
+   * 		c           matches character c (c != '*', '?', '\\', '[')
+   * 		'\\' c      matches character c
+   * 
+   * 	character-range:
+   * 		c           matches character c (c != '\\', '-', ']')
+   * 		'\\' c      matches character c
+   * 		lo '-' hi   matches character c for lo <= c <= hi
+   * ```
+   * 
+   * Match requires pattern to match all of name, not just a substring.
+   * The only possible returned error is [ErrBadPattern], when pattern
+   * is malformed.
+   * 
+   * On Windows, escaping is disabled. Instead, '\\' is treated as
+   * path separator.
+   */
+  (pattern: string, name: string): boolean
+ }
+ interface glob {
+  /**
+   * Glob returns the names of all files matching pattern or nil
+   * if there is no matching file. The syntax of patterns is the same
+   * as in [Match]. The pattern may describe hierarchical names such as
+   * /usr/*\/bin/ed (assuming the [Separator] is '/').
+   * 
+   * Glob ignores file system errors such as I/O errors reading directories.
+   * The only possible returned error is [ErrBadPattern], when pattern
+   * is malformed.
+   */
+  (pattern: string): Array<string>
+ }
+ interface clean {
+  /**
+   * Clean returns the shortest path name equivalent to path
+   * by purely lexical processing. It applies the following rules
+   * iteratively until no further processing can be done:
+   * 
+   *  1. Replace multiple [Separator] elements with a single one.
+   *  2. Eliminate each . path name element (the current directory).
+   *  3. Eliminate each inner .. path name element (the parent directory)
+   * ```
+   *     along with the non-.. element that precedes it.
+   * ```
+   *  4. Eliminate .. elements that begin a rooted path:
+   * ```
+   *     that is, replace "/.." by "/" at the beginning of a path,
+   *     assuming Separator is '/'.
+   * ```
+   * 
+   * The returned path ends in a slash only if it represents a root directory,
+   * such as "/" on Unix or `C:\` on Windows.
+   * 
+   * Finally, any occurrences of slash are replaced by Separator.
+   * 
+   * If the result of this process is an empty string, Clean
+   * returns the string ".".
+   * 
+   * On Windows, Clean does not modify the volume name other than to replace
+   * occurrences of "/" with `\`.
+   * For example, Clean("//host/share/../x") returns `\\host\share\x`.
+   * 
+   * See also Rob Pike, “Lexical File Names in Plan 9 or
+   * Getting Dot-Dot Right,”
+   * https://9p.io/sys/doc/lexnames.html
+   */
+  (path: string): string
+ }
+ interface isLocal {
+  /**
+   * IsLocal reports whether path, using lexical analysis only, has all of these properties:
+   * 
+   * ```
+   *   - is within the subtree rooted at the directory in which path is evaluated
+   *   - is not an absolute path
+   *   - is not empty
+   *   - on Windows, is not a reserved name such as "NUL"
+   * ```
+   * 
+   * If IsLocal(path) returns true, then
+   * Join(base, path) will always produce a path contained within base and
+   * Clean(path) will always produce an unrooted path with no ".." path elements.
+   * 
+   * IsLocal is a purely lexical operation.
+   * In particular, it does not account for the effect of any symbolic links
+   * that may exist in the filesystem.
+   */
+  (path: string): boolean
+ }
+ interface localize {
+  /**
+   * Localize converts a slash-separated path into an operating system path.
+   * The input path must be a valid path as reported by [io/fs.ValidPath].
+   * 
+   * Localize returns an error if the path cannot be represented by the operating system.
+   * For example, the path a\b is rejected on Windows, on which \ is a separator
+   * character and cannot be part of a filename.
+   * 
+   * The path returned by Localize will always be local, as reported by IsLocal.
+   */
+  (path: string): string
+ }
+ interface toSlash {
+  /**
+   * ToSlash returns the result of replacing each separator character
+   * in path with a slash ('/') character. Multiple separators are
+   * replaced by multiple slashes.
+   */
+  (path: string): string
+ }
+ interface fromSlash {
+  /**
+   * FromSlash returns the result of replacing each slash ('/') character
+   * in path with a separator character. Multiple slashes are replaced
+   * by multiple separators.
+   * 
+   * See also the Localize function, which converts a slash-separated path
+   * as used by the io/fs package to an operating system path.
+   */
+  (path: string): string
+ }
+ interface splitList {
+  /**
+   * SplitList splits a list of paths joined by the OS-specific [ListSeparator],
+   * usually found in PATH or GOPATH environment variables.
+   * Unlike strings.Split, SplitList returns an empty slice when passed an empty
+   * string.
+   */
+  (path: string): Array<string>
+ }
+ interface split {
+  /**
+   * Split splits path immediately following the final [Separator],
+   * separating it into a directory and file name component.
+   * If there is no Separator in path, Split returns an empty dir
+   * and file set to path.
+   * The returned values have the property that path = dir+file.
+   */
+  (path: string): [string, string]
+ }
+ interface join {
+  /**
+   * Join joins any number of path elements into a single path,
+   * separating them with an OS specific [Separator]. Empty elements
+   * are ignored. The result is Cleaned. However, if the argument
+   * list is empty or all its elements are empty, Join returns
+   * an empty string.
+   * On Windows, the result will only be a UNC path if the first
+   * non-empty element is a UNC path.
+   */
+  (...elem: string[]): string
+ }
+ interface ext {
+  /**
+   * Ext returns the file name extension used by path.
+   * The extension is the suffix beginning at the final dot
+   * in the final element of path; it is empty if there is
+   * no dot.
+   */
+  (path: string): string
+ }
+ interface evalSymlinks {
+  /**
+   * EvalSymlinks returns the path name after the evaluation of any symbolic
+   * links.
+   * If path is relative the result will be relative to the current directory,
+   * unless one of the components is an absolute symbolic link.
+   * EvalSymlinks calls [Clean] on the result.
+   */
+  (path: string): string
+ }
+ interface isAbs {
+  /**
+   * IsAbs reports whether the path is absolute.
+   */
+  (path: string): boolean
+ }
+ interface abs {
+  /**
+   * Abs returns an absolute representation of path.
+   * If the path is not absolute it will be joined with the current
+   * working directory to turn it into an absolute path. The absolute
+   * path name for a given file is not guaranteed to be unique.
+   * Abs calls [Clean] on the result.
+   */
+  (path: string): string
+ }
+ interface rel {
+  /**
+   * Rel returns a relative path that is lexically equivalent to targpath when
+   * joined to basepath with an intervening separator. That is,
+   * [Join](basepath, Rel(basepath, targpath)) is equivalent to targpath itself.
+   * On success, the returned path will always be relative to basepath,
+   * even if basepath and targpath share no elements.
+   * An error is returned if targpath can't be made relative to basepath or if
+   * knowing the current working directory would be necessary to compute it.
+   * Rel calls [Clean] on the result.
+   */
+  (basepath: string, targpath: string): string
+ }
+ /**
+  * WalkFunc is the type of the function called by [Walk] to visit each
+  * file or directory.
+  * 
+  * The path argument contains the argument to Walk as a prefix.
+  * That is, if Walk is called with root argument "dir" and finds a file
+  * named "a" in that directory, the walk function will be called with
+  * argument "dir/a".
+  * 
+  * The directory and file are joined with Join, which may clean the
+  * directory name: if Walk is called with the root argument "x/../dir"
+  * and finds a file named "a" in that directory, the walk function will
+  * be called with argument "dir/a", not "x/../dir/a".
+  * 
+  * The info argument is the fs.FileInfo for the named path.
+  * 
+  * The error result returned by the function controls how Walk continues.
+  * If the function returns the special value [SkipDir], Walk skips the
+  * current directory (path if info.IsDir() is true, otherwise path's
+  * parent directory). If the function returns the special value [SkipAll],
+  * Walk skips all remaining files and directories. Otherwise, if the function
+  * returns a non-nil error, Walk stops entirely and returns that error.
+  * 
+  * The err argument reports an error related to path, signaling that Walk
+  * will not walk into that directory. The function can decide how to
+  * handle that error; as described earlier, returning the error will
+  * cause Walk to stop walking the entire tree.
+  * 
+  * Walk calls the function with a non-nil err argument in two cases.
+  * 
+  * First, if an [os.Lstat] on the root directory or any directory or file
+  * in the tree fails, Walk calls the function with path set to that
+  * directory or file's path, info set to nil, and err set to the error
+  * from os.Lstat.
+  * 
+  * Second, if a directory's Readdirnames method fails, Walk calls the
+  * function with path set to the directory's path, info, set to an
+  * [fs.FileInfo] describing the directory, and err set to the error from
+  * Readdirnames.
+  */
+ interface WalkFunc {(path: string, info: fs.FileInfo, err: Error): void }
+ interface walkDir {
+  /**
+   * WalkDir walks the file tree rooted at root, calling fn for each file or
+   * directory in the tree, including root.
+   * 
+   * All errors that arise visiting files and directories are filtered by fn:
+   * see the [fs.WalkDirFunc] documentation for details.
+   * 
+   * The files are walked in lexical order, which makes the output deterministic
+   * but requires WalkDir to read an entire directory into memory before proceeding
+   * to walk that directory.
+   * 
+   * WalkDir does not follow symbolic links.
+   * 
+   * WalkDir calls fn with paths that use the separator character appropriate
+   * for the operating system. This is unlike [io/fs.WalkDir], which always
+   * uses slash separated paths.
+   */
+  (root: string, fn: fs.WalkDirFunc): void
+ }
+ interface walk {
+  /**
+   * Walk walks the file tree rooted at root, calling fn for each file or
+   * directory in the tree, including root.
+   * 
+   * All errors that arise visiting files and directories are filtered by fn:
+   * see the [WalkFunc] documentation for details.
+   * 
+   * The files are walked in lexical order, which makes the output deterministic
+   * but requires Walk to read an entire directory into memory before proceeding
+   * to walk that directory.
+   * 
+   * Walk does not follow symbolic links.
+   * 
+   * Walk is less efficient than [WalkDir], introduced in Go 1.16,
+   * which avoids calling os.Lstat on every visited file or directory.
+   */
+  (root: string, fn: WalkFunc): void
+ }
+ interface base {
+  /**
+   * Base returns the last element of path.
+   * Trailing path separators are removed before extracting the last element.
+   * If the path is empty, Base returns ".".
+   * If the path consists entirely of separators, Base returns a single separator.
+   */
+  (path: string): string
+ }
+ interface dir {
+  /**
+   * Dir returns all but the last element of path, typically the path's directory.
+   * After dropping the final element, Dir calls [Clean] on the path and trailing
+   * slashes are removed.
+   * If the path is empty, Dir returns ".".
+   * If the path consists entirely of separators, Dir returns a single separator.
+   * The returned path does not end in a separator unless it is the root directory.
+   */
+  (path: string): string
+ }
+ interface volumeName {
+  /**
+   * VolumeName returns leading volume name.
+   * Given "C:\foo\bar" it returns "C:" on Windows.
+   * Given "\\host\share\foo" it returns "\\host\share".
+   * On other platforms it returns "".
+   */
+  (path: string): string
+ }
+ interface hasPrefix {
+  /**
+   * HasPrefix exists for historical compatibility and should not be used.
+   * 
+   * Deprecated: HasPrefix does not respect path boundaries and
+   * does not ignore case when required.
+   */
+  (p: string, prefix: string): boolean
+ }
+}
+
+/**
+ * Package validation provides configurable and extensible rules for validating data of various types.
+ */
+namespace ozzo_validation {
+ /**
+  * Error interface represents an validation error
+  */
+ interface Error {
+  [key:string]: any;
+  error(): string
+  code(): string
+  message(): string
+  setMessage(_arg0: string): Error
+  params(): _TygojaDict
+  setParams(_arg0: _TygojaDict): Error
+ }
+}
+
+/**
+ * Package dbx provides a set of DB-agnostic and easy-to-use query building methods for relational databases.
+ */
+namespace dbx {
+ /**
+  * Builder supports building SQL statements in a DB-agnostic way.
+  * Builder mainly provides two sets of query building methods: those building SELECT statements
+  * and those manipulating DB data or schema (e.g. INSERT statements, CREATE TABLE statements).
+  */
+ interface Builder {
+  [key:string]: any;
+  /**
+   * NewQuery creates a new Query object with the given SQL statement.
+   * The SQL statement may contain parameter placeholders which can be bound with actual parameter
+   * values before the statement is executed.
+   */
+  newQuery(_arg0: string): (Query)
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(..._arg0: string[]): (SelectQuery)
+  /**
+   * ModelQuery returns a new ModelQuery object that can be used to perform model insertion, update, and deletion.
+   * The parameter to this method should be a pointer to the model struct that needs to be inserted, updated, or deleted.
+   */
+  model(_arg0: {
+  }): (ModelQuery)
+  /**
+   * GeneratePlaceholder generates an anonymous parameter placeholder with the given parameter ID.
+   */
+  generatePlaceholder(_arg0: number): string
+  /**
+   * Quote quotes a string so that it can be embedded in a SQL statement as a string value.
+   */
+  quote(_arg0: string): string
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(_arg0: string): string
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(_arg0: string): string
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+  /**
+   * Insert creates a Query that represents an INSERT SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  insert(table: string, cols: Params): (Query)
+  /**
+   * Upsert creates a Query that represents an UPSERT SQL statement.
+   * Upsert inserts a row into the table if the primary key or unique index is not found.
+   * Otherwise it will update the row with the new values.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  upsert(table: string, cols: Params, ...constraints: string[]): (Query)
+  /**
+   * Update creates a Query that represents an UPDATE SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding new column
+   * values. If the "where" expression is nil, the UPDATE SQL statement will have no WHERE clause
+   * (be careful in this case as the SQL statement will update ALL rows in the table).
+   */
+  update(table: string, cols: Params, where: Expression): (Query)
+  /**
+   * Delete creates a Query that represents a DELETE SQL statement.
+   * If the "where" expression is nil, the DELETE SQL statement will have no WHERE clause
+   * (be careful in this case as the SQL statement will delete ALL rows in the table).
+   */
+  delete(table: string, where: Expression): (Query)
+  /**
+   * CreateTable creates a Query that represents a CREATE TABLE SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding column types.
+   * The optional "options" parameters will be appended to the generated SQL statement.
+   */
+  createTable(table: string, cols: _TygojaDict, ...options: string[]): (Query)
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+  /**
+   * DropTable creates a Query that can be used to drop a table.
+   */
+  dropTable(table: string): (Query)
+  /**
+   * TruncateTable creates a Query that can be used to truncate a table.
+   */
+  truncateTable(table: string): (Query)
+  /**
+   * AddColumn creates a Query that can be used to add a column to a table.
+   */
+  addColumn(table: string, col: string, typ: string): (Query)
+  /**
+   * DropColumn creates a Query that can be used to drop a column from a table.
+   */
+  dropColumn(table: string, col: string): (Query)
+  /**
+   * RenameColumn creates a Query that can be used to rename a column in a table.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (Query)
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+  /**
+   * AddPrimaryKey creates a Query that can be used to specify primary key(s) for a table.
+   * The "name" parameter specifies the name of the primary key constraint.
+   */
+  addPrimaryKey(table: string, name: string, ...cols: string[]): (Query)
+  /**
+   * DropPrimaryKey creates a Query that can be used to remove the named primary key constraint from a table.
+   */
+  dropPrimaryKey(table: string, name: string): (Query)
+  /**
+   * AddForeignKey creates a Query that can be used to add a foreign key constraint to a table.
+   * The length of cols and refCols must be the same as they refer to the primary and referential columns.
+   * The optional "options" parameters will be appended to the SQL statement. They can be used to
+   * specify options such as "ON DELETE CASCADE".
+   */
+  addForeignKey(table: string, name: string, cols: Array<string>, refCols: Array<string>, refTable: string, ...options: string[]): (Query)
+  /**
+   * DropForeignKey creates a Query that can be used to remove the named foreign key constraint from a table.
+   */
+  dropForeignKey(table: string, name: string): (Query)
+  /**
+   * CreateIndex creates a Query that can be used to create an index for a table.
+   */
+  createIndex(table: string, name: string, ...cols: string[]): (Query)
+  /**
+   * CreateUniqueIndex creates a Query that can be used to create a unique index for a table.
+   */
+  createUniqueIndex(table: string, name: string, ...cols: string[]): (Query)
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ /**
+  * BaseBuilder provides a basic implementation of the Builder interface.
+  */
+ interface BaseBuilder {
+ }
+ interface newBaseBuilder {
+  /**
+   * NewBaseBuilder creates a new BaseBuilder instance.
+   */
+  (db: DB, executor: Executor): (BaseBuilder)
+ }
+ interface BaseBuilder {
+  /**
+   * DB returns the DB instance that this builder is associated with.
+   */
+  db(): (DB)
+ }
+ interface BaseBuilder {
+  /**
+   * Executor returns the executor object (a DB instance or a transaction) for executing SQL statements.
+   */
+  executor(): Executor
+ }
+ interface BaseBuilder {
+  /**
+   * NewQuery creates a new Query object with the given SQL statement.
+   * The SQL statement may contain parameter placeholders which can be bound with actual parameter
+   * values before the statement is executed.
+   */
+  newQuery(sql: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * GeneratePlaceholder generates an anonymous parameter placeholder with the given parameter ID.
+   */
+  generatePlaceholder(_arg0: number): string
+ }
+ interface BaseBuilder {
+  /**
+   * Quote quotes a string so that it can be embedded in a SQL statement as a string value.
+   */
+  quote(s: string): string
+ }
+ interface BaseBuilder {
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(s: string): string
+ }
+ interface BaseBuilder {
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(s: string): string
+ }
+ interface BaseBuilder {
+  /**
+   * Insert creates a Query that represents an INSERT SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  insert(table: string, cols: Params): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * Upsert creates a Query that represents an UPSERT SQL statement.
+   * Upsert inserts a row into the table if the primary key or unique index is not found.
+   * Otherwise it will update the row with the new values.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  upsert(table: string, cols: Params, ...constraints: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * Update creates a Query that represents an UPDATE SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding new column
+   * values. If the "where" expression is nil, the UPDATE SQL statement will have no WHERE clause
+   * (be careful in this case as the SQL statement will update ALL rows in the table).
+   */
+  update(table: string, cols: Params, where: Expression): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * Delete creates a Query that represents a DELETE SQL statement.
+   * If the "where" expression is nil, the DELETE SQL statement will have no WHERE clause
+   * (be careful in this case as the SQL statement will delete ALL rows in the table).
+   */
+  delete(table: string, where: Expression): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * CreateTable creates a Query that represents a CREATE TABLE SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding column types.
+   * The optional "options" parameters will be appended to the generated SQL statement.
+   */
+  createTable(table: string, cols: _TygojaDict, ...options: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropTable creates a Query that can be used to drop a table.
+   */
+  dropTable(table: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * TruncateTable creates a Query that can be used to truncate a table.
+   */
+  truncateTable(table: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * AddColumn creates a Query that can be used to add a column to a table.
+   */
+  addColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropColumn creates a Query that can be used to drop a column from a table.
+   */
+  dropColumn(table: string, col: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * RenameColumn creates a Query that can be used to rename a column in a table.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * AddPrimaryKey creates a Query that can be used to specify primary key(s) for a table.
+   * The "name" parameter specifies the name of the primary key constraint.
+   */
+  addPrimaryKey(table: string, name: string, ...cols: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropPrimaryKey creates a Query that can be used to remove the named primary key constraint from a table.
+   */
+  dropPrimaryKey(table: string, name: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * AddForeignKey creates a Query that can be used to add a foreign key constraint to a table.
+   * The length of cols and refCols must be the same as they refer to the primary and referential columns.
+   * The optional "options" parameters will be appended to the SQL statement. They can be used to
+   * specify options such as "ON DELETE CASCADE".
+   */
+  addForeignKey(table: string, name: string, cols: Array<string>, refCols: Array<string>, refTable: string, ...options: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropForeignKey creates a Query that can be used to remove the named foreign key constraint from a table.
+   */
+  dropForeignKey(table: string, name: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * CreateIndex creates a Query that can be used to create an index for a table.
+   */
+  createIndex(table: string, name: string, ...cols: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * CreateUniqueIndex creates a Query that can be used to create a unique index for a table.
+   */
+  createUniqueIndex(table: string, name: string, ...cols: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ /**
+  * MssqlBuilder is the builder for SQL Server databases.
+  */
+ type _sLlglaO = BaseBuilder
+ interface MssqlBuilder extends _sLlglaO {
+ }
+ /**
+  * MssqlQueryBuilder is the query builder for SQL Server databases.
+  */
+ type _sIerFva = BaseQueryBuilder
+ interface MssqlQueryBuilder extends _sIerFva {
+ }
+ interface newMssqlBuilder {
+  /**
+   * NewMssqlBuilder creates a new MssqlBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface MssqlBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface MssqlBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface MssqlBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface MssqlBuilder {
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(s: string): string
+ }
+ interface MssqlBuilder {
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(s: string): string
+ }
+ interface MssqlBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface MssqlBuilder {
+  /**
+   * RenameColumn creates a Query that can be used to rename a column in a table.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (Query)
+ }
+ interface MssqlBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface MssqlQueryBuilder {
+  /**
+   * BuildOrderByAndLimit generates the ORDER BY and LIMIT clauses.
+   */
+  buildOrderByAndLimit(sql: string, cols: Array<string>, limit: number, offset: number): string
+ }
+ /**
+  * MysqlBuilder is the builder for MySQL databases.
+  */
+ type _sJRJGqZ = BaseBuilder
+ interface MysqlBuilder extends _sJRJGqZ {
+ }
+ interface newMysqlBuilder {
+  /**
+   * NewMysqlBuilder creates a new MysqlBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface MysqlBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface MysqlBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface MysqlBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface MysqlBuilder {
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(s: string): string
+ }
+ interface MysqlBuilder {
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(s: string): string
+ }
+ interface MysqlBuilder {
+  /**
+   * Upsert creates a Query that represents an UPSERT SQL statement.
+   * Upsert inserts a row into the table if the primary key or unique index is not found.
+   * Otherwise it will update the row with the new values.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  upsert(table: string, cols: Params, ...constraints: string[]): (Query)
+ }
+ interface MysqlBuilder {
+  /**
+   * RenameColumn creates a Query that can be used to rename a column in a table.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (Query)
+ }
+ interface MysqlBuilder {
+  /**
+   * DropPrimaryKey creates a Query that can be used to remove the named primary key constraint from a table.
+   */
+  dropPrimaryKey(table: string, name: string): (Query)
+ }
+ interface MysqlBuilder {
+  /**
+   * DropForeignKey creates a Query that can be used to remove the named foreign key constraint from a table.
+   */
+  dropForeignKey(table: string, name: string): (Query)
+ }
+ /**
+  * OciBuilder is the builder for Oracle databases.
+  */
+ type _sHTbvIJ = BaseBuilder
+ interface OciBuilder extends _sHTbvIJ {
+ }
+ /**
+  * OciQueryBuilder is the query builder for Oracle databases.
+  */
+ type _sGNFgrc = BaseQueryBuilder
+ interface OciQueryBuilder extends _sGNFgrc {
+ }
+ interface newOciBuilder {
+  /**
+   * NewOciBuilder creates a new OciBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface OciBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface OciBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface OciBuilder {
+  /**
+   * GeneratePlaceholder generates an anonymous parameter placeholder with the given parameter ID.
+   */
+  generatePlaceholder(i: number): string
+ }
+ interface OciBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface OciBuilder {
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ interface OciBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface OciBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface OciQueryBuilder {
+  /**
+   * BuildOrderByAndLimit generates the ORDER BY and LIMIT clauses.
+   */
+  buildOrderByAndLimit(sql: string, cols: Array<string>, limit: number, offset: number): string
+ }
+ /**
+  * PgsqlBuilder is the builder for PostgreSQL databases.
+  */
+ type _sALdjlO = BaseBuilder
+ interface PgsqlBuilder extends _sALdjlO {
+ }
+ interface newPgsqlBuilder {
+  /**
+   * NewPgsqlBuilder creates a new PgsqlBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface PgsqlBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface PgsqlBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface PgsqlBuilder {
+  /**
+   * GeneratePlaceholder generates an anonymous parameter placeholder with the given parameter ID.
+   */
+  generatePlaceholder(i: number): string
+ }
+ interface PgsqlBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface PgsqlBuilder {
+  /**
+   * Upsert creates a Query that represents an UPSERT SQL statement.
+   * Upsert inserts a row into the table if the primary key or unique index is not found.
+   * Otherwise it will update the row with the new values.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  upsert(table: string, cols: Params, ...constraints: string[]): (Query)
+ }
+ interface PgsqlBuilder {
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ interface PgsqlBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface PgsqlBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ /**
+  * SqliteBuilder is the builder for SQLite databases.
+  */
+ type _spUmBhh = BaseBuilder
+ interface SqliteBuilder extends _spUmBhh {
+ }
+ interface newSqliteBuilder {
+  /**
+   * NewSqliteBuilder creates a new SqliteBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface SqliteBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface SqliteBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface SqliteBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface SqliteBuilder {
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(s: string): string
+ }
+ interface SqliteBuilder {
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(s: string): string
+ }
+ interface SqliteBuilder {
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * TruncateTable creates a Query that can be used to truncate a table.
+   */
+  truncateTable(table: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * AddPrimaryKey creates a Query that can be used to specify primary key(s) for a table.
+   * The "name" parameter specifies the name of the primary key constraint.
+   */
+  addPrimaryKey(table: string, name: string, ...cols: string[]): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * DropPrimaryKey creates a Query that can be used to remove the named primary key constraint from a table.
+   */
+  dropPrimaryKey(table: string, name: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * AddForeignKey creates a Query that can be used to add a foreign key constraint to a table.
+   * The length of cols and refCols must be the same as they refer to the primary and referential columns.
+   * The optional "options" parameters will be appended to the SQL statement. They can be used to
+   * specify options such as "ON DELETE CASCADE".
+   */
+  addForeignKey(table: string, name: string, cols: Array<string>, refCols: Array<string>, refTable: string, ...options: string[]): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * DropForeignKey creates a Query that can be used to remove the named foreign key constraint from a table.
+   */
+  dropForeignKey(table: string, name: string): (Query)
+ }
+ /**
+  * StandardBuilder is the builder that is used by DB for an unknown driver.
+  */
+ type _sWjnuHQ = BaseBuilder
+ interface StandardBuilder extends _sWjnuHQ {
+ }
+ interface newStandardBuilder {
+  /**
+   * NewStandardBuilder creates a new StandardBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface StandardBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface StandardBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface StandardBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ /**
+  * LogFunc logs a message for each SQL statement being executed.
+  * This method takes one or multiple parameters. If a single parameter
+  * is provided, it will be treated as the log message. If multiple parameters
+  * are provided, they will be passed to fmt.Sprintf() to generate the log message.
+  */
+ interface LogFunc {(format: string, ...a: {
+  }[]): void }
+ /**
+  * PerfFunc is called when a query finishes execution.
+  * The query execution time is passed to this function so that the DB performance
+  * can be profiled. The "ns" parameter gives the number of nanoseconds that the
+  * SQL statement takes to execute, while the "execute" parameter indicates whether
+  * the SQL statement is executed or queried (usually SELECT statements).
+  */
+ interface PerfFunc {(ns: number, sql: string, execute: boolean): void }
+ /**
+  * QueryLogFunc is called each time when performing a SQL query.
+  * The "t" parameter gives the time that the SQL statement takes to execute,
+  * while rows and err are the result of the query.
+  */
+ interface QueryLogFunc {(ctx: context.Context, t: time.Duration, sql: string, rows: sql.Rows, err: Error): void }
+ /**
+  * ExecLogFunc is called each time when a SQL statement is executed.
+  * The "t" parameter gives the time that the SQL statement takes to execute,
+  * while result and err refer to the result of the execution.
+  */
+ interface ExecLogFunc {(ctx: context.Context, t: time.Duration, sql: string, result: sql.Result, err: Error): void }
+ /**
+  * BuilderFunc creates a Builder instance using the given DB instance and Executor.
+  */
+ interface BuilderFunc {(_arg0: DB, _arg1: Executor): Builder }
+ /**
+  * DB enhances sql.DB by providing a set of DB-agnostic query building methods.
+  * DB allows easier query building and population of data into Go variables.
+  */
+ type _swIUbPb = Builder
+ interface DB extends _swIUbPb {
+  /**
+   * FieldMapper maps struct fields to DB columns. Defaults to DefaultFieldMapFunc.
+   */
+  fieldMapper: FieldMapFunc
+  /**
+   * TableMapper maps structs to table names. Defaults to GetTableName.
+   */
+  tableMapper: TableMapFunc
+  /**
+   * LogFunc logs the SQL statements being executed. Defaults to nil, meaning no logging.
+   */
+  logFunc: LogFunc
+  /**
+   * PerfFunc logs the SQL execution time. Defaults to nil, meaning no performance profiling.
+   * Deprecated: Please use QueryLogFunc and ExecLogFunc instead.
+   */
+  perfFunc: PerfFunc
+  /**
+   * QueryLogFunc is called each time when performing a SQL query that returns data.
+   */
+  queryLogFunc: QueryLogFunc
+  /**
+   * ExecLogFunc is called each time when a SQL statement is executed.
+   */
+  execLogFunc: ExecLogFunc
+ }
+ /**
+  * Errors represents a list of errors.
+  */
+ interface Errors extends Array<Error>{}
+ interface newFromDB {
+  /**
+   * NewFromDB encapsulates an existing database connection.
+   */
+  (sqlDB: sql.DB, driverName: string): (DB)
+ }
+ interface open {
+  /**
+   * Open opens a database specified by a driver name and data source name (DSN).
+   * Note that Open does not check if DSN is specified correctly. It doesn't try to establish a DB connection either.
+   * Please refer to sql.Open() for more information.
+   */
+  (driverName: string, dsn: string): (DB)
+ }
+ interface mustOpen {
+  /**
+   * MustOpen opens a database and establishes a connection to it.
+   * Please refer to sql.Open() and sql.Ping() for more information.
+   */
+  (driverName: string, dsn: string): (DB)
+ }
+ interface DB {
+  /**
+   * Clone makes a shallow copy of DB.
+   */
+  clone(): (DB)
+ }
+ interface DB {
+  /**
+   * WithContext returns a new instance of DB associated with the given context.
+   */
+  withContext(ctx: context.Context): (DB)
+ }
+ interface DB {
+  /**
+   * Context returns the context associated with the DB instance.
+   * It returns nil if no context is associated.
+   */
+  context(): context.Context
+ }
+ interface DB {
+  /**
+   * DB returns the sql.DB instance encapsulated by dbx.DB.
+   */
+  db(): (sql.DB)
+ }
+ interface DB {
+  /**
+   * Close closes the database, releasing any open resources.
+   * It is rare to Close a DB, as the DB handle is meant to be
+   * long-lived and shared between many goroutines.
+   */
+  close(): void
+ }
+ interface DB {
+  /**
+   * Begin starts a transaction.
+   */
+  begin(): (Tx)
+ }
+ interface DB {
+  /**
+   * BeginTx starts a transaction with the given context and transaction options.
+   */
+  beginTx(ctx: context.Context, opts: sql.TxOptions): (Tx)
+ }
+ interface DB {
+  /**
+   * Wrap encapsulates an existing transaction.
+   */
+  wrap(sqlTx: sql.Tx): (Tx)
+ }
+ interface DB {
+  /**
+   * Transactional starts a transaction and executes the given function.
+   * If the function returns an error, the transaction will be rolled back.
+   * Otherwise, the transaction will be committed.
+   */
+  transactional(f: (_arg0: Tx) => void): void
+ }
+ interface DB {
+  /**
+   * TransactionalContext starts a transaction and executes the given function with the given context and transaction options.
+   * If the function returns an error, the transaction will be rolled back.
+   * Otherwise, the transaction will be committed.
+   */
+  transactionalContext(ctx: context.Context, opts: sql.TxOptions, f: (_arg0: Tx) => void): void
+ }
+ interface DB {
+  /**
+   * DriverName returns the name of the DB driver.
+   */
+  driverName(): string
+ }
+ interface DB {
+  /**
+   * QuoteTableName quotes the given table name appropriately.
+   * If the table name contains DB schema prefix, it will be handled accordingly.
+   * This method will do nothing if the table name is already quoted or if it contains parenthesis.
+   */
+  quoteTableName(s: string): string
+ }
+ interface DB {
+  /**
+   * QuoteColumnName quotes the given column name appropriately.
+   * If the table name contains table name prefix, it will be handled accordingly.
+   * This method will do nothing if the column name is already quoted or if it contains parenthesis.
+   */
+  quoteColumnName(s: string): string
+ }
+ interface Errors {
+  /**
+   * Error returns the error string of Errors.
+   */
+  error(): string
+ }
+ /**
+  * Expression represents a DB expression that can be embedded in a SQL statement.
+  */
+ interface Expression {
+  [key:string]: any;
+  /**
+   * Build converts an expression into a SQL fragment.
+   * If the expression contains binding parameters, they will be added to the given Params.
+   */
+  build(_arg0: DB, _arg1: Params): string
+ }
+ /**
+  * HashExp represents a hash expression.
+  * 
+  * A hash expression is a map whose keys are DB column names which need to be filtered according
+  * to the corresponding values. For example, HashExp{"level": 2, "dept": 10} will generate
+  * the SQL: "level"=2 AND "dept"=10.
+  * 
+  * HashExp also handles nil values and slice values. For example, HashExp{"level": []interface{}{1, 2}, "dept": nil}
+  * will generate: "level" IN (1, 2) AND "dept" IS NULL.
+  */
+ interface HashExp extends _TygojaDict{}
+ interface newExp {
+  /**
+   * NewExp generates an expression with the specified SQL fragment and the optional binding parameters.
+   */
+  (e: string, ...params: Params[]): Expression
+ }
+ interface not {
+  /**
+   * Not generates a NOT expression which prefixes "NOT" to the specified expression.
+   */
+  (e: Expression): Expression
+ }
+ interface and {
+  /**
+   * And generates an AND expression which concatenates the given expressions with "AND".
+   */
+  (...exps: Expression[]): Expression
+ }
+ interface or {
+  /**
+   * Or generates an OR expression which concatenates the given expressions with "OR".
+   */
+  (...exps: Expression[]): Expression
+ }
+ interface _in {
+  /**
+   * In generates an IN expression for the specified column and the list of allowed values.
+   * If values is empty, a SQL "0=1" will be generated which represents a false expression.
+   */
+  (col: string, ...values: {
+   }[]): Expression
+ }
+ interface notIn {
+  /**
+   * NotIn generates an NOT IN expression for the specified column and the list of disallowed values.
+   * If values is empty, an empty string will be returned indicating a true expression.
+   */
+  (col: string, ...values: {
+   }[]): Expression
+ }
+ interface like {
+  /**
+   * Like generates a LIKE expression for the specified column and the possible strings that the column should be like.
+   * If multiple values are present, the column should be like *all* of them. For example, Like("name", "key", "word")
+   * will generate a SQL expression: "name" LIKE "%key%" AND "name" LIKE "%word%".
+   * 
+   * By default, each value will be surrounded by "%" to enable partial matching. If a value contains special characters
+   * such as "%", "\", "_", they will also be properly escaped.
+   * 
+   * You may call Escape() and/or Match() to change the default behavior. For example, Like("name", "key").Match(false, true)
+   * generates "name" LIKE "key%".
+   */
+  (col: string, ...values: string[]): (LikeExp)
+ }
+ interface notLike {
+  /**
+   * NotLike generates a NOT LIKE expression.
+   * For example, NotLike("name", "key", "word") will generate a SQL expression:
+   * "name" NOT LIKE "%key%" AND "name" NOT LIKE "%word%". Please see Like() for more details.
+   */
+  (col: string, ...values: string[]): (LikeExp)
+ }
+ interface orLike {
+  /**
+   * OrLike generates an OR LIKE expression.
+   * This is similar to Like() except that the column should be like one of the possible values.
+   * For example, OrLike("name", "key", "word") will generate a SQL expression:
+   * "name" LIKE "%key%" OR "name" LIKE "%word%". Please see Like() for more details.
+   */
+  (col: string, ...values: string[]): (LikeExp)
+ }
+ interface orNotLike {
+  /**
+   * OrNotLike generates an OR NOT LIKE expression.
+   * For example, OrNotLike("name", "key", "word") will generate a SQL expression:
+   * "name" NOT LIKE "%key%" OR "name" NOT LIKE "%word%". Please see Like() for more details.
+   */
+  (col: string, ...values: string[]): (LikeExp)
+ }
+ interface exists {
+  /**
+   * Exists generates an EXISTS expression by prefixing "EXISTS" to the given expression.
+   */
+  (exp: Expression): Expression
+ }
+ interface notExists {
+  /**
+   * NotExists generates an EXISTS expression by prefixing "NOT EXISTS" to the given expression.
+   */
+  (exp: Expression): Expression
+ }
+ interface between {
+  /**
+   * Between generates a BETWEEN expression.
+   * For example, Between("age", 10, 30) generates: "age" BETWEEN 10 AND 30
+   */
+  (col: string, from: {
+   }, to: {
+   }): Expression
+ }
+ interface notBetween {
+  /**
+   * NotBetween generates a NOT BETWEEN expression.
+   * For example, NotBetween("age", 10, 30) generates: "age" NOT BETWEEN 10 AND 30
+   */
+  (col: string, from: {
+   }, to: {
+   }): Expression
+ }
+ /**
+  * Exp represents an expression with a SQL fragment and a list of optional binding parameters.
+  */
+ interface Exp {
+ }
+ interface Exp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ interface HashExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * NotExp represents an expression that should prefix "NOT" to a specified expression.
+  */
+ interface NotExp {
+ }
+ interface NotExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * AndOrExp represents an expression that concatenates multiple expressions using either "AND" or "OR".
+  */
+ interface AndOrExp {
+ }
+ interface AndOrExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * InExp represents an "IN" or "NOT IN" expression.
+  */
+ interface InExp {
+ }
+ interface InExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * LikeExp represents a variant of LIKE expressions.
+  */
+ interface LikeExp {
+  /**
+   * Like stores the LIKE operator. It can be "LIKE", "NOT LIKE".
+   * It may also be customized as something like "ILIKE".
+   */
+  like: string
+ }
+ interface LikeExp {
+  /**
+   * Escape specifies how a LIKE expression should be escaped.
+   * Each string at position 2i represents a special character and the string at position 2i+1 is
+   * the corresponding escaped version.
+   */
+  escape(...chars: string[]): (LikeExp)
+ }
+ interface LikeExp {
+  /**
+   * Match specifies whether to do wildcard matching on the left and/or right of given strings.
+   */
+  match(left: boolean, right: boolean): (LikeExp)
+ }
+ interface LikeExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * ExistsExp represents an EXISTS or NOT EXISTS expression.
+  */
+ interface ExistsExp {
+ }
+ interface ExistsExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * BetweenExp represents a BETWEEN or a NOT BETWEEN expression.
+  */
+ interface BetweenExp {
+ }
+ interface BetweenExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ interface enclose {
+  /**
+   * Enclose surrounds the provided nonempty expression with parenthesis "()".
+   */
+  (exp: Expression): Expression
+ }
+ /**
+  * EncloseExp represents a parenthesis enclosed expression.
+  */
+ interface EncloseExp {
+ }
+ interface EncloseExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * TableModel is the interface that should be implemented by models which have unconventional table names.
+  */
+ interface TableModel {
+  [key:string]: any;
+  tableName(): string
+ }
+ /**
+  * ModelQuery represents a query associated with a struct model.
+  */
+ interface ModelQuery {
+ }
+ interface newModelQuery {
+  (model: {
+   }, fieldMapFunc: FieldMapFunc, db: DB, builder: Builder): (ModelQuery)
+ }
+ interface ModelQuery {
+  /**
+   * Context returns the context associated with the query.
+   */
+  context(): context.Context
+ }
+ interface ModelQuery {
+  /**
+   * WithContext associates a context with the query.
+   */
+  withContext(ctx: context.Context): (ModelQuery)
+ }
+ interface ModelQuery {
+  /**
+   * Exclude excludes the specified struct fields from being inserted/updated into the DB table.
+   */
+  exclude(...attrs: string[]): (ModelQuery)
+ }
+ interface ModelQuery {
+  /**
+   * Insert inserts a row in the table using the struct model associated with this query.
+   * 
+   * By default, it inserts *all* public fields into the table, including those nil or empty ones.
+   * You may pass a list of the fields to this method to indicate that only those fields should be inserted.
+   * You may also call Exclude to exclude some fields from being inserted.
+   * 
+   * If a model has an empty primary key, it is considered auto-incremental and the corresponding struct
+   * field will be filled with the generated primary key value after a successful insertion.
+   */
+  insert(...attrs: string[]): void
+ }
+ interface ModelQuery {
+  /**
+   * Update updates a row in the table using the struct model associated with this query.
+   * The row being updated has the same primary key as specified by the model.
+   * 
+   * By default, it updates *all* public fields in the table, including those nil or empty ones.
+   * You may pass a list of the fields to this method to indicate that only those fields should be updated.
+   * You may also call Exclude to exclude some fields from being updated.
+   */
+  update(...attrs: string[]): void
+ }
+ interface ModelQuery {
+  /**
+   * Delete deletes a row in the table using the primary key specified by the struct model associated with this query.
+   */
+  delete(): void
+ }
+ /**
+  * ExecHookFunc executes before op allowing custom handling like auto fail/retry.
+  */
+ interface ExecHookFunc {(q: Query, op: () => void): void }
+ /**
+  * OneHookFunc executes right before the query populate the row result from One() call (aka. op).
+  */
+ interface OneHookFunc {(q: Query, a: {
+  }, op: (b: {
+  }) => void): void }
+ /**
+  * AllHookFunc executes right before the query populate the row result from All() call (aka. op).
+  */
+ interface AllHookFunc {(q: Query, sliceA: {
+  }, op: (sliceB: {
+  }) => void): void }
+ /**
+  * Params represents a list of parameter values to be bound to a SQL statement.
+  * The map keys are the parameter names while the map values are the corresponding parameter values.
+  */
+ interface Params extends _TygojaDict{}
+ /**
+  * Executor prepares, executes, or queries a SQL statement.
+  */
+ interface Executor {
+  [key:string]: any;
+  /**
+   * Exec executes a SQL statement
+   */
+  exec(query: string, ...args: {
+  }[]): sql.Result
+  /**
+   * ExecContext executes a SQL statement with the given context
+   */
+  execContext(ctx: context.Context, query: string, ...args: {
+  }[]): sql.Result
+  /**
+   * Query queries a SQL statement
+   */
+  query(query: string, ...args: {
+  }[]): (sql.Rows)
+  /**
+   * QueryContext queries a SQL statement with the given context
+   */
+  queryContext(ctx: context.Context, query: string, ...args: {
+  }[]): (sql.Rows)
+  /**
+   * Prepare creates a prepared statement
+   */
+  prepare(query: string): (sql.Stmt)
+ }
+ /**
+  * Query represents a SQL statement to be executed.
+  */
+ interface Query {
+  /**
+   * FieldMapper maps struct field names to DB column names.
+   */
+  fieldMapper: FieldMapFunc
+  /**
+   * LastError contains the last error (if any) of the query.
+   * LastError is cleared by Execute(), Row(), Rows(), One(), and All().
+   */
+  lastError: Error
+  /**
+   * LogFunc is used to log the SQL statement being executed.
+   */
+  logFunc: LogFunc
+  /**
+   * PerfFunc is used to log the SQL execution time. It is ignored if nil.
+   * Deprecated: Please use QueryLogFunc and ExecLogFunc instead.
+   */
+  perfFunc: PerfFunc
+  /**
+   * QueryLogFunc is called each time when performing a SQL query that returns data.
+   */
+  queryLogFunc: QueryLogFunc
+  /**
+   * ExecLogFunc is called each time when a SQL statement is executed.
+   */
+  execLogFunc: ExecLogFunc
+ }
+ interface newQuery {
+  /**
+   * NewQuery creates a new Query with the given SQL statement.
+   */
+  (db: DB, executor: Executor, sql: string): (Query)
+ }
+ interface Query {
+  /**
+   * SQL returns the original SQL used to create the query.
+   * The actual SQL (RawSQL) being executed is obtained by replacing the named
+   * parameter placeholders with anonymous ones.
+   */
+  sql(): string
+ }
+ interface Query {
+  /**
+   * Context returns the context associated with the query.
+   */
+  context(): context.Context
+ }
+ interface Query {
+  /**
+   * WithContext associates a context with the query.
+   */
+  withContext(ctx: context.Context): (Query)
+ }
+ interface Query {
+  /**
+   * WithExecHook associates the provided exec hook function with the query.
+   * 
+   * It is called for every Query resolver (Execute(), One(), All(), Row(), Column()),
+   * allowing you to implement auto fail/retry or any other additional handling.
+   */
+  withExecHook(fn: ExecHookFunc): (Query)
+ }
+ interface Query {
+  /**
+   * WithOneHook associates the provided hook function with the query,
+   * called on q.One(), allowing you to implement custom struct scan based
+   * on the One() argument and/or result.
+   */
+  withOneHook(fn: OneHookFunc): (Query)
+ }
+ interface Query {
+  /**
+   * WithOneHook associates the provided hook function with the query,
+   * called on q.All(), allowing you to implement custom slice scan based
+   * on the All() argument and/or result.
+   */
+  withAllHook(fn: AllHookFunc): (Query)
+ }
+ interface Query {
+  /**
+   * Params returns the parameters to be bound to the SQL statement represented by this query.
+   */
+  params(): Params
+ }
+ interface Query {
+  /**
+   * Prepare creates a prepared statement for later queries or executions.
+   * Close() should be called after finishing all queries.
+   */
+  prepare(): (Query)
+ }
+ interface Query {
+  /**
+   * Close closes the underlying prepared statement.
+   * Close does nothing if the query has not been prepared before.
+   */
+  close(): void
+ }
+ interface Query {
+  /**
+   * Bind sets the parameters that should be bound to the SQL statement.
+   * The parameter placeholders in the SQL statement are in the format of "{:ParamName}".
+   */
+  bind(params: Params): (Query)
+ }
+ interface Query {
+  /**
+   * Execute executes the SQL statement without retrieving data.
+   */
+  execute(): sql.Result
+ }
+ interface Query {
+  /**
+   * One executes the SQL statement and populates the first row of the result into a struct or NullStringMap.
+   * Refer to Rows.ScanStruct() and Rows.ScanMap() for more details on how to specify
+   * the variable to be populated.
+   * Note that when the query has no rows in the result set, an sql.ErrNoRows will be returned.
+   */
+  one(a: {
+   }): void
+ }
+ interface Query {
+  /**
+   * All executes the SQL statement and populates all the resulting rows into a slice of struct or NullStringMap.
+   * The slice must be given as a pointer. Each slice element must be either a struct or a NullStringMap.
+   * Refer to Rows.ScanStruct() and Rows.ScanMap() for more details on how each slice element can be.
+   * If the query returns no row, the slice will be an empty slice (not nil).
+   */
+  all(slice: {
+   }): void
+ }
+ interface Query {
+  /**
+   * Row executes the SQL statement and populates the first row of the result into a list of variables.
+   * Note that the number of the variables should match to that of the columns in the query result.
+   * Note that when the query has no rows in the result set, an sql.ErrNoRows will be returned.
+   */
+  row(...a: {
+   }[]): void
+ }
+ interface Query {
+  /**
+   * Column executes the SQL statement and populates the first column of the result into a slice.
+   * Note that the parameter must be a pointer to a slice.
+   */
+  column(a: {
+   }): void
+ }
+ interface Query {
+  /**
+   * Rows executes the SQL statement and returns a Rows object to allow retrieving data row by row.
+   */
+  rows(): (Rows)
+ }
+ /**
+  * QueryBuilder builds different clauses for a SELECT SQL statement.
+  */
+ interface QueryBuilder {
+  [key:string]: any;
+  /**
+   * BuildSelect generates a SELECT clause from the given selected column names.
+   */
+  buildSelect(cols: Array<string>, distinct: boolean, option: string): string
+  /**
+   * BuildFrom generates a FROM clause from the given tables.
+   */
+  buildFrom(tables: Array<string>): string
+  /**
+   * BuildGroupBy generates a GROUP BY clause from the given group-by columns.
+   */
+  buildGroupBy(cols: Array<string>): string
+  /**
+   * BuildJoin generates a JOIN clause from the given join information.
+   */
+  buildJoin(_arg0: Array<JoinInfo>, _arg1: Params): string
+  /**
+   * BuildWhere generates a WHERE clause from the given expression.
+   */
+  buildWhere(_arg0: Expression, _arg1: Params): string
+  /**
+   * BuildHaving generates a HAVING clause from the given expression.
+   */
+  buildHaving(_arg0: Expression, _arg1: Params): string
+  /**
+   * BuildOrderByAndLimit generates the ORDER BY and LIMIT clauses.
+   */
+  buildOrderByAndLimit(_arg0: string, _arg1: Array<string>, _arg2: number, _arg3: number): string
+  /**
+   * BuildUnion generates a UNION clause from the given union information.
+   */
+  buildUnion(_arg0: Array<UnionInfo>, _arg1: Params): string
+ }
+ /**
+  * BaseQueryBuilder provides a basic implementation of QueryBuilder.
+  */
+ interface BaseQueryBuilder {
+ }
+ interface newBaseQueryBuilder {
+  /**
+   * NewBaseQueryBuilder creates a new BaseQueryBuilder instance.
+   */
+  (db: DB): (BaseQueryBuilder)
+ }
+ interface BaseQueryBuilder {
+  /**
+   * DB returns the DB instance associated with the query builder.
+   */
+  db(): (DB)
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildSelect generates a SELECT clause from the given selected column names.
+   */
+  buildSelect(cols: Array<string>, distinct: boolean, option: string): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildFrom generates a FROM clause from the given tables.
+   */
+  buildFrom(tables: Array<string>): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildJoin generates a JOIN clause from the given join information.
+   */
+  buildJoin(joins: Array<JoinInfo>, params: Params): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildWhere generates a WHERE clause from the given expression.
+   */
+  buildWhere(e: Expression, params: Params): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildHaving generates a HAVING clause from the given expression.
+   */
+  buildHaving(e: Expression, params: Params): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildGroupBy generates a GROUP BY clause from the given group-by columns.
+   */
+  buildGroupBy(cols: Array<string>): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildOrderByAndLimit generates the ORDER BY and LIMIT clauses.
+   */
+  buildOrderByAndLimit(sql: string, cols: Array<string>, limit: number, offset: number): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildUnion generates a UNION clause from the given union information.
+   */
+  buildUnion(unions: Array<UnionInfo>, params: Params): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildOrderBy generates the ORDER BY clause.
+   */
+  buildOrderBy(cols: Array<string>): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildLimit generates the LIMIT clause.
+   */
+  buildLimit(limit: number, offset: number): string
+ }
+ /**
+  * VarTypeError indicates a variable type error when trying to populating a variable with DB result.
+  */
+ interface VarTypeError extends String{}
+ interface VarTypeError {
+  /**
+   * Error returns the error message.
+   */
+  error(): string
+ }
+ /**
+  * NullStringMap is a map of sql.NullString that can be used to hold DB query result.
+  * The map keys correspond to the DB column names, while the map values are their corresponding column values.
+  */
+ interface NullStringMap extends _TygojaDict{}
+ /**
+  * Rows enhances sql.Rows by providing additional data query methods.
+  * Rows can be obtained by calling Query.Rows(). It is mainly used to populate data row by row.
+  */
+ type _sguxiye = sql.Rows
+ interface Rows extends _sguxiye {
+ }
+ interface Rows {
+  /**
+   * ScanMap populates the current row of data into a NullStringMap.
+   * Note that the NullStringMap must not be nil, or it will panic.
+   * The NullStringMap will be populated using column names as keys and their values as
+   * the corresponding element values.
+   */
+  scanMap(a: NullStringMap): void
+ }
+ interface Rows {
+  /**
+   * ScanStruct populates the current row of data into a struct.
+   * The struct must be given as a pointer.
+   * 
+   * ScanStruct associates struct fields with DB table columns through a field mapping function.
+   * It populates a struct field with the data of its associated column.
+   * Note that only exported struct fields will be populated.
+   * 
+   * By default, DefaultFieldMapFunc() is used to map struct fields to table columns.
+   * This function separates each word in a field name with a underscore and turns every letter into lower case.
+   * For example, "LastName" is mapped to "last_name", "MyID" is mapped to "my_id", and so on.
+   * To change the default behavior, set DB.FieldMapper with your custom mapping function.
+   * You may also set Query.FieldMapper to change the behavior for particular queries.
+   */
+  scanStruct(a: {
+   }): void
+ }
+ /**
+  * BuildHookFunc defines a callback function that is executed on Query creation.
+  */
+ interface BuildHookFunc {(q: Query): void }
+ /**
+  * SelectQuery represents a DB-agnostic SELECT query.
+  * It can be built into a DB-specific query by calling the Build() method.
+  */
+ interface SelectQuery {
+  /**
+   * FieldMapper maps struct field names to DB column names.
+   */
+  fieldMapper: FieldMapFunc
+  /**
+   * TableMapper maps structs to DB table names.
+   */
+  tableMapper: TableMapFunc
+ }
+ /**
+  * JoinInfo contains the specification for a JOIN clause.
+  */
+ interface JoinInfo {
+  join: string
+  table: string
+  on: Expression
+ }
+ /**
+  * UnionInfo contains the specification for a UNION clause.
+  */
+ interface UnionInfo {
+  all: boolean
+  query?: Query
+ }
+ interface newSelectQuery {
+  /**
+   * NewSelectQuery creates a new SelectQuery instance.
+   */
+  (builder: Builder, db: DB): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * WithBuildHook runs the provided hook function with the query created on Build().
+   */
+  withBuildHook(fn: BuildHookFunc): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Context returns the context associated with the query.
+   */
+  context(): context.Context
+ }
+ interface SelectQuery {
+  /**
+   * WithContext associates a context with the query.
+   */
+  withContext(ctx: context.Context): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * PreFragment sets SQL fragment that should be prepended before the select query (e.g. WITH clause).
+   */
+  preFragment(fragment: string): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * PostFragment sets SQL fragment that should be appended at the end of the select query.
+   */
+  postFragment(fragment: string): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Select specifies the columns to be selected.
+   * Column names will be automatically quoted.
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndSelect adds additional columns to be selected.
+   * Column names will be automatically quoted.
+   */
+  andSelect(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Distinct specifies whether to select columns distinctively.
+   * By default, distinct is false.
+   */
+  distinct(v: boolean): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * SelectOption specifies additional option that should be append to "SELECT".
+   */
+  selectOption(option: string): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * From specifies which tables to select from.
+   * Table names will be automatically quoted.
+   */
+  from(...tables: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Where specifies the WHERE condition.
+   */
+  where(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndWhere concatenates a new WHERE condition with the existing one (if any) using "AND".
+   */
+  andWhere(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * OrWhere concatenates a new WHERE condition with the existing one (if any) using "OR".
+   */
+  orWhere(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Join specifies a JOIN clause.
+   * The "typ" parameter specifies the JOIN type (e.g. "INNER JOIN", "LEFT JOIN").
+   */
+  join(typ: string, table: string, on: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * InnerJoin specifies an INNER JOIN clause.
+   * This is a shortcut method for Join.
+   */
+  innerJoin(table: string, on: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * LeftJoin specifies a LEFT JOIN clause.
+   * This is a shortcut method for Join.
+   */
+  leftJoin(table: string, on: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * RightJoin specifies a RIGHT JOIN clause.
+   * This is a shortcut method for Join.
+   */
+  rightJoin(table: string, on: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * OrderBy specifies the ORDER BY clause.
+   * Column names will be properly quoted. A column name can contain "ASC" or "DESC" to indicate its ordering direction.
+   */
+  orderBy(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndOrderBy appends additional columns to the existing ORDER BY clause.
+   * Column names will be properly quoted. A column name can contain "ASC" or "DESC" to indicate its ordering direction.
+   */
+  andOrderBy(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * GroupBy specifies the GROUP BY clause.
+   * Column names will be properly quoted.
+   */
+  groupBy(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndGroupBy appends additional columns to the existing GROUP BY clause.
+   * Column names will be properly quoted.
+   */
+  andGroupBy(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Having specifies the HAVING clause.
+   */
+  having(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndHaving concatenates a new HAVING condition with the existing one (if any) using "AND".
+   */
+  andHaving(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * OrHaving concatenates a new HAVING condition with the existing one (if any) using "OR".
+   */
+  orHaving(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Union specifies a UNION clause.
+   */
+  union(q: Query): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * UnionAll specifies a UNION ALL clause.
+   */
+  unionAll(q: Query): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Limit specifies the LIMIT clause.
+   * A negative limit means no limit.
+   */
+  limit(limit: number): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Offset specifies the OFFSET clause.
+   * A negative offset means no offset.
+   */
+  offset(offset: number): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Bind specifies the parameter values to be bound to the query.
+   */
+  bind(params: Params): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndBind appends additional parameters to be bound to the query.
+   */
+  andBind(params: Params): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Build builds the SELECT query and returns an executable Query object.
+   */
+  build(): (Query)
+ }
+ interface SelectQuery {
+  /**
+   * One executes the SELECT query and populates the first row of the result into the specified variable.
+   * 
+   * If the query does not specify a "from" clause, the method will try to infer the name of the table
+   * to be selected from by calling getTableName() which will return either the variable type name
+   * or the TableName() method if the variable implements the TableModel interface.
+   * 
+   * Note that when the query has no rows in the result set, an sql.ErrNoRows will be returned.
+   */
+  one(a: {
+   }): void
+ }
+ interface SelectQuery {
+  /**
+   * Model selects the row with the specified primary key and populates the model with the row data.
+   * 
+   * The model variable should be a pointer to a struct. If the query does not specify a "from" clause,
+   * it will use the model struct to determine which table to select data from. It will also use the model
+   * to infer the name of the primary key column. Only simple primary key is supported. For composite primary keys,
+   * please use Where() to specify the filtering condition.
+   */
+  model(pk: {
+   }, model: {
+   }): void
+ }
+ interface SelectQuery {
+  /**
+   * All executes the SELECT query and populates all rows of the result into a slice.
+   * 
+   * Note that the slice must be passed in as a pointer.
+   * 
+   * If the query does not specify a "from" clause, the method will try to infer the name of the table
+   * to be selected from by calling getTableName() which will return either the type name of the slice elements
+   * or the TableName() method if the slice element implements the TableModel interface.
+   */
+  all(slice: {
+   }): void
+ }
+ interface SelectQuery {
+  /**
+   * Rows builds and executes the SELECT query and returns a Rows object for data retrieval purpose.
+   * This is a shortcut to SelectQuery.Build().Rows()
+   */
+  rows(): (Rows)
+ }
+ interface SelectQuery {
+  /**
+   * Row builds and executes the SELECT query and populates the first row of the result into the specified variables.
+   * This is a shortcut to SelectQuery.Build().Row()
+   */
+  row(...a: {
+   }[]): void
+ }
+ interface SelectQuery {
+  /**
+   * Column builds and executes the SELECT statement and populates the first column of the result into a slice.
+   * Note that the parameter must be a pointer to a slice.
+   * This is a shortcut to SelectQuery.Build().Column()
+   */
+  column(a: {
+   }): void
+ }
+ /**
+  * QueryInfo represents a debug/info struct with exported SelectQuery fields.
+  */
+ interface QueryInfo {
+  preFragment: string
+  postFragment: string
+  builder: Builder
+  selects: Array<string>
+  distinct: boolean
+  selectOption: string
+  from: Array<string>
+  where: Expression
+  join: Array<JoinInfo>
+  orderBy: Array<string>
+  groupBy: Array<string>
+  having: Expression
+  union: Array<UnionInfo>
+  limit: number
+  offset: number
+  params: Params
+  context: context.Context
+  buildHook: BuildHookFunc
+ }
+ interface SelectQuery {
+  /**
+   * Info exports common SelectQuery fields allowing to inspect the
+   * current select query options.
+   */
+  info(): (QueryInfo)
+ }
+ /**
+  * FieldMapFunc converts a struct field name into a DB column name.
+  */
+ interface FieldMapFunc {(_arg0: string): string }
+ /**
+  * TableMapFunc converts a sample struct into a DB table name.
+  */
+ interface TableMapFunc {(a: {
+  }): string }
+ interface structInfo {
+ }
+ type _sPncttL = structInfo
+ interface structValue extends _sPncttL {
+ }
+ interface fieldInfo {
+ }
+ interface structInfoMapKey {
+ }
+ /**
+  * PostScanner is an optional interface used by ScanStruct.
+  */
+ interface PostScanner {
+  [key:string]: any;
+  /**
+   * PostScan executes right after the struct has been populated
+   * with the DB values, allowing you to further normalize or validate
+   * the loaded data.
+   */
+  postScan(): void
+ }
+ interface defaultFieldMapFunc {
+  /**
+   * DefaultFieldMapFunc maps a field name to a DB column name.
+   * The mapping rule set by this method is that words in a field name will be separated by underscores
+   * and the name will be turned into lower case. For example, "FirstName" maps to "first_name", and "MyID" becomes "my_id".
+   * See DB.FieldMapper for more details.
+   */
+  (f: string): string
+ }
+ interface getTableName {
+  /**
+   * GetTableName implements the default way of determining the table name corresponding to the given model struct
+   * or slice of structs. To get the actual table name for a model, you should use DB.TableMapFunc() instead.
+   * Do not call this method in a model's TableName() method because it will cause infinite loop.
+   */
+  (a: {
+   }): string
+ }
+ /**
+  * Tx enhances sql.Tx with additional querying methods.
+  */
+ type _sbhRiou = Builder
+ interface Tx extends _sbhRiou {
+ }
+ interface Tx {
+  /**
+   * Commit commits the transaction.
+   */
+  commit(): void
+ }
+ interface Tx {
+  /**
+   * Rollback aborts the transaction.
+   */
+  rollback(): void
+ }
+}
+
+namespace security {
+ interface s256Challenge {
+  /**
+   * S256Challenge creates base64 encoded sha256 challenge string derived from code.
+   * The padding of the result base64 string is stripped per [RFC 7636].
+   * 
+   * [RFC 7636]: https://datatracker.ietf.org/doc/html/rfc7636#section-4.2
+   */
+  (code: string): string
+ }
+ interface md5 {
+  /**
+   * MD5 creates md5 hash from the provided plain text.
+   */
+  (text: string): string
+ }
+ interface sha256 {
+  /**
+   * SHA256 creates sha256 hash as defined in FIPS 180-4 from the provided text.
+   */
+  (text: string): string
+ }
+ interface sha512 {
+  /**
+   * SHA512 creates sha512 hash as defined in FIPS 180-4 from the provided text.
+   */
+  (text: string): string
+ }
+ interface hs256 {
+  /**
+   * HS256 creates a HMAC hash with sha256 digest algorithm.
+   */
+  (text: string, secret: string): string
+ }
+ interface hs512 {
+  /**
+   * HS512 creates a HMAC hash with sha512 digest algorithm.
+   */
+  (text: string, secret: string): string
+ }
+ interface equal {
+  /**
+   * Equal compares two hash strings for equality without leaking timing information.
+   */
+  (hash1: string, hash2: string): boolean
+ }
+ // @ts-ignore
+ import crand = rand
+ interface encrypt {
+  /**
+   * Encrypt encrypts "data" with the specified "key" (must be valid 32 char AES key).
+   * 
+   * This method uses AES-256-GCM block cypher mode.
+   */
+  (data: string|Array<number>, key: string): string
+ }
+ interface decrypt {
+  /**
+   * Decrypt decrypts encrypted text with key (must be valid 32 chars AES key).
+   * 
+   * This method uses AES-256-GCM block cypher mode.
+   */
+  (cipherText: string, key: string): string|Array<number>
+ }
+ interface parseUnverifiedJWT {
+  /**
+   * ParseUnverifiedJWT parses JWT and returns its claims
+   * but DOES NOT verify the signature.
+   * 
+   * It verifies only the exp, iat and nbf claims.
+   */
+  (token: string): jwt.MapClaims
+ }
+ interface parseJWT {
+  /**
+   * ParseJWT verifies and parses JWT and returns its claims.
+   */
+  (token: string, verificationKey: string): jwt.MapClaims
+ }
+ interface newJWT {
+  /**
+   * NewJWT generates and returns new HS256 signed JWT.
+   */
+  (payload: jwt.MapClaims, signingKey: string, duration: time.Duration): string
+ }
+ // @ts-ignore
+ import cryptoRand = rand
+ // @ts-ignore
+ import mathRand = rand
+ interface randomString {
+  /**
+   * RandomString generates a cryptographically random string with the specified length.
+   * 
+   * The generated string matches [A-Za-z0-9]+ and it's transparent to URL-encoding.
+   */
+  (length: number): string
+ }
+ interface randomStringWithAlphabet {
+  /**
+   * RandomStringWithAlphabet generates a cryptographically random string
+   * with the specified length and characters set.
+   * 
+   * It panics if for some reason rand.Int returns a non-nil error.
+   */
+  (length: number, alphabet: string): string
+ }
+ interface pseudorandomString {
+  /**
+   * PseudorandomString generates a pseudorandom string with the specified length.
+   * 
+   * The generated string matches [A-Za-z0-9]+ and it's transparent to URL-encoding.
+   * 
+   * For a cryptographically random string (but a little bit slower) use RandomString instead.
+   */
+  (length: number): string
+ }
+ interface pseudorandomStringWithAlphabet {
+  /**
+   * PseudorandomStringWithAlphabet generates a pseudorandom string
+   * with the specified length and characters set.
+   * 
+   * For a cryptographically random (but a little bit slower) use RandomStringWithAlphabet instead.
+   */
+  (length: number, alphabet: string): string
+ }
+ interface randomStringByRegex {
+  /**
+   * RandomStringByRegex generates a random string matching the regex pattern.
+   * If optFlags is not set, fallbacks to [syntax.Perl].
+   * 
+   * NB! While the source of the randomness comes from [crypto/rand] this method
+   * is not recommended to be used on its own in critical secure contexts because
+   * the generated length could vary too much on the used pattern and may not be
+   * as secure as simply calling [security.RandomString].
+   * If you still insist on using it for such purposes, consider at least
+   * a large enough minimum length for the generated string, e.g. `[a-z0-9]{30}`.
+   * 
+   * This function is inspired by github.com/pipe01/revregexp, github.com/lucasjones/reggen and other similar packages.
+   */
+  (pattern: string, ...optFlags: syntax.Flags[]): string
+ }
+}
+
+namespace filesystem {
+ /**
+  * FileReader defines an interface for a file resource reader.
+  */
+ interface FileReader {
+  [key:string]: any;
+  open(): io.ReadSeekCloser
+ }
+ /**
+  * File defines a single file [io.ReadSeekCloser] resource.
+  * 
+  * The file could be from a local path, multipart/form-data header, etc.
+  */
+ interface File {
+  reader: FileReader
+  name: string
+  originalName: string
+  size: number
+ }
+ interface File {
+  /**
+   * AsMap implements [core.mapExtractor] and returns a value suitable
+   * to be used in an API rule expression.
+   */
+  asMap(): _TygojaDict
+ }
+ interface newFileFromPath {
+  /**
+   * NewFileFromPath creates a new File instance from the provided local file path.
+   */
+  (path: string): (File)
+ }
+ interface newFileFromBytes {
+  /**
+   * NewFileFromBytes creates a new File instance from the provided byte slice.
+   */
+  (b: string|Array<number>, name: string): (File)
+ }
+ interface newFileFromMultipart {
+  /**
+   * NewFileFromMultipart creates a new File from the provided multipart header.
+   */
+  (mh: multipart.FileHeader): (File)
+ }
+ interface newFileFromURL {
+  /**
+   * NewFileFromURL creates a new File from the provided url by
+   * downloading the resource and load it as BytesReader.
+   * 
+   * Example
+   * 
+   * ```
+   * 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+   * 	defer cancel()
+   * 
+   * 	file, err := filesystem.NewFileFromURL(ctx, "https://example.com/image.png")
+   * ```
+   */
+  (ctx: context.Context, url: string): (File)
+ }
+ /**
+  * MultipartReader defines a FileReader from [multipart.FileHeader].
+  */
+ interface MultipartReader {
+  header?: multipart.FileHeader
+ }
+ interface MultipartReader {
+  /**
+   * Open implements the [filesystem.FileReader] interface.
+   */
+  open(): io.ReadSeekCloser
+ }
+ /**
+  * PathReader defines a FileReader from a local file path.
+  */
+ interface PathReader {
+  path: string
+ }
+ interface PathReader {
+  /**
+   * Open implements the [filesystem.FileReader] interface.
+   */
+  open(): io.ReadSeekCloser
+ }
+ /**
+  * BytesReader defines a FileReader from bytes content.
+  */
+ interface BytesReader {
+  bytes: string|Array<number>
+ }
+ interface BytesReader {
+  /**
+   * Open implements the [filesystem.FileReader] interface.
+   */
+  open(): io.ReadSeekCloser
+ }
+ type _sgrUUXz = bytes.Reader
+ interface bytesReadSeekCloser extends _sgrUUXz {
+ }
+ interface bytesReadSeekCloser {
+  /**
+   * Close implements the [io.ReadSeekCloser] interface.
+   */
+  close(): void
+ }
+ /**
+  * openFuncAsReader defines a FileReader from a bare Open function.
+  */
+ interface openFuncAsReader {(): io.ReadSeekCloser }
+ interface openFuncAsReader {
+  /**
+   * Open implements the [filesystem.FileReader] interface.
+   */
+  open(): io.ReadSeekCloser
+ }
+ interface System {
+ }
+ interface newS3 {
+  /**
+   * NewS3 initializes an S3 filesystem instance.
+   * 
+   * NB! Make sure to call `Close()` after you are done working with it.
+   */
+  (bucketName: string, region: string, endpoint: string, accessKey: string, secretKey: string, s3ForcePathStyle: boolean): (System)
+ }
+ interface newLocal {
+  /**
+   * NewLocal initializes a new local filesystem instance.
+   * 
+   * NB! Make sure to call `Close()` after you are done working with it.
+   */
+  (dirPath: string): (System)
+ }
+ interface System {
+  /**
+   * SetContext assigns the specified context to the current filesystem.
+   */
+  setContext(ctx: context.Context): void
+ }
+ interface System {
+  /**
+   * Close releases any resources used for the related filesystem.
+   */
+  close(): void
+ }
+ interface System {
+  /**
+   * Exists checks if file with fileKey path exists or not.
+   */
+  exists(fileKey: string): boolean
+ }
+ interface System {
+  /**
+   * Attributes returns the attributes for the file with fileKey path.
+   * 
+   * If the file doesn't exist it returns ErrNotFound.
+   */
+  attributes(fileKey: string): (blob.Attributes)
+ }
+ interface System {
+  /**
+   * GetReader returns a file content reader for the given fileKey.
+   * 
+   * NB! Make sure to call Close() on the file after you are done working with it.
+   * 
+   * If the file doesn't exist returns ErrNotFound.
+   */
+  getReader(fileKey: string): (blob.Reader)
+ }
+ interface System {
+  /**
+   * Deprecated: Please use GetReader(fileKey) instead.
+   */
+  getFile(fileKey: string): (blob.Reader)
+ }
+ interface System {
+  /**
+   * GetReuploadableFile constructs a new reuploadable File value
+   * from the associated fileKey blob.Reader.
+   * 
+   * If preserveName is false then the returned File.Name will have
+   * a new randomly generated suffix, otherwise it will reuse the original one.
+   * 
+   * This method could be useful in case you want to clone an existing
+   * Record file and assign it to a new Record (e.g. in a Record duplicate action).
+   * 
+   * If you simply want to copy an existing file to a new location you
+   * could check the Copy(srcKey, dstKey) method.
+   */
+  getReuploadableFile(fileKey: string, preserveName: boolean): (File)
+ }
+ interface System {
+  /**
+   * Copy copies the file stored at srcKey to dstKey.
+   * 
+   * If srcKey file doesn't exist, it returns ErrNotFound.
+   * 
+   * If dstKey file already exists, it is overwritten.
+   */
+  copy(srcKey: string, dstKey: string): void
+ }
+ interface System {
+  /**
+   * List returns a flat list with info for all files under the specified prefix.
+   */
+  list(prefix: string): Array<(blob.ListObject | undefined)>
+ }
+ interface System {
+  /**
+   * Upload writes content into the fileKey location.
+   */
+  upload(content: string|Array<number>, fileKey: string): void
+ }
+ interface System {
+  /**
+   * UploadFile uploads the provided File to the fileKey location.
+   */
+  uploadFile(file: File, fileKey: string): void
+ }
+ interface System {
+  /**
+   * UploadMultipart uploads the provided multipart file to the fileKey location.
+   */
+  uploadMultipart(fh: multipart.FileHeader, fileKey: string): void
+ }
+ interface System {
+  /**
+   * Delete deletes stored file at fileKey location.
+   * 
+   * If the file doesn't exist returns ErrNotFound.
+   */
+  delete(fileKey: string): void
+ }
+ interface System {
+  /**
+   * DeletePrefix deletes everything starting with the specified prefix.
+   * 
+   * The prefix could be subpath (ex. "/a/b/") or filename prefix (ex. "/a/b/file_").
+   */
+  deletePrefix(prefix: string): Array<Error>
+ }
+ interface System {
+  /**
+   * Checks if the provided dir prefix doesn't have any files.
+   * 
+   * A trailing slash will be appended to a non-empty dir string argument
+   * to ensure that the checked prefix is a "directory".
+   * 
+   * Returns "false" in case the has at least one file, otherwise - "true".
+   */
+  isEmptyDir(dir: string): boolean
+ }
+ interface System {
+  /**
+   * Serve serves the file at fileKey location to an HTTP response.
+   * 
+   * If the `download` query parameter is used the file will be always served for
+   * download no matter of its type (aka. with "Content-Disposition: attachment").
+   * 
+   * Internally this method uses [http.ServeContent] so Range requests,
+   * If-Match, If-Unmodified-Since, etc. headers are handled transparently.
+   */
+  serve(res: http.ResponseWriter, req: http.Request, fileKey: string, name: string): void
+ }
+ interface System {
+  /**
+   * CreateThumb creates a new thumb image for the file at originalKey location.
+   * The new thumb file is stored at thumbKey location.
+   * 
+   * thumbSize is in the format:
+   * - 0xH  (eg. 0x100)    - resize to H height preserving the aspect ratio
+   * - Wx0  (eg. 300x0)    - resize to W width preserving the aspect ratio
+   * - WxH  (eg. 300x100)  - resize and crop to WxH viewbox (from center)
+   * - WxHt (eg. 300x100t) - resize and crop to WxH viewbox (from top)
+   * - WxHb (eg. 300x100b) - resize and crop to WxH viewbox (from bottom)
+   * - WxHf (eg. 300x100f) - fit inside a WxH viewbox (without cropping)
+   */
+  createThumb(originalKey: string, thumbKey: string, thumbSize: string): void
+ }
+}
+
+/**
+ * Package exec runs external commands. It wraps os.StartProcess to make it
+ * easier to remap stdin and stdout, connect I/O with pipes, and do other
+ * adjustments.
+ * 
+ * Unlike the "system" library call from C and other languages, the
+ * os/exec package intentionally does not invoke the system shell and
+ * does not expand any glob patterns or handle other expansions,
+ * pipelines, or redirections typically done by shells. The package
+ * behaves more like C's "exec" family of functions. To expand glob
+ * patterns, either call the shell directly, taking care to escape any
+ * dangerous input, or use the [path/filepath] package's Glob function.
+ * To expand environment variables, use package os's ExpandEnv.
+ * 
+ * Note that the examples in this package assume a Unix system.
+ * They may not run on Windows, and they do not run in the Go Playground
+ * used by golang.org and godoc.org.
+ * 
+ * # Executables in the current directory
+ * 
+ * The functions [Command] and [LookPath] look for a program
+ * in the directories listed in the current path, following the
+ * conventions of the host operating system.
+ * Operating systems have for decades included the current
+ * directory in this search, sometimes implicitly and sometimes
+ * configured explicitly that way by default.
+ * Modern practice is that including the current directory
+ * is usually unexpected and often leads to security problems.
+ * 
+ * To avoid those security problems, as of Go 1.19, this package will not resolve a program
+ * using an implicit or explicit path entry relative to the current directory.
+ * That is, if you run [LookPath]("go"), it will not successfully return
+ * ./go on Unix nor .\go.exe on Windows, no matter how the path is configured.
+ * Instead, if the usual path algorithms would result in that answer,
+ * these functions return an error err satisfying [errors.Is](err, [ErrDot]).
+ * 
+ * For example, consider these two program snippets:
+ * 
+ * ```
+ * 	path, err := exec.LookPath("prog")
+ * 	if err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * 	use(path)
+ * ```
+ * 
+ * and
+ * 
+ * ```
+ * 	cmd := exec.Command("prog")
+ * 	if err := cmd.Run(); err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * ```
+ * 
+ * These will not find and run ./prog or .\prog.exe,
+ * no matter how the current path is configured.
+ * 
+ * Code that always wants to run a program from the current directory
+ * can be rewritten to say "./prog" instead of "prog".
+ * 
+ * Code that insists on including results from relative path entries
+ * can instead override the error using an errors.Is check:
+ * 
+ * ```
+ * 	path, err := exec.LookPath("prog")
+ * 	if errors.Is(err, exec.ErrDot) {
+ * 		err = nil
+ * 	}
+ * 	if err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * 	use(path)
+ * ```
+ * 
+ * and
+ * 
+ * ```
+ * 	cmd := exec.Command("prog")
+ * 	if errors.Is(cmd.Err, exec.ErrDot) {
+ * 		cmd.Err = nil
+ * 	}
+ * 	if err := cmd.Run(); err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * ```
+ * 
+ * Setting the environment variable GODEBUG=execerrdot=0
+ * disables generation of ErrDot entirely, temporarily restoring the pre-Go 1.19
+ * behavior for programs that are unable to apply more targeted fixes.
+ * A future version of Go may remove support for this variable.
+ * 
+ * Before adding such overrides, make sure you understand the
+ * security implications of doing so.
+ * See https://go.dev/blog/path-security for more information.
+ */
+namespace exec {
+ interface command {
+  /**
+   * Command returns the [Cmd] struct to execute the named program with
+   * the given arguments.
+   * 
+   * It sets only the Path and Args in the returned structure.
+   * 
+   * If name contains no path separators, Command uses [LookPath] to
+   * resolve name to a complete path if possible. Otherwise it uses name
+   * directly as Path.
+   * 
+   * The returned Cmd's Args field is constructed from the command name
+   * followed by the elements of arg, so arg should not include the
+   * command name itself. For example, Command("echo", "hello").
+   * Args[0] is always name, not the possibly resolved Path.
+   * 
+   * On Windows, processes receive the whole command line as a single string
+   * and do their own parsing. Command combines and quotes Args into a command
+   * line string with an algorithm compatible with applications using
+   * CommandLineToArgvW (which is the most common way). Notable exceptions are
+   * msiexec.exe and cmd.exe (and thus, all batch files), which have a different
+   * unquoting algorithm. In these or other similar cases, you can do the
+   * quoting yourself and provide the full command line in SysProcAttr.CmdLine,
+   * leaving Args empty.
+   */
+  (name: string, ...arg: string[]): (Cmd)
+ }
+}
+
+/**
+ * Package core is the backbone of PocketBase.
+ * 
+ * It defines the main PocketBase App interface and its base implementation.
+ */
+namespace core {
+ /**
+  * App defines the main PocketBase app interface.
+  * 
+  * Note that the interface is not intended to be implemented manually by users
+  * and instead they should use core.BaseApp (either directly or as embedded field in a custom struct).
+  * 
+  * This interface exists to make testing easier and to allow users to
+  * create common and pluggable helpers and methods that doesn't rely
+  * on a specific wrapped app struct (hence the large interface size).
+  */
+ interface App {
+  [key:string]: any;
+  /**
+   * UnsafeWithoutHooks returns a shallow copy of the current app WITHOUT any registered hooks.
+   * 
+   * NB! Note that using the returned app instance may cause data integrity errors
+   * since the Record validations and data normalizations (including files uploads)
+   * rely on the app hooks to work.
+   */
+  unsafeWithoutHooks(): App
+  /**
+   * Logger returns the default app logger.
+   * 
+   * If the application is not bootstrapped yet, fallbacks to slog.Default().
+   */
+  logger(): (slog.Logger)
+  /**
+   * IsBootstrapped checks if the application was initialized
+   * (aka. whether Bootstrap() was called).
+   */
+  isBootstrapped(): boolean
+  /**
+   * IsTransactional checks if the current app instance is part of a transaction.
+   */
+  isTransactional(): boolean
+  /**
+   * TxInfo returns the transaction associated with the current app instance (if any).
+   * 
+   * Could be used if you want to execute indirectly a function after
+   * the related app transaction completes using `app.TxInfo().OnAfterFunc(callback)`.
+   */
+  txInfo(): (TxAppInfo)
+  /**
+   * Bootstrap initializes the application
+   * (aka. create data dir, open db connections, load settings, etc.).
+   * 
+   * It will call ResetBootstrapState() if the application was already bootstrapped.
+   */
+  bootstrap(): void
+  /**
+   * ResetBootstrapState releases the initialized core app resources
+   * (closing db connections, stopping cron ticker, etc.).
+   */
+  resetBootstrapState(): void
+  /**
+   * DataDir returns the app data directory path.
+   */
+  dataDir(): string
+  /**
+   * EncryptionEnv returns the name of the app secret env key
+   * (currently used primarily for optional settings encryption but this may change in the future).
+   */
+  encryptionEnv(): string
+  /**
+   * IsDev returns whether the app is in dev mode.
+   * 
+   * When enabled logs, executed sql statements, etc. are printed to the stderr.
+   */
+  isDev(): boolean
+  /**
+   * Settings returns the loaded app settings.
+   */
+  settings(): (Settings)
+  /**
+   * Store returns the app runtime store.
+   */
+  store(): (store.Store<string, any>)
+  /**
+   * Cron returns the app cron instance.
+   */
+  cron(): (cron.Cron)
+  /**
+   * SubscriptionsBroker returns the app realtime subscriptions broker instance.
+   */
+  subscriptionsBroker(): (subscriptions.Broker)
+  /**
+   * NewMailClient creates and returns a new SMTP or Sendmail client
+   * based on the current app settings.
+   */
+  newMailClient(): mailer.Mailer
+  /**
+   * NewFilesystem creates a new local or S3 filesystem instance
+   * for managing regular app files (ex. record uploads)
+   * based on the current app settings.
+   * 
+   * NB! Make sure to call Close() on the returned result
+   * after you are done working with it.
+   */
+  newFilesystem(): (filesystem.System)
+  /**
+   * NewBackupsFilesystem creates a new local or S3 filesystem instance
+   * for managing app backups based on the current app settings.
+   * 
+   * NB! Make sure to call Close() on the returned result
+   * after you are done working with it.
+   */
+  newBackupsFilesystem(): (filesystem.System)
+  /**
+   * ReloadSettings reinitializes and reloads the stored application settings.
+   */
+  reloadSettings(): void
+  /**
+   * CreateBackup creates a new backup of the current app pb_data directory.
+   * 
+   * Backups can be stored on S3 if it is configured in app.Settings().Backups.
+   * 
+   * Please refer to the godoc of the specific CoreApp implementation
+   * for details on the backup procedures.
+   */
+  createBackup(ctx: context.Context, name: string): void
+  /**
+   * RestoreBackup restores the backup with the specified name and restarts
+   * the current running application process.
+   * 
+   * The safely perform the restore it is recommended to have free disk space
+   * for at least 2x the size of the restored pb_data backup.
+   * 
+   * Please refer to the godoc of the specific CoreApp implementation
+   * for details on the restore procedures.
+   * 
+   * NB! This feature is experimental and currently is expected to work only on UNIX based systems.
+   */
+  restoreBackup(ctx: context.Context, name: string): void
+  /**
+   * Restart restarts (aka. replaces) the current running application process.
+   * 
+   * NB! It relies on execve which is supported only on UNIX based systems.
+   */
+  restart(): void
+  /**
+   * RunSystemMigrations applies all new migrations registered in the [core.SystemMigrations] list.
+   */
+  runSystemMigrations(): void
+  /**
+   * RunAppMigrations applies all new migrations registered in the [CoreAppMigrations] list.
+   */
+  runAppMigrations(): void
+  /**
+   * RunAllMigrations applies all system and app migrations
+   * (aka. from both [core.SystemMigrations] and [CoreAppMigrations]).
+   */
+  runAllMigrations(): void
+  /**
+   * DB returns the default app data.db builder instance.
+   * 
+   * To minimize SQLITE_BUSY errors, it automatically routes the
+   * SELECT queries to the underlying concurrent db pool and everything else
+   * to the nonconcurrent one.
+   * 
+   * For more finer control over the used connections pools you can
+   * call directly ConcurrentDB() or NonconcurrentDB().
+   */
+  db(): dbx.Builder
+  /**
+   * ConcurrentDB returns the concurrent app data.db builder instance.
+   * 
+   * This method is used mainly internally for executing db read
+   * operations in a concurrent/non-blocking manner.
+   * 
+   * Most users should use simply DB() as it will automatically
+   * route the query execution to ConcurrentDB() or NonconcurrentDB().
+   * 
+   * In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  concurrentDB(): dbx.Builder
+  /**
+   * NonconcurrentDB returns the nonconcurrent app data.db builder instance.
+   * 
+   * The returned db instance is limited only to a single open connection,
+   * meaning that it can process only 1 db operation at a time (other queries queue up).
+   * 
+   * This method is used mainly internally and in the tests to execute write
+   * (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+   * 
+   * Most users should use simply DB() as it will automatically
+   * route the query execution to ConcurrentDB() or NonconcurrentDB().
+   * 
+   * In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  nonconcurrentDB(): dbx.Builder
+  /**
+   * AuxDB returns the app auxiliary.db builder instance.
+   * 
+   * To minimize SQLITE_BUSY errors, it automatically routes the
+   * SELECT queries to the underlying concurrent db pool and everything else
+   * to the nonconcurrent one.
+   * 
+   * For more finer control over the used connections pools you can
+   * call directly AuxConcurrentDB() or AuxNonconcurrentDB().
+   */
+  auxDB(): dbx.Builder
+  /**
+   * AuxConcurrentDB returns the concurrent app auxiliary.db builder instance.
+   * 
+   * This method is used mainly internally for executing db read
+   * operations in a concurrent/non-blocking manner.
+   * 
+   * Most users should use simply AuxDB() as it will automatically
+   * route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+   * 
+   * In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  auxConcurrentDB(): dbx.Builder
+  /**
+   * AuxNonconcurrentDB returns the nonconcurrent app auxiliary.db builder instance.
+   * 
+   * The returned db instance is limited only to a single open connection,
+   * meaning that it can process only 1 db operation at a time (other queries queue up).
+   * 
+   * This method is used mainly internally and in the tests to execute write
+   * (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+   * 
+   * Most users should use simply AuxDB() as it will automatically
+   * route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+   * 
+   * In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  auxNonconcurrentDB(): dbx.Builder
+  /**
+   * HasTable checks if a table (or view) with the provided name exists (case insensitive).
+   * in the data.db.
+   */
+  hasTable(tableName: string): boolean
+  /**
+   * AuxHasTable checks if a table (or view) with the provided name exists (case insensitive)
+   * in the auxiliary.db.
+   */
+  auxHasTable(tableName: string): boolean
+  /**
+   * TableColumns returns all column names of a single table by its name.
+   */
+  tableColumns(tableName: string): Array<string>
+  /**
+   * TableInfo returns the "table_info" pragma result for the specified table.
+   */
+  tableInfo(tableName: string): Array<(TableInfoRow | undefined)>
+  /**
+   * TableIndexes returns a name grouped map with all non empty index of the specified table.
+   * 
+   * Note: This method doesn't return an error on nonexisting table.
+   */
+  tableIndexes(tableName: string): _TygojaDict
+  /**
+   * DeleteTable drops the specified table.
+   * 
+   * This method is a no-op if a table with the provided name doesn't exist.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "tableName" argument must come only from trusted input!
+   */
+  deleteTable(tableName: string): void
+  /**
+   * DeleteView drops the specified view name.
+   * 
+   * This method is a no-op if a view with the provided name doesn't exist.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "name" argument must come only from trusted input!
+   */
+  deleteView(name: string): void
+  /**
+   * SaveView creates (or updates already existing) persistent SQL view.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "selectQuery" argument must come only from trusted input!
+   */
+  saveView(name: string, selectQuery: string): void
+  /**
+   * CreateViewFields creates a new FieldsList from the provided select query.
+   * 
+   * There are some caveats:
+   * - The select query must have an "id" column.
+   * - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
+   */
+  createViewFields(selectQuery: string): FieldsList
+  /**
+   * FindRecordByViewFile returns the original Record of the provided view collection file.
+   */
+  findRecordByViewFile(viewCollectionModelOrIdentifier: any, fileFieldName: string, filename: string): (Record)
+  /**
+   * Vacuum executes VACUUM on the data.db in order to reclaim unused data db disk space.
+   */
+  vacuum(): void
+  /**
+   * AuxVacuum executes VACUUM on the auxiliary.db in order to reclaim unused auxiliary db disk space.
+   */
+  auxVacuum(): void
+  /**
+   * ModelQuery creates a new preconfigured select data.db query with preset
+   * SELECT, FROM and other common fields based on the provided model.
+   */
+  modelQuery(model: Model): (dbx.SelectQuery)
+  /**
+   * AuxModelQuery creates a new preconfigured select auxiliary.db query with preset
+   * SELECT, FROM and other common fields based on the provided model.
+   */
+  auxModelQuery(model: Model): (dbx.SelectQuery)
+  /**
+   * Delete deletes the specified model from the regular app database.
+   */
+  delete(model: Model): void
+  /**
+   * Delete deletes the specified model from the regular app database
+   * (the context could be used to limit the query execution).
+   */
+  deleteWithContext(ctx: context.Context, model: Model): void
+  /**
+   * AuxDelete deletes the specified model from the auxiliary database.
+   */
+  auxDelete(model: Model): void
+  /**
+   * AuxDeleteWithContext deletes the specified model from the auxiliary database
+   * (the context could be used to limit the query execution).
+   */
+  auxDeleteWithContext(ctx: context.Context, model: Model): void
+  /**
+   * Save validates and saves the specified model into the regular app database.
+   * 
+   * If you don't want to run validations, use [App.SaveNoValidate()].
+   */
+  save(model: Model): void
+  /**
+   * SaveWithContext is the same as [App.Save()] but allows specifying a context to limit the db execution.
+   * 
+   * If you don't want to run validations, use [App.SaveNoValidateWithContext()].
+   */
+  saveWithContext(ctx: context.Context, model: Model): void
+  /**
+   * SaveNoValidate saves the specified model into the regular app database without performing validations.
+   * 
+   * If you want to also run validations before persisting, use [App.Save()].
+   */
+  saveNoValidate(model: Model): void
+  /**
+   * SaveNoValidateWithContext is the same as [App.SaveNoValidate()]
+   * but allows specifying a context to limit the db execution.
+   * 
+   * If you want to also run validations before persisting, use [App.SaveWithContext()].
+   */
+  saveNoValidateWithContext(ctx: context.Context, model: Model): void
+  /**
+   * AuxSave validates and saves the specified model into the auxiliary app database.
+   * 
+   * If you don't want to run validations, use [App.AuxSaveNoValidate()].
+   */
+  auxSave(model: Model): void
+  /**
+   * AuxSaveWithContext is the same as [App.AuxSave()] but allows specifying a context to limit the db execution.
+   * 
+   * If you don't want to run validations, use [App.AuxSaveNoValidateWithContext()].
+   */
+  auxSaveWithContext(ctx: context.Context, model: Model): void
+  /**
+   * AuxSaveNoValidate saves the specified model into the auxiliary app database without performing validations.
+   * 
+   * If you want to also run validations before persisting, use [App.AuxSave()].
+   */
+  auxSaveNoValidate(model: Model): void
+  /**
+   * AuxSaveNoValidateWithContext is the same as [App.AuxSaveNoValidate()]
+   * but allows specifying a context to limit the db execution.
+   * 
+   * If you want to also run validations before persisting, use [App.AuxSaveWithContext()].
+   */
+  auxSaveNoValidateWithContext(ctx: context.Context, model: Model): void
+  /**
+   * Validate triggers the OnModelValidate hook for the specified model.
+   */
+  validate(model: Model): void
+  /**
+   * ValidateWithContext is the same as Validate but allows specifying the ModelEvent context.
+   */
+  validateWithContext(ctx: context.Context, model: Model): void
+  /**
+   * RunInTransaction wraps fn into a transaction for the regular app database.
+   * 
+   * It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+   */
+  runInTransaction(fn: (txApp: App) => void): void
+  /**
+   * AuxRunInTransaction wraps fn into a transaction for the auxiliary app database.
+   * 
+   * It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+   */
+  auxRunInTransaction(fn: (txApp: App) => void): void
+  /**
+   * LogQuery returns a new Log select query.
+   */
+  logQuery(): (dbx.SelectQuery)
+  /**
+   * FindLogById finds a single Log entry by its id.
+   */
+  findLogById(id: string): (Log)
+  /**
+   * LogsStatsItem returns hourly grouped logs statistics.
+   */
+  logsStats(expr: dbx.Expression): Array<(LogsStatsItem | undefined)>
+  /**
+   * DeleteOldLogs delete all logs that are created before createdBefore.
+   */
+  deleteOldLogs(createdBefore: time.Time): void
+  /**
+   * CollectionQuery returns a new Collection select query.
+   */
+  collectionQuery(): (dbx.SelectQuery)
+  /**
+   * FindCollections finds all collections by the given type(s).
+   * 
+   * If collectionTypes is not set, it returns all collections.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindAllCollections() // all collections
+   * 	app.FindAllCollections("auth", "view") // only auth and view collections
+   * ```
+   */
+  findAllCollections(...collectionTypes: string[]): Array<(Collection | undefined)>
+  /**
+   * ReloadCachedCollections fetches all collections and caches them into the app store.
+   */
+  reloadCachedCollections(): void
+  /**
+   * FindCollectionByNameOrId finds a single collection by its name (case insensitive) or id.s
+   */
+  findCollectionByNameOrId(nameOrId: string): (Collection)
+  /**
+   * FindCachedCollectionByNameOrId is similar to [App.FindCollectionByNameOrId]
+   * but retrieves the Collection from the app cache instead of making a db call.
+   * 
+   * NB! This method is suitable for read-only Collection operations.
+   * 
+   * Returns [sql.ErrNoRows] if no Collection is found for consistency
+   * with the [App.FindCollectionByNameOrId] method.
+   * 
+   * If you plan making changes to the returned Collection model,
+   * use [App.FindCollectionByNameOrId] instead.
+   * 
+   * Caveats:
+   * 
+   * ```
+   *   - The returned Collection should be used only for read-only operations.
+   *     Avoid directly modifying the returned cached Collection as it will affect
+   *     the global cached value even if you don't persist the changes in the database!
+   *   - If you are updating a Collection in a transaction and then call this method before commit,
+   *     it'll return the cached Collection state and not the one from the uncommitted transaction.
+   *   - The cache is automatically updated on collections db change (create/update/delete).
+   *     To manually reload the cache you can call [App.ReloadCachedCollections]
+   * ```
+   */
+  findCachedCollectionByNameOrId(nameOrId: string): (Collection)
+  /**
+   * FindCollectionReferences returns information for all relation
+   * fields referencing the provided collection.
+   * 
+   * If the provided collection has reference to itself then it will be
+   * also included in the result. To exclude it, pass the collection id
+   * as the excludeIds argument.
+   */
+  findCollectionReferences(collection: Collection, ...excludeIds: string[]): _TygojaDict
+  /**
+   * FindCachedCollectionReferences is similar to [App.FindCollectionReferences]
+   * but retrieves the Collection from the app cache instead of making a db call.
+   * 
+   * NB! This method is suitable for read-only Collection operations.
+   * 
+   * If you plan making changes to the returned Collection model,
+   * use [App.FindCollectionReferences] instead.
+   * 
+   * Caveats:
+   * 
+   * ```
+   *   - The returned Collection should be used only for read-only operations.
+   *     Avoid directly modifying the returned cached Collection as it will affect
+   *     the global cached value even if you don't persist the changes in the database!
+   *   - If you are updating a Collection in a transaction and then call this method before commit,
+   *     it'll return the cached Collection state and not the one from the uncommitted transaction.
+   *   - The cache is automatically updated on collections db change (create/update/delete).
+   *     To manually reload the cache you can call [App.ReloadCachedCollections].
+   * ```
+   */
+  findCachedCollectionReferences(collection: Collection, ...excludeIds: string[]): _TygojaDict
+  /**
+   * IsCollectionNameUnique checks that there is no existing collection
+   * with the provided name (case insensitive!).
+   * 
+   * Note: case insensitive check because the name is used also as
+   * table name for the records.
+   */
+  isCollectionNameUnique(name: string, ...excludeIds: string[]): boolean
+  /**
+   * TruncateCollection deletes all records associated with the provided collection.
+   * 
+   * The truncate operation is executed in a single transaction,
+   * aka. either everything is deleted or none.
+   * 
+   * Note that this method will also trigger the records related
+   * cascade and file delete actions.
+   */
+  truncateCollection(collection: Collection): void
+  /**
+   * ImportCollections imports the provided collections data in a single transaction.
+   * 
+   * For existing matching collections, the imported data is unmarshaled on top of the existing model.
+   * 
+   * NB! If deleteMissing is true, ALL NON-SYSTEM COLLECTIONS AND SCHEMA FIELDS,
+   * that are not present in the imported configuration, WILL BE DELETED
+   * (this includes their related records data).
+   */
+  importCollections(toImport: Array<_TygojaDict>, deleteMissing: boolean): void
+  /**
+   * ImportCollectionsByMarshaledJSON is the same as [ImportCollections]
+   * but accept marshaled json array as import data (usually used for the autogenerated snapshots).
+   */
+  importCollectionsByMarshaledJSON(rawSliceOfMaps: string|Array<number>, deleteMissing: boolean): void
+  /**
+   * SyncRecordTableSchema compares the two provided collections
+   * and applies the necessary related record table changes.
+   * 
+   * If oldCollection is null, then only newCollection is used to create the record table.
+   * 
+   * This method is automatically invoked as part of a collection create/update/delete operation.
+   */
+  syncRecordTableSchema(newCollection: Collection, oldCollection: Collection): void
+  /**
+   * FindAllExternalAuthsByRecord returns all ExternalAuth models
+   * linked to the provided auth record.
+   */
+  findAllExternalAuthsByRecord(authRecord: Record): Array<(ExternalAuth | undefined)>
+  /**
+   * FindAllExternalAuthsByCollection returns all ExternalAuth models
+   * linked to the provided auth collection.
+   */
+  findAllExternalAuthsByCollection(collection: Collection): Array<(ExternalAuth | undefined)>
+  /**
+   * FindFirstExternalAuthByExpr returns the first available (the most recent created)
+   * ExternalAuth model that satisfies the non-nil expression.
+   */
+  findFirstExternalAuthByExpr(expr: dbx.Expression): (ExternalAuth)
+  /**
+   * FindAllMFAsByRecord returns all MFA models linked to the provided auth record.
+   */
+  findAllMFAsByRecord(authRecord: Record): Array<(MFA | undefined)>
+  /**
+   * FindAllMFAsByCollection returns all MFA models linked to the provided collection.
+   */
+  findAllMFAsByCollection(collection: Collection): Array<(MFA | undefined)>
+  /**
+   * FindMFAById returns a single MFA model by its id.
+   */
+  findMFAById(id: string): (MFA)
+  /**
+   * DeleteAllMFAsByRecord deletes all MFA models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllMFAsByRecord(authRecord: Record): void
+  /**
+   * DeleteExpiredMFAs deletes the expired MFAs for all auth collections.
+   */
+  deleteExpiredMFAs(): void
+  /**
+   * FindAllOTPsByRecord returns all OTP models linked to the provided auth record.
+   */
+  findAllOTPsByRecord(authRecord: Record): Array<(OTP | undefined)>
+  /**
+   * FindAllOTPsByCollection returns all OTP models linked to the provided collection.
+   */
+  findAllOTPsByCollection(collection: Collection): Array<(OTP | undefined)>
+  /**
+   * FindOTPById returns a single OTP model by its id.
+   */
+  findOTPById(id: string): (OTP)
+  /**
+   * DeleteAllOTPsByRecord deletes all OTP models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllOTPsByRecord(authRecord: Record): void
+  /**
+   * DeleteExpiredOTPs deletes the expired OTPs for all auth collections.
+   */
+  deleteExpiredOTPs(): void
+  /**
+   * FindAllAuthOriginsByRecord returns all AuthOrigin models linked to the provided auth record (in DESC order).
+   */
+  findAllAuthOriginsByRecord(authRecord: Record): Array<(AuthOrigin | undefined)>
+  /**
+   * FindAllAuthOriginsByCollection returns all AuthOrigin models linked to the provided collection (in DESC order).
+   */
+  findAllAuthOriginsByCollection(collection: Collection): Array<(AuthOrigin | undefined)>
+  /**
+   * FindAuthOriginById returns a single AuthOrigin model by its id.
+   */
+  findAuthOriginById(id: string): (AuthOrigin)
+  /**
+   * FindAuthOriginByRecordAndFingerprint returns a single AuthOrigin model
+   * by its authRecord relation and fingerprint.
+   */
+  findAuthOriginByRecordAndFingerprint(authRecord: Record, fingerprint: string): (AuthOrigin)
+  /**
+   * DeleteAllAuthOriginsByRecord deletes all AuthOrigin models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllAuthOriginsByRecord(authRecord: Record): void
+  /**
+   * RecordQuery returns a new Record select query from a collection model, id or name.
+   * 
+   * In case a collection id or name is provided and that collection doesn't
+   * actually exists, the generated query will be created with a cancelled context
+   * and will fail once an executor (Row(), One(), All(), etc.) is called.
+   */
+  recordQuery(collectionModelOrIdentifier: any): (dbx.SelectQuery)
+  /**
+   * FindRecordById finds the Record model by its id.
+   */
+  findRecordById(collectionModelOrIdentifier: any, recordId: string, ...optFilters: ((q: dbx.SelectQuery) => void)[]): (Record)
+  /**
+   * FindRecordsByIds finds all records by the specified ids.
+   * If no records are found, returns an empty slice.
+   */
+  findRecordsByIds(collectionModelOrIdentifier: any, recordIds: Array<string>, ...optFilters: ((q: dbx.SelectQuery) => void)[]): Array<(Record | undefined)>
+  /**
+   * FindAllRecords finds all records matching specified db expressions.
+   * 
+   * Returns all collection records if no expression is provided.
+   * 
+   * Returns an empty slice if no records are found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	// no extra expressions
+   * 	app.FindAllRecords("example")
+   * 
+   * 	// with extra expressions
+   * 	expr1 := dbx.HashExp{"email": "test@example.com"}
+   * 	expr2 := dbx.NewExp("LOWER(username) = {:username}", dbx.Params{"username": "test"})
+   * 	app.FindAllRecords("example", expr1, expr2)
+   * ```
+   */
+  findAllRecords(collectionModelOrIdentifier: any, ...exprs: dbx.Expression[]): Array<(Record | undefined)>
+  /**
+   * FindFirstRecordByData returns the first found record matching
+   * the provided key-value pair.
+   */
+  findFirstRecordByData(collectionModelOrIdentifier: any, key: string, value: any): (Record)
+  /**
+   * FindRecordsByFilter returns limit number of records matching the
+   * provided string filter.
+   * 
+   * NB! Use the last "params" argument to bind untrusted user variables!
+   * 
+   * The filter argument is optional and can be empty string to target
+   * all available records.
+   * 
+   * The sort argument is optional and can be empty string OR the same format
+   * used in the web APIs, ex. "-created,title".
+   * 
+   * If the limit argument is <= 0, no limit is applied to the query and
+   * all matching records are returned.
+   * 
+   * Returns an empty slice if no records are found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindRecordsByFilter(
+   * 		"posts",
+   * 		"title ~ {:title} && visible = {:visible}",
+   * 		"-created",
+   * 		10,
+   * 		0,
+   * 		dbx.Params{"title": "lorem ipsum", "visible": true}
+   * 	)
+   * ```
+   */
+  findRecordsByFilter(collectionModelOrIdentifier: any, filter: string, sort: string, limit: number, offset: number, ...params: dbx.Params[]): Array<(Record | undefined)>
+  /**
+   * FindFirstRecordByFilter returns the first available record matching the provided filter (if any).
+   * 
+   * NB! Use the last params argument to bind untrusted user variables!
+   * 
+   * Returns sql.ErrNoRows if no record is found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindFirstRecordByFilter("posts", "")
+   * 	app.FindFirstRecordByFilter("posts", "slug={:slug} && status='public'", dbx.Params{"slug": "test"})
+   * ```
+   */
+  findFirstRecordByFilter(collectionModelOrIdentifier: any, filter: string, ...params: dbx.Params[]): (Record)
+  /**
+   * CountRecords returns the total number of records in a collection.
+   */
+  countRecords(collectionModelOrIdentifier: any, ...exprs: dbx.Expression[]): number
+  /**
+   * FindAuthRecordByToken finds the auth record associated with the provided JWT
+   * (auth, file, verifyEmail, changeEmail, passwordReset types).
+   * 
+   * Optionally specify a list of validTypes to check tokens only from those types.
+   * 
+   * Returns an error if the JWT is invalid, expired or not associated to an auth collection record.
+   */
+  findAuthRecordByToken(token: string, ...validTypes: string[]): (Record)
+  /**
+   * FindAuthRecordByEmail finds the auth record associated with the provided email.
+   * 
+   * Returns an error if it is not an auth collection or the record is not found.
+   */
+  findAuthRecordByEmail(collectionModelOrIdentifier: any, email: string): (Record)
+  /**
+   * CanAccessRecord checks if a record is allowed to be accessed by the
+   * specified requestInfo and accessRule.
+   * 
+   * Rule and db checks are ignored in case requestInfo.Auth is a superuser.
+   * 
+   * The returned error indicate that something unexpected happened during
+   * the check (eg. invalid rule or db query error).
+   * 
+   * The method always return false on invalid rule or db query error.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	requestInfo, _ := e.RequestInfo()
+   * 	record, _ := app.FindRecordById("example", "RECORD_ID")
+   * 	rule := types.Pointer("@request.auth.id != '' || status = 'public'")
+   * 	// ... or use one of the record collection's rule, eg. record.Collection().ViewRule
+   * 
+   * 	if ok, _ := app.CanAccessRecord(record, requestInfo, rule); ok { ... }
+   * ```
+   */
+  canAccessRecord(record: Record, requestInfo: RequestInfo, accessRule: string): boolean
+  /**
+   * ExpandRecord expands the relations of a single Record model.
+   * 
+   * If optFetchFunc is not set, then a default function will be used
+   * that returns all relation records.
+   * 
+   * Returns a map with the failed expand parameters and their errors.
+   */
+  expandRecord(record: Record, expands: Array<string>, optFetchFunc: ExpandFetchFunc): _TygojaDict
+  /**
+   * ExpandRecords expands the relations of the provided Record models list.
+   * 
+   * If optFetchFunc is not set, then a default function will be used
+   * that returns all relation records.
+   * 
+   * Returns a map with the failed expand parameters and their errors.
+   */
+  expandRecords(records: Array<(Record | undefined)>, expands: Array<string>, optFetchFunc: ExpandFetchFunc): _TygojaDict
+  /**
+   * OnBootstrap hook is triggered when initializing the main application
+   * resources (db, app settings, etc).
+   */
+  onBootstrap(): (hook.Hook<BootstrapEvent | undefined>)
+  /**
+   * OnServe hook is triggered when the app web server is started
+   * (after starting the TCP listener but before initializing the blocking serve task),
+   * allowing you to adjust its options and attach new routes or middlewares.
+   */
+  onServe(): (hook.Hook<ServeEvent | undefined>)
+  /**
+   * OnTerminate hook is triggered when the app is in the process
+   * of being terminated (ex. on SIGTERM signal).
+   * 
+   * Note that the app could be terminated abruptly without awaiting the hook completion.
+   */
+  onTerminate(): (hook.Hook<TerminateEvent | undefined>)
+  /**
+   * OnBackupCreate hook is triggered on each [App.CreateBackup] call.
+   */
+  onBackupCreate(): (hook.Hook<BackupEvent | undefined>)
+  /**
+   * OnBackupRestore hook is triggered before app backup restore (aka. [App.RestoreBackup] call).
+   * 
+   * Note that by default on success the application is restarted and the after state of the hook is ignored.
+   */
+  onBackupRestore(): (hook.Hook<BackupEvent | undefined>)
+  /**
+   * OnModelValidate is triggered every time when a model is being validated
+   * (e.g. triggered by App.Validate() or App.Save()).
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelValidate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelCreate is triggered every time when a new model is being created
+   * (e.g. triggered by App.Save()).
+   * 
+   * Operations BEFORE the e.Next() execute before the model validation
+   * and the INSERT DB statement.
+   * 
+   * Operations AFTER the e.Next() execute after the model validation
+   * and the INSERT DB statement.
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is persisted in the database since its wrapping transaction may
+   * not have been committed yet.
+   * If you want to listen to only the actual persisted events, you can
+   * bind to [OnModelAfterCreateSuccess] or [OnModelAfterCreateError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelCreate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelCreateExecute is triggered after successful Model validation
+   * and right before the model INSERT DB statement execution.
+   * 
+   * Usually it is triggered as part of the App.Save() in the following firing order:
+   * OnModelCreate {
+   * ```
+   *    -> OnModelValidate (skipped with App.SaveNoValidate())
+   *    -> OnModelCreateExecute
+   * ```
+   * }
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is persisted in the database since its wrapping transaction may have been
+   * committed yet.
+   * If you want to listen to only the actual persisted events,
+   * you can bind to [OnModelAfterCreateSuccess] or [OnModelAfterCreateError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelCreateExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterCreateSuccess is triggered after each successful
+   * Model DB create persistence.
+   * 
+   * Note that when a Model is persisted as part of a transaction,
+   * this hook is delayed and executed only AFTER the transaction has been committed.
+   * This hook is NOT triggered in case the transaction rollbacks
+   * (aka. when the model wasn't persisted).
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterCreateError is triggered after each failed
+   * Model DB create persistence.
+   * 
+   * Note that the execution of this hook is either immediate or delayed
+   * depending on the error:
+   * ```
+   *   - "immediate" on App.Save() failure
+   *   - "delayed" on transaction rollback
+   * ```
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterCreateError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+  /**
+   * OnModelUpdate is triggered every time when a new model is being updated
+   * (e.g. triggered by App.Save()).
+   * 
+   * Operations BEFORE the e.Next() execute before the model validation
+   * and the UPDATE DB statement.
+   * 
+   * Operations AFTER the e.Next() execute after the model validation
+   * and the UPDATE DB statement.
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is persisted in the database since its wrapping transaction may
+   * not have been committed yet.
+   * If you want to listen to only the actual persisted events, you can
+   * bind to [OnModelAfterUpdateSuccess] or [OnModelAfterUpdateError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelUpdate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelUpdateExecute is triggered after successful Model validation
+   * and right before the model UPDATE DB statement execution.
+   * 
+   * Usually it is triggered as part of the App.Save() in the following firing order:
+   * OnModelUpdate {
+   * ```
+   *    -> OnModelValidate (skipped with App.SaveNoValidate())
+   *    -> OnModelUpdateExecute
+   * ```
+   * }
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is persisted in the database since its wrapping transaction may have been
+   * committed yet.
+   * If you want to listen to only the actual persisted events,
+   * you can bind to [OnModelAfterUpdateSuccess] or [OnModelAfterUpdateError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelUpdateExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterUpdateSuccess is triggered after each successful
+   * Model DB update persistence.
+   * 
+   * Note that when a Model is persisted as part of a transaction,
+   * this hook is delayed and executed only AFTER the transaction has been committed.
+   * This hook is NOT triggered in case the transaction rollbacks
+   * (aka. when the model changes weren't persisted).
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterUpdateError is triggered after each failed
+   * Model DB update persistence.
+   * 
+   * Note that the execution of this hook is either immediate or delayed
+   * depending on the error:
+   * ```
+   *   - "immediate" on App.Save() failure
+   *   - "delayed" on transaction rollback
+   * ```
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterUpdateError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+  /**
+   * OnModelDelete is triggered every time when a new model is being deleted
+   * (e.g. triggered by App.Delete()).
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is deleted from the database since its wrapping transaction may
+   * not have been committed yet.
+   * If you want to listen to only the actual persisted deleted events, you can
+   * bind to [OnModelAfterDeleteSuccess] or [OnModelAfterDeleteError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelDelete(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelUpdateExecute is triggered right before the model
+   * DELETE DB statement execution.
+   * 
+   * Usually it is triggered as part of the App.Delete() in the following firing order:
+   * OnModelDelete {
+   * ```
+   *    -> (internal delete checks)
+   *    -> OnModelDeleteExecute
+   * ```
+   * }
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is deleted from the database since its wrapping transaction may
+   * not have been committed yet.
+   * If you want to listen to only the actual persisted deleted events, you can
+   * bind to [OnModelAfterDeleteSuccess] or [OnModelAfterDeleteError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelDeleteExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterDeleteSuccess is triggered after each successful
+   * Model DB delete persistence.
+   * 
+   * Note that when a Model is deleted as part of a transaction,
+   * this hook is delayed and executed only AFTER the transaction has been committed.
+   * This hook is NOT triggered in case the transaction rollbacks
+   * (aka. when the model delete wasn't persisted).
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterDeleteError is triggered after each failed
+   * Model DB delete persistence.
+   * 
+   * Note that the execution of this hook is either immediate or delayed
+   * depending on the error:
+   * ```
+   *   - "immediate" on App.Delete() failure
+   *   - "delayed" on transaction rollback
+   * ```
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterDeleteError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+  /**
+   * OnRecordEnrich is triggered every time when a record is enriched
+   * (as part of the builtin Record responses, during realtime message seriazation, or when [apis.EnrichRecord] is invoked).
+   * 
+   * It could be used for example to redact/hide or add computed temporary
+   * Record model props only for the specific request info. For example:
+   * 
+   *  app.OnRecordEnrich("posts").BindFunc(func(e core.*RecordEnrichEvent) {
+   * ```
+   *      // hide one or more fields
+   *      e.Record.Hide("role")
+   * 
+   *      // add new custom field for registered users
+   *      if e.RequestInfo.Auth != nil && e.RequestInfo.Auth.Collection().Name == "users" {
+   *          e.Record.WithCustomData(true) // for security requires explicitly allowing it
+   *          e.Record.Set("computedScore", e.Record.GetInt("score") * e.RequestInfo.Auth.GetInt("baseScore"))
+   *      }
+   * 
+   *      return e.Next()
+   * ```
+   *  })
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordEnrich(...tags: string[]): (hook.TaggedHook<RecordEnrichEvent | undefined>)
+  /**
+   * OnRecordValidate is a Record proxy model hook of [OnModelValidate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordValidate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordCreate is a Record proxy model hook of [OnModelCreate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordCreate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordCreateExecute is a Record proxy model hook of [OnModelCreateExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordCreateExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterCreateSuccess is a Record proxy model hook of [OnModelAfterCreateSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterCreateError is a Record proxy model hook of [OnModelAfterCreateError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterCreateError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+  /**
+   * OnRecordUpdate is a Record proxy model hook of [OnModelUpdate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordUpdate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordUpdateExecute is a Record proxy model hook of [OnModelUpdateExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordUpdateExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterUpdateSuccess is a Record proxy model hook of [OnModelAfterUpdateSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterUpdateError is a Record proxy model hook of [OnModelAfterUpdateError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterUpdateError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+  /**
+   * OnRecordDelete is a Record proxy model hook of [OnModelDelete].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordDelete(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordDeleteExecute is a Record proxy model hook of [OnModelDeleteExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordDeleteExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterDeleteSuccess is a Record proxy model hook of [OnModelAfterDeleteSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterDeleteError is a Record proxy model hook of [OnModelAfterDeleteError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterDeleteError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+  /**
+   * OnCollectionValidate is a Collection proxy model hook of [OnModelValidate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionValidate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionCreate is a Collection proxy model hook of [OnModelCreate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionCreate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionCreateExecute is a Collection proxy model hook of [OnModelCreateExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionCreateExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterCreateSuccess is a Collection proxy model hook of [OnModelAfterCreateSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterCreateError is a Collection proxy model hook of [OnModelAfterCreateError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterCreateError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+  /**
+   * OnCollectionUpdate is a Collection proxy model hook of [OnModelUpdate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionUpdate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionUpdateExecute is a Collection proxy model hook of [OnModelUpdateExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionUpdateExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterUpdateSuccess is a Collection proxy model hook of [OnModelAfterUpdateSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterUpdateError is a Collection proxy model hook of [OnModelAfterUpdateError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterUpdateError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+  /**
+   * OnCollectionDelete is a Collection proxy model hook of [OnModelDelete].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionDelete(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionDeleteExecute is a Collection proxy model hook of [OnModelDeleteExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionDeleteExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterDeleteSuccess is a Collection proxy model hook of [OnModelAfterDeleteSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterDeleteError is a Collection proxy model hook of [OnModelAfterDeleteError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterDeleteError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+  /**
+   * OnMailerSend hook is triggered every time when a new email is
+   * being send using the [App.NewMailClient()] instance.
+   * 
+   * It allows intercepting the email message or to use a custom mailer client.
+   */
+  onMailerSend(): (hook.Hook<MailerEvent | undefined>)
+  /**
+   * OnMailerRecordAuthAlertSend hook is triggered when
+   * sending a new device login auth alert email, allowing you to
+   * intercept and customize the email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordAuthAlertSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnMailerBeforeRecordResetPasswordSend hook is triggered when
+   * sending a password reset email to an auth record, allowing
+   * you to intercept and customize the email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordPasswordResetSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnMailerBeforeRecordVerificationSend hook is triggered when
+   * sending a verification email to an auth record, allowing
+   * you to intercept and customize the email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordVerificationSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnMailerRecordEmailChangeSend hook is triggered when sending a
+   * confirmation new address email to an auth record, allowing
+   * you to intercept and customize the email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordEmailChangeSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnMailerRecordOTPSend hook is triggered when sending an OTP email
+   * to an auth record, allowing you to intercept and customize the
+   * email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordOTPSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnRealtimeConnectRequest hook is triggered when establishing the SSE client connection.
+   * 
+   * Any execution after e.Next() of a hook handler happens after the client disconnects.
+   */
+  onRealtimeConnectRequest(): (hook.Hook<RealtimeConnectRequestEvent | undefined>)
+  /**
+   * OnRealtimeMessageSend hook is triggered when sending an SSE message to a client.
+   */
+  onRealtimeMessageSend(): (hook.Hook<RealtimeMessageEvent | undefined>)
+  /**
+   * OnRealtimeSubscribeRequest hook is triggered when updating the
+   * client subscriptions, allowing you to further validate and
+   * modify the submitted change.
+   */
+  onRealtimeSubscribeRequest(): (hook.Hook<RealtimeSubscribeRequestEvent | undefined>)
+  /**
+   * OnSettingsListRequest hook is triggered on each API Settings list request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   */
+  onSettingsListRequest(): (hook.Hook<SettingsListRequestEvent | undefined>)
+  /**
+   * OnSettingsUpdateRequest hook is triggered on each API Settings update request.
+   * 
+   * Could be used to additionally validate the request data or
+   * implement completely different persistence behavior.
+   */
+  onSettingsUpdateRequest(): (hook.Hook<SettingsUpdateRequestEvent | undefined>)
+  /**
+   * OnSettingsReload hook is triggered every time when the App.Settings()
+   * is being replaced with a new state.
+   * 
+   * Calling App.Settings() after e.Next() returns the new state.
+   */
+  onSettingsReload(): (hook.Hook<SettingsReloadEvent | undefined>)
+  /**
+   * OnFileDownloadRequest hook is triggered before each API File download request.
+   * 
+   * Could be used to validate or modify the file response before
+   * returning it to the client.
+   */
+  onFileDownloadRequest(...tags: string[]): (hook.TaggedHook<FileDownloadRequestEvent | undefined>)
+  /**
+   * OnFileBeforeTokenRequest hook is triggered on each auth file token API request.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onFileTokenRequest(...tags: string[]): (hook.TaggedHook<FileTokenRequestEvent | undefined>)
+  /**
+   * OnRecordAuthRequest hook is triggered on each successful API
+   * record authentication request (sign-in, token refresh, etc.).
+   * 
+   * Could be used to additionally validate or modify the authenticated
+   * record data and token.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthRequest(...tags: string[]): (hook.TaggedHook<RecordAuthRequestEvent | undefined>)
+  /**
+   * OnRecordAuthWithPasswordRequest hook is triggered on each
+   * Record auth with password API request.
+   * 
+   * [RecordAuthWithPasswordRequestEvent.Record] could be nil if no matching identity is found, allowing
+   * you to manually locate a different Record model (by reassigning [RecordAuthWithPasswordRequestEvent.Record]).
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthWithPasswordRequest(...tags: string[]): (hook.TaggedHook<RecordAuthWithPasswordRequestEvent | undefined>)
+  /**
+   * OnRecordAuthWithOAuth2Request hook is triggered on each Record
+   * OAuth2 sign-in/sign-up API request (after token exchange and before external provider linking).
+   * 
+   * If [RecordAuthWithOAuth2RequestEvent.Record] is not set, then the OAuth2
+   * request will try to create a new auth Record.
+   * 
+   * To assign or link a different existing record model you can
+   * change the [RecordAuthWithOAuth2RequestEvent.Record] field.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthWithOAuth2Request(...tags: string[]): (hook.TaggedHook<RecordAuthWithOAuth2RequestEvent | undefined>)
+  /**
+   * OnRecordAuthRefreshRequest hook is triggered on each Record
+   * auth refresh API request (right before generating a new auth token).
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different auth refresh behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthRefreshRequest(...tags: string[]): (hook.TaggedHook<RecordAuthRefreshRequestEvent | undefined>)
+  /**
+   * OnRecordRequestPasswordResetRequest hook is triggered on
+   * each Record request password reset API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different password reset behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordRequestPasswordResetRequest(...tags: string[]): (hook.TaggedHook<RecordRequestPasswordResetRequestEvent | undefined>)
+  /**
+   * OnRecordConfirmPasswordResetRequest hook is triggered on
+   * each Record confirm password reset API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordConfirmPasswordResetRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmPasswordResetRequestEvent | undefined>)
+  /**
+   * OnRecordRequestVerificationRequest hook is triggered on
+   * each Record request verification API request.
+   * 
+   * Could be used to additionally validate the loaded request data or implement
+   * completely different verification behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordRequestVerificationRequest(...tags: string[]): (hook.TaggedHook<RecordRequestVerificationRequestEvent | undefined>)
+  /**
+   * OnRecordConfirmVerificationRequest hook is triggered on each
+   * Record confirm verification API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordConfirmVerificationRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmVerificationRequestEvent | undefined>)
+  /**
+   * OnRecordRequestEmailChangeRequest hook is triggered on each
+   * Record request email change API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different request email change behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordRequestEmailChangeRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEmailChangeRequestEvent | undefined>)
+  /**
+   * OnRecordConfirmEmailChangeRequest hook is triggered on each
+   * Record confirm email change API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordConfirmEmailChangeRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmEmailChangeRequestEvent | undefined>)
+  /**
+   * OnRecordRequestOTPRequest hook is triggered on each Record
+   * request OTP API request.
+   * 
+   * [RecordCreateOTPRequestEvent.Record] could be nil if no matching identity is found, allowing
+   * you to manually create or locate a different Record model (by reassigning [RecordCreateOTPRequestEvent.Record]).
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordRequestOTPRequest(...tags: string[]): (hook.TaggedHook<RecordCreateOTPRequestEvent | undefined>)
+  /**
+   * OnRecordAuthWithOTPRequest hook is triggered on each Record
+   * auth with OTP API request.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthWithOTPRequest(...tags: string[]): (hook.TaggedHook<RecordAuthWithOTPRequestEvent | undefined>)
+  /**
+   * OnRecordsListRequest hook is triggered on each API Records list request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordsListRequest(...tags: string[]): (hook.TaggedHook<RecordsListRequestEvent | undefined>)
+  /**
+   * OnRecordViewRequest hook is triggered on each API Record view request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordViewRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+  /**
+   * OnRecordCreateRequest hook is triggered on each API Record create request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordCreateRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+  /**
+   * OnRecordUpdateRequest hook is triggered on each API Record update request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordUpdateRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+  /**
+   * OnRecordDeleteRequest hook is triggered on each API Record delete request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different delete behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordDeleteRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+  /**
+   * OnCollectionsListRequest hook is triggered on each API Collections list request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   */
+  onCollectionsListRequest(): (hook.Hook<CollectionsListRequestEvent | undefined>)
+  /**
+   * OnCollectionViewRequest hook is triggered on each API Collection view request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   */
+  onCollectionViewRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+  /**
+   * OnCollectionCreateRequest hook is triggered on each API Collection create request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   */
+  onCollectionCreateRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+  /**
+   * OnCollectionUpdateRequest hook is triggered on each API Collection update request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   */
+  onCollectionUpdateRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+  /**
+   * OnCollectionDeleteRequest hook is triggered on each API Collection delete request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different delete behavior.
+   */
+  onCollectionDeleteRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+  /**
+   * OnCollectionsBeforeImportRequest hook is triggered on each API
+   * collections import request.
+   * 
+   * Could be used to additionally validate the imported collections or
+   * to implement completely different import behavior.
+   */
+  onCollectionsImportRequest(): (hook.Hook<CollectionsImportRequestEvent | undefined>)
+  /**
+   * OnBatchRequest hook is triggered on each API batch request.
+   * 
+   * Could be used to additionally validate or modify the submitted batch requests.
+   */
+  onBatchRequest(): (hook.Hook<BatchRequestEvent | undefined>)
+ }
+ // @ts-ignore
+ import validation = ozzo_validation
+ /**
+  * AuthOrigin defines a Record proxy for working with the authOrigins collection.
+  */
+ type _sUmzkLl = Record
+ interface AuthOrigin extends _sUmzkLl {
+ }
+ interface newAuthOrigin {
+  /**
+   * NewAuthOrigin instantiates and returns a new blank *AuthOrigin model.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	origin := core.NewOrigin(app)
+   * 	origin.SetRecordRef(user.Id)
+   * 	origin.SetCollectionRef(user.Collection().Id)
+   * 	origin.SetFingerprint("...")
+   * 	app.Save(origin)
+   * ```
+   */
+  (app: App): (AuthOrigin)
+ }
+ interface AuthOrigin {
+  /**
+   * PreValidate implements the [PreValidator] interface and checks
+   * whether the proxy is properly loaded.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ interface AuthOrigin {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface AuthOrigin {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface AuthOrigin {
+  /**
+   * CollectionRef returns the "collectionRef" field value.
+   */
+  collectionRef(): string
+ }
+ interface AuthOrigin {
+  /**
+   * SetCollectionRef updates the "collectionRef" record field value.
+   */
+  setCollectionRef(collectionId: string): void
+ }
+ interface AuthOrigin {
+  /**
+   * RecordRef returns the "recordRef" record field value.
+   */
+  recordRef(): string
+ }
+ interface AuthOrigin {
+  /**
+   * SetRecordRef updates the "recordRef" record field value.
+   */
+  setRecordRef(recordId: string): void
+ }
+ interface AuthOrigin {
+  /**
+   * Fingerprint returns the "fingerprint" record field value.
+   */
+  fingerprint(): string
+ }
+ interface AuthOrigin {
+  /**
+   * SetFingerprint updates the "fingerprint" record field value.
+   */
+  setFingerprint(fingerprint: string): void
+ }
+ interface AuthOrigin {
+  /**
+   * Created returns the "created" record field value.
+   */
+  created(): types.DateTime
+ }
+ interface AuthOrigin {
+  /**
+   * Updated returns the "updated" record field value.
+   */
+  updated(): types.DateTime
+ }
+ interface BaseApp {
+  /**
+   * FindAllAuthOriginsByRecord returns all AuthOrigin models linked to the provided auth record (in DESC order).
+   */
+  findAllAuthOriginsByRecord(authRecord: Record): Array<(AuthOrigin | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllAuthOriginsByCollection returns all AuthOrigin models linked to the provided collection (in DESC order).
+   */
+  findAllAuthOriginsByCollection(collection: Collection): Array<(AuthOrigin | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAuthOriginById returns a single AuthOrigin model by its id.
+   */
+  findAuthOriginById(id: string): (AuthOrigin)
+ }
+ interface BaseApp {
+  /**
+   * FindAuthOriginByRecordAndFingerprint returns a single AuthOrigin model
+   * by its authRecord relation and fingerprint.
+   */
+  findAuthOriginByRecordAndFingerprint(authRecord: Record, fingerprint: string): (AuthOrigin)
+ }
+ interface BaseApp {
+  /**
+   * DeleteAllAuthOriginsByRecord deletes all AuthOrigin models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllAuthOriginsByRecord(authRecord: Record): void
+ }
+ /**
+  * FilesManager defines an interface with common methods that files manager models should implement.
+  */
+ interface FilesManager {
+  [key:string]: any;
+  /**
+   * BaseFilesPath returns the storage dir path used by the interface instance.
+   */
+  baseFilesPath(): string
+ }
+ /**
+  * DBConnectFunc defines a database connection initialization function.
+  */
+ interface DBConnectFunc {(dbPath: string): (dbx.DB) }
+ /**
+  * BaseAppConfig defines a BaseApp configuration option
+  */
+ interface BaseAppConfig {
+  dbConnect: DBConnectFunc
+  dataDir: string
+  encryptionEnv: string
+  queryTimeout: time.Duration
+  dataMaxOpenConns: number
+  dataMaxIdleConns: number
+  auxMaxOpenConns: number
+  auxMaxIdleConns: number
+  isDev: boolean
+ }
+ /**
+  * BaseApp implements CoreApp and defines the base PocketBase app structure.
+  */
+ interface BaseApp {
+ }
+ interface newBaseApp {
+  /**
+   * NewBaseApp creates and returns a new BaseApp instance
+   * configured with the provided arguments.
+   * 
+   * To initialize the app, you need to call `app.Bootstrap()`.
+   */
+  (config: BaseAppConfig): (BaseApp)
+ }
+ interface BaseApp {
+  /**
+   * UnsafeWithoutHooks returns a shallow copy of the current app WITHOUT any registered hooks.
+   * 
+   * NB! Note that using the returned app instance may cause data integrity errors
+   * since the Record validations and data normalizations (including files uploads)
+   * rely on the app hooks to work.
+   */
+  unsafeWithoutHooks(): App
+ }
+ interface BaseApp {
+  /**
+   * Logger returns the default app logger.
+   * 
+   * If the application is not bootstrapped yet, fallbacks to slog.Default().
+   */
+  logger(): (slog.Logger)
+ }
+ interface BaseApp {
+  /**
+   * TxInfo returns the transaction associated with the current app instance (if any).
+   * 
+   * Could be used if you want to execute indirectly a function after
+   * the related app transaction completes using `app.TxInfo().OnAfterFunc(callback)`.
+   */
+  txInfo(): (TxAppInfo)
+ }
+ interface BaseApp {
+  /**
+   * IsTransactional checks if the current app instance is part of a transaction.
+   */
+  isTransactional(): boolean
+ }
+ interface BaseApp {
+  /**
+   * IsBootstrapped checks if the application was initialized
+   * (aka. whether Bootstrap() was called).
+   */
+  isBootstrapped(): boolean
+ }
+ interface BaseApp {
+  /**
+   * Bootstrap initializes the application
+   * (aka. create data dir, open db connections, load settings, etc.).
+   * 
+   * It will call ResetBootstrapState() if the application was already bootstrapped.
+   */
+  bootstrap(): void
+ }
+ interface closer {
+  [key:string]: any;
+  close(): void
+ }
+ interface BaseApp {
+  /**
+   * ResetBootstrapState releases the initialized core app resources
+   * (closing db connections, stopping cron ticker, etc.).
+   */
+  resetBootstrapState(): void
+ }
+ interface BaseApp {
+  /**
+   * DB returns the default app data.db builder instance.
+   * 
+   * To minimize SQLITE_BUSY errors, it automatically routes the
+   * SELECT queries to the underlying concurrent db pool and everything
+   * else to the nonconcurrent one.
+   * 
+   * For more finer control over the used connections pools you can
+   * call directly ConcurrentDB() or NonconcurrentDB().
+   */
+  db(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * ConcurrentDB returns the concurrent app data.db builder instance.
+   * 
+   * This method is used mainly internally for executing db read
+   * operations in a concurrent/non-blocking manner.
+   * 
+   * Most users should use simply DB() as it will automatically
+   * route the query execution to ConcurrentDB() or NonconcurrentDB().
+   * 
+   * In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  concurrentDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * NonconcurrentDB returns the nonconcurrent app data.db builder instance.
+   * 
+   * The returned db instance is limited only to a single open connection,
+   * meaning that it can process only 1 db operation at a time (other queries queue up).
+   * 
+   * This method is used mainly internally and in the tests to execute write
+   * (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+   * 
+   * Most users should use simply DB() as it will automatically
+   * route the query execution to ConcurrentDB() or NonconcurrentDB().
+   * 
+   * In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  nonconcurrentDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * AuxDB returns the app auxiliary.db builder instance.
+   * 
+   * To minimize SQLITE_BUSY errors, it automatically routes the
+   * SELECT queries to the underlying concurrent db pool and everything
+   * else to the nonconcurrent one.
+   * 
+   * For more finer control over the used connections pools you can
+   * call directly AuxConcurrentDB() or AuxNonconcurrentDB().
+   */
+  auxDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * AuxConcurrentDB returns the concurrent app auxiliary.db builder instance.
+   * 
+   * This method is used mainly internally for executing db read
+   * operations in a concurrent/non-blocking manner.
+   * 
+   * Most users should use simply AuxDB() as it will automatically
+   * route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+   * 
+   * In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  auxConcurrentDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * AuxNonconcurrentDB returns the nonconcurrent app auxiliary.db builder instance.
+   * 
+   * The returned db instance is limited only to a single open connection,
+   * meaning that it can process only 1 db operation at a time (other queries queue up).
+   * 
+   * This method is used mainly internally and in the tests to execute write
+   * (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+   * 
+   * Most users should use simply AuxDB() as it will automatically
+   * route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+   * 
+   * In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  auxNonconcurrentDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * DataDir returns the app data directory path.
+   */
+  dataDir(): string
+ }
+ interface BaseApp {
+  /**
+   * EncryptionEnv returns the name of the app secret env key
+   * (currently used primarily for optional settings encryption but this may change in the future).
+   */
+  encryptionEnv(): string
+ }
+ interface BaseApp {
+  /**
+   * IsDev returns whether the app is in dev mode.
+   * 
+   * When enabled logs, executed sql statements, etc. are printed to the stderr.
+   */
+  isDev(): boolean
+ }
+ interface BaseApp {
+  /**
+   * Settings returns the loaded app settings.
+   */
+  settings(): (Settings)
+ }
+ interface BaseApp {
+  /**
+   * Store returns the app runtime store.
+   */
+  store(): (store.Store<string, any>)
+ }
+ interface BaseApp {
+  /**
+   * Cron returns the app cron instance.
+   */
+  cron(): (cron.Cron)
+ }
+ interface BaseApp {
+  /**
+   * SubscriptionsBroker returns the app realtime subscriptions broker instance.
+   */
+  subscriptionsBroker(): (subscriptions.Broker)
+ }
+ interface BaseApp {
+  /**
+   * NewMailClient creates and returns a new SMTP or Sendmail client
+   * based on the current app settings.
+   */
+  newMailClient(): mailer.Mailer
+ }
+ interface BaseApp {
+  /**
+   * NewFilesystem creates a new local or S3 filesystem instance
+   * for managing regular app files (ex. record uploads)
+   * based on the current app settings.
+   * 
+   * NB! Make sure to call Close() on the returned result
+   * after you are done working with it.
+   */
+  newFilesystem(): (filesystem.System)
+ }
+ interface BaseApp {
+  /**
+   * NewBackupsFilesystem creates a new local or S3 filesystem instance
+   * for managing app backups based on the current app settings.
+   * 
+   * NB! Make sure to call Close() on the returned result
+   * after you are done working with it.
+   */
+  newBackupsFilesystem(): (filesystem.System)
+ }
+ interface BaseApp {
+  /**
+   * Restart restarts (aka. replaces) the current running application process.
+   * 
+   * NB! It relies on execve which is supported only on UNIX based systems.
+   */
+  restart(): void
+ }
+ interface BaseApp {
+  /**
+   * RunSystemMigrations applies all new migrations registered in the [core.SystemMigrations] list.
+   */
+  runSystemMigrations(): void
+ }
+ interface BaseApp {
+  /**
+   * RunAppMigrations applies all new migrations registered in the [CoreAppMigrations] list.
+   */
+  runAppMigrations(): void
+ }
+ interface BaseApp {
+  /**
+   * RunAllMigrations applies all system and app migrations
+   * (aka. from both [core.SystemMigrations] and [CoreAppMigrations]).
+   */
+  runAllMigrations(): void
+ }
+ interface BaseApp {
+  onBootstrap(): (hook.Hook<BootstrapEvent | undefined>)
+ }
+ interface BaseApp {
+  onServe(): (hook.Hook<ServeEvent | undefined>)
+ }
+ interface BaseApp {
+  onTerminate(): (hook.Hook<TerminateEvent | undefined>)
+ }
+ interface BaseApp {
+  onBackupCreate(): (hook.Hook<BackupEvent | undefined>)
+ }
+ interface BaseApp {
+  onBackupRestore(): (hook.Hook<BackupEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelCreate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelCreateExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterCreateError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelUpdate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelUpdateExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterUpdateError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelValidate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelDelete(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelDeleteExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterDeleteError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordEnrich(...tags: string[]): (hook.TaggedHook<RecordEnrichEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordValidate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordCreate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordCreateExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterCreateError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordUpdate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordUpdateExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterUpdateError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordDelete(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordDeleteExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterDeleteError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionValidate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionCreate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionCreateExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterCreateError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionUpdate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionUpdateExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterUpdateError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionDelete(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionDeleteExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterDeleteError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerSend(): (hook.Hook<MailerEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordPasswordResetSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordVerificationSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordEmailChangeSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordOTPSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordAuthAlertSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRealtimeConnectRequest(): (hook.Hook<RealtimeConnectRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRealtimeMessageSend(): (hook.Hook<RealtimeMessageEvent | undefined>)
+ }
+ interface BaseApp {
+  onRealtimeSubscribeRequest(): (hook.Hook<RealtimeSubscribeRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onSettingsListRequest(): (hook.Hook<SettingsListRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onSettingsUpdateRequest(): (hook.Hook<SettingsUpdateRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onSettingsReload(): (hook.Hook<SettingsReloadEvent | undefined>)
+ }
+ interface BaseApp {
+  onFileDownloadRequest(...tags: string[]): (hook.TaggedHook<FileDownloadRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onFileTokenRequest(...tags: string[]): (hook.TaggedHook<FileTokenRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthRequest(...tags: string[]): (hook.TaggedHook<RecordAuthRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthWithPasswordRequest(...tags: string[]): (hook.TaggedHook<RecordAuthWithPasswordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthWithOAuth2Request(...tags: string[]): (hook.TaggedHook<RecordAuthWithOAuth2RequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthRefreshRequest(...tags: string[]): (hook.TaggedHook<RecordAuthRefreshRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordRequestPasswordResetRequest(...tags: string[]): (hook.TaggedHook<RecordRequestPasswordResetRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordConfirmPasswordResetRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmPasswordResetRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordRequestVerificationRequest(...tags: string[]): (hook.TaggedHook<RecordRequestVerificationRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordConfirmVerificationRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmVerificationRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordRequestEmailChangeRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEmailChangeRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordConfirmEmailChangeRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmEmailChangeRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordRequestOTPRequest(...tags: string[]): (hook.TaggedHook<RecordCreateOTPRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthWithOTPRequest(...tags: string[]): (hook.TaggedHook<RecordAuthWithOTPRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordsListRequest(...tags: string[]): (hook.TaggedHook<RecordsListRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordViewRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordCreateRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordUpdateRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordDeleteRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionsListRequest(): (hook.Hook<CollectionsListRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionViewRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionCreateRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionUpdateRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionDeleteRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionsImportRequest(): (hook.Hook<CollectionsImportRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onBatchRequest(): (hook.Hook<BatchRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  /**
+   * CreateBackup creates a new backup of the current app pb_data directory.
+   * 
+   * If name is empty, it will be autogenerated.
+   * If backup with the same name exists, the new backup file will replace it.
+   * 
+   * The backup is executed within a transaction, meaning that new writes
+   * will be temporary "blocked" until the backup file is generated.
+   * 
+   * To safely perform the backup, it is recommended to have free disk space
+   * for at least 2x the size of the pb_data directory.
+   * 
+   * By default backups are stored in pb_data/backups
+   * (the backups directory itself is excluded from the generated backup).
+   * 
+   * When using S3 storage for the uploaded collection files, you have to
+   * take care manually to backup those since they are not part of the pb_data.
+   * 
+   * Backups can be stored on S3 if it is configured in app.Settings().Backups.
+   */
+  createBackup(ctx: context.Context, name: string): void
+ }
+ interface BaseApp {
+  /**
+   * RestoreBackup restores the backup with the specified name and restarts
+   * the current running application process.
+   * 
+   * NB! This feature is experimental and currently is expected to work only on UNIX based systems.
+   * 
+   * To safely perform the restore it is recommended to have free disk space
+   * for at least 2x the size of the restored pb_data backup.
+   * 
+   * The performed steps are:
+   * 
+   *  1. Download the backup with the specified name in a temp location
+   * ```
+   *     (this is in case of S3; otherwise it creates a temp copy of the zip)
+   * ```
+   * 
+   *  2. Extract the backup in a temp directory inside the app "pb_data"
+   * ```
+   *     (eg. "pb_data/.pb_temp_to_delete/pb_restore").
+   * ```
+   * 
+   *  3. Move the current app "pb_data" content (excluding the local backups and the special temp dir)
+   * ```
+   *     under another temp sub dir that will be deleted on the next app start up
+   *     (eg. "pb_data/.pb_temp_to_delete/old_pb_data").
+   *     This is because on some environments it may not be allowed
+   *     to delete the currently open "pb_data" files.
+   * ```
+   * 
+   *  4. Move the extracted dir content to the app "pb_data".
+   * 
+   *  5. Restart the app (on successful app bootstap it will also remove the old pb_data).
+   * 
+   * If a failure occure during the restore process the dir changes are reverted.
+   * If for whatever reason the revert is not possible, it panics.
+   * 
+   * Note that if your pb_data has custom network mounts as subdirectories, then
+   * it is possible the restore to fail during the `os.Rename` operations
+   * (see https://github.com/pocketbase/pocketbase/issues/4647).
+   */
+  restoreBackup(ctx: context.Context, name: string): void
+ }
+ interface BaseApp {
+  /**
+   * ImportCollectionsByMarshaledJSON is the same as [ImportCollections]
+   * but accept marshaled json array as import data (usually used for the autogenerated snapshots).
+   */
+  importCollectionsByMarshaledJSON(rawSliceOfMaps: string|Array<number>, deleteMissing: boolean): void
+ }
+ interface BaseApp {
+  /**
+   * ImportCollections imports the provided collections data in a single transaction.
+   * 
+   * For existing matching collections, the imported data is unmarshaled on top of the existing model.
+   * 
+   * NB! If deleteMissing is true, ALL NON-SYSTEM COLLECTIONS AND SCHEMA FIELDS,
+   * that are not present in the imported configuration, WILL BE DELETED
+   * (this includes their related records data).
+   */
+  importCollections(toImport: Array<_TygojaDict>, deleteMissing: boolean): void
+ }
+ /**
+  * @todo experiment eventually replacing the rules *string with a struct?
+  */
+ type _smUOmdS = BaseModel
+ interface baseCollection extends _smUOmdS {
+  listRule?: string
+  viewRule?: string
+  createRule?: string
+  updateRule?: string
+  deleteRule?: string
+  /**
+   * RawOptions represents the raw serialized collection option loaded from the DB.
+   * NB! This field shouldn't be modified manually. It is automatically updated
+   * with the collection type specific option before save.
+   */
+  rawOptions: types.JSONRaw
+  name: string
+  type: string
+  fields: FieldsList
+  indexes: types.JSONArray<string>
+  created: types.DateTime
+  updated: types.DateTime
+  /**
+   * System prevents the collection rename, deletion and rules change.
+   * It is used primarily for internal purposes for collections like "_superusers", "_externalAuths", etc.
+   */
+  system: boolean
+ }
+ /**
+  * Collection defines the table, fields and various options related to a set of records.
+  */
+ type _sKRFDEg = baseCollection&collectionAuthOptions&collectionViewOptions
+ interface Collection extends _sKRFDEg {
+ }
+ interface newCollection {
+  /**
+   * NewCollection initializes and returns a new Collection model with the specified type and name.
+   * 
+   * It also loads the minimal default configuration for the collection
+   * (eg. system fields, indexes, type specific options, etc.).
+   */
+  (typ: string, name: string, ...optId: string[]): (Collection)
+ }
+ interface newBaseCollection {
+  /**
+   * NewBaseCollection initializes and returns a new "base" Collection model.
+   * 
+   * It also loads the minimal default configuration for the collection
+   * (eg. system fields, indexes, type specific options, etc.).
+   */
+  (name: string, ...optId: string[]): (Collection)
+ }
+ interface newViewCollection {
+  /**
+   * NewViewCollection initializes and returns a new "view" Collection model.
+   * 
+   * It also loads the minimal default configuration for the collection
+   * (eg. system fields, indexes, type specific options, etc.).
+   */
+  (name: string, ...optId: string[]): (Collection)
+ }
+ interface newAuthCollection {
+  /**
+   * NewAuthCollection initializes and returns a new "auth" Collection model.
+   * 
+   * It also loads the minimal default configuration for the collection
+   * (eg. system fields, indexes, type specific options, etc.).
+   */
+  (name: string, ...optId: string[]): (Collection)
+ }
+ interface Collection {
+  /**
+   * TableName returns the Collection model SQL table name.
+   */
+  tableName(): string
+ }
+ interface Collection {
+  /**
+   * BaseFilesPath returns the storage dir path used by the collection.
+   */
+  baseFilesPath(): string
+ }
+ interface Collection {
+  /**
+   * IsBase checks if the current collection has "base" type.
+   */
+  isBase(): boolean
+ }
+ interface Collection {
+  /**
+   * IsAuth checks if the current collection has "auth" type.
+   */
+  isAuth(): boolean
+ }
+ interface Collection {
+  /**
+   * IsView checks if the current collection has "view" type.
+   */
+  isView(): boolean
+ }
+ interface Collection {
+  /**
+   * IntegrityChecks toggles the current collection integrity checks (ex. checking references on delete).
+   */
+  integrityChecks(enable: boolean): void
+ }
+ interface Collection {
+  /**
+   * PostScan implements the [dbx.PostScanner] interface to auto unmarshal
+   * the raw serialized options into the concrete type specific fields.
+   */
+  postScan(): void
+ }
+ interface Collection {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   * 
+   * For new/"blank" Collection models it replaces the model with a factory
+   * instance and then unmarshal the provided data one on top of it.
+   */
+  unmarshalJSON(b: string|Array<number>): void
+ }
+ interface Collection {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * 
+   * Note that non-type related fields are ignored from the serialization
+   * (ex. for "view" colections the "auth" fields are skipped).
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface Collection {
+  /**
+   * String returns a string representation of the current collection.
+   */
+  string(): string
+ }
+ interface Collection {
+  /**
+   * DBExport prepares and exports the current collection data for db persistence.
+   */
+  dbExport(app: App): _TygojaDict
+ }
+ interface Collection {
+  /**
+   * GetIndex returns s single Collection index expression by its name.
+   */
+  getIndex(name: string): string
+ }
+ interface Collection {
+  /**
+   * AddIndex adds a new index into the current collection.
+   * 
+   * If the collection has an existing index matching the new name it will be replaced with the new one.
+   */
+  addIndex(name: string, unique: boolean, columnsExpr: string, optWhereExpr: string): void
+ }
+ interface Collection {
+  /**
+   * RemoveIndex removes a single index with the specified name from the current collection.
+   */
+  removeIndex(name: string): void
+ }
+ /**
+  * collectionAuthOptions defines the options for the "auth" type collection.
+  */
+ interface collectionAuthOptions {
+  /**
+   * AuthRule could be used to specify additional record constraints
+   * applied after record authentication and right before returning the
+   * auth token response to the client.
+   * 
+   * For example, to allow only verified users you could set it to
+   * "verified = true".
+   * 
+   * Set it to empty string to allow any Auth collection record to authenticate.
+   * 
+   * Set it to nil to disallow authentication altogether for the collection
+   * (that includes password, OAuth2, etc.).
+   */
+  authRule?: string
+  /**
+   * ManageRule gives admin-like permissions to allow fully managing
+   * the auth record(s), eg. changing the password without requiring
+   * to enter the old one, directly updating the verified state and email, etc.
+   * 
+   * This rule is executed in addition to the Create and Update API rules.
+   */
+  manageRule?: string
+  /**
+   * AuthAlert defines options related to the auth alerts on new device login.
+   */
+  authAlert: AuthAlertConfig
+  /**
+   * OAuth2 specifies whether OAuth2 auth is enabled for the collection
+   * and which OAuth2 providers are allowed.
+   */
+  oauth2: OAuth2Config
+  /**
+   * PasswordAuth defines options related to the collection password authentication.
+   */
+  passwordAuth: PasswordAuthConfig
+  /**
+   * MFA defines options related to the Multi-factor authentication (MFA).
+   */
+  mfa: MFAConfig
+  /**
+   * OTP defines options related to the One-time password authentication (OTP).
+   */
+  otp: OTPConfig
+  /**
+   * Various token configurations
+   * ---
+   */
+  authToken: TokenConfig
+  passwordResetToken: TokenConfig
+  emailChangeToken: TokenConfig
+  verificationToken: TokenConfig
+  fileToken: TokenConfig
+  /**
+   * Default email templates
+   * ---
+   */
+  verificationTemplate: EmailTemplate
+  resetPasswordTemplate: EmailTemplate
+  confirmEmailChangeTemplate: EmailTemplate
+ }
+ interface EmailTemplate {
+  subject: string
+  body: string
+ }
+ interface EmailTemplate {
+  /**
+   * Validate makes EmailTemplate validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface EmailTemplate {
+  /**
+   * Resolve replaces the placeholder parameters in the current email
+   * template and returns its components as ready-to-use strings.
+   */
+  resolve(placeholders: _TygojaDict): [string, string]
+ }
+ interface AuthAlertConfig {
+  enabled: boolean
+  emailTemplate: EmailTemplate
+ }
+ interface AuthAlertConfig {
+  /**
+   * Validate makes AuthAlertConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TokenConfig {
+  secret: string
+  /**
+   * Duration specifies how long an issued token to be valid (in seconds)
+   */
+  duration: number
+ }
+ interface TokenConfig {
+  /**
+   * Validate makes TokenConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TokenConfig {
+  /**
+   * DurationTime returns the current Duration as [time.Duration].
+   */
+  durationTime(): time.Duration
+ }
+ interface OTPConfig {
+  enabled: boolean
+  /**
+   * Duration specifies how long the OTP to be valid (in seconds)
+   */
+  duration: number
+  /**
+   * Length specifies the auto generated password length.
+   */
+  length: number
+  /**
+   * EmailTemplate is the default OTP email template that will be send to the auth record.
+   * 
+   * In addition to the system placeholders you can also make use of
+   * [core.EmailPlaceholderOTPId] and [core.EmailPlaceholderOTP].
+   */
+  emailTemplate: EmailTemplate
+ }
+ interface OTPConfig {
+  /**
+   * Validate makes OTPConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface OTPConfig {
+  /**
+   * DurationTime returns the current Duration as [time.Duration].
+   */
+  durationTime(): time.Duration
+ }
+ interface MFAConfig {
+  enabled: boolean
+  /**
+   * Duration specifies how long an issued MFA to be valid (in seconds)
+   */
+  duration: number
+  /**
+   * Rule is an optional field to restrict MFA only for the records that satisfy the rule.
+   * 
+   * Leave it empty to enable MFA for everyone.
+   */
+  rule: string
+ }
+ interface MFAConfig {
+  /**
+   * Validate makes MFAConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface MFAConfig {
+  /**
+   * DurationTime returns the current Duration as [time.Duration].
+   */
+  durationTime(): time.Duration
+ }
+ interface PasswordAuthConfig {
+  enabled: boolean
+  /**
+   * IdentityFields is a list of field names that could be used as
+   * identity during password authentication.
+   * 
+   * Usually only fields that has single column UNIQUE index are accepted as values.
+   */
+  identityFields: Array<string>
+ }
+ interface PasswordAuthConfig {
+  /**
+   * Validate makes PasswordAuthConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface OAuth2KnownFields {
+  id: string
+  name: string
+  username: string
+  avatarURL: string
+ }
+ interface OAuth2Config {
+  providers: Array<OAuth2ProviderConfig>
+  mappedFields: OAuth2KnownFields
+  enabled: boolean
+ }
+ interface OAuth2Config {
+  /**
+   * GetProviderConfig returns the first OAuth2ProviderConfig that matches the specified name.
+   * 
+   * Returns false and zero config if no such provider is available in c.Providers.
+   */
+  getProviderConfig(name: string): [OAuth2ProviderConfig, boolean]
+ }
+ interface OAuth2Config {
+  /**
+   * Validate makes OAuth2Config validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface OAuth2ProviderConfig {
+  /**
+   * PKCE overwrites the default provider PKCE config option.
+   * 
+   * This usually shouldn't be needed but some OAuth2 vendors, like the LinkedIn OIDC,
+   * may require manual adjustment due to returning error if extra parameters are added to the request
+   * (https://github.com/pocketbase/pocketbase/discussions/3799#discussioncomment-7640312)
+   */
+  pkce?: boolean
+  name: string
+  clientId: string
+  clientSecret: string
+  authURL: string
+  tokenURL: string
+  userInfoURL: string
+  displayName: string
+  extra: _TygojaDict
+ }
+ interface OAuth2ProviderConfig {
+  /**
+   * Validate makes OAuth2ProviderConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface OAuth2ProviderConfig {
+  /**
+   * InitProvider returns a new auth.Provider instance loaded with the current OAuth2ProviderConfig options.
+   */
+  initProvider(): auth.Provider
+ }
+ /**
+  * collectionBaseOptions defines the options for the "base" type collection.
+  */
+ interface collectionBaseOptions {
+ }
+ /**
+  * collectionViewOptions defines the options for the "view" type collection.
+  */
+ interface collectionViewOptions {
+  viewQuery: string
+ }
+ interface BaseApp {
+  /**
+   * CollectionQuery returns a new Collection select query.
+   */
+  collectionQuery(): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * FindCollections finds all collections by the given type(s).
+   * 
+   * If collectionTypes is not set, it returns all collections.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindAllCollections() // all collections
+   * 	app.FindAllCollections("auth", "view") // only auth and view collections
+   * ```
+   */
+  findAllCollections(...collectionTypes: string[]): Array<(Collection | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * ReloadCachedCollections fetches all collections and caches them into the app store.
+   */
+  reloadCachedCollections(): void
+ }
+ interface BaseApp {
+  /**
+   * FindCollectionByNameOrId finds a single collection by its name (case insensitive) or id.
+   */
+  findCollectionByNameOrId(nameOrId: string): (Collection)
+ }
+ interface BaseApp {
+  /**
+   * FindCachedCollectionByNameOrId is similar to [BaseApp.FindCollectionByNameOrId]
+   * but retrieves the Collection from the app cache instead of making a db call.
+   * 
+   * NB! This method is suitable for read-only Collection operations.
+   * 
+   * Returns [sql.ErrNoRows] if no Collection is found for consistency
+   * with the [BaseApp.FindCollectionByNameOrId] method.
+   * 
+   * If you plan making changes to the returned Collection model,
+   * use [BaseApp.FindCollectionByNameOrId] instead.
+   * 
+   * Caveats:
+   * 
+   * ```
+   *   - The returned Collection should be used only for read-only operations.
+   *     Avoid directly modifying the returned cached Collection as it will affect
+   *     the global cached value even if you don't persist the changes in the database!
+   *   - If you are updating a Collection in a transaction and then call this method before commit,
+   *     it'll return the cached Collection state and not the one from the uncommitted transaction.
+   *   - The cache is automatically updated on collections db change (create/update/delete).
+   *     To manually reload the cache you can call [BaseApp.ReloadCachedCollections].
+   * ```
+   */
+  findCachedCollectionByNameOrId(nameOrId: string): (Collection)
+ }
+ interface BaseApp {
+  /**
+   * FindCollectionReferences returns information for all relation fields
+   * referencing the provided collection.
+   * 
+   * If the provided collection has reference to itself then it will be
+   * also included in the result. To exclude it, pass the collection id
+   * as the excludeIds argument.
+   */
+  findCollectionReferences(collection: Collection, ...excludeIds: string[]): _TygojaDict
+ }
+ interface BaseApp {
+  /**
+   * FindCachedCollectionReferences is similar to [BaseApp.FindCollectionReferences]
+   * but retrieves the Collection from the app cache instead of making a db call.
+   * 
+   * NB! This method is suitable for read-only Collection operations.
+   * 
+   * If you plan making changes to the returned Collection model,
+   * use [BaseApp.FindCollectionReferences] instead.
+   * 
+   * Caveats:
+   * 
+   * ```
+   *   - The returned Collection should be used only for read-only operations.
+   *     Avoid directly modifying the returned cached Collection as it will affect
+   *     the global cached value even if you don't persist the changes in the database!
+   *   - If you are updating a Collection in a transaction and then call this method before commit,
+   *     it'll return the cached Collection state and not the one from the uncommitted transaction.
+   *   - The cache is automatically updated on collections db change (create/update/delete).
+   *     To manually reload the cache you can call [BaseApp.ReloadCachedCollections].
+   * ```
+   */
+  findCachedCollectionReferences(collection: Collection, ...excludeIds: string[]): _TygojaDict
+ }
+ interface BaseApp {
+  /**
+   * IsCollectionNameUnique checks that there is no existing collection
+   * with the provided name (case insensitive!).
+   * 
+   * Note: case insensitive check because the name is used also as
+   * table name for the records.
+   */
+  isCollectionNameUnique(name: string, ...excludeIds: string[]): boolean
+ }
+ interface BaseApp {
+  /**
+   * TruncateCollection deletes all records associated with the provided collection.
+   * 
+   * The truncate operation is executed in a single transaction,
+   * aka. either everything is deleted or none.
+   * 
+   * Note that this method will also trigger the records related
+   * cascade and file delete actions.
+   */
+  truncateCollection(collection: Collection): void
+ }
+ interface BaseApp {
+  /**
+   * SyncRecordTableSchema compares the two provided collections
+   * and applies the necessary related record table changes.
+   * 
+   * If oldCollection is null, then only newCollection is used to create the record table.
+   * 
+   * This method is automatically invoked as part of a collection create/update/delete operation.
+   */
+  syncRecordTableSchema(newCollection: Collection, oldCollection: Collection): void
+ }
+ interface collectionValidator {
+ }
+ interface optionsValidator {
+  [key:string]: any;
+ }
+ /**
+  * DBExporter defines an interface for custom DB data export.
+  * Usually used as part of [App.Save].
+  */
+ interface DBExporter {
+  [key:string]: any;
+  /**
+   * DBExport returns a key-value map with the data to be used when saving the struct in the database.
+   */
+  dbExport(app: App): _TygojaDict
+ }
+ /**
+  * PreValidator defines an optional model interface for registering a
+  * function that will run BEFORE firing the validation hooks (see [App.ValidateWithContext]).
+  */
+ interface PreValidator {
+  [key:string]: any;
+  /**
+   * PreValidate defines a function that runs BEFORE the validation hooks.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ /**
+  * PostValidator defines an optional model interface for registering a
+  * function that will run AFTER executing the validation hooks (see [App.ValidateWithContext]).
+  */
+ interface PostValidator {
+  [key:string]: any;
+  /**
+   * PostValidate defines a function that runs AFTER the successful
+   * execution of the validation hooks.
+   */
+  postValidate(ctx: context.Context, app: App): void
+ }
+ interface generateDefaultRandomId {
+  /**
+   * GenerateDefaultRandomId generates a default random id string
+   * (note: the generated random string is not intended for security purposes).
+   */
+  (): string
+ }
+ interface BaseApp {
+  /**
+   * ModelQuery creates a new preconfigured select data.db query with preset
+   * SELECT, FROM and other common fields based on the provided model.
+   */
+  modelQuery(m: Model): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * AuxModelQuery creates a new preconfigured select auxiliary.db query with preset
+   * SELECT, FROM and other common fields based on the provided model.
+   */
+  auxModelQuery(m: Model): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * Delete deletes the specified model from the regular app database.
+   */
+  delete(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * Delete deletes the specified model from the regular app database
+   * (the context could be used to limit the query execution).
+   */
+  deleteWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxDelete deletes the specified model from the auxiliary database.
+   */
+  auxDelete(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxDeleteWithContext deletes the specified model from the auxiliary database
+   * (the context could be used to limit the query execution).
+   */
+  auxDeleteWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * Save validates and saves the specified model into the regular app database.
+   * 
+   * If you don't want to run validations, use [App.SaveNoValidate()].
+   */
+  save(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * SaveWithContext is the same as [App.Save()] but allows specifying a context to limit the db execution.
+   * 
+   * If you don't want to run validations, use [App.SaveNoValidateWithContext()].
+   */
+  saveWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * SaveNoValidate saves the specified model into the regular app database without performing validations.
+   * 
+   * If you want to also run validations before persisting, use [App.Save()].
+   */
+  saveNoValidate(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * SaveNoValidateWithContext is the same as [App.SaveNoValidate()]
+   * but allows specifying a context to limit the db execution.
+   * 
+   * If you want to also run validations before persisting, use [App.SaveWithContext()].
+   */
+  saveNoValidateWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxSave validates and saves the specified model into the auxiliary app database.
+   * 
+   * If you don't want to run validations, use [App.AuxSaveNoValidate()].
+   */
+  auxSave(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxSaveWithContext is the same as [App.AuxSave()] but allows specifying a context to limit the db execution.
+   * 
+   * If you don't want to run validations, use [App.AuxSaveNoValidateWithContext()].
+   */
+  auxSaveWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxSaveNoValidate saves the specified model into the auxiliary app database without performing validations.
+   * 
+   * If you want to also run validations before persisting, use [App.AuxSave()].
+   */
+  auxSaveNoValidate(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxSaveNoValidateWithContext is the same as [App.AuxSaveNoValidate()]
+   * but allows specifying a context to limit the db execution.
+   * 
+   * If you want to also run validations before persisting, use [App.AuxSaveWithContext()].
+   */
+  auxSaveNoValidateWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * Validate triggers the OnModelValidate hook for the specified model.
+   */
+  validate(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * ValidateWithContext is the same as Validate but allows specifying the ModelEvent context.
+   */
+  validateWithContext(ctx: context.Context, model: Model): void
+ }
+ /**
+  * note: expects both builder to use the same driver
+  */
+ interface dualDBBuilder {
+ }
+ interface dualDBBuilder {
+  /**
+   * Select implements the [dbx.Builder.Select] interface method.
+   */
+  select(...cols: string[]): (dbx.SelectQuery)
+ }
+ interface dualDBBuilder {
+  /**
+   * Model implements the [dbx.Builder.Model] interface method.
+   */
+  model(data: {
+   }): (dbx.ModelQuery)
+ }
+ interface dualDBBuilder {
+  /**
+   * GeneratePlaceholder implements the [dbx.Builder.GeneratePlaceholder] interface method.
+   */
+  generatePlaceholder(i: number): string
+ }
+ interface dualDBBuilder {
+  /**
+   * Quote implements the [dbx.Builder.Quote] interface method.
+   */
+  quote(str: string): string
+ }
+ interface dualDBBuilder {
+  /**
+   * QuoteSimpleTableName implements the [dbx.Builder.QuoteSimpleTableName] interface method.
+   */
+  quoteSimpleTableName(table: string): string
+ }
+ interface dualDBBuilder {
+  /**
+   * QuoteSimpleColumnName implements the [dbx.Builder.QuoteSimpleColumnName] interface method.
+   */
+  quoteSimpleColumnName(col: string): string
+ }
+ interface dualDBBuilder {
+  /**
+   * QueryBuilder implements the [dbx.Builder.QueryBuilder] interface method.
+   */
+  queryBuilder(): dbx.QueryBuilder
+ }
+ interface dualDBBuilder {
+  /**
+   * Insert implements the [dbx.Builder.Insert] interface method.
+   */
+  insert(table: string, cols: dbx.Params): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * Upsert implements the [dbx.Builder.Upsert] interface method.
+   */
+  upsert(table: string, cols: dbx.Params, ...constraints: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * Update implements the [dbx.Builder.Update] interface method.
+   */
+  update(table: string, cols: dbx.Params, where: dbx.Expression): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * Delete implements the [dbx.Builder.Delete] interface method.
+   */
+  delete(table: string, where: dbx.Expression): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * CreateTable implements the [dbx.Builder.CreateTable] interface method.
+   */
+  createTable(table: string, cols: _TygojaDict, ...options: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * RenameTable implements the [dbx.Builder.RenameTable] interface method.
+   */
+  renameTable(oldName: string, newName: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropTable implements the [dbx.Builder.DropTable] interface method.
+   */
+  dropTable(table: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * TruncateTable implements the [dbx.Builder.TruncateTable] interface method.
+   */
+  truncateTable(table: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * AddColumn implements the [dbx.Builder.AddColumn] interface method.
+   */
+  addColumn(table: string, col: string, typ: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropColumn implements the [dbx.Builder.DropColumn] interface method.
+   */
+  dropColumn(table: string, col: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * RenameColumn implements the [dbx.Builder.RenameColumn] interface method.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * AlterColumn implements the [dbx.Builder.AlterColumn] interface method.
+   */
+  alterColumn(table: string, col: string, typ: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * AddPrimaryKey implements the [dbx.Builder.AddPrimaryKey] interface method.
+   */
+  addPrimaryKey(table: string, name: string, ...cols: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropPrimaryKey implements the [dbx.Builder.DropPrimaryKey] interface method.
+   */
+  dropPrimaryKey(table: string, name: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * AddForeignKey implements the [dbx.Builder.AddForeignKey] interface method.
+   */
+  addForeignKey(table: string, name: string, cols: Array<string>, refCols: Array<string>, refTable: string, ...options: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropForeignKey implements the [dbx.Builder.DropForeignKey] interface method.
+   */
+  dropForeignKey(table: string, name: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * CreateIndex implements the [dbx.Builder.CreateIndex] interface method.
+   */
+  createIndex(table: string, name: string, ...cols: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * CreateUniqueIndex implements the [dbx.Builder.CreateUniqueIndex] interface method.
+   */
+  createUniqueIndex(table: string, name: string, ...cols: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropIndex implements the [dbx.Builder.DropIndex] interface method.
+   */
+  dropIndex(table: string, name: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * NewQuery implements the [dbx.Builder.NewQuery] interface method by
+   * routing the SELECT queries to the concurrent builder instance.
+   */
+  newQuery(str: string): (dbx.Query)
+ }
+ interface defaultDBConnect {
+  (dbPath: string): (dbx.DB)
+ }
+ /**
+  * Model defines an interface with common methods that all db models should have.
+  * 
+  * Note: for simplicity composite pk are not supported.
+  */
+ interface Model {
+  [key:string]: any;
+  tableName(): string
+  pk(): any
+  lastSavedPK(): any
+  isNew(): boolean
+  markAsNew(): void
+  markAsNotNew(): void
+ }
+ /**
+  * BaseModel defines a base struct that is intended to be embedded into other custom models.
+  */
+ interface BaseModel {
+  /**
+   * Id is the primary key of the model.
+   * It is usually autogenerated by the parent model implementation.
+   */
+  id: string
+ }
+ interface BaseModel {
+  /**
+   * LastSavedPK returns the last saved primary key of the model.
+   * 
+   * Its value is updated to the latest PK value after MarkAsNotNew() or PostScan() calls.
+   */
+  lastSavedPK(): any
+ }
+ interface BaseModel {
+  pk(): any
+ }
+ interface BaseModel {
+  /**
+   * IsNew indicates what type of db query (insert or update)
+   * should be used with the model instance.
+   */
+  isNew(): boolean
+ }
+ interface BaseModel {
+  /**
+   * MarkAsNew clears the pk field and marks the current model as "new"
+   * (aka. forces m.IsNew() to be true).
+   */
+  markAsNew(): void
+ }
+ interface BaseModel {
+  /**
+   * MarkAsNew set the pk field to the Id value and marks the current model
+   * as NOT "new" (aka. forces m.IsNew() to be false).
+   */
+  markAsNotNew(): void
+ }
+ interface BaseModel {
+  /**
+   * PostScan implements the [dbx.PostScanner] interface.
+   * 
+   * It is usually executed right after the model is populated with the db row values.
+   */
+  postScan(): void
+ }
+ interface BaseApp {
+  /**
+   * TableColumns returns all column names of a single table by its name.
+   */
+  tableColumns(tableName: string): Array<string>
+ }
+ interface TableInfoRow {
+  /**
+   * the `db:"pk"` tag has special semantic so we cannot rename
+   * the original field without specifying a custom mapper
+   */
+  pk: number
+  index: number
+  name: string
+  type: string
+  notNull: boolean
+  defaultValue: sql.NullString
+ }
+ interface BaseApp {
+  /**
+   * TableInfo returns the "table_info" pragma result for the specified table.
+   */
+  tableInfo(tableName: string): Array<(TableInfoRow | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * TableIndexes returns a name grouped map with all non empty index of the specified table.
+   * 
+   * Note: This method doesn't return an error on nonexisting table.
+   */
+  tableIndexes(tableName: string): _TygojaDict
+ }
+ interface BaseApp {
+  /**
+   * DeleteTable drops the specified table.
+   * 
+   * This method is a no-op if a table with the provided name doesn't exist.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "tableName" argument must come only from trusted input!
+   */
+  deleteTable(tableName: string): void
+ }
+ interface BaseApp {
+  /**
+   * HasTable checks if a table (or view) with the provided name exists (case insensitive).
+   * in the data.db.
+   */
+  hasTable(tableName: string): boolean
+ }
+ interface BaseApp {
+  /**
+   * AuxHasTable checks if a table (or view) with the provided name exists (case insensitive)
+   * in the auixiliary.db.
+   */
+  auxHasTable(tableName: string): boolean
+ }
+ interface BaseApp {
+  /**
+   * Vacuum executes VACUUM on the data.db in order to reclaim unused data db disk space.
+   */
+  vacuum(): void
+ }
+ interface BaseApp {
+  /**
+   * AuxVacuum executes VACUUM on the auxiliary.db in order to reclaim unused auxiliary db disk space.
+   */
+  auxVacuum(): void
+ }
+ interface BaseApp {
+  /**
+   * RunInTransaction wraps fn into a transaction for the regular app database.
+   * 
+   * It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+   */
+  runInTransaction(fn: (txApp: App) => void): void
+ }
+ interface BaseApp {
+  /**
+   * AuxRunInTransaction wraps fn into a transaction for the auxiliary app database.
+   * 
+   * It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+   */
+  auxRunInTransaction(fn: (txApp: App) => void): void
+ }
+ /**
+  * TxAppInfo represents an active transaction context associated to an existing app instance.
+  */
+ interface TxAppInfo {
+ }
+ interface TxAppInfo {
+  /**
+   * OnComplete registers the provided callback that will be invoked
+   * once the related transaction ends (either completes successfully or rollbacked with an error).
+   * 
+   * The callback receives the transaction error (if any) as its argument.
+   * Any additional errors returned by the OnComplete callbacks will be
+   * joined together with txErr when returning the final transaction result.
+   */
+  onComplete(fn: (txErr: Error) => void): void
+ }
+ /**
+  * RequestEvent defines the PocketBase router handler event.
+  */
+ type _sKhraUa = router.Event
+ interface RequestEvent extends _sKhraUa {
+  app: App
+  auth?: Record
+ }
+ interface RequestEvent {
+  /**
+   * RealIP returns the "real" IP address from the configured trusted proxy headers.
+   * 
+   * If Settings.TrustedProxy is not configured or the found IP is empty,
+   * it fallbacks to e.RemoteIP().
+   * 
+   * NB!
+   * Be careful when used in a security critical context as it relies on
+   * the trusted proxy to be properly configured and your app to be accessible only through it.
+   * If you are not sure, use e.RemoteIP().
+   */
+  realIP(): string
+ }
+ interface RequestEvent {
+  /**
+   * HasSuperuserAuth checks whether the current RequestEvent has superuser authentication loaded.
+   */
+  hasSuperuserAuth(): boolean
+ }
+ interface RequestEvent {
+  /**
+   * RequestInfo parses the current request into RequestInfo instance.
+   * 
+   * Note that the returned result is cached to avoid copying the request data multiple times
+   * but the auth state and other common store items are always refreshed in case they were changed by another handler.
+   */
+  requestInfo(): (RequestInfo)
+ }
+ /**
+  * RequestInfo defines a HTTP request data struct, usually used
+  * as part of the `@request.*` filter resolver.
+  * 
+  * The Query and Headers fields contains only the first value for each found entry.
+  */
+ interface RequestInfo {
+  query: _TygojaDict
+  headers: _TygojaDict
+  body: _TygojaDict
+  auth?: Record
+  method: string
+  context: string
+ }
+ interface RequestInfo {
+  /**
+   * HasSuperuserAuth checks whether the current RequestInfo instance
+   * has superuser authentication loaded.
+   */
+  hasSuperuserAuth(): boolean
+ }
+ interface RequestInfo {
+  /**
+   * Clone creates a new shallow copy of the current RequestInfo and its Auth record (if any).
+   */
+  clone(): (RequestInfo)
+ }
+ type _sbXFFhl = hook.Event&RequestEvent
+ interface BatchRequestEvent extends _sbXFFhl {
+  batch: Array<(InternalRequest | undefined)>
+ }
+ interface InternalRequest {
+  /**
+   * note: for uploading files the value must be either *filesystem.File or []*filesystem.File
+   */
+  body: _TygojaDict
+  headers: _TygojaDict
+  method: string
+  url: string
+ }
+ interface InternalRequest {
+  validate(): void
+ }
+ interface HookTagger {
+  [key:string]: any;
+  hookTags(): Array<string>
+ }
+ interface baseModelEventData {
+  model: Model
+ }
+ interface baseModelEventData {
+  tags(): Array<string>
+ }
+ interface baseRecordEventData {
+  record?: Record
+ }
+ interface baseRecordEventData {
+  tags(): Array<string>
+ }
+ interface baseCollectionEventData {
+  collection?: Collection
+ }
+ interface baseCollectionEventData {
+  tags(): Array<string>
+ }
+ type _spyRtBo = hook.Event
+ interface BootstrapEvent extends _spyRtBo {
+  app: App
+ }
+ type _scmVEbS = hook.Event
+ interface TerminateEvent extends _scmVEbS {
+  app: App
+  isRestart: boolean
+ }
+ type _sLJKyMQ = hook.Event
+ interface BackupEvent extends _sLJKyMQ {
+  app: App
+  context: context.Context
+  name: string // the name of the backup to create/restore.
+  exclude: Array<string> // list of dir entries to exclude from the backup create/restore.
+ }
+ type _sZsAFoN = hook.Event
+ interface ServeEvent extends _sZsAFoN {
+  app: App
+  router?: router.Router<RequestEvent | undefined>
+  server?: http.Server
+  certManager?: any
+  /**
+   * InstallerFunc is the "installer" function that is called after
+   * successful server tcp bind but only if there is no explicit
+   * superuser record created yet.
+   * 
+   * It runs in a separate goroutine and its default value is [apis.DefaultInstallerFunc].
+   * 
+   * It receives a system superuser record as argument that you can use to generate
+   * a short-lived auth token (e.g. systemSuperuser.NewStaticAuthToken(30 * time.Minute))
+   * and concatenate it as query param for your installer page
+   * (if you are using the client-side SDKs, you can then load the
+   * token with pb.authStore.save(token) and perform any Web API request
+   * e.g. creating a new superuser).
+   * 
+   * Set it to nil if you want to skip the installer.
+   */
+  installerFunc: (app: App, systemSuperuser: Record, baseURL: string) => void
+ }
+ type _szpyhbL = hook.Event&RequestEvent
+ interface SettingsListRequestEvent extends _szpyhbL {
+  settings?: Settings
+ }
+ type _sUrpTPz = hook.Event&RequestEvent
+ interface SettingsUpdateRequestEvent extends _sUrpTPz {
+  oldSettings?: Settings
+  newSettings?: Settings
+ }
+ type _sOIBUYK = hook.Event
+ interface SettingsReloadEvent extends _sOIBUYK {
+  app: App
+ }
+ type _srxGkIn = hook.Event
+ interface MailerEvent extends _srxGkIn {
+  app: App
+  mailer: mailer.Mailer
+  message?: mailer.Message
+ }
+ type _spcbBxx = MailerEvent&baseRecordEventData
+ interface MailerRecordEvent extends _spcbBxx {
+  meta: _TygojaDict
+ }
+ type _seMeelk = hook.Event&baseModelEventData
+ interface ModelEvent extends _seMeelk {
+  app: App
+  context: context.Context
+  /**
+   * Could be any of the ModelEventType* constants, like:
+   * - create
+   * - update
+   * - delete
+   * - validate
+   */
+  type: string
+ }
+ type _stQeXll = ModelEvent
+ interface ModelErrorEvent extends _stQeXll {
+  error: Error
+ }
+ type _sLYFFhx = hook.Event&baseRecordEventData
+ interface RecordEvent extends _sLYFFhx {
+  app: App
+  context: context.Context
+  /**
+   * Could be any of the ModelEventType* constants, like:
+   * - create
+   * - update
+   * - delete
+   * - validate
+   */
+  type: string
+ }
+ type _sWPmnLi = RecordEvent
+ interface RecordErrorEvent extends _sWPmnLi {
+  error: Error
+ }
+ type _seGYfWU = hook.Event&baseCollectionEventData
+ interface CollectionEvent extends _seGYfWU {
+  app: App
+  context: context.Context
+  /**
+   * Could be any of the ModelEventType* constants, like:
+   * - create
+   * - update
+   * - delete
+   * - validate
+   */
+  type: string
+ }
+ type _sOEsoWv = CollectionEvent
+ interface CollectionErrorEvent extends _sOEsoWv {
+  error: Error
+ }
+ type _swJRVXC = hook.Event&RequestEvent&baseRecordEventData
+ interface FileTokenRequestEvent extends _swJRVXC {
+  token: string
+ }
+ type _skWTzPe = hook.Event&RequestEvent&baseCollectionEventData
+ interface FileDownloadRequestEvent extends _skWTzPe {
+  record?: Record
+  fileField?: FileField
+  servedPath: string
+  servedName: string
+ }
+ type _sjZNtLd = hook.Event&RequestEvent
+ interface CollectionsListRequestEvent extends _sjZNtLd {
+  collections: Array<(Collection | undefined)>
+  result?: search.Result
+ }
+ type _sQwJwmj = hook.Event&RequestEvent
+ interface CollectionsImportRequestEvent extends _sQwJwmj {
+  collectionsData: Array<_TygojaDict>
+  deleteMissing: boolean
+ }
+ type _ssHWEJn = hook.Event&RequestEvent&baseCollectionEventData
+ interface CollectionRequestEvent extends _ssHWEJn {
+ }
+ type _sZMxaAS = hook.Event&RequestEvent
+ interface RealtimeConnectRequestEvent extends _sZMxaAS {
+  client: subscriptions.Client
+  /**
+   * note: modifying it after the connect has no effect
+   */
+  idleTimeout: time.Duration
+ }
+ type _sirsirI = hook.Event&RequestEvent
+ interface RealtimeMessageEvent extends _sirsirI {
+  client: subscriptions.Client
+  message?: subscriptions.Message
+ }
+ type _sGVLXGI = hook.Event&RequestEvent
+ interface RealtimeSubscribeRequestEvent extends _sGVLXGI {
+  client: subscriptions.Client
+  subscriptions: Array<string>
+ }
+ type _sNkctgx = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordsListRequestEvent extends _sNkctgx {
+  /**
+   * @todo consider removing and maybe add as generic to the search.Result?
+   */
+  records: Array<(Record | undefined)>
+  result?: search.Result
+ }
+ type _sesXIeC = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordRequestEvent extends _sesXIeC {
+  record?: Record
+ }
+ type _sNqEfxw = hook.Event&baseRecordEventData
+ interface RecordEnrichEvent extends _sNqEfxw {
+  app: App
+  requestInfo?: RequestInfo
+ }
+ type _saJisDV = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordCreateOTPRequestEvent extends _saJisDV {
+  record?: Record
+  password: string
+ }
+ type _sOSfgvh = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthWithOTPRequestEvent extends _sOSfgvh {
+  record?: Record
+  otp?: OTP
+ }
+ type _sAHiJnG = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthRequestEvent extends _sAHiJnG {
+  record?: Record
+  token: string
+  meta: any
+  authMethod: string
+ }
+ type _syiXgiO = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthWithPasswordRequestEvent extends _syiXgiO {
+  record?: Record
+  identity: string
+  identityField: string
+  password: string
+ }
+ type _sRauTZa = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthWithOAuth2RequestEvent extends _sRauTZa {
+  providerName: string
+  providerClient: auth.Provider
+  record?: Record
+  oAuth2User?: auth.AuthUser
+  createData: _TygojaDict
+  isNewRecord: boolean
+ }
+ type _srGgmEJ = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthRefreshRequestEvent extends _srGgmEJ {
+  record?: Record
+ }
+ type _sFfmUxk = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordRequestPasswordResetRequestEvent extends _sFfmUxk {
+  record?: Record
+ }
+ type _sLGZbki = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordConfirmPasswordResetRequestEvent extends _sLGZbki {
+  record?: Record
+ }
+ type _sQcbAzh = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordRequestVerificationRequestEvent extends _sQcbAzh {
+  record?: Record
+ }
+ type _sIJpEBx = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordConfirmVerificationRequestEvent extends _sIJpEBx {
+  record?: Record
+ }
+ type _sGcXDVI = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordRequestEmailChangeRequestEvent extends _sGcXDVI {
+  record?: Record
+  newEmail: string
+ }
+ type _sFyRDNw = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordConfirmEmailChangeRequestEvent extends _sFyRDNw {
+  record?: Record
+  newEmail: string
+ }
+ /**
+  * ExternalAuth defines a Record proxy for working with the externalAuths collection.
+  */
+ type _sBktZEa = Record
+ interface ExternalAuth extends _sBktZEa {
+ }
+ interface newExternalAuth {
+  /**
+   * NewExternalAuth instantiates and returns a new blank *ExternalAuth model.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	ea := core.NewExternalAuth(app)
+   * 	ea.SetRecordRef(user.Id)
+   * 	ea.SetCollectionRef(user.Collection().Id)
+   * 	ea.SetProvider("google")
+   * 	ea.SetProviderId("...")
+   * 	app.Save(ea)
+   * ```
+   */
+  (app: App): (ExternalAuth)
+ }
+ interface ExternalAuth {
+  /**
+   * PreValidate implements the [PreValidator] interface and checks
+   * whether the proxy is properly loaded.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ interface ExternalAuth {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface ExternalAuth {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface ExternalAuth {
+  /**
+   * CollectionRef returns the "collectionRef" field value.
+   */
+  collectionRef(): string
+ }
+ interface ExternalAuth {
+  /**
+   * SetCollectionRef updates the "collectionRef" record field value.
+   */
+  setCollectionRef(collectionId: string): void
+ }
+ interface ExternalAuth {
+  /**
+   * RecordRef returns the "recordRef" record field value.
+   */
+  recordRef(): string
+ }
+ interface ExternalAuth {
+  /**
+   * SetRecordRef updates the "recordRef" record field value.
+   */
+  setRecordRef(recordId: string): void
+ }
+ interface ExternalAuth {
+  /**
+   * Provider returns the "provider" record field value.
+   */
+  provider(): string
+ }
+ interface ExternalAuth {
+  /**
+   * SetProvider updates the "provider" record field value.
+   */
+  setProvider(provider: string): void
+ }
+ interface ExternalAuth {
+  /**
+   * Provider returns the "providerId" record field value.
+   */
+  providerId(): string
+ }
+ interface ExternalAuth {
+  /**
+   * SetProvider updates the "providerId" record field value.
+   */
+  setProviderId(providerId: string): void
+ }
+ interface ExternalAuth {
+  /**
+   * Created returns the "created" record field value.
+   */
+  created(): types.DateTime
+ }
+ interface ExternalAuth {
+  /**
+   * Updated returns the "updated" record field value.
+   */
+  updated(): types.DateTime
+ }
+ interface BaseApp {
+  /**
+   * FindAllExternalAuthsByRecord returns all ExternalAuth models
+   * linked to the provided auth record.
+   */
+  findAllExternalAuthsByRecord(authRecord: Record): Array<(ExternalAuth | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllExternalAuthsByCollection returns all ExternalAuth models
+   * linked to the provided auth collection.
+   */
+  findAllExternalAuthsByCollection(collection: Collection): Array<(ExternalAuth | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindFirstExternalAuthByExpr returns the first available (the most recent created)
+   * ExternalAuth model that satisfies the non-nil expression.
+   */
+  findFirstExternalAuthByExpr(expr: dbx.Expression): (ExternalAuth)
+ }
+ /**
+  * FieldFactoryFunc defines a simple function to construct a specific Field instance.
+  */
+ interface FieldFactoryFunc {(): Field }
+ /**
+  * Field defines a common interface that all Collection fields should implement.
+  */
+ interface Field {
+  [key:string]: any;
+  /**
+   * GetId returns the field id.
+   */
+  getId(): string
+  /**
+   * SetId changes the field id.
+   */
+  setId(id: string): void
+  /**
+   * GetName returns the field name.
+   */
+  getName(): string
+  /**
+   * SetName changes the field name.
+   */
+  setName(name: string): void
+  /**
+   * GetSystem returns the field system flag state.
+   */
+  getSystem(): boolean
+  /**
+   * SetSystem changes the field system flag state.
+   */
+  setSystem(system: boolean): void
+  /**
+   * GetHidden returns the field hidden flag state.
+   */
+  getHidden(): boolean
+  /**
+   * SetHidden changes the field hidden flag state.
+   */
+  setHidden(hidden: boolean): void
+  /**
+   * Type returns the unique type of the field.
+   */
+  type(): string
+  /**
+   * ColumnType returns the DB column definition of the field.
+   */
+  columnType(app: App): string
+  /**
+   * PrepareValue returns a properly formatted field value based on the provided raw one.
+   * 
+   * This method is also called on record construction to initialize its default field value.
+   */
+  prepareValue(record: Record, raw: any): any
+  /**
+   * ValidateSettings validates the current field value associated with the provided record.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+  /**
+   * ValidateSettings validates the current field settings.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * MaxBodySizeCalculator defines an optional field interface for
+  * specifying the max size of a field value.
+  */
+ interface MaxBodySizeCalculator {
+  [key:string]: any;
+  /**
+   * CalculateMaxBodySize returns the approximate max body size of a field value.
+   */
+  calculateMaxBodySize(): number
+ }
+ interface SetterFunc {(record: Record, raw: any): void }
+ /**
+  * SetterFinder defines a field interface for registering custom field value setters.
+  */
+ interface SetterFinder {
+  [key:string]: any;
+  /**
+   * FindSetter returns a single field value setter function
+   * by performing pattern-like field matching using the specified key.
+   * 
+   * The key is usually just the field name but it could also
+   * contains "modifier" characters based on which you can perform custom set operations
+   * (ex. "users+" could be mapped to a function that will append new user to the existing field value).
+   * 
+   * Return nil if you want to fallback to the default field value setter.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ interface GetterFunc {(record: Record): any }
+ /**
+  * GetterFinder defines a field interface for registering custom field value getters.
+  */
+ interface GetterFinder {
+  [key:string]: any;
+  /**
+   * FindGetter returns a single field value getter function
+   * by performing pattern-like field matching using the specified key.
+   * 
+   * The key is usually just the field name but it could also
+   * contains "modifier" characters based on which you can perform custom get operations
+   * (ex. "description:excerpt" could be mapped to a function that will return an excerpt of the current field value).
+   * 
+   * Return nil if you want to fallback to the default field value setter.
+   */
+  findGetter(key: string): GetterFunc
+ }
+ /**
+  * DriverValuer defines a Field interface for exporting and formatting
+  * a field value for the database.
+  */
+ interface DriverValuer {
+  [key:string]: any;
+  /**
+   * DriverValue exports a single field value for persistence in the database.
+   */
+  driverValue(record: Record): any
+ }
+ /**
+  * MultiValuer defines a field interface that every multi-valued (eg. with MaxSelect) field has.
+  */
+ interface MultiValuer {
+  [key:string]: any;
+  /**
+   * IsMultiple checks whether the field is configured to support multiple or single values.
+   */
+  isMultiple(): boolean
+ }
+ /**
+  * RecordInterceptor defines a field interface for reacting to various
+  * Record related operations (create, delete, validate, etc.).
+  */
+ interface RecordInterceptor {
+  [key:string]: any;
+  /**
+   * Interceptor is invoked when a specific record action occurs
+   * allowing you to perform extra validations and normalization
+   * (ex. uploading or deleting files).
+   * 
+   * Note that users must call actionFunc() manually if they want to
+   * execute the specific record action.
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ interface defaultFieldIdValidationRule {
+  /**
+   * DefaultFieldIdValidationRule performs base validation on a field id value.
+   */
+  (value: any): void
+ }
+ interface defaultFieldNameValidationRule {
+  /**
+   * DefaultFieldIdValidationRule performs base validation on a field name value.
+   */
+  (value: any): void
+ }
+ /**
+  * AutodateField defines an "autodate" type field, aka.
+  * field which datetime value could be auto set on record create/update.
+  * 
+  * This field is usually used for defining timestamp fields like "created" and "updated".
+  * 
+  * Requires either both or at least one of the OnCreate or OnUpdate options to be set.
+  */
+ interface AutodateField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * OnCreate auto sets the current datetime as field value on record create.
+   */
+  onCreate: boolean
+  /**
+   * OnUpdate auto sets the current datetime as field value on record update.
+   */
+  onUpdate: boolean
+ }
+ interface AutodateField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface AutodateField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface AutodateField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface AutodateField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface AutodateField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface AutodateField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface AutodateField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface AutodateField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface AutodateField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface AutodateField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface AutodateField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface AutodateField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface AutodateField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface AutodateField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ interface AutodateField {
+  /**
+   * Intercept implements the [RecordInterceptor] interface.
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ /**
+  * BoolField defines "bool" type field to store a single true/false value.
+  * 
+  * The respective zero record field value is false.
+  */
+ interface BoolField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Required will require the field value to be always "true".
+   */
+  required: boolean
+ }
+ interface BoolField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface BoolField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface BoolField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface BoolField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface BoolField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface BoolField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface BoolField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface BoolField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface BoolField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface BoolField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface BoolField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface BoolField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface BoolField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * DateField defines "date" type field to store a single [types.DateTime] value.
+  * 
+  * The respective zero record field value is the zero [types.DateTime].
+  */
+ interface DateField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Min specifies the min allowed field value.
+   * 
+   * Leave it empty to skip the validator.
+   */
+  min: types.DateTime
+  /**
+   * Max specifies the max allowed field value.
+   * 
+   * Leave it empty to skip the validator.
+   */
+  max: types.DateTime
+  /**
+   * Required will require the field value to be non-zero [types.DateTime].
+   */
+  required: boolean
+ }
+ interface DateField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface DateField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface DateField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface DateField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface DateField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface DateField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface DateField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface DateField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface DateField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface DateField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface DateField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface DateField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface DateField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * EditorField defines "editor" type field to store HTML formatted text.
+  * 
+  * The respective zero record field value is empty string.
+  */
+ interface EditorField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * MaxSize specifies the maximum size of the allowed field value (in bytes and up to 2^53-1).
+   * 
+   * If zero, a default limit of ~5MB is applied.
+   */
+  maxSize: number
+  /**
+   * ConvertURLs is usually used to instruct the editor whether to
+   * apply url conversion (eg. stripping the domain name in case the
+   * urls are using the same domain as the one where the editor is loaded).
+   * 
+   * (see also https://www.tiny.cloud/docs/tinymce/6/url-handling/#convert_urls)
+   */
+  convertURLs: boolean
+  /**
+   * Required will require the field value to be non-empty string.
+   */
+  required: boolean
+ }
+ interface EditorField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface EditorField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface EditorField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface EditorField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface EditorField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface EditorField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface EditorField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface EditorField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface EditorField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface EditorField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface EditorField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface EditorField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface EditorField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface EditorField {
+  /**
+   * CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+   */
+  calculateMaxBodySize(): number
+ }
+ /**
+  * EmailField defines "email" type field for storing a single email string address.
+  * 
+  * The respective zero record field value is empty string.
+  */
+ interface EmailField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * ExceptDomains will require the email domain to NOT be included in the listed ones.
+   * 
+   * This validator can be set only if OnlyDomains is empty.
+   */
+  exceptDomains: Array<string>
+  /**
+   * OnlyDomains will require the email domain to be included in the listed ones.
+   * 
+   * This validator can be set only if ExceptDomains is empty.
+   */
+  onlyDomains: Array<string>
+  /**
+   * Required will require the field value to be non-empty email string.
+   */
+  required: boolean
+ }
+ interface EmailField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface EmailField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface EmailField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface EmailField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface EmailField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface EmailField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface EmailField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface EmailField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface EmailField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface EmailField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface EmailField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface EmailField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface EmailField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * FileField defines "file" type field for managing record file(s).
+  * 
+  * Only the file name is stored as part of the record value.
+  * New files (aka. files to upload) are expected to be of *filesytem.File.
+  * 
+  * If MaxSelect is not set or <= 1, then the field value is expected to be a single record id.
+  * 
+  * If MaxSelect is > 1, then the field value is expected to be a slice of record ids.
+  * 
+  * The respective zero record field value is either empty string (single) or empty string slice (multiple).
+  * 
+  * ---
+  * 
+  * The following additional setter keys are available:
+  * 
+  * ```
+  *   - "fieldName+" - append one or more files to the existing record one. For example:
+  * 
+  *     // []string{"old1.txt", "old2.txt", "new1_ajkvass.txt", "new2_klhfnwd.txt"}
+  *     record.Set("documents+", []*filesystem.File{new1, new2})
+  * 
+  *   - "+fieldName" - prepend one or more files to the existing record one. For example:
+  * 
+  *     // []string{"new1_ajkvass.txt", "new2_klhfnwd.txt", "old1.txt", "old2.txt",}
+  *     record.Set("+documents", []*filesystem.File{new1, new2})
+  * 
+  *   - "fieldName-" - subtract/delete one or more files from the existing record one. For example:
+  * 
+  *     // []string{"old2.txt",}
+  *     record.Set("documents-", "old1.txt")
+  * ```
+  */
+ interface FileField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * MaxSize specifies the maximum size of a single uploaded file (in bytes and up to 2^53-1).
+   * 
+   * If zero, a default limit of 5MB is applied.
+   */
+  maxSize: number
+  /**
+   * MaxSelect specifies the max allowed files.
+   * 
+   * For multiple files the value must be > 1, otherwise fallbacks to single (default).
+   */
+  maxSelect: number
+  /**
+   * MimeTypes specifies an optional list of the allowed file mime types.
+   * 
+   * Leave it empty to disable the validator.
+   */
+  mimeTypes: Array<string>
+  /**
+   * Thumbs specifies an optional list of the supported thumbs for image based files.
+   * 
+   * Each entry must be in one of the following formats:
+   * 
+   * ```
+   *   - WxH  (eg. 100x300) - crop to WxH viewbox (from center)
+   *   - WxHt (eg. 100x300t) - crop to WxH viewbox (from top)
+   *   - WxHb (eg. 100x300b) - crop to WxH viewbox (from bottom)
+   *   - WxHf (eg. 100x300f) - fit inside a WxH viewbox (without cropping)
+   *   - 0xH  (eg. 0x300)    - resize to H height preserving the aspect ratio
+   *   - Wx0  (eg. 100x0)    - resize to W width preserving the aspect ratio
+   * ```
+   */
+  thumbs: Array<string>
+  /**
+   * Protected will require the users to provide a special file token to access the file.
+   * 
+   * Note that by default all files are publicly accessible.
+   * 
+   * For the majority of the cases this is fine because by default
+   * all file names have random part appended to their name which
+   * need to be known by the user before accessing the file.
+   */
+  protected: boolean
+  /**
+   * Required will require the field value to have at least one file.
+   */
+  required: boolean
+ }
+ interface FileField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface FileField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface FileField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface FileField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface FileField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface FileField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface FileField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface FileField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface FileField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface FileField {
+  /**
+   * IsMultiple implements MultiValuer interface and checks whether the
+   * current field options support multiple values.
+   */
+  isMultiple(): boolean
+ }
+ interface FileField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface FileField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface FileField {
+  /**
+   * DriverValue implements the [DriverValuer] interface.
+   */
+  driverValue(record: Record): any
+ }
+ interface FileField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface FileField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface FileField {
+  /**
+   * CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+   */
+  calculateMaxBodySize(): number
+ }
+ interface FileField {
+  /**
+   * Intercept implements the [RecordInterceptor] interface.
+   * 
+   * note: files delete after records deletion is handled globally by the app FileManager hook
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ interface FileField {
+  /**
+   * FindGetter implements the [GetterFinder] interface.
+   */
+  findGetter(key: string): GetterFunc
+ }
+ interface FileField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * GeoPointField defines "geoPoint" type field for storing latitude and longitude GPS coordinates.
+  * 
+  * You can set the record field value as [types.GeoPoint], map or serialized json object with lat-lon props.
+  * The stored value is always converted to [types.GeoPoint].
+  * Nil, empty map, empty bytes slice, etc. results in zero [types.GeoPoint].
+  * 
+  * Examples of updating a record's GeoPointField value programmatically:
+  * 
+  * ```
+  * 	record.Set("location", types.GeoPoint{Lat: 123, Lon: 456})
+  * 	record.Set("location", map[string]any{"lat":123, "lon":456})
+  * 	record.Set("location", []byte(`{"lat":123, "lon":456}`)
+  * ```
+  */
+ interface GeoPointField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Required will require the field coordinates to be non-zero (aka. not "Null Island").
+   */
+  required: boolean
+ }
+ interface GeoPointField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface GeoPointField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface GeoPointField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface GeoPointField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface GeoPointField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface GeoPointField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface GeoPointField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface GeoPointField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface GeoPointField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface GeoPointField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface GeoPointField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface GeoPointField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface GeoPointField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * JSONField defines "json" type field for storing any serialized JSON value.
+  * 
+  * The respective zero record field value is the zero [types.JSONRaw].
+  */
+ interface JSONField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * MaxSize specifies the maximum size of the allowed field value (in bytes and up to 2^53-1).
+   * 
+   * If zero, a default limit of 1MB is applied.
+   */
+  maxSize: number
+  /**
+   * Required will require the field value to be non-empty JSON value
+   * (aka. not "null", `""`, "[]", "{}").
+   */
+  required: boolean
+ }
+ interface JSONField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface JSONField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface JSONField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface JSONField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface JSONField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface JSONField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface JSONField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface JSONField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface JSONField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface JSONField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface JSONField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface JSONField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface JSONField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface JSONField {
+  /**
+   * CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+   */
+  calculateMaxBodySize(): number
+ }
+ /**
+  * NumberField defines "number" type field for storing numeric (float64) value.
+  * 
+  * The respective zero record field value is 0.
+  * 
+  * The following additional setter keys are available:
+  * 
+  * ```
+  *   - "fieldName+" - appends to the existing record value. For example:
+  *     record.Set("total+", 5)
+  *   - "fieldName-" - subtracts from the existing record value. For example:
+  *     record.Set("total-", 5)
+  * ```
+  */
+ interface NumberField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Min specifies the min allowed field value.
+   * 
+   * Leave it nil to skip the validator.
+   */
+  min?: number
+  /**
+   * Max specifies the max allowed field value.
+   * 
+   * Leave it nil to skip the validator.
+   */
+  max?: number
+  /**
+   * OnlyInt will require the field value to be integer.
+   */
+  onlyInt: boolean
+  /**
+   * Required will require the field value to be non-zero.
+   */
+  required: boolean
+ }
+ interface NumberField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface NumberField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface NumberField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface NumberField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface NumberField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface NumberField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface NumberField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface NumberField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface NumberField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface NumberField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface NumberField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface NumberField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface NumberField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface NumberField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * PasswordField defines "password" type field for storing bcrypt hashed strings
+  * (usually used only internally for the "password" auth collection system field).
+  * 
+  * If you want to set a direct bcrypt hash as record field value you can use the SetRaw method, for example:
+  * 
+  * ```
+  * 	// generates a bcrypt hash of "123456" and set it as field value
+  * 	// (record.GetString("password") returns the plain password until persisted, otherwise empty string)
+  * 	record.Set("password", "123456")
+  * 
+  * 	// set directly a bcrypt hash of "123456" as field value
+  * 	// (record.GetString("password") returns empty string)
+  * 	record.SetRaw("password", "$2a$10$.5Elh8fgxypNUWhpUUr/xOa2sZm0VIaE0qWuGGl9otUfobb46T1Pq")
+  * ```
+  * 
+  * The following additional getter keys are available:
+  * 
+  * ```
+  *   - "fieldName:hash" - returns the bcrypt hash string of the record field value (if any). For example:
+  *     record.GetString("password:hash")
+  * ```
+  */
+ interface PasswordField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Pattern specifies an optional regex pattern to match against the field value.
+   * 
+   * Leave it empty to skip the pattern check.
+   */
+  pattern: string
+  /**
+   * Min specifies an optional required field string length.
+   */
+  min: number
+  /**
+   * Max specifies an optional required field string length.
+   * 
+   * If zero, fallback to max 71 bytes.
+   */
+  max: number
+  /**
+   * Cost specifies the cost/weight/iteration/etc. bcrypt factor.
+   * 
+   * If zero, fallback to [bcrypt.DefaultCost].
+   * 
+   * If explicitly set, must be between [bcrypt.MinCost] and [bcrypt.MaxCost].
+   */
+  cost: number
+  /**
+   * Required will require the field value to be non-empty string.
+   */
+  required: boolean
+ }
+ interface PasswordField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface PasswordField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface PasswordField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface PasswordField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface PasswordField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface PasswordField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface PasswordField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface PasswordField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface PasswordField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface PasswordField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface PasswordField {
+  /**
+   * DriverValue implements the [DriverValuer] interface.
+   */
+  driverValue(record: Record): any
+ }
+ interface PasswordField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface PasswordField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface PasswordField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface PasswordField {
+  /**
+   * Intercept implements the [RecordInterceptor] interface.
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ interface PasswordField {
+  /**
+   * FindGetter implements the [GetterFinder] interface.
+   */
+  findGetter(key: string): GetterFunc
+ }
+ interface PasswordField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ interface PasswordFieldValue {
+  lastError: Error
+  hash: string
+  plain: string
+ }
+ interface PasswordFieldValue {
+  validate(pass: string): boolean
+ }
+ /**
+  * RelationField defines "relation" type field for storing single or
+  * multiple collection record references.
+  * 
+  * Requires the CollectionId option to be set.
+  * 
+  * If MaxSelect is not set or <= 1, then the field value is expected to be a single record id.
+  * 
+  * If MaxSelect is > 1, then the field value is expected to be a slice of record ids.
+  * 
+  * The respective zero record field value is either empty string (single) or empty string slice (multiple).
+  * 
+  * ---
+  * 
+  * The following additional setter keys are available:
+  * 
+  * ```
+  *   - "fieldName+" - append one or more values to the existing record one. For example:
+  * 
+  *     record.Set("categories+", []string{"new1", "new2"}) // []string{"old1", "old2", "new1", "new2"}
+  * 
+  *   - "+fieldName" - prepend one or more values to the existing record one. For example:
+  * 
+  *     record.Set("+categories", []string{"new1", "new2"}) // []string{"new1", "new2", "old1", "old2"}
+  * 
+  *   - "fieldName-" - subtract one or more values from the existing record one. For example:
+  * 
+  *     record.Set("categories-", "old1") // []string{"old2"}
+  * ```
+  */
+ interface RelationField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * CollectionId is the id of the related collection.
+   */
+  collectionId: string
+  /**
+   * CascadeDelete indicates whether the root model should be deleted
+   * in case of delete of all linked relations.
+   */
+  cascadeDelete: boolean
+  /**
+   * MinSelect indicates the min number of allowed relation records
+   * that could be linked to the main model.
+   * 
+   * No min limit is applied if it is zero or negative value.
+   */
+  minSelect: number
+  /**
+   * MaxSelect indicates the max number of allowed relation records
+   * that could be linked to the main model.
+   * 
+   * For multiple select the value must be > 1, otherwise fallbacks to single (default).
+   * 
+   * If MinSelect is set, MaxSelect must be at least >= MinSelect.
+   */
+  maxSelect: number
+  /**
+   * Required will require the field value to be non-empty.
+   */
+  required: boolean
+ }
+ interface RelationField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface RelationField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface RelationField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface RelationField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface RelationField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface RelationField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface RelationField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface RelationField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface RelationField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface RelationField {
+  /**
+   * IsMultiple implements [MultiValuer] interface and checks whether the
+   * current field options support multiple values.
+   */
+  isMultiple(): boolean
+ }
+ interface RelationField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface RelationField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface RelationField {
+  /**
+   * DriverValue implements the [DriverValuer] interface.
+   */
+  driverValue(record: Record): any
+ }
+ interface RelationField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface RelationField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface RelationField {
+  /**
+   * FindSetter implements [SetterFinder] interface method.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * SelectField defines "select" type field for storing single or
+  * multiple string values from a predefined list.
+  * 
+  * Requires the Values option to be set.
+  * 
+  * If MaxSelect is not set or <= 1, then the field value is expected to be a single Values element.
+  * 
+  * If MaxSelect is > 1, then the field value is expected to be a subset of Values slice.
+  * 
+  * The respective zero record field value is either empty string (single) or empty string slice (multiple).
+  * 
+  * ---
+  * 
+  * The following additional setter keys are available:
+  * 
+  * ```
+  *   - "fieldName+" - append one or more values to the existing record one. For example:
+  * 
+  *     record.Set("roles+", []string{"new1", "new2"}) // []string{"old1", "old2", "new1", "new2"}
+  * 
+  *   - "+fieldName" - prepend one or more values to the existing record one. For example:
+  * 
+  *     record.Set("+roles", []string{"new1", "new2"}) // []string{"new1", "new2", "old1", "old2"}
+  * 
+  *   - "fieldName-" - subtract one or more values from the existing record one. For example:
+  * 
+  *     record.Set("roles-", "old1") // []string{"old2"}
+  * ```
+  */
+ interface SelectField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Values specifies the list of accepted values.
+   */
+  values: Array<string>
+  /**
+   * MaxSelect specifies the max allowed selected values.
+   * 
+   * For multiple select the value must be > 1, otherwise fallbacks to single (default).
+   */
+  maxSelect: number
+  /**
+   * Required will require the field value to be non-empty.
+   */
+  required: boolean
+ }
+ interface SelectField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface SelectField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface SelectField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface SelectField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface SelectField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface SelectField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface SelectField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface SelectField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface SelectField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface SelectField {
+  /**
+   * IsMultiple implements [MultiValuer] interface and checks whether the
+   * current field options support multiple values.
+   */
+  isMultiple(): boolean
+ }
+ interface SelectField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface SelectField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface SelectField {
+  /**
+   * DriverValue implements the [DriverValuer] interface.
+   */
+  driverValue(record: Record): any
+ }
+ interface SelectField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface SelectField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface SelectField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * TextField defines "text" type field for storing any string value.
+  * 
+  * The respective zero record field value is empty string.
+  * 
+  * The following additional setter keys are available:
+  * 
+  * - "fieldName:autogenerate" - autogenerate field value if AutogeneratePattern is set. For example:
+  * 
+  * ```
+  * 	record.Set("slug:autogenerate", "") // [random value]
+  * 	record.Set("slug:autogenerate", "abc-") // abc-[random value]
+  * ```
+  */
+ interface TextField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Min specifies the minimum required string characters.
+   * 
+   * if zero value, no min limit is applied.
+   */
+  min: number
+  /**
+   * Max specifies the maximum allowed string characters.
+   * 
+   * If zero, a default limit of 5000 is applied.
+   */
+  max: number
+  /**
+   * Pattern specifies an optional regex pattern to match against the field value.
+   * 
+   * Leave it empty to skip the pattern check.
+   */
+  pattern: string
+  /**
+   * AutogeneratePattern specifies an optional regex pattern that could
+   * be used to generate random string from it and set it automatically
+   * on record create if no explicit value is set or when the `:autogenerate` modifier is used.
+   * 
+   * Note: the generated value still needs to satisfy min, max, pattern (if set)
+   */
+  autogeneratePattern: string
+  /**
+   * Required will require the field value to be non-empty string.
+   */
+  required: boolean
+  /**
+   * PrimaryKey will mark the field as primary key.
+   * 
+   * A single collection can have only 1 field marked as primary key.
+   */
+  primaryKey: boolean
+ }
+ interface TextField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface TextField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface TextField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface TextField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface TextField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface TextField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface TextField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface TextField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface TextField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface TextField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface TextField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface TextField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface TextField {
+  /**
+   * ValidatePlainValue validates the provided string against the field options.
+   */
+  validatePlainValue(value: string): void
+ }
+ interface TextField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface TextField {
+  /**
+   * Intercept implements the [RecordInterceptor] interface.
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ interface TextField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * URLField defines "url" type field for storing a single URL string value.
+  * 
+  * The respective zero record field value is empty string.
+  */
+ interface URLField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * ExceptDomains will require the URL domain to NOT be included in the listed ones.
+   * 
+   * This validator can be set only if OnlyDomains is empty.
+   */
+  exceptDomains: Array<string>
+  /**
+   * OnlyDomains will require the URL domain to be included in the listed ones.
+   * 
+   * This validator can be set only if ExceptDomains is empty.
+   */
+  onlyDomains: Array<string>
+  /**
+   * Required will require the field value to be non-empty URL string.
+   */
+  required: boolean
+ }
+ interface URLField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface URLField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface URLField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface URLField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface URLField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface URLField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface URLField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface URLField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface URLField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface URLField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface URLField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface URLField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface URLField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface newFieldsList {
+  /**
+   * NewFieldsList creates a new FieldsList instance with the provided fields.
+   */
+  (...fields: Field[]): FieldsList
+ }
+ /**
+  * FieldsList defines a Collection slice of fields.
+  */
+ interface FieldsList extends Array<Field>{}
+ interface FieldsList {
+  /**
+   * Clone creates a deep clone of the current list.
+   */
+  clone(): FieldsList
+ }
+ interface FieldsList {
+  /**
+   * FieldNames returns a slice with the name of all list fields.
+   */
+  fieldNames(): Array<string>
+ }
+ interface FieldsList {
+  /**
+   * AsMap returns a map with all registered list field.
+   * The returned map is indexed with each field name.
+   */
+  asMap(): _TygojaDict
+ }
+ interface FieldsList {
+  /**
+   * GetById returns a single field by its id.
+   */
+  getById(fieldId: string): Field
+ }
+ interface FieldsList {
+  /**
+   * GetByName returns a single field by its name.
+   */
+  getByName(fieldName: string): Field
+ }
+ interface FieldsList {
+  /**
+   * RemoveById removes a single field by its id.
+   * 
+   * This method does nothing if field with the specified id doesn't exist.
+   */
+  removeById(fieldId: string): void
+ }
+ interface FieldsList {
+  /**
+   * RemoveByName removes a single field by its name.
+   * 
+   * This method does nothing if field with the specified name doesn't exist.
+   */
+  removeByName(fieldName: string): void
+ }
+ interface FieldsList {
+  /**
+   * Add adds one or more fields to the current list.
+   * 
+   * By default this method will try to REPLACE existing fields with
+   * the new ones by their id or by their name if the new field doesn't have an explicit id.
+   * 
+   * If no matching existing field is found, it will APPEND the field to the end of the list.
+   * 
+   * In all cases, if any of the new fields don't have an explicit id it will auto generate a default one for them
+   * (the id value doesn't really matter and it is mostly used as a stable identifier in case of a field rename).
+   */
+  add(...fields: Field[]): void
+ }
+ interface FieldsList {
+  /**
+   * AddAt is the same as Add but insert/move the fields at the specific position.
+   * 
+   * If pos < 0, then this method acts the same as calling Add.
+   * 
+   * If pos > FieldsList total items, then the specified fields are inserted/moved at the end of the list.
+   */
+  addAt(pos: number, ...fields: Field[]): void
+ }
+ interface FieldsList {
+  /**
+   * AddMarshaledJSON parses the provided raw json data and adds the
+   * found fields into the current list (following the same rule as the Add method).
+   * 
+   * The rawJSON argument could be one of:
+   * ```
+   *   - serialized array of field objects
+   *   - single field object.
+   * ```
+   * 
+   * Example:
+   * 
+   * ```
+   * 	l.AddMarshaledJSON([]byte{`{"type":"text", name: "test"}`})
+   * 	l.AddMarshaledJSON([]byte{`[{"type":"text", name: "test1"}, {"type":"text", name: "test2"}]`})
+   * ```
+   */
+  addMarshaledJSON(rawJSON: string|Array<number>): void
+ }
+ interface FieldsList {
+  /**
+   * AddMarshaledJSONAt is the same as AddMarshaledJSON but insert/move the fields at the specific position.
+   * 
+   * If pos < 0, then this method acts the same as calling AddMarshaledJSON.
+   * 
+   * If pos > FieldsList total items, then the specified fields are inserted/moved at the end of the list.
+   */
+  addMarshaledJSONAt(pos: number, rawJSON: string|Array<number>): void
+ }
+ interface FieldsList {
+  /**
+   * String returns the string representation of the current list.
+   */
+  string(): string
+ }
+ interface onlyFieldType {
+  type: string
+ }
+ type _sHqecYH = Field
+ interface fieldWithType extends _sHqecYH {
+  type: string
+ }
+ interface fieldWithType {
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface FieldsList {
+  /**
+   * UnmarshalJSON implements [json.Unmarshaler] and
+   * loads the provided json data into the current FieldsList.
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface FieldsList {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface FieldsList {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface FieldsList {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current FieldsList instance.
+   */
+  scan(value: any): void
+ }
+ type _sUWXjNf = BaseModel
+ interface Log extends _sUWXjNf {
+  created: types.DateTime
+  data: types.JSONMap<any>
+  message: string
+  level: number
+ }
+ interface Log {
+  tableName(): string
+ }
+ interface BaseApp {
+  /**
+   * LogQuery returns a new Log select query.
+   */
+  logQuery(): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * FindLogById finds a single Log entry by its id.
+   */
+  findLogById(id: string): (Log)
+ }
+ /**
+  * LogsStatsItem defines the total number of logs for a specific time period.
+  */
+ interface LogsStatsItem {
+  date: types.DateTime
+  total: number
+ }
+ interface BaseApp {
+  /**
+   * LogsStats returns hourly grouped logs statistics.
+   */
+  logsStats(expr: dbx.Expression): Array<(LogsStatsItem | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * DeleteOldLogs delete all logs that are created before createdBefore.
+   * 
+   * For better performance the logs delete is executed as plain SQL statement,
+   * aka. no delete model hook events will be fired.
+   */
+  deleteOldLogs(createdBefore: time.Time): void
+ }
+ /**
+  * MFA defines a Record proxy for working with the mfas collection.
+  */
+ type _sobFmjd = Record
+ interface MFA extends _sobFmjd {
+ }
+ interface newMFA {
+  /**
+   * NewMFA instantiates and returns a new blank *MFA model.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	mfa := core.NewMFA(app)
+   * 	mfa.SetRecordRef(user.Id)
+   * 	mfa.SetCollectionRef(user.Collection().Id)
+   * 	mfa.SetMethod(core.MFAMethodPassword)
+   * 	app.Save(mfa)
+   * ```
+   */
+  (app: App): (MFA)
+ }
+ interface MFA {
+  /**
+   * PreValidate implements the [PreValidator] interface and checks
+   * whether the proxy is properly loaded.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ interface MFA {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface MFA {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface MFA {
+  /**
+   * CollectionRef returns the "collectionRef" field value.
+   */
+  collectionRef(): string
+ }
+ interface MFA {
+  /**
+   * SetCollectionRef updates the "collectionRef" record field value.
+   */
+  setCollectionRef(collectionId: string): void
+ }
+ interface MFA {
+  /**
+   * RecordRef returns the "recordRef" record field value.
+   */
+  recordRef(): string
+ }
+ interface MFA {
+  /**
+   * SetRecordRef updates the "recordRef" record field value.
+   */
+  setRecordRef(recordId: string): void
+ }
+ interface MFA {
+  /**
+   * Method returns the "method" record field value.
+   */
+  method(): string
+ }
+ interface MFA {
+  /**
+   * SetMethod updates the "method" record field value.
+   */
+  setMethod(method: string): void
+ }
+ interface MFA {
+  /**
+   * Created returns the "created" record field value.
+   */
+  created(): types.DateTime
+ }
+ interface MFA {
+  /**
+   * Updated returns the "updated" record field value.
+   */
+  updated(): types.DateTime
+ }
+ interface MFA {
+  /**
+   * HasExpired checks if the mfa is expired, aka. whether it has been
+   * more than maxElapsed time since its creation.
+   */
+  hasExpired(maxElapsed: time.Duration): boolean
+ }
+ interface BaseApp {
+  /**
+   * FindAllMFAsByRecord returns all MFA models linked to the provided auth record.
+   */
+  findAllMFAsByRecord(authRecord: Record): Array<(MFA | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllMFAsByCollection returns all MFA models linked to the provided collection.
+   */
+  findAllMFAsByCollection(collection: Collection): Array<(MFA | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindMFAById returns a single MFA model by its id.
+   */
+  findMFAById(id: string): (MFA)
+ }
+ interface BaseApp {
+  /**
+   * DeleteAllMFAsByRecord deletes all MFA models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllMFAsByRecord(authRecord: Record): void
+ }
+ interface BaseApp {
+  /**
+   * DeleteExpiredMFAs deletes the expired MFAs for all auth collections.
+   */
+  deleteExpiredMFAs(): void
+ }
+ interface Migration {
+  up: (txApp: App) => void
+  down: (txApp: App) => void
+  file: string
+  reapplyCondition: (txApp: App, runner: MigrationsRunner, fileName: string) => boolean
+ }
+ /**
+  * MigrationsList defines a list with migration definitions
+  */
+ interface MigrationsList {
+ }
+ interface MigrationsList {
+  /**
+   * Item returns a single migration from the list by its index.
+   */
+  item(index: number): (Migration)
+ }
+ interface MigrationsList {
+  /**
+   * Items returns the internal migrations list slice.
+   */
+  items(): Array<(Migration | undefined)>
+ }
+ interface MigrationsList {
+  /**
+   * Copy copies all provided list migrations into the current one.
+   */
+  copy(list: MigrationsList): void
+ }
+ interface MigrationsList {
+  /**
+   * Add adds adds an existing migration definition to the list.
+   * 
+   * If m.File is not provided, it will try to get the name from its .go file.
+   * 
+   * The list will be sorted automatically based on the migrations file name.
+   */
+  add(m: Migration): void
+ }
+ interface MigrationsList {
+  /**
+   * Register adds new migration definition to the list.
+   * 
+   * If optFilename is not provided, it will try to get the name from its .go file.
+   * 
+   * The list will be sorted automatically based on the migrations file name.
+   */
+  register(up: (txApp: App) => void, down: (txApp: App) => void, ...optFilename: string[]): void
+ }
+ /**
+  * MigrationsRunner defines a simple struct for managing the execution of db migrations.
+  */
+ interface MigrationsRunner {
+ }
+ interface newMigrationsRunner {
+  /**
+   * NewMigrationsRunner creates and initializes a new db migrations MigrationsRunner instance.
+   */
+  (app: App, migrationsList: MigrationsList): (MigrationsRunner)
+ }
+ interface MigrationsRunner {
+  /**
+   * Run interactively executes the current runner with the provided args.
+   * 
+   * The following commands are supported:
+   * - up           - applies all migrations
+   * - down [n]     - reverts the last n (default 1) applied migrations
+   * - history-sync - syncs the migrations table with the runner's migrations list
+   */
+  run(...args: string[]): void
+ }
+ interface MigrationsRunner {
+  /**
+   * Up executes all unapplied migrations for the provided runner.
+   * 
+   * On success returns list with the applied migrations file names.
+   */
+  up(): Array<string>
+ }
+ interface MigrationsRunner {
+  /**
+   * Down reverts the last `toRevertCount` applied migrations
+   * (in the order they were applied).
+   * 
+   * On success returns list with the reverted migrations file names.
+   */
+  down(toRevertCount: number): Array<string>
+ }
+ interface MigrationsRunner {
+  /**
+   * RemoveMissingAppliedMigrations removes the db entries of all applied migrations
+   * that are not listed in the runner's migrations list.
+   */
+  removeMissingAppliedMigrations(): void
+ }
+ /**
+  * OTP defines a Record proxy for working with the otps collection.
+  */
+ type _swyrTJF = Record
+ interface OTP extends _swyrTJF {
+ }
+ interface newOTP {
+  /**
+   * NewOTP instantiates and returns a new blank *OTP model.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	otp := core.NewOTP(app)
+   * 	otp.SetRecordRef(user.Id)
+   * 	otp.SetCollectionRef(user.Collection().Id)
+   * 	otp.SetPassword(security.RandomStringWithAlphabet(6, "1234567890"))
+   * 	app.Save(otp)
+   * ```
+   */
+  (app: App): (OTP)
+ }
+ interface OTP {
+  /**
+   * PreValidate implements the [PreValidator] interface and checks
+   * whether the proxy is properly loaded.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ interface OTP {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface OTP {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface OTP {
+  /**
+   * CollectionRef returns the "collectionRef" field value.
+   */
+  collectionRef(): string
+ }
+ interface OTP {
+  /**
+   * SetCollectionRef updates the "collectionRef" record field value.
+   */
+  setCollectionRef(collectionId: string): void
+ }
+ interface OTP {
+  /**
+   * RecordRef returns the "recordRef" record field value.
+   */
+  recordRef(): string
+ }
+ interface OTP {
+  /**
+   * SetRecordRef updates the "recordRef" record field value.
+   */
+  setRecordRef(recordId: string): void
+ }
+ interface OTP {
+  /**
+   * SentTo returns the "sentTo" record field value.
+   * 
+   * It could be any string value (email, phone, message app id, etc.)
+   * and usually is used as part of the auth flow to update the verified
+   * user state in case for example the sentTo value matches with the user record email.
+   */
+  sentTo(): string
+ }
+ interface OTP {
+  /**
+   * SetSentTo updates the "sentTo" record field value.
+   */
+  setSentTo(val: string): void
+ }
+ interface OTP {
+  /**
+   * Created returns the "created" record field value.
+   */
+  created(): types.DateTime
+ }
+ interface OTP {
+  /**
+   * Updated returns the "updated" record field value.
+   */
+  updated(): types.DateTime
+ }
+ interface OTP {
+  /**
+   * HasExpired checks if the otp is expired, aka. whether it has been
+   * more than maxElapsed time since its creation.
+   */
+  hasExpired(maxElapsed: time.Duration): boolean
+ }
+ interface BaseApp {
+  /**
+   * FindAllOTPsByRecord returns all OTP models linked to the provided auth record.
+   */
+  findAllOTPsByRecord(authRecord: Record): Array<(OTP | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllOTPsByCollection returns all OTP models linked to the provided collection.
+   */
+  findAllOTPsByCollection(collection: Collection): Array<(OTP | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindOTPById returns a single OTP model by its id.
+   */
+  findOTPById(id: string): (OTP)
+ }
+ interface BaseApp {
+  /**
+   * DeleteAllOTPsByRecord deletes all OTP models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllOTPsByRecord(authRecord: Record): void
+ }
+ interface BaseApp {
+  /**
+   * DeleteExpiredOTPs deletes the expired OTPs for all auth collections.
+   */
+  deleteExpiredOTPs(): void
+ }
+ /**
+  * RecordFieldResolver defines a custom search resolver struct for
+  * managing Record model search fields.
+  * 
+  * Usually used together with `search.Provider`.
+  * Example:
+  * 
+  * ```
+  * 	resolver := resolvers.NewRecordFieldResolver(
+  * 	    app,
+  * 	    myCollection,
+  * 	    &models.RequestInfo{...},
+  * 	    true,
+  * 	)
+  * 	provider := search.NewProvider(resolver)
+  * 	...
+  * ```
+  */
+ interface RecordFieldResolver {
+ }
+ interface RecordFieldResolver {
+  /**
+   * AllowedFields returns a copy of the resolver's allowed fields.
+   */
+  allowedFields(): Array<string>
+ }
+ interface RecordFieldResolver {
+  /**
+   * SetAllowedFields replaces the resolver's allowed fields with the new ones.
+   */
+  setAllowedFields(newAllowedFields: Array<string>): void
+ }
+ interface RecordFieldResolver {
+  /**
+   * AllowHiddenFields returns whether the current resolver allows filtering hidden fields.
+   */
+  allowHiddenFields(): boolean
+ }
+ interface RecordFieldResolver {
+  /**
+   * SetAllowHiddenFields enables or disables hidden fields filtering.
+   */
+  setAllowHiddenFields(allowHiddenFields: boolean): void
+ }
+ interface newRecordFieldResolver {
+  /**
+   * NewRecordFieldResolver creates and initializes a new `RecordFieldResolver`.
+   */
+  (app: App, baseCollection: Collection, requestInfo: RequestInfo, allowHiddenFields: boolean): (RecordFieldResolver)
+ }
+ interface RecordFieldResolver {
+  /**
+   * UpdateQuery implements `search.FieldResolver` interface.
+   * 
+   * Conditionally updates the provided search query based on the
+   * resolved fields (eg. dynamically joining relations).
+   */
+  updateQuery(query: dbx.SelectQuery): void
+ }
+ interface RecordFieldResolver {
+  /**
+   * Resolve implements `search.FieldResolver` interface.
+   * 
+   * Example of some resolvable fieldName formats:
+   * 
+   * ```
+   * 	id
+   * 	someSelect.each
+   * 	project.screen.status
+   * 	screen.project_via_prototype.name
+   * 	@request.context
+   * 	@request.method
+   * 	@request.query.filter
+   * 	@request.headers.x_token
+   * 	@request.auth.someRelation.name
+   * 	@request.body.someRelation.name
+   * 	@request.body.someField
+   * 	@request.body.someSelect:each
+   * 	@request.body.someField:isset
+   * 	@collection.product.name
+   * ```
+   */
+  resolve(fieldName: string): (search.ResolverResult)
+ }
+ interface mapExtractor {
+  [key:string]: any;
+  asMap(): _TygojaDict
+ }
+ /**
+  * join defines the specification for a single SQL JOIN clause.
+  */
+ interface join {
+ }
+ /**
+  * multiMatchSubquery defines a record multi-match subquery expression.
+  */
+ interface multiMatchSubquery {
+ }
+ interface multiMatchSubquery {
+  /**
+   * Build converts the expression into a SQL fragment.
+   * 
+   * Implements [dbx.Expression] interface.
+   */
+  build(db: dbx.DB, params: dbx.Params): string
+ }
+ interface runner {
+ }
+ type _sksdbkz = BaseModel
+ interface Record extends _sksdbkz {
+ }
+ interface newRecord {
+  /**
+   * NewRecord initializes a new empty Record model.
+   */
+  (collection: Collection): (Record)
+ }
+ interface Record {
+  /**
+   * Collection returns the Collection model associated with the current Record model.
+   * 
+   * NB! The returned collection is only for read purposes and it shouldn't be modified
+   * because it could have unintended side-effects on other Record models from the same collection.
+   */
+  collection(): (Collection)
+ }
+ interface Record {
+  /**
+   * TableName returns the table name associated with the current Record model.
+   */
+  tableName(): string
+ }
+ interface Record {
+  /**
+   * PostScan implements the [dbx.PostScanner] interface.
+   * 
+   * It essentially refreshes/updates the current Record original state
+   * as if the model was fetched from the databases for the first time.
+   * 
+   * Or in other words, it means that m.Original().FieldsData() will have
+   * the same values as m.Record().FieldsData().
+   */
+  postScan(): void
+ }
+ interface Record {
+  /**
+   * HookTags returns the hook tags associated with the current record.
+   */
+  hookTags(): Array<string>
+ }
+ interface Record {
+  /**
+   * BaseFilesPath returns the storage dir path used by the record.
+   */
+  baseFilesPath(): string
+ }
+ interface Record {
+  /**
+   * Original returns a shallow copy of the current record model populated
+   * with its ORIGINAL db data state (aka. right after PostScan())
+   * and everything else reset to the defaults.
+   * 
+   * If record was created using NewRecord() the original will be always
+   * a blank record (until PostScan() is invoked).
+   */
+  original(): (Record)
+ }
+ interface Record {
+  /**
+   * Fresh returns a shallow copy of the current record model populated
+   * with its LATEST data state and everything else reset to the defaults
+   * (aka. no expand, no unknown fields and with default visibility flags).
+   */
+  fresh(): (Record)
+ }
+ interface Record {
+  /**
+   * Clone returns a shallow copy of the current record model with all of
+   * its collection and unknown fields data, expand and flags copied.
+   * 
+   * use [Record.Fresh()] instead if you want a copy with only the latest
+   * collection fields data and everything else reset to the defaults.
+   */
+  clone(): (Record)
+ }
+ interface Record {
+  /**
+   * Expand returns a shallow copy of the current Record model expand data (if any).
+   */
+  expand(): _TygojaDict
+ }
+ interface Record {
+  /**
+   * SetExpand replaces the current Record's expand with the provided expand arg data (shallow copied).
+   */
+  setExpand(expand: _TygojaDict): void
+ }
+ interface Record {
+  /**
+   * MergeExpand merges recursively the provided expand data into
+   * the current model's expand (if any).
+   * 
+   * Note that if an expanded prop with the same key is a slice (old or new expand)
+   * then both old and new records will be merged into a new slice (aka. a :merge: [b,c] => [a,b,c]).
+   * Otherwise the "old" expanded record will be replace with the "new" one (aka. a :merge: aNew => aNew).
+   */
+  mergeExpand(expand: _TygojaDict): void
+ }
+ interface Record {
+  /**
+   * FieldsData returns a shallow copy ONLY of the collection's fields record's data.
+   */
+  fieldsData(): _TygojaDict
+ }
+ interface Record {
+  /**
+   * CustomData returns a shallow copy ONLY of the custom record fields data,
+   * aka. fields that are neither defined by the collection, nor special system ones.
+   * 
+   * Note that custom fields prefixed with "@pbInternal" are always skipped.
+   */
+  customData(): _TygojaDict
+ }
+ interface Record {
+  /**
+   * WithCustomData toggles the export/serialization of custom data fields
+   * (false by default).
+   */
+  withCustomData(state: boolean): (Record)
+ }
+ interface Record {
+  /**
+   * IgnoreEmailVisibility toggles the flag to ignore the auth record email visibility check.
+   */
+  ignoreEmailVisibility(state: boolean): (Record)
+ }
+ interface Record {
+  /**
+   * IgnoreUnchangedFields toggles the flag to ignore the unchanged fields
+   * from the DB export for the UPDATE SQL query.
+   * 
+   * This could be used if you want to save only the record fields that you've changed
+   * without overwrite other untouched fields in case of concurrent update.
+   * 
+   * Note that the fields change comparison is based on the current fields against m.Original()
+   * (aka. if you have performed save on the same Record instance multiple times you may have to refetch it,
+   * so that m.Original() could reflect the last saved change).
+   */
+  ignoreUnchangedFields(state: boolean): (Record)
+ }
+ interface Record {
+  /**
+   * Set sets the provided key-value data pair into the current Record
+   * model directly as it is WITHOUT NORMALIZATIONS.
+   * 
+   * See also [Record.Set].
+   */
+  setRaw(key: string, value: any): void
+ }
+ interface Record {
+  /**
+   * SetIfFieldExists sets the provided key-value data pair into the current Record model
+   * ONLY if key is existing Collection field name/modifier.
+   * 
+   * This method does nothing if key is not a known Collection field name/modifier.
+   * 
+   * On success returns the matched Field, otherwise - nil.
+   * 
+   * To set any key-value, including custom/unknown fields, use the [Record.Set] method.
+   */
+  setIfFieldExists(key: string, value: any): Field
+ }
+ interface Record {
+  /**
+   * Set sets the provided key-value data pair into the current Record model.
+   * 
+   * If the record collection has field with name matching the provided "key",
+   * the value will be further normalized according to the field setter(s).
+   */
+  set(key: string, value: any): void
+ }
+ interface Record {
+  getRaw(key: string): any
+ }
+ interface Record {
+  /**
+   * Get returns a normalized single record model data value for "key".
+   */
+  get(key: string): any
+ }
+ interface Record {
+  /**
+   * Load bulk loads the provided data into the current Record model.
+   */
+  load(data: _TygojaDict): void
+ }
+ interface Record {
+  /**
+   * GetBool returns the data value for "key" as a bool.
+   */
+  getBool(key: string): boolean
+ }
+ interface Record {
+  /**
+   * GetString returns the data value for "key" as a string.
+   */
+  getString(key: string): string
+ }
+ interface Record {
+  /**
+   * GetInt returns the data value for "key" as an int.
+   */
+  getInt(key: string): number
+ }
+ interface Record {
+  /**
+   * GetFloat returns the data value for "key" as a float64.
+   */
+  getFloat(key: string): number
+ }
+ interface Record {
+  /**
+   * GetDateTime returns the data value for "key" as a DateTime instance.
+   */
+  getDateTime(key: string): types.DateTime
+ }
+ interface Record {
+  /**
+   * GetGeoPoint returns the data value for "key" as a GeoPoint instance.
+   */
+  getGeoPoint(key: string): types.GeoPoint
+ }
+ interface Record {
+  /**
+   * GetStringSlice returns the data value for "key" as a slice of non-zero unique strings.
+   */
+  getStringSlice(key: string): Array<string>
+ }
+ interface Record {
+  /**
+   * GetUnsavedFiles returns the uploaded files for the provided "file" field key,
+   * (aka. the current [*filesytem.File] values) so that you can apply further
+   * validations or modifications (including changing the file name or content before persisting).
+   * 
+   * Example:
+   * 
+   * ```
+   * 	files := record.GetUnsavedFiles("documents")
+   * 	for _, f := range files {
+   * 	    f.Name = "doc_" + f.Name // add a prefix to each file name
+   * 	}
+   * 	app.Save(record) // the files are pointers so the applied changes will transparently reflect on the record value
+   * ```
+   */
+  getUnsavedFiles(key: string): Array<(filesystem.File | undefined)>
+ }
+ interface Record {
+  /**
+   * Deprecated: replaced with GetUnsavedFiles.
+   */
+  getUploadedFiles(key: string): Array<(filesystem.File | undefined)>
+ }
+ interface Record {
+  /**
+   * Retrieves the "key" json field value and unmarshals it into "result".
+   * 
+   * Example
+   * 
+   * ```
+   * 	result := struct {
+   * 	    FirstName string `json:"first_name"`
+   * 	}{}
+   * 	err := m.UnmarshalJSONField("my_field_name", &result)
+   * ```
+   */
+  unmarshalJSONField(key: string, result: any): void
+ }
+ interface Record {
+  /**
+   * ExpandedOne retrieves a single relation Record from the already
+   * loaded expand data of the current model.
+   * 
+   * If the requested expand relation is multiple, this method returns
+   * only first available Record from the expanded relation.
+   * 
+   * Returns nil if there is no such expand relation loaded.
+   */
+  expandedOne(relField: string): (Record)
+ }
+ interface Record {
+  /**
+   * ExpandedAll retrieves a slice of relation Records from the already
+   * loaded expand data of the current model.
+   * 
+   * If the requested expand relation is single, this method normalizes
+   * the return result and will wrap the single model as a slice.
+   * 
+   * Returns nil slice if there is no such expand relation loaded.
+   */
+  expandedAll(relField: string): Array<(Record | undefined)>
+ }
+ interface Record {
+  /**
+   * FindFileFieldByFile returns the first file type field for which
+   * any of the record's data contains the provided filename.
+   */
+  findFileFieldByFile(filename: string): (FileField)
+ }
+ interface Record {
+  /**
+   * DBExport implements the [DBExporter] interface and returns a key-value
+   * map with the data to be persisted when saving the Record in the database.
+   */
+  dbExport(app: App): _TygojaDict
+ }
+ interface Record {
+  /**
+   * Hide hides the specified fields from the public safe serialization of the record.
+   */
+  hide(...fieldNames: string[]): (Record)
+ }
+ interface Record {
+  /**
+   * Unhide forces to unhide the specified fields from the public safe serialization
+   * of the record (even when the collection field itself is marked as hidden).
+   */
+  unhide(...fieldNames: string[]): (Record)
+ }
+ interface Record {
+  /**
+   * PublicExport exports only the record fields that are safe to be public.
+   * 
+   * To export unknown data fields you need to set record.WithCustomData(true).
+   * 
+   * For auth records, to force the export of the email field you need to set
+   * record.IgnoreEmailVisibility(true).
+   */
+  publicExport(): _TygojaDict
+ }
+ interface Record {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * 
+   * Only the data exported by `PublicExport()` will be serialized.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface Record {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface Record {
+  /**
+   * ReplaceModifiers returns a new map with applied modifier
+   * values based on the current record and the specified data.
+   * 
+   * The resolved modifier keys will be removed.
+   * 
+   * Multiple modifiers will be applied one after another,
+   * while reusing the previous base key value result (ex. 1; -5; +2 => -2).
+   * 
+   * Note that because Go doesn't guaranteed the iteration order of maps,
+   * we would explicitly apply shorter keys first for a more consistent and reproducible behavior.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	 newData := record.ReplaceModifiers(data)
+   * 		// record: {"field": 10}
+   * 		// data:   {"field+": 5}
+   * 		// result: {"field": 15}
+   * ```
+   */
+  replaceModifiers(data: _TygojaDict): _TygojaDict
+ }
+ interface Record {
+  /**
+   * Email returns the "email" record field value (usually available with Auth collections).
+   */
+  email(): string
+ }
+ interface Record {
+  /**
+   * SetEmail sets the "email" record field value (usually available with Auth collections).
+   */
+  setEmail(email: string): void
+ }
+ interface Record {
+  /**
+   * Verified returns the "emailVisibility" record field value (usually available with Auth collections).
+   */
+  emailVisibility(): boolean
+ }
+ interface Record {
+  /**
+   * SetEmailVisibility sets the "emailVisibility" record field value (usually available with Auth collections).
+   */
+  setEmailVisibility(visible: boolean): void
+ }
+ interface Record {
+  /**
+   * Verified returns the "verified" record field value (usually available with Auth collections).
+   */
+  verified(): boolean
+ }
+ interface Record {
+  /**
+   * SetVerified sets the "verified" record field value (usually available with Auth collections).
+   */
+  setVerified(verified: boolean): void
+ }
+ interface Record {
+  /**
+   * TokenKey returns the "tokenKey" record field value (usually available with Auth collections).
+   */
+  tokenKey(): string
+ }
+ interface Record {
+  /**
+   * SetTokenKey sets the "tokenKey" record field value (usually available with Auth collections).
+   */
+  setTokenKey(key: string): void
+ }
+ interface Record {
+  /**
+   * RefreshTokenKey generates and sets a new random auth record "tokenKey".
+   */
+  refreshTokenKey(): void
+ }
+ interface Record {
+  /**
+   * SetPassword sets the "password" record field value (usually available with Auth collections).
+   */
+  setPassword(password: string): void
+ }
+ interface Record {
+  /**
+   * SetRandomPassword sets the "password" auth record field to a random autogenerated value.
+   * 
+   * The autogenerated password is ~30 characters and it is set directly as hash,
+   * aka. the field plain password value validators (length, pattern, etc.) are ignored
+   * (this is usually used as part of the auto created OTP or OAuth2 user flows).
+   */
+  setRandomPassword(): string
+ }
+ interface Record {
+  /**
+   * ValidatePassword validates a plain password against the "password" record field.
+   * 
+   * Returns false if the password is incorrect.
+   */
+  validatePassword(password: string): boolean
+ }
+ interface Record {
+  /**
+   * IsSuperuser returns whether the current record is a superuser, aka.
+   * whether the record is from the _superusers collection.
+   */
+  isSuperuser(): boolean
+ }
+ /**
+  * RecordProxy defines an interface for a Record proxy/project model,
+  * aka. custom model struct that acts on behalve the proxied Record to
+  * allow for example typed getter/setters for the Record fields.
+  * 
+  * To implement the interface it is usually enough to embed the [BaseRecordProxy] struct.
+  */
+ interface RecordProxy {
+  [key:string]: any;
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ /**
+  * BaseRecordProxy implements the [RecordProxy] interface and it is intended
+  * to be used as embed to custom user provided Record proxy structs.
+  */
+ type _sPOlOfX = Record
+ interface BaseRecordProxy extends _sPOlOfX {
+ }
+ interface BaseRecordProxy {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface BaseRecordProxy {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface BaseApp {
+  /**
+   * RecordQuery returns a new Record select query from a collection model, id or name.
+   * 
+   * In case a collection id or name is provided and that collection doesn't
+   * actually exists, the generated query will be created with a cancelled context
+   * and will fail once an executor (Row(), One(), All(), etc.) is called.
+   */
+  recordQuery(collectionModelOrIdentifier: any): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * FindRecordById finds the Record model by its id.
+   */
+  findRecordById(collectionModelOrIdentifier: any, recordId: string, ...optFilters: ((q: dbx.SelectQuery) => void)[]): (Record)
+ }
+ interface BaseApp {
+  /**
+   * FindRecordsByIds finds all records by the specified ids.
+   * If no records are found, returns an empty slice.
+   */
+  findRecordsByIds(collectionModelOrIdentifier: any, recordIds: Array<string>, ...optFilters: ((q: dbx.SelectQuery) => void)[]): Array<(Record | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllRecords finds all records matching specified db expressions.
+   * 
+   * Returns all collection records if no expression is provided.
+   * 
+   * Returns an empty slice if no records are found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	// no extra expressions
+   * 	app.FindAllRecords("example")
+   * 
+   * 	// with extra expressions
+   * 	expr1 := dbx.HashExp{"email": "test@example.com"}
+   * 	expr2 := dbx.NewExp("LOWER(username) = {:username}", dbx.Params{"username": "test"})
+   * 	app.FindAllRecords("example", expr1, expr2)
+   * ```
+   */
+  findAllRecords(collectionModelOrIdentifier: any, ...exprs: dbx.Expression[]): Array<(Record | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindFirstRecordByData returns the first found record matching
+   * the provided key-value pair.
+   */
+  findFirstRecordByData(collectionModelOrIdentifier: any, key: string, value: any): (Record)
+ }
+ interface BaseApp {
+  /**
+   * FindRecordsByFilter returns limit number of records matching the
+   * provided string filter.
+   * 
+   * NB! Use the last "params" argument to bind untrusted user variables!
+   * 
+   * The filter argument is optional and can be empty string to target
+   * all available records.
+   * 
+   * The sort argument is optional and can be empty string OR the same format
+   * used in the web APIs, ex. "-created,title".
+   * 
+   * If the limit argument is <= 0, no limit is applied to the query and
+   * all matching records are returned.
+   * 
+   * Returns an empty slice if no records are found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindRecordsByFilter(
+   * 		"posts",
+   * 		"title ~ {:title} && visible = {:visible}",
+   * 		"-created",
+   * 		10,
+   * 		0,
+   * 		dbx.Params{"title": "lorem ipsum", "visible": true}
+   * 	)
+   * ```
+   */
+  findRecordsByFilter(collectionModelOrIdentifier: any, filter: string, sort: string, limit: number, offset: number, ...params: dbx.Params[]): Array<(Record | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindFirstRecordByFilter returns the first available record matching the provided filter (if any).
+   * 
+   * NB! Use the last params argument to bind untrusted user variables!
+   * 
+   * Returns sql.ErrNoRows if no record is found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindFirstRecordByFilter("posts", "")
+   * 	app.FindFirstRecordByFilter("posts", "slug={:slug} && status='public'", dbx.Params{"slug": "test"})
+   * ```
+   */
+  findFirstRecordByFilter(collectionModelOrIdentifier: any, filter: string, ...params: dbx.Params[]): (Record)
+ }
+ interface BaseApp {
+  /**
+   * CountRecords returns the total number of records in a collection.
+   */
+  countRecords(collectionModelOrIdentifier: any, ...exprs: dbx.Expression[]): number
+ }
+ interface BaseApp {
+  /**
+   * FindAuthRecordByToken finds the auth record associated with the provided JWT
+   * (auth, file, verifyEmail, changeEmail, passwordReset types).
+   * 
+   * Optionally specify a list of validTypes to check tokens only from those types.
+   * 
+   * Returns an error if the JWT is invalid, expired or not associated to an auth collection record.
+   */
+  findAuthRecordByToken(token: string, ...validTypes: string[]): (Record)
+ }
+ interface BaseApp {
+  /**
+   * FindAuthRecordByEmail finds the auth record associated with the provided email.
+   * 
+   * The email check would be case-insensitive if the related collection
+   * email unique index has COLLATE NOCASE specified for the email column.
+   * 
+   * Returns an error if it is not an auth collection or the record is not found.
+   */
+  findAuthRecordByEmail(collectionModelOrIdentifier: any, email: string): (Record)
+ }
+ interface BaseApp {
+  /**
+   * CanAccessRecord checks if a record is allowed to be accessed by the
+   * specified requestInfo and accessRule.
+   * 
+   * Rule and db checks are ignored in case requestInfo.Auth is a superuser.
+   * 
+   * The returned error indicate that something unexpected happened during
+   * the check (eg. invalid rule or db query error).
+   * 
+   * The method always return false on invalid rule or db query error.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	requestInfo, _ := e.RequestInfo()
+   * 	record, _ := app.FindRecordById("example", "RECORD_ID")
+   * 	rule := types.Pointer("@request.auth.id != '' || status = 'public'")
+   * 	// ... or use one of the record collection's rule, eg. record.Collection().ViewRule
+   * 
+   * 	if ok, _ := app.CanAccessRecord(record, requestInfo, rule); ok { ... }
+   * ```
+   */
+  canAccessRecord(record: Record, requestInfo: RequestInfo, accessRule: string): boolean
+ }
+ /**
+  * ExpandFetchFunc defines the function that is used to fetch the expanded relation records.
+  */
+ interface ExpandFetchFunc {(relCollection: Collection, relIds: Array<string>): Array<(Record | undefined)> }
+ interface BaseApp {
+  /**
+   * ExpandRecord expands the relations of a single Record model.
+   * 
+   * If optFetchFunc is not set, then a default function will be used
+   * that returns all relation records.
+   * 
+   * Returns a map with the failed expand parameters and their errors.
+   */
+  expandRecord(record: Record, expands: Array<string>, optFetchFunc: ExpandFetchFunc): _TygojaDict
+ }
+ interface BaseApp {
+  /**
+   * ExpandRecords expands the relations of the provided Record models list.
+   * 
+   * If optFetchFunc is not set, then a default function will be used
+   * that returns all relation records.
+   * 
+   * Returns a map with the failed expand parameters and their errors.
+   */
+  expandRecords(records: Array<(Record | undefined)>, expands: Array<string>, optFetchFunc: ExpandFetchFunc): _TygojaDict
+ }
+ interface Record {
+  /**
+   * NewStaticAuthToken generates and returns a new static record authentication token.
+   * 
+   * Static auth tokens are similar to the regular auth tokens, but are
+   * non-refreshable and support custom duration.
+   * 
+   * Zero or negative duration will fallback to the duration from the auth collection settings.
+   */
+  newStaticAuthToken(duration: time.Duration): string
+ }
+ interface Record {
+  /**
+   * NewAuthToken generates and returns a new record authentication token.
+   */
+  newAuthToken(): string
+ }
+ interface Record {
+  /**
+   * NewVerificationToken generates and returns a new record verification token.
+   */
+  newVerificationToken(): string
+ }
+ interface Record {
+  /**
+   * NewPasswordResetToken generates and returns a new auth record password reset request token.
+   */
+  newPasswordResetToken(): string
+ }
+ interface Record {
+  /**
+   * NewEmailChangeToken generates and returns a new auth record change email request token.
+   */
+  newEmailChangeToken(newEmail: string): string
+ }
+ interface Record {
+  /**
+   * NewFileToken generates and returns a new record private file access token.
+   */
+  newFileToken(): string
+ }
+ interface settings {
+  smtp: SMTPConfig
+  backups: BackupsConfig
+  s3: S3Config
+  meta: MetaConfig
+  rateLimits: RateLimitsConfig
+  trustedProxy: TrustedProxyConfig
+  batch: BatchConfig
+  logs: LogsConfig
+ }
+ /**
+  * Settings defines the PocketBase app settings.
+  */
+ type _sXtvxjh = settings
+ interface Settings extends _sXtvxjh {
+ }
+ interface Settings {
+  /**
+   * TableName implements [Model.TableName] interface method.
+   */
+  tableName(): string
+ }
+ interface Settings {
+  /**
+   * PK implements [Model.LastSavedPK] interface method.
+   */
+  lastSavedPK(): any
+ }
+ interface Settings {
+  /**
+   * PK implements [Model.PK] interface method.
+   */
+  pk(): any
+ }
+ interface Settings {
+  /**
+   * IsNew implements [Model.IsNew] interface method.
+   */
+  isNew(): boolean
+ }
+ interface Settings {
+  /**
+   * MarkAsNew implements [Model.MarkAsNew] interface method.
+   */
+  markAsNew(): void
+ }
+ interface Settings {
+  /**
+   * MarkAsNew implements [Model.MarkAsNotNew] interface method.
+   */
+  markAsNotNew(): void
+ }
+ interface Settings {
+  /**
+   * PostScan implements [Model.PostScan] interface method.
+   */
+  postScan(): void
+ }
+ interface Settings {
+  /**
+   * String returns a serialized string representation of the current settings.
+   */
+  string(): string
+ }
+ interface Settings {
+  /**
+   * DBExport prepares and exports the current settings for db persistence.
+   */
+  dbExport(app: App): _TygojaDict
+ }
+ interface Settings {
+  /**
+   * PostValidate implements the [PostValidator] interface and defines
+   * the Settings model validations.
+   */
+  postValidate(ctx: context.Context, app: App): void
+ }
+ interface Settings {
+  /**
+   * Merge merges the "other" settings into the current one.
+   */
+  merge(other: Settings): void
+ }
+ interface Settings {
+  /**
+   * Clone creates a new deep copy of the current settings.
+   */
+  clone(): (Settings)
+ }
+ interface Settings {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * 
+   * Note that sensitive fields (S3 secret, SMTP password, etc.) are excluded.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface SMTPConfig {
+  enabled: boolean
+  port: number
+  host: string
+  username: string
+  password: string
+  /**
+   * SMTP AUTH - PLAIN (default) or LOGIN
+   */
+  authMethod: string
+  /**
+   * Whether to enforce TLS encryption for the mail server connection.
+   * 
+   * When set to false StartTLS command is send, leaving the server
+   * to decide whether to upgrade the connection or not.
+   */
+  tls: boolean
+  /**
+   * LocalName is optional domain name or IP address used for the
+   * EHLO/HELO exchange (if not explicitly set, defaults to "localhost").
+   * 
+   * This is required only by some SMTP servers, such as Gmail SMTP-relay.
+   */
+  localName: string
+ }
+ interface SMTPConfig {
+  /**
+   * Validate makes SMTPConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface S3Config {
+  enabled: boolean
+  bucket: string
+  region: string
+  endpoint: string
+  accessKey: string
+  secret: string
+  forcePathStyle: boolean
+ }
+ interface S3Config {
+  /**
+   * Validate makes S3Config validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface BatchConfig {
+  enabled: boolean
+  /**
+   * MaxRequests is the maximum allowed batch request to execute.
+   */
+  maxRequests: number
+  /**
+   * Timeout is the the max duration in seconds to wait before cancelling the batch transaction.
+   */
+  timeout: number
+  /**
+   * MaxBodySize is the maximum allowed batch request body size in bytes.
+   * 
+   * If not set, fallbacks to max ~128MB.
+   */
+  maxBodySize: number
+ }
+ interface BatchConfig {
+  /**
+   * Validate makes BatchConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface BackupsConfig {
+  /**
+   * Cron is a cron expression to schedule auto backups, eg. "* * * * *".
+   * 
+   * Leave it empty to disable the auto backups functionality.
+   */
+  cron: string
+  /**
+   * CronMaxKeep is the the max number of cron generated backups to
+   * keep before removing older entries.
+   * 
+   * This field works only when the cron config has valid cron expression.
+   */
+  cronMaxKeep: number
+  /**
+   * S3 is an optional S3 storage config specifying where to store the app backups.
+   */
+  s3: S3Config
+ }
+ interface BackupsConfig {
+  /**
+   * Validate makes BackupsConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface MetaConfig {
+  appName: string
+  appURL: string
+  senderName: string
+  senderAddress: string
+  hideControls: boolean
+ }
+ interface MetaConfig {
+  /**
+   * Validate makes MetaConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface LogsConfig {
+  maxDays: number
+  minLevel: number
+  logIP: boolean
+  logAuthId: boolean
+ }
+ interface LogsConfig {
+  /**
+   * Validate makes LogsConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TrustedProxyConfig {
+  /**
+   * Headers is a list of explicit trusted header(s) to check.
+   */
+  headers: Array<string>
+  /**
+   * UseLeftmostIP specifies to use the left-mostish IP from the trusted headers.
+   * 
+   * Note that this could be insecure when used with X-Forwarded-For header
+   * because some proxies like AWS ELB allow users to prepend their own header value
+   * before appending the trusted ones.
+   */
+  useLeftmostIP: boolean
+ }
+ interface TrustedProxyConfig {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface TrustedProxyConfig {
+  /**
+   * Validate makes RateLimitRule validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface RateLimitsConfig {
+  rules: Array<RateLimitRule>
+  enabled: boolean
+ }
+ interface RateLimitsConfig {
+  /**
+   * FindRateLimitRule returns the first matching rule based on the provided labels.
+   * 
+   * Optionally you can further specify a list of valid RateLimitRule.Audience values to further filter the matching rule
+   * (aka. the rule Audience will have to exist in one of the specified options).
+   */
+  findRateLimitRule(searchLabels: Array<string>, ...optOnlyAudience: string[]): [RateLimitRule, boolean]
+ }
+ interface RateLimitsConfig {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface RateLimitsConfig {
+  /**
+   * Validate makes RateLimitsConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface RateLimitRule {
+  /**
+   * Label is the identifier of the current rule.
+   * 
+   * It could be a tag, complete path or path prerefix (when ends with `/`).
+   * 
+   * Example supported labels:
+   * ```
+   *   - test_a (plain text "tag")
+   *   - users:create
+   *   - *:create
+   *   - /
+   *   - /api
+   *   - POST /api/collections/
+   * ```
+   */
+  label: string
+  /**
+   * Audience specifies the auth group the rule should apply for:
+   * ```
+   *   - ""      - both guests and authenticated users (default)
+   *   - "guest" - only for guests
+   *   - "auth"  - only for authenticated users
+   * ```
+   */
+  audience: string
+  /**
+   * Duration specifies the interval (in seconds) per which to reset
+   * the counted/accumulated rate limiter tokens.
+   */
+  duration: number
+  /**
+   * MaxRequests is the max allowed number of requests per Duration.
+   */
+  maxRequests: number
+ }
+ interface RateLimitRule {
+  /**
+   * Validate makes RateLimitRule validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface RateLimitRule {
+  /**
+   * DurationTime returns the tag's Duration as [time.Duration].
+   */
+  durationTime(): time.Duration
+ }
+ type _sCbDiPV = BaseModel
+ interface Param extends _sCbDiPV {
+  created: types.DateTime
+  updated: types.DateTime
+  value: types.JSONRaw
+ }
+ interface Param {
+  tableName(): string
+ }
+ interface BaseApp {
+  /**
+   * ReloadSettings initializes and reloads the stored application settings.
+   * 
+   * If no settings were stored it will persist the current app ones.
+   */
+  reloadSettings(): void
+ }
+ interface BaseApp {
+  /**
+   * DeleteView drops the specified view name.
+   * 
+   * This method is a no-op if a view with the provided name doesn't exist.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "name" argument must come only from trusted input!
+   */
+  deleteView(name: string): void
+ }
+ interface BaseApp {
+  /**
+   * SaveView creates (or updates already existing) persistent SQL view.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "selectQuery" argument must come only from trusted input!
+   */
+  saveView(name: string, selectQuery: string): void
+ }
+ interface BaseApp {
+  /**
+   * CreateViewFields creates a new FieldsList from the provided select query.
+   * 
+   * There are some caveats:
+   * - The select query must have an "id" column.
+   * - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
+   */
+  createViewFields(selectQuery: string): FieldsList
+ }
+ interface BaseApp {
+  /**
+   * FindRecordByViewFile returns the original Record of the provided view collection file.
+   */
+  findRecordByViewFile(viewCollectionModelOrIdentifier: any, fileFieldName: string, filename: string): (Record)
+ }
+ interface queryField {
+ }
+ interface identifier {
+ }
+ interface identifiersParser {
+ }
+}
+
+/**
+ * Package mails implements various helper methods for sending common
+ * emails like forgotten password, verification, etc.
+ */
+namespace mails {
+ interface sendRecordAuthAlert {
+  /**
+   * SendRecordAuthAlert sends a new device login alert to the specified auth record.
+   */
+  (app: CoreApp, authRecord: core.Record): void
+ }
+ interface sendRecordOTP {
+  /**
+   * SendRecordOTP sends OTP email to the specified auth record.
+   * 
+   * This method will also update the "sentTo" field of the related OTP record to the mail sent To address (if the OTP exists and not already assigned).
+   */
+  (app: CoreApp, authRecord: core.Record, otpId: string, pass: string): void
+ }
+ interface sendRecordPasswordReset {
+  /**
+   * SendRecordPasswordReset sends a password reset request email to the specified auth record.
+   */
+  (app: CoreApp, authRecord: core.Record): void
+ }
+ interface sendRecordVerification {
+  /**
+   * SendRecordVerification sends a verification request email to the specified auth record.
+   */
+  (app: CoreApp, authRecord: core.Record): void
+ }
+ interface sendRecordChangeEmail {
+  /**
+   * SendRecordChangeEmail sends a change email confirmation email to the specified auth record.
+   */
+  (app: CoreApp, authRecord: core.Record, newEmail: string): void
+ }
+}
+
+namespace forms {
+ // @ts-ignore
+ import validation = ozzo_validation
+ /**
+  * AppleClientSecretCreate is a form struct to generate a new Apple Client Secret.
+  * 
+  * Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
+  */
+ interface AppleClientSecretCreate {
+  /**
+   * ClientId is the identifier of your app (aka. Service ID).
+   */
+  clientId: string
+  /**
+   * TeamId is a 10-character string associated with your developer account
+   * (usually could be found next to your name in the Apple Developer site).
+   */
+  teamId: string
+  /**
+   * KeyId is a 10-character key identifier generated for the "Sign in with Apple"
+   * private key associated with your developer account.
+   */
+  keyId: string
+  /**
+   * PrivateKey is the private key associated to your app.
+   * Usually wrapped within -----BEGIN PRIVATE KEY----- X -----END PRIVATE KEY-----.
+   */
+  privateKey: string
+  /**
+   * Duration specifies how long the generated JWT should be considered valid.
+   * The specified value must be in seconds and max 15777000 (~6months).
+   */
+  duration: number
+ }
+ interface newAppleClientSecretCreate {
+  /**
+   * NewAppleClientSecretCreate creates a new [AppleClientSecretCreate] form with initializer
+   * config created from the provided [CoreApp] instances.
+   */
+  (app: CoreApp): (AppleClientSecretCreate)
+ }
+ interface AppleClientSecretCreate {
+  /**
+   * Validate makes the form validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface AppleClientSecretCreate {
+  /**
+   * Submit validates the form and returns a new Apple Client Secret JWT.
+   */
+  submit(): string
+ }
+ interface RecordUpsert {
+ }
+ interface newRecordUpsert {
+  /**
+   * NewRecordUpsert creates a new [RecordUpsert] form from the provided [CoreApp] and [core.Record] instances
+   * (for create you could pass a pointer to an empty Record - core.NewRecord(collection)).
+   */
+  (app: CoreApp, record: core.Record): (RecordUpsert)
+ }
+ interface RecordUpsert {
+  /**
+   * SetContext assigns ctx as context of the current form.
+   */
+  setContext(ctx: context.Context): void
+ }
+ interface RecordUpsert {
+  /**
+   * SetApp replaces the current form app instance.
+   * 
+   * This could be used for example if you want to change at later stage
+   * before submission to change from regular -> transactional app instance.
+   */
+  setApp(app: CoreApp): void
+ }
+ interface RecordUpsert {
+  /**
+   * SetRecord replaces the current form record instance.
+   */
+  setRecord(record: core.Record): void
+ }
+ interface RecordUpsert {
+  /**
+   * ResetAccess resets the form access level to the accessLevelDefault.
+   */
+  resetAccess(): void
+ }
+ interface RecordUpsert {
+  /**
+   * GrantManagerAccess updates the form access level to "manager" allowing
+   * directly changing some system record fields (often used with auth collection records).
+   */
+  grantManagerAccess(): void
+ }
+ interface RecordUpsert {
+  /**
+   * GrantSuperuserAccess updates the form access level to "superuser" allowing
+   * directly changing all system record fields, including those marked as "Hidden".
+   */
+  grantSuperuserAccess(): void
+ }
+ interface RecordUpsert {
+  /**
+   * HasManageAccess reports whether the form has "manager" or "superuser" level access.
+   */
+  hasManageAccess(): boolean
+ }
+ interface RecordUpsert {
+  /**
+   * Load loads the provided data into the form and the related record.
+   */
+  load(data: _TygojaDict): void
+ }
+ interface RecordUpsert {
+  /**
+   * Deprecated: It was previously used as part of the record create action but it is not needed anymore and will be removed in the future.
+   * 
+   * DrySubmit performs a temp form submit within a transaction and reverts it at the end.
+   * For actual record persistence, check the [RecordUpsert.Submit()] method.
+   * 
+   * This method doesn't perform validations, handle file uploads/deletes or trigger app save events!
+   */
+  drySubmit(callback: (txApp: CoreApp, drySavedRecord: core.Record) => void): void
+ }
+ interface RecordUpsert {
+  /**
+   * Submit validates the form specific validations and attempts to save the form record.
+   */
+  submit(): void
+ }
+ /**
+  * TestEmailSend is a email template test request form.
+  */
+ interface TestEmailSend {
+  email: string
+  template: string
+  collection: string // optional, fallbacks to _superusers
+ }
+ interface newTestEmailSend {
+  /**
+   * NewTestEmailSend creates and initializes new TestEmailSend form.
+   */
+  (app: CoreApp): (TestEmailSend)
+ }
+ interface TestEmailSend {
+  /**
+   * Validate makes the form validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TestEmailSend {
+  /**
+   * Submit validates and sends a test email to the form.Email address.
+   */
+  submit(): void
+ }
+ /**
+  * TestS3Filesystem defines a S3 filesystem connection test.
+  */
+ interface TestS3Filesystem {
+  /**
+   * The name of the filesystem - storage or backups
+   */
+  filesystem: string
+ }
+ interface newTestS3Filesystem {
+  /**
+   * NewTestS3Filesystem creates and initializes new TestS3Filesystem form.
+   */
+  (app: CoreApp): (TestS3Filesystem)
+ }
+ interface TestS3Filesystem {
+  /**
+   * Validate makes the form validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TestS3Filesystem {
+  /**
+   * Submit validates and performs a S3 filesystem connection test.
+   */
+  submit(): void
+ }
+}
+
+namespace apis {
+ interface toApiError {
+  /**
+   * ToApiError wraps err into ApiError instance (if not already).
+   */
+  (err: Error): (router.ApiError)
+ }
+ interface newApiError {
+  /**
+   * NewApiError is an alias for [router.NewApiError].
+   */
+  (status: number, message: string, errData: any): (router.ApiError)
+ }
+ interface newBadRequestError {
+  /**
+   * NewBadRequestError is an alias for [router.NewBadRequestError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newNotFoundError {
+  /**
+   * NewNotFoundError is an alias for [router.NewNotFoundError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newForbiddenError {
+  /**
+   * NewForbiddenError is an alias for [router.NewForbiddenError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newUnauthorizedError {
+  /**
+   * NewUnauthorizedError is an alias for [router.NewUnauthorizedError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newTooManyRequestsError {
+  /**
+   * NewTooManyRequestsError is an alias for [router.NewTooManyRequestsError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newInternalServerError {
+  /**
+   * NewInternalServerError is an alias for [router.NewInternalServerError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface backupFileInfo {
+  modified: types.DateTime
+  key: string
+  size: number
+ }
+ // @ts-ignore
+ import validation = ozzo_validation
+ interface backupCreateForm {
+  name: string
+ }
+ interface backupUploadForm {
+  file?: filesystem.File
+ }
+ interface newRouter {
+  /**
+   * NewRouter returns a new router instance loaded with the default app middlewares and api routes.
+   */
+  (app: CoreApp): (router.Router<core.RequestEvent | undefined>)
+ }
+ interface wrapStdHandler {
+  /**
+   * WrapStdHandler wraps Go [http.Handler] into a PocketBase handler func.
+   */
+  (h: http.Handler): (_arg0: core.RequestEvent) => void
+ }
+ interface wrapStdMiddleware {
+  /**
+   * WrapStdMiddleware wraps Go [func(http.Handler) http.Handle] into a PocketBase middleware func.
+   */
+  (m: (_arg0: http.Handler) => http.Handler): (_arg0: core.RequestEvent) => void
+ }
+ interface mustSubFS {
+  /**
+   * MustSubFS returns an [fs.FS] corresponding to the subtree rooted at fsys's dir.
+   * 
+   * This is similar to [fs.Sub] but panics on failure.
+   */
+  (fsys: fs.FS, dir: string): fs.FS
+ }
+ interface _static {
+  /**
+   * Static is a handler function to serve static directory content from fsys.
+   * 
+   * If a file resource is missing and indexFallback is set, the request
+   * will be forwarded to the base index.html (useful for SPA with pretty urls).
+   * 
+   * NB! Expects the route to have a "{path...}" wildcard parameter.
+   * 
+   * Special redirects:
+   * ```
+   *   - if "path" is a file that ends in index.html, it is redirected to its non-index.html version (eg. /test/index.html -> /test/)
+   *   - if "path" is a directory that has index.html, the index.html file is rendered,
+   *     otherwise if missing - returns 404 or fallback to the root index.html if indexFallback is set
+   * ```
+   * 
+   * Example:
+   * 
+   * ```
+   * 	fsys := os.DirFS("./pb_public")
+   * 	router.GET("/files/{path...}", apis.Static(fsys, false))
+   * ```
+   */
+  (fsys: fs.FS, indexFallback: boolean): (_arg0: core.RequestEvent) => void
+ }
+ interface HandleFunc {(e: core.RequestEvent): void }
+ interface BatchActionHandlerFunc {(app: CoreApp, ir: core.InternalRequest, params: _TygojaDict, next: (data: any) => void): HandleFunc }
+ interface BatchRequestResult {
+  body: any
+  status: number
+ }
+ interface batchRequestsForm {
+  requests: Array<(core.InternalRequest | undefined)>
+ }
+ interface batchProcessor {
+ }
+ interface batchProcessor {
+  process(batch: Array<(core.InternalRequest | undefined)>, timeout: time.Duration): void
+ }
+ interface BatchResponseError {
+ }
+ interface BatchResponseError {
+  error(): string
+ }
+ interface BatchResponseError {
+  code(): string
+ }
+ interface BatchResponseError {
+  resolve(errData: _TygojaDict): any
+ }
+ interface BatchResponseError {
+  marshalJSON(): string|Array<number>
+ }
+ interface collectionsImportForm {
+  collections: Array<_TygojaDict>
+  deleteMissing: boolean
+ }
+ interface fileApi {
+ }
+ interface defaultInstallerFunc {
+  /**
+   * DefaultInstallerFunc is the default PocketBase installer function.
+   * 
+   * It will attempt to open a link in the browser (with a short-lived auth
+   * token for the systemSuperuser) to the installer UI so that users can
+   * create their own custom superuser record.
+   * 
+   * See https://github.com/pocketbase/pocketbase/discussions/5814.
+   */
+  (app: CoreApp, systemSuperuser: core.Record, baseURL: string): void
+ }
+ interface requireGuestOnly {
+  /**
+   * RequireGuestOnly middleware requires a request to NOT have a valid
+   * Authorization header.
+   * 
+   * This middleware is the opposite of [apis.RequireAuth()].
+   */
+  (): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface requireAuth {
+  /**
+   * RequireAuth middleware requires a request to have a valid record Authorization header.
+   * 
+   * The auth record could be from any collection.
+   * You can further filter the allowed record auth collections by specifying their names.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	apis.RequireAuth()                      // any auth collection
+   * 	apis.RequireAuth("_superusers", "users") // only the listed auth collections
+   * ```
+   */
+  (...optCollectionNames: string[]): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface requireSuperuserAuth {
+  /**
+   * RequireSuperuserAuth middleware requires a request to have
+   * a valid superuser Authorization header.
+   */
+  (): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface requireSuperuserOrOwnerAuth {
+  /**
+   * RequireSuperuserOrOwnerAuth middleware requires a request to have
+   * a valid superuser or regular record owner Authorization header set.
+   * 
+   * This middleware is similar to [apis.RequireAuth()] but
+   * for the auth record token expects to have the same id as the path
+   * parameter ownerIdPathParam (default to "id" if empty).
+   */
+  (ownerIdPathParam: string): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface requireSameCollectionContextAuth {
+  /**
+   * RequireSameCollectionContextAuth middleware requires a request to have
+   * a valid record Authorization header and the auth record's collection to
+   * match the one from the route path parameter (default to "collection" if collectionParam is empty).
+   */
+  (collectionPathParam: string): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface skipSuccessActivityLog {
+  /**
+   * SkipSuccessActivityLog is a helper middleware that instructs the global
+   * activity logger to log only requests that have failed/returned an error.
+   */
+  (): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface bodyLimit {
+  /**
+   * BodyLimit returns a middleware handler that changes the default request body size limit.
+   * 
+   * If limitBytes <= 0, no limit is applied.
+   * 
+   * Otherwise, if the request body size exceeds the configured limitBytes,
+   * it sends 413 error response.
+   */
+  (limitBytes: number): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ type _svzUclG = io.ReadCloser
+ interface limitedReader extends _svzUclG {
+ }
+ interface limitedReader {
+  read(b: string|Array<number>): number
+ }
+ interface limitedReader {
+  reread(): void
+ }
+ /**
+  * CORSConfig defines the config for CORS middleware.
+  */
+ interface CORSConfig {
+  /**
+   * AllowOrigins determines the value of the Access-Control-Allow-Origin
+   * response header.  This header defines a list of origins that may access the
+   * resource.  The wildcard characters '*' and '?' are supported and are
+   * converted to regex fragments '.*' and '.' accordingly.
+   * 
+   * Security: use extreme caution when handling the origin, and carefully
+   * validate any logic. Remember that attackers may register hostile domain names.
+   * See https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+   * 
+   * Optional. Default value []string{"*"}.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+   */
+  allowOrigins: Array<string>
+  /**
+   * AllowOriginFunc is a custom function to validate the origin. It takes the
+   * origin as an argument and returns true if allowed or false otherwise. If
+   * an error is returned, it is returned by the handler. If this option is
+   * set, AllowOrigins is ignored.
+   * 
+   * Security: use extreme caution when handling the origin, and carefully
+   * validate any logic. Remember that attackers may register hostile domain names.
+   * See https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+   * 
+   * Optional.
+   */
+  allowOriginFunc: (origin: string) => boolean
+  /**
+   * AllowMethods determines the value of the Access-Control-Allow-Methods
+   * response header.  This header specified the list of methods allowed when
+   * accessing the resource.  This is used in response to a preflight request.
+   * 
+   * Optional. Default value DefaultCORSConfig.AllowMethods.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+   */
+  allowMethods: Array<string>
+  /**
+   * AllowHeaders determines the value of the Access-Control-Allow-Headers
+   * response header.  This header is used in response to a preflight request to
+   * indicate which HTTP headers can be used when making the actual request.
+   * 
+   * Optional. Default value []string{}.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
+   */
+  allowHeaders: Array<string>
+  /**
+   * AllowCredentials determines the value of the
+   * Access-Control-Allow-Credentials response header.  This header indicates
+   * whether or not the response to the request can be exposed when the
+   * credentials mode (Request.credentials) is true. When used as part of a
+   * response to a preflight request, this indicates whether or not the actual
+   * request can be made using credentials.  See also
+   * [MDN: Access-Control-Allow-Credentials].
+   * 
+   * Optional. Default value false, in which case the header is not set.
+   * 
+   * Security: avoid using `AllowCredentials = true` with `AllowOrigins = *`.
+   * See "Exploiting CORS misconfigurations for Bitcoins and bounties",
+   * https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
+   */
+  allowCredentials: boolean
+  /**
+   * UnsafeWildcardOriginWithAllowCredentials UNSAFE/INSECURE: allows wildcard '*' origin to be used with AllowCredentials
+   * flag. In that case we consider any origin allowed and send it back to the client with `Access-Control-Allow-Origin` header.
+   * 
+   * This is INSECURE and potentially leads to [cross-origin](https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
+   * attacks. See: https://github.com/labstack/echo/issues/2400 for discussion on the subject.
+   * 
+   * Optional. Default value is false.
+   */
+  unsafeWildcardOriginWithAllowCredentials: boolean
+  /**
+   * ExposeHeaders determines the value of Access-Control-Expose-Headers, which
+   * defines a list of headers that clients are allowed to access.
+   * 
+   * Optional. Default value []string{}, in which case the header is not set.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Header
+   */
+  exposeHeaders: Array<string>
+  /**
+   * MaxAge determines the value of the Access-Control-Max-Age response header.
+   * This header indicates how long (in seconds) the results of a preflight
+   * request can be cached.
+   * The header is set only if MaxAge != 0, negative value sends "0" which instructs browsers not to cache that response.
+   * 
+   * Optional. Default value 0 - meaning header is not sent.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+   */
+  maxAge: number
+ }
+ interface cors {
+  /**
+   * CORS returns a CORS middleware.
+   */
+  (config: CORSConfig): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ /**
+  * GzipConfig defines the config for Gzip middleware.
+  */
+ interface GzipConfig {
+  /**
+   * Gzip compression level.
+   * Optional. Default value -1.
+   */
+  level: number
+  /**
+   * Length threshold before gzip compression is applied.
+   * Optional. Default value 0.
+   * 
+   * Most of the time you will not need to change the default. Compressing
+   * a short response might increase the transmitted data because of the
+   * gzip format overhead. Compressing the response will also consume CPU
+   * and time on the server and the client (for decompressing). Depending on
+   * your use case such a threshold might be useful.
+   * 
+   * See also:
+   * https://webmasters.stackexchange.com/questions/31750/what-is-recommended-minimum-object-size-for-gzip-performance-benefits
+   */
+  minLength: number
+ }
+ interface gzip {
+  /**
+   * Gzip returns a middleware which compresses HTTP response using Gzip compression scheme.
+   */
+  (): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface gzipWithConfig {
+  /**
+   * GzipWithConfig returns a middleware which compresses HTTP response using gzip compression scheme.
+   */
+  (config: GzipConfig): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ type _sGCwxMx = http.ResponseWriter&io.Writer
+ interface gzipResponseWriter extends _sGCwxMx {
+ }
+ interface gzipResponseWriter {
+  writeHeader(code: number): void
+ }
+ interface gzipResponseWriter {
+  write(b: string|Array<number>): number
+ }
+ interface gzipResponseWriter {
+  flush(): void
+ }
+ interface gzipResponseWriter {
+  hijack(): [net.Conn, (bufio.ReadWriter)]
+ }
+ interface gzipResponseWriter {
+  push(target: string, opts: http.PushOptions): void
+ }
+ interface gzipResponseWriter {
+  unwrap(): http.ResponseWriter
+ }
+ type _sXBRDsb = sync.RWMutex
+ interface rateLimiter extends _sXBRDsb {
+ }
+ type _sxuiJKx = sync.Mutex
+ interface fixedWindow extends _sxuiJKx {
+ }
+ interface realtimeSubscribeForm {
+  clientId: string
+  subscriptions: Array<string>
+ }
+ /**
+  * recordData represents the broadcasted record subscrition message data.
+  */
+ interface recordData {
+  record: any //  map or core.Record
+  action: string
+ }
+ interface EmailChangeConfirmForm {
+  token: string
+  password: string
+ }
+ interface emailChangeRequestForm {
+  newEmail: string
+ }
+ interface impersonateForm {
+  /**
+   * Duration is the optional custom token duration in seconds.
+   */
+  duration: number
+ }
+ interface otpResponse {
+  enabled: boolean
+  duration: number // in seconds
+ }
+ interface mfaResponse {
+  enabled: boolean
+  duration: number // in seconds
+ }
+ interface passwordResponse {
+  identityFields: Array<string>
+  enabled: boolean
+ }
+ interface oauth2Response {
+  providers: Array<providerInfo>
+  enabled: boolean
+ }
+ interface providerInfo {
+  name: string
+  displayName: string
+  state: string
+  authURL: string
+  /**
+   * @todo
+   * deprecated: use AuthURL instead
+   * AuthUrl will be removed after dropping v0.22 support
+   */
+  authUrl: string
+  /**
+   * technically could be omitted if the provider doesn't support PKCE,
+   * but to avoid breaking existing typed clients we'll return them as empty string
+   */
+  codeVerifier: string
+  codeChallenge: string
+  codeChallengeMethod: string
+ }
+ interface authMethodsResponse {
+  password: passwordResponse
+  oauth2: oauth2Response
+  mfa: mfaResponse
+  otp: otpResponse
+  /**
+   * legacy fields
+   * @todo remove after dropping v0.22 support
+   */
+  authProviders: Array<providerInfo>
+  usernamePassword: boolean
+  emailPassword: boolean
+ }
+ interface createOTPForm {
+  email: string
+ }
+ interface recordConfirmPasswordResetForm {
+  token: string
+  password: string
+  passwordConfirm: string
+ }
+ interface recordRequestPasswordResetForm {
+  email: string
+ }
+ interface recordConfirmVerificationForm {
+  token: string
+ }
+ interface recordRequestVerificationForm {
+  email: string
+ }
+ interface recordOAuth2LoginForm {
+  /**
+   * Additional data that will be used for creating a new auth record
+   * if an existing OAuth2 account doesn't exist.
+   */
+  createData: _TygojaDict
+  /**
+   * The name of the OAuth2 client provider (eg. "google")
+   */
+  provider: string
+  /**
+   * The authorization code returned from the initial request.
+   */
+  code: string
+  /**
+   * The optional PKCE code verifier as part of the code_challenge sent with the initial request.
+   */
+  codeVerifier: string
+  /**
+   * The redirect url sent with the initial request.
+   */
+  redirectURL: string
+  /**
+   * @todo
+   * deprecated: use RedirectURL instead
+   * RedirectUrl will be removed after dropping v0.22 support
+   */
+  redirectUrl: string
+ }
+ interface oauth2RedirectData {
+  state: string
+  code: string
+  error: string
+ }
+ interface authWithOTPForm {
+  otpId: string
+  password: string
+ }
+ interface authWithPasswordForm {
+  identity: string
+  password: string
+  /**
+   * IdentityField specifies the field to use to search for the identity
+   * (leave it empty for "auto" detection).
+   */
+  identityField: string
+ }
+ // @ts-ignore
+ import cryptoRand = rand
+ interface recordAuthResponse {
+  /**
+   * RecordAuthResponse writes standardized json record auth response
+   * into the specified request context.
+   * 
+   * The authMethod argument specify the name of the current authentication method (eg. password, oauth2, etc.)
+   * that it is used primarily as an auth identifier during MFA and for login alerts.
+   * 
+   * Set authMethod to empty string if you want to ignore the MFA checks and the login alerts
+   * (can be also adjusted additionally via the OnRecordAuthRequest hook).
+   */
+  (e: core.RequestEvent, authRecord: core.Record, authMethod: string, meta: any): void
+ }
+ interface enrichRecord {
+  /**
+   * EnrichRecord parses the request context and enrich the provided record:
+   * ```
+   *   - expands relations (if defaultExpands and/or ?expand query param is set)
+   *   - ensures that the emails of the auth record and its expanded auth relations
+   *     are visible only for the current logged superuser, record owner or record with manage access
+   * ```
+   */
+  (e: core.RequestEvent, record: core.Record, ...defaultExpands: string[]): void
+ }
+ interface enrichRecords {
+  /**
+   * EnrichRecords parses the request context and enriches the provided records:
+   * ```
+   *   - expands relations (if defaultExpands and/or ?expand query param is set)
+   *   - ensures that the emails of the auth records and their expanded auth relations
+   *     are visible only for the current logged superuser, record owner or record with manage access
+   * ```
+   * 
+   * Note: Expects all records to be from the same collection!
+   */
+  (e: core.RequestEvent, records: Array<(core.Record | undefined)>, ...defaultExpands: string[]): void
+ }
+ interface iterator<T> {
+ }
+ /**
+  * ServeConfig defines a configuration struct for apis.Serve().
+  */
+ interface ServeConfig {
+  /**
+   * ShowStartBanner indicates whether to show or hide the server start console message.
+   */
+  showStartBanner: boolean
+  /**
+   * HttpAddr is the TCP address to listen for the HTTP server (eg. "127.0.0.1:80").
+   */
+  httpAddr: string
+  /**
+   * HttpsAddr is the TCP address to listen for the HTTPS server (eg. "127.0.0.1:443").
+   */
+  httpsAddr: string
+  /**
+   * Optional domains list to use when issuing the TLS certificate.
+   * 
+   * If not set, the host from the bound server address will be used.
+   * 
+   * For convenience, for each "non-www" domain a "www" entry and
+   * redirect will be automatically added.
+   */
+  certificateDomains: Array<string>
+  /**
+   * AllowedOrigins is an optional list of CORS origins (default to "*").
+   */
+  allowedOrigins: Array<string>
+ }
+ interface serve {
+  /**
+   * Serve starts a new app web server.
+   * 
+   * NB! The app should be bootstrapped before starting the web server.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.Bootstrap()
+   * 	apis.Serve(app, apis.ServeConfig{
+   * 		HttpAddr:        "127.0.0.1:8080",
+   * 		ShowStartBanner: false,
+   * 	})
+   * ```
+   */
+  (app: CoreApp, config: ServeConfig): void
+ }
+ interface serverErrorLogWriter {
+ }
+ interface serverErrorLogWriter {
+  write(p: string|Array<number>): number
+ }
+}
+
+namespace pocketbase {
+ /**
+  * PocketBase defines a PocketBase app launcher.
+  * 
+  * It implements [CoreApp] via embedding and all of the app interface methods
+  * could be accessed directly through the instance (eg. PocketBase.DataDir()).
+  */
+ type _sQnaLxt = CoreApp
+ interface PocketBase extends _sQnaLxt {
+  /**
+   * RootCmd is the main console command
+   */
+  rootCmd?: cobra.Command
+ }
+ /**
+  * Config is the PocketBase initialization config struct.
+  */
+ interface Config {
+  /**
+   * hide the default console server info on app startup
+   */
+  hideStartBanner: boolean
+  /**
+   * optional default values for the console flags
+   */
+  defaultDev: boolean
+  defaultDataDir: string // if not set, it will fallback to "./pb_data"
+  defaultEncryptionEnv: string
+  defaultQueryTimeout: time.Duration // default to core.DefaultQueryTimeout (in seconds)
+  /**
+   * optional DB configurations
+   */
+  dataMaxOpenConns: number // default to core.DefaultDataMaxOpenConns
+  dataMaxIdleConns: number // default to core.DefaultDataMaxIdleConns
+  auxMaxOpenConns: number // default to core.DefaultAuxMaxOpenConns
+  auxMaxIdleConns: number // default to core.DefaultAuxMaxIdleConns
+  dbConnect: core.DBConnectFunc // default to core.dbConnect
+ }
+ interface _new {
+  /**
+   * New creates a new PocketBase instance with the default configuration.
+   * Use [NewWithConfig] if you want to provide a custom configuration.
+   * 
+   * Note that the application will not be initialized/bootstrapped yet,
+   * aka. DB connections, migrations, app settings, etc. will not be accessible.
+   * Everything will be initialized when [PocketBase.Start] is executed.
+   * If you want to initialize the application before calling [PocketBase.Start],
+   * then you'll have to manually call [PocketBase.Bootstrap].
+   */
+  (): (PocketBase)
+ }
+ interface newWithConfig {
+  /**
+   * NewWithConfig creates a new PocketBase instance with the provided config.
+   * 
+   * Note that the application will not be initialized/bootstrapped yet,
+   * aka. DB connections, migrations, app settings, etc. will not be accessible.
+   * Everything will be initialized when [PocketBase.Start] is executed.
+   * If you want to initialize the application before calling [PocketBase.Start],
+   * then you'll have to manually call [PocketBase.Bootstrap].
+   */
+  (config: Config): (PocketBase)
+ }
+ interface PocketBase {
+  /**
+   * Start starts the application, aka. registers the default system
+   * commands (serve, superuser, version) and executes pb.RootCmd.
+   */
+  start(): void
+ }
+ interface PocketBase {
+  /**
+   * Execute initializes the application (if not already) and executes
+   * the pb.RootCmd with graceful shutdown support.
+   * 
+   * This method differs from pb.Start() by not registering the default
+   * system commands!
+   */
+  execute(): void
+ }
+ /**
+  * coloredWriter is a small wrapper struct to construct a [color.Color] writter.
+  */
+ interface coloredWriter {
+ }
+ interface coloredWriter {
+  /**
+   * Write writes the p bytes using the colored writer.
+   */
+  write(p: string|Array<number>): number
+ }
+}
+
+/**
+ * Package template is a thin wrapper around the standard html/template
+ * and text/template packages that implements a convenient registry to
+ * load and cache templates on the fly concurrently.
+ * 
+ * It was created to assist the JSVM plugin HTML rendering, but could be used in other Go code.
+ * 
+ * Example:
+ * 
+ * ```
+ * 	registry := template.NewRegistry()
+ * 
+ * 	html1, err := registry.LoadFiles(
+ * 		// the files set wil be parsed only once and then cached
+ * 		"layout.html",
+ * 		"content.html",
+ * 	).Render(map[string]any{"name": "John"})
+ * 
+ * 	html2, err := registry.LoadFiles(
+ * 		// reuse the already parsed and cached files set
+ * 		"layout.html",
+ * 		"content.html",
+ * 	).Render(map[string]any{"name": "Jane"})
+ * ```
+ */
+namespace template {
+ interface newRegistry {
+  /**
+   * NewRegistry creates and initializes a new templates registry with
+   * some defaults (eg. global "raw" template function for unescaped HTML).
+   * 
+   * Use the Registry.Load* methods to load templates into the registry.
+   */
+  (): (Registry)
+ }
+ /**
+  * Registry defines a templates registry that is safe to be used by multiple goroutines.
+  * 
+  * Use the Registry.Load* methods to load templates into the registry.
+  */
+ interface Registry {
+ }
+ interface Registry {
+  /**
+   * AddFuncs registers new global template functions.
+   * 
+   * The key of each map entry is the function name that will be used in the templates.
+   * If a function with the map entry name already exists it will be replaced with the new one.
+   * 
+   * The value of each map entry is a function that must have either a
+   * single return value, or two return values of which the second has type error.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	r.AddFuncs(map[string]any{
+   * 	  "toUpper": func(str string) string {
+   * 	      return strings.ToUppser(str)
+   * 	  },
+   * 	  ...
+   * 	})
+   * ```
+   */
+  addFuncs(funcs: _TygojaDict): (Registry)
+ }
+ interface Registry {
+  /**
+   * LoadFiles caches (if not already) the specified filenames set as a
+   * single template and returns a ready to use Renderer instance.
+   * 
+   * There must be at least 1 filename specified.
+   */
+  loadFiles(...filenames: string[]): (Renderer)
+ }
+ interface Registry {
+  /**
+   * LoadString caches (if not already) the specified inline string as a
+   * single template and returns a ready to use Renderer instance.
+   */
+  loadString(text: string): (Renderer)
+ }
+ interface Registry {
+  /**
+   * LoadFS caches (if not already) the specified fs and globPatterns
+   * pair as single template and returns a ready to use Renderer instance.
+   * 
+   * There must be at least 1 file matching the provided globPattern(s)
+   * (note that most file names serves as glob patterns matching themselves).
+   */
+  loadFS(fsys: fs.FS, ...globPatterns: string[]): (Renderer)
+ }
+ /**
+  * Renderer defines a single parsed template.
+  */
+ interface Renderer {
+ }
+ interface Renderer {
+  /**
+   * Render executes the template with the specified data as the dot object
+   * and returns the result as plain string.
+   */
+  render(data: any): string
+ }
+}
+
+/**
+ * Package sync provides basic synchronization primitives such as mutual
+ * exclusion locks. Other than the [Once] and [WaitGroup] types, most are intended
+ * for use by low-level library routines. Higher-level synchronization is
+ * better done via channels and communication.
+ * 
+ * Values containing the types defined in this package should not be copied.
+ */
+namespace sync {
+ /**
+  * A Mutex is a mutual exclusion lock.
+  * The zero value for a Mutex is an unlocked mutex.
+  * 
+  * A Mutex must not be copied after first use.
+  * 
+  * In the terminology of [the Go memory model],
+  * the n'th call to [Mutex.Unlock] “synchronizes before” the m'th call to [Mutex.Lock]
+  * for any n < m.
+  * A successful call to [Mutex.TryLock] is equivalent to a call to Lock.
+  * A failed call to TryLock does not establish any “synchronizes before”
+  * relation at all.
+  * 
+  * [the Go memory model]: https://go.dev/ref/mem
+  */
+ interface Mutex {
+ }
+ interface Mutex {
+  /**
+   * Lock locks m.
+   * If the lock is already in use, the calling goroutine
+   * blocks until the mutex is available.
+   */
+  lock(): void
+ }
+ interface Mutex {
+  /**
+   * TryLock tries to lock m and reports whether it succeeded.
+   * 
+   * Note that while correct uses of TryLock do exist, they are rare,
+   * and use of TryLock is often a sign of a deeper problem
+   * in a particular use of mutexes.
+   */
+  tryLock(): boolean
+ }
+ interface Mutex {
+  /**
+   * Unlock unlocks m.
+   * It is a run-time error if m is not locked on entry to Unlock.
+   * 
+   * A locked [Mutex] is not associated with a particular goroutine.
+   * It is allowed for one goroutine to lock a Mutex and then
+   * arrange for another goroutine to unlock it.
+   */
+  unlock(): void
+ }
+ /**
+  * A RWMutex is a reader/writer mutual exclusion lock.
+  * The lock can be held by an arbitrary number of readers or a single writer.
+  * The zero value for a RWMutex is an unlocked mutex.
+  * 
+  * A RWMutex must not be copied after first use.
+  * 
+  * If any goroutine calls [RWMutex.Lock] while the lock is already held by
+  * one or more readers, concurrent calls to [RWMutex.RLock] will block until
+  * the writer has acquired (and released) the lock, to ensure that
+  * the lock eventually becomes available to the writer.
+  * Note that this prohibits recursive read-locking.
+  * 
+  * In the terminology of [the Go memory model],
+  * the n'th call to [RWMutex.Unlock] “synchronizes before” the m'th call to Lock
+  * for any n < m, just as for [Mutex].
+  * For any call to RLock, there exists an n such that
+  * the n'th call to Unlock “synchronizes before” that call to RLock,
+  * and the corresponding call to [RWMutex.RUnlock] “synchronizes before”
+  * the n+1'th call to Lock.
+  * 
+  * [the Go memory model]: https://go.dev/ref/mem
+  */
+ interface RWMutex {
+ }
+ interface RWMutex {
+  /**
+   * RLock locks rw for reading.
+   * 
+   * It should not be used for recursive read locking; a blocked Lock
+   * call excludes new readers from acquiring the lock. See the
+   * documentation on the [RWMutex] type.
+   */
+  rLock(): void
+ }
+ interface RWMutex {
+  /**
+   * TryRLock tries to lock rw for reading and reports whether it succeeded.
+   * 
+   * Note that while correct uses of TryRLock do exist, they are rare,
+   * and use of TryRLock is often a sign of a deeper problem
+   * in a particular use of mutexes.
+   */
+  tryRLock(): boolean
+ }
+ interface RWMutex {
+  /**
+   * RUnlock undoes a single [RWMutex.RLock] call;
+   * it does not affect other simultaneous readers.
+   * It is a run-time error if rw is not locked for reading
+   * on entry to RUnlock.
+   */
+  rUnlock(): void
+ }
+ interface RWMutex {
+  /**
+   * Lock locks rw for writing.
+   * If the lock is already locked for reading or writing,
+   * Lock blocks until the lock is available.
+   */
+  lock(): void
+ }
+ interface RWMutex {
+  /**
+   * TryLock tries to lock rw for writing and reports whether it succeeded.
+   * 
+   * Note that while correct uses of TryLock do exist, they are rare,
+   * and use of TryLock is often a sign of a deeper problem
+   * in a particular use of mutexes.
+   */
+  tryLock(): boolean
+ }
+ interface RWMutex {
+  /**
+   * Unlock unlocks rw for writing. It is a run-time error if rw is
+   * not locked for writing on entry to Unlock.
+   * 
+   * As with Mutexes, a locked [RWMutex] is not associated with a particular
+   * goroutine. One goroutine may [RWMutex.RLock] ([RWMutex.Lock]) a RWMutex and then
+   * arrange for another goroutine to [RWMutex.RUnlock] ([RWMutex.Unlock]) it.
+   */
+  unlock(): void
+ }
+ interface RWMutex {
+  /**
+   * RLocker returns a [Locker] interface that implements
+   * the [Locker.Lock] and [Locker.Unlock] methods by calling rw.RLock and rw.RUnlock.
+   */
+  rLocker(): Locker
+ }
+}
+
+/**
+ * Package io provides basic interfaces to I/O primitives.
+ * Its primary job is to wrap existing implementations of such primitives,
+ * such as those in package os, into shared public interfaces that
+ * abstract the functionality, plus some other related primitives.
+ * 
+ * Because these interfaces and primitives wrap lower-level operations with
+ * various implementations, unless otherwise informed clients should not
+ * assume they are safe for parallel execution.
+ */
+namespace io {
+ /**
+  * Reader is the interface that wraps the basic Read method.
+  * 
+  * Read reads up to len(p) bytes into p. It returns the number of bytes
+  * read (0 <= n <= len(p)) and any error encountered. Even if Read
+  * returns n < len(p), it may use all of p as scratch space during the call.
+  * If some data is available but not len(p) bytes, Read conventionally
+  * returns what is available instead of waiting for more.
+  * 
+  * When Read encounters an error or end-of-file condition after
+  * successfully reading n > 0 bytes, it returns the number of
+  * bytes read. It may return the (non-nil) error from the same call
+  * or return the error (and n == 0) from a subsequent call.
+  * An instance of this general case is that a Reader returning
+  * a non-zero number of bytes at the end of the input stream may
+  * return either err == EOF or err == nil. The next Read should
+  * return 0, EOF.
+  * 
+  * Callers should always process the n > 0 bytes returned before
+  * considering the error err. Doing so correctly handles I/O errors
+  * that happen after reading some bytes and also both of the
+  * allowed EOF behaviors.
+  * 
+  * If len(p) == 0, Read should always return n == 0. It may return a
+  * non-nil error if some error condition is known, such as EOF.
+  * 
+  * Implementations of Read are discouraged from returning a
+  * zero byte count with a nil error, except when len(p) == 0.
+  * Callers should treat a return of 0 and nil as indicating that
+  * nothing happened; in particular it does not indicate EOF.
+  * 
+  * Implementations must not retain p.
+  */
+ interface Reader {
+  [key:string]: any;
+  read(p: string|Array<number>): number
+ }
+ /**
+  * Writer is the interface that wraps the basic Write method.
+  * 
+  * Write writes len(p) bytes from p to the underlying data stream.
+  * It returns the number of bytes written from p (0 <= n <= len(p))
+  * and any error encountered that caused the write to stop early.
+  * Write must return a non-nil error if it returns n < len(p).
+  * Write must not modify the slice data, even temporarily.
+  * 
+  * Implementations must not retain p.
+  */
+ interface Writer {
+  [key:string]: any;
+  write(p: string|Array<number>): number
+ }
+ /**
+  * ReadCloser is the interface that groups the basic Read and Close methods.
+  */
+ interface ReadCloser {
+  [key:string]: any;
+ }
+ /**
+  * ReadSeekCloser is the interface that groups the basic Read, Seek and Close
+  * methods.
+  */
+ interface ReadSeekCloser {
+  [key:string]: any;
+ }
+}
+
+/**
+ * Package bytes implements functions for the manipulation of byte slices.
+ * It is analogous to the facilities of the [strings] package.
+ */
+namespace bytes {
+ /**
+  * A Reader implements the [io.Reader], [io.ReaderAt], [io.WriterTo], [io.Seeker],
+  * [io.ByteScanner], and [io.RuneScanner] interfaces by reading from
+  * a byte slice.
+  * Unlike a [Buffer], a Reader is read-only and supports seeking.
+  * The zero value for Reader operates like a Reader of an empty slice.
+  */
+ interface Reader {
+ }
+ interface Reader {
+  /**
+   * Len returns the number of bytes of the unread portion of the
+   * slice.
+   */
+  len(): number
+ }
+ interface Reader {
+  /**
+   * Size returns the original length of the underlying byte slice.
+   * Size is the number of bytes available for reading via [Reader.ReadAt].
+   * The result is unaffected by any method calls except [Reader.Reset].
+   */
+  size(): number
+ }
+ interface Reader {
+  /**
+   * Read implements the [io.Reader] interface.
+   */
+  read(b: string|Array<number>): number
+ }
+ interface Reader {
+  /**
+   * ReadAt implements the [io.ReaderAt] interface.
+   */
+  readAt(b: string|Array<number>, off: number): number
+ }
+ interface Reader {
+  /**
+   * ReadByte implements the [io.ByteReader] interface.
+   */
+  readByte(): number
+ }
+ interface Reader {
+  /**
+   * UnreadByte complements [Reader.ReadByte] in implementing the [io.ByteScanner] interface.
+   */
+  unreadByte(): void
+ }
+ interface Reader {
+  /**
+   * ReadRune implements the [io.RuneReader] interface.
+   */
+  readRune(): [number, number]
+ }
+ interface Reader {
+  /**
+   * UnreadRune complements [Reader.ReadRune] in implementing the [io.RuneScanner] interface.
+   */
+  unreadRune(): void
+ }
+ interface Reader {
+  /**
+   * Seek implements the [io.Seeker] interface.
+   */
+  seek(offset: number, whence: number): number
+ }
+ interface Reader {
+  /**
+   * WriteTo implements the [io.WriterTo] interface.
+   */
+  writeTo(w: io.Writer): number
+ }
+ interface Reader {
+  /**
+   * Reset resets the [Reader] to be reading from b.
+   */
+  reset(b: string|Array<number>): void
+ }
+}
+
+/**
+ * Package syscall contains an interface to the low-level operating system
+ * primitives. The details vary depending on the underlying system, and
+ * by default, godoc will display the syscall documentation for the current
+ * system. If you want godoc to display syscall documentation for another
+ * system, set $GOOS and $GOARCH to the desired system. For example, if
+ * you want to view documentation for freebsd/arm on linux/amd64, set $GOOS
+ * to freebsd and $GOARCH to arm.
+ * The primary use of syscall is inside other packages that provide a more
+ * portable interface to the system, such as "os", "time" and "net".  Use
+ * those packages rather than this one if you can.
+ * For details of the functions and data types in this package consult
+ * the manuals for the appropriate operating system.
+ * These calls return err == nil to indicate success; otherwise
+ * err is an operating system error describing the failure.
+ * On most systems, that error has type [Errno].
+ * 
+ * NOTE: Most of the functions, types, and constants defined in
+ * this package are also available in the [golang.org/x/sys] package.
+ * That package has more system call support than this one,
+ * and most new code should prefer that package where possible.
+ * See https://golang.org/s/go1.4-syscall for more information.
+ */
+namespace syscall {
+ interface SysProcAttr {
+  chroot: string // Chroot.
+  credential?: Credential // Credential.
+  /**
+   * Ptrace tells the child to call ptrace(PTRACE_TRACEME).
+   * Call runtime.LockOSThread before starting a process with this set,
+   * and don't call UnlockOSThread until done with PtraceSyscall calls.
+   */
+  ptrace: boolean
+  setsid: boolean // Create session.
+  /**
+   * Setpgid sets the process group ID of the child to Pgid,
+   * or, if Pgid == 0, to the new child's process ID.
+   */
+  setpgid: boolean
+  /**
+   * Setctty sets the controlling terminal of the child to
+   * file descriptor Ctty. Ctty must be a descriptor number
+   * in the child process: an index into ProcAttr.Files.
+   * This is only meaningful if Setsid is true.
+   */
+  setctty: boolean
+  noctty: boolean // Detach fd 0 from controlling terminal.
+  ctty: number // Controlling TTY fd.
+  /**
+   * Foreground places the child process group in the foreground.
+   * This implies Setpgid. The Ctty field must be set to
+   * the descriptor of the controlling TTY.
+   * Unlike Setctty, in this case Ctty must be a descriptor
+   * number in the parent process.
+   */
+  foreground: boolean
+  pgid: number // Child's process group ID if Setpgid.
+  /**
+   * Pdeathsig, if non-zero, is a signal that the kernel will send to
+   * the child process when the creating thread dies. Note that the signal
+   * is sent on thread termination, which may happen before process termination.
+   * There are more details at https://go.dev/issue/27505.
+   */
+  pdeathsig: Signal
+  cloneflags: number // Flags for clone calls.
+  unshareflags: number // Flags for unshare calls.
+  uidMappings: Array<SysProcIDMap> // User ID mappings for user namespaces.
+  gidMappings: Array<SysProcIDMap> // Group ID mappings for user namespaces.
+  /**
+   * GidMappingsEnableSetgroups enabling setgroups syscall.
+   * If false, then setgroups syscall will be disabled for the child process.
+   * This parameter is no-op if GidMappings == nil. Otherwise for unprivileged
+   * users this should be set to false for mappings work.
+   */
+  gidMappingsEnableSetgroups: boolean
+  ambientCaps: Array<number> // Ambient capabilities.
+  useCgroupFD: boolean // Whether to make use of the CgroupFD field.
+  cgroupFD: number // File descriptor of a cgroup to put the new process into.
+  /**
+   * PidFD, if not nil, is used to store the pidfd of a child, if the
+   * functionality is supported by the kernel, or -1. Note *PidFD is
+   * changed only if the process starts successfully.
+   */
+  pidFD?: number
+ }
+ // @ts-ignore
+ import errorspkg = errors
+ /**
+  * A RawConn is a raw network connection.
+  */
+ interface RawConn {
+  [key:string]: any;
+  /**
+   * Control invokes f on the underlying connection's file
+   * descriptor or handle.
+   * The file descriptor fd is guaranteed to remain valid while
+   * f executes but not after f returns.
+   */
+  control(f: (fd: number) => void): void
+  /**
+   * Read invokes f on the underlying connection's file
+   * descriptor or handle; f is expected to try to read from the
+   * file descriptor.
+   * If f returns true, Read returns. Otherwise Read blocks
+   * waiting for the connection to be ready for reading and
+   * tries again repeatedly.
+   * The file descriptor is guaranteed to remain valid while f
+   * executes but not after f returns.
+   */
+  read(f: (fd: number) => boolean): void
+  /**
+   * Write is like Read but for writing.
+   */
+  write(f: (fd: number) => boolean): void
+ }
+ // @ts-ignore
+ import runtimesyscall = syscall
+ /**
+  * An Errno is an unsigned number describing an error condition.
+  * It implements the error interface. The zero Errno is by convention
+  * a non-error, so code to convert from Errno to error should use:
+  * 
+  * ```
+  * 	err = nil
+  * 	if errno != 0 {
+  * 		err = errno
+  * 	}
+  * ```
+  * 
+  * Errno values can be tested against error values using [errors.Is].
+  * For example:
+  * 
+  * ```
+  * 	_, _, err := syscall.Syscall(...)
+  * 	if errors.Is(err, fs.ErrNotExist) ...
+  * ```
+  */
+ interface Errno extends Number{}
+ interface Errno {
+  error(): string
+ }
+ interface Errno {
+  is(target: Error): boolean
+ }
+ interface Errno {
+  temporary(): boolean
+ }
+ interface Errno {
+  timeout(): boolean
+ }
+}
+
+/**
+ * Package time provides functionality for measuring and displaying time.
+ * 
+ * The calendrical calculations always assume a Gregorian calendar, with
+ * no leap seconds.
+ * 
+ * # Monotonic Clocks
+ * 
+ * Operating systems provide both a “wall clock,” which is subject to
+ * changes for clock synchronization, and a “monotonic clock,” which is
+ * not. The general rule is that the wall clock is for telling time and
+ * the monotonic clock is for measuring time. Rather than split the API,
+ * in this package the Time returned by [time.Now] contains both a wall
+ * clock reading and a monotonic clock reading; later time-telling
+ * operations use the wall clock reading, but later time-measuring
+ * operations, specifically comparisons and subtractions, use the
+ * monotonic clock reading.
+ * 
+ * For example, this code always computes a positive elapsed time of
+ * approximately 20 milliseconds, even if the wall clock is changed during
+ * the operation being timed:
+ * 
+ * ```
+ * 	start := time.Now()
+ * 	... operation that takes 20 milliseconds ...
+ * 	t := time.Now()
+ * 	elapsed := t.Sub(start)
+ * ```
+ * 
+ * Other idioms, such as [time.Since](start), [time.Until](deadline), and
+ * time.Now().Before(deadline), are similarly robust against wall clock
+ * resets.
+ * 
+ * The rest of this section gives the precise details of how operations
+ * use monotonic clocks, but understanding those details is not required
+ * to use this package.
+ * 
+ * The Time returned by time.Now contains a monotonic clock reading.
+ * If Time t has a monotonic clock reading, t.Add adds the same duration to
+ * both the wall clock and monotonic clock readings to compute the result.
+ * Because t.AddDate(y, m, d), t.Round(d), and t.Truncate(d) are wall time
+ * computations, they always strip any monotonic clock reading from their results.
+ * Because t.In, t.Local, and t.UTC are used for their effect on the interpretation
+ * of the wall time, they also strip any monotonic clock reading from their results.
+ * The canonical way to strip a monotonic clock reading is to use t = t.Round(0).
+ * 
+ * If Times t and u both contain monotonic clock readings, the operations
+ * t.After(u), t.Before(u), t.Equal(u), t.Compare(u), and t.Sub(u) are carried out
+ * using the monotonic clock readings alone, ignoring the wall clock
+ * readings. If either t or u contains no monotonic clock reading, these
+ * operations fall back to using the wall clock readings.
+ * 
+ * On some systems the monotonic clock will stop if the computer goes to sleep.
+ * On such a system, t.Sub(u) may not accurately reflect the actual
+ * time that passed between t and u. The same applies to other functions and
+ * methods that subtract times, such as [Since], [Until], [Before], [After],
+ * [Add], [Sub], [Equal] and [Compare]. In some cases, you may need to strip
+ * the monotonic clock to get accurate results.
+ * 
+ * Because the monotonic clock reading has no meaning outside
+ * the current process, the serialized forms generated by t.GobEncode,
+ * t.MarshalBinary, t.MarshalJSON, and t.MarshalText omit the monotonic
+ * clock reading, and t.Format provides no format for it. Similarly, the
+ * constructors [time.Date], [time.Parse], [time.ParseInLocation], and [time.Unix],
+ * as well as the unmarshalers t.GobDecode, t.UnmarshalBinary.
+ * t.UnmarshalJSON, and t.UnmarshalText always create times with
+ * no monotonic clock reading.
+ * 
+ * The monotonic clock reading exists only in [Time] values. It is not
+ * a part of [Duration] values or the Unix times returned by t.Unix and
+ * friends.
+ * 
+ * Note that the Go == operator compares not just the time instant but
+ * also the [Location] and the monotonic clock reading. See the
+ * documentation for the Time type for a discussion of equality
+ * testing for Time values.
+ * 
+ * For debugging, the result of t.String does include the monotonic
+ * clock reading if present. If t != u because of different monotonic clock readings,
+ * that difference will be visible when printing t.String() and u.String().
+ * 
+ * # Timer Resolution
+ * 
+ * [Timer] resolution varies depending on the Go runtime, the operating system
+ * and the underlying hardware.
+ * On Unix, the resolution is ~1ms.
+ * On Windows version 1803 and newer, the resolution is ~0.5ms.
+ * On older Windows versions, the default resolution is ~16ms, but
+ * a higher resolution may be requested using [golang.org/x/sys/windows.TimeBeginPeriod].
+ */
+namespace time {
+ interface Time {
+  /**
+   * String returns the time formatted using the format string
+   * 
+   * ```
+   * 	"2006-01-02 15:04:05.999999999 -0700 MST"
+   * ```
+   * 
+   * If the time has a monotonic clock reading, the returned string
+   * includes a final field "m=±<value>", where value is the monotonic
+   * clock reading formatted as a decimal number of seconds.
+   * 
+   * The returned string is meant for debugging; for a stable serialized
+   * representation, use t.MarshalText, t.MarshalBinary, or t.Format
+   * with an explicit format string.
+   */
+  string(): string
+ }
+ interface Time {
+  /**
+   * GoString implements [fmt.GoStringer] and formats t to be printed in Go source
+   * code.
+   */
+  goString(): string
+ }
+ interface Time {
+  /**
+   * Format returns a textual representation of the time value formatted according
+   * to the layout defined by the argument. See the documentation for the
+   * constant called [Layout] to see how to represent the layout format.
+   * 
+   * The executable example for [Time.Format] demonstrates the working
+   * of the layout string in detail and is a good reference.
+   */
+  format(layout: string): string
+ }
+ interface Time {
+  /**
+   * AppendFormat is like [Time.Format] but appends the textual
+   * representation to b and returns the extended buffer.
+   */
+  appendFormat(b: string|Array<number>, layout: string): string|Array<number>
+ }
+ /**
+  * A Time represents an instant in time with nanosecond precision.
+  * 
+  * Programs using times should typically store and pass them as values,
+  * not pointers. That is, time variables and struct fields should be of
+  * type [time.Time], not *time.Time.
+  * 
+  * A Time value can be used by multiple goroutines simultaneously except
+  * that the methods [Time.GobDecode], [Time.UnmarshalBinary], [Time.UnmarshalJSON] and
+  * [Time.UnmarshalText] are not concurrency-safe.
+  * 
+  * Time instants can be compared using the [Time.Before], [Time.After], and [Time.Equal] methods.
+  * The [Time.Sub] method subtracts two instants, producing a [Duration].
+  * The [Time.Add] method adds a Time and a Duration, producing a Time.
+  * 
+  * The zero value of type Time is January 1, year 1, 00:00:00.000000000 UTC.
+  * As this time is unlikely to come up in practice, the [Time.IsZero] method gives
+  * a simple way of detecting a time that has not been initialized explicitly.
+  * 
+  * Each time has an associated [Location]. The methods [Time.Local], [Time.UTC], and Time.In return a
+  * Time with a specific Location. Changing the Location of a Time value with
+  * these methods does not change the actual instant it represents, only the time
+  * zone in which to interpret it.
+  * 
+  * Representations of a Time value saved by the [Time.GobEncode], [Time.MarshalBinary],
+  * [Time.MarshalJSON], and [Time.MarshalText] methods store the [Time.Location]'s offset, but not
+  * the location name. They therefore lose information about Daylight Saving Time.
+  * 
+  * In addition to the required “wall clock” reading, a Time may contain an optional
+  * reading of the current process's monotonic clock, to provide additional precision
+  * for comparison or subtraction.
+  * See the “Monotonic Clocks” section in the package documentation for details.
+  * 
+  * Note that the Go == operator compares not just the time instant but also the
+  * Location and the monotonic clock reading. Therefore, Time values should not
+  * be used as map or database keys without first guaranteeing that the
+  * identical Location has been set for all values, which can be achieved
+  * through use of the UTC or Local method, and that the monotonic clock reading
+  * has been stripped by setting t = t.Round(0). In general, prefer t.Equal(u)
+  * to t == u, since t.Equal uses the most accurate comparison available and
+  * correctly handles the case when only one of its arguments has a monotonic
+  * clock reading.
+  */
+ interface Time {
+ }
+ interface Time {
+  /**
+   * After reports whether the time instant t is after u.
+   */
+  after(u: Time): boolean
+ }
+ interface Time {
+  /**
+   * Before reports whether the time instant t is before u.
+   */
+  before(u: Time): boolean
+ }
+ interface Time {
+  /**
+   * Compare compares the time instant t with u. If t is before u, it returns -1;
+   * if t is after u, it returns +1; if they're the same, it returns 0.
+   */
+  compare(u: Time): number
+ }
+ interface Time {
+  /**
+   * Equal reports whether t and u represent the same time instant.
+   * Two times can be equal even if they are in different locations.
+   * For example, 6:00 +0200 and 4:00 UTC are Equal.
+   * See the documentation on the Time type for the pitfalls of using == with
+   * Time values; most code should use Equal instead.
+   */
+  equal(u: Time): boolean
+ }
+ interface Time {
+  /**
+   * IsZero reports whether t represents the zero time instant,
+   * January 1, year 1, 00:00:00 UTC.
+   */
+  isZero(): boolean
+ }
+ interface Time {
+  /**
+   * Date returns the year, month, and day in which t occurs.
+   */
+  date(): [number, Month, number]
+ }
+ interface Time {
+  /**
+   * Year returns the year in which t occurs.
+   */
+  year(): number
+ }
+ interface Time {
+  /**
+   * Month returns the month of the year specified by t.
+   */
+  month(): Month
+ }
+ interface Time {
+  /**
+   * Day returns the day of the month specified by t.
+   */
+  day(): number
+ }
+ interface Time {
+  /**
+   * Weekday returns the day of the week specified by t.
+   */
+  weekday(): Weekday
+ }
+ interface Time {
+  /**
+   * ISOWeek returns the ISO 8601 year and week number in which t occurs.
+   * Week ranges from 1 to 53. Jan 01 to Jan 03 of year n might belong to
+   * week 52 or 53 of year n-1, and Dec 29 to Dec 31 might belong to week 1
+   * of year n+1.
+   */
+  isoWeek(): [number, number]
+ }
+ interface Time {
+  /**
+   * Clock returns the hour, minute, and second within the day specified by t.
+   */
+  clock(): [number, number, number]
+ }
+ interface Time {
+  /**
+   * Hour returns the hour within the day specified by t, in the range [0, 23].
+   */
+  hour(): number
+ }
+ interface Time {
+  /**
+   * Minute returns the minute offset within the hour specified by t, in the range [0, 59].
+   */
+  minute(): number
+ }
+ interface Time {
+  /**
+   * Second returns the second offset within the minute specified by t, in the range [0, 59].
+   */
+  second(): number
+ }
+ interface Time {
+  /**
+   * Nanosecond returns the nanosecond offset within the second specified by t,
+   * in the range [0, 999999999].
+   */
+  nanosecond(): number
+ }
+ interface Time {
+  /**
+   * YearDay returns the day of the year specified by t, in the range [1,365] for non-leap years,
+   * and [1,366] in leap years.
+   */
+  yearDay(): number
+ }
+ /**
+  * A Duration represents the elapsed time between two instants
+  * as an int64 nanosecond count. The representation limits the
+  * largest representable duration to approximately 290 years.
+  */
+ interface Duration extends Number{}
+ interface Duration {
+  /**
+   * String returns a string representing the duration in the form "72h3m0.5s".
+   * Leading zero units are omitted. As a special case, durations less than one
+   * second format use a smaller unit (milli-, micro-, or nanoseconds) to ensure
+   * that the leading digit is non-zero. The zero duration formats as 0s.
+   */
+  string(): string
+ }
+ interface Duration {
+  /**
+   * Nanoseconds returns the duration as an integer nanosecond count.
+   */
+  nanoseconds(): number
+ }
+ interface Duration {
+  /**
+   * Microseconds returns the duration as an integer microsecond count.
+   */
+  microseconds(): number
+ }
+ interface Duration {
+  /**
+   * Milliseconds returns the duration as an integer millisecond count.
+   */
+  milliseconds(): number
+ }
+ interface Duration {
+  /**
+   * Seconds returns the duration as a floating point number of seconds.
+   */
+  seconds(): number
+ }
+ interface Duration {
+  /**
+   * Minutes returns the duration as a floating point number of minutes.
+   */
+  minutes(): number
+ }
+ interface Duration {
+  /**
+   * Hours returns the duration as a floating point number of hours.
+   */
+  hours(): number
+ }
+ interface Duration {
+  /**
+   * Truncate returns the result of rounding d toward zero to a multiple of m.
+   * If m <= 0, Truncate returns d unchanged.
+   */
+  truncate(m: Duration): Duration
+ }
+ interface Duration {
+  /**
+   * Round returns the result of rounding d to the nearest multiple of m.
+   * The rounding behavior for halfway values is to round away from zero.
+   * If the result exceeds the maximum (or minimum)
+   * value that can be stored in a [Duration],
+   * Round returns the maximum (or minimum) duration.
+   * If m <= 0, Round returns d unchanged.
+   */
+  round(m: Duration): Duration
+ }
+ interface Duration {
+  /**
+   * Abs returns the absolute value of d.
+   * As a special case, [math.MinInt64] is converted to [math.MaxInt64].
+   */
+  abs(): Duration
+ }
+ interface Time {
+  /**
+   * Add returns the time t+d.
+   */
+  add(d: Duration): Time
+ }
+ interface Time {
+  /**
+   * Sub returns the duration t-u. If the result exceeds the maximum (or minimum)
+   * value that can be stored in a [Duration], the maximum (or minimum) duration
+   * will be returned.
+   * To compute t-d for a duration d, use t.Add(-d).
+   */
+  sub(u: Time): Duration
+ }
+ interface Time {
+  /**
+   * AddDate returns the time corresponding to adding the
+   * given number of years, months, and days to t.
+   * For example, AddDate(-1, 2, 3) applied to January 1, 2011
+   * returns March 4, 2010.
+   * 
+   * Note that dates are fundamentally coupled to timezones, and calendrical
+   * periods like days don't have fixed durations. AddDate uses the Location of
+   * the Time value to determine these durations. That means that the same
+   * AddDate arguments can produce a different shift in absolute time depending on
+   * the base Time value and its Location. For example, AddDate(0, 0, 1) applied
+   * to 12:00 on March 27 always returns 12:00 on March 28. At some locations and
+   * in some years this is a 24 hour shift. In others it's a 23 hour shift due to
+   * daylight savings time transitions.
+   * 
+   * AddDate normalizes its result in the same way that Date does,
+   * so, for example, adding one month to October 31 yields
+   * December 1, the normalized form for November 31.
+   */
+  addDate(years: number, months: number, days: number): Time
+ }
+ interface Time {
+  /**
+   * UTC returns t with the location set to UTC.
+   */
+  utc(): Time
+ }
+ interface Time {
+  /**
+   * Local returns t with the location set to local time.
+   */
+  local(): Time
+ }
+ interface Time {
+  /**
+   * In returns a copy of t representing the same time instant, but
+   * with the copy's location information set to loc for display
+   * purposes.
+   * 
+   * In panics if loc is nil.
+   */
+  in(loc: Location): Time
+ }
+ interface Time {
+  /**
+   * Location returns the time zone information associated with t.
+   */
+  location(): (Location)
+ }
+ interface Time {
+  /**
+   * Zone computes the time zone in effect at time t, returning the abbreviated
+   * name of the zone (such as "CET") and its offset in seconds east of UTC.
+   */
+  zone(): [string, number]
+ }
+ interface Time {
+  /**
+   * ZoneBounds returns the bounds of the time zone in effect at time t.
+   * The zone begins at start and the next zone begins at end.
+   * If the zone begins at the beginning of time, start will be returned as a zero Time.
+   * If the zone goes on forever, end will be returned as a zero Time.
+   * The Location of the returned times will be the same as t.
+   */
+  zoneBounds(): [Time, Time]
+ }
+ interface Time {
+  /**
+   * Unix returns t as a Unix time, the number of seconds elapsed
+   * since January 1, 1970 UTC. The result does not depend on the
+   * location associated with t.
+   * Unix-like operating systems often record time as a 32-bit
+   * count of seconds, but since the method here returns a 64-bit
+   * value it is valid for billions of years into the past or future.
+   */
+  unix(): number
+ }
+ interface Time {
+  /**
+   * UnixMilli returns t as a Unix time, the number of milliseconds elapsed since
+   * January 1, 1970 UTC. The result is undefined if the Unix time in
+   * milliseconds cannot be represented by an int64 (a date more than 292 million
+   * years before or after 1970). The result does not depend on the
+   * location associated with t.
+   */
+  unixMilli(): number
+ }
+ interface Time {
+  /**
+   * UnixMicro returns t as a Unix time, the number of microseconds elapsed since
+   * January 1, 1970 UTC. The result is undefined if the Unix time in
+   * microseconds cannot be represented by an int64 (a date before year -290307 or
+   * after year 294246). The result does not depend on the location associated
+   * with t.
+   */
+  unixMicro(): number
+ }
+ interface Time {
+  /**
+   * UnixNano returns t as a Unix time, the number of nanoseconds elapsed
+   * since January 1, 1970 UTC. The result is undefined if the Unix time
+   * in nanoseconds cannot be represented by an int64 (a date before the year
+   * 1678 or after 2262). Note that this means the result of calling UnixNano
+   * on the zero Time is undefined. The result does not depend on the
+   * location associated with t.
+   */
+  unixNano(): number
+ }
+ interface Time {
+  /**
+   * MarshalBinary implements the encoding.BinaryMarshaler interface.
+   */
+  marshalBinary(): string|Array<number>
+ }
+ interface Time {
+  /**
+   * UnmarshalBinary implements the encoding.BinaryUnmarshaler interface.
+   */
+  unmarshalBinary(data: string|Array<number>): void
+ }
+ interface Time {
+  /**
+   * GobEncode implements the gob.GobEncoder interface.
+   */
+  gobEncode(): string|Array<number>
+ }
+ interface Time {
+  /**
+   * GobDecode implements the gob.GobDecoder interface.
+   */
+  gobDecode(data: string|Array<number>): void
+ }
+ interface Time {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * The time is a quoted string in the RFC 3339 format with sub-second precision.
+   * If the timestamp cannot be represented as valid RFC 3339
+   * (e.g., the year is out of range), then an error is reported.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface Time {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   * The time must be a quoted string in the RFC 3339 format.
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface Time {
+  /**
+   * MarshalText implements the [encoding.TextMarshaler] interface.
+   * The time is formatted in RFC 3339 format with sub-second precision.
+   * If the timestamp cannot be represented as valid RFC 3339
+   * (e.g., the year is out of range), then an error is reported.
+   */
+  marshalText(): string|Array<number>
+ }
+ interface Time {
+  /**
+   * UnmarshalText implements the [encoding.TextUnmarshaler] interface.
+   * The time must be in the RFC 3339 format.
+   */
+  unmarshalText(data: string|Array<number>): void
+ }
+ interface Time {
+  /**
+   * IsDST reports whether the time in the configured location is in Daylight Savings Time.
+   */
+  isDST(): boolean
+ }
+ interface Time {
+  /**
+   * Truncate returns the result of rounding t down to a multiple of d (since the zero time).
+   * If d <= 0, Truncate returns t stripped of any monotonic clock reading but otherwise unchanged.
+   * 
+   * Truncate operates on the time as an absolute duration since the
+   * zero time; it does not operate on the presentation form of the
+   * time. Thus, Truncate(Hour) may return a time with a non-zero
+   * minute, depending on the time's Location.
+   */
+  truncate(d: Duration): Time
+ }
+ interface Time {
+  /**
+   * Round returns the result of rounding t to the nearest multiple of d (since the zero time).
+   * The rounding behavior for halfway values is to round up.
+   * If d <= 0, Round returns t stripped of any monotonic clock reading but otherwise unchanged.
+   * 
+   * Round operates on the time as an absolute duration since the
+   * zero time; it does not operate on the presentation form of the
+   * time. Thus, Round(Hour) may return a time with a non-zero
+   * minute, depending on the time's Location.
+   */
+  round(d: Duration): Time
+ }
+}
+
+/**
+ * Package fs defines basic interfaces to a file system.
+ * A file system can be provided by the host operating system
+ * but also by other packages.
+ * 
+ * See the [testing/fstest] package for support with testing
+ * implementations of file systems.
+ */
+namespace fs {
+ /**
+  * An FS provides access to a hierarchical file system.
+  * 
+  * The FS interface is the minimum implementation required of the file system.
+  * A file system may implement additional interfaces,
+  * such as [ReadFileFS], to provide additional or optimized functionality.
+  * 
+  * [testing/fstest.TestFS] may be used to test implementations of an FS for
+  * correctness.
+  */
+ interface FS {
+  [key:string]: any;
+  /**
+   * Open opens the named file.
+   * 
+   * When Open returns an error, it should be of type *PathError
+   * with the Op field set to "open", the Path field set to name,
+   * and the Err field describing the problem.
+   * 
+   * Open should reject attempts to open names that do not satisfy
+   * ValidPath(name), returning a *PathError with Err set to
+   * ErrInvalid or ErrNotExist.
+   */
+  open(name: string): File
+ }
+ /**
+  * A File provides access to a single file.
+  * The File interface is the minimum implementation required of the file.
+  * Directory files should also implement [ReadDirFile].
+  * A file may implement [io.ReaderAt] or [io.Seeker] as optimizations.
+  */
+ interface File {
+  [key:string]: any;
+  stat(): FileInfo
+  read(_arg0: string|Array<number>): number
+  close(): void
+ }
+ /**
+  * A DirEntry is an entry read from a directory
+  * (using the [ReadDir] function or a [ReadDirFile]'s ReadDir method).
+  */
+ interface DirEntry {
+  [key:string]: any;
+  /**
+   * Name returns the name of the file (or subdirectory) described by the entry.
+   * This name is only the final element of the path (the base name), not the entire path.
+   * For example, Name would return "hello.go" not "home/gopher/hello.go".
+   */
+  name(): string
+  /**
+   * IsDir reports whether the entry describes a directory.
+   */
+  isDir(): boolean
+  /**
+   * Type returns the type bits for the entry.
+   * The type bits are a subset of the usual FileMode bits, those returned by the FileMode.Type method.
+   */
+  type(): FileMode
+  /**
+   * Info returns the FileInfo for the file or subdirectory described by the entry.
+   * The returned FileInfo may be from the time of the original directory read
+   * or from the time of the call to Info. If the file has been removed or renamed
+   * since the directory read, Info may return an error satisfying errors.Is(err, ErrNotExist).
+   * If the entry denotes a symbolic link, Info reports the information about the link itself,
+   * not the link's target.
+   */
+  info(): FileInfo
+ }
+ /**
+  * A FileInfo describes a file and is returned by [Stat].
+  */
+ interface FileInfo {
+  [key:string]: any;
+  name(): string // base name of the file
+  size(): number // length in bytes for regular files; system-dependent for others
+  mode(): FileMode // file mode bits
+  modTime(): time.Time // modification time
+  isDir(): boolean // abbreviation for Mode().IsDir()
+  sys(): any // underlying data source (can return nil)
+ }
+ /**
+  * A FileMode represents a file's mode and permission bits.
+  * The bits have the same definition on all systems, so that
+  * information about files can be moved from one system
+  * to another portably. Not all bits apply to all systems.
+  * The only required bit is [ModeDir] for directories.
+  */
+ interface FileMode extends Number{}
+ interface FileMode {
+  string(): string
+ }
+ interface FileMode {
+  /**
+   * IsDir reports whether m describes a directory.
+   * That is, it tests for the [ModeDir] bit being set in m.
+   */
+  isDir(): boolean
+ }
+ interface FileMode {
+  /**
+   * IsRegular reports whether m describes a regular file.
+   * That is, it tests that no mode type bits are set.
+   */
+  isRegular(): boolean
+ }
+ interface FileMode {
+  /**
+   * Perm returns the Unix permission bits in m (m & [ModePerm]).
+   */
+  perm(): FileMode
+ }
+ interface FileMode {
+  /**
+   * Type returns type bits in m (m & [ModeType]).
+   */
+  type(): FileMode
+ }
+ /**
+  * PathError records an error and the operation and file path that caused it.
+  */
+ interface PathError {
+  op: string
+  path: string
+  err: Error
+ }
+ interface PathError {
+  error(): string
+ }
+ interface PathError {
+  unwrap(): void
+ }
+ interface PathError {
+  /**
+   * Timeout reports whether this error represents a timeout.
+   */
+  timeout(): boolean
+ }
+ /**
+  * WalkDirFunc is the type of the function called by [WalkDir] to visit
+  * each file or directory.
+  * 
+  * The path argument contains the argument to [WalkDir] as a prefix.
+  * That is, if WalkDir is called with root argument "dir" and finds a file
+  * named "a" in that directory, the walk function will be called with
+  * argument "dir/a".
+  * 
+  * The d argument is the [DirEntry] for the named path.
+  * 
+  * The error result returned by the function controls how [WalkDir]
+  * continues. If the function returns the special value [SkipDir], WalkDir
+  * skips the current directory (path if d.IsDir() is true, otherwise
+  * path's parent directory). If the function returns the special value
+  * [SkipAll], WalkDir skips all remaining files and directories. Otherwise,
+  * if the function returns a non-nil error, WalkDir stops entirely and
+  * returns that error.
+  * 
+  * The err argument reports an error related to path, signaling that
+  * [WalkDir] will not walk into that directory. The function can decide how
+  * to handle that error; as described earlier, returning the error will
+  * cause WalkDir to stop walking the entire tree.
+  * 
+  * [WalkDir] calls the function with a non-nil err argument in two cases.
+  * 
+  * First, if the initial [Stat] on the root directory fails, WalkDir
+  * calls the function with path set to root, d set to nil, and err set to
+  * the error from [fs.Stat].
+  * 
+  * Second, if a directory's ReadDir method (see [ReadDirFile]) fails, WalkDir calls the
+  * function with path set to the directory's path, d set to an
+  * [DirEntry] describing the directory, and err set to the error from
+  * ReadDir. In this second case, the function is called twice with the
+  * path of the directory: the first call is before the directory read is
+  * attempted and has err set to nil, giving the function a chance to
+  * return [SkipDir] or [SkipAll] and avoid the ReadDir entirely. The second call
+  * is after a failed ReadDir and reports the error from ReadDir.
+  * (If ReadDir succeeds, there is no second call.)
+  * 
+  * The differences between WalkDirFunc compared to [path/filepath.WalkFunc] are:
+  * 
+  * ```
+  *   - The second argument has type [DirEntry] instead of [FileInfo].
+  *   - The function is called before reading a directory, to allow [SkipDir]
+  *     or [SkipAll] to bypass the directory read entirely or skip all remaining
+  *     files and directories respectively.
+  *   - If a directory read fails, the function is called a second time
+  *     for that directory to report the error.
+  * ```
+  */
+ interface WalkDirFunc {(path: string, d: DirEntry, err: Error): void }
+}
+
+/**
+ * Package context defines the Context type, which carries deadlines,
+ * cancellation signals, and other request-scoped values across API boundaries
+ * and between processes.
+ * 
+ * Incoming requests to a server should create a [Context], and outgoing
+ * calls to servers should accept a Context. The chain of function
+ * calls between them must propagate the Context, optionally replacing
+ * it with a derived Context created using [WithCancel], [WithDeadline],
+ * [WithTimeout], or [WithValue]. When a Context is canceled, all
+ * Contexts derived from it are also canceled.
+ * 
+ * The [WithCancel], [WithDeadline], and [WithTimeout] functions take a
+ * Context (the parent) and return a derived Context (the child) and a
+ * [CancelFunc]. Calling the CancelFunc cancels the child and its
+ * children, removes the parent's reference to the child, and stops
+ * any associated timers. Failing to call the CancelFunc leaks the
+ * child and its children until the parent is canceled or the timer
+ * fires. The go vet tool checks that CancelFuncs are used on all
+ * control-flow paths.
+ * 
+ * The [WithCancelCause] function returns a [CancelCauseFunc], which
+ * takes an error and records it as the cancellation cause. Calling
+ * [Cause] on the canceled context or any of its children retrieves
+ * the cause. If no cause is specified, Cause(ctx) returns the same
+ * value as ctx.Err().
+ * 
+ * Programs that use Contexts should follow these rules to keep interfaces
+ * consistent across packages and enable static analysis tools to check context
+ * propagation:
+ * 
+ * Do not store Contexts inside a struct type; instead, pass a Context
+ * explicitly to each function that needs it. The Context should be the first
+ * parameter, typically named ctx:
+ * 
+ * ```
+ * 	func DoSomething(ctx context.Context, arg Arg) error {
+ * 		// ... use ctx ...
+ * 	}
+ * ```
+ * 
+ * Do not pass a nil [Context], even if a function permits it. Pass [context.TODO]
+ * if you are unsure about which Context to use.
+ * 
+ * Use context Values only for request-scoped data that transits processes and
+ * APIs, not for passing optional parameters to functions.
+ * 
+ * The same Context may be passed to functions running in different goroutines;
+ * Contexts are safe for simultaneous use by multiple goroutines.
+ * 
+ * See https://blog.golang.org/context for example code for a server that uses
+ * Contexts.
+ */
+namespace context {
+ /**
+  * A Context carries a deadline, a cancellation signal, and other values across
+  * API boundaries.
+  * 
+  * Context's methods may be called by multiple goroutines simultaneously.
+  */
+ interface Context {
+  [key:string]: any;
+  /**
+   * Deadline returns the time when work done on behalf of this context
+   * should be canceled. Deadline returns ok==false when no deadline is
+   * set. Successive calls to Deadline return the same results.
+   */
+  deadline(): [time.Time, boolean]
+  /**
+   * Done returns a channel that's closed when work done on behalf of this
+   * context should be canceled. Done may return nil if this context can
+   * never be canceled. Successive calls to Done return the same value.
+   * The close of the Done channel may happen asynchronously,
+   * after the cancel function returns.
+   * 
+   * WithCancel arranges for Done to be closed when cancel is called;
+   * WithDeadline arranges for Done to be closed when the deadline
+   * expires; WithTimeout arranges for Done to be closed when the timeout
+   * elapses.
+   * 
+   * Done is provided for use in select statements:
+   * 
+   *  // Stream generates values with DoSomething and sends them to out
+   *  // until DoSomething returns an error or ctx.Done is closed.
+   *  func Stream(ctx context.Context, out chan<- Value) error {
+   *  	for {
+   *  		v, err := DoSomething(ctx)
+   *  		if err != nil {
+   *  			return err
+   *  		}
+   *  		select {
+   *  		case <-ctx.Done():
+   *  			return ctx.Err()
+   *  		case out <- v:
+   *  		}
+   *  	}
+   *  }
+   * 
+   * See https://blog.golang.org/pipelines for more examples of how to use
+   * a Done channel for cancellation.
+   */
+  done(): undefined
+  /**
+   * If Done is not yet closed, Err returns nil.
+   * If Done is closed, Err returns a non-nil error explaining why:
+   * Canceled if the context was canceled
+   * or DeadlineExceeded if the context's deadline passed.
+   * After Err returns a non-nil error, successive calls to Err return the same error.
+   */
+  err(): void
+  /**
+   * Value returns the value associated with this context for key, or nil
+   * if no value is associated with key. Successive calls to Value with
+   * the same key returns the same result.
+   * 
+   * Use context values only for request-scoped data that transits
+   * processes and API boundaries, not for passing optional parameters to
+   * functions.
+   * 
+   * A key identifies a specific value in a Context. Functions that wish
+   * to store values in Context typically allocate a key in a global
+   * variable then use that key as the argument to context.WithValue and
+   * Context.Value. A key can be any type that supports equality;
+   * packages should define keys as an unexported type to avoid
+   * collisions.
+   * 
+   * Packages that define a Context key should provide type-safe accessors
+   * for the values stored using that key:
+   * 
+   * ```
+   * 	// Package user defines a User type that's stored in Contexts.
+   * 	package user
+   * 
+   * 	import "context"
+   * 
+   * 	// User is the type of value stored in the Contexts.
+   * 	type User struct {...}
+   * 
+   * 	// key is an unexported type for keys defined in this package.
+   * 	// This prevents collisions with keys defined in other packages.
+   * 	type key int
+   * 
+   * 	// userKey is the key for user.User values in Contexts. It is
+   * 	// unexported; clients use user.NewContext and user.FromContext
+   * 	// instead of using this key directly.
+   * 	var userKey key
+   * 
+   * 	// NewContext returns a new Context that carries value u.
+   * 	func NewContext(ctx context.Context, u *User) context.Context {
+   * 		return context.WithValue(ctx, userKey, u)
+   * 	}
+   * 
+   * 	// FromContext returns the User value stored in ctx, if any.
+   * 	func FromContext(ctx context.Context) (*User, bool) {
+   * 		u, ok := ctx.Value(userKey).(*User)
+   * 		return u, ok
+   * 	}
+   * ```
+   */
+  value(key: any): any
+ }
+}
+
+/**
+ * Package sql provides a generic interface around SQL (or SQL-like)
+ * databases.
+ * 
+ * The sql package must be used in conjunction with a database driver.
+ * See https://golang.org/s/sqldrivers for a list of drivers.
+ * 
+ * Drivers that do not support context cancellation will not return until
+ * after the query is completed.
+ * 
+ * For usage examples, see the wiki page at
+ * https://golang.org/s/sqlwiki.
+ */
+namespace sql {
+ /**
+  * TxOptions holds the transaction options to be used in [DB.BeginTx].
+  */
+ interface TxOptions {
+  /**
+   * Isolation is the transaction isolation level.
+   * If zero, the driver or database's default level is used.
+   */
+  isolation: IsolationLevel
+  readOnly: boolean
+ }
+ /**
+  * NullString represents a string that may be null.
+  * NullString implements the [Scanner] interface so
+  * it can be used as a scan destination:
+  * 
+  * ```
+  * 	var s NullString
+  * 	err := db.QueryRow("SELECT name FROM foo WHERE id=?", id).Scan(&s)
+  * 	...
+  * 	if s.Valid {
+  * 	   // use s.String
+  * 	} else {
+  * 	   // NULL value
+  * 	}
+  * ```
+  */
+ interface NullString {
+  string: string
+  valid: boolean // Valid is true if String is not NULL
+ }
+ interface NullString {
+  /**
+   * Scan implements the [Scanner] interface.
+   */
+  scan(value: any): void
+ }
+ interface NullString {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ /**
+  * DB is a database handle representing a pool of zero or more
+  * underlying connections. It's safe for concurrent use by multiple
+  * goroutines.
+  * 
+  * The sql package creates and frees connections automatically; it
+  * also maintains a free pool of idle connections. If the database has
+  * a concept of per-connection state, such state can be reliably observed
+  * within a transaction ([Tx]) or connection ([Conn]). Once [DB.Begin] is called, the
+  * returned [Tx] is bound to a single connection. Once [Tx.Commit] or
+  * [Tx.Rollback] is called on the transaction, that transaction's
+  * connection is returned to [DB]'s idle connection pool. The pool size
+  * can be controlled with [DB.SetMaxIdleConns].
+  */
+ interface DB {
+ }
+ interface DB {
+  /**
+   * PingContext verifies a connection to the database is still alive,
+   * establishing a connection if necessary.
+   */
+  pingContext(ctx: context.Context): void
+ }
+ interface DB {
+  /**
+   * Ping verifies a connection to the database is still alive,
+   * establishing a connection if necessary.
+   * 
+   * Ping uses [context.Background] internally; to specify the context, use
+   * [DB.PingContext].
+   */
+  ping(): void
+ }
+ interface DB {
+  /**
+   * Close closes the database and prevents new queries from starting.
+   * Close then waits for all queries that have started processing on the server
+   * to finish.
+   * 
+   * It is rare to Close a [DB], as the [DB] handle is meant to be
+   * long-lived and shared between many goroutines.
+   */
+  close(): void
+ }
+ interface DB {
+  /**
+   * SetMaxIdleConns sets the maximum number of connections in the idle
+   * connection pool.
+   * 
+   * If MaxOpenConns is greater than 0 but less than the new MaxIdleConns,
+   * then the new MaxIdleConns will be reduced to match the MaxOpenConns limit.
+   * 
+   * If n <= 0, no idle connections are retained.
+   * 
+   * The default max idle connections is currently 2. This may change in
+   * a future release.
+   */
+  setMaxIdleConns(n: number): void
+ }
+ interface DB {
+  /**
+   * SetMaxOpenConns sets the maximum number of open connections to the database.
+   * 
+   * If MaxIdleConns is greater than 0 and the new MaxOpenConns is less than
+   * MaxIdleConns, then MaxIdleConns will be reduced to match the new
+   * MaxOpenConns limit.
+   * 
+   * If n <= 0, then there is no limit on the number of open connections.
+   * The default is 0 (unlimited).
+   */
+  setMaxOpenConns(n: number): void
+ }
+ interface DB {
+  /**
+   * SetConnMaxLifetime sets the maximum amount of time a connection may be reused.
+   * 
+   * Expired connections may be closed lazily before reuse.
+   * 
+   * If d <= 0, connections are not closed due to a connection's age.
+   */
+  setConnMaxLifetime(d: time.Duration): void
+ }
+ interface DB {
+  /**
+   * SetConnMaxIdleTime sets the maximum amount of time a connection may be idle.
+   * 
+   * Expired connections may be closed lazily before reuse.
+   * 
+   * If d <= 0, connections are not closed due to a connection's idle time.
+   */
+  setConnMaxIdleTime(d: time.Duration): void
+ }
+ interface DB {
+  /**
+   * Stats returns database statistics.
+   */
+  stats(): DBStats
+ }
+ interface DB {
+  /**
+   * PrepareContext creates a prepared statement for later queries or executions.
+   * Multiple queries or executions may be run concurrently from the
+   * returned statement.
+   * The caller must call the statement's [*Stmt.Close] method
+   * when the statement is no longer needed.
+   * 
+   * The provided context is used for the preparation of the statement, not for the
+   * execution of the statement.
+   */
+  prepareContext(ctx: context.Context, query: string): (Stmt)
+ }
+ interface DB {
+  /**
+   * Prepare creates a prepared statement for later queries or executions.
+   * Multiple queries or executions may be run concurrently from the
+   * returned statement.
+   * The caller must call the statement's [*Stmt.Close] method
+   * when the statement is no longer needed.
+   * 
+   * Prepare uses [context.Background] internally; to specify the context, use
+   * [DB.PrepareContext].
+   */
+  prepare(query: string): (Stmt)
+ }
+ interface DB {
+  /**
+   * ExecContext executes a query without returning any rows.
+   * The args are for any placeholder parameters in the query.
+   */
+  execContext(ctx: context.Context, query: string, ...args: any[]): Result
+ }
+ interface DB {
+  /**
+   * Exec executes a query without returning any rows.
+   * The args are for any placeholder parameters in the query.
+   * 
+   * Exec uses [context.Background] internally; to specify the context, use
+   * [DB.ExecContext].
+   */
+  exec(query: string, ...args: any[]): Result
+ }
+ interface DB {
+  /**
+   * QueryContext executes a query that returns rows, typically a SELECT.
+   * The args are for any placeholder parameters in the query.
+   */
+  queryContext(ctx: context.Context, query: string, ...args: any[]): (Rows)
+ }
+ interface DB {
+  /**
+   * Query executes a query that returns rows, typically a SELECT.
+   * The args are for any placeholder parameters in the query.
+   * 
+   * Query uses [context.Background] internally; to specify the context, use
+   * [DB.QueryContext].
+   */
+  query(query: string, ...args: any[]): (Rows)
+ }
+ interface DB {
+  /**
+   * QueryRowContext executes a query that is expected to return at most one row.
+   * QueryRowContext always returns a non-nil value. Errors are deferred until
+   * [Row]'s Scan method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   */
+  queryRowContext(ctx: context.Context, query: string, ...args: any[]): (Row)
+ }
+ interface DB {
+  /**
+   * QueryRow executes a query that is expected to return at most one row.
+   * QueryRow always returns a non-nil value. Errors are deferred until
+   * [Row]'s Scan method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   * 
+   * QueryRow uses [context.Background] internally; to specify the context, use
+   * [DB.QueryRowContext].
+   */
+  queryRow(query: string, ...args: any[]): (Row)
+ }
+ interface DB {
+  /**
+   * BeginTx starts a transaction.
+   * 
+   * The provided context is used until the transaction is committed or rolled back.
+   * If the context is canceled, the sql package will roll back
+   * the transaction. [Tx.Commit] will return an error if the context provided to
+   * BeginTx is canceled.
+   * 
+   * The provided [TxOptions] is optional and may be nil if defaults should be used.
+   * If a non-default isolation level is used that the driver doesn't support,
+   * an error will be returned.
+   */
+  beginTx(ctx: context.Context, opts: TxOptions): (Tx)
+ }
+ interface DB {
+  /**
+   * Begin starts a transaction. The default isolation level is dependent on
+   * the driver.
+   * 
+   * Begin uses [context.Background] internally; to specify the context, use
+   * [DB.BeginTx].
+   */
+  begin(): (Tx)
+ }
+ interface DB {
+  /**
+   * Driver returns the database's underlying driver.
+   */
+  driver(): any
+ }
+ interface DB {
+  /**
+   * Conn returns a single connection by either opening a new connection
+   * or returning an existing connection from the connection pool. Conn will
+   * block until either a connection is returned or ctx is canceled.
+   * Queries run on the same Conn will be run in the same database session.
+   * 
+   * Every Conn must be returned to the database pool after use by
+   * calling [Conn.Close].
+   */
+  conn(ctx: context.Context): (Conn)
+ }
+ /**
+  * Tx is an in-progress database transaction.
+  * 
+  * A transaction must end with a call to [Tx.Commit] or [Tx.Rollback].
+  * 
+  * After a call to [Tx.Commit] or [Tx.Rollback], all operations on the
+  * transaction fail with [ErrTxDone].
+  * 
+  * The statements prepared for a transaction by calling
+  * the transaction's [Tx.Prepare] or [Tx.Stmt] methods are closed
+  * by the call to [Tx.Commit] or [Tx.Rollback].
+  */
+ interface Tx {
+ }
+ interface Tx {
+  /**
+   * Commit commits the transaction.
+   */
+  commit(): void
+ }
+ interface Tx {
+  /**
+   * Rollback aborts the transaction.
+   */
+  rollback(): void
+ }
+ interface Tx {
+  /**
+   * PrepareContext creates a prepared statement for use within a transaction.
+   * 
+   * The returned statement operates within the transaction and will be closed
+   * when the transaction has been committed or rolled back.
+   * 
+   * To use an existing prepared statement on this transaction, see [Tx.Stmt].
+   * 
+   * The provided context will be used for the preparation of the context, not
+   * for the execution of the returned statement. The returned statement
+   * will run in the transaction context.
+   */
+  prepareContext(ctx: context.Context, query: string): (Stmt)
+ }
+ interface Tx {
+  /**
+   * Prepare creates a prepared statement for use within a transaction.
+   * 
+   * The returned statement operates within the transaction and will be closed
+   * when the transaction has been committed or rolled back.
+   * 
+   * To use an existing prepared statement on this transaction, see [Tx.Stmt].
+   * 
+   * Prepare uses [context.Background] internally; to specify the context, use
+   * [Tx.PrepareContext].
+   */
+  prepare(query: string): (Stmt)
+ }
+ interface Tx {
+  /**
+   * StmtContext returns a transaction-specific prepared statement from
+   * an existing statement.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	updateMoney, err := db.Prepare("UPDATE balance SET money=money+? WHERE id=?")
+   * 	...
+   * 	tx, err := db.Begin()
+   * 	...
+   * 	res, err := tx.StmtContext(ctx, updateMoney).Exec(123.45, 98293203)
+   * ```
+   * 
+   * The provided context is used for the preparation of the statement, not for the
+   * execution of the statement.
+   * 
+   * The returned statement operates within the transaction and will be closed
+   * when the transaction has been committed or rolled back.
+   */
+  stmtContext(ctx: context.Context, stmt: Stmt): (Stmt)
+ }
+ interface Tx {
+  /**
+   * Stmt returns a transaction-specific prepared statement from
+   * an existing statement.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	updateMoney, err := db.Prepare("UPDATE balance SET money=money+? WHERE id=?")
+   * 	...
+   * 	tx, err := db.Begin()
+   * 	...
+   * 	res, err := tx.Stmt(updateMoney).Exec(123.45, 98293203)
+   * ```
+   * 
+   * The returned statement operates within the transaction and will be closed
+   * when the transaction has been committed or rolled back.
+   * 
+   * Stmt uses [context.Background] internally; to specify the context, use
+   * [Tx.StmtContext].
+   */
+  stmt(stmt: Stmt): (Stmt)
+ }
+ interface Tx {
+  /**
+   * ExecContext executes a query that doesn't return rows.
+   * For example: an INSERT and UPDATE.
+   */
+  execContext(ctx: context.Context, query: string, ...args: any[]): Result
+ }
+ interface Tx {
+  /**
+   * Exec executes a query that doesn't return rows.
+   * For example: an INSERT and UPDATE.
+   * 
+   * Exec uses [context.Background] internally; to specify the context, use
+   * [Tx.ExecContext].
+   */
+  exec(query: string, ...args: any[]): Result
+ }
+ interface Tx {
+  /**
+   * QueryContext executes a query that returns rows, typically a SELECT.
+   */
+  queryContext(ctx: context.Context, query: string, ...args: any[]): (Rows)
+ }
+ interface Tx {
+  /**
+   * Query executes a query that returns rows, typically a SELECT.
+   * 
+   * Query uses [context.Background] internally; to specify the context, use
+   * [Tx.QueryContext].
+   */
+  query(query: string, ...args: any[]): (Rows)
+ }
+ interface Tx {
+  /**
+   * QueryRowContext executes a query that is expected to return at most one row.
+   * QueryRowContext always returns a non-nil value. Errors are deferred until
+   * [Row]'s Scan method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   */
+  queryRowContext(ctx: context.Context, query: string, ...args: any[]): (Row)
+ }
+ interface Tx {
+  /**
+   * QueryRow executes a query that is expected to return at most one row.
+   * QueryRow always returns a non-nil value. Errors are deferred until
+   * [Row]'s Scan method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   * 
+   * QueryRow uses [context.Background] internally; to specify the context, use
+   * [Tx.QueryRowContext].
+   */
+  queryRow(query: string, ...args: any[]): (Row)
+ }
+ /**
+  * Stmt is a prepared statement.
+  * A Stmt is safe for concurrent use by multiple goroutines.
+  * 
+  * If a Stmt is prepared on a [Tx] or [Conn], it will be bound to a single
+  * underlying connection forever. If the [Tx] or [Conn] closes, the Stmt will
+  * become unusable and all operations will return an error.
+  * If a Stmt is prepared on a [DB], it will remain usable for the lifetime of the
+  * [DB]. When the Stmt needs to execute on a new underlying connection, it will
+  * prepare itself on the new connection automatically.
+  */
+ interface Stmt {
+ }
+ interface Stmt {
+  /**
+   * ExecContext executes a prepared statement with the given arguments and
+   * returns a [Result] summarizing the effect of the statement.
+   */
+  execContext(ctx: context.Context, ...args: any[]): Result
+ }
+ interface Stmt {
+  /**
+   * Exec executes a prepared statement with the given arguments and
+   * returns a [Result] summarizing the effect of the statement.
+   * 
+   * Exec uses [context.Background] internally; to specify the context, use
+   * [Stmt.ExecContext].
+   */
+  exec(...args: any[]): Result
+ }
+ interface Stmt {
+  /**
+   * QueryContext executes a prepared query statement with the given arguments
+   * and returns the query results as a [*Rows].
+   */
+  queryContext(ctx: context.Context, ...args: any[]): (Rows)
+ }
+ interface Stmt {
+  /**
+   * Query executes a prepared query statement with the given arguments
+   * and returns the query results as a *Rows.
+   * 
+   * Query uses [context.Background] internally; to specify the context, use
+   * [Stmt.QueryContext].
+   */
+  query(...args: any[]): (Rows)
+ }
+ interface Stmt {
+  /**
+   * QueryRowContext executes a prepared query statement with the given arguments.
+   * If an error occurs during the execution of the statement, that error will
+   * be returned by a call to Scan on the returned [*Row], which is always non-nil.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   */
+  queryRowContext(ctx: context.Context, ...args: any[]): (Row)
+ }
+ interface Stmt {
+  /**
+   * QueryRow executes a prepared query statement with the given arguments.
+   * If an error occurs during the execution of the statement, that error will
+   * be returned by a call to Scan on the returned [*Row], which is always non-nil.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	var name string
+   * 	err := nameByUseridStmt.QueryRow(id).Scan(&name)
+   * ```
+   * 
+   * QueryRow uses [context.Background] internally; to specify the context, use
+   * [Stmt.QueryRowContext].
+   */
+  queryRow(...args: any[]): (Row)
+ }
+ interface Stmt {
+  /**
+   * Close closes the statement.
+   */
+  close(): void
+ }
+ /**
+  * Rows is the result of a query. Its cursor starts before the first row
+  * of the result set. Use [Rows.Next] to advance from row to row.
+  */
+ interface Rows {
+ }
+ interface Rows {
+  /**
+   * Next prepares the next result row for reading with the [Rows.Scan] method. It
+   * returns true on success, or false if there is no next result row or an error
+   * happened while preparing it. [Rows.Err] should be consulted to distinguish between
+   * the two cases.
+   * 
+   * Every call to [Rows.Scan], even the first one, must be preceded by a call to [Rows.Next].
+   */
+  next(): boolean
+ }
+ interface Rows {
+  /**
+   * NextResultSet prepares the next result set for reading. It reports whether
+   * there is further result sets, or false if there is no further result set
+   * or if there is an error advancing to it. The [Rows.Err] method should be consulted
+   * to distinguish between the two cases.
+   * 
+   * After calling NextResultSet, the [Rows.Next] method should always be called before
+   * scanning. If there are further result sets they may not have rows in the result
+   * set.
+   */
+  nextResultSet(): boolean
+ }
+ interface Rows {
+  /**
+   * Err returns the error, if any, that was encountered during iteration.
+   * Err may be called after an explicit or implicit [Rows.Close].
+   */
+  err(): void
+ }
+ interface Rows {
+  /**
+   * Columns returns the column names.
+   * Columns returns an error if the rows are closed.
+   */
+  columns(): Array<string>
+ }
+ interface Rows {
+  /**
+   * ColumnTypes returns column information such as column type, length,
+   * and nullable. Some information may not be available from some drivers.
+   */
+  columnTypes(): Array<(ColumnType | undefined)>
+ }
+ interface Rows {
+  /**
+   * Scan copies the columns in the current row into the values pointed
+   * at by dest. The number of values in dest must be the same as the
+   * number of columns in [Rows].
+   * 
+   * Scan converts columns read from the database into the following
+   * common Go types and special types provided by the sql package:
+   * 
+   * ```
+   * 	*string
+   * 	*[]byte
+   * 	*int, *int8, *int16, *int32, *int64
+   * 	*uint, *uint8, *uint16, *uint32, *uint64
+   * 	*bool
+   * 	*float32, *float64
+   * 	*interface{}
+   * 	*RawBytes
+   * 	*Rows (cursor value)
+   * 	any type implementing Scanner (see Scanner docs)
+   * ```
+   * 
+   * In the most simple case, if the type of the value from the source
+   * column is an integer, bool or string type T and dest is of type *T,
+   * Scan simply assigns the value through the pointer.
+   * 
+   * Scan also converts between string and numeric types, as long as no
+   * information would be lost. While Scan stringifies all numbers
+   * scanned from numeric database columns into *string, scans into
+   * numeric types are checked for overflow. For example, a float64 with
+   * value 300 or a string with value "300" can scan into a uint16, but
+   * not into a uint8, though float64(255) or "255" can scan into a
+   * uint8. One exception is that scans of some float64 numbers to
+   * strings may lose information when stringifying. In general, scan
+   * floating point columns into *float64.
+   * 
+   * If a dest argument has type *[]byte, Scan saves in that argument a
+   * copy of the corresponding data. The copy is owned by the caller and
+   * can be modified and held indefinitely. The copy can be avoided by
+   * using an argument of type [*RawBytes] instead; see the documentation
+   * for [RawBytes] for restrictions on its use.
+   * 
+   * If an argument has type *interface{}, Scan copies the value
+   * provided by the underlying driver without conversion. When scanning
+   * from a source value of type []byte to *interface{}, a copy of the
+   * slice is made and the caller owns the result.
+   * 
+   * Source values of type [time.Time] may be scanned into values of type
+   * *time.Time, *interface{}, *string, or *[]byte. When converting to
+   * the latter two, [time.RFC3339Nano] is used.
+   * 
+   * Source values of type bool may be scanned into types *bool,
+   * *interface{}, *string, *[]byte, or [*RawBytes].
+   * 
+   * For scanning into *bool, the source may be true, false, 1, 0, or
+   * string inputs parseable by [strconv.ParseBool].
+   * 
+   * Scan can also convert a cursor returned from a query, such as
+   * "select cursor(select * from my_table) from dual", into a
+   * [*Rows] value that can itself be scanned from. The parent
+   * select query will close any cursor [*Rows] if the parent [*Rows] is closed.
+   * 
+   * If any of the first arguments implementing [Scanner] returns an error,
+   * that error will be wrapped in the returned error.
+   */
+  scan(...dest: any[]): void
+ }
+ interface Rows {
+  /**
+   * Close closes the [Rows], preventing further enumeration. If [Rows.Next] is called
+   * and returns false and there are no further result sets,
+   * the [Rows] are closed automatically and it will suffice to check the
+   * result of [Rows.Err]. Close is idempotent and does not affect the result of [Rows.Err].
+   */
+  close(): void
+ }
+ /**
+  * A Result summarizes an executed SQL command.
+  */
+ interface Result {
+  [key:string]: any;
+  /**
+   * LastInsertId returns the integer generated by the database
+   * in response to a command. Typically this will be from an
+   * "auto increment" column when inserting a new row. Not all
+   * databases support this feature, and the syntax of such
+   * statements varies.
+   */
+  lastInsertId(): number
+  /**
+   * RowsAffected returns the number of rows affected by an
+   * update, insert, or delete. Not every database or database
+   * driver may support this.
+   */
+  rowsAffected(): number
+ }
+}
+
+/**
+ * Package syntax parses regular expressions into parse trees and compiles
+ * parse trees into programs. Most clients of regular expressions will use the
+ * facilities of package [regexp] (such as [regexp.Compile] and [regexp.Match]) instead of this package.
+ * 
+ * # Syntax
+ * 
+ * The regular expression syntax understood by this package when parsing with the [Perl] flag is as follows.
+ * Parts of the syntax can be disabled by passing alternate flags to [Parse].
+ * 
+ * Single characters:
+ * 
+ * ```
+ * 	.              any character, possibly including newline (flag s=true)
+ * 	[xyz]          character class
+ * 	[^xyz]         negated character class
+ * 	\d             Perl character class
+ * 	\D             negated Perl character class
+ * 	[[:alpha:]]    ASCII character class
+ * 	[[:^alpha:]]   negated ASCII character class
+ * 	\pN            Unicode character class (one-letter name)
+ * 	\p{Greek}      Unicode character class
+ * 	\PN            negated Unicode character class (one-letter name)
+ * 	\P{Greek}      negated Unicode character class
+ * ```
+ * 
+ * Composites:
+ * 
+ * ```
+ * 	xy             x followed by y
+ * 	x|y            x or y (prefer x)
+ * ```
+ * 
+ * Repetitions:
+ * 
+ * ```
+ * 	x*             zero or more x, prefer more
+ * 	x+             one or more x, prefer more
+ * 	x?             zero or one x, prefer one
+ * 	x{n,m}         n or n+1 or ... or m x, prefer more
+ * 	x{n,}          n or more x, prefer more
+ * 	x{n}           exactly n x
+ * 	x*?            zero or more x, prefer fewer
+ * 	x+?            one or more x, prefer fewer
+ * 	x??            zero or one x, prefer zero
+ * 	x{n,m}?        n or n+1 or ... or m x, prefer fewer
+ * 	x{n,}?         n or more x, prefer fewer
+ * 	x{n}?          exactly n x
+ * ```
+ * 
+ * Implementation restriction: The counting forms x{n,m}, x{n,}, and x{n}
+ * reject forms that create a minimum or maximum repetition count above 1000.
+ * Unlimited repetitions are not subject to this restriction.
+ * 
+ * Grouping:
+ * 
+ * ```
+ * 	(re)           numbered capturing group (submatch)
+ * 	(?P<name>re)   named & numbered capturing group (submatch)
+ * 	(?<name>re)    named & numbered capturing group (submatch)
+ * 	(?:re)         non-capturing group
+ * 	(?flags)       set flags within current group; non-capturing
+ * 	(?flags:re)    set flags during re; non-capturing
+ * 
+ * 	Flag syntax is xyz (set) or -xyz (clear) or xy-z (set xy, clear z). The flags are:
+ * 
+ * 	i              case-insensitive (default false)
+ * 	m              multi-line mode: ^ and $ match begin/end line in addition to begin/end text (default false)
+ * 	s              let . match \n (default false)
+ * 	U              ungreedy: swap meaning of x* and x*?, x+ and x+?, etc (default false)
+ * ```
+ * 
+ * Empty strings:
+ * 
+ * ```
+ * 	^              at beginning of text or line (flag m=true)
+ * 	$              at end of text (like \z not \Z) or line (flag m=true)
+ * 	\A             at beginning of text
+ * 	\b             at ASCII word boundary (\w on one side and \W, \A, or \z on the other)
+ * 	\B             not at ASCII word boundary
+ * 	\z             at end of text
+ * ```
+ * 
+ * Escape sequences:
+ * 
+ * ```
+ * 	\a             bell (== \007)
+ * 	\f             form feed (== \014)
+ * 	\t             horizontal tab (== \011)
+ * 	\n             newline (== \012)
+ * 	\r             carriage return (== \015)
+ * 	\v             vertical tab character (== \013)
+ * 	\*             literal *, for any punctuation character *
+ * 	\123           octal character code (up to three digits)
+ * 	\x7F           hex character code (exactly two digits)
+ * 	\x{10FFFF}     hex character code
+ * 	\Q...\E        literal text ... even if ... has punctuation
+ * ```
+ * 
+ * Character class elements:
+ * 
+ * ```
+ * 	x              single character
+ * 	A-Z            character range (inclusive)
+ * 	\d             Perl character class
+ * 	[:foo:]        ASCII character class foo
+ * 	\p{Foo}        Unicode character class Foo
+ * 	\pF            Unicode character class F (one-letter name)
+ * ```
+ * 
+ * Named character classes as character class elements:
+ * 
+ * ```
+ * 	[\d]           digits (== \d)
+ * 	[^\d]          not digits (== \D)
+ * 	[\D]           not digits (== \D)
+ * 	[^\D]          not not digits (== \d)
+ * 	[[:name:]]     named ASCII class inside character class (== [:name:])
+ * 	[^[:name:]]    named ASCII class inside negated character class (== [:^name:])
+ * 	[\p{Name}]     named Unicode property inside character class (== \p{Name})
+ * 	[^\p{Name}]    named Unicode property inside negated character class (== \P{Name})
+ * ```
+ * 
+ * Perl character classes (all ASCII-only):
+ * 
+ * ```
+ * 	\d             digits (== [0-9])
+ * 	\D             not digits (== [^0-9])
+ * 	\s             whitespace (== [\t\n\f\r ])
+ * 	\S             not whitespace (== [^\t\n\f\r ])
+ * 	\w             word characters (== [0-9A-Za-z_])
+ * 	\W             not word characters (== [^0-9A-Za-z_])
+ * ```
+ * 
+ * ASCII character classes:
+ * 
+ * ```
+ * 	[[:alnum:]]    alphanumeric (== [0-9A-Za-z])
+ * 	[[:alpha:]]    alphabetic (== [A-Za-z])
+ * 	[[:ascii:]]    ASCII (== [\x00-\x7F])
+ * 	[[:blank:]]    blank (== [\t ])
+ * 	[[:cntrl:]]    control (== [\x00-\x1F\x7F])
+ * 	[[:digit:]]    digits (== [0-9])
+ * 	[[:graph:]]    graphical (== [!-~] == [A-Za-z0-9!"#$%&'()*+,\-./:;<=>?@[\\\]^_`{|}~])
+ * 	[[:lower:]]    lower case (== [a-z])
+ * 	[[:print:]]    printable (== [ -~] == [ [:graph:]])
+ * 	[[:punct:]]    punctuation (== [!-/:-@[-`{-~])
+ * 	[[:space:]]    whitespace (== [\t\n\v\f\r ])
+ * 	[[:upper:]]    upper case (== [A-Z])
+ * 	[[:word:]]     word characters (== [0-9A-Za-z_])
+ * 	[[:xdigit:]]   hex digit (== [0-9A-Fa-f])
+ * ```
+ * 
+ * Unicode character classes are those in [unicode.Categories] and [unicode.Scripts].
+ */
+namespace syntax {
+ /**
+  * Flags control the behavior of the parser and record information about regexp context.
+  */
+ interface Flags extends Number{}
+}
+
+namespace store {
+ /**
+  * Store defines a concurrent safe in memory key-value data store.
+  */
+ interface Store<K,T> {
+ }
+ interface Store<K, T> {
+  /**
+   * Reset clears the store and replaces the store data with a
+   * shallow copy of the provided newData.
+   */
+  reset(newData: _TygojaDict): void
+ }
+ interface Store<K, T> {
+  /**
+   * Length returns the current number of elements in the store.
+   */
+  length(): number
+ }
+ interface Store<K, T> {
+  /**
+   * RemoveAll removes all the existing store entries.
+   */
+  removeAll(): void
+ }
+ interface Store<K, T> {
+  /**
+   * Remove removes a single entry from the store.
+   * 
+   * Remove does nothing if key doesn't exist in the store.
+   */
+  remove(key: K): void
+ }
+ interface Store<K, T> {
+  /**
+   * Has checks if element with the specified key exist or not.
+   */
+  has(key: K): boolean
+ }
+ interface Store<K, T> {
+  /**
+   * Get returns a single element value from the store.
+   * 
+   * If key is not set, the zero T value is returned.
+   */
+  get(key: K): T
+ }
+ interface Store<K, T> {
+  /**
+   * GetOk is similar to Get but returns also a boolean indicating whether the key exists or not.
+   */
+  getOk(key: K): [T, boolean]
+ }
+ interface Store<K, T> {
+  /**
+   * GetAll returns a shallow copy of the current store data.
+   */
+  getAll(): _TygojaDict
+ }
+ interface Store<K, T> {
+  /**
+   * Values returns a slice with all of the current store values.
+   */
+  values(): Array<T>
+ }
+ interface Store<K, T> {
+  /**
+   * Set sets (or overwrite if already exists) a new value for key.
+   */
+  set(key: K, value: T): void
+ }
+ interface Store<K, T> {
+  /**
+   * SetFunc sets (or overwrite if already exists) a new value resolved
+   * from the function callback for the provided key.
+   * 
+   * The function callback receives as argument the old store element value (if exists).
+   * If there is no old store element, the argument will be the T zero value.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	s := store.New[string, int](nil)
+   * 	s.SetFunc("count", func(old int) int {
+   * 	    return old + 1
+   * 	})
+   * ```
+   */
+  setFunc(key: K, fn: (old: T) => T): void
+ }
+ interface Store<K, T> {
+  /**
+   * GetOrSet retrieves a single existing value for the provided key
+   * or stores a new one if it doesn't exist.
+   */
+  getOrSet(key: K, setFunc: () => T): T
+ }
+ interface Store<K, T> {
+  /**
+   * SetIfLessThanLimit sets (or overwrite if already exist) a new value for key.
+   * 
+   * This method is similar to Set() but **it will skip adding new elements**
+   * to the store if the store length has reached the specified limit.
+   * false is returned if maxAllowedElements limit is reached.
+   */
+  setIfLessThanLimit(key: K, value: T, maxAllowedElements: number): boolean
+ }
+ interface Store<K, T> {
+  /**
+   * UnmarshalJSON implements [json.Unmarshaler] and imports the
+   * provided JSON data into the store.
+   * 
+   * The store entries that match with the ones from the data will be overwritten with the new value.
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface Store<K, T> {
+  /**
+   * MarshalJSON implements [json.Marshaler] and export the current
+   * store data into valid JSON.
+   */
+  marshalJSON(): string|Array<number>
+ }
+}
+
+/**
+ * Package net provides a portable interface for network I/O, including
+ * TCP/IP, UDP, domain name resolution, and Unix domain sockets.
+ * 
+ * Although the package provides access to low-level networking
+ * primitives, most clients will need only the basic interface provided
+ * by the [Dial], [Listen], and Accept functions and the associated
+ * [Conn] and [Listener] interfaces. The crypto/tls package uses
+ * the same interfaces and similar Dial and Listen functions.
+ * 
+ * The Dial function connects to a server:
+ * 
+ * ```
+ * 	conn, err := net.Dial("tcp", "golang.org:80")
+ * 	if err != nil {
+ * 		// handle error
+ * 	}
+ * 	fmt.Fprintf(conn, "GET / HTTP/1.0\r\n\r\n")
+ * 	status, err := bufio.NewReader(conn).ReadString('\n')
+ * 	// ...
+ * ```
+ * 
+ * The Listen function creates servers:
+ * 
+ * ```
+ * 	ln, err := net.Listen("tcp", ":8080")
+ * 	if err != nil {
+ * 		// handle error
+ * 	}
+ * 	for {
+ * 		conn, err := ln.Accept()
+ * 		if err != nil {
+ * 			// handle error
+ * 		}
+ * 		go handleConnection(conn)
+ * 	}
+ * ```
+ * 
+ * # Name Resolution
+ * 
+ * The method for resolving domain names, whether indirectly with functions like Dial
+ * or directly with functions like [LookupHost] and [LookupAddr], varies by operating system.
+ * 
+ * On Unix systems, the resolver has two options for resolving names.
+ * It can use a pure Go resolver that sends DNS requests directly to the servers
+ * listed in /etc/resolv.conf, or it can use a cgo-based resolver that calls C
+ * library routines such as getaddrinfo and getnameinfo.
+ * 
+ * On Unix the pure Go resolver is preferred over the cgo resolver, because a blocked DNS
+ * request consumes only a goroutine, while a blocked C call consumes an operating system thread.
+ * When cgo is available, the cgo-based resolver is used instead under a variety of
+ * conditions: on systems that do not let programs make direct DNS requests (OS X),
+ * when the LOCALDOMAIN environment variable is present (even if empty),
+ * when the RES_OPTIONS or HOSTALIASES environment variable is non-empty,
+ * when the ASR_CONFIG environment variable is non-empty (OpenBSD only),
+ * when /etc/resolv.conf or /etc/nsswitch.conf specify the use of features that the
+ * Go resolver does not implement.
+ * 
+ * On all systems (except Plan 9), when the cgo resolver is being used
+ * this package applies a concurrent cgo lookup limit to prevent the system
+ * from running out of system threads. Currently, it is limited to 500 concurrent lookups.
+ * 
+ * The resolver decision can be overridden by setting the netdns value of the
+ * GODEBUG environment variable (see package runtime) to go or cgo, as in:
+ * 
+ * ```
+ * 	export GODEBUG=netdns=go    # force pure Go resolver
+ * 	export GODEBUG=netdns=cgo   # force native resolver (cgo, win32)
+ * ```
+ * 
+ * The decision can also be forced while building the Go source tree
+ * by setting the netgo or netcgo build tag.
+ * 
+ * A numeric netdns setting, as in GODEBUG=netdns=1, causes the resolver
+ * to print debugging information about its decisions.
+ * To force a particular resolver while also printing debugging information,
+ * join the two settings by a plus sign, as in GODEBUG=netdns=go+1.
+ * 
+ * The Go resolver will send an EDNS0 additional header with a DNS request,
+ * to signal a willingness to accept a larger DNS packet size.
+ * This can reportedly cause sporadic failures with the DNS server run
+ * by some modems and routers. Setting GODEBUG=netedns0=0 will disable
+ * sending the additional header.
+ * 
+ * On macOS, if Go code that uses the net package is built with
+ * -buildmode=c-archive, linking the resulting archive into a C program
+ * requires passing -lresolv when linking the C code.
+ * 
+ * On Plan 9, the resolver always accesses /net/cs and /net/dns.
+ * 
+ * On Windows, in Go 1.18.x and earlier, the resolver always used C
+ * library functions, such as GetAddrInfo and DnsQuery.
+ */
+namespace net {
+ /**
+  * Conn is a generic stream-oriented network connection.
+  * 
+  * Multiple goroutines may invoke methods on a Conn simultaneously.
+  */
+ interface Conn {
+  [key:string]: any;
+  /**
+   * Read reads data from the connection.
+   * Read can be made to time out and return an error after a fixed
+   * time limit; see SetDeadline and SetReadDeadline.
+   */
+  read(b: string|Array<number>): number
+  /**
+   * Write writes data to the connection.
+   * Write can be made to time out and return an error after a fixed
+   * time limit; see SetDeadline and SetWriteDeadline.
+   */
+  write(b: string|Array<number>): number
+  /**
+   * Close closes the connection.
+   * Any blocked Read or Write operations will be unblocked and return errors.
+   */
+  close(): void
+  /**
+   * LocalAddr returns the local network address, if known.
+   */
+  localAddr(): Addr
+  /**
+   * RemoteAddr returns the remote network address, if known.
+   */
+  remoteAddr(): Addr
+  /**
+   * SetDeadline sets the read and write deadlines associated
+   * with the connection. It is equivalent to calling both
+   * SetReadDeadline and SetWriteDeadline.
+   * 
+   * A deadline is an absolute time after which I/O operations
+   * fail instead of blocking. The deadline applies to all future
+   * and pending I/O, not just the immediately following call to
+   * Read or Write. After a deadline has been exceeded, the
+   * connection can be refreshed by setting a deadline in the future.
+   * 
+   * If the deadline is exceeded a call to Read or Write or to other
+   * I/O methods will return an error that wraps os.ErrDeadlineExceeded.
+   * This can be tested using errors.Is(err, os.ErrDeadlineExceeded).
+   * The error's Timeout method will return true, but note that there
+   * are other possible errors for which the Timeout method will
+   * return true even if the deadline has not been exceeded.
+   * 
+   * An idle timeout can be implemented by repeatedly extending
+   * the deadline after successful Read or Write calls.
+   * 
+   * A zero value for t means I/O operations will not time out.
+   */
+  setDeadline(t: time.Time): void
+  /**
+   * SetReadDeadline sets the deadline for future Read calls
+   * and any currently-blocked Read call.
+   * A zero value for t means Read will not time out.
+   */
+  setReadDeadline(t: time.Time): void
+  /**
+   * SetWriteDeadline sets the deadline for future Write calls
+   * and any currently-blocked Write call.
+   * Even if write times out, it may return n > 0, indicating that
+   * some of the data was successfully written.
+   * A zero value for t means Write will not time out.
+   */
+  setWriteDeadline(t: time.Time): void
+ }
+}
+
+/**
+ * Package jwt is a Go implementation of JSON Web Tokens: http://self-issued.info/docs/draft-jones-json-web-token.html
+ * 
+ * See README.md for more info.
+ */
+namespace jwt {
+ /**
+  * MapClaims is a claims type that uses the map[string]interface{} for JSON
+  * decoding. This is the default claims type if you don't supply one
+  */
+ interface MapClaims extends _TygojaDict{}
+ interface MapClaims {
+  /**
+   * GetExpirationTime implements the Claims interface.
+   */
+  getExpirationTime(): (NumericDate)
+ }
+ interface MapClaims {
+  /**
+   * GetNotBefore implements the Claims interface.
+   */
+  getNotBefore(): (NumericDate)
+ }
+ interface MapClaims {
+  /**
+   * GetIssuedAt implements the Claims interface.
+   */
+  getIssuedAt(): (NumericDate)
+ }
+ interface MapClaims {
+  /**
+   * GetAudience implements the Claims interface.
+   */
+  getAudience(): ClaimStrings
+ }
+ interface MapClaims {
+  /**
+   * GetIssuer implements the Claims interface.
+   */
+  getIssuer(): string
+ }
+ interface MapClaims {
+  /**
+   * GetSubject implements the Claims interface.
+   */
+  getSubject(): string
+ }
+}
+
+/**
+ * Package types implements some commonly used db serializable types
+ * like datetime, json, etc.
+ */
+namespace types {
+ /**
+  * DateTime represents a [time.Time] instance in UTC that is wrapped
+  * and serialized using the app default date layout.
+  */
+ interface DateTime {
+ }
+ interface DateTime {
+  /**
+   * Time returns the internal [time.Time] instance.
+   */
+  time(): time.Time
+ }
+ interface DateTime {
+  /**
+   * Add returns a new DateTime based on the current DateTime + the specified duration.
+   */
+  add(duration: time.Duration): DateTime
+ }
+ interface DateTime {
+  /**
+   * Sub returns a [time.Duration] by subtracting the specified DateTime from the current one.
+   * 
+   * If the result exceeds the maximum (or minimum) value that can be stored in a [time.Duration],
+   * the maximum (or minimum) duration will be returned.
+   */
+  sub(u: DateTime): time.Duration
+ }
+ interface DateTime {
+  /**
+   * AddDate returns a new DateTime based on the current one + duration.
+   * 
+   * It follows the same rules as [time.AddDate].
+   */
+  addDate(years: number, months: number, days: number): DateTime
+ }
+ interface DateTime {
+  /**
+   * After reports whether the current DateTime instance is after u.
+   */
+  after(u: DateTime): boolean
+ }
+ interface DateTime {
+  /**
+   * Before reports whether the current DateTime instance is before u.
+   */
+  before(u: DateTime): boolean
+ }
+ interface DateTime {
+  /**
+   * Compare compares the current DateTime instance with u.
+   * If the current instance is before u, it returns -1.
+   * If the current instance is after u, it returns +1.
+   * If they're the same, it returns 0.
+   */
+  compare(u: DateTime): number
+ }
+ interface DateTime {
+  /**
+   * Equal reports whether the current DateTime and u represent the same time instant.
+   * Two DateTime can be equal even if they are in different locations.
+   * For example, 6:00 +0200 and 4:00 UTC are Equal.
+   */
+  equal(u: DateTime): boolean
+ }
+ interface DateTime {
+  /**
+   * Unix returns the current DateTime as a Unix time, aka.
+   * the number of seconds elapsed since January 1, 1970 UTC.
+   */
+  unix(): number
+ }
+ interface DateTime {
+  /**
+   * IsZero checks whether the current DateTime instance has zero time value.
+   */
+  isZero(): boolean
+ }
+ interface DateTime {
+  /**
+   * String serializes the current DateTime instance into a formatted
+   * UTC date string.
+   * 
+   * The zero value is serialized to an empty string.
+   */
+  string(): string
+ }
+ interface DateTime {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface DateTime {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   */
+  unmarshalJSON(b: string|Array<number>): void
+ }
+ interface DateTime {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface DateTime {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current DateTime instance.
+   */
+  scan(value: any): void
+ }
+ /**
+  * GeoPoint defines a struct for storing geo coordinates as serialized json object
+  * (e.g. {lon:0,lat:0}).
+  * 
+  * Note: using object notation and not a plain array to avoid the confusion
+  * as there doesn't seem to be a fixed standard for the coordinates order.
+  */
+ interface GeoPoint {
+  lon: number
+  lat: number
+ }
+ interface GeoPoint {
+  /**
+   * String returns the string representation of the current GeoPoint instance.
+   */
+  string(): string
+ }
+ interface GeoPoint {
+  /**
+   * AsMap implements [core.mapExtractor] and returns a value suitable
+   * to be used in an API rule expression.
+   */
+  asMap(): _TygojaDict
+ }
+ interface GeoPoint {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface GeoPoint {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current GeoPoint instance.
+   * 
+   * The value argument could be nil (no-op), another GeoPoint instance,
+   * map or serialized json object with lat-lon props.
+   */
+  scan(value: any): void
+ }
+ /**
+  * JSONArray defines a slice that is safe for json and db read/write.
+  */
+ interface JSONArray<T> extends Array<T>{}
+ /**
+  * JSONMap defines a map that is safe for json and db read/write.
+  */
+ interface JSONMap<T> extends _TygojaDict{}
+ /**
+  * JSONRaw defines a json value type that is safe for db read/write.
+  */
+ interface JSONRaw extends Array<number>{}
+ interface JSONRaw {
+  /**
+   * String returns the current JSONRaw instance as a json encoded string.
+   */
+  string(): string
+ }
+ interface JSONRaw {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface JSONRaw {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   */
+  unmarshalJSON(b: string|Array<number>): void
+ }
+ interface JSONRaw {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface JSONRaw {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current JSONRaw instance.
+   */
+  scan(value: any): void
+ }
+}
+
+namespace search {
+ /**
+  * Result defines the returned search result structure.
+  */
+ interface Result {
+  items: any
+  page: number
+  perPage: number
+  totalItems: number
+  totalPages: number
+ }
+ /**
+  * ResolverResult defines a single FieldResolver.Resolve() successfully parsed result.
+  */
+ interface ResolverResult {
+  /**
+   * Identifier is the plain SQL identifier/column that will be used
+   * in the final db expression as left or right operand.
+   */
+  identifier: string
+  /**
+   * NoCoalesce instructs to not use COALESCE or NULL fallbacks
+   * when building the identifier expression.
+   */
+  noCoalesce: boolean
+  /**
+   * Params is a map with db placeholder->value pairs that will be added
+   * to the query when building both resolved operands/sides in a single expression.
+   */
+  params: dbx.Params
+  /**
+   * MultiMatchSubQuery is an optional sub query expression that will be added
+   * in addition to the combined ResolverResult expression during build.
+   */
+  multiMatchSubQuery: dbx.Expression
+  /**
+   * AfterBuild is an optional function that will be called after building
+   * and combining the result of both resolved operands/sides in a single expression.
+   */
+  afterBuild: (expr: dbx.Expression) => dbx.Expression
+ }
+}
+
+/**
+ * Package slog provides structured logging,
+ * in which log records include a message,
+ * a severity level, and various other attributes
+ * expressed as key-value pairs.
+ * 
+ * It defines a type, [Logger],
+ * which provides several methods (such as [Logger.Info] and [Logger.Error])
+ * for reporting events of interest.
+ * 
+ * Each Logger is associated with a [Handler].
+ * A Logger output method creates a [Record] from the method arguments
+ * and passes it to the Handler, which decides how to handle it.
+ * There is a default Logger accessible through top-level functions
+ * (such as [Info] and [Error]) that call the corresponding Logger methods.
+ * 
+ * A log record consists of a time, a level, a message, and a set of key-value
+ * pairs, where the keys are strings and the values may be of any type.
+ * As an example,
+ * 
+ * ```
+ * 	slog.Info("hello", "count", 3)
+ * ```
+ * 
+ * creates a record containing the time of the call,
+ * a level of Info, the message "hello", and a single
+ * pair with key "count" and value 3.
+ * 
+ * The [Info] top-level function calls the [Logger.Info] method on the default Logger.
+ * In addition to [Logger.Info], there are methods for Debug, Warn and Error levels.
+ * Besides these convenience methods for common levels,
+ * there is also a [Logger.Log] method which takes the level as an argument.
+ * Each of these methods has a corresponding top-level function that uses the
+ * default logger.
+ * 
+ * The default handler formats the log record's message, time, level, and attributes
+ * as a string and passes it to the [log] package.
+ * 
+ * ```
+ * 	2022/11/08 15:28:26 INFO hello count=3
+ * ```
+ * 
+ * For more control over the output format, create a logger with a different handler.
+ * This statement uses [New] to create a new logger with a [TextHandler]
+ * that writes structured records in text form to standard error:
+ * 
+ * ```
+ * 	logger := slog.New(slog.NewTextHandler(os.Stderr, nil))
+ * ```
+ * 
+ * [TextHandler] output is a sequence of key=value pairs, easily and unambiguously
+ * parsed by machine. This statement:
+ * 
+ * ```
+ * 	logger.Info("hello", "count", 3)
+ * ```
+ * 
+ * produces this output:
+ * 
+ * ```
+ * 	time=2022-11-08T15:28:26.000-05:00 level=INFO msg=hello count=3
+ * ```
+ * 
+ * The package also provides [JSONHandler], whose output is line-delimited JSON:
+ * 
+ * ```
+ * 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
+ * 	logger.Info("hello", "count", 3)
+ * ```
+ * 
+ * produces this output:
+ * 
+ * ```
+ * 	{"time":"2022-11-08T15:28:26.000000000-05:00","level":"INFO","msg":"hello","count":3}
+ * ```
+ * 
+ * Both [TextHandler] and [JSONHandler] can be configured with [HandlerOptions].
+ * There are options for setting the minimum level (see Levels, below),
+ * displaying the source file and line of the log call, and
+ * modifying attributes before they are logged.
+ * 
+ * Setting a logger as the default with
+ * 
+ * ```
+ * 	slog.SetDefault(logger)
+ * ```
+ * 
+ * will cause the top-level functions like [Info] to use it.
+ * [SetDefault] also updates the default logger used by the [log] package,
+ * so that existing applications that use [log.Printf] and related functions
+ * will send log records to the logger's handler without needing to be rewritten.
+ * 
+ * Some attributes are common to many log calls.
+ * For example, you may wish to include the URL or trace identifier of a server request
+ * with all log events arising from the request.
+ * Rather than repeat the attribute with every log call, you can use [Logger.With]
+ * to construct a new Logger containing the attributes:
+ * 
+ * ```
+ * 	logger2 := logger.With("url", r.URL)
+ * ```
+ * 
+ * The arguments to With are the same key-value pairs used in [Logger.Info].
+ * The result is a new Logger with the same handler as the original, but additional
+ * attributes that will appear in the output of every call.
+ * 
+ * # Levels
+ * 
+ * A [Level] is an integer representing the importance or severity of a log event.
+ * The higher the level, the more severe the event.
+ * This package defines constants for the most common levels,
+ * but any int can be used as a level.
+ * 
+ * In an application, you may wish to log messages only at a certain level or greater.
+ * One common configuration is to log messages at Info or higher levels,
+ * suppressing debug logging until it is needed.
+ * The built-in handlers can be configured with the minimum level to output by
+ * setting [HandlerOptions.Level].
+ * The program's `main` function typically does this.
+ * The default value is LevelInfo.
+ * 
+ * Setting the [HandlerOptions.Level] field to a [Level] value
+ * fixes the handler's minimum level throughout its lifetime.
+ * Setting it to a [LevelVar] allows the level to be varied dynamically.
+ * A LevelVar holds a Level and is safe to read or write from multiple
+ * goroutines.
+ * To vary the level dynamically for an entire program, first initialize
+ * a global LevelVar:
+ * 
+ * ```
+ * 	var programLevel = new(slog.LevelVar) // Info by default
+ * ```
+ * 
+ * Then use the LevelVar to construct a handler, and make it the default:
+ * 
+ * ```
+ * 	h := slog.NewJSONHandler(os.Stderr, &slog.HandlerOptions{Level: programLevel})
+ * 	slog.SetDefault(slog.New(h))
+ * ```
+ * 
+ * Now the program can change its logging level with a single statement:
+ * 
+ * ```
+ * 	programLevel.Set(slog.LevelDebug)
+ * ```
+ * 
+ * # Groups
+ * 
+ * Attributes can be collected into groups.
+ * A group has a name that is used to qualify the names of its attributes.
+ * How this qualification is displayed depends on the handler.
+ * [TextHandler] separates the group and attribute names with a dot.
+ * [JSONHandler] treats each group as a separate JSON object, with the group name as the key.
+ * 
+ * Use [Group] to create a Group attribute from a name and a list of key-value pairs:
+ * 
+ * ```
+ * 	slog.Group("request",
+ * 	    "method", r.Method,
+ * 	    "url", r.URL)
+ * ```
+ * 
+ * TextHandler would display this group as
+ * 
+ * ```
+ * 	request.method=GET request.url=http://example.com
+ * ```
+ * 
+ * JSONHandler would display it as
+ * 
+ * ```
+ * 	"request":{"method":"GET","url":"http://example.com"}
+ * ```
+ * 
+ * Use [Logger.WithGroup] to qualify all of a Logger's output
+ * with a group name. Calling WithGroup on a Logger results in a
+ * new Logger with the same Handler as the original, but with all
+ * its attributes qualified by the group name.
+ * 
+ * This can help prevent duplicate attribute keys in large systems,
+ * where subsystems might use the same keys.
+ * Pass each subsystem a different Logger with its own group name so that
+ * potential duplicates are qualified:
+ * 
+ * ```
+ * 	logger := slog.Default().With("id", systemID)
+ * 	parserLogger := logger.WithGroup("parser")
+ * 	parseInput(input, parserLogger)
+ * ```
+ * 
+ * When parseInput logs with parserLogger, its keys will be qualified with "parser",
+ * so even if it uses the common key "id", the log line will have distinct keys.
+ * 
+ * # Contexts
+ * 
+ * Some handlers may wish to include information from the [context.Context] that is
+ * available at the call site. One example of such information
+ * is the identifier for the current span when tracing is enabled.
+ * 
+ * The [Logger.Log] and [Logger.LogAttrs] methods take a context as a first
+ * argument, as do their corresponding top-level functions.
+ * 
+ * Although the convenience methods on Logger (Info and so on) and the
+ * corresponding top-level functions do not take a context, the alternatives ending
+ * in "Context" do. For example,
+ * 
+ * ```
+ * 	slog.InfoContext(ctx, "message")
+ * ```
+ * 
+ * It is recommended to pass a context to an output method if one is available.
+ * 
+ * # Attrs and Values
+ * 
+ * An [Attr] is a key-value pair. The Logger output methods accept Attrs as well as
+ * alternating keys and values. The statement
+ * 
+ * ```
+ * 	slog.Info("hello", slog.Int("count", 3))
+ * ```
+ * 
+ * behaves the same as
+ * 
+ * ```
+ * 	slog.Info("hello", "count", 3)
+ * ```
+ * 
+ * There are convenience constructors for [Attr] such as [Int], [String], and [Bool]
+ * for common types, as well as the function [Any] for constructing Attrs of any
+ * type.
+ * 
+ * The value part of an Attr is a type called [Value].
+ * Like an [any], a Value can hold any Go value,
+ * but it can represent typical values, including all numbers and strings,
+ * without an allocation.
+ * 
+ * For the most efficient log output, use [Logger.LogAttrs].
+ * It is similar to [Logger.Log] but accepts only Attrs, not alternating
+ * keys and values; this allows it, too, to avoid allocation.
+ * 
+ * The call
+ * 
+ * ```
+ * 	logger.LogAttrs(ctx, slog.LevelInfo, "hello", slog.Int("count", 3))
+ * ```
+ * 
+ * is the most efficient way to achieve the same output as
+ * 
+ * ```
+ * 	slog.InfoContext(ctx, "hello", "count", 3)
+ * ```
+ * 
+ * # Customizing a type's logging behavior
+ * 
+ * If a type implements the [LogValuer] interface, the [Value] returned from its LogValue
+ * method is used for logging. You can use this to control how values of the type
+ * appear in logs. For example, you can redact secret information like passwords,
+ * or gather a struct's fields in a Group. See the examples under [LogValuer] for
+ * details.
+ * 
+ * A LogValue method may return a Value that itself implements [LogValuer]. The [Value.Resolve]
+ * method handles these cases carefully, avoiding infinite loops and unbounded recursion.
+ * Handler authors and others may wish to use [Value.Resolve] instead of calling LogValue directly.
+ * 
+ * # Wrapping output methods
+ * 
+ * The logger functions use reflection over the call stack to find the file name
+ * and line number of the logging call within the application. This can produce
+ * incorrect source information for functions that wrap slog. For instance, if you
+ * define this function in file mylog.go:
+ * 
+ * ```
+ * 	func Infof(logger *slog.Logger, format string, args ...any) {
+ * 	    logger.Info(fmt.Sprintf(format, args...))
+ * 	}
+ * ```
+ * 
+ * and you call it like this in main.go:
+ * 
+ * ```
+ * 	Infof(slog.Default(), "hello, %s", "world")
+ * ```
+ * 
+ * then slog will report the source file as mylog.go, not main.go.
+ * 
+ * A correct implementation of Infof will obtain the source location
+ * (pc) and pass it to NewRecord.
+ * The Infof function in the package-level example called "wrapping"
+ * demonstrates how to do this.
+ * 
+ * # Working with Records
+ * 
+ * Sometimes a Handler will need to modify a Record
+ * before passing it on to another Handler or backend.
+ * A Record contains a mixture of simple public fields (e.g. Time, Level, Message)
+ * and hidden fields that refer to state (such as attributes) indirectly. This
+ * means that modifying a simple copy of a Record (e.g. by calling
+ * [Record.Add] or [Record.AddAttrs] to add attributes)
+ * may have unexpected effects on the original.
+ * Before modifying a Record, use [Record.Clone] to
+ * create a copy that shares no state with the original,
+ * or create a new Record with [NewRecord]
+ * and build up its Attrs by traversing the old ones with [Record.Attrs].
+ * 
+ * # Performance considerations
+ * 
+ * If profiling your application demonstrates that logging is taking significant time,
+ * the following suggestions may help.
+ * 
+ * If many log lines have a common attribute, use [Logger.With] to create a Logger with
+ * that attribute. The built-in handlers will format that attribute only once, at the
+ * call to [Logger.With]. The [Handler] interface is designed to allow that optimization,
+ * and a well-written Handler should take advantage of it.
+ * 
+ * The arguments to a log call are always evaluated, even if the log event is discarded.
+ * If possible, defer computation so that it happens only if the value is actually logged.
+ * For example, consider the call
+ * 
+ * ```
+ * 	slog.Info("starting request", "url", r.URL.String())  // may compute String unnecessarily
+ * ```
+ * 
+ * The URL.String method will be called even if the logger discards Info-level events.
+ * Instead, pass the URL directly:
+ * 
+ * ```
+ * 	slog.Info("starting request", "url", &r.URL) // calls URL.String only if needed
+ * ```
+ * 
+ * The built-in [TextHandler] will call its String method, but only
+ * if the log event is enabled.
+ * Avoiding the call to String also preserves the structure of the underlying value.
+ * For example [JSONHandler] emits the components of the parsed URL as a JSON object.
+ * If you want to avoid eagerly paying the cost of the String call
+ * without causing the handler to potentially inspect the structure of the value,
+ * wrap the value in a fmt.Stringer implementation that hides its Marshal methods.
+ * 
+ * You can also use the [LogValuer] interface to avoid unnecessary work in disabled log
+ * calls. Say you need to log some expensive value:
+ * 
+ * ```
+ * 	slog.Debug("frobbing", "value", computeExpensiveValue(arg))
+ * ```
+ * 
+ * Even if this line is disabled, computeExpensiveValue will be called.
+ * To avoid that, define a type implementing LogValuer:
+ * 
+ * ```
+ * 	type expensive struct { arg int }
+ * 
+ * 	func (e expensive) LogValue() slog.Value {
+ * 	    return slog.AnyValue(computeExpensiveValue(e.arg))
+ * 	}
+ * ```
+ * 
+ * Then use a value of that type in log calls:
+ * 
+ * ```
+ * 	slog.Debug("frobbing", "value", expensive{arg})
+ * ```
+ * 
+ * Now computeExpensiveValue will only be called when the line is enabled.
+ * 
+ * The built-in handlers acquire a lock before calling [io.Writer.Write]
+ * to ensure that exactly one [Record] is written at a time in its entirety.
+ * Although each log record has a timestamp,
+ * the built-in handlers do not use that time to sort the written records.
+ * User-defined handlers are responsible for their own locking and sorting.
+ * 
+ * # Writing a handler
+ * 
+ * For a guide to writing a custom handler, see https://golang.org/s/slog-handler-guide.
+ */
+namespace slog {
+ // @ts-ignore
+ import loginternal = internal
+ /**
+  * A Logger records structured information about each call to its
+  * Log, Debug, Info, Warn, and Error methods.
+  * For each call, it creates a [Record] and passes it to a [Handler].
+  * 
+  * To create a new Logger, call [New] or a Logger method
+  * that begins "With".
+  */
+ interface Logger {
+ }
+ interface Logger {
+  /**
+   * Handler returns l's Handler.
+   */
+  handler(): Handler
+ }
+ interface Logger {
+  /**
+   * With returns a Logger that includes the given attributes
+   * in each output operation. Arguments are converted to
+   * attributes as if by [Logger.Log].
+   */
+  with(...args: any[]): (Logger)
+ }
+ interface Logger {
+  /**
+   * WithGroup returns a Logger that starts a group, if name is non-empty.
+   * The keys of all attributes added to the Logger will be qualified by the given
+   * name. (How that qualification happens depends on the [Handler.WithGroup]
+   * method of the Logger's Handler.)
+   * 
+   * If name is empty, WithGroup returns the receiver.
+   */
+  withGroup(name: string): (Logger)
+ }
+ interface Logger {
+  /**
+   * Enabled reports whether l emits log records at the given context and level.
+   */
+  enabled(ctx: context.Context, level: Level): boolean
+ }
+ interface Logger {
+  /**
+   * Log emits a log record with the current time and the given level and message.
+   * The Record's Attrs consist of the Logger's attributes followed by
+   * the Attrs specified by args.
+   * 
+   * The attribute arguments are processed as follows:
+   * ```
+   *   - If an argument is an Attr, it is used as is.
+   *   - If an argument is a string and this is not the last argument,
+   *     the following argument is treated as the value and the two are combined
+   *     into an Attr.
+   *   - Otherwise, the argument is treated as a value with key "!BADKEY".
+   * ```
+   */
+  log(ctx: context.Context, level: Level, msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * LogAttrs is a more efficient version of [Logger.Log] that accepts only Attrs.
+   */
+  logAttrs(ctx: context.Context, level: Level, msg: string, ...attrs: Attr[]): void
+ }
+ interface Logger {
+  /**
+   * Debug logs at [LevelDebug].
+   */
+  debug(msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * DebugContext logs at [LevelDebug] with the given context.
+   */
+  debugContext(ctx: context.Context, msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * Info logs at [LevelInfo].
+   */
+  info(msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * InfoContext logs at [LevelInfo] with the given context.
+   */
+  infoContext(ctx: context.Context, msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * Warn logs at [LevelWarn].
+   */
+  warn(msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * WarnContext logs at [LevelWarn] with the given context.
+   */
+  warnContext(ctx: context.Context, msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * Error logs at [LevelError].
+   */
+  error(msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * ErrorContext logs at [LevelError] with the given context.
+   */
+  errorContext(ctx: context.Context, msg: string, ...args: any[]): void
+ }
+}
+
+/**
+ * Package bufio implements buffered I/O. It wraps an io.Reader or io.Writer
+ * object, creating another object (Reader or Writer) that also implements
+ * the interface but provides buffering and some help for textual I/O.
+ */
+namespace bufio {
+ /**
+  * ReadWriter stores pointers to a [Reader] and a [Writer].
+  * It implements [io.ReadWriter].
+  */
+ type _sFTbWSf = Reader&Writer
+ interface ReadWriter extends _sFTbWSf {
+ }
+}
+
+/**
+ * Package multipart implements MIME multipart parsing, as defined in RFC
+ * 2046.
+ * 
+ * The implementation is sufficient for HTTP (RFC 2388) and the multipart
+ * bodies generated by popular browsers.
+ * 
+ * # Limits
+ * 
+ * To protect against malicious inputs, this package sets limits on the size
+ * of the MIME data it processes.
+ * 
+ * [Reader.NextPart] and [Reader.NextRawPart] limit the number of headers in a
+ * part to 10000 and [Reader.ReadForm] limits the total number of headers in all
+ * FileHeaders to 10000.
+ * These limits may be adjusted with the GODEBUG=multipartmaxheaders=<values>
+ * setting.
+ * 
+ * Reader.ReadForm further limits the number of parts in a form to 1000.
+ * This limit may be adjusted with the GODEBUG=multipartmaxparts=<value>
+ * setting.
+ */
+namespace multipart {
+ /**
+  * A FileHeader describes a file part of a multipart request.
+  */
+ interface FileHeader {
+  filename: string
+  header: textproto.MIMEHeader
+  size: number
+ }
+ interface FileHeader {
+  /**
+   * Open opens and returns the [FileHeader]'s associated File.
+   */
+  open(): File
+ }
+}
+
+/**
+ * Package http provides HTTP client and server implementations.
+ * 
+ * [Get], [Head], [Post], and [PostForm] make HTTP (or HTTPS) requests:
+ * 
+ * ```
+ * 	resp, err := http.Get("http://example.com/")
+ * 	...
+ * 	resp, err := http.Post("http://example.com/upload", "image/jpeg", &buf)
+ * 	...
+ * 	resp, err := http.PostForm("http://example.com/form",
+ * 		url.Values{"key": {"Value"}, "id": {"123"}})
+ * ```
+ * 
+ * The caller must close the response body when finished with it:
+ * 
+ * ```
+ * 	resp, err := http.Get("http://example.com/")
+ * 	if err != nil {
+ * 		// handle error
+ * 	}
+ * 	defer resp.Body.Close()
+ * 	body, err := io.ReadAll(resp.Body)
+ * 	// ...
+ * ```
+ * 
+ * # Clients and Transports
+ * 
+ * For control over HTTP client headers, redirect policy, and other
+ * settings, create a [Client]:
+ * 
+ * ```
+ * 	client := &http.Client{
+ * 		CheckRedirect: redirectPolicyFunc,
+ * 	}
+ * 
+ * 	resp, err := client.Get("http://example.com")
+ * 	// ...
+ * 
+ * 	req, err := http.NewRequest("GET", "http://example.com", nil)
+ * 	// ...
+ * 	req.Header.Add("If-None-Match", `W/"wyzzy"`)
+ * 	resp, err := client.Do(req)
+ * 	// ...
+ * ```
+ * 
+ * For control over proxies, TLS configuration, keep-alives,
+ * compression, and other settings, create a [Transport]:
+ * 
+ * ```
+ * 	tr := &http.Transport{
+ * 		MaxIdleConns:       10,
+ * 		IdleConnTimeout:    30 * time.Second,
+ * 		DisableCompression: true,
+ * 	}
+ * 	client := &http.Client{Transport: tr}
+ * 	resp, err := client.Get("https://example.com")
+ * ```
+ * 
+ * Clients and Transports are safe for concurrent use by multiple
+ * goroutines and for efficiency should only be created once and re-used.
+ * 
+ * # Servers
+ * 
+ * ListenAndServe starts an HTTP server with a given address and handler.
+ * The handler is usually nil, which means to use [DefaultServeMux].
+ * [Handle] and [HandleFunc] add handlers to [DefaultServeMux]:
+ * 
+ * ```
+ * 	http.Handle("/foo", fooHandler)
+ * 
+ * 	http.HandleFunc("/bar", func(w http.ResponseWriter, r *http.Request) {
+ * 		fmt.Fprintf(w, "Hello, %q", html.EscapeString(r.URL.Path))
+ * 	})
+ * 
+ * 	log.Fatal(http.ListenAndServe(":8080", nil))
+ * ```
+ * 
+ * More control over the server's behavior is available by creating a
+ * custom Server:
+ * 
+ * ```
+ * 	s := &http.Server{
+ * 		Addr:           ":8080",
+ * 		Handler:        myHandler,
+ * 		ReadTimeout:    10 * time.Second,
+ * 		WriteTimeout:   10 * time.Second,
+ * 		MaxHeaderBytes: 1 << 20,
+ * 	}
+ * 	log.Fatal(s.ListenAndServe())
+ * ```
+ * 
+ * # HTTP/2
+ * 
+ * Starting with Go 1.6, the http package has transparent support for the
+ * HTTP/2 protocol when using HTTPS. Programs that must disable HTTP/2
+ * can do so by setting [Transport.TLSNextProto] (for clients) or
+ * [Server.TLSNextProto] (for servers) to a non-nil, empty
+ * map. Alternatively, the following GODEBUG settings are
+ * currently supported:
+ * 
+ * ```
+ * 	GODEBUG=http2client=0  # disable HTTP/2 client support
+ * 	GODEBUG=http2server=0  # disable HTTP/2 server support
+ * 	GODEBUG=http2debug=1   # enable verbose HTTP/2 debug logs
+ * 	GODEBUG=http2debug=2   # ... even more verbose, with frame dumps
+ * ```
+ * 
+ * Please report any issues before disabling HTTP/2 support: https://golang.org/s/http2bug
+ * 
+ * The http package's [Transport] and [Server] both automatically enable
+ * HTTP/2 support for simple configurations. To enable HTTP/2 for more
+ * complex configurations, to use lower-level HTTP/2 features, or to use
+ * a newer version of Go's http2 package, import "golang.org/x/net/http2"
+ * directly and use its ConfigureTransport and/or ConfigureServer
+ * functions. Manually configuring HTTP/2 via the golang.org/x/net/http2
+ * package takes precedence over the net/http package's built-in HTTP/2
+ * support.
+ */
+namespace http {
+ // @ts-ignore
+ import mathrand = rand
+ /**
+  * PushOptions describes options for [Pusher.Push].
+  */
+ interface PushOptions {
+  /**
+   * Method specifies the HTTP method for the promised request.
+   * If set, it must be "GET" or "HEAD". Empty means "GET".
+   */
+  method: string
+  /**
+   * Header specifies additional promised request headers. This cannot
+   * include HTTP/2 pseudo header fields like ":path" and ":scheme",
+   * which will be added automatically.
+   */
+  header: Header
+ }
+ // @ts-ignore
+ import urlpkg = url
+ /**
+  * A Request represents an HTTP request received by a server
+  * or to be sent by a client.
+  * 
+  * The field semantics differ slightly between client and server
+  * usage. In addition to the notes on the fields below, see the
+  * documentation for [Request.Write] and [RoundTripper].
+  */
+ interface Request {
+  /**
+   * Method specifies the HTTP method (GET, POST, PUT, etc.).
+   * For client requests, an empty string means GET.
+   */
+  method: string
+  /**
+   * URL specifies either the URI being requested (for server
+   * requests) or the URL to access (for client requests).
+   * 
+   * For server requests, the URL is parsed from the URI
+   * supplied on the Request-Line as stored in RequestURI.  For
+   * most requests, fields other than Path and RawQuery will be
+   * empty. (See RFC 7230, Section 5.3)
+   * 
+   * For client requests, the URL's Host specifies the server to
+   * connect to, while the Request's Host field optionally
+   * specifies the Host header value to send in the HTTP
+   * request.
+   */
+  url?: url.URL
+  /**
+   * The protocol version for incoming server requests.
+   * 
+   * For client requests, these fields are ignored. The HTTP
+   * client code always uses either HTTP/1.1 or HTTP/2.
+   * See the docs on Transport for details.
+   */
+  proto: string // "HTTP/1.0"
+  protoMajor: number // 1
+  protoMinor: number // 0
+  /**
+   * Header contains the request header fields either received
+   * by the server or to be sent by the client.
+   * 
+   * If a server received a request with header lines,
+   * 
+   * ```
+   * 	Host: example.com
+   * 	accept-encoding: gzip, deflate
+   * 	Accept-Language: en-us
+   * 	fOO: Bar
+   * 	foo: two
+   * ```
+   * 
+   * then
+   * 
+   * ```
+   * 	Header = map[string][]string{
+   * 		"Accept-Encoding": {"gzip, deflate"},
+   * 		"Accept-Language": {"en-us"},
+   * 		"Foo": {"Bar", "two"},
+   * 	}
+   * ```
+   * 
+   * For incoming requests, the Host header is promoted to the
+   * Request.Host field and removed from the Header map.
+   * 
+   * HTTP defines that header names are case-insensitive. The
+   * request parser implements this by using CanonicalHeaderKey,
+   * making the first character and any characters following a
+   * hyphen uppercase and the rest lowercase.
+   * 
+   * For client requests, certain headers such as Content-Length
+   * and Connection are automatically written when needed and
+   * values in Header may be ignored. See the documentation
+   * for the Request.Write method.
+   */
+  header: Header
+  /**
+   * Body is the request's body.
+   * 
+   * For client requests, a nil body means the request has no
+   * body, such as a GET request. The HTTP Client's Transport
+   * is responsible for calling the Close method.
+   * 
+   * For server requests, the Request Body is always non-nil
+   * but will return EOF immediately when no body is present.
+   * The Server will close the request body. The ServeHTTP
+   * Handler does not need to.
+   * 
+   * Body must allow Read to be called concurrently with Close.
+   * In particular, calling Close should unblock a Read waiting
+   * for input.
+   */
+  body: io.ReadCloser
+  /**
+   * GetBody defines an optional func to return a new copy of
+   * Body. It is used for client requests when a redirect requires
+   * reading the body more than once. Use of GetBody still
+   * requires setting Body.
+   * 
+   * For server requests, it is unused.
+   */
+  getBody: () => io.ReadCloser
+  /**
+   * ContentLength records the length of the associated content.
+   * The value -1 indicates that the length is unknown.
+   * Values >= 0 indicate that the given number of bytes may
+   * be read from Body.
+   * 
+   * For client requests, a value of 0 with a non-nil Body is
+   * also treated as unknown.
+   */
+  contentLength: number
+  /**
+   * TransferEncoding lists the transfer encodings from outermost to
+   * innermost. An empty list denotes the "identity" encoding.
+   * TransferEncoding can usually be ignored; chunked encoding is
+   * automatically added and removed as necessary when sending and
+   * receiving requests.
+   */
+  transferEncoding: Array<string>
+  /**
+   * Close indicates whether to close the connection after
+   * replying to this request (for servers) or after sending this
+   * request and reading its response (for clients).
+   * 
+   * For server requests, the HTTP server handles this automatically
+   * and this field is not needed by Handlers.
+   * 
+   * For client requests, setting this field prevents re-use of
+   * TCP connections between requests to the same hosts, as if
+   * Transport.DisableKeepAlives were set.
+   */
+  close: boolean
+  /**
+   * For server requests, Host specifies the host on which the
+   * URL is sought. For HTTP/1 (per RFC 7230, section 5.4), this
+   * is either the value of the "Host" header or the host name
+   * given in the URL itself. For HTTP/2, it is the value of the
+   * ":authority" pseudo-header field.
+   * It may be of the form "host:port". For international domain
+   * names, Host may be in Punycode or Unicode form. Use
+   * golang.org/x/net/idna to convert it to either format if
+   * needed.
+   * To prevent DNS rebinding attacks, server Handlers should
+   * validate that the Host header has a value for which the
+   * Handler considers itself authoritative. The included
+   * ServeMux supports patterns registered to particular host
+   * names and thus protects its registered Handlers.
+   * 
+   * For client requests, Host optionally overrides the Host
+   * header to send. If empty, the Request.Write method uses
+   * the value of URL.Host. Host may contain an international
+   * domain name.
+   */
+  host: string
+  /**
+   * Form contains the parsed form data, including both the URL
+   * field's query parameters and the PATCH, POST, or PUT form data.
+   * This field is only available after ParseForm is called.
+   * The HTTP client ignores Form and uses Body instead.
+   */
+  form: url.Values
+  /**
+   * PostForm contains the parsed form data from PATCH, POST
+   * or PUT body parameters.
+   * 
+   * This field is only available after ParseForm is called.
+   * The HTTP client ignores PostForm and uses Body instead.
+   */
+  postForm: url.Values
+  /**
+   * MultipartForm is the parsed multipart form, including file uploads.
+   * This field is only available after ParseMultipartForm is called.
+   * The HTTP client ignores MultipartForm and uses Body instead.
+   */
+  multipartForm?: multipart.Form
+  /**
+   * Trailer specifies additional headers that are sent after the request
+   * body.
+   * 
+   * For server requests, the Trailer map initially contains only the
+   * trailer keys, with nil values. (The client declares which trailers it
+   * will later send.)  While the handler is reading from Body, it must
+   * not reference Trailer. After reading from Body returns EOF, Trailer
+   * can be read again and will contain non-nil values, if they were sent
+   * by the client.
+   * 
+   * For client requests, Trailer must be initialized to a map containing
+   * the trailer keys to later send. The values may be nil or their final
+   * values. The ContentLength must be 0 or -1, to send a chunked request.
+   * After the HTTP request is sent the map values can be updated while
+   * the request body is read. Once the body returns EOF, the caller must
+   * not mutate Trailer.
+   * 
+   * Few HTTP clients, servers, or proxies support HTTP trailers.
+   */
+  trailer: Header
+  /**
+   * RemoteAddr allows HTTP servers and other software to record
+   * the network address that sent the request, usually for
+   * logging. This field is not filled in by ReadRequest and
+   * has no defined format. The HTTP server in this package
+   * sets RemoteAddr to an "IP:port" address before invoking a
+   * handler.
+   * This field is ignored by the HTTP client.
+   */
+  remoteAddr: string
+  /**
+   * RequestURI is the unmodified request-target of the
+   * Request-Line (RFC 7230, Section 3.1.1) as sent by the client
+   * to a server. Usually the URL field should be used instead.
+   * It is an error to set this field in an HTTP client request.
+   */
+  requestURI: string
+  /**
+   * TLS allows HTTP servers and other software to record
+   * information about the TLS connection on which the request
+   * was received. This field is not filled in by ReadRequest.
+   * The HTTP server in this package sets the field for
+   * TLS-enabled connections before invoking a handler;
+   * otherwise it leaves the field nil.
+   * This field is ignored by the HTTP client.
+   */
+  tls?: any
+  /**
+   * Cancel is an optional channel whose closure indicates that the client
+   * request should be regarded as canceled. Not all implementations of
+   * RoundTripper may support Cancel.
+   * 
+   * For server requests, this field is not applicable.
+   * 
+   * Deprecated: Set the Request's context with NewRequestWithContext
+   * instead. If a Request's Cancel field and context are both
+   * set, it is undefined whether Cancel is respected.
+   */
+  cancel: undefined
+  /**
+   * Response is the redirect response which caused this request
+   * to be created. This field is only populated during client
+   * redirects.
+   */
+  response?: Response
+  /**
+   * Pattern is the [ServeMux] pattern that matched the request.
+   * It is empty if the request was not matched against a pattern.
+   */
+  pattern: string
+ }
+ interface Request {
+  /**
+   * Context returns the request's context. To change the context, use
+   * [Request.Clone] or [Request.WithContext].
+   * 
+   * The returned context is always non-nil; it defaults to the
+   * background context.
+   * 
+   * For outgoing client requests, the context controls cancellation.
+   * 
+   * For incoming server requests, the context is canceled when the
+   * client's connection closes, the request is canceled (with HTTP/2),
+   * or when the ServeHTTP method returns.
+   */
+  context(): context.Context
+ }
+ interface Request {
+  /**
+   * WithContext returns a shallow copy of r with its context changed
+   * to ctx. The provided ctx must be non-nil.
+   * 
+   * For outgoing client request, the context controls the entire
+   * lifetime of a request and its response: obtaining a connection,
+   * sending the request, and reading the response headers and body.
+   * 
+   * To create a new request with a context, use [NewRequestWithContext].
+   * To make a deep copy of a request with a new context, use [Request.Clone].
+   */
+  withContext(ctx: context.Context): (Request)
+ }
+ interface Request {
+  /**
+   * Clone returns a deep copy of r with its context changed to ctx.
+   * The provided ctx must be non-nil.
+   * 
+   * Clone only makes a shallow copy of the Body field.
+   * 
+   * For an outgoing client request, the context controls the entire
+   * lifetime of a request and its response: obtaining a connection,
+   * sending the request, and reading the response headers and body.
+   */
+  clone(ctx: context.Context): (Request)
+ }
+ interface Request {
+  /**
+   * ProtoAtLeast reports whether the HTTP protocol used
+   * in the request is at least major.minor.
+   */
+  protoAtLeast(major: number, minor: number): boolean
+ }
+ interface Request {
+  /**
+   * UserAgent returns the client's User-Agent, if sent in the request.
+   */
+  userAgent(): string
+ }
+ interface Request {
+  /**
+   * Cookies parses and returns the HTTP cookies sent with the request.
+   */
+  cookies(): Array<(Cookie | undefined)>
+ }
+ interface Request {
+  /**
+   * CookiesNamed parses and returns the named HTTP cookies sent with the request
+   * or an empty slice if none matched.
+   */
+  cookiesNamed(name: string): Array<(Cookie | undefined)>
+ }
+ interface Request {
+  /**
+   * Cookie returns the named cookie provided in the request or
+   * [ErrNoCookie] if not found.
+   * If multiple cookies match the given name, only one cookie will
+   * be returned.
+   */
+  cookie(name: string): (Cookie)
+ }
+ interface Request {
+  /**
+   * AddCookie adds a cookie to the request. Per RFC 6265 section 5.4,
+   * AddCookie does not attach more than one [Cookie] header field. That
+   * means all cookies, if any, are written into the same line,
+   * separated by semicolon.
+   * AddCookie only sanitizes c's name and value, and does not sanitize
+   * a Cookie header already present in the request.
+   */
+  addCookie(c: Cookie): void
+ }
+ interface Request {
+  /**
+   * Referer returns the referring URL, if sent in the request.
+   * 
+   * Referer is misspelled as in the request itself, a mistake from the
+   * earliest days of HTTP.  This value can also be fetched from the
+   * [Header] map as Header["Referer"]; the benefit of making it available
+   * as a method is that the compiler can diagnose programs that use the
+   * alternate (correct English) spelling req.Referrer() but cannot
+   * diagnose programs that use Header["Referrer"].
+   */
+  referer(): string
+ }
+ interface Request {
+  /**
+   * MultipartReader returns a MIME multipart reader if this is a
+   * multipart/form-data or a multipart/mixed POST request, else returns nil and an error.
+   * Use this function instead of [Request.ParseMultipartForm] to
+   * process the request body as a stream.
+   */
+  multipartReader(): (multipart.Reader)
+ }
+ interface Request {
+  /**
+   * Write writes an HTTP/1.1 request, which is the header and body, in wire format.
+   * This method consults the following fields of the request:
+   * 
+   * ```
+   * 	Host
+   * 	URL
+   * 	Method (defaults to "GET")
+   * 	Header
+   * 	ContentLength
+   * 	TransferEncoding
+   * 	Body
+   * ```
+   * 
+   * If Body is present, Content-Length is <= 0 and [Request.TransferEncoding]
+   * hasn't been set to "identity", Write adds "Transfer-Encoding:
+   * chunked" to the header. Body is closed after it is sent.
+   */
+  write(w: io.Writer): void
+ }
+ interface Request {
+  /**
+   * WriteProxy is like [Request.Write] but writes the request in the form
+   * expected by an HTTP proxy. In particular, [Request.WriteProxy] writes the
+   * initial Request-URI line of the request with an absolute URI, per
+   * section 5.3 of RFC 7230, including the scheme and host.
+   * In either case, WriteProxy also writes a Host header, using
+   * either r.Host or r.URL.Host.
+   */
+  writeProxy(w: io.Writer): void
+ }
+ interface Request {
+  /**
+   * BasicAuth returns the username and password provided in the request's
+   * Authorization header, if the request uses HTTP Basic Authentication.
+   * See RFC 2617, Section 2.
+   */
+  basicAuth(): [string, string, boolean]
+ }
+ interface Request {
+  /**
+   * SetBasicAuth sets the request's Authorization header to use HTTP
+   * Basic Authentication with the provided username and password.
+   * 
+   * With HTTP Basic Authentication the provided username and password
+   * are not encrypted. It should generally only be used in an HTTPS
+   * request.
+   * 
+   * The username may not contain a colon. Some protocols may impose
+   * additional requirements on pre-escaping the username and
+   * password. For instance, when used with OAuth2, both arguments must
+   * be URL encoded first with [url.QueryEscape].
+   */
+  setBasicAuth(username: string, password: string): void
+ }
+ interface Request {
+  /**
+   * ParseForm populates r.Form and r.PostForm.
+   * 
+   * For all requests, ParseForm parses the raw query from the URL and updates
+   * r.Form.
+   * 
+   * For POST, PUT, and PATCH requests, it also reads the request body, parses it
+   * as a form and puts the results into both r.PostForm and r.Form. Request body
+   * parameters take precedence over URL query string values in r.Form.
+   * 
+   * If the request Body's size has not already been limited by [MaxBytesReader],
+   * the size is capped at 10MB.
+   * 
+   * For other HTTP methods, or when the Content-Type is not
+   * application/x-www-form-urlencoded, the request Body is not read, and
+   * r.PostForm is initialized to a non-nil, empty value.
+   * 
+   * [Request.ParseMultipartForm] calls ParseForm automatically.
+   * ParseForm is idempotent.
+   */
+  parseForm(): void
+ }
+ interface Request {
+  /**
+   * ParseMultipartForm parses a request body as multipart/form-data.
+   * The whole request body is parsed and up to a total of maxMemory bytes of
+   * its file parts are stored in memory, with the remainder stored on
+   * disk in temporary files.
+   * ParseMultipartForm calls [Request.ParseForm] if necessary.
+   * If ParseForm returns an error, ParseMultipartForm returns it but also
+   * continues parsing the request body.
+   * After one call to ParseMultipartForm, subsequent calls have no effect.
+   */
+  parseMultipartForm(maxMemory: number): void
+ }
+ interface Request {
+  /**
+   * FormValue returns the first value for the named component of the query.
+   * The precedence order:
+   *  1. application/x-www-form-urlencoded form body (POST, PUT, PATCH only)
+   *  2. query parameters (always)
+   *  3. multipart/form-data form body (always)
+   * 
+   * FormValue calls [Request.ParseMultipartForm] and [Request.ParseForm]
+   * if necessary and ignores any errors returned by these functions.
+   * If key is not present, FormValue returns the empty string.
+   * To access multiple values of the same key, call ParseForm and
+   * then inspect [Request.Form] directly.
+   */
+  formValue(key: string): string
+ }
+ interface Request {
+  /**
+   * PostFormValue returns the first value for the named component of the POST,
+   * PUT, or PATCH request body. URL query parameters are ignored.
+   * PostFormValue calls [Request.ParseMultipartForm] and [Request.ParseForm] if necessary and ignores
+   * any errors returned by these functions.
+   * If key is not present, PostFormValue returns the empty string.
+   */
+  postFormValue(key: string): string
+ }
+ interface Request {
+  /**
+   * FormFile returns the first file for the provided form key.
+   * FormFile calls [Request.ParseMultipartForm] and [Request.ParseForm] if necessary.
+   */
+  formFile(key: string): [multipart.File, (multipart.FileHeader)]
+ }
+ interface Request {
+  /**
+   * PathValue returns the value for the named path wildcard in the [ServeMux] pattern
+   * that matched the request.
+   * It returns the empty string if the request was not matched against a pattern
+   * or there is no such wildcard in the pattern.
+   */
+  pathValue(name: string): string
+ }
+ interface Request {
+  /**
+   * SetPathValue sets name to value, so that subsequent calls to r.PathValue(name)
+   * return value.
+   */
+  setPathValue(name: string, value: string): void
+ }
+ /**
+  * A Handler responds to an HTTP request.
+  * 
+  * [Handler.ServeHTTP] should write reply headers and data to the [ResponseWriter]
+  * and then return. Returning signals that the request is finished; it
+  * is not valid to use the [ResponseWriter] or read from the
+  * [Request.Body] after or concurrently with the completion of the
+  * ServeHTTP call.
+  * 
+  * Depending on the HTTP client software, HTTP protocol version, and
+  * any intermediaries between the client and the Go server, it may not
+  * be possible to read from the [Request.Body] after writing to the
+  * [ResponseWriter]. Cautious handlers should read the [Request.Body]
+  * first, and then reply.
+  * 
+  * Except for reading the body, handlers should not modify the
+  * provided Request.
+  * 
+  * If ServeHTTP panics, the server (the caller of ServeHTTP) assumes
+  * that the effect of the panic was isolated to the active request.
+  * It recovers the panic, logs a stack trace to the server error log,
+  * and either closes the network connection or sends an HTTP/2
+  * RST_STREAM, depending on the HTTP protocol. To abort a handler so
+  * the client sees an interrupted response but the server doesn't log
+  * an error, panic with the value [ErrAbortHandler].
+  */
+ interface Handler {
+  [key:string]: any;
+  serveHTTP(_arg0: ResponseWriter, _arg1: Request): void
+ }
+ /**
+  * A ResponseWriter interface is used by an HTTP handler to
+  * construct an HTTP response.
+  * 
+  * A ResponseWriter may not be used after [Handler.ServeHTTP] has returned.
+  */
+ interface ResponseWriter {
+  [key:string]: any;
+  /**
+   * Header returns the header map that will be sent by
+   * [ResponseWriter.WriteHeader]. The [Header] map also is the mechanism with which
+   * [Handler] implementations can set HTTP trailers.
+   * 
+   * Changing the header map after a call to [ResponseWriter.WriteHeader] (or
+   * [ResponseWriter.Write]) has no effect unless the HTTP status code was of the
+   * 1xx class or the modified headers are trailers.
+   * 
+   * There are two ways to set Trailers. The preferred way is to
+   * predeclare in the headers which trailers you will later
+   * send by setting the "Trailer" header to the names of the
+   * trailer keys which will come later. In this case, those
+   * keys of the Header map are treated as if they were
+   * trailers. See the example. The second way, for trailer
+   * keys not known to the [Handler] until after the first [ResponseWriter.Write],
+   * is to prefix the [Header] map keys with the [TrailerPrefix]
+   * constant value.
+   * 
+   * To suppress automatic response headers (such as "Date"), set
+   * their value to nil.
+   */
+  header(): Header
+  /**
+   * Write writes the data to the connection as part of an HTTP reply.
+   * 
+   * If [ResponseWriter.WriteHeader] has not yet been called, Write calls
+   * WriteHeader(http.StatusOK) before writing the data. If the Header
+   * does not contain a Content-Type line, Write adds a Content-Type set
+   * to the result of passing the initial 512 bytes of written data to
+   * [DetectContentType]. Additionally, if the total size of all written
+   * data is under a few KB and there are no Flush calls, the
+   * Content-Length header is added automatically.
+   * 
+   * Depending on the HTTP protocol version and the client, calling
+   * Write or WriteHeader may prevent future reads on the
+   * Request.Body. For HTTP/1.x requests, handlers should read any
+   * needed request body data before writing the response. Once the
+   * headers have been flushed (due to either an explicit Flusher.Flush
+   * call or writing enough data to trigger a flush), the request body
+   * may be unavailable. For HTTP/2 requests, the Go HTTP server permits
+   * handlers to continue to read the request body while concurrently
+   * writing the response. However, such behavior may not be supported
+   * by all HTTP/2 clients. Handlers should read before writing if
+   * possible to maximize compatibility.
+   */
+  write(_arg0: string|Array<number>): number
+  /**
+   * WriteHeader sends an HTTP response header with the provided
+   * status code.
+   * 
+   * If WriteHeader is not called explicitly, the first call to Write
+   * will trigger an implicit WriteHeader(http.StatusOK).
+   * Thus explicit calls to WriteHeader are mainly used to
+   * send error codes or 1xx informational responses.
+   * 
+   * The provided code must be a valid HTTP 1xx-5xx status code.
+   * Any number of 1xx headers may be written, followed by at most
+   * one 2xx-5xx header. 1xx headers are sent immediately, but 2xx-5xx
+   * headers may be buffered. Use the Flusher interface to send
+   * buffered data. The header map is cleared when 2xx-5xx headers are
+   * sent, but not with 1xx headers.
+   * 
+   * The server will automatically send a 100 (Continue) header
+   * on the first read from the request body if the request has
+   * an "Expect: 100-continue" header.
+   */
+  writeHeader(statusCode: number): void
+ }
+ /**
+  * A Server defines parameters for running an HTTP server.
+  * The zero value for Server is a valid configuration.
+  */
+ interface Server {
+  /**
+   * Addr optionally specifies the TCP address for the server to listen on,
+   * in the form "host:port". If empty, ":http" (port 80) is used.
+   * The service names are defined in RFC 6335 and assigned by IANA.
+   * See net.Dial for details of the address format.
+   */
+  addr: string
+  handler: Handler // handler to invoke, http.DefaultServeMux if nil
+  /**
+   * DisableGeneralOptionsHandler, if true, passes "OPTIONS *" requests to the Handler,
+   * otherwise responds with 200 OK and Content-Length: 0.
+   */
+  disableGeneralOptionsHandler: boolean
+  /**
+   * TLSConfig optionally provides a TLS configuration for use
+   * by ServeTLS and ListenAndServeTLS. Note that this value is
+   * cloned by ServeTLS and ListenAndServeTLS, so it's not
+   * possible to modify the configuration with methods like
+   * tls.Config.SetSessionTicketKeys. To use
+   * SetSessionTicketKeys, use Server.Serve with a TLS Listener
+   * instead.
+   */
+  tlsConfig?: any
+  /**
+   * ReadTimeout is the maximum duration for reading the entire
+   * request, including the body. A zero or negative value means
+   * there will be no timeout.
+   * 
+   * Because ReadTimeout does not let Handlers make per-request
+   * decisions on each request body's acceptable deadline or
+   * upload rate, most users will prefer to use
+   * ReadHeaderTimeout. It is valid to use them both.
+   */
+  readTimeout: time.Duration
+  /**
+   * ReadHeaderTimeout is the amount of time allowed to read
+   * request headers. The connection's read deadline is reset
+   * after reading the headers and the Handler can decide what
+   * is considered too slow for the body. If zero, the value of
+   * ReadTimeout is used. If negative, or if zero and ReadTimeout
+   * is zero or negative, there is no timeout.
+   */
+  readHeaderTimeout: time.Duration
+  /**
+   * WriteTimeout is the maximum duration before timing out
+   * writes of the response. It is reset whenever a new
+   * request's header is read. Like ReadTimeout, it does not
+   * let Handlers make decisions on a per-request basis.
+   * A zero or negative value means there will be no timeout.
+   */
+  writeTimeout: time.Duration
+  /**
+   * IdleTimeout is the maximum amount of time to wait for the
+   * next request when keep-alives are enabled. If zero, the value
+   * of ReadTimeout is used. If negative, or if zero and ReadTimeout
+   * is zero or negative, there is no timeout.
+   */
+  idleTimeout: time.Duration
+  /**
+   * MaxHeaderBytes controls the maximum number of bytes the
+   * server will read parsing the request header's keys and
+   * values, including the request line. It does not limit the
+   * size of the request body.
+   * If zero, DefaultMaxHeaderBytes is used.
+   */
+  maxHeaderBytes: number
+  /**
+   * TLSNextProto optionally specifies a function to take over
+   * ownership of the provided TLS connection when an ALPN
+   * protocol upgrade has occurred. The map key is the protocol
+   * name negotiated. The Handler argument should be used to
+   * handle HTTP requests and will initialize the Request's TLS
+   * and RemoteAddr if not already set. The connection is
+   * automatically closed when the function returns.
+   * If TLSNextProto is not nil, HTTP/2 support is not enabled
+   * automatically.
+   */
+  tlsNextProto: _TygojaDict
+  /**
+   * ConnState specifies an optional callback function that is
+   * called when a client connection changes state. See the
+   * ConnState type and associated constants for details.
+   */
+  connState: (_arg0: net.Conn, _arg1: ConnState) => void
+  /**
+   * ErrorLog specifies an optional logger for errors accepting
+   * connections, unexpected behavior from handlers, and
+   * underlying FileSystem errors.
+   * If nil, logging is done via the log package's standard logger.
+   */
+  errorLog?: any
+  /**
+   * BaseContext optionally specifies a function that returns
+   * the base context for incoming requests on this server.
+   * The provided Listener is the specific Listener that's
+   * about to start accepting requests.
+   * If BaseContext is nil, the default is context.Background().
+   * If non-nil, it must return a non-nil context.
+   */
+  baseContext: (_arg0: net.Listener) => context.Context
+  /**
+   * ConnContext optionally specifies a function that modifies
+   * the context used for a new connection c. The provided ctx
+   * is derived from the base context and has a ServerContextKey
+   * value.
+   */
+  connContext: (ctx: context.Context, c: net.Conn) => context.Context
+ }
+ interface Server {
+  /**
+   * Close immediately closes all active net.Listeners and any
+   * connections in state [StateNew], [StateActive], or [StateIdle]. For a
+   * graceful shutdown, use [Server.Shutdown].
+   * 
+   * Close does not attempt to close (and does not even know about)
+   * any hijacked connections, such as WebSockets.
+   * 
+   * Close returns any error returned from closing the [Server]'s
+   * underlying Listener(s).
+   */
+  close(): void
+ }
+ interface Server {
+  /**
+   * Shutdown gracefully shuts down the server without interrupting any
+   * active connections. Shutdown works by first closing all open
+   * listeners, then closing all idle connections, and then waiting
+   * indefinitely for connections to return to idle and then shut down.
+   * If the provided context expires before the shutdown is complete,
+   * Shutdown returns the context's error, otherwise it returns any
+   * error returned from closing the [Server]'s underlying Listener(s).
+   * 
+   * When Shutdown is called, [Serve], [ListenAndServe], and
+   * [ListenAndServeTLS] immediately return [ErrServerClosed]. Make sure the
+   * program doesn't exit and waits instead for Shutdown to return.
+   * 
+   * Shutdown does not attempt to close nor wait for hijacked
+   * connections such as WebSockets. The caller of Shutdown should
+   * separately notify such long-lived connections of shutdown and wait
+   * for them to close, if desired. See [Server.RegisterOnShutdown] for a way to
+   * register shutdown notification functions.
+   * 
+   * Once Shutdown has been called on a server, it may not be reused;
+   * future calls to methods such as Serve will return ErrServerClosed.
+   */
+  shutdown(ctx: context.Context): void
+ }
+ interface Server {
+  /**
+   * RegisterOnShutdown registers a function to call on [Server.Shutdown].
+   * This can be used to gracefully shutdown connections that have
+   * undergone ALPN protocol upgrade or that have been hijacked.
+   * This function should start protocol-specific graceful shutdown,
+   * but should not wait for shutdown to complete.
+   */
+  registerOnShutdown(f: () => void): void
+ }
+ interface Server {
+  /**
+   * ListenAndServe listens on the TCP network address srv.Addr and then
+   * calls [Serve] to handle requests on incoming connections.
+   * Accepted connections are configured to enable TCP keep-alives.
+   * 
+   * If srv.Addr is blank, ":http" is used.
+   * 
+   * ListenAndServe always returns a non-nil error. After [Server.Shutdown] or [Server.Close],
+   * the returned error is [ErrServerClosed].
+   */
+  listenAndServe(): void
+ }
+ interface Server {
+  /**
+   * Serve accepts incoming connections on the Listener l, creating a
+   * new service goroutine for each. The service goroutines read requests and
+   * then call srv.Handler to reply to them.
+   * 
+   * HTTP/2 support is only enabled if the Listener returns [*tls.Conn]
+   * connections and they were configured with "h2" in the TLS
+   * Config.NextProtos.
+   * 
+   * Serve always returns a non-nil error and closes l.
+   * After [Server.Shutdown] or [Server.Close], the returned error is [ErrServerClosed].
+   */
+  serve(l: net.Listener): void
+ }
+ interface Server {
+  /**
+   * ServeTLS accepts incoming connections on the Listener l, creating a
+   * new service goroutine for each. The service goroutines perform TLS
+   * setup and then read requests, calling srv.Handler to reply to them.
+   * 
+   * Files containing a certificate and matching private key for the
+   * server must be provided if neither the [Server]'s
+   * TLSConfig.Certificates, TLSConfig.GetCertificate nor
+   * config.GetConfigForClient are populated.
+   * If the certificate is signed by a certificate authority, the
+   * certFile should be the concatenation of the server's certificate,
+   * any intermediates, and the CA's certificate.
+   * 
+   * ServeTLS always returns a non-nil error. After [Server.Shutdown] or [Server.Close], the
+   * returned error is [ErrServerClosed].
+   */
+  serveTLS(l: net.Listener, certFile: string, keyFile: string): void
+ }
+ interface Server {
+  /**
+   * SetKeepAlivesEnabled controls whether HTTP keep-alives are enabled.
+   * By default, keep-alives are always enabled. Only very
+   * resource-constrained environments or servers in the process of
+   * shutting down should disable them.
+   */
+  setKeepAlivesEnabled(v: boolean): void
+ }
+ interface Server {
+  /**
+   * ListenAndServeTLS listens on the TCP network address srv.Addr and
+   * then calls [ServeTLS] to handle requests on incoming TLS connections.
+   * Accepted connections are configured to enable TCP keep-alives.
+   * 
+   * Filenames containing a certificate and matching private key for the
+   * server must be provided if neither the [Server]'s TLSConfig.Certificates
+   * nor TLSConfig.GetCertificate are populated. If the certificate is
+   * signed by a certificate authority, the certFile should be the
+   * concatenation of the server's certificate, any intermediates, and
+   * the CA's certificate.
+   * 
+   * If srv.Addr is blank, ":https" is used.
+   * 
+   * ListenAndServeTLS always returns a non-nil error. After [Server.Shutdown] or
+   * [Server.Close], the returned error is [ErrServerClosed].
+   */
+  listenAndServeTLS(certFile: string, keyFile: string): void
+ }
+}
+
+namespace hook {
+ /**
+  * Event implements [Resolver] and it is intended to be used as a base
+  * Hook event that you can embed in your custom typed event structs.
+  * 
+  * Example:
+  * 
+  * ```
+  * 	type CustomEvent struct {
+  * 		hook.Event
+  * 
+  * 		SomeField int
+  * 	}
+  * ```
+  */
+ interface Event {
+ }
+ interface Event {
+  /**
+   * Next calls the next hook handler.
+   */
+  next(): void
+ }
+ /**
+  * Handler defines a single Hook handler.
+  * Multiple handlers can share the same id.
+  * If Id is not explicitly set it will be autogenerated by Hook.Add and Hook.AddHandler.
+  */
+ interface Handler<T> {
+  /**
+   * Func defines the handler function to execute.
+   * 
+   * Note that users need to call e.Next() in order to proceed with
+   * the execution of the hook chain.
+   */
+  func: (_arg0: T) => void
+  /**
+   * Id is the unique identifier of the handler.
+   * 
+   * It could be used later to remove the handler from a hook via [Hook.Remove].
+   * 
+   * If missing, an autogenerated value will be assigned when adding
+   * the handler to a hook.
+   */
+  id: string
+  /**
+   * Priority allows changing the default exec priority of the handler within a hook.
+   * 
+   * If 0, the handler will be executed in the same order it was registered.
+   */
+  priority: number
+ }
+ /**
+  * Hook defines a generic concurrent safe structure for managing event hooks.
+  * 
+  * When using custom event it must embed the base [hook.Event].
+  * 
+  * Example:
+  * 
+  * ```
+  * 	type CustomEvent struct {
+  * 		hook.Event
+  * 		SomeField int
+  * 	}
+  * 
+  * 	h := Hook[*CustomEvent]{}
+  * 
+  * 	h.BindFunc(func(e *CustomEvent) error {
+  * 		println(e.SomeField)
+  * 
+  * 		return e.Next()
+  * 	})
+  * 
+  * 	h.Trigger(&CustomEvent{ SomeField: 123 })
+  * ```
+  */
+ interface Hook<T> {
+ }
+ /**
+  * TaggedHook defines a proxy hook which register handlers that are triggered only
+  * if the TaggedHook.tags are empty or includes at least one of the event data tag(s).
+  */
+ type _sSpEQZd<T> = mainHook<T>
+ interface TaggedHook<T> extends _sSpEQZd<T> {
+ }
+}
+
+namespace exec {
+ /**
+  * Cmd represents an external command being prepared or run.
+  * 
+  * A Cmd cannot be reused after calling its [Cmd.Run], [Cmd.Output] or [Cmd.CombinedOutput]
+  * methods.
+  */
+ interface Cmd {
+  /**
+   * Path is the path of the command to run.
+   * 
+   * This is the only field that must be set to a non-zero
+   * value. If Path is relative, it is evaluated relative
+   * to Dir.
+   */
+  path: string
+  /**
+   * Args holds command line arguments, including the command as Args[0].
+   * If the Args field is empty or nil, Run uses {Path}.
+   * 
+   * In typical use, both Path and Args are set by calling Command.
+   */
+  args: Array<string>
+  /**
+   * Env specifies the environment of the process.
+   * Each entry is of the form "key=value".
+   * If Env is nil, the new process uses the current process's
+   * environment.
+   * If Env contains duplicate environment keys, only the last
+   * value in the slice for each duplicate key is used.
+   * As a special case on Windows, SYSTEMROOT is always added if
+   * missing and not explicitly set to the empty string.
+   */
+  env: Array<string>
+  /**
+   * Dir specifies the working directory of the command.
+   * If Dir is the empty string, Run runs the command in the
+   * calling process's current directory.
+   */
+  dir: string
+  /**
+   * Stdin specifies the process's standard input.
+   * 
+   * If Stdin is nil, the process reads from the null device (os.DevNull).
+   * 
+   * If Stdin is an *os.File, the process's standard input is connected
+   * directly to that file.
+   * 
+   * Otherwise, during the execution of the command a separate
+   * goroutine reads from Stdin and delivers that data to the command
+   * over a pipe. In this case, Wait does not complete until the goroutine
+   * stops copying, either because it has reached the end of Stdin
+   * (EOF or a read error), or because writing to the pipe returned an error,
+   * or because a nonzero WaitDelay was set and expired.
+   */
+  stdin: io.Reader
+  /**
+   * Stdout and Stderr specify the process's standard output and error.
+   * 
+   * If either is nil, Run connects the corresponding file descriptor
+   * to the null device (os.DevNull).
+   * 
+   * If either is an *os.File, the corresponding output from the process
+   * is connected directly to that file.
+   * 
+   * Otherwise, during the execution of the command a separate goroutine
+   * reads from the process over a pipe and delivers that data to the
+   * corresponding Writer. In this case, Wait does not complete until the
+   * goroutine reaches EOF or encounters an error or a nonzero WaitDelay
+   * expires.
+   * 
+   * If Stdout and Stderr are the same writer, and have a type that can
+   * be compared with ==, at most one goroutine at a time will call Write.
+   */
+  stdout: io.Writer
+  stderr: io.Writer
+  /**
+   * ExtraFiles specifies additional open files to be inherited by the
+   * new process. It does not include standard input, standard output, or
+   * standard error. If non-nil, entry i becomes file descriptor 3+i.
+   * 
+   * ExtraFiles is not supported on Windows.
+   */
+  extraFiles: Array<(os.File | undefined)>
+  /**
+   * SysProcAttr holds optional, operating system-specific attributes.
+   * Run passes it to os.StartProcess as the os.ProcAttr's Sys field.
+   */
+  sysProcAttr?: syscall.SysProcAttr
+  /**
+   * Process is the underlying process, once started.
+   */
+  process?: os.Process
+  /**
+   * ProcessState contains information about an exited process.
+   * If the process was started successfully, Wait or Run will
+   * populate its ProcessState when the command completes.
+   */
+  processState?: os.ProcessState
+  err: Error // LookPath error, if any.
+  /**
+   * If Cancel is non-nil, the command must have been created with
+   * CommandContext and Cancel will be called when the command's
+   * Context is done. By default, CommandContext sets Cancel to
+   * call the Kill method on the command's Process.
+   * 
+   * Typically a custom Cancel will send a signal to the command's
+   * Process, but it may instead take other actions to initiate cancellation,
+   * such as closing a stdin or stdout pipe or sending a shutdown request on a
+   * network socket.
+   * 
+   * If the command exits with a success status after Cancel is
+   * called, and Cancel does not return an error equivalent to
+   * os.ErrProcessDone, then Wait and similar methods will return a non-nil
+   * error: either an error wrapping the one returned by Cancel,
+   * or the error from the Context.
+   * (If the command exits with a non-success status, or Cancel
+   * returns an error that wraps os.ErrProcessDone, Wait and similar methods
+   * continue to return the command's usual exit status.)
+   * 
+   * If Cancel is set to nil, nothing will happen immediately when the command's
+   * Context is done, but a nonzero WaitDelay will still take effect. That may
+   * be useful, for example, to work around deadlocks in commands that do not
+   * support shutdown signals but are expected to always finish quickly.
+   * 
+   * Cancel will not be called if Start returns a non-nil error.
+   */
+  cancel: () => void
+  /**
+   * If WaitDelay is non-zero, it bounds the time spent waiting on two sources
+   * of unexpected delay in Wait: a child process that fails to exit after the
+   * associated Context is canceled, and a child process that exits but leaves
+   * its I/O pipes unclosed.
+   * 
+   * The WaitDelay timer starts when either the associated Context is done or a
+   * call to Wait observes that the child process has exited, whichever occurs
+   * first. When the delay has elapsed, the command shuts down the child process
+   * and/or its I/O pipes.
+   * 
+   * If the child process has failed to exit — perhaps because it ignored or
+   * failed to receive a shutdown signal from a Cancel function, or because no
+   * Cancel function was set — then it will be terminated using os.Process.Kill.
+   * 
+   * Then, if the I/O pipes communicating with the child process are still open,
+   * those pipes are closed in order to unblock any goroutines currently blocked
+   * on Read or Write calls.
+   * 
+   * If pipes are closed due to WaitDelay, no Cancel call has occurred,
+   * and the command has otherwise exited with a successful status, Wait and
+   * similar methods will return ErrWaitDelay instead of nil.
+   * 
+   * If WaitDelay is zero (the default), I/O pipes will be read until EOF,
+   * which might not occur until orphaned subprocesses of the command have
+   * also closed their descriptors for the pipes.
+   */
+  waitDelay: time.Duration
+ }
+ interface Cmd {
+  /**
+   * String returns a human-readable description of c.
+   * It is intended only for debugging.
+   * In particular, it is not suitable for use as input to a shell.
+   * The output of String may vary across Go releases.
+   */
+  string(): string
+ }
+ interface Cmd {
+  /**
+   * Run starts the specified command and waits for it to complete.
+   * 
+   * The returned error is nil if the command runs, has no problems
+   * copying stdin, stdout, and stderr, and exits with a zero exit
+   * status.
+   * 
+   * If the command starts but does not complete successfully, the error is of
+   * type [*ExitError]. Other error types may be returned for other situations.
+   * 
+   * If the calling goroutine has locked the operating system thread
+   * with [runtime.LockOSThread] and modified any inheritable OS-level
+   * thread state (for example, Linux or Plan 9 name spaces), the new
+   * process will inherit the caller's thread state.
+   */
+  run(): void
+ }
+ interface Cmd {
+  /**
+   * Start starts the specified command but does not wait for it to complete.
+   * 
+   * If Start returns successfully, the c.Process field will be set.
+   * 
+   * After a successful call to Start the [Cmd.Wait] method must be called in
+   * order to release associated system resources.
+   */
+  start(): void
+ }
+ interface Cmd {
+  /**
+   * Wait waits for the command to exit and waits for any copying to
+   * stdin or copying from stdout or stderr to complete.
+   * 
+   * The command must have been started by [Cmd.Start].
+   * 
+   * The returned error is nil if the command runs, has no problems
+   * copying stdin, stdout, and stderr, and exits with a zero exit
+   * status.
+   * 
+   * If the command fails to run or doesn't complete successfully, the
+   * error is of type [*ExitError]. Other error types may be
+   * returned for I/O problems.
+   * 
+   * If any of c.Stdin, c.Stdout or c.Stderr are not an [*os.File], Wait also waits
+   * for the respective I/O loop copying to or from the process to complete.
+   * 
+   * Wait releases any resources associated with the [Cmd].
+   */
+  wait(): void
+ }
+ interface Cmd {
+  /**
+   * Output runs the command and returns its standard output.
+   * Any returned error will usually be of type [*ExitError].
+   * If c.Stderr was nil, Output populates [ExitError.Stderr].
+   */
+  output(): string|Array<number>
+ }
+ interface Cmd {
+  /**
+   * CombinedOutput runs the command and returns its combined standard
+   * output and standard error.
+   */
+  combinedOutput(): string|Array<number>
+ }
+ interface Cmd {
+  /**
+   * StdinPipe returns a pipe that will be connected to the command's
+   * standard input when the command starts.
+   * The pipe will be closed automatically after [Cmd.Wait] sees the command exit.
+   * A caller need only call Close to force the pipe to close sooner.
+   * For example, if the command being run will not exit until standard input
+   * is closed, the caller must close the pipe.
+   */
+  stdinPipe(): io.WriteCloser
+ }
+ interface Cmd {
+  /**
+   * StdoutPipe returns a pipe that will be connected to the command's
+   * standard output when the command starts.
+   * 
+   * [Cmd.Wait] will close the pipe after seeing the command exit, so most callers
+   * need not close the pipe themselves. It is thus incorrect to call Wait
+   * before all reads from the pipe have completed.
+   * For the same reason, it is incorrect to call [Cmd.Run] when using StdoutPipe.
+   * See the example for idiomatic usage.
+   */
+  stdoutPipe(): io.ReadCloser
+ }
+ interface Cmd {
+  /**
+   * StderrPipe returns a pipe that will be connected to the command's
+   * standard error when the command starts.
+   * 
+   * [Cmd.Wait] will close the pipe after seeing the command exit, so most callers
+   * need not close the pipe themselves. It is thus incorrect to call Wait
+   * before all reads from the pipe have completed.
+   * For the same reason, it is incorrect to use [Cmd.Run] when using StderrPipe.
+   * See the StdoutPipe example for idiomatic usage.
+   */
+  stderrPipe(): io.ReadCloser
+ }
+ interface Cmd {
+  /**
+   * Environ returns a copy of the environment in which the command would be run
+   * as it is currently configured.
+   */
+  environ(): Array<string>
+ }
+}
+
+namespace mailer {
+ /**
+  * Message defines a generic email message struct.
+  */
+ interface Message {
+  from: { address: string; name?: string; }
+  to: Array<{ address: string; name?: string; }>
+  bcc: Array<{ address: string; name?: string; }>
+  cc: Array<{ address: string; name?: string; }>
+  subject: string
+  html: string
+  text: string
+  headers: _TygojaDict
+  attachments: _TygojaDict
+  inlineAttachments: _TygojaDict
+ }
+ /**
+  * Mailer defines a base mail client interface.
+  */
+ interface Mailer {
+  [key:string]: any;
+  /**
+   * Send sends an email with the provided Message.
+   */
+  send(message: Message): void
+ }
+}
+
+/**
+ * Package blob defines a lightweight abstration for interacting with
+ * various storage services (local filesystem, S3, etc.).
+ * 
+ * NB!
+ * For compatibility with earlier PocketBase versions and to prevent
+ * unnecessary breaking changes, this package is based and implemented
+ * as a minimal, stripped down version of the previously used gocloud.dev/blob.
+ * While there is no promise that it won't diverge in the future to accommodate
+ * better some PocketBase specific use cases, currently it copies and
+ * tries to follow as close as possible the same implementations,
+ * conventions and rules for the key escaping/unescaping, blob read/write
+ * interfaces and struct options as gocloud.dev/blob, therefore the
+ * credits goes to the original Go Cloud Development Kit Authors.
+ */
+namespace blob {
+ /**
+  * ListObject represents a single blob returned from List.
+  */
+ interface ListObject {
+  /**
+   * Key is the key for this blob.
+   */
+  key: string
+  /**
+   * ModTime is the time the blob was last modified.
+   */
+  modTime: time.Time
+  /**
+   * Size is the size of the blob's content in bytes.
+   */
+  size: number
+  /**
+   * MD5 is an MD5 hash of the blob contents or nil if not available.
+   */
+  md5: string|Array<number>
+  /**
+   * IsDir indicates that this result represents a "directory" in the
+   * hierarchical namespace, ending in ListOptions.Delimiter. Key can be
+   * passed as ListOptions.Prefix to list items in the "directory".
+   * Fields other than Key and IsDir will not be set if IsDir is true.
+   */
+  isDir: boolean
+ }
+ /**
+  * Attributes contains attributes about a blob.
+  */
+ interface Attributes {
+  /**
+   * CacheControl specifies caching attributes that services may use
+   * when serving the blob.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
+   */
+  cacheControl: string
+  /**
+   * ContentDisposition specifies whether the blob content is expected to be
+   * displayed inline or as an attachment.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
+   */
+  contentDisposition: string
+  /**
+   * ContentEncoding specifies the encoding used for the blob's content, if any.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
+   */
+  contentEncoding: string
+  /**
+   * ContentLanguage specifies the language used in the blob's content, if any.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
+   */
+  contentLanguage: string
+  /**
+   * ContentType is the MIME type of the blob. It will not be empty.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+   */
+  contentType: string
+  /**
+   * Metadata holds key/value pairs associated with the blob.
+   * Keys are guaranteed to be in lowercase, even if the backend service
+   * has case-sensitive keys (although note that Metadata written via
+   * this package will always be lowercased). If there are duplicate
+   * case-insensitive keys (e.g., "foo" and "FOO"), only one value
+   * will be kept, and it is undefined which one.
+   */
+  metadata: _TygojaDict
+  /**
+   * CreateTime is the time the blob was created, if available. If not available,
+   * CreateTime will be the zero time.
+   */
+  createTime: time.Time
+  /**
+   * ModTime is the time the blob was last modified.
+   */
+  modTime: time.Time
+  /**
+   * Size is the size of the blob's content in bytes.
+   */
+  size: number
+  /**
+   * MD5 is an MD5 hash of the blob contents or nil if not available.
+   */
+  md5: string|Array<number>
+  /**
+   * ETag for the blob; see https://en.wikipedia.org/wiki/HTTP_ETag.
+   */
+  eTag: string
+ }
+ /**
+  * Reader reads bytes from a blob.
+  * It implements io.ReadSeekCloser, and must be closed after reads are finished.
+  */
+ interface Reader {
+ }
+ interface Reader {
+  /**
+   * Read implements io.Reader (https://golang.org/pkg/io/#Reader).
+   */
+  read(p: string|Array<number>): number
+ }
+ interface Reader {
+  /**
+   * Seek implements io.Seeker (https://golang.org/pkg/io/#Seeker).
+   */
+  seek(offset: number, whence: number): number
+ }
+ interface Reader {
+  /**
+   * Close implements io.Closer (https://golang.org/pkg/io/#Closer).
+   */
+  close(): void
+ }
+ interface Reader {
+  /**
+   * ContentType returns the MIME type of the blob.
+   */
+  contentType(): string
+ }
+ interface Reader {
+  /**
+   * ModTime returns the time the blob was last modified.
+   */
+  modTime(): time.Time
+ }
+ interface Reader {
+  /**
+   * Size returns the size of the blob content in bytes.
+   */
+  size(): number
+ }
+ interface Reader {
+  /**
+   * WriteTo reads from r and writes to w until there's no more data or
+   * an error occurs.
+   * The return value is the number of bytes written to w.
+   * 
+   * It implements the io.WriterTo interface.
+   */
+  writeTo(w: io.Writer): number
+ }
+}
+
+/**
+ * Package cobra is a commander providing a simple interface to create powerful modern CLI interfaces.
+ * In addition to providing an interface, Cobra simultaneously provides a controller to organize your application code.
+ */
+namespace cobra {
+ interface Command {
+  /**
+   * GenBashCompletion generates bash completion file and writes to the passed writer.
+   */
+  genBashCompletion(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * GenBashCompletionFile generates bash completion file.
+   */
+  genBashCompletionFile(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenBashCompletionFileV2 generates Bash completion version 2.
+   */
+  genBashCompletionFileV2(filename: string, includeDesc: boolean): void
+ }
+ interface Command {
+  /**
+   * GenBashCompletionV2 generates Bash completion file version 2
+   * and writes it to the passed writer.
+   */
+  genBashCompletionV2(w: io.Writer, includeDesc: boolean): void
+ }
+ // @ts-ignore
+ import flag = pflag
+ /**
+  * Command is just that, a command for your application.
+  * E.g.  'go run ...' - 'run' is the command. Cobra requires
+  * you to define the usage and description as part of your command
+  * definition to ensure usability.
+  */
+ interface Command {
+  /**
+   * Use is the one-line usage message.
+   * Recommended syntax is as follows:
+   * ```
+   *   [ ] identifies an optional argument. Arguments that are not enclosed in brackets are required.
+   *   ... indicates that you can specify multiple values for the previous argument.
+   *   |   indicates mutually exclusive information. You can use the argument to the left of the separator or the
+   *       argument to the right of the separator. You cannot use both arguments in a single use of the command.
+   *   { } delimits a set of mutually exclusive arguments when one of the arguments is required. If the arguments are
+   *       optional, they are enclosed in brackets ([ ]).
+   * ```
+   * Example: add [-F file | -D dir]... [-f format] profile
+   */
+  use: string
+  /**
+   * Aliases is an array of aliases that can be used instead of the first word in Use.
+   */
+  aliases: Array<string>
+  /**
+   * SuggestFor is an array of command names for which this command will be suggested -
+   * similar to aliases but only suggests.
+   */
+  suggestFor: Array<string>
+  /**
+   * Short is the short description shown in the 'help' output.
+   */
+  short: string
+  /**
+   * The group id under which this subcommand is grouped in the 'help' output of its parent.
+   */
+  groupID: string
+  /**
+   * Long is the long message shown in the 'help <this-command>' output.
+   */
+  long: string
+  /**
+   * Example is examples of how to use the command.
+   */
+  example: string
+  /**
+   * ValidArgs is list of all valid non-flag arguments that are accepted in shell completions
+   */
+  validArgs: Array<Completion>
+  /**
+   * ValidArgsFunction is an optional function that provides valid non-flag arguments for shell completion.
+   * It is a dynamic version of using ValidArgs.
+   * Only one of ValidArgs and ValidArgsFunction can be used for a command.
+   */
+  validArgsFunction: CompletionFunc
+  /**
+   * Expected arguments
+   */
+  args: PositionalArgs
+  /**
+   * ArgAliases is List of aliases for ValidArgs.
+   * These are not suggested to the user in the shell completion,
+   * but accepted if entered manually.
+   */
+  argAliases: Array<string>
+  /**
+   * BashCompletionFunction is custom bash functions used by the legacy bash autocompletion generator.
+   * For portability with other shells, it is recommended to instead use ValidArgsFunction
+   */
+  bashCompletionFunction: string
+  /**
+   * Deprecated defines, if this command is deprecated and should print this string when used.
+   */
+  deprecated: string
+  /**
+   * Annotations are key/value pairs that can be used by applications to identify or
+   * group commands or set special options.
+   */
+  annotations: _TygojaDict
+  /**
+   * Version defines the version for this command. If this value is non-empty and the command does not
+   * define a "version" flag, a "version" boolean flag will be added to the command and, if specified,
+   * will print content of the "Version" variable. A shorthand "v" flag will also be added if the
+   * command does not define one.
+   */
+  version: string
+  /**
+   * The *Run functions are executed in the following order:
+   * ```
+   *   * PersistentPreRun()
+   *   * PreRun()
+   *   * Run()
+   *   * PostRun()
+   *   * PersistentPostRun()
+   * ```
+   * All functions get the same args, the arguments after the command name.
+   * The *PreRun and *PostRun functions will only be executed if the Run function of the current
+   * command has been declared.
+   * 
+   * PersistentPreRun: children of this command will inherit and execute.
+   */
+  persistentPreRun: (cmd: Command, args: Array<string>) => void
+  /**
+   * PersistentPreRunE: PersistentPreRun but returns an error.
+   */
+  persistentPreRunE: (cmd: Command, args: Array<string>) => void
+  /**
+   * PreRun: children of this command will not inherit.
+   */
+  preRun: (cmd: Command, args: Array<string>) => void
+  /**
+   * PreRunE: PreRun but returns an error.
+   */
+  preRunE: (cmd: Command, args: Array<string>) => void
+  /**
+   * Run: Typically the actual work function. Most commands will only implement this.
+   */
+  run: (cmd: Command, args: Array<string>) => void
+  /**
+   * RunE: Run but returns an error.
+   */
+  runE: (cmd: Command, args: Array<string>) => void
+  /**
+   * PostRun: run after the Run command.
+   */
+  postRun: (cmd: Command, args: Array<string>) => void
+  /**
+   * PostRunE: PostRun but returns an error.
+   */
+  postRunE: (cmd: Command, args: Array<string>) => void
+  /**
+   * PersistentPostRun: children of this command will inherit and execute after PostRun.
+   */
+  persistentPostRun: (cmd: Command, args: Array<string>) => void
+  /**
+   * PersistentPostRunE: PersistentPostRun but returns an error.
+   */
+  persistentPostRunE: (cmd: Command, args: Array<string>) => void
+  /**
+   * FParseErrWhitelist flag parse errors to be ignored
+   */
+  fParseErrWhitelist: FParseErrWhitelist
+  /**
+   * CompletionOptions is a set of options to control the handling of shell completion
+   */
+  completionOptions: CompletionOptions
+  /**
+   * TraverseChildren parses flags on all parents before executing child command.
+   */
+  traverseChildren: boolean
+  /**
+   * Hidden defines, if this command is hidden and should NOT show up in the list of available commands.
+   */
+  hidden: boolean
+  /**
+   * SilenceErrors is an option to quiet errors down stream.
+   */
+  silenceErrors: boolean
+  /**
+   * SilenceUsage is an option to silence usage when an error occurs.
+   */
+  silenceUsage: boolean
+  /**
+   * DisableFlagParsing disables the flag parsing.
+   * If this is true all flags will be passed to the command as arguments.
+   */
+  disableFlagParsing: boolean
+  /**
+   * DisableAutoGenTag defines, if gen tag ("Auto generated by spf13/cobra...")
+   * will be printed by generating docs for this command.
+   */
+  disableAutoGenTag: boolean
+  /**
+   * DisableFlagsInUseLine will disable the addition of [flags] to the usage
+   * line of a command when printing help or generating docs
+   */
+  disableFlagsInUseLine: boolean
+  /**
+   * DisableSuggestions disables the suggestions based on Levenshtein distance
+   * that go along with 'unknown command' messages.
+   */
+  disableSuggestions: boolean
+  /**
+   * SuggestionsMinimumDistance defines minimum levenshtein distance to display suggestions.
+   * Must be > 0.
+   */
+  suggestionsMinimumDistance: number
+ }
+ interface Command {
+  /**
+   * Context returns underlying command context. If command was executed
+   * with ExecuteContext or the context was set with SetContext, the
+   * previously set context will be returned. Otherwise, nil is returned.
+   * 
+   * Notice that a call to Execute and ExecuteC will replace a nil context of
+   * a command with a context.Background, so a background context will be
+   * returned by Context after one of these functions has been called.
+   */
+  context(): context.Context
+ }
+ interface Command {
+  /**
+   * SetContext sets context for the command. This context will be overwritten by
+   * Command.ExecuteContext or Command.ExecuteContextC.
+   */
+  setContext(ctx: context.Context): void
+ }
+ interface Command {
+  /**
+   * SetArgs sets arguments for the command. It is set to os.Args[1:] by default, if desired, can be overridden
+   * particularly useful when testing.
+   */
+  setArgs(a: Array<string>): void
+ }
+ interface Command {
+  /**
+   * SetOutput sets the destination for usage and error messages.
+   * If output is nil, os.Stderr is used.
+   * 
+   * Deprecated: Use SetOut and/or SetErr instead
+   */
+  setOutput(output: io.Writer): void
+ }
+ interface Command {
+  /**
+   * SetOut sets the destination for usage messages.
+   * If newOut is nil, os.Stdout is used.
+   */
+  setOut(newOut: io.Writer): void
+ }
+ interface Command {
+  /**
+   * SetErr sets the destination for error messages.
+   * If newErr is nil, os.Stderr is used.
+   */
+  setErr(newErr: io.Writer): void
+ }
+ interface Command {
+  /**
+   * SetIn sets the source for input data
+   * If newIn is nil, os.Stdin is used.
+   */
+  setIn(newIn: io.Reader): void
+ }
+ interface Command {
+  /**
+   * SetUsageFunc sets usage function. Usage can be defined by application.
+   */
+  setUsageFunc(f: (_arg0: Command) => void): void
+ }
+ interface Command {
+  /**
+   * SetUsageTemplate sets usage template. Can be defined by Application.
+   */
+  setUsageTemplate(s: string): void
+ }
+ interface Command {
+  /**
+   * SetFlagErrorFunc sets a function to generate an error when flag parsing
+   * fails.
+   */
+  setFlagErrorFunc(f: (_arg0: Command, _arg1: Error) => void): void
+ }
+ interface Command {
+  /**
+   * SetHelpFunc sets help function. Can be defined by Application.
+   */
+  setHelpFunc(f: (_arg0: Command, _arg1: Array<string>) => void): void
+ }
+ interface Command {
+  /**
+   * SetHelpCommand sets help command.
+   */
+  setHelpCommand(cmd: Command): void
+ }
+ interface Command {
+  /**
+   * SetHelpCommandGroupID sets the group id of the help command.
+   */
+  setHelpCommandGroupID(groupID: string): void
+ }
+ interface Command {
+  /**
+   * SetCompletionCommandGroupID sets the group id of the completion command.
+   */
+  setCompletionCommandGroupID(groupID: string): void
+ }
+ interface Command {
+  /**
+   * SetHelpTemplate sets help template to be used. Application can use it to set custom template.
+   */
+  setHelpTemplate(s: string): void
+ }
+ interface Command {
+  /**
+   * SetVersionTemplate sets version template to be used. Application can use it to set custom template.
+   */
+  setVersionTemplate(s: string): void
+ }
+ interface Command {
+  /**
+   * SetErrPrefix sets error message prefix to be used. Application can use it to set custom prefix.
+   */
+  setErrPrefix(s: string): void
+ }
+ interface Command {
+  /**
+   * SetGlobalNormalizationFunc sets a normalization function to all flag sets and also to child commands.
+   * The user should not have a cyclic dependency on commands.
+   */
+  setGlobalNormalizationFunc(n: (f: any, name: string) => any): void
+ }
+ interface Command {
+  /**
+   * OutOrStdout returns output to stdout.
+   */
+  outOrStdout(): io.Writer
+ }
+ interface Command {
+  /**
+   * OutOrStderr returns output to stderr
+   */
+  outOrStderr(): io.Writer
+ }
+ interface Command {
+  /**
+   * ErrOrStderr returns output to stderr
+   */
+  errOrStderr(): io.Writer
+ }
+ interface Command {
+  /**
+   * InOrStdin returns input to stdin
+   */
+  inOrStdin(): io.Reader
+ }
+ interface Command {
+  /**
+   * UsageFunc returns either the function set by SetUsageFunc for this command
+   * or a parent, or it returns a default usage function.
+   */
+  usageFunc(): (_arg0: Command) => void
+ }
+ interface Command {
+  /**
+   * Usage puts out the usage for the command.
+   * Used when a user provides invalid input.
+   * Can be defined by user by overriding UsageFunc.
+   */
+  usage(): void
+ }
+ interface Command {
+  /**
+   * HelpFunc returns either the function set by SetHelpFunc for this command
+   * or a parent, or it returns a function with default help behavior.
+   */
+  helpFunc(): (_arg0: Command, _arg1: Array<string>) => void
+ }
+ interface Command {
+  /**
+   * Help puts out the help for the command.
+   * Used when a user calls help [command].
+   * Can be defined by user by overriding HelpFunc.
+   */
+  help(): void
+ }
+ interface Command {
+  /**
+   * UsageString returns usage string.
+   */
+  usageString(): string
+ }
+ interface Command {
+  /**
+   * FlagErrorFunc returns either the function set by SetFlagErrorFunc for this
+   * command or a parent, or it returns a function which returns the original
+   * error.
+   */
+  flagErrorFunc(): (_arg0: Command, _arg1: Error) => void
+ }
+ interface Command {
+  /**
+   * UsagePadding return padding for the usage.
+   */
+  usagePadding(): number
+ }
+ interface Command {
+  /**
+   * CommandPathPadding return padding for the command path.
+   */
+  commandPathPadding(): number
+ }
+ interface Command {
+  /**
+   * NamePadding returns padding for the name.
+   */
+  namePadding(): number
+ }
+ interface Command {
+  /**
+   * UsageTemplate returns usage template for the command.
+   * This function is kept for backwards-compatibility reasons.
+   */
+  usageTemplate(): string
+ }
+ interface Command {
+  /**
+   * HelpTemplate return help template for the command.
+   * This function is kept for backwards-compatibility reasons.
+   */
+  helpTemplate(): string
+ }
+ interface Command {
+  /**
+   * VersionTemplate return version template for the command.
+   * This function is kept for backwards-compatibility reasons.
+   */
+  versionTemplate(): string
+ }
+ interface Command {
+  /**
+   * ErrPrefix return error message prefix for the command
+   */
+  errPrefix(): string
+ }
+ interface Command {
+  /**
+   * Find the target command given the args and command tree
+   * Meant to be run on the highest node. Only searches down.
+   */
+  find(args: Array<string>): [(Command), Array<string>]
+ }
+ interface Command {
+  /**
+   * Traverse the command tree to find the command, and parse args for
+   * each parent.
+   */
+  traverse(args: Array<string>): [(Command), Array<string>]
+ }
+ interface Command {
+  /**
+   * SuggestionsFor provides suggestions for the typedName.
+   */
+  suggestionsFor(typedName: string): Array<string>
+ }
+ interface Command {
+  /**
+   * VisitParents visits all parents of the command and invokes fn on each parent.
+   */
+  visitParents(fn: (_arg0: Command) => void): void
+ }
+ interface Command {
+  /**
+   * Root finds root command.
+   */
+  root(): (Command)
+ }
+ interface Command {
+  /**
+   * ArgsLenAtDash will return the length of c.Flags().Args at the moment
+   * when a -- was found during args parsing.
+   */
+  argsLenAtDash(): number
+ }
+ interface Command {
+  /**
+   * ExecuteContext is the same as Execute(), but sets the ctx on the command.
+   * Retrieve ctx by calling cmd.Context() inside your *Run lifecycle or ValidArgs
+   * functions.
+   */
+  executeContext(ctx: context.Context): void
+ }
+ interface Command {
+  /**
+   * Execute uses the args (os.Args[1:] by default)
+   * and run through the command tree finding appropriate matches
+   * for commands and then corresponding flags.
+   */
+  execute(): void
+ }
+ interface Command {
+  /**
+   * ExecuteContextC is the same as ExecuteC(), but sets the ctx on the command.
+   * Retrieve ctx by calling cmd.Context() inside your *Run lifecycle or ValidArgs
+   * functions.
+   */
+  executeContextC(ctx: context.Context): (Command)
+ }
+ interface Command {
+  /**
+   * ExecuteC executes the command.
+   */
+  executeC(): (Command)
+ }
+ interface Command {
+  validateArgs(args: Array<string>): void
+ }
+ interface Command {
+  /**
+   * ValidateRequiredFlags validates all required flags are present and returns an error otherwise
+   */
+  validateRequiredFlags(): void
+ }
+ interface Command {
+  /**
+   * InitDefaultHelpFlag adds default help flag to c.
+   * It is called automatically by executing the c or by calling help and usage.
+   * If c already has help flag, it will do nothing.
+   */
+  initDefaultHelpFlag(): void
+ }
+ interface Command {
+  /**
+   * InitDefaultVersionFlag adds default version flag to c.
+   * It is called automatically by executing the c.
+   * If c already has a version flag, it will do nothing.
+   * If c.Version is empty, it will do nothing.
+   */
+  initDefaultVersionFlag(): void
+ }
+ interface Command {
+  /**
+   * InitDefaultHelpCmd adds default help command to c.
+   * It is called automatically by executing the c or by calling help and usage.
+   * If c already has help command or c has no subcommands, it will do nothing.
+   */
+  initDefaultHelpCmd(): void
+ }
+ interface Command {
+  /**
+   * ResetCommands delete parent, subcommand and help command from c.
+   */
+  resetCommands(): void
+ }
+ interface Command {
+  /**
+   * Commands returns a sorted slice of child commands.
+   */
+  commands(): Array<(Command | undefined)>
+ }
+ interface Command {
+  /**
+   * AddCommand adds one or more commands to this parent command.
+   */
+  addCommand(...cmds: (Command | undefined)[]): void
+ }
+ interface Command {
+  /**
+   * Groups returns a slice of child command groups.
+   */
+  groups(): Array<(Group | undefined)>
+ }
+ interface Command {
+  /**
+   * AllChildCommandsHaveGroup returns if all subcommands are assigned to a group
+   */
+  allChildCommandsHaveGroup(): boolean
+ }
+ interface Command {
+  /**
+   * ContainsGroup return if groupID exists in the list of command groups.
+   */
+  containsGroup(groupID: string): boolean
+ }
+ interface Command {
+  /**
+   * AddGroup adds one or more command groups to this parent command.
+   */
+  addGroup(...groups: (Group | undefined)[]): void
+ }
+ interface Command {
+  /**
+   * RemoveCommand removes one or more commands from a parent command.
+   */
+  removeCommand(...cmds: (Command | undefined)[]): void
+ }
+ interface Command {
+  /**
+   * Print is a convenience method to Print to the defined output, fallback to Stderr if not set.
+   */
+  print(...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * Println is a convenience method to Println to the defined output, fallback to Stderr if not set.
+   */
+  println(...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * Printf is a convenience method to Printf to the defined output, fallback to Stderr if not set.
+   */
+  printf(format: string, ...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * PrintErr is a convenience method to Print to the defined Err output, fallback to Stderr if not set.
+   */
+  printErr(...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * PrintErrln is a convenience method to Println to the defined Err output, fallback to Stderr if not set.
+   */
+  printErrln(...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * PrintErrf is a convenience method to Printf to the defined Err output, fallback to Stderr if not set.
+   */
+  printErrf(format: string, ...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * CommandPath returns the full path to this command.
+   */
+  commandPath(): string
+ }
+ interface Command {
+  /**
+   * DisplayName returns the name to display in help text. Returns command Name()
+   * If CommandDisplayNameAnnoation is not set
+   */
+  displayName(): string
+ }
+ interface Command {
+  /**
+   * UseLine puts out the full usage for a given command (including parents).
+   */
+  useLine(): string
+ }
+ interface Command {
+  /**
+   * DebugFlags used to determine which flags have been assigned to which commands
+   * and which persist.
+   */
+  debugFlags(): void
+ }
+ interface Command {
+  /**
+   * Name returns the command's name: the first word in the use line.
+   */
+  name(): string
+ }
+ interface Command {
+  /**
+   * HasAlias determines if a given string is an alias of the command.
+   */
+  hasAlias(s: string): boolean
+ }
+ interface Command {
+  /**
+   * CalledAs returns the command name or alias that was used to invoke
+   * this command or an empty string if the command has not been called.
+   */
+  calledAs(): string
+ }
+ interface Command {
+  /**
+   * NameAndAliases returns a list of the command name and all aliases
+   */
+  nameAndAliases(): string
+ }
+ interface Command {
+  /**
+   * HasExample determines if the command has example.
+   */
+  hasExample(): boolean
+ }
+ interface Command {
+  /**
+   * Runnable determines if the command is itself runnable.
+   */
+  runnable(): boolean
+ }
+ interface Command {
+  /**
+   * HasSubCommands determines if the command has children commands.
+   */
+  hasSubCommands(): boolean
+ }
+ interface Command {
+  /**
+   * IsAvailableCommand determines if a command is available as a non-help command
+   * (this includes all non deprecated/hidden commands).
+   */
+  isAvailableCommand(): boolean
+ }
+ interface Command {
+  /**
+   * IsAdditionalHelpTopicCommand determines if a command is an additional
+   * help topic command; additional help topic command is determined by the
+   * fact that it is NOT runnable/hidden/deprecated, and has no sub commands that
+   * are runnable/hidden/deprecated.
+   * Concrete example: https://github.com/spf13/cobra/issues/393#issuecomment-282741924.
+   */
+  isAdditionalHelpTopicCommand(): boolean
+ }
+ interface Command {
+  /**
+   * HasHelpSubCommands determines if a command has any available 'help' sub commands
+   * that need to be shown in the usage/help default template under 'additional help
+   * topics'.
+   */
+  hasHelpSubCommands(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailableSubCommands determines if a command has available sub commands that
+   * need to be shown in the usage/help default template under 'available commands'.
+   */
+  hasAvailableSubCommands(): boolean
+ }
+ interface Command {
+  /**
+   * HasParent determines if the command is a child command.
+   */
+  hasParent(): boolean
+ }
+ interface Command {
+  /**
+   * GlobalNormalizationFunc returns the global normalization function or nil if it doesn't exist.
+   */
+  globalNormalizationFunc(): (f: any, name: string) => any
+ }
+ interface Command {
+  /**
+   * Flags returns the complete FlagSet that applies
+   * to this command (local and persistent declared here and by all parents).
+   */
+  flags(): (any)
+ }
+ interface Command {
+  /**
+   * LocalNonPersistentFlags are flags specific to this command which will NOT persist to subcommands.
+   * This function does not modify the flags of the current command, it's purpose is to return the current state.
+   */
+  localNonPersistentFlags(): (any)
+ }
+ interface Command {
+  /**
+   * LocalFlags returns the local FlagSet specifically set in the current command.
+   * This function does not modify the flags of the current command, it's purpose is to return the current state.
+   */
+  localFlags(): (any)
+ }
+ interface Command {
+  /**
+   * InheritedFlags returns all flags which were inherited from parent commands.
+   * This function does not modify the flags of the current command, it's purpose is to return the current state.
+   */
+  inheritedFlags(): (any)
+ }
+ interface Command {
+  /**
+   * NonInheritedFlags returns all flags which were not inherited from parent commands.
+   * This function does not modify the flags of the current command, it's purpose is to return the current state.
+   */
+  nonInheritedFlags(): (any)
+ }
+ interface Command {
+  /**
+   * PersistentFlags returns the persistent FlagSet specifically set in the current command.
+   */
+  persistentFlags(): (any)
+ }
+ interface Command {
+  /**
+   * ResetFlags deletes all flags from command.
+   */
+  resetFlags(): void
+ }
+ interface Command {
+  /**
+   * HasFlags checks if the command contains any flags (local plus persistent from the entire structure).
+   */
+  hasFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasPersistentFlags checks if the command contains persistent flags.
+   */
+  hasPersistentFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasLocalFlags checks if the command has flags specifically declared locally.
+   */
+  hasLocalFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasInheritedFlags checks if the command has flags inherited from its parent command.
+   */
+  hasInheritedFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailableFlags checks if the command contains any flags (local plus persistent from the entire
+   * structure) which are not hidden or deprecated.
+   */
+  hasAvailableFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailablePersistentFlags checks if the command contains persistent flags which are not hidden or deprecated.
+   */
+  hasAvailablePersistentFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailableLocalFlags checks if the command has flags specifically declared locally which are not hidden
+   * or deprecated.
+   */
+  hasAvailableLocalFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailableInheritedFlags checks if the command has flags inherited from its parent command which are
+   * not hidden or deprecated.
+   */
+  hasAvailableInheritedFlags(): boolean
+ }
+ interface Command {
+  /**
+   * Flag climbs up the command tree looking for matching flag.
+   */
+  flag(name: string): (any)
+ }
+ interface Command {
+  /**
+   * ParseFlags parses persistent flag tree and local flags.
+   */
+  parseFlags(args: Array<string>): void
+ }
+ interface Command {
+  /**
+   * Parent returns a commands parent command.
+   */
+  parent(): (Command)
+ }
+ interface Command {
+  /**
+   * RegisterFlagCompletionFunc should be called to register a function to provide completion for a flag.
+   * 
+   * You can use pre-defined completion functions such as [FixedCompletions] or [NoFileCompletions],
+   * or you can define your own.
+   */
+  registerFlagCompletionFunc(flagName: string, f: CompletionFunc): void
+ }
+ interface Command {
+  /**
+   * GetFlagCompletionFunc returns the completion function for the given flag of the command, if available.
+   */
+  getFlagCompletionFunc(flagName: string): [CompletionFunc, boolean]
+ }
+ interface Command {
+  /**
+   * InitDefaultCompletionCmd adds a default 'completion' command to c.
+   * This function will do nothing if any of the following is true:
+   * 1- the feature has been explicitly disabled by the program,
+   * 2- c has no subcommands (to avoid creating one),
+   * 3- c already has a 'completion' command provided by the program.
+   */
+  initDefaultCompletionCmd(...args: string[]): void
+ }
+ interface Command {
+  /**
+   * GenFishCompletion generates fish completion file and writes to the passed writer.
+   */
+  genFishCompletion(w: io.Writer, includeDesc: boolean): void
+ }
+ interface Command {
+  /**
+   * GenFishCompletionFile generates fish completion file.
+   */
+  genFishCompletionFile(filename: string, includeDesc: boolean): void
+ }
+ interface Command {
+  /**
+   * MarkFlagsRequiredTogether marks the given flags with annotations so that Cobra errors
+   * if the command is invoked with a subset (but not all) of the given flags.
+   */
+  markFlagsRequiredTogether(...flagNames: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkFlagsOneRequired marks the given flags with annotations so that Cobra errors
+   * if the command is invoked without at least one flag from the given set of flags.
+   */
+  markFlagsOneRequired(...flagNames: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkFlagsMutuallyExclusive marks the given flags with annotations so that Cobra errors
+   * if the command is invoked with more than one flag from the given set of flags.
+   */
+  markFlagsMutuallyExclusive(...flagNames: string[]): void
+ }
+ interface Command {
+  /**
+   * ValidateFlagGroups validates the mutuallyExclusive/oneRequired/requiredAsGroup logic and returns the
+   * first error encountered.
+   */
+  validateFlagGroups(): void
+ }
+ interface Command {
+  /**
+   * GenPowerShellCompletionFile generates powershell completion file without descriptions.
+   */
+  genPowerShellCompletionFile(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenPowerShellCompletion generates powershell completion file without descriptions
+   * and writes it to the passed writer.
+   */
+  genPowerShellCompletion(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * GenPowerShellCompletionFileWithDesc generates powershell completion file with descriptions.
+   */
+  genPowerShellCompletionFileWithDesc(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenPowerShellCompletionWithDesc generates powershell completion file with descriptions
+   * and writes it to the passed writer.
+   */
+  genPowerShellCompletionWithDesc(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * MarkFlagRequired instructs the various shell completion implementations to
+   * prioritize the named flag when performing completion,
+   * and causes your command to report an error if invoked without the flag.
+   */
+  markFlagRequired(name: string): void
+ }
+ interface Command {
+  /**
+   * MarkPersistentFlagRequired instructs the various shell completion implementations to
+   * prioritize the named persistent flag when performing completion,
+   * and causes your command to report an error if invoked without the flag.
+   */
+  markPersistentFlagRequired(name: string): void
+ }
+ interface Command {
+  /**
+   * MarkFlagFilename instructs the various shell completion implementations to
+   * limit completions for the named flag to the specified file extensions.
+   */
+  markFlagFilename(name: string, ...extensions: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkFlagCustom adds the BashCompCustom annotation to the named flag, if it exists.
+   * The bash completion script will call the bash function f for the flag.
+   * 
+   * This will only work for bash completion.
+   * It is recommended to instead use c.RegisterFlagCompletionFunc(...) which allows
+   * to register a Go function which will work across all shells.
+   */
+  markFlagCustom(name: string, f: string): void
+ }
+ interface Command {
+  /**
+   * MarkPersistentFlagFilename instructs the various shell completion
+   * implementations to limit completions for the named persistent flag to the
+   * specified file extensions.
+   */
+  markPersistentFlagFilename(name: string, ...extensions: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkFlagDirname instructs the various shell completion implementations to
+   * limit completions for the named flag to directory names.
+   */
+  markFlagDirname(name: string): void
+ }
+ interface Command {
+  /**
+   * MarkPersistentFlagDirname instructs the various shell completion
+   * implementations to limit completions for the named persistent flag to
+   * directory names.
+   */
+  markPersistentFlagDirname(name: string): void
+ }
+ interface Command {
+  /**
+   * GenZshCompletionFile generates zsh completion file including descriptions.
+   */
+  genZshCompletionFile(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenZshCompletion generates zsh completion file including descriptions
+   * and writes it to the passed writer.
+   */
+  genZshCompletion(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * GenZshCompletionFileNoDesc generates zsh completion file without descriptions.
+   */
+  genZshCompletionFileNoDesc(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenZshCompletionNoDesc generates zsh completion file without descriptions
+   * and writes it to the passed writer.
+   */
+  genZshCompletionNoDesc(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * MarkZshCompPositionalArgumentFile only worked for zsh and its behavior was
+   * not consistent with Bash completion. It has therefore been disabled.
+   * Instead, when no other completion is specified, file completion is done by
+   * default for every argument. One can disable file completion on a per-argument
+   * basis by using ValidArgsFunction and ShellCompDirectiveNoFileComp.
+   * To achieve file extension filtering, one can use ValidArgsFunction and
+   * ShellCompDirectiveFilterFileExt.
+   * 
+   * Deprecated
+   */
+  markZshCompPositionalArgumentFile(argPosition: number, ...patterns: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkZshCompPositionalArgumentWords only worked for zsh. It has therefore
+   * been disabled.
+   * To achieve the same behavior across all shells, one can use
+   * ValidArgs (for the first argument only) or ValidArgsFunction for
+   * any argument (can include the first one also).
+   * 
+   * Deprecated
+   */
+  markZshCompPositionalArgumentWords(argPosition: number, ...words: string[]): void
+ }
+}
+
+namespace auth {
+ /**
+  * Provider defines a common interface for an OAuth2 client.
+  */
+ interface Provider {
+  [key:string]: any;
+  /**
+   * Context returns the context associated with the provider (if any).
+   */
+  context(): context.Context
+  /**
+   * SetContext assigns the specified context to the current provider.
+   */
+  setContext(ctx: context.Context): void
+  /**
+   * PKCE indicates whether the provider can use the PKCE flow.
+   */
+  pkce(): boolean
+  /**
+   * SetPKCE toggles the state whether the provider can use the PKCE flow or not.
+   */
+  setPKCE(enable: boolean): void
+  /**
+   * DisplayName usually returns provider name as it is officially written
+   * and it could be used directly in the UI.
+   */
+  displayName(): string
+  /**
+   * SetDisplayName sets the provider's display name.
+   */
+  setDisplayName(displayName: string): void
+  /**
+   * Scopes returns the provider access permissions that will be requested.
+   */
+  scopes(): Array<string>
+  /**
+   * SetScopes sets the provider access permissions that will be requested later.
+   */
+  setScopes(scopes: Array<string>): void
+  /**
+   * ClientId returns the provider client's app ID.
+   */
+  clientId(): string
+  /**
+   * SetClientId sets the provider client's ID.
+   */
+  setClientId(clientId: string): void
+  /**
+   * ClientSecret returns the provider client's app secret.
+   */
+  clientSecret(): string
+  /**
+   * SetClientSecret sets the provider client's app secret.
+   */
+  setClientSecret(secret: string): void
+  /**
+   * RedirectURL returns the end address to redirect the user
+   * going through the OAuth flow.
+   */
+  redirectURL(): string
+  /**
+   * SetRedirectURL sets the provider's RedirectURL.
+   */
+  setRedirectURL(url: string): void
+  /**
+   * AuthURL returns the provider's authorization service url.
+   */
+  authURL(): string
+  /**
+   * SetAuthURL sets the provider's AuthURL.
+   */
+  setAuthURL(url: string): void
+  /**
+   * TokenURL returns the provider's token exchange service url.
+   */
+  tokenURL(): string
+  /**
+   * SetTokenURL sets the provider's TokenURL.
+   */
+  setTokenURL(url: string): void
+  /**
+   * UserInfoURL returns the provider's user info api url.
+   */
+  userInfoURL(): string
+  /**
+   * SetUserInfoURL sets the provider's UserInfoURL.
+   */
+  setUserInfoURL(url: string): void
+  /**
+   * Extra returns a shallow copy of any custom config data
+   * that the provider may be need.
+   */
+  extra(): _TygojaDict
+  /**
+   * SetExtra updates the provider's custom config data.
+   */
+  setExtra(data: _TygojaDict): void
+  /**
+   * Client returns an http client using the provided token.
+   */
+  client(token: oauth2.Token): (any)
+  /**
+   * BuildAuthURL returns a URL to the provider's consent page
+   * that asks for permissions for the required scopes explicitly.
+   */
+  buildAuthURL(state: string, ...opts: oauth2.AuthCodeOption[]): string
+  /**
+   * FetchToken converts an authorization code to token.
+   */
+  fetchToken(code: string, ...opts: oauth2.AuthCodeOption[]): (oauth2.Token)
+  /**
+   * FetchRawUserInfo requests and marshalizes into `result` the
+   * the OAuth user api response.
+   */
+  fetchRawUserInfo(token: oauth2.Token): string|Array<number>
+  /**
+   * FetchAuthUser is similar to FetchRawUserInfo, but normalizes and
+   * marshalizes the user api response into a standardized AuthUser struct.
+   */
+  fetchAuthUser(token: oauth2.Token): (AuthUser)
+ }
+ /**
+  * AuthUser defines a standardized OAuth2 user data structure.
+  */
+ interface AuthUser {
+  expiry: types.DateTime
+  rawUser: _TygojaDict
+  id: string
+  name: string
+  username: string
+  email: string
+  avatarURL: string
+  accessToken: string
+  refreshToken: string
+  /**
+   * @todo
+   * deprecated: use AvatarURL instead
+   * AvatarUrl will be removed after dropping v0.22 support
+   */
+  avatarUrl: string
+ }
+ interface AuthUser {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * 
+   * @todo remove after dropping v0.22 support
+   */
+  marshalJSON(): string|Array<number>
+ }
+}
+
+namespace router {
+ // @ts-ignore
+ import validation = ozzo_validation
+ /**
+  * ApiError defines the struct for a basic api error response.
+  */
+ interface ApiError {
+  data: _TygojaDict
+  message: string
+  status: number
+ }
+ interface ApiError {
+  /**
+   * Error makes it compatible with the `error` interface.
+   */
+  error(): string
+ }
+ interface ApiError {
+  /**
+   * RawData returns the unformatted error data (could be an internal error, text, etc.)
+   */
+  rawData(): any
+ }
+ interface ApiError {
+  /**
+   * Is reports whether the current ApiError wraps the target.
+   */
+  is(target: Error): boolean
+ }
+ /**
+  * Event specifies based Route handler event that is usually intended
+  * to be embedded as part of a custom event struct.
+  * 
+  * NB! It is expected that the Response and Request fields are always set.
+  */
+ type _sZPWzsb = hook.Event
+ interface Event extends _sZPWzsb {
+  response: http.ResponseWriter
+  request?: http.Request
+ }
+ interface Event {
+  /**
+   * Written reports whether the current response has already been written.
+   * 
+   * This method always returns false if e.ResponseWritter doesn't implement the WriteTracker interface
+   * (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+   */
+  written(): boolean
+ }
+ interface Event {
+  /**
+   * Status reports the status code of the current response.
+   * 
+   * This method always returns 0 if e.Response doesn't implement the StatusTracker interface
+   * (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+   */
+  status(): number
+ }
+ interface Event {
+  /**
+   * Flush flushes buffered data to the current response.
+   * 
+   * Returns [http.ErrNotSupported] if e.Response doesn't implement the [http.Flusher] interface
+   * (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+   */
+  flush(): void
+ }
+ interface Event {
+  /**
+   * IsTLS reports whether the connection on which the request was received is TLS.
+   */
+  isTLS(): boolean
+ }
+ interface Event {
+  /**
+   * SetCookie is an alias for [http.SetCookie].
+   * 
+   * SetCookie adds a Set-Cookie header to the current response's headers.
+   * The provided cookie must have a valid Name.
+   * Invalid cookies may be silently dropped.
+   */
+  setCookie(cookie: http.Cookie): void
+ }
+ interface Event {
+  /**
+   * RemoteIP returns the IP address of the client that sent the request.
+   * 
+   * IPv6 addresses are returned expanded.
+   * For example, "2001:db8::1" becomes "2001:0db8:0000:0000:0000:0000:0000:0001".
+   * 
+   * Note that if you are behind reverse proxy(ies), this method returns
+   * the IP of the last connecting proxy.
+   */
+  remoteIP(): string
+ }
+ interface Event {
+  /**
+   * FindUploadedFiles extracts all form files of "key" from a http request
+   * and returns a slice with filesystem.File instances (if any).
+   */
+  findUploadedFiles(key: string): Array<(filesystem.File | undefined)>
+ }
+ interface Event {
+  /**
+   * Get retrieves single value from the current event data store.
+   */
+  get(key: string): any
+ }
+ interface Event {
+  /**
+   * GetAll returns a copy of the current event data store.
+   */
+  getAll(): _TygojaDict
+ }
+ interface Event {
+  /**
+   * Set saves single value into the current event data store.
+   */
+  set(key: string, value: any): void
+ }
+ interface Event {
+  /**
+   * SetAll saves all items from m into the current event data store.
+   */
+  setAll(m: _TygojaDict): void
+ }
+ interface Event {
+  /**
+   * String writes a plain string response.
+   */
+  string(status: number, data: string): void
+ }
+ interface Event {
+  /**
+   * HTML writes an HTML response.
+   */
+  html(status: number, data: string): void
+ }
+ interface Event {
+  /**
+   * JSON writes a JSON response.
+   * 
+   * It also provides a generic response data fields picker if the "fields" query parameter is set.
+   * For example, if you are requesting `?fields=a,b` for `e.JSON(200, map[string]int{ "a":1, "b":2, "c":3 })`,
+   * it should result in a JSON response like: `{"a":1, "b": 2}`.
+   */
+  json(status: number, data: any): void
+ }
+ interface Event {
+  /**
+   * XML writes an XML response.
+   * It automatically prepends the generic [xml.Header] string to the response.
+   */
+  xml(status: number, data: any): void
+ }
+ interface Event {
+  /**
+   * Stream streams the specified reader into the response.
+   */
+  stream(status: number, contentType: string, reader: io.Reader): void
+ }
+ interface Event {
+  /**
+   * Blob writes a blob (bytes slice) response.
+   */
+  blob(status: number, contentType: string, b: string|Array<number>): void
+ }
+ interface Event {
+  /**
+   * FileFS serves the specified filename from fsys.
+   * 
+   * It is similar to [echo.FileFS] for consistency with earlier versions.
+   */
+  fileFS(fsys: fs.FS, filename: string): void
+ }
+ interface Event {
+  /**
+   * NoContent writes a response with no body (ex. 204).
+   */
+  noContent(status: number): void
+ }
+ interface Event {
+  /**
+   * Redirect writes a redirect response to the specified url.
+   * The status code must be in between 300 – 399 range.
+   */
+  redirect(status: number, url: string): void
+ }
+ interface Event {
+  error(status: number, message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  badRequestError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  notFoundError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  forbiddenError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  unauthorizedError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  tooManyRequestsError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  internalServerError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  /**
+   * BindBody unmarshal the request body into the provided dst.
+   * 
+   * dst must be either a struct pointer or map[string]any.
+   * 
+   * The rules how the body will be scanned depends on the request Content-Type.
+   * 
+   * Currently the following Content-Types are supported:
+   * ```
+   *   - application/json
+   *   - text/xml, application/xml
+   *   - multipart/form-data, application/x-www-form-urlencoded
+   * ```
+   * 
+   * Respectively the following struct tags are supported (again, which one will be used depends on the Content-Type):
+   * ```
+   *   - "json" (json body)- uses the builtin Go json package for unmarshaling.
+   *   - "xml" (xml body) - uses the builtin Go xml package for unmarshaling.
+   *   - "form" (form data) - utilizes the custom [router.UnmarshalRequestData] method.
+   * ```
+   * 
+   * NB! When dst is a struct make sure that it doesn't have public fields
+   * that shouldn't be bindable and it is advisible such fields to be unexported
+   * or have a separate struct just for the binding. For example:
+   * 
+   * ```
+   * 	data := struct{
+   * 	   somethingPrivate string
+   * 
+   * 	   Title string `json:"title" form:"title"`
+   * 	   Total int    `json:"total" form:"total"`
+   * 	}
+   * 	err := e.BindBody(&data)
+   * ```
+   */
+  bindBody(dst: any): void
+ }
+ /**
+  * Router defines a thin wrapper around the standard Go [http.ServeMux] by
+  * adding support for routing sub-groups, middlewares and other common utils.
+  * 
+  * Example:
+  * 
+  * ```
+  * 	r := NewRouter[*MyEvent](eventFactory)
+  * 
+  * 	// middlewares
+  * 	r.BindFunc(m1, m2)
+  * 
+  * 	// routes
+  * 	r.GET("/test", handler1)
+  * 
+  * 	// sub-routers/groups
+  * 	api := r.Group("/api")
+  * 	api.GET("/admins", handler2)
+  * 
+  * 	// generate a http.ServeMux instance based on the router configurations
+  * 	mux, _ := r.BuildMux()
+  * 
+  * 	http.ListenAndServe("localhost:8090", mux)
+  * ```
+  */
+ type _sAyDGzz<T> = RouterGroup<T>
+ interface Router<T> extends _sAyDGzz<T> {
+ }
+}
+
+namespace subscriptions {
+ /**
+  * Broker defines a struct for managing subscriptions clients.
+  */
+ interface Broker {
+ }
+ interface Broker {
+  /**
+   * Clients returns a shallow copy of all registered clients indexed
+   * with their connection id.
+   */
+  clients(): _TygojaDict
+ }
+ interface Broker {
+  /**
+   * ChunkedClients splits the current clients into a chunked slice.
+   */
+  chunkedClients(chunkSize: number): Array<Array<Client>>
+ }
+ interface Broker {
+  /**
+   * TotalClients returns the total number of registered clients.
+   */
+  totalClients(): number
+ }
+ interface Broker {
+  /**
+   * ClientById finds a registered client by its id.
+   * 
+   * Returns non-nil error when client with clientId is not registered.
+   */
+  clientById(clientId: string): Client
+ }
+ interface Broker {
+  /**
+   * Register adds a new client to the broker instance.
+   */
+  register(client: Client): void
+ }
+ interface Broker {
+  /**
+   * Unregister removes a single client by its id and marks it as discarded.
+   * 
+   * If client with clientId doesn't exist, this method does nothing.
+   */
+  unregister(clientId: string): void
+ }
+ /**
+  * Client is an interface for a generic subscription client.
+  */
+ interface Client {
+  [key:string]: any;
+  /**
+   * Id Returns the unique id of the client.
+   */
+  id(): string
+  /**
+   * Channel returns the client's communication channel.
+   * 
+   * NB! The channel shouldn't be used after calling Discard().
+   */
+  channel(): undefined
+  /**
+   * Subscriptions returns a shallow copy of the client subscriptions matching the prefixes.
+   * If no prefix is specified, returns all subscriptions.
+   */
+  subscriptions(...prefixes: string[]): _TygojaDict
+  /**
+   * Subscribe subscribes the client to the provided subscriptions list.
+   * 
+   * Each subscription can also have "options" (json serialized SubscriptionOptions) as query parameter.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	Subscribe(
+   * 	    "subscriptionA",
+   * 	    `subscriptionB?options={"query":{"a":1},"headers":{"x_token":"abc"}}`,
+   * 	)
+   * ```
+   */
+  subscribe(...subs: string[]): void
+  /**
+   * Unsubscribe unsubscribes the client from the provided subscriptions list.
+   */
+  unsubscribe(...subs: string[]): void
+  /**
+   * HasSubscription checks if the client is subscribed to `sub`.
+   */
+  hasSubscription(sub: string): boolean
+  /**
+   * Set stores any value to the client's context.
+   */
+  set(key: string, value: any): void
+  /**
+   * Unset removes a single value from the client's context.
+   */
+  unset(key: string): void
+  /**
+   * Get retrieves the key value from the client's context.
+   */
+  get(key: string): any
+  /**
+   * Discard marks the client as "discarded" (and closes its channel),
+   * meaning that it shouldn't be used anymore for sending new messages.
+   * 
+   * It is safe to call Discard() multiple times.
+   */
+  discard(): void
+  /**
+   * IsDiscarded indicates whether the client has been "discarded"
+   * and should no longer be used.
+   */
+  isDiscarded(): boolean
+  /**
+   * Send sends the specified message to the client's channel (if not discarded).
+   */
+  send(m: Message): void
+ }
+ /**
+  * Message defines a client's channel data.
+  */
+ interface Message {
+  name: string
+  data: string|Array<number>
+ }
+ interface Message {
+  /**
+   * WriteSSE writes the current message in a SSE format into the provided writer.
+   * 
+   * For example, writing to a router.Event:
+   * 
+   * ```
+   * 	m := Message{Name: "users/create", Data: []byte{...}}
+   * 	m.Write(e.Response, "yourEventId")
+   * 	e.Flush()
+   * ```
+   */
+  writeSSE(w: io.Writer, eventId: string): void
+ }
+}
+
+/**
+ * Package cron implements a crontab-like service to execute and schedule
+ * repeative tasks/jobs.
+ * 
+ * Example:
+ * 
+ * ```
+ * 	c := cron.New()
+ * 	c.MustAdd("dailyReport", "0 0 * * *", func() { ... })
+ * 	c.Start()
+ * ```
+ */
+namespace cron {
+ /**
+  * Cron is a crontab-like struct for tasks/jobs scheduling.
+  */
+ interface Cron {
+ }
+ interface Cron {
+  /**
+   * SetInterval changes the current cron tick interval
+   * (it usually should be >= 1 minute).
+   */
+  setInterval(d: time.Duration): void
+ }
+ interface Cron {
+  /**
+   * SetTimezone changes the current cron tick timezone.
+   */
+  setTimezone(l: time.Location): void
+ }
+ interface Cron {
+  /**
+   * MustAdd is similar to Add() but panic on failure.
+   */
+  mustAdd(jobId: string, cronExpr: string, run: () => void): void
+ }
+ interface Cron {
+  /**
+   * Add registers a single cron job.
+   * 
+   * If there is already a job with the provided id, then the old job
+   * will be replaced with the new one.
+   * 
+   * cronExpr is a regular cron expression, eg. "0 *\/3 * * *" (aka. at minute 0 past every 3rd hour).
+   * Check cron.NewSchedule() for the supported tokens.
+   */
+  add(jobId: string, cronExpr: string, fn: () => void): void
+ }
+ interface Cron {
+  /**
+   * Remove removes a single cron job by its id.
+   */
+  remove(jobId: string): void
+ }
+ interface Cron {
+  /**
+   * RemoveAll removes all registered cron jobs.
+   */
+  removeAll(): void
+ }
+ interface Cron {
+  /**
+   * Total returns the current total number of registered cron jobs.
+   */
+  total(): number
+ }
+ interface Cron {
+  /**
+   * Jobs returns a shallow copy of the currently registered cron jobs.
+   */
+  jobs(): Array<(Job | undefined)>
+ }
+ interface Cron {
+  /**
+   * Stop stops the current cron ticker (if not already).
+   * 
+   * You can resume the ticker by calling Start().
+   */
+  stop(): void
+ }
+ interface Cron {
+  /**
+   * Start starts the cron ticker.
+   * 
+   * Calling Start() on already started cron will restart the ticker.
+   */
+  start(): void
+ }
+ interface Cron {
+  /**
+   * HasStarted checks whether the current Cron ticker has been started.
+   */
+  hasStarted(): boolean
+ }
+}
+
+namespace sync {
+ /**
+  * A Locker represents an object that can be locked and unlocked.
+  */
+ interface Locker {
+  [key:string]: any;
+  lock(): void
+  unlock(): void
+ }
+}
+
+namespace syscall {
+ /**
+  * SysProcIDMap holds Container ID to Host ID mappings used for User Namespaces in Linux.
+  * See user_namespaces(7).
+  * 
+  * Note that User Namespaces are not available on a number of popular Linux
+  * versions (due to security issues), or are available but subject to AppArmor
+  * restrictions like in Ubuntu 24.04.
+  */
+ interface SysProcIDMap {
+  containerID: number // Container ID.
+  hostID: number // Host ID.
+  size: number // Size.
+ }
+ // @ts-ignore
+ import errorspkg = errors
+ /**
+  * Credential holds user and group identities to be assumed
+  * by a child process started by [StartProcess].
+  */
+ interface Credential {
+  uid: number // User ID.
+  gid: number // Group ID.
+  groups: Array<number> // Supplementary group IDs.
+  noSetGroups: boolean // If true, don't set supplementary groups
+ }
+ // @ts-ignore
+ import runtimesyscall = syscall
+ /**
+  * A Signal is a number describing a process signal.
+  * It implements the [os.Signal] interface.
+  */
+ interface Signal extends Number{}
+ interface Signal {
+  signal(): void
+ }
+ interface Signal {
+  string(): string
+ }
+}
+
+namespace io {
+ /**
+  * WriteCloser is the interface that groups the basic Write and Close methods.
+  */
+ interface WriteCloser {
+  [key:string]: any;
+ }
+}
+
+namespace time {
+ /**
+  * A Month specifies a month of the year (January = 1, ...).
+  */
+ interface Month extends Number{}
+ interface Month {
+  /**
+   * String returns the English name of the month ("January", "February", ...).
+   */
+  string(): string
+ }
+ /**
+  * A Weekday specifies a day of the week (Sunday = 0, ...).
+  */
+ interface Weekday extends Number{}
+ interface Weekday {
+  /**
+   * String returns the English name of the day ("Sunday", "Monday", ...).
+   */
+  string(): string
+ }
+ /**
+  * A Location maps time instants to the zone in use at that time.
+  * Typically, the Location represents the collection of time offsets
+  * in use in a geographical area. For many Locations the time offset varies
+  * depending on whether daylight savings time is in use at the time instant.
+  * 
+  * Location is used to provide a time zone in a printed Time value and for
+  * calculations involving intervals that may cross daylight savings time
+  * boundaries.
+  */
+ interface Location {
+ }
+ interface Location {
+  /**
+   * String returns a descriptive name for the time zone information,
+   * corresponding to the name argument to [LoadLocation] or [FixedZone].
+   */
+  string(): string
+ }
+}
+
+namespace fs {
+}
+
+namespace store {
+}
+
+/**
+ * Package url parses URLs and implements query escaping.
+ */
+namespace url {
+ /**
+  * A URL represents a parsed URL (technically, a URI reference).
+  * 
+  * The general form represented is:
+  * 
+  * ```
+  * 	[scheme:][//[userinfo@]host][/]path[?query][#fragment]
+  * ```
+  * 
+  * URLs that do not start with a slash after the scheme are interpreted as:
+  * 
+  * ```
+  * 	scheme:opaque[?query][#fragment]
+  * ```
+  * 
+  * The Host field contains the host and port subcomponents of the URL.
+  * When the port is present, it is separated from the host with a colon.
+  * When the host is an IPv6 address, it must be enclosed in square brackets:
+  * "[fe80::1]:80". The [net.JoinHostPort] function combines a host and port
+  * into a string suitable for the Host field, adding square brackets to
+  * the host when necessary.
+  * 
+  * Note that the Path field is stored in decoded form: /%47%6f%2f becomes /Go/.
+  * A consequence is that it is impossible to tell which slashes in the Path were
+  * slashes in the raw URL and which were %2f. This distinction is rarely important,
+  * but when it is, the code should use the [URL.EscapedPath] method, which preserves
+  * the original encoding of Path.
+  * 
+  * The RawPath field is an optional field which is only set when the default
+  * encoding of Path is different from the escaped path. See the EscapedPath method
+  * for more details.
+  * 
+  * URL's String method uses the EscapedPath method to obtain the path.
+  */
+ interface URL {
+  scheme: string
+  opaque: string // encoded opaque data
+  user?: Userinfo // username and password information
+  host: string // host or host:port (see Hostname and Port methods)
+  path: string // path (relative paths may omit leading slash)
+  rawPath: string // encoded path hint (see EscapedPath method)
+  omitHost: boolean // do not emit empty host (authority)
+  forceQuery: boolean // append a query ('?') even if RawQuery is empty
+  rawQuery: string // encoded query values, without '?'
+  fragment: string // fragment for references, without '#'
+  rawFragment: string // encoded fragment hint (see EscapedFragment method)
+ }
+ interface URL {
+  /**
+   * EscapedPath returns the escaped form of u.Path.
+   * In general there are multiple possible escaped forms of any path.
+   * EscapedPath returns u.RawPath when it is a valid escaping of u.Path.
+   * Otherwise EscapedPath ignores u.RawPath and computes an escaped
+   * form on its own.
+   * The [URL.String] and [URL.RequestURI] methods use EscapedPath to construct
+   * their results.
+   * In general, code should call EscapedPath instead of
+   * reading u.RawPath directly.
+   */
+  escapedPath(): string
+ }
+ interface URL {
+  /**
+   * EscapedFragment returns the escaped form of u.Fragment.
+   * In general there are multiple possible escaped forms of any fragment.
+   * EscapedFragment returns u.RawFragment when it is a valid escaping of u.Fragment.
+   * Otherwise EscapedFragment ignores u.RawFragment and computes an escaped
+   * form on its own.
+   * The [URL.String] method uses EscapedFragment to construct its result.
+   * In general, code should call EscapedFragment instead of
+   * reading u.RawFragment directly.
+   */
+  escapedFragment(): string
+ }
+ interface URL {
+  /**
+   * String reassembles the [URL] into a valid URL string.
+   * The general form of the result is one of:
+   * 
+   * ```
+   * 	scheme:opaque?query#fragment
+   * 	scheme://userinfo@host/path?query#fragment
+   * ```
+   * 
+   * If u.Opaque is non-empty, String uses the first form;
+   * otherwise it uses the second form.
+   * Any non-ASCII characters in host are escaped.
+   * To obtain the path, String uses u.EscapedPath().
+   * 
+   * In the second form, the following rules apply:
+   * ```
+   *   - if u.Scheme is empty, scheme: is omitted.
+   *   - if u.User is nil, userinfo@ is omitted.
+   *   - if u.Host is empty, host/ is omitted.
+   *   - if u.Scheme and u.Host are empty and u.User is nil,
+   *     the entire scheme://userinfo@host/ is omitted.
+   *   - if u.Host is non-empty and u.Path begins with a /,
+   *     the form host/path does not add its own /.
+   *   - if u.RawQuery is empty, ?query is omitted.
+   *   - if u.Fragment is empty, #fragment is omitted.
+   * ```
+   */
+  string(): string
+ }
+ interface URL {
+  /**
+   * Redacted is like [URL.String] but replaces any password with "xxxxx".
+   * Only the password in u.User is redacted.
+   */
+  redacted(): string
+ }
+ /**
+  * Values maps a string key to a list of values.
+  * It is typically used for query parameters and form values.
+  * Unlike in the http.Header map, the keys in a Values map
+  * are case-sensitive.
+  */
+ interface Values extends _TygojaDict{}
+ interface Values {
+  /**
+   * Get gets the first value associated with the given key.
+   * If there are no values associated with the key, Get returns
+   * the empty string. To access multiple values, use the map
+   * directly.
+   */
+  get(key: string): string
+ }
+ interface Values {
+  /**
+   * Set sets the key to value. It replaces any existing
+   * values.
+   */
+  set(key: string, value: string): void
+ }
+ interface Values {
+  /**
+   * Add adds the value to key. It appends to any existing
+   * values associated with key.
+   */
+  add(key: string, value: string): void
+ }
+ interface Values {
+  /**
+   * Del deletes the values associated with key.
+   */
+  del(key: string): void
+ }
+ interface Values {
+  /**
+   * Has checks whether a given key is set.
+   */
+  has(key: string): boolean
+ }
+ interface Values {
+  /**
+   * Encode encodes the values into “URL encoded” form
+   * ("bar=baz&foo=quux") sorted by key.
+   */
+  encode(): string
+ }
+ interface URL {
+  /**
+   * IsAbs reports whether the [URL] is absolute.
+   * Absolute means that it has a non-empty scheme.
+   */
+  isAbs(): boolean
+ }
+ interface URL {
+  /**
+   * Parse parses a [URL] in the context of the receiver. The provided URL
+   * may be relative or absolute. Parse returns nil, err on parse
+   * failure, otherwise its return value is the same as [URL.ResolveReference].
+   */
+  parse(ref: string): (URL)
+ }
+ interface URL {
+  /**
+   * ResolveReference resolves a URI reference to an absolute URI from
+   * an absolute base URI u, per RFC 3986 Section 5.2. The URI reference
+   * may be relative or absolute. ResolveReference always returns a new
+   * [URL] instance, even if the returned URL is identical to either the
+   * base or reference. If ref is an absolute URL, then ResolveReference
+   * ignores base and returns a copy of ref.
+   */
+  resolveReference(ref: URL): (URL)
+ }
+ interface URL {
+  /**
+   * Query parses RawQuery and returns the corresponding values.
+   * It silently discards malformed value pairs.
+   * To check errors use [ParseQuery].
+   */
+  query(): Values
+ }
+ interface URL {
+  /**
+   * RequestURI returns the encoded path?query or opaque?query
+   * string that would be used in an HTTP request for u.
+   */
+  requestURI(): string
+ }
+ interface URL {
+  /**
+   * Hostname returns u.Host, stripping any valid port number if present.
+   * 
+   * If the result is enclosed in square brackets, as literal IPv6 addresses are,
+   * the square brackets are removed from the result.
+   */
+  hostname(): string
+ }
+ interface URL {
+  /**
+   * Port returns the port part of u.Host, without the leading colon.
+   * 
+   * If u.Host doesn't contain a valid numeric port, Port returns an empty string.
+   */
+  port(): string
+ }
+ interface URL {
+  marshalBinary(): string|Array<number>
+ }
+ interface URL {
+  unmarshalBinary(text: string|Array<number>): void
+ }
+ interface URL {
+  /**
+   * JoinPath returns a new [URL] with the provided path elements joined to
+   * any existing path and the resulting path cleaned of any ./ or ../ elements.
+   * Any sequences of multiple / characters will be reduced to a single /.
+   */
+  joinPath(...elem: string[]): (URL)
+ }
+}
+
+namespace context {
+}
+
+namespace net {
+ /**
+  * Addr represents a network end point address.
+  * 
+  * The two methods [Addr.Network] and [Addr.String] conventionally return strings
+  * that can be passed as the arguments to [Dial], but the exact form
+  * and meaning of the strings is up to the implementation.
+  */
+ interface Addr {
+  [key:string]: any;
+  network(): string // name of the network (for example, "tcp", "udp")
+  string(): string // string form of address (for example, "192.0.2.1:25", "[2001:db8::1]:80")
+ }
+ /**
+  * A Listener is a generic network listener for stream-oriented protocols.
+  * 
+  * Multiple goroutines may invoke methods on a Listener simultaneously.
+  */
+ interface Listener {
+  [key:string]: any;
+  /**
+   * Accept waits for and returns the next connection to the listener.
+   */
+  accept(): Conn
+  /**
+   * Close closes the listener.
+   * Any blocked Accept operations will be unblocked and return errors.
+   */
+  close(): void
+  /**
+   * Addr returns the listener's network address.
+   */
+  addr(): Addr
+ }
+}
+
+namespace jwt {
+ /**
+  * NumericDate represents a JSON numeric date value, as referenced at
+  * https://datatracker.ietf.org/doc/html/rfc7519#section-2.
+  */
+ type _sHxJrxk = time.Time
+ interface NumericDate extends _sHxJrxk {
+ }
+ interface NumericDate {
+  /**
+   * MarshalJSON is an implementation of the json.RawMessage interface and serializes the UNIX epoch
+   * represented in NumericDate to a byte array, using the precision specified in TimePrecision.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface NumericDate {
+  /**
+   * UnmarshalJSON is an implementation of the json.RawMessage interface and
+   * deserializes a [NumericDate] from a JSON representation, i.e. a
+   * [json.Number]. This number represents an UNIX epoch with either integer or
+   * non-integer seconds.
+   */
+  unmarshalJSON(b: string|Array<number>): void
+ }
+ /**
+  * ClaimStrings is basically just a slice of strings, but it can be either
+  * serialized from a string array or just a string. This type is necessary,
+  * since the "aud" claim can either be a single string or an array.
+  */
+ interface ClaimStrings extends Array<string>{}
+ interface ClaimStrings {
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface ClaimStrings {
+  marshalJSON(): string|Array<number>
+ }
+}
+
+namespace hook {
+ /**
+  * wrapped local Hook embedded struct to limit the public API surface.
+  */
+ type _sAafFuB<T> = Hook<T>
+ interface mainHook<T> extends _sAafFuB<T> {
+ }
+}
+
+namespace sql {
+ /**
+  * IsolationLevel is the transaction isolation level used in [TxOptions].
+  */
+ interface IsolationLevel extends Number{}
+ interface IsolationLevel {
+  /**
+   * String returns the name of the transaction isolation level.
+   */
+  string(): string
+ }
+ /**
+  * DBStats contains database statistics.
+  */
+ interface DBStats {
+  maxOpenConnections: number // Maximum number of open connections to the database.
+  /**
+   * Pool Status
+   */
+  openConnections: number // The number of established connections both in use and idle.
+  inUse: number // The number of connections currently in use.
+  idle: number // The number of idle connections.
+  /**
+   * Counters
+   */
+  waitCount: number // The total number of connections waited for.
+  waitDuration: time.Duration // The total time blocked waiting for a new connection.
+  maxIdleClosed: number // The total number of connections closed due to SetMaxIdleConns.
+  maxIdleTimeClosed: number // The total number of connections closed due to SetConnMaxIdleTime.
+  maxLifetimeClosed: number // The total number of connections closed due to SetConnMaxLifetime.
+ }
+ /**
+  * Conn represents a single database connection rather than a pool of database
+  * connections. Prefer running queries from [DB] unless there is a specific
+  * need for a continuous single database connection.
+  * 
+  * A Conn must call [Conn.Close] to return the connection to the database pool
+  * and may do so concurrently with a running query.
+  * 
+  * After a call to [Conn.Close], all operations on the
+  * connection fail with [ErrConnDone].
+  */
+ interface Conn {
+ }
+ interface Conn {
+  /**
+   * PingContext verifies the connection to the database is still alive.
+   */
+  pingContext(ctx: context.Context): void
+ }
+ interface Conn {
+  /**
+   * ExecContext executes a query without returning any rows.
+   * The args are for any placeholder parameters in the query.
+   */
+  execContext(ctx: context.Context, query: string, ...args: any[]): Result
+ }
+ interface Conn {
+  /**
+   * QueryContext executes a query that returns rows, typically a SELECT.
+   * The args are for any placeholder parameters in the query.
+   */
+  queryContext(ctx: context.Context, query: string, ...args: any[]): (Rows)
+ }
+ interface Conn {
+  /**
+   * QueryRowContext executes a query that is expected to return at most one row.
+   * QueryRowContext always returns a non-nil value. Errors are deferred until
+   * the [*Row.Scan] method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   */
+  queryRowContext(ctx: context.Context, query: string, ...args: any[]): (Row)
+ }
+ interface Conn {
+  /**
+   * PrepareContext creates a prepared statement for later queries or executions.
+   * Multiple queries or executions may be run concurrently from the
+   * returned statement.
+   * The caller must call the statement's [*Stmt.Close] method
+   * when the statement is no longer needed.
+   * 
+   * The provided context is used for the preparation of the statement, not for the
+   * execution of the statement.
+   */
+  prepareContext(ctx: context.Context, query: string): (Stmt)
+ }
+ interface Conn {
+  /**
+   * Raw executes f exposing the underlying driver connection for the
+   * duration of f. The driverConn must not be used outside of f.
+   * 
+   * Once f returns and err is not [driver.ErrBadConn], the [Conn] will continue to be usable
+   * until [Conn.Close] is called.
+   */
+  raw(f: (driverConn: any) => void): void
+ }
+ interface Conn {
+  /**
+   * BeginTx starts a transaction.
+   * 
+   * The provided context is used until the transaction is committed or rolled back.
+   * If the context is canceled, the sql package will roll back
+   * the transaction. [Tx.Commit] will return an error if the context provided to
+   * BeginTx is canceled.
+   * 
+   * The provided [TxOptions] is optional and may be nil if defaults should be used.
+   * If a non-default isolation level is used that the driver doesn't support,
+   * an error will be returned.
+   */
+  beginTx(ctx: context.Context, opts: TxOptions): (Tx)
+ }
+ interface Conn {
+  /**
+   * Close returns the connection to the connection pool.
+   * All operations after a Close will return with [ErrConnDone].
+   * Close is safe to call concurrently with other operations and will
+   * block until all other operations finish. It may be useful to first
+   * cancel any used context and then call close directly after.
+   */
+  close(): void
+ }
+ /**
+  * ColumnType contains the name and type of a column.
+  */
+ interface ColumnType {
+ }
+ interface ColumnType {
+  /**
+   * Name returns the name or alias of the column.
+   */
+  name(): string
+ }
+ interface ColumnType {
+  /**
+   * Length returns the column type length for variable length column types such
+   * as text and binary field types. If the type length is unbounded the value will
+   * be [math.MaxInt64] (any database limits will still apply).
+   * If the column type is not variable length, such as an int, or if not supported
+   * by the driver ok is false.
+   */
+  length(): [number, boolean]
+ }
+ interface ColumnType {
+  /**
+   * DecimalSize returns the scale and precision of a decimal type.
+   * If not applicable or if not supported ok is false.
+   */
+  decimalSize(): [number, number, boolean]
+ }
+ interface ColumnType {
+  /**
+   * ScanType returns a Go type suitable for scanning into using [Rows.Scan].
+   * If a driver does not support this property ScanType will return
+   * the type of an empty interface.
+   */
+  scanType(): any
+ }
+ interface ColumnType {
+  /**
+   * Nullable reports whether the column may be null.
+   * If a driver does not support this property ok will be false.
+   */
+  nullable(): [boolean, boolean]
+ }
+ interface ColumnType {
+  /**
+   * DatabaseTypeName returns the database system name of the column type. If an empty
+   * string is returned, then the driver type name is not supported.
+   * Consult your driver documentation for a list of driver data types. [ColumnType.Length] specifiers
+   * are not included.
+   * Common type names include "VARCHAR", "TEXT", "NVARCHAR", "DECIMAL", "BOOL",
+   * "INT", and "BIGINT".
+   */
+  databaseTypeName(): string
+ }
+ /**
+  * Row is the result of calling [DB.QueryRow] to select a single row.
+  */
+ interface Row {
+ }
+ interface Row {
+  /**
+   * Scan copies the columns from the matched row into the values
+   * pointed at by dest. See the documentation on [Rows.Scan] for details.
+   * If more than one row matches the query,
+   * Scan uses the first row and discards the rest. If no row matches
+   * the query, Scan returns [ErrNoRows].
+   */
+  scan(...dest: any[]): void
+ }
+ interface Row {
+  /**
+   * Err provides a way for wrapping packages to check for
+   * query errors without calling [Row.Scan].
+   * Err returns the error, if any, that was encountered while running the query.
+   * If this error is not nil, this error will also be returned from [Row.Scan].
+   */
+  err(): void
+ }
+}
+
+namespace types {
+}
+
+namespace search {
+}
+
+namespace bufio {
+ /**
+  * Reader implements buffering for an io.Reader object.
+  */
+ interface Reader {
+ }
+ interface Reader {
+  /**
+   * Size returns the size of the underlying buffer in bytes.
+   */
+  size(): number
+ }
+ interface Reader {
+  /**
+   * Reset discards any buffered data, resets all state, and switches
+   * the buffered reader to read from r.
+   * Calling Reset on the zero value of [Reader] initializes the internal buffer
+   * to the default size.
+   * Calling b.Reset(b) (that is, resetting a [Reader] to itself) does nothing.
+   */
+  reset(r: io.Reader): void
+ }
+ interface Reader {
+  /**
+   * Peek returns the next n bytes without advancing the reader. The bytes stop
+   * being valid at the next read call. If Peek returns fewer than n bytes, it
+   * also returns an error explaining why the read is short. The error is
+   * [ErrBufferFull] if n is larger than b's buffer size.
+   * 
+   * Calling Peek prevents a [Reader.UnreadByte] or [Reader.UnreadRune] call from succeeding
+   * until the next read operation.
+   */
+  peek(n: number): string|Array<number>
+ }
+ interface Reader {
+  /**
+   * Discard skips the next n bytes, returning the number of bytes discarded.
+   * 
+   * If Discard skips fewer than n bytes, it also returns an error.
+   * If 0 <= n <= b.Buffered(), Discard is guaranteed to succeed without
+   * reading from the underlying io.Reader.
+   */
+  discard(n: number): number
+ }
+ interface Reader {
+  /**
+   * Read reads data into p.
+   * It returns the number of bytes read into p.
+   * The bytes are taken from at most one Read on the underlying [Reader],
+   * hence n may be less than len(p).
+   * To read exactly len(p) bytes, use io.ReadFull(b, p).
+   * If the underlying [Reader] can return a non-zero count with io.EOF,
+   * then this Read method can do so as well; see the [io.Reader] docs.
+   */
+  read(p: string|Array<number>): number
+ }
+ interface Reader {
+  /**
+   * ReadByte reads and returns a single byte.
+   * If no byte is available, returns an error.
+   */
+  readByte(): number
+ }
+ interface Reader {
+  /**
+   * UnreadByte unreads the last byte. Only the most recently read byte can be unread.
+   * 
+   * UnreadByte returns an error if the most recent method called on the
+   * [Reader] was not a read operation. Notably, [Reader.Peek], [Reader.Discard], and [Reader.WriteTo] are not
+   * considered read operations.
+   */
+  unreadByte(): void
+ }
+ interface Reader {
+  /**
+   * ReadRune reads a single UTF-8 encoded Unicode character and returns the
+   * rune and its size in bytes. If the encoded rune is invalid, it consumes one byte
+   * and returns unicode.ReplacementChar (U+FFFD) with a size of 1.
+   */
+  readRune(): [number, number]
+ }
+ interface Reader {
+  /**
+   * UnreadRune unreads the last rune. If the most recent method called on
+   * the [Reader] was not a [Reader.ReadRune], [Reader.UnreadRune] returns an error. (In this
+   * regard it is stricter than [Reader.UnreadByte], which will unread the last byte
+   * from any read operation.)
+   */
+  unreadRune(): void
+ }
+ interface Reader {
+  /**
+   * Buffered returns the number of bytes that can be read from the current buffer.
+   */
+  buffered(): number
+ }
+ interface Reader {
+  /**
+   * ReadSlice reads until the first occurrence of delim in the input,
+   * returning a slice pointing at the bytes in the buffer.
+   * The bytes stop being valid at the next read.
+   * If ReadSlice encounters an error before finding a delimiter,
+   * it returns all the data in the buffer and the error itself (often io.EOF).
+   * ReadSlice fails with error [ErrBufferFull] if the buffer fills without a delim.
+   * Because the data returned from ReadSlice will be overwritten
+   * by the next I/O operation, most clients should use
+   * [Reader.ReadBytes] or ReadString instead.
+   * ReadSlice returns err != nil if and only if line does not end in delim.
+   */
+  readSlice(delim: number): string|Array<number>
+ }
+ interface Reader {
+  /**
+   * ReadLine is a low-level line-reading primitive. Most callers should use
+   * [Reader.ReadBytes]('\n') or [Reader.ReadString]('\n') instead or use a [Scanner].
+   * 
+   * ReadLine tries to return a single line, not including the end-of-line bytes.
+   * If the line was too long for the buffer then isPrefix is set and the
+   * beginning of the line is returned. The rest of the line will be returned
+   * from future calls. isPrefix will be false when returning the last fragment
+   * of the line. The returned buffer is only valid until the next call to
+   * ReadLine. ReadLine either returns a non-nil line or it returns an error,
+   * never both.
+   * 
+   * The text returned from ReadLine does not include the line end ("\r\n" or "\n").
+   * No indication or error is given if the input ends without a final line end.
+   * Calling [Reader.UnreadByte] after ReadLine will always unread the last byte read
+   * (possibly a character belonging to the line end) even if that byte is not
+   * part of the line returned by ReadLine.
+   */
+  readLine(): [string|Array<number>, boolean]
+ }
+ interface Reader {
+  /**
+   * ReadBytes reads until the first occurrence of delim in the input,
+   * returning a slice containing the data up to and including the delimiter.
+   * If ReadBytes encounters an error before finding a delimiter,
+   * it returns the data read before the error and the error itself (often io.EOF).
+   * ReadBytes returns err != nil if and only if the returned data does not end in
+   * delim.
+   * For simple uses, a Scanner may be more convenient.
+   */
+  readBytes(delim: number): string|Array<number>
+ }
+ interface Reader {
+  /**
+   * ReadString reads until the first occurrence of delim in the input,
+   * returning a string containing the data up to and including the delimiter.
+   * If ReadString encounters an error before finding a delimiter,
+   * it returns the data read before the error and the error itself (often io.EOF).
+   * ReadString returns err != nil if and only if the returned data does not end in
+   * delim.
+   * For simple uses, a Scanner may be more convenient.
+   */
+  readString(delim: number): string
+ }
+ interface Reader {
+  /**
+   * WriteTo implements io.WriterTo.
+   * This may make multiple calls to the [Reader.Read] method of the underlying [Reader].
+   * If the underlying reader supports the [Reader.WriteTo] method,
+   * this calls the underlying [Reader.WriteTo] without buffering.
+   */
+  writeTo(w: io.Writer): number
+ }
+ /**
+  * Writer implements buffering for an [io.Writer] object.
+  * If an error occurs writing to a [Writer], no more data will be
+  * accepted and all subsequent writes, and [Writer.Flush], will return the error.
+  * After all data has been written, the client should call the
+  * [Writer.Flush] method to guarantee all data has been forwarded to
+  * the underlying [io.Writer].
+  */
+ interface Writer {
+ }
+ interface Writer {
+  /**
+   * Size returns the size of the underlying buffer in bytes.
+   */
+  size(): number
+ }
+ interface Writer {
+  /**
+   * Reset discards any unflushed buffered data, clears any error, and
+   * resets b to write its output to w.
+   * Calling Reset on the zero value of [Writer] initializes the internal buffer
+   * to the default size.
+   * Calling w.Reset(w) (that is, resetting a [Writer] to itself) does nothing.
+   */
+  reset(w: io.Writer): void
+ }
+ interface Writer {
+  /**
+   * Flush writes any buffered data to the underlying [io.Writer].
+   */
+  flush(): void
+ }
+ interface Writer {
+  /**
+   * Available returns how many bytes are unused in the buffer.
+   */
+  available(): number
+ }
+ interface Writer {
+  /**
+   * AvailableBuffer returns an empty buffer with b.Available() capacity.
+   * This buffer is intended to be appended to and
+   * passed to an immediately succeeding [Writer.Write] call.
+   * The buffer is only valid until the next write operation on b.
+   */
+  availableBuffer(): string|Array<number>
+ }
+ interface Writer {
+  /**
+   * Buffered returns the number of bytes that have been written into the current buffer.
+   */
+  buffered(): number
+ }
+ interface Writer {
+  /**
+   * Write writes the contents of p into the buffer.
+   * It returns the number of bytes written.
+   * If nn < len(p), it also returns an error explaining
+   * why the write is short.
+   */
+  write(p: string|Array<number>): number
+ }
+ interface Writer {
+  /**
+   * WriteByte writes a single byte.
+   */
+  writeByte(c: number): void
+ }
+ interface Writer {
+  /**
+   * WriteRune writes a single Unicode code point, returning
+   * the number of bytes written and any error.
+   */
+  writeRune(r: number): number
+ }
+ interface Writer {
+  /**
+   * WriteString writes a string.
+   * It returns the number of bytes written.
+   * If the count is less than len(s), it also returns an error explaining
+   * why the write is short.
+   */
+  writeString(s: string): number
+ }
+ interface Writer {
+  /**
+   * ReadFrom implements [io.ReaderFrom]. If the underlying writer
+   * supports the ReadFrom method, this calls the underlying ReadFrom.
+   * If there is buffered data and an underlying ReadFrom, this fills
+   * the buffer and writes it before calling ReadFrom.
+   */
+  readFrom(r: io.Reader): number
+ }
+}
+
+/**
+ * Package textproto implements generic support for text-based request/response
+ * protocols in the style of HTTP, NNTP, and SMTP.
+ * 
+ * The package provides:
+ * 
+ * [Error], which represents a numeric error response from
+ * a server.
+ * 
+ * [Pipeline], to manage pipelined requests and responses
+ * in a client.
+ * 
+ * [Reader], to read numeric response code lines,
+ * key: value headers, lines wrapped with leading spaces
+ * on continuation lines, and whole text blocks ending
+ * with a dot on a line by itself.
+ * 
+ * [Writer], to write dot-encoded text blocks.
+ * 
+ * [Conn], a convenient packaging of [Reader], [Writer], and [Pipeline] for use
+ * with a single network connection.
+ */
+namespace textproto {
+ /**
+  * A MIMEHeader represents a MIME-style header mapping
+  * keys to sets of values.
+  */
+ interface MIMEHeader extends _TygojaDict{}
+ interface MIMEHeader {
+  /**
+   * Add adds the key, value pair to the header.
+   * It appends to any existing values associated with key.
+   */
+  add(key: string, value: string): void
+ }
+ interface MIMEHeader {
+  /**
+   * Set sets the header entries associated with key to
+   * the single element value. It replaces any existing
+   * values associated with key.
+   */
+  set(key: string, value: string): void
+ }
+ interface MIMEHeader {
+  /**
+   * Get gets the first value associated with the given key.
+   * It is case insensitive; [CanonicalMIMEHeaderKey] is used
+   * to canonicalize the provided key.
+   * If there are no values associated with the key, Get returns "".
+   * To use non-canonical keys, access the map directly.
+   */
+  get(key: string): string
+ }
+ interface MIMEHeader {
+  /**
+   * Values returns all values associated with the given key.
+   * It is case insensitive; [CanonicalMIMEHeaderKey] is
+   * used to canonicalize the provided key. To use non-canonical
+   * keys, access the map directly.
+   * The returned slice is not a copy.
+   */
+  values(key: string): Array<string>
+ }
+ interface MIMEHeader {
+  /**
+   * Del deletes the values associated with key.
+   */
+  del(key: string): void
+ }
+}
+
+namespace multipart {
+ interface Reader {
+  /**
+   * ReadForm parses an entire multipart message whose parts have
+   * a Content-Disposition of "form-data".
+   * It stores up to maxMemory bytes + 10MB (reserved for non-file parts)
+   * in memory. File parts which can't be stored in memory will be stored on
+   * disk in temporary files.
+   * It returns [ErrMessageTooLarge] if all non-file parts can't be stored in
+   * memory.
+   */
+  readForm(maxMemory: number): (Form)
+ }
+ /**
+  * Form is a parsed multipart form.
+  * Its File parts are stored either in memory or on disk,
+  * and are accessible via the [*FileHeader]'s Open method.
+  * Its Value parts are stored as strings.
+  * Both are keyed by field name.
+  */
+ interface Form {
+  value: _TygojaDict
+  file: _TygojaDict
+ }
+ interface Form {
+  /**
+   * RemoveAll removes any temporary files associated with a [Form].
+   */
+  removeAll(): void
+ }
+ /**
+  * File is an interface to access the file part of a multipart message.
+  * Its contents may be either stored in memory or on disk.
+  * If stored on disk, the File's underlying concrete type will be an *os.File.
+  */
+ interface File {
+  [key:string]: any;
+ }
+ /**
+  * Reader is an iterator over parts in a MIME multipart body.
+  * Reader's underlying parser consumes its input as needed. Seeking
+  * isn't supported.
+  */
+ interface Reader {
+ }
+ interface Reader {
+  /**
+   * NextPart returns the next part in the multipart or an error.
+   * When there are no more parts, the error [io.EOF] is returned.
+   * 
+   * As a special case, if the "Content-Transfer-Encoding" header
+   * has a value of "quoted-printable", that header is instead
+   * hidden and the body is transparently decoded during Read calls.
+   */
+  nextPart(): (Part)
+ }
+ interface Reader {
+  /**
+   * NextRawPart returns the next part in the multipart or an error.
+   * When there are no more parts, the error [io.EOF] is returned.
+   * 
+   * Unlike [Reader.NextPart], it does not have special handling for
+   * "Content-Transfer-Encoding: quoted-printable".
+   */
+  nextRawPart(): (Part)
+ }
+}
+
+namespace http {
+ /**
+  * A Cookie represents an HTTP cookie as sent in the Set-Cookie header of an
+  * HTTP response or the Cookie header of an HTTP request.
+  * 
+  * See https://tools.ietf.org/html/rfc6265 for details.
+  */
+ interface Cookie {
+  name: string
+  value: string
+  quoted: boolean // indicates whether the Value was originally quoted
+  path: string // optional
+  domain: string // optional
+  expires: time.Time // optional
+  rawExpires: string // for reading cookies only
+  /**
+   * MaxAge=0 means no 'Max-Age' attribute specified.
+   * MaxAge<0 means delete cookie now, equivalently 'Max-Age: 0'
+   * MaxAge>0 means Max-Age attribute present and given in seconds
+   */
+  maxAge: number
+  secure: boolean
+  httpOnly: boolean
+  sameSite: SameSite
+  partitioned: boolean
+  raw: string
+  unparsed: Array<string> // Raw text of unparsed attribute-value pairs
+ }
+ interface Cookie {
+  /**
+   * String returns the serialization of the cookie for use in a [Cookie]
+   * header (if only Name and Value are set) or a Set-Cookie response
+   * header (if other fields are set).
+   * If c is nil or c.Name is invalid, the empty string is returned.
+   */
+  string(): string
+ }
+ interface Cookie {
+  /**
+   * Valid reports whether the cookie is valid.
+   */
+  valid(): void
+ }
+ // @ts-ignore
+ import mathrand = rand
+ /**
+  * A Header represents the key-value pairs in an HTTP header.
+  * 
+  * The keys should be in canonical form, as returned by
+  * [CanonicalHeaderKey].
+  */
+ interface Header extends _TygojaDict{}
+ interface Header {
+  /**
+   * Add adds the key, value pair to the header.
+   * It appends to any existing values associated with key.
+   * The key is case insensitive; it is canonicalized by
+   * [CanonicalHeaderKey].
+   */
+  add(key: string, value: string): void
+ }
+ interface Header {
+  /**
+   * Set sets the header entries associated with key to the
+   * single element value. It replaces any existing values
+   * associated with key. The key is case insensitive; it is
+   * canonicalized by [textproto.CanonicalMIMEHeaderKey].
+   * To use non-canonical keys, assign to the map directly.
+   */
+  set(key: string, value: string): void
+ }
+ interface Header {
+  /**
+   * Get gets the first value associated with the given key. If
+   * there are no values associated with the key, Get returns "".
+   * It is case insensitive; [textproto.CanonicalMIMEHeaderKey] is
+   * used to canonicalize the provided key. Get assumes that all
+   * keys are stored in canonical form. To use non-canonical keys,
+   * access the map directly.
+   */
+  get(key: string): string
+ }
+ interface Header {
+  /**
+   * Values returns all values associated with the given key.
+   * It is case insensitive; [textproto.CanonicalMIMEHeaderKey] is
+   * used to canonicalize the provided key. To use non-canonical
+   * keys, access the map directly.
+   * The returned slice is not a copy.
+   */
+  values(key: string): Array<string>
+ }
+ interface Header {
+  /**
+   * Del deletes the values associated with key.
+   * The key is case insensitive; it is canonicalized by
+   * [CanonicalHeaderKey].
+   */
+  del(key: string): void
+ }
+ interface Header {
+  /**
+   * Write writes a header in wire format.
+   */
+  write(w: io.Writer): void
+ }
+ interface Header {
+  /**
+   * Clone returns a copy of h or nil if h is nil.
+   */
+  clone(): Header
+ }
+ interface Header {
+  /**
+   * WriteSubset writes a header in wire format.
+   * If exclude is not nil, keys where exclude[key] == true are not written.
+   * Keys are not canonicalized before checking the exclude map.
+   */
+  writeSubset(w: io.Writer, exclude: _TygojaDict): void
+ }
+ // @ts-ignore
+ import urlpkg = url
+ /**
+  * Response represents the response from an HTTP request.
+  * 
+  * The [Client] and [Transport] return Responses from servers once
+  * the response headers have been received. The response body
+  * is streamed on demand as the Body field is read.
+  */
+ interface Response {
+  status: string // e.g. "200 OK"
+  statusCode: number // e.g. 200
+  proto: string // e.g. "HTTP/1.0"
+  protoMajor: number // e.g. 1
+  protoMinor: number // e.g. 0
+  /**
+   * Header maps header keys to values. If the response had multiple
+   * headers with the same key, they may be concatenated, with comma
+   * delimiters.  (RFC 7230, section 3.2.2 requires that multiple headers
+   * be semantically equivalent to a comma-delimited sequence.) When
+   * Header values are duplicated by other fields in this struct (e.g.,
+   * ContentLength, TransferEncoding, Trailer), the field values are
+   * authoritative.
+   * 
+   * Keys in the map are canonicalized (see CanonicalHeaderKey).
+   */
+  header: Header
+  /**
+   * Body represents the response body.
+   * 
+   * The response body is streamed on demand as the Body field
+   * is read. If the network connection fails or the server
+   * terminates the response, Body.Read calls return an error.
+   * 
+   * The http Client and Transport guarantee that Body is always
+   * non-nil, even on responses without a body or responses with
+   * a zero-length body. It is the caller's responsibility to
+   * close Body. The default HTTP client's Transport may not
+   * reuse HTTP/1.x "keep-alive" TCP connections if the Body is
+   * not read to completion and closed.
+   * 
+   * The Body is automatically dechunked if the server replied
+   * with a "chunked" Transfer-Encoding.
+   * 
+   * As of Go 1.12, the Body will also implement io.Writer
+   * on a successful "101 Switching Protocols" response,
+   * as used by WebSockets and HTTP/2's "h2c" mode.
+   */
+  body: io.ReadCloser
+  /**
+   * ContentLength records the length of the associated content. The
+   * value -1 indicates that the length is unknown. Unless Request.Method
+   * is "HEAD", values >= 0 indicate that the given number of bytes may
+   * be read from Body.
+   */
+  contentLength: number
+  /**
+   * Contains transfer encodings from outer-most to inner-most. Value is
+   * nil, means that "identity" encoding is used.
+   */
+  transferEncoding: Array<string>
+  /**
+   * Close records whether the header directed that the connection be
+   * closed after reading Body. The value is advice for clients: neither
+   * ReadResponse nor Response.Write ever closes a connection.
+   */
+  close: boolean
+  /**
+   * Uncompressed reports whether the response was sent compressed but
+   * was decompressed by the http package. When true, reading from
+   * Body yields the uncompressed content instead of the compressed
+   * content actually set from the server, ContentLength is set to -1,
+   * and the "Content-Length" and "Content-Encoding" fields are deleted
+   * from the responseHeader. To get the original response from
+   * the server, set Transport.DisableCompression to true.
+   */
+  uncompressed: boolean
+  /**
+   * Trailer maps trailer keys to values in the same
+   * format as Header.
+   * 
+   * The Trailer initially contains only nil values, one for
+   * each key specified in the server's "Trailer" header
+   * value. Those values are not added to Header.
+   * 
+   * Trailer must not be accessed concurrently with Read calls
+   * on the Body.
+   * 
+   * After Body.Read has returned io.EOF, Trailer will contain
+   * any trailer values sent by the server.
+   */
+  trailer: Header
+  /**
+   * Request is the request that was sent to obtain this Response.
+   * Request's Body is nil (having already been consumed).
+   * This is only populated for Client requests.
+   */
+  request?: Request
+  /**
+   * TLS contains information about the TLS connection on which the
+   * response was received. It is nil for unencrypted responses.
+   * The pointer is shared between responses and should not be
+   * modified.
+   */
+  tls?: any
+ }
+ interface Response {
+  /**
+   * Cookies parses and returns the cookies set in the Set-Cookie headers.
+   */
+  cookies(): Array<(Cookie | undefined)>
+ }
+ interface Response {
+  /**
+   * Location returns the URL of the response's "Location" header,
+   * if present. Relative redirects are resolved relative to
+   * [Response.Request]. [ErrNoLocation] is returned if no
+   * Location header is present.
+   */
+  location(): (url.URL)
+ }
+ interface Response {
+  /**
+   * ProtoAtLeast reports whether the HTTP protocol used
+   * in the response is at least major.minor.
+   */
+  protoAtLeast(major: number, minor: number): boolean
+ }
+ interface Response {
+  /**
+   * Write writes r to w in the HTTP/1.x server response format,
+   * including the status line, headers, body, and optional trailer.
+   * 
+   * This method consults the following fields of the response r:
+   * 
+   * ```
+   * 	StatusCode
+   * 	ProtoMajor
+   * 	ProtoMinor
+   * 	Request.Method
+   * 	TransferEncoding
+   * 	Trailer
+   * 	Body
+   * 	ContentLength
+   * 	Header, values for non-canonical keys will have unpredictable behavior
+   * ```
+   * 
+   * The Response Body is closed after it is sent.
+   */
+  write(w: io.Writer): void
+ }
+ /**
+  * A ConnState represents the state of a client connection to a server.
+  * It's used by the optional [Server.ConnState] hook.
+  */
+ interface ConnState extends Number{}
+ interface ConnState {
+  string(): string
+ }
+}
+
+/**
+ * Package oauth2 provides support for making
+ * OAuth2 authorized and authenticated HTTP requests,
+ * as specified in RFC 6749.
+ * It can additionally grant authorization with Bearer JWT.
+ */
+namespace oauth2 {
+ /**
+  * An AuthCodeOption is passed to Config.AuthCodeURL.
+  */
+ interface AuthCodeOption {
+  [key:string]: any;
+ }
+ /**
+  * Token represents the credentials used to authorize
+  * the requests to access protected resources on the OAuth 2.0
+  * provider's backend.
+  * 
+  * Most users of this package should not access fields of Token
+  * directly. They're exported mostly for use by related packages
+  * implementing derivative OAuth2 flows.
+  */
+ interface Token {
+  /**
+   * AccessToken is the token that authorizes and authenticates
+   * the requests.
+   */
+  accessToken: string
+  /**
+   * TokenType is the type of token.
+   * The Type method returns either this or "Bearer", the default.
+   */
+  tokenType: string
+  /**
+   * RefreshToken is a token that's used by the application
+   * (as opposed to the user) to refresh the access token
+   * if it expires.
+   */
+  refreshToken: string
+  /**
+   * Expiry is the optional expiration time of the access token.
+   * 
+   * If zero, [TokenSource] implementations will reuse the same
+   * token forever and RefreshToken or equivalent
+   * mechanisms for that TokenSource will not be used.
+   */
+  expiry: time.Time
+  /**
+   * ExpiresIn is the OAuth2 wire format "expires_in" field,
+   * which specifies how many seconds later the token expires,
+   * relative to an unknown time base approximately around "now".
+   * It is the application's responsibility to populate
+   * `Expiry` from `ExpiresIn` when required.
+   */
+  expiresIn: number
+ }
+ interface Token {
+  /**
+   * Type returns t.TokenType if non-empty, else "Bearer".
+   */
+  type(): string
+ }
+ interface Token {
+  /**
+   * SetAuthHeader sets the Authorization header to r using the access
+   * token in t.
+   * 
+   * This method is unnecessary when using [Transport] or an HTTP Client
+   * returned by this package.
+   */
+  setAuthHeader(r: http.Request): void
+ }
+ interface Token {
+  /**
+   * WithExtra returns a new [Token] that's a clone of t, but using the
+   * provided raw extra map. This is only intended for use by packages
+   * implementing derivative OAuth2 flows.
+   */
+  withExtra(extra: any): (Token)
+ }
+ interface Token {
+  /**
+   * Extra returns an extra field.
+   * Extra fields are key-value pairs returned by the server as a
+   * part of the token retrieval response.
+   */
+  extra(key: string): any
+ }
+ interface Token {
+  /**
+   * Valid reports whether t is non-nil, has an AccessToken, and is not expired.
+   */
+  valid(): boolean
+ }
+}
+
+namespace subscriptions {
+}
+
+namespace cron {
+ /**
+  * Job defines a single registered cron job.
+  */
+ interface Job {
+ }
+ interface Job {
+  /**
+   * Id returns the cron job id.
+   */
+  id(): string
+ }
+ interface Job {
+  /**
+   * Expression returns the plain cron job schedule expression.
+   */
+  expression(): string
+ }
+ interface Job {
+  /**
+   * Run runs the cron job function.
+   */
+  run(): void
+ }
+ interface Job {
+  /**
+   * MarshalJSON implements [json.Marshaler] and export the current
+   * jobs data into valid JSON.
+   */
+  marshalJSON(): string|Array<number>
+ }
+}
+
+namespace router {
+ // @ts-ignore
+ import validation = ozzo_validation
+ /**
+  * RouterGroup represents a collection of routes and other sub groups
+  * that share common pattern prefix and middlewares.
+  */
+ interface RouterGroup<T> {
+  prefix: string
+  middlewares: Array<(hook.Handler<T> | undefined)>
+ }
+}
+
+namespace slog {
+ /**
+  * An Attr is a key-value pair.
+  */
+ interface Attr {
+  key: string
+  value: Value
+ }
+ interface Attr {
+  /**
+   * Equal reports whether a and b have equal keys and values.
+   */
+  equal(b: Attr): boolean
+ }
+ interface Attr {
+  string(): string
+ }
+ /**
+  * A Handler handles log records produced by a Logger.
+  * 
+  * A typical handler may print log records to standard error,
+  * or write them to a file or database, or perhaps augment them
+  * with additional attributes and pass them on to another handler.
+  * 
+  * Any of the Handler's methods may be called concurrently with itself
+  * or with other methods. It is the responsibility of the Handler to
+  * manage this concurrency.
+  * 
+  * Users of the slog package should not invoke Handler methods directly.
+  * They should use the methods of [Logger] instead.
+  */
+ interface Handler {
+  [key:string]: any;
+  /**
+   * Enabled reports whether the handler handles records at the given level.
+   * The handler ignores records whose level is lower.
+   * It is called early, before any arguments are processed,
+   * to save effort if the log event should be discarded.
+   * If called from a Logger method, the first argument is the context
+   * passed to that method, or context.Background() if nil was passed
+   * or the method does not take a context.
+   * The context is passed so Enabled can use its values
+   * to make a decision.
+   */
+  enabled(_arg0: context.Context, _arg1: Level): boolean
+  /**
+   * Handle handles the Record.
+   * It will only be called when Enabled returns true.
+   * The Context argument is as for Enabled.
+   * It is present solely to provide Handlers access to the context's values.
+   * Canceling the context should not affect record processing.
+   * (Among other things, log messages may be necessary to debug a
+   * cancellation-related problem.)
+   * 
+   * Handle methods that produce output should observe the following rules:
+   * ```
+   *   - If r.Time is the zero time, ignore the time.
+   *   - If r.PC is zero, ignore it.
+   *   - Attr's values should be resolved.
+   *   - If an Attr's key and value are both the zero value, ignore the Attr.
+   *     This can be tested with attr.Equal(Attr{}).
+   *   - If a group's key is empty, inline the group's Attrs.
+   *   - If a group has no Attrs (even if it has a non-empty key),
+   *     ignore it.
+   * ```
+   */
+  handle(_arg0: context.Context, _arg1: Record): void
+  /**
+   * WithAttrs returns a new Handler whose attributes consist of
+   * both the receiver's attributes and the arguments.
+   * The Handler owns the slice: it may retain, modify or discard it.
+   */
+  withAttrs(attrs: Array<Attr>): Handler
+  /**
+   * WithGroup returns a new Handler with the given group appended to
+   * the receiver's existing groups.
+   * The keys of all subsequent attributes, whether added by With or in a
+   * Record, should be qualified by the sequence of group names.
+   * 
+   * How this qualification happens is up to the Handler, so long as
+   * this Handler's attribute keys differ from those of another Handler
+   * with a different sequence of group names.
+   * 
+   * A Handler should treat WithGroup as starting a Group of Attrs that ends
+   * at the end of the log event. That is,
+   * 
+   * ```
+   *     logger.WithGroup("s").LogAttrs(ctx, level, msg, slog.Int("a", 1), slog.Int("b", 2))
+   * ```
+   * 
+   * should behave like
+   * 
+   * ```
+   *     logger.LogAttrs(ctx, level, msg, slog.Group("s", slog.Int("a", 1), slog.Int("b", 2)))
+   * ```
+   * 
+   * If the name is empty, WithGroup returns the receiver.
+   */
+  withGroup(name: string): Handler
+ }
+ /**
+  * A Level is the importance or severity of a log event.
+  * The higher the level, the more important or severe the event.
+  */
+ interface Level extends Number{}
+ interface Level {
+  /**
+   * String returns a name for the level.
+   * If the level has a name, then that name
+   * in uppercase is returned.
+   * If the level is between named values, then
+   * an integer is appended to the uppercased name.
+   * Examples:
+   * 
+   * ```
+   * 	LevelWarn.String() => "WARN"
+   * 	(LevelInfo+2).String() => "INFO+2"
+   * ```
+   */
+  string(): string
+ }
+ interface Level {
+  /**
+   * MarshalJSON implements [encoding/json.Marshaler]
+   * by quoting the output of [Level.String].
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface Level {
+  /**
+   * UnmarshalJSON implements [encoding/json.Unmarshaler]
+   * It accepts any string produced by [Level.MarshalJSON],
+   * ignoring case.
+   * It also accepts numeric offsets that would result in a different string on
+   * output. For example, "Error-8" would marshal as "INFO".
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface Level {
+  /**
+   * MarshalText implements [encoding.TextMarshaler]
+   * by calling [Level.String].
+   */
+  marshalText(): string|Array<number>
+ }
+ interface Level {
+  /**
+   * UnmarshalText implements [encoding.TextUnmarshaler].
+   * It accepts any string produced by [Level.MarshalText],
+   * ignoring case.
+   * It also accepts numeric offsets that would result in a different string on
+   * output. For example, "Error-8" would marshal as "INFO".
+   */
+  unmarshalText(data: string|Array<number>): void
+ }
+ interface Level {
+  /**
+   * Level returns the receiver.
+   * It implements [Leveler].
+   */
+  level(): Level
+ }
+ // @ts-ignore
+ import loginternal = internal
+}
+
+namespace cobra {
+ interface PositionalArgs {(cmd: Command, args: Array<string>): void }
+ // @ts-ignore
+ import flag = pflag
+ /**
+  * FParseErrWhitelist configures Flag parse errors to be ignored
+  */
+ interface FParseErrWhitelist extends _TygojaAny{}
+ /**
+  * Group Structure to manage groups for commands
+  */
+ interface Group {
+  id: string
+  title: string
+ }
+ /**
+  * CompletionOptions are the options to control shell completion
+  */
+ interface CompletionOptions {
+  /**
+   * DisableDefaultCmd prevents Cobra from creating a default 'completion' command
+   */
+  disableDefaultCmd: boolean
+  /**
+   * DisableNoDescFlag prevents Cobra from creating the '--no-descriptions' flag
+   * for shells that support completion descriptions
+   */
+  disableNoDescFlag: boolean
+  /**
+   * DisableDescriptions turns off all completion descriptions for shells
+   * that support them
+   */
+  disableDescriptions: boolean
+  /**
+   * HiddenDefaultCmd makes the default 'completion' command hidden
+   */
+  hiddenDefaultCmd: boolean
+ }
+ /**
+  * Completion is a string that can be used for completions
+  * 
+  * two formats are supported:
+  * ```
+  *   - the completion choice
+  *   - the completion choice with a textual description (separated by a TAB).
+  * ```
+  * 
+  * [CompletionWithDesc] can be used to create a completion string with a textual description.
+  * 
+  * Note: Go type alias is used to provide a more descriptive name in the documentation, but any string can be used.
+  */
+ interface Completion extends String{}
+ /**
+  * CompletionFunc is a function that provides completion results.
+  */
+ interface CompletionFunc {(cmd: Command, args: Array<string>, toComplete: string): [Array<Completion>, ShellCompDirective] }
+}
+
+namespace multipart {
+ /**
+  * A Part represents a single part in a multipart body.
+  */
+ interface Part {
+  /**
+   * The headers of the body, if any, with the keys canonicalized
+   * in the same fashion that the Go http.Request headers are.
+   * For example, "foo-bar" changes case to "Foo-Bar"
+   */
+  header: textproto.MIMEHeader
+ }
+ interface Part {
+  /**
+   * FormName returns the name parameter if p has a Content-Disposition
+   * of type "form-data".  Otherwise it returns the empty string.
+   */
+  formName(): string
+ }
+ interface Part {
+  /**
+   * FileName returns the filename parameter of the [Part]'s Content-Disposition
+   * header. If not empty, the filename is passed through filepath.Base (which is
+   * platform dependent) before being returned.
+   */
+  fileName(): string
+ }
+ interface Part {
+  /**
+   * Read reads the body of a part, after its headers and before the
+   * next part (if any) begins.
+   */
+  read(d: string|Array<number>): number
+ }
+ interface Part {
+  close(): void
+ }
+}
+
+namespace url {
+ /**
+  * The Userinfo type is an immutable encapsulation of username and
+  * password details for a [URL]. An existing Userinfo value is guaranteed
+  * to have a username set (potentially empty, as allowed by RFC 2396),
+  * and optionally a password.
+  */
+ interface Userinfo {
+ }
+ interface Userinfo {
+  /**
+   * Username returns the username.
+   */
+  username(): string
+ }
+ interface Userinfo {
+  /**
+   * Password returns the password in case it is set, and whether it is set.
+   */
+  password(): [string, boolean]
+ }
+ interface Userinfo {
+  /**
+   * String returns the encoded userinfo information in the standard form
+   * of "username[:password]".
+   */
+  string(): string
+ }
+}
+
+namespace http {
+ /**
+  * SameSite allows a server to define a cookie attribute making it impossible for
+  * the browser to send this cookie along with cross-site requests. The main
+  * goal is to mitigate the risk of cross-origin information leakage, and provide
+  * some protection against cross-site request forgery attacks.
+  * 
+  * See https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00 for details.
+  */
+ interface SameSite extends Number{}
+ // @ts-ignore
+ import mathrand = rand
+ // @ts-ignore
+ import urlpkg = url
+}
+
+namespace oauth2 {
+}
+
+namespace slog {
+ // @ts-ignore
+ import loginternal = internal
+ /**
+  * A Record holds information about a log event.
+  * Copies of a Record share state.
+  * Do not modify a Record after handing out a copy to it.
+  * Call [NewRecord] to create a new Record.
+  * Use [Record.Clone] to create a copy with no shared state.
+  */
+ interface Record {
+  /**
+   * The time at which the output method (Log, Info, etc.) was called.
+   */
+  time: time.Time
+  /**
+   * The log message.
+   */
+  message: string
+  /**
+   * The level of the event.
+   */
+  level: Level
+  /**
+   * The program counter at the time the record was constructed, as determined
+   * by runtime.Callers. If zero, no program counter is available.
+   * 
+   * The only valid use for this value is as an argument to
+   * [runtime.CallersFrames]. In particular, it must not be passed to
+   * [runtime.FuncForPC].
+   */
+  pc: number
+ }
+ interface Record {
+  /**
+   * Clone returns a copy of the record with no shared state.
+   * The original record and the clone can both be modified
+   * without interfering with each other.
+   */
+  clone(): Record
+ }
+ interface Record {
+  /**
+   * NumAttrs returns the number of attributes in the [Record].
+   */
+  numAttrs(): number
+ }
+ interface Record {
+  /**
+   * Attrs calls f on each Attr in the [Record].
+   * Iteration stops if f returns false.
+   */
+  attrs(f: (_arg0: Attr) => boolean): void
+ }
+ interface Record {
+  /**
+   * AddAttrs appends the given Attrs to the [Record]'s list of Attrs.
+   * It omits empty groups.
+   */
+  addAttrs(...attrs: Attr[]): void
+ }
+ interface Record {
+  /**
+   * Add converts the args to Attrs as described in [Logger.Log],
+   * then appends the Attrs to the [Record]'s list of Attrs.
+   * It omits empty groups.
+   */
+  add(...args: any[]): void
+ }
+ /**
+  * A Value can represent any Go value, but unlike type any,
+  * it can represent most small values without an allocation.
+  * The zero Value corresponds to nil.
+  */
+ interface Value {
+ }
+ interface Value {
+  /**
+   * Kind returns v's Kind.
+   */
+  kind(): Kind
+ }
+ interface Value {
+  /**
+   * Any returns v's value as an any.
+   */
+  any(): any
+ }
+ interface Value {
+  /**
+   * String returns Value's value as a string, formatted like [fmt.Sprint]. Unlike
+   * the methods Int64, Float64, and so on, which panic if v is of the
+   * wrong kind, String never panics.
+   */
+  string(): string
+ }
+ interface Value {
+  /**
+   * Int64 returns v's value as an int64. It panics
+   * if v is not a signed integer.
+   */
+  int64(): number
+ }
+ interface Value {
+  /**
+   * Uint64 returns v's value as a uint64. It panics
+   * if v is not an unsigned integer.
+   */
+  uint64(): number
+ }
+ interface Value {
+  /**
+   * Bool returns v's value as a bool. It panics
+   * if v is not a bool.
+   */
+  bool(): boolean
+ }
+ interface Value {
+  /**
+   * Duration returns v's value as a [time.Duration]. It panics
+   * if v is not a time.Duration.
+   */
+  duration(): time.Duration
+ }
+ interface Value {
+  /**
+   * Float64 returns v's value as a float64. It panics
+   * if v is not a float64.
+   */
+  float64(): number
+ }
+ interface Value {
+  /**
+   * Time returns v's value as a [time.Time]. It panics
+   * if v is not a time.Time.
+   */
+  time(): time.Time
+ }
+ interface Value {
+  /**
+   * LogValuer returns v's value as a LogValuer. It panics
+   * if v is not a LogValuer.
+   */
+  logValuer(): LogValuer
+ }
+ interface Value {
+  /**
+   * Group returns v's value as a []Attr.
+   * It panics if v's [Kind] is not [KindGroup].
+   */
+  group(): Array<Attr>
+ }
+ interface Value {
+  /**
+   * Equal reports whether v and w represent the same Go value.
+   */
+  equal(w: Value): boolean
+ }
+ interface Value {
+  /**
+   * Resolve repeatedly calls LogValue on v while it implements [LogValuer],
+   * and returns the result.
+   * If v resolves to a group, the group's attributes' values are not recursively
+   * resolved.
+   * If the number of LogValue calls exceeds a threshold, a Value containing an
+   * error is returned.
+   * Resolve's return value is guaranteed not to be of Kind [KindLogValuer].
+   */
+  resolve(): Value
+ }
+}
+
+namespace cobra {
+ // @ts-ignore
+ import flag = pflag
+ /**
+  * ShellCompDirective is a bit map representing the different behaviors the shell
+  * can be instructed to have once completions have been provided.
+  */
+ interface ShellCompDirective extends Number{}
+}
+
+namespace slog {
+ // @ts-ignore
+ import loginternal = internal
+ /**
+  * Kind is the kind of a [Value].
+  */
+ interface Kind extends Number{}
+ interface Kind {
+  string(): string
+ }
+ /**
+  * A LogValuer is any Go value that can convert itself into a Value for logging.
+  * 
+  * This mechanism may be used to defer expensive operations until they are
+  * needed, or to expand a single value into a sequence of components.
+  */
+ interface LogValuer {
+  [key:string]: any;
+  logValue(): Value
+ }
+}
diff --git a/server/core_backend-server/plugins/ghupdate/ghupdate.go b/server/core_backend-server/plugins/ghupdate/ghupdate.go
new file mode 100644
index 0000000..0ffabe6
--- /dev/null
+++ b/server/core_backend-server/plugins/ghupdate/ghupdate.go
@@ -0,0 +1,417 @@
+// Package ghupdate implements a new command to selfupdate the current
+// PocketBase executable with the latest GitHub release.
+//
+// Example usage:
+//
+//	ghupdate.MustRegister(app, app.RootCmd, ghupdate.Config{})
+package ghupdate
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/archive"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"github.com/spf13/cobra"
+)
+
+// HttpClient is a base HTTP client interface (usually used for test purposes).
+type HttpClient interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// Config defines the config options of the ghupdate plugin.
+//
+// NB! This plugin is considered experimental and its config options may change in the future.
+type Config struct {
+	// Owner specifies the account owner of the repository (default to "pocketbase").
+	Owner string
+
+	// Repo specifies the name of the repository (default to "pocketbase").
+	Repo string
+
+	// ArchiveExecutable specifies the name of the executable file in the release archive
+	// (default to "pocketbase"; an additional ".exe" check is also performed as a fallback).
+	ArchiveExecutable string
+
+	// Optional context to use when fetching and downloading the latest release.
+	Context context.Context
+
+	// The HTTP client to use when fetching and downloading the latest release.
+	// Defaults to `http.DefaultClient`.
+	HttpClient HttpClient
+}
+
+// MustRegister registers the ghupdate plugin to the provided app instance
+// and panic if it fails.
+func MustRegister(app core.App, rootCmd *cobra.Command, config Config) {
+	if err := Register(app, rootCmd, config); err != nil {
+		panic(err)
+	}
+}
+
+// Register registers the ghupdate plugin to the provided app instance.
+func Register(app core.App, rootCmd *cobra.Command, config Config) error {
+	p := &plugin{
+		app:            app,
+		currentVersion: rootCmd.Version,
+		config:         config,
+	}
+
+	if p.config.Owner == "" {
+		p.config.Owner = "pocketbase"
+	}
+
+	if p.config.Repo == "" {
+		p.config.Repo = "pocketbase"
+	}
+
+	if p.config.ArchiveExecutable == "" {
+		p.config.ArchiveExecutable = "pocketbase"
+	}
+
+	if p.config.HttpClient == nil {
+		p.config.HttpClient = http.DefaultClient
+	}
+
+	if p.config.Context == nil {
+		p.config.Context = context.Background()
+	}
+
+	rootCmd.AddCommand(p.updateCmd())
+
+	return nil
+}
+
+type plugin struct {
+	app            core.App
+	config         Config
+	currentVersion string
+}
+
+func (p *plugin) updateCmd() *cobra.Command {
+	var withBackup bool
+
+	command := &cobra.Command{
+		Use:          "update",
+		Short:        "Automatically updates the current app executable with the latest available version",
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			var needConfirm bool
+			if isMaybeRunningInDocker() {
+				needConfirm = true
+				color.Yellow("NB! It seems that you are in a Docker container.")
+				color.Yellow("The update command may not work as expected in this context because usually the version of the app is managed by the container image itself.")
+			} else if isMaybeRunningInNixOS() {
+				needConfirm = true
+				color.Yellow("NB! It seems that you are in a NixOS.")
+				color.Yellow("Due to the non-standard filesystem implementation of the environment, the update command may not work as expected.")
+			}
+
+			if needConfirm {
+				confirm := osutils.YesNoPrompt("Do you want to proceed with the update?", false)
+				if !confirm {
+					fmt.Println("The command has been cancelled.")
+					return nil
+				}
+			}
+
+			return p.update(withBackup)
+		},
+	}
+
+	command.PersistentFlags().BoolVar(
+		&withBackup,
+		"backup",
+		true,
+		"Creates a pb_data backup at the end of the update process",
+	)
+
+	return command
+}
+
+func (p *plugin) update(withBackup bool) error {
+	color.Yellow("Fetching release information...")
+
+	latest, err := fetchLatestRelease(
+		p.config.Context,
+		p.config.HttpClient,
+		p.config.Owner,
+		p.config.Repo,
+	)
+	if err != nil {
+		return err
+	}
+
+	if compareVersions(strings.TrimPrefix(p.currentVersion, "v"), strings.TrimPrefix(latest.Tag, "v")) <= 0 {
+		color.Green("You already have the latest version %s.", p.currentVersion)
+		return nil
+	}
+
+	suffix := archiveSuffix(runtime.GOOS, runtime.GOARCH)
+	if suffix == "" {
+		return errors.New("unsupported platform")
+	}
+
+	asset, err := latest.findAssetBySuffix(suffix)
+	if err != nil {
+		return err
+	}
+
+	releaseDir := filepath.Join(p.app.DataDir(), core.LocalTempDirName)
+	defer os.RemoveAll(releaseDir)
+
+	color.Yellow("Downloading %s...", asset.Name)
+
+	// download the release asset
+	assetZip := filepath.Join(releaseDir, asset.Name)
+	if err := downloadFile(p.config.Context, p.config.HttpClient, asset.DownloadUrl, assetZip); err != nil {
+		return err
+	}
+
+	color.Yellow("Extracting %s...", asset.Name)
+
+	extractDir := filepath.Join(releaseDir, "extracted_"+asset.Name)
+	defer os.RemoveAll(extractDir)
+
+	if err := archive.Extract(assetZip, extractDir); err != nil {
+		return err
+	}
+
+	color.Yellow("Replacing the executable...")
+
+	oldExec, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	renamedOldExec := oldExec + ".old"
+	defer os.Remove(renamedOldExec)
+
+	newExec := filepath.Join(extractDir, p.config.ArchiveExecutable)
+	if _, err := os.Stat(newExec); err != nil {
+		// try again with an .exe extension
+		newExec = newExec + ".exe"
+		if _, fallbackErr := os.Stat(newExec); fallbackErr != nil {
+			return fmt.Errorf("the executable in the extracted path is missing or it is inaccessible: %v, %v", err, fallbackErr)
+		}
+	}
+
+	// rename the current executable
+	if err := os.Rename(oldExec, renamedOldExec); err != nil {
+		return fmt.Errorf("failed to rename the current executable: %w", err)
+	}
+
+	tryToRevertExecChanges := func() {
+		if revertErr := os.Rename(renamedOldExec, oldExec); revertErr != nil {
+			p.app.Logger().Debug(
+				"Failed to revert executable",
+				slog.String("old", renamedOldExec),
+				slog.String("new", oldExec),
+				slog.String("error", revertErr.Error()),
+			)
+		}
+	}
+
+	// replace with the extracted binary
+	if err := os.Rename(newExec, oldExec); err != nil {
+		tryToRevertExecChanges()
+		return fmt.Errorf("failed replacing the executable: %w", err)
+	}
+
+	if withBackup {
+		color.Yellow("Creating pb_data backup...")
+
+		backupName := fmt.Sprintf("@update_%s.zip", latest.Tag)
+		if err := p.app.CreateBackup(p.config.Context, backupName); err != nil {
+			tryToRevertExecChanges()
+			return err
+		}
+	}
+
+	color.HiBlack("---")
+	color.Green("Update completed successfully! You can start the executable as usual.")
+
+	// print the release notes
+	if latest.Body != "" {
+		fmt.Print("\n")
+		color.Cyan("Here is a list with some of the %s changes:", latest.Tag)
+		// remove the update command note to avoid "stuttering"
+		// (@todo consider moving to a config option)
+		releaseNotes := strings.TrimSpace(strings.Replace(latest.Body, "> _To update the prebuilt executable you can run `./"+p.config.ArchiveExecutable+" update`._", "", 1))
+		color.Cyan(releaseNotes)
+		fmt.Print("\n")
+	}
+
+	return nil
+}
+
+func fetchLatestRelease(
+	ctx context.Context,
+	client HttpClient,
+	owner string,
+	repo string,
+) (*release, error) {
+	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", owner, repo)
+
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	rawBody, err := io.ReadAll(res.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	// http.Client doesn't treat non 2xx responses as error
+	if res.StatusCode >= 400 {
+		return nil, fmt.Errorf(
+			"(%d) failed to fetch latest releases:\n%s",
+			res.StatusCode,
+			string(rawBody),
+		)
+	}
+
+	result := &release{}
+	if err := json.Unmarshal(rawBody, result); err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+func downloadFile(
+	ctx context.Context,
+	client HttpClient,
+	url string,
+	destPath string,
+) error {
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return err
+	}
+
+	res, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+
+	// http.Client doesn't treat non 2xx responses as error
+	if res.StatusCode >= 400 {
+		return fmt.Errorf("(%d) failed to send download file request", res.StatusCode)
+	}
+
+	// ensure that the dest parent dir(s) exist
+	if err := os.MkdirAll(filepath.Dir(destPath), os.ModePerm); err != nil {
+		return err
+	}
+
+	dest, err := os.Create(destPath)
+	if err != nil {
+		return err
+	}
+	defer dest.Close()
+
+	if _, err := io.Copy(dest, res.Body); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func archiveSuffix(goos, goarch string) string {
+	switch goos {
+	case "linux":
+		switch goarch {
+		case "amd64":
+			return "_linux_amd64.zip"
+		case "arm64":
+			return "_linux_arm64.zip"
+		case "arm":
+			return "_linux_armv7.zip"
+		}
+	case "darwin":
+		switch goarch {
+		case "amd64":
+			return "_darwin_amd64.zip"
+		case "arm64":
+			return "_darwin_arm64.zip"
+		}
+	case "windows":
+		switch goarch {
+		case "amd64":
+			return "_windows_amd64.zip"
+		case "arm64":
+			return "_windows_arm64.zip"
+		}
+	}
+
+	return ""
+}
+
+func compareVersions(a, b string) int {
+	aSplit := strings.Split(a, ".")
+	aTotal := len(aSplit)
+
+	bSplit := strings.Split(b, ".")
+	bTotal := len(bSplit)
+
+	limit := aTotal
+	if bTotal > aTotal {
+		limit = bTotal
+	}
+
+	for i := 0; i < limit; i++ {
+		var x, y int
+
+		if i < aTotal {
+			x, _ = strconv.Atoi(aSplit[i])
+		}
+
+		if i < bTotal {
+			y, _ = strconv.Atoi(bSplit[i])
+		}
+
+		if x < y {
+			return 1 // b is newer
+		}
+
+		if x > y {
+			return -1 // a is newer
+		}
+	}
+
+	return 0 // equal
+}
+
+// note: not completely reliable as it may not work on all platforms
+// but should at least provide a warning for the most common use cases
+func isMaybeRunningInDocker() bool {
+	_, err := os.Stat("/.dockerenv")
+	return err == nil
+}
+
+// note: untested
+func isMaybeRunningInNixOS() bool {
+	_, err := os.Stat("/etc/NIXOS")
+	return err == nil
+}
diff --git a/server/core_backend-server/plugins/ghupdate/ghupdate_test.go b/server/core_backend-server/plugins/ghupdate/ghupdate_test.go
new file mode 100644
index 0000000..e692cc8
--- /dev/null
+++ b/server/core_backend-server/plugins/ghupdate/ghupdate_test.go
@@ -0,0 +1,38 @@
+package ghupdate
+
+import "testing"
+
+func TestCompareVersions(t *testing.T) {
+	scenarios := []struct {
+		a        string
+		b        string
+		expected int
+	}{
+		{"", "", 0},
+		{"0", "", 0},
+		{"1", "1.0.0", 0},
+		{"1.1", "1.1.0", 0},
+		{"1.1", "1.1.1", 1},
+		{"1.1", "1.0.1", -1},
+		{"1.0", "1.0.1", 1},
+		{"1.10", "1.9", -1},
+		{"1.2", "1.12", 1},
+		{"3.2", "1.6", -1},
+		{"0.0.2", "0.0.1", -1},
+		{"0.16.2", "0.17.0", 1},
+		{"1.15.0", "0.16.1", -1},
+		{"1.2.9", "1.2.10", 1},
+		{"3.2", "4.0", 1},
+		{"3.2.4", "3.2.3", -1},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.a+"VS"+s.b, func(t *testing.T) {
+			result := compareVersions(s.a, s.b)
+
+			if result != s.expected {
+				t.Fatalf("Expected %q vs %q to result in %d, got %d", s.a, s.b, s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/plugins/ghupdate/release.go b/server/core_backend-server/plugins/ghupdate/release.go
new file mode 100644
index 0000000..2cd84fc
--- /dev/null
+++ b/server/core_backend-server/plugins/ghupdate/release.go
@@ -0,0 +1,36 @@
+package ghupdate
+
+import (
+	"errors"
+	"strings"
+)
+
+type releaseAsset struct {
+	Name        string `json:"name"`
+	DownloadUrl string `json:"browser_download_url"`
+	Id          int    `json:"id"`
+	Size        int    `json:"size"`
+}
+
+type release struct {
+	Name      string          `json:"name"`
+	Tag       string          `json:"tag_name"`
+	Published string          `json:"published_at"`
+	Url       string          `json:"html_url"`
+	Body      string          `json:"body"`
+	Assets    []*releaseAsset `json:"assets"`
+	Id        int             `json:"id"`
+}
+
+// findAssetBySuffix returns the first available asset containing the specified suffix.
+func (r *release) findAssetBySuffix(suffix string) (*releaseAsset, error) {
+	if suffix != "" {
+		for _, asset := range r.Assets {
+			if strings.HasSuffix(asset.Name, suffix) {
+				return asset, nil
+			}
+		}
+	}
+
+	return nil, errors.New("missing asset containing " + suffix)
+}
diff --git a/server/core_backend-server/plugins/ghupdate/release_test.go b/server/core_backend-server/plugins/ghupdate/release_test.go
new file mode 100644
index 0000000..8fa6fa1
--- /dev/null
+++ b/server/core_backend-server/plugins/ghupdate/release_test.go
@@ -0,0 +1,23 @@
+package ghupdate
+
+import "testing"
+
+func TestReleaseFindAssetBySuffix(t *testing.T) {
+	r := release{
+		Assets: []*releaseAsset{
+			{Name: "test1.zip", Id: 1},
+			{Name: "test2.zip", Id: 2},
+			{Name: "test22.zip", Id: 22},
+			{Name: "test3.zip", Id: 3},
+		},
+	}
+
+	asset, err := r.findAssetBySuffix("2.zip")
+	if err != nil {
+		t.Fatalf("Expected nil, got err: %v", err)
+	}
+
+	if asset.Id != 2 {
+		t.Fatalf("Expected asset with id %d, got %v", 2, asset)
+	}
+}
diff --git a/server/core_backend-server/plugins/jsvm/binds.go b/server/core_backend-server/plugins/jsvm/binds.go
new file mode 100644
index 0000000..3744b76
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/binds.go
@@ -0,0 +1,1221 @@
+package jsvm
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/dop251/goja"
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/forms"
+	"github.com/pocketbase/pocketbase/mails"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+	"github.com/spf13/cobra"
+)
+
+// hooksBinds adds wrapped "on*" hook methods by reflecting on core.App.
+func hooksBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
+	fm := FieldMapper{}
+
+	appType := reflect.TypeOf(app)
+	appValue := reflect.ValueOf(app)
+	totalMethods := appType.NumMethod()
+	excludeHooks := []string{"OnServe"}
+
+	for i := 0; i < totalMethods; i++ {
+		method := appType.Method(i)
+		if !strings.HasPrefix(method.Name, "On") || slices.Contains(excludeHooks, method.Name) {
+			continue // not a hook or excluded
+		}
+
+		jsName := fm.MethodName(appType, method)
+
+		// register the hook to the loader
+		loader.Set(jsName, func(callback string, tags ...string) {
+			// overwrite the global $app with the hook scoped instance
+			callback = `function(e) { $app = e.app; return (` + callback + `).call(undefined, e) }`
+			pr := goja.MustCompile(defaultScriptPath, "{("+callback+").apply(undefined, __args)}", true)
+
+			tagsAsValues := make([]reflect.Value, len(tags))
+			for i, tag := range tags {
+				tagsAsValues[i] = reflect.ValueOf(tag)
+			}
+
+			hookInstance := appValue.MethodByName(method.Name).Call(tagsAsValues)[0]
+			hookBindFunc := hookInstance.MethodByName("BindFunc")
+
+			handlerType := hookBindFunc.Type().In(0)
+
+			handler := reflect.MakeFunc(handlerType, func(args []reflect.Value) (results []reflect.Value) {
+				handlerArgs := make([]any, len(args))
+				for i, arg := range args {
+					handlerArgs[i] = arg.Interface()
+				}
+
+				err := executors.run(func(executor *goja.Runtime) error {
+					executor.Set("$app", goja.Undefined())
+					executor.Set("__args", handlerArgs)
+					res, err := executor.RunProgram(pr)
+					executor.Set("__args", goja.Undefined())
+
+					// check for returned Go error value
+					if resErr := checkGojaValueForError(app, res); resErr != nil {
+						return resErr
+					}
+
+					return normalizeException(err)
+				})
+
+				return []reflect.Value{reflect.ValueOf(&err).Elem()}
+			})
+
+			// register the wrapped hook handler
+			hookBindFunc.Call([]reflect.Value{handler})
+		})
+	}
+}
+
+func cronBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
+	cronAdd := func(jobId, cronExpr, handler string) {
+		pr := goja.MustCompile(defaultScriptPath, "{("+handler+").apply(undefined)}", true)
+
+		err := app.Cron().Add(jobId, cronExpr, func() {
+			err := executors.run(func(executor *goja.Runtime) error {
+				_, err := executor.RunProgram(pr)
+				return err
+			})
+
+			if err != nil {
+				app.Logger().Error(
+					"[cronAdd] failed to execute cron job",
+					slog.String("jobId", jobId),
+					slog.String("error", err.Error()),
+				)
+			}
+		})
+		if err != nil {
+			panic("[cronAdd] failed to register cron job " + jobId + ": " + err.Error())
+		}
+	}
+	loader.Set("cronAdd", cronAdd)
+
+	cronRemove := func(jobId string) {
+		app.Cron().Remove(jobId)
+	}
+	loader.Set("cronRemove", cronRemove)
+
+	// register the removal helper also in the executors to allow removing cron jobs from everywhere
+	oldFactory := executors.factory
+	executors.factory = func() *goja.Runtime {
+		vm := oldFactory()
+
+		vm.Set("cronAdd", cronAdd)
+		vm.Set("cronRemove", cronRemove)
+
+		return vm
+	}
+	for _, item := range executors.items {
+		item.vm.Set("cronAdd", cronAdd)
+		item.vm.Set("cronRemove", cronRemove)
+	}
+}
+
+func routerBinds(app core.App, loader *goja.Runtime, executors *vmsPool) {
+	loader.Set("routerAdd", func(method string, path string, handler goja.Value, middlewares ...goja.Value) {
+		wrappedMiddlewares, err := wrapMiddlewares(executors, middlewares...)
+		if err != nil {
+			panic("[routerAdd] failed to wrap middlewares: " + err.Error())
+		}
+
+		wrappedHandler, err := wrapHandlerFunc(executors, handler)
+		if err != nil {
+			panic("[routerAdd] failed to wrap handler: " + err.Error())
+		}
+
+		app.OnServe().BindFunc(func(e *core.ServeEvent) error {
+			e.Router.Route(strings.ToUpper(method), path, wrappedHandler).Bind(wrappedMiddlewares...)
+
+			return e.Next()
+		})
+	})
+
+	loader.Set("routerUse", func(middlewares ...goja.Value) {
+		wrappedMiddlewares, err := wrapMiddlewares(executors, middlewares...)
+		if err != nil {
+			panic("[routerUse] failed to wrap middlewares: " + err.Error())
+		}
+
+		app.OnServe().BindFunc(func(e *core.ServeEvent) error {
+			e.Router.Bind(wrappedMiddlewares...)
+			return e.Next()
+		})
+	})
+}
+
+func wrapHandlerFunc(executors *vmsPool, handler goja.Value) (func(*core.RequestEvent) error, error) {
+	if handler == nil {
+		return nil, errors.New("handler must be non-nil")
+	}
+
+	switch h := handler.Export().(type) {
+	case func(*core.RequestEvent) error:
+		// "native" handler func - no need to wrap
+		return h, nil
+	case func(goja.FunctionCall) goja.Value, string:
+		pr := goja.MustCompile(defaultScriptPath, "{("+handler.String()+").apply(undefined, __args)}", true)
+
+		wrappedHandler := func(e *core.RequestEvent) error {
+			return executors.run(func(executor *goja.Runtime) error {
+				executor.Set("$app", e.App) // overwrite the global $app with the hook scoped instance
+				executor.Set("__args", []any{e})
+				res, err := executor.RunProgram(pr)
+				executor.Set("__args", goja.Undefined())
+
+				// check for returned Go error value
+				if resErr := checkGojaValueForError(e.App, res); resErr != nil {
+					return resErr
+				}
+
+				return normalizeException(err)
+			})
+		}
+
+		return wrappedHandler, nil
+	default:
+		return nil, errors.New("unsupported goja handler type")
+	}
+}
+
+type gojaHookHandler struct {
+	id             string
+	serializedFunc string
+	priority       int
+}
+
+func wrapMiddlewares(executors *vmsPool, rawMiddlewares ...goja.Value) ([]*hook.Handler[*core.RequestEvent], error) {
+	wrappedMiddlewares := make([]*hook.Handler[*core.RequestEvent], len(rawMiddlewares))
+
+	for i, m := range rawMiddlewares {
+		if m == nil {
+			return nil, errors.New("middleware must be non-nil")
+		}
+
+		switch v := m.Export().(type) {
+		case *hook.Handler[*core.RequestEvent]:
+			// "native" middleware handler - no need to wrap
+			wrappedMiddlewares[i] = v
+		case func(*core.RequestEvent) error:
+			// "native" middleware func - wrap as handler
+			wrappedMiddlewares[i] = &hook.Handler[*core.RequestEvent]{
+				Func: v,
+			}
+		case *gojaHookHandler:
+			if v.serializedFunc == "" {
+				return nil, errors.New("missing or invalid Middleware function")
+			}
+
+			pr := goja.MustCompile(defaultScriptPath, "{("+v.serializedFunc+").apply(undefined, __args)}", true)
+
+			wrappedMiddlewares[i] = &hook.Handler[*core.RequestEvent]{
+				Id:       v.id,
+				Priority: v.priority,
+				Func: func(e *core.RequestEvent) error {
+					return executors.run(func(executor *goja.Runtime) error {
+						executor.Set("$app", e.App) // overwrite the global $app with the hook scoped instance
+						executor.Set("__args", []any{e})
+						res, err := executor.RunProgram(pr)
+						executor.Set("__args", goja.Undefined())
+
+						// check for returned Go error value
+						if resErr := checkGojaValueForError(e.App, res); resErr != nil {
+							return resErr
+						}
+
+						return normalizeException(err)
+					})
+				},
+			}
+		case func(goja.FunctionCall) goja.Value, string:
+			pr := goja.MustCompile(defaultScriptPath, "{("+m.String()+").apply(undefined, __args)}", true)
+
+			wrappedMiddlewares[i] = &hook.Handler[*core.RequestEvent]{
+				Func: func(e *core.RequestEvent) error {
+					return executors.run(func(executor *goja.Runtime) error {
+						executor.Set("$app", e.App) // overwrite the global $app with the hook scoped instance
+						executor.Set("__args", []any{e})
+						res, err := executor.RunProgram(pr)
+						executor.Set("__args", goja.Undefined())
+
+						// check for returned Go error value
+						if resErr := checkGojaValueForError(e.App, res); resErr != nil {
+							return resErr
+						}
+
+						return normalizeException(err)
+					})
+				},
+			}
+		default:
+			return nil, errors.New("unsupported goja middleware type")
+		}
+	}
+
+	return wrappedMiddlewares, nil
+}
+
+var cachedArrayOfTypes = store.New[reflect.Type, reflect.Type](nil)
+
+func baseBinds(vm *goja.Runtime) {
+	vm.SetFieldNameMapper(FieldMapper{})
+
+	// deprecated: use toString
+	vm.Set("readerToString", func(r io.Reader, maxBytes int) (string, error) {
+		if maxBytes == 0 {
+			maxBytes = router.DefaultMaxMemory
+		}
+
+		limitReader := io.LimitReader(r, int64(maxBytes))
+
+		bodyBytes, readErr := io.ReadAll(limitReader)
+		if readErr != nil {
+			return "", readErr
+		}
+
+		return string(bodyBytes), nil
+	})
+
+	// note: throw only on reader error
+	vm.Set("toBytes", func(raw any, maxReaderBytes int) ([]byte, error) {
+		switch v := raw.(type) {
+		case nil:
+			return []byte{}, nil
+		case string:
+			return []byte(v), nil
+		case []byte:
+			return v, nil
+		case types.JSONRaw:
+			return v, nil
+		case io.Reader:
+			if maxReaderBytes == 0 {
+				maxReaderBytes = router.DefaultMaxMemory
+			}
+
+			limitReader := io.LimitReader(v, int64(maxReaderBytes))
+
+			return io.ReadAll(limitReader)
+		default:
+			b, err := cast.ToUint8SliceE(v)
+			if err == nil {
+				return b, nil
+			}
+
+			str, err := cast.ToStringE(v)
+			if err == nil {
+				return []byte(str), nil
+			}
+
+			// as a last attempt try to json encode the value
+			rawBytes, _ := json.Marshal(raw)
+
+			return rawBytes, nil
+		}
+	})
+
+	// note: throw only on reader error
+	vm.Set("toString", func(raw any, maxReaderBytes int) (string, error) {
+		switch v := raw.(type) {
+		case io.Reader:
+			if maxReaderBytes == 0 {
+				maxReaderBytes = router.DefaultMaxMemory
+			}
+
+			limitReader := io.LimitReader(v, int64(maxReaderBytes))
+
+			bodyBytes, readErr := io.ReadAll(limitReader)
+			if readErr != nil {
+				return "", readErr
+			}
+
+			return string(bodyBytes), nil
+		default:
+			str, err := cast.ToStringE(v)
+			if err == nil {
+				return str, nil
+			}
+
+			// as a last attempt try to json encode the value
+			rawBytes, _ := json.Marshal(raw)
+
+			return string(rawBytes), nil
+		}
+	})
+
+	vm.Set("sleep", func(milliseconds int64) {
+		time.Sleep(time.Duration(milliseconds) * time.Millisecond)
+	})
+
+	vm.Set("arrayOf", func(model any) any {
+		mt := reflect.TypeOf(model)
+		st := cachedArrayOfTypes.GetOrSet(mt, func() reflect.Type {
+			return reflect.SliceOf(mt)
+		})
+
+		return reflect.New(st).Elem().Addr().Interface()
+	})
+
+	vm.Set("unmarshal", func(data, dst any) error {
+		raw, err := json.Marshal(data)
+		if err != nil {
+			return err
+		}
+
+		return json.Unmarshal(raw, &dst)
+	})
+
+	vm.Set("Context", func(call goja.ConstructorCall) *goja.Object {
+		var instance context.Context
+
+		oldCtx, ok := call.Argument(0).Export().(context.Context)
+		if ok {
+			instance = oldCtx
+		} else {
+			instance = context.Background()
+		}
+
+		key := call.Argument(1).Export()
+		if key != nil {
+			instance = context.WithValue(instance, key, call.Argument(2).Export())
+		}
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
+	vm.Set("DynamicModel", func(call goja.ConstructorCall) *goja.Object {
+		shape, ok := call.Argument(0).Export().(map[string]any)
+		if !ok || len(shape) == 0 {
+			panic("[DynamicModel] missing shape data")
+		}
+
+		instance := newDynamicModel(shape)
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
+	// nullable helpers usually used as DynamicModel shape values
+	vm.Set("nullString", func() *string {
+		var v string
+		return &v
+	})
+	vm.Set("nullFloat", func() *float64 {
+		var v float64
+		return &v
+	})
+	vm.Set("nullInt", func() *int64 {
+		var v int64
+		return &v
+	})
+	vm.Set("nullBool", func() *bool {
+		var v bool
+		return &v
+	})
+	vm.Set("nullArray", func() *types.JSONArray[any] {
+		var v types.JSONArray[any]
+		return &v
+	})
+	vm.Set("nullObject", func() *types.JSONMap[any] {
+		var v types.JSONMap[any]
+		return &v
+	})
+
+	vm.Set("Record", func(call goja.ConstructorCall) *goja.Object {
+		var instance *core.Record
+
+		collection, ok := call.Argument(0).Export().(*core.Collection)
+		if ok {
+			instance = core.NewRecord(collection)
+			data, ok := call.Argument(1).Export().(map[string]any)
+			if ok {
+				instance.Load(data)
+			}
+		} else {
+			instance = &core.Record{}
+		}
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
+	vm.Set("Collection", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.Collection{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+
+	vm.Set("FieldsList", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.FieldsList{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+
+	// fields
+	// ---
+	vm.Set("Field", func(call goja.ConstructorCall) *goja.Object {
+		data, _ := call.Argument(0).Export().(map[string]any)
+		rawDataSlice, _ := json.Marshal([]any{data})
+
+		fieldsList := core.NewFieldsList()
+		_ = fieldsList.UnmarshalJSON(rawDataSlice)
+
+		if len(fieldsList) == 0 {
+			return nil
+		}
+
+		field := fieldsList[0]
+
+		fieldValue := vm.ToValue(field).(*goja.Object)
+		fieldValue.SetPrototype(call.This.Prototype())
+
+		return fieldValue
+	})
+	vm.Set("NumberField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.NumberField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("BoolField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.BoolField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("TextField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.TextField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("URLField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.URLField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("EmailField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.EmailField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("EditorField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.EditorField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("PasswordField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.PasswordField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("DateField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.DateField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("AutodateField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.AutodateField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("JSONField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.JSONField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("RelationField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.RelationField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("SelectField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.SelectField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("FileField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.FileField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	vm.Set("GeoPointField", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.GeoPointField{}
+		return structConstructorUnmarshal(vm, call, instance)
+	})
+	// ---
+
+	vm.Set("MailerMessage", func(call goja.ConstructorCall) *goja.Object {
+		instance := &mailer.Message{}
+		return structConstructor(vm, call, instance)
+	})
+
+	vm.Set("Command", func(call goja.ConstructorCall) *goja.Object {
+		instance := &cobra.Command{}
+		return structConstructor(vm, call, instance)
+	})
+
+	vm.Set("RequestInfo", func(call goja.ConstructorCall) *goja.Object {
+		instance := &core.RequestInfo{Context: core.RequestInfoContextDefault}
+		return structConstructor(vm, call, instance)
+	})
+
+	// ```js
+	// new Middleware((e) => {
+	//    return e.next()
+	// }, 100, "example_middleware")
+	// ```
+	vm.Set("Middleware", func(call goja.ConstructorCall) *goja.Object {
+		instance := &gojaHookHandler{}
+
+		instance.serializedFunc = call.Argument(0).String()
+		instance.priority = cast.ToInt(call.Argument(1).Export())
+		instance.id = cast.ToString(call.Argument(2).Export())
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
+	// note: named Timezone to avoid conflicts with the JS Location interface.
+	vm.Set("Timezone", func(call goja.ConstructorCall) *goja.Object {
+		name, _ := call.Argument(0).Export().(string)
+
+		instance, err := time.LoadLocation(name)
+		if err != nil {
+			instance = time.UTC
+		}
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
+	vm.Set("DateTime", func(call goja.ConstructorCall) *goja.Object {
+		instance := types.NowDateTime()
+
+		rawDate, _ := call.Argument(0).Export().(string)
+		locName, _ := call.Argument(1).Export().(string)
+		if rawDate != "" && locName != "" {
+			loc, err := time.LoadLocation(locName)
+			if err != nil {
+				loc = time.UTC
+			}
+
+			instance, _ = types.ParseDateTime(cast.ToTimeInDefaultLocation(rawDate, loc))
+		} else if rawDate != "" {
+			// forward directly to ParseDateTime to preserve the original behavior
+			instance, _ = types.ParseDateTime(rawDate)
+		}
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return structConstructor(vm, call, instance)
+	})
+
+	vm.Set("ValidationError", func(call goja.ConstructorCall) *goja.Object {
+		code, _ := call.Argument(0).Export().(string)
+		message, _ := call.Argument(1).Export().(string)
+
+		instance := validation.NewError(code, message)
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
+	vm.Set("Cookie", func(call goja.ConstructorCall) *goja.Object {
+		instance := &http.Cookie{}
+		return structConstructor(vm, call, instance)
+	})
+
+	vm.Set("SubscriptionMessage", func(call goja.ConstructorCall) *goja.Object {
+		instance := &subscriptions.Message{}
+		return structConstructor(vm, call, instance)
+	})
+}
+
+func dbxBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$dbx", obj)
+
+	obj.Set("exp", dbx.NewExp)
+	obj.Set("hashExp", func(data map[string]any) dbx.HashExp {
+		return dbx.HashExp(data)
+	})
+	obj.Set("not", dbx.Not)
+	obj.Set("and", dbx.And)
+	obj.Set("or", dbx.Or)
+	obj.Set("in", dbx.In)
+	obj.Set("notIn", dbx.NotIn)
+	obj.Set("like", dbx.Like)
+	obj.Set("orLike", dbx.OrLike)
+	obj.Set("notLike", dbx.NotLike)
+	obj.Set("orNotLike", dbx.OrNotLike)
+	obj.Set("exists", dbx.Exists)
+	obj.Set("notExists", dbx.NotExists)
+	obj.Set("between", dbx.Between)
+	obj.Set("notBetween", dbx.NotBetween)
+}
+
+func mailsBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$mails", obj)
+
+	obj.Set("sendRecordPasswordReset", mails.SendRecordPasswordReset)
+	obj.Set("sendRecordVerification", mails.SendRecordVerification)
+	obj.Set("sendRecordChangeEmail", mails.SendRecordChangeEmail)
+	obj.Set("sendRecordOTP", mails.SendRecordOTP)
+	obj.Set("sendRecordAuthAlert", mails.SendRecordAuthAlert)
+}
+
+func securityBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$security", obj)
+
+	// crypto
+	obj.Set("md5", security.MD5)
+	obj.Set("sha256", security.SHA256)
+	obj.Set("sha512", security.SHA512)
+	obj.Set("hs256", security.HS256)
+	obj.Set("hs512", security.HS512)
+	obj.Set("equal", security.Equal)
+
+	// random
+	obj.Set("randomString", security.RandomString)
+	obj.Set("randomStringByRegex", security.RandomStringByRegex)
+	obj.Set("randomStringWithAlphabet", security.RandomStringWithAlphabet)
+	obj.Set("pseudorandomString", security.PseudorandomString)
+	obj.Set("pseudorandomStringWithAlphabet", security.PseudorandomStringWithAlphabet)
+
+	// jwt
+	obj.Set("parseUnverifiedJWT", func(token string) (map[string]any, error) {
+		return security.ParseUnverifiedJWT(token)
+	})
+	obj.Set("parseJWT", func(token string, verificationKey string) (map[string]any, error) {
+		return security.ParseJWT(token, verificationKey)
+	})
+	obj.Set("createJWT", func(payload jwt.MapClaims, signingKey string, secDuration int) (string, error) {
+		return security.NewJWT(payload, signingKey, time.Duration(secDuration)*time.Second)
+	})
+
+	// encryption
+	obj.Set("encrypt", security.Encrypt)
+	obj.Set("decrypt", func(cipherText, key string) (string, error) {
+		result, err := security.Decrypt(cipherText, key)
+
+		if err != nil {
+			return "", err
+		}
+
+		return string(result), err
+	})
+}
+
+func filesystemBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$filesystem", obj)
+
+	obj.Set("fileFromPath", filesystem.NewFileFromPath)
+	obj.Set("fileFromBytes", filesystem.NewFileFromBytes)
+	obj.Set("fileFromMultipart", filesystem.NewFileFromMultipart)
+	obj.Set("fileFromURL", func(url string, secTimeout int) (*filesystem.File, error) {
+		if secTimeout == 0 {
+			secTimeout = 120
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(secTimeout)*time.Second)
+		defer cancel()
+
+		return filesystem.NewFileFromURL(ctx, url)
+	})
+}
+
+func filepathBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$filepath", obj)
+
+	obj.Set("base", filepath.Base)
+	obj.Set("clean", filepath.Clean)
+	obj.Set("dir", filepath.Dir)
+	obj.Set("ext", filepath.Ext)
+	obj.Set("fromSlash", filepath.FromSlash)
+	obj.Set("glob", filepath.Glob)
+	obj.Set("isAbs", filepath.IsAbs)
+	obj.Set("join", filepath.Join)
+	obj.Set("match", filepath.Match)
+	obj.Set("rel", filepath.Rel)
+	obj.Set("split", filepath.Split)
+	obj.Set("splitList", filepath.SplitList)
+	obj.Set("toSlash", filepath.ToSlash)
+	obj.Set("walk", filepath.Walk)
+	obj.Set("walkDir", filepath.WalkDir)
+}
+
+func osBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$os", obj)
+
+	obj.Set("args", os.Args)
+	obj.Set("exec", exec.Command) // @deprecated
+	obj.Set("cmd", exec.Command)
+	obj.Set("exit", os.Exit)
+	obj.Set("getenv", os.Getenv)
+	obj.Set("dirFS", os.DirFS)
+	obj.Set("stat", os.Stat)
+	obj.Set("readFile", os.ReadFile)
+	obj.Set("writeFile", os.WriteFile)
+	obj.Set("readDir", os.ReadDir)
+	obj.Set("tempDir", os.TempDir)
+	obj.Set("truncate", os.Truncate)
+	obj.Set("getwd", os.Getwd)
+	obj.Set("mkdir", os.Mkdir)
+	obj.Set("mkdirAll", os.MkdirAll)
+	obj.Set("rename", os.Rename)
+	obj.Set("remove", os.Remove)
+	obj.Set("removeAll", os.RemoveAll)
+	obj.Set("openRoot", os.OpenRoot)
+	obj.Set("openInRoot", os.OpenInRoot)
+}
+
+func formsBinds(vm *goja.Runtime) {
+	registerFactoryAsConstructor(vm, "AppleClientSecretCreateForm", forms.NewAppleClientSecretCreate)
+	registerFactoryAsConstructor(vm, "RecordUpsertForm", forms.NewRecordUpsert)
+	registerFactoryAsConstructor(vm, "TestEmailSendForm", forms.NewTestEmailSend)
+	registerFactoryAsConstructor(vm, "TestS3FilesystemForm", forms.NewTestS3Filesystem)
+}
+
+func apisBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$apis", obj)
+
+	obj.Set("static", func(dir string, indexFallback bool) func(*core.RequestEvent) error {
+		return apis.Static(os.DirFS(dir), indexFallback)
+	})
+
+	// middlewares
+	obj.Set("requireGuestOnly", apis.RequireGuestOnly)
+	obj.Set("requireAuth", apis.RequireAuth)
+	obj.Set("requireSuperuserAuth", apis.RequireSuperuserAuth)
+	obj.Set("requireSuperuserOrOwnerAuth", apis.RequireSuperuserOrOwnerAuth)
+	obj.Set("skipSuccessActivityLog", apis.SkipSuccessActivityLog)
+	obj.Set("gzip", apis.Gzip)
+	obj.Set("bodyLimit", apis.BodyLimit)
+
+	// record helpers
+	obj.Set("recordAuthResponse", apis.RecordAuthResponse)
+	obj.Set("enrichRecord", apis.EnrichRecord)
+	obj.Set("enrichRecords", apis.EnrichRecords)
+
+	// api errors
+	registerFactoryAsConstructor(vm, "ApiError", router.NewApiError)
+	registerFactoryAsConstructor(vm, "NotFoundError", router.NewNotFoundError)
+	registerFactoryAsConstructor(vm, "BadRequestError", router.NewBadRequestError)
+	registerFactoryAsConstructor(vm, "ForbiddenError", router.NewForbiddenError)
+	registerFactoryAsConstructor(vm, "UnauthorizedError", router.NewUnauthorizedError)
+	registerFactoryAsConstructor(vm, "TooManyRequestsError", router.NewTooManyRequestsError)
+	registerFactoryAsConstructor(vm, "InternalServerError", router.NewInternalServerError)
+}
+
+func httpClientBinds(vm *goja.Runtime) {
+	obj := vm.NewObject()
+	vm.Set("$http", obj)
+
+	vm.Set("FormData", func(call goja.ConstructorCall) *goja.Object {
+		instance := FormData{}
+
+		instanceValue := vm.ToValue(instance).(*goja.Object)
+		instanceValue.SetPrototype(call.This.Prototype())
+
+		return instanceValue
+	})
+
+	type sendResult struct {
+		JSON    any                     `json:"json"`
+		Headers map[string][]string     `json:"headers"`
+		Cookies map[string]*http.Cookie `json:"cookies"`
+
+		// Deprecated: consider using Body instead
+		Raw string `json:"raw"`
+
+		Body       []byte `json:"body"`
+		StatusCode int    `json:"statusCode"`
+	}
+
+	type sendConfig struct {
+		// Deprecated: consider using Body instead
+		Data map[string]any
+
+		Body    any // raw string or FormData
+		Headers map[string]string
+		Method  string
+		Url     string
+		Timeout int // seconds (default to 120)
+	}
+
+	obj.Set("send", func(params map[string]any) (*sendResult, error) {
+		config := sendConfig{
+			Method: "GET",
+		}
+
+		if v, ok := params["data"]; ok {
+			config.Data = cast.ToStringMap(v)
+		}
+
+		if v, ok := params["body"]; ok {
+			config.Body = v
+		}
+
+		if v, ok := params["headers"]; ok {
+			config.Headers = cast.ToStringMapString(v)
+		}
+
+		if v, ok := params["method"]; ok {
+			config.Method = cast.ToString(v)
+		}
+
+		if v, ok := params["url"]; ok {
+			config.Url = cast.ToString(v)
+		}
+
+		if v, ok := params["timeout"]; ok {
+			config.Timeout = cast.ToInt(v)
+		}
+
+		if config.Timeout <= 0 {
+			config.Timeout = 120
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(config.Timeout)*time.Second)
+		defer cancel()
+
+		var reqBody io.Reader
+		var contentType string
+
+		// legacy json body data
+		if len(config.Data) != 0 {
+			encoded, err := json.Marshal(config.Data)
+			if err != nil {
+				return nil, err
+			}
+			reqBody = bytes.NewReader(encoded)
+		} else {
+			switch v := config.Body.(type) {
+			case io.Reader:
+				reqBody = v
+			case FormData:
+				body, mp, err := v.toMultipart()
+				if err != nil {
+					return nil, err
+				}
+
+				reqBody = body
+				contentType = mp.FormDataContentType()
+			default:
+				reqBody = strings.NewReader(cast.ToString(config.Body))
+			}
+		}
+
+		req, err := http.NewRequestWithContext(ctx, strings.ToUpper(config.Method), config.Url, reqBody)
+		if err != nil {
+			return nil, err
+		}
+
+		for k, v := range config.Headers {
+			req.Header.Add(k, v)
+		}
+
+		// set the explicit content type
+		// (overwriting the user provided header value if any)
+		if contentType != "" {
+			req.Header.Set("content-type", contentType)
+		}
+
+		res, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return nil, err
+		}
+		defer res.Body.Close()
+
+		bodyRaw, _ := io.ReadAll(res.Body)
+
+		result := &sendResult{
+			StatusCode: res.StatusCode,
+			Headers:    map[string][]string{},
+			Cookies:    map[string]*http.Cookie{},
+			Raw:        string(bodyRaw),
+			Body:       bodyRaw,
+		}
+
+		for k, v := range res.Header {
+			result.Headers[k] = v
+		}
+
+		for _, v := range res.Cookies() {
+			result.Cookies[v.Name] = v
+		}
+
+		if len(result.Body) > 0 {
+			// try as map
+			result.JSON = map[string]any{}
+			if err := json.Unmarshal(bodyRaw, &result.JSON); err != nil {
+				// try as slice
+				result.JSON = []any{}
+				if err := json.Unmarshal(bodyRaw, &result.JSON); err != nil {
+					result.JSON = nil
+				}
+			}
+		}
+
+		return result, nil
+	})
+}
+
+// -------------------------------------------------------------------
+
+// checkGojaValueForError resolves the provided goja.Value and tries
+// to extract its underlying error value (if any).
+func checkGojaValueForError(app core.App, value goja.Value) error {
+	if value == nil {
+		return nil
+	}
+
+	exported := value.Export()
+	switch v := exported.(type) {
+	case error:
+		return v
+	case *goja.Promise:
+		// Promise as return result is not officially supported but try to
+		// resolve any thrown exception to avoid silently ignoring it
+		app.Logger().Warn("the handler must a non-async function and not return a Promise")
+		if promiseErr, ok := v.Result().Export().(error); ok {
+			return normalizeException(promiseErr)
+		}
+	}
+
+	return nil
+}
+
+// normalizeException checks if the provided error is a goja.Exception
+// and attempts to return its underlying Go error.
+//
+// note: using just goja.Exception.Unwrap() is insufficient and may falsely result in nil.
+func normalizeException(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	jsException, ok := err.(*goja.Exception)
+	if !ok {
+		return err // no exception
+	}
+
+	switch v := jsException.Value().Export().(type) {
+	case error:
+		err = v
+	case map[string]any: // goja.GoError
+		if vErr, ok := v["value"].(error); ok {
+			err = vErr
+		}
+	}
+
+	return err
+}
+
+var cachedFactoryFuncTypes = store.New[string, reflect.Type](nil)
+
+// registerFactoryAsConstructor registers the factory function as native JS constructor.
+//
+// If there is missing or nil arguments, their type zero value is used.
+func registerFactoryAsConstructor(vm *goja.Runtime, constructorName string, factoryFunc any) {
+	rv := reflect.ValueOf(factoryFunc)
+	rt := cachedFactoryFuncTypes.GetOrSet(constructorName, func() reflect.Type {
+		return reflect.TypeOf(factoryFunc)
+	})
+	totalArgs := rt.NumIn()
+
+	vm.Set(constructorName, func(call goja.ConstructorCall) *goja.Object {
+		args := make([]reflect.Value, totalArgs)
+
+		for i := 0; i < totalArgs; i++ {
+			v := call.Argument(i).Export()
+
+			// use the arg type zero value
+			if v == nil {
+				args[i] = reflect.New(rt.In(i)).Elem()
+			} else if number, ok := v.(int64); ok {
+				// goja uses int64 for "int"-like numbers but we rarely do that and use int most of the times
+				// (at later stage we can use reflection on the arguments to validate the types in case this is not sufficient anymore)
+				args[i] = reflect.ValueOf(int(number))
+			} else {
+				args[i] = reflect.ValueOf(v)
+			}
+		}
+
+		result := rv.Call(args)
+
+		if len(result) != 1 {
+			panic("the factory function should return only 1 item")
+		}
+
+		value := vm.ToValue(result[0].Interface()).(*goja.Object)
+		value.SetPrototype(call.This.Prototype())
+
+		return value
+	})
+}
+
+// structConstructor wraps the provided struct with a native JS constructor.
+//
+// If the constructor argument is a map, each entry of the map will be loaded into the wrapped goja.Object.
+func structConstructor(vm *goja.Runtime, call goja.ConstructorCall, instance any) *goja.Object {
+	data, _ := call.Argument(0).Export().(map[string]any)
+
+	instanceValue := vm.ToValue(instance).(*goja.Object)
+	for k, v := range data {
+		instanceValue.Set(k, v)
+	}
+
+	instanceValue.SetPrototype(call.This.Prototype())
+
+	return instanceValue
+}
+
+// structConstructorUnmarshal wraps the provided struct with a native JS constructor.
+//
+// The constructor first argument will be loaded via json.Unmarshal into the instance.
+func structConstructorUnmarshal(vm *goja.Runtime, call goja.ConstructorCall, instance any) *goja.Object {
+	if data := call.Argument(0).Export(); data != nil {
+		if raw, err := json.Marshal(data); err == nil {
+			_ = json.Unmarshal(raw, instance)
+		}
+	}
+
+	instanceValue := vm.ToValue(instance).(*goja.Object)
+	instanceValue.SetPrototype(call.This.Prototype())
+
+	return instanceValue
+}
+
+var cachedDynamicModelStructs = store.New[string, reflect.Type](nil)
+
+// newDynamicModel creates a new dynamic struct with fields based
+// on the specified "shape".
+//
+// The "shape" values are used as defaults and could be of type:
+//
+//   - int64      (ex.: 0)
+//   - *int64     (ex.: nullInt())
+//   - float64    (ex.: -0)
+//   - *float64   (ex.: nullFloat())
+//   - string     (ex.: "")
+//   - *string    (ex.: nullString())
+//   - bool       (ex.: false)
+//   - *bool      (ex.: nullBool())
+//   - slice/arr  (ex.: [])
+//   - *slice/arr (ex.: nullArray())
+//   - map        (ex.: {})
+//   - *map       (ex.: nullObject())
+//
+// Example:
+//
+//	m := newDynamicModel(map[string]any{
+//		"title": "",
+//		"total": 0,
+//	})
+func newDynamicModel(shape map[string]any) any {
+	info := make([]*shapeFieldInfo, 0, len(shape))
+
+	var hash strings.Builder
+
+	sortedKeys := make([]string, 0, len(shape))
+	for k := range shape {
+		sortedKeys = append(sortedKeys, k)
+	}
+	sort.Strings(sortedKeys)
+
+	for _, k := range sortedKeys {
+		v := shape[k]
+		vt := reflect.TypeOf(v)
+
+		switch vt.Kind() {
+		case reflect.Map:
+			raw, _ := json.Marshal(v)
+			newV := types.JSONMap[any]{}
+			newV.Scan(raw)
+			v = newV
+			vt = reflect.TypeOf(v)
+		case reflect.Slice, reflect.Array:
+			raw, _ := json.Marshal(v)
+			newV := types.JSONArray[any]{}
+			newV.Scan(raw)
+			v = newV
+			vt = reflect.TypeOf(newV)
+		case reflect.Pointer:
+			// for pointers always fallback to nil as their default value
+			v = nil
+		}
+
+		hash.WriteString(k)
+		hash.WriteString(":")
+		hash.WriteString(vt.String()) // it doesn't guarantee to be unique across all types but it should be fine with the primitive types DynamicModel is used
+		hash.WriteString("|")
+
+		info = append(info, &shapeFieldInfo{key: k, value: v, valueType: vt})
+	}
+
+	st := cachedDynamicModelStructs.GetOrSet(hash.String(), func() reflect.Type {
+		structFields := make([]reflect.StructField, len(info))
+
+		for i, item := range info {
+			structFields[i] = reflect.StructField{
+				Name: inflector.UcFirst(item.key), // ensures that the field is exportable
+				Type: item.valueType,
+				Tag:  reflect.StructTag(`db:"` + item.key + `" json:"` + item.key + `" form:"` + item.key + `"`),
+			}
+		}
+
+		return reflect.StructOf(structFields)
+	})
+
+	elem := reflect.New(st).Elem()
+
+	// load default values into the new model
+	for i, item := range info {
+		if item.value == nil {
+			continue
+		}
+		elem.Field(i).Set(reflect.ValueOf(item.value))
+	}
+
+	return elem.Addr().Interface()
+}
+
+type shapeFieldInfo struct {
+	value     any
+	valueType reflect.Type
+	key       string
+}
diff --git a/server/core_backend-server/plugins/jsvm/binds_test.go b/server/core_backend-server/plugins/jsvm/binds_test.go
new file mode 100644
index 0000000..0718346
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/binds_test.go
@@ -0,0 +1,1876 @@
+package jsvm
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/dop251/goja"
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/mailer"
+	"github.com/pocketbase/pocketbase/tools/router"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+)
+
+func testBindsCount(vm *goja.Runtime, namespace string, count int, t *testing.T) {
+	v, err := vm.RunString(`Object.keys(` + namespace + `).length`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	total, _ := v.Export().(int64)
+
+	if int(total) != count {
+		t.Fatalf("Expected %d %s binds, got %d", count, namespace, total)
+	}
+}
+
+// note: this test is useful as a reminder to update the tests in case
+// a new base binding is added.
+func TestBaseBindsCount(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	testBindsCount(vm, "this", 41, t)
+}
+
+func TestBaseBindsSleep(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("reader", strings.NewReader("test"))
+
+	start := time.Now()
+	_, err := vm.RunString(`
+		sleep(100);
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	lasted := time.Since(start).Milliseconds()
+	if lasted < 100 || lasted > 150 {
+		t.Fatalf("Expected to sleep for ~100ms, got %d", lasted)
+	}
+}
+
+func TestBaseBindsReaderToString(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("reader", strings.NewReader("test"))
+
+	_, err := vm.RunString(`
+		let result = readerToString(reader)
+
+		if (result != "test") {
+			throw new Error('Expected "test", got ' + result);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsToString(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("scenarios", []struct {
+		Name     string
+		Value    any
+		Expected string
+	}{
+		{"null", nil, ""},
+		{"string", "test", "test"},
+		{"number", -12.4, "-12.4"},
+		{"bool", true, "true"},
+		{"arr", []int{1, 2, 3}, `[1,2,3]`},
+		{"obj", map[string]any{"test": 123}, `{"test":123}`},
+		{"reader", strings.NewReader("test"), "test"},
+		{"struct", struct {
+			Name    string
+			private string
+		}{Name: "123", private: "456"}, `{"Name":"123"}`},
+	})
+
+	_, err := vm.RunString(`
+		for (let s of scenarios) {
+			let str = toString(s.value)
+			if (str != s.expected) {
+				throw new Error('[' + s.name + '] Expected string ' + s.expected + ', got ' + str);
+			}
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsToBytes(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("bytesEqual", bytes.Equal)
+	vm.Set("scenarios", []struct {
+		Name     string
+		Value    any
+		Expected []byte
+	}{
+		{"null", nil, []byte{}},
+		{"string", "test", []byte("test")},
+		{"number", -12.4, []byte("-12.4")},
+		{"bool", true, []byte("true")},
+		{"arr", []int{1, 2, 3}, []byte{1, 2, 3}},
+		{"jsonraw", types.JSONRaw{1, 2, 3}, []byte{1, 2, 3}},
+		{"reader", strings.NewReader("test"), []byte("test")},
+		{"obj", map[string]any{"test": 123}, []byte(`{"test":123}`)},
+		{"struct", struct {
+			Name    string
+			private string
+		}{Name: "123", private: "456"}, []byte(`{"Name":"123"}`)},
+	})
+
+	_, err := vm.RunString(`
+		for (let s of scenarios) {
+			let b = toBytes(s.value)
+			if (!Array.isArray(b)) {
+				throw new Error('[' + s.name + '] Expected toBytes to return an array');
+			}
+
+			if (!bytesEqual(b, s.expected)) {
+				throw new Error('[' + s.name + '] Expected bytes ' + s.expected + ', got ' + b);
+			}
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsUnmarshal(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("data", &map[string]any{"a": 123})
+
+	_, err := vm.RunString(`
+		unmarshal({"b": 456}, data)
+
+		if (data.a != 123) {
+			throw new Error('Expected data.a 123, got ' + data.a);
+		}
+
+		if (data.b != 456) {
+			throw new Error('Expected data.b 456, got ' + data.b);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsContext(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		const base = new Context(null, "a", 123);
+		const sub = new Context(base, "b", 456);
+
+		const scenarios = [
+			{key: "a", expected: 123},
+			{key: "b", expected: 456},
+		];
+
+		for (let s of scenarios) {
+			if (sub.value(s.key) != s.expected) {
+				throw new("Expected " +s.key + " value " + s.expected + ", got " + sub.value(s.key));
+			}
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsCookie(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		const cookie = new Cookie({
+			name:     "example_name",
+			value:    "example_value",
+			path:     "/example_path",
+			domain:   "example.com",
+			maxAge:   10,
+			secure:   true,
+			httpOnly: true,
+			sameSite: 3,
+		});
+
+		const result = cookie.string();
+
+		const expected = "example_name=example_value; Path=/example_path; Domain=example.com; Max-Age=10; HttpOnly; Secure; SameSite=Strict";
+
+		if (expected != result) {
+			throw new("Expected \n" + expected + "\ngot\n" + result);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsSubscriptionMessage(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("bytesToString", func(b []byte) string {
+		return string(b)
+	})
+
+	_, err := vm.RunString(`
+		const payload = {
+			name: "test",
+			data: '{"test":123}'
+		}
+
+		const result = new SubscriptionMessage(payload);
+
+		if (result.name != payload.name) {
+			throw new("Expected name " + payload.name + ", got " + result.name);
+		}
+
+		if (bytesToString(result.data) != payload.data) {
+			throw new("Expected data '" + payload.data + "', got '" + bytesToString(result.data) + "'");
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsRecord(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection, err := app.FindCachedCollectionByNameOrId("users")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	vm := goja.New()
+	baseBinds(vm)
+	vm.Set("collection", collection)
+
+	// without record data
+	// ---
+	v1, err := vm.RunString(`new Record(collection)`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m1, ok := v1.Export().(*core.Record)
+	if !ok {
+		t.Fatalf("Expected m1 to be models.Record, got \n%v", m1)
+	}
+
+	// with record data
+	// ---
+	v2, err := vm.RunString(`new Record(collection, { email: "test@example.com" })`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m2, ok := v2.Export().(*core.Record)
+	if !ok {
+		t.Fatalf("Expected m2 to be core.Record, got \n%v", m2)
+	}
+
+	if m2.Collection().Name != "users" {
+		t.Fatalf("Expected record with collection %q, got \n%v", "users", m2.Collection())
+	}
+
+	if m2.Email() != "test@example.com" {
+		t.Fatalf("Expected record with email field set to %q, got \n%v", "test@example.com", m2)
+	}
+}
+
+func TestBaseBindsCollection(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	v, err := vm.RunString(`new Collection({ name: "test", createRule: "@request.auth.id != ''", fields: [{name: "title", "type": "text"}] })`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m, ok := v.Export().(*core.Collection)
+	if !ok {
+		t.Fatalf("Expected core.Collection, got %v", m)
+	}
+
+	if m.Name != "test" {
+		t.Fatalf("Expected collection with name %q, got %q", "test", m.Name)
+	}
+
+	expectedRule := "@request.auth.id != ''"
+	if m.CreateRule == nil || *m.CreateRule != expectedRule {
+		t.Fatalf("Expected create rule %q, got %v", "@request.auth.id != ''", m.CreateRule)
+	}
+
+	if f := m.Fields.GetByName("title"); f == nil {
+		t.Fatalf("Expected fields to be set, got %v", m.Fields)
+	}
+}
+
+func TestBaseBindsFieldsList(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	v, err := vm.RunString(`new FieldsList([{name: "title", "type": "text"}])`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m, ok := v.Export().(*core.FieldsList)
+	if !ok {
+		t.Fatalf("Expected core.FieldsList, got %v", m)
+	}
+
+	if f := m.GetByName("title"); f == nil {
+		t.Fatalf("Expected fields list to be loaded, got %v", m)
+	}
+}
+
+func TestBaseBindsField(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	v, err := vm.RunString(`new Field({name: "test", "type": "bool"})`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f, ok := v.Export().(*core.BoolField)
+	if !ok {
+		t.Fatalf("Expected *core.BoolField, got %v", f)
+	}
+
+	if f.Name != "test" {
+		t.Fatalf("Expected field %q, got %v", "test", f)
+	}
+}
+
+func isType[T any](v any) bool {
+	_, ok := v.(T)
+	return ok
+}
+
+func TestBaseBindsNamedFields(t *testing.T) {
+	t.Parallel()
+
+	vm := goja.New()
+	baseBinds(vm)
+
+	scenarios := []struct {
+		js       string
+		typeFunc func(v any) bool
+	}{
+		{
+			"new NumberField({name: 'test'})",
+			isType[*core.NumberField],
+		},
+		{
+			"new BoolField({name: 'test'})",
+			isType[*core.BoolField],
+		},
+		{
+			"new TextField({name: 'test'})",
+			isType[*core.TextField],
+		},
+		{
+			"new URLField({name: 'test'})",
+			isType[*core.URLField],
+		},
+		{
+			"new EmailField({name: 'test'})",
+			isType[*core.EmailField],
+		},
+		{
+			"new EditorField({name: 'test'})",
+			isType[*core.EditorField],
+		},
+		{
+			"new PasswordField({name: 'test'})",
+			isType[*core.PasswordField],
+		},
+		{
+			"new DateField({name: 'test'})",
+			isType[*core.DateField],
+		},
+		{
+			"new AutodateField({name: 'test'})",
+			isType[*core.AutodateField],
+		},
+		{
+			"new JSONField({name: 'test'})",
+			isType[*core.JSONField],
+		},
+		{
+			"new RelationField({name: 'test'})",
+			isType[*core.RelationField],
+		},
+		{
+			"new SelectField({name: 'test'})",
+			isType[*core.SelectField],
+		},
+		{
+			"new FileField({name: 'test'})",
+			isType[*core.FileField],
+		},
+		{
+			"new GeoPointField({name: 'test'})",
+			isType[*core.GeoPointField],
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.js, func(t *testing.T) {
+			v, err := vm.RunString(s.js)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			f, ok := v.Export().(core.Field)
+			if !ok {
+				t.Fatalf("Expected core.Field instance, got %T (%v)", f, f)
+			}
+
+			if !s.typeFunc(f) {
+				t.Fatalf("Unexpected field type %T (%v)", f, f)
+			}
+
+			if f.GetName() != "test" {
+				t.Fatalf("Expected field %q, got %v", "test", f)
+			}
+		})
+	}
+}
+
+func TestBaseBindsMailerMessage(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	v, err := vm.RunString(`new MailerMessage({
+		from: {name: "test_from", address: "test_from@example.com"},
+		to: [
+			{name: "test_to1", address: "test_to1@example.com"},
+			{name: "test_to2", address: "test_to2@example.com"},
+		],
+		bcc: [
+			{name: "test_bcc1", address: "test_bcc1@example.com"},
+			{name: "test_bcc2", address: "test_bcc2@example.com"},
+		],
+		cc: [
+			{name: "test_cc1", address: "test_cc1@example.com"},
+			{name: "test_cc2", address: "test_cc2@example.com"},
+		],
+		subject: "test_subject",
+		html: "test_html",
+		text: "test_text",
+		headers: {
+			header1: "a",
+			header2: "b",
+		}
+	})`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m, ok := v.Export().(*mailer.Message)
+	if !ok {
+		t.Fatalf("Expected mailer.Message, got %v", m)
+	}
+
+	raw, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `{"from":{"Name":"test_from","Address":"test_from@example.com"},"to":[{"Name":"test_to1","Address":"test_to1@example.com"},{"Name":"test_to2","Address":"test_to2@example.com"}],"bcc":[{"Name":"test_bcc1","Address":"test_bcc1@example.com"},{"Name":"test_bcc2","Address":"test_bcc2@example.com"}],"cc":[{"Name":"test_cc1","Address":"test_cc1@example.com"},{"Name":"test_cc2","Address":"test_cc2@example.com"}],"subject":"test_subject","html":"test_html","text":"test_text","headers":{"header1":"a","header2":"b"},"attachments":null,"inlineAttachments":null}`
+
+	if string(raw) != expected {
+		t.Fatalf("Expected \n%s, \ngot \n%s", expected, raw)
+	}
+}
+
+func TestBaseBindsCommand(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		let runCalls = 0;
+
+		let cmd = new Command({
+			use: "test",
+			run: (c, args) => {
+				runCalls++;
+			}
+		});
+
+		cmd.run(null, []);
+
+		if (cmd.use != "test") {
+			throw new Error('Expected cmd.use "test", got: ' + cmd.use);
+		}
+
+		if (runCalls != 1) {
+			throw new Error('Expected runCalls 1, got: ' + runCalls);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsRequestInfo(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		const info = new RequestInfo({
+			body: {"name": "test2"}
+		});
+
+		if (info.body?.name != "test2") {
+			throw new Error('Expected info.body.name to be test2, got: ' + info.body?.name);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsMiddleware(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		const m = new Middleware(
+			(e) => {},
+			10,
+			"test"
+		);
+
+		if (!m) {
+			throw new Error('Expected non-empty Middleware instance');
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsTimezone(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		const v0 = (new Timezone()).string();
+		if (v0 != "UTC") {
+			throw new Error("(v0) Expected UTC got " + v0)
+		}
+
+		const v1 = (new Timezone("invalid")).string();
+		if (v1 != "UTC") {
+			throw new Error("(v1) Expected UTC got " + v1)
+		}
+
+		const v2 = (new Timezone("EET")).string();
+		if (v2 != "EET") {
+			throw new Error("(v2) Expected EET got " + v2)
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsDateTime(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	_, err := vm.RunString(`
+		const now = new DateTime();
+		if (now.isZero()) {
+			throw new Error('(now) Expected to fallback to now, got zero value');
+		}
+
+		const nowPart = now.string().substring(0, 19)
+
+		const scenarios = [
+			// empty datetime string and no custom location
+			{date: new DateTime(''), expected: nowPart},
+			// empty datetime string and custom default location (should be ignored)
+			{date: new DateTime('', 'Asia/Tokyo'), expected: nowPart},
+			// full datetime string and no custom default location
+			{date: new DateTime('2023-01-01 00:00:00.000Z'), expected: "2023-01-01 00:00:00.000Z"},
+			// invalid location (fallback to UTC)
+			{date: new DateTime('2025-10-26 03:00:00', 'invalid'), expected: "2025-10-26 03:00:00.000Z"},
+			// CET
+			{date: new DateTime('2025-10-26 03:00:00', 'Europe/Amsterdam'), expected: "2025-10-26 02:00:00.000Z"},
+			// CEST
+			{date: new DateTime('2025-10-26 01:00:00', 'Europe/Amsterdam'), expected: "2025-10-25 23:00:00.000Z"},
+			// with timezone/offset in the date string (aka. should ignore the custom default location)
+			{date: new DateTime('2025-10-26 01:00:00 +0200', 'Asia/Tokyo'), expected: "2025-10-25 23:00:00.000Z"},
+		];
+
+		for (let i = 0; i < scenarios.length; i++) {
+			const s = scenarios[i];
+			if (!s.date.string().includes(s.expected)) {
+				throw new Error('(' + i + ') ' + s.date.string() + ' does not contain expected ' + s.expected);
+			}
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestBaseBindsValidationError(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+
+	scenarios := []struct {
+		js            string
+		expectCode    string
+		expectMessage string
+	}{
+		{
+			`new ValidationError()`,
+			"",
+			"",
+		},
+		{
+			`new ValidationError("test_code")`,
+			"test_code",
+			"",
+		},
+		{
+			`new ValidationError("test_code", "test_message")`,
+			"test_code",
+			"test_message",
+		},
+	}
+
+	for _, s := range scenarios {
+		v, err := vm.RunString(s.js)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		m, ok := v.Export().(validation.Error)
+		if !ok {
+			t.Fatalf("[%s] Expected validation.Error, got %v", s.js, m)
+		}
+
+		if m.Code() != s.expectCode {
+			t.Fatalf("[%s] Expected code %q, got %q", s.js, s.expectCode, m.Code())
+		}
+
+		if m.Message() != s.expectMessage {
+			t.Fatalf("[%s] Expected message %q, got %q", s.js, s.expectMessage, m.Message())
+		}
+	}
+}
+
+func TestDbxBinds(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	vm.Set("db", app.DB())
+	baseBinds(vm)
+	dbxBinds(vm)
+
+	testBindsCount(vm, "$dbx", 15, t)
+
+	sceneraios := []struct {
+		js       string
+		expected string
+	}{
+		{
+			`$dbx.exp("a = 1").build(db, {})`,
+			"a = 1",
+		},
+		{
+			`$dbx.hashExp({
+				"a": 1,
+				b: null,
+				c: [1, 2, 3],
+			}).build(db, {})`,
+			/* SQLite:
+			"`a`={:p0} AND `b` IS NULL AND `c` IN ({:p1}, {:p2}, {:p3})",
+			*/
+			// PostgreSQL:
+			`"a"={:p0} AND "b" IS NULL AND "c" IN ({:p1}, {:p2}, {:p3})`,
+		},
+		{
+			`$dbx.not($dbx.exp("a = 1")).build(db, {})`,
+			`NOT (a = 1)`,
+		},
+		{
+			`$dbx.and($dbx.exp("a = 1"), $dbx.exp("b = 2")).build(db, {})`,
+			/* SQLite:
+			"(a = 1) AND (b = 2)",
+			*/
+			// PostgreSQL:
+			`(a = 1) AND (b = 2)`,
+		},
+		{
+			`$dbx.or($dbx.exp("a = 1"), $dbx.exp("b = 2")).build(db, {})`,
+			"(a = 1) OR (b = 2)",
+		},
+		{
+			`$dbx.in("a", 1, 2, 3).build(db, {})`,
+			/* SQLite:
+			"`a` IN ({:p0}, {:p1}, {:p2})",
+			*/
+			// PostgreSQL:
+			`"a" IN ({:p0}, {:p1}, {:p2})`,
+		},
+		{
+			`$dbx.notIn("a", 1, 2, 3).build(db, {})`,
+			/* SQLite:
+			"`a` NOT IN ({:p0}, {:p1}, {:p2})",
+			*/
+			// PostgreSQL:
+			`"a" NOT IN ({:p0}, {:p1}, {:p2})`,
+		},
+		{
+			`$dbx.like("a", "test1", "test2").match(true, false).build(db, {})`,
+			/* SQLite:
+			"`a` LIKE {:p0} AND `a` LIKE {:p1}",
+			*/
+			// PostgreSQL:
+			`"a" LIKE {:p0} AND "a" LIKE {:p1}`,
+		},
+		{
+			`$dbx.orLike("a", "test1", "test2").match(false, true).build(db, {})`,
+			/* SQLite:
+			"`a` LIKE {:p0} OR `a` LIKE {:p1}",
+			*/
+			// PostgreSQL:
+			`"a" LIKE {:p0} OR "a" LIKE {:p1}`,
+		},
+		{
+			`$dbx.notLike("a", "test1", "test2").match(true, false).build(db, {})`,
+			/* SQLite:
+			"`a` NOT LIKE {:p0} AND `a` NOT LIKE {:p1}",
+			*/
+			// PostgreSQL:
+			`"a" NOT LIKE {:p0} AND "a" NOT LIKE {:p1}`,
+		},
+		{
+			`$dbx.orNotLike("a", "test1", "test2").match(false, false).build(db, {})`,
+			/* SQLite:
+			"`a` NOT LIKE {:p0} OR `a` NOT LIKE {:p1}",
+			*/
+			// PostgreSQL:
+			`"a" NOT LIKE {:p0} OR "a" NOT LIKE {:p1}`,
+		},
+		{
+			`$dbx.exists($dbx.exp("a = 1")).build(db, {})`,
+			"EXISTS (a = 1)",
+		},
+		{
+			`$dbx.notExists($dbx.exp("a = 1")).build(db, {})`,
+			"NOT EXISTS (a = 1)",
+		},
+		{
+			`$dbx.between("a", 1, 2).build(db, {})`,
+			/* SQLite:
+			"`a` BETWEEN {:p0} AND {:p1}",
+			*/
+			// PostgreSQL:
+			`"a" BETWEEN {:p0} AND {:p1}`,
+		},
+		{
+			`$dbx.notBetween("a", 1, 2).build(db, {})`,
+			/* SQLite:
+			"`a` NOT BETWEEN {:p0} AND {:p1}",
+			*/
+			// PostgreSQL:
+			`"a" NOT BETWEEN {:p0} AND {:p1}`,
+		},
+	}
+
+	for _, s := range sceneraios {
+		result, err := vm.RunString(s.js)
+		if err != nil {
+			t.Fatalf("[%s] Failed to execute js script, got %v", s.js, err)
+		}
+
+		v, _ := result.Export().(string)
+
+		if v != s.expected {
+			t.Fatalf("[%s] Expected \n%s, \ngot \n%s", s.js, s.expected, v)
+		}
+	}
+}
+
+func TestMailsBindsCount(t *testing.T) {
+	vm := goja.New()
+	mailsBinds(vm)
+
+	testBindsCount(vm, "$mails", 5, t)
+}
+
+func TestMailsBinds(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	record, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	vm := goja.New()
+	baseBinds(vm)
+	mailsBinds(vm)
+	vm.Set("$app", app)
+	vm.Set("record", record)
+
+	_, vmErr := vm.RunString(`
+		$mails.sendRecordPasswordReset($app, record);
+		if (!$app.testMailer.lastMessage().html.includes("/_/#/auth/confirm-password-reset/")) {
+			throw new Error("Expected record password reset email, got:" + JSON.stringify($app.testMailer.lastMessage()))
+		}
+
+		$mails.sendRecordVerification($app, record);
+		if (!$app.testMailer.lastMessage().html.includes("/_/#/auth/confirm-verification/")) {
+			throw new Error("Expected record verification email, got:" + JSON.stringify($app.testMailer.lastMessage()))
+		}
+
+		$mails.sendRecordChangeEmail($app, record, "new@example.com");
+		if (!$app.testMailer.lastMessage().html.includes("/_/#/auth/confirm-email-change/")) {
+			throw new Error("Expected record email change email, got:" + JSON.stringify($app.testMailer.lastMessage()))
+		}
+
+		$mails.sendRecordOTP($app, record, "test_otp_id", "test_otp_pass");
+		if (!$app.testMailer.lastMessage().html.includes("test_otp_pass")) {
+			throw new Error("Expected record OTP email, got:" + JSON.stringify($app.testMailer.lastMessage()))
+		}
+
+		$mails.sendRecordAuthAlert($app, record, "test_alert_info");
+		if (!$app.testMailer.lastMessage().html.includes("test_alert_info")) {
+			throw new Error("Expected record OTP email, got:" + JSON.stringify($app.testMailer.lastMessage()))
+		}
+	`)
+	if vmErr != nil {
+		t.Fatal(vmErr)
+	}
+}
+
+func TestSecurityBindsCount(t *testing.T) {
+	vm := goja.New()
+	securityBinds(vm)
+
+	testBindsCount(vm, "$security", 16, t)
+}
+
+func TestSecurityCryptoBinds(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	securityBinds(vm)
+
+	sceneraios := []struct {
+		js       string
+		expected string
+	}{
+		{`$security.md5("123")`, "202cb962ac59075b964b07152d234b70"},
+		{`$security.sha256("123")`, "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3"},
+		{`$security.sha512("123")`, "3c9909afec25354d551dae21590bb26e38d53f2173b8d3dc3eee4c047e7ab1c1eb8b85103e3be7ba613b31bb5c9c36214dc9f14a42fd7a2fdb84856bca5c44c2"},
+		{`$security.hs256("hello", "test")`, "f151ea24bda91a18e89b8bb5793ef324b2a02133cce15a28a719acbd2e58a986"},
+		{`$security.hs512("hello", "test")`, "44f280e11103e295c26cd61dd1cdd8178b531b860466867c13b1c37a26b6389f8af110efbe0bb0717b9d9c87f6fe1c97b3b1690936578890e5669abf279fe7fd"},
+		{`$security.equal("abc", "abc")`, "true"},
+		{`$security.equal("abc", "abcd")`, "false"},
+	}
+
+	for _, s := range sceneraios {
+		t.Run(s.js, func(t *testing.T) {
+			result, err := vm.RunString(s.js)
+			if err != nil {
+				t.Fatalf("Failed to execute js script, got %v", err)
+			}
+
+			v := cast.ToString(result.Export())
+
+			if v != s.expected {
+				t.Fatalf("Expected %v \ngot \n%v", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestSecurityRandomStringBinds(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	securityBinds(vm)
+
+	sceneraios := []struct {
+		js     string
+		length int
+	}{
+		{`$security.randomString(6)`, 6},
+		{`$security.randomStringWithAlphabet(7, "abc")`, 7},
+		{`$security.pseudorandomString(8)`, 8},
+		{`$security.pseudorandomStringWithAlphabet(9, "abc")`, 9},
+		{`$security.randomStringByRegex("abc")`, 3},
+	}
+
+	for _, s := range sceneraios {
+		t.Run(s.js, func(t *testing.T) {
+			result, err := vm.RunString(s.js)
+			if err != nil {
+				t.Fatalf("Failed to execute js script, got %v", err)
+			}
+
+			v, _ := result.Export().(string)
+
+			if len(v) != s.length {
+				t.Fatalf("Expected %d length string, \ngot \n%v", s.length, v)
+			}
+		})
+	}
+}
+
+func TestSecurityJWTBinds(t *testing.T) {
+	sceneraios := []struct {
+		name string
+		js   string
+	}{
+		{
+			"$security.parseUnverifiedJWT",
+			`
+				const result = $security.parseUnverifiedJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.aXzC7q7z1lX_hxk5P0R368xEU7H1xRwnBQQcLAmG0EY")
+				if (result.name != "John Doe") {
+					throw new Error("Expected result.name 'John Doe', got " + result.name)
+				}
+				if (result.sub != "1234567890") {
+					throw new Error("Expected result.sub '1234567890', got " + result.sub)
+				}
+			`,
+		},
+		{
+			"$security.parseJWT",
+			`
+				const result = $security.parseJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.aXzC7q7z1lX_hxk5P0R368xEU7H1xRwnBQQcLAmG0EY", "test")
+				if (result.name != "John Doe") {
+					throw new Error("Expected result.name 'John Doe', got " + result.name)
+				}
+				if (result.sub != "1234567890") {
+					throw new Error("Expected result.sub '1234567890', got " + result.sub)
+				}
+			`,
+		},
+		{
+			"$security.createJWT",
+			`
+				// overwrite the exp claim for static token
+				const result = $security.createJWT({"exp": 123}, "test", 0)
+
+				const expected = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjEyM30.7gbv7w672gApdBRASI6OniCtKwkKjhieSxsr6vxSrtw";
+				if (result != expected) {
+					throw new Error("Expected token \n" + expected + ", got \n" + result)
+				}
+			`,
+		},
+	}
+
+	for _, s := range sceneraios {
+		t.Run(s.name, func(t *testing.T) {
+			vm := goja.New()
+			baseBinds(vm)
+			securityBinds(vm)
+
+			_, err := vm.RunString(s.js)
+			if err != nil {
+				t.Fatalf("Failed to execute js script, got %v", err)
+			}
+		})
+	}
+}
+
+func TestSecurityEncryptAndDecryptBinds(t *testing.T) {
+	vm := goja.New()
+	baseBinds(vm)
+	securityBinds(vm)
+
+	_, err := vm.RunString(`
+		const key = "abcdabcdabcdabcdabcdabcdabcdabcd"
+
+		const encrypted = $security.encrypt("123", key)
+
+		const decrypted = $security.decrypt(encrypted, key)
+
+		if (decrypted != "123") {
+			throw new Error("Expected decrypted '123', got " + decrypted)
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestFilesystemBinds(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/error" {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+
+		fmt.Fprintf(w, "test")
+	}))
+	defer srv.Close()
+
+	vm := goja.New()
+	vm.Set("mh", &multipart.FileHeader{Filename: "test"})
+	vm.Set("testFile", filepath.Join(app.DataDir(), "data.db"))
+	vm.Set("baseURL", srv.URL)
+	baseBinds(vm)
+	filesystemBinds(vm)
+
+	testBindsCount(vm, "$filesystem", 4, t)
+
+	// fileFromPath
+	{
+		v, err := vm.RunString(`$filesystem.fileFromPath(testFile)`)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		file, _ := v.Export().(*filesystem.File)
+
+		if file == nil || file.OriginalName != "data.db" {
+			t.Fatalf("[fileFromPath] Expected file with name %q, got %v", file.OriginalName, file)
+		}
+	}
+
+	// fileFromBytes
+	{
+		v, err := vm.RunString(`$filesystem.fileFromBytes([1, 2, 3], "test")`)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		file, _ := v.Export().(*filesystem.File)
+
+		if file == nil || file.OriginalName != "test" {
+			t.Fatalf("[fileFromBytes] Expected file with name %q, got %v", file.OriginalName, file)
+		}
+	}
+
+	// fileFromMultipart
+	{
+		v, err := vm.RunString(`$filesystem.fileFromMultipart(mh)`)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		file, _ := v.Export().(*filesystem.File)
+
+		if file == nil || file.OriginalName != "test" {
+			t.Fatalf("[fileFromMultipart] Expected file with name %q, got %v", file.OriginalName, file)
+		}
+	}
+
+	// fileFromURL (success)
+	{
+		v, err := vm.RunString(`$filesystem.fileFromURL(baseURL + "/test")`)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		file, _ := v.Export().(*filesystem.File)
+
+		if file == nil || file.OriginalName != "test" {
+			t.Fatalf("[fileFromURL] Expected file with name %q, got %v", file.OriginalName, file)
+		}
+	}
+
+	// fileFromURL (failure)
+	{
+		_, err := vm.RunString(`$filesystem.fileFromURL(baseURL + "/error")`)
+		if err == nil {
+			t.Fatal("Expected url fetch error")
+		}
+	}
+}
+
+func TestFormsBinds(t *testing.T) {
+	vm := goja.New()
+	formsBinds(vm)
+
+	testBindsCount(vm, "this", 4, t)
+}
+
+func TestApisBindsCount(t *testing.T) {
+	vm := goja.New()
+	apisBinds(vm)
+
+	testBindsCount(vm, "this", 8, t)
+	testBindsCount(vm, "$apis", 11, t)
+}
+
+func TestApisBindsApiError(t *testing.T) {
+	vm := goja.New()
+	apisBinds(vm)
+
+	scenarios := []struct {
+		js            string
+		expectStatus  int
+		expectMessage string
+		expectData    string
+	}{
+		{"new ApiError()", 0, "", "null"},
+		{"new ApiError(100, 'test', {'test': 1})", 100, "Test.", `{"test":1}`},
+		{"new NotFoundError()", 404, "The requested resource wasn't found.", "null"},
+		{"new NotFoundError('test', {'test': 1})", 404, "Test.", `{"test":1}`},
+		{"new BadRequestError()", 400, "Something went wrong while processing your request.", "null"},
+		{"new BadRequestError('test', {'test': 1})", 400, "Test.", `{"test":1}`},
+		{"new ForbiddenError()", 403, "You are not allowed to perform this request.", "null"},
+		{"new ForbiddenError('test', {'test': 1})", 403, "Test.", `{"test":1}`},
+		{"new UnauthorizedError()", 401, "Missing or invalid authentication.", "null"},
+		{"new UnauthorizedError('test', {'test': 1})", 401, "Test.", `{"test":1}`},
+		{"new TooManyRequestsError()", 429, "Too Many Requests.", "null"},
+		{"new TooManyRequestsError('test', {'test': 1})", 429, "Test.", `{"test":1}`},
+		{"new InternalServerError()", 500, "Something went wrong while processing your request.", "null"},
+		{"new InternalServerError('test', {'test': 1})", 500, "Test.", `{"test":1}`},
+	}
+
+	for _, s := range scenarios {
+		v, err := vm.RunString(s.js)
+		if err != nil {
+			t.Errorf("[%s] %v", s.js, err)
+			continue
+		}
+
+		apiErr, ok := v.Export().(*router.ApiError)
+		if !ok {
+			t.Errorf("[%s] Expected ApiError, got %v", s.js, v)
+			continue
+		}
+
+		if apiErr.Status != s.expectStatus {
+			t.Errorf("[%s] Expected Status %d, got %d", s.js, s.expectStatus, apiErr.Status)
+		}
+
+		if apiErr.Message != s.expectMessage {
+			t.Errorf("[%s] Expected Message %q, got %q", s.js, s.expectMessage, apiErr.Message)
+		}
+
+		dataRaw, _ := json.Marshal(apiErr.RawData())
+		if string(dataRaw) != s.expectData {
+			t.Errorf("[%s] Expected Data %q, got %q", s.js, s.expectData, dataRaw)
+		}
+	}
+}
+
+func TestLoadingDynamicModel(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	baseBinds(vm)
+	dbxBinds(vm)
+	vm.Set("$app", app)
+
+	_, err := vm.RunString(`
+		let result = new DynamicModel({
+			string:          "",
+			nullString:      nullString(),
+			nullStringEmpty: nullString(),
+
+			bool:            false,
+			nullBool:        nullBool(),
+			nullBoolEmpty:   nullBool(),
+
+			int:             0,
+			nullInt:         nullInt(),
+			nullIntEmpty:    nullInt(),
+
+			float:           -0,
+			nullFloat:       nullFloat(),
+			nullFloatEmpty:  nullFloat(),
+
+			array:           [],
+			nullArray:       nullArray(),
+			nullArrayEmpty:  nullArray(),
+
+			object:          {},
+			nullObject:      nullObject(),
+			nullObjectEmpty: nullObject(),
+		})
+
+		const expectations = {
+			"string":          "a",
+			"nullString":      "b",
+			"nullStringEmpty": null,
+
+			"bool":          false,
+			"nullBool":      true,
+			"nullBoolEmpty": null,
+
+			"int":          1,
+			"nullInt":      2,
+			"nullIntEmpty": null,
+
+			"float":          1.1,
+			"nullFloat":      1.2,
+			"nullFloatEmpty": null,
+
+			"array":          [1,2],
+			"nullArray":      [3,4],
+			"nullArrayEmpty": null,
+
+			"object":          {a:1},
+			"nullObject":      {a:2},
+			"nullObjectEmpty": null,
+		};
+
+		// constuct dummy SELECT column value literals based on the expectations
+		const selectColumns = [];
+		for (const col in expectations) {
+			const val = expectations[col]
+
+			if (val === null) {
+				selectColumns.push("null as [[" + col + "]]")
+			} else if (typeof val === "string") {
+				selectColumns.push("'" + val + "' as [[" + col + "]]")
+			} else if (typeof val === "object") {
+				selectColumns.push("'" + JSON.stringify(val) + "' as [[" + col + "]]")
+			} else {
+				selectColumns.push(val + " as [[" + col + "]]")
+			}
+		}
+
+		$app.db()
+			.newQuery("SELECT " + selectColumns.join(", "))
+			.one(result)
+
+		for (const col in expectations) {
+			let expVal = expectations[col];
+			let resVal = result[col];
+
+			if (expVal !== null && typeof expVal === "object") {
+				expVal = JSON.stringify(expVal)
+				resVal = JSON.stringify(resVal)
+			}
+
+			if (expVal != resVal) {
+				throw new Error("Expected '" + col + "' value " + expVal + ", got " + resVal);
+			}
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDynamicModelMapFieldCaching(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	baseBinds(vm)
+	dbxBinds(vm)
+	vm.Set("$app", app)
+
+	_, err := vm.RunString(`
+		let m1 = new DynamicModel({
+			int: 0,
+			float: -0,
+			text: "",
+			bool: false,
+			obj: {},
+			arr: [],
+		})
+
+		let m2 = new DynamicModel({
+			int: 0,
+			float: -0,
+			text: "",
+			bool: false,
+			obj: {},
+			arr: [],
+		})
+
+		m1.int = 1
+		m1.float = 1.5
+		m1.text = "a"
+		m1.bool = true
+		m1.obj.set("a", 1)
+		m1.arr.push(1)
+
+		m2.int = 2
+		m2.float = 2.5
+		m2.text = "b"
+		m2.bool = false
+		m2.obj.set("b", 1)
+		m2.arr.push(2)
+
+		let m1Expected = '{"arr":[1],"bool":true,"float":1.5,"int":1,"obj":{"a":1},"text":"a"}';
+		let m1Serialized = JSON.stringify(m1);
+		if (m1Serialized != m1Expected) {
+			throw new Error("Expected m1 \n" + m1Expected + "\ngot\n" + m1Serialized);
+		}
+
+		let m2Expected = '{"arr":[2],"bool":false,"float":2.5,"int":2,"obj":{"b":1},"text":"b"}';
+		let m2Serialized = JSON.stringify(m2);
+		if (m2Serialized != m2Expected) {
+			throw new Error("Expected m2 \n" + m2Expected + "\ngot\n" + m2Serialized);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestLoadingArrayOf(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	baseBinds(vm)
+	dbxBinds(vm)
+	vm.Set("$app", app)
+
+	_, err := vm.RunString(`
+		let result = arrayOf(new DynamicModel({
+			id:   "",
+			text: "",
+		}))
+
+		$app.db()
+			.select("id", "text")
+			.from("demo1")
+			.where($dbx.exp("id='84nmscqy84lsi1t' OR id='al1h9ijdeojtsjy'"))
+			.limit(2)
+			.orderBy("text ASC")
+			.all(result)
+
+		if (result.length != 2) {
+			throw new Error('Expected 2 list items, got ' + result.length);
+		}
+
+		if (result[0].id != "84nmscqy84lsi1t") {
+			throw new Error('Expected 0.id "84nmscqy84lsi1t", got ' + result[0].id);
+		}
+		if (result[0].text != "test") {
+			throw new Error('Expected 0.text "test", got ' + result[0].text);
+		}
+
+		if (result[1].id != "al1h9ijdeojtsjy") {
+			throw new Error('Expected 1.id "al1h9ijdeojtsjy", got ' + result[1].id);
+		}
+		if (result[1].text != "test2") {
+			throw new Error('Expected 1.text "test2", got ' + result[1].text);
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestHttpClientBindsCount(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	httpClientBinds(vm)
+
+	testBindsCount(vm, "this", 2, t) // + FormData
+	testBindsCount(vm, "$http", 1, t)
+}
+
+func TestHttpClientBindsSend(t *testing.T) {
+	t.Parallel()
+
+	// start a test server
+	server := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		if req.URL.Query().Get("testError") != "" {
+			res.WriteHeader(400)
+			return
+		}
+
+		timeoutStr := req.URL.Query().Get("testTimeout")
+		timeout, _ := strconv.Atoi(timeoutStr)
+		if timeout > 0 {
+			time.Sleep(time.Duration(timeout) * time.Second)
+		}
+
+		bodyRaw, _ := io.ReadAll(req.Body)
+		defer req.Body.Close()
+
+		// normalize headers
+		headers := make(map[string]string, len(req.Header))
+		for k, v := range req.Header {
+			if len(v) > 0 {
+				headers[strings.ToLower(strings.ReplaceAll(k, "-", "_"))] = v[0]
+			}
+		}
+
+		info := map[string]any{
+			"method":  req.Method,
+			"headers": headers,
+			"body":    string(bodyRaw),
+		}
+
+		// add custom headers and cookies
+		res.Header().Add("X-Custom", "custom_header")
+		res.Header().Add("Set-Cookie", "sessionId=123456")
+
+		infoRaw, _ := json.Marshal(info)
+
+		// write back the submitted request
+		res.Write(infoRaw)
+	}))
+	defer server.Close()
+
+	vm := goja.New()
+	baseBinds(vm)
+	httpClientBinds(vm)
+	vm.Set("testURL", server.URL)
+
+	_, err := vm.RunString(`
+		function getNestedVal(data, path) {
+			let result = data || {};
+			let parts  = path.split(".");
+
+			for (const part of parts) {
+				if (
+					result == null ||
+					typeof result !== "object" ||
+					typeof result[part] === "undefined"
+				) {
+					return null;
+				}
+
+				result = result[part];
+			}
+
+			return result;
+		}
+
+		let testTimeout;
+		try {
+			$http.send({
+				url:     testURL + "?testTimeout=3",
+				timeout: 1
+			})
+		} catch (err) {
+			testTimeout = err
+		}
+		if (!testTimeout) {
+			throw new Error("Expected timeout error")
+		}
+
+		// error response check
+		const test0 = $http.send({
+			url: testURL + "?testError=1",
+		})
+
+		// basic fields check
+		const test1 = $http.send({
+			method:  "post",
+			url:     testURL,
+			headers: {"header1": "123", "header2": "456"},
+			body:    '789',
+		})
+
+		// with custom content-type header
+		const test2 = $http.send({
+			url: testURL,
+			headers: {"content-type": "text/plain"},
+		})
+
+		// with FormData
+		const formData = new FormData()
+		formData.append("title", "123")
+		const test3 = $http.send({
+			url: testURL,
+			body: formData,
+			headers: {"content-type": "text/plain"}, // should be ignored
+		})
+
+		// raw body response field check
+		const test4 = $http.send({
+			method: "post",
+			url:    testURL,
+			body:   'test',
+		})
+
+		const scenarios = [
+			[test0, {
+				"statusCode": "400",
+			}],
+			[test1, {
+				"statusCode":                "200",
+				"headers.X-Custom.0":        "custom_header",
+				"cookies.sessionId.value":   "123456",
+				"json.method":               "POST",
+				"json.headers.header1":      "123",
+				"json.headers.header2":      "456",
+				"json.body":                 "789",
+			}],
+			[test2, {
+				"statusCode":                "200",
+				"headers.X-Custom.0":        "custom_header",
+				"cookies.sessionId.value":   "123456",
+				"json.method":               "GET",
+				"json.headers.content_type": "text/plain",
+			}],
+			[test3, {
+				"statusCode":                "200",
+				"headers.X-Custom.0":        "custom_header",
+				"cookies.sessionId.value":   "123456",
+				"json.method":               "GET",
+				"json.body": [
+					"\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\n123\r\n--",
+				],
+				"json.headers.content_type": [
+					"multipart/form-data; boundary="
+				],
+			}],
+			[test4, {
+				"statusCode":              "200",
+				"headers.X-Custom.0":      "custom_header",
+				"cookies.sessionId.value": "123456",
+				// {"body":"test","headers":{"accept_encoding":"gzip","content_length":"4","user_agent":"Go-http-client/1.1"},"method":"POST"}
+				"body": [123,34,98,111,100,121,34,58,34,116,101,115,116,34,44,34,104,101,97,100,101,114,115,34,58,123,34,97,99,99,101,112,116,95,101,110,99,111,100,105,110,103,34,58,34,103,122,105,112,34,44,34,99,111,110,116,101,110,116,95,108,101,110,103,116,104,34,58,34,52,34,44,34,117,115,101,114,95,97,103,101,110,116,34,58,34,71,111,45,104,116,116,112,45,99,108,105,101,110,116,47,49,46,49,34,125,44,34,109,101,116,104,111,100,34,58,34,80,79,83,84,34,125],
+			}],
+		]
+
+		for (let scenario of scenarios) {
+			const result = scenario[0];
+			const expectations = scenario[1];
+
+			for (let key in expectations) {
+				const value = getNestedVal(result, key);
+				const expectation = expectations[key]
+				if (Array.isArray(expectation)) {
+					// check for partial match(es)
+					for (let exp of expectation) {
+						if (!value.includes(exp)) {
+							throw new Error('Expected ' + key + ' to contain ' + exp + ', got: ' + toString(result.body));
+						}
+					}
+				} else {
+					// check for direct match
+					if (value != expectation) {
+						throw new Error('Expected ' + key + ' ' + expectation + ', got: ' + toString(result.body));
+					}
+				}
+			}
+		}
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestCronBindsCount(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+
+	pool := newPool(1, func() *goja.Runtime { return goja.New() })
+
+	cronBinds(app, vm, pool)
+
+	testBindsCount(vm, "this", 2, t)
+
+	pool.run(func(poolVM *goja.Runtime) error {
+		testBindsCount(poolVM, "this", 2, t)
+		return nil
+	})
+}
+
+func TestHooksBindsCount(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	hooksBinds(app, vm, nil)
+
+	testBindsCount(vm, "this", 82, t)
+}
+
+func TestHooksBinds(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	result := &struct {
+		Called int
+	}{}
+
+	vmFactory := func() *goja.Runtime {
+		vm := goja.New()
+		baseBinds(vm)
+		vm.Set("$app", app)
+		vm.Set("result", result)
+		return vm
+	}
+
+	pool := newPool(1, vmFactory)
+
+	vm := vmFactory()
+	hooksBinds(app, vm, pool)
+
+	_, err := vm.RunString(`
+		onModelUpdate((e) => {
+			result.called++;
+			e.next()
+		}, "demo1")
+
+		onModelUpdate((e) => {
+			throw new Error("example");
+		}, "demo1")
+
+		onModelUpdate((e) => {
+			result.called++;
+			e.next();
+		}, "demo2")
+
+		onModelUpdate((e) => {
+			result.called++;
+			e.next()
+		}, "demo2")
+
+		onModelUpdate((e) => {
+			// stop propagation
+		}, "demo2")
+
+		onModelUpdate((e) => {
+			result.called++;
+			e.next();
+		}, "demo2")
+
+		onBootstrap((e) => {
+			e.next()
+
+			// check hooks propagation and tags filtering
+			const recordA = $app.findFirstRecordByFilter("demo2", "1=1")
+			recordA.set("title", "update")
+			$app.save(recordA)
+			if (result.called != 2) {
+				throw new Error("Expected result.called to be 2, got " + result.called)
+			}
+
+			// reset
+			result.called = 0;
+
+			// check error handling
+			let hasErr = false
+			try {
+				const recordB = $app.findFirstRecordByFilter("demo1", "1=1")
+				recordB.set("text", "update")
+				$app.save(recordB)
+			} catch (err) {
+				hasErr = true
+			}
+			if (!hasErr) {
+				throw new Error("Expected an error to be thrown")
+			}
+			if (result.called != 1) {
+				throw new Error("Expected result.called to be 1, got " + result.called)
+			}
+		})
+
+		$app.bootstrap();
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestHooksExceptionUnwrapping(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	goErr := errors.New("test")
+
+	vmFactory := func() *goja.Runtime {
+		vm := goja.New()
+		baseBinds(vm)
+		vm.Set("$app", app)
+		vm.Set("goErr", goErr)
+		return vm
+	}
+
+	pool := newPool(1, vmFactory)
+
+	vm := vmFactory()
+	hooksBinds(app, vm, pool)
+
+	_, err := vm.RunString(`
+		onModelUpdate((e) => {
+			throw goErr
+		}, "demo1")
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record, err := app.FindFirstRecordByFilter("demo1", "1=1")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record.Set("text", "update")
+
+	err = app.Save(record)
+	if !errors.Is(err, goErr) {
+		t.Fatalf("Expected goError, got %v", err)
+	}
+}
+
+func TestRouterBindsCount(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	vm := goja.New()
+	routerBinds(app, vm, nil)
+
+	testBindsCount(vm, "this", 2, t)
+}
+
+func TestRouterBinds(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	result := &struct {
+		RouteMiddlewareCalls  int
+		GlobalMiddlewareCalls int
+	}{}
+
+	vmFactory := func() *goja.Runtime {
+		vm := goja.New()
+		baseBinds(vm)
+		apisBinds(vm)
+		vm.Set("$app", app)
+		vm.Set("result", result)
+		return vm
+	}
+
+	pool := newPool(1, vmFactory)
+
+	vm := vmFactory()
+	routerBinds(app, vm, pool)
+
+	_, err := vm.RunString(`
+		routerAdd("GET", "/test", (e) => {
+			result.routeMiddlewareCalls++;
+		}, (e) => {
+			result.routeMiddlewareCalls++;
+			return e.next();
+		})
+
+		// Promise is not technically supported as return result
+		// but we try to resolve it at least for thrown errors
+		routerAdd("GET", "/error", async (e) => {
+			throw new ApiError(456, 'test', null)
+		})
+
+		routerUse((e) => {
+			result.globalMiddlewareCalls++;
+
+			return e.next();
+		})
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pbRouter, err := apis.NewRouter(app)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	serveEvent := new(core.ServeEvent)
+	serveEvent.App = app
+	serveEvent.Router = pbRouter
+	if err = app.OnServe().Trigger(serveEvent); err != nil {
+		t.Fatal(err)
+	}
+
+	mux, err := serveEvent.Router.BuildMux()
+	if err != nil {
+		t.Fatalf("Failed to build router mux: %v", err)
+	}
+
+	scenarios := []struct {
+		method                        string
+		path                          string
+		expectedRouteMiddlewareCalls  int
+		expectedGlobalMiddlewareCalls int
+		expectedCode                  int
+	}{
+		{"GET", "/test", 2, 1, 200},
+		{"GET", "/error", 0, 1, 456},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.method+" "+s.path, func(t *testing.T) {
+			// reset
+			result.RouteMiddlewareCalls = 0
+			result.GlobalMiddlewareCalls = 0
+
+			rec := httptest.NewRecorder()
+			req := httptest.NewRequest(s.method, s.path, nil)
+			mux.ServeHTTP(rec, req)
+
+			if result.RouteMiddlewareCalls != s.expectedRouteMiddlewareCalls {
+				t.Fatalf("Expected RouteMiddlewareCalls %d, got %d", s.expectedRouteMiddlewareCalls, result.RouteMiddlewareCalls)
+			}
+
+			if result.GlobalMiddlewareCalls != s.expectedGlobalMiddlewareCalls {
+				t.Fatalf("Expected GlobalMiddlewareCalls %d, got %d", s.expectedGlobalMiddlewareCalls, result.GlobalMiddlewareCalls)
+			}
+
+			if rec.Code != s.expectedCode {
+				t.Fatalf("Expected status code %d, got %d", s.expectedCode, rec.Code)
+			}
+		})
+	}
+}
+
+func TestFilepathBindsCount(t *testing.T) {
+	vm := goja.New()
+	filepathBinds(vm)
+
+	testBindsCount(vm, "$filepath", 15, t)
+}
+
+func TestOsBindsCount(t *testing.T) {
+	vm := goja.New()
+	osBinds(vm)
+
+	testBindsCount(vm, "$os", 20, t)
+}
diff --git a/server/core_backend-server/plugins/jsvm/form_data.go b/server/core_backend-server/plugins/jsvm/form_data.go
new file mode 100644
index 0000000..4419c68
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/form_data.go
@@ -0,0 +1,149 @@
+package jsvm
+
+import (
+	"bytes"
+	"io"
+	"mime/multipart"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/spf13/cast"
+)
+
+// FormData represents an interface similar to the browser's [FormData].
+//
+// The value of each FormData entry must be a string or [*filesystem.File] instance.
+//
+// It is intended to be used together with the JSVM `$http.send` when
+// sending multipart/form-data requests.
+//
+// [FormData]: https://developer.mozilla.org/en-US/docs/Web/API/FormData.
+type FormData map[string][]any
+
+// Append appends a new value onto an existing key inside the current FormData,
+// or adds the key if it does not already exist.
+func (data FormData) Append(key string, value any) {
+	data[key] = append(data[key], value)
+}
+
+// Set sets a new value for an existing key inside the current FormData,
+// or adds the key/value if it does not already exist.
+func (data FormData) Set(key string, value any) {
+	data[key] = []any{value}
+}
+
+// Delete deletes a key and its value(s) from the current FormData.
+func (data FormData) Delete(key string) {
+	delete(data, key)
+}
+
+// Get returns the first value associated with a given key from
+// within the current FormData.
+//
+// If you expect multiple values and want all of them,
+// use the [FormData.GetAll] method instead.
+func (data FormData) Get(key string) any {
+	values, ok := data[key]
+	if !ok || len(values) == 0 {
+		return nil
+	}
+
+	return values[0]
+}
+
+// GetAll returns all the values associated with a given key
+// from within the current FormData.
+func (data FormData) GetAll(key string) []any {
+	values, ok := data[key]
+	if !ok {
+		return nil
+	}
+
+	return values
+}
+
+// Has returns whether a FormData object contains a certain key.
+func (data FormData) Has(key string) bool {
+	values, ok := data[key]
+
+	return ok && len(values) > 0
+}
+
+// Keys returns all keys contained in the current FormData.
+func (data FormData) Keys() []string {
+	result := make([]string, 0, len(data))
+
+	for k := range data {
+		result = append(result, k)
+	}
+
+	return result
+}
+
+// Keys returns all values contained in the current FormData.
+func (data FormData) Values() []any {
+	result := make([]any, 0, len(data))
+
+	for _, values := range data {
+		result = append(result, values...)
+	}
+
+	return result
+}
+
+// Entries returns a [key, value] slice pair for each FormData entry.
+func (data FormData) Entries() [][]any {
+	result := make([][]any, 0, len(data))
+
+	for k, values := range data {
+		for _, v := range values {
+			result = append(result, []any{k, v})
+		}
+	}
+
+	return result
+}
+
+// toMultipart converts the current FormData entries into multipart encoded data.
+func (data FormData) toMultipart() (*bytes.Buffer, *multipart.Writer, error) {
+	body := new(bytes.Buffer)
+
+	mp := multipart.NewWriter(body)
+	defer mp.Close()
+
+	for k, values := range data {
+		for _, rawValue := range values {
+			switch v := rawValue.(type) {
+			case *filesystem.File:
+				err := func() error {
+					mpw, err := mp.CreateFormFile(k, v.OriginalName)
+					if err != nil {
+						return err
+					}
+
+					file, err := v.Reader.Open()
+					if err != nil {
+						return err
+					}
+					defer file.Close()
+
+					_, err = io.Copy(mpw, file)
+					if err != nil {
+						return err
+					}
+
+					return nil
+				}()
+				if err != nil {
+					return nil, nil, err
+				}
+			default:
+				err := mp.WriteField(k, cast.ToString(v))
+				if err != nil {
+					return nil, nil, err
+				}
+			}
+		}
+	}
+
+	return body, mp, nil
+}
diff --git a/server/core_backend-server/plugins/jsvm/form_data_test.go b/server/core_backend-server/plugins/jsvm/form_data_test.go
new file mode 100644
index 0000000..dbf0f40
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/form_data_test.go
@@ -0,0 +1,225 @@
+package jsvm
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+func TestFormDataAppendAndSet(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+
+	data.Append("a", 1)
+	data.Append("a", 2)
+
+	data.Append("b", 3)
+	data.Append("b", 4)
+	data.Set("b", 5) // should overwrite the previous 2 calls
+
+	data.Set("c", 6)
+	data.Set("c", 7)
+
+	if len(data["a"]) != 2 {
+		t.Fatalf("Expected 2 'a' values, got %v", data["a"])
+	}
+	if data["a"][0] != 1 || data["a"][1] != 2 {
+		t.Fatalf("Expected 1 and 2 'a' key values, got %v", data["a"])
+	}
+
+	if len(data["b"]) != 1 {
+		t.Fatalf("Expected 1 'b' values, got %v", data["b"])
+	}
+	if data["b"][0] != 5 {
+		t.Fatalf("Expected 5 as 'b' key value, got %v", data["b"])
+	}
+
+	if len(data["c"]) != 1 {
+		t.Fatalf("Expected 1 'c' values, got %v", data["c"])
+	}
+	if data["c"][0] != 7 {
+		t.Fatalf("Expected 7 as 'c' key value, got %v", data["c"])
+	}
+}
+
+func TestFormDataDelete(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("a", 2)
+	data.Append("b", 3)
+
+	data.Delete("missing") // should do nothing
+	data.Delete("a")
+
+	if len(data) != 1 {
+		t.Fatalf("Expected exactly 1 data remaining key, got %v", data)
+	}
+
+	if data["b"][0] != 3 {
+		t.Fatalf("Expected 3 as 'b' key value, got %v", data["b"])
+	}
+}
+
+func TestFormDataGet(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("a", 2)
+
+	if v := data.Get("missing"); v != nil {
+		t.Fatalf("Expected %v for key 'missing', got %v", nil, v)
+	}
+
+	if v := data.Get("a"); v != 1 {
+		t.Fatalf("Expected %v for key 'a', got %v", 1, v)
+	}
+}
+
+func TestFormDataGetAll(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("a", 2)
+
+	if v := data.GetAll("missing"); v != nil {
+		t.Fatalf("Expected %v for key 'a', got %v", nil, v)
+	}
+
+	values := data.GetAll("a")
+	if len(values) != 2 || values[0] != 1 || values[1] != 2 {
+		t.Fatalf("Expected 1 and 2 values, got %v", values)
+	}
+}
+
+func TestFormDataHas(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+
+	if v := data.Has("missing"); v {
+		t.Fatalf("Expected key 'missing' to not exist: %v", v)
+	}
+
+	if v := data.Has("a"); !v {
+		t.Fatalf("Expected key 'a' to exist: %v", v)
+	}
+}
+
+func TestFormDataKeys(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("b", 1)
+	data.Append("c", 1)
+	data.Append("a", 1)
+
+	keys := data.Keys()
+
+	expectedKeys := []string{"a", "b", "c"}
+
+	for _, expected := range expectedKeys {
+		if !list.ExistInSlice(expected, keys) {
+			t.Fatalf("Expected key %s to exists in %v", expected, keys)
+		}
+	}
+}
+
+func TestFormDataValues(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("b", 2)
+	data.Append("c", 3)
+	data.Append("a", 4)
+
+	values := data.Values()
+
+	expectedKeys := []any{1, 2, 3, 4}
+
+	for _, expected := range expectedKeys {
+		if !list.ExistInSlice(expected, values) {
+			t.Fatalf("Expected key %s to exists in %v", expected, values)
+		}
+	}
+}
+
+func TestFormDataEntries(t *testing.T) {
+	t.Parallel()
+
+	data := FormData{}
+	data.Append("a", 1)
+	data.Append("b", 2)
+	data.Append("c", 3)
+	data.Append("a", 4)
+
+	entries := data.Entries()
+
+	rawEntries, err := json.Marshal(entries)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(entries) != 4 {
+		t.Fatalf("Expected 4 entries")
+	}
+
+	expectedEntries := []string{`["a",1]`, `["a",4]`, `["b",2]`, `["c",3]`}
+	for _, expected := range expectedEntries {
+		if !bytes.Contains(rawEntries, []byte(expected)) {
+			t.Fatalf("Expected entry %s to exists in %s", expected, rawEntries)
+		}
+	}
+}
+
+func TestFormDataToMultipart(t *testing.T) {
+	t.Parallel()
+
+	f, err := filesystem.NewFileFromBytes([]byte("abc"), "test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	data := FormData{}
+	data.Append("a", 1) // should be casted
+	data.Append("b", "test1")
+	data.Append("b", "test2")
+	data.Append("c", f)
+
+	body, mp, err := data.toMultipart()
+	if err != nil {
+		t.Fatal(err)
+	}
+	bodyStr := body.String()
+
+	// content type checks
+	contentType := mp.FormDataContentType()
+	expectedContentType := "multipart/form-data; boundary="
+	if !strings.Contains(contentType, expectedContentType) {
+		t.Fatalf("Expected to find content-type %s in %s", expectedContentType, contentType)
+	}
+
+	// body checks
+	expectedBodyParts := []string{
+		"Content-Disposition: form-data; name=\"a\"\r\n\r\n1",
+		"Content-Disposition: form-data; name=\"b\"\r\n\r\ntest1",
+		"Content-Disposition: form-data; name=\"b\"\r\n\r\ntest2",
+		"Content-Disposition: form-data; name=\"c\"; filename=\"test\"\r\nContent-Type: application/octet-stream\r\n\r\nabc",
+	}
+	for _, part := range expectedBodyParts {
+		if !strings.Contains(bodyStr, part) {
+			t.Fatalf("Expected to find %s in body\n%s", part, bodyStr)
+		}
+	}
+}
diff --git a/server/core_backend-server/plugins/jsvm/internal/types/generated/embed.go b/server/core_backend-server/plugins/jsvm/internal/types/generated/embed.go
new file mode 100644
index 0000000..b5b9825
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/internal/types/generated/embed.go
@@ -0,0 +1,6 @@
+package generated
+
+import "embed"
+
+//go:embed types.d.ts
+var Types embed.FS
diff --git a/server/core_backend-server/plugins/jsvm/internal/types/generated/types.d.ts b/server/core_backend-server/plugins/jsvm/internal/types/generated/types.d.ts
new file mode 100644
index 0000000..ef367f2
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/internal/types/generated/types.d.ts
@@ -0,0 +1,23900 @@
+// 1766297115
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+// -------------------------------------------------------------------
+// cronBinds
+// -------------------------------------------------------------------
+
+/**
+ * CronAdd registers a new cron job.
+ *
+ * If a cron job with the specified name already exist, it will be
+ * replaced with the new one.
+ *
+ * Example:
+ *
+ * ```js
+ * // prints "Hello world!" on every 30 minutes
+ * cronAdd("hello", "*\/30 * * * *", () => {
+ *     console.log("Hello world!")
+ * })
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function cronAdd(
+  jobId:    string,
+  cronExpr: string,
+  handler:  () => void,
+): void;
+
+/**
+ * CronRemove removes a single registered cron job by its name.
+ *
+ * Example:
+ *
+ * ```js
+ * cronRemove("hello")
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function cronRemove(jobId: string): void;
+
+// -------------------------------------------------------------------
+// routerBinds
+// -------------------------------------------------------------------
+
+/**
+ * RouterAdd registers a new route definition.
+ *
+ * Example:
+ *
+ * ```js
+ * routerAdd("GET", "/hello", (e) => {
+ *     return e.json(200, {"message": "Hello!"})
+ * }, $apis.requireAuth())
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function routerAdd(
+  method: string,
+  path: string,
+  handler: (e: core.RequestEvent) => void,
+  ...middlewares: Array<string|((e: core.RequestEvent) => void)|Middleware>,
+): void;
+
+/**
+ * RouterUse registers one or more global middlewares that are executed
+ * along the handler middlewares after a matching route is found.
+ *
+ * Example:
+ *
+ * ```js
+ * routerUse((e) => {
+ *   console.log(e.request.url.path)
+ *   return e.next()
+ * })
+ * ```
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function routerUse(...middlewares: Array<string|((e: core.RequestEvent) => void)|Middleware>): void;
+
+// -------------------------------------------------------------------
+// baseBinds
+// -------------------------------------------------------------------
+
+/**
+ * Global helper variable that contains the absolute path to the app pb_hooks directory.
+ *
+ * @group PocketBase
+ */
+declare var __hooks: string
+
+// Utility type to exclude the on* hook methods from a type
+// (hooks are separately generated as global methods).
+//
+// See https://www.typescriptlang.org/docs/handbook/2/mapped-types.html#key-remapping-via-as
+type excludeHooks<Type> = {
+    [Property in keyof Type as Exclude<Property, `on${string}`|'cron'>]: Type[Property]
+};
+
+// CoreApp without the on* hook methods
+type CoreApp = excludeHooks<core.App>
+
+// PocketBase without the on* hook methods
+type PocketBase = excludeHooks<pocketbase.PocketBase>
+
+/**
+ * `$app` is the current running PocketBase instance that is globally
+ * available in each .pb.js file.
+ *
+ * _Note that this variable is available only in pb_hooks context._
+ *
+ * @namespace
+ * @group PocketBase
+ */
+declare var $app: PocketBase
+
+/**
+ * `$template` is a global helper to load and cache HTML templates on the fly.
+ *
+ * The templates uses the standard Go [html/template](https://pkg.go.dev/html/template)
+ * and [text/template](https://pkg.go.dev/text/template) package syntax.
+ *
+ * Example:
+ *
+ * ```js
+ * const html = $template.loadFiles(
+ *     "views/layout.html",
+ *     "views/content.html",
+ * ).render({"name": "John"})
+ * ```
+ *
+ * @namespace
+ * @group PocketBase
+ */
+declare var $template: template.Registry
+
+/**
+ * This method is superseded by toString.
+ *
+ * @deprecated
+ * @group PocketBase
+ */
+declare function readerToString(reader: any, maxBytes?: number): string;
+
+/**
+ * toString stringifies the specified value.
+ *
+ * Support optional second maxBytes argument to limit the max read bytes
+ * when the value is a io.Reader (default to 32MB).
+ *
+ * Types that don't have explicit string representation are json serialized.
+ *
+ * Example:
+ *
+ * ```js
+ * // io.Reader
+ * const ex1 = toString(e.request.body)
+ *
+ * // slice of bytes
+ * const ex2 = toString([104 101 108 108 111]) // "hello"
+ *
+ * // null
+ * const ex3 = toString(null) // ""
+ * ```
+ *
+ * @group PocketBase
+ */
+declare function toString(val: any, maxBytes?: number): string;
+
+/**
+ * toBytes converts the specified value into a bytes slice.
+ *
+ * Support optional second maxBytes argument to limit the max read bytes
+ * when the value is a io.Reader (default to 32MB).
+ *
+ * Types that don't have Go slice representation (bool, objects, etc.)
+ * are serialized to UTF8 string and its bytes slice is returned.
+ *
+ * Example:
+ *
+ * ```js
+ * // io.Reader
+ * const ex1 = toBytes(e.request.body)
+ *
+ * // string
+ * const ex2 = toBytes("hello") // [104 101 108 108 111]
+ *
+ * // object (the same as the string '{"test":1}')
+ * const ex3 = toBytes({"test":1}) // [123 34 116 101 115 116 34 58 49 125]
+ *
+ * // null
+ * const ex4 = toBytes(null) // []
+ * ```
+ *
+ * @group PocketBase
+ */
+declare function toBytes(val: any, maxBytes?: number): Array<number>;
+
+/**
+ * sleep pauses the current goroutine for at least the specified user duration (in ms).
+ * A zero or negative duration returns immediately.
+ *
+ * Example:
+ *
+ * ```js
+ * sleep(250) // sleeps for 250ms
+ * ```
+ *
+ * @group PocketBase
+ */
+declare function sleep(milliseconds: number): void;
+
+/**
+ * arrayOf creates a placeholder array of the specified models.
+ * Usually used to populate DB result into an array of models.
+ *
+ * Example:
+ *
+ * ```js
+ * const records = arrayOf(new Record)
+ *
+ * $app.recordQuery("articles").limit(10).all(records)
+ * ```
+ *
+ * @group PocketBase
+ */
+declare function arrayOf<T>(model: T): Array<T>;
+
+/**
+ * DynamicModel creates a new dynamic model with fields from the provided data shape.
+ *
+ * Caveats:
+ * - In order to use 0 as double/float initialization number you have to negate it (`-0`).
+ * - You need to use lowerCamelCase when accessing the model fields (e.g. `model.roles` and not `model.Roles` even if in the model shape and in the DB table the column is capitalized).
+ * - Objects are loaded into types.JSONMap, meaning that they need to be accessed with `get(key)` (e.g. `model.meta.get('something')`).
+ * - For describing nullable types you can use the `null*()` helpers - `nullString()`, `nullInt()`, `nullFloat()`, `nullBool()`, `nullArray()`, `nullObject()`.
+ *
+ * Example:
+ *
+ * ```js
+ * const model = new DynamicModel({
+ *     name:       ""     // or nullString() if nullable
+ *     age:        0,     // or nullInt() if nullable
+ *     totalSpent: -0,    // or nullFloat() if nullable
+ *     active:     false, // or nullBool() if nullable
+ *     Roles:      [],    // or nullArray() if nullable; maps to "Roles" in the DB/JSON but the prop would be accessible via "model.roles"
+ *     meta:       {},    // or nullObject() if nullable
+ * })
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class DynamicModel {
+  [key: string]: any;
+  constructor(shape?: { [key:string]: any })
+}
+
+/**
+ * nullString creates an empty Go string pointer usually used for
+ * describing a **nullable** `DynamicModel` string value.
+ *
+ * @group PocketBase
+ */
+declare function nullString(): string;
+
+/**
+ * nullInt creates an empty Go int64 pointer usually used for
+ * describing a **nullable** `DynamicModel` int value.
+ *
+ * @group PocketBase
+ */
+declare function nullInt(): number;
+
+/**
+ * nullFloat creates an empty Go float64 pointer usually used for
+ * describing a **nullable** `DynamicModel` float value.
+ *
+ * @group PocketBase
+ */
+declare function nullFloat(): number;
+
+/**
+ * nullBool creates an empty Go bool pointer usually used for
+ * describing a **nullable** `DynamicModel` bool value.
+ *
+ * @group PocketBase
+ */
+declare function nullBool(): boolean;
+
+/**
+ * nullArray creates an empty Go types.JSONArray pointer usually used for
+ * describing a **nullable** `DynamicModel` JSON array value.
+ *
+ * @group PocketBase
+ */
+declare function nullArray(): Array<any>;
+
+/**
+ * nullObject creates an empty Go types.JSONMap pointer usually used for
+ * describing a **nullable** `DynamicModel` JSON object value.
+ *
+ * @group PocketBase
+ */
+declare function nullObject(): { get(key:string):any; set(key:string,value:any):void };
+
+interface Context extends context.Context{} // merge
+/**
+ * Context creates a new empty Go context.Context.
+ *
+ * This is usually used as part of some Go transitive bindings.
+ *
+ * Example:
+ *
+ * ```js
+ * const blank = new Context()
+ *
+ * // with single key-value pair
+ * const base = new Context(null, "a", 123)
+ * console.log(base.value("a")) // 123
+ *
+ * // extend with additional key-value pair
+ * const sub = new Context(base, "b", 456)
+ * console.log(sub.value("a")) // 123
+ * console.log(sub.value("b")) // 456
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Context implements context.Context {
+  constructor(parentCtx?: Context, key?: any, value?: any)
+}
+
+/**
+ * Record model class.
+ *
+ * ```js
+ * const collection = $app.findCollectionByNameOrId("article")
+ *
+ * const record = new Record(collection, {
+ *     title: "Lorem ipsum"
+ * })
+ *
+ * // or set field values after the initialization
+ * record.set("description", "...")
+ * ```
+ *
+ * @group PocketBase
+ */
+declare const Record: {
+  new(collection?: core.Collection, data?: { [key:string]: any }): core.Record
+
+  // note: declare as "newable" const due to conflict with the Record TS utility type
+}
+
+interface Collection extends core.Collection{
+  type: "base" | "view" | "auth"
+} // merge
+/**
+ * Collection model class.
+ *
+ * ```js
+ * const collection = new Collection({
+ *     type:       "base",
+ *     name:       "article",
+ *     listRule:   "@request.auth.id != '' || status = 'public'",
+ *     viewRule:   "@request.auth.id != '' || status = 'public'",
+ *     deleteRule: "@request.auth.id != ''",
+ *     fields: [
+ *         {
+ *             name: "title",
+ *             type: "text",
+ *             required: true,
+ *             min: 6,
+ *             max: 100,
+ *         },
+ *         {
+ *             name: "description",
+ *             type: "text",
+ *         },
+ *     ]
+ * })
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Collection implements core.Collection {
+  constructor(data?: Partial<Collection>)
+}
+
+interface FieldsList extends core.FieldsList{} // merge
+/**
+ * FieldsList model class, usually used to define the Collection.fields.
+ *
+ * @group PocketBase
+ */
+declare class FieldsList implements core.FieldsList {
+  constructor(data?: Partial<core.FieldsList>)
+}
+
+interface Field extends core.Field{} // merge
+/**
+ * Field model class, usually used as part of the FieldsList model.
+ *
+ * @group PocketBase
+ */
+declare class Field implements core.Field {
+  constructor(data?: Partial<core.Field>)
+}
+
+interface NumberField extends core.NumberField{} // merge
+/**
+ * {@inheritDoc core.NumberField}
+ *
+ * @group PocketBase
+ */
+declare class NumberField implements core.NumberField {
+  constructor(data?: Partial<core.NumberField>)
+}
+
+interface BoolField extends core.BoolField{} // merge
+/**
+ * {@inheritDoc core.BoolField}
+ *
+ * @group PocketBase
+ */
+declare class BoolField implements core.BoolField {
+  constructor(data?: Partial<core.BoolField>)
+}
+
+interface TextField extends core.TextField{} // merge
+/**
+ * {@inheritDoc core.TextField}
+ *
+ * @group PocketBase
+ */
+declare class TextField implements core.TextField {
+  constructor(data?: Partial<core.TextField>)
+}
+
+interface URLField extends core.URLField{} // merge
+/**
+ * {@inheritDoc core.URLField}
+ *
+ * @group PocketBase
+ */
+declare class URLField implements core.URLField {
+  constructor(data?: Partial<core.URLField>)
+}
+
+interface EmailField extends core.EmailField{} // merge
+/**
+ * {@inheritDoc core.EmailField}
+ *
+ * @group PocketBase
+ */
+declare class EmailField implements core.EmailField {
+  constructor(data?: Partial<core.EmailField>)
+}
+
+interface EditorField extends core.EditorField{} // merge
+/**
+ * {@inheritDoc core.EditorField}
+ *
+ * @group PocketBase
+ */
+declare class EditorField implements core.EditorField {
+  constructor(data?: Partial<core.EditorField>)
+}
+
+interface PasswordField extends core.PasswordField{} // merge
+/**
+ * {@inheritDoc core.PasswordField}
+ *
+ * @group PocketBase
+ */
+declare class PasswordField implements core.PasswordField {
+  constructor(data?: Partial<core.PasswordField>)
+}
+
+interface DateField extends core.DateField{} // merge
+/**
+ * {@inheritDoc core.DateField}
+ *
+ * @group PocketBase
+ */
+declare class DateField implements core.DateField {
+  constructor(data?: Partial<core.DateField>)
+}
+
+interface AutodateField extends core.AutodateField{} // merge
+/**
+ * {@inheritDoc core.AutodateField}
+ *
+ * @group PocketBase
+ */
+declare class AutodateField implements core.AutodateField {
+  constructor(data?: Partial<core.AutodateField>)
+}
+
+interface JSONField extends core.JSONField{} // merge
+/**
+ * {@inheritDoc core.JSONField}
+ *
+ * @group PocketBase
+ */
+declare class JSONField implements core.JSONField {
+  constructor(data?: Partial<core.JSONField>)
+}
+
+interface RelationField extends core.RelationField{} // merge
+/**
+ * {@inheritDoc core.RelationField}
+ *
+ * @group PocketBase
+ */
+declare class RelationField implements core.RelationField {
+  constructor(data?: Partial<core.RelationField>)
+}
+
+interface SelectField extends core.SelectField{} // merge
+/**
+ * {@inheritDoc core.SelectField}
+ *
+ * @group PocketBase
+ */
+declare class SelectField implements core.SelectField {
+  constructor(data?: Partial<core.SelectField>)
+}
+
+interface FileField extends core.FileField{} // merge
+/**
+ * {@inheritDoc core.FileField}
+ *
+ * @group PocketBase
+ */
+declare class FileField implements core.FileField {
+  constructor(data?: Partial<core.FileField>)
+}
+
+interface GeoPointField extends core.GeoPointField{} // merge
+/**
+ * {@inheritDoc core.GeoPointField}
+ *
+ * @group PocketBase
+ */
+declare class GeoPointField implements core.GeoPointField {
+  constructor(data?: Partial<core.GeoPointField>)
+}
+
+interface MailerMessage extends mailer.Message{} // merge
+/**
+ * MailerMessage defines a single email message.
+ *
+ * ```js
+ * const message = new MailerMessage({
+ *     from: {
+ *         address: $app.settings().meta.senderAddress,
+ *         name:    $app.settings().meta.senderName,
+ *     },
+ *     to:      [{address: "test@example.com"}],
+ *     subject: "YOUR_SUBJECT...",
+ *     html:    "YOUR_HTML_BODY...",
+ * })
+ *
+ * $app.newMailClient().send(message)
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class MailerMessage implements mailer.Message {
+  constructor(message?: Partial<mailer.Message>)
+}
+
+interface Command extends cobra.Command{} // merge
+/**
+ * Command defines a single console command.
+ *
+ * Example:
+ *
+ * ```js
+ * const command = new Command({
+ *     use: "hello",
+ *     run: (cmd, args) => { console.log("Hello world!") },
+ * })
+ *
+ * $app.rootCmd.addCommand(command);
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Command implements cobra.Command {
+  constructor(cmd?: Partial<cobra.Command>)
+}
+
+/**
+ * RequestInfo defines a single core.RequestInfo instance, usually used
+ * as part of various filter checks.
+ *
+ * Example:
+ *
+ * ```js
+ * const authRecord = $app.findAuthRecordByEmail("users", "test@example.com")
+ *
+ * const info = new RequestInfo({
+ *     auth:    authRecord,
+ *     body:    {"name": 123},
+ *     headers: {"x-token": "..."},
+ * })
+ *
+ * const record = $app.findFirstRecordByData("articles", "slug", "hello")
+ *
+ * const canAccess = $app.canAccessRecord(record, info, "@request.auth.id != '' && @request.body.name = 123")
+ * ```
+ *
+ * @group PocketBase
+ */
+declare const RequestInfo: {
+  new(info?: Partial<core.RequestInfo>): core.RequestInfo
+
+ // note: declare as "newable" const due to conflict with the RequestInfo TS node type
+}
+
+/**
+ * Middleware defines a single request middleware handler.
+ *
+ * This class is usually used when you want to explicitly specify a priority to your custom route middleware.
+ *
+ * Example:
+ *
+ * ```js
+ * routerUse(new Middleware((e) => {
+ *   console.log(e.request.url.path)
+ *   return e.next()
+ * }, -10))
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Middleware {
+  constructor(
+    func: string|((e: core.RequestEvent) => void),
+    priority?: number,
+    id?: string,
+  )
+}
+
+interface Timezone extends time.Location{} // merge
+/**
+ * Timezone returns the timezone location with the given name.
+ *
+ * The name is expected to be a location name corresponding to a file
+ * in the IANA Time Zone database, such as "America/New_York".
+ *
+ * If the name is "Local", LoadLocation returns Local.
+ *
+ * If the name is "", invalid or "UTC", returns UTC.
+ *
+ * The constructor is equivalent to calling the Go `time.LoadLocation(name)` method.
+ *
+ * Example:
+ *
+ * ```js
+ * const zone = new Timezone("America/New_York")
+ * $app.cron().setTimezone(zone)
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Timezone implements time.Location {
+  constructor(name?: string)
+}
+
+interface DateTime extends types.DateTime{} // merge
+/**
+ * DateTime defines a single DateTime type instance.
+ * The returned date is always represented in UTC.
+ *
+ * Example:
+ *
+ * ```js
+ * const dt0 = new DateTime() // now
+ *
+ * // full datetime string
+ * const dt1 = new DateTime('2023-07-01 00:00:00.000Z')
+ *
+ * // datetime string with default "parse in" timezone location
+ * //
+ * // similar to new DateTime('2023-07-01 00:00:00 +01:00') or new DateTime('2023-07-01 00:00:00 +02:00')
+ * // but accounts for the daylight saving time (DST)
+ * const dt2 = new DateTime('2023-07-01 00:00:00', 'Europe/Amsterdam')
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class DateTime implements types.DateTime {
+  constructor(date?: string, defaultParseInLocation?: string)
+}
+
+interface ValidationError extends ozzo_validation.Error{} // merge
+/**
+ * ValidationError defines a single formatted data validation error,
+ * usually used as part of an error response.
+ *
+ * ```js
+ * new ValidationError("invalid_title", "Title is not valid")
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class ValidationError implements ozzo_validation.Error {
+  constructor(code?: string, message?: string)
+}
+
+interface Cookie extends http.Cookie{} // merge
+/**
+ * A Cookie represents an HTTP cookie as sent in the Set-Cookie header of an
+ * HTTP response.
+ *
+ * Example:
+ *
+ * ```js
+ * routerAdd("POST", "/example", (c) => {
+ *     c.setCookie(new Cookie({
+ *         name:     "example_name",
+ *         value:    "example_value",
+ *         path:     "/",
+ *         domain:   "example.com",
+ *         maxAge:   10,
+ *         secure:   true,
+ *         httpOnly: true,
+ *         sameSite: 3,
+ *     }))
+ *
+ *     return c.redirect(200, "/");
+ * })
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class Cookie implements http.Cookie {
+  constructor(options?: Partial<http.Cookie>)
+}
+
+interface SubscriptionMessage extends subscriptions.Message{} // merge
+/**
+ * SubscriptionMessage defines a realtime subscription payload.
+ *
+ * Example:
+ *
+ * ```js
+ * onRealtimeConnectRequest((e) => {
+ *     e.client.send(new SubscriptionMessage({
+ *         name: "example",
+ *         data: '{"greeting": "Hello world"}'
+ *     }))
+ * })
+ * ```
+ *
+ * @group PocketBase
+ */
+declare class SubscriptionMessage implements subscriptions.Message {
+  constructor(options?: Partial<subscriptions.Message>)
+}
+
+// -------------------------------------------------------------------
+// dbxBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$dbx` defines common utility for working with the DB abstraction.
+ * For examples and guides please check the [Database guide](https://pocketbase.io/docs/js-database).
+ *
+ * @group PocketBase
+ */
+declare namespace $dbx {
+  /**
+   * {@inheritDoc dbx.HashExp}
+   */
+  export function hashExp(pairs: { [key:string]: any }): dbx.Expression
+
+  let _in: dbx._in
+  export { _in as in }
+
+  export let exp:        dbx.newExp
+  export let not:        dbx.not
+  export let and:        dbx.and
+  export let or:         dbx.or
+  export let notIn:      dbx.notIn
+  export let like:       dbx.like
+  export let orLike:     dbx.orLike
+  export let notLike:    dbx.notLike
+  export let orNotLike:  dbx.orNotLike
+  export let exists:     dbx.exists
+  export let notExists:  dbx.notExists
+  export let between:    dbx.between
+  export let notBetween: dbx.notBetween
+}
+
+// -------------------------------------------------------------------
+// mailsBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$mails` defines helpers to send common
+ * auth records emails like verification, password reset, etc.
+ *
+ * @group PocketBase
+ */
+declare namespace $mails {
+  let sendRecordPasswordReset: mails.sendRecordPasswordReset
+  let sendRecordVerification:  mails.sendRecordVerification
+  let sendRecordChangeEmail:   mails.sendRecordChangeEmail
+  let sendRecordOTP:           mails.sendRecordOTP
+  let sendRecordAuthAlert:     mails.sendRecordAuthAlert
+}
+
+// -------------------------------------------------------------------
+// securityBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$security` defines low level helpers for creating
+ * and parsing JWTs, random string generation, AES encryption, etc.
+ *
+ * @group PocketBase
+ */
+declare namespace $security {
+  let randomString:                   security.randomString
+  let randomStringWithAlphabet:       security.randomStringWithAlphabet
+  let randomStringByRegex:            security.randomStringByRegex
+  let pseudorandomString:             security.pseudorandomString
+  let pseudorandomStringWithAlphabet: security.pseudorandomStringWithAlphabet
+  let encrypt:                        security.encrypt
+  let decrypt:                        security.decrypt
+  let hs256:                          security.hs256
+  let hs512:                          security.hs512
+  let equal:                          security.equal
+  let md5:                            security.md5
+  let sha256:                         security.sha256
+  let sha512:                         security.sha512
+
+  /**
+   * {@inheritDoc security.newJWT}
+   */
+  export function createJWT(payload: { [key:string]: any }, signingKey: string, secDuration: number): string
+
+  /**
+   * {@inheritDoc security.parseUnverifiedJWT}
+   */
+  export function parseUnverifiedJWT(token: string): _TygojaDict
+
+  /**
+   * {@inheritDoc security.parseJWT}
+   */
+  export function parseJWT(token: string, verificationKey: string): _TygojaDict
+}
+
+// -------------------------------------------------------------------
+// filesystemBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$filesystem` defines common helpers for working
+ * with the PocketBase filesystem abstraction.
+ *
+ * @group PocketBase
+ */
+declare namespace $filesystem {
+  let fileFromPath:      filesystem.newFileFromPath
+  let fileFromBytes:     filesystem.newFileFromBytes
+  let fileFromMultipart: filesystem.newFileFromMultipart
+
+  /**
+   * fileFromURL creates a new File from the provided url by
+   * downloading the resource and creating a BytesReader.
+   *
+   * Example:
+   *
+   * ```js
+   * // with default max timeout of 120sec
+   * const file1 = $filesystem.fileFromURL("https://...")
+   *
+   * // with custom timeout of 15sec
+   * const file2 = $filesystem.fileFromURL("https://...", 15)
+   * ```
+   */
+  export function fileFromURL(url: string, secTimeout?: number): filesystem.File
+}
+
+// -------------------------------------------------------------------
+// filepathBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$filepath` defines common helpers for manipulating filename
+ * paths in a way compatible with the target operating system-defined file paths.
+ *
+ * @group PocketBase
+ */
+declare namespace $filepath {
+  export let base:      filepath.base
+  export let clean:     filepath.clean
+  export let dir:       filepath.dir
+  export let ext:       filepath.ext
+  export let fromSlash: filepath.fromSlash
+  export let glob:      filepath.glob
+  export let isAbs:     filepath.isAbs
+  export let join:      filepath.join
+  export let match:     filepath.match
+  export let rel:       filepath.rel
+  export let split:     filepath.split
+  export let splitList: filepath.splitList
+  export let toSlash:   filepath.toSlash
+  export let walk:      filepath.walk
+  export let walkDir:   filepath.walkDir
+}
+
+// -------------------------------------------------------------------
+// osBinds
+// -------------------------------------------------------------------
+
+/**
+ * `$os` defines common helpers for working with the OS level primitives
+ * (eg. deleting directories, executing shell commands, etc.).
+ *
+ * @group PocketBase
+ */
+declare namespace $os {
+  /**
+   * Legacy alias for $os.cmd().
+   */
+  export let exec: exec.command
+
+  /**
+   * Prepares an external OS command.
+   *
+   * Example:
+   *
+   * ```js
+   * // prepare the command to execute
+   * const cmd = $os.cmd('ls', '-sl')
+   *
+   * // execute the command and return its standard output as string
+   * const output = toString(cmd.output());
+   * ```
+   */
+  export let cmd: exec.command
+
+  /**
+   * Args hold the command-line arguments, starting with the program name.
+   */
+  export let args: Array<string>
+
+  export let exit:       os.exit
+  export let getenv:     os.getenv
+  export let dirFS:      os.dirFS
+  export let readFile:   os.readFile
+  export let writeFile:  os.writeFile
+  export let stat:       os.stat
+  export let readDir:    os.readDir
+  export let tempDir:    os.tempDir
+  export let truncate:   os.truncate
+  export let getwd:      os.getwd
+  export let mkdir:      os.mkdir
+  export let mkdirAll:   os.mkdirAll
+  export let rename:     os.rename
+  export let remove:     os.remove
+  export let removeAll:  os.removeAll
+  export let openRoot:   os.openRoot
+  export let openInRoot: os.openInRoot
+}
+
+// -------------------------------------------------------------------
+// formsBinds
+// -------------------------------------------------------------------
+
+interface AppleClientSecretCreateForm extends forms.AppleClientSecretCreate{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class AppleClientSecretCreateForm implements forms.AppleClientSecretCreate {
+  constructor(app: CoreApp)
+}
+
+interface RecordUpsertForm extends forms.RecordUpsert{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class RecordUpsertForm implements forms.RecordUpsert {
+  constructor(app: CoreApp, record: core.Record)
+}
+
+interface TestEmailSendForm extends forms.TestEmailSend{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class TestEmailSendForm implements forms.TestEmailSend {
+  constructor(app: CoreApp)
+}
+
+interface TestS3FilesystemForm extends forms.TestS3Filesystem{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class TestS3FilesystemForm implements forms.TestS3Filesystem {
+  constructor(app: CoreApp)
+}
+
+// -------------------------------------------------------------------
+// apisBinds
+// -------------------------------------------------------------------
+
+interface ApiError extends router.ApiError{} // merge
+/**
+ * @inheritDoc
+ *
+ * @group PocketBase
+ */
+declare class ApiError implements router.ApiError {
+  constructor(status?: number, message?: string, data?: any)
+}
+
+interface NotFoundError extends router.ApiError{} // merge
+/**
+ * NotFounderor returns 404 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class NotFoundError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface BadRequestError extends router.ApiError{} // merge
+/**
+ * BadRequestError returns 400 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class BadRequestError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface ForbiddenError extends router.ApiError{} // merge
+/**
+ * ForbiddenError returns 403 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class ForbiddenError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface UnauthorizedError extends router.ApiError{} // merge
+/**
+ * UnauthorizedError returns 401 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class UnauthorizedError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface TooManyRequestsError extends router.ApiError{} // merge
+/**
+ * TooManyRequestsError returns 429 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class TooManyRequestsError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface InternalServerError extends router.ApiError{} // merge
+/**
+ * InternalServerError returns 429 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class InternalServerError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+/**
+ * `$apis` defines commonly used PocketBase api helpers and middlewares.
+ *
+ * @group PocketBase
+ */
+declare namespace $apis {
+  /**
+   * Route handler to serve static directory content (html, js, css, etc.).
+   *
+   * If a file resource is missing and indexFallback is set, the request
+   * will be forwarded to the base index.html (useful for SPA).
+   */
+  export function static(dir: string, indexFallback: boolean): (e: core.RequestEvent) => void
+
+  let requireGuestOnly:              apis.requireGuestOnly
+  let requireAuth:                   apis.requireAuth
+  let requireSuperuserAuth:          apis.requireSuperuserAuth
+  let requireSuperuserOrOwnerAuth:   apis.requireSuperuserOrOwnerAuth
+  let skipSuccessActivityLog:        apis.skipSuccessActivityLog
+  let gzip:                          apis.gzip
+  let bodyLimit:                     apis.bodyLimit
+  let enrichRecord:                  apis.enrichRecord
+  let enrichRecords:                 apis.enrichRecords
+
+  /**
+   * RecordAuthResponse writes standardized json record auth response
+   * into the specified request event.
+   *
+   * The authMethod argument specify the name of the current authentication method (eg. password, oauth2, etc.)
+   * that it is used primarily as an auth identifier during MFA and for login alerts.
+   *
+   * Set authMethod to empty string if you want to ignore the MFA checks and the login alerts
+   * (can be also adjusted additionally via the onRecordAuthRequest hook).
+   */
+  export function recordAuthResponse(e: core.RequestEvent, authRecord: core.Record, authMethod: string, meta?: any): void
+}
+
+// -------------------------------------------------------------------
+// httpClientBinds
+// -------------------------------------------------------------------
+
+// extra FormData overload to prevent TS warnings when used with non File/Blob value.
+interface FormData {
+  append(key:string, value:any): void
+  set(key:string, value:any): void
+}
+
+/**
+ * `$http` defines common methods for working with HTTP requests.
+ *
+ * @group PocketBase
+ */
+declare namespace $http {
+  /**
+   * Sends a single HTTP request.
+   *
+   * Example:
+   *
+   * ```js
+   * const res = $http.send({
+   *     method:  "POST",
+   *     url:     "https://example.com",
+   *     body:    JSON.stringify({"title": "test"}),
+   *     headers: { 'Content-Type': 'application/json' }
+   * })
+   *
+   * console.log(res.statusCode) // the response HTTP status code
+   * console.log(res.headers)    // the response headers (eg. res.headers['X-Custom'][0])
+   * console.log(res.cookies)    // the response cookies (eg. res.cookies.sessionId.value)
+   * console.log(res.body)       // the response body as raw bytes slice
+   * console.log(res.json)       // the response body as parsed json array or map
+   * ```
+   */
+  function send(config: {
+    url:      string,
+    body?:    string|FormData,
+    method?:  string, // default to "GET"
+    headers?: { [key:string]: string },
+    timeout?: number, // default to 120
+
+    // @deprecated please use body instead
+    data?: { [key:string]: any },
+  }): {
+    statusCode: number,
+    headers:    { [key:string]: Array<string> },
+    cookies:    { [key:string]: http.Cookie },
+    json:       any,
+    body:       Array<number>,
+
+    // @deprecated please use toString(result.body) instead
+    raw: string,
+  };
+}
+
+// -------------------------------------------------------------------
+// migrate only
+// -------------------------------------------------------------------
+
+/**
+ * Migrate defines a single migration upgrade/downgrade action.
+ *
+ * _Note that this method is available only in pb_migrations context._
+ *
+ * @group PocketBase
+ */
+declare function migrate(
+  up: (txApp: CoreApp) => void,
+  down?: (txApp: CoreApp) => void
+): void;
+/** @group PocketBase */declare function onBackupCreate(handler: (e: core.BackupEvent) => void): void
+/** @group PocketBase */declare function onBackupRestore(handler: (e: core.BackupEvent) => void): void
+/** @group PocketBase */declare function onBatchRequest(handler: (e: core.BatchRequestEvent) => void): void
+/** @group PocketBase */declare function onBootstrap(handler: (e: core.BootstrapEvent) => void): void
+/** @group PocketBase */declare function onCollectionAfterCreateError(handler: (e: core.CollectionErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterCreateSuccess(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterDeleteError(handler: (e: core.CollectionErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterDeleteSuccess(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterUpdateError(handler: (e: core.CollectionErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionAfterUpdateSuccess(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionCreate(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionCreateExecute(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionCreateRequest(handler: (e: core.CollectionRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionDelete(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionDeleteExecute(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionDeleteRequest(handler: (e: core.CollectionRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionUpdate(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionUpdateExecute(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionUpdateRequest(handler: (e: core.CollectionRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionValidate(handler: (e: core.CollectionEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onCollectionViewRequest(handler: (e: core.CollectionRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionsImportRequest(handler: (e: core.CollectionsImportRequestEvent) => void): void
+/** @group PocketBase */declare function onCollectionsListRequest(handler: (e: core.CollectionsListRequestEvent) => void): void
+/** @group PocketBase */declare function onFileDownloadRequest(handler: (e: core.FileDownloadRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onFileTokenRequest(handler: (e: core.FileTokenRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordAuthAlertSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordEmailChangeSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordOTPSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordPasswordResetSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerRecordVerificationSend(handler: (e: core.MailerRecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onMailerSend(handler: (e: core.MailerEvent) => void): void
+/** @group PocketBase */declare function onModelAfterCreateError(handler: (e: core.ModelErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterCreateSuccess(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterDeleteError(handler: (e: core.ModelErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterDeleteSuccess(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterUpdateError(handler: (e: core.ModelErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelAfterUpdateSuccess(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelCreate(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelCreateExecute(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelDelete(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelDeleteExecute(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelUpdate(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelUpdateExecute(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onModelValidate(handler: (e: core.ModelEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRealtimeConnectRequest(handler: (e: core.RealtimeConnectRequestEvent) => void): void
+/** @group PocketBase */declare function onRealtimeMessageSend(handler: (e: core.RealtimeMessageEvent) => void): void
+/** @group PocketBase */declare function onRealtimeSubscribeRequest(handler: (e: core.RealtimeSubscribeRequestEvent) => void): void
+/** @group PocketBase */declare function onRecordAfterCreateError(handler: (e: core.RecordErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterCreateSuccess(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterDeleteError(handler: (e: core.RecordErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterDeleteSuccess(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterUpdateError(handler: (e: core.RecordErrorEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAfterUpdateSuccess(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthRefreshRequest(handler: (e: core.RecordAuthRefreshRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthRequest(handler: (e: core.RecordAuthRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthWithOAuth2Request(handler: (e: core.RecordAuthWithOAuth2RequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthWithOTPRequest(handler: (e: core.RecordAuthWithOTPRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordAuthWithPasswordRequest(handler: (e: core.RecordAuthWithPasswordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordConfirmEmailChangeRequest(handler: (e: core.RecordConfirmEmailChangeRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordConfirmPasswordResetRequest(handler: (e: core.RecordConfirmPasswordResetRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordConfirmVerificationRequest(handler: (e: core.RecordConfirmVerificationRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordCreate(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordCreateExecute(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordCreateRequest(handler: (e: core.RecordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordDelete(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordDeleteExecute(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordDeleteRequest(handler: (e: core.RecordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordEnrich(handler: (e: core.RecordEnrichEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordRequestEmailChangeRequest(handler: (e: core.RecordRequestEmailChangeRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordRequestOTPRequest(handler: (e: core.RecordCreateOTPRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordRequestPasswordResetRequest(handler: (e: core.RecordRequestPasswordResetRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordRequestVerificationRequest(handler: (e: core.RecordRequestVerificationRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordUpdate(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordUpdateExecute(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordUpdateRequest(handler: (e: core.RecordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordValidate(handler: (e: core.RecordEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordViewRequest(handler: (e: core.RecordRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onRecordsListRequest(handler: (e: core.RecordsListRequestEvent) => void, ...tags: string[]): void
+/** @group PocketBase */declare function onSettingsListRequest(handler: (e: core.SettingsListRequestEvent) => void): void
+/** @group PocketBase */declare function onSettingsReload(handler: (e: core.SettingsReloadEvent) => void): void
+/** @group PocketBase */declare function onSettingsUpdateRequest(handler: (e: core.SettingsUpdateRequestEvent) => void): void
+/** @group PocketBase */declare function onTerminate(handler: (e: core.TerminateEvent) => void): void
+type _TygojaDict = { [key:string | number | symbol]: any; }
+type _TygojaAny = any
+
+/**
+ * Package os provides a platform-independent interface to operating system
+ * functionality. The design is Unix-like, although the error handling is
+ * Go-like; failing calls return values of type error rather than error numbers.
+ * Often, more information is available within the error. For example,
+ * if a call that takes a file name fails, such as [Open] or [Stat], the error
+ * will include the failing file name when printed and will be of type
+ * [*PathError], which may be unpacked for more information.
+ * 
+ * The os interface is intended to be uniform across all operating systems.
+ * Features not generally available appear in the system-specific package syscall.
+ * 
+ * Here is a simple example, opening a file and reading some of it.
+ * 
+ * ```
+ * 	file, err := os.Open("file.go") // For read access.
+ * 	if err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * ```
+ * 
+ * If the open fails, the error string will be self-explanatory, like
+ * 
+ * ```
+ * 	open file.go: no such file or directory
+ * ```
+ * 
+ * The file's data can then be read into a slice of bytes. Read and
+ * Write take their byte counts from the length of the argument slice.
+ * 
+ * ```
+ * 	data := make([]byte, 100)
+ * 	count, err := file.Read(data)
+ * 	if err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * 	fmt.Printf("read %d bytes: %q\n", count, data[:count])
+ * ```
+ * 
+ * # Concurrency
+ * 
+ * The methods of [File] correspond to file system operations. All are
+ * safe for concurrent use. The maximum number of concurrent
+ * operations on a File may be limited by the OS or the system. The
+ * number should be high, but exceeding it may degrade performance or
+ * cause other issues.
+ */
+namespace os {
+ interface readdirMode extends Number{}
+ interface File {
+  /**
+   * Readdir reads the contents of the directory associated with file and
+   * returns a slice of up to n [FileInfo] values, as would be returned
+   * by [Lstat], in directory order. Subsequent calls on the same file will yield
+   * further FileInfos.
+   * 
+   * If n > 0, Readdir returns at most n FileInfo structures. In this case, if
+   * Readdir returns an empty slice, it will return a non-nil error
+   * explaining why. At the end of a directory, the error is [io.EOF].
+   * 
+   * If n <= 0, Readdir returns all the FileInfo from the directory in
+   * a single slice. In this case, if Readdir succeeds (reads all
+   * the way to the end of the directory), it returns the slice and a
+   * nil error. If it encounters an error before the end of the
+   * directory, Readdir returns the FileInfo read until that point
+   * and a non-nil error.
+   * 
+   * Most clients are better served by the more efficient ReadDir method.
+   */
+  readdir(n: number): Array<FileInfo>
+ }
+ interface File {
+  /**
+   * Readdirnames reads the contents of the directory associated with file
+   * and returns a slice of up to n names of files in the directory,
+   * in directory order. Subsequent calls on the same file will yield
+   * further names.
+   * 
+   * If n > 0, Readdirnames returns at most n names. In this case, if
+   * Readdirnames returns an empty slice, it will return a non-nil error
+   * explaining why. At the end of a directory, the error is [io.EOF].
+   * 
+   * If n <= 0, Readdirnames returns all the names from the directory in
+   * a single slice. In this case, if Readdirnames succeeds (reads all
+   * the way to the end of the directory), it returns the slice and a
+   * nil error. If it encounters an error before the end of the
+   * directory, Readdirnames returns the names read until that point and
+   * a non-nil error.
+   */
+  readdirnames(n: number): Array<string>
+ }
+ /**
+  * A DirEntry is an entry read from a directory
+  * (using the [ReadDir] function or a [File.ReadDir] method).
+  */
+ interface DirEntry extends fs.DirEntry{}
+ interface File {
+  /**
+   * ReadDir reads the contents of the directory associated with the file f
+   * and returns a slice of [DirEntry] values in directory order.
+   * Subsequent calls on the same file will yield later DirEntry records in the directory.
+   * 
+   * If n > 0, ReadDir returns at most n DirEntry records.
+   * In this case, if ReadDir returns an empty slice, it will return an error explaining why.
+   * At the end of a directory, the error is [io.EOF].
+   * 
+   * If n <= 0, ReadDir returns all the DirEntry records remaining in the directory.
+   * When it succeeds, it returns a nil error (not io.EOF).
+   */
+  readDir(n: number): Array<DirEntry>
+ }
+ interface readDir {
+  /**
+   * ReadDir reads the named directory,
+   * returning all its directory entries sorted by filename.
+   * If an error occurs reading the directory,
+   * ReadDir returns the entries it was able to read before the error,
+   * along with the error.
+   */
+  (name: string): Array<DirEntry>
+ }
+ interface copyFS {
+  /**
+   * CopyFS copies the file system fsys into the directory dir,
+   * creating dir if necessary.
+   * 
+   * Files are created with mode 0o666 plus any execute permissions
+   * from the source, and directories are created with mode 0o777
+   * (before umask).
+   * 
+   * CopyFS will not overwrite existing files. If a file name in fsys
+   * already exists in the destination, CopyFS will return an error
+   * such that errors.Is(err, fs.ErrExist) will be true.
+   * 
+   * Symbolic links in fsys are not supported. A *PathError with Err set
+   * to ErrInvalid is returned when copying from a symbolic link.
+   * 
+   * Symbolic links in dir are followed.
+   * 
+   * New files added to fsys (including if dir is a subdirectory of fsys)
+   * while CopyFS is running are not guaranteed to be copied.
+   * 
+   * Copying stops at and returns the first error encountered.
+   */
+  (dir: string, fsys: fs.FS): void
+ }
+ /**
+  * Auxiliary information if the File describes a directory
+  */
+ interface dirInfo {
+ }
+ interface expand {
+  /**
+   * Expand replaces ${var} or $var in the string based on the mapping function.
+   * For example, [os.ExpandEnv](s) is equivalent to [os.Expand](s, [os.Getenv]).
+   */
+  (s: string, mapping: (_arg0: string) => string): string
+ }
+ interface expandEnv {
+  /**
+   * ExpandEnv replaces ${var} or $var in the string according to the values
+   * of the current environment variables. References to undefined
+   * variables are replaced by the empty string.
+   */
+  (s: string): string
+ }
+ interface getenv {
+  /**
+   * Getenv retrieves the value of the environment variable named by the key.
+   * It returns the value, which will be empty if the variable is not present.
+   * To distinguish between an empty value and an unset value, use [LookupEnv].
+   */
+  (key: string): string
+ }
+ interface lookupEnv {
+  /**
+   * LookupEnv retrieves the value of the environment variable named
+   * by the key. If the variable is present in the environment the
+   * value (which may be empty) is returned and the boolean is true.
+   * Otherwise the returned value will be empty and the boolean will
+   * be false.
+   */
+  (key: string): [string, boolean]
+ }
+ interface setenv {
+  /**
+   * Setenv sets the value of the environment variable named by the key.
+   * It returns an error, if any.
+   */
+  (key: string, value: string): void
+ }
+ interface unsetenv {
+  /**
+   * Unsetenv unsets a single environment variable.
+   */
+  (key: string): void
+ }
+ interface clearenv {
+  /**
+   * Clearenv deletes all environment variables.
+   */
+  (): void
+ }
+ interface environ {
+  /**
+   * Environ returns a copy of strings representing the environment,
+   * in the form "key=value".
+   */
+  (): Array<string>
+ }
+ interface timeout {
+  [key:string]: any;
+  timeout(): boolean
+ }
+ /**
+  * PathError records an error and the operation and file path that caused it.
+  */
+ interface PathError extends fs.PathError{}
+ /**
+  * SyscallError records an error from a specific system call.
+  */
+ interface SyscallError {
+  syscall: string
+  err: Error
+ }
+ interface SyscallError {
+  error(): string
+ }
+ interface SyscallError {
+  unwrap(): void
+ }
+ interface SyscallError {
+  /**
+   * Timeout reports whether this error represents a timeout.
+   */
+  timeout(): boolean
+ }
+ interface newSyscallError {
+  /**
+   * NewSyscallError returns, as an error, a new [SyscallError]
+   * with the given system call name and error details.
+   * As a convenience, if err is nil, NewSyscallError returns nil.
+   */
+  (syscall: string, err: Error): void
+ }
+ interface isExist {
+  /**
+   * IsExist returns a boolean indicating whether its argument is known to report
+   * that a file or directory already exists. It is satisfied by [ErrExist] as
+   * well as some syscall errors.
+   * 
+   * This function predates [errors.Is]. It only supports errors returned by
+   * the os package. New code should use errors.Is(err, fs.ErrExist).
+   */
+  (err: Error): boolean
+ }
+ interface isNotExist {
+  /**
+   * IsNotExist returns a boolean indicating whether its argument is known to
+   * report that a file or directory does not exist. It is satisfied by
+   * [ErrNotExist] as well as some syscall errors.
+   * 
+   * This function predates [errors.Is]. It only supports errors returned by
+   * the os package. New code should use errors.Is(err, fs.ErrNotExist).
+   */
+  (err: Error): boolean
+ }
+ interface isPermission {
+  /**
+   * IsPermission returns a boolean indicating whether its argument is known to
+   * report that permission is denied. It is satisfied by [ErrPermission] as well
+   * as some syscall errors.
+   * 
+   * This function predates [errors.Is]. It only supports errors returned by
+   * the os package. New code should use errors.Is(err, fs.ErrPermission).
+   */
+  (err: Error): boolean
+ }
+ interface isTimeout {
+  /**
+   * IsTimeout returns a boolean indicating whether its argument is known
+   * to report that a timeout occurred.
+   * 
+   * This function predates [errors.Is], and the notion of whether an
+   * error indicates a timeout can be ambiguous. For example, the Unix
+   * error EWOULDBLOCK sometimes indicates a timeout and sometimes does not.
+   * New code should use errors.Is with a value appropriate to the call
+   * returning the error, such as [os.ErrDeadlineExceeded].
+   */
+  (err: Error): boolean
+ }
+ interface syscallErrorType extends syscall.Errno{}
+ interface processMode extends Number{}
+ interface processStatus extends Number{}
+ /**
+  * Process stores the information about a process created by [StartProcess].
+  */
+ interface Process {
+  pid: number
+ }
+ /**
+  * ProcAttr holds the attributes that will be applied to a new process
+  * started by StartProcess.
+  */
+ interface ProcAttr {
+  /**
+   * If Dir is non-empty, the child changes into the directory before
+   * creating the process.
+   */
+  dir: string
+  /**
+   * If Env is non-nil, it gives the environment variables for the
+   * new process in the form returned by Environ.
+   * If it is nil, the result of Environ will be used.
+   */
+  env: Array<string>
+  /**
+   * Files specifies the open files inherited by the new process. The
+   * first three entries correspond to standard input, standard output, and
+   * standard error. An implementation may support additional entries,
+   * depending on the underlying operating system. A nil entry corresponds
+   * to that file being closed when the process starts.
+   * On Unix systems, StartProcess will change these File values
+   * to blocking mode, which means that SetDeadline will stop working
+   * and calling Close will not interrupt a Read or Write.
+   */
+  files: Array<(File | undefined)>
+  /**
+   * Operating system-specific process creation attributes.
+   * Note that setting this field means that your program
+   * may not execute properly or even compile on some
+   * operating systems.
+   */
+  sys?: syscall.SysProcAttr
+ }
+ /**
+  * A Signal represents an operating system signal.
+  * The usual underlying implementation is operating system-dependent:
+  * on Unix it is syscall.Signal.
+  */
+ interface Signal {
+  [key:string]: any;
+  string(): string
+  signal(): void // to distinguish from other Stringers
+ }
+ interface getpid {
+  /**
+   * Getpid returns the process id of the caller.
+   */
+  (): number
+ }
+ interface getppid {
+  /**
+   * Getppid returns the process id of the caller's parent.
+   */
+  (): number
+ }
+ interface findProcess {
+  /**
+   * FindProcess looks for a running process by its pid.
+   * 
+   * The [Process] it returns can be used to obtain information
+   * about the underlying operating system process.
+   * 
+   * On Unix systems, FindProcess always succeeds and returns a Process
+   * for the given pid, regardless of whether the process exists. To test whether
+   * the process actually exists, see whether p.Signal(syscall.Signal(0)) reports
+   * an error.
+   */
+  (pid: number): (Process)
+ }
+ interface startProcess {
+  /**
+   * StartProcess starts a new process with the program, arguments and attributes
+   * specified by name, argv and attr. The argv slice will become [os.Args] in the
+   * new process, so it normally starts with the program name.
+   * 
+   * If the calling goroutine has locked the operating system thread
+   * with [runtime.LockOSThread] and modified any inheritable OS-level
+   * thread state (for example, Linux or Plan 9 name spaces), the new
+   * process will inherit the caller's thread state.
+   * 
+   * StartProcess is a low-level interface. The [os/exec] package provides
+   * higher-level interfaces.
+   * 
+   * If there is an error, it will be of type [*PathError].
+   */
+  (name: string, argv: Array<string>, attr: ProcAttr): (Process)
+ }
+ interface Process {
+  /**
+   * Release releases any resources associated with the [Process] p,
+   * rendering it unusable in the future.
+   * Release only needs to be called if [Process.Wait] is not.
+   */
+  release(): void
+ }
+ interface Process {
+  /**
+   * Kill causes the [Process] to exit immediately. Kill does not wait until
+   * the Process has actually exited. This only kills the Process itself,
+   * not any other processes it may have started.
+   */
+  kill(): void
+ }
+ interface Process {
+  /**
+   * Wait waits for the [Process] to exit, and then returns a
+   * ProcessState describing its status and an error, if any.
+   * Wait releases any resources associated with the Process.
+   * On most operating systems, the Process must be a child
+   * of the current process or an error will be returned.
+   */
+  wait(): (ProcessState)
+ }
+ interface Process {
+  /**
+   * Signal sends a signal to the [Process].
+   * Sending [Interrupt] on Windows is not implemented.
+   */
+  signal(sig: Signal): void
+ }
+ interface ProcessState {
+  /**
+   * UserTime returns the user CPU time of the exited process and its children.
+   */
+  userTime(): time.Duration
+ }
+ interface ProcessState {
+  /**
+   * SystemTime returns the system CPU time of the exited process and its children.
+   */
+  systemTime(): time.Duration
+ }
+ interface ProcessState {
+  /**
+   * Exited reports whether the program has exited.
+   * On Unix systems this reports true if the program exited due to calling exit,
+   * but false if the program terminated due to a signal.
+   */
+  exited(): boolean
+ }
+ interface ProcessState {
+  /**
+   * Success reports whether the program exited successfully,
+   * such as with exit status 0 on Unix.
+   */
+  success(): boolean
+ }
+ interface ProcessState {
+  /**
+   * Sys returns system-dependent exit information about
+   * the process. Convert it to the appropriate underlying
+   * type, such as [syscall.WaitStatus] on Unix, to access its contents.
+   */
+  sys(): any
+ }
+ interface ProcessState {
+  /**
+   * SysUsage returns system-dependent resource usage information about
+   * the exited process. Convert it to the appropriate underlying
+   * type, such as [*syscall.Rusage] on Unix, to access its contents.
+   * (On Unix, *syscall.Rusage matches struct rusage as defined in the
+   * getrusage(2) manual page.)
+   */
+  sysUsage(): any
+ }
+ /**
+  * ProcessState stores information about a process, as reported by Wait.
+  */
+ interface ProcessState {
+ }
+ interface ProcessState {
+  /**
+   * Pid returns the process id of the exited process.
+   */
+  pid(): number
+ }
+ interface ProcessState {
+  string(): string
+ }
+ interface ProcessState {
+  /**
+   * ExitCode returns the exit code of the exited process, or -1
+   * if the process hasn't exited or was terminated by a signal.
+   */
+  exitCode(): number
+ }
+ interface executable {
+  /**
+   * Executable returns the path name for the executable that started
+   * the current process. There is no guarantee that the path is still
+   * pointing to the correct executable. If a symlink was used to start
+   * the process, depending on the operating system, the result might
+   * be the symlink or the path it pointed to. If a stable result is
+   * needed, [path/filepath.EvalSymlinks] might help.
+   * 
+   * Executable returns an absolute path unless an error occurred.
+   * 
+   * The main use case is finding resources located relative to an
+   * executable.
+   */
+  (): string
+ }
+ interface File {
+  /**
+   * Name returns the name of the file as presented to Open.
+   * 
+   * It is safe to call Name after [Close].
+   */
+  name(): string
+ }
+ /**
+  * LinkError records an error during a link or symlink or rename
+  * system call and the paths that caused it.
+  */
+ interface LinkError {
+  op: string
+  old: string
+  new: string
+  err: Error
+ }
+ interface LinkError {
+  error(): string
+ }
+ interface LinkError {
+  unwrap(): void
+ }
+ interface File {
+  /**
+   * Read reads up to len(b) bytes from the File and stores them in b.
+   * It returns the number of bytes read and any error encountered.
+   * At end of file, Read returns 0, io.EOF.
+   */
+  read(b: string|Array<number>): number
+ }
+ interface File {
+  /**
+   * ReadAt reads len(b) bytes from the File starting at byte offset off.
+   * It returns the number of bytes read and the error, if any.
+   * ReadAt always returns a non-nil error when n < len(b).
+   * At end of file, that error is io.EOF.
+   */
+  readAt(b: string|Array<number>, off: number): number
+ }
+ interface File {
+  /**
+   * ReadFrom implements io.ReaderFrom.
+   */
+  readFrom(r: io.Reader): number
+ }
+ /**
+  * noReadFrom can be embedded alongside another type to
+  * hide the ReadFrom method of that other type.
+  */
+ interface noReadFrom {
+ }
+ interface noReadFrom {
+  /**
+   * ReadFrom hides another ReadFrom method.
+   * It should never be called.
+   */
+  readFrom(_arg0: io.Reader): number
+ }
+ /**
+  * fileWithoutReadFrom implements all the methods of *File other
+  * than ReadFrom. This is used to permit ReadFrom to call io.Copy
+  * without leading to a recursive call to ReadFrom.
+  */
+ type _sJTEwYC = noReadFrom&File
+ interface fileWithoutReadFrom extends _sJTEwYC {
+ }
+ interface File {
+  /**
+   * Write writes len(b) bytes from b to the File.
+   * It returns the number of bytes written and an error, if any.
+   * Write returns a non-nil error when n != len(b).
+   */
+  write(b: string|Array<number>): number
+ }
+ interface File {
+  /**
+   * WriteAt writes len(b) bytes to the File starting at byte offset off.
+   * It returns the number of bytes written and an error, if any.
+   * WriteAt returns a non-nil error when n != len(b).
+   * 
+   * If file was opened with the O_APPEND flag, WriteAt returns an error.
+   */
+  writeAt(b: string|Array<number>, off: number): number
+ }
+ interface File {
+  /**
+   * WriteTo implements io.WriterTo.
+   */
+  writeTo(w: io.Writer): number
+ }
+ /**
+  * noWriteTo can be embedded alongside another type to
+  * hide the WriteTo method of that other type.
+  */
+ interface noWriteTo {
+ }
+ interface noWriteTo {
+  /**
+   * WriteTo hides another WriteTo method.
+   * It should never be called.
+   */
+  writeTo(_arg0: io.Writer): number
+ }
+ /**
+  * fileWithoutWriteTo implements all the methods of *File other
+  * than WriteTo. This is used to permit WriteTo to call io.Copy
+  * without leading to a recursive call to WriteTo.
+  */
+ type _sKjNhhA = noWriteTo&File
+ interface fileWithoutWriteTo extends _sKjNhhA {
+ }
+ interface File {
+  /**
+   * Seek sets the offset for the next Read or Write on file to offset, interpreted
+   * according to whence: 0 means relative to the origin of the file, 1 means
+   * relative to the current offset, and 2 means relative to the end.
+   * It returns the new offset and an error, if any.
+   * The behavior of Seek on a file opened with O_APPEND is not specified.
+   */
+  seek(offset: number, whence: number): number
+ }
+ interface File {
+  /**
+   * WriteString is like Write, but writes the contents of string s rather than
+   * a slice of bytes.
+   */
+  writeString(s: string): number
+ }
+ interface mkdir {
+  /**
+   * Mkdir creates a new directory with the specified name and permission
+   * bits (before umask).
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string, perm: FileMode): void
+ }
+ interface chdir {
+  /**
+   * Chdir changes the current working directory to the named directory.
+   * If there is an error, it will be of type *PathError.
+   */
+  (dir: string): void
+ }
+ interface open {
+  /**
+   * Open opens the named file for reading. If successful, methods on
+   * the returned file can be used for reading; the associated file
+   * descriptor has mode O_RDONLY.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string): (File)
+ }
+ interface create {
+  /**
+   * Create creates or truncates the named file. If the file already exists,
+   * it is truncated. If the file does not exist, it is created with mode 0o666
+   * (before umask). If successful, methods on the returned File can
+   * be used for I/O; the associated file descriptor has mode O_RDWR.
+   * The directory containing the file must already exist.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string): (File)
+ }
+ interface openFile {
+  /**
+   * OpenFile is the generalized open call; most users will use Open
+   * or Create instead. It opens the named file with specified flag
+   * (O_RDONLY etc.). If the file does not exist, and the O_CREATE flag
+   * is passed, it is created with mode perm (before umask);
+   * the containing directory must exist. If successful,
+   * methods on the returned File can be used for I/O.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string, flag: number, perm: FileMode): (File)
+ }
+ interface rename {
+  /**
+   * Rename renames (moves) oldpath to newpath.
+   * If newpath already exists and is not a directory, Rename replaces it.
+   * If newpath already exists and is a directory, Rename returns an error.
+   * OS-specific restrictions may apply when oldpath and newpath are in different directories.
+   * Even within the same directory, on non-Unix platforms Rename is not an atomic operation.
+   * If there is an error, it will be of type *LinkError.
+   */
+  (oldpath: string, newpath: string): void
+ }
+ interface readlink {
+  /**
+   * Readlink returns the destination of the named symbolic link.
+   * If there is an error, it will be of type *PathError.
+   * 
+   * If the link destination is relative, Readlink returns the relative path
+   * without resolving it to an absolute one.
+   */
+  (name: string): string
+ }
+ interface tempDir {
+  /**
+   * TempDir returns the default directory to use for temporary files.
+   * 
+   * On Unix systems, it returns $TMPDIR if non-empty, else /tmp.
+   * On Windows, it uses GetTempPath, returning the first non-empty
+   * value from %TMP%, %TEMP%, %USERPROFILE%, or the Windows directory.
+   * On Plan 9, it returns /tmp.
+   * 
+   * The directory is neither guaranteed to exist nor have accessible
+   * permissions.
+   */
+  (): string
+ }
+ interface userCacheDir {
+  /**
+   * UserCacheDir returns the default root directory to use for user-specific
+   * cached data. Users should create their own application-specific subdirectory
+   * within this one and use that.
+   * 
+   * On Unix systems, it returns $XDG_CACHE_HOME as specified by
+   * https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html if
+   * non-empty, else $HOME/.cache.
+   * On Darwin, it returns $HOME/Library/Caches.
+   * On Windows, it returns %LocalAppData%.
+   * On Plan 9, it returns $home/lib/cache.
+   * 
+   * If the location cannot be determined (for example, $HOME is not defined) or
+   * the path in $XDG_CACHE_HOME is relative, then it will return an error.
+   */
+  (): string
+ }
+ interface userConfigDir {
+  /**
+   * UserConfigDir returns the default root directory to use for user-specific
+   * configuration data. Users should create their own application-specific
+   * subdirectory within this one and use that.
+   * 
+   * On Unix systems, it returns $XDG_CONFIG_HOME as specified by
+   * https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html if
+   * non-empty, else $HOME/.config.
+   * On Darwin, it returns $HOME/Library/Application Support.
+   * On Windows, it returns %AppData%.
+   * On Plan 9, it returns $home/lib.
+   * 
+   * If the location cannot be determined (for example, $HOME is not defined) or
+   * the path in $XDG_CONFIG_HOME is relative, then it will return an error.
+   */
+  (): string
+ }
+ interface userHomeDir {
+  /**
+   * UserHomeDir returns the current user's home directory.
+   * 
+   * On Unix, including macOS, it returns the $HOME environment variable.
+   * On Windows, it returns %USERPROFILE%.
+   * On Plan 9, it returns the $home environment variable.
+   * 
+   * If the expected variable is not set in the environment, UserHomeDir
+   * returns either a platform-specific default value or a non-nil error.
+   */
+  (): string
+ }
+ interface chmod {
+  /**
+   * Chmod changes the mode of the named file to mode.
+   * If the file is a symbolic link, it changes the mode of the link's target.
+   * If there is an error, it will be of type *PathError.
+   * 
+   * A different subset of the mode bits are used, depending on the
+   * operating system.
+   * 
+   * On Unix, the mode's permission bits, ModeSetuid, ModeSetgid, and
+   * ModeSticky are used.
+   * 
+   * On Windows, only the 0o200 bit (owner writable) of mode is used; it
+   * controls whether the file's read-only attribute is set or cleared.
+   * The other bits are currently unused. For compatibility with Go 1.12
+   * and earlier, use a non-zero mode. Use mode 0o400 for a read-only
+   * file and 0o600 for a readable+writable file.
+   * 
+   * On Plan 9, the mode's permission bits, ModeAppend, ModeExclusive,
+   * and ModeTemporary are used.
+   */
+  (name: string, mode: FileMode): void
+ }
+ interface File {
+  /**
+   * Chmod changes the mode of the file to mode.
+   * If there is an error, it will be of type *PathError.
+   */
+  chmod(mode: FileMode): void
+ }
+ interface File {
+  /**
+   * SetDeadline sets the read and write deadlines for a File.
+   * It is equivalent to calling both SetReadDeadline and SetWriteDeadline.
+   * 
+   * Only some kinds of files support setting a deadline. Calls to SetDeadline
+   * for files that do not support deadlines will return ErrNoDeadline.
+   * On most systems ordinary files do not support deadlines, but pipes do.
+   * 
+   * A deadline is an absolute time after which I/O operations fail with an
+   * error instead of blocking. The deadline applies to all future and pending
+   * I/O, not just the immediately following call to Read or Write.
+   * After a deadline has been exceeded, the connection can be refreshed
+   * by setting a deadline in the future.
+   * 
+   * If the deadline is exceeded a call to Read or Write or to other I/O
+   * methods will return an error that wraps ErrDeadlineExceeded.
+   * This can be tested using errors.Is(err, os.ErrDeadlineExceeded).
+   * That error implements the Timeout method, and calling the Timeout
+   * method will return true, but there are other possible errors for which
+   * the Timeout will return true even if the deadline has not been exceeded.
+   * 
+   * An idle timeout can be implemented by repeatedly extending
+   * the deadline after successful Read or Write calls.
+   * 
+   * A zero value for t means I/O operations will not time out.
+   */
+  setDeadline(t: time.Time): void
+ }
+ interface File {
+  /**
+   * SetReadDeadline sets the deadline for future Read calls and any
+   * currently-blocked Read call.
+   * A zero value for t means Read will not time out.
+   * Not all files support setting deadlines; see SetDeadline.
+   */
+  setReadDeadline(t: time.Time): void
+ }
+ interface File {
+  /**
+   * SetWriteDeadline sets the deadline for any future Write calls and any
+   * currently-blocked Write call.
+   * Even if Write times out, it may return n > 0, indicating that
+   * some of the data was successfully written.
+   * A zero value for t means Write will not time out.
+   * Not all files support setting deadlines; see SetDeadline.
+   */
+  setWriteDeadline(t: time.Time): void
+ }
+ interface File {
+  /**
+   * SyscallConn returns a raw file.
+   * This implements the syscall.Conn interface.
+   */
+  syscallConn(): syscall.RawConn
+ }
+ interface dirFS {
+  /**
+   * DirFS returns a file system (an fs.FS) for the tree of files rooted at the directory dir.
+   * 
+   * Note that DirFS("/prefix") only guarantees that the Open calls it makes to the
+   * operating system will begin with "/prefix": DirFS("/prefix").Open("file") is the
+   * same as os.Open("/prefix/file"). So if /prefix/file is a symbolic link pointing outside
+   * the /prefix tree, then using DirFS does not stop the access any more than using
+   * os.Open does. Additionally, the root of the fs.FS returned for a relative path,
+   * DirFS("prefix"), will be affected by later calls to Chdir. DirFS is therefore not
+   * a general substitute for a chroot-style security mechanism when the directory tree
+   * contains arbitrary content.
+   * 
+   * Use [Root.FS] to obtain a fs.FS that prevents escapes from the tree via symbolic links.
+   * 
+   * The directory dir must not be "".
+   * 
+   * The result implements [io/fs.StatFS], [io/fs.ReadFileFS] and
+   * [io/fs.ReadDirFS].
+   */
+  (dir: string): fs.FS
+ }
+ interface dirFS extends String{}
+ interface dirFS {
+  open(name: string): fs.File
+ }
+ interface dirFS {
+  /**
+   * The ReadFile method calls the [ReadFile] function for the file
+   * with the given name in the directory. The function provides
+   * robust handling for small files and special file systems.
+   * Through this method, dirFS implements [io/fs.ReadFileFS].
+   */
+  readFile(name: string): string|Array<number>
+ }
+ interface dirFS {
+  /**
+   * ReadDir reads the named directory, returning all its directory entries sorted
+   * by filename. Through this method, dirFS implements [io/fs.ReadDirFS].
+   */
+  readDir(name: string): Array<DirEntry>
+ }
+ interface dirFS {
+  stat(name: string): fs.FileInfo
+ }
+ interface readFile {
+  /**
+   * ReadFile reads the named file and returns the contents.
+   * A successful call returns err == nil, not err == EOF.
+   * Because ReadFile reads the whole file, it does not treat an EOF from Read
+   * as an error to be reported.
+   */
+  (name: string): string|Array<number>
+ }
+ interface writeFile {
+  /**
+   * WriteFile writes data to the named file, creating it if necessary.
+   * If the file does not exist, WriteFile creates it with permissions perm (before umask);
+   * otherwise WriteFile truncates it before writing, without changing permissions.
+   * Since WriteFile requires multiple system calls to complete, a failure mid-operation
+   * can leave the file in a partially written state.
+   */
+  (name: string, data: string|Array<number>, perm: FileMode): void
+ }
+ interface File {
+  /**
+   * Close closes the [File], rendering it unusable for I/O.
+   * On files that support [File.SetDeadline], any pending I/O operations will
+   * be canceled and return immediately with an [ErrClosed] error.
+   * Close will return an error if it has already been called.
+   */
+  close(): void
+ }
+ interface chown {
+  /**
+   * Chown changes the numeric uid and gid of the named file.
+   * If the file is a symbolic link, it changes the uid and gid of the link's target.
+   * A uid or gid of -1 means to not change that value.
+   * If there is an error, it will be of type [*PathError].
+   * 
+   * On Windows or Plan 9, Chown always returns the [syscall.EWINDOWS] or
+   * EPLAN9 error, wrapped in *PathError.
+   */
+  (name: string, uid: number, gid: number): void
+ }
+ interface lchown {
+  /**
+   * Lchown changes the numeric uid and gid of the named file.
+   * If the file is a symbolic link, it changes the uid and gid of the link itself.
+   * If there is an error, it will be of type [*PathError].
+   * 
+   * On Windows, it always returns the [syscall.EWINDOWS] error, wrapped
+   * in *PathError.
+   */
+  (name: string, uid: number, gid: number): void
+ }
+ interface File {
+  /**
+   * Chown changes the numeric uid and gid of the named file.
+   * If there is an error, it will be of type [*PathError].
+   * 
+   * On Windows, it always returns the [syscall.EWINDOWS] error, wrapped
+   * in *PathError.
+   */
+  chown(uid: number, gid: number): void
+ }
+ interface File {
+  /**
+   * Truncate changes the size of the file.
+   * It does not change the I/O offset.
+   * If there is an error, it will be of type [*PathError].
+   */
+  truncate(size: number): void
+ }
+ interface File {
+  /**
+   * Sync commits the current contents of the file to stable storage.
+   * Typically, this means flushing the file system's in-memory copy
+   * of recently written data to disk.
+   */
+  sync(): void
+ }
+ interface chtimes {
+  /**
+   * Chtimes changes the access and modification times of the named
+   * file, similar to the Unix utime() or utimes() functions.
+   * A zero [time.Time] value will leave the corresponding file time unchanged.
+   * 
+   * The underlying filesystem may truncate or round the values to a
+   * less precise time unit.
+   * If there is an error, it will be of type [*PathError].
+   */
+  (name: string, atime: time.Time, mtime: time.Time): void
+ }
+ interface File {
+  /**
+   * Chdir changes the current working directory to the file,
+   * which must be a directory.
+   * If there is an error, it will be of type [*PathError].
+   */
+  chdir(): void
+ }
+ /**
+  * file is the real representation of *File.
+  * The extra level of indirection ensures that no clients of os
+  * can overwrite this data, which could cause the finalizer
+  * to close the wrong file descriptor.
+  */
+ interface file {
+ }
+ interface File {
+  /**
+   * Fd returns the integer Unix file descriptor referencing the open file.
+   * If f is closed, the file descriptor becomes invalid.
+   * If f is garbage collected, a finalizer may close the file descriptor,
+   * making it invalid; see [runtime.SetFinalizer] for more information on when
+   * a finalizer might be run. On Unix systems this will cause the [File.SetDeadline]
+   * methods to stop working.
+   * Because file descriptors can be reused, the returned file descriptor may
+   * only be closed through the [File.Close] method of f, or by its finalizer during
+   * garbage collection. Otherwise, during garbage collection the finalizer
+   * may close an unrelated file descriptor with the same (reused) number.
+   * 
+   * As an alternative, see the f.SyscallConn method.
+   */
+  fd(): number
+ }
+ interface newFile {
+  /**
+   * NewFile returns a new File with the given file descriptor and
+   * name. The returned value will be nil if fd is not a valid file
+   * descriptor. On Unix systems, if the file descriptor is in
+   * non-blocking mode, NewFile will attempt to return a pollable File
+   * (one for which the SetDeadline methods work).
+   * 
+   * After passing it to NewFile, fd may become invalid under the same
+   * conditions described in the comments of the Fd method, and the same
+   * constraints apply.
+   */
+  (fd: number, name: string): (File)
+ }
+ /**
+  * newFileKind describes the kind of file to newFile.
+  */
+ interface newFileKind extends Number{}
+ interface truncate {
+  /**
+   * Truncate changes the size of the named file.
+   * If the file is a symbolic link, it changes the size of the link's target.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string, size: number): void
+ }
+ interface remove {
+  /**
+   * Remove removes the named file or (empty) directory.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string): void
+ }
+ interface link {
+  /**
+   * Link creates newname as a hard link to the oldname file.
+   * If there is an error, it will be of type *LinkError.
+   */
+  (oldname: string, newname: string): void
+ }
+ interface symlink {
+  /**
+   * Symlink creates newname as a symbolic link to oldname.
+   * On Windows, a symlink to a non-existent oldname creates a file symlink;
+   * if oldname is later created as a directory the symlink will not work.
+   * If there is an error, it will be of type *LinkError.
+   */
+  (oldname: string, newname: string): void
+ }
+ interface unixDirent {
+ }
+ interface unixDirent {
+  name(): string
+ }
+ interface unixDirent {
+  isDir(): boolean
+ }
+ interface unixDirent {
+  type(): FileMode
+ }
+ interface unixDirent {
+  info(): FileInfo
+ }
+ interface unixDirent {
+  string(): string
+ }
+ interface getwd {
+  /**
+   * Getwd returns an absolute path name corresponding to the
+   * current directory. If the current directory can be
+   * reached via multiple paths (due to symbolic links),
+   * Getwd may return any one of them.
+   * 
+   * On Unix platforms, if the environment variable PWD
+   * provides an absolute name, and it is a name of the
+   * current directory, it is returned.
+   */
+  (): string
+ }
+ interface mkdirAll {
+  /**
+   * MkdirAll creates a directory named path,
+   * along with any necessary parents, and returns nil,
+   * or else returns an error.
+   * The permission bits perm (before umask) are used for all
+   * directories that MkdirAll creates.
+   * If path is already a directory, MkdirAll does nothing
+   * and returns nil.
+   */
+  (path: string, perm: FileMode): void
+ }
+ interface removeAll {
+  /**
+   * RemoveAll removes path and any children it contains.
+   * It removes everything it can but returns the first error
+   * it encounters. If the path does not exist, RemoveAll
+   * returns nil (no error).
+   * If there is an error, it will be of type [*PathError].
+   */
+  (path: string): void
+ }
+ interface isPathSeparator {
+  /**
+   * IsPathSeparator reports whether c is a directory separator character.
+   */
+  (c: number): boolean
+ }
+ interface pipe {
+  /**
+   * Pipe returns a connected pair of Files; reads from r return bytes written to w.
+   * It returns the files and an error, if any.
+   */
+  (): [(File), (File)]
+ }
+ interface getuid {
+  /**
+   * Getuid returns the numeric user id of the caller.
+   * 
+   * On Windows, it returns -1.
+   */
+  (): number
+ }
+ interface geteuid {
+  /**
+   * Geteuid returns the numeric effective user id of the caller.
+   * 
+   * On Windows, it returns -1.
+   */
+  (): number
+ }
+ interface getgid {
+  /**
+   * Getgid returns the numeric group id of the caller.
+   * 
+   * On Windows, it returns -1.
+   */
+  (): number
+ }
+ interface getegid {
+  /**
+   * Getegid returns the numeric effective group id of the caller.
+   * 
+   * On Windows, it returns -1.
+   */
+  (): number
+ }
+ interface getgroups {
+  /**
+   * Getgroups returns a list of the numeric ids of groups that the caller belongs to.
+   * 
+   * On Windows, it returns [syscall.EWINDOWS]. See the [os/user] package
+   * for a possible alternative.
+   */
+  (): Array<number>
+ }
+ interface exit {
+  /**
+   * Exit causes the current program to exit with the given status code.
+   * Conventionally, code zero indicates success, non-zero an error.
+   * The program terminates immediately; deferred functions are not run.
+   * 
+   * For portability, the status code should be in the range [0, 125].
+   */
+  (code: number): void
+ }
+ /**
+  * rawConn implements syscall.RawConn.
+  */
+ interface rawConn {
+ }
+ interface rawConn {
+  control(f: (_arg0: number) => void): void
+ }
+ interface rawConn {
+  read(f: (_arg0: number) => boolean): void
+ }
+ interface rawConn {
+  write(f: (_arg0: number) => boolean): void
+ }
+ interface openInRoot {
+  /**
+   * OpenInRoot opens the file name in the directory dir.
+   * It is equivalent to OpenRoot(dir) followed by opening the file in the root.
+   * 
+   * OpenInRoot returns an error if any component of the name
+   * references a location outside of dir.
+   * 
+   * See [Root] for details and limitations.
+   */
+  (dir: string, name: string): (File)
+ }
+ /**
+  * Root may be used to only access files within a single directory tree.
+  * 
+  * Methods on Root can only access files and directories beneath a root directory.
+  * If any component of a file name passed to a method of Root references a location
+  * outside the root, the method returns an error.
+  * File names may reference the directory itself (.).
+  * 
+  * Methods on Root will follow symbolic links, but symbolic links may not
+  * reference a location outside the root.
+  * Symbolic links must not be absolute.
+  * 
+  * Methods on Root do not prohibit traversal of filesystem boundaries,
+  * Linux bind mounts, /proc special files, or access to Unix device files.
+  * 
+  * Methods on Root are safe to be used from multiple goroutines simultaneously.
+  * 
+  * On most platforms, creating a Root opens a file descriptor or handle referencing
+  * the directory. If the directory is moved, methods on Root reference the original
+  * directory in its new location.
+  * 
+  * Root's behavior differs on some platforms:
+  * 
+  * ```
+  *   - When GOOS=windows, file names may not reference Windows reserved device names
+  *     such as NUL and COM1.
+  *   - When GOOS=js, Root is vulnerable to TOCTOU (time-of-check-time-of-use)
+  *     attacks in symlink validation, and cannot ensure that operations will not
+  *     escape the root.
+  *   - When GOOS=plan9 or GOOS=js, Root does not track directories across renames.
+  *     On these platforms, a Root references a directory name, not a file descriptor.
+  * ```
+  */
+ interface Root {
+ }
+ interface openRoot {
+  /**
+   * OpenRoot opens the named directory.
+   * If there is an error, it will be of type *PathError.
+   */
+  (name: string): (Root)
+ }
+ interface Root {
+  /**
+   * Name returns the name of the directory presented to OpenRoot.
+   * 
+   * It is safe to call Name after [Close].
+   */
+  name(): string
+ }
+ interface Root {
+  /**
+   * Close closes the Root.
+   * After Close is called, methods on Root return errors.
+   */
+  close(): void
+ }
+ interface Root {
+  /**
+   * Open opens the named file in the root for reading.
+   * See [Open] for more details.
+   */
+  open(name: string): (File)
+ }
+ interface Root {
+  /**
+   * Create creates or truncates the named file in the root.
+   * See [Create] for more details.
+   */
+  create(name: string): (File)
+ }
+ interface Root {
+  /**
+   * OpenFile opens the named file in the root.
+   * See [OpenFile] for more details.
+   * 
+   * If perm contains bits other than the nine least-significant bits (0o777),
+   * OpenFile returns an error.
+   */
+  openFile(name: string, flag: number, perm: FileMode): (File)
+ }
+ interface Root {
+  /**
+   * OpenRoot opens the named directory in the root.
+   * If there is an error, it will be of type *PathError.
+   */
+  openRoot(name: string): (Root)
+ }
+ interface Root {
+  /**
+   * Mkdir creates a new directory in the root
+   * with the specified name and permission bits (before umask).
+   * See [Mkdir] for more details.
+   * 
+   * If perm contains bits other than the nine least-significant bits (0o777),
+   * OpenFile returns an error.
+   */
+  mkdir(name: string, perm: FileMode): void
+ }
+ interface Root {
+  /**
+   * Remove removes the named file or (empty) directory in the root.
+   * See [Remove] for more details.
+   */
+  remove(name: string): void
+ }
+ interface Root {
+  /**
+   * Stat returns a [FileInfo] describing the named file in the root.
+   * See [Stat] for more details.
+   */
+  stat(name: string): FileInfo
+ }
+ interface Root {
+  /**
+   * Lstat returns a [FileInfo] describing the named file in the root.
+   * If the file is a symbolic link, the returned FileInfo
+   * describes the symbolic link.
+   * See [Lstat] for more details.
+   */
+  lstat(name: string): FileInfo
+ }
+ interface Root {
+  /**
+   * FS returns a file system (an fs.FS) for the tree of files in the root.
+   * 
+   * The result implements [io/fs.StatFS], [io/fs.ReadFileFS] and
+   * [io/fs.ReadDirFS].
+   */
+  fs(): fs.FS
+ }
+ interface rootFS extends Root{}
+ interface rootFS {
+  open(name: string): fs.File
+ }
+ interface rootFS {
+  readDir(name: string): Array<DirEntry>
+ }
+ interface rootFS {
+  readFile(name: string): string|Array<number>
+ }
+ interface rootFS {
+  stat(name: string): FileInfo
+ }
+ /**
+  * root implementation for platforms with a function to open a file
+  * relative to a directory.
+  */
+ interface root {
+ }
+ interface root {
+  close(): void
+ }
+ interface root {
+  name(): string
+ }
+ /**
+  * errSymlink reports that a file being operated on is actually a symlink,
+  * and the target of that symlink.
+  */
+ interface errSymlink extends String{}
+ interface errSymlink {
+  error(): string
+ }
+ interface sysfdType extends Number{}
+ interface stat {
+  /**
+   * Stat returns a [FileInfo] describing the named file.
+   * If there is an error, it will be of type [*PathError].
+   */
+  (name: string): FileInfo
+ }
+ interface lstat {
+  /**
+   * Lstat returns a [FileInfo] describing the named file.
+   * If the file is a symbolic link, the returned FileInfo
+   * describes the symbolic link. Lstat makes no attempt to follow the link.
+   * If there is an error, it will be of type [*PathError].
+   * 
+   * On Windows, if the file is a reparse point that is a surrogate for another
+   * named entity (such as a symbolic link or mounted folder), the returned
+   * FileInfo describes the reparse point, and makes no attempt to resolve it.
+   */
+  (name: string): FileInfo
+ }
+ interface File {
+  /**
+   * Stat returns the [FileInfo] structure describing file.
+   * If there is an error, it will be of type [*PathError].
+   */
+  stat(): FileInfo
+ }
+ interface hostname {
+  /**
+   * Hostname returns the host name reported by the kernel.
+   */
+  (): string
+ }
+ interface createTemp {
+  /**
+   * CreateTemp creates a new temporary file in the directory dir,
+   * opens the file for reading and writing, and returns the resulting file.
+   * The filename is generated by taking pattern and adding a random string to the end.
+   * If pattern includes a "*", the random string replaces the last "*".
+   * The file is created with mode 0o600 (before umask).
+   * If dir is the empty string, CreateTemp uses the default directory for temporary files, as returned by [TempDir].
+   * Multiple programs or goroutines calling CreateTemp simultaneously will not choose the same file.
+   * The caller can use the file's Name method to find the pathname of the file.
+   * It is the caller's responsibility to remove the file when it is no longer needed.
+   */
+  (dir: string, pattern: string): (File)
+ }
+ interface mkdirTemp {
+  /**
+   * MkdirTemp creates a new temporary directory in the directory dir
+   * and returns the pathname of the new directory.
+   * The new directory's name is generated by adding a random string to the end of pattern.
+   * If pattern includes a "*", the random string replaces the last "*" instead.
+   * The directory is created with mode 0o700 (before umask).
+   * If dir is the empty string, MkdirTemp uses the default directory for temporary files, as returned by TempDir.
+   * Multiple programs or goroutines calling MkdirTemp simultaneously will not choose the same directory.
+   * It is the caller's responsibility to remove the directory when it is no longer needed.
+   */
+  (dir: string, pattern: string): string
+ }
+ interface getpagesize {
+  /**
+   * Getpagesize returns the underlying system's memory page size.
+   */
+  (): number
+ }
+ /**
+  * File represents an open file descriptor.
+  * 
+  * The methods of File are safe for concurrent use.
+  */
+ type _sJqvjSA = file
+ interface File extends _sJqvjSA {
+ }
+ /**
+  * A FileInfo describes a file and is returned by [Stat] and [Lstat].
+  */
+ interface FileInfo extends fs.FileInfo{}
+ /**
+  * A FileMode represents a file's mode and permission bits.
+  * The bits have the same definition on all systems, so that
+  * information about files can be moved from one system
+  * to another portably. Not all bits apply to all systems.
+  * The only required bit is [ModeDir] for directories.
+  */
+ interface FileMode extends fs.FileMode{}
+ interface fileStat {
+  name(): string
+ }
+ interface fileStat {
+  isDir(): boolean
+ }
+ interface sameFile {
+  /**
+   * SameFile reports whether fi1 and fi2 describe the same file.
+   * For example, on Unix this means that the device and inode fields
+   * of the two underlying structures are identical; on other systems
+   * the decision may be based on the path names.
+   * SameFile only applies to results returned by this package's [Stat].
+   * It returns false in other cases.
+   */
+  (fi1: FileInfo, fi2: FileInfo): boolean
+ }
+ /**
+  * A fileStat is the implementation of FileInfo returned by Stat and Lstat.
+  */
+ interface fileStat {
+ }
+ interface fileStat {
+  size(): number
+ }
+ interface fileStat {
+  mode(): FileMode
+ }
+ interface fileStat {
+  modTime(): time.Time
+ }
+ interface fileStat {
+  sys(): any
+ }
+}
+
+/**
+ * Package filepath implements utility routines for manipulating filename paths
+ * in a way compatible with the target operating system-defined file paths.
+ * 
+ * The filepath package uses either forward slashes or backslashes,
+ * depending on the operating system. To process paths such as URLs
+ * that always use forward slashes regardless of the operating
+ * system, see the [path] package.
+ */
+namespace filepath {
+ interface match {
+  /**
+   * Match reports whether name matches the shell file name pattern.
+   * The pattern syntax is:
+   * 
+   * ```
+   * 	pattern:
+   * 		{ term }
+   * 	term:
+   * 		'*'         matches any sequence of non-Separator characters
+   * 		'?'         matches any single non-Separator character
+   * 		'[' [ '^' ] { character-range } ']'
+   * 		            character class (must be non-empty)
+   * 		c           matches character c (c != '*', '?', '\\', '[')
+   * 		'\\' c      matches character c
+   * 
+   * 	character-range:
+   * 		c           matches character c (c != '\\', '-', ']')
+   * 		'\\' c      matches character c
+   * 		lo '-' hi   matches character c for lo <= c <= hi
+   * ```
+   * 
+   * Match requires pattern to match all of name, not just a substring.
+   * The only possible returned error is [ErrBadPattern], when pattern
+   * is malformed.
+   * 
+   * On Windows, escaping is disabled. Instead, '\\' is treated as
+   * path separator.
+   */
+  (pattern: string, name: string): boolean
+ }
+ interface glob {
+  /**
+   * Glob returns the names of all files matching pattern or nil
+   * if there is no matching file. The syntax of patterns is the same
+   * as in [Match]. The pattern may describe hierarchical names such as
+   * /usr/*\/bin/ed (assuming the [Separator] is '/').
+   * 
+   * Glob ignores file system errors such as I/O errors reading directories.
+   * The only possible returned error is [ErrBadPattern], when pattern
+   * is malformed.
+   */
+  (pattern: string): Array<string>
+ }
+ interface clean {
+  /**
+   * Clean returns the shortest path name equivalent to path
+   * by purely lexical processing. It applies the following rules
+   * iteratively until no further processing can be done:
+   * 
+   *  1. Replace multiple [Separator] elements with a single one.
+   *  2. Eliminate each . path name element (the current directory).
+   *  3. Eliminate each inner .. path name element (the parent directory)
+   * ```
+   *     along with the non-.. element that precedes it.
+   * ```
+   *  4. Eliminate .. elements that begin a rooted path:
+   * ```
+   *     that is, replace "/.." by "/" at the beginning of a path,
+   *     assuming Separator is '/'.
+   * ```
+   * 
+   * The returned path ends in a slash only if it represents a root directory,
+   * such as "/" on Unix or `C:\` on Windows.
+   * 
+   * Finally, any occurrences of slash are replaced by Separator.
+   * 
+   * If the result of this process is an empty string, Clean
+   * returns the string ".".
+   * 
+   * On Windows, Clean does not modify the volume name other than to replace
+   * occurrences of "/" with `\`.
+   * For example, Clean("//host/share/../x") returns `\\host\share\x`.
+   * 
+   * See also Rob Pike, “Lexical File Names in Plan 9 or
+   * Getting Dot-Dot Right,”
+   * https://9p.io/sys/doc/lexnames.html
+   */
+  (path: string): string
+ }
+ interface isLocal {
+  /**
+   * IsLocal reports whether path, using lexical analysis only, has all of these properties:
+   * 
+   * ```
+   *   - is within the subtree rooted at the directory in which path is evaluated
+   *   - is not an absolute path
+   *   - is not empty
+   *   - on Windows, is not a reserved name such as "NUL"
+   * ```
+   * 
+   * If IsLocal(path) returns true, then
+   * Join(base, path) will always produce a path contained within base and
+   * Clean(path) will always produce an unrooted path with no ".." path elements.
+   * 
+   * IsLocal is a purely lexical operation.
+   * In particular, it does not account for the effect of any symbolic links
+   * that may exist in the filesystem.
+   */
+  (path: string): boolean
+ }
+ interface localize {
+  /**
+   * Localize converts a slash-separated path into an operating system path.
+   * The input path must be a valid path as reported by [io/fs.ValidPath].
+   * 
+   * Localize returns an error if the path cannot be represented by the operating system.
+   * For example, the path a\b is rejected on Windows, on which \ is a separator
+   * character and cannot be part of a filename.
+   * 
+   * The path returned by Localize will always be local, as reported by IsLocal.
+   */
+  (path: string): string
+ }
+ interface toSlash {
+  /**
+   * ToSlash returns the result of replacing each separator character
+   * in path with a slash ('/') character. Multiple separators are
+   * replaced by multiple slashes.
+   */
+  (path: string): string
+ }
+ interface fromSlash {
+  /**
+   * FromSlash returns the result of replacing each slash ('/') character
+   * in path with a separator character. Multiple slashes are replaced
+   * by multiple separators.
+   * 
+   * See also the Localize function, which converts a slash-separated path
+   * as used by the io/fs package to an operating system path.
+   */
+  (path: string): string
+ }
+ interface splitList {
+  /**
+   * SplitList splits a list of paths joined by the OS-specific [ListSeparator],
+   * usually found in PATH or GOPATH environment variables.
+   * Unlike strings.Split, SplitList returns an empty slice when passed an empty
+   * string.
+   */
+  (path: string): Array<string>
+ }
+ interface split {
+  /**
+   * Split splits path immediately following the final [Separator],
+   * separating it into a directory and file name component.
+   * If there is no Separator in path, Split returns an empty dir
+   * and file set to path.
+   * The returned values have the property that path = dir+file.
+   */
+  (path: string): [string, string]
+ }
+ interface join {
+  /**
+   * Join joins any number of path elements into a single path,
+   * separating them with an OS specific [Separator]. Empty elements
+   * are ignored. The result is Cleaned. However, if the argument
+   * list is empty or all its elements are empty, Join returns
+   * an empty string.
+   * On Windows, the result will only be a UNC path if the first
+   * non-empty element is a UNC path.
+   */
+  (...elem: string[]): string
+ }
+ interface ext {
+  /**
+   * Ext returns the file name extension used by path.
+   * The extension is the suffix beginning at the final dot
+   * in the final element of path; it is empty if there is
+   * no dot.
+   */
+  (path: string): string
+ }
+ interface evalSymlinks {
+  /**
+   * EvalSymlinks returns the path name after the evaluation of any symbolic
+   * links.
+   * If path is relative the result will be relative to the current directory,
+   * unless one of the components is an absolute symbolic link.
+   * EvalSymlinks calls [Clean] on the result.
+   */
+  (path: string): string
+ }
+ interface isAbs {
+  /**
+   * IsAbs reports whether the path is absolute.
+   */
+  (path: string): boolean
+ }
+ interface abs {
+  /**
+   * Abs returns an absolute representation of path.
+   * If the path is not absolute it will be joined with the current
+   * working directory to turn it into an absolute path. The absolute
+   * path name for a given file is not guaranteed to be unique.
+   * Abs calls [Clean] on the result.
+   */
+  (path: string): string
+ }
+ interface rel {
+  /**
+   * Rel returns a relative path that is lexically equivalent to targpath when
+   * joined to basepath with an intervening separator. That is,
+   * [Join](basepath, Rel(basepath, targpath)) is equivalent to targpath itself.
+   * On success, the returned path will always be relative to basepath,
+   * even if basepath and targpath share no elements.
+   * An error is returned if targpath can't be made relative to basepath or if
+   * knowing the current working directory would be necessary to compute it.
+   * Rel calls [Clean] on the result.
+   */
+  (basepath: string, targpath: string): string
+ }
+ /**
+  * WalkFunc is the type of the function called by [Walk] to visit each
+  * file or directory.
+  * 
+  * The path argument contains the argument to Walk as a prefix.
+  * That is, if Walk is called with root argument "dir" and finds a file
+  * named "a" in that directory, the walk function will be called with
+  * argument "dir/a".
+  * 
+  * The directory and file are joined with Join, which may clean the
+  * directory name: if Walk is called with the root argument "x/../dir"
+  * and finds a file named "a" in that directory, the walk function will
+  * be called with argument "dir/a", not "x/../dir/a".
+  * 
+  * The info argument is the fs.FileInfo for the named path.
+  * 
+  * The error result returned by the function controls how Walk continues.
+  * If the function returns the special value [SkipDir], Walk skips the
+  * current directory (path if info.IsDir() is true, otherwise path's
+  * parent directory). If the function returns the special value [SkipAll],
+  * Walk skips all remaining files and directories. Otherwise, if the function
+  * returns a non-nil error, Walk stops entirely and returns that error.
+  * 
+  * The err argument reports an error related to path, signaling that Walk
+  * will not walk into that directory. The function can decide how to
+  * handle that error; as described earlier, returning the error will
+  * cause Walk to stop walking the entire tree.
+  * 
+  * Walk calls the function with a non-nil err argument in two cases.
+  * 
+  * First, if an [os.Lstat] on the root directory or any directory or file
+  * in the tree fails, Walk calls the function with path set to that
+  * directory or file's path, info set to nil, and err set to the error
+  * from os.Lstat.
+  * 
+  * Second, if a directory's Readdirnames method fails, Walk calls the
+  * function with path set to the directory's path, info, set to an
+  * [fs.FileInfo] describing the directory, and err set to the error from
+  * Readdirnames.
+  */
+ interface WalkFunc {(path: string, info: fs.FileInfo, err: Error): void }
+ interface walkDir {
+  /**
+   * WalkDir walks the file tree rooted at root, calling fn for each file or
+   * directory in the tree, including root.
+   * 
+   * All errors that arise visiting files and directories are filtered by fn:
+   * see the [fs.WalkDirFunc] documentation for details.
+   * 
+   * The files are walked in lexical order, which makes the output deterministic
+   * but requires WalkDir to read an entire directory into memory before proceeding
+   * to walk that directory.
+   * 
+   * WalkDir does not follow symbolic links.
+   * 
+   * WalkDir calls fn with paths that use the separator character appropriate
+   * for the operating system. This is unlike [io/fs.WalkDir], which always
+   * uses slash separated paths.
+   */
+  (root: string, fn: fs.WalkDirFunc): void
+ }
+ interface walk {
+  /**
+   * Walk walks the file tree rooted at root, calling fn for each file or
+   * directory in the tree, including root.
+   * 
+   * All errors that arise visiting files and directories are filtered by fn:
+   * see the [WalkFunc] documentation for details.
+   * 
+   * The files are walked in lexical order, which makes the output deterministic
+   * but requires Walk to read an entire directory into memory before proceeding
+   * to walk that directory.
+   * 
+   * Walk does not follow symbolic links.
+   * 
+   * Walk is less efficient than [WalkDir], introduced in Go 1.16,
+   * which avoids calling os.Lstat on every visited file or directory.
+   */
+  (root: string, fn: WalkFunc): void
+ }
+ interface base {
+  /**
+   * Base returns the last element of path.
+   * Trailing path separators are removed before extracting the last element.
+   * If the path is empty, Base returns ".".
+   * If the path consists entirely of separators, Base returns a single separator.
+   */
+  (path: string): string
+ }
+ interface dir {
+  /**
+   * Dir returns all but the last element of path, typically the path's directory.
+   * After dropping the final element, Dir calls [Clean] on the path and trailing
+   * slashes are removed.
+   * If the path is empty, Dir returns ".".
+   * If the path consists entirely of separators, Dir returns a single separator.
+   * The returned path does not end in a separator unless it is the root directory.
+   */
+  (path: string): string
+ }
+ interface volumeName {
+  /**
+   * VolumeName returns leading volume name.
+   * Given "C:\foo\bar" it returns "C:" on Windows.
+   * Given "\\host\share\foo" it returns "\\host\share".
+   * On other platforms it returns "".
+   */
+  (path: string): string
+ }
+ interface hasPrefix {
+  /**
+   * HasPrefix exists for historical compatibility and should not be used.
+   * 
+   * Deprecated: HasPrefix does not respect path boundaries and
+   * does not ignore case when required.
+   */
+  (p: string, prefix: string): boolean
+ }
+}
+
+namespace security {
+ interface s256Challenge {
+  /**
+   * S256Challenge creates base64 encoded sha256 challenge string derived from code.
+   * The padding of the result base64 string is stripped per [RFC 7636].
+   * 
+   * [RFC 7636]: https://datatracker.ietf.org/doc/html/rfc7636#section-4.2
+   */
+  (code: string): string
+ }
+ interface md5 {
+  /**
+   * MD5 creates md5 hash from the provided plain text.
+   */
+  (text: string): string
+ }
+ interface sha256 {
+  /**
+   * SHA256 creates sha256 hash as defined in FIPS 180-4 from the provided text.
+   */
+  (text: string): string
+ }
+ interface sha512 {
+  /**
+   * SHA512 creates sha512 hash as defined in FIPS 180-4 from the provided text.
+   */
+  (text: string): string
+ }
+ interface hs256 {
+  /**
+   * HS256 creates a HMAC hash with sha256 digest algorithm.
+   */
+  (text: string, secret: string): string
+ }
+ interface hs512 {
+  /**
+   * HS512 creates a HMAC hash with sha512 digest algorithm.
+   */
+  (text: string, secret: string): string
+ }
+ interface equal {
+  /**
+   * Equal compares two hash strings for equality without leaking timing information.
+   */
+  (hash1: string, hash2: string): boolean
+ }
+ // @ts-ignore
+ import crand = rand
+ interface encrypt {
+  /**
+   * Encrypt encrypts "data" with the specified "key" (must be valid 32 char AES key).
+   * 
+   * This method uses AES-256-GCM block cypher mode.
+   */
+  (data: string|Array<number>, key: string): string
+ }
+ interface decrypt {
+  /**
+   * Decrypt decrypts encrypted text with key (must be valid 32 chars AES key).
+   * 
+   * This method uses AES-256-GCM block cypher mode.
+   */
+  (cipherText: string, key: string): string|Array<number>
+ }
+ interface parseUnverifiedJWT {
+  /**
+   * ParseUnverifiedJWT parses JWT and returns its claims
+   * but DOES NOT verify the signature.
+   * 
+   * It verifies only the exp, iat and nbf claims.
+   */
+  (token: string): jwt.MapClaims
+ }
+ interface parseJWT {
+  /**
+   * ParseJWT verifies and parses JWT and returns its claims.
+   */
+  (token: string, verificationKey: string): jwt.MapClaims
+ }
+ interface newJWT {
+  /**
+   * NewJWT generates and returns new HS256 signed JWT.
+   */
+  (payload: jwt.MapClaims, signingKey: string, duration: time.Duration): string
+ }
+ // @ts-ignore
+ import cryptoRand = rand
+ // @ts-ignore
+ import mathRand = rand
+ interface randomString {
+  /**
+   * RandomString generates a cryptographically random string with the specified length.
+   * 
+   * The generated string matches [A-Za-z0-9]+ and it's transparent to URL-encoding.
+   */
+  (length: number): string
+ }
+ interface randomStringWithAlphabet {
+  /**
+   * RandomStringWithAlphabet generates a cryptographically random string
+   * with the specified length and characters set.
+   * 
+   * It panics if for some reason rand.Int returns a non-nil error.
+   */
+  (length: number, alphabet: string): string
+ }
+ interface pseudorandomString {
+  /**
+   * PseudorandomString generates a pseudorandom string with the specified length.
+   * 
+   * The generated string matches [A-Za-z0-9]+ and it's transparent to URL-encoding.
+   * 
+   * For a cryptographically random string (but a little bit slower) use RandomString instead.
+   */
+  (length: number): string
+ }
+ interface pseudorandomStringWithAlphabet {
+  /**
+   * PseudorandomStringWithAlphabet generates a pseudorandom string
+   * with the specified length and characters set.
+   * 
+   * For a cryptographically random (but a little bit slower) use RandomStringWithAlphabet instead.
+   */
+  (length: number, alphabet: string): string
+ }
+ interface randomStringByRegex {
+  /**
+   * RandomStringByRegex generates a random string matching the regex pattern.
+   * If optFlags is not set, fallbacks to [syntax.Perl].
+   * 
+   * NB! While the source of the randomness comes from [crypto/rand] this method
+   * is not recommended to be used on its own in critical secure contexts because
+   * the generated length could vary too much on the used pattern and may not be
+   * as secure as simply calling [security.RandomString].
+   * If you still insist on using it for such purposes, consider at least
+   * a large enough minimum length for the generated string, e.g. `[a-z0-9]{30}`.
+   * 
+   * This function is inspired by github.com/pipe01/revregexp, github.com/lucasjones/reggen and other similar packages.
+   */
+  (pattern: string, ...optFlags: syntax.Flags[]): string
+ }
+}
+
+namespace filesystem {
+ /**
+  * FileReader defines an interface for a file resource reader.
+  */
+ interface FileReader {
+  [key:string]: any;
+  open(): io.ReadSeekCloser
+ }
+ /**
+  * File defines a single file [io.ReadSeekCloser] resource.
+  * 
+  * The file could be from a local path, multipart/form-data header, etc.
+  */
+ interface File {
+  reader: FileReader
+  name: string
+  originalName: string
+  size: number
+ }
+ interface File {
+  /**
+   * AsMap implements [core.mapExtractor] and returns a value suitable
+   * to be used in an API rule expression.
+   */
+  asMap(): _TygojaDict
+ }
+ interface newFileFromPath {
+  /**
+   * NewFileFromPath creates a new File instance from the provided local file path.
+   */
+  (path: string): (File)
+ }
+ interface newFileFromBytes {
+  /**
+   * NewFileFromBytes creates a new File instance from the provided byte slice.
+   */
+  (b: string|Array<number>, name: string): (File)
+ }
+ interface newFileFromMultipart {
+  /**
+   * NewFileFromMultipart creates a new File from the provided multipart header.
+   */
+  (mh: multipart.FileHeader): (File)
+ }
+ interface newFileFromURL {
+  /**
+   * NewFileFromURL creates a new File from the provided url by
+   * downloading the resource and load it as BytesReader.
+   * 
+   * Example
+   * 
+   * ```
+   * 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+   * 	defer cancel()
+   * 
+   * 	file, err := filesystem.NewFileFromURL(ctx, "https://example.com/image.png")
+   * ```
+   */
+  (ctx: context.Context, url: string): (File)
+ }
+ /**
+  * MultipartReader defines a FileReader from [multipart.FileHeader].
+  */
+ interface MultipartReader {
+  header?: multipart.FileHeader
+ }
+ interface MultipartReader {
+  /**
+   * Open implements the [filesystem.FileReader] interface.
+   */
+  open(): io.ReadSeekCloser
+ }
+ /**
+  * PathReader defines a FileReader from a local file path.
+  */
+ interface PathReader {
+  path: string
+ }
+ interface PathReader {
+  /**
+   * Open implements the [filesystem.FileReader] interface.
+   */
+  open(): io.ReadSeekCloser
+ }
+ /**
+  * BytesReader defines a FileReader from bytes content.
+  */
+ interface BytesReader {
+  bytes: string|Array<number>
+ }
+ interface BytesReader {
+  /**
+   * Open implements the [filesystem.FileReader] interface.
+   */
+  open(): io.ReadSeekCloser
+ }
+ type _sGrPWvz = bytes.Reader
+ interface bytesReadSeekCloser extends _sGrPWvz {
+ }
+ interface bytesReadSeekCloser {
+  /**
+   * Close implements the [io.ReadSeekCloser] interface.
+   */
+  close(): void
+ }
+ /**
+  * openFuncAsReader defines a FileReader from a bare Open function.
+  */
+ interface openFuncAsReader {(): io.ReadSeekCloser }
+ interface openFuncAsReader {
+  /**
+   * Open implements the [filesystem.FileReader] interface.
+   */
+  open(): io.ReadSeekCloser
+ }
+ interface System {
+ }
+ interface newS3 {
+  /**
+   * NewS3 initializes an S3 filesystem instance.
+   * 
+   * NB! Make sure to call `Close()` after you are done working with it.
+   */
+  (bucketName: string, region: string, endpoint: string, accessKey: string, secretKey: string, s3ForcePathStyle: boolean): (System)
+ }
+ interface newLocal {
+  /**
+   * NewLocal initializes a new local filesystem instance.
+   * 
+   * NB! Make sure to call `Close()` after you are done working with it.
+   */
+  (dirPath: string): (System)
+ }
+ interface System {
+  /**
+   * SetContext assigns the specified context to the current filesystem.
+   */
+  setContext(ctx: context.Context): void
+ }
+ interface System {
+  /**
+   * Close releases any resources used for the related filesystem.
+   */
+  close(): void
+ }
+ interface System {
+  /**
+   * Exists checks if file with fileKey path exists or not.
+   */
+  exists(fileKey: string): boolean
+ }
+ interface System {
+  /**
+   * Attributes returns the attributes for the file with fileKey path.
+   * 
+   * If the file doesn't exist it returns ErrNotFound.
+   */
+  attributes(fileKey: string): (blob.Attributes)
+ }
+ interface System {
+  /**
+   * GetReader returns a file content reader for the given fileKey.
+   * 
+   * NB! Make sure to call Close() on the file after you are done working with it.
+   * 
+   * If the file doesn't exist returns ErrNotFound.
+   */
+  getReader(fileKey: string): (blob.Reader)
+ }
+ interface System {
+  /**
+   * Deprecated: Please use GetReader(fileKey) instead.
+   */
+  getFile(fileKey: string): (blob.Reader)
+ }
+ interface System {
+  /**
+   * GetReuploadableFile constructs a new reuploadable File value
+   * from the associated fileKey blob.Reader.
+   * 
+   * If preserveName is false then the returned File.Name will have
+   * a new randomly generated suffix, otherwise it will reuse the original one.
+   * 
+   * This method could be useful in case you want to clone an existing
+   * Record file and assign it to a new Record (e.g. in a Record duplicate action).
+   * 
+   * If you simply want to copy an existing file to a new location you
+   * could check the Copy(srcKey, dstKey) method.
+   */
+  getReuploadableFile(fileKey: string, preserveName: boolean): (File)
+ }
+ interface System {
+  /**
+   * Copy copies the file stored at srcKey to dstKey.
+   * 
+   * If srcKey file doesn't exist, it returns ErrNotFound.
+   * 
+   * If dstKey file already exists, it is overwritten.
+   */
+  copy(srcKey: string, dstKey: string): void
+ }
+ interface System {
+  /**
+   * List returns a flat list with info for all files under the specified prefix.
+   */
+  list(prefix: string): Array<(blob.ListObject | undefined)>
+ }
+ interface System {
+  /**
+   * Upload writes content into the fileKey location.
+   */
+  upload(content: string|Array<number>, fileKey: string): void
+ }
+ interface System {
+  /**
+   * UploadFile uploads the provided File to the fileKey location.
+   */
+  uploadFile(file: File, fileKey: string): void
+ }
+ interface System {
+  /**
+   * UploadMultipart uploads the provided multipart file to the fileKey location.
+   */
+  uploadMultipart(fh: multipart.FileHeader, fileKey: string): void
+ }
+ interface System {
+  /**
+   * Delete deletes stored file at fileKey location.
+   * 
+   * If the file doesn't exist returns ErrNotFound.
+   */
+  delete(fileKey: string): void
+ }
+ interface System {
+  /**
+   * DeletePrefix deletes everything starting with the specified prefix.
+   * 
+   * The prefix could be subpath (ex. "/a/b/") or filename prefix (ex. "/a/b/file_").
+   */
+  deletePrefix(prefix: string): Array<Error>
+ }
+ interface System {
+  /**
+   * Checks if the provided dir prefix doesn't have any files.
+   * 
+   * A trailing slash will be appended to a non-empty dir string argument
+   * to ensure that the checked prefix is a "directory".
+   * 
+   * Returns "false" in case the has at least one file, otherwise - "true".
+   */
+  isEmptyDir(dir: string): boolean
+ }
+ interface System {
+  /**
+   * Serve serves the file at fileKey location to an HTTP response.
+   * 
+   * If the `download` query parameter is used the file will be always served for
+   * download no matter of its type (aka. with "Content-Disposition: attachment").
+   * 
+   * Internally this method uses [http.ServeContent] so Range requests,
+   * If-Match, If-Unmodified-Since, etc. headers are handled transparently.
+   */
+  serve(res: http.ResponseWriter, req: http.Request, fileKey: string, name: string): void
+ }
+ interface System {
+  /**
+   * CreateThumb creates a new thumb image for the file at originalKey location.
+   * The new thumb file is stored at thumbKey location.
+   * 
+   * thumbSize is in the format:
+   * - 0xH  (eg. 0x100)    - resize to H height preserving the aspect ratio
+   * - Wx0  (eg. 300x0)    - resize to W width preserving the aspect ratio
+   * - WxH  (eg. 300x100)  - resize and crop to WxH viewbox (from center)
+   * - WxHt (eg. 300x100t) - resize and crop to WxH viewbox (from top)
+   * - WxHb (eg. 300x100b) - resize and crop to WxH viewbox (from bottom)
+   * - WxHf (eg. 300x100f) - fit inside a WxH viewbox (without cropping)
+   */
+  createThumb(originalKey: string, thumbKey: string, thumbSize: string): void
+ }
+}
+
+/**
+ * Package template is a thin wrapper around the standard html/template
+ * and text/template packages that implements a convenient registry to
+ * load and cache templates on the fly concurrently.
+ * 
+ * It was created to assist the JSVM plugin HTML rendering, but could be used in other Go code.
+ * 
+ * Example:
+ * 
+ * ```
+ * 	registry := template.NewRegistry()
+ * 
+ * 	html1, err := registry.LoadFiles(
+ * 		// the files set wil be parsed only once and then cached
+ * 		"layout.html",
+ * 		"content.html",
+ * 	).Render(map[string]any{"name": "John"})
+ * 
+ * 	html2, err := registry.LoadFiles(
+ * 		// reuse the already parsed and cached files set
+ * 		"layout.html",
+ * 		"content.html",
+ * 	).Render(map[string]any{"name": "Jane"})
+ * ```
+ */
+namespace template {
+ interface newRegistry {
+  /**
+   * NewRegistry creates and initializes a new templates registry with
+   * some defaults (eg. global "raw" template function for unescaped HTML).
+   * 
+   * Use the Registry.Load* methods to load templates into the registry.
+   */
+  (): (Registry)
+ }
+ /**
+  * Registry defines a templates registry that is safe to be used by multiple goroutines.
+  * 
+  * Use the Registry.Load* methods to load templates into the registry.
+  */
+ interface Registry {
+ }
+ interface Registry {
+  /**
+   * AddFuncs registers new global template functions.
+   * 
+   * The key of each map entry is the function name that will be used in the templates.
+   * If a function with the map entry name already exists it will be replaced with the new one.
+   * 
+   * The value of each map entry is a function that must have either a
+   * single return value, or two return values of which the second has type error.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	r.AddFuncs(map[string]any{
+   * 	  "toUpper": func(str string) string {
+   * 	      return strings.ToUppser(str)
+   * 	  },
+   * 	  ...
+   * 	})
+   * ```
+   */
+  addFuncs(funcs: _TygojaDict): (Registry)
+ }
+ interface Registry {
+  /**
+   * LoadFiles caches (if not already) the specified filenames set as a
+   * single template and returns a ready to use Renderer instance.
+   * 
+   * There must be at least 1 filename specified.
+   */
+  loadFiles(...filenames: string[]): (Renderer)
+ }
+ interface Registry {
+  /**
+   * LoadString caches (if not already) the specified inline string as a
+   * single template and returns a ready to use Renderer instance.
+   */
+  loadString(text: string): (Renderer)
+ }
+ interface Registry {
+  /**
+   * LoadFS caches (if not already) the specified fs and globPatterns
+   * pair as single template and returns a ready to use Renderer instance.
+   * 
+   * There must be at least 1 file matching the provided globPattern(s)
+   * (note that most file names serves as glob patterns matching themselves).
+   */
+  loadFS(fsys: fs.FS, ...globPatterns: string[]): (Renderer)
+ }
+ /**
+  * Renderer defines a single parsed template.
+  */
+ interface Renderer {
+ }
+ interface Renderer {
+  /**
+   * Render executes the template with the specified data as the dot object
+   * and returns the result as plain string.
+   */
+  render(data: any): string
+ }
+}
+
+/**
+ * Package validation provides configurable and extensible rules for validating data of various types.
+ */
+namespace ozzo_validation {
+ /**
+  * Error interface represents an validation error
+  */
+ interface Error {
+  [key:string]: any;
+  error(): string
+  code(): string
+  message(): string
+  setMessage(_arg0: string): Error
+  params(): _TygojaDict
+  setParams(_arg0: _TygojaDict): Error
+ }
+}
+
+/**
+ * Package dbx provides a set of DB-agnostic and easy-to-use query building methods for relational databases.
+ */
+namespace dbx {
+ /**
+  * Builder supports building SQL statements in a DB-agnostic way.
+  * Builder mainly provides two sets of query building methods: those building SELECT statements
+  * and those manipulating DB data or schema (e.g. INSERT statements, CREATE TABLE statements).
+  */
+ interface Builder {
+  [key:string]: any;
+  /**
+   * NewQuery creates a new Query object with the given SQL statement.
+   * The SQL statement may contain parameter placeholders which can be bound with actual parameter
+   * values before the statement is executed.
+   */
+  newQuery(_arg0: string): (Query)
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(..._arg0: string[]): (SelectQuery)
+  /**
+   * ModelQuery returns a new ModelQuery object that can be used to perform model insertion, update, and deletion.
+   * The parameter to this method should be a pointer to the model struct that needs to be inserted, updated, or deleted.
+   */
+  model(_arg0: {
+  }): (ModelQuery)
+  /**
+   * GeneratePlaceholder generates an anonymous parameter placeholder with the given parameter ID.
+   */
+  generatePlaceholder(_arg0: number): string
+  /**
+   * Quote quotes a string so that it can be embedded in a SQL statement as a string value.
+   */
+  quote(_arg0: string): string
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(_arg0: string): string
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(_arg0: string): string
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+  /**
+   * Insert creates a Query that represents an INSERT SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  insert(table: string, cols: Params): (Query)
+  /**
+   * Upsert creates a Query that represents an UPSERT SQL statement.
+   * Upsert inserts a row into the table if the primary key or unique index is not found.
+   * Otherwise it will update the row with the new values.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  upsert(table: string, cols: Params, ...constraints: string[]): (Query)
+  /**
+   * Update creates a Query that represents an UPDATE SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding new column
+   * values. If the "where" expression is nil, the UPDATE SQL statement will have no WHERE clause
+   * (be careful in this case as the SQL statement will update ALL rows in the table).
+   */
+  update(table: string, cols: Params, where: Expression): (Query)
+  /**
+   * Delete creates a Query that represents a DELETE SQL statement.
+   * If the "where" expression is nil, the DELETE SQL statement will have no WHERE clause
+   * (be careful in this case as the SQL statement will delete ALL rows in the table).
+   */
+  delete(table: string, where: Expression): (Query)
+  /**
+   * CreateTable creates a Query that represents a CREATE TABLE SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding column types.
+   * The optional "options" parameters will be appended to the generated SQL statement.
+   */
+  createTable(table: string, cols: _TygojaDict, ...options: string[]): (Query)
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+  /**
+   * DropTable creates a Query that can be used to drop a table.
+   */
+  dropTable(table: string): (Query)
+  /**
+   * TruncateTable creates a Query that can be used to truncate a table.
+   */
+  truncateTable(table: string): (Query)
+  /**
+   * AddColumn creates a Query that can be used to add a column to a table.
+   */
+  addColumn(table: string, col: string, typ: string): (Query)
+  /**
+   * DropColumn creates a Query that can be used to drop a column from a table.
+   */
+  dropColumn(table: string, col: string): (Query)
+  /**
+   * RenameColumn creates a Query that can be used to rename a column in a table.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (Query)
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+  /**
+   * AddPrimaryKey creates a Query that can be used to specify primary key(s) for a table.
+   * The "name" parameter specifies the name of the primary key constraint.
+   */
+  addPrimaryKey(table: string, name: string, ...cols: string[]): (Query)
+  /**
+   * DropPrimaryKey creates a Query that can be used to remove the named primary key constraint from a table.
+   */
+  dropPrimaryKey(table: string, name: string): (Query)
+  /**
+   * AddForeignKey creates a Query that can be used to add a foreign key constraint to a table.
+   * The length of cols and refCols must be the same as they refer to the primary and referential columns.
+   * The optional "options" parameters will be appended to the SQL statement. They can be used to
+   * specify options such as "ON DELETE CASCADE".
+   */
+  addForeignKey(table: string, name: string, cols: Array<string>, refCols: Array<string>, refTable: string, ...options: string[]): (Query)
+  /**
+   * DropForeignKey creates a Query that can be used to remove the named foreign key constraint from a table.
+   */
+  dropForeignKey(table: string, name: string): (Query)
+  /**
+   * CreateIndex creates a Query that can be used to create an index for a table.
+   */
+  createIndex(table: string, name: string, ...cols: string[]): (Query)
+  /**
+   * CreateUniqueIndex creates a Query that can be used to create a unique index for a table.
+   */
+  createUniqueIndex(table: string, name: string, ...cols: string[]): (Query)
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ /**
+  * BaseBuilder provides a basic implementation of the Builder interface.
+  */
+ interface BaseBuilder {
+ }
+ interface newBaseBuilder {
+  /**
+   * NewBaseBuilder creates a new BaseBuilder instance.
+   */
+  (db: DB, executor: Executor): (BaseBuilder)
+ }
+ interface BaseBuilder {
+  /**
+   * DB returns the DB instance that this builder is associated with.
+   */
+  db(): (DB)
+ }
+ interface BaseBuilder {
+  /**
+   * Executor returns the executor object (a DB instance or a transaction) for executing SQL statements.
+   */
+  executor(): Executor
+ }
+ interface BaseBuilder {
+  /**
+   * NewQuery creates a new Query object with the given SQL statement.
+   * The SQL statement may contain parameter placeholders which can be bound with actual parameter
+   * values before the statement is executed.
+   */
+  newQuery(sql: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * GeneratePlaceholder generates an anonymous parameter placeholder with the given parameter ID.
+   */
+  generatePlaceholder(_arg0: number): string
+ }
+ interface BaseBuilder {
+  /**
+   * Quote quotes a string so that it can be embedded in a SQL statement as a string value.
+   */
+  quote(s: string): string
+ }
+ interface BaseBuilder {
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(s: string): string
+ }
+ interface BaseBuilder {
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(s: string): string
+ }
+ interface BaseBuilder {
+  /**
+   * Insert creates a Query that represents an INSERT SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  insert(table: string, cols: Params): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * Upsert creates a Query that represents an UPSERT SQL statement.
+   * Upsert inserts a row into the table if the primary key or unique index is not found.
+   * Otherwise it will update the row with the new values.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  upsert(table: string, cols: Params, ...constraints: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * Update creates a Query that represents an UPDATE SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding new column
+   * values. If the "where" expression is nil, the UPDATE SQL statement will have no WHERE clause
+   * (be careful in this case as the SQL statement will update ALL rows in the table).
+   */
+  update(table: string, cols: Params, where: Expression): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * Delete creates a Query that represents a DELETE SQL statement.
+   * If the "where" expression is nil, the DELETE SQL statement will have no WHERE clause
+   * (be careful in this case as the SQL statement will delete ALL rows in the table).
+   */
+  delete(table: string, where: Expression): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * CreateTable creates a Query that represents a CREATE TABLE SQL statement.
+   * The keys of cols are the column names, while the values of cols are the corresponding column types.
+   * The optional "options" parameters will be appended to the generated SQL statement.
+   */
+  createTable(table: string, cols: _TygojaDict, ...options: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropTable creates a Query that can be used to drop a table.
+   */
+  dropTable(table: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * TruncateTable creates a Query that can be used to truncate a table.
+   */
+  truncateTable(table: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * AddColumn creates a Query that can be used to add a column to a table.
+   */
+  addColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropColumn creates a Query that can be used to drop a column from a table.
+   */
+  dropColumn(table: string, col: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * RenameColumn creates a Query that can be used to rename a column in a table.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * AddPrimaryKey creates a Query that can be used to specify primary key(s) for a table.
+   * The "name" parameter specifies the name of the primary key constraint.
+   */
+  addPrimaryKey(table: string, name: string, ...cols: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropPrimaryKey creates a Query that can be used to remove the named primary key constraint from a table.
+   */
+  dropPrimaryKey(table: string, name: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * AddForeignKey creates a Query that can be used to add a foreign key constraint to a table.
+   * The length of cols and refCols must be the same as they refer to the primary and referential columns.
+   * The optional "options" parameters will be appended to the SQL statement. They can be used to
+   * specify options such as "ON DELETE CASCADE".
+   */
+  addForeignKey(table: string, name: string, cols: Array<string>, refCols: Array<string>, refTable: string, ...options: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropForeignKey creates a Query that can be used to remove the named foreign key constraint from a table.
+   */
+  dropForeignKey(table: string, name: string): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * CreateIndex creates a Query that can be used to create an index for a table.
+   */
+  createIndex(table: string, name: string, ...cols: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * CreateUniqueIndex creates a Query that can be used to create a unique index for a table.
+   */
+  createUniqueIndex(table: string, name: string, ...cols: string[]): (Query)
+ }
+ interface BaseBuilder {
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ /**
+  * MssqlBuilder is the builder for SQL Server databases.
+  */
+ type _sBKjicr = BaseBuilder
+ interface MssqlBuilder extends _sBKjicr {
+ }
+ /**
+  * MssqlQueryBuilder is the query builder for SQL Server databases.
+  */
+ type _skYeNDL = BaseQueryBuilder
+ interface MssqlQueryBuilder extends _skYeNDL {
+ }
+ interface newMssqlBuilder {
+  /**
+   * NewMssqlBuilder creates a new MssqlBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface MssqlBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface MssqlBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface MssqlBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface MssqlBuilder {
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(s: string): string
+ }
+ interface MssqlBuilder {
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(s: string): string
+ }
+ interface MssqlBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface MssqlBuilder {
+  /**
+   * RenameColumn creates a Query that can be used to rename a column in a table.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (Query)
+ }
+ interface MssqlBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface MssqlQueryBuilder {
+  /**
+   * BuildOrderByAndLimit generates the ORDER BY and LIMIT clauses.
+   */
+  buildOrderByAndLimit(sql: string, cols: Array<string>, limit: number, offset: number): string
+ }
+ /**
+  * MysqlBuilder is the builder for MySQL databases.
+  */
+ type _sBZnOlD = BaseBuilder
+ interface MysqlBuilder extends _sBZnOlD {
+ }
+ interface newMysqlBuilder {
+  /**
+   * NewMysqlBuilder creates a new MysqlBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface MysqlBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface MysqlBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface MysqlBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface MysqlBuilder {
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(s: string): string
+ }
+ interface MysqlBuilder {
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(s: string): string
+ }
+ interface MysqlBuilder {
+  /**
+   * Upsert creates a Query that represents an UPSERT SQL statement.
+   * Upsert inserts a row into the table if the primary key or unique index is not found.
+   * Otherwise it will update the row with the new values.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  upsert(table: string, cols: Params, ...constraints: string[]): (Query)
+ }
+ interface MysqlBuilder {
+  /**
+   * RenameColumn creates a Query that can be used to rename a column in a table.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (Query)
+ }
+ interface MysqlBuilder {
+  /**
+   * DropPrimaryKey creates a Query that can be used to remove the named primary key constraint from a table.
+   */
+  dropPrimaryKey(table: string, name: string): (Query)
+ }
+ interface MysqlBuilder {
+  /**
+   * DropForeignKey creates a Query that can be used to remove the named foreign key constraint from a table.
+   */
+  dropForeignKey(table: string, name: string): (Query)
+ }
+ /**
+  * OciBuilder is the builder for Oracle databases.
+  */
+ type _srXEQmy = BaseBuilder
+ interface OciBuilder extends _srXEQmy {
+ }
+ /**
+  * OciQueryBuilder is the query builder for Oracle databases.
+  */
+ type _szFzMVt = BaseQueryBuilder
+ interface OciQueryBuilder extends _szFzMVt {
+ }
+ interface newOciBuilder {
+  /**
+   * NewOciBuilder creates a new OciBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface OciBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface OciBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface OciBuilder {
+  /**
+   * GeneratePlaceholder generates an anonymous parameter placeholder with the given parameter ID.
+   */
+  generatePlaceholder(i: number): string
+ }
+ interface OciBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface OciBuilder {
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ interface OciBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface OciBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface OciQueryBuilder {
+  /**
+   * BuildOrderByAndLimit generates the ORDER BY and LIMIT clauses.
+   */
+  buildOrderByAndLimit(sql: string, cols: Array<string>, limit: number, offset: number): string
+ }
+ /**
+  * PgsqlBuilder is the builder for PostgreSQL databases.
+  */
+ type _sWRqDtn = BaseBuilder
+ interface PgsqlBuilder extends _sWRqDtn {
+ }
+ interface newPgsqlBuilder {
+  /**
+   * NewPgsqlBuilder creates a new PgsqlBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface PgsqlBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface PgsqlBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface PgsqlBuilder {
+  /**
+   * GeneratePlaceholder generates an anonymous parameter placeholder with the given parameter ID.
+   */
+  generatePlaceholder(i: number): string
+ }
+ interface PgsqlBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface PgsqlBuilder {
+  /**
+   * Upsert creates a Query that represents an UPSERT SQL statement.
+   * Upsert inserts a row into the table if the primary key or unique index is not found.
+   * Otherwise it will update the row with the new values.
+   * The keys of cols are the column names, while the values of cols are the corresponding column
+   * values to be inserted.
+   */
+  upsert(table: string, cols: Params, ...constraints: string[]): (Query)
+ }
+ interface PgsqlBuilder {
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ interface PgsqlBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface PgsqlBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ /**
+  * SqliteBuilder is the builder for SQLite databases.
+  */
+ type _skPQwFR = BaseBuilder
+ interface SqliteBuilder extends _skPQwFR {
+ }
+ interface newSqliteBuilder {
+  /**
+   * NewSqliteBuilder creates a new SqliteBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface SqliteBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface SqliteBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface SqliteBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ interface SqliteBuilder {
+  /**
+   * QuoteSimpleTableName quotes a simple table name.
+   * A simple table name does not contain any schema prefix.
+   */
+  quoteSimpleTableName(s: string): string
+ }
+ interface SqliteBuilder {
+  /**
+   * QuoteSimpleColumnName quotes a simple column name.
+   * A simple column name does not contain any table prefix.
+   */
+  quoteSimpleColumnName(s: string): string
+ }
+ interface SqliteBuilder {
+  /**
+   * DropIndex creates a Query that can be used to remove the named index from a table.
+   */
+  dropIndex(table: string, name: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * TruncateTable creates a Query that can be used to truncate a table.
+   */
+  truncateTable(table: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * RenameTable creates a Query that can be used to rename a table.
+   */
+  renameTable(oldName: string, newName: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * AlterColumn creates a Query that can be used to change the definition of a table column.
+   */
+  alterColumn(table: string, col: string, typ: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * AddPrimaryKey creates a Query that can be used to specify primary key(s) for a table.
+   * The "name" parameter specifies the name of the primary key constraint.
+   */
+  addPrimaryKey(table: string, name: string, ...cols: string[]): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * DropPrimaryKey creates a Query that can be used to remove the named primary key constraint from a table.
+   */
+  dropPrimaryKey(table: string, name: string): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * AddForeignKey creates a Query that can be used to add a foreign key constraint to a table.
+   * The length of cols and refCols must be the same as they refer to the primary and referential columns.
+   * The optional "options" parameters will be appended to the SQL statement. They can be used to
+   * specify options such as "ON DELETE CASCADE".
+   */
+  addForeignKey(table: string, name: string, cols: Array<string>, refCols: Array<string>, refTable: string, ...options: string[]): (Query)
+ }
+ interface SqliteBuilder {
+  /**
+   * DropForeignKey creates a Query that can be used to remove the named foreign key constraint from a table.
+   */
+  dropForeignKey(table: string, name: string): (Query)
+ }
+ /**
+  * StandardBuilder is the builder that is used by DB for an unknown driver.
+  */
+ type _sNKmtRd = BaseBuilder
+ interface StandardBuilder extends _sNKmtRd {
+ }
+ interface newStandardBuilder {
+  /**
+   * NewStandardBuilder creates a new StandardBuilder instance.
+   */
+  (db: DB, executor: Executor): Builder
+ }
+ interface StandardBuilder {
+  /**
+   * QueryBuilder returns the query builder supporting the current DB.
+   */
+  queryBuilder(): QueryBuilder
+ }
+ interface StandardBuilder {
+  /**
+   * Select returns a new SelectQuery object that can be used to build a SELECT statement.
+   * The parameters to this method should be the list column names to be selected.
+   * A column name may have an optional alias name. For example, Select("id", "my_name AS name").
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface StandardBuilder {
+  /**
+   * Model returns a new ModelQuery object that can be used to perform model-based DB operations.
+   * The model passed to this method should be a pointer to a model struct.
+   */
+  model(model: {
+   }): (ModelQuery)
+ }
+ /**
+  * LogFunc logs a message for each SQL statement being executed.
+  * This method takes one or multiple parameters. If a single parameter
+  * is provided, it will be treated as the log message. If multiple parameters
+  * are provided, they will be passed to fmt.Sprintf() to generate the log message.
+  */
+ interface LogFunc {(format: string, ...a: {
+  }[]): void }
+ /**
+  * PerfFunc is called when a query finishes execution.
+  * The query execution time is passed to this function so that the DB performance
+  * can be profiled. The "ns" parameter gives the number of nanoseconds that the
+  * SQL statement takes to execute, while the "execute" parameter indicates whether
+  * the SQL statement is executed or queried (usually SELECT statements).
+  */
+ interface PerfFunc {(ns: number, sql: string, execute: boolean): void }
+ /**
+  * QueryLogFunc is called each time when performing a SQL query.
+  * The "t" parameter gives the time that the SQL statement takes to execute,
+  * while rows and err are the result of the query.
+  */
+ interface QueryLogFunc {(ctx: context.Context, t: time.Duration, sql: string, rows: sql.Rows, err: Error): void }
+ /**
+  * ExecLogFunc is called each time when a SQL statement is executed.
+  * The "t" parameter gives the time that the SQL statement takes to execute,
+  * while result and err refer to the result of the execution.
+  */
+ interface ExecLogFunc {(ctx: context.Context, t: time.Duration, sql: string, result: sql.Result, err: Error): void }
+ /**
+  * BuilderFunc creates a Builder instance using the given DB instance and Executor.
+  */
+ interface BuilderFunc {(_arg0: DB, _arg1: Executor): Builder }
+ /**
+  * DB enhances sql.DB by providing a set of DB-agnostic query building methods.
+  * DB allows easier query building and population of data into Go variables.
+  */
+ type _sDWFFtS = Builder
+ interface DB extends _sDWFFtS {
+  /**
+   * FieldMapper maps struct fields to DB columns. Defaults to DefaultFieldMapFunc.
+   */
+  fieldMapper: FieldMapFunc
+  /**
+   * TableMapper maps structs to table names. Defaults to GetTableName.
+   */
+  tableMapper: TableMapFunc
+  /**
+   * LogFunc logs the SQL statements being executed. Defaults to nil, meaning no logging.
+   */
+  logFunc: LogFunc
+  /**
+   * PerfFunc logs the SQL execution time. Defaults to nil, meaning no performance profiling.
+   * Deprecated: Please use QueryLogFunc and ExecLogFunc instead.
+   */
+  perfFunc: PerfFunc
+  /**
+   * QueryLogFunc is called each time when performing a SQL query that returns data.
+   */
+  queryLogFunc: QueryLogFunc
+  /**
+   * ExecLogFunc is called each time when a SQL statement is executed.
+   */
+  execLogFunc: ExecLogFunc
+ }
+ /**
+  * Errors represents a list of errors.
+  */
+ interface Errors extends Array<Error>{}
+ interface newFromDB {
+  /**
+   * NewFromDB encapsulates an existing database connection.
+   */
+  (sqlDB: sql.DB, driverName: string): (DB)
+ }
+ interface open {
+  /**
+   * Open opens a database specified by a driver name and data source name (DSN).
+   * Note that Open does not check if DSN is specified correctly. It doesn't try to establish a DB connection either.
+   * Please refer to sql.Open() for more information.
+   */
+  (driverName: string, dsn: string): (DB)
+ }
+ interface mustOpen {
+  /**
+   * MustOpen opens a database and establishes a connection to it.
+   * Please refer to sql.Open() and sql.Ping() for more information.
+   */
+  (driverName: string, dsn: string): (DB)
+ }
+ interface DB {
+  /**
+   * Clone makes a shallow copy of DB.
+   */
+  clone(): (DB)
+ }
+ interface DB {
+  /**
+   * WithContext returns a new instance of DB associated with the given context.
+   */
+  withContext(ctx: context.Context): (DB)
+ }
+ interface DB {
+  /**
+   * Context returns the context associated with the DB instance.
+   * It returns nil if no context is associated.
+   */
+  context(): context.Context
+ }
+ interface DB {
+  /**
+   * DB returns the sql.DB instance encapsulated by dbx.DB.
+   */
+  db(): (sql.DB)
+ }
+ interface DB {
+  /**
+   * Close closes the database, releasing any open resources.
+   * It is rare to Close a DB, as the DB handle is meant to be
+   * long-lived and shared between many goroutines.
+   */
+  close(): void
+ }
+ interface DB {
+  /**
+   * Begin starts a transaction.
+   */
+  begin(): (Tx)
+ }
+ interface DB {
+  /**
+   * BeginTx starts a transaction with the given context and transaction options.
+   */
+  beginTx(ctx: context.Context, opts: sql.TxOptions): (Tx)
+ }
+ interface DB {
+  /**
+   * Wrap encapsulates an existing transaction.
+   */
+  wrap(sqlTx: sql.Tx): (Tx)
+ }
+ interface DB {
+  /**
+   * Transactional starts a transaction and executes the given function.
+   * If the function returns an error, the transaction will be rolled back.
+   * Otherwise, the transaction will be committed.
+   */
+  transactional(f: (_arg0: Tx) => void): void
+ }
+ interface DB {
+  /**
+   * TransactionalContext starts a transaction and executes the given function with the given context and transaction options.
+   * If the function returns an error, the transaction will be rolled back.
+   * Otherwise, the transaction will be committed.
+   */
+  transactionalContext(ctx: context.Context, opts: sql.TxOptions, f: (_arg0: Tx) => void): void
+ }
+ interface DB {
+  /**
+   * DriverName returns the name of the DB driver.
+   */
+  driverName(): string
+ }
+ interface DB {
+  /**
+   * QuoteTableName quotes the given table name appropriately.
+   * If the table name contains DB schema prefix, it will be handled accordingly.
+   * This method will do nothing if the table name is already quoted or if it contains parenthesis.
+   */
+  quoteTableName(s: string): string
+ }
+ interface DB {
+  /**
+   * QuoteColumnName quotes the given column name appropriately.
+   * If the table name contains table name prefix, it will be handled accordingly.
+   * This method will do nothing if the column name is already quoted or if it contains parenthesis.
+   */
+  quoteColumnName(s: string): string
+ }
+ interface Errors {
+  /**
+   * Error returns the error string of Errors.
+   */
+  error(): string
+ }
+ /**
+  * Expression represents a DB expression that can be embedded in a SQL statement.
+  */
+ interface Expression {
+  [key:string]: any;
+  /**
+   * Build converts an expression into a SQL fragment.
+   * If the expression contains binding parameters, they will be added to the given Params.
+   */
+  build(_arg0: DB, _arg1: Params): string
+ }
+ /**
+  * HashExp represents a hash expression.
+  * 
+  * A hash expression is a map whose keys are DB column names which need to be filtered according
+  * to the corresponding values. For example, HashExp{"level": 2, "dept": 10} will generate
+  * the SQL: "level"=2 AND "dept"=10.
+  * 
+  * HashExp also handles nil values and slice values. For example, HashExp{"level": []interface{}{1, 2}, "dept": nil}
+  * will generate: "level" IN (1, 2) AND "dept" IS NULL.
+  */
+ interface HashExp extends _TygojaDict{}
+ interface newExp {
+  /**
+   * NewExp generates an expression with the specified SQL fragment and the optional binding parameters.
+   */
+  (e: string, ...params: Params[]): Expression
+ }
+ interface not {
+  /**
+   * Not generates a NOT expression which prefixes "NOT" to the specified expression.
+   */
+  (e: Expression): Expression
+ }
+ interface and {
+  /**
+   * And generates an AND expression which concatenates the given expressions with "AND".
+   */
+  (...exps: Expression[]): Expression
+ }
+ interface or {
+  /**
+   * Or generates an OR expression which concatenates the given expressions with "OR".
+   */
+  (...exps: Expression[]): Expression
+ }
+ interface _in {
+  /**
+   * In generates an IN expression for the specified column and the list of allowed values.
+   * If values is empty, a SQL "0=1" will be generated which represents a false expression.
+   */
+  (col: string, ...values: {
+   }[]): Expression
+ }
+ interface notIn {
+  /**
+   * NotIn generates an NOT IN expression for the specified column and the list of disallowed values.
+   * If values is empty, an empty string will be returned indicating a true expression.
+   */
+  (col: string, ...values: {
+   }[]): Expression
+ }
+ interface like {
+  /**
+   * Like generates a LIKE expression for the specified column and the possible strings that the column should be like.
+   * If multiple values are present, the column should be like *all* of them. For example, Like("name", "key", "word")
+   * will generate a SQL expression: "name" LIKE "%key%" AND "name" LIKE "%word%".
+   * 
+   * By default, each value will be surrounded by "%" to enable partial matching. If a value contains special characters
+   * such as "%", "\", "_", they will also be properly escaped.
+   * 
+   * You may call Escape() and/or Match() to change the default behavior. For example, Like("name", "key").Match(false, true)
+   * generates "name" LIKE "key%".
+   */
+  (col: string, ...values: string[]): (LikeExp)
+ }
+ interface notLike {
+  /**
+   * NotLike generates a NOT LIKE expression.
+   * For example, NotLike("name", "key", "word") will generate a SQL expression:
+   * "name" NOT LIKE "%key%" AND "name" NOT LIKE "%word%". Please see Like() for more details.
+   */
+  (col: string, ...values: string[]): (LikeExp)
+ }
+ interface orLike {
+  /**
+   * OrLike generates an OR LIKE expression.
+   * This is similar to Like() except that the column should be like one of the possible values.
+   * For example, OrLike("name", "key", "word") will generate a SQL expression:
+   * "name" LIKE "%key%" OR "name" LIKE "%word%". Please see Like() for more details.
+   */
+  (col: string, ...values: string[]): (LikeExp)
+ }
+ interface orNotLike {
+  /**
+   * OrNotLike generates an OR NOT LIKE expression.
+   * For example, OrNotLike("name", "key", "word") will generate a SQL expression:
+   * "name" NOT LIKE "%key%" OR "name" NOT LIKE "%word%". Please see Like() for more details.
+   */
+  (col: string, ...values: string[]): (LikeExp)
+ }
+ interface exists {
+  /**
+   * Exists generates an EXISTS expression by prefixing "EXISTS" to the given expression.
+   */
+  (exp: Expression): Expression
+ }
+ interface notExists {
+  /**
+   * NotExists generates an EXISTS expression by prefixing "NOT EXISTS" to the given expression.
+   */
+  (exp: Expression): Expression
+ }
+ interface between {
+  /**
+   * Between generates a BETWEEN expression.
+   * For example, Between("age", 10, 30) generates: "age" BETWEEN 10 AND 30
+   */
+  (col: string, from: {
+   }, to: {
+   }): Expression
+ }
+ interface notBetween {
+  /**
+   * NotBetween generates a NOT BETWEEN expression.
+   * For example, NotBetween("age", 10, 30) generates: "age" NOT BETWEEN 10 AND 30
+   */
+  (col: string, from: {
+   }, to: {
+   }): Expression
+ }
+ /**
+  * Exp represents an expression with a SQL fragment and a list of optional binding parameters.
+  */
+ interface Exp {
+ }
+ interface Exp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ interface HashExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * NotExp represents an expression that should prefix "NOT" to a specified expression.
+  */
+ interface NotExp {
+ }
+ interface NotExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * AndOrExp represents an expression that concatenates multiple expressions using either "AND" or "OR".
+  */
+ interface AndOrExp {
+ }
+ interface AndOrExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * InExp represents an "IN" or "NOT IN" expression.
+  */
+ interface InExp {
+ }
+ interface InExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * LikeExp represents a variant of LIKE expressions.
+  */
+ interface LikeExp {
+  /**
+   * Like stores the LIKE operator. It can be "LIKE", "NOT LIKE".
+   * It may also be customized as something like "ILIKE".
+   */
+  like: string
+ }
+ interface LikeExp {
+  /**
+   * Escape specifies how a LIKE expression should be escaped.
+   * Each string at position 2i represents a special character and the string at position 2i+1 is
+   * the corresponding escaped version.
+   */
+  escape(...chars: string[]): (LikeExp)
+ }
+ interface LikeExp {
+  /**
+   * Match specifies whether to do wildcard matching on the left and/or right of given strings.
+   */
+  match(left: boolean, right: boolean): (LikeExp)
+ }
+ interface LikeExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * ExistsExp represents an EXISTS or NOT EXISTS expression.
+  */
+ interface ExistsExp {
+ }
+ interface ExistsExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * BetweenExp represents a BETWEEN or a NOT BETWEEN expression.
+  */
+ interface BetweenExp {
+ }
+ interface BetweenExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ interface enclose {
+  /**
+   * Enclose surrounds the provided nonempty expression with parenthesis "()".
+   */
+  (exp: Expression): Expression
+ }
+ /**
+  * EncloseExp represents a parenthesis enclosed expression.
+  */
+ interface EncloseExp {
+ }
+ interface EncloseExp {
+  /**
+   * Build converts an expression into a SQL fragment.
+   */
+  build(db: DB, params: Params): string
+ }
+ /**
+  * TableModel is the interface that should be implemented by models which have unconventional table names.
+  */
+ interface TableModel {
+  [key:string]: any;
+  tableName(): string
+ }
+ /**
+  * ModelQuery represents a query associated with a struct model.
+  */
+ interface ModelQuery {
+ }
+ interface newModelQuery {
+  (model: {
+   }, fieldMapFunc: FieldMapFunc, db: DB, builder: Builder): (ModelQuery)
+ }
+ interface ModelQuery {
+  /**
+   * Context returns the context associated with the query.
+   */
+  context(): context.Context
+ }
+ interface ModelQuery {
+  /**
+   * WithContext associates a context with the query.
+   */
+  withContext(ctx: context.Context): (ModelQuery)
+ }
+ interface ModelQuery {
+  /**
+   * Exclude excludes the specified struct fields from being inserted/updated into the DB table.
+   */
+  exclude(...attrs: string[]): (ModelQuery)
+ }
+ interface ModelQuery {
+  /**
+   * Insert inserts a row in the table using the struct model associated with this query.
+   * 
+   * By default, it inserts *all* public fields into the table, including those nil or empty ones.
+   * You may pass a list of the fields to this method to indicate that only those fields should be inserted.
+   * You may also call Exclude to exclude some fields from being inserted.
+   * 
+   * If a model has an empty primary key, it is considered auto-incremental and the corresponding struct
+   * field will be filled with the generated primary key value after a successful insertion.
+   */
+  insert(...attrs: string[]): void
+ }
+ interface ModelQuery {
+  /**
+   * Update updates a row in the table using the struct model associated with this query.
+   * The row being updated has the same primary key as specified by the model.
+   * 
+   * By default, it updates *all* public fields in the table, including those nil or empty ones.
+   * You may pass a list of the fields to this method to indicate that only those fields should be updated.
+   * You may also call Exclude to exclude some fields from being updated.
+   */
+  update(...attrs: string[]): void
+ }
+ interface ModelQuery {
+  /**
+   * Delete deletes a row in the table using the primary key specified by the struct model associated with this query.
+   */
+  delete(): void
+ }
+ /**
+  * ExecHookFunc executes before op allowing custom handling like auto fail/retry.
+  */
+ interface ExecHookFunc {(q: Query, op: () => void): void }
+ /**
+  * OneHookFunc executes right before the query populate the row result from One() call (aka. op).
+  */
+ interface OneHookFunc {(q: Query, a: {
+  }, op: (b: {
+  }) => void): void }
+ /**
+  * AllHookFunc executes right before the query populate the row result from All() call (aka. op).
+  */
+ interface AllHookFunc {(q: Query, sliceA: {
+  }, op: (sliceB: {
+  }) => void): void }
+ /**
+  * Params represents a list of parameter values to be bound to a SQL statement.
+  * The map keys are the parameter names while the map values are the corresponding parameter values.
+  */
+ interface Params extends _TygojaDict{}
+ /**
+  * Executor prepares, executes, or queries a SQL statement.
+  */
+ interface Executor {
+  [key:string]: any;
+  /**
+   * Exec executes a SQL statement
+   */
+  exec(query: string, ...args: {
+  }[]): sql.Result
+  /**
+   * ExecContext executes a SQL statement with the given context
+   */
+  execContext(ctx: context.Context, query: string, ...args: {
+  }[]): sql.Result
+  /**
+   * Query queries a SQL statement
+   */
+  query(query: string, ...args: {
+  }[]): (sql.Rows)
+  /**
+   * QueryContext queries a SQL statement with the given context
+   */
+  queryContext(ctx: context.Context, query: string, ...args: {
+  }[]): (sql.Rows)
+  /**
+   * Prepare creates a prepared statement
+   */
+  prepare(query: string): (sql.Stmt)
+ }
+ /**
+  * Query represents a SQL statement to be executed.
+  */
+ interface Query {
+  /**
+   * FieldMapper maps struct field names to DB column names.
+   */
+  fieldMapper: FieldMapFunc
+  /**
+   * LastError contains the last error (if any) of the query.
+   * LastError is cleared by Execute(), Row(), Rows(), One(), and All().
+   */
+  lastError: Error
+  /**
+   * LogFunc is used to log the SQL statement being executed.
+   */
+  logFunc: LogFunc
+  /**
+   * PerfFunc is used to log the SQL execution time. It is ignored if nil.
+   * Deprecated: Please use QueryLogFunc and ExecLogFunc instead.
+   */
+  perfFunc: PerfFunc
+  /**
+   * QueryLogFunc is called each time when performing a SQL query that returns data.
+   */
+  queryLogFunc: QueryLogFunc
+  /**
+   * ExecLogFunc is called each time when a SQL statement is executed.
+   */
+  execLogFunc: ExecLogFunc
+ }
+ interface newQuery {
+  /**
+   * NewQuery creates a new Query with the given SQL statement.
+   */
+  (db: DB, executor: Executor, sql: string): (Query)
+ }
+ interface Query {
+  /**
+   * SQL returns the original SQL used to create the query.
+   * The actual SQL (RawSQL) being executed is obtained by replacing the named
+   * parameter placeholders with anonymous ones.
+   */
+  sql(): string
+ }
+ interface Query {
+  /**
+   * Context returns the context associated with the query.
+   */
+  context(): context.Context
+ }
+ interface Query {
+  /**
+   * WithContext associates a context with the query.
+   */
+  withContext(ctx: context.Context): (Query)
+ }
+ interface Query {
+  /**
+   * WithExecHook associates the provided exec hook function with the query.
+   * 
+   * It is called for every Query resolver (Execute(), One(), All(), Row(), Column()),
+   * allowing you to implement auto fail/retry or any other additional handling.
+   */
+  withExecHook(fn: ExecHookFunc): (Query)
+ }
+ interface Query {
+  /**
+   * WithOneHook associates the provided hook function with the query,
+   * called on q.One(), allowing you to implement custom struct scan based
+   * on the One() argument and/or result.
+   */
+  withOneHook(fn: OneHookFunc): (Query)
+ }
+ interface Query {
+  /**
+   * WithOneHook associates the provided hook function with the query,
+   * called on q.All(), allowing you to implement custom slice scan based
+   * on the All() argument and/or result.
+   */
+  withAllHook(fn: AllHookFunc): (Query)
+ }
+ interface Query {
+  /**
+   * Params returns the parameters to be bound to the SQL statement represented by this query.
+   */
+  params(): Params
+ }
+ interface Query {
+  /**
+   * Prepare creates a prepared statement for later queries or executions.
+   * Close() should be called after finishing all queries.
+   */
+  prepare(): (Query)
+ }
+ interface Query {
+  /**
+   * Close closes the underlying prepared statement.
+   * Close does nothing if the query has not been prepared before.
+   */
+  close(): void
+ }
+ interface Query {
+  /**
+   * Bind sets the parameters that should be bound to the SQL statement.
+   * The parameter placeholders in the SQL statement are in the format of "{:ParamName}".
+   */
+  bind(params: Params): (Query)
+ }
+ interface Query {
+  /**
+   * Execute executes the SQL statement without retrieving data.
+   */
+  execute(): sql.Result
+ }
+ interface Query {
+  /**
+   * One executes the SQL statement and populates the first row of the result into a struct or NullStringMap.
+   * Refer to Rows.ScanStruct() and Rows.ScanMap() for more details on how to specify
+   * the variable to be populated.
+   * Note that when the query has no rows in the result set, an sql.ErrNoRows will be returned.
+   */
+  one(a: {
+   }): void
+ }
+ interface Query {
+  /**
+   * All executes the SQL statement and populates all the resulting rows into a slice of struct or NullStringMap.
+   * The slice must be given as a pointer. Each slice element must be either a struct or a NullStringMap.
+   * Refer to Rows.ScanStruct() and Rows.ScanMap() for more details on how each slice element can be.
+   * If the query returns no row, the slice will be an empty slice (not nil).
+   */
+  all(slice: {
+   }): void
+ }
+ interface Query {
+  /**
+   * Row executes the SQL statement and populates the first row of the result into a list of variables.
+   * Note that the number of the variables should match to that of the columns in the query result.
+   * Note that when the query has no rows in the result set, an sql.ErrNoRows will be returned.
+   */
+  row(...a: {
+   }[]): void
+ }
+ interface Query {
+  /**
+   * Column executes the SQL statement and populates the first column of the result into a slice.
+   * Note that the parameter must be a pointer to a slice.
+   */
+  column(a: {
+   }): void
+ }
+ interface Query {
+  /**
+   * Rows executes the SQL statement and returns a Rows object to allow retrieving data row by row.
+   */
+  rows(): (Rows)
+ }
+ /**
+  * QueryBuilder builds different clauses for a SELECT SQL statement.
+  */
+ interface QueryBuilder {
+  [key:string]: any;
+  /**
+   * BuildSelect generates a SELECT clause from the given selected column names.
+   */
+  buildSelect(cols: Array<string>, distinct: boolean, option: string): string
+  /**
+   * BuildFrom generates a FROM clause from the given tables.
+   */
+  buildFrom(tables: Array<string>): string
+  /**
+   * BuildGroupBy generates a GROUP BY clause from the given group-by columns.
+   */
+  buildGroupBy(cols: Array<string>): string
+  /**
+   * BuildJoin generates a JOIN clause from the given join information.
+   */
+  buildJoin(_arg0: Array<JoinInfo>, _arg1: Params): string
+  /**
+   * BuildWhere generates a WHERE clause from the given expression.
+   */
+  buildWhere(_arg0: Expression, _arg1: Params): string
+  /**
+   * BuildHaving generates a HAVING clause from the given expression.
+   */
+  buildHaving(_arg0: Expression, _arg1: Params): string
+  /**
+   * BuildOrderByAndLimit generates the ORDER BY and LIMIT clauses.
+   */
+  buildOrderByAndLimit(_arg0: string, _arg1: Array<string>, _arg2: number, _arg3: number): string
+  /**
+   * BuildUnion generates a UNION clause from the given union information.
+   */
+  buildUnion(_arg0: Array<UnionInfo>, _arg1: Params): string
+ }
+ /**
+  * BaseQueryBuilder provides a basic implementation of QueryBuilder.
+  */
+ interface BaseQueryBuilder {
+ }
+ interface newBaseQueryBuilder {
+  /**
+   * NewBaseQueryBuilder creates a new BaseQueryBuilder instance.
+   */
+  (db: DB): (BaseQueryBuilder)
+ }
+ interface BaseQueryBuilder {
+  /**
+   * DB returns the DB instance associated with the query builder.
+   */
+  db(): (DB)
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildSelect generates a SELECT clause from the given selected column names.
+   */
+  buildSelect(cols: Array<string>, distinct: boolean, option: string): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildFrom generates a FROM clause from the given tables.
+   */
+  buildFrom(tables: Array<string>): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildJoin generates a JOIN clause from the given join information.
+   */
+  buildJoin(joins: Array<JoinInfo>, params: Params): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildWhere generates a WHERE clause from the given expression.
+   */
+  buildWhere(e: Expression, params: Params): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildHaving generates a HAVING clause from the given expression.
+   */
+  buildHaving(e: Expression, params: Params): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildGroupBy generates a GROUP BY clause from the given group-by columns.
+   */
+  buildGroupBy(cols: Array<string>): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildOrderByAndLimit generates the ORDER BY and LIMIT clauses.
+   */
+  buildOrderByAndLimit(sql: string, cols: Array<string>, limit: number, offset: number): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildUnion generates a UNION clause from the given union information.
+   */
+  buildUnion(unions: Array<UnionInfo>, params: Params): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildOrderBy generates the ORDER BY clause.
+   */
+  buildOrderBy(cols: Array<string>): string
+ }
+ interface BaseQueryBuilder {
+  /**
+   * BuildLimit generates the LIMIT clause.
+   */
+  buildLimit(limit: number, offset: number): string
+ }
+ /**
+  * VarTypeError indicates a variable type error when trying to populating a variable with DB result.
+  */
+ interface VarTypeError extends String{}
+ interface VarTypeError {
+  /**
+   * Error returns the error message.
+   */
+  error(): string
+ }
+ /**
+  * NullStringMap is a map of sql.NullString that can be used to hold DB query result.
+  * The map keys correspond to the DB column names, while the map values are their corresponding column values.
+  */
+ interface NullStringMap extends _TygojaDict{}
+ /**
+  * Rows enhances sql.Rows by providing additional data query methods.
+  * Rows can be obtained by calling Query.Rows(). It is mainly used to populate data row by row.
+  */
+ type _sbUcBjY = sql.Rows
+ interface Rows extends _sbUcBjY {
+ }
+ interface Rows {
+  /**
+   * ScanMap populates the current row of data into a NullStringMap.
+   * Note that the NullStringMap must not be nil, or it will panic.
+   * The NullStringMap will be populated using column names as keys and their values as
+   * the corresponding element values.
+   */
+  scanMap(a: NullStringMap): void
+ }
+ interface Rows {
+  /**
+   * ScanStruct populates the current row of data into a struct.
+   * The struct must be given as a pointer.
+   * 
+   * ScanStruct associates struct fields with DB table columns through a field mapping function.
+   * It populates a struct field with the data of its associated column.
+   * Note that only exported struct fields will be populated.
+   * 
+   * By default, DefaultFieldMapFunc() is used to map struct fields to table columns.
+   * This function separates each word in a field name with a underscore and turns every letter into lower case.
+   * For example, "LastName" is mapped to "last_name", "MyID" is mapped to "my_id", and so on.
+   * To change the default behavior, set DB.FieldMapper with your custom mapping function.
+   * You may also set Query.FieldMapper to change the behavior for particular queries.
+   */
+  scanStruct(a: {
+   }): void
+ }
+ /**
+  * BuildHookFunc defines a callback function that is executed on Query creation.
+  */
+ interface BuildHookFunc {(q: Query): void }
+ /**
+  * SelectQuery represents a DB-agnostic SELECT query.
+  * It can be built into a DB-specific query by calling the Build() method.
+  */
+ interface SelectQuery {
+  /**
+   * FieldMapper maps struct field names to DB column names.
+   */
+  fieldMapper: FieldMapFunc
+  /**
+   * TableMapper maps structs to DB table names.
+   */
+  tableMapper: TableMapFunc
+ }
+ /**
+  * JoinInfo contains the specification for a JOIN clause.
+  */
+ interface JoinInfo {
+  join: string
+  table: string
+  on: Expression
+ }
+ /**
+  * UnionInfo contains the specification for a UNION clause.
+  */
+ interface UnionInfo {
+  all: boolean
+  query?: Query
+ }
+ interface newSelectQuery {
+  /**
+   * NewSelectQuery creates a new SelectQuery instance.
+   */
+  (builder: Builder, db: DB): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * WithBuildHook runs the provided hook function with the query created on Build().
+   */
+  withBuildHook(fn: BuildHookFunc): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Context returns the context associated with the query.
+   */
+  context(): context.Context
+ }
+ interface SelectQuery {
+  /**
+   * WithContext associates a context with the query.
+   */
+  withContext(ctx: context.Context): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * PreFragment sets SQL fragment that should be prepended before the select query (e.g. WITH clause).
+   */
+  preFragment(fragment: string): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * PostFragment sets SQL fragment that should be appended at the end of the select query.
+   */
+  postFragment(fragment: string): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Select specifies the columns to be selected.
+   * Column names will be automatically quoted.
+   */
+  select(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndSelect adds additional columns to be selected.
+   * Column names will be automatically quoted.
+   */
+  andSelect(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Distinct specifies whether to select columns distinctively.
+   * By default, distinct is false.
+   */
+  distinct(v: boolean): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * SelectOption specifies additional option that should be append to "SELECT".
+   */
+  selectOption(option: string): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * From specifies which tables to select from.
+   * Table names will be automatically quoted.
+   */
+  from(...tables: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Where specifies the WHERE condition.
+   */
+  where(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndWhere concatenates a new WHERE condition with the existing one (if any) using "AND".
+   */
+  andWhere(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * OrWhere concatenates a new WHERE condition with the existing one (if any) using "OR".
+   */
+  orWhere(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Join specifies a JOIN clause.
+   * The "typ" parameter specifies the JOIN type (e.g. "INNER JOIN", "LEFT JOIN").
+   */
+  join(typ: string, table: string, on: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * InnerJoin specifies an INNER JOIN clause.
+   * This is a shortcut method for Join.
+   */
+  innerJoin(table: string, on: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * LeftJoin specifies a LEFT JOIN clause.
+   * This is a shortcut method for Join.
+   */
+  leftJoin(table: string, on: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * RightJoin specifies a RIGHT JOIN clause.
+   * This is a shortcut method for Join.
+   */
+  rightJoin(table: string, on: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * OrderBy specifies the ORDER BY clause.
+   * Column names will be properly quoted. A column name can contain "ASC" or "DESC" to indicate its ordering direction.
+   */
+  orderBy(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndOrderBy appends additional columns to the existing ORDER BY clause.
+   * Column names will be properly quoted. A column name can contain "ASC" or "DESC" to indicate its ordering direction.
+   */
+  andOrderBy(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * GroupBy specifies the GROUP BY clause.
+   * Column names will be properly quoted.
+   */
+  groupBy(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndGroupBy appends additional columns to the existing GROUP BY clause.
+   * Column names will be properly quoted.
+   */
+  andGroupBy(...cols: string[]): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Having specifies the HAVING clause.
+   */
+  having(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndHaving concatenates a new HAVING condition with the existing one (if any) using "AND".
+   */
+  andHaving(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * OrHaving concatenates a new HAVING condition with the existing one (if any) using "OR".
+   */
+  orHaving(e: Expression): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Union specifies a UNION clause.
+   */
+  union(q: Query): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * UnionAll specifies a UNION ALL clause.
+   */
+  unionAll(q: Query): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Limit specifies the LIMIT clause.
+   * A negative limit means no limit.
+   */
+  limit(limit: number): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Offset specifies the OFFSET clause.
+   * A negative offset means no offset.
+   */
+  offset(offset: number): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Bind specifies the parameter values to be bound to the query.
+   */
+  bind(params: Params): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * AndBind appends additional parameters to be bound to the query.
+   */
+  andBind(params: Params): (SelectQuery)
+ }
+ interface SelectQuery {
+  /**
+   * Build builds the SELECT query and returns an executable Query object.
+   */
+  build(): (Query)
+ }
+ interface SelectQuery {
+  /**
+   * One executes the SELECT query and populates the first row of the result into the specified variable.
+   * 
+   * If the query does not specify a "from" clause, the method will try to infer the name of the table
+   * to be selected from by calling getTableName() which will return either the variable type name
+   * or the TableName() method if the variable implements the TableModel interface.
+   * 
+   * Note that when the query has no rows in the result set, an sql.ErrNoRows will be returned.
+   */
+  one(a: {
+   }): void
+ }
+ interface SelectQuery {
+  /**
+   * Model selects the row with the specified primary key and populates the model with the row data.
+   * 
+   * The model variable should be a pointer to a struct. If the query does not specify a "from" clause,
+   * it will use the model struct to determine which table to select data from. It will also use the model
+   * to infer the name of the primary key column. Only simple primary key is supported. For composite primary keys,
+   * please use Where() to specify the filtering condition.
+   */
+  model(pk: {
+   }, model: {
+   }): void
+ }
+ interface SelectQuery {
+  /**
+   * All executes the SELECT query and populates all rows of the result into a slice.
+   * 
+   * Note that the slice must be passed in as a pointer.
+   * 
+   * If the query does not specify a "from" clause, the method will try to infer the name of the table
+   * to be selected from by calling getTableName() which will return either the type name of the slice elements
+   * or the TableName() method if the slice element implements the TableModel interface.
+   */
+  all(slice: {
+   }): void
+ }
+ interface SelectQuery {
+  /**
+   * Rows builds and executes the SELECT query and returns a Rows object for data retrieval purpose.
+   * This is a shortcut to SelectQuery.Build().Rows()
+   */
+  rows(): (Rows)
+ }
+ interface SelectQuery {
+  /**
+   * Row builds and executes the SELECT query and populates the first row of the result into the specified variables.
+   * This is a shortcut to SelectQuery.Build().Row()
+   */
+  row(...a: {
+   }[]): void
+ }
+ interface SelectQuery {
+  /**
+   * Column builds and executes the SELECT statement and populates the first column of the result into a slice.
+   * Note that the parameter must be a pointer to a slice.
+   * This is a shortcut to SelectQuery.Build().Column()
+   */
+  column(a: {
+   }): void
+ }
+ /**
+  * QueryInfo represents a debug/info struct with exported SelectQuery fields.
+  */
+ interface QueryInfo {
+  preFragment: string
+  postFragment: string
+  builder: Builder
+  selects: Array<string>
+  distinct: boolean
+  selectOption: string
+  from: Array<string>
+  where: Expression
+  join: Array<JoinInfo>
+  orderBy: Array<string>
+  groupBy: Array<string>
+  having: Expression
+  union: Array<UnionInfo>
+  limit: number
+  offset: number
+  params: Params
+  context: context.Context
+  buildHook: BuildHookFunc
+ }
+ interface SelectQuery {
+  /**
+   * Info exports common SelectQuery fields allowing to inspect the
+   * current select query options.
+   */
+  info(): (QueryInfo)
+ }
+ /**
+  * FieldMapFunc converts a struct field name into a DB column name.
+  */
+ interface FieldMapFunc {(_arg0: string): string }
+ /**
+  * TableMapFunc converts a sample struct into a DB table name.
+  */
+ interface TableMapFunc {(a: {
+  }): string }
+ interface structInfo {
+ }
+ type _sCNfXkX = structInfo
+ interface structValue extends _sCNfXkX {
+ }
+ interface fieldInfo {
+ }
+ interface structInfoMapKey {
+ }
+ /**
+  * PostScanner is an optional interface used by ScanStruct.
+  */
+ interface PostScanner {
+  [key:string]: any;
+  /**
+   * PostScan executes right after the struct has been populated
+   * with the DB values, allowing you to further normalize or validate
+   * the loaded data.
+   */
+  postScan(): void
+ }
+ interface defaultFieldMapFunc {
+  /**
+   * DefaultFieldMapFunc maps a field name to a DB column name.
+   * The mapping rule set by this method is that words in a field name will be separated by underscores
+   * and the name will be turned into lower case. For example, "FirstName" maps to "first_name", and "MyID" becomes "my_id".
+   * See DB.FieldMapper for more details.
+   */
+  (f: string): string
+ }
+ interface getTableName {
+  /**
+   * GetTableName implements the default way of determining the table name corresponding to the given model struct
+   * or slice of structs. To get the actual table name for a model, you should use DB.TableMapFunc() instead.
+   * Do not call this method in a model's TableName() method because it will cause infinite loop.
+   */
+  (a: {
+   }): string
+ }
+ /**
+  * Tx enhances sql.Tx with additional querying methods.
+  */
+ type _sgPpogo = Builder
+ interface Tx extends _sgPpogo {
+ }
+ interface Tx {
+  /**
+   * Commit commits the transaction.
+   */
+  commit(): void
+ }
+ interface Tx {
+  /**
+   * Rollback aborts the transaction.
+   */
+  rollback(): void
+ }
+}
+
+/**
+ * Package exec runs external commands. It wraps os.StartProcess to make it
+ * easier to remap stdin and stdout, connect I/O with pipes, and do other
+ * adjustments.
+ * 
+ * Unlike the "system" library call from C and other languages, the
+ * os/exec package intentionally does not invoke the system shell and
+ * does not expand any glob patterns or handle other expansions,
+ * pipelines, or redirections typically done by shells. The package
+ * behaves more like C's "exec" family of functions. To expand glob
+ * patterns, either call the shell directly, taking care to escape any
+ * dangerous input, or use the [path/filepath] package's Glob function.
+ * To expand environment variables, use package os's ExpandEnv.
+ * 
+ * Note that the examples in this package assume a Unix system.
+ * They may not run on Windows, and they do not run in the Go Playground
+ * used by golang.org and godoc.org.
+ * 
+ * # Executables in the current directory
+ * 
+ * The functions [Command] and [LookPath] look for a program
+ * in the directories listed in the current path, following the
+ * conventions of the host operating system.
+ * Operating systems have for decades included the current
+ * directory in this search, sometimes implicitly and sometimes
+ * configured explicitly that way by default.
+ * Modern practice is that including the current directory
+ * is usually unexpected and often leads to security problems.
+ * 
+ * To avoid those security problems, as of Go 1.19, this package will not resolve a program
+ * using an implicit or explicit path entry relative to the current directory.
+ * That is, if you run [LookPath]("go"), it will not successfully return
+ * ./go on Unix nor .\go.exe on Windows, no matter how the path is configured.
+ * Instead, if the usual path algorithms would result in that answer,
+ * these functions return an error err satisfying [errors.Is](err, [ErrDot]).
+ * 
+ * For example, consider these two program snippets:
+ * 
+ * ```
+ * 	path, err := exec.LookPath("prog")
+ * 	if err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * 	use(path)
+ * ```
+ * 
+ * and
+ * 
+ * ```
+ * 	cmd := exec.Command("prog")
+ * 	if err := cmd.Run(); err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * ```
+ * 
+ * These will not find and run ./prog or .\prog.exe,
+ * no matter how the current path is configured.
+ * 
+ * Code that always wants to run a program from the current directory
+ * can be rewritten to say "./prog" instead of "prog".
+ * 
+ * Code that insists on including results from relative path entries
+ * can instead override the error using an errors.Is check:
+ * 
+ * ```
+ * 	path, err := exec.LookPath("prog")
+ * 	if errors.Is(err, exec.ErrDot) {
+ * 		err = nil
+ * 	}
+ * 	if err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * 	use(path)
+ * ```
+ * 
+ * and
+ * 
+ * ```
+ * 	cmd := exec.Command("prog")
+ * 	if errors.Is(cmd.Err, exec.ErrDot) {
+ * 		cmd.Err = nil
+ * 	}
+ * 	if err := cmd.Run(); err != nil {
+ * 		log.Fatal(err)
+ * 	}
+ * ```
+ * 
+ * Setting the environment variable GODEBUG=execerrdot=0
+ * disables generation of ErrDot entirely, temporarily restoring the pre-Go 1.19
+ * behavior for programs that are unable to apply more targeted fixes.
+ * A future version of Go may remove support for this variable.
+ * 
+ * Before adding such overrides, make sure you understand the
+ * security implications of doing so.
+ * See https://go.dev/blog/path-security for more information.
+ */
+namespace exec {
+ interface command {
+  /**
+   * Command returns the [Cmd] struct to execute the named program with
+   * the given arguments.
+   * 
+   * It sets only the Path and Args in the returned structure.
+   * 
+   * If name contains no path separators, Command uses [LookPath] to
+   * resolve name to a complete path if possible. Otherwise it uses name
+   * directly as Path.
+   * 
+   * The returned Cmd's Args field is constructed from the command name
+   * followed by the elements of arg, so arg should not include the
+   * command name itself. For example, Command("echo", "hello").
+   * Args[0] is always name, not the possibly resolved Path.
+   * 
+   * On Windows, processes receive the whole command line as a single string
+   * and do their own parsing. Command combines and quotes Args into a command
+   * line string with an algorithm compatible with applications using
+   * CommandLineToArgvW (which is the most common way). Notable exceptions are
+   * msiexec.exe and cmd.exe (and thus, all batch files), which have a different
+   * unquoting algorithm. In these or other similar cases, you can do the
+   * quoting yourself and provide the full command line in SysProcAttr.CmdLine,
+   * leaving Args empty.
+   */
+  (name: string, ...arg: string[]): (Cmd)
+ }
+}
+
+/**
+ * Package core is the backbone of PocketBase.
+ * 
+ * It defines the main PocketBase App interface and its base implementation.
+ */
+namespace core {
+ /**
+  * App defines the main PocketBase app interface.
+  * 
+  * Note that the interface is not intended to be implemented manually by users
+  * and instead they should use core.BaseApp (either directly or as embedded field in a custom struct).
+  * 
+  * This interface exists to make testing easier and to allow users to
+  * create common and pluggable helpers and methods that doesn't rely
+  * on a specific wrapped app struct (hence the large interface size).
+  */
+ interface App {
+  [key:string]: any;
+  /**
+   * UnsafeWithoutHooks returns a shallow copy of the current app WITHOUT any registered hooks.
+   * 
+   * NB! Note that using the returned app instance may cause data integrity errors
+   * since the Record validations and data normalizations (including files uploads)
+   * rely on the app hooks to work.
+   */
+  unsafeWithoutHooks(): App
+  /**
+   * Logger returns the default app logger.
+   * 
+   * If the application is not bootstrapped yet, fallbacks to slog.Default().
+   */
+  logger(): (slog.Logger)
+  /**
+   * IsBootstrapped checks if the application was initialized
+   * (aka. whether Bootstrap() was called).
+   */
+  isBootstrapped(): boolean
+  /**
+   * IsTransactional checks if the current app instance is part of a transaction.
+   */
+  isTransactional(): boolean
+  /**
+   * TxInfo returns the transaction associated with the current app instance (if any).
+   * 
+   * Could be used if you want to execute indirectly a function after
+   * the related app transaction completes using `app.TxInfo().OnAfterFunc(callback)`.
+   */
+  txInfo(): (TxAppInfo)
+  /**
+   * Bootstrap initializes the application
+   * (aka. create data dir, open db connections, load settings, etc.).
+   * 
+   * It will call ResetBootstrapState() if the application was already bootstrapped.
+   */
+  bootstrap(): void
+  /**
+   * ResetBootstrapState releases the initialized core app resources
+   * (closing db connections, stopping cron ticker, etc.).
+   */
+  resetBootstrapState(): void
+  /**
+   * DataDir returns the app data directory path.
+   */
+  dataDir(): string
+  /**
+   * EncryptionEnv returns the name of the app secret env key
+   * (currently used primarily for optional settings encryption but this may change in the future).
+   */
+  encryptionEnv(): string
+  /**
+   * IsDev returns whether the app is in dev mode.
+   * 
+   * When enabled logs, executed sql statements, etc. are printed to the stderr.
+   */
+  isDev(): boolean
+  /**
+   * Settings returns the loaded app settings.
+   */
+  settings(): (Settings)
+  /**
+   * Store returns the app runtime store.
+   */
+  store(): (store.Store<string, any>)
+  /**
+   * Cron returns the app cron instance.
+   */
+  cron(): (cron.Cron)
+  /**
+   * SubscriptionsBroker returns the app realtime subscriptions broker instance.
+   */
+  subscriptionsBroker(): (subscriptions.Broker)
+  /**
+   * NewMailClient creates and returns a new SMTP or Sendmail client
+   * based on the current app settings.
+   */
+  newMailClient(): mailer.Mailer
+  /**
+   * NewFilesystem creates a new local or S3 filesystem instance
+   * for managing regular app files (ex. record uploads)
+   * based on the current app settings.
+   * 
+   * NB! Make sure to call Close() on the returned result
+   * after you are done working with it.
+   */
+  newFilesystem(): (filesystem.System)
+  /**
+   * NewBackupsFilesystem creates a new local or S3 filesystem instance
+   * for managing app backups based on the current app settings.
+   * 
+   * NB! Make sure to call Close() on the returned result
+   * after you are done working with it.
+   */
+  newBackupsFilesystem(): (filesystem.System)
+  /**
+   * ReloadSettings reinitializes and reloads the stored application settings.
+   */
+  reloadSettings(): void
+  /**
+   * CreateBackup creates a new backup of the current app pb_data directory.
+   * 
+   * Backups can be stored on S3 if it is configured in app.Settings().Backups.
+   * 
+   * Please refer to the godoc of the specific CoreApp implementation
+   * for details on the backup procedures.
+   */
+  createBackup(ctx: context.Context, name: string): void
+  /**
+   * RestoreBackup restores the backup with the specified name and restarts
+   * the current running application process.
+   * 
+   * The safely perform the restore it is recommended to have free disk space
+   * for at least 2x the size of the restored pb_data backup.
+   * 
+   * Please refer to the godoc of the specific CoreApp implementation
+   * for details on the restore procedures.
+   * 
+   * NB! This feature is experimental and currently is expected to work only on UNIX based systems.
+   */
+  restoreBackup(ctx: context.Context, name: string): void
+  /**
+   * Restart restarts (aka. replaces) the current running application process.
+   * 
+   * NB! It relies on execve which is supported only on UNIX based systems.
+   */
+  restart(): void
+  /**
+   * RunSystemMigrations applies all new migrations registered in the [core.SystemMigrations] list.
+   */
+  runSystemMigrations(): void
+  /**
+   * RunAppMigrations applies all new migrations registered in the [CoreAppMigrations] list.
+   */
+  runAppMigrations(): void
+  /**
+   * RunAllMigrations applies all system and app migrations
+   * (aka. from both [core.SystemMigrations] and [CoreAppMigrations]).
+   */
+  runAllMigrations(): void
+  /**
+   * DB returns the default app data.db builder instance.
+   * 
+   * To minimize SQLITE_BUSY errors, it automatically routes the
+   * SELECT queries to the underlying concurrent db pool and everything else
+   * to the nonconcurrent one.
+   * 
+   * For more finer control over the used connections pools you can
+   * call directly ConcurrentDB() or NonconcurrentDB().
+   */
+  db(): dbx.Builder
+  /**
+   * ConcurrentDB returns the concurrent app data.db builder instance.
+   * 
+   * This method is used mainly internally for executing db read
+   * operations in a concurrent/non-blocking manner.
+   * 
+   * Most users should use simply DB() as it will automatically
+   * route the query execution to ConcurrentDB() or NonconcurrentDB().
+   * 
+   * In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  concurrentDB(): dbx.Builder
+  /**
+   * NonconcurrentDB returns the nonconcurrent app data.db builder instance.
+   * 
+   * The returned db instance is limited only to a single open connection,
+   * meaning that it can process only 1 db operation at a time (other queries queue up).
+   * 
+   * This method is used mainly internally and in the tests to execute write
+   * (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+   * 
+   * Most users should use simply DB() as it will automatically
+   * route the query execution to ConcurrentDB() or NonconcurrentDB().
+   * 
+   * In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  nonconcurrentDB(): dbx.Builder
+  /**
+   * AuxDB returns the app auxiliary.db builder instance.
+   * 
+   * To minimize SQLITE_BUSY errors, it automatically routes the
+   * SELECT queries to the underlying concurrent db pool and everything else
+   * to the nonconcurrent one.
+   * 
+   * For more finer control over the used connections pools you can
+   * call directly AuxConcurrentDB() or AuxNonconcurrentDB().
+   */
+  auxDB(): dbx.Builder
+  /**
+   * AuxConcurrentDB returns the concurrent app auxiliary.db builder instance.
+   * 
+   * This method is used mainly internally for executing db read
+   * operations in a concurrent/non-blocking manner.
+   * 
+   * Most users should use simply AuxDB() as it will automatically
+   * route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+   * 
+   * In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  auxConcurrentDB(): dbx.Builder
+  /**
+   * AuxNonconcurrentDB returns the nonconcurrent app auxiliary.db builder instance.
+   * 
+   * The returned db instance is limited only to a single open connection,
+   * meaning that it can process only 1 db operation at a time (other queries queue up).
+   * 
+   * This method is used mainly internally and in the tests to execute write
+   * (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+   * 
+   * Most users should use simply AuxDB() as it will automatically
+   * route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+   * 
+   * In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  auxNonconcurrentDB(): dbx.Builder
+  /**
+   * HasTable checks if a table (or view) with the provided name exists (case insensitive).
+   * in the data.db.
+   */
+  hasTable(tableName: string): boolean
+  /**
+   * AuxHasTable checks if a table (or view) with the provided name exists (case insensitive)
+   * in the auxiliary.db.
+   */
+  auxHasTable(tableName: string): boolean
+  /**
+   * TableColumns returns all column names of a single table by its name.
+   */
+  tableColumns(tableName: string): Array<string>
+  /**
+   * TableInfo returns the "table_info" pragma result for the specified table.
+   */
+  tableInfo(tableName: string): Array<(TableInfoRow | undefined)>
+  /**
+   * TableIndexes returns a name grouped map with all non empty index of the specified table.
+   * 
+   * Note: This method doesn't return an error on nonexisting table.
+   */
+  tableIndexes(tableName: string): _TygojaDict
+  /**
+   * DeleteTable drops the specified table.
+   * 
+   * This method is a no-op if a table with the provided name doesn't exist.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "tableName" argument must come only from trusted input!
+   */
+  deleteTable(tableName: string): void
+  /**
+   * DeleteView drops the specified view name.
+   * 
+   * This method is a no-op if a view with the provided name doesn't exist.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "name" argument must come only from trusted input!
+   */
+  deleteView(name: string): void
+  /**
+   * SaveView creates (or updates already existing) persistent SQL view.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "selectQuery" argument must come only from trusted input!
+   */
+  saveView(name: string, selectQuery: string): void
+  /**
+   * CreateViewFields creates a new FieldsList from the provided select query.
+   * 
+   * There are some caveats:
+   * - The select query must have an "id" column.
+   * - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
+   */
+  createViewFields(selectQuery: string): FieldsList
+  /**
+   * FindRecordByViewFile returns the original Record of the provided view collection file.
+   */
+  findRecordByViewFile(viewCollectionModelOrIdentifier: any, fileFieldName: string, filename: string): (Record)
+  /**
+   * Vacuum executes VACUUM on the data.db in order to reclaim unused data db disk space.
+   */
+  vacuum(): void
+  /**
+   * AuxVacuum executes VACUUM on the auxiliary.db in order to reclaim unused auxiliary db disk space.
+   */
+  auxVacuum(): void
+  /**
+   * ModelQuery creates a new preconfigured select data.db query with preset
+   * SELECT, FROM and other common fields based on the provided model.
+   */
+  modelQuery(model: Model): (dbx.SelectQuery)
+  /**
+   * AuxModelQuery creates a new preconfigured select auxiliary.db query with preset
+   * SELECT, FROM and other common fields based on the provided model.
+   */
+  auxModelQuery(model: Model): (dbx.SelectQuery)
+  /**
+   * Delete deletes the specified model from the regular app database.
+   */
+  delete(model: Model): void
+  /**
+   * Delete deletes the specified model from the regular app database
+   * (the context could be used to limit the query execution).
+   */
+  deleteWithContext(ctx: context.Context, model: Model): void
+  /**
+   * AuxDelete deletes the specified model from the auxiliary database.
+   */
+  auxDelete(model: Model): void
+  /**
+   * AuxDeleteWithContext deletes the specified model from the auxiliary database
+   * (the context could be used to limit the query execution).
+   */
+  auxDeleteWithContext(ctx: context.Context, model: Model): void
+  /**
+   * Save validates and saves the specified model into the regular app database.
+   * 
+   * If you don't want to run validations, use [App.SaveNoValidate()].
+   */
+  save(model: Model): void
+  /**
+   * SaveWithContext is the same as [App.Save()] but allows specifying a context to limit the db execution.
+   * 
+   * If you don't want to run validations, use [App.SaveNoValidateWithContext()].
+   */
+  saveWithContext(ctx: context.Context, model: Model): void
+  /**
+   * SaveNoValidate saves the specified model into the regular app database without performing validations.
+   * 
+   * If you want to also run validations before persisting, use [App.Save()].
+   */
+  saveNoValidate(model: Model): void
+  /**
+   * SaveNoValidateWithContext is the same as [App.SaveNoValidate()]
+   * but allows specifying a context to limit the db execution.
+   * 
+   * If you want to also run validations before persisting, use [App.SaveWithContext()].
+   */
+  saveNoValidateWithContext(ctx: context.Context, model: Model): void
+  /**
+   * AuxSave validates and saves the specified model into the auxiliary app database.
+   * 
+   * If you don't want to run validations, use [App.AuxSaveNoValidate()].
+   */
+  auxSave(model: Model): void
+  /**
+   * AuxSaveWithContext is the same as [App.AuxSave()] but allows specifying a context to limit the db execution.
+   * 
+   * If you don't want to run validations, use [App.AuxSaveNoValidateWithContext()].
+   */
+  auxSaveWithContext(ctx: context.Context, model: Model): void
+  /**
+   * AuxSaveNoValidate saves the specified model into the auxiliary app database without performing validations.
+   * 
+   * If you want to also run validations before persisting, use [App.AuxSave()].
+   */
+  auxSaveNoValidate(model: Model): void
+  /**
+   * AuxSaveNoValidateWithContext is the same as [App.AuxSaveNoValidate()]
+   * but allows specifying a context to limit the db execution.
+   * 
+   * If you want to also run validations before persisting, use [App.AuxSaveWithContext()].
+   */
+  auxSaveNoValidateWithContext(ctx: context.Context, model: Model): void
+  /**
+   * Validate triggers the OnModelValidate hook for the specified model.
+   */
+  validate(model: Model): void
+  /**
+   * ValidateWithContext is the same as Validate but allows specifying the ModelEvent context.
+   */
+  validateWithContext(ctx: context.Context, model: Model): void
+  /**
+   * RunInTransaction wraps fn into a transaction for the regular app database.
+   * 
+   * It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+   */
+  runInTransaction(fn: (txApp: App) => void): void
+  /**
+   * AuxRunInTransaction wraps fn into a transaction for the auxiliary app database.
+   * 
+   * It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+   */
+  auxRunInTransaction(fn: (txApp: App) => void): void
+  /**
+   * LogQuery returns a new Log select query.
+   */
+  logQuery(): (dbx.SelectQuery)
+  /**
+   * FindLogById finds a single Log entry by its id.
+   */
+  findLogById(id: string): (Log)
+  /**
+   * LogsStatsItem returns hourly grouped logs statistics.
+   */
+  logsStats(expr: dbx.Expression): Array<(LogsStatsItem | undefined)>
+  /**
+   * DeleteOldLogs delete all logs that are created before createdBefore.
+   */
+  deleteOldLogs(createdBefore: time.Time): void
+  /**
+   * CollectionQuery returns a new Collection select query.
+   */
+  collectionQuery(): (dbx.SelectQuery)
+  /**
+   * FindCollections finds all collections by the given type(s).
+   * 
+   * If collectionTypes is not set, it returns all collections.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindAllCollections() // all collections
+   * 	app.FindAllCollections("auth", "view") // only auth and view collections
+   * ```
+   */
+  findAllCollections(...collectionTypes: string[]): Array<(Collection | undefined)>
+  /**
+   * ReloadCachedCollections fetches all collections and caches them into the app store.
+   */
+  reloadCachedCollections(): void
+  /**
+   * FindCollectionByNameOrId finds a single collection by its name (case insensitive) or id.s
+   */
+  findCollectionByNameOrId(nameOrId: string): (Collection)
+  /**
+   * FindCachedCollectionByNameOrId is similar to [App.FindCollectionByNameOrId]
+   * but retrieves the Collection from the app cache instead of making a db call.
+   * 
+   * NB! This method is suitable for read-only Collection operations.
+   * 
+   * Returns [sql.ErrNoRows] if no Collection is found for consistency
+   * with the [App.FindCollectionByNameOrId] method.
+   * 
+   * If you plan making changes to the returned Collection model,
+   * use [App.FindCollectionByNameOrId] instead.
+   * 
+   * Caveats:
+   * 
+   * ```
+   *   - The returned Collection should be used only for read-only operations.
+   *     Avoid directly modifying the returned cached Collection as it will affect
+   *     the global cached value even if you don't persist the changes in the database!
+   *   - If you are updating a Collection in a transaction and then call this method before commit,
+   *     it'll return the cached Collection state and not the one from the uncommitted transaction.
+   *   - The cache is automatically updated on collections db change (create/update/delete).
+   *     To manually reload the cache you can call [App.ReloadCachedCollections]
+   * ```
+   */
+  findCachedCollectionByNameOrId(nameOrId: string): (Collection)
+  /**
+   * FindCollectionReferences returns information for all relation
+   * fields referencing the provided collection.
+   * 
+   * If the provided collection has reference to itself then it will be
+   * also included in the result. To exclude it, pass the collection id
+   * as the excludeIds argument.
+   */
+  findCollectionReferences(collection: Collection, ...excludeIds: string[]): _TygojaDict
+  /**
+   * FindCachedCollectionReferences is similar to [App.FindCollectionReferences]
+   * but retrieves the Collection from the app cache instead of making a db call.
+   * 
+   * NB! This method is suitable for read-only Collection operations.
+   * 
+   * If you plan making changes to the returned Collection model,
+   * use [App.FindCollectionReferences] instead.
+   * 
+   * Caveats:
+   * 
+   * ```
+   *   - The returned Collection should be used only for read-only operations.
+   *     Avoid directly modifying the returned cached Collection as it will affect
+   *     the global cached value even if you don't persist the changes in the database!
+   *   - If you are updating a Collection in a transaction and then call this method before commit,
+   *     it'll return the cached Collection state and not the one from the uncommitted transaction.
+   *   - The cache is automatically updated on collections db change (create/update/delete).
+   *     To manually reload the cache you can call [App.ReloadCachedCollections].
+   * ```
+   */
+  findCachedCollectionReferences(collection: Collection, ...excludeIds: string[]): _TygojaDict
+  /**
+   * IsCollectionNameUnique checks that there is no existing collection
+   * with the provided name (case insensitive!).
+   * 
+   * Note: case insensitive check because the name is used also as
+   * table name for the records.
+   */
+  isCollectionNameUnique(name: string, ...excludeIds: string[]): boolean
+  /**
+   * TruncateCollection deletes all records associated with the provided collection.
+   * 
+   * The truncate operation is executed in a single transaction,
+   * aka. either everything is deleted or none.
+   * 
+   * Note that this method will also trigger the records related
+   * cascade and file delete actions.
+   */
+  truncateCollection(collection: Collection): void
+  /**
+   * ImportCollections imports the provided collections data in a single transaction.
+   * 
+   * For existing matching collections, the imported data is unmarshaled on top of the existing model.
+   * 
+   * NB! If deleteMissing is true, ALL NON-SYSTEM COLLECTIONS AND SCHEMA FIELDS,
+   * that are not present in the imported configuration, WILL BE DELETED
+   * (this includes their related records data).
+   */
+  importCollections(toImport: Array<_TygojaDict>, deleteMissing: boolean): void
+  /**
+   * ImportCollectionsByMarshaledJSON is the same as [ImportCollections]
+   * but accept marshaled json array as import data (usually used for the autogenerated snapshots).
+   */
+  importCollectionsByMarshaledJSON(rawSliceOfMaps: string|Array<number>, deleteMissing: boolean): void
+  /**
+   * SyncRecordTableSchema compares the two provided collections
+   * and applies the necessary related record table changes.
+   * 
+   * If oldCollection is null, then only newCollection is used to create the record table.
+   * 
+   * This method is automatically invoked as part of a collection create/update/delete operation.
+   */
+  syncRecordTableSchema(newCollection: Collection, oldCollection: Collection): void
+  /**
+   * FindAllExternalAuthsByRecord returns all ExternalAuth models
+   * linked to the provided auth record.
+   */
+  findAllExternalAuthsByRecord(authRecord: Record): Array<(ExternalAuth | undefined)>
+  /**
+   * FindAllExternalAuthsByCollection returns all ExternalAuth models
+   * linked to the provided auth collection.
+   */
+  findAllExternalAuthsByCollection(collection: Collection): Array<(ExternalAuth | undefined)>
+  /**
+   * FindFirstExternalAuthByExpr returns the first available (the most recent created)
+   * ExternalAuth model that satisfies the non-nil expression.
+   */
+  findFirstExternalAuthByExpr(expr: dbx.Expression): (ExternalAuth)
+  /**
+   * FindAllMFAsByRecord returns all MFA models linked to the provided auth record.
+   */
+  findAllMFAsByRecord(authRecord: Record): Array<(MFA | undefined)>
+  /**
+   * FindAllMFAsByCollection returns all MFA models linked to the provided collection.
+   */
+  findAllMFAsByCollection(collection: Collection): Array<(MFA | undefined)>
+  /**
+   * FindMFAById returns a single MFA model by its id.
+   */
+  findMFAById(id: string): (MFA)
+  /**
+   * DeleteAllMFAsByRecord deletes all MFA models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllMFAsByRecord(authRecord: Record): void
+  /**
+   * DeleteExpiredMFAs deletes the expired MFAs for all auth collections.
+   */
+  deleteExpiredMFAs(): void
+  /**
+   * FindAllOTPsByRecord returns all OTP models linked to the provided auth record.
+   */
+  findAllOTPsByRecord(authRecord: Record): Array<(OTP | undefined)>
+  /**
+   * FindAllOTPsByCollection returns all OTP models linked to the provided collection.
+   */
+  findAllOTPsByCollection(collection: Collection): Array<(OTP | undefined)>
+  /**
+   * FindOTPById returns a single OTP model by its id.
+   */
+  findOTPById(id: string): (OTP)
+  /**
+   * DeleteAllOTPsByRecord deletes all OTP models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllOTPsByRecord(authRecord: Record): void
+  /**
+   * DeleteExpiredOTPs deletes the expired OTPs for all auth collections.
+   */
+  deleteExpiredOTPs(): void
+  /**
+   * FindAllAuthOriginsByRecord returns all AuthOrigin models linked to the provided auth record (in DESC order).
+   */
+  findAllAuthOriginsByRecord(authRecord: Record): Array<(AuthOrigin | undefined)>
+  /**
+   * FindAllAuthOriginsByCollection returns all AuthOrigin models linked to the provided collection (in DESC order).
+   */
+  findAllAuthOriginsByCollection(collection: Collection): Array<(AuthOrigin | undefined)>
+  /**
+   * FindAuthOriginById returns a single AuthOrigin model by its id.
+   */
+  findAuthOriginById(id: string): (AuthOrigin)
+  /**
+   * FindAuthOriginByRecordAndFingerprint returns a single AuthOrigin model
+   * by its authRecord relation and fingerprint.
+   */
+  findAuthOriginByRecordAndFingerprint(authRecord: Record, fingerprint: string): (AuthOrigin)
+  /**
+   * DeleteAllAuthOriginsByRecord deletes all AuthOrigin models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllAuthOriginsByRecord(authRecord: Record): void
+  /**
+   * RecordQuery returns a new Record select query from a collection model, id or name.
+   * 
+   * In case a collection id or name is provided and that collection doesn't
+   * actually exists, the generated query will be created with a cancelled context
+   * and will fail once an executor (Row(), One(), All(), etc.) is called.
+   */
+  recordQuery(collectionModelOrIdentifier: any): (dbx.SelectQuery)
+  /**
+   * FindRecordById finds the Record model by its id.
+   */
+  findRecordById(collectionModelOrIdentifier: any, recordId: string, ...optFilters: ((q: dbx.SelectQuery) => void)[]): (Record)
+  /**
+   * FindRecordsByIds finds all records by the specified ids.
+   * If no records are found, returns an empty slice.
+   */
+  findRecordsByIds(collectionModelOrIdentifier: any, recordIds: Array<string>, ...optFilters: ((q: dbx.SelectQuery) => void)[]): Array<(Record | undefined)>
+  /**
+   * FindAllRecords finds all records matching specified db expressions.
+   * 
+   * Returns all collection records if no expression is provided.
+   * 
+   * Returns an empty slice if no records are found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	// no extra expressions
+   * 	app.FindAllRecords("example")
+   * 
+   * 	// with extra expressions
+   * 	expr1 := dbx.HashExp{"email": "test@example.com"}
+   * 	expr2 := dbx.NewExp("LOWER(username) = {:username}", dbx.Params{"username": "test"})
+   * 	app.FindAllRecords("example", expr1, expr2)
+   * ```
+   */
+  findAllRecords(collectionModelOrIdentifier: any, ...exprs: dbx.Expression[]): Array<(Record | undefined)>
+  /**
+   * FindFirstRecordByData returns the first found record matching
+   * the provided key-value pair.
+   */
+  findFirstRecordByData(collectionModelOrIdentifier: any, key: string, value: any): (Record)
+  /**
+   * FindRecordsByFilter returns limit number of records matching the
+   * provided string filter.
+   * 
+   * NB! Use the last "params" argument to bind untrusted user variables!
+   * 
+   * The filter argument is optional and can be empty string to target
+   * all available records.
+   * 
+   * The sort argument is optional and can be empty string OR the same format
+   * used in the web APIs, ex. "-created,title".
+   * 
+   * If the limit argument is <= 0, no limit is applied to the query and
+   * all matching records are returned.
+   * 
+   * Returns an empty slice if no records are found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindRecordsByFilter(
+   * 		"posts",
+   * 		"title ~ {:title} && visible = {:visible}",
+   * 		"-created",
+   * 		10,
+   * 		0,
+   * 		dbx.Params{"title": "lorem ipsum", "visible": true}
+   * 	)
+   * ```
+   */
+  findRecordsByFilter(collectionModelOrIdentifier: any, filter: string, sort: string, limit: number, offset: number, ...params: dbx.Params[]): Array<(Record | undefined)>
+  /**
+   * FindFirstRecordByFilter returns the first available record matching the provided filter (if any).
+   * 
+   * NB! Use the last params argument to bind untrusted user variables!
+   * 
+   * Returns sql.ErrNoRows if no record is found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindFirstRecordByFilter("posts", "")
+   * 	app.FindFirstRecordByFilter("posts", "slug={:slug} && status='public'", dbx.Params{"slug": "test"})
+   * ```
+   */
+  findFirstRecordByFilter(collectionModelOrIdentifier: any, filter: string, ...params: dbx.Params[]): (Record)
+  /**
+   * CountRecords returns the total number of records in a collection.
+   */
+  countRecords(collectionModelOrIdentifier: any, ...exprs: dbx.Expression[]): number
+  /**
+   * FindAuthRecordByToken finds the auth record associated with the provided JWT
+   * (auth, file, verifyEmail, changeEmail, passwordReset types).
+   * 
+   * Optionally specify a list of validTypes to check tokens only from those types.
+   * 
+   * Returns an error if the JWT is invalid, expired or not associated to an auth collection record.
+   */
+  findAuthRecordByToken(token: string, ...validTypes: string[]): (Record)
+  /**
+   * FindAuthRecordByEmail finds the auth record associated with the provided email.
+   * 
+   * Returns an error if it is not an auth collection or the record is not found.
+   */
+  findAuthRecordByEmail(collectionModelOrIdentifier: any, email: string): (Record)
+  /**
+   * CanAccessRecord checks if a record is allowed to be accessed by the
+   * specified requestInfo and accessRule.
+   * 
+   * Rule and db checks are ignored in case requestInfo.Auth is a superuser.
+   * 
+   * The returned error indicate that something unexpected happened during
+   * the check (eg. invalid rule or db query error).
+   * 
+   * The method always return false on invalid rule or db query error.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	requestInfo, _ := e.RequestInfo()
+   * 	record, _ := app.FindRecordById("example", "RECORD_ID")
+   * 	rule := types.Pointer("@request.auth.id != '' || status = 'public'")
+   * 	// ... or use one of the record collection's rule, eg. record.Collection().ViewRule
+   * 
+   * 	if ok, _ := app.CanAccessRecord(record, requestInfo, rule); ok { ... }
+   * ```
+   */
+  canAccessRecord(record: Record, requestInfo: RequestInfo, accessRule: string): boolean
+  /**
+   * ExpandRecord expands the relations of a single Record model.
+   * 
+   * If optFetchFunc is not set, then a default function will be used
+   * that returns all relation records.
+   * 
+   * Returns a map with the failed expand parameters and their errors.
+   */
+  expandRecord(record: Record, expands: Array<string>, optFetchFunc: ExpandFetchFunc): _TygojaDict
+  /**
+   * ExpandRecords expands the relations of the provided Record models list.
+   * 
+   * If optFetchFunc is not set, then a default function will be used
+   * that returns all relation records.
+   * 
+   * Returns a map with the failed expand parameters and their errors.
+   */
+  expandRecords(records: Array<(Record | undefined)>, expands: Array<string>, optFetchFunc: ExpandFetchFunc): _TygojaDict
+  /**
+   * OnBootstrap hook is triggered when initializing the main application
+   * resources (db, app settings, etc).
+   */
+  onBootstrap(): (hook.Hook<BootstrapEvent | undefined>)
+  /**
+   * OnServe hook is triggered when the app web server is started
+   * (after starting the TCP listener but before initializing the blocking serve task),
+   * allowing you to adjust its options and attach new routes or middlewares.
+   */
+  onServe(): (hook.Hook<ServeEvent | undefined>)
+  /**
+   * OnTerminate hook is triggered when the app is in the process
+   * of being terminated (ex. on SIGTERM signal).
+   * 
+   * Note that the app could be terminated abruptly without awaiting the hook completion.
+   */
+  onTerminate(): (hook.Hook<TerminateEvent | undefined>)
+  /**
+   * OnBackupCreate hook is triggered on each [App.CreateBackup] call.
+   */
+  onBackupCreate(): (hook.Hook<BackupEvent | undefined>)
+  /**
+   * OnBackupRestore hook is triggered before app backup restore (aka. [App.RestoreBackup] call).
+   * 
+   * Note that by default on success the application is restarted and the after state of the hook is ignored.
+   */
+  onBackupRestore(): (hook.Hook<BackupEvent | undefined>)
+  /**
+   * OnModelValidate is triggered every time when a model is being validated
+   * (e.g. triggered by App.Validate() or App.Save()).
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelValidate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelCreate is triggered every time when a new model is being created
+   * (e.g. triggered by App.Save()).
+   * 
+   * Operations BEFORE the e.Next() execute before the model validation
+   * and the INSERT DB statement.
+   * 
+   * Operations AFTER the e.Next() execute after the model validation
+   * and the INSERT DB statement.
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is persisted in the database since its wrapping transaction may
+   * not have been committed yet.
+   * If you want to listen to only the actual persisted events, you can
+   * bind to [OnModelAfterCreateSuccess] or [OnModelAfterCreateError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelCreate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelCreateExecute is triggered after successful Model validation
+   * and right before the model INSERT DB statement execution.
+   * 
+   * Usually it is triggered as part of the App.Save() in the following firing order:
+   * OnModelCreate {
+   * ```
+   *    -> OnModelValidate (skipped with App.SaveNoValidate())
+   *    -> OnModelCreateExecute
+   * ```
+   * }
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is persisted in the database since its wrapping transaction may have been
+   * committed yet.
+   * If you want to listen to only the actual persisted events,
+   * you can bind to [OnModelAfterCreateSuccess] or [OnModelAfterCreateError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelCreateExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterCreateSuccess is triggered after each successful
+   * Model DB create persistence.
+   * 
+   * Note that when a Model is persisted as part of a transaction,
+   * this hook is delayed and executed only AFTER the transaction has been committed.
+   * This hook is NOT triggered in case the transaction rollbacks
+   * (aka. when the model wasn't persisted).
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterCreateError is triggered after each failed
+   * Model DB create persistence.
+   * 
+   * Note that the execution of this hook is either immediate or delayed
+   * depending on the error:
+   * ```
+   *   - "immediate" on App.Save() failure
+   *   - "delayed" on transaction rollback
+   * ```
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterCreateError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+  /**
+   * OnModelUpdate is triggered every time when a new model is being updated
+   * (e.g. triggered by App.Save()).
+   * 
+   * Operations BEFORE the e.Next() execute before the model validation
+   * and the UPDATE DB statement.
+   * 
+   * Operations AFTER the e.Next() execute after the model validation
+   * and the UPDATE DB statement.
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is persisted in the database since its wrapping transaction may
+   * not have been committed yet.
+   * If you want to listen to only the actual persisted events, you can
+   * bind to [OnModelAfterUpdateSuccess] or [OnModelAfterUpdateError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelUpdate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelUpdateExecute is triggered after successful Model validation
+   * and right before the model UPDATE DB statement execution.
+   * 
+   * Usually it is triggered as part of the App.Save() in the following firing order:
+   * OnModelUpdate {
+   * ```
+   *    -> OnModelValidate (skipped with App.SaveNoValidate())
+   *    -> OnModelUpdateExecute
+   * ```
+   * }
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is persisted in the database since its wrapping transaction may have been
+   * committed yet.
+   * If you want to listen to only the actual persisted events,
+   * you can bind to [OnModelAfterUpdateSuccess] or [OnModelAfterUpdateError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelUpdateExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterUpdateSuccess is triggered after each successful
+   * Model DB update persistence.
+   * 
+   * Note that when a Model is persisted as part of a transaction,
+   * this hook is delayed and executed only AFTER the transaction has been committed.
+   * This hook is NOT triggered in case the transaction rollbacks
+   * (aka. when the model changes weren't persisted).
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterUpdateError is triggered after each failed
+   * Model DB update persistence.
+   * 
+   * Note that the execution of this hook is either immediate or delayed
+   * depending on the error:
+   * ```
+   *   - "immediate" on App.Save() failure
+   *   - "delayed" on transaction rollback
+   * ```
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterUpdateError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+  /**
+   * OnModelDelete is triggered every time when a new model is being deleted
+   * (e.g. triggered by App.Delete()).
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is deleted from the database since its wrapping transaction may
+   * not have been committed yet.
+   * If you want to listen to only the actual persisted deleted events, you can
+   * bind to [OnModelAfterDeleteSuccess] or [OnModelAfterDeleteError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelDelete(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelUpdateExecute is triggered right before the model
+   * DELETE DB statement execution.
+   * 
+   * Usually it is triggered as part of the App.Delete() in the following firing order:
+   * OnModelDelete {
+   * ```
+   *    -> (internal delete checks)
+   *    -> OnModelDeleteExecute
+   * ```
+   * }
+   * 
+   * Note that successful execution doesn't guarantee that the model
+   * is deleted from the database since its wrapping transaction may
+   * not have been committed yet.
+   * If you want to listen to only the actual persisted deleted events, you can
+   * bind to [OnModelAfterDeleteSuccess] or [OnModelAfterDeleteError] hooks.
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelDeleteExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterDeleteSuccess is triggered after each successful
+   * Model DB delete persistence.
+   * 
+   * Note that when a Model is deleted as part of a transaction,
+   * this hook is delayed and executed only AFTER the transaction has been committed.
+   * This hook is NOT triggered in case the transaction rollbacks
+   * (aka. when the model delete wasn't persisted).
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+  /**
+   * OnModelAfterDeleteError is triggered after each failed
+   * Model DB delete persistence.
+   * 
+   * Note that the execution of this hook is either immediate or delayed
+   * depending on the error:
+   * ```
+   *   - "immediate" on App.Delete() failure
+   *   - "delayed" on transaction rollback
+   * ```
+   * 
+   * For convenience, if you want to listen to only the Record models
+   * events without doing manual type assertion, you can attach to the OnRecord* proxy hooks.
+   * 
+   * If the optional "tags" list (Collection id/name, Model table name, etc.) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onModelAfterDeleteError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+  /**
+   * OnRecordEnrich is triggered every time when a record is enriched
+   * (as part of the builtin Record responses, during realtime message seriazation, or when [apis.EnrichRecord] is invoked).
+   * 
+   * It could be used for example to redact/hide or add computed temporary
+   * Record model props only for the specific request info. For example:
+   * 
+   *  app.OnRecordEnrich("posts").BindFunc(func(e core.*RecordEnrichEvent) {
+   * ```
+   *      // hide one or more fields
+   *      e.Record.Hide("role")
+   * 
+   *      // add new custom field for registered users
+   *      if e.RequestInfo.Auth != nil && e.RequestInfo.Auth.Collection().Name == "users" {
+   *          e.Record.WithCustomData(true) // for security requires explicitly allowing it
+   *          e.Record.Set("computedScore", e.Record.GetInt("score") * e.RequestInfo.Auth.GetInt("baseScore"))
+   *      }
+   * 
+   *      return e.Next()
+   * ```
+   *  })
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordEnrich(...tags: string[]): (hook.TaggedHook<RecordEnrichEvent | undefined>)
+  /**
+   * OnRecordValidate is a Record proxy model hook of [OnModelValidate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordValidate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordCreate is a Record proxy model hook of [OnModelCreate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordCreate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordCreateExecute is a Record proxy model hook of [OnModelCreateExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordCreateExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterCreateSuccess is a Record proxy model hook of [OnModelAfterCreateSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterCreateError is a Record proxy model hook of [OnModelAfterCreateError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterCreateError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+  /**
+   * OnRecordUpdate is a Record proxy model hook of [OnModelUpdate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordUpdate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordUpdateExecute is a Record proxy model hook of [OnModelUpdateExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordUpdateExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterUpdateSuccess is a Record proxy model hook of [OnModelAfterUpdateSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterUpdateError is a Record proxy model hook of [OnModelAfterUpdateError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterUpdateError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+  /**
+   * OnRecordDelete is a Record proxy model hook of [OnModelDelete].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordDelete(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordDeleteExecute is a Record proxy model hook of [OnModelDeleteExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordDeleteExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterDeleteSuccess is a Record proxy model hook of [OnModelAfterDeleteSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+  /**
+   * OnRecordAfterDeleteError is a Record proxy model hook of [OnModelAfterDeleteError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAfterDeleteError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+  /**
+   * OnCollectionValidate is a Collection proxy model hook of [OnModelValidate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionValidate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionCreate is a Collection proxy model hook of [OnModelCreate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionCreate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionCreateExecute is a Collection proxy model hook of [OnModelCreateExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionCreateExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterCreateSuccess is a Collection proxy model hook of [OnModelAfterCreateSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterCreateError is a Collection proxy model hook of [OnModelAfterCreateError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterCreateError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+  /**
+   * OnCollectionUpdate is a Collection proxy model hook of [OnModelUpdate].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionUpdate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionUpdateExecute is a Collection proxy model hook of [OnModelUpdateExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionUpdateExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterUpdateSuccess is a Collection proxy model hook of [OnModelAfterUpdateSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterUpdateError is a Collection proxy model hook of [OnModelAfterUpdateError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterUpdateError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+  /**
+   * OnCollectionDelete is a Collection proxy model hook of [OnModelDelete].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionDelete(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionDeleteExecute is a Collection proxy model hook of [OnModelDeleteExecute].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionDeleteExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterDeleteSuccess is a Collection proxy model hook of [OnModelAfterDeleteSuccess].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+  /**
+   * OnCollectionAfterDeleteError is a Collection proxy model hook of [OnModelAfterDeleteError].
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onCollectionAfterDeleteError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+  /**
+   * OnMailerSend hook is triggered every time when a new email is
+   * being sent using the [App.NewMailClient()] instance.
+   * 
+   * It allows intercepting the email message or to use a custom mailer client.
+   */
+  onMailerSend(): (hook.Hook<MailerEvent | undefined>)
+  /**
+   * OnMailerRecordAuthAlertSend hook is triggered when
+   * sending a new device login auth alert email, allowing you to
+   * intercept and customize the email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordAuthAlertSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnMailerBeforeRecordResetPasswordSend hook is triggered when
+   * sending a password reset email to an auth record, allowing
+   * you to intercept and customize the email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordPasswordResetSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnMailerBeforeRecordVerificationSend hook is triggered when
+   * sending a verification email to an auth record, allowing
+   * you to intercept and customize the email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordVerificationSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnMailerRecordEmailChangeSend hook is triggered when sending a
+   * confirmation new address email to an auth record, allowing
+   * you to intercept and customize the email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordEmailChangeSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnMailerRecordOTPSend hook is triggered when sending an OTP email
+   * to an auth record, allowing you to intercept and customize the
+   * email message that is being sent.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onMailerRecordOTPSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+  /**
+   * OnRealtimeConnectRequest hook is triggered when establishing the SSE client connection.
+   * 
+   * Any execution after e.Next() of a hook handler happens after the client disconnects.
+   */
+  onRealtimeConnectRequest(): (hook.Hook<RealtimeConnectRequestEvent | undefined>)
+  /**
+   * OnRealtimeMessageSend hook is triggered when sending an SSE message to a client.
+   */
+  onRealtimeMessageSend(): (hook.Hook<RealtimeMessageEvent | undefined>)
+  /**
+   * OnRealtimeSubscribeRequest hook is triggered when updating the
+   * client subscriptions, allowing you to further validate and
+   * modify the submitted change.
+   */
+  onRealtimeSubscribeRequest(): (hook.Hook<RealtimeSubscribeRequestEvent | undefined>)
+  /**
+   * OnSettingsListRequest hook is triggered on each API Settings list request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   */
+  onSettingsListRequest(): (hook.Hook<SettingsListRequestEvent | undefined>)
+  /**
+   * OnSettingsUpdateRequest hook is triggered on each API Settings update request.
+   * 
+   * Could be used to additionally validate the request data or
+   * implement completely different persistence behavior.
+   */
+  onSettingsUpdateRequest(): (hook.Hook<SettingsUpdateRequestEvent | undefined>)
+  /**
+   * OnSettingsReload hook is triggered every time when the App.Settings()
+   * is being replaced with a new state.
+   * 
+   * Calling App.Settings() after e.Next() returns the new state.
+   */
+  onSettingsReload(): (hook.Hook<SettingsReloadEvent | undefined>)
+  /**
+   * OnFileDownloadRequest hook is triggered before each API File download request.
+   * 
+   * Could be used to validate or modify the file response before
+   * returning it to the client.
+   */
+  onFileDownloadRequest(...tags: string[]): (hook.TaggedHook<FileDownloadRequestEvent | undefined>)
+  /**
+   * OnFileBeforeTokenRequest hook is triggered on each auth file token API request.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onFileTokenRequest(...tags: string[]): (hook.TaggedHook<FileTokenRequestEvent | undefined>)
+  /**
+   * OnRecordAuthRequest hook is triggered on each successful API
+   * record authentication request (sign-in, token refresh, etc.).
+   * 
+   * Could be used to additionally validate or modify the authenticated
+   * record data and token.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthRequest(...tags: string[]): (hook.TaggedHook<RecordAuthRequestEvent | undefined>)
+  /**
+   * OnRecordAuthWithPasswordRequest hook is triggered on each
+   * Record auth with password API request.
+   * 
+   * [RecordAuthWithPasswordRequestEvent.Record] could be nil if no matching identity is found, allowing
+   * you to manually locate a different Record model (by reassigning [RecordAuthWithPasswordRequestEvent.Record]).
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthWithPasswordRequest(...tags: string[]): (hook.TaggedHook<RecordAuthWithPasswordRequestEvent | undefined>)
+  /**
+   * OnRecordAuthWithOAuth2Request hook is triggered on each Record
+   * OAuth2 sign-in/sign-up API request (after token exchange and before external provider linking).
+   * 
+   * If [RecordAuthWithOAuth2RequestEvent.Record] is not set, then the OAuth2
+   * request will try to create a new auth Record.
+   * 
+   * To assign or link a different existing record model you can
+   * change the [RecordAuthWithOAuth2RequestEvent.Record] field.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthWithOAuth2Request(...tags: string[]): (hook.TaggedHook<RecordAuthWithOAuth2RequestEvent | undefined>)
+  /**
+   * OnRecordAuthRefreshRequest hook is triggered on each Record
+   * auth refresh API request (right before generating a new auth token).
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different auth refresh behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthRefreshRequest(...tags: string[]): (hook.TaggedHook<RecordAuthRefreshRequestEvent | undefined>)
+  /**
+   * OnRecordRequestPasswordResetRequest hook is triggered on
+   * each Record request password reset API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different password reset behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordRequestPasswordResetRequest(...tags: string[]): (hook.TaggedHook<RecordRequestPasswordResetRequestEvent | undefined>)
+  /**
+   * OnRecordConfirmPasswordResetRequest hook is triggered on
+   * each Record confirm password reset API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordConfirmPasswordResetRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmPasswordResetRequestEvent | undefined>)
+  /**
+   * OnRecordRequestVerificationRequest hook is triggered on
+   * each Record request verification API request.
+   * 
+   * Could be used to additionally validate the loaded request data or implement
+   * completely different verification behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordRequestVerificationRequest(...tags: string[]): (hook.TaggedHook<RecordRequestVerificationRequestEvent | undefined>)
+  /**
+   * OnRecordConfirmVerificationRequest hook is triggered on each
+   * Record confirm verification API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordConfirmVerificationRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmVerificationRequestEvent | undefined>)
+  /**
+   * OnRecordRequestEmailChangeRequest hook is triggered on each
+   * Record request email change API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different request email change behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordRequestEmailChangeRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEmailChangeRequestEvent | undefined>)
+  /**
+   * OnRecordConfirmEmailChangeRequest hook is triggered on each
+   * Record confirm email change API request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordConfirmEmailChangeRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmEmailChangeRequestEvent | undefined>)
+  /**
+   * OnRecordRequestOTPRequest hook is triggered on each Record
+   * request OTP API request.
+   * 
+   * [RecordCreateOTPRequestEvent.Record] could be nil if no matching identity is found, allowing
+   * you to manually create or locate a different Record model (by reassigning [RecordCreateOTPRequestEvent.Record]).
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordRequestOTPRequest(...tags: string[]): (hook.TaggedHook<RecordCreateOTPRequestEvent | undefined>)
+  /**
+   * OnRecordAuthWithOTPRequest hook is triggered on each Record
+   * auth with OTP API request.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordAuthWithOTPRequest(...tags: string[]): (hook.TaggedHook<RecordAuthWithOTPRequestEvent | undefined>)
+  /**
+   * OnRecordsListRequest hook is triggered on each API Records list request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordsListRequest(...tags: string[]): (hook.TaggedHook<RecordsListRequestEvent | undefined>)
+  /**
+   * OnRecordViewRequest hook is triggered on each API Record view request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordViewRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+  /**
+   * OnRecordCreateRequest hook is triggered on each API Record create request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordCreateRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+  /**
+   * OnRecordUpdateRequest hook is triggered on each API Record update request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordUpdateRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+  /**
+   * OnRecordDeleteRequest hook is triggered on each API Record delete request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different delete behavior.
+   * 
+   * If the optional "tags" list (Collection ids or names) is specified,
+   * then all event handlers registered via the created hook will be
+   * triggered and called only if their event data origin matches the tags.
+   */
+  onRecordDeleteRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+  /**
+   * OnCollectionsListRequest hook is triggered on each API Collections list request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   */
+  onCollectionsListRequest(): (hook.Hook<CollectionsListRequestEvent | undefined>)
+  /**
+   * OnCollectionViewRequest hook is triggered on each API Collection view request.
+   * 
+   * Could be used to validate or modify the response before returning it to the client.
+   */
+  onCollectionViewRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+  /**
+   * OnCollectionCreateRequest hook is triggered on each API Collection create request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   */
+  onCollectionCreateRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+  /**
+   * OnCollectionUpdateRequest hook is triggered on each API Collection update request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different persistence behavior.
+   */
+  onCollectionUpdateRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+  /**
+   * OnCollectionDeleteRequest hook is triggered on each API Collection delete request.
+   * 
+   * Could be used to additionally validate the request data or implement
+   * completely different delete behavior.
+   */
+  onCollectionDeleteRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+  /**
+   * OnCollectionsBeforeImportRequest hook is triggered on each API
+   * collections import request.
+   * 
+   * Could be used to additionally validate the imported collections or
+   * to implement completely different import behavior.
+   */
+  onCollectionsImportRequest(): (hook.Hook<CollectionsImportRequestEvent | undefined>)
+  /**
+   * OnBatchRequest hook is triggered on each API batch request.
+   * 
+   * Could be used to additionally validate or modify the submitted batch requests.
+   */
+  onBatchRequest(): (hook.Hook<BatchRequestEvent | undefined>)
+ }
+ // @ts-ignore
+ import validation = ozzo_validation
+ /**
+  * AuthOrigin defines a Record proxy for working with the authOrigins collection.
+  */
+ type _sTDlENF = Record
+ interface AuthOrigin extends _sTDlENF {
+ }
+ interface newAuthOrigin {
+  /**
+   * NewAuthOrigin instantiates and returns a new blank *AuthOrigin model.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	origin := core.NewOrigin(app)
+   * 	origin.SetRecordRef(user.Id)
+   * 	origin.SetCollectionRef(user.Collection().Id)
+   * 	origin.SetFingerprint("...")
+   * 	app.Save(origin)
+   * ```
+   */
+  (app: App): (AuthOrigin)
+ }
+ interface AuthOrigin {
+  /**
+   * PreValidate implements the [PreValidator] interface and checks
+   * whether the proxy is properly loaded.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ interface AuthOrigin {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface AuthOrigin {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface AuthOrigin {
+  /**
+   * CollectionRef returns the "collectionRef" field value.
+   */
+  collectionRef(): string
+ }
+ interface AuthOrigin {
+  /**
+   * SetCollectionRef updates the "collectionRef" record field value.
+   */
+  setCollectionRef(collectionId: string): void
+ }
+ interface AuthOrigin {
+  /**
+   * RecordRef returns the "recordRef" record field value.
+   */
+  recordRef(): string
+ }
+ interface AuthOrigin {
+  /**
+   * SetRecordRef updates the "recordRef" record field value.
+   */
+  setRecordRef(recordId: string): void
+ }
+ interface AuthOrigin {
+  /**
+   * Fingerprint returns the "fingerprint" record field value.
+   */
+  fingerprint(): string
+ }
+ interface AuthOrigin {
+  /**
+   * SetFingerprint updates the "fingerprint" record field value.
+   */
+  setFingerprint(fingerprint: string): void
+ }
+ interface AuthOrigin {
+  /**
+   * Created returns the "created" record field value.
+   */
+  created(): types.DateTime
+ }
+ interface AuthOrigin {
+  /**
+   * Updated returns the "updated" record field value.
+   */
+  updated(): types.DateTime
+ }
+ interface BaseApp {
+  /**
+   * FindAllAuthOriginsByRecord returns all AuthOrigin models linked to the provided auth record (in DESC order).
+   */
+  findAllAuthOriginsByRecord(authRecord: Record): Array<(AuthOrigin | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllAuthOriginsByCollection returns all AuthOrigin models linked to the provided collection (in DESC order).
+   */
+  findAllAuthOriginsByCollection(collection: Collection): Array<(AuthOrigin | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAuthOriginById returns a single AuthOrigin model by its id.
+   */
+  findAuthOriginById(id: string): (AuthOrigin)
+ }
+ interface BaseApp {
+  /**
+   * FindAuthOriginByRecordAndFingerprint returns a single AuthOrigin model
+   * by its authRecord relation and fingerprint.
+   */
+  findAuthOriginByRecordAndFingerprint(authRecord: Record, fingerprint: string): (AuthOrigin)
+ }
+ interface BaseApp {
+  /**
+   * DeleteAllAuthOriginsByRecord deletes all AuthOrigin models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllAuthOriginsByRecord(authRecord: Record): void
+ }
+ /**
+  * FilesManager defines an interface with common methods that files manager models should implement.
+  */
+ interface FilesManager {
+  [key:string]: any;
+  /**
+   * BaseFilesPath returns the storage dir path used by the interface instance.
+   */
+  baseFilesPath(): string
+ }
+ /**
+  * DBConnectFunc defines a database connection initialization function.
+  */
+ interface DBConnectFunc {(dbPath: string): (dbx.DB) }
+ /**
+  * BaseAppConfig defines a BaseApp configuration option
+  */
+ interface BaseAppConfig {
+  dbConnect: DBConnectFunc
+  dataDir: string
+  encryptionEnv: string
+  queryTimeout: time.Duration
+  dataMaxOpenConns: number
+  dataMaxIdleConns: number
+  auxMaxOpenConns: number
+  auxMaxIdleConns: number
+  isDev: boolean
+ }
+ /**
+  * BaseApp implements CoreApp and defines the base PocketBase app structure.
+  */
+ interface BaseApp {
+ }
+ interface newBaseApp {
+  /**
+   * NewBaseApp creates and returns a new BaseApp instance
+   * configured with the provided arguments.
+   * 
+   * To initialize the app, you need to call `app.Bootstrap()`.
+   */
+  (config: BaseAppConfig): (BaseApp)
+ }
+ interface BaseApp {
+  /**
+   * UnsafeWithoutHooks returns a shallow copy of the current app WITHOUT any registered hooks.
+   * 
+   * NB! Note that using the returned app instance may cause data integrity errors
+   * since the Record validations and data normalizations (including files uploads)
+   * rely on the app hooks to work.
+   */
+  unsafeWithoutHooks(): App
+ }
+ interface BaseApp {
+  /**
+   * Logger returns the default app logger.
+   * 
+   * If the application is not bootstrapped yet, fallbacks to slog.Default().
+   */
+  logger(): (slog.Logger)
+ }
+ interface BaseApp {
+  /**
+   * TxInfo returns the transaction associated with the current app instance (if any).
+   * 
+   * Could be used if you want to execute indirectly a function after
+   * the related app transaction completes using `app.TxInfo().OnAfterFunc(callback)`.
+   */
+  txInfo(): (TxAppInfo)
+ }
+ interface BaseApp {
+  /**
+   * IsTransactional checks if the current app instance is part of a transaction.
+   */
+  isTransactional(): boolean
+ }
+ interface BaseApp {
+  /**
+   * IsBootstrapped checks if the application was initialized
+   * (aka. whether Bootstrap() was called).
+   */
+  isBootstrapped(): boolean
+ }
+ interface BaseApp {
+  /**
+   * Bootstrap initializes the application
+   * (aka. create data dir, open db connections, load settings, etc.).
+   * 
+   * It will call ResetBootstrapState() if the application was already bootstrapped.
+   */
+  bootstrap(): void
+ }
+ interface closer {
+  [key:string]: any;
+  close(): void
+ }
+ interface BaseApp {
+  /**
+   * ResetBootstrapState releases the initialized core app resources
+   * (closing db connections, stopping cron ticker, etc.).
+   */
+  resetBootstrapState(): void
+ }
+ interface BaseApp {
+  /**
+   * DB returns the default app data.db builder instance.
+   * 
+   * To minimize SQLITE_BUSY errors, it automatically routes the
+   * SELECT queries to the underlying concurrent db pool and everything
+   * else to the nonconcurrent one.
+   * 
+   * For more finer control over the used connections pools you can
+   * call directly ConcurrentDB() or NonconcurrentDB().
+   */
+  db(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * ConcurrentDB returns the concurrent app data.db builder instance.
+   * 
+   * This method is used mainly internally for executing db read
+   * operations in a concurrent/non-blocking manner.
+   * 
+   * Most users should use simply DB() as it will automatically
+   * route the query execution to ConcurrentDB() or NonconcurrentDB().
+   * 
+   * In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  concurrentDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * NonconcurrentDB returns the nonconcurrent app data.db builder instance.
+   * 
+   * The returned db instance is limited only to a single open connection,
+   * meaning that it can process only 1 db operation at a time (other queries queue up).
+   * 
+   * This method is used mainly internally and in the tests to execute write
+   * (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+   * 
+   * Most users should use simply DB() as it will automatically
+   * route the query execution to ConcurrentDB() or NonconcurrentDB().
+   * 
+   * In a transaction the ConcurrentDB() and NonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  nonconcurrentDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * AuxDB returns the app auxiliary.db builder instance.
+   * 
+   * To minimize SQLITE_BUSY errors, it automatically routes the
+   * SELECT queries to the underlying concurrent db pool and everything
+   * else to the nonconcurrent one.
+   * 
+   * For more finer control over the used connections pools you can
+   * call directly AuxConcurrentDB() or AuxNonconcurrentDB().
+   */
+  auxDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * AuxConcurrentDB returns the concurrent app auxiliary.db builder instance.
+   * 
+   * This method is used mainly internally for executing db read
+   * operations in a concurrent/non-blocking manner.
+   * 
+   * Most users should use simply AuxDB() as it will automatically
+   * route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+   * 
+   * In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  auxConcurrentDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * AuxNonconcurrentDB returns the nonconcurrent app auxiliary.db builder instance.
+   * 
+   * The returned db instance is limited only to a single open connection,
+   * meaning that it can process only 1 db operation at a time (other queries queue up).
+   * 
+   * This method is used mainly internally and in the tests to execute write
+   * (save/delete) db operations as it helps with minimizing the SQLITE_BUSY errors.
+   * 
+   * Most users should use simply AuxDB() as it will automatically
+   * route the query execution to AuxConcurrentDB() or AuxNonconcurrentDB().
+   * 
+   * In a transaction the AuxConcurrentDB() and AuxNonconcurrentDB() refer to the same *dbx.TX instance.
+   */
+  auxNonconcurrentDB(): dbx.Builder
+ }
+ interface BaseApp {
+  /**
+   * DataDir returns the app data directory path.
+   */
+  dataDir(): string
+ }
+ interface BaseApp {
+  /**
+   * EncryptionEnv returns the name of the app secret env key
+   * (currently used primarily for optional settings encryption but this may change in the future).
+   */
+  encryptionEnv(): string
+ }
+ interface BaseApp {
+  /**
+   * IsDev returns whether the app is in dev mode.
+   * 
+   * When enabled logs, executed sql statements, etc. are printed to the stderr.
+   */
+  isDev(): boolean
+ }
+ interface BaseApp {
+  /**
+   * Settings returns the loaded app settings.
+   */
+  settings(): (Settings)
+ }
+ interface BaseApp {
+  /**
+   * Store returns the app runtime store.
+   */
+  store(): (store.Store<string, any>)
+ }
+ interface BaseApp {
+  /**
+   * Cron returns the app cron instance.
+   */
+  cron(): (cron.Cron)
+ }
+ interface BaseApp {
+  /**
+   * SubscriptionsBroker returns the app realtime subscriptions broker instance.
+   */
+  subscriptionsBroker(): (subscriptions.Broker)
+ }
+ interface BaseApp {
+  /**
+   * NewMailClient creates and returns a new SMTP or Sendmail client
+   * based on the current app settings.
+   */
+  newMailClient(): mailer.Mailer
+ }
+ interface BaseApp {
+  /**
+   * NewFilesystem creates a new local or S3 filesystem instance
+   * for managing regular app files (ex. record uploads)
+   * based on the current app settings.
+   * 
+   * NB! Make sure to call Close() on the returned result
+   * after you are done working with it.
+   */
+  newFilesystem(): (filesystem.System)
+ }
+ interface BaseApp {
+  /**
+   * NewBackupsFilesystem creates a new local or S3 filesystem instance
+   * for managing app backups based on the current app settings.
+   * 
+   * NB! Make sure to call Close() on the returned result
+   * after you are done working with it.
+   */
+  newBackupsFilesystem(): (filesystem.System)
+ }
+ interface BaseApp {
+  /**
+   * Restart restarts (aka. replaces) the current running application process.
+   * 
+   * NB! It relies on execve which is supported only on UNIX based systems.
+   */
+  restart(): void
+ }
+ interface BaseApp {
+  /**
+   * RunSystemMigrations applies all new migrations registered in the [core.SystemMigrations] list.
+   */
+  runSystemMigrations(): void
+ }
+ interface BaseApp {
+  /**
+   * RunAppMigrations applies all new migrations registered in the [CoreAppMigrations] list.
+   */
+  runAppMigrations(): void
+ }
+ interface BaseApp {
+  /**
+   * RunAllMigrations applies all system and app migrations
+   * (aka. from both [core.SystemMigrations] and [CoreAppMigrations]).
+   */
+  runAllMigrations(): void
+ }
+ interface BaseApp {
+  onBootstrap(): (hook.Hook<BootstrapEvent | undefined>)
+ }
+ interface BaseApp {
+  onServe(): (hook.Hook<ServeEvent | undefined>)
+ }
+ interface BaseApp {
+  onTerminate(): (hook.Hook<TerminateEvent | undefined>)
+ }
+ interface BaseApp {
+  onBackupCreate(): (hook.Hook<BackupEvent | undefined>)
+ }
+ interface BaseApp {
+  onBackupRestore(): (hook.Hook<BackupEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelCreate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelCreateExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterCreateError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelUpdate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelUpdateExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterUpdateError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelValidate(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelDelete(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelDeleteExecute(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<ModelEvent | undefined>)
+ }
+ interface BaseApp {
+  onModelAfterDeleteError(...tags: string[]): (hook.TaggedHook<ModelErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordEnrich(...tags: string[]): (hook.TaggedHook<RecordEnrichEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordValidate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordCreate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordCreateExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterCreateError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordUpdate(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordUpdateExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterUpdateError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordDelete(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordDeleteExecute(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<RecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAfterDeleteError(...tags: string[]): (hook.TaggedHook<RecordErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionValidate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionCreate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionCreateExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterCreateSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterCreateError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionUpdate(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionUpdateExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterUpdateSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterUpdateError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionDelete(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionDeleteExecute(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterDeleteSuccess(...tags: string[]): (hook.TaggedHook<CollectionEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionAfterDeleteError(...tags: string[]): (hook.TaggedHook<CollectionErrorEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerSend(): (hook.Hook<MailerEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordPasswordResetSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordVerificationSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordEmailChangeSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordOTPSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onMailerRecordAuthAlertSend(...tags: string[]): (hook.TaggedHook<MailerRecordEvent | undefined>)
+ }
+ interface BaseApp {
+  onRealtimeConnectRequest(): (hook.Hook<RealtimeConnectRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRealtimeMessageSend(): (hook.Hook<RealtimeMessageEvent | undefined>)
+ }
+ interface BaseApp {
+  onRealtimeSubscribeRequest(): (hook.Hook<RealtimeSubscribeRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onSettingsListRequest(): (hook.Hook<SettingsListRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onSettingsUpdateRequest(): (hook.Hook<SettingsUpdateRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onSettingsReload(): (hook.Hook<SettingsReloadEvent | undefined>)
+ }
+ interface BaseApp {
+  onFileDownloadRequest(...tags: string[]): (hook.TaggedHook<FileDownloadRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onFileTokenRequest(...tags: string[]): (hook.TaggedHook<FileTokenRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthRequest(...tags: string[]): (hook.TaggedHook<RecordAuthRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthWithPasswordRequest(...tags: string[]): (hook.TaggedHook<RecordAuthWithPasswordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthWithOAuth2Request(...tags: string[]): (hook.TaggedHook<RecordAuthWithOAuth2RequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthRefreshRequest(...tags: string[]): (hook.TaggedHook<RecordAuthRefreshRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordRequestPasswordResetRequest(...tags: string[]): (hook.TaggedHook<RecordRequestPasswordResetRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordConfirmPasswordResetRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmPasswordResetRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordRequestVerificationRequest(...tags: string[]): (hook.TaggedHook<RecordRequestVerificationRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordConfirmVerificationRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmVerificationRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordRequestEmailChangeRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEmailChangeRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordConfirmEmailChangeRequest(...tags: string[]): (hook.TaggedHook<RecordConfirmEmailChangeRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordRequestOTPRequest(...tags: string[]): (hook.TaggedHook<RecordCreateOTPRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordAuthWithOTPRequest(...tags: string[]): (hook.TaggedHook<RecordAuthWithOTPRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordsListRequest(...tags: string[]): (hook.TaggedHook<RecordsListRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordViewRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordCreateRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordUpdateRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onRecordDeleteRequest(...tags: string[]): (hook.TaggedHook<RecordRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionsListRequest(): (hook.Hook<CollectionsListRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionViewRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionCreateRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionUpdateRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionDeleteRequest(): (hook.Hook<CollectionRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onCollectionsImportRequest(): (hook.Hook<CollectionsImportRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  onBatchRequest(): (hook.Hook<BatchRequestEvent | undefined>)
+ }
+ interface BaseApp {
+  /**
+   * CreateBackup creates a new backup of the current app pb_data directory.
+   * 
+   * If name is empty, it will be autogenerated.
+   * If backup with the same name exists, the new backup file will replace it.
+   * 
+   * The backup is executed within a transaction, meaning that new writes
+   * will be temporary "blocked" until the backup file is generated.
+   * 
+   * To safely perform the backup, it is recommended to have free disk space
+   * for at least 2x the size of the pb_data directory.
+   * 
+   * By default backups are stored in pb_data/backups
+   * (the backups directory itself is excluded from the generated backup).
+   * 
+   * When using S3 storage for the uploaded collection files, you have to
+   * take care manually to backup those since they are not part of the pb_data.
+   * 
+   * Backups can be stored on S3 if it is configured in app.Settings().Backups.
+   */
+  createBackup(ctx: context.Context, name: string): void
+ }
+ interface BaseApp {
+  /**
+   * RestoreBackup restores the backup with the specified name and restarts
+   * the current running application process.
+   * 
+   * NB! This feature is experimental and currently is expected to work only on UNIX based systems.
+   * 
+   * To safely perform the restore it is recommended to have free disk space
+   * for at least 2x the size of the restored pb_data backup.
+   * 
+   * The performed steps are:
+   * 
+   *  1. Download the backup with the specified name in a temp location
+   * ```
+   *     (this is in case of S3; otherwise it creates a temp copy of the zip)
+   * ```
+   * 
+   *  2. Extract the backup in a temp directory inside the app "pb_data"
+   * ```
+   *     (eg. "pb_data/.pb_temp_to_delete/pb_restore").
+   * ```
+   * 
+   *  3. Move the current app "pb_data" content (excluding the local backups and the special temp dir)
+   * ```
+   *     under another temp sub dir that will be deleted on the next app start up
+   *     (eg. "pb_data/.pb_temp_to_delete/old_pb_data").
+   *     This is because on some environments it may not be allowed
+   *     to delete the currently open "pb_data" files.
+   * ```
+   * 
+   *  4. Move the extracted dir content to the app "pb_data".
+   * 
+   *  5. Restart the app (on successful app bootstap it will also remove the old pb_data).
+   * 
+   * If a failure occure during the restore process the dir changes are reverted.
+   * If for whatever reason the revert is not possible, it panics.
+   * 
+   * Note that if your pb_data has custom network mounts as subdirectories, then
+   * it is possible the restore to fail during the `os.Rename` operations
+   * (see https://github.com/pocketbase/pocketbase/issues/4647).
+   */
+  restoreBackup(ctx: context.Context, name: string): void
+ }
+ interface BaseApp {
+  /**
+   * ImportCollectionsByMarshaledJSON is the same as [ImportCollections]
+   * but accept marshaled json array as import data (usually used for the autogenerated snapshots).
+   */
+  importCollectionsByMarshaledJSON(rawSliceOfMaps: string|Array<number>, deleteMissing: boolean): void
+ }
+ interface BaseApp {
+  /**
+   * ImportCollections imports the provided collections data in a single transaction.
+   * 
+   * For existing matching collections, the imported data is unmarshaled on top of the existing model.
+   * 
+   * NB! If deleteMissing is true, ALL NON-SYSTEM COLLECTIONS AND SCHEMA FIELDS,
+   * that are not present in the imported configuration, WILL BE DELETED
+   * (this includes their related records data).
+   */
+  importCollections(toImport: Array<_TygojaDict>, deleteMissing: boolean): void
+ }
+ /**
+  * @todo experiment eventually replacing the rules *string with a struct?
+  */
+ type _smnjuXX = BaseModel
+ interface baseCollection extends _smnjuXX {
+  listRule?: string
+  viewRule?: string
+  createRule?: string
+  updateRule?: string
+  deleteRule?: string
+  /**
+   * RawOptions represents the raw serialized collection option loaded from the DB.
+   * NB! This field shouldn't be modified manually. It is automatically updated
+   * with the collection type specific option before save.
+   */
+  rawOptions: types.JSONRaw
+  name: string
+  type: string
+  fields: FieldsList
+  indexes: types.JSONArray<string>
+  created: types.DateTime
+  updated: types.DateTime
+  /**
+   * System prevents the collection rename, deletion and rules change.
+   * It is used primarily for internal purposes for collections like "_superusers", "_externalAuths", etc.
+   */
+  system: boolean
+ }
+ /**
+  * Collection defines the table, fields and various options related to a set of records.
+  */
+ type _sEMwBUg = baseCollection&collectionAuthOptions&collectionViewOptions
+ interface Collection extends _sEMwBUg {
+ }
+ interface newCollection {
+  /**
+   * NewCollection initializes and returns a new Collection model with the specified type and name.
+   * 
+   * It also loads the minimal default configuration for the collection
+   * (eg. system fields, indexes, type specific options, etc.).
+   */
+  (typ: string, name: string, ...optId: string[]): (Collection)
+ }
+ interface newBaseCollection {
+  /**
+   * NewBaseCollection initializes and returns a new "base" Collection model.
+   * 
+   * It also loads the minimal default configuration for the collection
+   * (eg. system fields, indexes, type specific options, etc.).
+   */
+  (name: string, ...optId: string[]): (Collection)
+ }
+ interface newViewCollection {
+  /**
+   * NewViewCollection initializes and returns a new "view" Collection model.
+   * 
+   * It also loads the minimal default configuration for the collection
+   * (eg. system fields, indexes, type specific options, etc.).
+   */
+  (name: string, ...optId: string[]): (Collection)
+ }
+ interface newAuthCollection {
+  /**
+   * NewAuthCollection initializes and returns a new "auth" Collection model.
+   * 
+   * It also loads the minimal default configuration for the collection
+   * (eg. system fields, indexes, type specific options, etc.).
+   */
+  (name: string, ...optId: string[]): (Collection)
+ }
+ interface Collection {
+  /**
+   * TableName returns the Collection model SQL table name.
+   */
+  tableName(): string
+ }
+ interface Collection {
+  /**
+   * BaseFilesPath returns the storage dir path used by the collection.
+   */
+  baseFilesPath(): string
+ }
+ interface Collection {
+  /**
+   * IsBase checks if the current collection has "base" type.
+   */
+  isBase(): boolean
+ }
+ interface Collection {
+  /**
+   * IsAuth checks if the current collection has "auth" type.
+   */
+  isAuth(): boolean
+ }
+ interface Collection {
+  /**
+   * IsView checks if the current collection has "view" type.
+   */
+  isView(): boolean
+ }
+ interface Collection {
+  /**
+   * IntegrityChecks toggles the current collection integrity checks (ex. checking references on delete).
+   */
+  integrityChecks(enable: boolean): void
+ }
+ interface Collection {
+  /**
+   * PostScan implements the [dbx.PostScanner] interface to auto unmarshal
+   * the raw serialized options into the concrete type specific fields.
+   */
+  postScan(): void
+ }
+ interface Collection {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   * 
+   * For new/"blank" Collection models it replaces the model with a factory
+   * instance and then unmarshal the provided data one on top of it.
+   */
+  unmarshalJSON(b: string|Array<number>): void
+ }
+ interface Collection {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * 
+   * Note that non-type related fields are ignored from the serialization
+   * (ex. for "view" colections the "auth" fields are skipped).
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface Collection {
+  /**
+   * String returns a string representation of the current collection.
+   */
+  string(): string
+ }
+ interface Collection {
+  /**
+   * DBExport prepares and exports the current collection data for db persistence.
+   */
+  dbExport(app: App): _TygojaDict
+ }
+ interface Collection {
+  /**
+   * GetIndex returns s single Collection index expression by its name.
+   */
+  getIndex(name: string): string
+ }
+ interface Collection {
+  /**
+   * AddIndex adds a new index into the current collection.
+   * 
+   * If the collection has an existing index matching the new name it will be replaced with the new one.
+   */
+  addIndex(name: string, unique: boolean, columnsExpr: string, optWhereExpr: string): void
+ }
+ interface Collection {
+  /**
+   * RemoveIndex removes a single index with the specified name from the current collection.
+   */
+  removeIndex(name: string): void
+ }
+ /**
+  * collectionAuthOptions defines the options for the "auth" type collection.
+  */
+ interface collectionAuthOptions {
+  /**
+   * AuthRule could be used to specify additional record constraints
+   * applied after record authentication and right before returning the
+   * auth token response to the client.
+   * 
+   * For example, to allow only verified users you could set it to
+   * "verified = true".
+   * 
+   * Set it to empty string to allow any Auth collection record to authenticate.
+   * 
+   * Set it to nil to disallow authentication altogether for the collection
+   * (that includes password, OAuth2, etc.).
+   */
+  authRule?: string
+  /**
+   * ManageRule gives admin-like permissions to allow fully managing
+   * the auth record(s), eg. changing the password without requiring
+   * to enter the old one, directly updating the verified state and email, etc.
+   * 
+   * This rule is executed in addition to the Create and Update API rules.
+   */
+  manageRule?: string
+  /**
+   * AuthAlert defines options related to the auth alerts on new device login.
+   */
+  authAlert: AuthAlertConfig
+  /**
+   * OAuth2 specifies whether OAuth2 auth is enabled for the collection
+   * and which OAuth2 providers are allowed.
+   */
+  oauth2: OAuth2Config
+  /**
+   * PasswordAuth defines options related to the collection password authentication.
+   */
+  passwordAuth: PasswordAuthConfig
+  /**
+   * MFA defines options related to the Multi-factor authentication (MFA).
+   */
+  mfa: MFAConfig
+  /**
+   * OTP defines options related to the One-time password authentication (OTP).
+   */
+  otp: OTPConfig
+  /**
+   * Various token configurations
+   * ---
+   */
+  authToken: TokenConfig
+  passwordResetToken: TokenConfig
+  emailChangeToken: TokenConfig
+  verificationToken: TokenConfig
+  fileToken: TokenConfig
+  /**
+   * Default email templates
+   * ---
+   */
+  verificationTemplate: EmailTemplate
+  resetPasswordTemplate: EmailTemplate
+  confirmEmailChangeTemplate: EmailTemplate
+ }
+ interface EmailTemplate {
+  subject: string
+  body: string
+ }
+ interface EmailTemplate {
+  /**
+   * Validate makes EmailTemplate validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface EmailTemplate {
+  /**
+   * Resolve replaces the placeholder parameters in the current email
+   * template and returns its components as ready-to-use strings.
+   */
+  resolve(placeholders: _TygojaDict): [string, string]
+ }
+ interface AuthAlertConfig {
+  enabled: boolean
+  emailTemplate: EmailTemplate
+ }
+ interface AuthAlertConfig {
+  /**
+   * Validate makes AuthAlertConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TokenConfig {
+  secret: string
+  /**
+   * Duration specifies how long an issued token to be valid (in seconds)
+   */
+  duration: number
+ }
+ interface TokenConfig {
+  /**
+   * Validate makes TokenConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TokenConfig {
+  /**
+   * DurationTime returns the current Duration as [time.Duration].
+   */
+  durationTime(): time.Duration
+ }
+ interface OTPConfig {
+  enabled: boolean
+  /**
+   * Duration specifies how long the OTP to be valid (in seconds)
+   */
+  duration: number
+  /**
+   * Length specifies the auto generated password length.
+   */
+  length: number
+  /**
+   * EmailTemplate is the default OTP email template that will be send to the auth record.
+   * 
+   * In addition to the system placeholders you can also make use of
+   * [core.EmailPlaceholderOTPId] and [core.EmailPlaceholderOTP].
+   */
+  emailTemplate: EmailTemplate
+ }
+ interface OTPConfig {
+  /**
+   * Validate makes OTPConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface OTPConfig {
+  /**
+   * DurationTime returns the current Duration as [time.Duration].
+   */
+  durationTime(): time.Duration
+ }
+ interface MFAConfig {
+  enabled: boolean
+  /**
+   * Duration specifies how long an issued MFA to be valid (in seconds)
+   */
+  duration: number
+  /**
+   * Rule is an optional field to restrict MFA only for the records that satisfy the rule.
+   * 
+   * Leave it empty to enable MFA for everyone.
+   */
+  rule: string
+ }
+ interface MFAConfig {
+  /**
+   * Validate makes MFAConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface MFAConfig {
+  /**
+   * DurationTime returns the current Duration as [time.Duration].
+   */
+  durationTime(): time.Duration
+ }
+ interface PasswordAuthConfig {
+  enabled: boolean
+  /**
+   * IdentityFields is a list of field names that could be used as
+   * identity during password authentication.
+   * 
+   * Usually only fields that has single column UNIQUE index are accepted as values.
+   */
+  identityFields: Array<string>
+ }
+ interface PasswordAuthConfig {
+  /**
+   * Validate makes PasswordAuthConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface OAuth2KnownFields {
+  id: string
+  name: string
+  username: string
+  avatarURL: string
+ }
+ interface OAuth2Config {
+  providers: Array<OAuth2ProviderConfig>
+  mappedFields: OAuth2KnownFields
+  enabled: boolean
+ }
+ interface OAuth2Config {
+  /**
+   * GetProviderConfig returns the first OAuth2ProviderConfig that matches the specified name.
+   * 
+   * Returns false and zero config if no such provider is available in c.Providers.
+   */
+  getProviderConfig(name: string): [OAuth2ProviderConfig, boolean]
+ }
+ interface OAuth2Config {
+  /**
+   * Validate makes OAuth2Config validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface OAuth2ProviderConfig {
+  /**
+   * PKCE overwrites the default provider PKCE config option.
+   * 
+   * This usually shouldn't be needed but some OAuth2 vendors, like the LinkedIn OIDC,
+   * may require manual adjustment due to returning error if extra parameters are added to the request
+   * (https://github.com/pocketbase/pocketbase/discussions/3799#discussioncomment-7640312)
+   */
+  pkce?: boolean
+  name: string
+  clientId: string
+  clientSecret: string
+  authURL: string
+  tokenURL: string
+  userInfoURL: string
+  displayName: string
+  extra: _TygojaDict
+ }
+ interface OAuth2ProviderConfig {
+  /**
+   * Validate makes OAuth2ProviderConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface OAuth2ProviderConfig {
+  /**
+   * InitProvider returns a new auth.Provider instance loaded with the current OAuth2ProviderConfig options.
+   */
+  initProvider(): auth.Provider
+ }
+ /**
+  * collectionBaseOptions defines the options for the "base" type collection.
+  */
+ interface collectionBaseOptions {
+ }
+ /**
+  * collectionViewOptions defines the options for the "view" type collection.
+  */
+ interface collectionViewOptions {
+  viewQuery: string
+ }
+ interface BaseApp {
+  /**
+   * CollectionQuery returns a new Collection select query.
+   */
+  collectionQuery(): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * FindCollections finds all collections by the given type(s).
+   * 
+   * If collectionTypes is not set, it returns all collections.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindAllCollections() // all collections
+   * 	app.FindAllCollections("auth", "view") // only auth and view collections
+   * ```
+   */
+  findAllCollections(...collectionTypes: string[]): Array<(Collection | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * ReloadCachedCollections fetches all collections and caches them into the app store.
+   */
+  reloadCachedCollections(): void
+ }
+ interface BaseApp {
+  /**
+   * FindCollectionByNameOrId finds a single collection by its name (case insensitive) or id.
+   */
+  findCollectionByNameOrId(nameOrId: string): (Collection)
+ }
+ interface BaseApp {
+  /**
+   * FindCachedCollectionByNameOrId is similar to [BaseApp.FindCollectionByNameOrId]
+   * but retrieves the Collection from the app cache instead of making a db call.
+   * 
+   * NB! This method is suitable for read-only Collection operations.
+   * 
+   * Returns [sql.ErrNoRows] if no Collection is found for consistency
+   * with the [BaseApp.FindCollectionByNameOrId] method.
+   * 
+   * If you plan making changes to the returned Collection model,
+   * use [BaseApp.FindCollectionByNameOrId] instead.
+   * 
+   * Caveats:
+   * 
+   * ```
+   *   - The returned Collection should be used only for read-only operations.
+   *     Avoid directly modifying the returned cached Collection as it will affect
+   *     the global cached value even if you don't persist the changes in the database!
+   *   - If you are updating a Collection in a transaction and then call this method before commit,
+   *     it'll return the cached Collection state and not the one from the uncommitted transaction.
+   *   - The cache is automatically updated on collections db change (create/update/delete).
+   *     To manually reload the cache you can call [BaseApp.ReloadCachedCollections].
+   * ```
+   */
+  findCachedCollectionByNameOrId(nameOrId: string): (Collection)
+ }
+ interface BaseApp {
+  /**
+   * FindCollectionReferences returns information for all relation fields
+   * referencing the provided collection.
+   * 
+   * If the provided collection has reference to itself then it will be
+   * also included in the result. To exclude it, pass the collection id
+   * as the excludeIds argument.
+   */
+  findCollectionReferences(collection: Collection, ...excludeIds: string[]): _TygojaDict
+ }
+ interface BaseApp {
+  /**
+   * FindCachedCollectionReferences is similar to [BaseApp.FindCollectionReferences]
+   * but retrieves the Collection from the app cache instead of making a db call.
+   * 
+   * NB! This method is suitable for read-only Collection operations.
+   * 
+   * If you plan making changes to the returned Collection model,
+   * use [BaseApp.FindCollectionReferences] instead.
+   * 
+   * Caveats:
+   * 
+   * ```
+   *   - The returned Collection should be used only for read-only operations.
+   *     Avoid directly modifying the returned cached Collection as it will affect
+   *     the global cached value even if you don't persist the changes in the database!
+   *   - If you are updating a Collection in a transaction and then call this method before commit,
+   *     it'll return the cached Collection state and not the one from the uncommitted transaction.
+   *   - The cache is automatically updated on collections db change (create/update/delete).
+   *     To manually reload the cache you can call [BaseApp.ReloadCachedCollections].
+   * ```
+   */
+  findCachedCollectionReferences(collection: Collection, ...excludeIds: string[]): _TygojaDict
+ }
+ interface BaseApp {
+  /**
+   * IsCollectionNameUnique checks that there is no existing collection
+   * with the provided name (case insensitive!).
+   * 
+   * Note: case insensitive check because the name is used also as
+   * table name for the records.
+   */
+  isCollectionNameUnique(name: string, ...excludeIds: string[]): boolean
+ }
+ interface BaseApp {
+  /**
+   * TruncateCollection deletes all records associated with the provided collection.
+   * 
+   * The truncate operation is executed in a single transaction,
+   * aka. either everything is deleted or none.
+   * 
+   * Note that this method will also trigger the records related
+   * cascade and file delete actions.
+   */
+  truncateCollection(collection: Collection): void
+ }
+ interface BaseApp {
+  /**
+   * SyncRecordTableSchema compares the two provided collections
+   * and applies the necessary related record table changes.
+   * 
+   * If oldCollection is null, then only newCollection is used to create the record table.
+   * 
+   * This method is automatically invoked as part of a collection create/update/delete operation.
+   */
+  syncRecordTableSchema(newCollection: Collection, oldCollection: Collection): void
+ }
+ interface collectionValidator {
+ }
+ interface optionsValidator {
+  [key:string]: any;
+ }
+ /**
+  * DBExporter defines an interface for custom DB data export.
+  * Usually used as part of [App.Save].
+  */
+ interface DBExporter {
+  [key:string]: any;
+  /**
+   * DBExport returns a key-value map with the data to be used when saving the struct in the database.
+   */
+  dbExport(app: App): _TygojaDict
+ }
+ /**
+  * PreValidator defines an optional model interface for registering a
+  * function that will run BEFORE firing the validation hooks (see [App.ValidateWithContext]).
+  */
+ interface PreValidator {
+  [key:string]: any;
+  /**
+   * PreValidate defines a function that runs BEFORE the validation hooks.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ /**
+  * PostValidator defines an optional model interface for registering a
+  * function that will run AFTER executing the validation hooks (see [App.ValidateWithContext]).
+  */
+ interface PostValidator {
+  [key:string]: any;
+  /**
+   * PostValidate defines a function that runs AFTER the successful
+   * execution of the validation hooks.
+   */
+  postValidate(ctx: context.Context, app: App): void
+ }
+ interface generateDefaultRandomId {
+  /**
+   * GenerateDefaultRandomId generates a default random id string
+   * (note: the generated random string is not intended for security purposes).
+   */
+  (): string
+ }
+ interface BaseApp {
+  /**
+   * ModelQuery creates a new preconfigured select data.db query with preset
+   * SELECT, FROM and other common fields based on the provided model.
+   */
+  modelQuery(m: Model): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * AuxModelQuery creates a new preconfigured select auxiliary.db query with preset
+   * SELECT, FROM and other common fields based on the provided model.
+   */
+  auxModelQuery(m: Model): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * Delete deletes the specified model from the regular app database.
+   */
+  delete(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * Delete deletes the specified model from the regular app database
+   * (the context could be used to limit the query execution).
+   */
+  deleteWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxDelete deletes the specified model from the auxiliary database.
+   */
+  auxDelete(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxDeleteWithContext deletes the specified model from the auxiliary database
+   * (the context could be used to limit the query execution).
+   */
+  auxDeleteWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * Save validates and saves the specified model into the regular app database.
+   * 
+   * If you don't want to run validations, use [App.SaveNoValidate()].
+   */
+  save(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * SaveWithContext is the same as [App.Save()] but allows specifying a context to limit the db execution.
+   * 
+   * If you don't want to run validations, use [App.SaveNoValidateWithContext()].
+   */
+  saveWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * SaveNoValidate saves the specified model into the regular app database without performing validations.
+   * 
+   * If you want to also run validations before persisting, use [App.Save()].
+   */
+  saveNoValidate(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * SaveNoValidateWithContext is the same as [App.SaveNoValidate()]
+   * but allows specifying a context to limit the db execution.
+   * 
+   * If you want to also run validations before persisting, use [App.SaveWithContext()].
+   */
+  saveNoValidateWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxSave validates and saves the specified model into the auxiliary app database.
+   * 
+   * If you don't want to run validations, use [App.AuxSaveNoValidate()].
+   */
+  auxSave(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxSaveWithContext is the same as [App.AuxSave()] but allows specifying a context to limit the db execution.
+   * 
+   * If you don't want to run validations, use [App.AuxSaveNoValidateWithContext()].
+   */
+  auxSaveWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxSaveNoValidate saves the specified model into the auxiliary app database without performing validations.
+   * 
+   * If you want to also run validations before persisting, use [App.AuxSave()].
+   */
+  auxSaveNoValidate(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * AuxSaveNoValidateWithContext is the same as [App.AuxSaveNoValidate()]
+   * but allows specifying a context to limit the db execution.
+   * 
+   * If you want to also run validations before persisting, use [App.AuxSaveWithContext()].
+   */
+  auxSaveNoValidateWithContext(ctx: context.Context, model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * Validate triggers the OnModelValidate hook for the specified model.
+   */
+  validate(model: Model): void
+ }
+ interface BaseApp {
+  /**
+   * ValidateWithContext is the same as Validate but allows specifying the ModelEvent context.
+   */
+  validateWithContext(ctx: context.Context, model: Model): void
+ }
+ /**
+  * note: expects both builder to use the same driver
+  */
+ interface dualDBBuilder {
+ }
+ interface dualDBBuilder {
+  /**
+   * Select implements the [dbx.Builder.Select] interface method.
+   */
+  select(...cols: string[]): (dbx.SelectQuery)
+ }
+ interface dualDBBuilder {
+  /**
+   * Model implements the [dbx.Builder.Model] interface method.
+   */
+  model(data: {
+   }): (dbx.ModelQuery)
+ }
+ interface dualDBBuilder {
+  /**
+   * GeneratePlaceholder implements the [dbx.Builder.GeneratePlaceholder] interface method.
+   */
+  generatePlaceholder(i: number): string
+ }
+ interface dualDBBuilder {
+  /**
+   * Quote implements the [dbx.Builder.Quote] interface method.
+   */
+  quote(str: string): string
+ }
+ interface dualDBBuilder {
+  /**
+   * QuoteSimpleTableName implements the [dbx.Builder.QuoteSimpleTableName] interface method.
+   */
+  quoteSimpleTableName(table: string): string
+ }
+ interface dualDBBuilder {
+  /**
+   * QuoteSimpleColumnName implements the [dbx.Builder.QuoteSimpleColumnName] interface method.
+   */
+  quoteSimpleColumnName(col: string): string
+ }
+ interface dualDBBuilder {
+  /**
+   * QueryBuilder implements the [dbx.Builder.QueryBuilder] interface method.
+   */
+  queryBuilder(): dbx.QueryBuilder
+ }
+ interface dualDBBuilder {
+  /**
+   * Insert implements the [dbx.Builder.Insert] interface method.
+   */
+  insert(table: string, cols: dbx.Params): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * Upsert implements the [dbx.Builder.Upsert] interface method.
+   */
+  upsert(table: string, cols: dbx.Params, ...constraints: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * Update implements the [dbx.Builder.Update] interface method.
+   */
+  update(table: string, cols: dbx.Params, where: dbx.Expression): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * Delete implements the [dbx.Builder.Delete] interface method.
+   */
+  delete(table: string, where: dbx.Expression): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * CreateTable implements the [dbx.Builder.CreateTable] interface method.
+   */
+  createTable(table: string, cols: _TygojaDict, ...options: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * RenameTable implements the [dbx.Builder.RenameTable] interface method.
+   */
+  renameTable(oldName: string, newName: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropTable implements the [dbx.Builder.DropTable] interface method.
+   */
+  dropTable(table: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * TruncateTable implements the [dbx.Builder.TruncateTable] interface method.
+   */
+  truncateTable(table: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * AddColumn implements the [dbx.Builder.AddColumn] interface method.
+   */
+  addColumn(table: string, col: string, typ: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropColumn implements the [dbx.Builder.DropColumn] interface method.
+   */
+  dropColumn(table: string, col: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * RenameColumn implements the [dbx.Builder.RenameColumn] interface method.
+   */
+  renameColumn(table: string, oldName: string, newName: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * AlterColumn implements the [dbx.Builder.AlterColumn] interface method.
+   */
+  alterColumn(table: string, col: string, typ: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * AddPrimaryKey implements the [dbx.Builder.AddPrimaryKey] interface method.
+   */
+  addPrimaryKey(table: string, name: string, ...cols: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropPrimaryKey implements the [dbx.Builder.DropPrimaryKey] interface method.
+   */
+  dropPrimaryKey(table: string, name: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * AddForeignKey implements the [dbx.Builder.AddForeignKey] interface method.
+   */
+  addForeignKey(table: string, name: string, cols: Array<string>, refCols: Array<string>, refTable: string, ...options: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropForeignKey implements the [dbx.Builder.DropForeignKey] interface method.
+   */
+  dropForeignKey(table: string, name: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * CreateIndex implements the [dbx.Builder.CreateIndex] interface method.
+   */
+  createIndex(table: string, name: string, ...cols: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * CreateUniqueIndex implements the [dbx.Builder.CreateUniqueIndex] interface method.
+   */
+  createUniqueIndex(table: string, name: string, ...cols: string[]): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * DropIndex implements the [dbx.Builder.DropIndex] interface method.
+   */
+  dropIndex(table: string, name: string): (dbx.Query)
+ }
+ interface dualDBBuilder {
+  /**
+   * NewQuery implements the [dbx.Builder.NewQuery] interface method by
+   * routing the SELECT queries to the concurrent builder instance.
+   */
+  newQuery(str: string): (dbx.Query)
+ }
+ interface defaultDBConnect {
+  (dbPath: string): (dbx.DB)
+ }
+ /**
+  * Model defines an interface with common methods that all db models should have.
+  * 
+  * Note: for simplicity composite pk are not supported.
+  */
+ interface Model {
+  [key:string]: any;
+  tableName(): string
+  pk(): any
+  lastSavedPK(): any
+  isNew(): boolean
+  markAsNew(): void
+  markAsNotNew(): void
+ }
+ /**
+  * BaseModel defines a base struct that is intended to be embedded into other custom models.
+  */
+ interface BaseModel {
+  /**
+   * Id is the primary key of the model.
+   * It is usually autogenerated by the parent model implementation.
+   */
+  id: string
+ }
+ interface BaseModel {
+  /**
+   * LastSavedPK returns the last saved primary key of the model.
+   * 
+   * Its value is updated to the latest PK value after MarkAsNotNew() or PostScan() calls.
+   */
+  lastSavedPK(): any
+ }
+ interface BaseModel {
+  pk(): any
+ }
+ interface BaseModel {
+  /**
+   * IsNew indicates what type of db query (insert or update)
+   * should be used with the model instance.
+   */
+  isNew(): boolean
+ }
+ interface BaseModel {
+  /**
+   * MarkAsNew clears the pk field and marks the current model as "new"
+   * (aka. forces m.IsNew() to be true).
+   */
+  markAsNew(): void
+ }
+ interface BaseModel {
+  /**
+   * MarkAsNew set the pk field to the Id value and marks the current model
+   * as NOT "new" (aka. forces m.IsNew() to be false).
+   */
+  markAsNotNew(): void
+ }
+ interface BaseModel {
+  /**
+   * PostScan implements the [dbx.PostScanner] interface.
+   * 
+   * It is usually executed right after the model is populated with the db row values.
+   */
+  postScan(): void
+ }
+ interface BaseApp {
+  /**
+   * TableColumns returns all column names of a single table by its name.
+   */
+  tableColumns(tableName: string): Array<string>
+ }
+ interface TableInfoRow {
+  /**
+   * the `db:"pk"` tag has special semantic so we cannot rename
+   * the original field without specifying a custom mapper
+   */
+  pk: number
+  index: number
+  name: string
+  type: string
+  notNull: boolean
+  defaultValue: sql.NullString
+ }
+ interface BaseApp {
+  /**
+   * TableInfo returns the "table_info" pragma result for the specified table.
+   */
+  tableInfo(tableName: string): Array<(TableInfoRow | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * TableIndexes returns a name grouped map with all non empty index of the specified table.
+   * 
+   * Note: This method doesn't return an error on nonexisting table.
+   */
+  tableIndexes(tableName: string): _TygojaDict
+ }
+ interface BaseApp {
+  /**
+   * DeleteTable drops the specified table.
+   * 
+   * This method is a no-op if a table with the provided name doesn't exist.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "tableName" argument must come only from trusted input!
+   */
+  deleteTable(tableName: string): void
+ }
+ interface BaseApp {
+  /**
+   * HasTable checks if a table (or view) with the provided name exists (case insensitive).
+   * in the data.db.
+   */
+  hasTable(tableName: string): boolean
+ }
+ interface BaseApp {
+  /**
+   * AuxHasTable checks if a table (or view) with the provided name exists (case insensitive)
+   * in the auixiliary.db.
+   */
+  auxHasTable(tableName: string): boolean
+ }
+ interface BaseApp {
+  /**
+   * Vacuum executes VACUUM on the data.db in order to reclaim unused data db disk space.
+   */
+  vacuum(): void
+ }
+ interface BaseApp {
+  /**
+   * AuxVacuum executes VACUUM on the auxiliary.db in order to reclaim unused auxiliary db disk space.
+   */
+  auxVacuum(): void
+ }
+ interface BaseApp {
+  /**
+   * RunInTransaction wraps fn into a transaction for the regular app database.
+   * 
+   * It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+   */
+  runInTransaction(fn: (txApp: App) => void): void
+ }
+ interface BaseApp {
+  /**
+   * AuxRunInTransaction wraps fn into a transaction for the auxiliary app database.
+   * 
+   * It is safe to nest RunInTransaction calls as long as you use the callback's txApp.
+   */
+  auxRunInTransaction(fn: (txApp: App) => void): void
+ }
+ /**
+  * TxAppInfo represents an active transaction context associated to an existing app instance.
+  */
+ interface TxAppInfo {
+ }
+ interface TxAppInfo {
+  /**
+   * OnComplete registers the provided callback that will be invoked
+   * once the related transaction ends (either completes successfully or rollbacked with an error).
+   * 
+   * The callback receives the transaction error (if any) as its argument.
+   * Any additional errors returned by the OnComplete callbacks will be
+   * joined together with txErr when returning the final transaction result.
+   */
+  onComplete(fn: (txErr: Error) => void): void
+ }
+ /**
+  * RequestEvent defines the PocketBase router handler event.
+  */
+ type _sRGzdIt = router.Event
+ interface RequestEvent extends _sRGzdIt {
+  app: App
+  auth?: Record
+ }
+ interface RequestEvent {
+  /**
+   * RealIP returns the "real" IP address from the configured trusted proxy headers.
+   * 
+   * If Settings.TrustedProxy is not configured or the found IP is empty,
+   * it fallbacks to e.RemoteIP().
+   * 
+   * NB!
+   * Be careful when used in a security critical context as it relies on
+   * the trusted proxy to be properly configured and your app to be accessible only through it.
+   * If you are not sure, use e.RemoteIP().
+   */
+  realIP(): string
+ }
+ interface RequestEvent {
+  /**
+   * HasSuperuserAuth checks whether the current RequestEvent has superuser authentication loaded.
+   */
+  hasSuperuserAuth(): boolean
+ }
+ interface RequestEvent {
+  /**
+   * RequestInfo parses the current request into RequestInfo instance.
+   * 
+   * Note that the returned result is cached to avoid copying the request data multiple times
+   * but the auth state and other common store items are always refreshed in case they were changed by another handler.
+   */
+  requestInfo(): (RequestInfo)
+ }
+ /**
+  * RequestInfo defines a HTTP request data struct, usually used
+  * as part of the `@request.*` filter resolver.
+  * 
+  * The Query and Headers fields contains only the first value for each found entry.
+  */
+ interface RequestInfo {
+  query: _TygojaDict
+  headers: _TygojaDict
+  body: _TygojaDict
+  auth?: Record
+  method: string
+  context: string
+ }
+ interface RequestInfo {
+  /**
+   * HasSuperuserAuth checks whether the current RequestInfo instance
+   * has superuser authentication loaded.
+   */
+  hasSuperuserAuth(): boolean
+ }
+ interface RequestInfo {
+  /**
+   * Clone creates a new shallow copy of the current RequestInfo and its Auth record (if any).
+   */
+  clone(): (RequestInfo)
+ }
+ type _sArPely = hook.Event&RequestEvent
+ interface BatchRequestEvent extends _sArPely {
+  batch: Array<(InternalRequest | undefined)>
+ }
+ interface InternalRequest {
+  /**
+   * note: for uploading files the value must be either *filesystem.File or []*filesystem.File
+   */
+  body: _TygojaDict
+  headers: _TygojaDict
+  method: string
+  url: string
+ }
+ interface InternalRequest {
+  validate(): void
+ }
+ interface HookTagger {
+  [key:string]: any;
+  hookTags(): Array<string>
+ }
+ interface baseModelEventData {
+  model: Model
+ }
+ interface baseModelEventData {
+  tags(): Array<string>
+ }
+ interface baseRecordEventData {
+  record?: Record
+ }
+ interface baseRecordEventData {
+  tags(): Array<string>
+ }
+ interface baseCollectionEventData {
+  collection?: Collection
+ }
+ interface baseCollectionEventData {
+  tags(): Array<string>
+ }
+ type _sYQIivo = hook.Event
+ interface BootstrapEvent extends _sYQIivo {
+  app: App
+ }
+ type _sOXHUYt = hook.Event
+ interface TerminateEvent extends _sOXHUYt {
+  app: App
+  isRestart: boolean
+ }
+ type _sWYWmEg = hook.Event
+ interface BackupEvent extends _sWYWmEg {
+  app: App
+  context: context.Context
+  name: string // the name of the backup to create/restore.
+  exclude: Array<string> // list of dir entries to exclude from the backup create/restore.
+ }
+ type _skUtbei = hook.Event
+ interface ServeEvent extends _skUtbei {
+  app: App
+  router?: router.Router<RequestEvent | undefined>
+  server?: http.Server
+  certManager?: any
+  /**
+   * Listener allow specifying a custom network listener.
+   * 
+   * Leave it nil to use the default net.Listen("tcp", e.Server.Addr).
+   */
+  listener: net.Listener
+  /**
+   * InstallerFunc is the "installer" function that is called after
+   * successful server tcp bind but only if there is no explicit
+   * superuser record created yet.
+   * 
+   * It runs in a separate goroutine and its default value is [apis.DefaultInstallerFunc].
+   * 
+   * It receives a system superuser record as argument that you can use to generate
+   * a short-lived auth token (e.g. systemSuperuser.NewStaticAuthToken(30 * time.Minute))
+   * and concatenate it as query param for your installer page
+   * (if you are using the client-side SDKs, you can then load the
+   * token with pb.authStore.save(token) and perform any Web API request
+   * e.g. creating a new superuser).
+   * 
+   * Set it to nil if you want to skip the installer.
+   */
+  installerFunc: (app: App, systemSuperuser: Record, baseURL: string) => void
+ }
+ type _sRzIJjC = hook.Event&RequestEvent
+ interface SettingsListRequestEvent extends _sRzIJjC {
+  settings?: Settings
+ }
+ type _syhDEfK = hook.Event&RequestEvent
+ interface SettingsUpdateRequestEvent extends _syhDEfK {
+  oldSettings?: Settings
+  newSettings?: Settings
+ }
+ type _sCjpHeS = hook.Event
+ interface SettingsReloadEvent extends _sCjpHeS {
+  app: App
+ }
+ type _sbjQGOJ = hook.Event
+ interface MailerEvent extends _sbjQGOJ {
+  app: App
+  mailer: mailer.Mailer
+  message?: mailer.Message
+ }
+ type _sZObaGR = MailerEvent&baseRecordEventData
+ interface MailerRecordEvent extends _sZObaGR {
+  meta: _TygojaDict
+ }
+ type _sRScLly = hook.Event&baseModelEventData
+ interface ModelEvent extends _sRScLly {
+  app: App
+  context: context.Context
+  /**
+   * Could be any of the ModelEventType* constants, like:
+   * - create
+   * - update
+   * - delete
+   * - validate
+   */
+  type: string
+ }
+ type _sWjDVot = ModelEvent
+ interface ModelErrorEvent extends _sWjDVot {
+  error: Error
+ }
+ type _sytGftI = hook.Event&baseRecordEventData
+ interface RecordEvent extends _sytGftI {
+  app: App
+  context: context.Context
+  /**
+   * Could be any of the ModelEventType* constants, like:
+   * - create
+   * - update
+   * - delete
+   * - validate
+   */
+  type: string
+ }
+ type _sEfMqPB = RecordEvent
+ interface RecordErrorEvent extends _sEfMqPB {
+  error: Error
+ }
+ type _sHEcvVp = hook.Event&baseCollectionEventData
+ interface CollectionEvent extends _sHEcvVp {
+  app: App
+  context: context.Context
+  /**
+   * Could be any of the ModelEventType* constants, like:
+   * - create
+   * - update
+   * - delete
+   * - validate
+   */
+  type: string
+ }
+ type _soztHBY = CollectionEvent
+ interface CollectionErrorEvent extends _soztHBY {
+  error: Error
+ }
+ type _sqzmpxn = hook.Event&RequestEvent&baseRecordEventData
+ interface FileTokenRequestEvent extends _sqzmpxn {
+  token: string
+ }
+ type _siNgiLQ = hook.Event&RequestEvent&baseCollectionEventData
+ interface FileDownloadRequestEvent extends _siNgiLQ {
+  record?: Record
+  fileField?: FileField
+  servedPath: string
+  servedName: string
+  /**
+   * ThumbError indicates the a thumb wasn't able to be generated
+   * (e.g. because it didn't satisfy the support image formats or it timed out).
+   * 
+   * Note that PocketBase fallbacks to the original file in case of a thumb error,
+   * but developers can check the field and provide their own custom thumb generation if necessary.
+   */
+  thumbError: Error
+ }
+ type _smJfdQb = hook.Event&RequestEvent
+ interface CollectionsListRequestEvent extends _smJfdQb {
+  collections: Array<(Collection | undefined)>
+  result?: search.Result
+ }
+ type _sKcXAYJ = hook.Event&RequestEvent
+ interface CollectionsImportRequestEvent extends _sKcXAYJ {
+  collectionsData: Array<_TygojaDict>
+  deleteMissing: boolean
+ }
+ type _sbfynpd = hook.Event&RequestEvent&baseCollectionEventData
+ interface CollectionRequestEvent extends _sbfynpd {
+ }
+ type _sPtlQpd = hook.Event&RequestEvent
+ interface RealtimeConnectRequestEvent extends _sPtlQpd {
+  client: subscriptions.Client
+  /**
+   * note: modifying it after the connect has no effect
+   */
+  idleTimeout: time.Duration
+ }
+ type _sagVwAZ = hook.Event&RequestEvent
+ interface RealtimeMessageEvent extends _sagVwAZ {
+  client: subscriptions.Client
+  message?: subscriptions.Message
+ }
+ type _sNVTWUP = hook.Event&RequestEvent
+ interface RealtimeSubscribeRequestEvent extends _sNVTWUP {
+  client: subscriptions.Client
+  subscriptions: Array<string>
+ }
+ type _sPehkcw = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordsListRequestEvent extends _sPehkcw {
+  /**
+   * @todo consider removing and maybe add as generic to the search.Result?
+   */
+  records: Array<(Record | undefined)>
+  result?: search.Result
+ }
+ type _sfhGEVQ = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordRequestEvent extends _sfhGEVQ {
+  record?: Record
+ }
+ type _sDOHyIM = hook.Event&baseRecordEventData
+ interface RecordEnrichEvent extends _sDOHyIM {
+  app: App
+  requestInfo?: RequestInfo
+ }
+ type _sMzymih = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordCreateOTPRequestEvent extends _sMzymih {
+  record?: Record
+  password: string
+ }
+ type _sHcUecd = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthWithOTPRequestEvent extends _sHcUecd {
+  record?: Record
+  otp?: OTP
+ }
+ type _skUyOYu = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthRequestEvent extends _skUyOYu {
+  record?: Record
+  token: string
+  meta: any
+  authMethod: string
+ }
+ type _sDzsOEm = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthWithPasswordRequestEvent extends _sDzsOEm {
+  record?: Record
+  identity: string
+  identityField: string
+  password: string
+ }
+ type _ssmigHx = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthWithOAuth2RequestEvent extends _ssmigHx {
+  providerName: string
+  providerClient: auth.Provider
+  record?: Record
+  oAuth2User?: auth.AuthUser
+  createData: _TygojaDict
+  isNewRecord: boolean
+ }
+ type _sGIPmTg = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordAuthRefreshRequestEvent extends _sGIPmTg {
+  record?: Record
+ }
+ type _smeIRag = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordRequestPasswordResetRequestEvent extends _smeIRag {
+  record?: Record
+ }
+ type _sLnpKjL = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordConfirmPasswordResetRequestEvent extends _sLnpKjL {
+  record?: Record
+ }
+ type _sIEkbCk = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordRequestVerificationRequestEvent extends _sIEkbCk {
+  record?: Record
+ }
+ type _ssYvGVL = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordConfirmVerificationRequestEvent extends _ssYvGVL {
+  record?: Record
+ }
+ type _sWJhgxY = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordRequestEmailChangeRequestEvent extends _sWJhgxY {
+  record?: Record
+  newEmail: string
+ }
+ type _sYIobQS = hook.Event&RequestEvent&baseCollectionEventData
+ interface RecordConfirmEmailChangeRequestEvent extends _sYIobQS {
+  record?: Record
+  newEmail: string
+ }
+ /**
+  * ExternalAuth defines a Record proxy for working with the externalAuths collection.
+  */
+ type _sLBGFGj = Record
+ interface ExternalAuth extends _sLBGFGj {
+ }
+ interface newExternalAuth {
+  /**
+   * NewExternalAuth instantiates and returns a new blank *ExternalAuth model.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	ea := core.NewExternalAuth(app)
+   * 	ea.SetRecordRef(user.Id)
+   * 	ea.SetCollectionRef(user.Collection().Id)
+   * 	ea.SetProvider("google")
+   * 	ea.SetProviderId("...")
+   * 	app.Save(ea)
+   * ```
+   */
+  (app: App): (ExternalAuth)
+ }
+ interface ExternalAuth {
+  /**
+   * PreValidate implements the [PreValidator] interface and checks
+   * whether the proxy is properly loaded.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ interface ExternalAuth {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface ExternalAuth {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface ExternalAuth {
+  /**
+   * CollectionRef returns the "collectionRef" field value.
+   */
+  collectionRef(): string
+ }
+ interface ExternalAuth {
+  /**
+   * SetCollectionRef updates the "collectionRef" record field value.
+   */
+  setCollectionRef(collectionId: string): void
+ }
+ interface ExternalAuth {
+  /**
+   * RecordRef returns the "recordRef" record field value.
+   */
+  recordRef(): string
+ }
+ interface ExternalAuth {
+  /**
+   * SetRecordRef updates the "recordRef" record field value.
+   */
+  setRecordRef(recordId: string): void
+ }
+ interface ExternalAuth {
+  /**
+   * Provider returns the "provider" record field value.
+   */
+  provider(): string
+ }
+ interface ExternalAuth {
+  /**
+   * SetProvider updates the "provider" record field value.
+   */
+  setProvider(provider: string): void
+ }
+ interface ExternalAuth {
+  /**
+   * Provider returns the "providerId" record field value.
+   */
+  providerId(): string
+ }
+ interface ExternalAuth {
+  /**
+   * SetProvider updates the "providerId" record field value.
+   */
+  setProviderId(providerId: string): void
+ }
+ interface ExternalAuth {
+  /**
+   * Created returns the "created" record field value.
+   */
+  created(): types.DateTime
+ }
+ interface ExternalAuth {
+  /**
+   * Updated returns the "updated" record field value.
+   */
+  updated(): types.DateTime
+ }
+ interface BaseApp {
+  /**
+   * FindAllExternalAuthsByRecord returns all ExternalAuth models
+   * linked to the provided auth record.
+   */
+  findAllExternalAuthsByRecord(authRecord: Record): Array<(ExternalAuth | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllExternalAuthsByCollection returns all ExternalAuth models
+   * linked to the provided auth collection.
+   */
+  findAllExternalAuthsByCollection(collection: Collection): Array<(ExternalAuth | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindFirstExternalAuthByExpr returns the first available (the most recent created)
+   * ExternalAuth model that satisfies the non-nil expression.
+   */
+  findFirstExternalAuthByExpr(expr: dbx.Expression): (ExternalAuth)
+ }
+ /**
+  * FieldFactoryFunc defines a simple function to construct a specific Field instance.
+  */
+ interface FieldFactoryFunc {(): Field }
+ /**
+  * Field defines a common interface that all Collection fields should implement.
+  */
+ interface Field {
+  [key:string]: any;
+  /**
+   * GetId returns the field id.
+   */
+  getId(): string
+  /**
+   * SetId changes the field id.
+   */
+  setId(id: string): void
+  /**
+   * GetName returns the field name.
+   */
+  getName(): string
+  /**
+   * SetName changes the field name.
+   */
+  setName(name: string): void
+  /**
+   * GetSystem returns the field system flag state.
+   */
+  getSystem(): boolean
+  /**
+   * SetSystem changes the field system flag state.
+   */
+  setSystem(system: boolean): void
+  /**
+   * GetHidden returns the field hidden flag state.
+   */
+  getHidden(): boolean
+  /**
+   * SetHidden changes the field hidden flag state.
+   */
+  setHidden(hidden: boolean): void
+  /**
+   * Type returns the unique type of the field.
+   */
+  type(): string
+  /**
+   * ColumnType returns the DB column definition of the field.
+   */
+  columnType(app: App): string
+  /**
+   * PrepareValue returns a properly formatted field value based on the provided raw one.
+   * 
+   * This method is also called on record construction to initialize its default field value.
+   */
+  prepareValue(record: Record, raw: any): any
+  /**
+   * ValidateSettings validates the current field value associated with the provided record.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+  /**
+   * ValidateSettings validates the current field settings.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * MaxBodySizeCalculator defines an optional field interface for
+  * specifying the max size of a field value.
+  */
+ interface MaxBodySizeCalculator {
+  [key:string]: any;
+  /**
+   * CalculateMaxBodySize returns the approximate max body size of a field value.
+   */
+  calculateMaxBodySize(): number
+ }
+ interface SetterFunc {(record: Record, raw: any): void }
+ /**
+  * SetterFinder defines a field interface for registering custom field value setters.
+  */
+ interface SetterFinder {
+  [key:string]: any;
+  /**
+   * FindSetter returns a single field value setter function
+   * by performing pattern-like field matching using the specified key.
+   * 
+   * The key is usually just the field name but it could also
+   * contains "modifier" characters based on which you can perform custom set operations
+   * (ex. "users+" could be mapped to a function that will append new user to the existing field value).
+   * 
+   * Return nil if you want to fallback to the default field value setter.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ interface GetterFunc {(record: Record): any }
+ /**
+  * GetterFinder defines a field interface for registering custom field value getters.
+  */
+ interface GetterFinder {
+  [key:string]: any;
+  /**
+   * FindGetter returns a single field value getter function
+   * by performing pattern-like field matching using the specified key.
+   * 
+   * The key is usually just the field name but it could also
+   * contains "modifier" characters based on which you can perform custom get operations
+   * (ex. "description:excerpt" could be mapped to a function that will return an excerpt of the current field value).
+   * 
+   * Return nil if you want to fallback to the default field value setter.
+   */
+  findGetter(key: string): GetterFunc
+ }
+ /**
+  * DriverValuer defines a Field interface for exporting and formatting
+  * a field value for the database.
+  */
+ interface DriverValuer {
+  [key:string]: any;
+  /**
+   * DriverValue exports a single field value for persistence in the database.
+   */
+  driverValue(record: Record): any
+ }
+ /**
+  * MultiValuer defines a field interface that every multi-valued (eg. with MaxSelect) field has.
+  */
+ interface MultiValuer {
+  [key:string]: any;
+  /**
+   * IsMultiple checks whether the field is configured to support multiple or single values.
+   */
+  isMultiple(): boolean
+ }
+ /**
+  * RecordInterceptor defines a field interface for reacting to various
+  * Record related operations (create, delete, validate, etc.).
+  */
+ interface RecordInterceptor {
+  [key:string]: any;
+  /**
+   * Interceptor is invoked when a specific record action occurs
+   * allowing you to perform extra validations and normalization
+   * (ex. uploading or deleting files).
+   * 
+   * Note that users must call actionFunc() manually if they want to
+   * execute the specific record action.
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ interface defaultFieldIdValidationRule {
+  /**
+   * DefaultFieldIdValidationRule performs base validation on a field id value.
+   */
+  (value: any): void
+ }
+ interface defaultFieldNameValidationRule {
+  /**
+   * DefaultFieldIdValidationRule performs base validation on a field name value.
+   */
+  (value: any): void
+ }
+ /**
+  * AutodateField defines an "autodate" type field, aka.
+  * field which datetime value could be auto set on record create/update.
+  * 
+  * This field is usually used for defining timestamp fields like "created" and "updated".
+  * 
+  * Requires either both or at least one of the OnCreate or OnUpdate options to be set.
+  */
+ interface AutodateField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * OnCreate auto sets the current datetime as field value on record create.
+   */
+  onCreate: boolean
+  /**
+   * OnUpdate auto sets the current datetime as field value on record update.
+   */
+  onUpdate: boolean
+ }
+ interface AutodateField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface AutodateField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface AutodateField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface AutodateField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface AutodateField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface AutodateField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface AutodateField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface AutodateField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface AutodateField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface AutodateField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface AutodateField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface AutodateField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface AutodateField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface AutodateField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ interface AutodateField {
+  /**
+   * Intercept implements the [RecordInterceptor] interface.
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ /**
+  * BoolField defines "bool" type field to store a single true/false value.
+  * 
+  * The respective zero record field value is false.
+  */
+ interface BoolField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Required will require the field value to be always "true".
+   */
+  required: boolean
+ }
+ interface BoolField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface BoolField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface BoolField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface BoolField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface BoolField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface BoolField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface BoolField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface BoolField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface BoolField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface BoolField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface BoolField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface BoolField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface BoolField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * DateField defines "date" type field to store a single [types.DateTime] value.
+  * 
+  * The respective zero record field value is the zero [types.DateTime].
+  */
+ interface DateField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Min specifies the min allowed field value.
+   * 
+   * Leave it empty to skip the validator.
+   */
+  min: types.DateTime
+  /**
+   * Max specifies the max allowed field value.
+   * 
+   * Leave it empty to skip the validator.
+   */
+  max: types.DateTime
+  /**
+   * Required will require the field value to be non-zero [types.DateTime].
+   */
+  required: boolean
+ }
+ interface DateField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface DateField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface DateField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface DateField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface DateField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface DateField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface DateField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface DateField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface DateField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface DateField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface DateField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface DateField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface DateField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * EditorField defines "editor" type field to store HTML formatted text.
+  * 
+  * The respective zero record field value is empty string.
+  */
+ interface EditorField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * MaxSize specifies the maximum size of the allowed field value (in bytes and up to 2^53-1).
+   * 
+   * If zero, a default limit of ~5MB is applied.
+   */
+  maxSize: number
+  /**
+   * ConvertURLs is usually used to instruct the editor whether to
+   * apply url conversion (eg. stripping the domain name in case the
+   * urls are using the same domain as the one where the editor is loaded).
+   * 
+   * (see also https://www.tiny.cloud/docs/tinymce/6/url-handling/#convert_urls)
+   */
+  convertURLs: boolean
+  /**
+   * Required will require the field value to be non-empty string.
+   */
+  required: boolean
+ }
+ interface EditorField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface EditorField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface EditorField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface EditorField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface EditorField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface EditorField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface EditorField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface EditorField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface EditorField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface EditorField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface EditorField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface EditorField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface EditorField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface EditorField {
+  /**
+   * CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+   */
+  calculateMaxBodySize(): number
+ }
+ /**
+  * EmailField defines "email" type field for storing a single email string address.
+  * 
+  * The respective zero record field value is empty string.
+  */
+ interface EmailField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * ExceptDomains will require the email domain to NOT be included in the listed ones.
+   * 
+   * This validator can be set only if OnlyDomains is empty.
+   */
+  exceptDomains: Array<string>
+  /**
+   * OnlyDomains will require the email domain to be included in the listed ones.
+   * 
+   * This validator can be set only if ExceptDomains is empty.
+   */
+  onlyDomains: Array<string>
+  /**
+   * Required will require the field value to be non-empty email string.
+   */
+  required: boolean
+ }
+ interface EmailField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface EmailField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface EmailField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface EmailField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface EmailField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface EmailField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface EmailField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface EmailField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface EmailField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface EmailField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface EmailField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface EmailField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface EmailField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * FileField defines "file" type field for managing record file(s).
+  * 
+  * Only the file name is stored as part of the record value.
+  * New files (aka. files to upload) are expected to be of *filesytem.File.
+  * 
+  * If MaxSelect is not set or <= 1, then the field value is expected to be a single record id.
+  * 
+  * If MaxSelect is > 1, then the field value is expected to be a slice of record ids.
+  * 
+  * The respective zero record field value is either empty string (single) or empty string slice (multiple).
+  * 
+  * ---
+  * 
+  * The following additional setter keys are available:
+  * 
+  * ```
+  *   - "fieldName+" - append one or more files to the existing record one. For example:
+  * 
+  *     // []string{"old1.txt", "old2.txt", "new1_ajkvass.txt", "new2_klhfnwd.txt"}
+  *     record.Set("documents+", []*filesystem.File{new1, new2})
+  * 
+  *   - "+fieldName" - prepend one or more files to the existing record one. For example:
+  * 
+  *     // []string{"new1_ajkvass.txt", "new2_klhfnwd.txt", "old1.txt", "old2.txt",}
+  *     record.Set("+documents", []*filesystem.File{new1, new2})
+  * 
+  *   - "fieldName-" - subtract/delete one or more files from the existing record one. For example:
+  * 
+  *     // []string{"old2.txt",}
+  *     record.Set("documents-", "old1.txt")
+  * ```
+  */
+ interface FileField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * MaxSize specifies the maximum size of a single uploaded file (in bytes and up to 2^53-1).
+   * 
+   * If zero, a default limit of 5MB is applied.
+   */
+  maxSize: number
+  /**
+   * MaxSelect specifies the max allowed files.
+   * 
+   * For multiple files the value must be > 1, otherwise fallbacks to single (default).
+   */
+  maxSelect: number
+  /**
+   * MimeTypes specifies an optional list of the allowed file mime types.
+   * 
+   * Leave it empty to disable the validator.
+   */
+  mimeTypes: Array<string>
+  /**
+   * Thumbs specifies an optional list of the supported thumbs for image based files.
+   * 
+   * Each entry must be in one of the following formats:
+   * 
+   * ```
+   *   - WxH  (eg. 100x300) - crop to WxH viewbox (from center)
+   *   - WxHt (eg. 100x300t) - crop to WxH viewbox (from top)
+   *   - WxHb (eg. 100x300b) - crop to WxH viewbox (from bottom)
+   *   - WxHf (eg. 100x300f) - fit inside a WxH viewbox (without cropping)
+   *   - 0xH  (eg. 0x300)    - resize to H height preserving the aspect ratio
+   *   - Wx0  (eg. 100x0)    - resize to W width preserving the aspect ratio
+   * ```
+   */
+  thumbs: Array<string>
+  /**
+   * Protected will require the users to provide a special file token to access the file.
+   * 
+   * Note that by default all files are publicly accessible.
+   * 
+   * For the majority of the cases this is fine because by default
+   * all file names have random part appended to their name which
+   * need to be known by the user before accessing the file.
+   */
+  protected: boolean
+  /**
+   * Required will require the field value to have at least one file.
+   */
+  required: boolean
+ }
+ interface FileField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface FileField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface FileField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface FileField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface FileField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface FileField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface FileField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface FileField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface FileField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface FileField {
+  /**
+   * IsMultiple implements MultiValuer interface and checks whether the
+   * current field options support multiple values.
+   */
+  isMultiple(): boolean
+ }
+ interface FileField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface FileField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface FileField {
+  /**
+   * DriverValue implements the [DriverValuer] interface.
+   */
+  driverValue(record: Record): any
+ }
+ interface FileField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface FileField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface FileField {
+  /**
+   * CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+   */
+  calculateMaxBodySize(): number
+ }
+ interface FileField {
+  /**
+   * Intercept implements the [RecordInterceptor] interface.
+   * 
+   * note: files delete after records deletion is handled globally by the app FileManager hook
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ interface FileField {
+  /**
+   * FindGetter implements the [GetterFinder] interface.
+   */
+  findGetter(key: string): GetterFunc
+ }
+ interface FileField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * GeoPointField defines "geoPoint" type field for storing latitude and longitude GPS coordinates.
+  * 
+  * You can set the record field value as [types.GeoPoint], map or serialized json object with lat-lon props.
+  * The stored value is always converted to [types.GeoPoint].
+  * Nil, empty map, empty bytes slice, etc. results in zero [types.GeoPoint].
+  * 
+  * Examples of updating a record's GeoPointField value programmatically:
+  * 
+  * ```
+  * 	record.Set("location", types.GeoPoint{Lat: 123, Lon: 456})
+  * 	record.Set("location", map[string]any{"lat":123, "lon":456})
+  * 	record.Set("location", []byte(`{"lat":123, "lon":456}`)
+  * ```
+  */
+ interface GeoPointField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Required will require the field coordinates to be non-zero (aka. not "Null Island").
+   */
+  required: boolean
+ }
+ interface GeoPointField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface GeoPointField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface GeoPointField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface GeoPointField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface GeoPointField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface GeoPointField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface GeoPointField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface GeoPointField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface GeoPointField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface GeoPointField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface GeoPointField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface GeoPointField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface GeoPointField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ /**
+  * JSONField defines "json" type field for storing any serialized JSON value.
+  * 
+  * The respective zero record field value is the zero [types.JSONRaw].
+  */
+ interface JSONField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * MaxSize specifies the maximum size of the allowed field value (in bytes and up to 2^53-1).
+   * 
+   * If zero, a default limit of 1MB is applied.
+   */
+  maxSize: number
+  /**
+   * Required will require the field value to be non-empty JSON value
+   * (aka. not "null", `""`, "[]", "{}").
+   */
+  required: boolean
+ }
+ interface JSONField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface JSONField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface JSONField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface JSONField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface JSONField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface JSONField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface JSONField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface JSONField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface JSONField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface JSONField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface JSONField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface JSONField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface JSONField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface JSONField {
+  /**
+   * CalculateMaxBodySize implements the [MaxBodySizeCalculator] interface.
+   */
+  calculateMaxBodySize(): number
+ }
+ /**
+  * NumberField defines "number" type field for storing numeric (float64) value.
+  * 
+  * The respective zero record field value is 0.
+  * 
+  * The following additional setter keys are available:
+  * 
+  * ```
+  *   - "fieldName+" - appends to the existing record value. For example:
+  *     record.Set("total+", 5)
+  *   - "fieldName-" - subtracts from the existing record value. For example:
+  *     record.Set("total-", 5)
+  * ```
+  */
+ interface NumberField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Min specifies the min allowed field value.
+   * 
+   * Leave it nil to skip the validator.
+   */
+  min?: number
+  /**
+   * Max specifies the max allowed field value.
+   * 
+   * Leave it nil to skip the validator.
+   */
+  max?: number
+  /**
+   * OnlyInt will require the field value to be integer.
+   */
+  onlyInt: boolean
+  /**
+   * Required will require the field value to be non-zero.
+   */
+  required: boolean
+ }
+ interface NumberField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface NumberField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface NumberField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface NumberField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface NumberField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface NumberField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface NumberField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface NumberField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface NumberField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface NumberField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface NumberField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface NumberField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface NumberField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface NumberField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * PasswordField defines "password" type field for storing bcrypt hashed strings
+  * (usually used only internally for the "password" auth collection system field).
+  * 
+  * If you want to set a direct bcrypt hash as record field value you can use the SetRaw method, for example:
+  * 
+  * ```
+  * 	// generates a bcrypt hash of "123456" and set it as field value
+  * 	// (record.GetString("password") returns the plain password until persisted, otherwise empty string)
+  * 	record.Set("password", "123456")
+  * 
+  * 	// set directly a bcrypt hash of "123456" as field value
+  * 	// (record.GetString("password") returns empty string)
+  * 	record.SetRaw("password", "$2a$10$.5Elh8fgxypNUWhpUUr/xOa2sZm0VIaE0qWuGGl9otUfobb46T1Pq")
+  * ```
+  * 
+  * The following additional getter keys are available:
+  * 
+  * ```
+  *   - "fieldName:hash" - returns the bcrypt hash string of the record field value (if any). For example:
+  *     record.GetString("password:hash")
+  * ```
+  */
+ interface PasswordField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Pattern specifies an optional regex pattern to match against the field value.
+   * 
+   * Leave it empty to skip the pattern check.
+   */
+  pattern: string
+  /**
+   * Min specifies an optional required field string length.
+   */
+  min: number
+  /**
+   * Max specifies an optional required field string length.
+   * 
+   * If zero, fallback to max 71 bytes.
+   */
+  max: number
+  /**
+   * Cost specifies the cost/weight/iteration/etc. bcrypt factor.
+   * 
+   * If zero, fallback to [bcrypt.DefaultCost].
+   * 
+   * If explicitly set, must be between [bcrypt.MinCost] and [bcrypt.MaxCost].
+   */
+  cost: number
+  /**
+   * Required will require the field value to be non-empty string.
+   */
+  required: boolean
+ }
+ interface PasswordField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface PasswordField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface PasswordField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface PasswordField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface PasswordField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface PasswordField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface PasswordField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface PasswordField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface PasswordField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface PasswordField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface PasswordField {
+  /**
+   * DriverValue implements the [DriverValuer] interface.
+   */
+  driverValue(record: Record): any
+ }
+ interface PasswordField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface PasswordField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface PasswordField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface PasswordField {
+  /**
+   * Intercept implements the [RecordInterceptor] interface.
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ interface PasswordField {
+  /**
+   * FindGetter implements the [GetterFinder] interface.
+   */
+  findGetter(key: string): GetterFunc
+ }
+ interface PasswordField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ interface PasswordFieldValue {
+  lastError: Error
+  hash: string
+  plain: string
+ }
+ interface PasswordFieldValue {
+  validate(pass: string): boolean
+ }
+ /**
+  * RelationField defines "relation" type field for storing single or
+  * multiple collection record references.
+  * 
+  * Requires the CollectionId option to be set.
+  * 
+  * If MaxSelect is not set or <= 1, then the field value is expected to be a single record id.
+  * 
+  * If MaxSelect is > 1, then the field value is expected to be a slice of record ids.
+  * 
+  * The respective zero record field value is either empty string (single) or empty string slice (multiple).
+  * 
+  * ---
+  * 
+  * The following additional setter keys are available:
+  * 
+  * ```
+  *   - "fieldName+" - append one or more values to the existing record one. For example:
+  * 
+  *     record.Set("categories+", []string{"new1", "new2"}) // []string{"old1", "old2", "new1", "new2"}
+  * 
+  *   - "+fieldName" - prepend one or more values to the existing record one. For example:
+  * 
+  *     record.Set("+categories", []string{"new1", "new2"}) // []string{"new1", "new2", "old1", "old2"}
+  * 
+  *   - "fieldName-" - subtract one or more values from the existing record one. For example:
+  * 
+  *     record.Set("categories-", "old1") // []string{"old2"}
+  * ```
+  */
+ interface RelationField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * CollectionId is the id of the related collection.
+   */
+  collectionId: string
+  /**
+   * CascadeDelete indicates whether the root model should be deleted
+   * in case of delete of all linked relations.
+   */
+  cascadeDelete: boolean
+  /**
+   * MinSelect indicates the min number of allowed relation records
+   * that could be linked to the main model.
+   * 
+   * No min limit is applied if it is zero or negative value.
+   */
+  minSelect: number
+  /**
+   * MaxSelect indicates the max number of allowed relation records
+   * that could be linked to the main model.
+   * 
+   * For multiple select the value must be > 1, otherwise fallbacks to single (default).
+   * 
+   * If MinSelect is set, MaxSelect must be at least >= MinSelect.
+   */
+  maxSelect: number
+  /**
+   * Required will require the field value to be non-empty.
+   */
+  required: boolean
+ }
+ interface RelationField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface RelationField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface RelationField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface RelationField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface RelationField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface RelationField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface RelationField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface RelationField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface RelationField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface RelationField {
+  /**
+   * IsMultiple implements [MultiValuer] interface and checks whether the
+   * current field options support multiple values.
+   */
+  isMultiple(): boolean
+ }
+ interface RelationField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface RelationField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface RelationField {
+  /**
+   * DriverValue implements the [DriverValuer] interface.
+   */
+  driverValue(record: Record): any
+ }
+ interface RelationField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface RelationField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface RelationField {
+  /**
+   * FindSetter implements [SetterFinder] interface method.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * SelectField defines "select" type field for storing single or
+  * multiple string values from a predefined list.
+  * 
+  * Requires the Values option to be set.
+  * 
+  * If MaxSelect is not set or <= 1, then the field value is expected to be a single Values element.
+  * 
+  * If MaxSelect is > 1, then the field value is expected to be a subset of Values slice.
+  * 
+  * The respective zero record field value is either empty string (single) or empty string slice (multiple).
+  * 
+  * ---
+  * 
+  * The following additional setter keys are available:
+  * 
+  * ```
+  *   - "fieldName+" - append one or more values to the existing record one. For example:
+  * 
+  *     record.Set("roles+", []string{"new1", "new2"}) // []string{"old1", "old2", "new1", "new2"}
+  * 
+  *   - "+fieldName" - prepend one or more values to the existing record one. For example:
+  * 
+  *     record.Set("+roles", []string{"new1", "new2"}) // []string{"new1", "new2", "old1", "old2"}
+  * 
+  *   - "fieldName-" - subtract one or more values from the existing record one. For example:
+  * 
+  *     record.Set("roles-", "old1") // []string{"old2"}
+  * ```
+  */
+ interface SelectField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Values specifies the list of accepted values.
+   */
+  values: Array<string>
+  /**
+   * MaxSelect specifies the max allowed selected values.
+   * 
+   * For multiple select the value must be > 1, otherwise fallbacks to single (default).
+   */
+  maxSelect: number
+  /**
+   * Required will require the field value to be non-empty.
+   */
+  required: boolean
+ }
+ interface SelectField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface SelectField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface SelectField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface SelectField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface SelectField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface SelectField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface SelectField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface SelectField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface SelectField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface SelectField {
+  /**
+   * IsMultiple implements [MultiValuer] interface and checks whether the
+   * current field options support multiple values.
+   */
+  isMultiple(): boolean
+ }
+ interface SelectField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface SelectField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface SelectField {
+  /**
+   * DriverValue implements the [DriverValuer] interface.
+   */
+  driverValue(record: Record): any
+ }
+ interface SelectField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface SelectField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface SelectField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * TextField defines "text" type field for storing any string value.
+  * 
+  * The respective zero record field value is empty string.
+  * 
+  * The following additional setter keys are available:
+  * 
+  * - "fieldName:autogenerate" - autogenerate field value if AutogeneratePattern is set. For example:
+  * 
+  * ```
+  * 	record.Set("slug:autogenerate", "") // [random value]
+  * 	record.Set("slug:autogenerate", "abc-") // abc-[random value]
+  * ```
+  */
+ interface TextField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * Min specifies the minimum required string characters.
+   * 
+   * if zero value, no min limit is applied.
+   */
+  min: number
+  /**
+   * Max specifies the maximum allowed string characters.
+   * 
+   * If zero, a default limit of 5000 is applied.
+   */
+  max: number
+  /**
+   * Pattern specifies an optional regex pattern to match against the field value.
+   * 
+   * Leave it empty to skip the pattern check.
+   */
+  pattern: string
+  /**
+   * AutogeneratePattern specifies an optional regex pattern that could
+   * be used to generate random string from it and set it automatically
+   * on record create if no explicit value is set or when the `:autogenerate` modifier is used.
+   * 
+   * Note: the generated value still needs to satisfy min, max, pattern (if set)
+   */
+  autogeneratePattern: string
+  /**
+   * Required will require the field value to be non-empty string.
+   */
+  required: boolean
+  /**
+   * PrimaryKey will mark the field as primary key.
+   * 
+   * A single collection can have only 1 field marked as primary key.
+   */
+  primaryKey: boolean
+ }
+ interface TextField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface TextField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface TextField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface TextField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface TextField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface TextField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface TextField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface TextField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface TextField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface TextField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface TextField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface TextField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface TextField {
+  /**
+   * ValidatePlainValue validates the provided string against the field options.
+   */
+  validatePlainValue(value: string): void
+ }
+ interface TextField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface TextField {
+  /**
+   * Intercept implements the [RecordInterceptor] interface.
+   */
+  intercept(ctx: context.Context, app: App, record: Record, actionName: string, actionFunc: () => void): void
+ }
+ interface TextField {
+  /**
+   * FindSetter implements the [SetterFinder] interface.
+   */
+  findSetter(key: string): SetterFunc
+ }
+ /**
+  * URLField defines "url" type field for storing a single URL string value.
+  * 
+  * The respective zero record field value is empty string.
+  */
+ interface URLField {
+  /**
+   * Name (required) is the unique name of the field.
+   */
+  name: string
+  /**
+   * Id is the unique stable field identifier.
+   * 
+   * It is automatically generated from the name when adding to a collection FieldsList.
+   */
+  id: string
+  /**
+   * System prevents the renaming and removal of the field.
+   */
+  system: boolean
+  /**
+   * Hidden hides the field from the API response.
+   */
+  hidden: boolean
+  /**
+   * Presentable hints the Dashboard UI to use the underlying
+   * field record value in the relation preview label.
+   */
+  presentable: boolean
+  /**
+   * ExceptDomains will require the URL domain to NOT be included in the listed ones.
+   * 
+   * This validator can be set only if OnlyDomains is empty.
+   */
+  exceptDomains: Array<string>
+  /**
+   * OnlyDomains will require the URL domain to be included in the listed ones.
+   * 
+   * This validator can be set only if ExceptDomains is empty.
+   */
+  onlyDomains: Array<string>
+  /**
+   * Required will require the field value to be non-empty URL string.
+   */
+  required: boolean
+ }
+ interface URLField {
+  /**
+   * Type implements [Field.Type] interface method.
+   */
+  type(): string
+ }
+ interface URLField {
+  /**
+   * GetId implements [Field.GetId] interface method.
+   */
+  getId(): string
+ }
+ interface URLField {
+  /**
+   * SetId implements [Field.SetId] interface method.
+   */
+  setId(id: string): void
+ }
+ interface URLField {
+  /**
+   * GetName implements [Field.GetName] interface method.
+   */
+  getName(): string
+ }
+ interface URLField {
+  /**
+   * SetName implements [Field.SetName] interface method.
+   */
+  setName(name: string): void
+ }
+ interface URLField {
+  /**
+   * GetSystem implements [Field.GetSystem] interface method.
+   */
+  getSystem(): boolean
+ }
+ interface URLField {
+  /**
+   * SetSystem implements [Field.SetSystem] interface method.
+   */
+  setSystem(system: boolean): void
+ }
+ interface URLField {
+  /**
+   * GetHidden implements [Field.GetHidden] interface method.
+   */
+  getHidden(): boolean
+ }
+ interface URLField {
+  /**
+   * SetHidden implements [Field.SetHidden] interface method.
+   */
+  setHidden(hidden: boolean): void
+ }
+ interface URLField {
+  /**
+   * ColumnType implements [Field.ColumnType] interface method.
+   */
+  columnType(app: App): string
+ }
+ interface URLField {
+  /**
+   * PrepareValue implements [Field.PrepareValue] interface method.
+   */
+  prepareValue(record: Record, raw: any): any
+ }
+ interface URLField {
+  /**
+   * ValidateValue implements [Field.ValidateValue] interface method.
+   */
+  validateValue(ctx: context.Context, app: App, record: Record): void
+ }
+ interface URLField {
+  /**
+   * ValidateSettings implements [Field.ValidateSettings] interface method.
+   */
+  validateSettings(ctx: context.Context, app: App, collection: Collection): void
+ }
+ interface newFieldsList {
+  /**
+   * NewFieldsList creates a new FieldsList instance with the provided fields.
+   */
+  (...fields: Field[]): FieldsList
+ }
+ /**
+  * FieldsList defines a Collection slice of fields.
+  */
+ interface FieldsList extends Array<Field>{}
+ interface FieldsList {
+  /**
+   * Clone creates a deep clone of the current list.
+   */
+  clone(): FieldsList
+ }
+ interface FieldsList {
+  /**
+   * FieldNames returns a slice with the name of all list fields.
+   */
+  fieldNames(): Array<string>
+ }
+ interface FieldsList {
+  /**
+   * AsMap returns a map with all registered list field.
+   * The returned map is indexed with each field name.
+   */
+  asMap(): _TygojaDict
+ }
+ interface FieldsList {
+  /**
+   * GetById returns a single field by its id.
+   */
+  getById(fieldId: string): Field
+ }
+ interface FieldsList {
+  /**
+   * GetByName returns a single field by its name.
+   */
+  getByName(fieldName: string): Field
+ }
+ interface FieldsList {
+  /**
+   * RemoveById removes a single field by its id.
+   * 
+   * This method does nothing if field with the specified id doesn't exist.
+   */
+  removeById(fieldId: string): void
+ }
+ interface FieldsList {
+  /**
+   * RemoveByName removes a single field by its name.
+   * 
+   * This method does nothing if field with the specified name doesn't exist.
+   */
+  removeByName(fieldName: string): void
+ }
+ interface FieldsList {
+  /**
+   * Add adds one or more fields to the current list.
+   * 
+   * By default this method will try to REPLACE existing fields with
+   * the new ones by their id or by their name if the new field doesn't have an explicit id.
+   * 
+   * If no matching existing field is found, it will APPEND the field to the end of the list.
+   * 
+   * In all cases, if any of the new fields don't have an explicit id it will auto generate a default one for them
+   * (the id value doesn't really matter and it is mostly used as a stable identifier in case of a field rename).
+   */
+  add(...fields: Field[]): void
+ }
+ interface FieldsList {
+  /**
+   * AddAt is the same as Add but insert/move the fields at the specific position.
+   * 
+   * If pos < 0, then this method acts the same as calling Add.
+   * 
+   * If pos > FieldsList total items, then the specified fields are inserted/moved at the end of the list.
+   */
+  addAt(pos: number, ...fields: Field[]): void
+ }
+ interface FieldsList {
+  /**
+   * AddMarshaledJSON parses the provided raw json data and adds the
+   * found fields into the current list (following the same rule as the Add method).
+   * 
+   * The rawJSON argument could be one of:
+   * ```
+   *   - serialized array of field objects
+   *   - single field object.
+   * ```
+   * 
+   * Example:
+   * 
+   * ```
+   * 	l.AddMarshaledJSON([]byte{`{"type":"text", name: "test"}`})
+   * 	l.AddMarshaledJSON([]byte{`[{"type":"text", name: "test1"}, {"type":"text", name: "test2"}]`})
+   * ```
+   */
+  addMarshaledJSON(rawJSON: string|Array<number>): void
+ }
+ interface FieldsList {
+  /**
+   * AddMarshaledJSONAt is the same as AddMarshaledJSON but insert/move the fields at the specific position.
+   * 
+   * If pos < 0, then this method acts the same as calling AddMarshaledJSON.
+   * 
+   * If pos > FieldsList total items, then the specified fields are inserted/moved at the end of the list.
+   */
+  addMarshaledJSONAt(pos: number, rawJSON: string|Array<number>): void
+ }
+ interface FieldsList {
+  /**
+   * String returns the string representation of the current list.
+   */
+  string(): string
+ }
+ interface onlyFieldType {
+  type: string
+ }
+ type _sqZrMPW = Field
+ interface fieldWithType extends _sqZrMPW {
+  type: string
+ }
+ interface fieldWithType {
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface FieldsList {
+  /**
+   * UnmarshalJSON implements [json.Unmarshaler] and
+   * loads the provided json data into the current FieldsList.
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface FieldsList {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface FieldsList {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface FieldsList {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current FieldsList instance.
+   */
+  scan(value: any): void
+ }
+ type _sKXLqsv = BaseModel
+ interface Log extends _sKXLqsv {
+  created: types.DateTime
+  data: types.JSONMap<any>
+  message: string
+  level: number
+ }
+ interface Log {
+  tableName(): string
+ }
+ interface BaseApp {
+  /**
+   * LogQuery returns a new Log select query.
+   */
+  logQuery(): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * FindLogById finds a single Log entry by its id.
+   */
+  findLogById(id: string): (Log)
+ }
+ /**
+  * LogsStatsItem defines the total number of logs for a specific time period.
+  */
+ interface LogsStatsItem {
+  date: types.DateTime
+  total: number
+ }
+ interface BaseApp {
+  /**
+   * LogsStats returns hourly grouped logs statistics.
+   */
+  logsStats(expr: dbx.Expression): Array<(LogsStatsItem | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * DeleteOldLogs delete all logs that are created before createdBefore.
+   * 
+   * For better performance the logs delete is executed as plain SQL statement,
+   * aka. no delete model hook events will be fired.
+   */
+  deleteOldLogs(createdBefore: time.Time): void
+ }
+ /**
+  * MFA defines a Record proxy for working with the mfas collection.
+  */
+ type _sWVeMoI = Record
+ interface MFA extends _sWVeMoI {
+ }
+ interface newMFA {
+  /**
+   * NewMFA instantiates and returns a new blank *MFA model.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	mfa := core.NewMFA(app)
+   * 	mfa.SetRecordRef(user.Id)
+   * 	mfa.SetCollectionRef(user.Collection().Id)
+   * 	mfa.SetMethod(core.MFAMethodPassword)
+   * 	app.Save(mfa)
+   * ```
+   */
+  (app: App): (MFA)
+ }
+ interface MFA {
+  /**
+   * PreValidate implements the [PreValidator] interface and checks
+   * whether the proxy is properly loaded.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ interface MFA {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface MFA {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface MFA {
+  /**
+   * CollectionRef returns the "collectionRef" field value.
+   */
+  collectionRef(): string
+ }
+ interface MFA {
+  /**
+   * SetCollectionRef updates the "collectionRef" record field value.
+   */
+  setCollectionRef(collectionId: string): void
+ }
+ interface MFA {
+  /**
+   * RecordRef returns the "recordRef" record field value.
+   */
+  recordRef(): string
+ }
+ interface MFA {
+  /**
+   * SetRecordRef updates the "recordRef" record field value.
+   */
+  setRecordRef(recordId: string): void
+ }
+ interface MFA {
+  /**
+   * Method returns the "method" record field value.
+   */
+  method(): string
+ }
+ interface MFA {
+  /**
+   * SetMethod updates the "method" record field value.
+   */
+  setMethod(method: string): void
+ }
+ interface MFA {
+  /**
+   * Created returns the "created" record field value.
+   */
+  created(): types.DateTime
+ }
+ interface MFA {
+  /**
+   * Updated returns the "updated" record field value.
+   */
+  updated(): types.DateTime
+ }
+ interface MFA {
+  /**
+   * HasExpired checks if the mfa is expired, aka. whether it has been
+   * more than maxElapsed time since its creation.
+   */
+  hasExpired(maxElapsed: time.Duration): boolean
+ }
+ interface BaseApp {
+  /**
+   * FindAllMFAsByRecord returns all MFA models linked to the provided auth record.
+   */
+  findAllMFAsByRecord(authRecord: Record): Array<(MFA | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllMFAsByCollection returns all MFA models linked to the provided collection.
+   */
+  findAllMFAsByCollection(collection: Collection): Array<(MFA | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindMFAById returns a single MFA model by its id.
+   */
+  findMFAById(id: string): (MFA)
+ }
+ interface BaseApp {
+  /**
+   * DeleteAllMFAsByRecord deletes all MFA models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllMFAsByRecord(authRecord: Record): void
+ }
+ interface BaseApp {
+  /**
+   * DeleteExpiredMFAs deletes the expired MFAs for all auth collections.
+   */
+  deleteExpiredMFAs(): void
+ }
+ interface Migration {
+  up: (txApp: App) => void
+  down: (txApp: App) => void
+  file: string
+  reapplyCondition: (txApp: App, runner: MigrationsRunner, fileName: string) => boolean
+ }
+ /**
+  * MigrationsList defines a list with migration definitions
+  */
+ interface MigrationsList {
+ }
+ interface MigrationsList {
+  /**
+   * Item returns a single migration from the list by its index.
+   */
+  item(index: number): (Migration)
+ }
+ interface MigrationsList {
+  /**
+   * Items returns the internal migrations list slice.
+   */
+  items(): Array<(Migration | undefined)>
+ }
+ interface MigrationsList {
+  /**
+   * Copy copies all provided list migrations into the current one.
+   */
+  copy(list: MigrationsList): void
+ }
+ interface MigrationsList {
+  /**
+   * Add adds adds an existing migration definition to the list.
+   * 
+   * If m.File is not provided, it will try to get the name from its .go file.
+   * 
+   * The list will be sorted automatically based on the migrations file name.
+   */
+  add(m: Migration): void
+ }
+ interface MigrationsList {
+  /**
+   * Register adds new migration definition to the list.
+   * 
+   * If optFilename is not provided, it will try to get the name from its .go file.
+   * 
+   * The list will be sorted automatically based on the migrations file name.
+   */
+  register(up: (txApp: App) => void, down: (txApp: App) => void, ...optFilename: string[]): void
+ }
+ /**
+  * MigrationsRunner defines a simple struct for managing the execution of db migrations.
+  */
+ interface MigrationsRunner {
+ }
+ interface newMigrationsRunner {
+  /**
+   * NewMigrationsRunner creates and initializes a new db migrations MigrationsRunner instance.
+   */
+  (app: App, migrationsList: MigrationsList): (MigrationsRunner)
+ }
+ interface MigrationsRunner {
+  /**
+   * Run interactively executes the current runner with the provided args.
+   * 
+   * The following commands are supported:
+   * - up           - applies all migrations
+   * - down [n]     - reverts the last n (default 1) applied migrations
+   * - history-sync - syncs the migrations table with the runner's migrations list
+   */
+  run(...args: string[]): void
+ }
+ interface MigrationsRunner {
+  /**
+   * Up executes all unapplied migrations for the provided runner.
+   * 
+   * On success returns list with the applied migrations file names.
+   */
+  up(): Array<string>
+ }
+ interface MigrationsRunner {
+  /**
+   * Down reverts the last `toRevertCount` applied migrations
+   * (in the order they were applied).
+   * 
+   * On success returns list with the reverted migrations file names.
+   */
+  down(toRevertCount: number): Array<string>
+ }
+ interface MigrationsRunner {
+  /**
+   * RemoveMissingAppliedMigrations removes the db entries of all applied migrations
+   * that are not listed in the runner's migrations list.
+   */
+  removeMissingAppliedMigrations(): void
+ }
+ /**
+  * OTP defines a Record proxy for working with the otps collection.
+  */
+ type _shJZrhg = Record
+ interface OTP extends _shJZrhg {
+ }
+ interface newOTP {
+  /**
+   * NewOTP instantiates and returns a new blank *OTP model.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	otp := core.NewOTP(app)
+   * 	otp.SetRecordRef(user.Id)
+   * 	otp.SetCollectionRef(user.Collection().Id)
+   * 	otp.SetPassword(security.RandomStringWithAlphabet(6, "1234567890"))
+   * 	app.Save(otp)
+   * ```
+   */
+  (app: App): (OTP)
+ }
+ interface OTP {
+  /**
+   * PreValidate implements the [PreValidator] interface and checks
+   * whether the proxy is properly loaded.
+   */
+  preValidate(ctx: context.Context, app: App): void
+ }
+ interface OTP {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface OTP {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface OTP {
+  /**
+   * CollectionRef returns the "collectionRef" field value.
+   */
+  collectionRef(): string
+ }
+ interface OTP {
+  /**
+   * SetCollectionRef updates the "collectionRef" record field value.
+   */
+  setCollectionRef(collectionId: string): void
+ }
+ interface OTP {
+  /**
+   * RecordRef returns the "recordRef" record field value.
+   */
+  recordRef(): string
+ }
+ interface OTP {
+  /**
+   * SetRecordRef updates the "recordRef" record field value.
+   */
+  setRecordRef(recordId: string): void
+ }
+ interface OTP {
+  /**
+   * SentTo returns the "sentTo" record field value.
+   * 
+   * It could be any string value (email, phone, message app id, etc.)
+   * and usually is used as part of the auth flow to update the verified
+   * user state in case for example the sentTo value matches with the user record email.
+   */
+  sentTo(): string
+ }
+ interface OTP {
+  /**
+   * SetSentTo updates the "sentTo" record field value.
+   */
+  setSentTo(val: string): void
+ }
+ interface OTP {
+  /**
+   * Created returns the "created" record field value.
+   */
+  created(): types.DateTime
+ }
+ interface OTP {
+  /**
+   * Updated returns the "updated" record field value.
+   */
+  updated(): types.DateTime
+ }
+ interface OTP {
+  /**
+   * HasExpired checks if the otp is expired, aka. whether it has been
+   * more than maxElapsed time since its creation.
+   */
+  hasExpired(maxElapsed: time.Duration): boolean
+ }
+ interface BaseApp {
+  /**
+   * FindAllOTPsByRecord returns all OTP models linked to the provided auth record.
+   */
+  findAllOTPsByRecord(authRecord: Record): Array<(OTP | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllOTPsByCollection returns all OTP models linked to the provided collection.
+   */
+  findAllOTPsByCollection(collection: Collection): Array<(OTP | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindOTPById returns a single OTP model by its id.
+   */
+  findOTPById(id: string): (OTP)
+ }
+ interface BaseApp {
+  /**
+   * DeleteAllOTPsByRecord deletes all OTP models associated with the provided record.
+   * 
+   * Returns a combined error with the failed deletes.
+   */
+  deleteAllOTPsByRecord(authRecord: Record): void
+ }
+ interface BaseApp {
+  /**
+   * DeleteExpiredOTPs deletes the expired OTPs for all auth collections.
+   */
+  deleteExpiredOTPs(): void
+ }
+ /**
+  * RecordFieldResolver defines a custom search resolver struct for
+  * managing Record model search fields.
+  * 
+  * Usually used together with `search.Provider`.
+  * Example:
+  * 
+  * ```
+  * 	resolver := resolvers.NewRecordFieldResolver(
+  * 	    app,
+  * 	    myCollection,
+  * 	    &models.RequestInfo{...},
+  * 	    true,
+  * 	)
+  * 	provider := search.NewProvider(resolver)
+  * 	...
+  * ```
+  */
+ interface RecordFieldResolver {
+ }
+ interface RecordFieldResolver {
+  /**
+   * AllowedFields returns a copy of the resolver's allowed fields.
+   */
+  allowedFields(): Array<string>
+ }
+ interface RecordFieldResolver {
+  /**
+   * SetAllowedFields replaces the resolver's allowed fields with the new ones.
+   */
+  setAllowedFields(newAllowedFields: Array<string>): void
+ }
+ interface RecordFieldResolver {
+  /**
+   * AllowHiddenFields returns whether the current resolver allows filtering hidden fields.
+   */
+  allowHiddenFields(): boolean
+ }
+ interface RecordFieldResolver {
+  /**
+   * SetAllowHiddenFields enables or disables hidden fields filtering.
+   */
+  setAllowHiddenFields(allowHiddenFields: boolean): void
+ }
+ interface newRecordFieldResolver {
+  /**
+   * NewRecordFieldResolver creates and initializes a new `RecordFieldResolver`.
+   */
+  (app: App, baseCollection: Collection, requestInfo: RequestInfo, allowHiddenFields: boolean): (RecordFieldResolver)
+ }
+ interface RecordFieldResolver {
+  /**
+   * @todo think of a better a way how to call it automatically after BuildExpr
+   * 
+   * UpdateQuery implements `search.FieldResolver` interface.
+   * 
+   * Conditionally updates the provided search query based on the
+   * resolved fields (eg. dynamically joining relations).
+   */
+  updateQuery(query: dbx.SelectQuery): void
+ }
+ interface RecordFieldResolver {
+  /**
+   * Resolve implements `search.FieldResolver` interface.
+   * 
+   * Example of some resolvable fieldName formats:
+   * 
+   * ```
+   * 	id
+   * 	someSelect.each
+   * 	project.screen.status
+   * 	screen.project_via_prototype.name
+   * 	@request.context
+   * 	@request.method
+   * 	@request.query.filter
+   * 	@request.headers.x_token
+   * 	@request.auth.someRelation.name
+   * 	@request.body.someRelation.name
+   * 	@request.body.someField
+   * 	@request.body.someSelect:each
+   * 	@request.body.someField:isset
+   * 	@collection.product.name
+   * ```
+   */
+  resolve(fieldName: string): (search.ResolverResult)
+ }
+ interface mapExtractor {
+  [key:string]: any;
+  asMap(): _TygojaDict
+ }
+ /**
+  * join defines the specification for a single SQL JOIN clause.
+  */
+ interface join {
+ }
+ /**
+  * multiMatchSubquery defines a record multi-match subquery expression.
+  */
+ interface multiMatchSubquery {
+ }
+ interface multiMatchSubquery {
+  /**
+   * Build converts the expression into a SQL fragment.
+   * 
+   * Implements [dbx.Expression] interface.
+   */
+  build(db: dbx.DB, params: dbx.Params): string
+ }
+ /**
+  * replaceWithExpression defines a custom expression that will replace
+  * a placeholder identifier found in "old" with the result of "new".
+  */
+ interface replaceWithExpression {
+ }
+ interface replaceWithExpression {
+  /**
+   * Build converts the expression into a SQL fragment.
+   * 
+   * Implements [dbx.Expression] interface.
+   */
+  build(db: dbx.DB, params: dbx.Params): string
+ }
+ interface runner {
+ }
+ type _srvXuBC = BaseModel
+ interface Record extends _srvXuBC {
+ }
+ interface newRecord {
+  /**
+   * NewRecord initializes a new empty Record model.
+   */
+  (collection: Collection): (Record)
+ }
+ interface Record {
+  /**
+   * Collection returns the Collection model associated with the current Record model.
+   * 
+   * NB! The returned collection is only for read purposes and it shouldn't be modified
+   * because it could have unintended side-effects on other Record models from the same collection.
+   */
+  collection(): (Collection)
+ }
+ interface Record {
+  /**
+   * TableName returns the table name associated with the current Record model.
+   */
+  tableName(): string
+ }
+ interface Record {
+  /**
+   * PostScan implements the [dbx.PostScanner] interface.
+   * 
+   * It essentially refreshes/updates the current Record original state
+   * as if the model was fetched from the databases for the first time.
+   * 
+   * Or in other words, it means that m.Original().FieldsData() will have
+   * the same values as m.Record().FieldsData().
+   */
+  postScan(): void
+ }
+ interface Record {
+  /**
+   * HookTags returns the hook tags associated with the current record.
+   */
+  hookTags(): Array<string>
+ }
+ interface Record {
+  /**
+   * BaseFilesPath returns the storage dir path used by the record.
+   */
+  baseFilesPath(): string
+ }
+ interface Record {
+  /**
+   * Original returns a shallow copy of the current record model populated
+   * with its ORIGINAL db data state (aka. right after PostScan())
+   * and everything else reset to the defaults.
+   * 
+   * If record was created using NewRecord() the original will be always
+   * a blank record (until PostScan() is invoked).
+   */
+  original(): (Record)
+ }
+ interface Record {
+  /**
+   * Fresh returns a shallow copy of the current record model populated
+   * with its LATEST data state and everything else reset to the defaults
+   * (aka. no expand, no unknown fields and with default visibility flags).
+   */
+  fresh(): (Record)
+ }
+ interface Record {
+  /**
+   * Clone returns a shallow copy of the current record model with all of
+   * its collection and unknown fields data, expand and flags copied.
+   * 
+   * use [Record.Fresh()] instead if you want a copy with only the latest
+   * collection fields data and everything else reset to the defaults.
+   */
+  clone(): (Record)
+ }
+ interface Record {
+  /**
+   * Expand returns a shallow copy of the current Record model expand data (if any).
+   */
+  expand(): _TygojaDict
+ }
+ interface Record {
+  /**
+   * SetExpand replaces the current Record's expand with the provided expand arg data (shallow copied).
+   */
+  setExpand(expand: _TygojaDict): void
+ }
+ interface Record {
+  /**
+   * MergeExpand merges recursively the provided expand data into
+   * the current model's expand (if any).
+   * 
+   * Note that if an expanded prop with the same key is a slice (old or new expand)
+   * then both old and new records will be merged into a new slice (aka. a :merge: [b,c] => [a,b,c]).
+   * Otherwise the "old" expanded record will be replace with the "new" one (aka. a :merge: aNew => aNew).
+   */
+  mergeExpand(expand: _TygojaDict): void
+ }
+ interface Record {
+  /**
+   * FieldsData returns a shallow copy ONLY of the collection's fields record's data.
+   */
+  fieldsData(): _TygojaDict
+ }
+ interface Record {
+  /**
+   * CustomData returns a shallow copy ONLY of the custom record fields data,
+   * aka. fields that are neither defined by the collection, nor special system ones.
+   * 
+   * Note that custom fields prefixed with "@pbInternal" are always skipped.
+   */
+  customData(): _TygojaDict
+ }
+ interface Record {
+  /**
+   * WithCustomData toggles the export/serialization of custom data fields
+   * (false by default).
+   */
+  withCustomData(state: boolean): (Record)
+ }
+ interface Record {
+  /**
+   * IgnoreEmailVisibility toggles the flag to ignore the auth record email visibility check.
+   */
+  ignoreEmailVisibility(state: boolean): (Record)
+ }
+ interface Record {
+  /**
+   * IgnoreUnchangedFields toggles the flag to ignore the unchanged fields
+   * from the DB export for the UPDATE SQL query.
+   * 
+   * This could be used if you want to save only the record fields that you've changed
+   * without overwrite other untouched fields in case of concurrent update.
+   * 
+   * Note that the fields change comparison is based on the current fields against m.Original()
+   * (aka. if you have performed save on the same Record instance multiple times you may have to refetch it,
+   * so that m.Original() could reflect the last saved change).
+   */
+  ignoreUnchangedFields(state: boolean): (Record)
+ }
+ interface Record {
+  /**
+   * Set sets the provided key-value data pair into the current Record
+   * model directly as it is WITHOUT NORMALIZATIONS.
+   * 
+   * See also [Record.Set].
+   */
+  setRaw(key: string, value: any): void
+ }
+ interface Record {
+  /**
+   * SetIfFieldExists sets the provided key-value data pair into the current Record model
+   * ONLY if key is existing Collection field name/modifier.
+   * 
+   * This method does nothing if key is not a known Collection field name/modifier.
+   * 
+   * On success returns the matched Field, otherwise - nil.
+   * 
+   * To set any key-value, including custom/unknown fields, use the [Record.Set] method.
+   */
+  setIfFieldExists(key: string, value: any): Field
+ }
+ interface Record {
+  /**
+   * Set sets the provided key-value data pair into the current Record model.
+   * 
+   * If the record collection has field with name matching the provided "key",
+   * the value will be further normalized according to the field setter(s).
+   */
+  set(key: string, value: any): void
+ }
+ interface Record {
+  getRaw(key: string): any
+ }
+ interface Record {
+  /**
+   * Get returns a normalized single record model data value for "key".
+   */
+  get(key: string): any
+ }
+ interface Record {
+  /**
+   * Load bulk loads the provided data into the current Record model.
+   */
+  load(data: _TygojaDict): void
+ }
+ interface Record {
+  /**
+   * GetBool returns the data value for "key" as a bool.
+   */
+  getBool(key: string): boolean
+ }
+ interface Record {
+  /**
+   * GetString returns the data value for "key" as a string.
+   */
+  getString(key: string): string
+ }
+ interface Record {
+  /**
+   * GetInt returns the data value for "key" as an int.
+   */
+  getInt(key: string): number
+ }
+ interface Record {
+  /**
+   * GetFloat returns the data value for "key" as a float64.
+   */
+  getFloat(key: string): number
+ }
+ interface Record {
+  /**
+   * GetDateTime returns the data value for "key" as a DateTime instance.
+   */
+  getDateTime(key: string): types.DateTime
+ }
+ interface Record {
+  /**
+   * GetGeoPoint returns the data value for "key" as a GeoPoint instance.
+   */
+  getGeoPoint(key: string): types.GeoPoint
+ }
+ interface Record {
+  /**
+   * GetStringSlice returns the data value for "key" as a slice of non-zero unique strings.
+   */
+  getStringSlice(key: string): Array<string>
+ }
+ interface Record {
+  /**
+   * GetUnsavedFiles returns the uploaded files for the provided "file" field key,
+   * (aka. the current [*filesytem.File] values) so that you can apply further
+   * validations or modifications (including changing the file name or content before persisting).
+   * 
+   * Example:
+   * 
+   * ```
+   * 	files := record.GetUnsavedFiles("documents")
+   * 	for _, f := range files {
+   * 	    f.Name = "doc_" + f.Name // add a prefix to each file name
+   * 	}
+   * 	app.Save(record) // the files are pointers so the applied changes will transparently reflect on the record value
+   * ```
+   */
+  getUnsavedFiles(key: string): Array<(filesystem.File | undefined)>
+ }
+ interface Record {
+  /**
+   * Deprecated: replaced with GetUnsavedFiles.
+   */
+  getUploadedFiles(key: string): Array<(filesystem.File | undefined)>
+ }
+ interface Record {
+  /**
+   * Retrieves the "key" json field value and unmarshals it into "result".
+   * 
+   * Example
+   * 
+   * ```
+   * 	result := struct {
+   * 	    FirstName string `json:"first_name"`
+   * 	}{}
+   * 	err := m.UnmarshalJSONField("my_field_name", &result)
+   * ```
+   */
+  unmarshalJSONField(key: string, result: any): void
+ }
+ interface Record {
+  /**
+   * ExpandedOne retrieves a single relation Record from the already
+   * loaded expand data of the current model.
+   * 
+   * If the requested expand relation is multiple, this method returns
+   * only first available Record from the expanded relation.
+   * 
+   * Returns nil if there is no such expand relation loaded.
+   */
+  expandedOne(relField: string): (Record)
+ }
+ interface Record {
+  /**
+   * ExpandedAll retrieves a slice of relation Records from the already
+   * loaded expand data of the current model.
+   * 
+   * If the requested expand relation is single, this method normalizes
+   * the return result and will wrap the single model as a slice.
+   * 
+   * Returns nil slice if there is no such expand relation loaded.
+   */
+  expandedAll(relField: string): Array<(Record | undefined)>
+ }
+ interface Record {
+  /**
+   * FindFileFieldByFile returns the first file type field for which
+   * any of the record's data contains the provided filename.
+   */
+  findFileFieldByFile(filename: string): (FileField)
+ }
+ interface Record {
+  /**
+   * DBExport implements the [DBExporter] interface and returns a key-value
+   * map with the data to be persisted when saving the Record in the database.
+   */
+  dbExport(app: App): _TygojaDict
+ }
+ interface Record {
+  /**
+   * Hide hides the specified fields from the public safe serialization of the record.
+   */
+  hide(...fieldNames: string[]): (Record)
+ }
+ interface Record {
+  /**
+   * Unhide forces to unhide the specified fields from the public safe serialization
+   * of the record (even when the collection field itself is marked as hidden).
+   */
+  unhide(...fieldNames: string[]): (Record)
+ }
+ interface Record {
+  /**
+   * PublicExport exports only the record fields that are safe to be public.
+   * 
+   * To export unknown data fields you need to set record.WithCustomData(true).
+   * 
+   * For auth records, to force the export of the email field you need to set
+   * record.IgnoreEmailVisibility(true).
+   */
+  publicExport(): _TygojaDict
+ }
+ interface Record {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * 
+   * Only the data exported by `PublicExport()` will be serialized.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface Record {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface Record {
+  /**
+   * ReplaceModifiers returns a new map with applied modifier
+   * values based on the current record and the specified data.
+   * 
+   * The resolved modifier keys will be removed.
+   * 
+   * Multiple modifiers will be applied one after another,
+   * while reusing the previous base key value result (ex. 1; -5; +2 => -2).
+   * 
+   * Note that because Go doesn't guaranteed the iteration order of maps,
+   * we would explicitly apply shorter keys first for a more consistent and reproducible behavior.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	 newData := record.ReplaceModifiers(data)
+   * 		// record: {"field": 10}
+   * 		// data:   {"field+": 5}
+   * 		// result: {"field": 15}
+   * ```
+   */
+  replaceModifiers(data: _TygojaDict): _TygojaDict
+ }
+ interface Record {
+  /**
+   * Email returns the "email" record field value (usually available with Auth collections).
+   */
+  email(): string
+ }
+ interface Record {
+  /**
+   * SetEmail sets the "email" record field value (usually available with Auth collections).
+   */
+  setEmail(email: string): void
+ }
+ interface Record {
+  /**
+   * Verified returns the "emailVisibility" record field value (usually available with Auth collections).
+   */
+  emailVisibility(): boolean
+ }
+ interface Record {
+  /**
+   * SetEmailVisibility sets the "emailVisibility" record field value (usually available with Auth collections).
+   */
+  setEmailVisibility(visible: boolean): void
+ }
+ interface Record {
+  /**
+   * Verified returns the "verified" record field value (usually available with Auth collections).
+   */
+  verified(): boolean
+ }
+ interface Record {
+  /**
+   * SetVerified sets the "verified" record field value (usually available with Auth collections).
+   */
+  setVerified(verified: boolean): void
+ }
+ interface Record {
+  /**
+   * TokenKey returns the "tokenKey" record field value (usually available with Auth collections).
+   */
+  tokenKey(): string
+ }
+ interface Record {
+  /**
+   * SetTokenKey sets the "tokenKey" record field value (usually available with Auth collections).
+   */
+  setTokenKey(key: string): void
+ }
+ interface Record {
+  /**
+   * RefreshTokenKey generates and sets a new random auth record "tokenKey".
+   */
+  refreshTokenKey(): void
+ }
+ interface Record {
+  /**
+   * SetPassword sets the "password" record field value (usually available with Auth collections).
+   */
+  setPassword(password: string): void
+ }
+ interface Record {
+  /**
+   * SetRandomPassword sets the "password" auth record field to a random autogenerated value.
+   * 
+   * The autogenerated password is ~30 characters and it is set directly as hash,
+   * aka. the field plain password value validators (length, pattern, etc.) are ignored
+   * (this is usually used as part of the auto created OTP or OAuth2 user flows).
+   */
+  setRandomPassword(): string
+ }
+ interface Record {
+  /**
+   * ValidatePassword validates a plain password against the "password" record field.
+   * 
+   * Returns false if the password is incorrect.
+   */
+  validatePassword(password: string): boolean
+ }
+ interface Record {
+  /**
+   * IsSuperuser returns whether the current record is a superuser, aka.
+   * whether the record is from the _superusers collection.
+   */
+  isSuperuser(): boolean
+ }
+ /**
+  * RecordProxy defines an interface for a Record proxy/project model,
+  * aka. custom model struct that acts on behalve the proxied Record to
+  * allow for example typed getter/setters for the Record fields.
+  * 
+  * To implement the interface it is usually enough to embed the [BaseRecordProxy] struct.
+  */
+ interface RecordProxy {
+  [key:string]: any;
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ /**
+  * BaseRecordProxy implements the [RecordProxy] interface and it is intended
+  * to be used as embed to custom user provided Record proxy structs.
+  */
+ type _swOBUmj = Record
+ interface BaseRecordProxy extends _swOBUmj {
+ }
+ interface BaseRecordProxy {
+  /**
+   * ProxyRecord returns the proxied Record model.
+   */
+  proxyRecord(): (Record)
+ }
+ interface BaseRecordProxy {
+  /**
+   * SetProxyRecord loads the specified record model into the current proxy.
+   */
+  setProxyRecord(record: Record): void
+ }
+ interface BaseApp {
+  /**
+   * RecordQuery returns a new Record select query from a collection model, id or name.
+   * 
+   * In case a collection id or name is provided and that collection doesn't
+   * actually exists, the generated query will be created with a cancelled context
+   * and will fail once an executor (Row(), One(), All(), etc.) is called.
+   */
+  recordQuery(collectionModelOrIdentifier: any): (dbx.SelectQuery)
+ }
+ interface BaseApp {
+  /**
+   * FindRecordById finds the Record model by its id.
+   */
+  findRecordById(collectionModelOrIdentifier: any, recordId: string, ...optFilters: ((q: dbx.SelectQuery) => void)[]): (Record)
+ }
+ interface BaseApp {
+  /**
+   * FindRecordsByIds finds all records by the specified ids.
+   * If no records are found, returns an empty slice.
+   */
+  findRecordsByIds(collectionModelOrIdentifier: any, recordIds: Array<string>, ...optFilters: ((q: dbx.SelectQuery) => void)[]): Array<(Record | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindAllRecords finds all records matching specified db expressions.
+   * 
+   * Returns all collection records if no expression is provided.
+   * 
+   * Returns an empty slice if no records are found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	// no extra expressions
+   * 	app.FindAllRecords("example")
+   * 
+   * 	// with extra expressions
+   * 	expr1 := dbx.HashExp{"email": "test@example.com"}
+   * 	expr2 := dbx.NewExp("LOWER(username) = {:username}", dbx.Params{"username": "test"})
+   * 	app.FindAllRecords("example", expr1, expr2)
+   * ```
+   */
+  findAllRecords(collectionModelOrIdentifier: any, ...exprs: dbx.Expression[]): Array<(Record | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindFirstRecordByData returns the first found record matching
+   * the provided key-value pair.
+   */
+  findFirstRecordByData(collectionModelOrIdentifier: any, key: string, value: any): (Record)
+ }
+ interface BaseApp {
+  /**
+   * FindRecordsByFilter returns limit number of records matching the
+   * provided string filter.
+   * 
+   * NB! Use the last "params" argument to bind untrusted user variables!
+   * 
+   * The filter argument is optional and can be empty string to target
+   * all available records.
+   * 
+   * The sort argument is optional and can be empty string OR the same format
+   * used in the web APIs, ex. "-created,title".
+   * 
+   * If the limit argument is <= 0, no limit is applied to the query and
+   * all matching records are returned.
+   * 
+   * Returns an empty slice if no records are found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindRecordsByFilter(
+   * 		"posts",
+   * 		"title ~ {:title} && visible = {:visible}",
+   * 		"-created",
+   * 		10,
+   * 		0,
+   * 		dbx.Params{"title": "lorem ipsum", "visible": true}
+   * 	)
+   * ```
+   */
+  findRecordsByFilter(collectionModelOrIdentifier: any, filter: string, sort: string, limit: number, offset: number, ...params: dbx.Params[]): Array<(Record | undefined)>
+ }
+ interface BaseApp {
+  /**
+   * FindFirstRecordByFilter returns the first available record matching the provided filter (if any).
+   * 
+   * NB! Use the last params argument to bind untrusted user variables!
+   * 
+   * Returns sql.ErrNoRows if no record is found.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.FindFirstRecordByFilter("posts", "")
+   * 	app.FindFirstRecordByFilter("posts", "slug={:slug} && status='public'", dbx.Params{"slug": "test"})
+   * ```
+   */
+  findFirstRecordByFilter(collectionModelOrIdentifier: any, filter: string, ...params: dbx.Params[]): (Record)
+ }
+ interface BaseApp {
+  /**
+   * CountRecords returns the total number of records in a collection.
+   */
+  countRecords(collectionModelOrIdentifier: any, ...exprs: dbx.Expression[]): number
+ }
+ interface BaseApp {
+  /**
+   * FindAuthRecordByToken finds the auth record associated with the provided JWT
+   * (auth, file, verifyEmail, changeEmail, passwordReset types).
+   * 
+   * Optionally specify a list of validTypes to check tokens only from those types.
+   * 
+   * Returns an error if the JWT is invalid, expired or not associated to an auth collection record.
+   */
+  findAuthRecordByToken(token: string, ...validTypes: string[]): (Record)
+ }
+ interface BaseApp {
+  /**
+   * FindAuthRecordByEmail finds the auth record associated with the provided email.
+   * 
+   * The email check would be case-insensitive if the related collection
+   * email unique index has COLLATE NOCASE specified for the email column.
+   * 
+   * Returns an error if it is not an auth collection or the record is not found.
+   */
+  findAuthRecordByEmail(collectionModelOrIdentifier: any, email: string): (Record)
+ }
+ interface BaseApp {
+  /**
+   * CanAccessRecord checks if a record is allowed to be accessed by the
+   * specified requestInfo and accessRule.
+   * 
+   * Rule and db checks are ignored in case requestInfo.Auth is a superuser.
+   * 
+   * The returned error indicate that something unexpected happened during
+   * the check (eg. invalid rule or db query error).
+   * 
+   * The method always return false on invalid rule or db query error.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	requestInfo, _ := e.RequestInfo()
+   * 	record, _ := app.FindRecordById("example", "RECORD_ID")
+   * 	rule := types.Pointer("@request.auth.id != '' || status = 'public'")
+   * 	// ... or use one of the record collection's rule, eg. record.Collection().ViewRule
+   * 
+   * 	if ok, _ := app.CanAccessRecord(record, requestInfo, rule); ok { ... }
+   * ```
+   */
+  canAccessRecord(record: Record, requestInfo: RequestInfo, accessRule: string): boolean
+ }
+ /**
+  * ExpandFetchFunc defines the function that is used to fetch the expanded relation records.
+  */
+ interface ExpandFetchFunc {(relCollection: Collection, relIds: Array<string>): Array<(Record | undefined)> }
+ interface BaseApp {
+  /**
+   * ExpandRecord expands the relations of a single Record model.
+   * 
+   * If optFetchFunc is not set, then a default function will be used
+   * that returns all relation records.
+   * 
+   * Returns a map with the failed expand parameters and their errors.
+   */
+  expandRecord(record: Record, expands: Array<string>, optFetchFunc: ExpandFetchFunc): _TygojaDict
+ }
+ interface BaseApp {
+  /**
+   * ExpandRecords expands the relations of the provided Record models list.
+   * 
+   * If optFetchFunc is not set, then a default function will be used
+   * that returns all relation records.
+   * 
+   * Returns a map with the failed expand parameters and their errors.
+   */
+  expandRecords(records: Array<(Record | undefined)>, expands: Array<string>, optFetchFunc: ExpandFetchFunc): _TygojaDict
+ }
+ interface Record {
+  /**
+   * NewStaticAuthToken generates and returns a new static record authentication token.
+   * 
+   * Static auth tokens are similar to the regular auth tokens, but are
+   * non-refreshable and support custom duration.
+   * 
+   * Zero or negative duration will fallback to the duration from the auth collection settings.
+   */
+  newStaticAuthToken(duration: time.Duration): string
+ }
+ interface Record {
+  /**
+   * NewAuthToken generates and returns a new record authentication token.
+   */
+  newAuthToken(): string
+ }
+ interface Record {
+  /**
+   * NewVerificationToken generates and returns a new record verification token.
+   */
+  newVerificationToken(): string
+ }
+ interface Record {
+  /**
+   * NewPasswordResetToken generates and returns a new auth record password reset request token.
+   */
+  newPasswordResetToken(): string
+ }
+ interface Record {
+  /**
+   * NewEmailChangeToken generates and returns a new auth record change email request token.
+   */
+  newEmailChangeToken(newEmail: string): string
+ }
+ interface Record {
+  /**
+   * NewFileToken generates and returns a new record private file access token.
+   */
+  newFileToken(): string
+ }
+ interface settings {
+  smtp: SMTPConfig
+  backups: BackupsConfig
+  s3: S3Config
+  meta: MetaConfig
+  rateLimits: RateLimitsConfig
+  trustedProxy: TrustedProxyConfig
+  batch: BatchConfig
+  logs: LogsConfig
+ }
+ /**
+  * Settings defines the PocketBase app settings.
+  */
+ type _sUSqZcG = settings
+ interface Settings extends _sUSqZcG {
+ }
+ interface Settings {
+  /**
+   * TableName implements [Model.TableName] interface method.
+   */
+  tableName(): string
+ }
+ interface Settings {
+  /**
+   * PK implements [Model.LastSavedPK] interface method.
+   */
+  lastSavedPK(): any
+ }
+ interface Settings {
+  /**
+   * PK implements [Model.PK] interface method.
+   */
+  pk(): any
+ }
+ interface Settings {
+  /**
+   * IsNew implements [Model.IsNew] interface method.
+   */
+  isNew(): boolean
+ }
+ interface Settings {
+  /**
+   * MarkAsNew implements [Model.MarkAsNew] interface method.
+   */
+  markAsNew(): void
+ }
+ interface Settings {
+  /**
+   * MarkAsNew implements [Model.MarkAsNotNew] interface method.
+   */
+  markAsNotNew(): void
+ }
+ interface Settings {
+  /**
+   * PostScan implements [Model.PostScan] interface method.
+   */
+  postScan(): void
+ }
+ interface Settings {
+  /**
+   * String returns a serialized string representation of the current settings.
+   */
+  string(): string
+ }
+ interface Settings {
+  /**
+   * DBExport prepares and exports the current settings for db persistence.
+   */
+  dbExport(app: App): _TygojaDict
+ }
+ interface Settings {
+  /**
+   * PostValidate implements the [PostValidator] interface and defines
+   * the Settings model validations.
+   */
+  postValidate(ctx: context.Context, app: App): void
+ }
+ interface Settings {
+  /**
+   * Merge merges the "other" settings into the current one.
+   */
+  merge(other: Settings): void
+ }
+ interface Settings {
+  /**
+   * Clone creates a new deep copy of the current settings.
+   */
+  clone(): (Settings)
+ }
+ interface Settings {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * 
+   * Note that sensitive fields (S3 secret, SMTP password, etc.) are excluded.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface SMTPConfig {
+  enabled: boolean
+  port: number
+  host: string
+  username: string
+  password: string
+  /**
+   * SMTP AUTH - PLAIN (default) or LOGIN
+   */
+  authMethod: string
+  /**
+   * Whether to enforce TLS encryption for the mail server connection.
+   * 
+   * When set to false StartTLS command is send, leaving the server
+   * to decide whether to upgrade the connection or not.
+   */
+  tls: boolean
+  /**
+   * LocalName is optional domain name or IP address used for the
+   * EHLO/HELO exchange (if not explicitly set, defaults to "localhost").
+   * 
+   * This is required only by some SMTP servers, such as Gmail SMTP-relay.
+   */
+  localName: string
+ }
+ interface SMTPConfig {
+  /**
+   * Validate makes SMTPConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface S3Config {
+  enabled: boolean
+  bucket: string
+  region: string
+  endpoint: string
+  accessKey: string
+  secret: string
+  forcePathStyle: boolean
+ }
+ interface S3Config {
+  /**
+   * Validate makes S3Config validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface BatchConfig {
+  enabled: boolean
+  /**
+   * MaxRequests is the maximum allowed batch request to execute.
+   */
+  maxRequests: number
+  /**
+   * Timeout is the the max duration in seconds to wait before cancelling the batch transaction.
+   */
+  timeout: number
+  /**
+   * MaxBodySize is the maximum allowed batch request body size in bytes.
+   * 
+   * If not set, fallbacks to max ~128MB.
+   */
+  maxBodySize: number
+ }
+ interface BatchConfig {
+  /**
+   * Validate makes BatchConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface BackupsConfig {
+  /**
+   * Cron is a cron expression to schedule auto backups, eg. "* * * * *".
+   * 
+   * Leave it empty to disable the auto backups functionality.
+   */
+  cron: string
+  /**
+   * CronMaxKeep is the the max number of cron generated backups to
+   * keep before removing older entries.
+   * 
+   * This field works only when the cron config has valid cron expression.
+   */
+  cronMaxKeep: number
+  /**
+   * S3 is an optional S3 storage config specifying where to store the app backups.
+   */
+  s3: S3Config
+ }
+ interface BackupsConfig {
+  /**
+   * Validate makes BackupsConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface MetaConfig {
+  appName: string
+  appURL: string
+  senderName: string
+  senderAddress: string
+  hideControls: boolean
+ }
+ interface MetaConfig {
+  /**
+   * Validate makes MetaConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface LogsConfig {
+  maxDays: number
+  minLevel: number
+  logIP: boolean
+  logAuthId: boolean
+ }
+ interface LogsConfig {
+  /**
+   * Validate makes LogsConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TrustedProxyConfig {
+  /**
+   * Headers is a list of explicit trusted header(s) to check.
+   */
+  headers: Array<string>
+  /**
+   * UseLeftmostIP specifies to use the left-mostish IP from the trusted headers.
+   * 
+   * Note that this could be insecure when used with X-Forwarded-For header
+   * because some proxies like AWS ELB allow users to prepend their own header value
+   * before appending the trusted ones.
+   */
+  useLeftmostIP: boolean
+ }
+ interface TrustedProxyConfig {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface TrustedProxyConfig {
+  /**
+   * Validate makes RateLimitRule validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface RateLimitsConfig {
+  rules: Array<RateLimitRule>
+  enabled: boolean
+ }
+ interface RateLimitsConfig {
+  /**
+   * FindRateLimitRule returns the first matching rule based on the provided labels.
+   * 
+   * Optionally you can further specify a list of valid RateLimitRule.Audience values to further filter the matching rule
+   * (aka. the rule Audience will have to exist in one of the specified options).
+   */
+  findRateLimitRule(searchLabels: Array<string>, ...optOnlyAudience: string[]): [RateLimitRule, boolean]
+ }
+ interface RateLimitsConfig {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface RateLimitsConfig {
+  /**
+   * Validate makes RateLimitsConfig validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface RateLimitRule {
+  /**
+   * Label is the identifier of the current rule.
+   * 
+   * It could be a tag, complete path or path prerefix (when ends with `/`).
+   * 
+   * Example supported labels:
+   * ```
+   *   - test_a (plain text "tag")
+   *   - users:create
+   *   - *:create
+   *   - /
+   *   - /api
+   *   - POST /api/collections/
+   * ```
+   */
+  label: string
+  /**
+   * Audience specifies the auth group the rule should apply for:
+   * ```
+   *   - ""      - both guests and authenticated users (default)
+   *   - "@guest" - only for guests
+   *   - "@auth"  - only for authenticated users
+   * ```
+   */
+  audience: string
+  /**
+   * Duration specifies the interval (in seconds) per which to reset
+   * the counted/accumulated rate limiter tokens.
+   */
+  duration: number
+  /**
+   * MaxRequests is the max allowed number of requests per Duration.
+   */
+  maxRequests: number
+ }
+ interface RateLimitRule {
+  /**
+   * Validate makes RateLimitRule validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface RateLimitRule {
+  /**
+   * DurationTime returns the tag's Duration as [time.Duration].
+   */
+  durationTime(): time.Duration
+ }
+ interface RateLimitRule {
+  /**
+   * String returns a string representation of the rule.
+   */
+  string(): string
+ }
+ type _syRXTNa = BaseModel
+ interface Param extends _syRXTNa {
+  created: types.DateTime
+  updated: types.DateTime
+  value: types.JSONRaw
+ }
+ interface Param {
+  tableName(): string
+ }
+ interface BaseApp {
+  /**
+   * ReloadSettings initializes and reloads the stored application settings.
+   * 
+   * If no settings were stored it will persist the current app ones.
+   */
+  reloadSettings(): void
+ }
+ interface BaseApp {
+  /**
+   * DeleteView drops the specified view name.
+   * 
+   * This method is a no-op if a view with the provided name doesn't exist.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "name" argument must come only from trusted input!
+   */
+  deleteView(name: string): void
+ }
+ interface BaseApp {
+  /**
+   * SaveView creates (or updates already existing) persistent SQL view.
+   * 
+   * NB! Be aware that this method is vulnerable to SQL injection and the
+   * "selectQuery" argument must come only from trusted input!
+   */
+  saveView(name: string, selectQuery: string): void
+ }
+ interface BaseApp {
+  /**
+   * CreateViewFields creates a new FieldsList from the provided select query.
+   * 
+   * There are some caveats:
+   * - The select query must have an "id" column.
+   * - Wildcard ("*") columns are not supported to avoid accidentally leaking sensitive data.
+   */
+  createViewFields(selectQuery: string): FieldsList
+ }
+ interface BaseApp {
+  /**
+   * FindRecordByViewFile returns the original Record of the provided view collection file.
+   */
+  findRecordByViewFile(viewCollectionModelOrIdentifier: any, fileFieldName: string, filename: string): (Record)
+ }
+ interface queryField {
+ }
+ interface identifier {
+ }
+ interface identifiersParser {
+ }
+}
+
+/**
+ * Package mails implements various helper methods for sending common
+ * emails like forgotten password, verification, etc.
+ */
+namespace mails {
+ interface sendRecordAuthAlert {
+  /**
+   * SendRecordAuthAlert sends a new device login alert to the specified auth record.
+   */
+  (app: CoreApp, authRecord: core.Record, info: string): void
+ }
+ interface sendRecordOTP {
+  /**
+   * SendRecordOTP sends OTP email to the specified auth record.
+   * 
+   * This method will also update the "sentTo" field of the related OTP record to the mail sent To address (if the OTP exists and not already assigned).
+   */
+  (app: CoreApp, authRecord: core.Record, otpId: string, pass: string): void
+ }
+ interface sendRecordPasswordReset {
+  /**
+   * SendRecordPasswordReset sends a password reset request email to the specified auth record.
+   */
+  (app: CoreApp, authRecord: core.Record): void
+ }
+ interface sendRecordVerification {
+  /**
+   * SendRecordVerification sends a verification request email to the specified auth record.
+   */
+  (app: CoreApp, authRecord: core.Record): void
+ }
+ interface sendRecordChangeEmail {
+  /**
+   * SendRecordChangeEmail sends a change email confirmation email to the specified auth record.
+   */
+  (app: CoreApp, authRecord: core.Record, newEmail: string): void
+ }
+}
+
+namespace forms {
+ // @ts-ignore
+ import validation = ozzo_validation
+ /**
+  * AppleClientSecretCreate is a form struct to generate a new Apple Client Secret.
+  * 
+  * Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
+  */
+ interface AppleClientSecretCreate {
+  /**
+   * ClientId is the identifier of your app (aka. Service ID).
+   */
+  clientId: string
+  /**
+   * TeamId is a 10-character string associated with your developer account
+   * (usually could be found next to your name in the Apple Developer site).
+   */
+  teamId: string
+  /**
+   * KeyId is a 10-character key identifier generated for the "Sign in with Apple"
+   * private key associated with your developer account.
+   */
+  keyId: string
+  /**
+   * PrivateKey is the private key associated to your app.
+   * Usually wrapped within -----BEGIN PRIVATE KEY----- X -----END PRIVATE KEY-----.
+   */
+  privateKey: string
+  /**
+   * Duration specifies how long the generated JWT should be considered valid.
+   * The specified value must be in seconds and max 15777000 (~6months).
+   */
+  duration: number
+ }
+ interface newAppleClientSecretCreate {
+  /**
+   * NewAppleClientSecretCreate creates a new [AppleClientSecretCreate] form with initializer
+   * config created from the provided [CoreApp] instances.
+   */
+  (app: CoreApp): (AppleClientSecretCreate)
+ }
+ interface AppleClientSecretCreate {
+  /**
+   * Validate makes the form validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface AppleClientSecretCreate {
+  /**
+   * Submit validates the form and returns a new Apple Client Secret JWT.
+   */
+  submit(): string
+ }
+ interface RecordUpsert {
+ }
+ interface newRecordUpsert {
+  /**
+   * NewRecordUpsert creates a new [RecordUpsert] form from the provided [CoreApp] and [core.Record] instances
+   * (for create you could pass a pointer to an empty Record - core.NewRecord(collection)).
+   */
+  (app: CoreApp, record: core.Record): (RecordUpsert)
+ }
+ interface RecordUpsert {
+  /**
+   * SetContext assigns ctx as context of the current form.
+   */
+  setContext(ctx: context.Context): void
+ }
+ interface RecordUpsert {
+  /**
+   * SetApp replaces the current form app instance.
+   * 
+   * This could be used for example if you want to change at later stage
+   * before submission to change from regular -> transactional app instance.
+   */
+  setApp(app: CoreApp): void
+ }
+ interface RecordUpsert {
+  /**
+   * SetRecord replaces the current form record instance.
+   */
+  setRecord(record: core.Record): void
+ }
+ interface RecordUpsert {
+  /**
+   * ResetAccess resets the form access level to the accessLevelDefault.
+   */
+  resetAccess(): void
+ }
+ interface RecordUpsert {
+  /**
+   * GrantManagerAccess updates the form access level to "manager" allowing
+   * directly changing some system record fields (often used with auth collection records).
+   */
+  grantManagerAccess(): void
+ }
+ interface RecordUpsert {
+  /**
+   * GrantSuperuserAccess updates the form access level to "superuser" allowing
+   * directly changing all system record fields, including those marked as "Hidden".
+   */
+  grantSuperuserAccess(): void
+ }
+ interface RecordUpsert {
+  /**
+   * HasManageAccess reports whether the form has "manager" or "superuser" level access.
+   */
+  hasManageAccess(): boolean
+ }
+ interface RecordUpsert {
+  /**
+   * Load loads the provided data into the form and the related record.
+   */
+  load(data: _TygojaDict): void
+ }
+ interface RecordUpsert {
+  /**
+   * Deprecated: It was previously used as part of the record create action but it is not needed anymore and will be removed in the future.
+   * 
+   * DrySubmit performs a temp form submit within a transaction and reverts it at the end.
+   * For actual record persistence, check the [RecordUpsert.Submit()] method.
+   * 
+   * This method doesn't perform validations, handle file uploads/deletes or trigger app save events!
+   */
+  drySubmit(callback: (txApp: CoreApp, drySavedRecord: core.Record) => void): void
+ }
+ interface RecordUpsert {
+  /**
+   * Submit validates the form specific validations and attempts to save the form record.
+   */
+  submit(): void
+ }
+ /**
+  * TestEmailSend is a email template test request form.
+  */
+ interface TestEmailSend {
+  email: string
+  template: string
+  collection: string // optional, fallbacks to _superusers
+ }
+ interface newTestEmailSend {
+  /**
+   * NewTestEmailSend creates and initializes new TestEmailSend form.
+   */
+  (app: CoreApp): (TestEmailSend)
+ }
+ interface TestEmailSend {
+  /**
+   * Validate makes the form validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TestEmailSend {
+  /**
+   * Submit validates and sends a test email to the form.Email address.
+   */
+  submit(): void
+ }
+ /**
+  * TestS3Filesystem defines a S3 filesystem connection test.
+  */
+ interface TestS3Filesystem {
+  /**
+   * The name of the filesystem - storage or backups
+   */
+  filesystem: string
+ }
+ interface newTestS3Filesystem {
+  /**
+   * NewTestS3Filesystem creates and initializes new TestS3Filesystem form.
+   */
+  (app: CoreApp): (TestS3Filesystem)
+ }
+ interface TestS3Filesystem {
+  /**
+   * Validate makes the form validatable by implementing [validation.Validatable] interface.
+   */
+  validate(): void
+ }
+ interface TestS3Filesystem {
+  /**
+   * Submit validates and performs a S3 filesystem connection test.
+   */
+  submit(): void
+ }
+}
+
+namespace apis {
+ interface toApiError {
+  /**
+   * ToApiError wraps err into ApiError instance (if not already).
+   */
+  (err: Error): (router.ApiError)
+ }
+ interface newApiError {
+  /**
+   * NewApiError is an alias for [router.NewApiError].
+   */
+  (status: number, message: string, errData: any): (router.ApiError)
+ }
+ interface newBadRequestError {
+  /**
+   * NewBadRequestError is an alias for [router.NewBadRequestError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newNotFoundError {
+  /**
+   * NewNotFoundError is an alias for [router.NewNotFoundError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newForbiddenError {
+  /**
+   * NewForbiddenError is an alias for [router.NewForbiddenError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newUnauthorizedError {
+  /**
+   * NewUnauthorizedError is an alias for [router.NewUnauthorizedError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newTooManyRequestsError {
+  /**
+   * NewTooManyRequestsError is an alias for [router.NewTooManyRequestsError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface newInternalServerError {
+  /**
+   * NewInternalServerError is an alias for [router.NewInternalServerError].
+   */
+  (message: string, errData: any): (router.ApiError)
+ }
+ interface backupFileInfo {
+  modified: types.DateTime
+  key: string
+  size: number
+ }
+ // @ts-ignore
+ import validation = ozzo_validation
+ interface backupCreateForm {
+  name: string
+ }
+ interface backupUploadForm {
+  file?: filesystem.File
+ }
+ interface newRouter {
+  /**
+   * NewRouter returns a new router instance loaded with the default app middlewares and api routes.
+   */
+  (app: CoreApp): (router.Router<core.RequestEvent | undefined>)
+ }
+ interface wrapStdHandler {
+  /**
+   * WrapStdHandler wraps Go [http.Handler] into a PocketBase handler func.
+   */
+  (h: http.Handler): (_arg0: core.RequestEvent) => void
+ }
+ interface wrapStdMiddleware {
+  /**
+   * WrapStdMiddleware wraps Go [func(http.Handler) http.Handle] into a PocketBase middleware func.
+   */
+  (m: (_arg0: http.Handler) => http.Handler): (_arg0: core.RequestEvent) => void
+ }
+ interface mustSubFS {
+  /**
+   * MustSubFS returns an [fs.FS] corresponding to the subtree rooted at fsys's dir.
+   * 
+   * This is similar to [fs.Sub] but panics on failure.
+   */
+  (fsys: fs.FS, dir: string): fs.FS
+ }
+ interface _static {
+  /**
+   * Static is a handler function to serve static directory content from fsys.
+   * 
+   * If a file resource is missing and indexFallback is set, the request
+   * will be forwarded to the base index.html (useful for SPA with pretty urls).
+   * 
+   * NB! Expects the route to have a "{path...}" wildcard parameter.
+   * 
+   * Special redirects:
+   * ```
+   *   - if "path" is a file that ends in index.html, it is redirected to its non-index.html version (eg. /test/index.html -> /test/)
+   *   - if "path" is a directory that has index.html, the index.html file is rendered,
+   *     otherwise if missing - returns 404 or fallback to the root index.html if indexFallback is set
+   * ```
+   * 
+   * Example:
+   * 
+   * ```
+   * 	fsys := os.DirFS("./pb_public")
+   * 	router.GET("/files/{path...}", apis.Static(fsys, false))
+   * ```
+   */
+  (fsys: fs.FS, indexFallback: boolean): (_arg0: core.RequestEvent) => void
+ }
+ interface HandleFunc {(e: core.RequestEvent): void }
+ interface BatchActionHandlerFunc {(app: CoreApp, ir: core.InternalRequest, params: _TygojaDict, next: (data: any) => void): HandleFunc }
+ interface BatchRequestResult {
+  body: any
+  status: number
+ }
+ interface batchRequestsForm {
+  requests: Array<(core.InternalRequest | undefined)>
+ }
+ interface batchProcessor {
+ }
+ interface batchProcessor {
+  process(batch: Array<(core.InternalRequest | undefined)>, timeout: time.Duration): void
+ }
+ interface BatchResponseError {
+ }
+ interface BatchResponseError {
+  error(): string
+ }
+ interface BatchResponseError {
+  code(): string
+ }
+ interface BatchResponseError {
+  resolve(errData: _TygojaDict): any
+ }
+ interface BatchResponseError {
+  marshalJSON(): string|Array<number>
+ }
+ interface collectionsImportForm {
+  collections: Array<_TygojaDict>
+  deleteMissing: boolean
+ }
+ interface fileApi {
+ }
+ interface defaultInstallerFunc {
+  /**
+   * DefaultInstallerFunc is the default PocketBase installer function.
+   * 
+   * It will attempt to open a link in the browser (with a short-lived auth
+   * token for the systemSuperuser) to the installer UI so that users can
+   * create their own custom superuser record.
+   * 
+   * See https://github.com/pocketbase/pocketbase/discussions/5814.
+   */
+  (app: CoreApp, systemSuperuser: core.Record, baseURL: string): void
+ }
+ interface requireGuestOnly {
+  /**
+   * RequireGuestOnly middleware requires a request to NOT have a valid
+   * Authorization header.
+   * 
+   * This middleware is the opposite of [apis.RequireAuth()].
+   */
+  (): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface requireAuth {
+  /**
+   * RequireAuth middleware requires a request to have a valid record Authorization header.
+   * 
+   * The auth record could be from any collection.
+   * You can further filter the allowed record auth collections by specifying their names.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	apis.RequireAuth()                      // any auth collection
+   * 	apis.RequireAuth("_superusers", "users") // only the listed auth collections
+   * ```
+   */
+  (...optCollectionNames: string[]): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface requireSuperuserAuth {
+  /**
+   * RequireSuperuserAuth middleware requires a request to have
+   * a valid superuser Authorization header.
+   */
+  (): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface requireSuperuserOrOwnerAuth {
+  /**
+   * RequireSuperuserOrOwnerAuth middleware requires a request to have
+   * a valid superuser or regular record owner Authorization header set.
+   * 
+   * This middleware is similar to [apis.RequireAuth()] but
+   * for the auth record token expects to have the same id as the path
+   * parameter ownerIdPathParam (default to "id" if empty).
+   */
+  (ownerIdPathParam: string): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface requireSameCollectionContextAuth {
+  /**
+   * RequireSameCollectionContextAuth middleware requires a request to have
+   * a valid record Authorization header and the auth record's collection to
+   * match the one from the route path parameter (default to "collection" if collectionParam is empty).
+   */
+  (collectionPathParam: string): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface skipSuccessActivityLog {
+  /**
+   * SkipSuccessActivityLog is a helper middleware that instructs the global
+   * activity logger to log only requests that have failed/returned an error.
+   */
+  (): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface bodyLimit {
+  /**
+   * BodyLimit returns a middleware handler that changes the default request body size limit.
+   * 
+   * If limitBytes <= 0, no limit is applied.
+   * 
+   * Otherwise, if the request body size exceeds the configured limitBytes,
+   * it sends 413 error response.
+   */
+  (limitBytes: number): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ type _saXJZha = io.ReadCloser
+ interface limitedReader extends _saXJZha {
+ }
+ interface limitedReader {
+  read(b: string|Array<number>): number
+ }
+ interface limitedReader {
+  reread(): void
+ }
+ /**
+  * CORSConfig defines the config for CORS middleware.
+  */
+ interface CORSConfig {
+  /**
+   * AllowOrigins determines the value of the Access-Control-Allow-Origin
+   * response header.  This header defines a list of origins that may access the
+   * resource.  The wildcard characters '*' and '?' are supported and are
+   * converted to regex fragments '.*' and '.' accordingly.
+   * 
+   * Security: use extreme caution when handling the origin, and carefully
+   * validate any logic. Remember that attackers may register hostile domain names.
+   * See https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+   * 
+   * Optional. Default value []string{"*"}.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+   */
+  allowOrigins: Array<string>
+  /**
+   * AllowOriginFunc is a custom function to validate the origin. It takes the
+   * origin as an argument and returns true if allowed or false otherwise. If
+   * an error is returned, it is returned by the handler. If this option is
+   * set, AllowOrigins is ignored.
+   * 
+   * Security: use extreme caution when handling the origin, and carefully
+   * validate any logic. Remember that attackers may register hostile domain names.
+   * See https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+   * 
+   * Optional.
+   */
+  allowOriginFunc: (origin: string) => boolean
+  /**
+   * AllowMethods determines the value of the Access-Control-Allow-Methods
+   * response header.  This header specified the list of methods allowed when
+   * accessing the resource.  This is used in response to a preflight request.
+   * 
+   * Optional. Default value DefaultCORSConfig.AllowMethods.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+   */
+  allowMethods: Array<string>
+  /**
+   * AllowHeaders determines the value of the Access-Control-Allow-Headers
+   * response header.  This header is used in response to a preflight request to
+   * indicate which HTTP headers can be used when making the actual request.
+   * 
+   * Optional. Default value []string{}.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
+   */
+  allowHeaders: Array<string>
+  /**
+   * AllowCredentials determines the value of the
+   * Access-Control-Allow-Credentials response header.  This header indicates
+   * whether or not the response to the request can be exposed when the
+   * credentials mode (Request.credentials) is true. When used as part of a
+   * response to a preflight request, this indicates whether or not the actual
+   * request can be made using credentials.  See also
+   * [MDN: Access-Control-Allow-Credentials].
+   * 
+   * Optional. Default value false, in which case the header is not set.
+   * 
+   * Security: avoid using `AllowCredentials = true` with `AllowOrigins = *`.
+   * See "Exploiting CORS misconfigurations for Bitcoins and bounties",
+   * https://blog.portswigger.net/2016/10/exploiting-cors-misconfigurations-for.html
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
+   */
+  allowCredentials: boolean
+  /**
+   * UnsafeWildcardOriginWithAllowCredentials UNSAFE/INSECURE: allows wildcard '*' origin to be used with AllowCredentials
+   * flag. In that case we consider any origin allowed and send it back to the client with `Access-Control-Allow-Origin` header.
+   * 
+   * This is INSECURE and potentially leads to [cross-origin](https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties)
+   * attacks. See: https://github.com/labstack/echo/issues/2400 for discussion on the subject.
+   * 
+   * Optional. Default value is false.
+   */
+  unsafeWildcardOriginWithAllowCredentials: boolean
+  /**
+   * ExposeHeaders determines the value of Access-Control-Expose-Headers, which
+   * defines a list of headers that clients are allowed to access.
+   * 
+   * Optional. Default value []string{}, in which case the header is not set.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Header
+   */
+  exposeHeaders: Array<string>
+  /**
+   * MaxAge determines the value of the Access-Control-Max-Age response header.
+   * This header indicates how long (in seconds) the results of a preflight
+   * request can be cached.
+   * The header is set only if MaxAge != 0, negative value sends "0" which instructs browsers not to cache that response.
+   * 
+   * Optional. Default value 0 - meaning header is not sent.
+   * 
+   * See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+   */
+  maxAge: number
+ }
+ interface cors {
+  /**
+   * CORS returns a CORS middleware.
+   */
+  (config: CORSConfig): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ /**
+  * GzipConfig defines the config for Gzip middleware.
+  */
+ interface GzipConfig {
+  /**
+   * Gzip compression level.
+   * Optional. Default value -1.
+   */
+  level: number
+  /**
+   * Length threshold before gzip compression is applied.
+   * Optional. Default value 0.
+   * 
+   * Most of the time you will not need to change the default. Compressing
+   * a short response might increase the transmitted data because of the
+   * gzip format overhead. Compressing the response will also consume CPU
+   * and time on the server and the client (for decompressing). Depending on
+   * your use case such a threshold might be useful.
+   * 
+   * See also:
+   * https://webmasters.stackexchange.com/questions/31750/what-is-recommended-minimum-object-size-for-gzip-performance-benefits
+   */
+  minLength: number
+ }
+ interface gzip {
+  /**
+   * Gzip returns a middleware which compresses HTTP response using Gzip compression scheme.
+   */
+  (): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ interface gzipWithConfig {
+  /**
+   * GzipWithConfig returns a middleware which compresses HTTP response using gzip compression scheme.
+   */
+  (config: GzipConfig): (hook.Handler<core.RequestEvent | undefined>)
+ }
+ type _sAhjBUw = http.ResponseWriter&io.Writer
+ interface gzipResponseWriter extends _sAhjBUw {
+ }
+ interface gzipResponseWriter {
+  writeHeader(code: number): void
+ }
+ interface gzipResponseWriter {
+  write(b: string|Array<number>): number
+ }
+ interface gzipResponseWriter {
+  flush(): void
+ }
+ interface gzipResponseWriter {
+  hijack(): [net.Conn, (bufio.ReadWriter)]
+ }
+ interface gzipResponseWriter {
+  push(target: string, opts: http.PushOptions): void
+ }
+ interface gzipResponseWriter {
+  unwrap(): http.ResponseWriter
+ }
+ type _sHbfVnf = sync.RWMutex
+ interface rateLimiter extends _sHbfVnf {
+ }
+ /**
+  * @todo evaluate swiching to a more traditional fixed window or sliding window counter
+  * implementations since some users complained that it is not intuitive (see #7329).
+  * 
+  * rateClient is a mixture of token bucket and fixed window rate limit strategies
+  * that refills the allowance only after at least "interval" seconds
+  * has elapsed since the last request.
+  */
+ type _sxgajMO = sync.Mutex
+ interface rateClient extends _sxgajMO {
+ }
+ interface realtimeSubscribeForm {
+  clientId: string
+  subscriptions: Array<string>
+ }
+ /**
+  * recordData represents the broadcasted record subscrition message data.
+  */
+ interface recordData {
+  record: any //  map or core.Record
+  action: string
+ }
+ interface EmailChangeConfirmForm {
+  token: string
+  password: string
+ }
+ interface emailChangeRequestForm {
+  newEmail: string
+ }
+ interface impersonateForm {
+  /**
+   * Duration is the optional custom token duration in seconds.
+   */
+  duration: number
+ }
+ interface otpResponse {
+  enabled: boolean
+  duration: number // in seconds
+ }
+ interface mfaResponse {
+  enabled: boolean
+  duration: number // in seconds
+ }
+ interface passwordResponse {
+  identityFields: Array<string>
+  enabled: boolean
+ }
+ interface oauth2Response {
+  providers: Array<providerInfo>
+  enabled: boolean
+ }
+ interface providerInfo {
+  name: string
+  displayName: string
+  state: string
+  authURL: string
+  /**
+   * @todo
+   * deprecated: use AuthURL instead
+   * AuthUrl will be removed after dropping v0.22 support
+   */
+  authUrl: string
+  /**
+   * technically could be omitted if the provider doesn't support PKCE,
+   * but to avoid breaking existing typed clients we'll return them as empty string
+   */
+  codeVerifier: string
+  codeChallenge: string
+  codeChallengeMethod: string
+ }
+ interface authMethodsResponse {
+  password: passwordResponse
+  oauth2: oauth2Response
+  mfa: mfaResponse
+  otp: otpResponse
+  /**
+   * legacy fields
+   * @todo remove after dropping v0.22 support
+   */
+  authProviders: Array<providerInfo>
+  usernamePassword: boolean
+  emailPassword: boolean
+ }
+ interface createOTPForm {
+  email: string
+ }
+ interface recordConfirmPasswordResetForm {
+  token: string
+  password: string
+  passwordConfirm: string
+ }
+ interface recordRequestPasswordResetForm {
+  email: string
+ }
+ interface recordConfirmVerificationForm {
+  token: string
+ }
+ interface recordRequestVerificationForm {
+  email: string
+ }
+ interface recordOAuth2LoginForm {
+  /**
+   * Additional data that will be used for creating a new auth record
+   * if an existing OAuth2 account doesn't exist.
+   */
+  createData: _TygojaDict
+  /**
+   * The name of the OAuth2 client provider (eg. "google")
+   */
+  provider: string
+  /**
+   * The authorization code returned from the initial request.
+   */
+  code: string
+  /**
+   * The optional PKCE code verifier as part of the code_challenge sent with the initial request.
+   */
+  codeVerifier: string
+  /**
+   * The redirect url sent with the initial request.
+   */
+  redirectURL: string
+  /**
+   * @todo
+   * deprecated: use RedirectURL instead
+   * RedirectUrl will be removed after dropping v0.22 support
+   */
+  redirectUrl: string
+ }
+ interface oauth2RedirectData {
+  state: string
+  code: string
+  error: string
+  /**
+   * returned by Apple only
+   */
+  appleUser: string
+ }
+ interface authWithOTPForm {
+  otpId: string
+  password: string
+ }
+ interface authWithPasswordForm {
+  identity: string
+  password: string
+  /**
+   * IdentityField specifies the field to use to search for the identity
+   * (leave it empty for "auto" detection).
+   */
+  identityField: string
+ }
+ // @ts-ignore
+ import cryptoRand = rand
+ interface recordAuthResponse {
+  /**
+   * RecordAuthResponse writes standardized json record auth response
+   * into the specified request context.
+   * 
+   * The authMethod argument specify the name of the current authentication method (eg. password, oauth2, etc.)
+   * that it is used primarily as an auth identifier during MFA and for login alerts.
+   * 
+   * Set authMethod to empty string if you want to ignore the MFA checks and the login alerts
+   * (can be also adjusted additionally via the OnRecordAuthRequest hook).
+   */
+  (e: core.RequestEvent, authRecord: core.Record, authMethod: string, meta: any): void
+ }
+ interface enrichRecord {
+  /**
+   * EnrichRecord parses the request context and enrich the provided record:
+   * ```
+   *   - expands relations (if defaultExpands and/or ?expand query param is set)
+   *   - ensures that the emails of the auth record and its expanded auth relations
+   *     are visible only for the current logged superuser, record owner or record with manage access
+   * ```
+   */
+  (e: core.RequestEvent, record: core.Record, ...defaultExpands: string[]): void
+ }
+ interface enrichRecords {
+  /**
+   * EnrichRecords parses the request context and enriches the provided records:
+   * ```
+   *   - expands relations (if defaultExpands and/or ?expand query param is set)
+   *   - ensures that the emails of the auth records and their expanded auth relations
+   *     are visible only for the current logged superuser, record owner or record with manage access
+   * ```
+   * 
+   * Note: Expects all records to be from the same collection!
+   */
+  (e: core.RequestEvent, records: Array<(core.Record | undefined)>, ...defaultExpands: string[]): void
+ }
+ interface iterator<T> {
+ }
+ /**
+  * ServeConfig defines a configuration struct for apis.Serve().
+  */
+ interface ServeConfig {
+  /**
+   * ShowStartBanner indicates whether to show or hide the server start console message.
+   */
+  showStartBanner: boolean
+  /**
+   * HttpAddr is the TCP address to listen for the HTTP server (eg. "127.0.0.1:80").
+   */
+  httpAddr: string
+  /**
+   * HttpsAddr is the TCP address to listen for the HTTPS server (eg. "127.0.0.1:443").
+   */
+  httpsAddr: string
+  /**
+   * Optional domains list to use when issuing the TLS certificate.
+   * 
+   * If not set, the host from the bound server address will be used.
+   * 
+   * For convenience, for each "non-www" domain a "www" entry and
+   * redirect will be automatically added.
+   */
+  certificateDomains: Array<string>
+  /**
+   * AllowedOrigins is an optional list of CORS origins (default to "*").
+   */
+  allowedOrigins: Array<string>
+ }
+ interface serve {
+  /**
+   * Serve starts a new app web server.
+   * 
+   * NB! The app should be bootstrapped before starting the web server.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	app.Bootstrap()
+   * 	apis.Serve(app, apis.ServeConfig{
+   * 		HttpAddr:        "127.0.0.1:8080",
+   * 		ShowStartBanner: false,
+   * 	})
+   * ```
+   */
+  (app: CoreApp, config: ServeConfig): void
+ }
+ interface serverErrorLogWriter {
+ }
+ interface serverErrorLogWriter {
+  write(p: string|Array<number>): number
+ }
+}
+
+namespace pocketbase {
+ /**
+  * PocketBase defines a PocketBase app launcher.
+  * 
+  * It implements [CoreApp] via embedding and all of the app interface methods
+  * could be accessed directly through the instance (eg. PocketBase.DataDir()).
+  */
+ type _sQPGTlT = CoreApp
+ interface PocketBase extends _sQPGTlT {
+  /**
+   * RootCmd is the main console command
+   */
+  rootCmd?: cobra.Command
+ }
+ /**
+  * Config is the PocketBase initialization config struct.
+  */
+ interface Config {
+  /**
+   * hide the default console server info on app startup
+   */
+  hideStartBanner: boolean
+  /**
+   * optional default values for the console flags
+   */
+  defaultDev: boolean
+  defaultDataDir: string // if not set, it will fallback to "./pb_data"
+  defaultEncryptionEnv: string
+  defaultQueryTimeout: time.Duration // default to core.DefaultQueryTimeout (in seconds)
+  /**
+   * optional DB configurations
+   */
+  dataMaxOpenConns: number // default to core.DefaultDataMaxOpenConns
+  dataMaxIdleConns: number // default to core.DefaultDataMaxIdleConns
+  auxMaxOpenConns: number // default to core.DefaultAuxMaxOpenConns
+  auxMaxIdleConns: number // default to core.DefaultAuxMaxIdleConns
+  dbConnect: core.DBConnectFunc // default to core.dbConnect
+ }
+ interface _new {
+  /**
+   * New creates a new PocketBase instance with the default configuration.
+   * Use [NewWithConfig] if you want to provide a custom configuration.
+   * 
+   * Note that the application will not be initialized/bootstrapped yet,
+   * aka. DB connections, migrations, app settings, etc. will not be accessible.
+   * Everything will be initialized when [PocketBase.Start] is executed.
+   * If you want to initialize the application before calling [PocketBase.Start],
+   * then you'll have to manually call [PocketBase.Bootstrap].
+   */
+  (): (PocketBase)
+ }
+ interface newWithConfig {
+  /**
+   * NewWithConfig creates a new PocketBase instance with the provided config.
+   * 
+   * Note that the application will not be initialized/bootstrapped yet,
+   * aka. DB connections, migrations, app settings, etc. will not be accessible.
+   * Everything will be initialized when [PocketBase.Start] is executed.
+   * If you want to initialize the application before calling [PocketBase.Start],
+   * then you'll have to manually call [PocketBase.Bootstrap].
+   */
+  (config: Config): (PocketBase)
+ }
+ interface PocketBase {
+  /**
+   * Start starts the application, aka. registers the default system
+   * commands (serve, superuser, version) and executes pb.RootCmd.
+   */
+  start(): void
+ }
+ interface PocketBase {
+  /**
+   * Execute initializes the application (if not already) and executes
+   * the pb.RootCmd with graceful shutdown support.
+   * 
+   * This method differs from pb.Start() by not registering the default
+   * system commands!
+   */
+  execute(): void
+ }
+ /**
+  * coloredWriter is a small wrapper struct to construct a [color.Color] writter.
+  */
+ interface coloredWriter {
+ }
+ interface coloredWriter {
+  /**
+   * Write writes the p bytes using the colored writer.
+   */
+  write(p: string|Array<number>): number
+ }
+}
+
+/**
+ * Package sync provides basic synchronization primitives such as mutual
+ * exclusion locks. Other than the [Once] and [WaitGroup] types, most are intended
+ * for use by low-level library routines. Higher-level synchronization is
+ * better done via channels and communication.
+ * 
+ * Values containing the types defined in this package should not be copied.
+ */
+namespace sync {
+ // @ts-ignore
+ import isync = sync
+ /**
+  * A Mutex is a mutual exclusion lock.
+  * The zero value for a Mutex is an unlocked mutex.
+  * 
+  * A Mutex must not be copied after first use.
+  * 
+  * In the terminology of [the Go memory model],
+  * the n'th call to [Mutex.Unlock] “synchronizes before” the m'th call to [Mutex.Lock]
+  * for any n < m.
+  * A successful call to [Mutex.TryLock] is equivalent to a call to Lock.
+  * A failed call to TryLock does not establish any “synchronizes before”
+  * relation at all.
+  * 
+  * [the Go memory model]: https://go.dev/ref/mem
+  */
+ interface Mutex {
+ }
+ interface Mutex {
+  /**
+   * Lock locks m.
+   * If the lock is already in use, the calling goroutine
+   * blocks until the mutex is available.
+   */
+  lock(): void
+ }
+ interface Mutex {
+  /**
+   * TryLock tries to lock m and reports whether it succeeded.
+   * 
+   * Note that while correct uses of TryLock do exist, they are rare,
+   * and use of TryLock is often a sign of a deeper problem
+   * in a particular use of mutexes.
+   */
+  tryLock(): boolean
+ }
+ interface Mutex {
+  /**
+   * Unlock unlocks m.
+   * It is a run-time error if m is not locked on entry to Unlock.
+   * 
+   * A locked [Mutex] is not associated with a particular goroutine.
+   * It is allowed for one goroutine to lock a Mutex and then
+   * arrange for another goroutine to unlock it.
+   */
+  unlock(): void
+ }
+ /**
+  * A RWMutex is a reader/writer mutual exclusion lock.
+  * The lock can be held by an arbitrary number of readers or a single writer.
+  * The zero value for a RWMutex is an unlocked mutex.
+  * 
+  * A RWMutex must not be copied after first use.
+  * 
+  * If any goroutine calls [RWMutex.Lock] while the lock is already held by
+  * one or more readers, concurrent calls to [RWMutex.RLock] will block until
+  * the writer has acquired (and released) the lock, to ensure that
+  * the lock eventually becomes available to the writer.
+  * Note that this prohibits recursive read-locking.
+  * A [RWMutex.RLock] cannot be upgraded into a [RWMutex.Lock],
+  * nor can a [RWMutex.Lock] be downgraded into a [RWMutex.RLock].
+  * 
+  * In the terminology of [the Go memory model],
+  * the n'th call to [RWMutex.Unlock] “synchronizes before” the m'th call to Lock
+  * for any n < m, just as for [Mutex].
+  * For any call to RLock, there exists an n such that
+  * the n'th call to Unlock “synchronizes before” that call to RLock,
+  * and the corresponding call to [RWMutex.RUnlock] “synchronizes before”
+  * the n+1'th call to Lock.
+  * 
+  * [the Go memory model]: https://go.dev/ref/mem
+  */
+ interface RWMutex {
+ }
+ interface RWMutex {
+  /**
+   * RLock locks rw for reading.
+   * 
+   * It should not be used for recursive read locking; a blocked Lock
+   * call excludes new readers from acquiring the lock. See the
+   * documentation on the [RWMutex] type.
+   */
+  rLock(): void
+ }
+ interface RWMutex {
+  /**
+   * TryRLock tries to lock rw for reading and reports whether it succeeded.
+   * 
+   * Note that while correct uses of TryRLock do exist, they are rare,
+   * and use of TryRLock is often a sign of a deeper problem
+   * in a particular use of mutexes.
+   */
+  tryRLock(): boolean
+ }
+ interface RWMutex {
+  /**
+   * RUnlock undoes a single [RWMutex.RLock] call;
+   * it does not affect other simultaneous readers.
+   * It is a run-time error if rw is not locked for reading
+   * on entry to RUnlock.
+   */
+  rUnlock(): void
+ }
+ interface RWMutex {
+  /**
+   * Lock locks rw for writing.
+   * If the lock is already locked for reading or writing,
+   * Lock blocks until the lock is available.
+   */
+  lock(): void
+ }
+ interface RWMutex {
+  /**
+   * TryLock tries to lock rw for writing and reports whether it succeeded.
+   * 
+   * Note that while correct uses of TryLock do exist, they are rare,
+   * and use of TryLock is often a sign of a deeper problem
+   * in a particular use of mutexes.
+   */
+  tryLock(): boolean
+ }
+ interface RWMutex {
+  /**
+   * Unlock unlocks rw for writing. It is a run-time error if rw is
+   * not locked for writing on entry to Unlock.
+   * 
+   * As with Mutexes, a locked [RWMutex] is not associated with a particular
+   * goroutine. One goroutine may [RWMutex.RLock] ([RWMutex.Lock]) a RWMutex and then
+   * arrange for another goroutine to [RWMutex.RUnlock] ([RWMutex.Unlock]) it.
+   */
+  unlock(): void
+ }
+ interface RWMutex {
+  /**
+   * RLocker returns a [Locker] interface that implements
+   * the [Locker.Lock] and [Locker.Unlock] methods by calling rw.RLock and rw.RUnlock.
+   */
+  rLocker(): Locker
+ }
+}
+
+/**
+ * Package syscall contains an interface to the low-level operating system
+ * primitives. The details vary depending on the underlying system, and
+ * by default, godoc will display the syscall documentation for the current
+ * system. If you want godoc to display syscall documentation for another
+ * system, set $GOOS and $GOARCH to the desired system. For example, if
+ * you want to view documentation for freebsd/arm on linux/amd64, set $GOOS
+ * to freebsd and $GOARCH to arm.
+ * The primary use of syscall is inside other packages that provide a more
+ * portable interface to the system, such as "os", "time" and "net".  Use
+ * those packages rather than this one if you can.
+ * For details of the functions and data types in this package consult
+ * the manuals for the appropriate operating system.
+ * These calls return err == nil to indicate success; otherwise
+ * err is an operating system error describing the failure.
+ * On most systems, that error has type [Errno].
+ * 
+ * NOTE: Most of the functions, types, and constants defined in
+ * this package are also available in the [golang.org/x/sys] package.
+ * That package has more system call support than this one,
+ * and most new code should prefer that package where possible.
+ * See https://golang.org/s/go1.4-syscall for more information.
+ */
+namespace syscall {
+ // @ts-ignore
+ import errpkg = errors
+ interface SysProcAttr {
+  chroot: string // Chroot.
+  credential?: Credential // Credential.
+  /**
+   * Ptrace tells the child to call ptrace(PTRACE_TRACEME).
+   * Call runtime.LockOSThread before starting a process with this set,
+   * and don't call UnlockOSThread until done with PtraceSyscall calls.
+   */
+  ptrace: boolean
+  setsid: boolean // Create session.
+  /**
+   * Setpgid sets the process group ID of the child to Pgid,
+   * or, if Pgid == 0, to the new child's process ID.
+   */
+  setpgid: boolean
+  /**
+   * Setctty sets the controlling terminal of the child to
+   * file descriptor Ctty. Ctty must be a descriptor number
+   * in the child process: an index into ProcAttr.Files.
+   * This is only meaningful if Setsid is true.
+   */
+  setctty: boolean
+  noctty: boolean // Detach fd 0 from controlling terminal.
+  ctty: number // Controlling TTY fd.
+  /**
+   * Foreground places the child process group in the foreground.
+   * This implies Setpgid. The Ctty field must be set to
+   * the descriptor of the controlling TTY.
+   * Unlike Setctty, in this case Ctty must be a descriptor
+   * number in the parent process.
+   */
+  foreground: boolean
+  pgid: number // Child's process group ID if Setpgid.
+  /**
+   * Pdeathsig, if non-zero, is a signal that the kernel will send to
+   * the child process when the creating thread dies. Note that the signal
+   * is sent on thread termination, which may happen before process termination.
+   * There are more details at https://go.dev/issue/27505.
+   */
+  pdeathsig: Signal
+  cloneflags: number // Flags for clone calls.
+  unshareflags: number // Flags for unshare calls.
+  uidMappings: Array<SysProcIDMap> // User ID mappings for user namespaces.
+  gidMappings: Array<SysProcIDMap> // Group ID mappings for user namespaces.
+  /**
+   * GidMappingsEnableSetgroups enabling setgroups syscall.
+   * If false, then setgroups syscall will be disabled for the child process.
+   * This parameter is no-op if GidMappings == nil. Otherwise for unprivileged
+   * users this should be set to false for mappings work.
+   */
+  gidMappingsEnableSetgroups: boolean
+  ambientCaps: Array<number> // Ambient capabilities.
+  useCgroupFD: boolean // Whether to make use of the CgroupFD field.
+  cgroupFD: number // File descriptor of a cgroup to put the new process into.
+  /**
+   * PidFD, if not nil, is used to store the pidfd of a child, if the
+   * functionality is supported by the kernel, or -1. Note *PidFD is
+   * changed only if the process starts successfully.
+   */
+  pidFD?: number
+ }
+ // @ts-ignore
+ import errorspkg = errors
+ /**
+  * A RawConn is a raw network connection.
+  */
+ interface RawConn {
+  [key:string]: any;
+  /**
+   * Control invokes f on the underlying connection's file
+   * descriptor or handle.
+   * The file descriptor fd is guaranteed to remain valid while
+   * f executes but not after f returns.
+   */
+  control(f: (fd: number) => void): void
+  /**
+   * Read invokes f on the underlying connection's file
+   * descriptor or handle; f is expected to try to read from the
+   * file descriptor.
+   * If f returns true, Read returns. Otherwise Read blocks
+   * waiting for the connection to be ready for reading and
+   * tries again repeatedly.
+   * The file descriptor is guaranteed to remain valid while f
+   * executes but not after f returns.
+   */
+  read(f: (fd: number) => boolean): void
+  /**
+   * Write is like Read but for writing.
+   */
+  write(f: (fd: number) => boolean): void
+ }
+ // @ts-ignore
+ import runtimesyscall = syscall
+ /**
+  * An Errno is an unsigned number describing an error condition.
+  * It implements the error interface. The zero Errno is by convention
+  * a non-error, so code to convert from Errno to error should use:
+  * 
+  * ```
+  * 	err = nil
+  * 	if errno != 0 {
+  * 		err = errno
+  * 	}
+  * ```
+  * 
+  * Errno values can be tested against error values using [errors.Is].
+  * For example:
+  * 
+  * ```
+  * 	_, _, err := syscall.Syscall(...)
+  * 	if errors.Is(err, fs.ErrNotExist) ...
+  * ```
+  */
+ interface Errno extends Number{}
+ interface Errno {
+  error(): string
+ }
+ interface Errno {
+  is(target: Error): boolean
+ }
+ interface Errno {
+  temporary(): boolean
+ }
+ interface Errno {
+  timeout(): boolean
+ }
+}
+
+/**
+ * Package time provides functionality for measuring and displaying time.
+ * 
+ * The calendrical calculations always assume a Gregorian calendar, with
+ * no leap seconds.
+ * 
+ * # Monotonic Clocks
+ * 
+ * Operating systems provide both a “wall clock,” which is subject to
+ * changes for clock synchronization, and a “monotonic clock,” which is
+ * not. The general rule is that the wall clock is for telling time and
+ * the monotonic clock is for measuring time. Rather than split the API,
+ * in this package the Time returned by [time.Now] contains both a wall
+ * clock reading and a monotonic clock reading; later time-telling
+ * operations use the wall clock reading, but later time-measuring
+ * operations, specifically comparisons and subtractions, use the
+ * monotonic clock reading.
+ * 
+ * For example, this code always computes a positive elapsed time of
+ * approximately 20 milliseconds, even if the wall clock is changed during
+ * the operation being timed:
+ * 
+ * ```
+ * 	start := time.Now()
+ * 	... operation that takes 20 milliseconds ...
+ * 	t := time.Now()
+ * 	elapsed := t.Sub(start)
+ * ```
+ * 
+ * Other idioms, such as [time.Since](start), [time.Until](deadline), and
+ * time.Now().Before(deadline), are similarly robust against wall clock
+ * resets.
+ * 
+ * The rest of this section gives the precise details of how operations
+ * use monotonic clocks, but understanding those details is not required
+ * to use this package.
+ * 
+ * The Time returned by time.Now contains a monotonic clock reading.
+ * If Time t has a monotonic clock reading, t.Add adds the same duration to
+ * both the wall clock and monotonic clock readings to compute the result.
+ * Because t.AddDate(y, m, d), t.Round(d), and t.Truncate(d) are wall time
+ * computations, they always strip any monotonic clock reading from their results.
+ * Because t.In, t.Local, and t.UTC are used for their effect on the interpretation
+ * of the wall time, they also strip any monotonic clock reading from their results.
+ * The canonical way to strip a monotonic clock reading is to use t = t.Round(0).
+ * 
+ * If Times t and u both contain monotonic clock readings, the operations
+ * t.After(u), t.Before(u), t.Equal(u), t.Compare(u), and t.Sub(u) are carried out
+ * using the monotonic clock readings alone, ignoring the wall clock
+ * readings. If either t or u contains no monotonic clock reading, these
+ * operations fall back to using the wall clock readings.
+ * 
+ * On some systems the monotonic clock will stop if the computer goes to sleep.
+ * On such a system, t.Sub(u) may not accurately reflect the actual
+ * time that passed between t and u. The same applies to other functions and
+ * methods that subtract times, such as [Since], [Until], [Time.Before], [Time.After],
+ * [Time.Add], [Time.Equal] and [Time.Compare]. In some cases, you may need to strip
+ * the monotonic clock to get accurate results.
+ * 
+ * Because the monotonic clock reading has no meaning outside
+ * the current process, the serialized forms generated by t.GobEncode,
+ * t.MarshalBinary, t.MarshalJSON, and t.MarshalText omit the monotonic
+ * clock reading, and t.Format provides no format for it. Similarly, the
+ * constructors [time.Date], [time.Parse], [time.ParseInLocation], and [time.Unix],
+ * as well as the unmarshalers t.GobDecode, t.UnmarshalBinary.
+ * t.UnmarshalJSON, and t.UnmarshalText always create times with
+ * no monotonic clock reading.
+ * 
+ * The monotonic clock reading exists only in [Time] values. It is not
+ * a part of [Duration] values or the Unix times returned by t.Unix and
+ * friends.
+ * 
+ * Note that the Go == operator compares not just the time instant but
+ * also the [Location] and the monotonic clock reading. See the
+ * documentation for the Time type for a discussion of equality
+ * testing for Time values.
+ * 
+ * For debugging, the result of t.String does include the monotonic
+ * clock reading if present. If t != u because of different monotonic clock readings,
+ * that difference will be visible when printing t.String() and u.String().
+ * 
+ * # Timer Resolution
+ * 
+ * [Timer] resolution varies depending on the Go runtime, the operating system
+ * and the underlying hardware.
+ * On Unix, the resolution is ~1ms.
+ * On Windows version 1803 and newer, the resolution is ~0.5ms.
+ * On older Windows versions, the default resolution is ~16ms, but
+ * a higher resolution may be requested using [golang.org/x/sys/windows.TimeBeginPeriod].
+ */
+namespace time {
+ interface Time {
+  /**
+   * String returns the time formatted using the format string
+   * 
+   * ```
+   * 	"2006-01-02 15:04:05.999999999 -0700 MST"
+   * ```
+   * 
+   * If the time has a monotonic clock reading, the returned string
+   * includes a final field "m=±<value>", where value is the monotonic
+   * clock reading formatted as a decimal number of seconds.
+   * 
+   * The returned string is meant for debugging; for a stable serialized
+   * representation, use t.MarshalText, t.MarshalBinary, or t.Format
+   * with an explicit format string.
+   */
+  string(): string
+ }
+ interface Time {
+  /**
+   * GoString implements [fmt.GoStringer] and formats t to be printed in Go source
+   * code.
+   */
+  goString(): string
+ }
+ interface Time {
+  /**
+   * Format returns a textual representation of the time value formatted according
+   * to the layout defined by the argument. See the documentation for the
+   * constant called [Layout] to see how to represent the layout format.
+   * 
+   * The executable example for [Time.Format] demonstrates the working
+   * of the layout string in detail and is a good reference.
+   */
+  format(layout: string): string
+ }
+ interface Time {
+  /**
+   * AppendFormat is like [Time.Format] but appends the textual
+   * representation to b and returns the extended buffer.
+   */
+  appendFormat(b: string|Array<number>, layout: string): string|Array<number>
+ }
+ /**
+  * A Time represents an instant in time with nanosecond precision.
+  * 
+  * Programs using times should typically store and pass them as values,
+  * not pointers. That is, time variables and struct fields should be of
+  * type [time.Time], not *time.Time.
+  * 
+  * A Time value can be used by multiple goroutines simultaneously except
+  * that the methods [Time.GobDecode], [Time.UnmarshalBinary], [Time.UnmarshalJSON] and
+  * [Time.UnmarshalText] are not concurrency-safe.
+  * 
+  * Time instants can be compared using the [Time.Before], [Time.After], and [Time.Equal] methods.
+  * The [Time.Sub] method subtracts two instants, producing a [Duration].
+  * The [Time.Add] method adds a Time and a Duration, producing a Time.
+  * 
+  * The zero value of type Time is January 1, year 1, 00:00:00.000000000 UTC.
+  * As this time is unlikely to come up in practice, the [Time.IsZero] method gives
+  * a simple way of detecting a time that has not been initialized explicitly.
+  * 
+  * Each time has an associated [Location]. The methods [Time.Local], [Time.UTC], and Time.In return a
+  * Time with a specific Location. Changing the Location of a Time value with
+  * these methods does not change the actual instant it represents, only the time
+  * zone in which to interpret it.
+  * 
+  * Representations of a Time value saved by the [Time.GobEncode], [Time.MarshalBinary], [Time.AppendBinary],
+  * [Time.MarshalJSON], [Time.MarshalText] and [Time.AppendText] methods store the [Time.Location]'s offset,
+  * but not the location name. They therefore lose information about Daylight Saving Time.
+  * 
+  * In addition to the required “wall clock” reading, a Time may contain an optional
+  * reading of the current process's monotonic clock, to provide additional precision
+  * for comparison or subtraction.
+  * See the “Monotonic Clocks” section in the package documentation for details.
+  * 
+  * Note that the Go == operator compares not just the time instant but also the
+  * Location and the monotonic clock reading. Therefore, Time values should not
+  * be used as map or database keys without first guaranteeing that the
+  * identical Location has been set for all values, which can be achieved
+  * through use of the UTC or Local method, and that the monotonic clock reading
+  * has been stripped by setting t = t.Round(0). In general, prefer t.Equal(u)
+  * to t == u, since t.Equal uses the most accurate comparison available and
+  * correctly handles the case when only one of its arguments has a monotonic
+  * clock reading.
+  */
+ interface Time {
+ }
+ interface Time {
+  /**
+   * IsZero reports whether t represents the zero time instant,
+   * January 1, year 1, 00:00:00 UTC.
+   */
+  isZero(): boolean
+ }
+ interface Time {
+  /**
+   * After reports whether the time instant t is after u.
+   */
+  after(u: Time): boolean
+ }
+ interface Time {
+  /**
+   * Before reports whether the time instant t is before u.
+   */
+  before(u: Time): boolean
+ }
+ interface Time {
+  /**
+   * Compare compares the time instant t with u. If t is before u, it returns -1;
+   * if t is after u, it returns +1; if they're the same, it returns 0.
+   */
+  compare(u: Time): number
+ }
+ interface Time {
+  /**
+   * Equal reports whether t and u represent the same time instant.
+   * Two times can be equal even if they are in different locations.
+   * For example, 6:00 +0200 and 4:00 UTC are Equal.
+   * See the documentation on the Time type for the pitfalls of using == with
+   * Time values; most code should use Equal instead.
+   */
+  equal(u: Time): boolean
+ }
+ interface Time {
+  /**
+   * Date returns the year, month, and day in which t occurs.
+   */
+  date(): [number, Month, number]
+ }
+ interface Time {
+  /**
+   * Year returns the year in which t occurs.
+   */
+  year(): number
+ }
+ interface Time {
+  /**
+   * Month returns the month of the year specified by t.
+   */
+  month(): Month
+ }
+ interface Time {
+  /**
+   * Day returns the day of the month specified by t.
+   */
+  day(): number
+ }
+ interface Time {
+  /**
+   * Weekday returns the day of the week specified by t.
+   */
+  weekday(): Weekday
+ }
+ interface Time {
+  /**
+   * ISOWeek returns the ISO 8601 year and week number in which t occurs.
+   * Week ranges from 1 to 53. Jan 01 to Jan 03 of year n might belong to
+   * week 52 or 53 of year n-1, and Dec 29 to Dec 31 might belong to week 1
+   * of year n+1.
+   */
+  isoWeek(): [number, number]
+ }
+ interface Time {
+  /**
+   * Clock returns the hour, minute, and second within the day specified by t.
+   */
+  clock(): [number, number, number]
+ }
+ interface Time {
+  /**
+   * Hour returns the hour within the day specified by t, in the range [0, 23].
+   */
+  hour(): number
+ }
+ interface Time {
+  /**
+   * Minute returns the minute offset within the hour specified by t, in the range [0, 59].
+   */
+  minute(): number
+ }
+ interface Time {
+  /**
+   * Second returns the second offset within the minute specified by t, in the range [0, 59].
+   */
+  second(): number
+ }
+ interface Time {
+  /**
+   * Nanosecond returns the nanosecond offset within the second specified by t,
+   * in the range [0, 999999999].
+   */
+  nanosecond(): number
+ }
+ interface Time {
+  /**
+   * YearDay returns the day of the year specified by t, in the range [1,365] for non-leap years,
+   * and [1,366] in leap years.
+   */
+  yearDay(): number
+ }
+ /**
+  * A Duration represents the elapsed time between two instants
+  * as an int64 nanosecond count. The representation limits the
+  * largest representable duration to approximately 290 years.
+  */
+ interface Duration extends Number{}
+ interface Duration {
+  /**
+   * String returns a string representing the duration in the form "72h3m0.5s".
+   * Leading zero units are omitted. As a special case, durations less than one
+   * second format use a smaller unit (milli-, micro-, or nanoseconds) to ensure
+   * that the leading digit is non-zero. The zero duration formats as 0s.
+   */
+  string(): string
+ }
+ interface Duration {
+  /**
+   * Nanoseconds returns the duration as an integer nanosecond count.
+   */
+  nanoseconds(): number
+ }
+ interface Duration {
+  /**
+   * Microseconds returns the duration as an integer microsecond count.
+   */
+  microseconds(): number
+ }
+ interface Duration {
+  /**
+   * Milliseconds returns the duration as an integer millisecond count.
+   */
+  milliseconds(): number
+ }
+ interface Duration {
+  /**
+   * Seconds returns the duration as a floating point number of seconds.
+   */
+  seconds(): number
+ }
+ interface Duration {
+  /**
+   * Minutes returns the duration as a floating point number of minutes.
+   */
+  minutes(): number
+ }
+ interface Duration {
+  /**
+   * Hours returns the duration as a floating point number of hours.
+   */
+  hours(): number
+ }
+ interface Duration {
+  /**
+   * Truncate returns the result of rounding d toward zero to a multiple of m.
+   * If m <= 0, Truncate returns d unchanged.
+   */
+  truncate(m: Duration): Duration
+ }
+ interface Duration {
+  /**
+   * Round returns the result of rounding d to the nearest multiple of m.
+   * The rounding behavior for halfway values is to round away from zero.
+   * If the result exceeds the maximum (or minimum)
+   * value that can be stored in a [Duration],
+   * Round returns the maximum (or minimum) duration.
+   * If m <= 0, Round returns d unchanged.
+   */
+  round(m: Duration): Duration
+ }
+ interface Duration {
+  /**
+   * Abs returns the absolute value of d.
+   * As a special case, Duration([math.MinInt64]) is converted to Duration([math.MaxInt64]),
+   * reducing its magnitude by 1 nanosecond.
+   */
+  abs(): Duration
+ }
+ interface Time {
+  /**
+   * Add returns the time t+d.
+   */
+  add(d: Duration): Time
+ }
+ interface Time {
+  /**
+   * Sub returns the duration t-u. If the result exceeds the maximum (or minimum)
+   * value that can be stored in a [Duration], the maximum (or minimum) duration
+   * will be returned.
+   * To compute t-d for a duration d, use t.Add(-d).
+   */
+  sub(u: Time): Duration
+ }
+ interface Time {
+  /**
+   * AddDate returns the time corresponding to adding the
+   * given number of years, months, and days to t.
+   * For example, AddDate(-1, 2, 3) applied to January 1, 2011
+   * returns March 4, 2010.
+   * 
+   * Note that dates are fundamentally coupled to timezones, and calendrical
+   * periods like days don't have fixed durations. AddDate uses the Location of
+   * the Time value to determine these durations. That means that the same
+   * AddDate arguments can produce a different shift in absolute time depending on
+   * the base Time value and its Location. For example, AddDate(0, 0, 1) applied
+   * to 12:00 on March 27 always returns 12:00 on March 28. At some locations and
+   * in some years this is a 24 hour shift. In others it's a 23 hour shift due to
+   * daylight savings time transitions.
+   * 
+   * AddDate normalizes its result in the same way that Date does,
+   * so, for example, adding one month to October 31 yields
+   * December 1, the normalized form for November 31.
+   */
+  addDate(years: number, months: number, days: number): Time
+ }
+ interface Time {
+  /**
+   * UTC returns t with the location set to UTC.
+   */
+  utc(): Time
+ }
+ interface Time {
+  /**
+   * Local returns t with the location set to local time.
+   */
+  local(): Time
+ }
+ interface Time {
+  /**
+   * In returns a copy of t representing the same time instant, but
+   * with the copy's location information set to loc for display
+   * purposes.
+   * 
+   * In panics if loc is nil.
+   */
+  in(loc: Location): Time
+ }
+ interface Time {
+  /**
+   * Location returns the time zone information associated with t.
+   */
+  location(): (Location)
+ }
+ interface Time {
+  /**
+   * Zone computes the time zone in effect at time t, returning the abbreviated
+   * name of the zone (such as "CET") and its offset in seconds east of UTC.
+   */
+  zone(): [string, number]
+ }
+ interface Time {
+  /**
+   * ZoneBounds returns the bounds of the time zone in effect at time t.
+   * The zone begins at start and the next zone begins at end.
+   * If the zone begins at the beginning of time, start will be returned as a zero Time.
+   * If the zone goes on forever, end will be returned as a zero Time.
+   * The Location of the returned times will be the same as t.
+   */
+  zoneBounds(): [Time, Time]
+ }
+ interface Time {
+  /**
+   * Unix returns t as a Unix time, the number of seconds elapsed
+   * since January 1, 1970 UTC. The result does not depend on the
+   * location associated with t.
+   * Unix-like operating systems often record time as a 32-bit
+   * count of seconds, but since the method here returns a 64-bit
+   * value it is valid for billions of years into the past or future.
+   */
+  unix(): number
+ }
+ interface Time {
+  /**
+   * UnixMilli returns t as a Unix time, the number of milliseconds elapsed since
+   * January 1, 1970 UTC. The result is undefined if the Unix time in
+   * milliseconds cannot be represented by an int64 (a date more than 292 million
+   * years before or after 1970). The result does not depend on the
+   * location associated with t.
+   */
+  unixMilli(): number
+ }
+ interface Time {
+  /**
+   * UnixMicro returns t as a Unix time, the number of microseconds elapsed since
+   * January 1, 1970 UTC. The result is undefined if the Unix time in
+   * microseconds cannot be represented by an int64 (a date before year -290307 or
+   * after year 294246). The result does not depend on the location associated
+   * with t.
+   */
+  unixMicro(): number
+ }
+ interface Time {
+  /**
+   * UnixNano returns t as a Unix time, the number of nanoseconds elapsed
+   * since January 1, 1970 UTC. The result is undefined if the Unix time
+   * in nanoseconds cannot be represented by an int64 (a date before the year
+   * 1678 or after 2262). Note that this means the result of calling UnixNano
+   * on the zero Time is undefined. The result does not depend on the
+   * location associated with t.
+   */
+  unixNano(): number
+ }
+ interface Time {
+  /**
+   * AppendBinary implements the [encoding.BinaryAppender] interface.
+   */
+  appendBinary(b: string|Array<number>): string|Array<number>
+ }
+ interface Time {
+  /**
+   * MarshalBinary implements the [encoding.BinaryMarshaler] interface.
+   */
+  marshalBinary(): string|Array<number>
+ }
+ interface Time {
+  /**
+   * UnmarshalBinary implements the [encoding.BinaryUnmarshaler] interface.
+   */
+  unmarshalBinary(data: string|Array<number>): void
+ }
+ interface Time {
+  /**
+   * GobEncode implements the gob.GobEncoder interface.
+   */
+  gobEncode(): string|Array<number>
+ }
+ interface Time {
+  /**
+   * GobDecode implements the gob.GobDecoder interface.
+   */
+  gobDecode(data: string|Array<number>): void
+ }
+ interface Time {
+  /**
+   * MarshalJSON implements the [encoding/json.Marshaler] interface.
+   * The time is a quoted string in the RFC 3339 format with sub-second precision.
+   * If the timestamp cannot be represented as valid RFC 3339
+   * (e.g., the year is out of range), then an error is reported.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface Time {
+  /**
+   * UnmarshalJSON implements the [encoding/json.Unmarshaler] interface.
+   * The time must be a quoted string in the RFC 3339 format.
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface Time {
+  /**
+   * AppendText implements the [encoding.TextAppender] interface.
+   * The time is formatted in RFC 3339 format with sub-second precision.
+   * If the timestamp cannot be represented as valid RFC 3339
+   * (e.g., the year is out of range), then an error is returned.
+   */
+  appendText(b: string|Array<number>): string|Array<number>
+ }
+ interface Time {
+  /**
+   * MarshalText implements the [encoding.TextMarshaler] interface. The output
+   * matches that of calling the [Time.AppendText] method.
+   * 
+   * See [Time.AppendText] for more information.
+   */
+  marshalText(): string|Array<number>
+ }
+ interface Time {
+  /**
+   * UnmarshalText implements the [encoding.TextUnmarshaler] interface.
+   * The time must be in the RFC 3339 format.
+   */
+  unmarshalText(data: string|Array<number>): void
+ }
+ interface Time {
+  /**
+   * IsDST reports whether the time in the configured location is in Daylight Savings Time.
+   */
+  isDST(): boolean
+ }
+ interface Time {
+  /**
+   * Truncate returns the result of rounding t down to a multiple of d (since the zero time).
+   * If d <= 0, Truncate returns t stripped of any monotonic clock reading but otherwise unchanged.
+   * 
+   * Truncate operates on the time as an absolute duration since the
+   * zero time; it does not operate on the presentation form of the
+   * time. Thus, Truncate(Hour) may return a time with a non-zero
+   * minute, depending on the time's Location.
+   */
+  truncate(d: Duration): Time
+ }
+ interface Time {
+  /**
+   * Round returns the result of rounding t to the nearest multiple of d (since the zero time).
+   * The rounding behavior for halfway values is to round up.
+   * If d <= 0, Round returns t stripped of any monotonic clock reading but otherwise unchanged.
+   * 
+   * Round operates on the time as an absolute duration since the
+   * zero time; it does not operate on the presentation form of the
+   * time. Thus, Round(Hour) may return a time with a non-zero
+   * minute, depending on the time's Location.
+   */
+  round(d: Duration): Time
+ }
+}
+
+/**
+ * Package context defines the Context type, which carries deadlines,
+ * cancellation signals, and other request-scoped values across API boundaries
+ * and between processes.
+ * 
+ * Incoming requests to a server should create a [Context], and outgoing
+ * calls to servers should accept a Context. The chain of function
+ * calls between them must propagate the Context, optionally replacing
+ * it with a derived Context created using [WithCancel], [WithDeadline],
+ * [WithTimeout], or [WithValue].
+ * 
+ * A Context may be canceled to indicate that work done on its behalf should stop.
+ * A Context with a deadline is canceled after the deadline passes.
+ * When a Context is canceled, all Contexts derived from it are also canceled.
+ * 
+ * The [WithCancel], [WithDeadline], and [WithTimeout] functions take a
+ * Context (the parent) and return a derived Context (the child) and a
+ * [CancelFunc]. Calling the CancelFunc directly cancels the child and its
+ * children, removes the parent's reference to the child, and stops
+ * any associated timers. Failing to call the CancelFunc leaks the
+ * child and its children until the parent is canceled. The go vet tool
+ * checks that CancelFuncs are used on all control-flow paths.
+ * 
+ * The [WithCancelCause], [WithDeadlineCause], and [WithTimeoutCause] functions
+ * return a [CancelCauseFunc], which takes an error and records it as
+ * the cancellation cause. Calling [Cause] on the canceled context
+ * or any of its children retrieves the cause. If no cause is specified,
+ * Cause(ctx) returns the same value as ctx.Err().
+ * 
+ * Programs that use Contexts should follow these rules to keep interfaces
+ * consistent across packages and enable static analysis tools to check context
+ * propagation:
+ * 
+ * Do not store Contexts inside a struct type; instead, pass a Context
+ * explicitly to each function that needs it. This is discussed further in
+ * https://go.dev/blog/context-and-structs. The Context should be the first
+ * parameter, typically named ctx:
+ * 
+ * ```
+ * 	func DoSomething(ctx context.Context, arg Arg) error {
+ * 		// ... use ctx ...
+ * 	}
+ * ```
+ * 
+ * Do not pass a nil [Context], even if a function permits it. Pass [context.TODO]
+ * if you are unsure about which Context to use.
+ * 
+ * Use context Values only for request-scoped data that transits processes and
+ * APIs, not for passing optional parameters to functions.
+ * 
+ * The same Context may be passed to functions running in different goroutines;
+ * Contexts are safe for simultaneous use by multiple goroutines.
+ * 
+ * See https://go.dev/blog/context for example code for a server that uses
+ * Contexts.
+ */
+namespace context {
+ /**
+  * A Context carries a deadline, a cancellation signal, and other values across
+  * API boundaries.
+  * 
+  * Context's methods may be called by multiple goroutines simultaneously.
+  */
+ interface Context {
+  [key:string]: any;
+  /**
+   * Deadline returns the time when work done on behalf of this context
+   * should be canceled. Deadline returns ok==false when no deadline is
+   * set. Successive calls to Deadline return the same results.
+   */
+  deadline(): [time.Time, boolean]
+  /**
+   * Done returns a channel that's closed when work done on behalf of this
+   * context should be canceled. Done may return nil if this context can
+   * never be canceled. Successive calls to Done return the same value.
+   * The close of the Done channel may happen asynchronously,
+   * after the cancel function returns.
+   * 
+   * WithCancel arranges for Done to be closed when cancel is called;
+   * WithDeadline arranges for Done to be closed when the deadline
+   * expires; WithTimeout arranges for Done to be closed when the timeout
+   * elapses.
+   * 
+   * Done is provided for use in select statements:
+   * 
+   *  // Stream generates values with DoSomething and sends them to out
+   *  // until DoSomething returns an error or ctx.Done is closed.
+   *  func Stream(ctx context.Context, out chan<- Value) error {
+   *  	for {
+   *  		v, err := DoSomething(ctx)
+   *  		if err != nil {
+   *  			return err
+   *  		}
+   *  		select {
+   *  		case <-ctx.Done():
+   *  			return ctx.Err()
+   *  		case out <- v:
+   *  		}
+   *  	}
+   *  }
+   * 
+   * See https://blog.golang.org/pipelines for more examples of how to use
+   * a Done channel for cancellation.
+   */
+  done(): undefined
+  /**
+   * If Done is not yet closed, Err returns nil.
+   * If Done is closed, Err returns a non-nil error explaining why:
+   * DeadlineExceeded if the context's deadline passed,
+   * or Canceled if the context was canceled for some other reason.
+   * After Err returns a non-nil error, successive calls to Err return the same error.
+   */
+  err(): void
+  /**
+   * Value returns the value associated with this context for key, or nil
+   * if no value is associated with key. Successive calls to Value with
+   * the same key returns the same result.
+   * 
+   * Use context values only for request-scoped data that transits
+   * processes and API boundaries, not for passing optional parameters to
+   * functions.
+   * 
+   * A key identifies a specific value in a Context. Functions that wish
+   * to store values in Context typically allocate a key in a global
+   * variable then use that key as the argument to context.WithValue and
+   * Context.Value. A key can be any type that supports equality;
+   * packages should define keys as an unexported type to avoid
+   * collisions.
+   * 
+   * Packages that define a Context key should provide type-safe accessors
+   * for the values stored using that key:
+   * 
+   * ```
+   * 	// Package user defines a User type that's stored in Contexts.
+   * 	package user
+   * 
+   * 	import "context"
+   * 
+   * 	// User is the type of value stored in the Contexts.
+   * 	type User struct {...}
+   * 
+   * 	// key is an unexported type for keys defined in this package.
+   * 	// This prevents collisions with keys defined in other packages.
+   * 	type key int
+   * 
+   * 	// userKey is the key for user.User values in Contexts. It is
+   * 	// unexported; clients use user.NewContext and user.FromContext
+   * 	// instead of using this key directly.
+   * 	var userKey key
+   * 
+   * 	// NewContext returns a new Context that carries value u.
+   * 	func NewContext(ctx context.Context, u *User) context.Context {
+   * 		return context.WithValue(ctx, userKey, u)
+   * 	}
+   * 
+   * 	// FromContext returns the User value stored in ctx, if any.
+   * 	func FromContext(ctx context.Context) (*User, bool) {
+   * 		u, ok := ctx.Value(userKey).(*User)
+   * 		return u, ok
+   * 	}
+   * ```
+   */
+  value(key: any): any
+ }
+}
+
+/**
+ * Package io provides basic interfaces to I/O primitives.
+ * Its primary job is to wrap existing implementations of such primitives,
+ * such as those in package os, into shared public interfaces that
+ * abstract the functionality, plus some other related primitives.
+ * 
+ * Because these interfaces and primitives wrap lower-level operations with
+ * various implementations, unless otherwise informed clients should not
+ * assume they are safe for parallel execution.
+ */
+namespace io {
+ /**
+  * Reader is the interface that wraps the basic Read method.
+  * 
+  * Read reads up to len(p) bytes into p. It returns the number of bytes
+  * read (0 <= n <= len(p)) and any error encountered. Even if Read
+  * returns n < len(p), it may use all of p as scratch space during the call.
+  * If some data is available but not len(p) bytes, Read conventionally
+  * returns what is available instead of waiting for more.
+  * 
+  * When Read encounters an error or end-of-file condition after
+  * successfully reading n > 0 bytes, it returns the number of
+  * bytes read. It may return the (non-nil) error from the same call
+  * or return the error (and n == 0) from a subsequent call.
+  * An instance of this general case is that a Reader returning
+  * a non-zero number of bytes at the end of the input stream may
+  * return either err == EOF or err == nil. The next Read should
+  * return 0, EOF.
+  * 
+  * Callers should always process the n > 0 bytes returned before
+  * considering the error err. Doing so correctly handles I/O errors
+  * that happen after reading some bytes and also both of the
+  * allowed EOF behaviors.
+  * 
+  * If len(p) == 0, Read should always return n == 0. It may return a
+  * non-nil error if some error condition is known, such as EOF.
+  * 
+  * Implementations of Read are discouraged from returning a
+  * zero byte count with a nil error, except when len(p) == 0.
+  * Callers should treat a return of 0 and nil as indicating that
+  * nothing happened; in particular it does not indicate EOF.
+  * 
+  * Implementations must not retain p.
+  */
+ interface Reader {
+  [key:string]: any;
+  read(p: string|Array<number>): number
+ }
+ /**
+  * Writer is the interface that wraps the basic Write method.
+  * 
+  * Write writes len(p) bytes from p to the underlying data stream.
+  * It returns the number of bytes written from p (0 <= n <= len(p))
+  * and any error encountered that caused the write to stop early.
+  * Write must return a non-nil error if it returns n < len(p).
+  * Write must not modify the slice data, even temporarily.
+  * 
+  * Implementations must not retain p.
+  */
+ interface Writer {
+  [key:string]: any;
+  write(p: string|Array<number>): number
+ }
+ /**
+  * ReadCloser is the interface that groups the basic Read and Close methods.
+  */
+ interface ReadCloser {
+  [key:string]: any;
+ }
+ /**
+  * ReadSeekCloser is the interface that groups the basic Read, Seek and Close
+  * methods.
+  */
+ interface ReadSeekCloser {
+  [key:string]: any;
+ }
+}
+
+/**
+ * Package fs defines basic interfaces to a file system.
+ * A file system can be provided by the host operating system
+ * but also by other packages.
+ * 
+ * See the [testing/fstest] package for support with testing
+ * implementations of file systems.
+ */
+namespace fs {
+ /**
+  * An FS provides access to a hierarchical file system.
+  * 
+  * The FS interface is the minimum implementation required of the file system.
+  * A file system may implement additional interfaces,
+  * such as [ReadFileFS], to provide additional or optimized functionality.
+  * 
+  * [testing/fstest.TestFS] may be used to test implementations of an FS for
+  * correctness.
+  */
+ interface FS {
+  [key:string]: any;
+  /**
+   * Open opens the named file.
+   * [File.Close] must be called to release any associated resources.
+   * 
+   * When Open returns an error, it should be of type *PathError
+   * with the Op field set to "open", the Path field set to name,
+   * and the Err field describing the problem.
+   * 
+   * Open should reject attempts to open names that do not satisfy
+   * ValidPath(name), returning a *PathError with Err set to
+   * ErrInvalid or ErrNotExist.
+   */
+  open(name: string): File
+ }
+ /**
+  * A File provides access to a single file.
+  * The File interface is the minimum implementation required of the file.
+  * Directory files should also implement [ReadDirFile].
+  * A file may implement [io.ReaderAt] or [io.Seeker] as optimizations.
+  */
+ interface File {
+  [key:string]: any;
+  stat(): FileInfo
+  read(_arg0: string|Array<number>): number
+  close(): void
+ }
+ /**
+  * A DirEntry is an entry read from a directory
+  * (using the [ReadDir] function or a [ReadDirFile]'s ReadDir method).
+  */
+ interface DirEntry {
+  [key:string]: any;
+  /**
+   * Name returns the name of the file (or subdirectory) described by the entry.
+   * This name is only the final element of the path (the base name), not the entire path.
+   * For example, Name would return "hello.go" not "home/gopher/hello.go".
+   */
+  name(): string
+  /**
+   * IsDir reports whether the entry describes a directory.
+   */
+  isDir(): boolean
+  /**
+   * Type returns the type bits for the entry.
+   * The type bits are a subset of the usual FileMode bits, those returned by the FileMode.Type method.
+   */
+  type(): FileMode
+  /**
+   * Info returns the FileInfo for the file or subdirectory described by the entry.
+   * The returned FileInfo may be from the time of the original directory read
+   * or from the time of the call to Info. If the file has been removed or renamed
+   * since the directory read, Info may return an error satisfying errors.Is(err, ErrNotExist).
+   * If the entry denotes a symbolic link, Info reports the information about the link itself,
+   * not the link's target.
+   */
+  info(): FileInfo
+ }
+ /**
+  * A FileInfo describes a file and is returned by [Stat].
+  */
+ interface FileInfo {
+  [key:string]: any;
+  name(): string // base name of the file
+  size(): number // length in bytes for regular files; system-dependent for others
+  mode(): FileMode // file mode bits
+  modTime(): time.Time // modification time
+  isDir(): boolean // abbreviation for Mode().IsDir()
+  sys(): any // underlying data source (can return nil)
+ }
+ /**
+  * A FileMode represents a file's mode and permission bits.
+  * The bits have the same definition on all systems, so that
+  * information about files can be moved from one system
+  * to another portably. Not all bits apply to all systems.
+  * The only required bit is [ModeDir] for directories.
+  */
+ interface FileMode extends Number{}
+ interface FileMode {
+  string(): string
+ }
+ interface FileMode {
+  /**
+   * IsDir reports whether m describes a directory.
+   * That is, it tests for the [ModeDir] bit being set in m.
+   */
+  isDir(): boolean
+ }
+ interface FileMode {
+  /**
+   * IsRegular reports whether m describes a regular file.
+   * That is, it tests that no mode type bits are set.
+   */
+  isRegular(): boolean
+ }
+ interface FileMode {
+  /**
+   * Perm returns the Unix permission bits in m (m & [ModePerm]).
+   */
+  perm(): FileMode
+ }
+ interface FileMode {
+  /**
+   * Type returns type bits in m (m & [ModeType]).
+   */
+  type(): FileMode
+ }
+ /**
+  * PathError records an error and the operation and file path that caused it.
+  */
+ interface PathError {
+  op: string
+  path: string
+  err: Error
+ }
+ interface PathError {
+  error(): string
+ }
+ interface PathError {
+  unwrap(): void
+ }
+ interface PathError {
+  /**
+   * Timeout reports whether this error represents a timeout.
+   */
+  timeout(): boolean
+ }
+ /**
+  * WalkDirFunc is the type of the function called by [WalkDir] to visit
+  * each file or directory.
+  * 
+  * The path argument contains the argument to [WalkDir] as a prefix.
+  * That is, if WalkDir is called with root argument "dir" and finds a file
+  * named "a" in that directory, the walk function will be called with
+  * argument "dir/a".
+  * 
+  * The d argument is the [DirEntry] for the named path.
+  * 
+  * The error result returned by the function controls how [WalkDir]
+  * continues. If the function returns the special value [SkipDir], WalkDir
+  * skips the current directory (path if d.IsDir() is true, otherwise
+  * path's parent directory). If the function returns the special value
+  * [SkipAll], WalkDir skips all remaining files and directories. Otherwise,
+  * if the function returns a non-nil error, WalkDir stops entirely and
+  * returns that error.
+  * 
+  * The err argument reports an error related to path, signaling that
+  * [WalkDir] will not walk into that directory. The function can decide how
+  * to handle that error; as described earlier, returning the error will
+  * cause WalkDir to stop walking the entire tree.
+  * 
+  * [WalkDir] calls the function with a non-nil err argument in two cases.
+  * 
+  * First, if the initial [Stat] on the root directory fails, WalkDir
+  * calls the function with path set to root, d set to nil, and err set to
+  * the error from [fs.Stat].
+  * 
+  * Second, if a directory's ReadDir method (see [ReadDirFile]) fails, WalkDir calls the
+  * function with path set to the directory's path, d set to an
+  * [DirEntry] describing the directory, and err set to the error from
+  * ReadDir. In this second case, the function is called twice with the
+  * path of the directory: the first call is before the directory read is
+  * attempted and has err set to nil, giving the function a chance to
+  * return [SkipDir] or [SkipAll] and avoid the ReadDir entirely. The second call
+  * is after a failed ReadDir and reports the error from ReadDir.
+  * (If ReadDir succeeds, there is no second call.)
+  * 
+  * The differences between WalkDirFunc compared to [path/filepath.WalkFunc] are:
+  * 
+  * ```
+  *   - The second argument has type [DirEntry] instead of [FileInfo].
+  *   - The function is called before reading a directory, to allow [SkipDir]
+  *     or [SkipAll] to bypass the directory read entirely or skip all remaining
+  *     files and directories respectively.
+  *   - If a directory read fails, the function is called a second time
+  *     for that directory to report the error.
+  * ```
+  */
+ interface WalkDirFunc {(path: string, d: DirEntry, err: Error): void }
+}
+
+/**
+ * Package net provides a portable interface for network I/O, including
+ * TCP/IP, UDP, domain name resolution, and Unix domain sockets.
+ * 
+ * Although the package provides access to low-level networking
+ * primitives, most clients will need only the basic interface provided
+ * by the [Dial], [Listen], and Accept functions and the associated
+ * [Conn] and [Listener] interfaces. The crypto/tls package uses
+ * the same interfaces and similar Dial and Listen functions.
+ * 
+ * The Dial function connects to a server:
+ * 
+ * ```
+ * 	conn, err := net.Dial("tcp", "golang.org:80")
+ * 	if err != nil {
+ * 		// handle error
+ * 	}
+ * 	fmt.Fprintf(conn, "GET / HTTP/1.0\r\n\r\n")
+ * 	status, err := bufio.NewReader(conn).ReadString('\n')
+ * 	// ...
+ * ```
+ * 
+ * The Listen function creates servers:
+ * 
+ * ```
+ * 	ln, err := net.Listen("tcp", ":8080")
+ * 	if err != nil {
+ * 		// handle error
+ * 	}
+ * 	for {
+ * 		conn, err := ln.Accept()
+ * 		if err != nil {
+ * 			// handle error
+ * 		}
+ * 		go handleConnection(conn)
+ * 	}
+ * ```
+ * 
+ * # Name Resolution
+ * 
+ * The method for resolving domain names, whether indirectly with functions like Dial
+ * or directly with functions like [LookupHost] and [LookupAddr], varies by operating system.
+ * 
+ * On Unix systems, the resolver has two options for resolving names.
+ * It can use a pure Go resolver that sends DNS requests directly to the servers
+ * listed in /etc/resolv.conf, or it can use a cgo-based resolver that calls C
+ * library routines such as getaddrinfo and getnameinfo.
+ * 
+ * On Unix the pure Go resolver is preferred over the cgo resolver, because a blocked DNS
+ * request consumes only a goroutine, while a blocked C call consumes an operating system thread.
+ * When cgo is available, the cgo-based resolver is used instead under a variety of
+ * conditions: on systems that do not let programs make direct DNS requests (OS X),
+ * when the LOCALDOMAIN environment variable is present (even if empty),
+ * when the RES_OPTIONS or HOSTALIASES environment variable is non-empty,
+ * when the ASR_CONFIG environment variable is non-empty (OpenBSD only),
+ * when /etc/resolv.conf or /etc/nsswitch.conf specify the use of features that the
+ * Go resolver does not implement.
+ * 
+ * On all systems (except Plan 9), when the cgo resolver is being used
+ * this package applies a concurrent cgo lookup limit to prevent the system
+ * from running out of system threads. Currently, it is limited to 500 concurrent lookups.
+ * 
+ * The resolver decision can be overridden by setting the netdns value of the
+ * GODEBUG environment variable (see package runtime) to go or cgo, as in:
+ * 
+ * ```
+ * 	export GODEBUG=netdns=go    # force pure Go resolver
+ * 	export GODEBUG=netdns=cgo   # force native resolver (cgo, win32)
+ * ```
+ * 
+ * The decision can also be forced while building the Go source tree
+ * by setting the netgo or netcgo build tag.
+ * The netgo build tag disables entirely the use of the native (CGO) resolver,
+ * meaning the Go resolver is the only one that can be used.
+ * With the netcgo build tag the native and the pure Go resolver are compiled into the binary,
+ * but the native (CGO) resolver is preferred over the Go resolver.
+ * With netcgo, the Go resolver can still be forced at runtime with GODEBUG=netdns=go.
+ * 
+ * A numeric netdns setting, as in GODEBUG=netdns=1, causes the resolver
+ * to print debugging information about its decisions.
+ * To force a particular resolver while also printing debugging information,
+ * join the two settings by a plus sign, as in GODEBUG=netdns=go+1.
+ * 
+ * The Go resolver will send an EDNS0 additional header with a DNS request,
+ * to signal a willingness to accept a larger DNS packet size.
+ * This can reportedly cause sporadic failures with the DNS server run
+ * by some modems and routers. Setting GODEBUG=netedns0=0 will disable
+ * sending the additional header.
+ * 
+ * On macOS, if Go code that uses the net package is built with
+ * -buildmode=c-archive, linking the resulting archive into a C program
+ * requires passing -lresolv when linking the C code.
+ * 
+ * On Plan 9, the resolver always accesses /net/cs and /net/dns.
+ * 
+ * On Windows, in Go 1.18.x and earlier, the resolver always used C
+ * library functions, such as GetAddrInfo and DnsQuery.
+ */
+namespace net {
+ /**
+  * Conn is a generic stream-oriented network connection.
+  * 
+  * Multiple goroutines may invoke methods on a Conn simultaneously.
+  */
+ interface Conn {
+  [key:string]: any;
+  /**
+   * Read reads data from the connection.
+   * Read can be made to time out and return an error after a fixed
+   * time limit; see SetDeadline and SetReadDeadline.
+   */
+  read(b: string|Array<number>): number
+  /**
+   * Write writes data to the connection.
+   * Write can be made to time out and return an error after a fixed
+   * time limit; see SetDeadline and SetWriteDeadline.
+   */
+  write(b: string|Array<number>): number
+  /**
+   * Close closes the connection.
+   * Any blocked Read or Write operations will be unblocked and return errors.
+   */
+  close(): void
+  /**
+   * LocalAddr returns the local network address, if known.
+   */
+  localAddr(): Addr
+  /**
+   * RemoteAddr returns the remote network address, if known.
+   */
+  remoteAddr(): Addr
+  /**
+   * SetDeadline sets the read and write deadlines associated
+   * with the connection. It is equivalent to calling both
+   * SetReadDeadline and SetWriteDeadline.
+   * 
+   * A deadline is an absolute time after which I/O operations
+   * fail instead of blocking. The deadline applies to all future
+   * and pending I/O, not just the immediately following call to
+   * Read or Write. After a deadline has been exceeded, the
+   * connection can be refreshed by setting a deadline in the future.
+   * 
+   * If the deadline is exceeded a call to Read or Write or to other
+   * I/O methods will return an error that wraps os.ErrDeadlineExceeded.
+   * This can be tested using errors.Is(err, os.ErrDeadlineExceeded).
+   * The error's Timeout method will return true, but note that there
+   * are other possible errors for which the Timeout method will
+   * return true even if the deadline has not been exceeded.
+   * 
+   * An idle timeout can be implemented by repeatedly extending
+   * the deadline after successful Read or Write calls.
+   * 
+   * A zero value for t means I/O operations will not time out.
+   */
+  setDeadline(t: time.Time): void
+  /**
+   * SetReadDeadline sets the deadline for future Read calls
+   * and any currently-blocked Read call.
+   * A zero value for t means Read will not time out.
+   */
+  setReadDeadline(t: time.Time): void
+  /**
+   * SetWriteDeadline sets the deadline for future Write calls
+   * and any currently-blocked Write call.
+   * Even if write times out, it may return n > 0, indicating that
+   * some of the data was successfully written.
+   * A zero value for t means Write will not time out.
+   */
+  setWriteDeadline(t: time.Time): void
+ }
+ /**
+  * A Listener is a generic network listener for stream-oriented protocols.
+  * 
+  * Multiple goroutines may invoke methods on a Listener simultaneously.
+  */
+ interface Listener {
+  [key:string]: any;
+  /**
+   * Accept waits for and returns the next connection to the listener.
+   */
+  accept(): Conn
+  /**
+   * Close closes the listener.
+   * Any blocked Accept operations will be unblocked and return errors.
+   */
+  close(): void
+  /**
+   * Addr returns the listener's network address.
+   */
+  addr(): Addr
+ }
+}
+
+/**
+ * Package bytes implements functions for the manipulation of byte slices.
+ * It is analogous to the facilities of the [strings] package.
+ */
+namespace bytes {
+ /**
+  * A Reader implements the [io.Reader], [io.ReaderAt], [io.WriterTo], [io.Seeker],
+  * [io.ByteScanner], and [io.RuneScanner] interfaces by reading from
+  * a byte slice.
+  * Unlike a [Buffer], a Reader is read-only and supports seeking.
+  * The zero value for Reader operates like a Reader of an empty slice.
+  */
+ interface Reader {
+ }
+ interface Reader {
+  /**
+   * Len returns the number of bytes of the unread portion of the
+   * slice.
+   */
+  len(): number
+ }
+ interface Reader {
+  /**
+   * Size returns the original length of the underlying byte slice.
+   * Size is the number of bytes available for reading via [Reader.ReadAt].
+   * The result is unaffected by any method calls except [Reader.Reset].
+   */
+  size(): number
+ }
+ interface Reader {
+  /**
+   * Read implements the [io.Reader] interface.
+   */
+  read(b: string|Array<number>): number
+ }
+ interface Reader {
+  /**
+   * ReadAt implements the [io.ReaderAt] interface.
+   */
+  readAt(b: string|Array<number>, off: number): number
+ }
+ interface Reader {
+  /**
+   * ReadByte implements the [io.ByteReader] interface.
+   */
+  readByte(): number
+ }
+ interface Reader {
+  /**
+   * UnreadByte complements [Reader.ReadByte] in implementing the [io.ByteScanner] interface.
+   */
+  unreadByte(): void
+ }
+ interface Reader {
+  /**
+   * ReadRune implements the [io.RuneReader] interface.
+   */
+  readRune(): [number, number]
+ }
+ interface Reader {
+  /**
+   * UnreadRune complements [Reader.ReadRune] in implementing the [io.RuneScanner] interface.
+   */
+  unreadRune(): void
+ }
+ interface Reader {
+  /**
+   * Seek implements the [io.Seeker] interface.
+   */
+  seek(offset: number, whence: number): number
+ }
+ interface Reader {
+  /**
+   * WriteTo implements the [io.WriterTo] interface.
+   */
+  writeTo(w: io.Writer): number
+ }
+ interface Reader {
+  /**
+   * Reset resets the [Reader] to be reading from b.
+   */
+  reset(b: string|Array<number>): void
+ }
+}
+
+/**
+ * Package sql provides a generic interface around SQL (or SQL-like)
+ * databases.
+ * 
+ * The sql package must be used in conjunction with a database driver.
+ * See https://golang.org/s/sqldrivers for a list of drivers.
+ * 
+ * Drivers that do not support context cancellation will not return until
+ * after the query is completed.
+ * 
+ * For usage examples, see the wiki page at
+ * https://golang.org/s/sqlwiki.
+ */
+namespace sql {
+ /**
+  * TxOptions holds the transaction options to be used in [DB.BeginTx].
+  */
+ interface TxOptions {
+  /**
+   * Isolation is the transaction isolation level.
+   * If zero, the driver or database's default level is used.
+   */
+  isolation: IsolationLevel
+  readOnly: boolean
+ }
+ /**
+  * NullString represents a string that may be null.
+  * NullString implements the [Scanner] interface so
+  * it can be used as a scan destination:
+  * 
+  * ```
+  * 	var s NullString
+  * 	err := db.QueryRow("SELECT name FROM foo WHERE id=?", id).Scan(&s)
+  * 	...
+  * 	if s.Valid {
+  * 	   // use s.String
+  * 	} else {
+  * 	   // NULL value
+  * 	}
+  * ```
+  */
+ interface NullString {
+  string: string
+  valid: boolean // Valid is true if String is not NULL
+ }
+ interface NullString {
+  /**
+   * Scan implements the [Scanner] interface.
+   */
+  scan(value: any): void
+ }
+ interface NullString {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ /**
+  * DB is a database handle representing a pool of zero or more
+  * underlying connections. It's safe for concurrent use by multiple
+  * goroutines.
+  * 
+  * The sql package creates and frees connections automatically; it
+  * also maintains a free pool of idle connections. If the database has
+  * a concept of per-connection state, such state can be reliably observed
+  * within a transaction ([Tx]) or connection ([Conn]). Once [DB.Begin] is called, the
+  * returned [Tx] is bound to a single connection. Once [Tx.Commit] or
+  * [Tx.Rollback] is called on the transaction, that transaction's
+  * connection is returned to [DB]'s idle connection pool. The pool size
+  * can be controlled with [DB.SetMaxIdleConns].
+  */
+ interface DB {
+ }
+ interface DB {
+  /**
+   * PingContext verifies a connection to the database is still alive,
+   * establishing a connection if necessary.
+   */
+  pingContext(ctx: context.Context): void
+ }
+ interface DB {
+  /**
+   * Ping verifies a connection to the database is still alive,
+   * establishing a connection if necessary.
+   * 
+   * Ping uses [context.Background] internally; to specify the context, use
+   * [DB.PingContext].
+   */
+  ping(): void
+ }
+ interface DB {
+  /**
+   * Close closes the database and prevents new queries from starting.
+   * Close then waits for all queries that have started processing on the server
+   * to finish.
+   * 
+   * It is rare to Close a [DB], as the [DB] handle is meant to be
+   * long-lived and shared between many goroutines.
+   */
+  close(): void
+ }
+ interface DB {
+  /**
+   * SetMaxIdleConns sets the maximum number of connections in the idle
+   * connection pool.
+   * 
+   * If MaxOpenConns is greater than 0 but less than the new MaxIdleConns,
+   * then the new MaxIdleConns will be reduced to match the MaxOpenConns limit.
+   * 
+   * If n <= 0, no idle connections are retained.
+   * 
+   * The default max idle connections is currently 2. This may change in
+   * a future release.
+   */
+  setMaxIdleConns(n: number): void
+ }
+ interface DB {
+  /**
+   * SetMaxOpenConns sets the maximum number of open connections to the database.
+   * 
+   * If MaxIdleConns is greater than 0 and the new MaxOpenConns is less than
+   * MaxIdleConns, then MaxIdleConns will be reduced to match the new
+   * MaxOpenConns limit.
+   * 
+   * If n <= 0, then there is no limit on the number of open connections.
+   * The default is 0 (unlimited).
+   */
+  setMaxOpenConns(n: number): void
+ }
+ interface DB {
+  /**
+   * SetConnMaxLifetime sets the maximum amount of time a connection may be reused.
+   * 
+   * Expired connections may be closed lazily before reuse.
+   * 
+   * If d <= 0, connections are not closed due to a connection's age.
+   */
+  setConnMaxLifetime(d: time.Duration): void
+ }
+ interface DB {
+  /**
+   * SetConnMaxIdleTime sets the maximum amount of time a connection may be idle.
+   * 
+   * Expired connections may be closed lazily before reuse.
+   * 
+   * If d <= 0, connections are not closed due to a connection's idle time.
+   */
+  setConnMaxIdleTime(d: time.Duration): void
+ }
+ interface DB {
+  /**
+   * Stats returns database statistics.
+   */
+  stats(): DBStats
+ }
+ interface DB {
+  /**
+   * PrepareContext creates a prepared statement for later queries or executions.
+   * Multiple queries or executions may be run concurrently from the
+   * returned statement.
+   * The caller must call the statement's [*Stmt.Close] method
+   * when the statement is no longer needed.
+   * 
+   * The provided context is used for the preparation of the statement, not for the
+   * execution of the statement.
+   */
+  prepareContext(ctx: context.Context, query: string): (Stmt)
+ }
+ interface DB {
+  /**
+   * Prepare creates a prepared statement for later queries or executions.
+   * Multiple queries or executions may be run concurrently from the
+   * returned statement.
+   * The caller must call the statement's [*Stmt.Close] method
+   * when the statement is no longer needed.
+   * 
+   * Prepare uses [context.Background] internally; to specify the context, use
+   * [DB.PrepareContext].
+   */
+  prepare(query: string): (Stmt)
+ }
+ interface DB {
+  /**
+   * ExecContext executes a query without returning any rows.
+   * The args are for any placeholder parameters in the query.
+   */
+  execContext(ctx: context.Context, query: string, ...args: any[]): Result
+ }
+ interface DB {
+  /**
+   * Exec executes a query without returning any rows.
+   * The args are for any placeholder parameters in the query.
+   * 
+   * Exec uses [context.Background] internally; to specify the context, use
+   * [DB.ExecContext].
+   */
+  exec(query: string, ...args: any[]): Result
+ }
+ interface DB {
+  /**
+   * QueryContext executes a query that returns rows, typically a SELECT.
+   * The args are for any placeholder parameters in the query.
+   */
+  queryContext(ctx: context.Context, query: string, ...args: any[]): (Rows)
+ }
+ interface DB {
+  /**
+   * Query executes a query that returns rows, typically a SELECT.
+   * The args are for any placeholder parameters in the query.
+   * 
+   * Query uses [context.Background] internally; to specify the context, use
+   * [DB.QueryContext].
+   */
+  query(query: string, ...args: any[]): (Rows)
+ }
+ interface DB {
+  /**
+   * QueryRowContext executes a query that is expected to return at most one row.
+   * QueryRowContext always returns a non-nil value. Errors are deferred until
+   * [Row]'s Scan method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   */
+  queryRowContext(ctx: context.Context, query: string, ...args: any[]): (Row)
+ }
+ interface DB {
+  /**
+   * QueryRow executes a query that is expected to return at most one row.
+   * QueryRow always returns a non-nil value. Errors are deferred until
+   * [Row]'s Scan method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   * 
+   * QueryRow uses [context.Background] internally; to specify the context, use
+   * [DB.QueryRowContext].
+   */
+  queryRow(query: string, ...args: any[]): (Row)
+ }
+ interface DB {
+  /**
+   * BeginTx starts a transaction.
+   * 
+   * The provided context is used until the transaction is committed or rolled back.
+   * If the context is canceled, the sql package will roll back
+   * the transaction. [Tx.Commit] will return an error if the context provided to
+   * BeginTx is canceled.
+   * 
+   * The provided [TxOptions] is optional and may be nil if defaults should be used.
+   * If a non-default isolation level is used that the driver doesn't support,
+   * an error will be returned.
+   */
+  beginTx(ctx: context.Context, opts: TxOptions): (Tx)
+ }
+ interface DB {
+  /**
+   * Begin starts a transaction. The default isolation level is dependent on
+   * the driver.
+   * 
+   * Begin uses [context.Background] internally; to specify the context, use
+   * [DB.BeginTx].
+   */
+  begin(): (Tx)
+ }
+ interface DB {
+  /**
+   * Driver returns the database's underlying driver.
+   */
+  driver(): any
+ }
+ interface DB {
+  /**
+   * Conn returns a single connection by either opening a new connection
+   * or returning an existing connection from the connection pool. Conn will
+   * block until either a connection is returned or ctx is canceled.
+   * Queries run on the same Conn will be run in the same database session.
+   * 
+   * Every Conn must be returned to the database pool after use by
+   * calling [Conn.Close].
+   */
+  conn(ctx: context.Context): (Conn)
+ }
+ /**
+  * Tx is an in-progress database transaction.
+  * 
+  * A transaction must end with a call to [Tx.Commit] or [Tx.Rollback].
+  * 
+  * After a call to [Tx.Commit] or [Tx.Rollback], all operations on the
+  * transaction fail with [ErrTxDone].
+  * 
+  * The statements prepared for a transaction by calling
+  * the transaction's [Tx.Prepare] or [Tx.Stmt] methods are closed
+  * by the call to [Tx.Commit] or [Tx.Rollback].
+  */
+ interface Tx {
+ }
+ interface Tx {
+  /**
+   * Commit commits the transaction.
+   */
+  commit(): void
+ }
+ interface Tx {
+  /**
+   * Rollback aborts the transaction.
+   */
+  rollback(): void
+ }
+ interface Tx {
+  /**
+   * PrepareContext creates a prepared statement for use within a transaction.
+   * 
+   * The returned statement operates within the transaction and will be closed
+   * when the transaction has been committed or rolled back.
+   * 
+   * To use an existing prepared statement on this transaction, see [Tx.Stmt].
+   * 
+   * The provided context will be used for the preparation of the context, not
+   * for the execution of the returned statement. The returned statement
+   * will run in the transaction context.
+   */
+  prepareContext(ctx: context.Context, query: string): (Stmt)
+ }
+ interface Tx {
+  /**
+   * Prepare creates a prepared statement for use within a transaction.
+   * 
+   * The returned statement operates within the transaction and will be closed
+   * when the transaction has been committed or rolled back.
+   * 
+   * To use an existing prepared statement on this transaction, see [Tx.Stmt].
+   * 
+   * Prepare uses [context.Background] internally; to specify the context, use
+   * [Tx.PrepareContext].
+   */
+  prepare(query: string): (Stmt)
+ }
+ interface Tx {
+  /**
+   * StmtContext returns a transaction-specific prepared statement from
+   * an existing statement.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	updateMoney, err := db.Prepare("UPDATE balance SET money=money+? WHERE id=?")
+   * 	...
+   * 	tx, err := db.Begin()
+   * 	...
+   * 	res, err := tx.StmtContext(ctx, updateMoney).Exec(123.45, 98293203)
+   * ```
+   * 
+   * The provided context is used for the preparation of the statement, not for the
+   * execution of the statement.
+   * 
+   * The returned statement operates within the transaction and will be closed
+   * when the transaction has been committed or rolled back.
+   */
+  stmtContext(ctx: context.Context, stmt: Stmt): (Stmt)
+ }
+ interface Tx {
+  /**
+   * Stmt returns a transaction-specific prepared statement from
+   * an existing statement.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	updateMoney, err := db.Prepare("UPDATE balance SET money=money+? WHERE id=?")
+   * 	...
+   * 	tx, err := db.Begin()
+   * 	...
+   * 	res, err := tx.Stmt(updateMoney).Exec(123.45, 98293203)
+   * ```
+   * 
+   * The returned statement operates within the transaction and will be closed
+   * when the transaction has been committed or rolled back.
+   * 
+   * Stmt uses [context.Background] internally; to specify the context, use
+   * [Tx.StmtContext].
+   */
+  stmt(stmt: Stmt): (Stmt)
+ }
+ interface Tx {
+  /**
+   * ExecContext executes a query that doesn't return rows.
+   * For example: an INSERT and UPDATE.
+   */
+  execContext(ctx: context.Context, query: string, ...args: any[]): Result
+ }
+ interface Tx {
+  /**
+   * Exec executes a query that doesn't return rows.
+   * For example: an INSERT and UPDATE.
+   * 
+   * Exec uses [context.Background] internally; to specify the context, use
+   * [Tx.ExecContext].
+   */
+  exec(query: string, ...args: any[]): Result
+ }
+ interface Tx {
+  /**
+   * QueryContext executes a query that returns rows, typically a SELECT.
+   */
+  queryContext(ctx: context.Context, query: string, ...args: any[]): (Rows)
+ }
+ interface Tx {
+  /**
+   * Query executes a query that returns rows, typically a SELECT.
+   * 
+   * Query uses [context.Background] internally; to specify the context, use
+   * [Tx.QueryContext].
+   */
+  query(query: string, ...args: any[]): (Rows)
+ }
+ interface Tx {
+  /**
+   * QueryRowContext executes a query that is expected to return at most one row.
+   * QueryRowContext always returns a non-nil value. Errors are deferred until
+   * [Row]'s Scan method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   */
+  queryRowContext(ctx: context.Context, query: string, ...args: any[]): (Row)
+ }
+ interface Tx {
+  /**
+   * QueryRow executes a query that is expected to return at most one row.
+   * QueryRow always returns a non-nil value. Errors are deferred until
+   * [Row]'s Scan method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   * 
+   * QueryRow uses [context.Background] internally; to specify the context, use
+   * [Tx.QueryRowContext].
+   */
+  queryRow(query: string, ...args: any[]): (Row)
+ }
+ /**
+  * Stmt is a prepared statement.
+  * A Stmt is safe for concurrent use by multiple goroutines.
+  * 
+  * If a Stmt is prepared on a [Tx] or [Conn], it will be bound to a single
+  * underlying connection forever. If the [Tx] or [Conn] closes, the Stmt will
+  * become unusable and all operations will return an error.
+  * If a Stmt is prepared on a [DB], it will remain usable for the lifetime of the
+  * [DB]. When the Stmt needs to execute on a new underlying connection, it will
+  * prepare itself on the new connection automatically.
+  */
+ interface Stmt {
+ }
+ interface Stmt {
+  /**
+   * ExecContext executes a prepared statement with the given arguments and
+   * returns a [Result] summarizing the effect of the statement.
+   */
+  execContext(ctx: context.Context, ...args: any[]): Result
+ }
+ interface Stmt {
+  /**
+   * Exec executes a prepared statement with the given arguments and
+   * returns a [Result] summarizing the effect of the statement.
+   * 
+   * Exec uses [context.Background] internally; to specify the context, use
+   * [Stmt.ExecContext].
+   */
+  exec(...args: any[]): Result
+ }
+ interface Stmt {
+  /**
+   * QueryContext executes a prepared query statement with the given arguments
+   * and returns the query results as a [*Rows].
+   */
+  queryContext(ctx: context.Context, ...args: any[]): (Rows)
+ }
+ interface Stmt {
+  /**
+   * Query executes a prepared query statement with the given arguments
+   * and returns the query results as a *Rows.
+   * 
+   * Query uses [context.Background] internally; to specify the context, use
+   * [Stmt.QueryContext].
+   */
+  query(...args: any[]): (Rows)
+ }
+ interface Stmt {
+  /**
+   * QueryRowContext executes a prepared query statement with the given arguments.
+   * If an error occurs during the execution of the statement, that error will
+   * be returned by a call to Scan on the returned [*Row], which is always non-nil.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   */
+  queryRowContext(ctx: context.Context, ...args: any[]): (Row)
+ }
+ interface Stmt {
+  /**
+   * QueryRow executes a prepared query statement with the given arguments.
+   * If an error occurs during the execution of the statement, that error will
+   * be returned by a call to Scan on the returned [*Row], which is always non-nil.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   * 
+   * Example usage:
+   * 
+   * ```
+   * 	var name string
+   * 	err := nameByUseridStmt.QueryRow(id).Scan(&name)
+   * ```
+   * 
+   * QueryRow uses [context.Background] internally; to specify the context, use
+   * [Stmt.QueryRowContext].
+   */
+  queryRow(...args: any[]): (Row)
+ }
+ interface Stmt {
+  /**
+   * Close closes the statement.
+   */
+  close(): void
+ }
+ /**
+  * Rows is the result of a query. Its cursor starts before the first row
+  * of the result set. Use [Rows.Next] to advance from row to row.
+  */
+ interface Rows {
+ }
+ interface Rows {
+  /**
+   * Next prepares the next result row for reading with the [Rows.Scan] method. It
+   * returns true on success, or false if there is no next result row or an error
+   * happened while preparing it. [Rows.Err] should be consulted to distinguish between
+   * the two cases.
+   * 
+   * Every call to [Rows.Scan], even the first one, must be preceded by a call to [Rows.Next].
+   */
+  next(): boolean
+ }
+ interface Rows {
+  /**
+   * NextResultSet prepares the next result set for reading. It reports whether
+   * there is further result sets, or false if there is no further result set
+   * or if there is an error advancing to it. The [Rows.Err] method should be consulted
+   * to distinguish between the two cases.
+   * 
+   * After calling NextResultSet, the [Rows.Next] method should always be called before
+   * scanning. If there are further result sets they may not have rows in the result
+   * set.
+   */
+  nextResultSet(): boolean
+ }
+ interface Rows {
+  /**
+   * Err returns the error, if any, that was encountered during iteration.
+   * Err may be called after an explicit or implicit [Rows.Close].
+   */
+  err(): void
+ }
+ interface Rows {
+  /**
+   * Columns returns the column names.
+   * Columns returns an error if the rows are closed.
+   */
+  columns(): Array<string>
+ }
+ interface Rows {
+  /**
+   * ColumnTypes returns column information such as column type, length,
+   * and nullable. Some information may not be available from some drivers.
+   */
+  columnTypes(): Array<(ColumnType | undefined)>
+ }
+ interface Rows {
+  /**
+   * Scan copies the columns in the current row into the values pointed
+   * at by dest. The number of values in dest must be the same as the
+   * number of columns in [Rows].
+   * 
+   * Scan converts columns read from the database into the following
+   * common Go types and special types provided by the sql package:
+   * 
+   * ```
+   * 	*string
+   * 	*[]byte
+   * 	*int, *int8, *int16, *int32, *int64
+   * 	*uint, *uint8, *uint16, *uint32, *uint64
+   * 	*bool
+   * 	*float32, *float64
+   * 	*interface{}
+   * 	*RawBytes
+   * 	*Rows (cursor value)
+   * 	any type implementing Scanner (see Scanner docs)
+   * ```
+   * 
+   * In the most simple case, if the type of the value from the source
+   * column is an integer, bool or string type T and dest is of type *T,
+   * Scan simply assigns the value through the pointer.
+   * 
+   * Scan also converts between string and numeric types, as long as no
+   * information would be lost. While Scan stringifies all numbers
+   * scanned from numeric database columns into *string, scans into
+   * numeric types are checked for overflow. For example, a float64 with
+   * value 300 or a string with value "300" can scan into a uint16, but
+   * not into a uint8, though float64(255) or "255" can scan into a
+   * uint8. One exception is that scans of some float64 numbers to
+   * strings may lose information when stringifying. In general, scan
+   * floating point columns into *float64.
+   * 
+   * If a dest argument has type *[]byte, Scan saves in that argument a
+   * copy of the corresponding data. The copy is owned by the caller and
+   * can be modified and held indefinitely. The copy can be avoided by
+   * using an argument of type [*RawBytes] instead; see the documentation
+   * for [RawBytes] for restrictions on its use.
+   * 
+   * If an argument has type *interface{}, Scan copies the value
+   * provided by the underlying driver without conversion. When scanning
+   * from a source value of type []byte to *interface{}, a copy of the
+   * slice is made and the caller owns the result.
+   * 
+   * Source values of type [time.Time] may be scanned into values of type
+   * *time.Time, *interface{}, *string, or *[]byte. When converting to
+   * the latter two, [time.RFC3339Nano] is used.
+   * 
+   * Source values of type bool may be scanned into types *bool,
+   * *interface{}, *string, *[]byte, or [*RawBytes].
+   * 
+   * For scanning into *bool, the source may be true, false, 1, 0, or
+   * string inputs parseable by [strconv.ParseBool].
+   * 
+   * Scan can also convert a cursor returned from a query, such as
+   * "select cursor(select * from my_table) from dual", into a
+   * [*Rows] value that can itself be scanned from. The parent
+   * select query will close any cursor [*Rows] if the parent [*Rows] is closed.
+   * 
+   * If any of the first arguments implementing [Scanner] returns an error,
+   * that error will be wrapped in the returned error.
+   */
+  scan(...dest: any[]): void
+ }
+ interface Rows {
+  /**
+   * Close closes the [Rows], preventing further enumeration. If [Rows.Next] is called
+   * and returns false and there are no further result sets,
+   * the [Rows] are closed automatically and it will suffice to check the
+   * result of [Rows.Err]. Close is idempotent and does not affect the result of [Rows.Err].
+   */
+  close(): void
+ }
+ /**
+  * A Result summarizes an executed SQL command.
+  */
+ interface Result {
+  [key:string]: any;
+  /**
+   * LastInsertId returns the integer generated by the database
+   * in response to a command. Typically this will be from an
+   * "auto increment" column when inserting a new row. Not all
+   * databases support this feature, and the syntax of such
+   * statements varies.
+   */
+  lastInsertId(): number
+  /**
+   * RowsAffected returns the number of rows affected by an
+   * update, insert, or delete. Not every database or database
+   * driver may support this.
+   */
+  rowsAffected(): number
+ }
+}
+
+namespace exec {
+ /**
+  * Cmd represents an external command being prepared or run.
+  * 
+  * A Cmd cannot be reused after calling its [Cmd.Run], [Cmd.Output] or [Cmd.CombinedOutput]
+  * methods.
+  */
+ interface Cmd {
+  /**
+   * Path is the path of the command to run.
+   * 
+   * This is the only field that must be set to a non-zero
+   * value. If Path is relative, it is evaluated relative
+   * to Dir.
+   */
+  path: string
+  /**
+   * Args holds command line arguments, including the command as Args[0].
+   * If the Args field is empty or nil, Run uses {Path}.
+   * 
+   * In typical use, both Path and Args are set by calling Command.
+   */
+  args: Array<string>
+  /**
+   * Env specifies the environment of the process.
+   * Each entry is of the form "key=value".
+   * If Env is nil, the new process uses the current process's
+   * environment.
+   * If Env contains duplicate environment keys, only the last
+   * value in the slice for each duplicate key is used.
+   * As a special case on Windows, SYSTEMROOT is always added if
+   * missing and not explicitly set to the empty string.
+   * 
+   * See also the Dir field, which may set PWD in the environment.
+   */
+  env: Array<string>
+  /**
+   * Dir specifies the working directory of the command.
+   * If Dir is the empty string, Run runs the command in the
+   * calling process's current directory.
+   * 
+   * On Unix systems, the value of Dir also determines the
+   * child process's PWD environment variable if not otherwise
+   * specified. A Unix process represents its working directory
+   * not by name but as an implicit reference to a node in the
+   * file tree. So, if the child process obtains its working
+   * directory by calling a function such as C's getcwd, which
+   * computes the canonical name by walking up the file tree, it
+   * will not recover the original value of Dir if that value
+   * was an alias involving symbolic links. However, if the
+   * child process calls Go's [os.Getwd] or GNU C's
+   * get_current_dir_name, and the value of PWD is an alias for
+   * the current directory, those functions will return the
+   * value of PWD, which matches the value of Dir.
+   */
+  dir: string
+  /**
+   * Stdin specifies the process's standard input.
+   * 
+   * If Stdin is nil, the process reads from the null device (os.DevNull).
+   * 
+   * If Stdin is an *os.File, the process's standard input is connected
+   * directly to that file.
+   * 
+   * Otherwise, during the execution of the command a separate
+   * goroutine reads from Stdin and delivers that data to the command
+   * over a pipe. In this case, Wait does not complete until the goroutine
+   * stops copying, either because it has reached the end of Stdin
+   * (EOF or a read error), or because writing to the pipe returned an error,
+   * or because a nonzero WaitDelay was set and expired.
+   */
+  stdin: io.Reader
+  /**
+   * Stdout and Stderr specify the process's standard output and error.
+   * 
+   * If either is nil, Run connects the corresponding file descriptor
+   * to the null device (os.DevNull).
+   * 
+   * If either is an *os.File, the corresponding output from the process
+   * is connected directly to that file.
+   * 
+   * Otherwise, during the execution of the command a separate goroutine
+   * reads from the process over a pipe and delivers that data to the
+   * corresponding Writer. In this case, Wait does not complete until the
+   * goroutine reaches EOF or encounters an error or a nonzero WaitDelay
+   * expires.
+   * 
+   * If Stdout and Stderr are the same writer, and have a type that can
+   * be compared with ==, at most one goroutine at a time will call Write.
+   */
+  stdout: io.Writer
+  stderr: io.Writer
+  /**
+   * ExtraFiles specifies additional open files to be inherited by the
+   * new process. It does not include standard input, standard output, or
+   * standard error. If non-nil, entry i becomes file descriptor 3+i.
+   * 
+   * ExtraFiles is not supported on Windows.
+   */
+  extraFiles: Array<(os.File | undefined)>
+  /**
+   * SysProcAttr holds optional, operating system-specific attributes.
+   * Run passes it to os.StartProcess as the os.ProcAttr's Sys field.
+   */
+  sysProcAttr?: syscall.SysProcAttr
+  /**
+   * Process is the underlying process, once started.
+   */
+  process?: os.Process
+  /**
+   * ProcessState contains information about an exited process.
+   * If the process was started successfully, Wait or Run will
+   * populate its ProcessState when the command completes.
+   */
+  processState?: os.ProcessState
+  err: Error // LookPath error, if any.
+  /**
+   * If Cancel is non-nil, the command must have been created with
+   * CommandContext and Cancel will be called when the command's
+   * Context is done. By default, CommandContext sets Cancel to
+   * call the Kill method on the command's Process.
+   * 
+   * Typically a custom Cancel will send a signal to the command's
+   * Process, but it may instead take other actions to initiate cancellation,
+   * such as closing a stdin or stdout pipe or sending a shutdown request on a
+   * network socket.
+   * 
+   * If the command exits with a success status after Cancel is
+   * called, and Cancel does not return an error equivalent to
+   * os.ErrProcessDone, then Wait and similar methods will return a non-nil
+   * error: either an error wrapping the one returned by Cancel,
+   * or the error from the Context.
+   * (If the command exits with a non-success status, or Cancel
+   * returns an error that wraps os.ErrProcessDone, Wait and similar methods
+   * continue to return the command's usual exit status.)
+   * 
+   * If Cancel is set to nil, nothing will happen immediately when the command's
+   * Context is done, but a nonzero WaitDelay will still take effect. That may
+   * be useful, for example, to work around deadlocks in commands that do not
+   * support shutdown signals but are expected to always finish quickly.
+   * 
+   * Cancel will not be called if Start returns a non-nil error.
+   */
+  cancel: () => void
+  /**
+   * If WaitDelay is non-zero, it bounds the time spent waiting on two sources
+   * of unexpected delay in Wait: a child process that fails to exit after the
+   * associated Context is canceled, and a child process that exits but leaves
+   * its I/O pipes unclosed.
+   * 
+   * The WaitDelay timer starts when either the associated Context is done or a
+   * call to Wait observes that the child process has exited, whichever occurs
+   * first. When the delay has elapsed, the command shuts down the child process
+   * and/or its I/O pipes.
+   * 
+   * If the child process has failed to exit — perhaps because it ignored or
+   * failed to receive a shutdown signal from a Cancel function, or because no
+   * Cancel function was set — then it will be terminated using os.Process.Kill.
+   * 
+   * Then, if the I/O pipes communicating with the child process are still open,
+   * those pipes are closed in order to unblock any goroutines currently blocked
+   * on Read or Write calls.
+   * 
+   * If pipes are closed due to WaitDelay, no Cancel call has occurred,
+   * and the command has otherwise exited with a successful status, Wait and
+   * similar methods will return ErrWaitDelay instead of nil.
+   * 
+   * If WaitDelay is zero (the default), I/O pipes will be read until EOF,
+   * which might not occur until orphaned subprocesses of the command have
+   * also closed their descriptors for the pipes.
+   */
+  waitDelay: time.Duration
+ }
+ interface Cmd {
+  /**
+   * String returns a human-readable description of c.
+   * It is intended only for debugging.
+   * In particular, it is not suitable for use as input to a shell.
+   * The output of String may vary across Go releases.
+   */
+  string(): string
+ }
+ interface Cmd {
+  /**
+   * Run starts the specified command and waits for it to complete.
+   * 
+   * The returned error is nil if the command runs, has no problems
+   * copying stdin, stdout, and stderr, and exits with a zero exit
+   * status.
+   * 
+   * If the command starts but does not complete successfully, the error is of
+   * type [*ExitError]. Other error types may be returned for other situations.
+   * 
+   * If the calling goroutine has locked the operating system thread
+   * with [runtime.LockOSThread] and modified any inheritable OS-level
+   * thread state (for example, Linux or Plan 9 name spaces), the new
+   * process will inherit the caller's thread state.
+   */
+  run(): void
+ }
+ interface Cmd {
+  /**
+   * Start starts the specified command but does not wait for it to complete.
+   * 
+   * If Start returns successfully, the c.Process field will be set.
+   * 
+   * After a successful call to Start the [Cmd.Wait] method must be called in
+   * order to release associated system resources.
+   */
+  start(): void
+ }
+ interface Cmd {
+  /**
+   * Wait waits for the command to exit and waits for any copying to
+   * stdin or copying from stdout or stderr to complete.
+   * 
+   * The command must have been started by [Cmd.Start].
+   * 
+   * The returned error is nil if the command runs, has no problems
+   * copying stdin, stdout, and stderr, and exits with a zero exit
+   * status.
+   * 
+   * If the command fails to run or doesn't complete successfully, the
+   * error is of type [*ExitError]. Other error types may be
+   * returned for I/O problems.
+   * 
+   * If any of c.Stdin, c.Stdout or c.Stderr are not an [*os.File], Wait also waits
+   * for the respective I/O loop copying to or from the process to complete.
+   * 
+   * Wait releases any resources associated with the [Cmd].
+   */
+  wait(): void
+ }
+ interface Cmd {
+  /**
+   * Output runs the command and returns its standard output.
+   * Any returned error will usually be of type [*ExitError].
+   * If c.Stderr was nil and the returned error is of type
+   * [*ExitError], Output populates the Stderr field of the
+   * returned error.
+   */
+  output(): string|Array<number>
+ }
+ interface Cmd {
+  /**
+   * CombinedOutput runs the command and returns its combined standard
+   * output and standard error.
+   */
+  combinedOutput(): string|Array<number>
+ }
+ interface Cmd {
+  /**
+   * StdinPipe returns a pipe that will be connected to the command's
+   * standard input when the command starts.
+   * The pipe will be closed automatically after [Cmd.Wait] sees the command exit.
+   * A caller need only call Close to force the pipe to close sooner.
+   * For example, if the command being run will not exit until standard input
+   * is closed, the caller must close the pipe.
+   */
+  stdinPipe(): io.WriteCloser
+ }
+ interface Cmd {
+  /**
+   * StdoutPipe returns a pipe that will be connected to the command's
+   * standard output when the command starts.
+   * 
+   * [Cmd.Wait] will close the pipe after seeing the command exit, so most callers
+   * need not close the pipe themselves. It is thus incorrect to call Wait
+   * before all reads from the pipe have completed.
+   * For the same reason, it is incorrect to call [Cmd.Run] when using StdoutPipe.
+   * See the example for idiomatic usage.
+   */
+  stdoutPipe(): io.ReadCloser
+ }
+ interface Cmd {
+  /**
+   * StderrPipe returns a pipe that will be connected to the command's
+   * standard error when the command starts.
+   * 
+   * [Cmd.Wait] will close the pipe after seeing the command exit, so most callers
+   * need not close the pipe themselves. It is thus incorrect to call Wait
+   * before all reads from the pipe have completed.
+   * For the same reason, it is incorrect to use [Cmd.Run] when using StderrPipe.
+   * See the StdoutPipe example for idiomatic usage.
+   */
+  stderrPipe(): io.ReadCloser
+ }
+ interface Cmd {
+  /**
+   * Environ returns a copy of the environment in which the command would be run
+   * as it is currently configured.
+   */
+  environ(): Array<string>
+ }
+}
+
+/**
+ * Package cron implements a crontab-like service to execute and schedule
+ * repeative tasks/jobs.
+ * 
+ * Example:
+ * 
+ * ```
+ * 	c := cron.New()
+ * 	c.MustAdd("dailyReport", "0 0 * * *", func() { ... })
+ * 	c.Start()
+ * ```
+ */
+namespace cron {
+ /**
+  * Cron is a crontab-like struct for tasks/jobs scheduling.
+  */
+ interface Cron {
+ }
+ interface Cron {
+  /**
+   * SetInterval changes the current cron tick interval
+   * (it usually should be >= 1 minute).
+   */
+  setInterval(d: time.Duration): void
+ }
+ interface Cron {
+  /**
+   * SetTimezone changes the current cron tick timezone.
+   */
+  setTimezone(l: time.Location): void
+ }
+ interface Cron {
+  /**
+   * MustAdd is similar to Add() but panic on failure.
+   */
+  mustAdd(jobId: string, cronExpr: string, run: () => void): void
+ }
+ interface Cron {
+  /**
+   * Add registers a single cron job.
+   * 
+   * If there is already a job with the provided id, then the old job
+   * will be replaced with the new one.
+   * 
+   * cronExpr is a regular cron expression, eg. "0 *\/3 * * *" (aka. at minute 0 past every 3rd hour).
+   * Check cron.NewSchedule() for the supported tokens.
+   */
+  add(jobId: string, cronExpr: string, fn: () => void): void
+ }
+ interface Cron {
+  /**
+   * Remove removes a single cron job by its id.
+   */
+  remove(jobId: string): void
+ }
+ interface Cron {
+  /**
+   * RemoveAll removes all registered cron jobs.
+   */
+  removeAll(): void
+ }
+ interface Cron {
+  /**
+   * Total returns the current total number of registered cron jobs.
+   */
+  total(): number
+ }
+ interface Cron {
+  /**
+   * Jobs returns a shallow copy of the currently registered cron jobs.
+   */
+  jobs(): Array<(Job | undefined)>
+ }
+ interface Cron {
+  /**
+   * Stop stops the current cron ticker (if not already).
+   * 
+   * You can resume the ticker by calling Start().
+   */
+  stop(): void
+ }
+ interface Cron {
+  /**
+   * Start starts the cron ticker.
+   * 
+   * Calling Start() on already started cron will restart the ticker.
+   */
+  start(): void
+ }
+ interface Cron {
+  /**
+   * HasStarted checks whether the current Cron ticker has been started.
+   */
+  hasStarted(): boolean
+ }
+}
+
+/**
+ * Package bufio implements buffered I/O. It wraps an io.Reader or io.Writer
+ * object, creating another object (Reader or Writer) that also implements
+ * the interface but provides buffering and some help for textual I/O.
+ */
+namespace bufio {
+ /**
+  * ReadWriter stores pointers to a [Reader] and a [Writer].
+  * It implements [io.ReadWriter].
+  */
+ type _shkLyDs = Reader&Writer
+ interface ReadWriter extends _shkLyDs {
+ }
+}
+
+/**
+ * Package multipart implements MIME multipart parsing, as defined in RFC
+ * 2046.
+ * 
+ * The implementation is sufficient for HTTP (RFC 2388) and the multipart
+ * bodies generated by popular browsers.
+ * 
+ * # Limits
+ * 
+ * To protect against malicious inputs, this package sets limits on the size
+ * of the MIME data it processes.
+ * 
+ * [Reader.NextPart] and [Reader.NextRawPart] limit the number of headers in a
+ * part to 10000 and [Reader.ReadForm] limits the total number of headers in all
+ * FileHeaders to 10000.
+ * These limits may be adjusted with the GODEBUG=multipartmaxheaders=<values>
+ * setting.
+ * 
+ * Reader.ReadForm further limits the number of parts in a form to 1000.
+ * This limit may be adjusted with the GODEBUG=multipartmaxparts=<value>
+ * setting.
+ */
+namespace multipart {
+ /**
+  * A FileHeader describes a file part of a multipart request.
+  */
+ interface FileHeader {
+  filename: string
+  header: textproto.MIMEHeader
+  size: number
+ }
+ interface FileHeader {
+  /**
+   * Open opens and returns the [FileHeader]'s associated File.
+   */
+  open(): File
+ }
+}
+
+/**
+ * Package http provides HTTP client and server implementations.
+ * 
+ * [Get], [Head], [Post], and [PostForm] make HTTP (or HTTPS) requests:
+ * 
+ * ```
+ * 	resp, err := http.Get("http://example.com/")
+ * 	...
+ * 	resp, err := http.Post("http://example.com/upload", "image/jpeg", &buf)
+ * 	...
+ * 	resp, err := http.PostForm("http://example.com/form",
+ * 		url.Values{"key": {"Value"}, "id": {"123"}})
+ * ```
+ * 
+ * The caller must close the response body when finished with it:
+ * 
+ * ```
+ * 	resp, err := http.Get("http://example.com/")
+ * 	if err != nil {
+ * 		// handle error
+ * 	}
+ * 	defer resp.Body.Close()
+ * 	body, err := io.ReadAll(resp.Body)
+ * 	// ...
+ * ```
+ * 
+ * # Clients and Transports
+ * 
+ * For control over HTTP client headers, redirect policy, and other
+ * settings, create a [Client]:
+ * 
+ * ```
+ * 	client := &http.Client{
+ * 		CheckRedirect: redirectPolicyFunc,
+ * 	}
+ * 
+ * 	resp, err := client.Get("http://example.com")
+ * 	// ...
+ * 
+ * 	req, err := http.NewRequest("GET", "http://example.com", nil)
+ * 	// ...
+ * 	req.Header.Add("If-None-Match", `W/"wyzzy"`)
+ * 	resp, err := client.Do(req)
+ * 	// ...
+ * ```
+ * 
+ * For control over proxies, TLS configuration, keep-alives,
+ * compression, and other settings, create a [Transport]:
+ * 
+ * ```
+ * 	tr := &http.Transport{
+ * 		MaxIdleConns:       10,
+ * 		IdleConnTimeout:    30 * time.Second,
+ * 		DisableCompression: true,
+ * 	}
+ * 	client := &http.Client{Transport: tr}
+ * 	resp, err := client.Get("https://example.com")
+ * ```
+ * 
+ * Clients and Transports are safe for concurrent use by multiple
+ * goroutines and for efficiency should only be created once and re-used.
+ * 
+ * # Servers
+ * 
+ * ListenAndServe starts an HTTP server with a given address and handler.
+ * The handler is usually nil, which means to use [DefaultServeMux].
+ * [Handle] and [HandleFunc] add handlers to [DefaultServeMux]:
+ * 
+ * ```
+ * 	http.Handle("/foo", fooHandler)
+ * 
+ * 	http.HandleFunc("/bar", func(w http.ResponseWriter, r *http.Request) {
+ * 		fmt.Fprintf(w, "Hello, %q", html.EscapeString(r.URL.Path))
+ * 	})
+ * 
+ * 	log.Fatal(http.ListenAndServe(":8080", nil))
+ * ```
+ * 
+ * More control over the server's behavior is available by creating a
+ * custom Server:
+ * 
+ * ```
+ * 	s := &http.Server{
+ * 		Addr:           ":8080",
+ * 		Handler:        myHandler,
+ * 		ReadTimeout:    10 * time.Second,
+ * 		WriteTimeout:   10 * time.Second,
+ * 		MaxHeaderBytes: 1 << 20,
+ * 	}
+ * 	log.Fatal(s.ListenAndServe())
+ * ```
+ * 
+ * # HTTP/2
+ * 
+ * Starting with Go 1.6, the http package has transparent support for the
+ * HTTP/2 protocol when using HTTPS. Programs that must disable HTTP/2
+ * can do so by setting [Transport.TLSNextProto] (for clients) or
+ * [Server.TLSNextProto] (for servers) to a non-nil, empty
+ * map. Alternatively, the following GODEBUG settings are
+ * currently supported:
+ * 
+ * ```
+ * 	GODEBUG=http2client=0  # disable HTTP/2 client support
+ * 	GODEBUG=http2server=0  # disable HTTP/2 server support
+ * 	GODEBUG=http2debug=1   # enable verbose HTTP/2 debug logs
+ * 	GODEBUG=http2debug=2   # ... even more verbose, with frame dumps
+ * ```
+ * 
+ * Please report any issues before disabling HTTP/2 support: https://golang.org/s/http2bug
+ * 
+ * The http package's [Transport] and [Server] both automatically enable
+ * HTTP/2 support for simple configurations. To enable HTTP/2 for more
+ * complex configurations, to use lower-level HTTP/2 features, or to use
+ * a newer version of Go's http2 package, import "golang.org/x/net/http2"
+ * directly and use its ConfigureTransport and/or ConfigureServer
+ * functions. Manually configuring HTTP/2 via the golang.org/x/net/http2
+ * package takes precedence over the net/http package's built-in HTTP/2
+ * support.
+ */
+namespace http {
+ // @ts-ignore
+ import mathrand = rand
+ /**
+  * PushOptions describes options for [Pusher.Push].
+  */
+ interface PushOptions {
+  /**
+   * Method specifies the HTTP method for the promised request.
+   * If set, it must be "GET" or "HEAD". Empty means "GET".
+   */
+  method: string
+  /**
+   * Header specifies additional promised request headers. This cannot
+   * include HTTP/2 pseudo header fields like ":path" and ":scheme",
+   * which will be added automatically.
+   */
+  header: Header
+ }
+ // @ts-ignore
+ import urlpkg = url
+ /**
+  * A Request represents an HTTP request received by a server
+  * or to be sent by a client.
+  * 
+  * The field semantics differ slightly between client and server
+  * usage. In addition to the notes on the fields below, see the
+  * documentation for [Request.Write] and [RoundTripper].
+  */
+ interface Request {
+  /**
+   * Method specifies the HTTP method (GET, POST, PUT, etc.).
+   * For client requests, an empty string means GET.
+   */
+  method: string
+  /**
+   * URL specifies either the URI being requested (for server
+   * requests) or the URL to access (for client requests).
+   * 
+   * For server requests, the URL is parsed from the URI
+   * supplied on the Request-Line as stored in RequestURI.  For
+   * most requests, fields other than Path and RawQuery will be
+   * empty. (See RFC 7230, Section 5.3)
+   * 
+   * For client requests, the URL's Host specifies the server to
+   * connect to, while the Request's Host field optionally
+   * specifies the Host header value to send in the HTTP
+   * request.
+   */
+  url?: url.URL
+  /**
+   * The protocol version for incoming server requests.
+   * 
+   * For client requests, these fields are ignored. The HTTP
+   * client code always uses either HTTP/1.1 or HTTP/2.
+   * See the docs on Transport for details.
+   */
+  proto: string // "HTTP/1.0"
+  protoMajor: number // 1
+  protoMinor: number // 0
+  /**
+   * Header contains the request header fields either received
+   * by the server or to be sent by the client.
+   * 
+   * If a server received a request with header lines,
+   * 
+   * ```
+   * 	Host: example.com
+   * 	accept-encoding: gzip, deflate
+   * 	Accept-Language: en-us
+   * 	fOO: Bar
+   * 	foo: two
+   * ```
+   * 
+   * then
+   * 
+   * ```
+   * 	Header = map[string][]string{
+   * 		"Accept-Encoding": {"gzip, deflate"},
+   * 		"Accept-Language": {"en-us"},
+   * 		"Foo": {"Bar", "two"},
+   * 	}
+   * ```
+   * 
+   * For incoming requests, the Host header is promoted to the
+   * Request.Host field and removed from the Header map.
+   * 
+   * HTTP defines that header names are case-insensitive. The
+   * request parser implements this by using CanonicalHeaderKey,
+   * making the first character and any characters following a
+   * hyphen uppercase and the rest lowercase.
+   * 
+   * For client requests, certain headers such as Content-Length
+   * and Connection are automatically written when needed and
+   * values in Header may be ignored. See the documentation
+   * for the Request.Write method.
+   */
+  header: Header
+  /**
+   * Body is the request's body.
+   * 
+   * For client requests, a nil body means the request has no
+   * body, such as a GET request. The HTTP Client's Transport
+   * is responsible for calling the Close method.
+   * 
+   * For server requests, the Request Body is always non-nil
+   * but will return EOF immediately when no body is present.
+   * The Server will close the request body. The ServeHTTP
+   * Handler does not need to.
+   * 
+   * Body must allow Read to be called concurrently with Close.
+   * In particular, calling Close should unblock a Read waiting
+   * for input.
+   */
+  body: io.ReadCloser
+  /**
+   * GetBody defines an optional func to return a new copy of
+   * Body. It is used for client requests when a redirect requires
+   * reading the body more than once. Use of GetBody still
+   * requires setting Body.
+   * 
+   * For server requests, it is unused.
+   */
+  getBody: () => io.ReadCloser
+  /**
+   * ContentLength records the length of the associated content.
+   * The value -1 indicates that the length is unknown.
+   * Values >= 0 indicate that the given number of bytes may
+   * be read from Body.
+   * 
+   * For client requests, a value of 0 with a non-nil Body is
+   * also treated as unknown.
+   */
+  contentLength: number
+  /**
+   * TransferEncoding lists the transfer encodings from outermost to
+   * innermost. An empty list denotes the "identity" encoding.
+   * TransferEncoding can usually be ignored; chunked encoding is
+   * automatically added and removed as necessary when sending and
+   * receiving requests.
+   */
+  transferEncoding: Array<string>
+  /**
+   * Close indicates whether to close the connection after
+   * replying to this request (for servers) or after sending this
+   * request and reading its response (for clients).
+   * 
+   * For server requests, the HTTP server handles this automatically
+   * and this field is not needed by Handlers.
+   * 
+   * For client requests, setting this field prevents re-use of
+   * TCP connections between requests to the same hosts, as if
+   * Transport.DisableKeepAlives were set.
+   */
+  close: boolean
+  /**
+   * For server requests, Host specifies the host on which the
+   * URL is sought. For HTTP/1 (per RFC 7230, section 5.4), this
+   * is either the value of the "Host" header or the host name
+   * given in the URL itself. For HTTP/2, it is the value of the
+   * ":authority" pseudo-header field.
+   * It may be of the form "host:port". For international domain
+   * names, Host may be in Punycode or Unicode form. Use
+   * golang.org/x/net/idna to convert it to either format if
+   * needed.
+   * To prevent DNS rebinding attacks, server Handlers should
+   * validate that the Host header has a value for which the
+   * Handler considers itself authoritative. The included
+   * ServeMux supports patterns registered to particular host
+   * names and thus protects its registered Handlers.
+   * 
+   * For client requests, Host optionally overrides the Host
+   * header to send. If empty, the Request.Write method uses
+   * the value of URL.Host. Host may contain an international
+   * domain name.
+   */
+  host: string
+  /**
+   * Form contains the parsed form data, including both the URL
+   * field's query parameters and the PATCH, POST, or PUT form data.
+   * This field is only available after ParseForm is called.
+   * The HTTP client ignores Form and uses Body instead.
+   */
+  form: url.Values
+  /**
+   * PostForm contains the parsed form data from PATCH, POST
+   * or PUT body parameters.
+   * 
+   * This field is only available after ParseForm is called.
+   * The HTTP client ignores PostForm and uses Body instead.
+   */
+  postForm: url.Values
+  /**
+   * MultipartForm is the parsed multipart form, including file uploads.
+   * This field is only available after ParseMultipartForm is called.
+   * The HTTP client ignores MultipartForm and uses Body instead.
+   */
+  multipartForm?: multipart.Form
+  /**
+   * Trailer specifies additional headers that are sent after the request
+   * body.
+   * 
+   * For server requests, the Trailer map initially contains only the
+   * trailer keys, with nil values. (The client declares which trailers it
+   * will later send.)  While the handler is reading from Body, it must
+   * not reference Trailer. After reading from Body returns EOF, Trailer
+   * can be read again and will contain non-nil values, if they were sent
+   * by the client.
+   * 
+   * For client requests, Trailer must be initialized to a map containing
+   * the trailer keys to later send. The values may be nil or their final
+   * values. The ContentLength must be 0 or -1, to send a chunked request.
+   * After the HTTP request is sent the map values can be updated while
+   * the request body is read. Once the body returns EOF, the caller must
+   * not mutate Trailer.
+   * 
+   * Few HTTP clients, servers, or proxies support HTTP trailers.
+   */
+  trailer: Header
+  /**
+   * RemoteAddr allows HTTP servers and other software to record
+   * the network address that sent the request, usually for
+   * logging. This field is not filled in by ReadRequest and
+   * has no defined format. The HTTP server in this package
+   * sets RemoteAddr to an "IP:port" address before invoking a
+   * handler.
+   * This field is ignored by the HTTP client.
+   */
+  remoteAddr: string
+  /**
+   * RequestURI is the unmodified request-target of the
+   * Request-Line (RFC 7230, Section 3.1.1) as sent by the client
+   * to a server. Usually the URL field should be used instead.
+   * It is an error to set this field in an HTTP client request.
+   */
+  requestURI: string
+  /**
+   * TLS allows HTTP servers and other software to record
+   * information about the TLS connection on which the request
+   * was received. This field is not filled in by ReadRequest.
+   * The HTTP server in this package sets the field for
+   * TLS-enabled connections before invoking a handler;
+   * otherwise it leaves the field nil.
+   * This field is ignored by the HTTP client.
+   */
+  tls?: any
+  /**
+   * Cancel is an optional channel whose closure indicates that the client
+   * request should be regarded as canceled. Not all implementations of
+   * RoundTripper may support Cancel.
+   * 
+   * For server requests, this field is not applicable.
+   * 
+   * Deprecated: Set the Request's context with NewRequestWithContext
+   * instead. If a Request's Cancel field and context are both
+   * set, it is undefined whether Cancel is respected.
+   */
+  cancel: undefined
+  /**
+   * Response is the redirect response which caused this request
+   * to be created. This field is only populated during client
+   * redirects.
+   */
+  response?: Response
+  /**
+   * Pattern is the [ServeMux] pattern that matched the request.
+   * It is empty if the request was not matched against a pattern.
+   */
+  pattern: string
+ }
+ interface Request {
+  /**
+   * Context returns the request's context. To change the context, use
+   * [Request.Clone] or [Request.WithContext].
+   * 
+   * The returned context is always non-nil; it defaults to the
+   * background context.
+   * 
+   * For outgoing client requests, the context controls cancellation.
+   * 
+   * For incoming server requests, the context is canceled when the
+   * client's connection closes, the request is canceled (with HTTP/2),
+   * or when the ServeHTTP method returns.
+   */
+  context(): context.Context
+ }
+ interface Request {
+  /**
+   * WithContext returns a shallow copy of r with its context changed
+   * to ctx. The provided ctx must be non-nil.
+   * 
+   * For outgoing client request, the context controls the entire
+   * lifetime of a request and its response: obtaining a connection,
+   * sending the request, and reading the response headers and body.
+   * 
+   * To create a new request with a context, use [NewRequestWithContext].
+   * To make a deep copy of a request with a new context, use [Request.Clone].
+   */
+  withContext(ctx: context.Context): (Request)
+ }
+ interface Request {
+  /**
+   * Clone returns a deep copy of r with its context changed to ctx.
+   * The provided ctx must be non-nil.
+   * 
+   * Clone only makes a shallow copy of the Body field.
+   * 
+   * For an outgoing client request, the context controls the entire
+   * lifetime of a request and its response: obtaining a connection,
+   * sending the request, and reading the response headers and body.
+   */
+  clone(ctx: context.Context): (Request)
+ }
+ interface Request {
+  /**
+   * ProtoAtLeast reports whether the HTTP protocol used
+   * in the request is at least major.minor.
+   */
+  protoAtLeast(major: number, minor: number): boolean
+ }
+ interface Request {
+  /**
+   * UserAgent returns the client's User-Agent, if sent in the request.
+   */
+  userAgent(): string
+ }
+ interface Request {
+  /**
+   * Cookies parses and returns the HTTP cookies sent with the request.
+   */
+  cookies(): Array<(Cookie | undefined)>
+ }
+ interface Request {
+  /**
+   * CookiesNamed parses and returns the named HTTP cookies sent with the request
+   * or an empty slice if none matched.
+   */
+  cookiesNamed(name: string): Array<(Cookie | undefined)>
+ }
+ interface Request {
+  /**
+   * Cookie returns the named cookie provided in the request or
+   * [ErrNoCookie] if not found.
+   * If multiple cookies match the given name, only one cookie will
+   * be returned.
+   */
+  cookie(name: string): (Cookie)
+ }
+ interface Request {
+  /**
+   * AddCookie adds a cookie to the request. Per RFC 6265 section 5.4,
+   * AddCookie does not attach more than one [Cookie] header field. That
+   * means all cookies, if any, are written into the same line,
+   * separated by semicolon.
+   * AddCookie only sanitizes c's name and value, and does not sanitize
+   * a Cookie header already present in the request.
+   */
+  addCookie(c: Cookie): void
+ }
+ interface Request {
+  /**
+   * Referer returns the referring URL, if sent in the request.
+   * 
+   * Referer is misspelled as in the request itself, a mistake from the
+   * earliest days of HTTP.  This value can also be fetched from the
+   * [Header] map as Header["Referer"]; the benefit of making it available
+   * as a method is that the compiler can diagnose programs that use the
+   * alternate (correct English) spelling req.Referrer() but cannot
+   * diagnose programs that use Header["Referrer"].
+   */
+  referer(): string
+ }
+ interface Request {
+  /**
+   * MultipartReader returns a MIME multipart reader if this is a
+   * multipart/form-data or a multipart/mixed POST request, else returns nil and an error.
+   * Use this function instead of [Request.ParseMultipartForm] to
+   * process the request body as a stream.
+   */
+  multipartReader(): (multipart.Reader)
+ }
+ interface Request {
+  /**
+   * Write writes an HTTP/1.1 request, which is the header and body, in wire format.
+   * This method consults the following fields of the request:
+   * 
+   * ```
+   * 	Host
+   * 	URL
+   * 	Method (defaults to "GET")
+   * 	Header
+   * 	ContentLength
+   * 	TransferEncoding
+   * 	Body
+   * ```
+   * 
+   * If Body is present, Content-Length is <= 0 and [Request.TransferEncoding]
+   * hasn't been set to "identity", Write adds "Transfer-Encoding:
+   * chunked" to the header. Body is closed after it is sent.
+   */
+  write(w: io.Writer): void
+ }
+ interface Request {
+  /**
+   * WriteProxy is like [Request.Write] but writes the request in the form
+   * expected by an HTTP proxy. In particular, [Request.WriteProxy] writes the
+   * initial Request-URI line of the request with an absolute URI, per
+   * section 5.3 of RFC 7230, including the scheme and host.
+   * In either case, WriteProxy also writes a Host header, using
+   * either r.Host or r.URL.Host.
+   */
+  writeProxy(w: io.Writer): void
+ }
+ interface Request {
+  /**
+   * BasicAuth returns the username and password provided in the request's
+   * Authorization header, if the request uses HTTP Basic Authentication.
+   * See RFC 2617, Section 2.
+   */
+  basicAuth(): [string, string, boolean]
+ }
+ interface Request {
+  /**
+   * SetBasicAuth sets the request's Authorization header to use HTTP
+   * Basic Authentication with the provided username and password.
+   * 
+   * With HTTP Basic Authentication the provided username and password
+   * are not encrypted. It should generally only be used in an HTTPS
+   * request.
+   * 
+   * The username may not contain a colon. Some protocols may impose
+   * additional requirements on pre-escaping the username and
+   * password. For instance, when used with OAuth2, both arguments must
+   * be URL encoded first with [url.QueryEscape].
+   */
+  setBasicAuth(username: string, password: string): void
+ }
+ interface Request {
+  /**
+   * ParseForm populates r.Form and r.PostForm.
+   * 
+   * For all requests, ParseForm parses the raw query from the URL and updates
+   * r.Form.
+   * 
+   * For POST, PUT, and PATCH requests, it also reads the request body, parses it
+   * as a form and puts the results into both r.PostForm and r.Form. Request body
+   * parameters take precedence over URL query string values in r.Form.
+   * 
+   * If the request Body's size has not already been limited by [MaxBytesReader],
+   * the size is capped at 10MB.
+   * 
+   * For other HTTP methods, or when the Content-Type is not
+   * application/x-www-form-urlencoded, the request Body is not read, and
+   * r.PostForm is initialized to a non-nil, empty value.
+   * 
+   * [Request.ParseMultipartForm] calls ParseForm automatically.
+   * ParseForm is idempotent.
+   */
+  parseForm(): void
+ }
+ interface Request {
+  /**
+   * ParseMultipartForm parses a request body as multipart/form-data.
+   * The whole request body is parsed and up to a total of maxMemory bytes of
+   * its file parts are stored in memory, with the remainder stored on
+   * disk in temporary files.
+   * ParseMultipartForm calls [Request.ParseForm] if necessary.
+   * If ParseForm returns an error, ParseMultipartForm returns it but also
+   * continues parsing the request body.
+   * After one call to ParseMultipartForm, subsequent calls have no effect.
+   */
+  parseMultipartForm(maxMemory: number): void
+ }
+ interface Request {
+  /**
+   * FormValue returns the first value for the named component of the query.
+   * The precedence order:
+   *  1. application/x-www-form-urlencoded form body (POST, PUT, PATCH only)
+   *  2. query parameters (always)
+   *  3. multipart/form-data form body (always)
+   * 
+   * FormValue calls [Request.ParseMultipartForm] and [Request.ParseForm]
+   * if necessary and ignores any errors returned by these functions.
+   * If key is not present, FormValue returns the empty string.
+   * To access multiple values of the same key, call ParseForm and
+   * then inspect [Request.Form] directly.
+   */
+  formValue(key: string): string
+ }
+ interface Request {
+  /**
+   * PostFormValue returns the first value for the named component of the POST,
+   * PUT, or PATCH request body. URL query parameters are ignored.
+   * PostFormValue calls [Request.ParseMultipartForm] and [Request.ParseForm] if necessary and ignores
+   * any errors returned by these functions.
+   * If key is not present, PostFormValue returns the empty string.
+   */
+  postFormValue(key: string): string
+ }
+ interface Request {
+  /**
+   * FormFile returns the first file for the provided form key.
+   * FormFile calls [Request.ParseMultipartForm] and [Request.ParseForm] if necessary.
+   */
+  formFile(key: string): [multipart.File, (multipart.FileHeader)]
+ }
+ interface Request {
+  /**
+   * PathValue returns the value for the named path wildcard in the [ServeMux] pattern
+   * that matched the request.
+   * It returns the empty string if the request was not matched against a pattern
+   * or there is no such wildcard in the pattern.
+   */
+  pathValue(name: string): string
+ }
+ interface Request {
+  /**
+   * SetPathValue sets name to value, so that subsequent calls to r.PathValue(name)
+   * return value.
+   */
+  setPathValue(name: string, value: string): void
+ }
+ /**
+  * A Handler responds to an HTTP request.
+  * 
+  * [Handler.ServeHTTP] should write reply headers and data to the [ResponseWriter]
+  * and then return. Returning signals that the request is finished; it
+  * is not valid to use the [ResponseWriter] or read from the
+  * [Request.Body] after or concurrently with the completion of the
+  * ServeHTTP call.
+  * 
+  * Depending on the HTTP client software, HTTP protocol version, and
+  * any intermediaries between the client and the Go server, it may not
+  * be possible to read from the [Request.Body] after writing to the
+  * [ResponseWriter]. Cautious handlers should read the [Request.Body]
+  * first, and then reply.
+  * 
+  * Except for reading the body, handlers should not modify the
+  * provided Request.
+  * 
+  * If ServeHTTP panics, the server (the caller of ServeHTTP) assumes
+  * that the effect of the panic was isolated to the active request.
+  * It recovers the panic, logs a stack trace to the server error log,
+  * and either closes the network connection or sends an HTTP/2
+  * RST_STREAM, depending on the HTTP protocol. To abort a handler so
+  * the client sees an interrupted response but the server doesn't log
+  * an error, panic with the value [ErrAbortHandler].
+  */
+ interface Handler {
+  [key:string]: any;
+  serveHTTP(_arg0: ResponseWriter, _arg1: Request): void
+ }
+ /**
+  * A ResponseWriter interface is used by an HTTP handler to
+  * construct an HTTP response.
+  * 
+  * A ResponseWriter may not be used after [Handler.ServeHTTP] has returned.
+  */
+ interface ResponseWriter {
+  [key:string]: any;
+  /**
+   * Header returns the header map that will be sent by
+   * [ResponseWriter.WriteHeader]. The [Header] map also is the mechanism with which
+   * [Handler] implementations can set HTTP trailers.
+   * 
+   * Changing the header map after a call to [ResponseWriter.WriteHeader] (or
+   * [ResponseWriter.Write]) has no effect unless the HTTP status code was of the
+   * 1xx class or the modified headers are trailers.
+   * 
+   * There are two ways to set Trailers. The preferred way is to
+   * predeclare in the headers which trailers you will later
+   * send by setting the "Trailer" header to the names of the
+   * trailer keys which will come later. In this case, those
+   * keys of the Header map are treated as if they were
+   * trailers. See the example. The second way, for trailer
+   * keys not known to the [Handler] until after the first [ResponseWriter.Write],
+   * is to prefix the [Header] map keys with the [TrailerPrefix]
+   * constant value.
+   * 
+   * To suppress automatic response headers (such as "Date"), set
+   * their value to nil.
+   */
+  header(): Header
+  /**
+   * Write writes the data to the connection as part of an HTTP reply.
+   * 
+   * If [ResponseWriter.WriteHeader] has not yet been called, Write calls
+   * WriteHeader(http.StatusOK) before writing the data. If the Header
+   * does not contain a Content-Type line, Write adds a Content-Type set
+   * to the result of passing the initial 512 bytes of written data to
+   * [DetectContentType]. Additionally, if the total size of all written
+   * data is under a few KB and there are no Flush calls, the
+   * Content-Length header is added automatically.
+   * 
+   * Depending on the HTTP protocol version and the client, calling
+   * Write or WriteHeader may prevent future reads on the
+   * Request.Body. For HTTP/1.x requests, handlers should read any
+   * needed request body data before writing the response. Once the
+   * headers have been flushed (due to either an explicit Flusher.Flush
+   * call or writing enough data to trigger a flush), the request body
+   * may be unavailable. For HTTP/2 requests, the Go HTTP server permits
+   * handlers to continue to read the request body while concurrently
+   * writing the response. However, such behavior may not be supported
+   * by all HTTP/2 clients. Handlers should read before writing if
+   * possible to maximize compatibility.
+   */
+  write(_arg0: string|Array<number>): number
+  /**
+   * WriteHeader sends an HTTP response header with the provided
+   * status code.
+   * 
+   * If WriteHeader is not called explicitly, the first call to Write
+   * will trigger an implicit WriteHeader(http.StatusOK).
+   * Thus explicit calls to WriteHeader are mainly used to
+   * send error codes or 1xx informational responses.
+   * 
+   * The provided code must be a valid HTTP 1xx-5xx status code.
+   * Any number of 1xx headers may be written, followed by at most
+   * one 2xx-5xx header. 1xx headers are sent immediately, but 2xx-5xx
+   * headers may be buffered. Use the Flusher interface to send
+   * buffered data. The header map is cleared when 2xx-5xx headers are
+   * sent, but not with 1xx headers.
+   * 
+   * The server will automatically send a 100 (Continue) header
+   * on the first read from the request body if the request has
+   * an "Expect: 100-continue" header.
+   */
+  writeHeader(statusCode: number): void
+ }
+ /**
+  * A Server defines parameters for running an HTTP server.
+  * The zero value for Server is a valid configuration.
+  */
+ interface Server {
+  /**
+   * Addr optionally specifies the TCP address for the server to listen on,
+   * in the form "host:port". If empty, ":http" (port 80) is used.
+   * The service names are defined in RFC 6335 and assigned by IANA.
+   * See net.Dial for details of the address format.
+   */
+  addr: string
+  handler: Handler // handler to invoke, http.DefaultServeMux if nil
+  /**
+   * DisableGeneralOptionsHandler, if true, passes "OPTIONS *" requests to the Handler,
+   * otherwise responds with 200 OK and Content-Length: 0.
+   */
+  disableGeneralOptionsHandler: boolean
+  /**
+   * TLSConfig optionally provides a TLS configuration for use
+   * by ServeTLS and ListenAndServeTLS. Note that this value is
+   * cloned by ServeTLS and ListenAndServeTLS, so it's not
+   * possible to modify the configuration with methods like
+   * tls.Config.SetSessionTicketKeys. To use
+   * SetSessionTicketKeys, use Server.Serve with a TLS Listener
+   * instead.
+   */
+  tlsConfig?: any
+  /**
+   * ReadTimeout is the maximum duration for reading the entire
+   * request, including the body. A zero or negative value means
+   * there will be no timeout.
+   * 
+   * Because ReadTimeout does not let Handlers make per-request
+   * decisions on each request body's acceptable deadline or
+   * upload rate, most users will prefer to use
+   * ReadHeaderTimeout. It is valid to use them both.
+   */
+  readTimeout: time.Duration
+  /**
+   * ReadHeaderTimeout is the amount of time allowed to read
+   * request headers. The connection's read deadline is reset
+   * after reading the headers and the Handler can decide what
+   * is considered too slow for the body. If zero, the value of
+   * ReadTimeout is used. If negative, or if zero and ReadTimeout
+   * is zero or negative, there is no timeout.
+   */
+  readHeaderTimeout: time.Duration
+  /**
+   * WriteTimeout is the maximum duration before timing out
+   * writes of the response. It is reset whenever a new
+   * request's header is read. Like ReadTimeout, it does not
+   * let Handlers make decisions on a per-request basis.
+   * A zero or negative value means there will be no timeout.
+   */
+  writeTimeout: time.Duration
+  /**
+   * IdleTimeout is the maximum amount of time to wait for the
+   * next request when keep-alives are enabled. If zero, the value
+   * of ReadTimeout is used. If negative, or if zero and ReadTimeout
+   * is zero or negative, there is no timeout.
+   */
+  idleTimeout: time.Duration
+  /**
+   * MaxHeaderBytes controls the maximum number of bytes the
+   * server will read parsing the request header's keys and
+   * values, including the request line. It does not limit the
+   * size of the request body.
+   * If zero, DefaultMaxHeaderBytes is used.
+   */
+  maxHeaderBytes: number
+  /**
+   * TLSNextProto optionally specifies a function to take over
+   * ownership of the provided TLS connection when an ALPN
+   * protocol upgrade has occurred. The map key is the protocol
+   * name negotiated. The Handler argument should be used to
+   * handle HTTP requests and will initialize the Request's TLS
+   * and RemoteAddr if not already set. The connection is
+   * automatically closed when the function returns.
+   * If TLSNextProto is not nil, HTTP/2 support is not enabled
+   * automatically.
+   */
+  tlsNextProto: _TygojaDict
+  /**
+   * ConnState specifies an optional callback function that is
+   * called when a client connection changes state. See the
+   * ConnState type and associated constants for details.
+   */
+  connState: (_arg0: net.Conn, _arg1: ConnState) => void
+  /**
+   * ErrorLog specifies an optional logger for errors accepting
+   * connections, unexpected behavior from handlers, and
+   * underlying FileSystem errors.
+   * If nil, logging is done via the log package's standard logger.
+   */
+  errorLog?: any
+  /**
+   * BaseContext optionally specifies a function that returns
+   * the base context for incoming requests on this server.
+   * The provided Listener is the specific Listener that's
+   * about to start accepting requests.
+   * If BaseContext is nil, the default is context.Background().
+   * If non-nil, it must return a non-nil context.
+   */
+  baseContext: (_arg0: net.Listener) => context.Context
+  /**
+   * ConnContext optionally specifies a function that modifies
+   * the context used for a new connection c. The provided ctx
+   * is derived from the base context and has a ServerContextKey
+   * value.
+   */
+  connContext: (ctx: context.Context, c: net.Conn) => context.Context
+  /**
+   * HTTP2 configures HTTP/2 connections.
+   * 
+   * This field does not yet have any effect.
+   * See https://go.dev/issue/67813.
+   */
+  http2?: HTTP2Config
+  /**
+   * Protocols is the set of protocols accepted by the server.
+   * 
+   * If Protocols includes UnencryptedHTTP2, the server will accept
+   * unencrypted HTTP/2 connections. The server can serve both
+   * HTTP/1 and unencrypted HTTP/2 on the same address and port.
+   * 
+   * If Protocols is nil, the default is usually HTTP/1 and HTTP/2.
+   * If TLSNextProto is non-nil and does not contain an "h2" entry,
+   * the default is HTTP/1 only.
+   */
+  protocols?: Protocols
+ }
+ interface Server {
+  /**
+   * Close immediately closes all active net.Listeners and any
+   * connections in state [StateNew], [StateActive], or [StateIdle]. For a
+   * graceful shutdown, use [Server.Shutdown].
+   * 
+   * Close does not attempt to close (and does not even know about)
+   * any hijacked connections, such as WebSockets.
+   * 
+   * Close returns any error returned from closing the [Server]'s
+   * underlying Listener(s).
+   */
+  close(): void
+ }
+ interface Server {
+  /**
+   * Shutdown gracefully shuts down the server without interrupting any
+   * active connections. Shutdown works by first closing all open
+   * listeners, then closing all idle connections, and then waiting
+   * indefinitely for connections to return to idle and then shut down.
+   * If the provided context expires before the shutdown is complete,
+   * Shutdown returns the context's error, otherwise it returns any
+   * error returned from closing the [Server]'s underlying Listener(s).
+   * 
+   * When Shutdown is called, [Serve], [ListenAndServe], and
+   * [ListenAndServeTLS] immediately return [ErrServerClosed]. Make sure the
+   * program doesn't exit and waits instead for Shutdown to return.
+   * 
+   * Shutdown does not attempt to close nor wait for hijacked
+   * connections such as WebSockets. The caller of Shutdown should
+   * separately notify such long-lived connections of shutdown and wait
+   * for them to close, if desired. See [Server.RegisterOnShutdown] for a way to
+   * register shutdown notification functions.
+   * 
+   * Once Shutdown has been called on a server, it may not be reused;
+   * future calls to methods such as Serve will return ErrServerClosed.
+   */
+  shutdown(ctx: context.Context): void
+ }
+ interface Server {
+  /**
+   * RegisterOnShutdown registers a function to call on [Server.Shutdown].
+   * This can be used to gracefully shutdown connections that have
+   * undergone ALPN protocol upgrade or that have been hijacked.
+   * This function should start protocol-specific graceful shutdown,
+   * but should not wait for shutdown to complete.
+   */
+  registerOnShutdown(f: () => void): void
+ }
+ interface Server {
+  /**
+   * ListenAndServe listens on the TCP network address s.Addr and then
+   * calls [Serve] to handle requests on incoming connections.
+   * Accepted connections are configured to enable TCP keep-alives.
+   * 
+   * If s.Addr is blank, ":http" is used.
+   * 
+   * ListenAndServe always returns a non-nil error. After [Server.Shutdown] or [Server.Close],
+   * the returned error is [ErrServerClosed].
+   */
+  listenAndServe(): void
+ }
+ interface Server {
+  /**
+   * Serve accepts incoming connections on the Listener l, creating a
+   * new service goroutine for each. The service goroutines read requests and
+   * then call s.Handler to reply to them.
+   * 
+   * HTTP/2 support is only enabled if the Listener returns [*tls.Conn]
+   * connections and they were configured with "h2" in the TLS
+   * Config.NextProtos.
+   * 
+   * Serve always returns a non-nil error and closes l.
+   * After [Server.Shutdown] or [Server.Close], the returned error is [ErrServerClosed].
+   */
+  serve(l: net.Listener): void
+ }
+ interface Server {
+  /**
+   * ServeTLS accepts incoming connections on the Listener l, creating a
+   * new service goroutine for each. The service goroutines perform TLS
+   * setup and then read requests, calling s.Handler to reply to them.
+   * 
+   * Files containing a certificate and matching private key for the
+   * server must be provided if neither the [Server]'s
+   * TLSConfig.Certificates, TLSConfig.GetCertificate nor
+   * config.GetConfigForClient are populated.
+   * If the certificate is signed by a certificate authority, the
+   * certFile should be the concatenation of the server's certificate,
+   * any intermediates, and the CA's certificate.
+   * 
+   * ServeTLS always returns a non-nil error. After [Server.Shutdown] or [Server.Close], the
+   * returned error is [ErrServerClosed].
+   */
+  serveTLS(l: net.Listener, certFile: string, keyFile: string): void
+ }
+ interface Server {
+  /**
+   * SetKeepAlivesEnabled controls whether HTTP keep-alives are enabled.
+   * By default, keep-alives are always enabled. Only very
+   * resource-constrained environments or servers in the process of
+   * shutting down should disable them.
+   */
+  setKeepAlivesEnabled(v: boolean): void
+ }
+ interface Server {
+  /**
+   * ListenAndServeTLS listens on the TCP network address s.Addr and
+   * then calls [ServeTLS] to handle requests on incoming TLS connections.
+   * Accepted connections are configured to enable TCP keep-alives.
+   * 
+   * Filenames containing a certificate and matching private key for the
+   * server must be provided if neither the [Server]'s TLSConfig.Certificates
+   * nor TLSConfig.GetCertificate are populated. If the certificate is
+   * signed by a certificate authority, the certFile should be the
+   * concatenation of the server's certificate, any intermediates, and
+   * the CA's certificate.
+   * 
+   * If s.Addr is blank, ":https" is used.
+   * 
+   * ListenAndServeTLS always returns a non-nil error. After [Server.Shutdown] or
+   * [Server.Close], the returned error is [ErrServerClosed].
+   */
+  listenAndServeTLS(certFile: string, keyFile: string): void
+ }
+}
+
+/**
+ * Package blob defines a lightweight abstration for interacting with
+ * various storage services (local filesystem, S3, etc.).
+ * 
+ * NB!
+ * For compatibility with earlier PocketBase versions and to prevent
+ * unnecessary breaking changes, this package is based and implemented
+ * as a minimal, stripped down version of the previously used gocloud.dev/blob.
+ * While there is no promise that it won't diverge in the future to accommodate
+ * better some PocketBase specific use cases, currently it copies and
+ * tries to follow as close as possible the same implementations,
+ * conventions and rules for the key escaping/unescaping, blob read/write
+ * interfaces and struct options as gocloud.dev/blob, therefore the
+ * credits goes to the original Go Cloud Development Kit Authors.
+ */
+namespace blob {
+ /**
+  * ListObject represents a single blob returned from List.
+  */
+ interface ListObject {
+  /**
+   * Key is the key for this blob.
+   */
+  key: string
+  /**
+   * ModTime is the time the blob was last modified.
+   */
+  modTime: time.Time
+  /**
+   * Size is the size of the blob's content in bytes.
+   */
+  size: number
+  /**
+   * MD5 is an MD5 hash of the blob contents or nil if not available.
+   */
+  md5: string|Array<number>
+  /**
+   * IsDir indicates that this result represents a "directory" in the
+   * hierarchical namespace, ending in ListOptions.Delimiter. Key can be
+   * passed as ListOptions.Prefix to list items in the "directory".
+   * Fields other than Key and IsDir will not be set if IsDir is true.
+   */
+  isDir: boolean
+ }
+ /**
+  * Attributes contains attributes about a blob.
+  */
+ interface Attributes {
+  /**
+   * CacheControl specifies caching attributes that services may use
+   * when serving the blob.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
+   */
+  cacheControl: string
+  /**
+   * ContentDisposition specifies whether the blob content is expected to be
+   * displayed inline or as an attachment.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
+   */
+  contentDisposition: string
+  /**
+   * ContentEncoding specifies the encoding used for the blob's content, if any.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
+   */
+  contentEncoding: string
+  /**
+   * ContentLanguage specifies the language used in the blob's content, if any.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
+   */
+  contentLanguage: string
+  /**
+   * ContentType is the MIME type of the blob. It will not be empty.
+   * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+   */
+  contentType: string
+  /**
+   * Metadata holds key/value pairs associated with the blob.
+   * Keys are guaranteed to be in lowercase, even if the backend service
+   * has case-sensitive keys (although note that Metadata written via
+   * this package will always be lowercased). If there are duplicate
+   * case-insensitive keys (e.g., "foo" and "FOO"), only one value
+   * will be kept, and it is undefined which one.
+   */
+  metadata: _TygojaDict
+  /**
+   * CreateTime is the time the blob was created, if available. If not available,
+   * CreateTime will be the zero time.
+   */
+  createTime: time.Time
+  /**
+   * ModTime is the time the blob was last modified.
+   */
+  modTime: time.Time
+  /**
+   * Size is the size of the blob's content in bytes.
+   */
+  size: number
+  /**
+   * MD5 is an MD5 hash of the blob contents or nil if not available.
+   */
+  md5: string|Array<number>
+  /**
+   * ETag for the blob; see https://en.wikipedia.org/wiki/HTTP_ETag.
+   */
+  eTag: string
+ }
+ /**
+  * Reader reads bytes from a blob.
+  * It implements io.ReadSeekCloser, and must be closed after reads are finished.
+  */
+ interface Reader {
+ }
+ interface Reader {
+  /**
+   * Read implements io.Reader (https://golang.org/pkg/io/#Reader).
+   */
+  read(p: string|Array<number>): number
+ }
+ interface Reader {
+  /**
+   * Seek implements io.Seeker (https://golang.org/pkg/io/#Seeker).
+   */
+  seek(offset: number, whence: number): number
+ }
+ interface Reader {
+  /**
+   * Close implements io.Closer (https://golang.org/pkg/io/#Closer).
+   */
+  close(): void
+ }
+ interface Reader {
+  /**
+   * ContentType returns the MIME type of the blob.
+   */
+  contentType(): string
+ }
+ interface Reader {
+  /**
+   * ModTime returns the time the blob was last modified.
+   */
+  modTime(): time.Time
+ }
+ interface Reader {
+  /**
+   * Size returns the size of the blob content in bytes.
+   */
+  size(): number
+ }
+ interface Reader {
+  /**
+   * WriteTo reads from r and writes to w until there's no more data or
+   * an error occurs.
+   * The return value is the number of bytes written to w.
+   * 
+   * It implements the io.WriterTo interface.
+   */
+  writeTo(w: io.Writer): number
+ }
+}
+
+/**
+ * Package syntax parses regular expressions into parse trees and compiles
+ * parse trees into programs. Most clients of regular expressions will use the
+ * facilities of package [regexp] (such as [regexp.Compile] and [regexp.Match]) instead of this package.
+ * 
+ * # Syntax
+ * 
+ * The regular expression syntax understood by this package when parsing with the [Perl] flag is as follows.
+ * Parts of the syntax can be disabled by passing alternate flags to [Parse].
+ * 
+ * Single characters:
+ * 
+ * ```
+ * 	.              any character, possibly including newline (flag s=true)
+ * 	[xyz]          character class
+ * 	[^xyz]         negated character class
+ * 	\d             Perl character class
+ * 	\D             negated Perl character class
+ * 	[[:alpha:]]    ASCII character class
+ * 	[[:^alpha:]]   negated ASCII character class
+ * 	\pN            Unicode character class (one-letter name)
+ * 	\p{Greek}      Unicode character class
+ * 	\PN            negated Unicode character class (one-letter name)
+ * 	\P{Greek}      negated Unicode character class
+ * ```
+ * 
+ * Composites:
+ * 
+ * ```
+ * 	xy             x followed by y
+ * 	x|y            x or y (prefer x)
+ * ```
+ * 
+ * Repetitions:
+ * 
+ * ```
+ * 	x*             zero or more x, prefer more
+ * 	x+             one or more x, prefer more
+ * 	x?             zero or one x, prefer one
+ * 	x{n,m}         n or n+1 or ... or m x, prefer more
+ * 	x{n,}          n or more x, prefer more
+ * 	x{n}           exactly n x
+ * 	x*?            zero or more x, prefer fewer
+ * 	x+?            one or more x, prefer fewer
+ * 	x??            zero or one x, prefer zero
+ * 	x{n,m}?        n or n+1 or ... or m x, prefer fewer
+ * 	x{n,}?         n or more x, prefer fewer
+ * 	x{n}?          exactly n x
+ * ```
+ * 
+ * Implementation restriction: The counting forms x{n,m}, x{n,}, and x{n}
+ * reject forms that create a minimum or maximum repetition count above 1000.
+ * Unlimited repetitions are not subject to this restriction.
+ * 
+ * Grouping:
+ * 
+ * ```
+ * 	(re)           numbered capturing group (submatch)
+ * 	(?P<name>re)   named & numbered capturing group (submatch)
+ * 	(?<name>re)    named & numbered capturing group (submatch)
+ * 	(?:re)         non-capturing group
+ * 	(?flags)       set flags within current group; non-capturing
+ * 	(?flags:re)    set flags during re; non-capturing
+ * 
+ * 	Flag syntax is xyz (set) or -xyz (clear) or xy-z (set xy, clear z). The flags are:
+ * 
+ * 	i              case-insensitive (default false)
+ * 	m              multi-line mode: ^ and $ match begin/end line in addition to begin/end text (default false)
+ * 	s              let . match \n (default false)
+ * 	U              ungreedy: swap meaning of x* and x*?, x+ and x+?, etc (default false)
+ * ```
+ * 
+ * Empty strings:
+ * 
+ * ```
+ * 	^              at beginning of text or line (flag m=true)
+ * 	$              at end of text (like \z not \Z) or line (flag m=true)
+ * 	\A             at beginning of text
+ * 	\b             at ASCII word boundary (\w on one side and \W, \A, or \z on the other)
+ * 	\B             not at ASCII word boundary
+ * 	\z             at end of text
+ * ```
+ * 
+ * Escape sequences:
+ * 
+ * ```
+ * 	\a             bell (== \007)
+ * 	\f             form feed (== \014)
+ * 	\t             horizontal tab (== \011)
+ * 	\n             newline (== \012)
+ * 	\r             carriage return (== \015)
+ * 	\v             vertical tab character (== \013)
+ * 	\*             literal *, for any punctuation character *
+ * 	\123           octal character code (up to three digits)
+ * 	\x7F           hex character code (exactly two digits)
+ * 	\x{10FFFF}     hex character code
+ * 	\Q...\E        literal text ... even if ... has punctuation
+ * ```
+ * 
+ * Character class elements:
+ * 
+ * ```
+ * 	x              single character
+ * 	A-Z            character range (inclusive)
+ * 	\d             Perl character class
+ * 	[:foo:]        ASCII character class foo
+ * 	\p{Foo}        Unicode character class Foo
+ * 	\pF            Unicode character class F (one-letter name)
+ * ```
+ * 
+ * Named character classes as character class elements:
+ * 
+ * ```
+ * 	[\d]           digits (== \d)
+ * 	[^\d]          not digits (== \D)
+ * 	[\D]           not digits (== \D)
+ * 	[^\D]          not not digits (== \d)
+ * 	[[:name:]]     named ASCII class inside character class (== [:name:])
+ * 	[^[:name:]]    named ASCII class inside negated character class (== [:^name:])
+ * 	[\p{Name}]     named Unicode property inside character class (== \p{Name})
+ * 	[^\p{Name}]    named Unicode property inside negated character class (== \P{Name})
+ * ```
+ * 
+ * Perl character classes (all ASCII-only):
+ * 
+ * ```
+ * 	\d             digits (== [0-9])
+ * 	\D             not digits (== [^0-9])
+ * 	\s             whitespace (== [\t\n\f\r ])
+ * 	\S             not whitespace (== [^\t\n\f\r ])
+ * 	\w             word characters (== [0-9A-Za-z_])
+ * 	\W             not word characters (== [^0-9A-Za-z_])
+ * ```
+ * 
+ * ASCII character classes:
+ * 
+ * ```
+ * 	[[:alnum:]]    alphanumeric (== [0-9A-Za-z])
+ * 	[[:alpha:]]    alphabetic (== [A-Za-z])
+ * 	[[:ascii:]]    ASCII (== [\x00-\x7F])
+ * 	[[:blank:]]    blank (== [\t ])
+ * 	[[:cntrl:]]    control (== [\x00-\x1F\x7F])
+ * 	[[:digit:]]    digits (== [0-9])
+ * 	[[:graph:]]    graphical (== [!-~] == [A-Za-z0-9!"#$%&'()*+,\-./:;<=>?@[\\\]^_`{|}~])
+ * 	[[:lower:]]    lower case (== [a-z])
+ * 	[[:print:]]    printable (== [ -~] == [ [:graph:]])
+ * 	[[:punct:]]    punctuation (== [!-/:-@[-`{-~])
+ * 	[[:space:]]    whitespace (== [\t\n\v\f\r ])
+ * 	[[:upper:]]    upper case (== [A-Z])
+ * 	[[:word:]]     word characters (== [0-9A-Za-z_])
+ * 	[[:xdigit:]]   hex digit (== [0-9A-Fa-f])
+ * ```
+ * 
+ * Unicode character classes are those in [unicode.Categories] and [unicode.Scripts].
+ */
+namespace syntax {
+ /**
+  * Flags control the behavior of the parser and record information about regexp context.
+  */
+ interface Flags extends Number{}
+}
+
+namespace store {
+ /**
+  * Store defines a concurrent safe in memory key-value data store.
+  */
+ interface Store<K,T> {
+ }
+ interface Store<K, T> {
+  /**
+   * Reset clears the store and replaces the store data with a
+   * shallow copy of the provided newData.
+   */
+  reset(newData: _TygojaDict): void
+ }
+ interface Store<K, T> {
+  /**
+   * Length returns the current number of elements in the store.
+   */
+  length(): number
+ }
+ interface Store<K, T> {
+  /**
+   * RemoveAll removes all the existing store entries.
+   */
+  removeAll(): void
+ }
+ interface Store<K, T> {
+  /**
+   * Remove removes a single entry from the store.
+   * 
+   * Remove does nothing if key doesn't exist in the store.
+   */
+  remove(key: K): void
+ }
+ interface Store<K, T> {
+  /**
+   * Has checks if element with the specified key exist or not.
+   */
+  has(key: K): boolean
+ }
+ interface Store<K, T> {
+  /**
+   * Get returns a single element value from the store.
+   * 
+   * If key is not set, the zero T value is returned.
+   */
+  get(key: K): T
+ }
+ interface Store<K, T> {
+  /**
+   * GetOk is similar to Get but returns also a boolean indicating whether the key exists or not.
+   */
+  getOk(key: K): [T, boolean]
+ }
+ interface Store<K, T> {
+  /**
+   * GetAll returns a shallow copy of the current store data.
+   */
+  getAll(): _TygojaDict
+ }
+ interface Store<K, T> {
+  /**
+   * Values returns a slice with all of the current store values.
+   */
+  values(): Array<T>
+ }
+ interface Store<K, T> {
+  /**
+   * Set sets (or overwrite if already exists) a new value for key.
+   */
+  set(key: K, value: T): void
+ }
+ interface Store<K, T> {
+  /**
+   * SetFunc sets (or overwrite if already exists) a new value resolved
+   * from the function callback for the provided key.
+   * 
+   * The function callback receives as argument the old store element value (if exists).
+   * If there is no old store element, the argument will be the T zero value.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	s := store.New[string, int](nil)
+   * 	s.SetFunc("count", func(old int) int {
+   * 	    return old + 1
+   * 	})
+   * ```
+   */
+  setFunc(key: K, fn: (old: T) => T): void
+ }
+ interface Store<K, T> {
+  /**
+   * GetOrSet retrieves a single existing value for the provided key
+   * or stores a new one if it doesn't exist.
+   */
+  getOrSet(key: K, setFunc: () => T): T
+ }
+ interface Store<K, T> {
+  /**
+   * SetIfLessThanLimit sets (or overwrite if already exist) a new value for key.
+   * 
+   * This method is similar to Set() but **it will skip adding new elements**
+   * to the store if the store length has reached the specified limit.
+   * false is returned if maxAllowedElements limit is reached.
+   */
+  setIfLessThanLimit(key: K, value: T, maxAllowedElements: number): boolean
+ }
+ interface Store<K, T> {
+  /**
+   * UnmarshalJSON implements [json.Unmarshaler] and imports the
+   * provided JSON data into the store.
+   * 
+   * The store entries that match with the ones from the data will be overwritten with the new value.
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface Store<K, T> {
+  /**
+   * MarshalJSON implements [json.Marshaler] and export the current
+   * store data into valid JSON.
+   */
+  marshalJSON(): string|Array<number>
+ }
+}
+
+/**
+ * Package jwt is a Go implementation of JSON Web Tokens: http://self-issued.info/docs/draft-jones-json-web-token.html
+ * 
+ * See README.md for more info.
+ */
+namespace jwt {
+ /**
+  * MapClaims is a claims type that uses the map[string]any for JSON
+  * decoding. This is the default claims type if you don't supply one
+  */
+ interface MapClaims extends _TygojaDict{}
+ interface MapClaims {
+  /**
+   * GetExpirationTime implements the Claims interface.
+   */
+  getExpirationTime(): (NumericDate)
+ }
+ interface MapClaims {
+  /**
+   * GetNotBefore implements the Claims interface.
+   */
+  getNotBefore(): (NumericDate)
+ }
+ interface MapClaims {
+  /**
+   * GetIssuedAt implements the Claims interface.
+   */
+  getIssuedAt(): (NumericDate)
+ }
+ interface MapClaims {
+  /**
+   * GetAudience implements the Claims interface.
+   */
+  getAudience(): ClaimStrings
+ }
+ interface MapClaims {
+  /**
+   * GetIssuer implements the Claims interface.
+   */
+  getIssuer(): string
+ }
+ interface MapClaims {
+  /**
+   * GetSubject implements the Claims interface.
+   */
+  getSubject(): string
+ }
+}
+
+namespace hook {
+ /**
+  * Event implements [Resolver] and it is intended to be used as a base
+  * Hook event that you can embed in your custom typed event structs.
+  * 
+  * Example:
+  * 
+  * ```
+  * 	type CustomEvent struct {
+  * 		hook.Event
+  * 
+  * 		SomeField int
+  * 	}
+  * ```
+  */
+ interface Event {
+ }
+ interface Event {
+  /**
+   * Next calls the next hook handler.
+   */
+  next(): void
+ }
+ /**
+  * Handler defines a single Hook handler.
+  * Multiple handlers can share the same id.
+  * If Id is not explicitly set it will be autogenerated by Hook.Add and Hook.AddHandler.
+  */
+ interface Handler<T> {
+  /**
+   * Func defines the handler function to execute.
+   * 
+   * Note that users need to call e.Next() in order to proceed with
+   * the execution of the hook chain.
+   */
+  func: (_arg0: T) => void
+  /**
+   * Id is the unique identifier of the handler.
+   * 
+   * It could be used later to remove the handler from a hook via [Hook.Remove].
+   * 
+   * If missing, an autogenerated value will be assigned when adding
+   * the handler to a hook.
+   */
+  id: string
+  /**
+   * Priority allows changing the default exec priority of the handler within a hook.
+   * 
+   * If 0, the handler will be executed in the same order it was registered.
+   */
+  priority: number
+ }
+ /**
+  * Hook defines a generic concurrent safe structure for managing event hooks.
+  * 
+  * When using custom event it must embed the base [hook.Event].
+  * 
+  * Example:
+  * 
+  * ```
+  * 	type CustomEvent struct {
+  * 		hook.Event
+  * 		SomeField int
+  * 	}
+  * 
+  * 	h := Hook[*CustomEvent]{}
+  * 
+  * 	h.BindFunc(func(e *CustomEvent) error {
+  * 		println(e.SomeField)
+  * 
+  * 		return e.Next()
+  * 	})
+  * 
+  * 	h.Trigger(&CustomEvent{ SomeField: 123 })
+  * ```
+  */
+ interface Hook<T> {
+ }
+ interface Hook<T> {
+  /**
+   * Bind registers the provided handler to the current hooks queue.
+   * 
+   * If handler.Id is empty it is updated with autogenerated value.
+   * 
+   * If a handler from the current hook list has Id matching handler.Id
+   * then the old handler is replaced with the new one.
+   */
+  bind(handler: Handler<T>): string
+ }
+ interface Hook<T> {
+  /**
+   * BindFunc is similar to Bind but registers a new handler from just the provided function.
+   * 
+   * The registered handler is added with a default 0 priority and the id will be autogenerated.
+   * 
+   * If you want to register a handler with custom priority or id use the [Hook.Bind] method.
+   */
+  bindFunc(fn: (e: T) => void): string
+ }
+ interface Hook<T> {
+  /**
+   * Unbind removes one or many hook handler by their id.
+   */
+  unbind(...idsToRemove: string[]): void
+ }
+ interface Hook<T> {
+  /**
+   * UnbindAll removes all registered handlers.
+   */
+  unbindAll(): void
+ }
+ interface Hook<T> {
+  /**
+   * Length returns to total number of registered hook handlers.
+   */
+  length(): number
+ }
+ interface Hook<T> {
+  /**
+   * Trigger executes all registered hook handlers one by one
+   * with the specified event as an argument.
+   * 
+   * Optionally, this method allows also to register additional one off
+   * handler funcs that will be temporary appended to the handlers queue.
+   * 
+   * NB! Each hook handler must call event.Next() in order the hook chain to proceed.
+   */
+  trigger(event: T, ...oneOffHandlerFuncs: ((_arg0: T) => void)[]): void
+ }
+ /**
+  * TaggedHook defines a proxy hook which register handlers that are triggered only
+  * if the TaggedHook.tags are empty or includes at least one of the event data tag(s).
+  */
+ type _sNxGjLJ<T> = mainHook<T>
+ interface TaggedHook<T> extends _sNxGjLJ<T> {
+ }
+ interface TaggedHook<T> {
+  /**
+   * CanTriggerOn checks if the current TaggedHook can be triggered with
+   * the provided event data tags.
+   * 
+   * It returns always true if the hook doens't have any tags.
+   */
+  canTriggerOn(tagsToCheck: Array<string>): boolean
+ }
+ interface TaggedHook<T> {
+  /**
+   * Bind registers the provided handler to the current hooks queue.
+   * 
+   * It is similar to [Hook.Bind] with the difference that the handler
+   * function is invoked only if the event data tags satisfy h.CanTriggerOn.
+   */
+  bind(handler: Handler<T>): string
+ }
+ interface TaggedHook<T> {
+  /**
+   * BindFunc registers a new handler with the specified function.
+   * 
+   * It is similar to [Hook.Bind] with the difference that the handler
+   * function is invoked only if the event data tags satisfy h.CanTriggerOn.
+   */
+  bindFunc(fn: (e: T) => void): string
+ }
+}
+
+/**
+ * Package types implements some commonly used db serializable types
+ * like datetime, json, etc.
+ */
+namespace types {
+ /**
+  * DateTime represents a [time.Time] instance in UTC that is wrapped
+  * and serialized using the app default date layout.
+  */
+ interface DateTime {
+ }
+ interface DateTime {
+  /**
+   * Time returns the internal [time.Time] instance.
+   */
+  time(): time.Time
+ }
+ interface DateTime {
+  /**
+   * Add returns a new DateTime based on the current DateTime + the specified duration.
+   */
+  add(duration: time.Duration): DateTime
+ }
+ interface DateTime {
+  /**
+   * Sub returns a [time.Duration] by subtracting the specified DateTime from the current one.
+   * 
+   * If the result exceeds the maximum (or minimum) value that can be stored in a [time.Duration],
+   * the maximum (or minimum) duration will be returned.
+   */
+  sub(u: DateTime): time.Duration
+ }
+ interface DateTime {
+  /**
+   * AddDate returns a new DateTime based on the current one + duration.
+   * 
+   * It follows the same rules as [time.AddDate].
+   */
+  addDate(years: number, months: number, days: number): DateTime
+ }
+ interface DateTime {
+  /**
+   * After reports whether the current DateTime instance is after u.
+   */
+  after(u: DateTime): boolean
+ }
+ interface DateTime {
+  /**
+   * Before reports whether the current DateTime instance is before u.
+   */
+  before(u: DateTime): boolean
+ }
+ interface DateTime {
+  /**
+   * Compare compares the current DateTime instance with u.
+   * If the current instance is before u, it returns -1.
+   * If the current instance is after u, it returns +1.
+   * If they're the same, it returns 0.
+   */
+  compare(u: DateTime): number
+ }
+ interface DateTime {
+  /**
+   * Equal reports whether the current DateTime and u represent the same time instant.
+   * Two DateTime can be equal even if they are in different locations.
+   * For example, 6:00 +0200 and 4:00 UTC are Equal.
+   */
+  equal(u: DateTime): boolean
+ }
+ interface DateTime {
+  /**
+   * Unix returns the current DateTime as a Unix time, aka.
+   * the number of seconds elapsed since January 1, 1970 UTC.
+   */
+  unix(): number
+ }
+ interface DateTime {
+  /**
+   * IsZero checks whether the current DateTime instance has zero time value.
+   */
+  isZero(): boolean
+ }
+ interface DateTime {
+  /**
+   * String serializes the current DateTime instance into a formatted
+   * UTC date string.
+   * 
+   * The zero value is serialized to an empty string.
+   */
+  string(): string
+ }
+ interface DateTime {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface DateTime {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   */
+  unmarshalJSON(b: string|Array<number>): void
+ }
+ interface DateTime {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface DateTime {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current DateTime instance.
+   */
+  scan(value: any): void
+ }
+ /**
+  * GeoPoint defines a struct for storing geo coordinates as serialized json object
+  * (e.g. {lon:0,lat:0}).
+  * 
+  * Note: using object notation and not a plain array to avoid the confusion
+  * as there doesn't seem to be a fixed standard for the coordinates order.
+  */
+ interface GeoPoint {
+  lon: number
+  lat: number
+ }
+ interface GeoPoint {
+  /**
+   * String returns the string representation of the current GeoPoint instance.
+   */
+  string(): string
+ }
+ interface GeoPoint {
+  /**
+   * AsMap implements [core.mapExtractor] and returns a value suitable
+   * to be used in an API rule expression.
+   */
+  asMap(): _TygojaDict
+ }
+ interface GeoPoint {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface GeoPoint {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current GeoPoint instance.
+   * 
+   * The value argument could be nil (no-op), another GeoPoint instance,
+   * map or serialized json object with lat-lon props.
+   */
+  scan(value: any): void
+ }
+ /**
+  * JSONArray defines a slice that is safe for json and db read/write.
+  */
+ interface JSONArray<T> extends Array<T>{}
+ interface JSONArray<T> {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface JSONArray<T> {
+  /**
+   * String returns the string representation of the current json array.
+   */
+  string(): string
+ }
+ interface JSONArray<T> {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface JSONArray<T> {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current JSONArray[T] instance.
+   */
+  scan(value: any): void
+ }
+ /**
+  * JSONMap defines a map that is safe for json and db read/write.
+  */
+ interface JSONMap<T> extends _TygojaDict{}
+ interface JSONMap<T> {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface JSONMap<T> {
+  /**
+   * String returns the string representation of the current json map.
+   */
+  string(): string
+ }
+ interface JSONMap<T> {
+  /**
+   * Get retrieves a single value from the current JSONMap[T].
+   * 
+   * This helper was added primarily to assist the goja integration since custom map types
+   * don't have direct access to the map keys (https://pkg.go.dev/github.com/dop251/goja#hdr-Maps_with_methods).
+   */
+  get(key: string): T
+ }
+ interface JSONMap<T> {
+  /**
+   * Set sets a single value in the current JSONMap[T].
+   * 
+   * This helper was added primarily to assist the goja integration since custom map types
+   * don't have direct access to the map keys (https://pkg.go.dev/github.com/dop251/goja#hdr-Maps_with_methods).
+   */
+  set(key: string, value: T): void
+ }
+ interface JSONMap<T> {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface JSONMap<T> {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current JSONMap[T] instance.
+   */
+  scan(value: any): void
+ }
+ /**
+  * JSONRaw defines a json value type that is safe for db read/write.
+  */
+ interface JSONRaw extends Array<number>{}
+ interface JSONRaw {
+  /**
+   * String returns the current JSONRaw instance as a json encoded string.
+   */
+  string(): string
+ }
+ interface JSONRaw {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface JSONRaw {
+  /**
+   * UnmarshalJSON implements the [json.Unmarshaler] interface.
+   */
+  unmarshalJSON(b: string|Array<number>): void
+ }
+ interface JSONRaw {
+  /**
+   * Value implements the [driver.Valuer] interface.
+   */
+  value(): any
+ }
+ interface JSONRaw {
+  /**
+   * Scan implements [sql.Scanner] interface to scan the provided value
+   * into the current JSONRaw instance.
+   */
+  scan(value: any): void
+ }
+}
+
+namespace search {
+ /**
+  * Result defines the returned search result structure.
+  */
+ interface Result {
+  items: any
+  page: number
+  perPage: number
+  totalItems: number
+  totalPages: number
+ }
+ /**
+  * ResolverResult defines a single FieldResolver.Resolve() successfully parsed result.
+  */
+ interface ResolverResult {
+  /**
+   * Identifier is the plain SQL identifier/column that will be used
+   * in the final db expression as left or right operand.
+   */
+  identifier: string
+  /**
+   * NoCoalesce instructs to not use COALESCE or NULL fallbacks
+   * when building the identifier expression.
+   */
+  noCoalesce: boolean
+  /**
+   * Params is a map with db placeholder->value pairs that will be added
+   * to the query when building both resolved operands/sides in a single expression.
+   */
+  params: dbx.Params
+  /**
+   * MultiMatchSubQuery is an optional sub query expression that will be added
+   * in addition to the combined ResolverResult expression during build.
+   */
+  multiMatchSubQuery: dbx.Expression
+  /**
+   * AfterBuild is an optional function that will be called after building
+   * and combining the result of both resolved operands/sides in a single expression.
+   */
+  afterBuild: (expr: dbx.Expression) => dbx.Expression
+ }
+}
+
+namespace router {
+ // @ts-ignore
+ import validation = ozzo_validation
+ /**
+  * ApiError defines the struct for a basic api error response.
+  */
+ interface ApiError {
+  data: _TygojaDict
+  message: string
+  status: number
+ }
+ interface ApiError {
+  /**
+   * Error makes it compatible with the `error` interface.
+   */
+  error(): string
+ }
+ interface ApiError {
+  /**
+   * RawData returns the unformatted error data (could be an internal error, text, etc.)
+   */
+  rawData(): any
+ }
+ interface ApiError {
+  /**
+   * Is reports whether the current ApiError wraps the target.
+   */
+  is(target: Error): boolean
+ }
+ /**
+  * Event specifies based Route handler event that is usually intended
+  * to be embedded as part of a custom event struct.
+  * 
+  * NB! It is expected that the Response and Request fields are always set.
+  */
+ type _svXjTlX = hook.Event
+ interface Event extends _svXjTlX {
+  response: http.ResponseWriter
+  request?: http.Request
+ }
+ interface Event {
+  /**
+   * Written reports whether the current response has already been written.
+   * 
+   * This method always returns false if e.ResponseWritter doesn't implement the WriteTracker interface
+   * (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+   */
+  written(): boolean
+ }
+ interface Event {
+  /**
+   * Status reports the status code of the current response.
+   * 
+   * This method always returns 0 if e.Response doesn't implement the StatusTracker interface
+   * (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+   */
+  status(): number
+ }
+ interface Event {
+  /**
+   * Flush flushes buffered data to the current response.
+   * 
+   * Returns [http.ErrNotSupported] if e.Response doesn't implement the [http.Flusher] interface
+   * (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+   */
+  flush(): void
+ }
+ interface Event {
+  /**
+   * IsTLS reports whether the connection on which the request was received is TLS.
+   */
+  isTLS(): boolean
+ }
+ interface Event {
+  /**
+   * SetCookie is an alias for [http.SetCookie].
+   * 
+   * SetCookie adds a Set-Cookie header to the current response's headers.
+   * The provided cookie must have a valid Name.
+   * Invalid cookies may be silently dropped.
+   */
+  setCookie(cookie: http.Cookie): void
+ }
+ interface Event {
+  /**
+   * RemoteIP returns the IP address of the client that sent the request.
+   * 
+   * IPv6 addresses are returned expanded.
+   * For example, "2001:db8::1" becomes "2001:0db8:0000:0000:0000:0000:0000:0001".
+   * 
+   * Note that if you are behind reverse proxy(ies), this method returns
+   * the IP of the last connecting proxy.
+   */
+  remoteIP(): string
+ }
+ interface Event {
+  /**
+   * FindUploadedFiles extracts all form files of "key" from a http request
+   * and returns a slice with filesystem.File instances (if any).
+   */
+  findUploadedFiles(key: string): Array<(filesystem.File | undefined)>
+ }
+ interface Event {
+  /**
+   * Get retrieves single value from the current event data store.
+   */
+  get(key: string): any
+ }
+ interface Event {
+  /**
+   * GetAll returns a copy of the current event data store.
+   */
+  getAll(): _TygojaDict
+ }
+ interface Event {
+  /**
+   * Set saves single value into the current event data store.
+   */
+  set(key: string, value: any): void
+ }
+ interface Event {
+  /**
+   * SetAll saves all items from m into the current event data store.
+   */
+  setAll(m: _TygojaDict): void
+ }
+ interface Event {
+  /**
+   * String writes a plain string response.
+   */
+  string(status: number, data: string): void
+ }
+ interface Event {
+  /**
+   * HTML writes an HTML response.
+   */
+  html(status: number, data: string): void
+ }
+ interface Event {
+  /**
+   * JSON writes a JSON response.
+   * 
+   * It also provides a generic response data fields picker if the "fields" query parameter is set.
+   * For example, if you are requesting `?fields=a,b` for `e.JSON(200, map[string]int{ "a":1, "b":2, "c":3 })`,
+   * it should result in a JSON response like: `{"a":1, "b": 2}`.
+   */
+  json(status: number, data: any): void
+ }
+ interface Event {
+  /**
+   * XML writes an XML response.
+   * It automatically prepends the generic [xml.Header] string to the response.
+   */
+  xml(status: number, data: any): void
+ }
+ interface Event {
+  /**
+   * Stream streams the specified reader into the response.
+   */
+  stream(status: number, contentType: string, reader: io.Reader): void
+ }
+ interface Event {
+  /**
+   * Blob writes a blob (bytes slice) response.
+   */
+  blob(status: number, contentType: string, b: string|Array<number>): void
+ }
+ interface Event {
+  /**
+   * FileFS serves the specified filename from fsys.
+   * 
+   * It is similar to [echo.FileFS] for consistency with earlier versions.
+   */
+  fileFS(fsys: fs.FS, filename: string): void
+ }
+ interface Event {
+  /**
+   * NoContent writes a response with no body (ex. 204).
+   */
+  noContent(status: number): void
+ }
+ interface Event {
+  /**
+   * Redirect writes a redirect response to the specified url.
+   * The status code must be in between 300 – 399 range.
+   */
+  redirect(status: number, url: string): void
+ }
+ interface Event {
+  error(status: number, message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  badRequestError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  notFoundError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  forbiddenError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  unauthorizedError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  tooManyRequestsError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  internalServerError(message: string, errData: any): (ApiError)
+ }
+ interface Event {
+  /**
+   * BindBody unmarshal the request body into the provided dst.
+   * 
+   * dst must be either a struct pointer or map[string]any.
+   * 
+   * The rules how the body will be scanned depends on the request Content-Type.
+   * 
+   * Currently the following Content-Types are supported:
+   * ```
+   *   - application/json
+   *   - text/xml, application/xml
+   *   - multipart/form-data, application/x-www-form-urlencoded
+   * ```
+   * 
+   * Respectively the following struct tags are supported (again, which one will be used depends on the Content-Type):
+   * ```
+   *   - "json" (json body)- uses the builtin Go json package for unmarshaling.
+   *   - "xml" (xml body) - uses the builtin Go xml package for unmarshaling.
+   *   - "form" (form data) - utilizes the custom [router.UnmarshalRequestData] method.
+   * ```
+   * 
+   * NB! When dst is a struct make sure that it doesn't have public fields
+   * that shouldn't be bindable and it is advisible such fields to be unexported
+   * or have a separate struct just for the binding. For example:
+   * 
+   * ```
+   * 	data := struct{
+   * 	   somethingPrivate string
+   * 
+   * 	   Title string `json:"title" form:"title"`
+   * 	   Total int    `json:"total" form:"total"`
+   * 	}
+   * 	err := e.BindBody(&data)
+   * ```
+   */
+  bindBody(dst: any): void
+ }
+ /**
+  * Router defines a thin wrapper around the standard Go [http.ServeMux] by
+  * adding support for routing sub-groups, middlewares and other common utils.
+  * 
+  * Example:
+  * 
+  * ```
+  * 	r := NewRouter[*MyEvent](eventFactory)
+  * 
+  * 	// middlewares
+  * 	r.BindFunc(m1, m2)
+  * 
+  * 	// routes
+  * 	r.GET("/test", handler1)
+  * 
+  * 	// sub-routers/groups
+  * 	api := r.Group("/api")
+  * 	api.GET("/admins", handler2)
+  * 
+  * 	// generate a http.ServeMux instance based on the router configurations
+  * 	mux, _ := r.BuildMux()
+  * 
+  * 	http.ListenAndServe("localhost:8090", mux)
+  * ```
+  */
+ type _sPTBpRb<T> = RouterGroup<T>
+ interface Router<T> extends _sPTBpRb<T> {
+ }
+ interface Router<T> {
+  /**
+   * BuildMux constructs a new mux [http.Handler] instance from the current router configurations.
+   */
+  buildMux(): http.Handler
+ }
+}
+
+/**
+ * Package cobra is a commander providing a simple interface to create powerful modern CLI interfaces.
+ * In addition to providing an interface, Cobra simultaneously provides a controller to organize your application code.
+ */
+namespace cobra {
+ interface Command {
+  /**
+   * GenBashCompletion generates bash completion file and writes to the passed writer.
+   */
+  genBashCompletion(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * GenBashCompletionFile generates bash completion file.
+   */
+  genBashCompletionFile(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenBashCompletionFileV2 generates Bash completion version 2.
+   */
+  genBashCompletionFileV2(filename: string, includeDesc: boolean): void
+ }
+ interface Command {
+  /**
+   * GenBashCompletionV2 generates Bash completion file version 2
+   * and writes it to the passed writer.
+   */
+  genBashCompletionV2(w: io.Writer, includeDesc: boolean): void
+ }
+ // @ts-ignore
+ import flag = pflag
+ /**
+  * Command is just that, a command for your application.
+  * E.g.  'go run ...' - 'run' is the command. Cobra requires
+  * you to define the usage and description as part of your command
+  * definition to ensure usability.
+  */
+ interface Command {
+  /**
+   * Use is the one-line usage message.
+   * Recommended syntax is as follows:
+   * ```
+   *   [ ] identifies an optional argument. Arguments that are not enclosed in brackets are required.
+   *   ... indicates that you can specify multiple values for the previous argument.
+   *   |   indicates mutually exclusive information. You can use the argument to the left of the separator or the
+   *       argument to the right of the separator. You cannot use both arguments in a single use of the command.
+   *   { } delimits a set of mutually exclusive arguments when one of the arguments is required. If the arguments are
+   *       optional, they are enclosed in brackets ([ ]).
+   * ```
+   * Example: add [-F file | -D dir]... [-f format] profile
+   */
+  use: string
+  /**
+   * Aliases is an array of aliases that can be used instead of the first word in Use.
+   */
+  aliases: Array<string>
+  /**
+   * SuggestFor is an array of command names for which this command will be suggested -
+   * similar to aliases but only suggests.
+   */
+  suggestFor: Array<string>
+  /**
+   * Short is the short description shown in the 'help' output.
+   */
+  short: string
+  /**
+   * The group id under which this subcommand is grouped in the 'help' output of its parent.
+   */
+  groupID: string
+  /**
+   * Long is the long message shown in the 'help <this-command>' output.
+   */
+  long: string
+  /**
+   * Example is examples of how to use the command.
+   */
+  example: string
+  /**
+   * ValidArgs is list of all valid non-flag arguments that are accepted in shell completions
+   */
+  validArgs: Array<Completion>
+  /**
+   * ValidArgsFunction is an optional function that provides valid non-flag arguments for shell completion.
+   * It is a dynamic version of using ValidArgs.
+   * Only one of ValidArgs and ValidArgsFunction can be used for a command.
+   */
+  validArgsFunction: CompletionFunc
+  /**
+   * Expected arguments
+   */
+  args: PositionalArgs
+  /**
+   * ArgAliases is List of aliases for ValidArgs.
+   * These are not suggested to the user in the shell completion,
+   * but accepted if entered manually.
+   */
+  argAliases: Array<string>
+  /**
+   * BashCompletionFunction is custom bash functions used by the legacy bash autocompletion generator.
+   * For portability with other shells, it is recommended to instead use ValidArgsFunction
+   */
+  bashCompletionFunction: string
+  /**
+   * Deprecated defines, if this command is deprecated and should print this string when used.
+   */
+  deprecated: string
+  /**
+   * Annotations are key/value pairs that can be used by applications to identify or
+   * group commands or set special options.
+   */
+  annotations: _TygojaDict
+  /**
+   * Version defines the version for this command. If this value is non-empty and the command does not
+   * define a "version" flag, a "version" boolean flag will be added to the command and, if specified,
+   * will print content of the "Version" variable. A shorthand "v" flag will also be added if the
+   * command does not define one.
+   */
+  version: string
+  /**
+   * The *Run functions are executed in the following order:
+   * ```
+   *   * PersistentPreRun()
+   *   * PreRun()
+   *   * Run()
+   *   * PostRun()
+   *   * PersistentPostRun()
+   * ```
+   * All functions get the same args, the arguments after the command name.
+   * The *PreRun and *PostRun functions will only be executed if the Run function of the current
+   * command has been declared.
+   * 
+   * PersistentPreRun: children of this command will inherit and execute.
+   */
+  persistentPreRun: (cmd: Command, args: Array<string>) => void
+  /**
+   * PersistentPreRunE: PersistentPreRun but returns an error.
+   */
+  persistentPreRunE: (cmd: Command, args: Array<string>) => void
+  /**
+   * PreRun: children of this command will not inherit.
+   */
+  preRun: (cmd: Command, args: Array<string>) => void
+  /**
+   * PreRunE: PreRun but returns an error.
+   */
+  preRunE: (cmd: Command, args: Array<string>) => void
+  /**
+   * Run: Typically the actual work function. Most commands will only implement this.
+   */
+  run: (cmd: Command, args: Array<string>) => void
+  /**
+   * RunE: Run but returns an error.
+   */
+  runE: (cmd: Command, args: Array<string>) => void
+  /**
+   * PostRun: run after the Run command.
+   */
+  postRun: (cmd: Command, args: Array<string>) => void
+  /**
+   * PostRunE: PostRun but returns an error.
+   */
+  postRunE: (cmd: Command, args: Array<string>) => void
+  /**
+   * PersistentPostRun: children of this command will inherit and execute after PostRun.
+   */
+  persistentPostRun: (cmd: Command, args: Array<string>) => void
+  /**
+   * PersistentPostRunE: PersistentPostRun but returns an error.
+   */
+  persistentPostRunE: (cmd: Command, args: Array<string>) => void
+  /**
+   * FParseErrWhitelist flag parse errors to be ignored
+   */
+  fParseErrWhitelist: FParseErrWhitelist
+  /**
+   * CompletionOptions is a set of options to control the handling of shell completion
+   */
+  completionOptions: CompletionOptions
+  /**
+   * TraverseChildren parses flags on all parents before executing child command.
+   */
+  traverseChildren: boolean
+  /**
+   * Hidden defines, if this command is hidden and should NOT show up in the list of available commands.
+   */
+  hidden: boolean
+  /**
+   * SilenceErrors is an option to quiet errors down stream.
+   */
+  silenceErrors: boolean
+  /**
+   * SilenceUsage is an option to silence usage when an error occurs.
+   */
+  silenceUsage: boolean
+  /**
+   * DisableFlagParsing disables the flag parsing.
+   * If this is true all flags will be passed to the command as arguments.
+   */
+  disableFlagParsing: boolean
+  /**
+   * DisableAutoGenTag defines, if gen tag ("Auto generated by spf13/cobra...")
+   * will be printed by generating docs for this command.
+   */
+  disableAutoGenTag: boolean
+  /**
+   * DisableFlagsInUseLine will disable the addition of [flags] to the usage
+   * line of a command when printing help or generating docs
+   */
+  disableFlagsInUseLine: boolean
+  /**
+   * DisableSuggestions disables the suggestions based on Levenshtein distance
+   * that go along with 'unknown command' messages.
+   */
+  disableSuggestions: boolean
+  /**
+   * SuggestionsMinimumDistance defines minimum levenshtein distance to display suggestions.
+   * Must be > 0.
+   */
+  suggestionsMinimumDistance: number
+ }
+ interface Command {
+  /**
+   * Context returns underlying command context. If command was executed
+   * with ExecuteContext or the context was set with SetContext, the
+   * previously set context will be returned. Otherwise, nil is returned.
+   * 
+   * Notice that a call to Execute and ExecuteC will replace a nil context of
+   * a command with a context.Background, so a background context will be
+   * returned by Context after one of these functions has been called.
+   */
+  context(): context.Context
+ }
+ interface Command {
+  /**
+   * SetContext sets context for the command. This context will be overwritten by
+   * Command.ExecuteContext or Command.ExecuteContextC.
+   */
+  setContext(ctx: context.Context): void
+ }
+ interface Command {
+  /**
+   * SetArgs sets arguments for the command. It is set to os.Args[1:] by default, if desired, can be overridden
+   * particularly useful when testing.
+   */
+  setArgs(a: Array<string>): void
+ }
+ interface Command {
+  /**
+   * SetOutput sets the destination for usage and error messages.
+   * If output is nil, os.Stderr is used.
+   * 
+   * Deprecated: Use SetOut and/or SetErr instead
+   */
+  setOutput(output: io.Writer): void
+ }
+ interface Command {
+  /**
+   * SetOut sets the destination for usage messages.
+   * If newOut is nil, os.Stdout is used.
+   */
+  setOut(newOut: io.Writer): void
+ }
+ interface Command {
+  /**
+   * SetErr sets the destination for error messages.
+   * If newErr is nil, os.Stderr is used.
+   */
+  setErr(newErr: io.Writer): void
+ }
+ interface Command {
+  /**
+   * SetIn sets the source for input data
+   * If newIn is nil, os.Stdin is used.
+   */
+  setIn(newIn: io.Reader): void
+ }
+ interface Command {
+  /**
+   * SetUsageFunc sets usage function. Usage can be defined by application.
+   */
+  setUsageFunc(f: (_arg0: Command) => void): void
+ }
+ interface Command {
+  /**
+   * SetUsageTemplate sets usage template. Can be defined by Application.
+   */
+  setUsageTemplate(s: string): void
+ }
+ interface Command {
+  /**
+   * SetFlagErrorFunc sets a function to generate an error when flag parsing
+   * fails.
+   */
+  setFlagErrorFunc(f: (_arg0: Command, _arg1: Error) => void): void
+ }
+ interface Command {
+  /**
+   * SetHelpFunc sets help function. Can be defined by Application.
+   */
+  setHelpFunc(f: (_arg0: Command, _arg1: Array<string>) => void): void
+ }
+ interface Command {
+  /**
+   * SetHelpCommand sets help command.
+   */
+  setHelpCommand(cmd: Command): void
+ }
+ interface Command {
+  /**
+   * SetHelpCommandGroupID sets the group id of the help command.
+   */
+  setHelpCommandGroupID(groupID: string): void
+ }
+ interface Command {
+  /**
+   * SetCompletionCommandGroupID sets the group id of the completion command.
+   */
+  setCompletionCommandGroupID(groupID: string): void
+ }
+ interface Command {
+  /**
+   * SetHelpTemplate sets help template to be used. Application can use it to set custom template.
+   */
+  setHelpTemplate(s: string): void
+ }
+ interface Command {
+  /**
+   * SetVersionTemplate sets version template to be used. Application can use it to set custom template.
+   */
+  setVersionTemplate(s: string): void
+ }
+ interface Command {
+  /**
+   * SetErrPrefix sets error message prefix to be used. Application can use it to set custom prefix.
+   */
+  setErrPrefix(s: string): void
+ }
+ interface Command {
+  /**
+   * SetGlobalNormalizationFunc sets a normalization function to all flag sets and also to child commands.
+   * The user should not have a cyclic dependency on commands.
+   */
+  setGlobalNormalizationFunc(n: (f: any, name: string) => any): void
+ }
+ interface Command {
+  /**
+   * OutOrStdout returns output to stdout.
+   */
+  outOrStdout(): io.Writer
+ }
+ interface Command {
+  /**
+   * OutOrStderr returns output to stderr
+   */
+  outOrStderr(): io.Writer
+ }
+ interface Command {
+  /**
+   * ErrOrStderr returns output to stderr
+   */
+  errOrStderr(): io.Writer
+ }
+ interface Command {
+  /**
+   * InOrStdin returns input to stdin
+   */
+  inOrStdin(): io.Reader
+ }
+ interface Command {
+  /**
+   * UsageFunc returns either the function set by SetUsageFunc for this command
+   * or a parent, or it returns a default usage function.
+   */
+  usageFunc(): (_arg0: Command) => void
+ }
+ interface Command {
+  /**
+   * Usage puts out the usage for the command.
+   * Used when a user provides invalid input.
+   * Can be defined by user by overriding UsageFunc.
+   */
+  usage(): void
+ }
+ interface Command {
+  /**
+   * HelpFunc returns either the function set by SetHelpFunc for this command
+   * or a parent, or it returns a function with default help behavior.
+   */
+  helpFunc(): (_arg0: Command, _arg1: Array<string>) => void
+ }
+ interface Command {
+  /**
+   * Help puts out the help for the command.
+   * Used when a user calls help [command].
+   * Can be defined by user by overriding HelpFunc.
+   */
+  help(): void
+ }
+ interface Command {
+  /**
+   * UsageString returns usage string.
+   */
+  usageString(): string
+ }
+ interface Command {
+  /**
+   * FlagErrorFunc returns either the function set by SetFlagErrorFunc for this
+   * command or a parent, or it returns a function which returns the original
+   * error.
+   */
+  flagErrorFunc(): (_arg0: Command, _arg1: Error) => void
+ }
+ interface Command {
+  /**
+   * UsagePadding return padding for the usage.
+   */
+  usagePadding(): number
+ }
+ interface Command {
+  /**
+   * CommandPathPadding return padding for the command path.
+   */
+  commandPathPadding(): number
+ }
+ interface Command {
+  /**
+   * NamePadding returns padding for the name.
+   */
+  namePadding(): number
+ }
+ interface Command {
+  /**
+   * UsageTemplate returns usage template for the command.
+   * This function is kept for backwards-compatibility reasons.
+   */
+  usageTemplate(): string
+ }
+ interface Command {
+  /**
+   * HelpTemplate return help template for the command.
+   * This function is kept for backwards-compatibility reasons.
+   */
+  helpTemplate(): string
+ }
+ interface Command {
+  /**
+   * VersionTemplate return version template for the command.
+   * This function is kept for backwards-compatibility reasons.
+   */
+  versionTemplate(): string
+ }
+ interface Command {
+  /**
+   * ErrPrefix return error message prefix for the command
+   */
+  errPrefix(): string
+ }
+ interface Command {
+  /**
+   * Find the target command given the args and command tree
+   * Meant to be run on the highest node. Only searches down.
+   */
+  find(args: Array<string>): [(Command), Array<string>]
+ }
+ interface Command {
+  /**
+   * Traverse the command tree to find the command, and parse args for
+   * each parent.
+   */
+  traverse(args: Array<string>): [(Command), Array<string>]
+ }
+ interface Command {
+  /**
+   * SuggestionsFor provides suggestions for the typedName.
+   */
+  suggestionsFor(typedName: string): Array<string>
+ }
+ interface Command {
+  /**
+   * VisitParents visits all parents of the command and invokes fn on each parent.
+   */
+  visitParents(fn: (_arg0: Command) => void): void
+ }
+ interface Command {
+  /**
+   * Root finds root command.
+   */
+  root(): (Command)
+ }
+ interface Command {
+  /**
+   * ArgsLenAtDash will return the length of c.Flags().Args at the moment
+   * when a -- was found during args parsing.
+   */
+  argsLenAtDash(): number
+ }
+ interface Command {
+  /**
+   * ExecuteContext is the same as Execute(), but sets the ctx on the command.
+   * Retrieve ctx by calling cmd.Context() inside your *Run lifecycle or ValidArgs
+   * functions.
+   */
+  executeContext(ctx: context.Context): void
+ }
+ interface Command {
+  /**
+   * Execute uses the args (os.Args[1:] by default)
+   * and run through the command tree finding appropriate matches
+   * for commands and then corresponding flags.
+   */
+  execute(): void
+ }
+ interface Command {
+  /**
+   * ExecuteContextC is the same as ExecuteC(), but sets the ctx on the command.
+   * Retrieve ctx by calling cmd.Context() inside your *Run lifecycle or ValidArgs
+   * functions.
+   */
+  executeContextC(ctx: context.Context): (Command)
+ }
+ interface Command {
+  /**
+   * ExecuteC executes the command.
+   */
+  executeC(): (Command)
+ }
+ interface Command {
+  validateArgs(args: Array<string>): void
+ }
+ interface Command {
+  /**
+   * ValidateRequiredFlags validates all required flags are present and returns an error otherwise
+   */
+  validateRequiredFlags(): void
+ }
+ interface Command {
+  /**
+   * InitDefaultHelpFlag adds default help flag to c.
+   * It is called automatically by executing the c or by calling help and usage.
+   * If c already has help flag, it will do nothing.
+   */
+  initDefaultHelpFlag(): void
+ }
+ interface Command {
+  /**
+   * InitDefaultVersionFlag adds default version flag to c.
+   * It is called automatically by executing the c.
+   * If c already has a version flag, it will do nothing.
+   * If c.Version is empty, it will do nothing.
+   */
+  initDefaultVersionFlag(): void
+ }
+ interface Command {
+  /**
+   * InitDefaultHelpCmd adds default help command to c.
+   * It is called automatically by executing the c or by calling help and usage.
+   * If c already has help command or c has no subcommands, it will do nothing.
+   */
+  initDefaultHelpCmd(): void
+ }
+ interface Command {
+  /**
+   * ResetCommands delete parent, subcommand and help command from c.
+   */
+  resetCommands(): void
+ }
+ interface Command {
+  /**
+   * Commands returns a sorted slice of child commands.
+   */
+  commands(): Array<(Command | undefined)>
+ }
+ interface Command {
+  /**
+   * AddCommand adds one or more commands to this parent command.
+   */
+  addCommand(...cmds: (Command | undefined)[]): void
+ }
+ interface Command {
+  /**
+   * Groups returns a slice of child command groups.
+   */
+  groups(): Array<(Group | undefined)>
+ }
+ interface Command {
+  /**
+   * AllChildCommandsHaveGroup returns if all subcommands are assigned to a group
+   */
+  allChildCommandsHaveGroup(): boolean
+ }
+ interface Command {
+  /**
+   * ContainsGroup return if groupID exists in the list of command groups.
+   */
+  containsGroup(groupID: string): boolean
+ }
+ interface Command {
+  /**
+   * AddGroup adds one or more command groups to this parent command.
+   */
+  addGroup(...groups: (Group | undefined)[]): void
+ }
+ interface Command {
+  /**
+   * RemoveCommand removes one or more commands from a parent command.
+   */
+  removeCommand(...cmds: (Command | undefined)[]): void
+ }
+ interface Command {
+  /**
+   * Print is a convenience method to Print to the defined output, fallback to Stderr if not set.
+   */
+  print(...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * Println is a convenience method to Println to the defined output, fallback to Stderr if not set.
+   */
+  println(...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * Printf is a convenience method to Printf to the defined output, fallback to Stderr if not set.
+   */
+  printf(format: string, ...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * PrintErr is a convenience method to Print to the defined Err output, fallback to Stderr if not set.
+   */
+  printErr(...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * PrintErrln is a convenience method to Println to the defined Err output, fallback to Stderr if not set.
+   */
+  printErrln(...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * PrintErrf is a convenience method to Printf to the defined Err output, fallback to Stderr if not set.
+   */
+  printErrf(format: string, ...i: {
+   }[]): void
+ }
+ interface Command {
+  /**
+   * CommandPath returns the full path to this command.
+   */
+  commandPath(): string
+ }
+ interface Command {
+  /**
+   * DisplayName returns the name to display in help text. Returns command Name()
+   * If CommandDisplayNameAnnoation is not set
+   */
+  displayName(): string
+ }
+ interface Command {
+  /**
+   * UseLine puts out the full usage for a given command (including parents).
+   */
+  useLine(): string
+ }
+ interface Command {
+  /**
+   * DebugFlags used to determine which flags have been assigned to which commands
+   * and which persist.
+   */
+  debugFlags(): void
+ }
+ interface Command {
+  /**
+   * Name returns the command's name: the first word in the use line.
+   */
+  name(): string
+ }
+ interface Command {
+  /**
+   * HasAlias determines if a given string is an alias of the command.
+   */
+  hasAlias(s: string): boolean
+ }
+ interface Command {
+  /**
+   * CalledAs returns the command name or alias that was used to invoke
+   * this command or an empty string if the command has not been called.
+   */
+  calledAs(): string
+ }
+ interface Command {
+  /**
+   * NameAndAliases returns a list of the command name and all aliases
+   */
+  nameAndAliases(): string
+ }
+ interface Command {
+  /**
+   * HasExample determines if the command has example.
+   */
+  hasExample(): boolean
+ }
+ interface Command {
+  /**
+   * Runnable determines if the command is itself runnable.
+   */
+  runnable(): boolean
+ }
+ interface Command {
+  /**
+   * HasSubCommands determines if the command has children commands.
+   */
+  hasSubCommands(): boolean
+ }
+ interface Command {
+  /**
+   * IsAvailableCommand determines if a command is available as a non-help command
+   * (this includes all non deprecated/hidden commands).
+   */
+  isAvailableCommand(): boolean
+ }
+ interface Command {
+  /**
+   * IsAdditionalHelpTopicCommand determines if a command is an additional
+   * help topic command; additional help topic command is determined by the
+   * fact that it is NOT runnable/hidden/deprecated, and has no sub commands that
+   * are runnable/hidden/deprecated.
+   * Concrete example: https://github.com/spf13/cobra/issues/393#issuecomment-282741924.
+   */
+  isAdditionalHelpTopicCommand(): boolean
+ }
+ interface Command {
+  /**
+   * HasHelpSubCommands determines if a command has any available 'help' sub commands
+   * that need to be shown in the usage/help default template under 'additional help
+   * topics'.
+   */
+  hasHelpSubCommands(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailableSubCommands determines if a command has available sub commands that
+   * need to be shown in the usage/help default template under 'available commands'.
+   */
+  hasAvailableSubCommands(): boolean
+ }
+ interface Command {
+  /**
+   * HasParent determines if the command is a child command.
+   */
+  hasParent(): boolean
+ }
+ interface Command {
+  /**
+   * GlobalNormalizationFunc returns the global normalization function or nil if it doesn't exist.
+   */
+  globalNormalizationFunc(): (f: any, name: string) => any
+ }
+ interface Command {
+  /**
+   * Flags returns the complete FlagSet that applies
+   * to this command (local and persistent declared here and by all parents).
+   */
+  flags(): (any)
+ }
+ interface Command {
+  /**
+   * LocalNonPersistentFlags are flags specific to this command which will NOT persist to subcommands.
+   * This function does not modify the flags of the current command, it's purpose is to return the current state.
+   */
+  localNonPersistentFlags(): (any)
+ }
+ interface Command {
+  /**
+   * LocalFlags returns the local FlagSet specifically set in the current command.
+   * This function does not modify the flags of the current command, it's purpose is to return the current state.
+   */
+  localFlags(): (any)
+ }
+ interface Command {
+  /**
+   * InheritedFlags returns all flags which were inherited from parent commands.
+   * This function does not modify the flags of the current command, it's purpose is to return the current state.
+   */
+  inheritedFlags(): (any)
+ }
+ interface Command {
+  /**
+   * NonInheritedFlags returns all flags which were not inherited from parent commands.
+   * This function does not modify the flags of the current command, it's purpose is to return the current state.
+   */
+  nonInheritedFlags(): (any)
+ }
+ interface Command {
+  /**
+   * PersistentFlags returns the persistent FlagSet specifically set in the current command.
+   */
+  persistentFlags(): (any)
+ }
+ interface Command {
+  /**
+   * ResetFlags deletes all flags from command.
+   */
+  resetFlags(): void
+ }
+ interface Command {
+  /**
+   * HasFlags checks if the command contains any flags (local plus persistent from the entire structure).
+   */
+  hasFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasPersistentFlags checks if the command contains persistent flags.
+   */
+  hasPersistentFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasLocalFlags checks if the command has flags specifically declared locally.
+   */
+  hasLocalFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasInheritedFlags checks if the command has flags inherited from its parent command.
+   */
+  hasInheritedFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailableFlags checks if the command contains any flags (local plus persistent from the entire
+   * structure) which are not hidden or deprecated.
+   */
+  hasAvailableFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailablePersistentFlags checks if the command contains persistent flags which are not hidden or deprecated.
+   */
+  hasAvailablePersistentFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailableLocalFlags checks if the command has flags specifically declared locally which are not hidden
+   * or deprecated.
+   */
+  hasAvailableLocalFlags(): boolean
+ }
+ interface Command {
+  /**
+   * HasAvailableInheritedFlags checks if the command has flags inherited from its parent command which are
+   * not hidden or deprecated.
+   */
+  hasAvailableInheritedFlags(): boolean
+ }
+ interface Command {
+  /**
+   * Flag climbs up the command tree looking for matching flag.
+   */
+  flag(name: string): (any)
+ }
+ interface Command {
+  /**
+   * ParseFlags parses persistent flag tree and local flags.
+   */
+  parseFlags(args: Array<string>): void
+ }
+ interface Command {
+  /**
+   * Parent returns a commands parent command.
+   */
+  parent(): (Command)
+ }
+ interface Command {
+  /**
+   * RegisterFlagCompletionFunc should be called to register a function to provide completion for a flag.
+   * 
+   * You can use pre-defined completion functions such as [FixedCompletions] or [NoFileCompletions],
+   * or you can define your own.
+   */
+  registerFlagCompletionFunc(flagName: string, f: CompletionFunc): void
+ }
+ interface Command {
+  /**
+   * GetFlagCompletionFunc returns the completion function for the given flag of the command, if available.
+   */
+  getFlagCompletionFunc(flagName: string): [CompletionFunc, boolean]
+ }
+ interface Command {
+  /**
+   * InitDefaultCompletionCmd adds a default 'completion' command to c.
+   * This function will do nothing if any of the following is true:
+   * 1- the feature has been explicitly disabled by the program,
+   * 2- c has no subcommands (to avoid creating one),
+   * 3- c already has a 'completion' command provided by the program.
+   */
+  initDefaultCompletionCmd(...args: string[]): void
+ }
+ interface Command {
+  /**
+   * GenFishCompletion generates fish completion file and writes to the passed writer.
+   */
+  genFishCompletion(w: io.Writer, includeDesc: boolean): void
+ }
+ interface Command {
+  /**
+   * GenFishCompletionFile generates fish completion file.
+   */
+  genFishCompletionFile(filename: string, includeDesc: boolean): void
+ }
+ interface Command {
+  /**
+   * MarkFlagsRequiredTogether marks the given flags with annotations so that Cobra errors
+   * if the command is invoked with a subset (but not all) of the given flags.
+   */
+  markFlagsRequiredTogether(...flagNames: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkFlagsOneRequired marks the given flags with annotations so that Cobra errors
+   * if the command is invoked without at least one flag from the given set of flags.
+   */
+  markFlagsOneRequired(...flagNames: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkFlagsMutuallyExclusive marks the given flags with annotations so that Cobra errors
+   * if the command is invoked with more than one flag from the given set of flags.
+   */
+  markFlagsMutuallyExclusive(...flagNames: string[]): void
+ }
+ interface Command {
+  /**
+   * ValidateFlagGroups validates the mutuallyExclusive/oneRequired/requiredAsGroup logic and returns the
+   * first error encountered.
+   */
+  validateFlagGroups(): void
+ }
+ interface Command {
+  /**
+   * GenPowerShellCompletionFile generates powershell completion file without descriptions.
+   */
+  genPowerShellCompletionFile(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenPowerShellCompletion generates powershell completion file without descriptions
+   * and writes it to the passed writer.
+   */
+  genPowerShellCompletion(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * GenPowerShellCompletionFileWithDesc generates powershell completion file with descriptions.
+   */
+  genPowerShellCompletionFileWithDesc(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenPowerShellCompletionWithDesc generates powershell completion file with descriptions
+   * and writes it to the passed writer.
+   */
+  genPowerShellCompletionWithDesc(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * MarkFlagRequired instructs the various shell completion implementations to
+   * prioritize the named flag when performing completion,
+   * and causes your command to report an error if invoked without the flag.
+   */
+  markFlagRequired(name: string): void
+ }
+ interface Command {
+  /**
+   * MarkPersistentFlagRequired instructs the various shell completion implementations to
+   * prioritize the named persistent flag when performing completion,
+   * and causes your command to report an error if invoked without the flag.
+   */
+  markPersistentFlagRequired(name: string): void
+ }
+ interface Command {
+  /**
+   * MarkFlagFilename instructs the various shell completion implementations to
+   * limit completions for the named flag to the specified file extensions.
+   */
+  markFlagFilename(name: string, ...extensions: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkFlagCustom adds the BashCompCustom annotation to the named flag, if it exists.
+   * The bash completion script will call the bash function f for the flag.
+   * 
+   * This will only work for bash completion.
+   * It is recommended to instead use c.RegisterFlagCompletionFunc(...) which allows
+   * to register a Go function which will work across all shells.
+   */
+  markFlagCustom(name: string, f: string): void
+ }
+ interface Command {
+  /**
+   * MarkPersistentFlagFilename instructs the various shell completion
+   * implementations to limit completions for the named persistent flag to the
+   * specified file extensions.
+   */
+  markPersistentFlagFilename(name: string, ...extensions: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkFlagDirname instructs the various shell completion implementations to
+   * limit completions for the named flag to directory names.
+   */
+  markFlagDirname(name: string): void
+ }
+ interface Command {
+  /**
+   * MarkPersistentFlagDirname instructs the various shell completion
+   * implementations to limit completions for the named persistent flag to
+   * directory names.
+   */
+  markPersistentFlagDirname(name: string): void
+ }
+ interface Command {
+  /**
+   * GenZshCompletionFile generates zsh completion file including descriptions.
+   */
+  genZshCompletionFile(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenZshCompletion generates zsh completion file including descriptions
+   * and writes it to the passed writer.
+   */
+  genZshCompletion(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * GenZshCompletionFileNoDesc generates zsh completion file without descriptions.
+   */
+  genZshCompletionFileNoDesc(filename: string): void
+ }
+ interface Command {
+  /**
+   * GenZshCompletionNoDesc generates zsh completion file without descriptions
+   * and writes it to the passed writer.
+   */
+  genZshCompletionNoDesc(w: io.Writer): void
+ }
+ interface Command {
+  /**
+   * MarkZshCompPositionalArgumentFile only worked for zsh and its behavior was
+   * not consistent with Bash completion. It has therefore been disabled.
+   * Instead, when no other completion is specified, file completion is done by
+   * default for every argument. One can disable file completion on a per-argument
+   * basis by using ValidArgsFunction and ShellCompDirectiveNoFileComp.
+   * To achieve file extension filtering, one can use ValidArgsFunction and
+   * ShellCompDirectiveFilterFileExt.
+   * 
+   * Deprecated
+   */
+  markZshCompPositionalArgumentFile(argPosition: number, ...patterns: string[]): void
+ }
+ interface Command {
+  /**
+   * MarkZshCompPositionalArgumentWords only worked for zsh. It has therefore
+   * been disabled.
+   * To achieve the same behavior across all shells, one can use
+   * ValidArgs (for the first argument only) or ValidArgsFunction for
+   * any argument (can include the first one also).
+   * 
+   * Deprecated
+   */
+  markZshCompPositionalArgumentWords(argPosition: number, ...words: string[]): void
+ }
+}
+
+namespace auth {
+ /**
+  * Provider defines a common interface for an OAuth2 client.
+  */
+ interface Provider {
+  [key:string]: any;
+  /**
+   * Context returns the context associated with the provider (if any).
+   */
+  context(): context.Context
+  /**
+   * SetContext assigns the specified context to the current provider.
+   */
+  setContext(ctx: context.Context): void
+  /**
+   * PKCE indicates whether the provider can use the PKCE flow.
+   */
+  pkce(): boolean
+  /**
+   * SetPKCE toggles the state whether the provider can use the PKCE flow or not.
+   */
+  setPKCE(enable: boolean): void
+  /**
+   * DisplayName usually returns provider name as it is officially written
+   * and it could be used directly in the UI.
+   */
+  displayName(): string
+  /**
+   * SetDisplayName sets the provider's display name.
+   */
+  setDisplayName(displayName: string): void
+  /**
+   * Scopes returns the provider access permissions that will be requested.
+   */
+  scopes(): Array<string>
+  /**
+   * SetScopes sets the provider access permissions that will be requested later.
+   */
+  setScopes(scopes: Array<string>): void
+  /**
+   * ClientId returns the provider client's app ID.
+   */
+  clientId(): string
+  /**
+   * SetClientId sets the provider client's ID.
+   */
+  setClientId(clientId: string): void
+  /**
+   * ClientSecret returns the provider client's app secret.
+   */
+  clientSecret(): string
+  /**
+   * SetClientSecret sets the provider client's app secret.
+   */
+  setClientSecret(secret: string): void
+  /**
+   * RedirectURL returns the end address to redirect the user
+   * going through the OAuth flow.
+   */
+  redirectURL(): string
+  /**
+   * SetRedirectURL sets the provider's RedirectURL.
+   */
+  setRedirectURL(url: string): void
+  /**
+   * AuthURL returns the provider's authorization service url.
+   */
+  authURL(): string
+  /**
+   * SetAuthURL sets the provider's AuthURL.
+   */
+  setAuthURL(url: string): void
+  /**
+   * TokenURL returns the provider's token exchange service url.
+   */
+  tokenURL(): string
+  /**
+   * SetTokenURL sets the provider's TokenURL.
+   */
+  setTokenURL(url: string): void
+  /**
+   * UserInfoURL returns the provider's user info api url.
+   */
+  userInfoURL(): string
+  /**
+   * SetUserInfoURL sets the provider's UserInfoURL.
+   */
+  setUserInfoURL(url: string): void
+  /**
+   * Extra returns a shallow copy of any custom config data
+   * that the provider may be need.
+   */
+  extra(): _TygojaDict
+  /**
+   * SetExtra updates the provider's custom config data.
+   */
+  setExtra(data: _TygojaDict): void
+  /**
+   * Client returns an http client using the provided token.
+   */
+  client(token: oauth2.Token): (any)
+  /**
+   * BuildAuthURL returns a URL to the provider's consent page
+   * that asks for permissions for the required scopes explicitly.
+   */
+  buildAuthURL(state: string, ...opts: oauth2.AuthCodeOption[]): string
+  /**
+   * FetchToken converts an authorization code to token.
+   */
+  fetchToken(code: string, ...opts: oauth2.AuthCodeOption[]): (oauth2.Token)
+  /**
+   * FetchRawUserInfo requests and marshalizes into `result` the
+   * the OAuth user api response.
+   */
+  fetchRawUserInfo(token: oauth2.Token): string|Array<number>
+  /**
+   * FetchAuthUser is similar to FetchRawUserInfo, but normalizes and
+   * marshalizes the user api response into a standardized AuthUser struct.
+   */
+  fetchAuthUser(token: oauth2.Token): (AuthUser)
+ }
+ /**
+  * AuthUser defines a standardized OAuth2 user data structure.
+  */
+ interface AuthUser {
+  expiry: types.DateTime
+  rawUser: _TygojaDict
+  id: string
+  name: string
+  username: string
+  email: string
+  avatarURL: string
+  accessToken: string
+  refreshToken: string
+  /**
+   * @todo
+   * deprecated: use AvatarURL instead
+   * AvatarUrl will be removed after dropping v0.22 support
+   */
+  avatarUrl: string
+ }
+ interface AuthUser {
+  /**
+   * MarshalJSON implements the [json.Marshaler] interface.
+   * 
+   * @todo remove after dropping v0.22 support
+   */
+  marshalJSON(): string|Array<number>
+ }
+}
+
+namespace mailer {
+ /**
+  * Message defines a generic email message struct.
+  */
+ interface Message {
+  from: { address: string; name?: string; }
+  to: Array<{ address: string; name?: string; }>
+  bcc: Array<{ address: string; name?: string; }>
+  cc: Array<{ address: string; name?: string; }>
+  subject: string
+  html: string
+  text: string
+  headers: _TygojaDict
+  attachments: _TygojaDict
+  inlineAttachments: _TygojaDict
+ }
+ /**
+  * Mailer defines a base mail client interface.
+  */
+ interface Mailer {
+  [key:string]: any;
+  /**
+   * Send sends an email with the provided Message.
+   */
+  send(message: Message): void
+ }
+}
+
+namespace subscriptions {
+ /**
+  * Broker defines a struct for managing subscriptions clients.
+  */
+ interface Broker {
+ }
+ interface Broker {
+  /**
+   * Clients returns a shallow copy of all registered clients indexed
+   * with their connection id.
+   */
+  clients(): _TygojaDict
+ }
+ interface Broker {
+  /**
+   * ChunkedClients splits the current clients into a chunked slice.
+   */
+  chunkedClients(chunkSize: number): Array<Array<Client>>
+ }
+ interface Broker {
+  /**
+   * TotalClients returns the total number of registered clients.
+   */
+  totalClients(): number
+ }
+ interface Broker {
+  /**
+   * ClientById finds a registered client by its id.
+   * 
+   * Returns non-nil error when client with clientId is not registered.
+   */
+  clientById(clientId: string): Client
+ }
+ interface Broker {
+  /**
+   * Register adds a new client to the broker instance.
+   */
+  register(client: Client): void
+ }
+ interface Broker {
+  /**
+   * Unregister removes a single client by its id and marks it as discarded.
+   * 
+   * If client with clientId doesn't exist, this method does nothing.
+   */
+  unregister(clientId: string): void
+ }
+ /**
+  * Client is an interface for a generic subscription client.
+  */
+ interface Client {
+  [key:string]: any;
+  /**
+   * Id Returns the unique id of the client.
+   */
+  id(): string
+  /**
+   * Channel returns the client's communication channel.
+   * 
+   * NB! The channel shouldn't be used after calling Discard().
+   */
+  channel(): undefined
+  /**
+   * Subscriptions returns a shallow copy of the client subscriptions matching the prefixes.
+   * If no prefix is specified, returns all subscriptions.
+   */
+  subscriptions(...prefixes: string[]): _TygojaDict
+  /**
+   * Subscribe subscribes the client to the provided subscriptions list.
+   * 
+   * Each subscription can also have "options" (json serialized SubscriptionOptions) as query parameter.
+   * 
+   * Example:
+   * 
+   * ```
+   * 	Subscribe(
+   * 	    "subscriptionA",
+   * 	    `subscriptionB?options={"query":{"a":1},"headers":{"x_token":"abc"}}`,
+   * 	)
+   * ```
+   */
+  subscribe(...subs: string[]): void
+  /**
+   * Unsubscribe unsubscribes the client from the provided subscriptions list.
+   */
+  unsubscribe(...subs: string[]): void
+  /**
+   * HasSubscription checks if the client is subscribed to `sub`.
+   */
+  hasSubscription(sub: string): boolean
+  /**
+   * Set stores any value to the client's context.
+   */
+  set(key: string, value: any): void
+  /**
+   * Unset removes a single value from the client's context.
+   */
+  unset(key: string): void
+  /**
+   * Get retrieves the key value from the client's context.
+   */
+  get(key: string): any
+  /**
+   * Discard marks the client as "discarded" (and closes its channel),
+   * meaning that it shouldn't be used anymore for sending new messages.
+   * 
+   * It is safe to call Discard() multiple times.
+   */
+  discard(): void
+  /**
+   * IsDiscarded indicates whether the client has been "discarded"
+   * and should no longer be used.
+   */
+  isDiscarded(): boolean
+  /**
+   * Send sends the specified message to the client's channel (if not discarded).
+   */
+  send(m: Message): void
+ }
+ /**
+  * Message defines a client's channel data.
+  */
+ interface Message {
+  name: string
+  data: string|Array<number>
+ }
+ interface Message {
+  /**
+   * WriteSSE writes the current message in a SSE format into the provided writer.
+   * 
+   * For example, writing to a router.Event:
+   * 
+   * ```
+   * 	m := Message{Name: "users/create", Data: []byte{...}}
+   * 	m.WriteSSE(e.Response, "yourEventId")
+   * 	e.Flush()
+   * ```
+   */
+  writeSSE(w: io.Writer, eventId: string): void
+ }
+}
+
+/**
+ * Package slog provides structured logging,
+ * in which log records include a message,
+ * a severity level, and various other attributes
+ * expressed as key-value pairs.
+ * 
+ * It defines a type, [Logger],
+ * which provides several methods (such as [Logger.Info] and [Logger.Error])
+ * for reporting events of interest.
+ * 
+ * Each Logger is associated with a [Handler].
+ * A Logger output method creates a [Record] from the method arguments
+ * and passes it to the Handler, which decides how to handle it.
+ * There is a default Logger accessible through top-level functions
+ * (such as [Info] and [Error]) that call the corresponding Logger methods.
+ * 
+ * A log record consists of a time, a level, a message, and a set of key-value
+ * pairs, where the keys are strings and the values may be of any type.
+ * As an example,
+ * 
+ * ```
+ * 	slog.Info("hello", "count", 3)
+ * ```
+ * 
+ * creates a record containing the time of the call,
+ * a level of Info, the message "hello", and a single
+ * pair with key "count" and value 3.
+ * 
+ * The [Info] top-level function calls the [Logger.Info] method on the default Logger.
+ * In addition to [Logger.Info], there are methods for Debug, Warn and Error levels.
+ * Besides these convenience methods for common levels,
+ * there is also a [Logger.Log] method which takes the level as an argument.
+ * Each of these methods has a corresponding top-level function that uses the
+ * default logger.
+ * 
+ * The default handler formats the log record's message, time, level, and attributes
+ * as a string and passes it to the [log] package.
+ * 
+ * ```
+ * 	2022/11/08 15:28:26 INFO hello count=3
+ * ```
+ * 
+ * For more control over the output format, create a logger with a different handler.
+ * This statement uses [New] to create a new logger with a [TextHandler]
+ * that writes structured records in text form to standard error:
+ * 
+ * ```
+ * 	logger := slog.New(slog.NewTextHandler(os.Stderr, nil))
+ * ```
+ * 
+ * [TextHandler] output is a sequence of key=value pairs, easily and unambiguously
+ * parsed by machine. This statement:
+ * 
+ * ```
+ * 	logger.Info("hello", "count", 3)
+ * ```
+ * 
+ * produces this output:
+ * 
+ * ```
+ * 	time=2022-11-08T15:28:26.000-05:00 level=INFO msg=hello count=3
+ * ```
+ * 
+ * The package also provides [JSONHandler], whose output is line-delimited JSON:
+ * 
+ * ```
+ * 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
+ * 	logger.Info("hello", "count", 3)
+ * ```
+ * 
+ * produces this output:
+ * 
+ * ```
+ * 	{"time":"2022-11-08T15:28:26.000000000-05:00","level":"INFO","msg":"hello","count":3}
+ * ```
+ * 
+ * Both [TextHandler] and [JSONHandler] can be configured with [HandlerOptions].
+ * There are options for setting the minimum level (see Levels, below),
+ * displaying the source file and line of the log call, and
+ * modifying attributes before they are logged.
+ * 
+ * Setting a logger as the default with
+ * 
+ * ```
+ * 	slog.SetDefault(logger)
+ * ```
+ * 
+ * will cause the top-level functions like [Info] to use it.
+ * [SetDefault] also updates the default logger used by the [log] package,
+ * so that existing applications that use [log.Printf] and related functions
+ * will send log records to the logger's handler without needing to be rewritten.
+ * 
+ * Some attributes are common to many log calls.
+ * For example, you may wish to include the URL or trace identifier of a server request
+ * with all log events arising from the request.
+ * Rather than repeat the attribute with every log call, you can use [Logger.With]
+ * to construct a new Logger containing the attributes:
+ * 
+ * ```
+ * 	logger2 := logger.With("url", r.URL)
+ * ```
+ * 
+ * The arguments to With are the same key-value pairs used in [Logger.Info].
+ * The result is a new Logger with the same handler as the original, but additional
+ * attributes that will appear in the output of every call.
+ * 
+ * # Levels
+ * 
+ * A [Level] is an integer representing the importance or severity of a log event.
+ * The higher the level, the more severe the event.
+ * This package defines constants for the most common levels,
+ * but any int can be used as a level.
+ * 
+ * In an application, you may wish to log messages only at a certain level or greater.
+ * One common configuration is to log messages at Info or higher levels,
+ * suppressing debug logging until it is needed.
+ * The built-in handlers can be configured with the minimum level to output by
+ * setting [HandlerOptions.Level].
+ * The program's `main` function typically does this.
+ * The default value is LevelInfo.
+ * 
+ * Setting the [HandlerOptions.Level] field to a [Level] value
+ * fixes the handler's minimum level throughout its lifetime.
+ * Setting it to a [LevelVar] allows the level to be varied dynamically.
+ * A LevelVar holds a Level and is safe to read or write from multiple
+ * goroutines.
+ * To vary the level dynamically for an entire program, first initialize
+ * a global LevelVar:
+ * 
+ * ```
+ * 	var programLevel = new(slog.LevelVar) // Info by default
+ * ```
+ * 
+ * Then use the LevelVar to construct a handler, and make it the default:
+ * 
+ * ```
+ * 	h := slog.NewJSONHandler(os.Stderr, &slog.HandlerOptions{Level: programLevel})
+ * 	slog.SetDefault(slog.New(h))
+ * ```
+ * 
+ * Now the program can change its logging level with a single statement:
+ * 
+ * ```
+ * 	programLevel.Set(slog.LevelDebug)
+ * ```
+ * 
+ * # Groups
+ * 
+ * Attributes can be collected into groups.
+ * A group has a name that is used to qualify the names of its attributes.
+ * How this qualification is displayed depends on the handler.
+ * [TextHandler] separates the group and attribute names with a dot.
+ * [JSONHandler] treats each group as a separate JSON object, with the group name as the key.
+ * 
+ * Use [Group] to create a Group attribute from a name and a list of key-value pairs:
+ * 
+ * ```
+ * 	slog.Group("request",
+ * 	    "method", r.Method,
+ * 	    "url", r.URL)
+ * ```
+ * 
+ * TextHandler would display this group as
+ * 
+ * ```
+ * 	request.method=GET request.url=http://example.com
+ * ```
+ * 
+ * JSONHandler would display it as
+ * 
+ * ```
+ * 	"request":{"method":"GET","url":"http://example.com"}
+ * ```
+ * 
+ * Use [Logger.WithGroup] to qualify all of a Logger's output
+ * with a group name. Calling WithGroup on a Logger results in a
+ * new Logger with the same Handler as the original, but with all
+ * its attributes qualified by the group name.
+ * 
+ * This can help prevent duplicate attribute keys in large systems,
+ * where subsystems might use the same keys.
+ * Pass each subsystem a different Logger with its own group name so that
+ * potential duplicates are qualified:
+ * 
+ * ```
+ * 	logger := slog.Default().With("id", systemID)
+ * 	parserLogger := logger.WithGroup("parser")
+ * 	parseInput(input, parserLogger)
+ * ```
+ * 
+ * When parseInput logs with parserLogger, its keys will be qualified with "parser",
+ * so even if it uses the common key "id", the log line will have distinct keys.
+ * 
+ * # Contexts
+ * 
+ * Some handlers may wish to include information from the [context.Context] that is
+ * available at the call site. One example of such information
+ * is the identifier for the current span when tracing is enabled.
+ * 
+ * The [Logger.Log] and [Logger.LogAttrs] methods take a context as a first
+ * argument, as do their corresponding top-level functions.
+ * 
+ * Although the convenience methods on Logger (Info and so on) and the
+ * corresponding top-level functions do not take a context, the alternatives ending
+ * in "Context" do. For example,
+ * 
+ * ```
+ * 	slog.InfoContext(ctx, "message")
+ * ```
+ * 
+ * It is recommended to pass a context to an output method if one is available.
+ * 
+ * # Attrs and Values
+ * 
+ * An [Attr] is a key-value pair. The Logger output methods accept Attrs as well as
+ * alternating keys and values. The statement
+ * 
+ * ```
+ * 	slog.Info("hello", slog.Int("count", 3))
+ * ```
+ * 
+ * behaves the same as
+ * 
+ * ```
+ * 	slog.Info("hello", "count", 3)
+ * ```
+ * 
+ * There are convenience constructors for [Attr] such as [Int], [String], and [Bool]
+ * for common types, as well as the function [Any] for constructing Attrs of any
+ * type.
+ * 
+ * The value part of an Attr is a type called [Value].
+ * Like an [any], a Value can hold any Go value,
+ * but it can represent typical values, including all numbers and strings,
+ * without an allocation.
+ * 
+ * For the most efficient log output, use [Logger.LogAttrs].
+ * It is similar to [Logger.Log] but accepts only Attrs, not alternating
+ * keys and values; this allows it, too, to avoid allocation.
+ * 
+ * The call
+ * 
+ * ```
+ * 	logger.LogAttrs(ctx, slog.LevelInfo, "hello", slog.Int("count", 3))
+ * ```
+ * 
+ * is the most efficient way to achieve the same output as
+ * 
+ * ```
+ * 	slog.InfoContext(ctx, "hello", "count", 3)
+ * ```
+ * 
+ * # Customizing a type's logging behavior
+ * 
+ * If a type implements the [LogValuer] interface, the [Value] returned from its LogValue
+ * method is used for logging. You can use this to control how values of the type
+ * appear in logs. For example, you can redact secret information like passwords,
+ * or gather a struct's fields in a Group. See the examples under [LogValuer] for
+ * details.
+ * 
+ * A LogValue method may return a Value that itself implements [LogValuer]. The [Value.Resolve]
+ * method handles these cases carefully, avoiding infinite loops and unbounded recursion.
+ * Handler authors and others may wish to use [Value.Resolve] instead of calling LogValue directly.
+ * 
+ * # Wrapping output methods
+ * 
+ * The logger functions use reflection over the call stack to find the file name
+ * and line number of the logging call within the application. This can produce
+ * incorrect source information for functions that wrap slog. For instance, if you
+ * define this function in file mylog.go:
+ * 
+ * ```
+ * 	func Infof(logger *slog.Logger, format string, args ...any) {
+ * 	    logger.Info(fmt.Sprintf(format, args...))
+ * 	}
+ * ```
+ * 
+ * and you call it like this in main.go:
+ * 
+ * ```
+ * 	Infof(slog.Default(), "hello, %s", "world")
+ * ```
+ * 
+ * then slog will report the source file as mylog.go, not main.go.
+ * 
+ * A correct implementation of Infof will obtain the source location
+ * (pc) and pass it to NewRecord.
+ * The Infof function in the package-level example called "wrapping"
+ * demonstrates how to do this.
+ * 
+ * # Working with Records
+ * 
+ * Sometimes a Handler will need to modify a Record
+ * before passing it on to another Handler or backend.
+ * A Record contains a mixture of simple public fields (e.g. Time, Level, Message)
+ * and hidden fields that refer to state (such as attributes) indirectly. This
+ * means that modifying a simple copy of a Record (e.g. by calling
+ * [Record.Add] or [Record.AddAttrs] to add attributes)
+ * may have unexpected effects on the original.
+ * Before modifying a Record, use [Record.Clone] to
+ * create a copy that shares no state with the original,
+ * or create a new Record with [NewRecord]
+ * and build up its Attrs by traversing the old ones with [Record.Attrs].
+ * 
+ * # Performance considerations
+ * 
+ * If profiling your application demonstrates that logging is taking significant time,
+ * the following suggestions may help.
+ * 
+ * If many log lines have a common attribute, use [Logger.With] to create a Logger with
+ * that attribute. The built-in handlers will format that attribute only once, at the
+ * call to [Logger.With]. The [Handler] interface is designed to allow that optimization,
+ * and a well-written Handler should take advantage of it.
+ * 
+ * The arguments to a log call are always evaluated, even if the log event is discarded.
+ * If possible, defer computation so that it happens only if the value is actually logged.
+ * For example, consider the call
+ * 
+ * ```
+ * 	slog.Info("starting request", "url", r.URL.String())  // may compute String unnecessarily
+ * ```
+ * 
+ * The URL.String method will be called even if the logger discards Info-level events.
+ * Instead, pass the URL directly:
+ * 
+ * ```
+ * 	slog.Info("starting request", "url", &r.URL) // calls URL.String only if needed
+ * ```
+ * 
+ * The built-in [TextHandler] will call its String method, but only
+ * if the log event is enabled.
+ * Avoiding the call to String also preserves the structure of the underlying value.
+ * For example [JSONHandler] emits the components of the parsed URL as a JSON object.
+ * If you want to avoid eagerly paying the cost of the String call
+ * without causing the handler to potentially inspect the structure of the value,
+ * wrap the value in a fmt.Stringer implementation that hides its Marshal methods.
+ * 
+ * You can also use the [LogValuer] interface to avoid unnecessary work in disabled log
+ * calls. Say you need to log some expensive value:
+ * 
+ * ```
+ * 	slog.Debug("frobbing", "value", computeExpensiveValue(arg))
+ * ```
+ * 
+ * Even if this line is disabled, computeExpensiveValue will be called.
+ * To avoid that, define a type implementing LogValuer:
+ * 
+ * ```
+ * 	type expensive struct { arg int }
+ * 
+ * 	func (e expensive) LogValue() slog.Value {
+ * 	    return slog.AnyValue(computeExpensiveValue(e.arg))
+ * 	}
+ * ```
+ * 
+ * Then use a value of that type in log calls:
+ * 
+ * ```
+ * 	slog.Debug("frobbing", "value", expensive{arg})
+ * ```
+ * 
+ * Now computeExpensiveValue will only be called when the line is enabled.
+ * 
+ * The built-in handlers acquire a lock before calling [io.Writer.Write]
+ * to ensure that exactly one [Record] is written at a time in its entirety.
+ * Although each log record has a timestamp,
+ * the built-in handlers do not use that time to sort the written records.
+ * User-defined handlers are responsible for their own locking and sorting.
+ * 
+ * # Writing a handler
+ * 
+ * For a guide to writing a custom handler, see https://golang.org/s/slog-handler-guide.
+ */
+namespace slog {
+ // @ts-ignore
+ import loginternal = internal
+ /**
+  * A Logger records structured information about each call to its
+  * Log, Debug, Info, Warn, and Error methods.
+  * For each call, it creates a [Record] and passes it to a [Handler].
+  * 
+  * To create a new Logger, call [New] or a Logger method
+  * that begins "With".
+  */
+ interface Logger {
+ }
+ interface Logger {
+  /**
+   * Handler returns l's Handler.
+   */
+  handler(): Handler
+ }
+ interface Logger {
+  /**
+   * With returns a Logger that includes the given attributes
+   * in each output operation. Arguments are converted to
+   * attributes as if by [Logger.Log].
+   */
+  with(...args: any[]): (Logger)
+ }
+ interface Logger {
+  /**
+   * WithGroup returns a Logger that starts a group, if name is non-empty.
+   * The keys of all attributes added to the Logger will be qualified by the given
+   * name. (How that qualification happens depends on the [Handler.WithGroup]
+   * method of the Logger's Handler.)
+   * 
+   * If name is empty, WithGroup returns the receiver.
+   */
+  withGroup(name: string): (Logger)
+ }
+ interface Logger {
+  /**
+   * Enabled reports whether l emits log records at the given context and level.
+   */
+  enabled(ctx: context.Context, level: Level): boolean
+ }
+ interface Logger {
+  /**
+   * Log emits a log record with the current time and the given level and message.
+   * The Record's Attrs consist of the Logger's attributes followed by
+   * the Attrs specified by args.
+   * 
+   * The attribute arguments are processed as follows:
+   * ```
+   *   - If an argument is an Attr, it is used as is.
+   *   - If an argument is a string and this is not the last argument,
+   *     the following argument is treated as the value and the two are combined
+   *     into an Attr.
+   *   - Otherwise, the argument is treated as a value with key "!BADKEY".
+   * ```
+   */
+  log(ctx: context.Context, level: Level, msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * LogAttrs is a more efficient version of [Logger.Log] that accepts only Attrs.
+   */
+  logAttrs(ctx: context.Context, level: Level, msg: string, ...attrs: Attr[]): void
+ }
+ interface Logger {
+  /**
+   * Debug logs at [LevelDebug].
+   */
+  debug(msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * DebugContext logs at [LevelDebug] with the given context.
+   */
+  debugContext(ctx: context.Context, msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * Info logs at [LevelInfo].
+   */
+  info(msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * InfoContext logs at [LevelInfo] with the given context.
+   */
+  infoContext(ctx: context.Context, msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * Warn logs at [LevelWarn].
+   */
+  warn(msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * WarnContext logs at [LevelWarn] with the given context.
+   */
+  warnContext(ctx: context.Context, msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * Error logs at [LevelError].
+   */
+  error(msg: string, ...args: any[]): void
+ }
+ interface Logger {
+  /**
+   * ErrorContext logs at [LevelError] with the given context.
+   */
+  errorContext(ctx: context.Context, msg: string, ...args: any[]): void
+ }
+}
+
+namespace sync {
+ // @ts-ignore
+ import isync = sync
+ /**
+  * A Locker represents an object that can be locked and unlocked.
+  */
+ interface Locker {
+  [key:string]: any;
+  lock(): void
+  unlock(): void
+ }
+}
+
+namespace io {
+ /**
+  * WriteCloser is the interface that groups the basic Write and Close methods.
+  */
+ interface WriteCloser {
+  [key:string]: any;
+ }
+}
+
+namespace bufio {
+ /**
+  * Reader implements buffering for an io.Reader object.
+  * A new Reader is created by calling [NewReader] or [NewReaderSize];
+  * alternatively the zero value of a Reader may be used after calling [Reset]
+  * on it.
+  */
+ interface Reader {
+ }
+ interface Reader {
+  /**
+   * Size returns the size of the underlying buffer in bytes.
+   */
+  size(): number
+ }
+ interface Reader {
+  /**
+   * Reset discards any buffered data, resets all state, and switches
+   * the buffered reader to read from r.
+   * Calling Reset on the zero value of [Reader] initializes the internal buffer
+   * to the default size.
+   * Calling b.Reset(b) (that is, resetting a [Reader] to itself) does nothing.
+   */
+  reset(r: io.Reader): void
+ }
+ interface Reader {
+  /**
+   * Peek returns the next n bytes without advancing the reader. The bytes stop
+   * being valid at the next read call. If necessary, Peek will read more bytes
+   * into the buffer in order to make n bytes available. If Peek returns fewer
+   * than n bytes, it also returns an error explaining why the read is short.
+   * The error is [ErrBufferFull] if n is larger than b's buffer size.
+   * 
+   * Calling Peek prevents a [Reader.UnreadByte] or [Reader.UnreadRune] call from succeeding
+   * until the next read operation.
+   */
+  peek(n: number): string|Array<number>
+ }
+ interface Reader {
+  /**
+   * Discard skips the next n bytes, returning the number of bytes discarded.
+   * 
+   * If Discard skips fewer than n bytes, it also returns an error.
+   * If 0 <= n <= b.Buffered(), Discard is guaranteed to succeed without
+   * reading from the underlying io.Reader.
+   */
+  discard(n: number): number
+ }
+ interface Reader {
+  /**
+   * Read reads data into p.
+   * It returns the number of bytes read into p.
+   * The bytes are taken from at most one Read on the underlying [Reader],
+   * hence n may be less than len(p).
+   * To read exactly len(p) bytes, use io.ReadFull(b, p).
+   * If the underlying [Reader] can return a non-zero count with io.EOF,
+   * then this Read method can do so as well; see the [io.Reader] docs.
+   */
+  read(p: string|Array<number>): number
+ }
+ interface Reader {
+  /**
+   * ReadByte reads and returns a single byte.
+   * If no byte is available, returns an error.
+   */
+  readByte(): number
+ }
+ interface Reader {
+  /**
+   * UnreadByte unreads the last byte. Only the most recently read byte can be unread.
+   * 
+   * UnreadByte returns an error if the most recent method called on the
+   * [Reader] was not a read operation. Notably, [Reader.Peek], [Reader.Discard], and [Reader.WriteTo] are not
+   * considered read operations.
+   */
+  unreadByte(): void
+ }
+ interface Reader {
+  /**
+   * ReadRune reads a single UTF-8 encoded Unicode character and returns the
+   * rune and its size in bytes. If the encoded rune is invalid, it consumes one byte
+   * and returns unicode.ReplacementChar (U+FFFD) with a size of 1.
+   */
+  readRune(): [number, number]
+ }
+ interface Reader {
+  /**
+   * UnreadRune unreads the last rune. If the most recent method called on
+   * the [Reader] was not a [Reader.ReadRune], [Reader.UnreadRune] returns an error. (In this
+   * regard it is stricter than [Reader.UnreadByte], which will unread the last byte
+   * from any read operation.)
+   */
+  unreadRune(): void
+ }
+ interface Reader {
+  /**
+   * Buffered returns the number of bytes that can be read from the current buffer.
+   */
+  buffered(): number
+ }
+ interface Reader {
+  /**
+   * ReadSlice reads until the first occurrence of delim in the input,
+   * returning a slice pointing at the bytes in the buffer.
+   * The bytes stop being valid at the next read.
+   * If ReadSlice encounters an error before finding a delimiter,
+   * it returns all the data in the buffer and the error itself (often io.EOF).
+   * ReadSlice fails with error [ErrBufferFull] if the buffer fills without a delim.
+   * Because the data returned from ReadSlice will be overwritten
+   * by the next I/O operation, most clients should use
+   * [Reader.ReadBytes] or ReadString instead.
+   * ReadSlice returns err != nil if and only if line does not end in delim.
+   */
+  readSlice(delim: number): string|Array<number>
+ }
+ interface Reader {
+  /**
+   * ReadLine is a low-level line-reading primitive. Most callers should use
+   * [Reader.ReadBytes]('\n') or [Reader.ReadString]('\n') instead or use a [Scanner].
+   * 
+   * ReadLine tries to return a single line, not including the end-of-line bytes.
+   * If the line was too long for the buffer then isPrefix is set and the
+   * beginning of the line is returned. The rest of the line will be returned
+   * from future calls. isPrefix will be false when returning the last fragment
+   * of the line. The returned buffer is only valid until the next call to
+   * ReadLine. ReadLine either returns a non-nil line or it returns an error,
+   * never both.
+   * 
+   * The text returned from ReadLine does not include the line end ("\r\n" or "\n").
+   * No indication or error is given if the input ends without a final line end.
+   * Calling [Reader.UnreadByte] after ReadLine will always unread the last byte read
+   * (possibly a character belonging to the line end) even if that byte is not
+   * part of the line returned by ReadLine.
+   */
+  readLine(): [string|Array<number>, boolean]
+ }
+ interface Reader {
+  /**
+   * ReadBytes reads until the first occurrence of delim in the input,
+   * returning a slice containing the data up to and including the delimiter.
+   * If ReadBytes encounters an error before finding a delimiter,
+   * it returns the data read before the error and the error itself (often io.EOF).
+   * ReadBytes returns err != nil if and only if the returned data does not end in
+   * delim.
+   * For simple uses, a Scanner may be more convenient.
+   */
+  readBytes(delim: number): string|Array<number>
+ }
+ interface Reader {
+  /**
+   * ReadString reads until the first occurrence of delim in the input,
+   * returning a string containing the data up to and including the delimiter.
+   * If ReadString encounters an error before finding a delimiter,
+   * it returns the data read before the error and the error itself (often io.EOF).
+   * ReadString returns err != nil if and only if the returned data does not end in
+   * delim.
+   * For simple uses, a Scanner may be more convenient.
+   */
+  readString(delim: number): string
+ }
+ interface Reader {
+  /**
+   * WriteTo implements io.WriterTo.
+   * This may make multiple calls to the [Reader.Read] method of the underlying [Reader].
+   * If the underlying reader supports the [Reader.WriteTo] method,
+   * this calls the underlying [Reader.WriteTo] without buffering.
+   */
+  writeTo(w: io.Writer): number
+ }
+ /**
+  * Writer implements buffering for an [io.Writer] object.
+  * If an error occurs writing to a [Writer], no more data will be
+  * accepted and all subsequent writes, and [Writer.Flush], will return the error.
+  * After all data has been written, the client should call the
+  * [Writer.Flush] method to guarantee all data has been forwarded to
+  * the underlying [io.Writer].
+  */
+ interface Writer {
+ }
+ interface Writer {
+  /**
+   * Size returns the size of the underlying buffer in bytes.
+   */
+  size(): number
+ }
+ interface Writer {
+  /**
+   * Reset discards any unflushed buffered data, clears any error, and
+   * resets b to write its output to w.
+   * Calling Reset on the zero value of [Writer] initializes the internal buffer
+   * to the default size.
+   * Calling w.Reset(w) (that is, resetting a [Writer] to itself) does nothing.
+   */
+  reset(w: io.Writer): void
+ }
+ interface Writer {
+  /**
+   * Flush writes any buffered data to the underlying [io.Writer].
+   */
+  flush(): void
+ }
+ interface Writer {
+  /**
+   * Available returns how many bytes are unused in the buffer.
+   */
+  available(): number
+ }
+ interface Writer {
+  /**
+   * AvailableBuffer returns an empty buffer with b.Available() capacity.
+   * This buffer is intended to be appended to and
+   * passed to an immediately succeeding [Writer.Write] call.
+   * The buffer is only valid until the next write operation on b.
+   */
+  availableBuffer(): string|Array<number>
+ }
+ interface Writer {
+  /**
+   * Buffered returns the number of bytes that have been written into the current buffer.
+   */
+  buffered(): number
+ }
+ interface Writer {
+  /**
+   * Write writes the contents of p into the buffer.
+   * It returns the number of bytes written.
+   * If nn < len(p), it also returns an error explaining
+   * why the write is short.
+   */
+  write(p: string|Array<number>): number
+ }
+ interface Writer {
+  /**
+   * WriteByte writes a single byte.
+   */
+  writeByte(c: number): void
+ }
+ interface Writer {
+  /**
+   * WriteRune writes a single Unicode code point, returning
+   * the number of bytes written and any error.
+   */
+  writeRune(r: number): number
+ }
+ interface Writer {
+  /**
+   * WriteString writes a string.
+   * It returns the number of bytes written.
+   * If the count is less than len(s), it also returns an error explaining
+   * why the write is short.
+   */
+  writeString(s: string): number
+ }
+ interface Writer {
+  /**
+   * ReadFrom implements [io.ReaderFrom]. If the underlying writer
+   * supports the ReadFrom method, this calls the underlying ReadFrom.
+   * If there is buffered data and an underlying ReadFrom, this fills
+   * the buffer and writes it before calling ReadFrom.
+   */
+  readFrom(r: io.Reader): number
+ }
+}
+
+namespace syscall {
+ // @ts-ignore
+ import errpkg = errors
+ /**
+  * SysProcIDMap holds Container ID to Host ID mappings used for User Namespaces in Linux.
+  * See user_namespaces(7).
+  * 
+  * Note that User Namespaces are not available on a number of popular Linux
+  * versions (due to security issues), or are available but subject to AppArmor
+  * restrictions like in Ubuntu 24.04.
+  */
+ interface SysProcIDMap {
+  containerID: number // Container ID.
+  hostID: number // Host ID.
+  size: number // Size.
+ }
+ // @ts-ignore
+ import errorspkg = errors
+ /**
+  * Credential holds user and group identities to be assumed
+  * by a child process started by [StartProcess].
+  */
+ interface Credential {
+  uid: number // User ID.
+  gid: number // Group ID.
+  groups: Array<number> // Supplementary group IDs.
+  noSetGroups: boolean // If true, don't set supplementary groups
+ }
+ // @ts-ignore
+ import runtimesyscall = syscall
+ /**
+  * A Signal is a number describing a process signal.
+  * It implements the [os.Signal] interface.
+  */
+ interface Signal extends Number{}
+ interface Signal {
+  signal(): void
+ }
+ interface Signal {
+  string(): string
+ }
+}
+
+namespace time {
+ /**
+  * A Month specifies a month of the year (January = 1, ...).
+  */
+ interface Month extends Number{}
+ interface Month {
+  /**
+   * String returns the English name of the month ("January", "February", ...).
+   */
+  string(): string
+ }
+ /**
+  * A Weekday specifies a day of the week (Sunday = 0, ...).
+  */
+ interface Weekday extends Number{}
+ interface Weekday {
+  /**
+   * String returns the English name of the day ("Sunday", "Monday", ...).
+   */
+  string(): string
+ }
+ /**
+  * A Location maps time instants to the zone in use at that time.
+  * Typically, the Location represents the collection of time offsets
+  * in use in a geographical area. For many Locations the time offset varies
+  * depending on whether daylight savings time is in use at the time instant.
+  * 
+  * Location is used to provide a time zone in a printed Time value and for
+  * calculations involving intervals that may cross daylight savings time
+  * boundaries.
+  */
+ interface Location {
+ }
+ interface Location {
+  /**
+   * String returns a descriptive name for the time zone information,
+   * corresponding to the name argument to [LoadLocation] or [FixedZone].
+   */
+  string(): string
+ }
+}
+
+namespace context {
+}
+
+namespace fs {
+}
+
+/**
+ * Package url parses URLs and implements query escaping.
+ */
+namespace url {
+ /**
+  * A URL represents a parsed URL (technically, a URI reference).
+  * 
+  * The general form represented is:
+  * 
+  * ```
+  * 	[scheme:][//[userinfo@]host][/]path[?query][#fragment]
+  * ```
+  * 
+  * URLs that do not start with a slash after the scheme are interpreted as:
+  * 
+  * ```
+  * 	scheme:opaque[?query][#fragment]
+  * ```
+  * 
+  * The Host field contains the host and port subcomponents of the URL.
+  * When the port is present, it is separated from the host with a colon.
+  * When the host is an IPv6 address, it must be enclosed in square brackets:
+  * "[fe80::1]:80". The [net.JoinHostPort] function combines a host and port
+  * into a string suitable for the Host field, adding square brackets to
+  * the host when necessary.
+  * 
+  * Note that the Path field is stored in decoded form: /%47%6f%2f becomes /Go/.
+  * A consequence is that it is impossible to tell which slashes in the Path were
+  * slashes in the raw URL and which were %2f. This distinction is rarely important,
+  * but when it is, the code should use the [URL.EscapedPath] method, which preserves
+  * the original encoding of Path.
+  * 
+  * The RawPath field is an optional field which is only set when the default
+  * encoding of Path is different from the escaped path. See the EscapedPath method
+  * for more details.
+  * 
+  * URL's String method uses the EscapedPath method to obtain the path.
+  */
+ interface URL {
+  scheme: string
+  opaque: string // encoded opaque data
+  user?: Userinfo // username and password information
+  host: string // host or host:port (see Hostname and Port methods)
+  path: string // path (relative paths may omit leading slash)
+  rawPath: string // encoded path hint (see EscapedPath method)
+  omitHost: boolean // do not emit empty host (authority)
+  forceQuery: boolean // append a query ('?') even if RawQuery is empty
+  rawQuery: string // encoded query values, without '?'
+  fragment: string // fragment for references, without '#'
+  rawFragment: string // encoded fragment hint (see EscapedFragment method)
+ }
+ interface URL {
+  /**
+   * EscapedPath returns the escaped form of u.Path.
+   * In general there are multiple possible escaped forms of any path.
+   * EscapedPath returns u.RawPath when it is a valid escaping of u.Path.
+   * Otherwise EscapedPath ignores u.RawPath and computes an escaped
+   * form on its own.
+   * The [URL.String] and [URL.RequestURI] methods use EscapedPath to construct
+   * their results.
+   * In general, code should call EscapedPath instead of
+   * reading u.RawPath directly.
+   */
+  escapedPath(): string
+ }
+ interface URL {
+  /**
+   * EscapedFragment returns the escaped form of u.Fragment.
+   * In general there are multiple possible escaped forms of any fragment.
+   * EscapedFragment returns u.RawFragment when it is a valid escaping of u.Fragment.
+   * Otherwise EscapedFragment ignores u.RawFragment and computes an escaped
+   * form on its own.
+   * The [URL.String] method uses EscapedFragment to construct its result.
+   * In general, code should call EscapedFragment instead of
+   * reading u.RawFragment directly.
+   */
+  escapedFragment(): string
+ }
+ interface URL {
+  /**
+   * String reassembles the [URL] into a valid URL string.
+   * The general form of the result is one of:
+   * 
+   * ```
+   * 	scheme:opaque?query#fragment
+   * 	scheme://userinfo@host/path?query#fragment
+   * ```
+   * 
+   * If u.Opaque is non-empty, String uses the first form;
+   * otherwise it uses the second form.
+   * Any non-ASCII characters in host are escaped.
+   * To obtain the path, String uses u.EscapedPath().
+   * 
+   * In the second form, the following rules apply:
+   * ```
+   *   - if u.Scheme is empty, scheme: is omitted.
+   *   - if u.User is nil, userinfo@ is omitted.
+   *   - if u.Host is empty, host/ is omitted.
+   *   - if u.Scheme and u.Host are empty and u.User is nil,
+   *     the entire scheme://userinfo@host/ is omitted.
+   *   - if u.Host is non-empty and u.Path begins with a /,
+   *     the form host/path does not add its own /.
+   *   - if u.RawQuery is empty, ?query is omitted.
+   *   - if u.Fragment is empty, #fragment is omitted.
+   * ```
+   */
+  string(): string
+ }
+ interface URL {
+  /**
+   * Redacted is like [URL.String] but replaces any password with "xxxxx".
+   * Only the password in u.User is redacted.
+   */
+  redacted(): string
+ }
+ /**
+  * Values maps a string key to a list of values.
+  * It is typically used for query parameters and form values.
+  * Unlike in the http.Header map, the keys in a Values map
+  * are case-sensitive.
+  */
+ interface Values extends _TygojaDict{}
+ interface Values {
+  /**
+   * Get gets the first value associated with the given key.
+   * If there are no values associated with the key, Get returns
+   * the empty string. To access multiple values, use the map
+   * directly.
+   */
+  get(key: string): string
+ }
+ interface Values {
+  /**
+   * Set sets the key to value. It replaces any existing
+   * values.
+   */
+  set(key: string, value: string): void
+ }
+ interface Values {
+  /**
+   * Add adds the value to key. It appends to any existing
+   * values associated with key.
+   */
+  add(key: string, value: string): void
+ }
+ interface Values {
+  /**
+   * Del deletes the values associated with key.
+   */
+  del(key: string): void
+ }
+ interface Values {
+  /**
+   * Has checks whether a given key is set.
+   */
+  has(key: string): boolean
+ }
+ interface Values {
+  /**
+   * Encode encodes the values into “URL encoded” form
+   * ("bar=baz&foo=quux") sorted by key.
+   */
+  encode(): string
+ }
+ interface URL {
+  /**
+   * IsAbs reports whether the [URL] is absolute.
+   * Absolute means that it has a non-empty scheme.
+   */
+  isAbs(): boolean
+ }
+ interface URL {
+  /**
+   * Parse parses a [URL] in the context of the receiver. The provided URL
+   * may be relative or absolute. Parse returns nil, err on parse
+   * failure, otherwise its return value is the same as [URL.ResolveReference].
+   */
+  parse(ref: string): (URL)
+ }
+ interface URL {
+  /**
+   * ResolveReference resolves a URI reference to an absolute URI from
+   * an absolute base URI u, per RFC 3986 Section 5.2. The URI reference
+   * may be relative or absolute. ResolveReference always returns a new
+   * [URL] instance, even if the returned URL is identical to either the
+   * base or reference. If ref is an absolute URL, then ResolveReference
+   * ignores base and returns a copy of ref.
+   */
+  resolveReference(ref: URL): (URL)
+ }
+ interface URL {
+  /**
+   * Query parses RawQuery and returns the corresponding values.
+   * It silently discards malformed value pairs.
+   * To check errors use [ParseQuery].
+   */
+  query(): Values
+ }
+ interface URL {
+  /**
+   * RequestURI returns the encoded path?query or opaque?query
+   * string that would be used in an HTTP request for u.
+   */
+  requestURI(): string
+ }
+ interface URL {
+  /**
+   * Hostname returns u.Host, stripping any valid port number if present.
+   * 
+   * If the result is enclosed in square brackets, as literal IPv6 addresses are,
+   * the square brackets are removed from the result.
+   */
+  hostname(): string
+ }
+ interface URL {
+  /**
+   * Port returns the port part of u.Host, without the leading colon.
+   * 
+   * If u.Host doesn't contain a valid numeric port, Port returns an empty string.
+   */
+  port(): string
+ }
+ interface URL {
+  marshalBinary(): string|Array<number>
+ }
+ interface URL {
+  appendBinary(b: string|Array<number>): string|Array<number>
+ }
+ interface URL {
+  unmarshalBinary(text: string|Array<number>): void
+ }
+ interface URL {
+  /**
+   * JoinPath returns a new [URL] with the provided path elements joined to
+   * any existing path and the resulting path cleaned of any ./ or ../ elements.
+   * Any sequences of multiple / characters will be reduced to a single /.
+   */
+  joinPath(...elem: string[]): (URL)
+ }
+}
+
+namespace types {
+}
+
+namespace net {
+ /**
+  * Addr represents a network end point address.
+  * 
+  * The two methods [Addr.Network] and [Addr.String] conventionally return strings
+  * that can be passed as the arguments to [Dial], but the exact form
+  * and meaning of the strings is up to the implementation.
+  */
+ interface Addr {
+  [key:string]: any;
+  network(): string // name of the network (for example, "tcp", "udp")
+  string(): string // string form of address (for example, "192.0.2.1:25", "[2001:db8::1]:80")
+ }
+}
+
+/**
+ * Package textproto implements generic support for text-based request/response
+ * protocols in the style of HTTP, NNTP, and SMTP.
+ * 
+ * The package provides:
+ * 
+ * [Error], which represents a numeric error response from
+ * a server.
+ * 
+ * [Pipeline], to manage pipelined requests and responses
+ * in a client.
+ * 
+ * [Reader], to read numeric response code lines,
+ * key: value headers, lines wrapped with leading spaces
+ * on continuation lines, and whole text blocks ending
+ * with a dot on a line by itself.
+ * 
+ * [Writer], to write dot-encoded text blocks.
+ * 
+ * [Conn], a convenient packaging of [Reader], [Writer], and [Pipeline] for use
+ * with a single network connection.
+ */
+namespace textproto {
+ /**
+  * A MIMEHeader represents a MIME-style header mapping
+  * keys to sets of values.
+  */
+ interface MIMEHeader extends _TygojaDict{}
+ interface MIMEHeader {
+  /**
+   * Add adds the key, value pair to the header.
+   * It appends to any existing values associated with key.
+   */
+  add(key: string, value: string): void
+ }
+ interface MIMEHeader {
+  /**
+   * Set sets the header entries associated with key to
+   * the single element value. It replaces any existing
+   * values associated with key.
+   */
+  set(key: string, value: string): void
+ }
+ interface MIMEHeader {
+  /**
+   * Get gets the first value associated with the given key.
+   * It is case insensitive; [CanonicalMIMEHeaderKey] is used
+   * to canonicalize the provided key.
+   * If there are no values associated with the key, Get returns "".
+   * To use non-canonical keys, access the map directly.
+   */
+  get(key: string): string
+ }
+ interface MIMEHeader {
+  /**
+   * Values returns all values associated with the given key.
+   * It is case insensitive; [CanonicalMIMEHeaderKey] is
+   * used to canonicalize the provided key. To use non-canonical
+   * keys, access the map directly.
+   * The returned slice is not a copy.
+   */
+  values(key: string): Array<string>
+ }
+ interface MIMEHeader {
+  /**
+   * Del deletes the values associated with key.
+   */
+  del(key: string): void
+ }
+}
+
+namespace multipart {
+ interface Reader {
+  /**
+   * ReadForm parses an entire multipart message whose parts have
+   * a Content-Disposition of "form-data".
+   * It stores up to maxMemory bytes + 10MB (reserved for non-file parts)
+   * in memory. File parts which can't be stored in memory will be stored on
+   * disk in temporary files.
+   * It returns [ErrMessageTooLarge] if all non-file parts can't be stored in
+   * memory.
+   */
+  readForm(maxMemory: number): (Form)
+ }
+ /**
+  * Form is a parsed multipart form.
+  * Its File parts are stored either in memory or on disk,
+  * and are accessible via the [*FileHeader]'s Open method.
+  * Its Value parts are stored as strings.
+  * Both are keyed by field name.
+  */
+ interface Form {
+  value: _TygojaDict
+  file: _TygojaDict
+ }
+ interface Form {
+  /**
+   * RemoveAll removes any temporary files associated with a [Form].
+   */
+  removeAll(): void
+ }
+ /**
+  * File is an interface to access the file part of a multipart message.
+  * Its contents may be either stored in memory or on disk.
+  * If stored on disk, the File's underlying concrete type will be an *os.File.
+  */
+ interface File {
+  [key:string]: any;
+ }
+ /**
+  * Reader is an iterator over parts in a MIME multipart body.
+  * Reader's underlying parser consumes its input as needed. Seeking
+  * isn't supported.
+  */
+ interface Reader {
+ }
+ interface Reader {
+  /**
+   * NextPart returns the next part in the multipart or an error.
+   * When there are no more parts, the error [io.EOF] is returned.
+   * 
+   * As a special case, if the "Content-Transfer-Encoding" header
+   * has a value of "quoted-printable", that header is instead
+   * hidden and the body is transparently decoded during Read calls.
+   */
+  nextPart(): (Part)
+ }
+ interface Reader {
+  /**
+   * NextRawPart returns the next part in the multipart or an error.
+   * When there are no more parts, the error [io.EOF] is returned.
+   * 
+   * Unlike [Reader.NextPart], it does not have special handling for
+   * "Content-Transfer-Encoding: quoted-printable".
+   */
+  nextRawPart(): (Part)
+ }
+}
+
+namespace http {
+ /**
+  * A Cookie represents an HTTP cookie as sent in the Set-Cookie header of an
+  * HTTP response or the Cookie header of an HTTP request.
+  * 
+  * See https://tools.ietf.org/html/rfc6265 for details.
+  */
+ interface Cookie {
+  name: string
+  value: string
+  quoted: boolean // indicates whether the Value was originally quoted
+  path: string // optional
+  domain: string // optional
+  expires: time.Time // optional
+  rawExpires: string // for reading cookies only
+  /**
+   * MaxAge=0 means no 'Max-Age' attribute specified.
+   * MaxAge<0 means delete cookie now, equivalently 'Max-Age: 0'
+   * MaxAge>0 means Max-Age attribute present and given in seconds
+   */
+  maxAge: number
+  secure: boolean
+  httpOnly: boolean
+  sameSite: SameSite
+  partitioned: boolean
+  raw: string
+  unparsed: Array<string> // Raw text of unparsed attribute-value pairs
+ }
+ interface Cookie {
+  /**
+   * String returns the serialization of the cookie for use in a [Cookie]
+   * header (if only Name and Value are set) or a Set-Cookie response
+   * header (if other fields are set).
+   * If c is nil or c.Name is invalid, the empty string is returned.
+   */
+  string(): string
+ }
+ interface Cookie {
+  /**
+   * Valid reports whether the cookie is valid.
+   */
+  valid(): void
+ }
+ // @ts-ignore
+ import mathrand = rand
+ /**
+  * A Header represents the key-value pairs in an HTTP header.
+  * 
+  * The keys should be in canonical form, as returned by
+  * [CanonicalHeaderKey].
+  */
+ interface Header extends _TygojaDict{}
+ interface Header {
+  /**
+   * Add adds the key, value pair to the header.
+   * It appends to any existing values associated with key.
+   * The key is case insensitive; it is canonicalized by
+   * [CanonicalHeaderKey].
+   */
+  add(key: string, value: string): void
+ }
+ interface Header {
+  /**
+   * Set sets the header entries associated with key to the
+   * single element value. It replaces any existing values
+   * associated with key. The key is case insensitive; it is
+   * canonicalized by [textproto.CanonicalMIMEHeaderKey].
+   * To use non-canonical keys, assign to the map directly.
+   */
+  set(key: string, value: string): void
+ }
+ interface Header {
+  /**
+   * Get gets the first value associated with the given key. If
+   * there are no values associated with the key, Get returns "".
+   * It is case insensitive; [textproto.CanonicalMIMEHeaderKey] is
+   * used to canonicalize the provided key. Get assumes that all
+   * keys are stored in canonical form. To use non-canonical keys,
+   * access the map directly.
+   */
+  get(key: string): string
+ }
+ interface Header {
+  /**
+   * Values returns all values associated with the given key.
+   * It is case insensitive; [textproto.CanonicalMIMEHeaderKey] is
+   * used to canonicalize the provided key. To use non-canonical
+   * keys, access the map directly.
+   * The returned slice is not a copy.
+   */
+  values(key: string): Array<string>
+ }
+ interface Header {
+  /**
+   * Del deletes the values associated with key.
+   * The key is case insensitive; it is canonicalized by
+   * [CanonicalHeaderKey].
+   */
+  del(key: string): void
+ }
+ interface Header {
+  /**
+   * Write writes a header in wire format.
+   */
+  write(w: io.Writer): void
+ }
+ interface Header {
+  /**
+   * Clone returns a copy of h or nil if h is nil.
+   */
+  clone(): Header
+ }
+ interface Header {
+  /**
+   * WriteSubset writes a header in wire format.
+   * If exclude is not nil, keys where exclude[key] == true are not written.
+   * Keys are not canonicalized before checking the exclude map.
+   */
+  writeSubset(w: io.Writer, exclude: _TygojaDict): void
+ }
+ /**
+  * Protocols is a set of HTTP protocols.
+  * The zero value is an empty set of protocols.
+  * 
+  * The supported protocols are:
+  * 
+  * ```
+  *   - HTTP1 is the HTTP/1.0 and HTTP/1.1 protocols.
+  *     HTTP1 is supported on both unsecured TCP and secured TLS connections.
+  * 
+  *   - HTTP2 is the HTTP/2 protcol over a TLS connection.
+  * 
+  *   - UnencryptedHTTP2 is the HTTP/2 protocol over an unsecured TCP connection.
+  * ```
+  */
+ interface Protocols {
+ }
+ interface Protocols {
+  /**
+   * HTTP1 reports whether p includes HTTP/1.
+   */
+  http1(): boolean
+ }
+ interface Protocols {
+  /**
+   * SetHTTP1 adds or removes HTTP/1 from p.
+   */
+  setHTTP1(ok: boolean): void
+ }
+ interface Protocols {
+  /**
+   * HTTP2 reports whether p includes HTTP/2.
+   */
+  http2(): boolean
+ }
+ interface Protocols {
+  /**
+   * SetHTTP2 adds or removes HTTP/2 from p.
+   */
+  setHTTP2(ok: boolean): void
+ }
+ interface Protocols {
+  /**
+   * UnencryptedHTTP2 reports whether p includes unencrypted HTTP/2.
+   */
+  unencryptedHTTP2(): boolean
+ }
+ interface Protocols {
+  /**
+   * SetUnencryptedHTTP2 adds or removes unencrypted HTTP/2 from p.
+   */
+  setUnencryptedHTTP2(ok: boolean): void
+ }
+ interface Protocols {
+  string(): string
+ }
+ /**
+  * HTTP2Config defines HTTP/2 configuration parameters common to
+  * both [Transport] and [Server].
+  */
+ interface HTTP2Config {
+  /**
+   * MaxConcurrentStreams optionally specifies the number of
+   * concurrent streams that a peer may have open at a time.
+   * If zero, MaxConcurrentStreams defaults to at least 100.
+   */
+  maxConcurrentStreams: number
+  /**
+   * MaxDecoderHeaderTableSize optionally specifies an upper limit for the
+   * size of the header compression table used for decoding headers sent
+   * by the peer.
+   * A valid value is less than 4MiB.
+   * If zero or invalid, a default value is used.
+   */
+  maxDecoderHeaderTableSize: number
+  /**
+   * MaxEncoderHeaderTableSize optionally specifies an upper limit for the
+   * header compression table used for sending headers to the peer.
+   * A valid value is less than 4MiB.
+   * If zero or invalid, a default value is used.
+   */
+  maxEncoderHeaderTableSize: number
+  /**
+   * MaxReadFrameSize optionally specifies the largest frame
+   * this endpoint is willing to read.
+   * A valid value is between 16KiB and 16MiB, inclusive.
+   * If zero or invalid, a default value is used.
+   */
+  maxReadFrameSize: number
+  /**
+   * MaxReceiveBufferPerConnection is the maximum size of the
+   * flow control window for data received on a connection.
+   * A valid value is at least 64KiB and less than 4MiB.
+   * If invalid, a default value is used.
+   */
+  maxReceiveBufferPerConnection: number
+  /**
+   * MaxReceiveBufferPerStream is the maximum size of
+   * the flow control window for data received on a stream (request).
+   * A valid value is less than 4MiB.
+   * If zero or invalid, a default value is used.
+   */
+  maxReceiveBufferPerStream: number
+  /**
+   * SendPingTimeout is the timeout after which a health check using a ping
+   * frame will be carried out if no frame is received on a connection.
+   * If zero, no health check is performed.
+   */
+  sendPingTimeout: time.Duration
+  /**
+   * PingTimeout is the timeout after which a connection will be closed
+   * if a response to a ping is not received.
+   * If zero, a default of 15 seconds is used.
+   */
+  pingTimeout: time.Duration
+  /**
+   * WriteByteTimeout is the timeout after which a connection will be
+   * closed if no data can be written to it. The timeout begins when data is
+   * available to write, and is extended whenever any bytes are written.
+   */
+  writeByteTimeout: time.Duration
+  /**
+   * PermitProhibitedCipherSuites, if true, permits the use of
+   * cipher suites prohibited by the HTTP/2 spec.
+   */
+  permitProhibitedCipherSuites: boolean
+  /**
+   * CountError, if non-nil, is called on HTTP/2 errors.
+   * It is intended to increment a metric for monitoring.
+   * The errType contains only lowercase letters, digits, and underscores
+   * (a-z, 0-9, _).
+   */
+  countError: (errType: string) => void
+ }
+ // @ts-ignore
+ import urlpkg = url
+ /**
+  * Response represents the response from an HTTP request.
+  * 
+  * The [Client] and [Transport] return Responses from servers once
+  * the response headers have been received. The response body
+  * is streamed on demand as the Body field is read.
+  */
+ interface Response {
+  status: string // e.g. "200 OK"
+  statusCode: number // e.g. 200
+  proto: string // e.g. "HTTP/1.0"
+  protoMajor: number // e.g. 1
+  protoMinor: number // e.g. 0
+  /**
+   * Header maps header keys to values. If the response had multiple
+   * headers with the same key, they may be concatenated, with comma
+   * delimiters.  (RFC 7230, section 3.2.2 requires that multiple headers
+   * be semantically equivalent to a comma-delimited sequence.) When
+   * Header values are duplicated by other fields in this struct (e.g.,
+   * ContentLength, TransferEncoding, Trailer), the field values are
+   * authoritative.
+   * 
+   * Keys in the map are canonicalized (see CanonicalHeaderKey).
+   */
+  header: Header
+  /**
+   * Body represents the response body.
+   * 
+   * The response body is streamed on demand as the Body field
+   * is read. If the network connection fails or the server
+   * terminates the response, Body.Read calls return an error.
+   * 
+   * The http Client and Transport guarantee that Body is always
+   * non-nil, even on responses without a body or responses with
+   * a zero-length body. It is the caller's responsibility to
+   * close Body. The default HTTP client's Transport may not
+   * reuse HTTP/1.x "keep-alive" TCP connections if the Body is
+   * not read to completion and closed.
+   * 
+   * The Body is automatically dechunked if the server replied
+   * with a "chunked" Transfer-Encoding.
+   * 
+   * As of Go 1.12, the Body will also implement io.Writer
+   * on a successful "101 Switching Protocols" response,
+   * as used by WebSockets and HTTP/2's "h2c" mode.
+   */
+  body: io.ReadCloser
+  /**
+   * ContentLength records the length of the associated content. The
+   * value -1 indicates that the length is unknown. Unless Request.Method
+   * is "HEAD", values >= 0 indicate that the given number of bytes may
+   * be read from Body.
+   */
+  contentLength: number
+  /**
+   * Contains transfer encodings from outer-most to inner-most. Value is
+   * nil, means that "identity" encoding is used.
+   */
+  transferEncoding: Array<string>
+  /**
+   * Close records whether the header directed that the connection be
+   * closed after reading Body. The value is advice for clients: neither
+   * ReadResponse nor Response.Write ever closes a connection.
+   */
+  close: boolean
+  /**
+   * Uncompressed reports whether the response was sent compressed but
+   * was decompressed by the http package. When true, reading from
+   * Body yields the uncompressed content instead of the compressed
+   * content actually set from the server, ContentLength is set to -1,
+   * and the "Content-Length" and "Content-Encoding" fields are deleted
+   * from the responseHeader. To get the original response from
+   * the server, set Transport.DisableCompression to true.
+   */
+  uncompressed: boolean
+  /**
+   * Trailer maps trailer keys to values in the same
+   * format as Header.
+   * 
+   * The Trailer initially contains only nil values, one for
+   * each key specified in the server's "Trailer" header
+   * value. Those values are not added to Header.
+   * 
+   * Trailer must not be accessed concurrently with Read calls
+   * on the Body.
+   * 
+   * After Body.Read has returned io.EOF, Trailer will contain
+   * any trailer values sent by the server.
+   */
+  trailer: Header
+  /**
+   * Request is the request that was sent to obtain this Response.
+   * Request's Body is nil (having already been consumed).
+   * This is only populated for Client requests.
+   */
+  request?: Request
+  /**
+   * TLS contains information about the TLS connection on which the
+   * response was received. It is nil for unencrypted responses.
+   * The pointer is shared between responses and should not be
+   * modified.
+   */
+  tls?: any
+ }
+ interface Response {
+  /**
+   * Cookies parses and returns the cookies set in the Set-Cookie headers.
+   */
+  cookies(): Array<(Cookie | undefined)>
+ }
+ interface Response {
+  /**
+   * Location returns the URL of the response's "Location" header,
+   * if present. Relative redirects are resolved relative to
+   * [Response.Request]. [ErrNoLocation] is returned if no
+   * Location header is present.
+   */
+  location(): (url.URL)
+ }
+ interface Response {
+  /**
+   * ProtoAtLeast reports whether the HTTP protocol used
+   * in the response is at least major.minor.
+   */
+  protoAtLeast(major: number, minor: number): boolean
+ }
+ interface Response {
+  /**
+   * Write writes r to w in the HTTP/1.x server response format,
+   * including the status line, headers, body, and optional trailer.
+   * 
+   * This method consults the following fields of the response r:
+   * 
+   * ```
+   * 	StatusCode
+   * 	ProtoMajor
+   * 	ProtoMinor
+   * 	Request.Method
+   * 	TransferEncoding
+   * 	Trailer
+   * 	Body
+   * 	ContentLength
+   * 	Header, values for non-canonical keys will have unpredictable behavior
+   * ```
+   * 
+   * The Response Body is closed after it is sent.
+   */
+  write(w: io.Writer): void
+ }
+ /**
+  * A ConnState represents the state of a client connection to a server.
+  * It's used by the optional [Server.ConnState] hook.
+  */
+ interface ConnState extends Number{}
+ interface ConnState {
+  string(): string
+ }
+}
+
+/**
+ * Package oauth2 provides support for making
+ * OAuth2 authorized and authenticated HTTP requests,
+ * as specified in RFC 6749.
+ * It can additionally grant authorization with Bearer JWT.
+ */
+namespace oauth2 {
+ /**
+  * An AuthCodeOption is passed to Config.AuthCodeURL.
+  */
+ interface AuthCodeOption {
+  [key:string]: any;
+ }
+ /**
+  * Token represents the credentials used to authorize
+  * the requests to access protected resources on the OAuth 2.0
+  * provider's backend.
+  * 
+  * Most users of this package should not access fields of Token
+  * directly. They're exported mostly for use by related packages
+  * implementing derivative OAuth2 flows.
+  */
+ interface Token {
+  /**
+   * AccessToken is the token that authorizes and authenticates
+   * the requests.
+   */
+  accessToken: string
+  /**
+   * TokenType is the type of token.
+   * The Type method returns either this or "Bearer", the default.
+   */
+  tokenType: string
+  /**
+   * RefreshToken is a token that's used by the application
+   * (as opposed to the user) to refresh the access token
+   * if it expires.
+   */
+  refreshToken: string
+  /**
+   * Expiry is the optional expiration time of the access token.
+   * 
+   * If zero, [TokenSource] implementations will reuse the same
+   * token forever and RefreshToken or equivalent
+   * mechanisms for that TokenSource will not be used.
+   */
+  expiry: time.Time
+  /**
+   * ExpiresIn is the OAuth2 wire format "expires_in" field,
+   * which specifies how many seconds later the token expires,
+   * relative to an unknown time base approximately around "now".
+   * It is the application's responsibility to populate
+   * `Expiry` from `ExpiresIn` when required.
+   */
+  expiresIn: number
+ }
+ interface Token {
+  /**
+   * Type returns t.TokenType if non-empty, else "Bearer".
+   */
+  type(): string
+ }
+ interface Token {
+  /**
+   * SetAuthHeader sets the Authorization header to r using the access
+   * token in t.
+   * 
+   * This method is unnecessary when using [Transport] or an HTTP Client
+   * returned by this package.
+   */
+  setAuthHeader(r: http.Request): void
+ }
+ interface Token {
+  /**
+   * WithExtra returns a new [Token] that's a clone of t, but using the
+   * provided raw extra map. This is only intended for use by packages
+   * implementing derivative OAuth2 flows.
+   */
+  withExtra(extra: any): (Token)
+ }
+ interface Token {
+  /**
+   * Extra returns an extra field.
+   * Extra fields are key-value pairs returned by the server as
+   * part of the token retrieval response.
+   */
+  extra(key: string): any
+ }
+ interface Token {
+  /**
+   * Valid reports whether t is non-nil, has an AccessToken, and is not expired.
+   */
+  valid(): boolean
+ }
+}
+
+namespace cobra {
+ interface PositionalArgs {(cmd: Command, args: Array<string>): void }
+ // @ts-ignore
+ import flag = pflag
+ /**
+  * FParseErrWhitelist configures Flag parse errors to be ignored
+  */
+ interface FParseErrWhitelist extends _TygojaAny{}
+ /**
+  * Group Structure to manage groups for commands
+  */
+ interface Group {
+  id: string
+  title: string
+ }
+ /**
+  * CompletionOptions are the options to control shell completion
+  */
+ interface CompletionOptions {
+  /**
+   * DisableDefaultCmd prevents Cobra from creating a default 'completion' command
+   */
+  disableDefaultCmd: boolean
+  /**
+   * DisableNoDescFlag prevents Cobra from creating the '--no-descriptions' flag
+   * for shells that support completion descriptions
+   */
+  disableNoDescFlag: boolean
+  /**
+   * DisableDescriptions turns off all completion descriptions for shells
+   * that support them
+   */
+  disableDescriptions: boolean
+  /**
+   * HiddenDefaultCmd makes the default 'completion' command hidden
+   */
+  hiddenDefaultCmd: boolean
+  /**
+   * DefaultShellCompDirective sets the ShellCompDirective that is returned
+   * if no special directive can be determined
+   */
+  defaultShellCompDirective?: ShellCompDirective
+ }
+ interface CompletionOptions {
+  setDefaultShellCompDirective(directive: ShellCompDirective): void
+ }
+ /**
+  * Completion is a string that can be used for completions
+  * 
+  * two formats are supported:
+  * ```
+  *   - the completion choice
+  *   - the completion choice with a textual description (separated by a TAB).
+  * ```
+  * 
+  * [CompletionWithDesc] can be used to create a completion string with a textual description.
+  * 
+  * Note: Go type alias is used to provide a more descriptive name in the documentation, but any string can be used.
+  */
+ interface Completion extends String{}
+ /**
+  * CompletionFunc is a function that provides completion results.
+  */
+ interface CompletionFunc {(cmd: Command, args: Array<string>, toComplete: string): [Array<Completion>, ShellCompDirective] }
+}
+
+namespace cron {
+ /**
+  * Job defines a single registered cron job.
+  */
+ interface Job {
+ }
+ interface Job {
+  /**
+   * Id returns the cron job id.
+   */
+  id(): string
+ }
+ interface Job {
+  /**
+   * Expression returns the plain cron job schedule expression.
+   */
+  expression(): string
+ }
+ interface Job {
+  /**
+   * Run runs the cron job function.
+   */
+  run(): void
+ }
+ interface Job {
+  /**
+   * MarshalJSON implements [json.Marshaler] and export the current
+   * jobs data into valid JSON.
+   */
+  marshalJSON(): string|Array<number>
+ }
+}
+
+namespace store {
+}
+
+namespace sql {
+ /**
+  * IsolationLevel is the transaction isolation level used in [TxOptions].
+  */
+ interface IsolationLevel extends Number{}
+ interface IsolationLevel {
+  /**
+   * String returns the name of the transaction isolation level.
+   */
+  string(): string
+ }
+ /**
+  * DBStats contains database statistics.
+  */
+ interface DBStats {
+  maxOpenConnections: number // Maximum number of open connections to the database.
+  /**
+   * Pool Status
+   */
+  openConnections: number // The number of established connections both in use and idle.
+  inUse: number // The number of connections currently in use.
+  idle: number // The number of idle connections.
+  /**
+   * Counters
+   */
+  waitCount: number // The total number of connections waited for.
+  waitDuration: time.Duration // The total time blocked waiting for a new connection.
+  maxIdleClosed: number // The total number of connections closed due to SetMaxIdleConns.
+  maxIdleTimeClosed: number // The total number of connections closed due to SetConnMaxIdleTime.
+  maxLifetimeClosed: number // The total number of connections closed due to SetConnMaxLifetime.
+ }
+ /**
+  * Conn represents a single database connection rather than a pool of database
+  * connections. Prefer running queries from [DB] unless there is a specific
+  * need for a continuous single database connection.
+  * 
+  * A Conn must call [Conn.Close] to return the connection to the database pool
+  * and may do so concurrently with a running query.
+  * 
+  * After a call to [Conn.Close], all operations on the
+  * connection fail with [ErrConnDone].
+  */
+ interface Conn {
+ }
+ interface Conn {
+  /**
+   * PingContext verifies the connection to the database is still alive.
+   */
+  pingContext(ctx: context.Context): void
+ }
+ interface Conn {
+  /**
+   * ExecContext executes a query without returning any rows.
+   * The args are for any placeholder parameters in the query.
+   */
+  execContext(ctx: context.Context, query: string, ...args: any[]): Result
+ }
+ interface Conn {
+  /**
+   * QueryContext executes a query that returns rows, typically a SELECT.
+   * The args are for any placeholder parameters in the query.
+   */
+  queryContext(ctx: context.Context, query: string, ...args: any[]): (Rows)
+ }
+ interface Conn {
+  /**
+   * QueryRowContext executes a query that is expected to return at most one row.
+   * QueryRowContext always returns a non-nil value. Errors are deferred until
+   * the [*Row.Scan] method is called.
+   * If the query selects no rows, the [*Row.Scan] will return [ErrNoRows].
+   * Otherwise, the [*Row.Scan] scans the first selected row and discards
+   * the rest.
+   */
+  queryRowContext(ctx: context.Context, query: string, ...args: any[]): (Row)
+ }
+ interface Conn {
+  /**
+   * PrepareContext creates a prepared statement for later queries or executions.
+   * Multiple queries or executions may be run concurrently from the
+   * returned statement.
+   * The caller must call the statement's [*Stmt.Close] method
+   * when the statement is no longer needed.
+   * 
+   * The provided context is used for the preparation of the statement, not for the
+   * execution of the statement.
+   */
+  prepareContext(ctx: context.Context, query: string): (Stmt)
+ }
+ interface Conn {
+  /**
+   * Raw executes f exposing the underlying driver connection for the
+   * duration of f. The driverConn must not be used outside of f.
+   * 
+   * Once f returns and err is not [driver.ErrBadConn], the [Conn] will continue to be usable
+   * until [Conn.Close] is called.
+   */
+  raw(f: (driverConn: any) => void): void
+ }
+ interface Conn {
+  /**
+   * BeginTx starts a transaction.
+   * 
+   * The provided context is used until the transaction is committed or rolled back.
+   * If the context is canceled, the sql package will roll back
+   * the transaction. [Tx.Commit] will return an error if the context provided to
+   * BeginTx is canceled.
+   * 
+   * The provided [TxOptions] is optional and may be nil if defaults should be used.
+   * If a non-default isolation level is used that the driver doesn't support,
+   * an error will be returned.
+   */
+  beginTx(ctx: context.Context, opts: TxOptions): (Tx)
+ }
+ interface Conn {
+  /**
+   * Close returns the connection to the connection pool.
+   * All operations after a Close will return with [ErrConnDone].
+   * Close is safe to call concurrently with other operations and will
+   * block until all other operations finish. It may be useful to first
+   * cancel any used context and then call close directly after.
+   */
+  close(): void
+ }
+ /**
+  * ColumnType contains the name and type of a column.
+  */
+ interface ColumnType {
+ }
+ interface ColumnType {
+  /**
+   * Name returns the name or alias of the column.
+   */
+  name(): string
+ }
+ interface ColumnType {
+  /**
+   * Length returns the column type length for variable length column types such
+   * as text and binary field types. If the type length is unbounded the value will
+   * be [math.MaxInt64] (any database limits will still apply).
+   * If the column type is not variable length, such as an int, or if not supported
+   * by the driver ok is false.
+   */
+  length(): [number, boolean]
+ }
+ interface ColumnType {
+  /**
+   * DecimalSize returns the scale and precision of a decimal type.
+   * If not applicable or if not supported ok is false.
+   */
+  decimalSize(): [number, number, boolean]
+ }
+ interface ColumnType {
+  /**
+   * ScanType returns a Go type suitable for scanning into using [Rows.Scan].
+   * If a driver does not support this property ScanType will return
+   * the type of an empty interface.
+   */
+  scanType(): any
+ }
+ interface ColumnType {
+  /**
+   * Nullable reports whether the column may be null.
+   * If a driver does not support this property ok will be false.
+   */
+  nullable(): [boolean, boolean]
+ }
+ interface ColumnType {
+  /**
+   * DatabaseTypeName returns the database system name of the column type. If an empty
+   * string is returned, then the driver type name is not supported.
+   * Consult your driver documentation for a list of driver data types. [ColumnType.Length] specifiers
+   * are not included.
+   * Common type names include "VARCHAR", "TEXT", "NVARCHAR", "DECIMAL", "BOOL",
+   * "INT", and "BIGINT".
+   */
+  databaseTypeName(): string
+ }
+ /**
+  * Row is the result of calling [DB.QueryRow] to select a single row.
+  */
+ interface Row {
+ }
+ interface Row {
+  /**
+   * Scan copies the columns from the matched row into the values
+   * pointed at by dest. See the documentation on [Rows.Scan] for details.
+   * If more than one row matches the query,
+   * Scan uses the first row and discards the rest. If no row matches
+   * the query, Scan returns [ErrNoRows].
+   */
+  scan(...dest: any[]): void
+ }
+ interface Row {
+  /**
+   * Err provides a way for wrapping packages to check for
+   * query errors without calling [Row.Scan].
+   * Err returns the error, if any, that was encountered while running the query.
+   * If this error is not nil, this error will also be returned from [Row.Scan].
+   */
+  err(): void
+ }
+}
+
+namespace jwt {
+ /**
+  * NumericDate represents a JSON numeric date value, as referenced at
+  * https://datatracker.ietf.org/doc/html/rfc7519#section-2.
+  */
+ type _scRHKob = time.Time
+ interface NumericDate extends _scRHKob {
+ }
+ interface NumericDate {
+  /**
+   * MarshalJSON is an implementation of the json.RawMessage interface and serializes the UNIX epoch
+   * represented in NumericDate to a byte array, using the precision specified in TimePrecision.
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface NumericDate {
+  /**
+   * UnmarshalJSON is an implementation of the json.RawMessage interface and
+   * deserializes a [NumericDate] from a JSON representation, i.e. a
+   * [json.Number]. This number represents an UNIX epoch with either integer or
+   * non-integer seconds.
+   */
+  unmarshalJSON(b: string|Array<number>): void
+ }
+ /**
+  * ClaimStrings is basically just a slice of strings, but it can be either
+  * serialized from a string array or just a string. This type is necessary,
+  * since the "aud" claim can either be a single string or an array.
+  */
+ interface ClaimStrings extends Array<string>{}
+ interface ClaimStrings {
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface ClaimStrings {
+  marshalJSON(): string|Array<number>
+ }
+}
+
+namespace search {
+}
+
+namespace hook {
+ /**
+  * wrapped local Hook embedded struct to limit the public API surface.
+  */
+ type _sxHMxkR<T> = Hook<T>
+ interface mainHook<T> extends _sxHMxkR<T> {
+ }
+}
+
+namespace router {
+ // @ts-ignore
+ import validation = ozzo_validation
+ /**
+  * RouterGroup represents a collection of routes and other sub groups
+  * that share common pattern prefix and middlewares.
+  */
+ interface RouterGroup<T> {
+  prefix: string
+  middlewares: Array<(hook.Handler<T> | undefined)>
+ }
+ interface RouterGroup<T> {
+  /**
+   * Group creates and register a new child Group into the current one
+   * with the specified prefix.
+   * 
+   * The prefix follows the standard Go net/http ServeMux pattern format ("[HOST]/[PATH]")
+   * and will be concatenated recursively into the final route path, meaning that
+   * only the root level group could have HOST as part of the prefix.
+   * 
+   * Returns the newly created group to allow chaining and registering
+   * sub-routes and group specific middlewares.
+   */
+  group(prefix: string): (RouterGroup<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * BindFunc registers one or multiple middleware functions to the current group.
+   * 
+   * The registered middleware functions are "anonymous" and with default priority,
+   * aka. executes in the order they were registered.
+   * 
+   * If you need to specify a named middleware (ex. so that it can be removed)
+   * or middleware with custom exec prirority, use [RouterGroup.Bind] method.
+   */
+  bindFunc(...middlewareFuncs: ((e: T) => void)[]): (RouterGroup<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * Bind registers one or multiple middleware handlers to the current group.
+   */
+  bind(...middlewares: (hook.Handler<T> | undefined)[]): (RouterGroup<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * Unbind removes one or more middlewares with the specified id(s)
+   * from the current group and its children (if any).
+   * 
+   * Anonymous middlewares are not removable, aka. this method does nothing
+   * if the middleware id is an empty string.
+   */
+  unbind(...middlewareIds: string[]): (RouterGroup<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * Route registers a single route into the current group.
+   * 
+   * Note that the final route path will be the concatenation of all parent groups prefixes + the route path.
+   * The path follows the standard Go net/http ServeMux format ("[HOST]/[PATH]"),
+   * meaning that only a top level group route could have HOST as part of the prefix.
+   * 
+   * Returns the newly created route to allow attaching route-only middlewares.
+   */
+  route(method: string, path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * Any is a shorthand for [RouterGroup.AddRoute] with "" as route method (aka. matches any method).
+   */
+  any(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * GET is a shorthand for [RouterGroup.AddRoute] with GET as route method.
+   */
+  get(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * SEARCH is a shorthand for [RouterGroup.AddRoute] with SEARCH as route method.
+   */
+  search(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * POST is a shorthand for [RouterGroup.AddRoute] with POST as route method.
+   */
+  post(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * DELETE is a shorthand for [RouterGroup.AddRoute] with DELETE as route method.
+   */
+  delete(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * PATCH is a shorthand for [RouterGroup.AddRoute] with PATCH as route method.
+   */
+  patch(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * PUT is a shorthand for [RouterGroup.AddRoute] with PUT as route method.
+   */
+  put(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * HEAD is a shorthand for [RouterGroup.AddRoute] with HEAD as route method.
+   */
+  head(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * OPTIONS is a shorthand for [RouterGroup.AddRoute] with OPTIONS as route method.
+   */
+  options(path: string, action: (e: T) => void): (Route<T>)
+ }
+ interface RouterGroup<T> {
+  /**
+   * HasRoute checks whether the specified route pattern (method + path)
+   * is registered in the current group or its children.
+   * 
+   * This could be useful to conditionally register and checks for routes
+   * in order prevent panic on duplicated routes.
+   * 
+   * Note that routes with anonymous and named wildcard placeholder are treated as equal,
+   * aka. "GET /abc/" is considered the same as "GET /abc/{something...}".
+   */
+  hasRoute(method: string, path: string): boolean
+ }
+}
+
+namespace slog {
+ /**
+  * An Attr is a key-value pair.
+  */
+ interface Attr {
+  key: string
+  value: Value
+ }
+ interface Attr {
+  /**
+   * Equal reports whether a and b have equal keys and values.
+   */
+  equal(b: Attr): boolean
+ }
+ interface Attr {
+  string(): string
+ }
+ /**
+  * A Handler handles log records produced by a Logger.
+  * 
+  * A typical handler may print log records to standard error,
+  * or write them to a file or database, or perhaps augment them
+  * with additional attributes and pass them on to another handler.
+  * 
+  * Any of the Handler's methods may be called concurrently with itself
+  * or with other methods. It is the responsibility of the Handler to
+  * manage this concurrency.
+  * 
+  * Users of the slog package should not invoke Handler methods directly.
+  * They should use the methods of [Logger] instead.
+  */
+ interface Handler {
+  [key:string]: any;
+  /**
+   * Enabled reports whether the handler handles records at the given level.
+   * The handler ignores records whose level is lower.
+   * It is called early, before any arguments are processed,
+   * to save effort if the log event should be discarded.
+   * If called from a Logger method, the first argument is the context
+   * passed to that method, or context.Background() if nil was passed
+   * or the method does not take a context.
+   * The context is passed so Enabled can use its values
+   * to make a decision.
+   */
+  enabled(_arg0: context.Context, _arg1: Level): boolean
+  /**
+   * Handle handles the Record.
+   * It will only be called when Enabled returns true.
+   * The Context argument is as for Enabled.
+   * It is present solely to provide Handlers access to the context's values.
+   * Canceling the context should not affect record processing.
+   * (Among other things, log messages may be necessary to debug a
+   * cancellation-related problem.)
+   * 
+   * Handle methods that produce output should observe the following rules:
+   * ```
+   *   - If r.Time is the zero time, ignore the time.
+   *   - If r.PC is zero, ignore it.
+   *   - Attr's values should be resolved.
+   *   - If an Attr's key and value are both the zero value, ignore the Attr.
+   *     This can be tested with attr.Equal(Attr{}).
+   *   - If a group's key is empty, inline the group's Attrs.
+   *   - If a group has no Attrs (even if it has a non-empty key),
+   *     ignore it.
+   * ```
+   */
+  handle(_arg0: context.Context, _arg1: Record): void
+  /**
+   * WithAttrs returns a new Handler whose attributes consist of
+   * both the receiver's attributes and the arguments.
+   * The Handler owns the slice: it may retain, modify or discard it.
+   */
+  withAttrs(attrs: Array<Attr>): Handler
+  /**
+   * WithGroup returns a new Handler with the given group appended to
+   * the receiver's existing groups.
+   * The keys of all subsequent attributes, whether added by With or in a
+   * Record, should be qualified by the sequence of group names.
+   * 
+   * How this qualification happens is up to the Handler, so long as
+   * this Handler's attribute keys differ from those of another Handler
+   * with a different sequence of group names.
+   * 
+   * A Handler should treat WithGroup as starting a Group of Attrs that ends
+   * at the end of the log event. That is,
+   * 
+   * ```
+   *     logger.WithGroup("s").LogAttrs(ctx, level, msg, slog.Int("a", 1), slog.Int("b", 2))
+   * ```
+   * 
+   * should behave like
+   * 
+   * ```
+   *     logger.LogAttrs(ctx, level, msg, slog.Group("s", slog.Int("a", 1), slog.Int("b", 2)))
+   * ```
+   * 
+   * If the name is empty, WithGroup returns the receiver.
+   */
+  withGroup(name: string): Handler
+ }
+ /**
+  * A Level is the importance or severity of a log event.
+  * The higher the level, the more important or severe the event.
+  */
+ interface Level extends Number{}
+ interface Level {
+  /**
+   * String returns a name for the level.
+   * If the level has a name, then that name
+   * in uppercase is returned.
+   * If the level is between named values, then
+   * an integer is appended to the uppercased name.
+   * Examples:
+   * 
+   * ```
+   * 	LevelWarn.String() => "WARN"
+   * 	(LevelInfo+2).String() => "INFO+2"
+   * ```
+   */
+  string(): string
+ }
+ interface Level {
+  /**
+   * MarshalJSON implements [encoding/json.Marshaler]
+   * by quoting the output of [Level.String].
+   */
+  marshalJSON(): string|Array<number>
+ }
+ interface Level {
+  /**
+   * UnmarshalJSON implements [encoding/json.Unmarshaler]
+   * It accepts any string produced by [Level.MarshalJSON],
+   * ignoring case.
+   * It also accepts numeric offsets that would result in a different string on
+   * output. For example, "Error-8" would marshal as "INFO".
+   */
+  unmarshalJSON(data: string|Array<number>): void
+ }
+ interface Level {
+  /**
+   * AppendText implements [encoding.TextAppender]
+   * by calling [Level.String].
+   */
+  appendText(b: string|Array<number>): string|Array<number>
+ }
+ interface Level {
+  /**
+   * MarshalText implements [encoding.TextMarshaler]
+   * by calling [Level.AppendText].
+   */
+  marshalText(): string|Array<number>
+ }
+ interface Level {
+  /**
+   * UnmarshalText implements [encoding.TextUnmarshaler].
+   * It accepts any string produced by [Level.MarshalText],
+   * ignoring case.
+   * It also accepts numeric offsets that would result in a different string on
+   * output. For example, "Error-8" would marshal as "INFO".
+   */
+  unmarshalText(data: string|Array<number>): void
+ }
+ interface Level {
+  /**
+   * Level returns the receiver.
+   * It implements [Leveler].
+   */
+  level(): Level
+ }
+ // @ts-ignore
+ import loginternal = internal
+}
+
+namespace subscriptions {
+}
+
+namespace url {
+ /**
+  * The Userinfo type is an immutable encapsulation of username and
+  * password details for a [URL]. An existing Userinfo value is guaranteed
+  * to have a username set (potentially empty, as allowed by RFC 2396),
+  * and optionally a password.
+  */
+ interface Userinfo {
+ }
+ interface Userinfo {
+  /**
+   * Username returns the username.
+   */
+  username(): string
+ }
+ interface Userinfo {
+  /**
+   * Password returns the password in case it is set, and whether it is set.
+   */
+  password(): [string, boolean]
+ }
+ interface Userinfo {
+  /**
+   * String returns the encoded userinfo information in the standard form
+   * of "username[:password]".
+   */
+  string(): string
+ }
+}
+
+namespace multipart {
+ /**
+  * A Part represents a single part in a multipart body.
+  */
+ interface Part {
+  /**
+   * The headers of the body, if any, with the keys canonicalized
+   * in the same fashion that the Go http.Request headers are.
+   * For example, "foo-bar" changes case to "Foo-Bar"
+   */
+  header: textproto.MIMEHeader
+ }
+ interface Part {
+  /**
+   * FormName returns the name parameter if p has a Content-Disposition
+   * of type "form-data".  Otherwise it returns the empty string.
+   */
+  formName(): string
+ }
+ interface Part {
+  /**
+   * FileName returns the filename parameter of the [Part]'s Content-Disposition
+   * header. If not empty, the filename is passed through filepath.Base (which is
+   * platform dependent) before being returned.
+   */
+  fileName(): string
+ }
+ interface Part {
+  /**
+   * Read reads the body of a part, after its headers and before the
+   * next part (if any) begins.
+   */
+  read(d: string|Array<number>): number
+ }
+ interface Part {
+  close(): void
+ }
+}
+
+namespace http {
+ /**
+  * SameSite allows a server to define a cookie attribute making it impossible for
+  * the browser to send this cookie along with cross-site requests. The main
+  * goal is to mitigate the risk of cross-origin information leakage, and provide
+  * some protection against cross-site request forgery attacks.
+  * 
+  * See https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00 for details.
+  */
+ interface SameSite extends Number{}
+ // @ts-ignore
+ import mathrand = rand
+ // @ts-ignore
+ import urlpkg = url
+}
+
+namespace oauth2 {
+}
+
+namespace cobra {
+ // @ts-ignore
+ import flag = pflag
+ /**
+  * ShellCompDirective is a bit map representing the different behaviors the shell
+  * can be instructed to have once completions have been provided.
+  */
+ interface ShellCompDirective extends Number{}
+}
+
+namespace router {
+ // @ts-ignore
+ import validation = ozzo_validation
+ interface Route<T> {
+  action: (e: T) => void
+  method: string
+  path: string
+  middlewares: Array<(hook.Handler<T> | undefined)>
+ }
+ interface Route<T> {
+  /**
+   * BindFunc registers one or multiple middleware functions to the current route.
+   * 
+   * The registered middleware functions are "anonymous" and with default priority,
+   * aka. executes in the order they were registered.
+   * 
+   * If you need to specify a named middleware (ex. so that it can be removed)
+   * or middleware with custom exec prirority, use the [Route.Bind] method.
+   */
+  bindFunc(...middlewareFuncs: ((e: T) => void)[]): (Route<T>)
+ }
+ interface Route<T> {
+  /**
+   * Bind registers one or multiple middleware handlers to the current route.
+   */
+  bind(...middlewares: (hook.Handler<T> | undefined)[]): (Route<T>)
+ }
+ interface Route<T> {
+  /**
+   * Unbind removes one or more middlewares with the specified id(s) from the current route.
+   * 
+   * It also adds the removed middleware ids to an exclude list so that they could be skipped from
+   * the execution chain in case the middleware is registered in a parent group.
+   * 
+   * Anonymous middlewares are considered non-removable, aka. this method
+   * does nothing if the middleware id is an empty string.
+   */
+  unbind(...middlewareIds: string[]): (Route<T>)
+ }
+}
+
+namespace slog {
+ // @ts-ignore
+ import loginternal = internal
+ /**
+  * A Record holds information about a log event.
+  * Copies of a Record share state.
+  * Do not modify a Record after handing out a copy to it.
+  * Call [NewRecord] to create a new Record.
+  * Use [Record.Clone] to create a copy with no shared state.
+  */
+ interface Record {
+  /**
+   * The time at which the output method (Log, Info, etc.) was called.
+   */
+  time: time.Time
+  /**
+   * The log message.
+   */
+  message: string
+  /**
+   * The level of the event.
+   */
+  level: Level
+  /**
+   * The program counter at the time the record was constructed, as determined
+   * by runtime.Callers. If zero, no program counter is available.
+   * 
+   * The only valid use for this value is as an argument to
+   * [runtime.CallersFrames]. In particular, it must not be passed to
+   * [runtime.FuncForPC].
+   */
+  pc: number
+ }
+ interface Record {
+  /**
+   * Clone returns a copy of the record with no shared state.
+   * The original record and the clone can both be modified
+   * without interfering with each other.
+   */
+  clone(): Record
+ }
+ interface Record {
+  /**
+   * NumAttrs returns the number of attributes in the [Record].
+   */
+  numAttrs(): number
+ }
+ interface Record {
+  /**
+   * Attrs calls f on each Attr in the [Record].
+   * Iteration stops if f returns false.
+   */
+  attrs(f: (_arg0: Attr) => boolean): void
+ }
+ interface Record {
+  /**
+   * AddAttrs appends the given Attrs to the [Record]'s list of Attrs.
+   * It omits empty groups.
+   */
+  addAttrs(...attrs: Attr[]): void
+ }
+ interface Record {
+  /**
+   * Add converts the args to Attrs as described in [Logger.Log],
+   * then appends the Attrs to the [Record]'s list of Attrs.
+   * It omits empty groups.
+   */
+  add(...args: any[]): void
+ }
+ /**
+  * A Value can represent any Go value, but unlike type any,
+  * it can represent most small values without an allocation.
+  * The zero Value corresponds to nil.
+  */
+ interface Value {
+ }
+ interface Value {
+  /**
+   * Kind returns v's Kind.
+   */
+  kind(): Kind
+ }
+ interface Value {
+  /**
+   * Any returns v's value as an any.
+   */
+  any(): any
+ }
+ interface Value {
+  /**
+   * String returns Value's value as a string, formatted like [fmt.Sprint]. Unlike
+   * the methods Int64, Float64, and so on, which panic if v is of the
+   * wrong kind, String never panics.
+   */
+  string(): string
+ }
+ interface Value {
+  /**
+   * Int64 returns v's value as an int64. It panics
+   * if v is not a signed integer.
+   */
+  int64(): number
+ }
+ interface Value {
+  /**
+   * Uint64 returns v's value as a uint64. It panics
+   * if v is not an unsigned integer.
+   */
+  uint64(): number
+ }
+ interface Value {
+  /**
+   * Bool returns v's value as a bool. It panics
+   * if v is not a bool.
+   */
+  bool(): boolean
+ }
+ interface Value {
+  /**
+   * Duration returns v's value as a [time.Duration]. It panics
+   * if v is not a time.Duration.
+   */
+  duration(): time.Duration
+ }
+ interface Value {
+  /**
+   * Float64 returns v's value as a float64. It panics
+   * if v is not a float64.
+   */
+  float64(): number
+ }
+ interface Value {
+  /**
+   * Time returns v's value as a [time.Time]. It panics
+   * if v is not a time.Time.
+   */
+  time(): time.Time
+ }
+ interface Value {
+  /**
+   * LogValuer returns v's value as a LogValuer. It panics
+   * if v is not a LogValuer.
+   */
+  logValuer(): LogValuer
+ }
+ interface Value {
+  /**
+   * Group returns v's value as a []Attr.
+   * It panics if v's [Kind] is not [KindGroup].
+   */
+  group(): Array<Attr>
+ }
+ interface Value {
+  /**
+   * Equal reports whether v and w represent the same Go value.
+   */
+  equal(w: Value): boolean
+ }
+ interface Value {
+  /**
+   * Resolve repeatedly calls LogValue on v while it implements [LogValuer],
+   * and returns the result.
+   * If v resolves to a group, the group's attributes' values are not recursively
+   * resolved.
+   * If the number of LogValue calls exceeds a threshold, a Value containing an
+   * error is returned.
+   * Resolve's return value is guaranteed not to be of Kind [KindLogValuer].
+   */
+  resolve(): Value
+ }
+}
+
+namespace router {
+ // @ts-ignore
+ import validation = ozzo_validation
+}
+
+namespace slog {
+ // @ts-ignore
+ import loginternal = internal
+ /**
+  * Kind is the kind of a [Value].
+  */
+ interface Kind extends Number{}
+ interface Kind {
+  string(): string
+ }
+ /**
+  * A LogValuer is any Go value that can convert itself into a Value for logging.
+  * 
+  * This mechanism may be used to defer expensive operations until they are
+  * needed, or to expand a single value into a sequence of components.
+  */
+ interface LogValuer {
+  [key:string]: any;
+  logValue(): Value
+ }
+}
diff --git a/server/core_backend-server/plugins/jsvm/internal/types/types.go b/server/core_backend-server/plugins/jsvm/internal/types/types.go
new file mode 100644
index 0000000..cd050b1
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/internal/types/types.go
@@ -0,0 +1,1344 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/plugins/jsvm"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/tygoja"
+)
+
+const heading = `
+// -------------------------------------------------------------------
+// cronBinds
+// -------------------------------------------------------------------
+
+/**
+ * CronAdd registers a new cron job.
+ *
+ * If a cron job with the specified name already exist, it will be
+ * replaced with the new one.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * // prints "Hello world!" on every 30 minutes
+ * cronAdd("hello", "*\/30 * * * *", () => {
+ *     console.log("Hello world!")
+ * })
+ * ` + "```" + `
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function cronAdd(
+  jobId:    string,
+  cronExpr: string,
+  handler:  () => void,
+): void;
+
+/**
+ * CronRemove removes a single registered cron job by its name.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * cronRemove("hello")
+ * ` + "```" + `
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function cronRemove(jobId: string): void;
+
+// -------------------------------------------------------------------
+// routerBinds
+// -------------------------------------------------------------------
+
+/**
+ * RouterAdd registers a new route definition.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * routerAdd("GET", "/hello", (e) => {
+ *     return e.json(200, {"message": "Hello!"})
+ * }, $apis.requireAuth())
+ * ` + "```" + `
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function routerAdd(
+  method: string,
+  path: string,
+  handler: (e: core.RequestEvent) => void,
+  ...middlewares: Array<string|((e: core.RequestEvent) => void)|Middleware>,
+): void;
+
+/**
+ * RouterUse registers one or more global middlewares that are executed
+ * along the handler middlewares after a matching route is found.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * routerUse((e) => {
+ *   console.log(e.request.url.path)
+ *   return e.next()
+ * })
+ * ` + "```" + `
+ *
+ * _Note that this method is available only in pb_hooks context._
+ *
+ * @group PocketBase
+ */
+declare function routerUse(...middlewares: Array<string|((e: core.RequestEvent) => void)|Middleware>): void;
+
+// -------------------------------------------------------------------
+// baseBinds
+// -------------------------------------------------------------------
+
+/**
+ * Global helper variable that contains the absolute path to the app pb_hooks directory.
+ *
+ * @group PocketBase
+ */
+declare var __hooks: string
+
+// Utility type to exclude the on* hook methods from a type
+// (hooks are separately generated as global methods).
+//
+// See https://www.typescriptlang.org/docs/handbook/2/mapped-types.html#key-remapping-via-as
+type excludeHooks<Type> = {
+    [Property in keyof Type as Exclude<Property, ` + "`on${string}`" + `|'cron'>]: Type[Property]
+};
+
+// core.App without the on* hook methods
+type CoreApp = excludeHooks<ORIGINAL_CORE_APP>
+
+// pocketbase.PocketBase without the on* hook methods
+type PocketBase = excludeHooks<ORIGINAL_POCKETBASE>
+
+/**
+ * ` + "`$app`" + ` is the current running PocketBase instance that is globally
+ * available in each .pb.js file.
+ *
+ * _Note that this variable is available only in pb_hooks context._
+ *
+ * @namespace
+ * @group PocketBase
+ */
+declare var $app: PocketBase
+
+/**
+ * ` + "`$template`" + ` is a global helper to load and cache HTML templates on the fly.
+ *
+ * The templates uses the standard Go [html/template](https://pkg.go.dev/html/template)
+ * and [text/template](https://pkg.go.dev/text/template) package syntax.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const html = $template.loadFiles(
+ *     "views/layout.html",
+ *     "views/content.html",
+ * ).render({"name": "John"})
+ * ` + "```" + `
+ *
+ * @namespace
+ * @group PocketBase
+ */
+declare var $template: template.Registry
+
+/**
+ * This method is superseded by toString.
+ *
+ * @deprecated
+ * @group PocketBase
+ */
+declare function readerToString(reader: any, maxBytes?: number): string;
+
+/**
+ * toString stringifies the specified value.
+ *
+ * Support optional second maxBytes argument to limit the max read bytes
+ * when the value is a io.Reader (default to 32MB).
+ *
+ * Types that don't have explicit string representation are json serialized.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * // io.Reader
+ * const ex1 = toString(e.request.body)
+ *
+ * // slice of bytes
+ * const ex2 = toString([104 101 108 108 111]) // "hello"
+ *
+ * // null
+ * const ex3 = toString(null) // ""
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare function toString(val: any, maxBytes?: number): string;
+
+/**
+ * toBytes converts the specified value into a bytes slice.
+ *
+ * Support optional second maxBytes argument to limit the max read bytes
+ * when the value is a io.Reader (default to 32MB).
+ *
+ * Types that don't have Go slice representation (bool, objects, etc.)
+ * are serialized to UTF8 string and its bytes slice is returned.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * // io.Reader
+ * const ex1 = toBytes(e.request.body)
+ *
+ * // string
+ * const ex2 = toBytes("hello") // [104 101 108 108 111]
+ *
+ * // object (the same as the string '{"test":1}')
+ * const ex3 = toBytes({"test":1}) // [123 34 116 101 115 116 34 58 49 125]
+ *
+ * // null
+ * const ex4 = toBytes(null) // []
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare function toBytes(val: any, maxBytes?: number): Array<number>;
+
+/**
+ * sleep pauses the current goroutine for at least the specified user duration (in ms).
+ * A zero or negative duration returns immediately.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * sleep(250) // sleeps for 250ms
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare function sleep(milliseconds: number): void;
+
+/**
+ * arrayOf creates a placeholder array of the specified models.
+ * Usually used to populate DB result into an array of models.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const records = arrayOf(new Record)
+ *
+ * $app.recordQuery("articles").limit(10).all(records)
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare function arrayOf<T>(model: T): Array<T>;
+
+/**
+ * DynamicModel creates a new dynamic model with fields from the provided data shape.
+ *
+ * Caveats:
+ * - In order to use 0 as double/float initialization number you have to negate it (` + "`-0`" + `).
+ * - You need to use lowerCamelCase when accessing the model fields (e.g. ` + "`model.roles`" + ` and not ` + "`model.Roles`" + ` even if in the model shape and in the DB table the column is capitalized).
+ * - Objects are loaded into types.JSONMap, meaning that they need to be accessed with ` + "`get(key)`" + ` (e.g. ` + "`model.meta.get('something')`" + `).
+ * - For describing nullable types you can use the ` + "`null*()`" + ` helpers - ` + "`nullString()`" + `, ` + "`nullInt()`" + `, ` + "`nullFloat()`" + `, ` + "`nullBool()`" + `, ` + "`nullArray()`" + `, ` + "`nullObject()`" + `.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const model = new DynamicModel({
+ *     name:       ""     // or nullString() if nullable
+ *     age:        0,     // or nullInt() if nullable
+ *     totalSpent: -0,    // or nullFloat() if nullable
+ *     active:     false, // or nullBool() if nullable
+ *     Roles:      [],    // or nullArray() if nullable; maps to "Roles" in the DB/JSON but the prop would be accessible via "model.roles"
+ *     meta:       {},    // or nullObject() if nullable
+ * })
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class DynamicModel {
+  [key: string]: any;
+  constructor(shape?: { [key:string]: any })
+}
+
+/**
+ * nullString creates an empty Go string pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` string value.
+ *
+ * @group PocketBase
+ */
+declare function nullString(): string;
+
+/**
+ * nullInt creates an empty Go int64 pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` int value.
+ *
+ * @group PocketBase
+ */
+declare function nullInt(): number;
+
+/**
+ * nullFloat creates an empty Go float64 pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` float value.
+ *
+ * @group PocketBase
+ */
+declare function nullFloat(): number;
+
+/**
+ * nullBool creates an empty Go bool pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` bool value.
+ *
+ * @group PocketBase
+ */
+declare function nullBool(): boolean;
+
+/**
+ * nullArray creates an empty Go types.JSONArray pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` JSON array value.
+ *
+ * @group PocketBase
+ */
+declare function nullArray(): Array<any>;
+
+/**
+ * nullObject creates an empty Go types.JSONMap pointer usually used for
+ * describing a **nullable** ` + "`DynamicModel`" + ` JSON object value.
+ *
+ * @group PocketBase
+ */
+declare function nullObject(): { get(key:string):any; set(key:string,value:any):void };
+
+interface Context extends context.Context{} // merge
+/**
+ * Context creates a new empty Go context.Context.
+ *
+ * This is usually used as part of some Go transitive bindings.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const blank = new Context()
+ *
+ * // with single key-value pair
+ * const base = new Context(null, "a", 123)
+ * console.log(base.value("a")) // 123
+ *
+ * // extend with additional key-value pair
+ * const sub = new Context(base, "b", 456)
+ * console.log(sub.value("a")) // 123
+ * console.log(sub.value("b")) // 456
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class Context implements context.Context {
+  constructor(parentCtx?: Context, key?: any, value?: any)
+}
+
+/**
+ * Record model class.
+ *
+ * ` + "```" + `js
+ * const collection = $app.findCollectionByNameOrId("article")
+ *
+ * const record = new Record(collection, {
+ *     title: "Lorem ipsum"
+ * })
+ *
+ * // or set field values after the initialization
+ * record.set("description", "...")
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare const Record: {
+  new(collection?: core.Collection, data?: { [key:string]: any }): core.Record
+
+  // note: declare as "newable" const due to conflict with the Record TS utility type
+}
+
+interface Collection extends core.Collection{
+  type: "base" | "view" | "auth"
+} // merge
+/**
+ * Collection model class.
+ *
+ * ` + "```" + `js
+ * const collection = new Collection({
+ *     type:       "base",
+ *     name:       "article",
+ *     listRule:   "@request.auth.id != '' || status = 'public'",
+ *     viewRule:   "@request.auth.id != '' || status = 'public'",
+ *     deleteRule: "@request.auth.id != ''",
+ *     fields: [
+ *         {
+ *             name: "title",
+ *             type: "text",
+ *             required: true,
+ *             min: 6,
+ *             max: 100,
+ *         },
+ *         {
+ *             name: "description",
+ *             type: "text",
+ *         },
+ *     ]
+ * })
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class Collection implements core.Collection {
+  constructor(data?: Partial<Collection>)
+}
+
+interface FieldsList extends core.FieldsList{} // merge
+/**
+ * FieldsList model class, usually used to define the Collection.fields.
+ *
+ * @group PocketBase
+ */
+declare class FieldsList implements core.FieldsList {
+  constructor(data?: Partial<core.FieldsList>)
+}
+
+interface Field extends core.Field{} // merge
+/**
+ * Field model class, usually used as part of the FieldsList model.
+ *
+ * @group PocketBase
+ */
+declare class Field implements core.Field {
+  constructor(data?: Partial<core.Field>)
+}
+
+interface NumberField extends core.NumberField{} // merge
+/**
+ * {@inheritDoc core.NumberField}
+ *
+ * @group PocketBase
+ */
+declare class NumberField implements core.NumberField {
+  constructor(data?: Partial<core.NumberField>)
+}
+
+interface BoolField extends core.BoolField{} // merge
+/**
+ * {@inheritDoc core.BoolField}
+ *
+ * @group PocketBase
+ */
+declare class BoolField implements core.BoolField {
+  constructor(data?: Partial<core.BoolField>)
+}
+
+interface TextField extends core.TextField{} // merge
+/**
+ * {@inheritDoc core.TextField}
+ *
+ * @group PocketBase
+ */
+declare class TextField implements core.TextField {
+  constructor(data?: Partial<core.TextField>)
+}
+
+interface URLField extends core.URLField{} // merge
+/**
+ * {@inheritDoc core.URLField}
+ *
+ * @group PocketBase
+ */
+declare class URLField implements core.URLField {
+  constructor(data?: Partial<core.URLField>)
+}
+
+interface EmailField extends core.EmailField{} // merge
+/**
+ * {@inheritDoc core.EmailField}
+ *
+ * @group PocketBase
+ */
+declare class EmailField implements core.EmailField {
+  constructor(data?: Partial<core.EmailField>)
+}
+
+interface EditorField extends core.EditorField{} // merge
+/**
+ * {@inheritDoc core.EditorField}
+ *
+ * @group PocketBase
+ */
+declare class EditorField implements core.EditorField {
+  constructor(data?: Partial<core.EditorField>)
+}
+
+interface PasswordField extends core.PasswordField{} // merge
+/**
+ * {@inheritDoc core.PasswordField}
+ *
+ * @group PocketBase
+ */
+declare class PasswordField implements core.PasswordField {
+  constructor(data?: Partial<core.PasswordField>)
+}
+
+interface DateField extends core.DateField{} // merge
+/**
+ * {@inheritDoc core.DateField}
+ *
+ * @group PocketBase
+ */
+declare class DateField implements core.DateField {
+  constructor(data?: Partial<core.DateField>)
+}
+
+interface AutodateField extends core.AutodateField{} // merge
+/**
+ * {@inheritDoc core.AutodateField}
+ *
+ * @group PocketBase
+ */
+declare class AutodateField implements core.AutodateField {
+  constructor(data?: Partial<core.AutodateField>)
+}
+
+interface JSONField extends core.JSONField{} // merge
+/**
+ * {@inheritDoc core.JSONField}
+ *
+ * @group PocketBase
+ */
+declare class JSONField implements core.JSONField {
+  constructor(data?: Partial<core.JSONField>)
+}
+
+interface RelationField extends core.RelationField{} // merge
+/**
+ * {@inheritDoc core.RelationField}
+ *
+ * @group PocketBase
+ */
+declare class RelationField implements core.RelationField {
+  constructor(data?: Partial<core.RelationField>)
+}
+
+interface SelectField extends core.SelectField{} // merge
+/**
+ * {@inheritDoc core.SelectField}
+ *
+ * @group PocketBase
+ */
+declare class SelectField implements core.SelectField {
+  constructor(data?: Partial<core.SelectField>)
+}
+
+interface FileField extends core.FileField{} // merge
+/**
+ * {@inheritDoc core.FileField}
+ *
+ * @group PocketBase
+ */
+declare class FileField implements core.FileField {
+  constructor(data?: Partial<core.FileField>)
+}
+
+interface GeoPointField extends core.GeoPointField{} // merge
+/**
+ * {@inheritDoc core.GeoPointField}
+ *
+ * @group PocketBase
+ */
+declare class GeoPointField implements core.GeoPointField {
+  constructor(data?: Partial<core.GeoPointField>)
+}
+
+interface MailerMessage extends mailer.Message{} // merge
+/**
+ * MailerMessage defines a single email message.
+ *
+ * ` + "```" + `js
+ * const message = new MailerMessage({
+ *     from: {
+ *         address: $app.settings().meta.senderAddress,
+ *         name:    $app.settings().meta.senderName,
+ *     },
+ *     to:      [{address: "test@example.com"}],
+ *     subject: "YOUR_SUBJECT...",
+ *     html:    "YOUR_HTML_BODY...",
+ * })
+ *
+ * $app.newMailClient().send(message)
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class MailerMessage implements mailer.Message {
+  constructor(message?: Partial<mailer.Message>)
+}
+
+interface Command extends cobra.Command{} // merge
+/**
+ * Command defines a single console command.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const command = new Command({
+ *     use: "hello",
+ *     run: (cmd, args) => { console.log("Hello world!") },
+ * })
+ *
+ * $app.rootCmd.addCommand(command);
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class Command implements cobra.Command {
+  constructor(cmd?: Partial<cobra.Command>)
+}
+
+/**
+ * RequestInfo defines a single core.RequestInfo instance, usually used
+ * as part of various filter checks.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const authRecord = $app.findAuthRecordByEmail("users", "test@example.com")
+ *
+ * const info = new RequestInfo({
+ *     auth:    authRecord,
+ *     body:    {"name": 123},
+ *     headers: {"x-token": "..."},
+ * })
+ *
+ * const record = $app.findFirstRecordByData("articles", "slug", "hello")
+ *
+ * const canAccess = $app.canAccessRecord(record, info, "@request.auth.id != '' && @request.body.name = 123")
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare const RequestInfo: {
+  new(info?: Partial<core.RequestInfo>): core.RequestInfo
+
+ // note: declare as "newable" const due to conflict with the RequestInfo TS node type
+}
+
+/**
+ * Middleware defines a single request middleware handler.
+ *
+ * This class is usually used when you want to explicitly specify a priority to your custom route middleware.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * routerUse(new Middleware((e) => {
+ *   console.log(e.request.url.path)
+ *   return e.next()
+ * }, -10))
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class Middleware {
+  constructor(
+    func: string|((e: core.RequestEvent) => void),
+    priority?: number,
+    id?: string,
+  )
+}
+
+interface Timezone extends time.Location{} // merge
+/**
+ * Timezone returns the timezone location with the given name.
+ *
+ * The name is expected to be a location name corresponding to a file
+ * in the IANA Time Zone database, such as "America/New_York".
+ *
+ * If the name is "Local", LoadLocation returns Local.
+ *
+ * If the name is "", invalid or "UTC", returns UTC.
+ *
+ * The constructor is equivalent to calling the Go ` + "`" + `time.LoadLocation(name)` + "`" + ` method.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const zone = new Timezone("America/New_York")
+ * $app.cron().setTimezone(zone)
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class Timezone implements time.Location {
+  constructor(name?: string)
+}
+
+interface DateTime extends types.DateTime{} // merge
+/**
+ * DateTime defines a single DateTime type instance.
+ * The returned date is always represented in UTC.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * const dt0 = new DateTime() // now
+ *
+ * // full datetime string
+ * const dt1 = new DateTime('2023-07-01 00:00:00.000Z')
+ *
+ * // datetime string with default "parse in" timezone location
+ * //
+ * // similar to new DateTime('2023-07-01 00:00:00 +01:00') or new DateTime('2023-07-01 00:00:00 +02:00')
+ * // but accounts for the daylight saving time (DST)
+ * const dt2 = new DateTime('2023-07-01 00:00:00', 'Europe/Amsterdam')
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class DateTime implements types.DateTime {
+  constructor(date?: string, defaultParseInLocation?: string)
+}
+
+interface ValidationError extends ozzo_validation.Error{} // merge
+/**
+ * ValidationError defines a single formatted data validation error,
+ * usually used as part of an error response.
+ *
+ * ` + "```" + `js
+ * new ValidationError("invalid_title", "Title is not valid")
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class ValidationError implements ozzo_validation.Error {
+  constructor(code?: string, message?: string)
+}
+
+interface Cookie extends http.Cookie{} // merge
+/**
+ * A Cookie represents an HTTP cookie as sent in the Set-Cookie header of an
+ * HTTP response.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * routerAdd("POST", "/example", (c) => {
+ *     c.setCookie(new Cookie({
+ *         name:     "example_name",
+ *         value:    "example_value",
+ *         path:     "/",
+ *         domain:   "example.com",
+ *         maxAge:   10,
+ *         secure:   true,
+ *         httpOnly: true,
+ *         sameSite: 3,
+ *     }))
+ *
+ *     return c.redirect(200, "/");
+ * })
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class Cookie implements http.Cookie {
+  constructor(options?: Partial<http.Cookie>)
+}
+
+interface SubscriptionMessage extends subscriptions.Message{} // merge
+/**
+ * SubscriptionMessage defines a realtime subscription payload.
+ *
+ * Example:
+ *
+ * ` + "```" + `js
+ * onRealtimeConnectRequest((e) => {
+ *     e.client.send(new SubscriptionMessage({
+ *         name: "example",
+ *         data: '{"greeting": "Hello world"}'
+ *     }))
+ * })
+ * ` + "```" + `
+ *
+ * @group PocketBase
+ */
+declare class SubscriptionMessage implements subscriptions.Message {
+  constructor(options?: Partial<subscriptions.Message>)
+}
+
+// -------------------------------------------------------------------
+// dbxBinds
+// -------------------------------------------------------------------
+
+/**
+ * ` + "`$dbx`" + ` defines common utility for working with the DB abstraction.
+ * For examples and guides please check the [Database guide](https://pocketbase.io/docs/js-database).
+ *
+ * @group PocketBase
+ */
+declare namespace $dbx {
+  /**
+   * {@inheritDoc dbx.HashExp}
+   */
+  export function hashExp(pairs: { [key:string]: any }): dbx.Expression
+
+  let _in: dbx._in
+  export { _in as in }
+
+  export let exp:        dbx.newExp
+  export let not:        dbx.not
+  export let and:        dbx.and
+  export let or:         dbx.or
+  export let notIn:      dbx.notIn
+  export let like:       dbx.like
+  export let orLike:     dbx.orLike
+  export let notLike:    dbx.notLike
+  export let orNotLike:  dbx.orNotLike
+  export let exists:     dbx.exists
+  export let notExists:  dbx.notExists
+  export let between:    dbx.between
+  export let notBetween: dbx.notBetween
+}
+
+// -------------------------------------------------------------------
+// mailsBinds
+// -------------------------------------------------------------------
+
+/**
+ * ` + "`" + `$mails` + "`" + ` defines helpers to send common
+ * auth records emails like verification, password reset, etc.
+ *
+ * @group PocketBase
+ */
+declare namespace $mails {
+  let sendRecordPasswordReset: mails.sendRecordPasswordReset
+  let sendRecordVerification:  mails.sendRecordVerification
+  let sendRecordChangeEmail:   mails.sendRecordChangeEmail
+  let sendRecordOTP:           mails.sendRecordOTP
+  let sendRecordAuthAlert:     mails.sendRecordAuthAlert
+}
+
+// -------------------------------------------------------------------
+// securityBinds
+// -------------------------------------------------------------------
+
+/**
+ * ` + "`" + `$security` + "`" + ` defines low level helpers for creating
+ * and parsing JWTs, random string generation, AES encryption, etc.
+ *
+ * @group PocketBase
+ */
+declare namespace $security {
+  let randomString:                   security.randomString
+  let randomStringWithAlphabet:       security.randomStringWithAlphabet
+  let randomStringByRegex:            security.randomStringByRegex
+  let pseudorandomString:             security.pseudorandomString
+  let pseudorandomStringWithAlphabet: security.pseudorandomStringWithAlphabet
+  let encrypt:                        security.encrypt
+  let decrypt:                        security.decrypt
+  let hs256:                          security.hs256
+  let hs512:                          security.hs512
+  let equal:                          security.equal
+  let md5:                            security.md5
+  let sha256:                         security.sha256
+  let sha512:                         security.sha512
+
+  /**
+   * {@inheritDoc security.newJWT}
+   */
+  export function createJWT(payload: { [key:string]: any }, signingKey: string, secDuration: number): string
+
+  /**
+   * {@inheritDoc security.parseUnverifiedJWT}
+   */
+  export function parseUnverifiedJWT(token: string): _TygojaDict
+
+  /**
+   * {@inheritDoc security.parseJWT}
+   */
+  export function parseJWT(token: string, verificationKey: string): _TygojaDict
+}
+
+// -------------------------------------------------------------------
+// filesystemBinds
+// -------------------------------------------------------------------
+
+/**
+ * ` + "`" + `$filesystem` + "`" + ` defines common helpers for working
+ * with the PocketBase filesystem abstraction.
+ *
+ * @group PocketBase
+ */
+declare namespace $filesystem {
+  let fileFromPath:      filesystem.newFileFromPath
+  let fileFromBytes:     filesystem.newFileFromBytes
+  let fileFromMultipart: filesystem.newFileFromMultipart
+
+  /**
+   * fileFromURL creates a new File from the provided url by
+   * downloading the resource and creating a BytesReader.
+   *
+   * Example:
+   *
+   * ` + "```" + `js
+   * // with default max timeout of 120sec
+   * const file1 = $filesystem.fileFromURL("https://...")
+   *
+   * // with custom timeout of 15sec
+   * const file2 = $filesystem.fileFromURL("https://...", 15)
+   * ` + "```" + `
+   */
+  export function fileFromURL(url: string, secTimeout?: number): filesystem.File
+}
+
+// -------------------------------------------------------------------
+// filepathBinds
+// -------------------------------------------------------------------
+
+/**
+ * ` + "`$filepath`" + ` defines common helpers for manipulating filename
+ * paths in a way compatible with the target operating system-defined file paths.
+ *
+ * @group PocketBase
+ */
+declare namespace $filepath {
+  export let base:      filepath.base
+  export let clean:     filepath.clean
+  export let dir:       filepath.dir
+  export let ext:       filepath.ext
+  export let fromSlash: filepath.fromSlash
+  export let glob:      filepath.glob
+  export let isAbs:     filepath.isAbs
+  export let join:      filepath.join
+  export let match:     filepath.match
+  export let rel:       filepath.rel
+  export let split:     filepath.split
+  export let splitList: filepath.splitList
+  export let toSlash:   filepath.toSlash
+  export let walk:      filepath.walk
+  export let walkDir:   filepath.walkDir
+}
+
+// -------------------------------------------------------------------
+// osBinds
+// -------------------------------------------------------------------
+
+/**
+ * ` + "`$os`" + ` defines common helpers for working with the OS level primitives
+ * (eg. deleting directories, executing shell commands, etc.).
+ *
+ * @group PocketBase
+ */
+declare namespace $os {
+  /**
+   * Legacy alias for $os.cmd().
+   */
+  export let exec: exec.command
+
+  /**
+   * Prepares an external OS command.
+   *
+   * Example:
+   *
+   * ` + "```" + `js
+   * // prepare the command to execute
+   * const cmd = $os.cmd('ls', '-sl')
+   *
+   * // execute the command and return its standard output as string
+   * const output = toString(cmd.output());
+   * ` + "```" + `
+   */
+  export let cmd: exec.command
+
+  /**
+   * Args hold the command-line arguments, starting with the program name.
+   */
+  export let args: Array<string>
+
+  export let exit:       os.exit
+  export let getenv:     os.getenv
+  export let dirFS:      os.dirFS
+  export let readFile:   os.readFile
+  export let writeFile:  os.writeFile
+  export let stat:       os.stat
+  export let readDir:    os.readDir
+  export let tempDir:    os.tempDir
+  export let truncate:   os.truncate
+  export let getwd:      os.getwd
+  export let mkdir:      os.mkdir
+  export let mkdirAll:   os.mkdirAll
+  export let rename:     os.rename
+  export let remove:     os.remove
+  export let removeAll:  os.removeAll
+  export let openRoot:   os.openRoot
+  export let openInRoot: os.openInRoot
+}
+
+// -------------------------------------------------------------------
+// formsBinds
+// -------------------------------------------------------------------
+
+interface AppleClientSecretCreateForm extends forms.AppleClientSecretCreate{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class AppleClientSecretCreateForm implements forms.AppleClientSecretCreate {
+  constructor(app: CoreApp)
+}
+
+interface RecordUpsertForm extends forms.RecordUpsert{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class RecordUpsertForm implements forms.RecordUpsert {
+  constructor(app: CoreApp, record: core.Record)
+}
+
+interface TestEmailSendForm extends forms.TestEmailSend{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class TestEmailSendForm implements forms.TestEmailSend {
+  constructor(app: CoreApp)
+}
+
+interface TestS3FilesystemForm extends forms.TestS3Filesystem{} // merge
+/**
+ * @inheritDoc
+ * @group PocketBase
+ */
+declare class TestS3FilesystemForm implements forms.TestS3Filesystem {
+  constructor(app: CoreApp)
+}
+
+// -------------------------------------------------------------------
+// apisBinds
+// -------------------------------------------------------------------
+
+interface ApiError extends router.ApiError{} // merge
+/**
+ * @inheritDoc
+ *
+ * @group PocketBase
+ */
+declare class ApiError implements router.ApiError {
+  constructor(status?: number, message?: string, data?: any)
+}
+
+interface NotFoundError extends router.ApiError{} // merge
+/**
+ * NotFounderor returns 404 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class NotFoundError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface BadRequestError extends router.ApiError{} // merge
+/**
+ * BadRequestError returns 400 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class BadRequestError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface ForbiddenError extends router.ApiError{} // merge
+/**
+ * ForbiddenError returns 403 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class ForbiddenError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface UnauthorizedError extends router.ApiError{} // merge
+/**
+ * UnauthorizedError returns 401 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class UnauthorizedError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface TooManyRequestsError extends router.ApiError{} // merge
+/**
+ * TooManyRequestsError returns 429 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class TooManyRequestsError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+interface InternalServerError extends router.ApiError{} // merge
+/**
+ * InternalServerError returns 429 ApiError.
+ *
+ * @group PocketBase
+ */
+declare class InternalServerError implements router.ApiError {
+  constructor(message?: string, data?: any)
+}
+
+/**
+ * ` + "`" + `$apis` + "`" + ` defines commonly used PocketBase api helpers and middlewares.
+ *
+ * @group PocketBase
+ */
+declare namespace $apis {
+  /**
+   * Route handler to serve static directory content (html, js, css, etc.).
+   *
+   * If a file resource is missing and indexFallback is set, the request
+   * will be forwarded to the base index.html (useful for SPA).
+   */
+  export function static(dir: string, indexFallback: boolean): (e: core.RequestEvent) => void
+
+  let requireGuestOnly:              apis.requireGuestOnly
+  let requireAuth:                   apis.requireAuth
+  let requireSuperuserAuth:          apis.requireSuperuserAuth
+  let requireSuperuserOrOwnerAuth:   apis.requireSuperuserOrOwnerAuth
+  let skipSuccessActivityLog:        apis.skipSuccessActivityLog
+  let gzip:                          apis.gzip
+  let bodyLimit:                     apis.bodyLimit
+  let enrichRecord:                  apis.enrichRecord
+  let enrichRecords:                 apis.enrichRecords
+
+  /**
+   * RecordAuthResponse writes standardized json record auth response
+   * into the specified request event.
+   *
+   * The authMethod argument specify the name of the current authentication method (eg. password, oauth2, etc.)
+   * that it is used primarily as an auth identifier during MFA and for login alerts.
+   *
+   * Set authMethod to empty string if you want to ignore the MFA checks and the login alerts
+   * (can be also adjusted additionally via the onRecordAuthRequest hook).
+   */
+  export function recordAuthResponse(e: core.RequestEvent, authRecord: core.Record, authMethod: string, meta?: any): void
+}
+
+// -------------------------------------------------------------------
+// httpClientBinds
+// -------------------------------------------------------------------
+
+// extra FormData overload to prevent TS warnings when used with non File/Blob value.
+interface FormData {
+  append(key:string, value:any): void
+  set(key:string, value:any): void
+}
+
+/**
+ * ` + "`" + `$http` + "`" + ` defines common methods for working with HTTP requests.
+ *
+ * @group PocketBase
+ */
+declare namespace $http {
+  /**
+   * Sends a single HTTP request.
+   *
+   * Example:
+   *
+   * ` + "```" + `js
+   * const res = $http.send({
+   *     method:  "POST",
+   *     url:     "https://example.com",
+   *     body:    JSON.stringify({"title": "test"}),
+   *     headers: { 'Content-Type': 'application/json' }
+   * })
+   *
+   * console.log(res.statusCode) // the response HTTP status code
+   * console.log(res.headers)    // the response headers (eg. res.headers['X-Custom'][0])
+   * console.log(res.cookies)    // the response cookies (eg. res.cookies.sessionId.value)
+   * console.log(res.body)       // the response body as raw bytes slice
+   * console.log(res.json)       // the response body as parsed json array or map
+   * ` + "```" + `
+   */
+  function send(config: {
+    url:      string,
+    body?:    string|FormData,
+    method?:  string, // default to "GET"
+    headers?: { [key:string]: string },
+    timeout?: number, // default to 120
+
+    // @deprecated please use body instead
+    data?: { [key:string]: any },
+  }): {
+    statusCode: number,
+    headers:    { [key:string]: Array<string> },
+    cookies:    { [key:string]: http.Cookie },
+    json:       any,
+    body:       Array<number>,
+
+    // @deprecated please use toString(result.body) instead
+    raw: string,
+  };
+}
+
+// -------------------------------------------------------------------
+// migrate only
+// -------------------------------------------------------------------
+
+/**
+ * Migrate defines a single migration upgrade/downgrade action.
+ *
+ * _Note that this method is available only in pb_migrations context._
+ *
+ * @group PocketBase
+ */
+declare function migrate(
+  up: (txApp: CoreApp) => void,
+  down?: (txApp: CoreApp) => void
+): void;
+`
+
+var mapper = &jsvm.FieldMapper{}
+
+func main() {
+	declarations := heading + hooksDeclarations()
+
+	gen := tygoja.New(tygoja.Config{
+		Packages: map[string][]string{
+			"github.com/go-ozzo/ozzo-validation/v4":             {"Error"},
+			"github.com/pocketbase/dbx":                         {"*"},
+			"github.com/pocketbase/pocketbase/tools/security":   {"*"},
+			"github.com/pocketbase/pocketbase/tools/filesystem": {"*"},
+			"github.com/pocketbase/pocketbase/tools/template":   {"*"},
+			"github.com/pocketbase/pocketbase/mails":            {"*"},
+			"github.com/pocketbase/pocketbase/apis":             {"*"},
+			"github.com/pocketbase/pocketbase/core":             {"*"},
+			"github.com/pocketbase/pocketbase/forms":            {"*"},
+			"github.com/pocketbase/pocketbase":                  {"*"},
+			"path/filepath":                                     {"*"},
+			"os":                                                {"*"},
+			"os/exec":                                           {"Command"},
+		},
+		FieldNameFormatter: func(s string) string {
+			return mapper.FieldName(nil, reflect.StructField{Name: s})
+		},
+		MethodNameFormatter: func(s string) string {
+			return mapper.MethodName(nil, reflect.Method{Name: s})
+		},
+		TypeMappings: map[string]string{
+			"crypto.*":     "any",
+			"acme.*":       "any",
+			"autocert.*":   "any",
+			"driver.*":     "any",
+			"reflect.*":    "any",
+			"fmt.*":        "any",
+			"rand.*":       "any",
+			"tls.*":        "any",
+			"asn1.*":       "any",
+			"pkix.*":       "any",
+			"x509.*":       "any",
+			"pflag.*":      "any",
+			"flag.*":       "any",
+			"log.*":        "any",
+			"http.Client":  "any",
+			"mail.Address": "{ address: string; name?: string; }", // prevents the LSP to complain in case no name is provided
+		},
+		Indent:               " ", // use only a single space to reduce slightly the size
+		WithPackageFunctions: true,
+		Heading:              declarations,
+	})
+
+	result, err := gen.Generate()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	_, filename, _, ok := runtime.Caller(0)
+	if !ok {
+		log.Fatal("Failed to get the current docs directory")
+	}
+
+	// replace the original app interfaces with their non-"on*"" hooks equivalents
+	result = strings.ReplaceAll(result, "core.App", "CoreApp")
+	result = strings.ReplaceAll(result, "pocketbase.PocketBase", "PocketBase")
+	result = strings.ReplaceAll(result, "ORIGINAL_CORE_APP", "core.App")
+	result = strings.ReplaceAll(result, "ORIGINAL_POCKETBASE", "pocketbase.PocketBase")
+
+	// prepend a timestamp with the generation time
+	// so that it can be compared without reading the entire file
+	result = fmt.Sprintf("// %d\n%s", time.Now().Unix(), result)
+
+	parentDir := filepath.Dir(filename)
+	typesFile := filepath.Join(parentDir, "generated", "types.d.ts")
+
+	if err := os.WriteFile(typesFile, []byte(result), 0644); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func hooksDeclarations() string {
+	var result strings.Builder
+
+	excluded := []string{"OnServe"}
+	appType := reflect.TypeOf(struct{ core.App }{})
+	totalMethods := appType.NumMethod()
+
+	for i := 0; i < totalMethods; i++ {
+		method := appType.Method(i)
+		if !strings.HasPrefix(method.Name, "On") || list.ExistInSlice(method.Name, excluded) {
+			continue // not a hook or excluded
+		}
+
+		hookType := method.Type.Out(0)
+
+		withTags := strings.HasPrefix(hookType.String(), "*hook.TaggedHook")
+
+		addMethod, ok := hookType.MethodByName("BindFunc")
+		if !ok {
+			continue
+		}
+
+		addHanlder := addMethod.Type.In(1)
+		eventTypeName := strings.TrimPrefix(addHanlder.In(0).String(), "*")
+
+		jsName := mapper.MethodName(appType, method)
+		result.WriteString("/** @group PocketBase */")
+		result.WriteString("declare function ")
+		result.WriteString(jsName)
+		result.WriteString("(handler: (e: ")
+		result.WriteString(eventTypeName)
+		result.WriteString(") => void")
+		if withTags {
+			result.WriteString(", ...tags: string[]")
+		}
+		result.WriteString("): void")
+		result.WriteString("\n")
+	}
+
+	return result.String()
+}
diff --git a/server/core_backend-server/plugins/jsvm/jsvm.go b/server/core_backend-server/plugins/jsvm/jsvm.go
new file mode 100644
index 0000000..b20a0c1
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/jsvm.go
@@ -0,0 +1,562 @@
+// Package jsvm implements pluggable utilities for binding a JS goja runtime
+// to the PocketBase instance (loading migrations, attaching to app hooks, etc.).
+//
+// Example:
+//
+//	jsvm.MustRegister(app, jsvm.Config{
+//		HooksWatch: true,
+//	})
+package jsvm
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/dop251/goja"
+	"github.com/dop251/goja_nodejs/buffer"
+	"github.com/dop251/goja_nodejs/console"
+	"github.com/dop251/goja_nodejs/process"
+	"github.com/dop251/goja_nodejs/require"
+	"github.com/fatih/color"
+	"github.com/fsnotify/fsnotify"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/plugins/jsvm/internal/types/generated"
+	"github.com/pocketbase/pocketbase/tools/template"
+)
+
+const typesFileName = "types.d.ts"
+
+var defaultScriptPath = "pb.js"
+
+func init() {
+	// For backward compatibility and consistency with the Go exposed
+	// methods that operate with relative paths (e.g. `$os.writeFile`),
+	// we define the "current JS module" as if it is a file in the current working directory
+	// (the filename itself doesn't really matter and in our case the hook handlers are executed as separate "programs").
+	//
+	// This is necessary for `require(module)` to properly traverse parents node_modules (goja_nodejs#95).
+	cwd, err := os.Getwd()
+	if err != nil {
+		// truly rare case, log just for debug purposes
+		color.Yellow("Failed to retrieve the current working directory: %v", err)
+	} else {
+		defaultScriptPath = filepath.Join(cwd, defaultScriptPath)
+	}
+}
+
+// Config defines the config options of the jsvm plugin.
+type Config struct {
+	// OnInit is an optional function that will be called
+	// after a JS runtime is initialized, allowing you to
+	// attach custom Go variables and functions.
+	OnInit func(vm *goja.Runtime)
+
+	// HooksWatch enables auto app restarts when a JS app hook file changes.
+	//
+	// Note that currently the application cannot be automatically restarted on Windows
+	// because the restart process relies on execve.
+	HooksWatch bool
+
+	// HooksDir specifies the JS app hooks directory.
+	//
+	// If not set it fallbacks to a relative "pb_data/../pb_hooks" directory.
+	HooksDir string
+
+	// HooksFilesPattern specifies a regular expression pattern that
+	// identify which file to load by the hook vm(s).
+	//
+	// If not set it fallbacks to `^.*(\.pb\.js|\.pb\.ts)$`, aka. any
+	// HookdsDir file ending in ".pb.js" or ".pb.ts" (the last one is to enforce IDE linters).
+	HooksFilesPattern string
+
+	// HooksPoolSize specifies how many goja.Runtime instances to prewarm
+	// and keep for the JS app hooks gorotines execution.
+	//
+	// Zero or negative value means that it will create a new goja.Runtime
+	// on every fired goroutine.
+	HooksPoolSize int
+
+	// MigrationsDir specifies the JS migrations directory.
+	//
+	// If not set it fallbacks to a relative "pb_data/../pb_migrations" directory.
+	MigrationsDir string
+
+	// If not set it fallbacks to `^.*(\.js|\.ts)$`, aka. any MigrationDir file
+	// ending in ".js" or ".ts" (the last one is to enforce IDE linters).
+	MigrationsFilesPattern string
+
+	// TypesDir specifies the directory where to store the embedded
+	// TypeScript declarations file.
+	//
+	// If not set it fallbacks to "pb_data".
+	//
+	// Note: Avoid using the same directory as the HooksDir when HooksWatch is enabled
+	// to prevent unnecessary app restarts when the types file is initially created.
+	TypesDir string
+}
+
+// MustRegister registers the jsvm plugin in the provided app instance
+// and panics if it fails.
+//
+// Example usage:
+//
+//	jsvm.MustRegister(app, jsvm.Config{
+//		OnInit: func(vm *goja.Runtime) {
+//			// register custom bindings
+//			vm.Set("myCustomVar", 123)
+//		},
+//	})
+func MustRegister(app core.App, config Config) {
+	if err := Register(app, config); err != nil {
+		panic(err)
+	}
+}
+
+// Register registers the jsvm plugin in the provided app instance.
+func Register(app core.App, config Config) error {
+	p := &plugin{app: app, config: config}
+
+	if p.config.HooksDir == "" {
+		p.config.HooksDir = filepath.Join(app.DataDir(), "../pb_hooks")
+	}
+
+	if p.config.MigrationsDir == "" {
+		p.config.MigrationsDir = filepath.Join(app.DataDir(), "../pb_migrations")
+	}
+
+	if p.config.HooksFilesPattern == "" {
+		p.config.HooksFilesPattern = `^.*(\.pb\.js|\.pb\.ts)$`
+	}
+
+	if p.config.MigrationsFilesPattern == "" {
+		p.config.MigrationsFilesPattern = `^.*(\.js|\.ts)$`
+	}
+
+	if p.config.TypesDir == "" {
+		p.config.TypesDir = app.DataDir()
+	}
+
+	p.app.OnBootstrap().BindFunc(func(e *core.BootstrapEvent) error {
+		err := e.Next()
+		if err != nil {
+			return err
+		}
+
+		// ensure that the user has the latest types declaration
+		err = p.refreshTypesFile()
+		if err != nil {
+			color.Yellow("Unable to refresh app types file: %v", err)
+		}
+
+		return nil
+	})
+
+	if err := p.registerMigrations(); err != nil {
+		return fmt.Errorf("registerMigrations: %w", err)
+	}
+
+	if err := p.registerHooks(); err != nil {
+		return fmt.Errorf("registerHooks: %w", err)
+	}
+
+	return nil
+}
+
+type plugin struct {
+	app    core.App
+	config Config
+}
+
+// registerMigrations registers the JS migrations loader.
+func (p *plugin) registerMigrations() error {
+	// fetch all js migrations sorted by their filename
+	files, err := filesContent(p.config.MigrationsDir, p.config.MigrationsFilesPattern)
+	if err != nil {
+		return err
+	}
+
+	absHooksDir, err := filepath.Abs(p.config.HooksDir)
+	if err != nil {
+		return err
+	}
+
+	registry := new(require.Registry) // this can be shared by multiple runtimes
+	templateRegistry := template.NewRegistry()
+
+	for file, content := range files {
+		vm := goja.New()
+
+		registry.Enable(vm)
+		console.Enable(vm)
+		process.Enable(vm)
+		buffer.Enable(vm)
+
+		baseBinds(vm)
+		dbxBinds(vm)
+		securityBinds(vm)
+		osBinds(vm)
+		filepathBinds(vm)
+		httpClientBinds(vm)
+		filesystemBinds(vm)
+		formsBinds(vm)
+		mailsBinds(vm)
+
+		vm.Set("$template", templateRegistry)
+		vm.Set("__hooks", absHooksDir)
+
+		vm.Set("migrate", func(up, down func(txApp core.App) error) {
+			core.AppMigrations.Register(up, down, file)
+		})
+
+		if p.config.OnInit != nil {
+			p.config.OnInit(vm)
+		}
+
+		_, err := vm.RunScript(defaultScriptPath, string(content))
+		if err != nil {
+			return fmt.Errorf("failed to run migration %s: %w", file, err)
+		}
+	}
+
+	return nil
+}
+
+// registerHooks registers the JS app hooks loader.
+func (p *plugin) registerHooks() error {
+	// fetch all js hooks sorted by their filename
+	files, err := filesContent(p.config.HooksDir, p.config.HooksFilesPattern)
+	if err != nil {
+		return err
+	}
+
+	// prepend the types reference directive
+	//
+	// note: it is loaded during startup to handle conveniently also
+	// the case when the HooksWatch option is enabled and the application
+	// restart on newly created file
+	for name, content := range files {
+		if len(content) != 0 {
+			// skip non-empty files for now to prevent accidental overwrite
+			continue
+		}
+		path := filepath.Join(p.config.HooksDir, name)
+		directive := `/// <reference path="` + p.relativeTypesPath(p.config.HooksDir) + `" />`
+		if err := prependToEmptyFile(path, directive+"\n\n"); err != nil {
+			color.Yellow("Unable to prepend the types reference: %v", err)
+		}
+	}
+
+	// initialize the hooks dir watcher
+	if p.config.HooksWatch {
+		if err := p.watchHooks(); err != nil {
+			color.Yellow("Unable to init hooks watcher: %v", err)
+		}
+	}
+
+	if len(files) == 0 {
+		// no need to register the vms since there are no entrypoint files anyway
+		return nil
+	}
+
+	absHooksDir, err := filepath.Abs(p.config.HooksDir)
+	if err != nil {
+		return err
+	}
+
+	p.app.OnServe().BindFunc(func(e *core.ServeEvent) error {
+		e.Router.BindFunc(p.normalizeServeExceptions)
+
+		return e.Next()
+	})
+
+	// safe to be shared across multiple vms
+	requireRegistry := new(require.Registry)
+	templateRegistry := template.NewRegistry()
+
+	sharedBinds := func(vm *goja.Runtime) {
+		requireRegistry.Enable(vm)
+		console.Enable(vm)
+		process.Enable(vm)
+		buffer.Enable(vm)
+
+		baseBinds(vm)
+		dbxBinds(vm)
+		filesystemBinds(vm)
+		securityBinds(vm)
+		osBinds(vm)
+		filepathBinds(vm)
+		httpClientBinds(vm)
+		formsBinds(vm)
+		apisBinds(vm)
+		mailsBinds(vm)
+
+		vm.Set("$app", p.app)
+		vm.Set("$template", templateRegistry)
+		vm.Set("__hooks", absHooksDir)
+
+		if p.config.OnInit != nil {
+			p.config.OnInit(vm)
+		}
+	}
+
+	// initiliaze the executor vms
+	executors := newPool(p.config.HooksPoolSize, func() *goja.Runtime {
+		executor := goja.New()
+		sharedBinds(executor)
+		return executor
+	})
+
+	// initialize the loader vm
+	loader := goja.New()
+	sharedBinds(loader)
+	hooksBinds(p.app, loader, executors)
+	cronBinds(p.app, loader, executors)
+	routerBinds(p.app, loader, executors)
+
+	for file, content := range files {
+		func() {
+			defer func() {
+				if err := recover(); err != nil {
+					fmtErr := fmt.Errorf("failed to execute %s:\n - %v", file, err)
+
+					if p.config.HooksWatch {
+						color.Red("%v", fmtErr)
+					} else {
+						panic(fmtErr)
+					}
+				}
+			}()
+
+			_, err := loader.RunScript(defaultScriptPath, string(content))
+			if err != nil {
+				panic(err)
+			}
+		}()
+	}
+
+	return nil
+}
+
+// normalizeExceptions registers a global error handler that
+// wraps the extracted goja exception error value for consistency
+// when throwing or returning errors.
+func (p *plugin) normalizeServeExceptions(e *core.RequestEvent) error {
+	err := e.Next()
+
+	if err == nil || e.Written() {
+		return err // no error or already committed
+	}
+
+	return normalizeException(err)
+}
+
+// watchHooks initializes a hooks file watcher that will restart the
+// application (*if possible) in case of a change in the hooks directory.
+//
+// This method does nothing if the hooks directory is missing.
+func (p *plugin) watchHooks() error {
+	watchDir := p.config.HooksDir
+
+	hooksDirInfo, err := os.Lstat(p.config.HooksDir)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil // no hooks dir to watch
+		}
+		return err
+	}
+
+	if hooksDirInfo.Mode()&os.ModeSymlink == os.ModeSymlink {
+		watchDir, err = filepath.EvalSymlinks(p.config.HooksDir)
+		if err != nil {
+			return fmt.Errorf("failed to resolve hooksDir symlink: %w", err)
+		}
+	}
+
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return err
+	}
+
+	var debounceTimer *time.Timer
+
+	stopDebounceTimer := func() {
+		if debounceTimer != nil {
+			debounceTimer.Stop()
+			debounceTimer = nil
+		}
+	}
+
+	p.app.OnTerminate().BindFunc(func(e *core.TerminateEvent) error {
+		watcher.Close()
+
+		stopDebounceTimer()
+
+		return e.Next()
+	})
+
+	// start listening for events.
+	go func() {
+		defer stopDebounceTimer()
+
+		for {
+			select {
+			case event, ok := <-watcher.Events:
+				if !ok {
+					return
+				}
+
+				stopDebounceTimer()
+
+				debounceTimer = time.AfterFunc(50*time.Millisecond, func() {
+					// app restart is currently not supported on Windows
+					if runtime.GOOS == "windows" {
+						color.Yellow("File %s changed, please restart the app manually", event.Name)
+					} else {
+						color.Yellow("File %s changed, restarting...", event.Name)
+						if err := p.app.Restart(); err != nil {
+							color.Red("Failed to restart the app:", err)
+						}
+					}
+				})
+			case err, ok := <-watcher.Errors:
+				if !ok {
+					return
+				}
+				color.Red("Watch error:", err)
+			}
+		}
+	}()
+
+	// add directories to watch
+	//
+	// @todo replace once recursive watcher is added (https://github.com/fsnotify/fsnotify/issues/18)
+	dirsErr := filepath.WalkDir(watchDir, func(path string, entry fs.DirEntry, err error) error {
+		// ignore hidden directories, node_modules, symlinks, sockets, etc.
+		if !entry.IsDir() || entry.Name() == "node_modules" || strings.HasPrefix(entry.Name(), ".") {
+			return nil
+		}
+
+		return watcher.Add(path)
+	})
+	if dirsErr != nil {
+		watcher.Close()
+	}
+
+	return dirsErr
+}
+
+// fullTypesPathReturns returns the full path to the generated TS file.
+func (p *plugin) fullTypesPath() string {
+	return filepath.Join(p.config.TypesDir, typesFileName)
+}
+
+// relativeTypesPath returns a path to the generated TS file relative
+// to the specified basepath.
+//
+// It fallbacks to the full path if generating the relative path fails.
+func (p *plugin) relativeTypesPath(basepath string) string {
+	fullPath := p.fullTypesPath()
+
+	rel, err := filepath.Rel(basepath, fullPath)
+	if err != nil {
+		// fallback to the full path
+		rel = fullPath
+	}
+
+	return rel
+}
+
+// refreshTypesFile saves the embedded TS declarations as a file on the disk.
+func (p *plugin) refreshTypesFile() error {
+	fullPath := p.fullTypesPath()
+
+	// ensure that the types directory exists
+	dir := filepath.Dir(fullPath)
+	if err := os.MkdirAll(dir, os.ModePerm); err != nil {
+		return err
+	}
+
+	// retrieve the types data to write
+	data, err := generated.Types.ReadFile(typesFileName)
+	if err != nil {
+		return err
+	}
+
+	// read the first timestamp line of the old file (if exists) and compare it to the embedded one
+	// (note: ignore errors to allow always overwriting the file if it is invalid)
+	existingFile, err := os.Open(fullPath)
+	if err == nil {
+		timestamp := make([]byte, 13)
+		io.ReadFull(existingFile, timestamp)
+		existingFile.Close()
+
+		if len(data) >= len(timestamp) && bytes.Equal(data[:13], timestamp) {
+			return nil // nothing new to save
+		}
+	}
+
+	return os.WriteFile(fullPath, data, 0644)
+}
+
+// prependToEmptyFile prepends the specified text to an empty file.
+//
+// If the file is not empty this method does nothing.
+func prependToEmptyFile(path, text string) error {
+	info, err := os.Stat(path)
+
+	if err == nil && info.Size() == 0 {
+		return os.WriteFile(path, []byte(text), 0644)
+	}
+
+	return err
+}
+
+// filesContent returns a map with all direct files within the specified dir and their content.
+//
+// If directory with dirPath is missing or no files matching the pattern were found,
+// it returns an empty map and no error.
+//
+// If pattern is empty string it matches all root files.
+func filesContent(dirPath string, pattern string) (map[string][]byte, error) {
+	files, err := os.ReadDir(dirPath)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return map[string][]byte{}, nil
+		}
+		return nil, err
+	}
+
+	var exp *regexp.Regexp
+	if pattern != "" {
+		var err error
+		if exp, err = regexp.Compile(pattern); err != nil {
+			return nil, err
+		}
+	}
+
+	result := map[string][]byte{}
+
+	for _, f := range files {
+		if f.IsDir() || (exp != nil && !exp.MatchString(f.Name())) {
+			continue
+		}
+
+		raw, err := os.ReadFile(filepath.Join(dirPath, f.Name()))
+		if err != nil {
+			return nil, err
+		}
+
+		result[f.Name()] = raw
+	}
+
+	return result, nil
+}
diff --git a/server/core_backend-server/plugins/jsvm/mapper.go b/server/core_backend-server/plugins/jsvm/mapper.go
new file mode 100644
index 0000000..d9c16bb
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/mapper.go
@@ -0,0 +1,67 @@
+package jsvm
+
+import (
+	"reflect"
+	"strings"
+	"unicode"
+
+	"github.com/dop251/goja"
+)
+
+var (
+	_ goja.FieldNameMapper = (*FieldMapper)(nil)
+)
+
+// FieldMapper provides custom mapping between Go and JavaScript property names.
+//
+// It is similar to the builtin "uncapFieldNameMapper" but also converts
+// all uppercase identifiers to their lowercase equivalent (eg. "GET" -> "get").
+type FieldMapper struct {
+}
+
+// FieldName implements the [FieldNameMapper.FieldName] interface method.
+func (u FieldMapper) FieldName(_ reflect.Type, f reflect.StructField) string {
+	return convertGoToJSName(f.Name)
+}
+
+// MethodName implements the [FieldNameMapper.MethodName] interface method.
+func (u FieldMapper) MethodName(_ reflect.Type, m reflect.Method) string {
+	return convertGoToJSName(m.Name)
+}
+
+var nameExceptions = map[string]string{"OAuth2": "oauth2"}
+
+func convertGoToJSName(name string) string {
+	if v, ok := nameExceptions[name]; ok {
+		return v
+	}
+
+	startUppercase := make([]rune, 0, len(name))
+
+	for _, c := range name {
+		if c != '_' && !unicode.IsUpper(c) && !unicode.IsDigit(c) {
+			break
+		}
+
+		startUppercase = append(startUppercase, c)
+	}
+
+	totalStartUppercase := len(startUppercase)
+
+	// all uppercase eg. "JSON" -> "json"
+	if len(name) == totalStartUppercase {
+		return strings.ToLower(name)
+	}
+
+	// eg. "JSONField" -> "jsonField"
+	if totalStartUppercase > 1 {
+		return strings.ToLower(name[0:totalStartUppercase-1]) + name[totalStartUppercase-1:]
+	}
+
+	// eg. "GetField" -> "getField"
+	if totalStartUppercase == 1 {
+		return strings.ToLower(name[0:1]) + name[1:]
+	}
+
+	return name
+}
diff --git a/server/core_backend-server/plugins/jsvm/mapper_test.go b/server/core_backend-server/plugins/jsvm/mapper_test.go
new file mode 100644
index 0000000..0cc020e
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/mapper_test.go
@@ -0,0 +1,42 @@
+package jsvm_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/plugins/jsvm"
+)
+
+func TestFieldMapper(t *testing.T) {
+	mapper := jsvm.FieldMapper{}
+
+	scenarios := []struct {
+		name     string
+		expected string
+	}{
+		{"", ""},
+		{"test", "test"},
+		{"Test", "test"},
+		{"miXeD", "miXeD"},
+		{"MiXeD", "miXeD"},
+		{"ResolveRequestAsJSON", "resolveRequestAsJSON"},
+		{"Variable_with_underscore", "variable_with_underscore"},
+		{"ALLCAPS", "allcaps"},
+		{"ALL_CAPS_WITH_UNDERSCORE", "all_caps_with_underscore"},
+		{"OIDCMap", "oidcMap"},
+		{"MD5", "md5"},
+		{"OAuth2", "oauth2"},
+	}
+
+	for i, s := range scenarios {
+		field := reflect.StructField{Name: s.name}
+		if v := mapper.FieldName(nil, field); v != s.expected {
+			t.Fatalf("[%d] Expected FieldName %q, got %q", i, s.expected, v)
+		}
+
+		method := reflect.Method{Name: s.name}
+		if v := mapper.MethodName(nil, method); v != s.expected {
+			t.Fatalf("[%d] Expected MethodName %q, got %q", i, s.expected, v)
+		}
+	}
+}
diff --git a/server/core_backend-server/plugins/jsvm/pool.go b/server/core_backend-server/plugins/jsvm/pool.go
new file mode 100644
index 0000000..e0174c5
--- /dev/null
+++ b/server/core_backend-server/plugins/jsvm/pool.go
@@ -0,0 +1,73 @@
+package jsvm
+
+import (
+	"sync"
+
+	"github.com/dop251/goja"
+)
+
+type poolItem struct {
+	mux  sync.Mutex
+	busy bool
+	vm   *goja.Runtime
+}
+
+type vmsPool struct {
+	mux     sync.RWMutex
+	factory func() *goja.Runtime
+	items   []*poolItem
+}
+
+// newPool creates a new pool with pre-warmed vms generated from the specified factory.
+func newPool(size int, factory func() *goja.Runtime) *vmsPool {
+	pool := &vmsPool{
+		factory: factory,
+		items:   make([]*poolItem, size),
+	}
+
+	for i := 0; i < size; i++ {
+		vm := pool.factory()
+		pool.items[i] = &poolItem{vm: vm}
+	}
+
+	return pool
+}
+
+// run executes "call" with a vm created from the pool
+// (either from the buffer or a new one if all buffered vms are busy)
+func (p *vmsPool) run(call func(vm *goja.Runtime) error) error {
+	p.mux.RLock()
+
+	// try to find a free item
+	var freeItem *poolItem
+	for _, item := range p.items {
+		item.mux.Lock()
+		if item.busy {
+			item.mux.Unlock()
+			continue
+		}
+		item.busy = true
+		item.mux.Unlock()
+		freeItem = item
+		break
+	}
+
+	p.mux.RUnlock()
+
+	// create a new one-off item if of all of the pool items are currently busy
+	//
+	// note: if turned out not efficient we may change this in the future
+	// by adding the created item in the pool with some timer for removal
+	if freeItem == nil {
+		return call(p.factory())
+	}
+
+	execErr := call(freeItem.vm)
+
+	// "free" the vm
+	freeItem.mux.Lock()
+	freeItem.busy = false
+	freeItem.mux.Unlock()
+
+	return execErr
+}
diff --git a/server/core_backend-server/plugins/migratecmd/automigrate.go b/server/core_backend-server/plugins/migratecmd/automigrate.go
new file mode 100644
index 0000000..a022a4e
--- /dev/null
+++ b/server/core_backend-server/plugins/migratecmd/automigrate.go
@@ -0,0 +1,106 @@
+package migratecmd
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// automigrateOnCollectionChange handles the automigration snapshot
+// generation on collection change request event (create/update/delete).
+func (p *plugin) automigrateOnCollectionChange(e *core.CollectionRequestEvent) error {
+	var err error
+	var old *core.Collection
+	if !e.Collection.IsNew() {
+		old, err = e.App.FindCollectionByNameOrId(e.Collection.Id)
+		if err != nil {
+			return err
+		}
+	}
+
+	err = e.Next()
+	if err != nil {
+		return err
+	}
+
+	new, err := p.app.FindCollectionByNameOrId(e.Collection.Id)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return err
+	}
+
+	// for now exclude OAuth2 configs from the migration
+	if old != nil && old.IsAuth() {
+		old.OAuth2.Providers = nil
+	}
+	if new != nil && new.IsAuth() {
+		new.OAuth2.Providers = nil
+	}
+
+	var template string
+	var templateErr error
+	if p.config.TemplateLang == TemplateLangJS {
+		template, templateErr = p.jsDiffTemplate(new, old)
+	} else {
+		template, templateErr = p.goDiffTemplate(new, old)
+	}
+	if templateErr != nil {
+		if errors.Is(templateErr, ErrEmptyTemplate) {
+			return nil // no changes
+		}
+		return fmt.Errorf("failed to resolve template: %w", templateErr)
+	}
+
+	var action string
+	switch {
+	case new == nil:
+		action = "deleted_" + normalizeCollectionName(old.Name)
+	case old == nil:
+		action = "created_" + normalizeCollectionName(new.Name)
+	default:
+		action = "updated_" + normalizeCollectionName(old.Name)
+	}
+
+	name := fmt.Sprintf("%d_%s.%s", time.Now().Unix(), action, p.config.TemplateLang)
+	filePath := filepath.Join(p.config.Dir, name)
+
+	return p.app.RunInTransaction(func(txApp core.App) error {
+		// insert the migration entry
+		_, err := txApp.DB().Insert(core.DefaultMigrationsTable, dbx.Params{
+			"file": name,
+			// use microseconds for more granular applied time in case
+			// multiple collection changes happens at the ~exact time
+			"applied": time.Now().UnixMicro(),
+		}).Execute()
+		if err != nil {
+			return err
+		}
+
+		// ensure that the local migrations dir exist
+		if err := os.MkdirAll(p.config.Dir, os.ModePerm); err != nil {
+			return fmt.Errorf("failed to create migration dir: %w", err)
+		}
+
+		if err := os.WriteFile(filePath, []byte(template), 0644); err != nil {
+			return fmt.Errorf("failed to save automigrate file: %w", err)
+		}
+
+		return nil
+	})
+}
+
+func normalizeCollectionName(name string) string {
+	// adds an extra "_" suffix to the name in case the collection ends
+	// with "test" to prevent accidentally resulting in "_test.go"/"_test.js" files
+	if strings.HasSuffix(strings.ToLower(name), "test") {
+		name += "_"
+	}
+
+	return name
+}
diff --git a/server/core_backend-server/plugins/migratecmd/migratecmd.go b/server/core_backend-server/plugins/migratecmd/migratecmd.go
new file mode 100644
index 0000000..38485ff
--- /dev/null
+++ b/server/core_backend-server/plugins/migratecmd/migratecmd.go
@@ -0,0 +1,217 @@
+// Package migratecmd adds a new "migrate" command support to a PocketBase instance.
+//
+// It also comes with automigrations support and templates generation
+// (both for JS and GO migration files).
+//
+// Example usage:
+//
+//	migratecmd.MustRegister(app, app.RootCmd, migratecmd.Config{
+//		TemplateLang: migratecmd.TemplateLangJS, // default to migratecmd.TemplateLangGo
+//		Automigrate:  true,
+//		Dir:          "/custom/migrations/dir", // optional template migrations path; default to "pb_migrations" (for JS) and "migrations" (for Go)
+//	})
+//
+//	Note: To allow running JS migrations you'll need to enable first
+//	[jsvm.MustRegister()].
+package migratecmd
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"github.com/spf13/cobra"
+)
+
+// Config defines the config options of the migratecmd plugin.
+type Config struct {
+	// Dir specifies the directory with the user defined migrations.
+	//
+	// If not set it fallbacks to a relative "pb_data/../pb_migrations" (for js)
+	// or "pb_data/../migrations" (for go) directory.
+	Dir string
+
+	// Automigrate specifies whether to enable automigrations.
+	Automigrate bool
+
+	// TemplateLang specifies the template language to use when
+	// generating migrations - js or go (default).
+	TemplateLang string
+}
+
+// MustRegister registers the migratecmd plugin to the provided app instance
+// and panic if it fails.
+//
+// Example usage:
+//
+//	migratecmd.MustRegister(app, app.RootCmd, migratecmd.Config{})
+func MustRegister(app core.App, rootCmd *cobra.Command, config Config) {
+	if err := Register(app, rootCmd, config); err != nil {
+		panic(err)
+	}
+}
+
+// Register registers the migratecmd plugin to the provided app instance.
+func Register(app core.App, rootCmd *cobra.Command, config Config) error {
+	p := &plugin{app: app, config: config}
+
+	if p.config.TemplateLang == "" {
+		p.config.TemplateLang = TemplateLangGo
+	}
+
+	if p.config.Dir == "" {
+		if p.config.TemplateLang == TemplateLangJS {
+			p.config.Dir = filepath.Join(p.app.DataDir(), "../pb_migrations")
+		} else {
+			p.config.Dir = filepath.Join(p.app.DataDir(), "../migrations")
+		}
+	}
+
+	// attach the migrate command
+	if rootCmd != nil {
+		rootCmd.AddCommand(p.createCommand())
+	}
+
+	// watch for collection changes
+	if p.config.Automigrate {
+		p.app.OnCollectionCreateRequest().BindFunc(p.automigrateOnCollectionChange)
+		p.app.OnCollectionUpdateRequest().BindFunc(p.automigrateOnCollectionChange)
+		p.app.OnCollectionDeleteRequest().BindFunc(p.automigrateOnCollectionChange)
+	}
+
+	return nil
+}
+
+type plugin struct {
+	app    core.App
+	config Config
+}
+
+func (p *plugin) createCommand() *cobra.Command {
+	const cmdDesc = `Supported arguments are:
+- up            - runs all available migrations
+- down [number] - reverts the last [number] applied migrations
+- create name   - creates new blank migration template file
+- collections   - creates new migration file with snapshot of the local collections configuration
+- history-sync  - ensures that the _migrations history table doesn't have references to deleted migration files
+`
+
+	command := &cobra.Command{
+		Use:          "migrate",
+		Short:        "Executes app DB migration scripts",
+		Long:         cmdDesc,
+		ValidArgs:    []string{"up", "down", "create", "collections"},
+		SilenceUsage: true,
+		RunE: func(command *cobra.Command, args []string) error {
+			cmd := ""
+			if len(args) > 0 {
+				cmd = args[0]
+			}
+
+			switch cmd {
+			case "create":
+				if _, err := p.migrateCreateHandler("", args[1:], true); err != nil {
+					return err
+				}
+			case "collections":
+				if _, err := p.migrateCollectionsHandler(args[1:], true); err != nil {
+					return err
+				}
+			default:
+				// note: system migrations are always applied as part of the bootstrap process
+				var list = core.MigrationsList{}
+				list.Copy(core.SystemMigrations)
+				list.Copy(core.AppMigrations)
+
+				runner := core.NewMigrationsRunner(p.app, list)
+
+				if err := runner.Run(args...); err != nil {
+					return err
+				}
+			}
+
+			return nil
+		},
+	}
+
+	return command
+}
+
+func (p *plugin) migrateCreateHandler(template string, args []string, interactive bool) (string, error) {
+	if len(args) < 1 {
+		return "", errors.New("missing migration file name")
+	}
+
+	name := args[0]
+	dir := p.config.Dir
+
+	filename := fmt.Sprintf("%d_%s.%s", time.Now().Unix(), inflector.Snakecase(name), p.config.TemplateLang)
+
+	resultFilePath := path.Join(dir, filename)
+
+	if interactive {
+		confirm := osutils.YesNoPrompt(fmt.Sprintf("Do you really want to create migration %q?", resultFilePath), false)
+		if !confirm {
+			fmt.Println("The command has been cancelled")
+			return "", nil
+		}
+	}
+
+	// get default create template
+	if template == "" {
+		var templateErr error
+		if p.config.TemplateLang == TemplateLangJS {
+			template, templateErr = p.jsBlankTemplate()
+		} else {
+			template, templateErr = p.goBlankTemplate()
+		}
+		if templateErr != nil {
+			return "", fmt.Errorf("failed to resolve create template: %v", templateErr)
+		}
+	}
+
+	// ensure that the migrations dir exist
+	if err := os.MkdirAll(dir, os.ModePerm); err != nil {
+		return "", err
+	}
+
+	// save the migration file
+	if err := os.WriteFile(resultFilePath, []byte(template), 0644); err != nil {
+		return "", fmt.Errorf("failed to save migration file %q: %v", resultFilePath, err)
+	}
+
+	if interactive {
+		fmt.Printf("Successfully created file %q\n", resultFilePath)
+	}
+
+	return filename, nil
+}
+
+func (p *plugin) migrateCollectionsHandler(args []string, interactive bool) (string, error) {
+	createArgs := []string{"collections_snapshot"}
+	createArgs = append(createArgs, args...)
+
+	collections := []*core.Collection{}
+	if err := p.app.CollectionQuery().OrderBy("created ASC").All(&collections); err != nil {
+		return "", fmt.Errorf("failed to fetch migrations list: %v", err)
+	}
+
+	var template string
+	var templateErr error
+	if p.config.TemplateLang == TemplateLangJS {
+		template, templateErr = p.jsSnapshotTemplate(collections)
+	} else {
+		template, templateErr = p.goSnapshotTemplate(collections)
+	}
+	if templateErr != nil {
+		return "", fmt.Errorf("failed to resolve template: %v", templateErr)
+	}
+
+	return p.migrateCreateHandler(template, createArgs, interactive)
+}
diff --git a/server/core_backend-server/plugins/migratecmd/migratecmd_test.go b/server/core_backend-server/plugins/migratecmd/migratecmd_test.go
new file mode 100644
index 0000000..41d4f99
--- /dev/null
+++ b/server/core_backend-server/plugins/migratecmd/migratecmd_test.go
@@ -0,0 +1,1337 @@
+package migratecmd_test
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/plugins/migratecmd"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestAutomigrateCollectionCreate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		lang             string
+		expectedTemplate string
+	}{
+		{
+			migratecmd.TemplateLangJS,
+			`
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = new Collection({
+    "authAlert": {
+      "emailTemplate": {
+        "body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location:</p>\n<p><em>{ALERT_INFO}</em></p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>If this was you, you may disregard this email.</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+        "subject": "Login from a new location"
+      },
+      "enabled": true
+    },
+    "authRule": "",
+    "authToken": {
+      "duration": 604800
+    },
+    "confirmEmailChangeTemplate": {
+      "body": "<p>Hello,</p>\n<p>Click on the button below to confirm your new email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Confirm new email</a>\n</p>\n<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+      "subject": "Confirm your {APP_NAME} new email address"
+    },
+    "createRule": null,
+    "deleteRule": null,
+    "emailChangeToken": {
+      "duration": 1800
+    },
+    "fields": [
+      {
+        "autogeneratePattern": "[a-z0-9]{15}",
+        "hidden": false,
+        "id": "text@TEST_RANDOM",
+        "max": 15,
+        "min": 15,
+        "name": "id",
+        "pattern": "^[a-z0-9]+$",
+        "presentable": false,
+        "primaryKey": true,
+        "required": true,
+        "system": true,
+        "type": "text"
+      },
+      {
+        "cost": 0,
+        "hidden": true,
+        "id": "password@TEST_RANDOM",
+        "max": 0,
+        "min": 8,
+        "name": "password",
+        "pattern": "",
+        "presentable": false,
+        "required": true,
+        "system": true,
+        "type": "password"
+      },
+      {
+        "autogeneratePattern": "[a-zA-Z0-9]{50}",
+        "hidden": true,
+        "id": "text@TEST_RANDOM",
+        "max": 60,
+        "min": 30,
+        "name": "tokenKey",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": true,
+        "system": true,
+        "type": "text"
+      },
+      {
+        "exceptDomains": null,
+        "hidden": false,
+        "id": "email@TEST_RANDOM",
+        "name": "email",
+        "onlyDomains": null,
+        "presentable": false,
+        "required": true,
+        "system": true,
+        "type": "email"
+      },
+      {
+        "hidden": false,
+        "id": "bool@TEST_RANDOM",
+        "name": "emailVisibility",
+        "presentable": false,
+        "required": false,
+        "system": true,
+        "type": "bool"
+      },
+      {
+        "hidden": false,
+        "id": "bool@TEST_RANDOM",
+        "name": "verified",
+        "presentable": false,
+        "required": false,
+        "system": true,
+        "type": "bool"
+      }
+    ],
+    "fileToken": {
+      "duration": 180
+    },
+    "id": "@TEST_RANDOM",
+    "indexes": [
+      "create index test on new_name (id)",
+      "CREATE UNIQUE INDEX \"idx_tokenKey_@TEST_RANDOM\" ON \"new_name\" (\"tokenKey\")",
+      "CREATE UNIQUE INDEX \"idx_email_@TEST_RANDOM\" ON \"new_name\" (\"email\") WHERE \"email\" != ''"
+    ],
+    "listRule": "@request.auth.id != '' && 1 > 0 || 'backtick` + "`" + `test' = 0",
+    "manageRule": "1 != 2",
+    "mfa": {
+      "duration": 1800,
+      "enabled": false,
+      "rule": ""
+    },
+    "name": "new_name",
+    "oauth2": {
+      "enabled": false,
+      "mappedFields": {
+        "avatarURL": "",
+        "id": "",
+        "name": "",
+        "username": ""
+      }
+    },
+    "otp": {
+      "duration": 180,
+      "emailTemplate": {
+        "body": "<p>Hello,</p>\n<p>Your one-time password is: <strong>{OTP}</strong></p>\n<p><i>If you didn't ask for the one-time password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+        "subject": "OTP for {APP_NAME}"
+      },
+      "enabled": false,
+      "length": 8
+    },
+    "passwordAuth": {
+      "enabled": true,
+      "identityFields": [
+        "email"
+      ]
+    },
+    "passwordResetToken": {
+      "duration": 1800
+    },
+    "resetPasswordTemplate": {
+      "body": "<p>Hello,</p>\n<p>Click on the button below to reset your password.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Reset password</a>\n</p>\n<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+      "subject": "Reset your {APP_NAME} password"
+    },
+    "system": true,
+    "type": "auth",
+    "updateRule": null,
+    "verificationTemplate": {
+      "body": "<p>Hello,</p>\n<p>Thank you for joining us at {APP_NAME}.</p>\n<p>Click on the button below to verify your email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Verify</a>\n</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+      "subject": "Verify your {APP_NAME} email"
+    },
+    "verificationToken": {
+      "duration": 259200
+    },
+    "viewRule": "id = \"1\""
+  });
+
+  return app.save(collection);
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("@TEST_RANDOM");
+
+  return app.delete(collection);
+})
+`,
+		},
+		{
+			migratecmd.TemplateLangGo,
+			`
+package _test_migrations
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		jsonData := ` + "`" + `{
+			"authAlert": {
+				"emailTemplate": {
+					"body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location:</p>\n<p><em>{ALERT_INFO}</em></p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>If this was you, you may disregard this email.</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+					"subject": "Login from a new location"
+				},
+				"enabled": true
+			},
+			"authRule": "",
+			"authToken": {
+				"duration": 604800
+			},
+			"confirmEmailChangeTemplate": {
+				"body": "<p>Hello,</p>\n<p>Click on the button below to confirm your new email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Confirm new email</a>\n</p>\n<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+				"subject": "Confirm your {APP_NAME} new email address"
+			},
+			"createRule": null,
+			"deleteRule": null,
+			"emailChangeToken": {
+				"duration": 1800
+			},
+			"fields": [
+				{
+					"autogeneratePattern": "[a-z0-9]{15}",
+					"hidden": false,
+					"id": "text@TEST_RANDOM",
+					"max": 15,
+					"min": 15,
+					"name": "id",
+					"pattern": "^[a-z0-9]+$",
+					"presentable": false,
+					"primaryKey": true,
+					"required": true,
+					"system": true,
+					"type": "text"
+				},
+				{
+					"cost": 0,
+					"hidden": true,
+					"id": "password@TEST_RANDOM",
+					"max": 0,
+					"min": 8,
+					"name": "password",
+					"pattern": "",
+					"presentable": false,
+					"required": true,
+					"system": true,
+					"type": "password"
+				},
+				{
+					"autogeneratePattern": "[a-zA-Z0-9]{50}",
+					"hidden": true,
+					"id": "text@TEST_RANDOM",
+					"max": 60,
+					"min": 30,
+					"name": "tokenKey",
+					"pattern": "",
+					"presentable": false,
+					"primaryKey": false,
+					"required": true,
+					"system": true,
+					"type": "text"
+				},
+				{
+					"exceptDomains": null,
+					"hidden": false,
+					"id": "email@TEST_RANDOM",
+					"name": "email",
+					"onlyDomains": null,
+					"presentable": false,
+					"required": true,
+					"system": true,
+					"type": "email"
+				},
+				{
+					"hidden": false,
+					"id": "bool@TEST_RANDOM",
+					"name": "emailVisibility",
+					"presentable": false,
+					"required": false,
+					"system": true,
+					"type": "bool"
+				},
+				{
+					"hidden": false,
+					"id": "bool@TEST_RANDOM",
+					"name": "verified",
+					"presentable": false,
+					"required": false,
+					"system": true,
+					"type": "bool"
+				}
+			],
+			"fileToken": {
+				"duration": 180
+			},
+			"id": "@TEST_RANDOM",
+			"indexes": [
+				"create index test on new_name (id)",
+				"CREATE UNIQUE INDEX \"idx_tokenKey_@TEST_RANDOM\" ON \"new_name\" (\"tokenKey\")",
+				"CREATE UNIQUE INDEX \"idx_email_@TEST_RANDOM\" ON \"new_name\" (\"email\") WHERE \"email\" != ''"
+			],
+			"listRule": "@request.auth.id != '' && 1 > 0 || 'backtick` + "` + \"`\" + `" + `test' = 0",
+			"manageRule": "1 != 2",
+			"mfa": {
+				"duration": 1800,
+				"enabled": false,
+				"rule": ""
+			},
+			"name": "new_name",
+			"oauth2": {
+				"enabled": false,
+				"mappedFields": {
+					"avatarURL": "",
+					"id": "",
+					"name": "",
+					"username": ""
+				}
+			},
+			"otp": {
+				"duration": 180,
+				"emailTemplate": {
+					"body": "<p>Hello,</p>\n<p>Your one-time password is: <strong>{OTP}</strong></p>\n<p><i>If you didn't ask for the one-time password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+					"subject": "OTP for {APP_NAME}"
+				},
+				"enabled": false,
+				"length": 8
+			},
+			"passwordAuth": {
+				"enabled": true,
+				"identityFields": [
+					"email"
+				]
+			},
+			"passwordResetToken": {
+				"duration": 1800
+			},
+			"resetPasswordTemplate": {
+				"body": "<p>Hello,</p>\n<p>Click on the button below to reset your password.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Reset password</a>\n</p>\n<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+				"subject": "Reset your {APP_NAME} password"
+			},
+			"system": true,
+			"type": "auth",
+			"updateRule": null,
+			"verificationTemplate": {
+				"body": "<p>Hello,</p>\n<p>Thank you for joining us at {APP_NAME}.</p>\n<p>Click on the button below to verify your email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Verify</a>\n</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+				"subject": "Verify your {APP_NAME} email"
+			},
+			"verificationToken": {
+				"duration": 259200
+			},
+			"viewRule": "id = \"1\""
+		}` + "`" + `
+
+		collection := &core.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collection); err != nil {
+			return err
+		}
+
+		return app.Save(collection)
+	}, func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId("@TEST_RANDOM")
+		if err != nil {
+			return err
+		}
+
+		return app.Delete(collection)
+	})
+}
+`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.lang, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+
+			migratecmd.MustRegister(app, nil, migratecmd.Config{
+				TemplateLang: s.lang,
+				Automigrate:  true,
+				Dir:          migrationsDir,
+			})
+
+			app.Bootstrap()
+
+			collection := core.NewAuthCollection("new_name")
+			collection.System = true
+			collection.ListRule = types.Pointer("@request.auth.id != '' && 1 > 0 || 'backtick`test' = 0")
+			collection.ViewRule = types.Pointer(`id = "1"`)
+			collection.Indexes = types.JSONArray[string]{"create index test on new_name (id)"}
+			collection.ManageRule = types.Pointer("1 != 2")
+			//  should be ignored
+			collection.OAuth2.Providers = []core.OAuth2ProviderConfig{{Name: "gitlab", ClientId: "abc", ClientSecret: "123"}}
+			testSecret := strings.Repeat("a", 30)
+			collection.AuthToken.Secret = testSecret
+			collection.FileToken.Secret = testSecret
+			collection.EmailChangeToken.Secret = testSecret
+			collection.PasswordResetToken.Secret = testSecret
+			collection.VerificationToken.Secret = testSecret
+
+			// save the newly created dummy collection (with mock request event)
+			event := new(core.CollectionRequestEvent)
+			event.RequestEvent = &core.RequestEvent{}
+			event.App = app
+			event.Collection = collection
+			err := app.OnCollectionCreateRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
+				return e.App.Save(e.Collection)
+			})
+			if err != nil {
+				t.Fatalf("Failed to save the created dummy collection, got: %v", err)
+			}
+
+			files, err := os.ReadDir(migrationsDir)
+			if err != nil {
+				t.Fatalf("Expected migrationsDir to be created, got %v", err)
+			}
+
+			if total := len(files); total != 1 {
+				t.Fatalf("Expected 1 file to be generated, got %d: %v", total, files)
+			}
+
+			expectedName := "_created_new_name." + s.lang
+			if !strings.Contains(files[0].Name(), expectedName) {
+				t.Fatalf("Expected filename to contains %q, got %q", expectedName, files[0].Name())
+			}
+
+			fullPath := filepath.Join(migrationsDir, files[0].Name())
+			content, err := os.ReadFile(fullPath)
+			if err != nil {
+				t.Fatalf("Failed to read the generated migration file: %v", err)
+			}
+			contentStr := strings.TrimSpace(string(content))
+
+			// replace @TEST_RANDOM placeholder with a regex pattern
+			expectedTemplate := strings.ReplaceAll(
+				"^"+regexp.QuoteMeta(strings.TrimSpace(s.expectedTemplate))+"$",
+				"@TEST_RANDOM",
+				`\w+`,
+			)
+			if !list.ExistInSliceWithRegex(contentStr, []string{expectedTemplate}) {
+				t.Fatalf("Expected template \n%v \ngot \n%v", s.expectedTemplate, contentStr)
+			}
+		})
+	}
+}
+
+func TestAutomigrateCollectionDelete(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		lang             string
+		expectedTemplate string
+	}{
+		{
+			migratecmd.TemplateLangJS,
+			`
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("@TEST_RANDOM");
+
+  return app.delete(collection);
+}, (app) => {
+  const collection = new Collection({
+    "authAlert": {
+      "emailTemplate": {
+        "body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location:</p>\n<p><em>{ALERT_INFO}</em></p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>If this was you, you may disregard this email.</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+        "subject": "Login from a new location"
+      },
+      "enabled": true
+    },
+    "authRule": "",
+    "authToken": {
+      "duration": 604800
+    },
+    "confirmEmailChangeTemplate": {
+      "body": "<p>Hello,</p>\n<p>Click on the button below to confirm your new email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Confirm new email</a>\n</p>\n<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+      "subject": "Confirm your {APP_NAME} new email address"
+    },
+    "createRule": null,
+    "deleteRule": null,
+    "emailChangeToken": {
+      "duration": 1800
+    },
+    "fields": [
+      {
+        "autogeneratePattern": "[a-z0-9]{15}",
+        "hidden": false,
+        "id": "text@TEST_RANDOM",
+        "max": 15,
+        "min": 15,
+        "name": "id",
+        "pattern": "^[a-z0-9]+$",
+        "presentable": false,
+        "primaryKey": true,
+        "required": true,
+        "system": true,
+        "type": "text"
+      },
+      {
+        "cost": 0,
+        "hidden": true,
+        "id": "password@TEST_RANDOM",
+        "max": 0,
+        "min": 8,
+        "name": "password",
+        "pattern": "",
+        "presentable": false,
+        "required": true,
+        "system": true,
+        "type": "password"
+      },
+      {
+        "autogeneratePattern": "[a-zA-Z0-9]{50}",
+        "hidden": true,
+        "id": "text@TEST_RANDOM",
+        "max": 60,
+        "min": 30,
+        "name": "tokenKey",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": true,
+        "system": true,
+        "type": "text"
+      },
+      {
+        "exceptDomains": null,
+        "hidden": false,
+        "id": "email3885137012",
+        "name": "email",
+        "onlyDomains": null,
+        "presentable": false,
+        "required": true,
+        "system": true,
+        "type": "email"
+      },
+      {
+        "hidden": false,
+        "id": "bool@TEST_RANDOM",
+        "name": "emailVisibility",
+        "presentable": false,
+        "required": false,
+        "system": true,
+        "type": "bool"
+      },
+      {
+        "hidden": false,
+        "id": "bool256245529",
+        "name": "verified",
+        "presentable": false,
+        "required": false,
+        "system": true,
+        "type": "bool"
+      }
+    ],
+    "fileToken": {
+      "duration": 180
+    },
+    "id": "@TEST_RANDOM",
+    "indexes": [
+      "create index test on test123 (id)",
+      "CREATE UNIQUE INDEX \"idx_tokenKey_@TEST_RANDOM\" ON \"test123\" (\"tokenKey\")",
+      "CREATE UNIQUE INDEX \"idx_email_@TEST_RANDOM\" ON \"test123\" (\"email\") WHERE \"email\" != ''"
+    ],
+    "listRule": "@request.auth.id != '' && 1 > 0 || 'backtick` + "`" + `test' = 0",
+    "manageRule": "1 != 2",
+    "mfa": {
+      "duration": 1800,
+      "enabled": false,
+      "rule": ""
+    },
+    "name": "test123",
+    "oauth2": {
+      "enabled": false,
+      "mappedFields": {
+        "avatarURL": "",
+        "id": "",
+        "name": "",
+        "username": ""
+      }
+    },
+    "otp": {
+      "duration": 180,
+      "emailTemplate": {
+        "body": "<p>Hello,</p>\n<p>Your one-time password is: <strong>{OTP}</strong></p>\n<p><i>If you didn't ask for the one-time password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+        "subject": "OTP for {APP_NAME}"
+      },
+      "enabled": false,
+      "length": 8
+    },
+    "passwordAuth": {
+      "enabled": true,
+      "identityFields": [
+        "email"
+      ]
+    },
+    "passwordResetToken": {
+      "duration": 1800
+    },
+    "resetPasswordTemplate": {
+      "body": "<p>Hello,</p>\n<p>Click on the button below to reset your password.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Reset password</a>\n</p>\n<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+      "subject": "Reset your {APP_NAME} password"
+    },
+    "system": false,
+    "type": "auth",
+    "updateRule": null,
+    "verificationTemplate": {
+      "body": "<p>Hello,</p>\n<p>Thank you for joining us at {APP_NAME}.</p>\n<p>Click on the button below to verify your email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Verify</a>\n</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+      "subject": "Verify your {APP_NAME} email"
+    },
+    "verificationToken": {
+      "duration": 259200
+    },
+    "viewRule": "id = \"1\""
+  });
+
+  return app.save(collection);
+})
+`,
+		},
+		{
+			migratecmd.TemplateLangGo,
+			`
+package _test_migrations
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId("@TEST_RANDOM")
+		if err != nil {
+			return err
+		}
+
+		return app.Delete(collection)
+	}, func(app core.App) error {
+		jsonData := ` + "`" + `{
+			"authAlert": {
+				"emailTemplate": {
+					"body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location:</p>\n<p><em>{ALERT_INFO}</em></p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>If this was you, you may disregard this email.</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+					"subject": "Login from a new location"
+				},
+				"enabled": true
+			},
+			"authRule": "",
+			"authToken": {
+				"duration": 604800
+			},
+			"confirmEmailChangeTemplate": {
+				"body": "<p>Hello,</p>\n<p>Click on the button below to confirm your new email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Confirm new email</a>\n</p>\n<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+				"subject": "Confirm your {APP_NAME} new email address"
+			},
+			"createRule": null,
+			"deleteRule": null,
+			"emailChangeToken": {
+				"duration": 1800
+			},
+			"fields": [
+				{
+					"autogeneratePattern": "[a-z0-9]{15}",
+					"hidden": false,
+					"id": "text@TEST_RANDOM",
+					"max": 15,
+					"min": 15,
+					"name": "id",
+					"pattern": "^[a-z0-9]+$",
+					"presentable": false,
+					"primaryKey": true,
+					"required": true,
+					"system": true,
+					"type": "text"
+				},
+				{
+					"cost": 0,
+					"hidden": true,
+					"id": "password@TEST_RANDOM",
+					"max": 0,
+					"min": 8,
+					"name": "password",
+					"pattern": "",
+					"presentable": false,
+					"required": true,
+					"system": true,
+					"type": "password"
+				},
+				{
+					"autogeneratePattern": "[a-zA-Z0-9]{50}",
+					"hidden": true,
+					"id": "text@TEST_RANDOM",
+					"max": 60,
+					"min": 30,
+					"name": "tokenKey",
+					"pattern": "",
+					"presentable": false,
+					"primaryKey": false,
+					"required": true,
+					"system": true,
+					"type": "text"
+				},
+				{
+					"exceptDomains": null,
+					"hidden": false,
+					"id": "email3885137012",
+					"name": "email",
+					"onlyDomains": null,
+					"presentable": false,
+					"required": true,
+					"system": true,
+					"type": "email"
+				},
+				{
+					"hidden": false,
+					"id": "bool@TEST_RANDOM",
+					"name": "emailVisibility",
+					"presentable": false,
+					"required": false,
+					"system": true,
+					"type": "bool"
+				},
+				{
+					"hidden": false,
+					"id": "bool256245529",
+					"name": "verified",
+					"presentable": false,
+					"required": false,
+					"system": true,
+					"type": "bool"
+				}
+			],
+			"fileToken": {
+				"duration": 180
+			},
+			"id": "@TEST_RANDOM",
+			"indexes": [
+				"create index test on test123 (id)",
+				"CREATE UNIQUE INDEX \"idx_tokenKey_@TEST_RANDOM\" ON \"test123\" (\"tokenKey\")",
+				"CREATE UNIQUE INDEX \"idx_email_@TEST_RANDOM\" ON \"test123\" (\"email\") WHERE \"email\" != ''"
+			],
+			"listRule": "@request.auth.id != '' && 1 > 0 || 'backtick` + "` + \"`\" + `" + `test' = 0",
+			"manageRule": "1 != 2",
+			"mfa": {
+				"duration": 1800,
+				"enabled": false,
+				"rule": ""
+			},
+			"name": "test123",
+			"oauth2": {
+				"enabled": false,
+				"mappedFields": {
+					"avatarURL": "",
+					"id": "",
+					"name": "",
+					"username": ""
+				}
+			},
+			"otp": {
+				"duration": 180,
+				"emailTemplate": {
+					"body": "<p>Hello,</p>\n<p>Your one-time password is: <strong>{OTP}</strong></p>\n<p><i>If you didn't ask for the one-time password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+					"subject": "OTP for {APP_NAME}"
+				},
+				"enabled": false,
+				"length": 8
+			},
+			"passwordAuth": {
+				"enabled": true,
+				"identityFields": [
+					"email"
+				]
+			},
+			"passwordResetToken": {
+				"duration": 1800
+			},
+			"resetPasswordTemplate": {
+				"body": "<p>Hello,</p>\n<p>Click on the button below to reset your password.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Reset password</a>\n</p>\n<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+				"subject": "Reset your {APP_NAME} password"
+			},
+			"system": false,
+			"type": "auth",
+			"updateRule": null,
+			"verificationTemplate": {
+				"body": "<p>Hello,</p>\n<p>Thank you for joining us at {APP_NAME}.</p>\n<p>Click on the button below to verify your email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Verify</a>\n</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>",
+				"subject": "Verify your {APP_NAME} email"
+			},
+			"verificationToken": {
+				"duration": 259200
+			},
+			"viewRule": "id = \"1\""
+		}` + "`" + `
+
+		collection := &core.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collection); err != nil {
+			return err
+		}
+
+		return app.Save(collection)
+	})
+}
+`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.lang, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+
+			// create dummy collection
+			collection := core.NewAuthCollection("test123")
+			collection.ListRule = types.Pointer("@request.auth.id != '' && 1 > 0 || 'backtick`test' = 0")
+			collection.ViewRule = types.Pointer(`id = "1"`)
+			collection.Indexes = types.JSONArray[string]{"create index test on test123 (id)"}
+			collection.ManageRule = types.Pointer("1 != 2")
+			if err := app.Save(collection); err != nil {
+				t.Fatalf("Failed to save dummy collection, got: %v", err)
+			}
+
+			migratecmd.MustRegister(app, nil, migratecmd.Config{
+				TemplateLang: s.lang,
+				Automigrate:  true,
+				Dir:          migrationsDir,
+			})
+
+			app.Bootstrap()
+
+			// delete the newly created dummy collection (with mock request event)
+			event := new(core.CollectionRequestEvent)
+			event.RequestEvent = &core.RequestEvent{}
+			event.App = app
+			event.Collection = collection
+			err := app.OnCollectionDeleteRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
+				return e.App.Delete(e.Collection)
+			})
+			if err != nil {
+				t.Fatalf("Failed to delete dummy collection, got: %v", err)
+			}
+
+			files, err := os.ReadDir(migrationsDir)
+			if err != nil {
+				t.Fatalf("Expected migrationsDir to be created, got: %v", err)
+			}
+
+			if total := len(files); total != 1 {
+				t.Fatalf("Expected 1 file to be generated, got %d", total)
+			}
+
+			expectedName := "_deleted_test123." + s.lang
+			if !strings.Contains(files[0].Name(), expectedName) {
+				t.Fatalf("Expected filename to contains %q, got %q", expectedName, files[0].Name())
+			}
+
+			fullPath := filepath.Join(migrationsDir, files[0].Name())
+			content, err := os.ReadFile(fullPath)
+			if err != nil {
+				t.Fatalf("Failed to read the generated migration file: %v", err)
+			}
+			contentStr := strings.TrimSpace(string(content))
+
+			// replace @TEST_RANDOM placeholder with a regex pattern
+			expectedTemplate := strings.ReplaceAll(
+				"^"+regexp.QuoteMeta(strings.TrimSpace(s.expectedTemplate))+"$",
+				"@TEST_RANDOM",
+				`\w+`,
+			)
+			if !list.ExistInSliceWithRegex(contentStr, []string{expectedTemplate}) {
+				t.Fatalf("Expected template \n%v \ngot \n%v", s.expectedTemplate, contentStr)
+			}
+		})
+	}
+}
+
+func TestAutomigrateCollectionUpdate(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		lang             string
+		expectedTemplate string
+	}{
+		{
+			migratecmd.TemplateLangJS,
+			`
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("@TEST_RANDOM")
+
+  // update collection data
+  unmarshal({
+    "createRule": "id = \"nil_update\"",
+    "deleteRule": null,
+    "fileToken": {
+      "duration": 10
+    },
+    "indexes": [
+      "create index test1 on test123_update (f1_name)",
+      "CREATE UNIQUE INDEX \"idx_tokenKey_pbc_700768986\" ON \"test123_update\" (\"tokenKey\")",
+      "CREATE UNIQUE INDEX \"idx_email_pbc_700768986\" ON \"test123_update\" (\"email\") WHERE \"email\" != ''"
+    ],
+    "listRule": "@request.auth.id != ''",
+    "name": "test123_update",
+    "oauth2": {
+      "enabled": true
+    },
+    "updateRule": "id = \"2_update\""
+  }, collection)
+
+  // remove field
+  collection.fields.removeById("f3_id")
+
+  // add field
+  collection.fields.addAt(8, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "f4_id",
+    "max": 0,
+    "min": 0,
+    "name": "f4_name",
+    "pattern": "` + "`" + `test backtick` + "`" + `123",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // update field
+  collection.fields.addAt(7, new Field({
+    "hidden": false,
+    "id": "f2_id",
+    "max": null,
+    "min": 10,
+    "name": "f2_name_new",
+    "onlyInt": false,
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "number"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("@TEST_RANDOM")
+
+  // update collection data
+  unmarshal({
+    "createRule": null,
+    "deleteRule": "id = \"3\"",
+    "fileToken": {
+      "duration": 180
+    },
+    "indexes": [
+      "create index test1 on test123 (f1_name)",
+      "CREATE UNIQUE INDEX \"idx_tokenKey_pbc_700768986\" ON \"test123\" (\"tokenKey\")",
+      "CREATE UNIQUE INDEX \"idx_email_pbc_700768986\" ON \"test123\" (\"email\") WHERE \"email\" != ''"
+    ],
+    "listRule": "@request.auth.id != '' && 1 != 2",
+    "name": "test123",
+    "oauth2": {
+      "enabled": false
+    },
+    "updateRule": "id = \"2\""
+  }, collection)
+
+  // add field
+  collection.fields.addAt(8, new Field({
+    "hidden": false,
+    "id": "f3_id",
+    "name": "f3_name",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "bool"
+  }))
+
+  // remove field
+  collection.fields.removeById("f4_id")
+
+  // update field
+  collection.fields.addAt(7, new Field({
+    "hidden": false,
+    "id": "f2_id",
+    "max": null,
+    "min": 10,
+    "name": "f2_name",
+    "onlyInt": false,
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "number"
+  }))
+
+  return app.save(collection)
+})
+
+`,
+		},
+		{
+			migratecmd.TemplateLangGo,
+			`
+package _test_migrations
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId("@TEST_RANDOM")
+		if err != nil {
+			return err
+		}
+
+		// update collection data
+		if err := json.Unmarshal([]byte(` + "`" + `{
+			"createRule": "id = \"nil_update\"",
+			"deleteRule": null,
+			"fileToken": {
+				"duration": 10
+			},
+			"indexes": [
+				"create index test1 on test123_update (f1_name)",
+				"CREATE UNIQUE INDEX \"idx_tokenKey_pbc_700768986\" ON \"test123_update\" (\"tokenKey\")",
+				"CREATE UNIQUE INDEX \"idx_email_pbc_700768986\" ON \"test123_update\" (\"email\") WHERE \"email\" != ''"
+			],
+			"listRule": "@request.auth.id != ''",
+			"name": "test123_update",
+			"oauth2": {
+				"enabled": true
+			},
+			"updateRule": "id = \"2_update\""
+		}` + "`" + `), &collection); err != nil {
+			return err
+		}
+
+		// remove field
+		collection.Fields.RemoveById("f3_id")
+
+		// add field
+		if err := collection.Fields.AddMarshaledJSONAt(8, []byte(` + "`" + `{
+			"autogeneratePattern": "",
+			"hidden": false,
+			"id": "f4_id",
+			"max": 0,
+			"min": 0,
+			"name": "f4_name",
+			"pattern": "` + "` + \"`\" + `" + `test backtick` + "` + \"`\" + `" + `123",
+			"presentable": false,
+			"primaryKey": false,
+			"required": false,
+			"system": false,
+			"type": "text"
+		}` + "`" + `)); err != nil {
+			return err
+		}
+
+		// update field
+		if err := collection.Fields.AddMarshaledJSONAt(7, []byte(` + "`" + `{
+			"hidden": false,
+			"id": "f2_id",
+			"max": null,
+			"min": 10,
+			"name": "f2_name_new",
+			"onlyInt": false,
+			"presentable": false,
+			"required": false,
+			"system": false,
+			"type": "number"
+		}` + "`" + `)); err != nil {
+			return err
+		}
+
+		return app.Save(collection)
+	}, func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId("@TEST_RANDOM")
+		if err != nil {
+			return err
+		}
+
+		// update collection data
+		if err := json.Unmarshal([]byte(` + "`" + `{
+			"createRule": null,
+			"deleteRule": "id = \"3\"",
+			"fileToken": {
+				"duration": 180
+			},
+			"indexes": [
+				"create index test1 on test123 (f1_name)",
+				"CREATE UNIQUE INDEX \"idx_tokenKey_pbc_700768986\" ON \"test123\" (\"tokenKey\")",
+				"CREATE UNIQUE INDEX \"idx_email_pbc_700768986\" ON \"test123\" (\"email\") WHERE \"email\" != ''"
+			],
+			"listRule": "@request.auth.id != '' && 1 != 2",
+			"name": "test123",
+			"oauth2": {
+				"enabled": false
+			},
+			"updateRule": "id = \"2\""
+		}` + "`" + `), &collection); err != nil {
+			return err
+		}
+
+		// add field
+		if err := collection.Fields.AddMarshaledJSONAt(8, []byte(` + "`" + `{
+			"hidden": false,
+			"id": "f3_id",
+			"name": "f3_name",
+			"presentable": false,
+			"required": false,
+			"system": false,
+			"type": "bool"
+		}` + "`" + `)); err != nil {
+			return err
+		}
+
+		// remove field
+		collection.Fields.RemoveById("f4_id")
+
+		// update field
+		if err := collection.Fields.AddMarshaledJSONAt(7, []byte(` + "`" + `{
+			"hidden": false,
+			"id": "f2_id",
+			"max": null,
+			"min": 10,
+			"name": "f2_name",
+			"onlyInt": false,
+			"presentable": false,
+			"required": false,
+			"system": false,
+			"type": "number"
+		}` + "`" + `)); err != nil {
+			return err
+		}
+
+		return app.Save(collection)
+	})
+}
+`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.lang, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+
+			// create dummy collection
+			collection := core.NewAuthCollection("test123")
+			collection.ListRule = types.Pointer("@request.auth.id != '' && 1 != 2")
+			collection.ViewRule = types.Pointer(`id = "1"`)
+			collection.UpdateRule = types.Pointer(`id = "2"`)
+			collection.CreateRule = nil
+			collection.DeleteRule = types.Pointer(`id = "3"`)
+			collection.Indexes = types.JSONArray[string]{"create index test1 on test123 (f1_name)"}
+			collection.ManageRule = types.Pointer("1 != 2")
+			collection.Fields.Add(&core.TextField{
+				Id:       "f1_id",
+				Name:     "f1_name",
+				Required: true,
+			})
+			collection.Fields.Add(&core.NumberField{
+				Id:   "f2_id",
+				Name: "f2_name",
+				Min:  types.Pointer(10.0),
+			})
+			collection.Fields.Add(&core.BoolField{
+				Id:   "f3_id",
+				Name: "f3_name",
+			})
+
+			if err := app.Save(collection); err != nil {
+				t.Fatalf("Failed to save dummy collection, got %v", err)
+			}
+
+			// init plugin
+			migratecmd.MustRegister(app, nil, migratecmd.Config{
+				TemplateLang: s.lang,
+				Automigrate:  true,
+				Dir:          migrationsDir,
+			})
+			app.Bootstrap()
+
+			// update the dummy collection
+			collection.Name = "test123_update"
+			collection.ListRule = types.Pointer("@request.auth.id != ''")
+			collection.ViewRule = types.Pointer(`id = "1"`) // no change
+			collection.UpdateRule = types.Pointer(`id = "2_update"`)
+			collection.CreateRule = types.Pointer(`id = "nil_update"`)
+			collection.DeleteRule = nil
+			collection.Indexes = types.JSONArray[string]{
+				"create index test1 on test123_update (f1_name)",
+			}
+			collection.Fields.RemoveById("f3_id")
+			collection.Fields.Add(&core.TextField{
+				Id:      "f4_id",
+				Name:    "f4_name",
+				Pattern: "`test backtick`123",
+			})
+			f := collection.Fields.GetById("f2_id")
+			f.SetName("f2_name_new")
+			collection.OAuth2.Enabled = true
+			collection.FileToken.Duration = 10
+			//  should be ignored
+			collection.OAuth2.Providers = []core.OAuth2ProviderConfig{{Name: "gitlab", ClientId: "abc", ClientSecret: "123"}}
+			testSecret := strings.Repeat("b", 30)
+			collection.AuthToken.Secret = testSecret
+			collection.FileToken.Secret = testSecret
+			collection.EmailChangeToken.Secret = testSecret
+			collection.PasswordResetToken.Secret = testSecret
+			collection.VerificationToken.Secret = testSecret
+
+			// save the changes and trigger automigrate (with mock request event)
+			event := new(core.CollectionRequestEvent)
+			event.RequestEvent = &core.RequestEvent{}
+			event.App = app
+			event.Collection = collection
+			err := app.OnCollectionUpdateRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
+				return e.App.Save(e.Collection)
+			})
+			if err != nil {
+				t.Fatalf("Failed to save dummy collection changes, got %v", err)
+			}
+
+			files, err := os.ReadDir(migrationsDir)
+			if err != nil {
+				t.Fatalf("Expected migrationsDir to be created, got: %v", err)
+			}
+
+			if total := len(files); total != 1 {
+				t.Fatalf("Expected 1 file to be generated, got %d", total)
+			}
+
+			expectedName := "_updated_test123." + s.lang
+			if !strings.Contains(files[0].Name(), expectedName) {
+				t.Fatalf("Expected filename to contains %q, got %q", expectedName, files[0].Name())
+			}
+
+			fullPath := filepath.Join(migrationsDir, files[0].Name())
+			content, err := os.ReadFile(fullPath)
+			if err != nil {
+				t.Fatalf("Failed to read the generated migration file: %v", err)
+			}
+			contentStr := strings.TrimSpace(string(content))
+
+			// replace @TEST_RANDOM placeholder with a regex pattern
+			expectedTemplate := strings.ReplaceAll(
+				"^"+regexp.QuoteMeta(strings.TrimSpace(s.expectedTemplate))+"$",
+				"@TEST_RANDOM",
+				`\w+`,
+			)
+			if !list.ExistInSliceWithRegex(contentStr, []string{expectedTemplate}) {
+				t.Fatalf("Expected template \n%v \ngot \n%v", s.expectedTemplate, contentStr)
+			}
+		})
+	}
+}
+
+func TestAutomigrateCollectionNoChanges(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		lang string
+	}{
+		{
+			migratecmd.TemplateLangJS,
+		},
+		{
+			migratecmd.TemplateLangGo,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.lang, func(t *testing.T) {
+			app, _ := tests.NewTestApp()
+			defer app.Cleanup()
+
+			migrationsDir := filepath.Join(app.DataDir(), "_test_migrations")
+
+			// create dummy collection
+			collection := core.NewAuthCollection("test123")
+
+			if err := app.Save(collection); err != nil {
+				t.Fatalf("Failed to save dummy collection, got %v", err)
+			}
+
+			// init plugin
+			migratecmd.MustRegister(app, nil, migratecmd.Config{
+				TemplateLang: s.lang,
+				Automigrate:  true,
+				Dir:          migrationsDir,
+			})
+			app.Bootstrap()
+
+			//  should be ignored
+			collection.OAuth2.Providers = []core.OAuth2ProviderConfig{{Name: "gitlab", ClientId: "abc", ClientSecret: "123"}}
+			testSecret := strings.Repeat("b", 30)
+			collection.AuthToken.Secret = testSecret
+			collection.FileToken.Secret = testSecret
+			collection.EmailChangeToken.Secret = testSecret
+			collection.PasswordResetToken.Secret = testSecret
+			collection.VerificationToken.Secret = testSecret
+
+			// resave without other changes and trigger automigrate (with mock request event)
+			event := new(core.CollectionRequestEvent)
+			event.RequestEvent = &core.RequestEvent{}
+			event.App = app
+			event.Collection = collection
+			err := app.OnCollectionUpdateRequest().Trigger(event, func(e *core.CollectionRequestEvent) error {
+				return e.App.Save(e.Collection)
+			})
+			if err != nil {
+				t.Fatalf("Failed to save dummy collection update, got %v", err)
+			}
+
+			files, _ := os.ReadDir(migrationsDir)
+			if total := len(files); total != 0 {
+				t.Fatalf("Expected 0 files to be generated, got %d", total)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/plugins/migratecmd/templates.go b/server/core_backend-server/plugins/migratecmd/templates.go
new file mode 100644
index 0000000..3667deb
--- /dev/null
+++ b/server/core_backend-server/plugins/migratecmd/templates.go
@@ -0,0 +1,769 @@
+package migratecmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+const (
+	TemplateLangJS = "js"
+	TemplateLangGo = "go"
+
+	// note: this usually should be configurable similar to the jsvm plugin,
+	// but for simplicity is static as users can easily change the
+	// reference path if they use custom dirs structure
+	jsTypesDirective = `/// <reference path="../pb_data/types.d.ts" />` + "\n"
+)
+
+var ErrEmptyTemplate = errors.New("empty template")
+
+// -------------------------------------------------------------------
+// JavaScript templates
+// -------------------------------------------------------------------
+
+func (p *plugin) jsBlankTemplate() (string, error) {
+	const template = jsTypesDirective + `migrate((app) => {
+  // add up queries...
+}, (app) => {
+  // add down queries...
+})
+`
+
+	return template, nil
+}
+
+func (p *plugin) jsSnapshotTemplate(collections []*core.Collection) (string, error) {
+	// unset timestamp fields
+	var collectionsData = make([]map[string]any, len(collections))
+	for i, c := range collections {
+		data, err := toMap(c)
+		if err != nil {
+			return "", fmt.Errorf("failed to serialize %q into a map: %w", c.Name, err)
+		}
+		delete(data, "created")
+		delete(data, "updated")
+		deleteNestedMapKey(data, "oauth2", "providers")
+		collectionsData[i] = data
+	}
+
+	jsonData, err := marhshalWithoutEscape(collectionsData, "  ", "  ")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = jsTypesDirective + `migrate((app) => {
+  const snapshot = %s;
+
+  return app.importCollections(snapshot, false);
+}, (app) => {
+  return null;
+})
+`
+
+	return fmt.Sprintf(template, string(jsonData)), nil
+}
+
+func (p *plugin) jsCreateTemplate(collection *core.Collection) (string, error) {
+	// unset timestamp fields
+	collectionData, err := toMap(collection)
+	if err != nil {
+		return "", err
+	}
+	delete(collectionData, "created")
+	delete(collectionData, "updated")
+	deleteNestedMapKey(collectionData, "oauth2", "providers")
+
+	jsonData, err := marhshalWithoutEscape(collectionData, "  ", "  ")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collection: %w", err)
+	}
+
+	const template = jsTypesDirective + `migrate((app) => {
+  const collection = new Collection(%s);
+
+  return app.save(collection);
+}, (app) => {
+  const collection = app.findCollectionByNameOrId(%q);
+
+  return app.delete(collection);
+})
+`
+
+	return fmt.Sprintf(template, string(jsonData), collection.Id), nil
+}
+
+func (p *plugin) jsDeleteTemplate(collection *core.Collection) (string, error) {
+	// unset timestamp fields
+	collectionData, err := toMap(collection)
+	if err != nil {
+		return "", err
+	}
+	delete(collectionData, "created")
+	delete(collectionData, "updated")
+	deleteNestedMapKey(collectionData, "oauth2", "providers")
+
+	jsonData, err := marhshalWithoutEscape(collectionData, "  ", "  ")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = jsTypesDirective + `migrate((app) => {
+  const collection = app.findCollectionByNameOrId(%q);
+
+  return app.delete(collection);
+}, (app) => {
+  const collection = new Collection(%s);
+
+  return app.save(collection);
+})
+`
+
+	return fmt.Sprintf(template, collection.Id, string(jsonData)), nil
+}
+
+func (p *plugin) jsDiffTemplate(new *core.Collection, old *core.Collection) (string, error) {
+	if new == nil && old == nil {
+		return "", errors.New("the diff template require at least one of the collection to be non-nil")
+	}
+
+	if new == nil {
+		return p.jsDeleteTemplate(old)
+	}
+
+	if old == nil {
+		return p.jsCreateTemplate(new)
+	}
+
+	upParts := []string{}
+	downParts := []string{}
+	varName := "collection"
+
+	newMap, err := toMap(new)
+	if err != nil {
+		return "", err
+	}
+
+	oldMap, err := toMap(old)
+	if err != nil {
+		return "", err
+	}
+
+	// non-fields
+	// -----------------------------------------------------------------
+
+	upDiff := diffMaps(oldMap, newMap, "fields", "created", "updated")
+	if len(upDiff) > 0 {
+		downDiff := diffMaps(newMap, oldMap, "fields", "created", "updated")
+
+		rawUpDiff, err := marhshalWithoutEscape(upDiff, "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		rawDownDiff, err := marhshalWithoutEscape(downDiff, "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		upParts = append(upParts, "// update collection data")
+		upParts = append(upParts, fmt.Sprintf("unmarshal(%s, %s)", string(rawUpDiff), varName)+"\n")
+		// ---
+		downParts = append(downParts, "// update collection data")
+		downParts = append(downParts, fmt.Sprintf("unmarshal(%s, %s)", string(rawDownDiff), varName)+"\n")
+	}
+
+	// fields
+	// -----------------------------------------------------------------
+
+	oldFieldsSlice, ok := oldMap["fields"].([]any)
+	if !ok {
+		return "", errors.New(`oldMap["fields"] is not []any`)
+	}
+
+	newFieldsSlice, ok := newMap["fields"].([]any)
+	if !ok {
+		return "", errors.New(`newMap["fields"] is not []any`)
+	}
+
+	// deleted fields
+	for i, oldField := range old.Fields {
+		if new.Fields.GetById(oldField.GetId()) != nil {
+			continue // exist
+		}
+
+		rawOldField, err := marhshalWithoutEscape(oldFieldsSlice[i], "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		upParts = append(upParts, "// remove field")
+		upParts = append(upParts, fmt.Sprintf("%s.fields.removeById(%q)\n", varName, oldField.GetId()))
+
+		downParts = append(downParts, "// add field")
+		downParts = append(downParts, fmt.Sprintf("%s.fields.addAt(%d, new Field(%s))\n", varName, i, rawOldField))
+	}
+
+	// created fields
+	for i, newField := range new.Fields {
+		if old.Fields.GetById(newField.GetId()) != nil {
+			continue // exist
+		}
+
+		rawNewField, err := marhshalWithoutEscape(newFieldsSlice[i], "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		upParts = append(upParts, "// add field")
+		upParts = append(upParts, fmt.Sprintf("%s.fields.addAt(%d, new Field(%s))\n", varName, i, rawNewField))
+
+		downParts = append(downParts, "// remove field")
+		downParts = append(downParts, fmt.Sprintf("%s.fields.removeById(%q)\n", varName, newField.GetId()))
+	}
+
+	// modified fields
+	// (note currently ignoring order-only changes as it comes with too many edge-cases)
+	for i, newField := range new.Fields {
+		var rawNewField, rawOldField []byte
+
+		rawNewField, err = marhshalWithoutEscape(newFieldsSlice[i], "  ", "  ")
+		if err != nil {
+			return "", err
+		}
+
+		var oldFieldIndex int
+
+		for j, oldField := range old.Fields {
+			if oldField.GetId() == newField.GetId() {
+				rawOldField, err = marhshalWithoutEscape(oldFieldsSlice[j], "  ", "  ")
+				if err != nil {
+					return "", err
+				}
+				oldFieldIndex = j
+				break
+			}
+		}
+
+		if rawOldField == nil || bytes.Equal(rawNewField, rawOldField) {
+			continue // new field or no change
+		}
+
+		upParts = append(upParts, "// update field")
+		upParts = append(upParts, fmt.Sprintf("%s.fields.addAt(%d, new Field(%s))\n", varName, i, rawNewField))
+
+		downParts = append(downParts, "// update field")
+		downParts = append(downParts, fmt.Sprintf("%s.fields.addAt(%d, new Field(%s))\n", varName, oldFieldIndex, rawOldField))
+	}
+
+	// -----------------------------------------------------------------
+
+	if len(upParts) == 0 && len(downParts) == 0 {
+		return "", ErrEmptyTemplate
+	}
+
+	up := strings.Join(upParts, "\n  ")
+	down := strings.Join(downParts, "\n  ")
+
+	const template = jsTypesDirective + `migrate((app) => {
+  const collection = app.findCollectionByNameOrId(%q)
+
+  %s
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId(%q)
+
+  %s
+
+  return app.save(collection)
+})
+`
+
+	return fmt.Sprintf(
+		template,
+		old.Id, strings.TrimSpace(up),
+		new.Id, strings.TrimSpace(down),
+	), nil
+}
+
+// -------------------------------------------------------------------
+// Go templates
+// -------------------------------------------------------------------
+
+func (p *plugin) goBlankTemplate() (string, error) {
+	const template = `package %s
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		// add up queries...
+
+		return nil
+	}, func(app core.App) error {
+		// add down queries...
+
+		return nil
+	})
+}
+`
+
+	return fmt.Sprintf(template, filepath.Base(p.config.Dir)), nil
+}
+
+func (p *plugin) goSnapshotTemplate(collections []*core.Collection) (string, error) {
+	// unset timestamp fields
+	var collectionsData = make([]map[string]any, len(collections))
+	for i, c := range collections {
+		data, err := toMap(c)
+		if err != nil {
+			return "", fmt.Errorf("failed to serialize %q into a map: %w", c.Name, err)
+		}
+		delete(data, "created")
+		delete(data, "updated")
+		deleteNestedMapKey(data, "oauth2", "providers")
+		collectionsData[i] = data
+	}
+
+	jsonData, err := marhshalWithoutEscape(collectionsData, "\t\t", "\t")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `package %s
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		jsonData := ` + "`%s`" + `
+
+		return app.ImportCollectionsByMarshaledJSON([]byte(jsonData), false)
+	}, func(app core.App) error {
+		return nil
+	})
+}
+`
+	return fmt.Sprintf(
+		template,
+		filepath.Base(p.config.Dir),
+		escapeBacktick(string(jsonData)),
+	), nil
+}
+
+func (p *plugin) goCreateTemplate(collection *core.Collection) (string, error) {
+	// unset timestamp fields
+	collectionData, err := toMap(collection)
+	if err != nil {
+		return "", err
+	}
+	delete(collectionData, "created")
+	delete(collectionData, "updated")
+	deleteNestedMapKey(collectionData, "oauth2", "providers")
+
+	jsonData, err := marhshalWithoutEscape(collectionData, "\t\t", "\t")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `package %s
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		jsonData := ` + "`%s`" + `
+
+		collection := &core.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collection); err != nil {
+			return err
+		}
+
+		return app.Save(collection)
+	}, func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId(%q)
+		if err != nil {
+			return err
+		}
+
+		return app.Delete(collection)
+	})
+}
+`
+
+	return fmt.Sprintf(
+		template,
+		filepath.Base(p.config.Dir),
+		escapeBacktick(string(jsonData)),
+		collection.Id,
+	), nil
+}
+
+func (p *plugin) goDeleteTemplate(collection *core.Collection) (string, error) {
+	// unset timestamp fields
+	collectionData, err := toMap(collection)
+	if err != nil {
+		return "", err
+	}
+	delete(collectionData, "created")
+	delete(collectionData, "updated")
+	deleteNestedMapKey(collectionData, "oauth2", "providers")
+
+	jsonData, err := marhshalWithoutEscape(collectionData, "\t\t", "\t")
+	if err != nil {
+		return "", fmt.Errorf("failed to serialize collections list: %w", err)
+	}
+
+	const template = `package %s
+
+import (
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId(%q)
+		if err != nil {
+			return err
+		}
+
+		return app.Delete(collection)
+	}, func(app core.App) error {
+		jsonData := ` + "`%s`" + `
+
+		collection := &core.Collection{}
+		if err := json.Unmarshal([]byte(jsonData), &collection); err != nil {
+			return err
+		}
+
+		return app.Save(collection)
+	})
+}
+`
+
+	return fmt.Sprintf(
+		template,
+		filepath.Base(p.config.Dir),
+		collection.Id,
+		escapeBacktick(string(jsonData)),
+	), nil
+}
+
+func (p *plugin) goDiffTemplate(new *core.Collection, old *core.Collection) (string, error) {
+	if new == nil && old == nil {
+		return "", errors.New("the diff template require at least one of the collection to be non-nil")
+	}
+
+	if new == nil {
+		return p.goDeleteTemplate(old)
+	}
+
+	if old == nil {
+		return p.goCreateTemplate(new)
+	}
+
+	upParts := []string{}
+	downParts := []string{}
+	varName := "collection"
+
+	newMap, err := toMap(new)
+	if err != nil {
+		return "", err
+	}
+
+	oldMap, err := toMap(old)
+	if err != nil {
+		return "", err
+	}
+
+	// non-fields
+	// -----------------------------------------------------------------
+
+	upDiff := diffMaps(oldMap, newMap, "fields", "created", "updated")
+	if len(upDiff) > 0 {
+		downDiff := diffMaps(newMap, oldMap, "fields", "created", "updated")
+
+		rawUpDiff, err := marhshalWithoutEscape(upDiff, "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		rawDownDiff, err := marhshalWithoutEscape(downDiff, "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		upParts = append(upParts, "// update collection data")
+		upParts = append(upParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), &%s)", escapeBacktick(string(rawUpDiff)), varName)))
+		// ---
+		downParts = append(downParts, "// update collection data")
+		downParts = append(downParts, goErrIf(fmt.Sprintf("json.Unmarshal([]byte(`%s`), &%s)", escapeBacktick(string(rawDownDiff)), varName)))
+	}
+
+	// fields
+	// -----------------------------------------------------------------
+
+	oldFieldsSlice, ok := oldMap["fields"].([]any)
+	if !ok {
+		return "", errors.New(`oldMap["fields"] is not []any`)
+	}
+
+	newFieldsSlice, ok := newMap["fields"].([]any)
+	if !ok {
+		return "", errors.New(`newMap["fields"] is not []any`)
+	}
+
+	// deleted fields
+	for i, oldField := range old.Fields {
+		if new.Fields.GetById(oldField.GetId()) != nil {
+			continue // exist
+		}
+
+		rawOldField, err := marhshalWithoutEscape(oldFieldsSlice[i], "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		upParts = append(upParts, "// remove field")
+		upParts = append(upParts, fmt.Sprintf("%s.Fields.RemoveById(%q)\n", varName, oldField.GetId()))
+
+		downParts = append(downParts, "// add field")
+		downParts = append(downParts, goErrIf(fmt.Sprintf("%s.Fields.AddMarshaledJSONAt(%d, []byte(`%s`))", varName, i, escapeBacktick(string(rawOldField)))))
+	}
+
+	// created fields
+	for i, newField := range new.Fields {
+		if old.Fields.GetById(newField.GetId()) != nil {
+			continue // exist
+		}
+
+		rawNewField, err := marhshalWithoutEscape(newFieldsSlice[i], "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		upParts = append(upParts, "// add field")
+		upParts = append(upParts, goErrIf(fmt.Sprintf("%s.Fields.AddMarshaledJSONAt(%d, []byte(`%s`))", varName, i, escapeBacktick(string(rawNewField)))))
+
+		downParts = append(downParts, "// remove field")
+		downParts = append(downParts, fmt.Sprintf("%s.Fields.RemoveById(%q)\n", varName, newField.GetId()))
+	}
+
+	// modified fields
+	// (note currently ignoring order-only changes as it comes with too many edge-cases)
+	for i, newField := range new.Fields {
+		var rawNewField, rawOldField []byte
+
+		rawNewField, err = marhshalWithoutEscape(newFieldsSlice[i], "\t\t", "\t")
+		if err != nil {
+			return "", err
+		}
+
+		var oldFieldIndex int
+
+		for j, oldField := range old.Fields {
+			if oldField.GetId() == newField.GetId() {
+				rawOldField, err = marhshalWithoutEscape(oldFieldsSlice[j], "\t\t", "\t")
+				if err != nil {
+					return "", err
+				}
+				oldFieldIndex = j
+				break
+			}
+		}
+
+		if rawOldField == nil || bytes.Equal(rawNewField, rawOldField) {
+			continue // new field or no change
+		}
+
+		upParts = append(upParts, "// update field")
+		upParts = append(upParts, goErrIf(fmt.Sprintf("%s.Fields.AddMarshaledJSONAt(%d, []byte(`%s`))", varName, i, escapeBacktick(string(rawNewField)))))
+
+		downParts = append(downParts, "// update field")
+		downParts = append(downParts, goErrIf(fmt.Sprintf("%s.Fields.AddMarshaledJSONAt(%d, []byte(`%s`))", varName, oldFieldIndex, escapeBacktick(string(rawOldField)))))
+	}
+
+	// ---------------------------------------------------------------
+
+	if len(upParts) == 0 && len(downParts) == 0 {
+		return "", ErrEmptyTemplate
+	}
+
+	up := strings.Join(upParts, "\n\t\t")
+	down := strings.Join(downParts, "\n\t\t")
+	combined := up + down
+
+	// generate imports
+	// ---
+	var imports string
+
+	if strings.Contains(combined, "json.Unmarshal(") ||
+		strings.Contains(combined, "json.Marshal(") {
+		imports += "\n\t\"encoding/json\"\n"
+	}
+
+	imports += "\n\t\"github.com/pocketbase/pocketbase/core\""
+	imports += "\n\tm \"github.com/pocketbase/pocketbase/migrations\""
+	// ---
+
+	const template = `package %s
+
+import (%s
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId(%q)
+		if err != nil {
+			return err
+		}
+
+		%s
+
+		return app.Save(collection)
+	}, func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId(%q)
+		if err != nil {
+			return err
+		}
+
+		%s
+
+		return app.Save(collection)
+	})
+}
+`
+
+	return fmt.Sprintf(
+		template,
+		filepath.Base(p.config.Dir),
+		imports,
+		old.Id, strings.TrimSpace(up),
+		new.Id, strings.TrimSpace(down),
+	), nil
+}
+
+func marhshalWithoutEscape(v any, prefix string, indent string) ([]byte, error) {
+	raw, err := json.MarshalIndent(v, prefix, indent)
+	if err != nil {
+		return nil, err
+	}
+
+	// unescape escaped unicode characters
+	unescaped, err := strconv.Unquote(strings.ReplaceAll(strconv.Quote(string(raw)), `\\u`, `\u`))
+	if err != nil {
+		return nil, err
+	}
+
+	return []byte(unescaped), nil
+}
+
+func escapeBacktick(v string) string {
+	return strings.ReplaceAll(v, "`", "` + \"`\" + `")
+}
+
+func goErrIf(v string) string {
+	return "if err := " + v + "; err != nil {\n\t\t\treturn err\n\t\t}\n"
+}
+
+func toMap(v any) (map[string]any, error) {
+	raw, err := json.Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+
+	result := map[string]any{}
+
+	err = json.Unmarshal(raw, &result)
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+func diffMaps(old, new map[string]any, excludeKeys ...string) map[string]any {
+	diff := map[string]any{}
+
+	for k, vNew := range new {
+		if slices.Contains(excludeKeys, k) {
+			continue
+		}
+
+		vOld, ok := old[k]
+		if !ok {
+			// new field
+			diff[k] = vNew
+			continue
+		}
+
+		// compare the serialized version of the values in case of slice or other custom type
+		rawOld, _ := json.Marshal(vOld)
+		rawNew, _ := json.Marshal(vNew)
+
+		if !bytes.Equal(rawOld, rawNew) {
+			// if both are maps add recursively only the changed fields
+			vOldMap, ok1 := vOld.(map[string]any)
+			vNewMap, ok2 := vNew.(map[string]any)
+			if ok1 && ok2 {
+				subDiff := diffMaps(vOldMap, vNewMap)
+				if len(subDiff) > 0 {
+					diff[k] = subDiff
+				}
+			} else {
+				diff[k] = vNew
+			}
+		}
+	}
+
+	// unset missing fields
+	for k := range old {
+		if _, ok := diff[k]; ok || slices.Contains(excludeKeys, k) {
+			continue // already added
+		}
+
+		if _, ok := new[k]; !ok {
+			diff[k] = nil
+		}
+	}
+
+	return diff
+}
+
+func deleteNestedMapKey(data map[string]any, parts ...string) {
+	if len(parts) == 0 {
+		return
+	}
+
+	if len(parts) == 1 {
+		delete(data, parts[0])
+		return
+	}
+
+	v, ok := data[parts[0]].(map[string]any)
+	if ok {
+		deleteNestedMapKey(v, parts[1:]...)
+	}
+}
diff --git a/server/core_backend-server/pocketbase.go b/server/core_backend-server/pocketbase.go
new file mode 100644
index 0000000..4f18776
--- /dev/null
+++ b/server/core_backend-server/pocketbase.go
@@ -0,0 +1,405 @@
+package pocketbase
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/pocketbase/pocketbase/cmd"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"github.com/pocketbase/pocketbase/tools/routine"
+	"github.com/spf13/cobra"
+
+	_ "github.com/pocketbase/pocketbase/migrations"
+)
+
+var _ core.App = (*PocketBase)(nil)
+
+// Version of PocketBase
+var Version = "(untracked)"
+
+// PocketBase defines a PocketBase app launcher.
+//
+// It implements [core.App] via embedding and all of the app interface methods
+// could be accessed directly through the instance (eg. PocketBase.DataDir()).
+type PocketBase struct {
+	core.App
+
+	devFlag            bool
+	dataDirFlag        string
+	postgresUrlFlag    string
+	postgresDataDBFlag string
+	postgresAuxDBFlag  string
+	realtimeBridgeFlag bool
+	encryptionEnvFlag  string
+	queryTimeout       int
+	hideStartBanner    bool
+	hideAdminUI        bool
+
+	// RootCmd is the main console command
+	RootCmd *cobra.Command
+}
+
+// Config is the PocketBase initialization config struct.
+type Config struct {
+	// hide the default console server info on app startup
+	HideStartBanner bool
+
+	// optional default values for the console flags
+	DefaultDev            bool
+	DefaultDataDir        string // if not set, it will fallback to "./pb_data"
+	DefaultPostgresURL    string // if not set, it will fallback to "postgres://user:pass@127.0.0.1:6432/postgres?sslmode=disable"
+	DefaultPostgresDataDb string // if not set, it will fallback to "pb-data"
+	DefaultPostgresAuxDb  string // if not set, it will fallback to "pb-auxiliary"
+	DefaultRealtimeBridge *bool  // if not set, it will fallback to the `true`
+	DefaultEncryptionEnv  string
+	DefaultQueryTimeout   time.Duration // default to core.DefaultQueryTimeout (in seconds)
+
+	// hide the admin UI dashboard
+	HideAdminUI bool
+
+	// optional DB configurations
+	DataMaxOpenConns int                // default to core.DefaultDataMaxOpenConns
+	DataMaxIdleConns int                // default to core.DefaultDataMaxIdleConns
+	AuxMaxOpenConns  int                // default to core.DefaultAuxMaxOpenConns
+	AuxMaxIdleConns  int                // default to core.DefaultAuxMaxIdleConns
+	DBConnect        core.DBConnectFunc // default to core.dbConnect
+}
+
+// New creates a new PocketBase instance with the default configuration.
+// Use [NewWithConfig] if you want to provide a custom configuration.
+//
+// Note that the application will not be initialized/bootstrapped yet,
+// aka. DB connections, migrations, app settings, etc. will not be accessible.
+// Everything will be initialized when [PocketBase.Start] is executed.
+// If you want to initialize the application before calling [PocketBase.Start],
+// then you'll have to manually call [PocketBase.Bootstrap].
+func New() *PocketBase {
+	_, isUsingGoRun := inspectRuntime()
+
+	return NewWithConfig(Config{
+		DefaultDev: isUsingGoRun,
+	})
+}
+
+// NewWithConfig creates a new PocketBase instance with the provided config.
+//
+// Note that the application will not be initialized/bootstrapped yet,
+// aka. DB connections, migrations, app settings, etc. will not be accessible.
+// Everything will be initialized when [PocketBase.Start] is executed.
+// If you want to initialize the application before calling [PocketBase.Start],
+// then you'll have to manually call [PocketBase.Bootstrap].
+func NewWithConfig(config Config) *PocketBase {
+	// initialize a default data directory based on the executable baseDir
+	if config.DefaultDataDir == "" {
+		if config.DefaultDataDir = os.Getenv("PB_DATA_DIR"); config.DefaultDataDir == "" {
+			baseDir, _ := inspectRuntime()
+			config.DefaultDataDir = filepath.Join(baseDir, "pb_data")
+		}
+	}
+	if config.DefaultPostgresURL == "" {
+		config.DefaultPostgresURL = os.Getenv("POSTGRES_URL")
+	}
+	if config.DefaultPostgresDataDb == "" {
+		config.DefaultPostgresDataDb = os.Getenv("POSTGRES_DATA_DB")
+	}
+	if config.DefaultPostgresAuxDb == "" {
+		config.DefaultPostgresAuxDb = os.Getenv("POSTGRES_AUX_DB")
+	}
+	if config.DefaultRealtimeBridge == nil {
+		if enable, err := strconv.ParseBool(os.Getenv("PB_REALTIME_BRIDGE")); err == nil {
+			config.DefaultRealtimeBridge = &enable
+		} else {
+			enable = true
+			config.DefaultRealtimeBridge = &enable
+		}
+	}
+
+	if os.Getenv("PB_ADMIN_UI_ENABLED") == "false" {
+		config.HideAdminUI = true
+	}
+
+	if config.DefaultQueryTimeout == 0 {
+		config.DefaultQueryTimeout = core.DefaultQueryTimeout
+	}
+
+	executableName := filepath.Base(os.Args[0])
+
+	pb := &PocketBase{
+		RootCmd: &cobra.Command{
+			Use:     executableName,
+			Short:   executableName + " CLI",
+			Version: Version,
+			FParseErrWhitelist: cobra.FParseErrWhitelist{
+				UnknownFlags: true,
+			},
+			// no need to provide the default cobra completion command
+			CompletionOptions: cobra.CompletionOptions{
+				DisableDefaultCmd: true,
+			},
+		},
+		devFlag:            config.DefaultDev,
+		dataDirFlag:        config.DefaultDataDir,
+		postgresUrlFlag:    config.DefaultPostgresURL,
+		postgresDataDBFlag: config.DefaultPostgresDataDb,
+		postgresAuxDBFlag:  config.DefaultPostgresAuxDb,
+		realtimeBridgeFlag: *config.DefaultRealtimeBridge,
+		encryptionEnvFlag:  config.DefaultEncryptionEnv,
+		hideStartBanner:    config.HideStartBanner,
+		hideAdminUI:        config.HideAdminUI,
+	}
+
+	// replace with a colored stderr writer
+	pb.RootCmd.SetErr(newErrWriter())
+
+	// parse base flags
+	// (errors are ignored, since the full flags parsing happens on Execute())
+	pb.eagerParseFlags(&config)
+
+	// initialize the app instance
+	pb.App = core.NewBaseApp(core.BaseAppConfig{
+		IsDev:            pb.devFlag,
+		DataDir:          pb.dataDirFlag,
+		PostgresURL:      pb.postgresUrlFlag,
+		PostgresDataDB:   pb.postgresDataDBFlag,
+		PostgresAuxDB:    pb.postgresAuxDBFlag,
+		IsRealtimeBridge: pb.realtimeBridgeFlag,
+		EncryptionEnv:    pb.encryptionEnvFlag,
+		QueryTimeout:     time.Duration(pb.queryTimeout) * time.Second,
+		DataMaxOpenConns: config.DataMaxOpenConns,
+		DataMaxIdleConns: config.DataMaxIdleConns,
+		AuxMaxOpenConns:  config.AuxMaxOpenConns,
+		AuxMaxIdleConns:  config.AuxMaxIdleConns,
+		DBConnect:        config.DBConnect,
+	})
+
+	// hide the default help command (allow only `--help` flag)
+	pb.RootCmd.SetHelpCommand(&cobra.Command{Hidden: true})
+
+	// https://github.com/pocketbase/pocketbase/issues/6136
+	pb.OnBootstrap().Bind(&hook.Handler[*core.BootstrapEvent]{
+		Id: ModerncDepsCheckHookId,
+		Func: func(be *core.BootstrapEvent) error {
+			if err := be.Next(); err != nil {
+				return err
+			}
+
+			// run separately to avoid blocking
+			app := be.App
+			routine.FireAndForget(func() {
+				checkModerncDeps(app)
+			})
+
+			return nil
+		},
+	})
+
+	return pb
+}
+
+// Start starts the application, aka. registers the default system
+// commands (serve, superuser, version) and executes pb.RootCmd.
+func (pb *PocketBase) Start() error {
+	// register system commands
+	pb.RootCmd.AddCommand(cmd.NewSuperuserCommand(pb))
+	pb.RootCmd.AddCommand(cmd.NewServeCommand(pb, !pb.hideStartBanner, pb.hideAdminUI))
+
+	return pb.Execute()
+}
+
+// Execute initializes the application (if not already) and executes
+// the pb.RootCmd with graceful shutdown support.
+//
+// This method differs from pb.Start() by not registering the default
+// system commands!
+func (pb *PocketBase) Execute() error {
+	if !pb.skipBootstrap() {
+		if err := pb.Bootstrap(); err != nil {
+			return err
+		}
+	}
+
+	done := make(chan bool, 1)
+
+	// listen for interrupt signal to gracefully shutdown the application
+	go func() {
+		sigch := make(chan os.Signal, 1)
+		signal.Notify(sigch, os.Interrupt, syscall.SIGTERM)
+		<-sigch
+
+		done <- true
+	}()
+
+	// execute the root command
+	go func() {
+		// note: leave to the commands to decide whether to print their error
+		pb.RootCmd.Execute()
+
+		done <- true
+	}()
+
+	<-done
+
+	// trigger cleanups
+	//
+	// @todo consider skipping and just call the finalizer in case OnTerminate was already invoked manually?
+	event := new(core.TerminateEvent)
+	event.App = pb
+	return pb.OnTerminate().Trigger(event, func(e *core.TerminateEvent) error {
+		return e.App.ResetBootstrapState()
+	})
+}
+
+// eagerParseFlags parses the global app flags before calling pb.RootCmd.Execute().
+// so we can have all PocketBase flags ready for use on initialization.
+func (pb *PocketBase) eagerParseFlags(config *Config) error {
+	pb.RootCmd.PersistentFlags().StringVar(
+		&pb.dataDirFlag,
+		"dir",
+		config.DefaultDataDir,
+		"the PocketBase data directory",
+	)
+
+	pb.RootCmd.PersistentFlags().StringVar(
+		&pb.postgresUrlFlag,
+		"postgresUrl",
+		config.DefaultPostgresURL,
+		"the Postgres connection string (if not set, it will fallback to the POSTGRES_URL env variable)",
+	)
+
+	pb.RootCmd.PersistentFlags().StringVar(
+		&pb.postgresDataDBFlag,
+		"postgresDataDB",
+		config.DefaultPostgresDataDb,
+		"the PocketBase `data` database name (if not set, it will fallback to the POSTGRES_DATA_DB env variable)",
+	)
+
+	pb.RootCmd.PersistentFlags().StringVar(
+		&pb.postgresAuxDBFlag,
+		"postgresAuxDB",
+		config.DefaultPostgresAuxDb,
+		"the PocketBase `auxiliary` database name (if not set, it will fallback to the POSTGRES_AUX_DB env variable)",
+	)
+
+	pb.RootCmd.PersistentFlags().StringVar(
+		&pb.encryptionEnvFlag,
+		"encryptionEnv",
+		config.DefaultEncryptionEnv,
+		"the env variable whose value of 32 characters will be used \nas encryption key for the app settings (default none)",
+	)
+
+	pb.RootCmd.PersistentFlags().BoolVar(
+		&pb.devFlag,
+		"dev",
+		config.DefaultDev,
+		"enable dev mode, aka. printing logs and sql statements to the console",
+	)
+
+	pb.RootCmd.PersistentFlags().IntVar(
+		&pb.queryTimeout,
+		"queryTimeout",
+		int(config.DefaultQueryTimeout.Seconds()),
+		"the default SELECT queries timeout in seconds",
+	)
+
+	pb.RootCmd.PersistentFlags().BoolVar(
+		&pb.realtimeBridgeFlag,
+		"realtimeBridge",
+		*config.DefaultRealtimeBridge,
+		fmt.Sprintf("enable/disable the realtime bridge (default %v). You must not disable this flag if you plan horizontally scale your app.", *config.DefaultRealtimeBridge),
+	)
+
+	return pb.RootCmd.ParseFlags(os.Args[1:])
+}
+
+// skipBootstrap eagerly checks if the app should skip the bootstrap process:
+// - already bootstrapped
+// - is unknown command
+// - is the default help command
+// - is the default version command
+//
+// https://github.com/pocketbase/pocketbase/issues/404
+// https://github.com/pocketbase/pocketbase/discussions/1267
+func (pb *PocketBase) skipBootstrap() bool {
+	flags := []string{
+		"-h",
+		"--help",
+		"-v",
+		"--version",
+	}
+
+	if pb.IsBootstrapped() {
+		return true // already bootstrapped
+	}
+
+	cmd, _, err := pb.RootCmd.Find(os.Args[1:])
+	if err != nil {
+		return true // unknown command
+	}
+
+	for _, arg := range os.Args {
+		if !list.ExistInSlice(arg, flags) {
+			continue
+		}
+
+		// ensure that there is no user defined flag with the same name/shorthand
+		trimmed := strings.TrimLeft(arg, "-")
+		if len(trimmed) > 1 && cmd.Flags().Lookup(trimmed) == nil {
+			return true
+		}
+		if len(trimmed) == 1 && cmd.Flags().ShorthandLookup(trimmed) == nil {
+			return true
+		}
+	}
+
+	return false
+}
+
+// inspectRuntime tries to find the base executable directory and how it was run.
+//
+// note: we are using os.Args[0] and not os.Executable() since it could
+// break existing aliased binaries (eg. the community maintained homebrew package)
+func inspectRuntime() (baseDir string, withGoRun bool) {
+	if osutils.IsProbablyGoRun() {
+		// probably ran with go run
+		withGoRun = true
+		baseDir, _ = os.Getwd()
+	} else {
+		// probably ran with go build
+		withGoRun = false
+		baseDir = filepath.Dir(os.Args[0])
+	}
+	return
+}
+
+// newErrWriter returns a red colored stderr writter.
+func newErrWriter() *coloredWriter {
+	return &coloredWriter{
+		w: os.Stderr,
+		c: color.New(color.FgRed),
+	}
+}
+
+// coloredWriter is a small wrapper struct to construct a [color.Color] writter.
+type coloredWriter struct {
+	w io.Writer
+	c *color.Color
+}
+
+// Write writes the p bytes using the colored writer.
+func (colored *coloredWriter) Write(p []byte) (n int, err error) {
+	colored.c.SetWriter(colored.w)
+	defer colored.c.UnsetWriter(colored.w)
+
+	return colored.c.Print(string(p))
+}
diff --git a/server/core_backend-server/pocketbase_test.go b/server/core_backend-server/pocketbase_test.go
new file mode 100644
index 0000000..101883e
--- /dev/null
+++ b/server/core_backend-server/pocketbase_test.go
@@ -0,0 +1,210 @@
+package pocketbase
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+func TestNew(t *testing.T) {
+	// copy os.Args
+	originalArgs := make([]string, len(os.Args))
+	copy(originalArgs, os.Args)
+	defer func() {
+		// restore os.Args
+		os.Args = originalArgs
+	}()
+
+	// change os.Args
+	os.Args = os.Args[:1]
+	os.Args = append(
+		os.Args,
+		"--dir=test_dir",
+		"--encryptionEnv=test_encryption_env",
+		"--debug=true",
+	)
+
+	app := New()
+
+	if app == nil {
+		t.Fatal("Expected initialized PocketBase instance, got nil")
+	}
+
+	if app.RootCmd == nil {
+		t.Fatal("Expected RootCmd to be initialized, got nil")
+	}
+
+	if app.App == nil {
+		t.Fatal("Expected App to be initialized, got nil")
+	}
+
+	if app.DataDir() != "test_dir" {
+		t.Fatalf("Expected app.DataDir() %q, got %q", "test_dir", app.DataDir())
+	}
+
+	if app.EncryptionEnv() != "test_encryption_env" {
+		t.Fatalf("Expected app.EncryptionEnv() test_encryption_env, got %q", app.EncryptionEnv())
+	}
+}
+
+func TestNewWithConfig(t *testing.T) {
+	app := NewWithConfig(Config{
+		DefaultDataDir:       "test_dir",
+		DefaultEncryptionEnv: "test_encryption_env",
+		HideStartBanner:      true,
+	})
+
+	if app == nil {
+		t.Fatal("Expected initialized PocketBase instance, got nil")
+	}
+
+	if app.RootCmd == nil {
+		t.Fatal("Expected RootCmd to be initialized, got nil")
+	}
+
+	if app.App == nil {
+		t.Fatal("Expected App to be initialized, got nil")
+	}
+
+	if app.hideStartBanner != true {
+		t.Fatal("Expected app.hideStartBanner to be true, got false")
+	}
+
+	if app.DataDir() != "test_dir" {
+		t.Fatalf("Expected app.DataDir() %q, got %q", "test_dir", app.DataDir())
+	}
+
+	if app.EncryptionEnv() != "test_encryption_env" {
+		t.Fatalf("Expected app.EncryptionEnv() %q, got %q", "test_encryption_env", app.EncryptionEnv())
+	}
+}
+
+func TestNewWithConfigAndFlags(t *testing.T) {
+	// copy os.Args
+	originalArgs := make([]string, len(os.Args))
+	copy(originalArgs, os.Args)
+	defer func() {
+		// restore os.Args
+		os.Args = originalArgs
+	}()
+
+	// change os.Args
+	os.Args = os.Args[:1]
+	os.Args = append(
+		os.Args,
+		"--dir=test_dir_flag",
+		"--encryptionEnv=test_encryption_env_flag",
+		"--debug=false",
+	)
+
+	app := NewWithConfig(Config{
+		DefaultDataDir:       "test_dir",
+		DefaultEncryptionEnv: "test_encryption_env",
+		HideStartBanner:      true,
+	})
+
+	if app == nil {
+		t.Fatal("Expected initialized PocketBase instance, got nil")
+	}
+
+	if app.RootCmd == nil {
+		t.Fatal("Expected RootCmd to be initialized, got nil")
+	}
+
+	if app.App == nil {
+		t.Fatal("Expected App to be initialized, got nil")
+	}
+
+	if app.hideStartBanner != true {
+		t.Fatal("Expected app.hideStartBanner to be true, got false")
+	}
+
+	if app.DataDir() != "test_dir_flag" {
+		t.Fatalf("Expected app.DataDir() %q, got %q", "test_dir_flag", app.DataDir())
+	}
+
+	if app.EncryptionEnv() != "test_encryption_env_flag" {
+		t.Fatalf("Expected app.EncryptionEnv() %q, got %q", "test_encryption_env_flag", app.EncryptionEnv())
+	}
+}
+
+func TestSkipBootstrap(t *testing.T) {
+	// copy os.Args
+	originalArgs := make([]string, len(os.Args))
+	copy(originalArgs, os.Args)
+	defer func() {
+		// restore os.Args
+		os.Args = originalArgs
+	}()
+
+	tempDir := filepath.Join(os.TempDir(), "temp_pb_data")
+	defer os.RemoveAll(tempDir)
+
+	// already bootstrapped
+	app0 := NewWithConfig(Config{DefaultDataDir: tempDir})
+	app0.Bootstrap()
+	if v := app0.skipBootstrap(); !v {
+		t.Fatal("[bootstrapped] Expected true, got false")
+	}
+
+	// unknown command
+	os.Args = os.Args[:1]
+	os.Args = append(os.Args, "demo")
+	app1 := NewWithConfig(Config{DefaultDataDir: tempDir})
+	app1.RootCmd.AddCommand(&cobra.Command{Use: "test"})
+	if v := app1.skipBootstrap(); !v {
+		t.Fatal("[unknown] Expected true, got false")
+	}
+
+	// default flags
+	flagScenarios := []struct {
+		name  string
+		short string
+	}{
+		{"help", "h"},
+		{"version", "v"},
+	}
+
+	for _, s := range flagScenarios {
+		// base flag
+		os.Args = os.Args[:1]
+		os.Args = append(os.Args, "--"+s.name)
+		app1 := NewWithConfig(Config{DefaultDataDir: tempDir})
+		if v := app1.skipBootstrap(); !v {
+			t.Fatalf("[--%s] Expected true, got false", s.name)
+		}
+
+		// short flag
+		os.Args = os.Args[:1]
+		os.Args = append(os.Args, "-"+s.short)
+		app2 := NewWithConfig(Config{DefaultDataDir: tempDir})
+		if v := app2.skipBootstrap(); !v {
+			t.Fatalf("[-%s] Expected true, got false", s.short)
+		}
+
+		customCmd := &cobra.Command{Use: "custom"}
+		customCmd.PersistentFlags().BoolP(s.name, s.short, false, "")
+
+		// base flag in custom command
+		os.Args = os.Args[:1]
+		os.Args = append(os.Args, "custom")
+		os.Args = append(os.Args, "--"+s.name)
+		app3 := NewWithConfig(Config{DefaultDataDir: tempDir})
+		app3.RootCmd.AddCommand(customCmd)
+		if v := app3.skipBootstrap(); v {
+			t.Fatalf("[--%s custom] Expected false, got true", s.name)
+		}
+
+		// short flag in custom command
+		os.Args = os.Args[:1]
+		os.Args = append(os.Args, "custom")
+		os.Args = append(os.Args, "-"+s.short)
+		app4 := NewWithConfig(Config{DefaultDataDir: tempDir})
+		app4.RootCmd.AddCommand(customCmd)
+		if v := app4.skipBootstrap(); v {
+			t.Fatalf("[-%s custom] Expected false, got true", s.short)
+		}
+	}
+}
diff --git a/server/core_backend-server/tests/api.go b/server/core_backend-server/tests/api.go
new file mode 100644
index 0000000..35d2928
--- /dev/null
+++ b/server/core_backend-server/tests/api.go
@@ -0,0 +1,316 @@
+package tests
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+// ApiScenario defines a single api request test case/scenario.
+type ApiScenario struct {
+	// Name is the test name.
+	Name string
+
+	// Method is the HTTP method of the test request to use.
+	Method string
+
+	// URL is the url/path of the endpoint you want to test.
+	URL string
+
+	// Body specifies the body to send with the request.
+	//
+	// For example:
+	//
+	//	strings.NewReader(`{"title":"abc"}`)
+	Body io.Reader
+
+	// Headers specifies the headers to send with the request (e.g. "Authorization": "abc")
+	Headers map[string]string
+
+	// Delay adds a delay before checking the expectations usually
+	// to ensure that all fired non-awaited go routines have finished
+	Delay time.Duration
+
+	// Timeout specifies how long to wait before cancelling the request context.
+	//
+	// A zero or negative value means that there will be no timeout.
+	Timeout time.Duration
+
+	// DisableTestAppCleanup disables the builtin TestApp cleanup at
+	// the end of the ApiScenario execution.
+	//
+	// This option works only when explicit TestAppFactory is specified
+	// and means that the developer is responsible to do the necessary
+	// after test cleanup on their own (e.g. by manually calling testApp.Cleanup()).
+	DisableTestAppCleanup bool
+
+	// expectations
+	// ---------------------------------------------------------------
+
+	// ExpectedStatus specifies the expected response HTTP status code.
+	ExpectedStatus int
+
+	// List of keywords that MUST exist in the response body.
+	//
+	// Either ExpectedContent or NotExpectedContent must be set if the response body is non-empty.
+	// Leave both fields empty if you want to ensure that the response didn't have any body (e.g. 204).
+	ExpectedContent []string
+
+	// List of keywords that MUST NOT exist in the response body.
+	//
+	// Either ExpectedContent or NotExpectedContent must be set if the response body is non-empty.
+	// Leave both fields empty if you want to ensure that the response didn't have any body (e.g. 204).
+	NotExpectedContent []string
+
+	// List of hook events to check whether they were fired or not.
+	//
+	// You can use the wildcard "*" event key if you want to ensure
+	// that no other hook events except those listed have been fired.
+	//
+	// For example:
+	//
+	//	map[string]int{ "*": 0 } // no hook events were fired
+	//	map[string]int{ "*": 0, "EventA": 2 } // no hook events, except EventA were fired
+	//	map[string]int{ "EventA": 2, "EventB": 0 } // ensures that EventA was fired exactly 2 times and EventB exactly 0 times.
+	ExpectedEvents map[string]int
+
+	// test hooks
+	// ---------------------------------------------------------------
+
+	TestAppFactory func(t testing.TB) *TestApp
+	BeforeTestFunc func(t testing.TB, app *TestApp, e *core.ServeEvent)
+	AfterTestFunc  func(t testing.TB, app *TestApp, res *http.Response)
+}
+
+// Test executes the test scenario.
+//
+// Example:
+//
+//	func TestListExample(t *testing.T) {
+//	    scenario := tests.ApiScenario{
+//	        Name:           "list example collection",
+//	        Method:         http.MethodGet,
+//	        URL:            "/api/collections/example/records",
+//	        ExpectedStatus: 200,
+//	        ExpectedContent: []string{
+//	            `"totalItems":3`,
+//	            `"id":"0yxhwia2amd8gec"`,
+//	            `"id":"achvryl401bhse3"`,
+//	            `"id":"llvuca81nly1qls"`,
+//	        },
+//	        ExpectedEvents: map[string]int{
+//	            "OnRecordsListRequest": 1,
+//	            "OnRecordEnrich":       3,
+//	        },
+//	    }
+//
+//	    scenario.Test(t)
+//	}
+func (scenario *ApiScenario) Test(t *testing.T) {
+	t.Run(scenario.normalizedName(), func(t *testing.T) {
+		scenario.test(t)
+	})
+}
+
+// Benchmark benchmarks the test scenario.
+//
+// Example:
+//
+//	func BenchmarkListExample(b *testing.B) {
+//	    scenario := tests.ApiScenario{
+//	        Name:           "list example collection",
+//	        Method:         http.MethodGet,
+//	        URL:            "/api/collections/example/records",
+//	        ExpectedStatus: 200,
+//	        ExpectedContent: []string{
+//	            `"totalItems":3`,
+//	            `"id":"0yxhwia2amd8gec"`,
+//	            `"id":"achvryl401bhse3"`,
+//	            `"id":"llvuca81nly1qls"`,
+//	        },
+//	        ExpectedEvents: map[string]int{
+//	            "OnRecordsListRequest": 1,
+//	            "OnRecordEnrich":       3,
+//	        },
+//	    }
+//
+//	    scenario.Benchmark(b)
+//	}
+func (scenario *ApiScenario) Benchmark(b *testing.B) {
+	b.Run(scenario.normalizedName(), func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			scenario.test(b)
+		}
+	})
+}
+
+func (scenario *ApiScenario) normalizedName() string {
+	var name = scenario.Name
+
+	if name == "" {
+		name = fmt.Sprintf("%s:%s", scenario.Method, scenario.URL)
+	}
+
+	return name
+}
+
+func (scenario *ApiScenario) test(t testing.TB) {
+	var testApp *TestApp
+	if scenario.TestAppFactory != nil {
+		testApp = scenario.TestAppFactory(t)
+		if testApp == nil {
+			t.Fatal("TestAppFactory must return a non-nill app instance")
+		}
+	} else {
+		var testAppErr error
+		testApp, testAppErr = NewTestApp()
+		if testAppErr != nil {
+			t.Fatalf("Failed to initialize the test app instance: %v", testAppErr)
+		}
+	}
+
+	// https://github.com/pocketbase/pocketbase/discussions/7267
+	if scenario.TestAppFactory == nil || !scenario.DisableTestAppCleanup {
+		defer testApp.Cleanup()
+	}
+
+	baseRouter, err := apis.NewRouter(testApp)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// manually trigger the serve event to ensure that custom app routes and middlewares are registered
+	serveEvent := new(core.ServeEvent)
+	serveEvent.App = testApp
+	serveEvent.Router = baseRouter
+
+	serveErr := testApp.OnServe().Trigger(serveEvent, func(e *core.ServeEvent) error {
+		if scenario.BeforeTestFunc != nil {
+			scenario.BeforeTestFunc(t, testApp, e)
+		}
+
+		// reset the event counters in case a hook was triggered from a before func (eg. db save)
+		testApp.ResetEventCalls()
+
+		// add middleware to timeout long-running requests (eg. keep-alive routes)
+		e.Router.Bind(&hook.Handler[*core.RequestEvent]{
+			Func: func(re *core.RequestEvent) error {
+				slowTimer := time.AfterFunc(3*time.Second, func() {
+					t.Logf("[WARN] Long running test %q", scenario.Name)
+				})
+				defer slowTimer.Stop()
+
+				if scenario.Timeout > 0 {
+					ctx, cancelFunc := context.WithTimeout(re.Request.Context(), scenario.Timeout)
+					defer cancelFunc()
+					re.Request = re.Request.Clone(ctx)
+				}
+
+				return re.Next()
+			},
+			Priority: -9999,
+		})
+
+		recorder := httptest.NewRecorder()
+
+		req := httptest.NewRequest(scenario.Method, scenario.URL, scenario.Body)
+
+		// set default header
+		req.Header.Set("content-type", "application/json")
+
+		// set scenario headers
+		for k, v := range scenario.Headers {
+			req.Header.Set(k, v)
+		}
+
+		// execute request
+		mux, err := e.Router.BuildMux()
+		if err != nil {
+			t.Fatalf("Failed to build router mux: %v", err)
+		}
+		mux.ServeHTTP(recorder, req)
+
+		res := recorder.Result()
+
+		if res.StatusCode != scenario.ExpectedStatus {
+			t.Errorf("Expected status code %d, got %d", scenario.ExpectedStatus, res.StatusCode)
+		}
+
+		if scenario.Delay > 0 {
+			time.Sleep(scenario.Delay)
+		}
+
+		if len(scenario.ExpectedContent) == 0 && len(scenario.NotExpectedContent) == 0 {
+			if len(recorder.Body.Bytes()) != 0 {
+				t.Errorf("Expected empty body, got \n%v", recorder.Body.String())
+			}
+		} else {
+			// normalize json response format
+			buffer := new(bytes.Buffer)
+			err := json.Compact(buffer, recorder.Body.Bytes())
+			var normalizedBody string
+			if err != nil {
+				// not a json...
+				normalizedBody = recorder.Body.String()
+			} else {
+				normalizedBody = buffer.String()
+			}
+
+			for _, item := range scenario.ExpectedContent {
+				if !strings.Contains(normalizedBody, item) {
+					t.Errorf("Cannot find %v in response body \n%v", item, normalizedBody)
+					break
+				}
+			}
+
+			for _, item := range scenario.NotExpectedContent {
+				if strings.Contains(normalizedBody, item) {
+					t.Errorf("Didn't expect %v in response body \n%v", item, normalizedBody)
+					break
+				}
+			}
+		}
+
+		remainingEvents := maps.Clone(testApp.EventCalls)
+
+		var noOtherEventsShouldRemain bool
+		for event, expectedNum := range scenario.ExpectedEvents {
+			if event == "*" && expectedNum <= 0 {
+				noOtherEventsShouldRemain = true
+				continue
+			}
+
+			actualNum := remainingEvents[event]
+			if actualNum != expectedNum {
+				t.Errorf("Expected event %s to be called %d, got %d", event, expectedNum, actualNum)
+			}
+
+			delete(remainingEvents, event)
+		}
+
+		if noOtherEventsShouldRemain && len(remainingEvents) > 0 {
+			t.Errorf("Missing expected remaining events:\n%#v\nAll triggered app events are:\n%#v", remainingEvents, testApp.EventCalls)
+		}
+
+		if scenario.AfterTestFunc != nil {
+			scenario.AfterTestFunc(t, testApp, res)
+		}
+
+		return nil
+	})
+	if serveErr != nil {
+		t.Fatalf("Failed to trigger app serve hook: %v", serveErr)
+	}
+}
diff --git a/server/core_backend-server/tests/app.go b/server/core_backend-server/tests/app.go
new file mode 100644
index 0000000..90c1b09
--- /dev/null
+++ b/server/core_backend-server/tests/app.go
@@ -0,0 +1,953 @@
+// Package tests provides common helpers and mocks used in PocketBase application tests.
+package tests
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"runtime"
+	"sync"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/security"
+
+	_ "github.com/pocketbase/pocketbase/migrations"
+)
+
+// TestApp is a wrapper app instance used for testing.
+type TestApp struct {
+	*core.BaseApp
+
+	mux sync.Mutex
+
+	// EventCalls defines a map to inspect which app events
+	// (and how many times) were triggered.
+	EventCalls map[string]int
+
+	TestMailer *TestMailer
+
+	KeepTestPostgresDB bool
+}
+
+// Cleanup resets the test application state and removes the test
+// app's dataDir from the filesystem.
+//
+// After this call, the app instance shouldn't be used anymore.
+func (t *TestApp) Cleanup() {
+	event := new(core.TerminateEvent)
+	event.App = t
+
+	t.OnTerminate().Trigger(event, func(e *core.TerminateEvent) error {
+		t.TestMailer.Reset()
+		t.ResetEventCalls()
+		t.ResetBootstrapState()
+
+		return e.Next()
+	})
+
+	if t.DataDir() != "" {
+		os.RemoveAll(t.DataDir())
+	}
+
+	// Drop the temporary Postgres dbs
+	if !t.KeepTestPostgresDB && (t.PostgresDataDB() != "" || t.PostgresAuxDB() != "") {
+		exec.Command("sh", "-c", fmt.Sprintf("PGPASSWORD=pass dropdb --if-exists -h 127.0.0.1 -U user %s", t.PostgresDataDB())).Run()
+		exec.Command("sh", "-c", fmt.Sprintf("PGPASSWORD=pass dropdb --if-exists -h 127.0.0.1 -U user %s", t.PostgresAuxDB())).Run()
+	}
+}
+
+// ResetEventCalls resets the EventCalls counter.
+func (t *TestApp) ResetEventCalls() {
+	t.mux.Lock()
+	defer t.mux.Unlock()
+
+	t.EventCalls = make(map[string]int)
+}
+
+func (t *TestApp) registerEventCall(name string) {
+	t.mux.Lock()
+	defer t.mux.Unlock()
+
+	if t.EventCalls == nil {
+		t.EventCalls = make(map[string]int)
+	}
+
+	t.EventCalls[name]++
+}
+
+// NewTestApp creates and initializes a test application instance.
+//
+// It is the caller's responsibility to call app.Cleanup() when the app is no longer needed.
+func NewTestApp(optTestDataDir ...string) (*TestApp, error) {
+	var testDataDir string
+	if len(optTestDataDir) > 0 {
+		testDataDir = optTestDataDir[0]
+	}
+
+	// docker run -d --rm --name postgres -e POSTGRES_USER=user -e POSTGRES_PASSWORD=pass -p 6432:6432 postgres:alpine
+	return NewTestAppWithConfig(core.BaseAppConfig{
+		DataDir:       testDataDir,
+		EncryptionEnv: "pb_test_env",
+		PostgresURL:   "postgres://user:pass@127.0.0.1:6432/postgres?sslmode=disable",
+		// IsDev:         true, // Turn it on in unit tests to see sql erros.
+	})
+}
+
+// NewTestAppWithConfig creates and initializes a test application instance
+// from the provided config.
+//
+// If config.DataDir is not set it fallbacks to the default internal test data directory.
+//
+// config.DataDir is cloned for each new test application instance.
+//
+// It is the caller's responsibility to call app.Cleanup() when the app is no longer needed.
+func NewTestAppWithConfig(config core.BaseAppConfig) (*TestApp, error) {
+	if config.DataDir == "" {
+		// fallback to the default test data directory
+		_, currentFile, _, _ := runtime.Caller(0)
+		config.DataDir = filepath.Join(path.Dir(currentFile), "data")
+	}
+
+	tempDir, err := TempDirClone(config.DataDir)
+	if err != nil {
+		return nil, err
+	}
+
+	// replace with the clone
+	config.DataDir = tempDir
+
+	// Copy postgres data
+	config.PostgresDataDB, config.PostgresAuxDB, err = CopyTempPostgresDB(config)
+	if err != nil {
+		return nil, err
+	}
+
+	app := core.NewBaseApp(config)
+
+	// load data dir and db connections
+	if err := app.Bootstrap(); err != nil {
+		panic(err)
+	}
+
+	// ensure that the Dao and DB configurations are properly loaded
+	if _, err := app.DB().NewQuery("Select 1").Execute(); err != nil {
+		return nil, err
+	}
+	if _, err := app.AuxDB().NewQuery("Select 1").Execute(); err != nil {
+		return nil, err
+	}
+
+	// apply any missing migrations
+	if err := app.RunAllMigrations(); err != nil {
+		return nil, err
+	}
+
+	// force disable request logs because the logs db call execute in a separate
+	// go routine and it is possible to panic due to earlier api test completion.
+	app.Settings().Logs.MaxDays = 0
+
+	t := &TestApp{
+		BaseApp:    app,
+		EventCalls: make(map[string]int),
+		TestMailer: &TestMailer{},
+	}
+
+	t.OnBootstrap().Bind(&hook.Handler[*core.BootstrapEvent]{
+		Func: func(e *core.BootstrapEvent) error {
+			t.registerEventCall("OnBootstrap")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnServe().Bind(&hook.Handler[*core.ServeEvent]{
+		Func: func(e *core.ServeEvent) error {
+			t.registerEventCall("OnServe")
+			e.InstallerFunc = nil // https://github.com/pocketbase/pocketbase/discussions/7202
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnTerminate().Bind(&hook.Handler[*core.TerminateEvent]{
+		Func: func(e *core.TerminateEvent) error {
+			t.registerEventCall("OnTerminate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnBackupCreate().Bind(&hook.Handler[*core.BackupEvent]{
+		Func: func(e *core.BackupEvent) error {
+			t.registerEventCall("OnBackupCreate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnBackupRestore().Bind(&hook.Handler[*core.BackupEvent]{
+		Func: func(e *core.BackupEvent) error {
+			t.registerEventCall("OnBackupRestore")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelCreate().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelCreate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelCreateExecute().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelCreateExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelAfterCreateSuccess().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelAfterCreateSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelAfterCreateError().Bind(&hook.Handler[*core.ModelErrorEvent]{
+		Func: func(e *core.ModelErrorEvent) error {
+			t.registerEventCall("OnModelAfterCreateError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelUpdate().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelUpdate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelUpdateExecute().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelUpdateExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelAfterUpdateSuccess().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelAfterUpdateSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelAfterUpdateError().Bind(&hook.Handler[*core.ModelErrorEvent]{
+		Func: func(e *core.ModelErrorEvent) error {
+			t.registerEventCall("OnModelAfterUpdateError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelValidate().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelValidate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelDelete().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelDelete")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelDeleteExecute().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelDeleteExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelAfterDeleteSuccess().Bind(&hook.Handler[*core.ModelEvent]{
+		Func: func(e *core.ModelEvent) error {
+			t.registerEventCall("OnModelAfterDeleteSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnModelAfterDeleteError().Bind(&hook.Handler[*core.ModelErrorEvent]{
+		Func: func(e *core.ModelErrorEvent) error {
+			t.registerEventCall("OnModelAfterDeleteError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordEnrich().Bind(&hook.Handler[*core.RecordEnrichEvent]{
+		Func: func(e *core.RecordEnrichEvent) error {
+			t.registerEventCall("OnRecordEnrich")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordValidate().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordValidate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordCreate().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordCreate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordCreateExecute().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordCreateExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAfterCreateSuccess().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordAfterCreateSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAfterCreateError().Bind(&hook.Handler[*core.RecordErrorEvent]{
+		Func: func(e *core.RecordErrorEvent) error {
+			t.registerEventCall("OnRecordAfterCreateError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordUpdate().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordUpdate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordUpdateExecute().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordUpdateExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAfterUpdateSuccess().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordAfterUpdateSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAfterUpdateError().Bind(&hook.Handler[*core.RecordErrorEvent]{
+		Func: func(e *core.RecordErrorEvent) error {
+			t.registerEventCall("OnRecordAfterUpdateError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordDelete().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordDelete")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordDeleteExecute().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordDeleteExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAfterDeleteSuccess().Bind(&hook.Handler[*core.RecordEvent]{
+		Func: func(e *core.RecordEvent) error {
+			t.registerEventCall("OnRecordAfterDeleteSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAfterDeleteError().Bind(&hook.Handler[*core.RecordErrorEvent]{
+		Func: func(e *core.RecordErrorEvent) error {
+			t.registerEventCall("OnRecordAfterDeleteError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionValidate().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionValidate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionCreate().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionCreate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionCreateExecute().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionCreateExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionAfterCreateSuccess().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionAfterCreateSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionAfterCreateError().Bind(&hook.Handler[*core.CollectionErrorEvent]{
+		Func: func(e *core.CollectionErrorEvent) error {
+			t.registerEventCall("OnCollectionAfterCreateError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionUpdate().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionUpdate")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionUpdateExecute().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionUpdateExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionAfterUpdateSuccess().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionAfterUpdateSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionAfterUpdateError().Bind(&hook.Handler[*core.CollectionErrorEvent]{
+		Func: func(e *core.CollectionErrorEvent) error {
+			t.registerEventCall("OnCollectionAfterUpdateError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionDelete().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionDelete")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionDeleteExecute().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionDeleteExecute")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionAfterDeleteSuccess().Bind(&hook.Handler[*core.CollectionEvent]{
+		Func: func(e *core.CollectionEvent) error {
+			t.registerEventCall("OnCollectionAfterDeleteSuccess")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionAfterDeleteError().Bind(&hook.Handler[*core.CollectionErrorEvent]{
+		Func: func(e *core.CollectionErrorEvent) error {
+			t.registerEventCall("OnCollectionAfterDeleteError")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnMailerSend().Bind(&hook.Handler[*core.MailerEvent]{
+		Func: func(e *core.MailerEvent) error {
+			if t.TestMailer == nil {
+				t.TestMailer = &TestMailer{}
+			}
+			e.Mailer = t.TestMailer
+			t.registerEventCall("OnMailerSend")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnMailerRecordAuthAlertSend().Bind(&hook.Handler[*core.MailerRecordEvent]{
+		Func: func(e *core.MailerRecordEvent) error {
+			t.registerEventCall("OnMailerRecordAuthAlertSend")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnMailerRecordPasswordResetSend().Bind(&hook.Handler[*core.MailerRecordEvent]{
+		Func: func(e *core.MailerRecordEvent) error {
+			t.registerEventCall("OnMailerRecordPasswordResetSend")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnMailerRecordVerificationSend().Bind(&hook.Handler[*core.MailerRecordEvent]{
+		Func: func(e *core.MailerRecordEvent) error {
+			t.registerEventCall("OnMailerRecordVerificationSend")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnMailerRecordEmailChangeSend().Bind(&hook.Handler[*core.MailerRecordEvent]{
+		Func: func(e *core.MailerRecordEvent) error {
+			t.registerEventCall("OnMailerRecordEmailChangeSend")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnMailerRecordOTPSend().Bind(&hook.Handler[*core.MailerRecordEvent]{
+		Func: func(e *core.MailerRecordEvent) error {
+			t.registerEventCall("OnMailerRecordOTPSend")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRealtimeConnectRequest().Bind(&hook.Handler[*core.RealtimeConnectRequestEvent]{
+		Func: func(e *core.RealtimeConnectRequestEvent) error {
+			t.registerEventCall("OnRealtimeConnectRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRealtimeMessageSend().Bind(&hook.Handler[*core.RealtimeMessageEvent]{
+		Func: func(e *core.RealtimeMessageEvent) error {
+			t.registerEventCall("OnRealtimeMessageSend")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRealtimeSubscribeRequest().Bind(&hook.Handler[*core.RealtimeSubscribeRequestEvent]{
+		Func: func(e *core.RealtimeSubscribeRequestEvent) error {
+			t.registerEventCall("OnRealtimeSubscribeRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnSettingsListRequest().Bind(&hook.Handler[*core.SettingsListRequestEvent]{
+		Func: func(e *core.SettingsListRequestEvent) error {
+			t.registerEventCall("OnSettingsListRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnSettingsUpdateRequest().Bind(&hook.Handler[*core.SettingsUpdateRequestEvent]{
+		Func: func(e *core.SettingsUpdateRequestEvent) error {
+			t.registerEventCall("OnSettingsUpdateRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnSettingsReload().Bind(&hook.Handler[*core.SettingsReloadEvent]{
+		Func: func(e *core.SettingsReloadEvent) error {
+			t.registerEventCall("OnSettingsReload")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnFileDownloadRequest().Bind(&hook.Handler[*core.FileDownloadRequestEvent]{
+		Func: func(e *core.FileDownloadRequestEvent) error {
+			t.registerEventCall("OnFileDownloadRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnFileTokenRequest().Bind(&hook.Handler[*core.FileTokenRequestEvent]{
+		Func: func(e *core.FileTokenRequestEvent) error {
+			t.registerEventCall("OnFileTokenRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAuthRequest().Bind(&hook.Handler[*core.RecordAuthRequestEvent]{
+		Func: func(e *core.RecordAuthRequestEvent) error {
+			t.registerEventCall("OnRecordAuthRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAuthWithPasswordRequest().Bind(&hook.Handler[*core.RecordAuthWithPasswordRequestEvent]{
+		Func: func(e *core.RecordAuthWithPasswordRequestEvent) error {
+			t.registerEventCall("OnRecordAuthWithPasswordRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAuthWithOAuth2Request().Bind(&hook.Handler[*core.RecordAuthWithOAuth2RequestEvent]{
+		Func: func(e *core.RecordAuthWithOAuth2RequestEvent) error {
+			t.registerEventCall("OnRecordAuthWithOAuth2Request")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAuthRefreshRequest().Bind(&hook.Handler[*core.RecordAuthRefreshRequestEvent]{
+		Func: func(e *core.RecordAuthRefreshRequestEvent) error {
+			t.registerEventCall("OnRecordAuthRefreshRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordRequestPasswordResetRequest().Bind(&hook.Handler[*core.RecordRequestPasswordResetRequestEvent]{
+		Func: func(e *core.RecordRequestPasswordResetRequestEvent) error {
+			t.registerEventCall("OnRecordRequestPasswordResetRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordConfirmPasswordResetRequest().Bind(&hook.Handler[*core.RecordConfirmPasswordResetRequestEvent]{
+		Func: func(e *core.RecordConfirmPasswordResetRequestEvent) error {
+			t.registerEventCall("OnRecordConfirmPasswordResetRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordRequestVerificationRequest().Bind(&hook.Handler[*core.RecordRequestVerificationRequestEvent]{
+		Func: func(e *core.RecordRequestVerificationRequestEvent) error {
+			t.registerEventCall("OnRecordRequestVerificationRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordConfirmVerificationRequest().Bind(&hook.Handler[*core.RecordConfirmVerificationRequestEvent]{
+		Func: func(e *core.RecordConfirmVerificationRequestEvent) error {
+			t.registerEventCall("OnRecordConfirmVerificationRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordRequestEmailChangeRequest().Bind(&hook.Handler[*core.RecordRequestEmailChangeRequestEvent]{
+		Func: func(e *core.RecordRequestEmailChangeRequestEvent) error {
+			t.registerEventCall("OnRecordRequestEmailChangeRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordConfirmEmailChangeRequest().Bind(&hook.Handler[*core.RecordConfirmEmailChangeRequestEvent]{
+		Func: func(e *core.RecordConfirmEmailChangeRequestEvent) error {
+			t.registerEventCall("OnRecordConfirmEmailChangeRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordRequestOTPRequest().Bind(&hook.Handler[*core.RecordCreateOTPRequestEvent]{
+		Func: func(e *core.RecordCreateOTPRequestEvent) error {
+			t.registerEventCall("OnRecordRequestOTPRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordAuthWithOTPRequest().Bind(&hook.Handler[*core.RecordAuthWithOTPRequestEvent]{
+		Func: func(e *core.RecordAuthWithOTPRequestEvent) error {
+			t.registerEventCall("OnRecordAuthWithOTPRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordsListRequest().Bind(&hook.Handler[*core.RecordsListRequestEvent]{
+		Func: func(e *core.RecordsListRequestEvent) error {
+			t.registerEventCall("OnRecordsListRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordViewRequest().Bind(&hook.Handler[*core.RecordRequestEvent]{
+		Func: func(e *core.RecordRequestEvent) error {
+			t.registerEventCall("OnRecordViewRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordCreateRequest().Bind(&hook.Handler[*core.RecordRequestEvent]{
+		Func: func(e *core.RecordRequestEvent) error {
+			t.registerEventCall("OnRecordCreateRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordUpdateRequest().Bind(&hook.Handler[*core.RecordRequestEvent]{
+		Func: func(e *core.RecordRequestEvent) error {
+			t.registerEventCall("OnRecordUpdateRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnRecordDeleteRequest().Bind(&hook.Handler[*core.RecordRequestEvent]{
+		Func: func(e *core.RecordRequestEvent) error {
+			t.registerEventCall("OnRecordDeleteRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionsListRequest().Bind(&hook.Handler[*core.CollectionsListRequestEvent]{
+		Func: func(e *core.CollectionsListRequestEvent) error {
+			t.registerEventCall("OnCollectionsListRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionViewRequest().Bind(&hook.Handler[*core.CollectionRequestEvent]{
+		Func: func(e *core.CollectionRequestEvent) error {
+			t.registerEventCall("OnCollectionViewRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionCreateRequest().Bind(&hook.Handler[*core.CollectionRequestEvent]{
+		Func: func(e *core.CollectionRequestEvent) error {
+			t.registerEventCall("OnCollectionCreateRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionUpdateRequest().Bind(&hook.Handler[*core.CollectionRequestEvent]{
+		Func: func(e *core.CollectionRequestEvent) error {
+			t.registerEventCall("OnCollectionUpdateRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionDeleteRequest().Bind(&hook.Handler[*core.CollectionRequestEvent]{
+		Func: func(e *core.CollectionRequestEvent) error {
+			t.registerEventCall("OnCollectionDeleteRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnCollectionsImportRequest().Bind(&hook.Handler[*core.CollectionsImportRequestEvent]{
+		Func: func(e *core.CollectionsImportRequestEvent) error {
+			t.registerEventCall("OnCollectionsImportRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	t.OnBatchRequest().Bind(&hook.Handler[*core.BatchRequestEvent]{
+		Func: func(e *core.BatchRequestEvent) error {
+			t.registerEventCall("OnBatchRequest")
+			return e.Next()
+		},
+		Priority: -99999,
+	})
+
+	return t, nil
+}
+
+// TempDirClone creates a new temporary directory copy from the
+// provided directory path.
+//
+// It is the caller's responsibility to call `os.RemoveAll(tempDir)`
+// when the directory is no longer needed!
+func TempDirClone(dirToClone string) (string, error) {
+	tempDir, err := os.MkdirTemp("", "pb_test_*")
+	if err != nil {
+		return "", err
+	}
+
+	// copy everything from testDataDir to tempDir
+	if err := copyDir(dirToClone, tempDir); err != nil {
+		return "", err
+	}
+
+	return tempDir, nil
+}
+
+func CopyTempPostgresDB(config core.BaseAppConfig) (string, string, error) {
+	dataDbName := "pb_test_" + security.RandomString(5)
+	if config.PostgresDataDB != "" {
+		dataDbName = config.PostgresDataDB
+	}
+	auxiliaryDbName := dataDbName + "_aux"
+	if config.PostgresAuxDB != "" {
+		auxiliaryDbName = config.PostgresAuxDB
+	}
+	// Run `cd tests/data && make dump`
+	commands := []any{
+		fmt.Sprintf("PGPASSWORD=pass createdb -h 127.0.0.1 -U user %s", dataDbName),
+		fmt.Sprintf("PGPASSWORD=pass createdb -h 127.0.0.1 -U user %s", auxiliaryDbName),
+		fmt.Sprintf("PGPASSWORD=pass psql -h 127.0.0.1 -U user -d %s < data.pg-dump.sql", dataDbName),
+		fmt.Sprintf("PGPASSWORD=pass psql -h 127.0.0.1 -U user -d %s < auxiliary.pg-dump.sql", auxiliaryDbName),
+	}
+	// Execute the commands
+	for _, cmd := range commands {
+		switch cmd := cmd.(type) {
+		case func():
+			cmd()
+		case string:
+			var stdout, stderr bytes.Buffer
+			fmt.Fprintln(&stdout, "Running command:", cmd)
+			command := exec.Command("sh", "-c", cmd)
+			command.Dir = config.DataDir
+			command.Stdout = &stdout
+			command.Stderr = io.MultiWriter(&stdout, &stderr) // combine stdout and stderr to get ordered output
+			err := command.Run()
+			if err != nil {
+				panic(err.Error())
+			}
+			if command.ProcessState.ExitCode() != 0 {
+				fmt.Fprintln(&stdout, "Command output:", stdout.String())
+				return "", "", fmt.Errorf("command failed with exit code %d", command.ProcessState.ExitCode())
+			}
+			if stderr.Len() > 0 {
+				fmt.Fprintln(&stdout, "Command output:", stdout.String())
+				return "", "", fmt.Errorf("command stderr: %s", stderr.String())
+			}
+		}
+	}
+	return dataDbName, auxiliaryDbName, nil
+}
+
+// -------------------------------------------------------------------
+// Helpers
+// -------------------------------------------------------------------
+
+func copyDir(src string, dest string) error {
+	if err := os.MkdirAll(dest, os.ModePerm); err != nil {
+		return err
+	}
+
+	sourceDir, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer sourceDir.Close()
+
+	items, err := sourceDir.Readdir(-1)
+	if err != nil {
+		return err
+	}
+
+	for _, item := range items {
+		fullSrcPath := filepath.Join(src, item.Name())
+		fullDestPath := filepath.Join(dest, item.Name())
+
+		var copyErr error
+		if item.IsDir() {
+			copyErr = copyDir(fullSrcPath, fullDestPath)
+		} else {
+			copyErr = copyFile(fullSrcPath, fullDestPath)
+		}
+
+		if copyErr != nil {
+			return copyErr
+		}
+	}
+
+	return nil
+}
+
+func copyFile(src string, dest string) error {
+	srcFile, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer srcFile.Close()
+
+	destFile, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+	defer destFile.Close()
+
+	if _, err := io.Copy(destFile, srcFile); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/tests/data/.gitignore b/server/core_backend-server/tests/data/.gitignore
new file mode 100644
index 0000000..d3baf10
--- /dev/null
+++ b/server/core_backend-server/tests/data/.gitignore
@@ -0,0 +1,3 @@
+*.db-shm
+*.db-wal
+types.d.ts
diff --git a/server/core_backend-server/tests/data/Makefile b/server/core_backend-server/tests/data/Makefile
new file mode 100644
index 0000000..72eeaba
--- /dev/null
+++ b/server/core_backend-server/tests/data/Makefile
@@ -0,0 +1,60 @@
+
+# Dependencies: pg-loader, postgres client tools
+
+install-tools-macos:
+	brew install pgloader
+	brew install libpq
+
+install-tools-linux:
+	sudo apt install pgloader
+	sudo apt install postgresql-client
+
+run-docker:
+	docker run -d --rm --name postgres -e POSTGRES_USER=user -e POSTGRES_PASSWORD=pass -p 6432:6432 postgres:alpine
+
+# Max performance for unit tests.
+run-docker-unit-test-only:
+	docker run -d --rm --name postgres -e POSTGRES_USER=user -e POSTGRES_PASSWORD=pass \
+		--tmpfs /var/lib/postgresql/data:rw,noexec,nosuid,size=2G \
+		-p 6432:6432 postgres:alpine \
+		-c fsync=off \
+		-c synchronous_commit=off \
+		-c full_page_writes=off \
+		-c wal_level=minimal \
+		-c max_wal_senders=0 \
+		-c archive_mode=off \
+		-c shared_buffers=256MB \
+		-c max_wal_size=512MB \
+		-c checkpoint_timeout=30min \
+		-c logging_collector=off \
+		-c log_statement=none \
+		-c jit=off \
+		-c track_counts=off \
+		-c autovacuum=off
+
+dump-db:
+# 1. Convert `data.db` to `data.sqlite-dump.sql` and `data.pg-dump.sql`
+	sqlite3 data.db .dump > data.sqlite-dump.sql
+	-PGPASSWORD=pass dropdb -h 127.0.0.1 -U user pb-data
+	PGPASSWORD=pass createdb -h 127.0.0.1 -U user pb-data
+	-pgloader --with "preserve index names" sqlite://$$(pwd)/data.db pgsql://user:pass@127.0.0.1/pb-data
+	docker exec -it postgres pg_dump -U user -h 127.0.0.1 pb-data > data.pg-dump.sql
+# 2. Convert `auxiliary.db` to `auxiliary.sqlite-dump.sql` and `auxiliary.pg-dump.sql`
+	sqlite3 auxiliary.db .dump > auxiliary.sqlite-dump.sql
+	-PGPASSWORD=pass dropdb -h 127.0.0.1 -U user pb-auxiliary
+	PGPASSWORD=pass createdb -h 127.0.0.1 -U user pb-auxiliary
+	-pgloader --with "preserve index names" sqlite://$$(pwd)/auxiliary.db pgsql://user:pass@127.0.0.1/pb-auxiliary
+	docker exec -it postgres pg_dump -U user -h 127.0.0.1 pb-auxiliary > auxiliary.pg-dump.sql
+
+
+PREFIX=pb_test_
+drop-matching-dbs:
+	@echo "Looking for databases starting with $(PREFIX)..."
+	@PGPASSWORD=pass psql -h 127.0.0.1 -U user -d postgres -t -c "SELECT datname FROM pg_database WHERE datname LIKE '$(PREFIX)%'" | \
+	while read dbname; do \
+	  dbname=$$(echo $$dbname | xargs); \
+	  if [ ! -z "$$dbname" ]; then \
+	    echo "Dropping database: $$dbname"; \
+	    PGPASSWORD=pass psql -h 127.0.0.1 -U user -d postgres -c "DROP DATABASE \"$$dbname\""; \
+	  fi; \
+	done
diff --git a/server/core_backend-server/tests/data/auxiliary.db b/server/core_backend-server/tests/data/auxiliary.db
new file mode 100644
index 0000000..8c3bc97
Binary files /dev/null and b/server/core_backend-server/tests/data/auxiliary.db differ
diff --git a/server/core_backend-server/tests/data/auxiliary.pg-dump.sql b/server/core_backend-server/tests/data/auxiliary.pg-dump.sql
new file mode 100644
index 0000000..c3cd034
--- /dev/null
+++ b/server/core_backend-server/tests/data/auxiliary.pg-dump.sql
@@ -0,0 +1,122 @@
+--
+-- PostgreSQL database dump
+--
+
+-- Dumped from database version 17.6
+-- Dumped by pg_dump version 17.6
+
+-- Enable built-in pgcrypto extension to use gen_random_bytes function
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+-- Adding "nocase" collation to be compatible with SQLite's default "nocase" collation
+CREATE COLLATION IF NOT EXISTS "nocase" (
+  provider = icu,          -- Specify ICU as the provider
+  locale = 'und-u-ks-level2', -- Undetermined locale, Unicode extension (-u-), collation strength (ks) level 2 (level2)
+  deterministic = false    -- Case-insensitive collations are typically non-deterministic
+);
+
+-- Alias [hex] to encode(..., 'hex')
+CREATE OR REPLACE FUNCTION hex(data bytea)
+RETURNS text
+LANGUAGE SQL
+IMMUTABLE
+AS $$
+SELECT encode(data, 'hex')
+$$;
+
+-- Alias [randomblob] to gen_random_bytes(...)
+CREATE OR REPLACE FUNCTION randomblob(length integer)
+RETURNS bytea
+LANGUAGE SQL
+IMMUTABLE
+AS $$
+SELECT gen_random_bytes(length)
+$$;
+
+-- Create the uuid_generate_v7 function
+create or replace function uuid_generate_v7()
+    returns uuid
+    as $$
+    begin
+    -- use random v4 uuid as starting point (which has the same variant we need)
+    -- then overlay timestamp
+    -- then set version 7 by flipping the 2 and 1 bit in the version 4 string
+    return encode(
+        set_bit(
+        set_bit(
+            overlay(uuid_send(gen_random_uuid())
+                    placing substring(int8send(floor(extract(epoch from clock_timestamp()) * 1000)::bigint) from 3)
+                    from 1 for 6
+            ),
+            52, 1
+        ),
+        53, 1
+        ),
+        'hex')::uuid;
+    end
+    $$
+    language plpgsql
+    volatile;
+
+-- Create json_valid function
+CREATE OR REPLACE FUNCTION json_valid(text) RETURNS boolean AS $$
+	BEGIN
+		PERFORM $1::jsonb;
+		RETURN TRUE;
+	EXCEPTION WHEN others THEN
+		RETURN FALSE;
+	END;
+	$$ LANGUAGE plpgsql IMMUTABLE;
+
+--
+-- Name: _logs; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public._logs (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v7() NOT NULL,
+    level bigint DEFAULT '0'::bigint,
+    message text DEFAULT '""'::text,
+    data json DEFAULT '"{}"'::json,
+    created TIMESTAMP DEFAULT NOW() NOT NULL,
+    updated TIMESTAMP DEFAULT NOW() NOT NULL
+);
+
+
+ALTER TABLE public._logs OWNER TO "user";
+
+--
+-- Name: _migrations; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public._migrations (
+    file text,
+    applied bigint
+);
+
+
+ALTER TABLE public._migrations OWNER TO "user";
+
+--
+-- Data for Name: _logs; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public._logs (id, level, message, data, created, updated) FROM stdin;
+\.
+
+
+--
+-- Data for Name: _migrations; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public._migrations (file, applied) FROM stdin;
+1640988000_init.go	1679427415788852
+1660821103_add_user_ip_column.go	1679427415792425
+1677760279_uppsercase_method.go	1679427415792706
+1699187560_logs_generalization.go	1700504854831333
+\.
+
+
+--
+-- PostgreSQL database dump complete
+--
+
diff --git a/server/core_backend-server/tests/data/auxiliary.sqlite-dump.sql b/server/core_backend-server/tests/data/auxiliary.sqlite-dump.sql
new file mode 100644
index 0000000..2c910f5
--- /dev/null
+++ b/server/core_backend-server/tests/data/auxiliary.sqlite-dump.sql
@@ -0,0 +1,23 @@
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+CREATE TABLE `_migrations` (file VARCHAR(255) PRIMARY KEY NOT NULL, applied INTEGER NOT NULL);
+INSERT INTO _migrations VALUES('1640988000_init.go',1679427415788852);
+INSERT INTO _migrations VALUES('1660821103_add_user_ip_column.go',1679427415792425);
+INSERT INTO _migrations VALUES('1677760279_uppsercase_method.go',1679427415792706);
+INSERT INTO _migrations VALUES('1699187560_logs_generalization.go',1700504854831333);
+CREATE TABLE `_logs` (
+				`id`      TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL,
+				`level`   INTEGER DEFAULT 0 NOT NULL,
+				`message` TEXT DEFAULT "" NOT NULL,
+				`data`    JSON DEFAULT "{}" NOT NULL,
+				`created` TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL,
+				`updated` TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%fZ')) NOT NULL
+			);
+CREATE INDEX _logs_level_idx on `_logs` (`level`);
+CREATE INDEX _logs_message_idx on `_logs` (`message`);
+CREATE INDEX _logs_data_auth_idx on `_logs` (JSON_EXTRACT(`data`, '$.auth'));
+CREATE INDEX _logs_created_hour_idx on `_logs` (strftime('%Y-%m-%d %H:00:00', `created`));
+CREATE INDEX idx_logs_level on `_logs` (`level`);
+CREATE INDEX idx_logs_message on `_logs` (`message`);
+CREATE INDEX idx_logs_created_hour on `_logs` (strftime('%Y-%m-%d %H:00:00', `created`));
+COMMIT;
diff --git a/server/core_backend-server/tests/data/data.db b/server/core_backend-server/tests/data/data.db
new file mode 100644
index 0000000..02bcb3d
Binary files /dev/null and b/server/core_backend-server/tests/data/data.db differ
diff --git a/server/core_backend-server/tests/data/data.pg-dump.sql b/server/core_backend-server/tests/data/data.pg-dump.sql
new file mode 100644
index 0000000..165e7cd
--- /dev/null
+++ b/server/core_backend-server/tests/data/data.pg-dump.sql
@@ -0,0 +1,1060 @@
+--
+-- PostgreSQL database dump
+--
+
+-- Dumped from database version 17.6
+-- Dumped by pg_dump version 17.6
+
+-- Enable built-in pgcrypto extension to use gen_random_bytes function
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+
+-- Adding "nocase" collation to be compatible with SQLite's default "nocase" collation
+CREATE COLLATION IF NOT EXISTS "nocase" (
+  provider = icu,          -- Specify ICU as the provider
+  locale = 'und-u-ks-level2', -- Undetermined locale, Unicode extension (-u-), collation strength (ks) level 2 (level2)
+  deterministic = false    -- Case-insensitive collations are typically non-deterministic
+);
+
+-- Alias [hex] to encode(..., 'hex')
+CREATE OR REPLACE FUNCTION hex(data bytea)
+RETURNS text
+LANGUAGE SQL
+IMMUTABLE
+AS $$
+SELECT encode(data, 'hex')
+$$;
+
+-- Alias [randomblob] to gen_random_bytes(...)
+CREATE OR REPLACE FUNCTION randomblob(length integer)
+RETURNS bytea
+LANGUAGE SQL
+IMMUTABLE
+AS $$
+SELECT gen_random_bytes(length)
+$$;
+
+-- Create the uuid_generate_v7 function
+create or replace function uuid_generate_v7()
+    returns uuid
+    as $$
+    begin
+    -- use random v4 uuid as starting point (which has the same variant we need)
+    -- then overlay timestamp
+    -- then set version 7 by flipping the 2 and 1 bit in the version 4 string
+    return encode(
+        set_bit(
+        set_bit(
+            overlay(uuid_send(gen_random_uuid())
+                    placing substring(int8send(floor(extract(epoch from clock_timestamp()) * 1000)::bigint) from 3)
+                    from 1 for 6
+            ),
+            52, 1
+        ),
+        53, 1
+        ),
+        'hex')::uuid;
+    end
+    $$
+    language plpgsql
+    volatile;
+
+-- Create json_valid function
+CREATE OR REPLACE FUNCTION json_valid(text) RETURNS boolean AS $$
+	BEGIN
+		PERFORM $1::jsonb;
+		RETURN TRUE;
+	EXCEPTION WHEN others THEN
+		RETURN FALSE;
+	END;
+	$$ LANGUAGE plpgsql IMMUTABLE;
+
+-- Create a json_query_or_null function that handles any types.
+CREATE OR REPLACE FUNCTION json_query_or_null(p_input jsonb, p_query text) RETURNS jsonb AS $$
+    SELECT JSON_QUERY(p_input, p_query)
+$$ LANGUAGE sql IMMUTABLE;
+
+-- Create a json_query_or_null function that handles any types.
+CREATE OR REPLACE FUNCTION json_query_or_null(p_input anyelement, p_query text) RETURNS jsonb AS $$
+BEGIN
+    RETURN JSON_QUERY(p_input::text::jsonb, p_query);
+EXCEPTION WHEN others THEN
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+--
+-- Name: "_authOrigins"; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public."_authOrigins" (
+    "collectionRef" text DEFAULT ''::text,
+    created text DEFAULT ''::text,
+    fingerprint text DEFAULT ''::text,
+    id text DEFAULT '''r''||lower(hex(randomblob(7)))'::text NOT NULL,
+    "recordRef" text DEFAULT ''::text,
+    updated text DEFAULT ''::text
+);
+
+
+ALTER TABLE public."_authOrigins" OWNER TO "user";
+
+--
+-- Name: _collections; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public._collections (
+    id text NOT NULL,
+    system boolean DEFAULT false,
+    type text DEFAULT '"base"'::text,
+    name text,
+    fields jsonb DEFAULT '"[]"'::jsonb,
+    "listRule" text,
+    "viewRule" text,
+    "createRule" text,
+    "updateRule" text,
+    "deleteRule" text,
+    options jsonb DEFAULT '"{}"'::jsonb,
+    created text DEFAULT '""'::text,
+    updated text DEFAULT '""'::text,
+    indexes jsonb DEFAULT '"[]"'::jsonb
+);
+
+
+ALTER TABLE public._collections OWNER TO "user";
+
+--
+-- Name: "_externalAuths"; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public."_externalAuths" (
+    "collectionRef" text DEFAULT ''::text,
+    created text DEFAULT ''::text,
+    id text DEFAULT '''r''||lower(hex(randomblob(7)))'::text NOT NULL,
+    provider text DEFAULT ''::text,
+    "providerId" text DEFAULT ''::text,
+    "recordRef" text DEFAULT ''::text,
+    updated text DEFAULT ''::text
+);
+
+
+ALTER TABLE public."_externalAuths" OWNER TO "user";
+
+--
+-- Name: _mfas; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public._mfas (
+    "collectionRef" text DEFAULT ''::text,
+    created text DEFAULT ''::text,
+    id text DEFAULT '''r''||lower(hex(randomblob(7)))'::text NOT NULL,
+    method text DEFAULT ''::text,
+    "recordRef" text DEFAULT ''::text,
+    updated text DEFAULT ''::text
+);
+
+
+ALTER TABLE public._mfas OWNER TO "user";
+
+--
+-- Name: _migrations; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public._migrations (
+    file text NOT NULL,
+    applied bigint
+);
+
+
+ALTER TABLE public._migrations OWNER TO "user";
+
+--
+-- Name: _otps; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public._otps (
+    "collectionRef" text DEFAULT ''::text,
+    created text DEFAULT ''::text,
+    id text DEFAULT '''r''||lower(hex(randomblob(7)))'::text NOT NULL,
+    password text DEFAULT ''::text,
+    "recordRef" text DEFAULT ''::text,
+    updated text DEFAULT ''::text,
+    "sentTo" text DEFAULT ''::text
+);
+
+
+ALTER TABLE public._otps OWNER TO "user";
+
+--
+-- Name: _params; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public._params (
+    created TEXT DEFAULT ''::text NOT NULL,
+    id TEXT DEFAULT '''r''||lower(hex(randomblob(7)))'::text NOT NULL,
+    updated TEXT DEFAULT '' NOT NULL,
+    value TEXT DEFAULT NULL -- Use TEXT because encrypted values are not valid JSON.
+);
+
+ALTER TABLE public._params OWNER TO "user";
+
+--
+-- Name: _superusers; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public._superusers (
+    created text DEFAULT ''::text,
+    email text DEFAULT ''::text,
+    "emailVisibility" boolean DEFAULT false,
+    id text DEFAULT '''r''||lower(hex(randomblob(7)))'::text NOT NULL,
+    password text DEFAULT ''::text,
+    "tokenKey" text DEFAULT ''::text,
+    updated text DEFAULT ''::text,
+    verified boolean DEFAULT false
+);
+
+
+ALTER TABLE public._superusers OWNER TO "user";
+
+--
+-- Name: clients; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.clients (
+    created text DEFAULT ''::text,
+    email text DEFAULT ''::text,
+    "emailVisibility" boolean DEFAULT false,
+    id text NOT NULL,
+    name text DEFAULT ''::text,
+    password text,
+    "tokenKey" text,
+    updated text DEFAULT ''::text,
+    username text,
+    verified boolean DEFAULT false
+);
+
+
+ALTER TABLE public.clients OWNER TO "user";
+
+--
+-- Name: demo1; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.demo1 (
+    created text DEFAULT ''::text,
+    id text NOT NULL,
+    updated text DEFAULT ''::text,
+    text text DEFAULT ''::text,
+    bool boolean DEFAULT false,
+    url text DEFAULT ''::text,
+    select_one text DEFAULT ''::text,
+    file_one text DEFAULT ''::text,
+    file_many text DEFAULT ''::text,
+    number real DEFAULT '0'::real,
+    email text DEFAULT ''::text,
+    datetime text DEFAULT ''::text,
+    "json" jsonb,
+    rel_one text DEFAULT ''::text,
+    select_many text DEFAULT ''::text,
+    rel_many jsonb DEFAULT '[]'::jsonb,
+    point jsonb DEFAULT '{"lat":0,"lon":0}'::jsonb
+);
+
+
+ALTER TABLE public.demo1 OWNER TO "user";
+
+--
+-- Name: demo2; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.demo2 (
+    created text DEFAULT ''::text,
+    id text NOT NULL,
+    title text DEFAULT ''::text,
+    updated text DEFAULT ''::text,
+    active boolean DEFAULT false
+);
+
+
+ALTER TABLE public.demo2 OWNER TO "user";
+
+--
+-- Name: demo3; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.demo3 (
+    created text DEFAULT ''::text,
+    id text NOT NULL,
+    title text DEFAULT ''::text,
+    updated text DEFAULT ''::text,
+    files text DEFAULT ''::text
+);
+
+
+ALTER TABLE public.demo3 OWNER TO "user";
+
+--
+-- Name: demo4; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.demo4 (
+    created text DEFAULT ''::text,
+    id text NOT NULL,
+    title text DEFAULT ''::text,
+    updated text DEFAULT ''::text,
+    rel_one_no_cascade text DEFAULT ''::text,
+    rel_one_no_cascade_required text DEFAULT ''::text,
+    rel_one_cascade text DEFAULT ''::text,
+    self_rel_one text DEFAULT ''::text,
+    "json_array" jsonb,
+    "json_object" jsonb,
+    rel_one_unique text DEFAULT ''::text,
+    rel_many_no_cascade jsonb DEFAULT '[]'::jsonb,
+    rel_many_no_cascade_required jsonb DEFAULT '[]'::jsonb,
+    rel_many_cascade jsonb DEFAULT '[]'::jsonb,
+    rel_many_unique jsonb DEFAULT '[]'::jsonb,
+    self_rel_many jsonb DEFAULT '[]'::jsonb
+);
+
+
+ALTER TABLE public.demo4 OWNER TO "user";
+
+--
+-- Name: demo5; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.demo5 (
+    created text DEFAULT ''::text,
+    id text NOT NULL,
+    rel_many jsonb DEFAULT '[]'::jsonb,
+    rel_one text DEFAULT ''::text,
+    select_many text DEFAULT ''::text,
+    select_one text DEFAULT ''::text,
+    updated text DEFAULT ''::text,
+    total real DEFAULT '0'::real,
+    file text DEFAULT ''::text
+);
+
+
+ALTER TABLE public.demo5 OWNER TO "user";
+
+--
+-- Name: nologin; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.nologin (
+    created text DEFAULT ''::text,
+    email text DEFAULT ''::text,
+    "emailVisibility" boolean DEFAULT false,
+    id text NOT NULL,
+    name text DEFAULT ''::text,
+    password text,
+    "tokenKey" text,
+    updated text DEFAULT ''::text,
+    username text,
+    verified boolean DEFAULT false
+);
+
+
+ALTER TABLE public.nologin OWNER TO "user";
+
+--
+-- Name: sqlite_stat1; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.sqlite_stat1 (
+    tbl text,
+    idx text,
+    stat text
+);
+
+
+ALTER TABLE public.sqlite_stat1 OWNER TO "user";
+
+--
+-- Name: sqlite_stat4; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.sqlite_stat4 (
+    tbl text,
+    idx text,
+    neq text,
+    nlt text,
+    ndlt text,
+    sample text
+);
+
+
+ALTER TABLE public.sqlite_stat4 OWNER TO "user";
+
+--
+-- Name: users; Type: TABLE; Schema: public; Owner: user
+--
+
+CREATE TABLE public.users (
+    avatar text DEFAULT ''::text,
+    created text DEFAULT ''::text,
+    email text DEFAULT ''::text,
+    "emailVisibility" boolean DEFAULT false,
+    id text NOT NULL,
+    name text DEFAULT ''::text,
+    password text,
+    "tokenKey" text,
+    updated text DEFAULT ''::text,
+    username text,
+    verified boolean DEFAULT false,
+    file text DEFAULT ''::text,
+    rel text DEFAULT ''::text
+);
+
+
+ALTER TABLE public.users OWNER TO "user";
+
+--
+-- Data for Name: "_authOrigins"; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public."_authOrigins" ("collectionRef", created, fingerprint, id, "recordRef", updated) FROM stdin;
+pbc_3142635823	2024-07-13 09:24:15.442Z	6afbfe481c31c08c55a746cccb88ece0	5f29jy38bf5zm3f	sywbhecnh46rhm0	2024-11-04 16:41:03.658Z
+pbc_3142635823	2024-07-26 12:10:47.102Z	22bbbcbed36e25321f384ccf99f60057	dmy260k6ksjr4ib	sbmbsdb40jyxf7h	2024-11-04 16:41:03.656Z
+pbc_3142635823	2024-07-26 12:11:38.697Z	6afbfe481c31c08c55a746cccb88ece0	ic55o70g4f8pcl4	sbmbsdb40jyxf7h	2024-11-04 16:41:03.654Z
+pbc_3142635823	2024-07-26 12:12:17.972Z	dc879cfc889d0f1c1f3258d6f3a828fe	5798yh833k6w6w0	sbmbsdb40jyxf7h	2024-11-04 16:41:03.650Z
+v851q4r790rhknl	2024-07-26 12:22:37.681Z	22bbbcbed36e25321f384ccf99f60057	9r2j0m74260ur8i	gk390qegs4y47wn	2024-07-26 12:22:37.681Z
+\.
+
+
+--
+-- Data for Name: _collections; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public._collections (id, system, type, name, fields, "listRule", "viewRule", "createRule", "updateRule", "deleteRule", options, created, updated, indexes) FROM stdin;
+_pb_users_auth_	f	auth	users	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"cost":10,"hidden":true,"id":"_pbf_auth_password_","max":0,"min":8,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"autogeneratePattern":"[a-zA-Z0-9_]{50}","hidden":true,"id":"_pbf_auth_tokenKey_","max":60,"min":30,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"_pbf_auth_email_","name":"email","onlyDomains":null,"presentable":false,"required":false,"system":true,"type":"email"},{"hidden":false,"id":"_pbf_auth_emailVisibility_","name":"emailVisibility","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"_pbf_auth_verified_","name":"verified","presentable":false,"required":false,"system":true,"type":"bool"},{"autogeneratePattern":"users[0-9]{5}","hidden":false,"id":"_pbf_auth_username_","max":150,"min":3,"name":"username","pattern":"^[\\\\w][\\\\w\\\\.\\\\-]*$","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"users_name","max":0,"min":0,"name":"name","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"users_avatar","maxSelect":1,"maxSize":5242880,"mimeTypes":["image/jpg","image/jpeg","image/png","image/svg+xml","image/gif"],"name":"avatar","presentable":false,"protected":false,"required":false,"system":false,"thumbs":["70x50","70x50t","70x50b","70x50f","0x50","70x0"],"type":"file"},{"hidden":false,"id":"xtecur3m","maxSelect":5,"maxSize":5242880,"mimeTypes":null,"name":"file","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"cascadeDelete":false,"collectionId":"sz5l5z67tg7gku0","hidden":false,"id":"lkeigvv3","maxSelect":1,"minSelect":0,"name":"rel","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]	\N	id = @request.auth.id		id = @request.auth.id	id = @request.auth.id	{"authRule":"","manageRule":null,"authAlert":{"enabled":true,"emailTemplate":{"subject":"Login from a new location","body":"\\u003cp\\u003eHello {RECORD:name}{RECORD:tokenKey},\\u003c/p\\u003e\\n\\u003cp\\u003eWe noticed a login to your {APP_NAME} account from a new location:\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003cem\\u003e{ALERT_INFO}\\u003c/em\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003eIf this was you, you may disregard this email.\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003cstrong\\u003eIf this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.\\u003c/strong\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}},"oauth2":{"providers":[{"pkce":null,"name":"gitlab","clientId":"test1","clientSecret":"test2","authURL":"","tokenURL":"","userInfoURL":"","displayName":"","extra":null},{"pkce":null,"name":"google","clientId":"test","clientSecret":"test2","authURL":"","tokenURL":"","userInfoURL":"","displayName":"","extra":null}],"mappedFields":{"id":"","name":"","username":"username","avatarURL":""},"enabled":true},"passwordAuth":{"enabled":true,"identityFields":["email","username"]},"mfa":{"enabled":true,"duration":1800,"rule":""},"otp":{"enabled":true,"duration":300,"length":8,"emailTemplate":{"subject":"OTP for {APP_NAME}","body":"\\u003cp\\u003eHello {RECORD:name}{RECORD:tokenKey},\\u003c/p\\u003e\\n\\u003cp\\u003eYour one-time password is: \\u003cstrong\\u003e{OTP}\\u003c/strong\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask for the one-time password, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}},"authToken":{"secret":"PjVU4hAV7CZIWbCByJHkDcMUlSEWCLI6M5aWSZOpEq0a3rYxKT","duration":1209600},"passwordResetToken":{"secret":"BC6jYPe4JXpQGGNzu6VXtYw0yhKoH2mh2ezIJClOJQuZYrd4Ol","duration":1800},"emailChangeToken":{"secret":"eON2TTJZiGCEi7mvUvwMLADj8CMHQzwZN3gmyMjQb24EY08ATP","duration":1800},"verificationToken":{"secret":"dgGGHlzzdCJ2C5MjXGoondllwSXkJHyL50FuvLvXGHNmBhvGKO","duration":604800},"fileToken":{"secret":"4Ax9zDm2Rwtny81dGaGQrJQBnIx5wVOuNe89X6v7NbNzrAZhvn","duration":180},"verificationTemplate":{"subject":"Verify your {APP_NAME} email","body":"\\u003cp\\u003eHello {RECORD:name}{RECORD:tokenKey},\\u003c/p\\u003e\\n\\u003cp\\u003eThank you for joining us at {APP_NAME}.\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to verify your email address.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eVerify\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"},"resetPasswordTemplate":{"subject":"Reset your {APP_NAME} password","body":"\\u003cp\\u003eHello {RECORD:name}{RECORD:tokenKey},\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to reset your password.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eReset password\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask to reset your password, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"},"confirmEmailChangeTemplate":{"subject":"Confirm your {APP_NAME} new email address","body":"\\u003cp\\u003eHello {RECORD:name}{RECORD:tokenKey},\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to confirm your new email address.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eConfirm new email\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask to change your email address, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}}	2022-10-10 09:49:46.145Z	2025-11-10 15:33:37.841Z	["CREATE UNIQUE INDEX \\"__pb_users_auth__username_idx\\" ON \\"users\\" (username)","CREATE UNIQUE INDEX \\"__pb_users_auth__email_idx\\" ON \\"users\\" (email) WHERE email != ''","CREATE UNIQUE INDEX \\"__pb_users_auth__tokenKey_idx\\" ON \\"users\\" (\\"tokenKey\\")","CREATE INDEX \\"__pb_users_auth__created_idx\\" ON \\"users\\" (\\"created\\")"]
+wsmn24bux7wo113	f	base	demo1	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"u7spsiph","max":0,"min":0,"name":"text","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"puk534el","name":"bool","presentable":false,"required":false,"system":false,"type":"bool"},{"exceptDomains":null,"hidden":false,"id":"ktas5n7b","name":"url","onlyDomains":null,"presentable":false,"required":false,"system":false,"type":"url"},{"hidden":false,"id":"dc4abz4i","maxSelect":1,"name":"select_one","presentable":false,"required":false,"system":false,"type":"select","values":["optionA","optionB","optionC"]},{"hidden":false,"id":"owtlq7zl","maxSelect":3,"name":"select_many","presentable":false,"required":false,"system":false,"type":"select","values":["optionA","optionB","optionC"]},{"hidden":false,"id":"4ulkdevf","maxSelect":1,"maxSize":5242880,"mimeTypes":null,"name":"file_one","presentable":false,"protected":true,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"fjzhrsvq","maxSelect":99,"maxSize":5242880,"mimeTypes":null,"name":"file_many","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"1z1ld0i5","max":null,"min":null,"name":"number","onlyInt":false,"presentable":false,"required":false,"system":false,"type":"number"},{"exceptDomains":null,"hidden":false,"id":"khvhpwgj","name":"email","onlyDomains":null,"presentable":false,"required":false,"system":false,"type":"email"},{"hidden":false,"id":"ro6p02gk","max":"","min":"","name":"datetime","presentable":false,"required":false,"system":false,"type":"date"},{"hidden":false,"id":"ei2fg4v1","maxSize":5242880,"name":"json","presentable":false,"required":false,"system":false,"type":"json"},{"cascadeDelete":false,"collectionId":"wsmn24bux7wo113","hidden":false,"id":"zaedritp","maxSelect":1,"minSelect":0,"name":"rel_one","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":true,"collectionId":"_pb_users_auth_","hidden":false,"id":"t9bpk2ug","maxSelect":9999,"minSelect":0,"name":"rel_many","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"geoPoint3081106212","name":"point","presentable":false,"required":false,"system":false,"type":"geoPoint"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]	\N	\N	\N	\N	\N	{}	2022-10-10 09:51:19.868Z	2025-04-02 11:04:29.260Z	["CREATE INDEX \\"_wsmn24bux7wo113_created_idx\\" ON \\"demo1\\" (\\"created\\")"]
+sz5l5z67tg7gku0	f	base	demo2	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"mkrguaaf","max":0,"min":2,"name":"title","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"hidden":false,"id":"izkl5z2s","name":"active","presentable":false,"required":false,"system":false,"type":"bool"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]						{}	2022-10-10 09:51:28.452Z	2023-03-20 16:39:25.211Z	["CREATE INDEX \\"idx_demo2_created\\" ON \\"demo2\\" (\\"created\\")","CREATE UNIQUE INDEX \\"idx_unique_demo2_title\\" on \\"demo2\\" (\\"title\\")","CREATE INDEX \\"idx_demo2_active\\" ON \\"demo2\\" (\\n\\"active\\"\\n)"]
+wzlqyes4orhoygb	f	base	demo3	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"w5z2x0nq","max":0,"min":0,"name":"title","pattern":"","presentable":true,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"tgqrbwio","maxSelect":99,"maxSize":5242880,"mimeTypes":null,"name":"files","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]	@request.auth.id != "" && @request.auth.collectionName != "users"	@request.auth.id != "" && @request.auth.collectionName != "users"	@request.auth.id != "" && @request.auth.collectionName != "users"	@request.auth.id != "" && @request.auth.collectionName != "users"	@request.auth.id != "" && @request.auth.collectionName != "users"	{}	2022-10-10 09:51:36.853Z	2023-11-20 18:26:53.176Z	["CREATE INDEX \\"_wzlqyes4orhoygb_created_idx\\" ON \\"demo3\\" (\\"created\\")"]
+4d1blo5cuycfaca	f	base	demo4	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"erkxnabw","max":0,"min":0,"name":"title","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"t5jskeyz","maxSelect":1,"minSelect":0,"name":"rel_one_no_cascade","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"ldrcjhk8","maxSelect":1,"minSelect":0,"name":"rel_one_no_cascade_required","presentable":false,"required":true,"system":false,"type":"relation"},{"cascadeDelete":true,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"pl5lcd4y","maxSelect":1,"minSelect":0,"name":"rel_one_cascade","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"jz0oue3z","maxSelect":999,"minSelect":0,"name":"rel_many_no_cascade","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"bsxyqrhb","maxSelect":999,"minSelect":0,"name":"rel_many_no_cascade_required","presentable":false,"required":true,"system":false,"type":"relation"},{"cascadeDelete":true,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"kwmchnf7","maxSelect":999,"minSelect":0,"name":"rel_many_cascade","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"pmynkqk5","maxSelect":1,"minSelect":0,"name":"rel_one_unique","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"mjzyk9vb","maxSelect":999,"minSelect":0,"name":"rel_many_unique","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"4d1blo5cuycfaca","hidden":false,"id":"dagiyxj4","maxSelect":1,"minSelect":0,"name":"self_rel_one","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"4d1blo5cuycfaca","hidden":false,"id":"tsrki8kc","maxSelect":999,"minSelect":0,"name":"self_rel_many","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"4wpx0hhx","maxSize":5242880,"name":"json_array","presentable":false,"required":false,"system":false,"type":"json"},{"hidden":false,"id":"ufpwiqnx","maxSize":5242880,"name":"json_object","presentable":false,"required":false,"system":false,"type":"json"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]			@request.auth.collectionName = 'users'	@request.auth.collectionName = 'users'		{}	2022-10-10 09:51:47.770Z	2024-09-01 12:15:28.332Z	["CREATE INDEX \\"_4d1blo5cuycfaca_created_idx\\" ON \\"demo4\\" (\\"created\\")","CREATE UNIQUE INDEX \\"idx_luoQV2A\\" ON \\"demo4\\" (\\"rel_one_unique\\") WHERE rel_one_unique != ''","CREATE UNIQUE INDEX \\"idx_IjL94ze\\" ON \\"demo4\\" ((\\"rel_many_unique\\" #>> '{}')) WHERE rel_many_unique::text != '[]'"]
+v851q4r790rhknl	f	auth	clients	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"cost":10,"hidden":true,"id":"_pbf_auth_password_","max":0,"min":8,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"autogeneratePattern":"[a-zA-Z0-9_]{50}","hidden":true,"id":"_pbf_auth_tokenKey_","max":60,"min":30,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"_pbf_auth_email_","name":"email","onlyDomains":null,"presentable":false,"required":true,"system":true,"type":"email"},{"hidden":false,"id":"_pbf_auth_emailVisibility_","name":"emailVisibility","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"_pbf_auth_verified_","name":"verified","presentable":false,"required":false,"system":true,"type":"bool"},{"autogeneratePattern":"users[0-9]{5}","hidden":false,"id":"_pbf_auth_username_","max":150,"min":3,"name":"username","pattern":"^[\\\\w][\\\\w\\\\.\\\\-]*$","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"lacorw19","max":0,"min":0,"name":"name","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]	\N	\N	\N	\N	\N	{"authRule":"verified=true","manageRule":null,"authAlert":{"enabled":true,"emailTemplate":{"subject":"Login from a new location","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eWe noticed a login to your {APP_NAME} account from a new location:\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003cem\\u003e{ALERT_INFO}\\u003c/em\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003cstrong\\u003eIf this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.\\u003c/strong\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003eIf this was you, you may disregard this email.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}},"oauth2":{"providers":[],"mappedFields":{"id":"","name":"","username":"username","avatarURL":""},"enabled":false},"passwordAuth":{"enabled":true,"identityFields":["email","username"]},"mfa":{"enabled":false,"duration":1800,"rule":""},"otp":{"enabled":false,"duration":300,"length":8,"emailTemplate":{"subject":"OTP for {APP_NAME}","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eYour one-time password is: \\u003cstrong\\u003e{OTP}\\u003c/strong\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask for the one-time password, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}},"authToken":{"secret":"PjVU4hAV7CZIWbCByJHkDcMUlSEWCLI6M5aWSZOpEq0a3rYxKT","duration":1209600},"passwordResetToken":{"secret":"BC6jYPe4JXpQGGNzu6VXtYw0yhKoH2mh2ezIJClOJQuZYrd4Ol","duration":1800},"emailChangeToken":{"secret":"eON2TTJZiGCEi7mvUvwMLADj8CMHQzwZN3gmyMjQb24EY08ATP","duration":1800},"verificationToken":{"secret":"dgGGHlzzdCJ2C5MjXGoondllwSXkJHyL50FuvLvXGHNmBhvGKO","duration":604800},"fileToken":{"secret":"4Ax9zDm2Rwtny81dGaGQrJQBnIx5wVOuNe89X6v7NbNzrAZhvn","duration":180},"verificationTemplate":{"subject":"Verify your {APP_NAME} email","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eThank you for joining us at {APP_NAME}.\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to verify your email address.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eVerify\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"},"resetPasswordTemplate":{"subject":"Reset your {APP_NAME} password","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to reset your password.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eReset password\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask to reset your password, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"},"confirmEmailChangeTemplate":{"subject":"Confirm your {APP_NAME} new email address","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to confirm your new email address.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eConfirm new email\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask to change your email address, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}}	2022-10-11 09:41:36.712Z	2025-11-10 15:33:30.519Z	["CREATE UNIQUE INDEX \\"_v851q4r790rhknl_username_idx\\" ON \\"clients\\" (username)","CREATE UNIQUE INDEX \\"_v851q4r790rhknl_email_idx\\" ON \\"clients\\" (email) WHERE email != ''","CREATE UNIQUE INDEX \\"_v851q4r790rhknl_tokenKey_idx\\" ON \\"clients\\" (\\"tokenKey\\")","CREATE INDEX \\"_v851q4r790rhknl_created_idx\\" ON \\"clients\\" (\\"created\\")"]
+kpv709sk2lqbqk8	t	auth	nologin	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"cost":10,"hidden":true,"id":"_pbf_auth_password_","max":0,"min":8,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"autogeneratePattern":"[a-zA-Z0-9_]{50}","hidden":true,"id":"_pbf_auth_tokenKey_","max":60,"min":30,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"_pbf_auth_email_","name":"email","onlyDomains":null,"presentable":false,"required":true,"system":true,"type":"email"},{"hidden":false,"id":"_pbf_auth_emailVisibility_","name":"emailVisibility","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"_pbf_auth_verified_","name":"verified","presentable":false,"required":false,"system":true,"type":"bool"},{"autogeneratePattern":"users[0-9]{5}","hidden":false,"id":"_pbf_auth_username_","max":150,"min":3,"name":"username","pattern":"^[\\\\w][\\\\w\\\\.\\\\-]*$","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"x8zzktwe","max":0,"min":0,"name":"name","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]						{"authRule":"","manageRule":"@request.auth.collectionName = 'users'","authAlert":{"enabled":true,"emailTemplate":{"subject":"Login from a new location","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eWe noticed a login to your {APP_NAME} account from a new location:\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003cem\\u003e{ALERT_INFO}\\u003c/em\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003cstrong\\u003eIf this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.\\u003c/strong\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003eIf this was you, you may disregard this email.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}},"oauth2":{"providers":[{"pkce":null,"name":"gitlab","clientId":"test","clientSecret":"test","authURL":"","tokenURL":"","userInfoURL":"","displayName":"","extra":null}],"mappedFields":{"id":"","name":"","username":"username","avatarURL":""},"enabled":false},"passwordAuth":{"enabled":false,"identityFields":["email"]},"mfa":{"enabled":false,"duration":1800,"rule":""},"otp":{"enabled":false,"duration":300,"length":8,"emailTemplate":{"subject":"OTP for {APP_NAME}","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eYour one-time password is: \\u003cstrong\\u003e{OTP}\\u003c/strong\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask for the one-time password, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}},"authToken":{"secret":"PjVU4hAV7CZIWbCByJHkDcMUlSEWCLI6M5aWSZOpEq0a3rYxKT","duration":1209600},"passwordResetToken":{"secret":"BC6jYPe4JXpQGGNzu6VXtYw0yhKoH2mh2ezIJClOJQuZYrd4Ol","duration":1800},"emailChangeToken":{"secret":"eON2TTJZiGCEi7mvUvwMLADj8CMHQzwZN3gmyMjQb24EY08ATP","duration":1800},"verificationToken":{"secret":"dgGGHlzzdCJ2C5MjXGoondllwSXkJHyL50FuvLvXGHNmBhvGKO","duration":604800},"fileToken":{"secret":"4Ax9zDm2Rwtny81dGaGQrJQBnIx5wVOuNe89X6v7NbNzrAZhvn","duration":180},"verificationTemplate":{"subject":"Verify your {APP_NAME} email","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eThank you for joining us at {APP_NAME}.\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to verify your email address.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eVerify\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"},"resetPasswordTemplate":{"subject":"Reset your {APP_NAME} password","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to reset your password.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eReset password\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask to reset your password, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"},"confirmEmailChangeTemplate":{"subject":"Confirm your {APP_NAME} new email address","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to confirm your new email address.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eConfirm new email\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask to change your email address, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}}	2022-10-12 10:39:21.294Z	2025-11-10 15:34:06.288Z	["CREATE UNIQUE INDEX \\"_kpv709sk2lqbqk8_username_idx\\" ON \\"nologin\\" (username)","CREATE UNIQUE INDEX \\"_kpv709sk2lqbqk8_email_idx\\" ON \\"nologin\\" (email) WHERE email != ''","CREATE UNIQUE INDEX \\"_kpv709sk2lqbqk8_tokenKey_idx\\" ON \\"nologin\\" (\\"tokenKey\\")","CREATE INDEX \\"_kpv709sk2lqbqk8_created_idx\\" ON \\"nologin\\" (\\"created\\")"]
+9n89pl5vkct6330	f	base	demo5	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"sozvpexq","maxSelect":1,"name":"select_one","presentable":false,"required":false,"system":false,"type":"select","values":["a","b","c","d"]},{"hidden":false,"id":"qlq1nxlc","maxSelect":5,"name":"select_many","presentable":false,"required":false,"system":false,"type":"select","values":["a","b","c","d","e"]},{"cascadeDelete":false,"collectionId":"4d1blo5cuycfaca","hidden":false,"id":"ajrrsq1a","maxSelect":1,"minSelect":0,"name":"rel_one","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"4d1blo5cuycfaca","hidden":false,"id":"soxhs0ou","maxSelect":5,"minSelect":0,"name":"rel_many","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"kvbyzuqj","max":null,"min":null,"name":"total","onlyInt":false,"presentable":false,"required":false,"system":false,"type":"number"},{"hidden":false,"id":"ob7dsrcl","maxSelect":1,"maxSize":5242880,"mimeTypes":null,"name":"file","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]	select_many:length = 3	rel_many.self_rel_many.rel_many_cascade.files:length = 1	@request.body.total = 3	@request.body.total = 3	@request.query.test:isset = true	{}	2023-01-07 13:13:08.733Z	2023-04-04 13:10:52.723Z	["CREATE INDEX \\"_9n89pl5vkct6330_created_idx\\" ON \\"demo5\\" (\\"created\\")"]
+v9gwnfh02gjq1q0	f	view	view1	[{"autogeneratePattern":"","hidden":false,"id":"text3208210256","max":0,"min":0,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"_clone_r09R","max":0,"min":0,"name":"text","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"_clone_8o57","name":"bool","presentable":false,"required":false,"system":false,"type":"bool"},{"exceptDomains":null,"hidden":false,"id":"_clone_y2Ow","name":"url","onlyDomains":null,"presentable":false,"required":false,"system":false,"type":"url"},{"hidden":false,"id":"_clone_jFNd","maxSelect":1,"name":"select_one","presentable":false,"required":false,"system":false,"type":"select","values":["optionA","optionB","optionC"]},{"hidden":false,"id":"_clone_mNKL","maxSelect":3,"name":"select_many","presentable":false,"required":false,"system":false,"type":"select","values":["optionA","optionB","optionC"]},{"hidden":false,"id":"_clone_diFB","maxSelect":1,"maxSize":5242880,"mimeTypes":null,"name":"file_one","presentable":false,"protected":true,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"_clone_dViH","maxSelect":99,"maxSize":5242880,"mimeTypes":null,"name":"file_many","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"_clone_dIjh","max":null,"min":null,"name":"number","onlyInt":false,"presentable":false,"required":false,"system":false,"type":"number"},{"exceptDomains":null,"hidden":false,"id":"_clone_5R4l","name":"email","onlyDomains":null,"presentable":false,"required":false,"system":false,"type":"email"},{"hidden":false,"id":"_clone_LZkS","max":"","min":"","name":"datetime","presentable":false,"required":false,"system":false,"type":"date"},{"hidden":false,"id":"_clone_yiCN","maxSize":5242880,"name":"json","presentable":false,"required":false,"system":false,"type":"json"},{"cascadeDelete":false,"collectionId":"wsmn24bux7wo113","hidden":false,"id":"_clone_UJXf","maxSelect":1,"minSelect":0,"name":"rel_one","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":true,"collectionId":"_pb_users_auth_","hidden":false,"id":"_clone_0li1","maxSelect":9999,"minSelect":0,"name":"rel_many","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"_clone_VWxh","name":"point","presentable":false,"required":false,"system":false,"type":"geoPoint"},{"hidden":false,"id":"_clone_b5hm","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"}]	@request.auth.id != "" && bool = true	@request.auth.id != "" && bool = true	\N	\N	\N	{"viewQuery":"select id, text, bool, url, select_one, select_many, file_one, file_many, number, email, datetime, json, rel_one, rel_many, point, created from demo1"}	2023-02-12 18:58:12.315Z	2025-10-23 11:42:16.302Z	[]
+ib3m2700k5hlsjz	f	view	view2	[{"autogeneratePattern":"","hidden":false,"id":"text3208210256","max":0,"min":0,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"_clone_77Ik","name":"state","presentable":false,"required":false,"system":false,"type":"bool"},{"hidden":false,"id":"_clone_IbSu","maxSelect":99,"maxSize":5242880,"mimeTypes":null,"name":"file_many","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"cascadeDelete":true,"collectionId":"_pb_users_auth_","hidden":false,"id":"_clone_Asz0","maxSelect":9999,"minSelect":0,"name":"rel_many","presentable":false,"required":false,"system":false,"type":"relation"}]			\N	\N	\N	{"viewQuery":"SELECT view1.id, view1.bool as state, view1.file_many, view1.rel_many from view1\\n"}	2023-02-17 19:42:54.278Z	2024-11-19 15:29:43.857Z	[]
+zahsr9d2mix2fvk	f	view	numeric_id_view	[{"autogeneratePattern":"","hidden":false,"id":"text3208210256","max":0,"min":0,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"_clone_jO9O","name":"email","onlyDomains":null,"presentable":false,"required":true,"system":true,"type":"email"}]			\N	\N	\N	{"viewQuery":"select (ROW_NUMBER() OVER()) as id, email from clients"}	2023-08-11 09:41:00.997Z	2024-11-19 15:29:43.901Z	[]
+pbc_3142635823	t	auth	_superusers	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"cost":0,"hidden":true,"id":"password901924565","max":0,"min":8,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"autogeneratePattern":"[a-zA-Z0-9_]{50}","hidden":true,"id":"text2504183744","max":60,"min":30,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"email3885137012","name":"email","onlyDomains":null,"presentable":false,"required":true,"system":true,"type":"email"},{"hidden":false,"id":"bool1547992806","name":"emailVisibility","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"bool256245529","name":"verified","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"}]	\N	\N	\N	\N	\N	{"authRule":"","manageRule":null,"authAlert":{"enabled":true,"emailTemplate":{"subject":"Login from a new location","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eWe noticed a login to your {APP_NAME} account from a new location:\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003cem\\u003e{ALERT_INFO}\\u003c/em\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003cstrong\\u003eIf this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.\\u003c/strong\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003eIf this was you, you may disregard this email.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}},"oauth2":{"providers":null,"mappedFields":{"id":"","name":"","username":"","avatarURL":""},"enabled":false},"passwordAuth":{"enabled":true,"identityFields":["email"]},"mfa":{"enabled":false,"duration":1800,"rule":""},"otp":{"enabled":false,"duration":300,"length":8,"emailTemplate":{"subject":"OTP for {APP_NAME}","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eYour one-time password is: \\u003cstrong\\u003e{OTP}\\u003c/strong\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask for the one-time password, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}},"authToken":{"secret":"MyN3nDlzmHnuCjd35vb6cyIdqNr7Os0PmgiPVDMxmbFToSpBvS","duration":1209600},"passwordResetToken":{"secret":"fPSpFm9rxjj4mdeWYfyQ5OZQ4UWpyainTO0dqrJe3LHEYEDduq","duration":1800},"emailChangeToken":{"secret":"unYNiYeuIxH7BCV09NIb81abe2bkPgaexMYdDQ6uOOIFh74urD","duration":1800},"verificationToken":{"secret":"uhr68rXLVjPBWALFtw8uEHeQwDdN4t0MiTLr2pBWVkEQnNICe1","duration":259200},"fileToken":{"secret":"sjJAjTNPrOcRDmnIKwQm7qY9FyjuXTG5KNcaqw4U1TSDVfu4r9","duration":180},"verificationTemplate":{"subject":"Verify your {APP_NAME} email","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eThank you for joining us at {APP_NAME}.\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to verify your email address.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eVerify\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"},"resetPasswordTemplate":{"subject":"Reset your {APP_NAME} password","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to reset your password.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eReset password\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask to reset your password, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"},"confirmEmailChangeTemplate":{"subject":"Confirm your {APP_NAME} new email address","body":"\\u003cp\\u003eHello,\\u003c/p\\u003e\\n\\u003cp\\u003eClick on the button below to confirm your new email address.\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  \\u003ca class=\\"btn\\" href=\\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\\" target=\\"_blank\\" rel=\\"noopener\\"\\u003eConfirm new email\\u003c/a\\u003e\\n\\u003c/p\\u003e\\n\\u003cp\\u003e\\u003ci\\u003eIf you didn't ask to change your email address, you can ignore this email.\\u003c/i\\u003e\\u003c/p\\u003e\\n\\u003cp\\u003e\\n  Thanks,\\u003cbr/\\u003e\\n  {APP_NAME} team\\n\\u003c/p\\u003e"}}	2024-06-20 09:29:22.826Z	2025-11-10 15:33:49.591Z	["CREATE UNIQUE INDEX \\"idx_tokenKey__pbc_3323866339\\" ON \\"_superusers\\" (\\"tokenKey\\")","CREATE UNIQUE INDEX \\"idx_email__pbc_3323866339\\" ON \\"_superusers\\" (\\"email\\") WHERE \\"email\\" != ''"]
+pbc_2281828961	t	base	_externalAuths	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text455797646","max":0,"min":0,"name":"collectionRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text127846527","max":0,"min":0,"name":"recordRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text2462348188","max":0,"min":0,"name":"provider","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text1044722854","max":0,"min":0,"name":"providerId","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"}]	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	\N	\N	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	{}	2024-06-20 09:29:22.862Z	2024-07-31 16:33:51.596Z	["CREATE UNIQUE INDEX \\"idx_externalAuths_record_provider\\" ON \\"externalAuths\\" (\\"collectionRef\\", \\"recordRef\\", provider)","CREATE UNIQUE INDEX \\"idx_externalAuths_collection_provider\\" ON \\"externalAuths\\" (\\"collectionRef\\", provider, \\"providerId\\")"]
+pbc_2279338944	t	base	_mfas	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text455797646","max":0,"min":0,"name":"collectionRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text127846527","max":0,"min":0,"name":"recordRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text1582905952","max":0,"min":0,"name":"method","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"}]	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	\N	\N	\N	{}	2024-06-20 09:29:22.894Z	2024-10-24 18:34:35.352Z	["CREATE INDEX \\"idx_mfas_collectionRef_recordRef\\" ON \\"mfas\\" (\\n  \\"collectionRef\\",\\n  \\"recordRef\\"\\n)"]
+pbc_1638494021	t	base	_otps	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text455797646","max":0,"min":0,"name":"collectionRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text127846527","max":0,"min":0,"name":"recordRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"cost":8,"hidden":true,"id":"password901924565","max":0,"min":0,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"},{"autogeneratePattern":"","hidden":true,"id":"text3866985172","max":0,"min":0,"name":"sentTo","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":true,"type":"text"}]	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	\N	\N	\N	{}	2024-06-20 09:29:22.901Z	2024-11-19 15:29:43.633Z	["CREATE INDEX \\"idx_otps_collectionRef_recordRef\\" ON \\"otps\\" (\\n  \\"collectionRef\\",\\n  \\"recordRef\\"\\n)"]
+pbc_4275539003	t	base	_authOrigins	[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text455797646","max":0,"min":0,"name":"collectionRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text127846527","max":0,"min":0,"name":"recordRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text4228609354","max":0,"min":0,"name":"fingerprint","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"}]	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	\N	\N	@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId	{}	2024-06-20 12:10:52.542Z	2024-07-31 16:32:24.722Z	["CREATE UNIQUE INDEX \\"idx_authOrigins_unique_pairs\\" ON \\"authDevices\\" (\\"collectionRef\\", \\"recordRef\\", fingerprint)"]
+\.
+
+
+--
+-- Data for Name: "_externalAuths"; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public."_externalAuths" ("collectionRef", created, id, provider, "providerId", "recordRef", updated) FROM stdin;
+_pb_users_auth_	2023-01-01 01:02:03.456Z	clmflokuq1xl341	google	test123	4q1xlclmfloku33	2022-01-01 01:01:01.123Z
+_pb_users_auth_	2022-01-01 01:01:01.123Z	dlmflokuq1xl342	gitlab	test123	4q1xlclmfloku33	2022-01-01 01:01:01.123Z
+v851q4r790rhknl	2024-07-29 11:56:28.439Z	f1z5b3843pzc964	google	test456	gk390qegs4y47wn	2024-07-29 11:56:35.151Z
+_pb_users_auth_	2024-07-29 11:57:28.598Z	5eto7nmys833164	github	test456	bgs820n361vj1qd	2024-07-29 11:57:28.598Z
+\.
+
+
+--
+-- Data for Name: _mfas; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public._mfas ("collectionRef", created, id, method, "recordRef", updated) FROM stdin;
+\.
+
+
+--
+-- Data for Name: _migrations; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public._migrations (file, applied) FROM stdin;
+1640988000_init.go	1665395386
+1673167670_multi_match_migrate.go	1674485474882542
+1677152688_rename_authentik_to_oidc.go	1678107894196945
+1679943780_normalize_single_multiple_values.go	1680612240224966
+1679943781_add_indexes_column.go	1680612240225611
+1685164450_check_fk.go	1691746422498469
+1689579878_renormalize_single_multiple_values.go	1691746422518206
+1690319366_reset_null_values.go	1691746422524214
+1690454337_transform_relations_to_views.go	1691746422528322
+1691746861_created_view3.js	1691746861006404
+1691746871_updated_view3.js	1691746871088040
+1691746903_updated_view3.js	1691746903261135
+1691747509_updated_numeric_id_view.js	1691747509618098
+1691747531_updated_numeric_id_view.js	1691747531135925
+1691747757_updated_numeric_id_view.js	1691747757587507
+1691747912_resave_views.go	1691748137353973
+1691747913_resave_views.go	1700504813174477
+1692609521_copy_display_fields.go	1700504813176541
+1701496825_allow_single_oauth2_provider_in_multiple_auth_collections.go	1701851393247905
+1702134272_set_default_json_max_size.go	1702153002153382
+1717233556_v0.23_migrate.go	1718885452550907
+1719427055_updated_nologin.js	1719427055398268
+1719427146_updated_users.js	1719427146443227
+1719427201_updated_users.js	1719427201183755
+1719427256_updated_users.js	1719427256670615
+1719590348_updated_clients.js	1719590348495815
+1720595195_updated_superusers.js	1720595195991995
+1720862691_updated_numeric_id_view.js	1720862691263317
+1720862697_updated_numeric_id_view.js	1720862697604141
+1720862718_updated_view1.js	1720862718468637
+1720862724_updated_view1.js	1720862724486655
+1720862730_updated_view2.js	1720862730874909
+1720862738_updated_view2.js	1720862738769086
+1720862814_updated_numeric_id_view.js	1720862814980193
+1720862822_updated_numeric_id_view.js	1720862822105793
+1720863228_updated_numeric_id_view.js	1720863228586333
+1720863270_updated_numeric_id_view.js	1720863270461984
+1720863324_updated_numeric_id_view.js	1720863324872674
+1720865157_updated_numeric_id_view.js	1720865157366879
+1720865165_updated_view1.js	1720865165743836
+1720865172_updated_view2.js	1720865172373325
+1720865176_updated_view2.js	1720865176952277
+1720865181_updated_view1.js	1720865181999132
+1720865200_updated_view2.js	1720865200364699
+1721987625_updated_authOrigins.js	1721987625054154
+1721987631_updated_authOrigins.js	1721987631008720
+1721987781_updated_authOrigins.js	1721987781298849
+1721987788_updated_authOrigins.js	1721987788166593
+1722443467_updated_otps.js	1722443467352142
+1722443484_updated_mfas.js	1722443484760600
+1722443494_updated_mfas.js	1722443494222859
+1722443544_updated_authOrigins.js	1722443544810664
+1722443631_updated_externalAuths.js	1722443631679710
+1722443663_updated_superusers.js	1722443663936374
+1724072848_updated_superusers.js	1724072848003576
+1725192864_updated_view2.js	1725192864550539
+1725192864_updated_view1.js	1725192864554724
+1725192864_updated_demo1.js	1725192864567727
+1725192928_updated_demo4.js	1725192928513955
+1725792578_updated__superusers.js	1725792578533745
+1726224305_updated_users.js	1726224305917687
+1726224493_updated_users.js	1726224493523356
+1640988000_aux_init.go	1729794875351351
+1717233557_v0.23_migrate2.go	1729794875412697
+1717233558_v0.23_migrate3.go	1730738463660106
+1717233559_v0.23_migrate4.go	1732030183936141
+1743591869_updated_demo1.js	1743591869355669
+1761219736_updated_view1.js	1761219736410514
+1762785011_update_default_auth_alert_templates.go	1762787986774549
+1762788048_updated_users.js	1762788048394996
+1762788810_updated_clients.js	1762788810586927
+1762788817_updated_users.js	1762788817890021
+1762788829_updated__superusers.js	1762788829638737
+1762788846_updated_nologin.js	1762788846329028
+\.
+
+
+--
+-- Data for Name: _otps; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public._otps ("collectionRef", created, id, password, "recordRef", updated, "sentTo") FROM stdin;
+\.
+
+
+--
+-- Data for Name: _params; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public._params (created, id, updated, value) FROM stdin;
+\.
+
+
+--
+-- Data for Name: _superusers; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public._superusers (created, email, "emailVisibility", id, password, "tokenKey", updated, verified) FROM stdin;
+2022-10-10 09:50:06.449Z	test@example.com	f	sywbhecnh46rhm0	$2a$13$6PP1fpShEsQHpZElw4.BN.vMl/2CMIKc2kpumJM//T4qV4RGUgb6i	O4rvW9FSUyTA3xUuQmXR3wHF2db9bHs19nBHeSgVTxerOsTAl4	2022-10-10 09:50:06.449Z	t
+2022-10-10 11:22:27.982Z	test2@example.com	f	sbmbsdb40jyxf7h	$2a$13$1U32ttl.v1VtQkIH.a.z2.VVrU2IFwkW41TnY2OgyMcjADv34ynMK	cvg1nk1dKRFlazQH8nCKuFYwczdReQx6ZJimxXvei0uDyTkgEb	2022-10-10 11:22:31.096Z	t
+2022-10-10 11:22:50.693Z	test3@example.com	f	9q2trqumvlyr3bd	$2a$13$gqXkfs0WjqTtUNRjRDxAHuLul1sxmA.elEfYuL0KT0ef5cMDt9Fjm	ezLvEu7DRFtUp9BI6nxtXCpgtp7qWaNQLdD6dDwjIVB0mA0uUr	2022-10-10 11:22:54.907Z	t
+2024-07-26 12:17:43.787Z	test4@example.com	f	q911776rrfy658l	$2a$10$0CUWH81tPWUhxKqksZnO/eDfJiWTTG/xg7v5Yg8RhcLIGWY3oeCHe	B4LS_3ZiIlL_TQ97_W_u2_82__W1_l64037w_x211_F_BM_J4_	2024-07-26 12:17:43.787Z	t
+\.
+
+
+--
+-- Data for Name: clients; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.clients (created, email, "emailVisibility", id, name, password, "tokenKey", updated, username, verified) FROM stdin;
+2022-10-11 09:42:15.113Z	test@example.com	f	gk390qegs4y47wn		$2a$13$utsLtiNVf226R7hhXXyOM.kHTyTcVLRNqTIrT44Fw8JZbxMhIK0uu	rMb1gUpn27s53t66gOGscSHfYsa272cgOgn4nhTZIl4fIC8XP8	2022-10-11 09:42:15.113Z	clients57772	t
+2022-10-11 09:42:25.984Z	test2@example.com	f	o1y0dd0spd786md	test_name	$2a$13$D/8j2Q7NzN5g/INiVn8qPOa2O3qkyZj7U82CXOyqzBFV0B9OdWhvC	RunSD73nFfH3sNScreizPcZYNkiPls2YjmFYPNo73cWKsDnZVm	2022-10-14 11:44:33.150Z	clients43362	f
+\.
+
+
+--
+-- Data for Name: demo1; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.demo1 (created, id, updated, text, bool, url, select_one, file_one, file_many, number, email, datetime, "json", rel_one, select_many, rel_many, point) FROM stdin;
+2022-10-14 10:13:12.397Z	84nmscqy84lsi1t	2023-01-04 20:11:20.732Z	test	t	https://example.copm	optionB	test_d61b33QdDU.txt	["test_QZFjKjXchk.txt","300_WlbFWSGmW9.png","logo_vcfJJG5TAh.svg","test_MaWC6mWyrP.txt","test_tC1Yc87DfC.txt"]	123456	test@example.com	2022-10-01 12:00:00.000Z	[\r\n  1,\r\n  2,\r\n  3\r\n]		["optionB","optionC"]	["oap640cot4yru2s"]	{"lat":0,"lon":0}
+2022-10-14 10:14:04.685Z	al1h9ijdeojtsjy	2025-04-02 11:05:26.292Z	test2	f		optionB	300_Jsjq7RdBgA.png	[]	456	test2@example.com		null	84nmscqy84lsi1t	["optionB"]	["bgs820n361vj1qd","4q1xlclmfloku33","oap640cot4yru2s"]	{"lon":23.333157,"lat":42.654318}
+2022-10-14 10:36:21.012Z	imy661ixudk5izi	2025-04-02 11:05:03.433Z	lorem ipsum	f				[]	0			null		[]	[]	{"lon":-74.006015,"lat":40.712728}
+\.
+
+
+--
+-- Data for Name: demo2; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.demo2 (created, id, title, updated, active) FROM stdin;
+2022-10-12 11:42:51.509Z	llvuca81nly1qls	test1	2022-10-12 11:42:51.509Z	f
+2022-10-12 11:42:55.076Z	achvryl401bhse3	test2	2022-10-14 10:52:46.726Z	t
+2022-10-12 11:42:58.215Z	0yxhwia2amd8gec	test3	2022-10-14 10:52:49.596Z	t
+\.
+
+
+--
+-- Data for Name: demo3; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.demo3 (created, id, title, updated, files) FROM stdin;
+2022-10-14 11:41:09.381Z	1tmknxy2868d869	test1	2022-10-14 11:41:09.381Z	[]
+2022-10-14 11:41:12.548Z	lcl9d87w22ml6jy	test2	2022-10-14 14:08:29.095Z	["test_FLurQTgrY8.txt","300_UhLKX91HVb.png"]
+2022-10-14 11:41:15.689Z	7nwo8tuiatetxdm	test3	2022-10-14 14:08:16.072Z	["test_JnXeKEwgwr.txt"]
+2022-10-14 11:41:18.877Z	mk5fmymtx4wsprk	test4	2022-10-14 14:08:06.446Z	["300_JdfBOieXAW.png"]
+\.
+
+
+--
+-- Data for Name: demo4; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.demo4 (created, id, title, updated, rel_one_no_cascade, rel_one_no_cascade_required, rel_one_cascade, self_rel_one, "json_array", "json_object", rel_one_unique, rel_many_no_cascade, rel_many_no_cascade_required, rel_many_cascade, rel_many_unique, self_rel_many) FROM stdin;
+2022-10-14 14:15:43.771Z	qzaqccwrmva4o1n	test1	2022-10-20 19:23:59.427Z	mk5fmymtx4wsprk	lcl9d87w22ml6jy	7nwo8tuiatetxdm	i9naidtvr6qsgb4	[\r\n  1\r\n]	{"a": 123}		["1tmknxy2868d869"]	["lcl9d87w22ml6jy","1tmknxy2868d869"]	["mk5fmymtx4wsprk"]	[]	["i9naidtvr6qsgb4","qzaqccwrmva4o1n"]
+2022-10-14 17:35:18.647Z	i9naidtvr6qsgb4	test2	2022-10-20 19:23:39.645Z		lcl9d87w22ml6jy		qzaqccwrmva4o1n	[1, 2, 3]	{"a": {"b": "test"}}		[]	["7nwo8tuiatetxdm"]	[]	[]	[]
+\.
+
+
+--
+-- Data for Name: demo5; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.demo5 (created, id, rel_many, rel_one, select_many, select_one, updated, total, file) FROM stdin;
+2023-01-07 13:13:24.249Z	qjeql998mtp1azp	["qzaqccwrmva4o1n","i9naidtvr6qsgb4"]	i9naidtvr6qsgb4	["b","c","a"]	b	2023-02-18 11:51:08.128Z	0	logo_vcf_jjg5_tah_9MtIHytOmZ.svg
+2023-01-07 13:13:28.337Z	la4y2w4o98acwuj	[]		[]		2023-02-18 11:50:46.943Z	2	300_uh_lkx91_hvb_Da8K5pl069.png
+\.
+
+
+--
+-- Data for Name: nologin; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.nologin (created, email, "emailVisibility", id, name, password, "tokenKey", updated, username, verified) FROM stdin;
+2022-10-12 10:39:47.633Z	test@example.com	f	dc49k6jgejn40h3	test	$2a$13$395zl/w/nUmeo.vov5t6SO0/RsoE4suJnKLN2SzP41sJCe6PBAePq	6mi4JvnX8uIxS7JiO8LWl150Af8mnAGWkWRImHL2YB4XhOYf9c	2022-10-12 10:39:47.633Z	test_username	f
+2022-10-12 10:39:59.058Z	test2@example.com	t	phhq3wr65cap535		$2a$13$ldkBOjQbXIXP3.xvJ8AXJep5I3kMzmXWu7wC75mP5RN4qK7mwQIK.	9Bsj2ogZ5b0Q3daAKZ5ZZrUuVb7lWHO0YDD4d5TbPCLfYE3COY	2022-10-14 12:03:49.335Z	viewers74618	f
+2022-10-14 12:16:52.515Z	test3@example.com	f	oos036e9xvqeexy		$2a$13$oXNjS0xVi4aYHSaQ10bTOOMRvVFBY2t474S3UjM8.5BNnL5WB1Gce	uYafEN2cDgImHKMW4SfZ6tayrENAJVVWOTDxFXatOs2AO0KEMY	2022-10-14 12:16:52.515Z	nologin84738	t
+\.
+
+
+--
+-- Data for Name: sqlite_stat1; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.sqlite_stat1 (tbl, idx, stat) FROM stdin;
+authOrigins	idx_authOrigins_unique_pairs	7 4 3 1
+authOrigins	sqlite_autoindex_authOrigins_1	7 1
+_params	sqlite_autoindex__params_1	1 1
+externalAuths	idx_externalAuths_collection_provider	4 2 1 1
+externalAuths	idx_externalAuths_record_provider	4 2 2 1
+externalAuths	sqlite_autoindex_externalAuths_1	4 1
+superusers	sqlite_autoindex_superusers_1	4 1
+demo5	_9n89pl5vkct6330_created_idx	2 1
+demo5	sqlite_autoindex_demo5_1	2 1
+users	__pb_users_auth__created_idx	3 1
+users	__pb_users_auth__tokenKey_idx	3 1
+users	__pb_users_auth__email_idx	3 1
+users	__pb_users_auth__username_idx	3 1
+users	sqlite_autoindex_users_1	3 1
+nologin	_kpv709sk2lqbqk8_created_idx	3 1
+nologin	_kpv709sk2lqbqk8_tokenKey_idx	3 1
+nologin	_kpv709sk2lqbqk8_email_idx	3 1
+nologin	_kpv709sk2lqbqk8_username_idx	3 1
+nologin	sqlite_autoindex_nologin_1	3 1
+demo2	idx_demo2_active	3 2
+demo2	idx_unique_demo2_title	3 1
+demo2	idx_demo2_created	3 1
+demo2	sqlite_autoindex_demo2_1	3 1
+_migrations	sqlite_autoindex__migrations_1	54 1
+demo3	_wzlqyes4orhoygb_created_idx	4 1
+demo3	sqlite_autoindex_demo3_1	4 1
+clients	_v851q4r790rhknl_created_idx	2 1
+clients	_v851q4r790rhknl_tokenKey_idx	2 1
+clients	_v851q4r790rhknl_email_idx	2 1
+clients	_v851q4r790rhknl_username_idx	2 1
+clients	sqlite_autoindex_clients_1	2 1
+demo4	idx_IjL94ze	0 0
+demo4	idx_luoQV2A	0 0
+demo4	_4d1blo5cuycfaca_created_idx	2 1
+demo4	sqlite_autoindex_demo4_1	2 1
+_superusers	idx_email__pbc_3323866339	4 1
+_superusers	idx_tokenKey__pbc_3323866339	4 1
+_superusers	sqlite_autoindex__superusers_1	4 1
+_authOrigins	idx_authOrigins_unique_pairs	6 3 2 1
+_authOrigins	sqlite_autoindex__authOrigins_1	6 1
+_externalAuths	idx_externalAuths_collection_provider	4 2 1 1
+_externalAuths	idx_externalAuths_record_provider	4 2 2 1
+_externalAuths	sqlite_autoindex__externalAuths_1	4 1
+_collections	idx__collections_type	16 6
+_collections	sqlite_autoindex__collections_2	16 1
+_collections	sqlite_autoindex__collections_1	16 1
+demo1	_wsmn24bux7wo113_created_idx	3 1
+demo1	sqlite_autoindex_demo1_1	3 1
+\.
+
+
+--
+-- Data for Name: sqlite_stat4; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.sqlite_stat4 (tbl, idx, neq, nlt, ndlt, sample) FROM stdin;
+\.
+
+
+--
+-- Data for Name: users; Type: TABLE DATA; Schema: public; Owner: user
+--
+
+COPY public.users (avatar, created, email, "emailVisibility", id, name, password, "tokenKey", updated, username, verified, file, rel) FROM stdin;
+300_1SEi6Q6U72.png	2022-10-10 10:36:26.879Z	test@example.com	f	4q1xlclmfloku33	test1	$2a$13$uULN32dHTkWQIALJP1N54.22HW/K9/qkXqcmsfz2hOA1wGeuUDbfG	tfYe7rCTX4D2KuWQY3pJjBifgsrMbecyXBatEPjrSfGEGS2jh6	2022-10-12 11:46:10.490Z	users75657	f	[]	llvuca81nly1qls
+	2022-10-10 10:36:59.438Z	test2@example.com	f	oap640cot4yru2s		$2a$13$RC6/uXsHWM1ZV1v0cPJLRuWPXxyNINDmUDIHTq1x1dM.K.TBgWzFK	AQbE30CNb8Ncwr6Sg0sfvDJGJuepriTJN24EHZqO5DsEBTk1kA	2022-10-11 18:37:20.744Z	test2_username	t	["test_kfd2wYLxkz.txt"]	
+	2022-10-10 10:37:33.119Z	test3@example.com	t	bgs820n361vj1qd	test3	$2a$13$qzF1J0ePG5.fvBrm0fVrtez5RRBjPOUoezvYRbTQGAfsT85d4XH2K	x6vHUi00LvM5bFeGIpwXN9xuol8k1BknfTmlySQ7YQWoTLKOa7	2022-10-12 11:46:02.462Z	users69238	t	[]	0yxhwia2amd8gec
+\.
+
+
+--
+-- Name: "_authOrigins" sqlite_autoindex__authOrigins_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public."_authOrigins"
+    ADD CONSTRAINT "sqlite_autoindex__authOrigins_1" PRIMARY KEY (id);
+
+
+--
+-- Name: _collections sqlite_autoindex__collections_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public._collections
+    ADD CONSTRAINT sqlite_autoindex__collections_1 PRIMARY KEY (id);
+
+
+--
+-- Name: "_externalAuths" sqlite_autoindex__externalAuths_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public."_externalAuths"
+    ADD CONSTRAINT "sqlite_autoindex__externalAuths_1" PRIMARY KEY (id);
+
+
+--
+-- Name: _mfas sqlite_autoindex__mfas_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public._mfas
+    ADD CONSTRAINT sqlite_autoindex__mfas_1 PRIMARY KEY (id);
+
+
+--
+-- Name: _migrations sqlite_autoindex__migrations_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public._migrations
+    ADD CONSTRAINT sqlite_autoindex__migrations_1 PRIMARY KEY (file);
+
+
+--
+-- Name: _otps sqlite_autoindex__otps_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public._otps
+    ADD CONSTRAINT sqlite_autoindex__otps_1 PRIMARY KEY (id);
+
+
+--
+-- Name: _params sqlite_autoindex__params_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public._params
+    ADD CONSTRAINT sqlite_autoindex__params_1 PRIMARY KEY (id);
+
+
+--
+-- Name: _superusers sqlite_autoindex__superusers_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public._superusers
+    ADD CONSTRAINT sqlite_autoindex__superusers_1 PRIMARY KEY (id);
+
+
+--
+-- Name: clients sqlite_autoindex_clients_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public.clients
+    ADD CONSTRAINT sqlite_autoindex_clients_1 PRIMARY KEY (id);
+
+
+--
+-- Name: demo1 sqlite_autoindex_demo1_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public.demo1
+    ADD CONSTRAINT sqlite_autoindex_demo1_1 PRIMARY KEY (id);
+
+
+--
+-- Name: demo2 sqlite_autoindex_demo2_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public.demo2
+    ADD CONSTRAINT sqlite_autoindex_demo2_1 PRIMARY KEY (id);
+
+
+--
+-- Name: demo3 sqlite_autoindex_demo3_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public.demo3
+    ADD CONSTRAINT sqlite_autoindex_demo3_1 PRIMARY KEY (id);
+
+
+--
+-- Name: demo4 sqlite_autoindex_demo4_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public.demo4
+    ADD CONSTRAINT sqlite_autoindex_demo4_1 PRIMARY KEY (id);
+
+
+--
+-- Name: demo5 sqlite_autoindex_demo5_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public.demo5
+    ADD CONSTRAINT sqlite_autoindex_demo5_1 PRIMARY KEY (id);
+
+
+--
+-- Name: nologin sqlite_autoindex_nologin_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public.nologin
+    ADD CONSTRAINT sqlite_autoindex_nologin_1 PRIMARY KEY (id);
+
+
+--
+-- Name: users sqlite_autoindex_users_1; Type: CONSTRAINT; Schema: public; Owner: user
+--
+
+ALTER TABLE ONLY public.users
+    ADD CONSTRAINT sqlite_autoindex_users_1 PRIMARY KEY (id);
+
+
+--
+-- Name: _4d1blo5cuycfaca_created_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "_4d1blo5cuycfaca_created_idx" ON public.demo4 USING btree (created);
+
+
+--
+-- Name: _9n89pl5vkct6330_created_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "_9n89pl5vkct6330_created_idx" ON public.demo5 USING btree (created);
+
+
+--
+-- Name: __pb_users_auth__created_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "__pb_users_auth__created_idx" ON public.users USING btree (created);
+
+
+--
+-- Name: __pb_users_auth__email_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "__pb_users_auth__email_idx" ON public.users USING btree (email) WHERE "email" != '';
+
+
+--
+-- Name: __pb_users_auth__tokenKey_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "__pb_users_auth__tokenKey_idx" ON public.users USING btree ("tokenKey");
+
+
+--
+-- Name: __pb_users_auth__username_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "__pb_users_auth__username_idx" ON public.users USING btree (username);
+
+
+--
+-- Name: _kpv709sk2lqbqk8_created_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "_kpv709sk2lqbqk8_created_idx" ON public.nologin USING btree (created);
+
+
+--
+-- Name: _kpv709sk2lqbqk8_email_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "_kpv709sk2lqbqk8_email_idx" ON public.nologin USING btree (email);
+
+
+--
+-- Name: _kpv709sk2lqbqk8_tokenKey_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "_kpv709sk2lqbqk8_tokenKey_idx" ON public.nologin USING btree ("tokenKey");
+
+
+--
+-- Name: _kpv709sk2lqbqk8_username_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "_kpv709sk2lqbqk8_username_idx" ON public.nologin USING btree (username);
+
+
+--
+-- Name: _v851q4r790rhknl_created_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "_v851q4r790rhknl_created_idx" ON public.clients USING btree (created);
+
+
+--
+-- Name: _v851q4r790rhknl_email_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "_v851q4r790rhknl_email_idx" ON public.clients USING btree (email);
+
+
+--
+-- Name: _v851q4r790rhknl_tokenKey_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "_v851q4r790rhknl_tokenKey_idx" ON public.clients USING btree ("tokenKey");
+
+
+--
+-- Name: _v851q4r790rhknl_username_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "_v851q4r790rhknl_username_idx" ON public.clients USING btree (username);
+
+
+--
+-- Name: _wsmn24bux7wo113_created_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "_wsmn24bux7wo113_created_idx" ON public.demo1 USING btree (created);
+
+
+--
+-- Name: _wzlqyes4orhoygb_created_idx; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "_wzlqyes4orhoygb_created_idx" ON public.demo3 USING btree (created);
+
+
+--
+-- Name: idx__collections_type; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "idx__collections_type" ON public._collections USING btree (type);
+
+
+--
+-- Name: idx_authOrigins_unique_pairs; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "idx_authOrigins_unique_pairs" ON public."_authOrigins" USING btree ("collectionRef", "recordRef", fingerprint);
+
+
+--
+-- Name: idx_demo2_active; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "idx_demo2_active" ON public.demo2 USING btree (active);
+
+
+--
+-- Name: idx_demo2_created; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "idx_demo2_created" ON public.demo2 USING btree (created);
+
+
+--
+-- Name: idx_email__pbc_3323866339; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "idx_email__pbc_3323866339" ON public._superusers USING btree (email);
+
+
+--
+-- Name: idx_externalAuths_collection_provider; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "idx_externalAuths_collection_provider" ON public."_externalAuths" USING btree ("collectionRef", provider, "providerId");
+
+
+--
+-- Name: idx_externalAuths_record_provider; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "idx_externalAuths_record_provider" ON public."_externalAuths" USING btree ("collectionRef", "recordRef", provider);
+
+
+--
+-- Name: idx_mfas_collectionRef_recordRef; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "idx_mfas_collectionRef_recordRef" ON public._mfas USING btree ("collectionRef", "recordRef");
+
+
+--
+-- Name: idx_otps_collectionRef_recordRef; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE INDEX "idx_otps_collectionRef_recordRef" ON public._otps USING btree ("collectionRef", "recordRef");
+
+
+--
+-- Name: idx_tokenKey__pbc_3323866339; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "idx_tokenKey__pbc_3323866339" ON public._superusers USING btree ("tokenKey");
+
+
+--
+-- Name: idx_unique_demo2_title; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "idx_unique_demo2_title" ON public.demo2 USING btree (title);
+
+
+--
+-- Name: sqlite_autoindex__collections_2; Type: INDEX; Schema: public; Owner: user
+--
+
+CREATE UNIQUE INDEX "sqlite_autoindex__collections_2" ON public._collections USING btree (name);
+
+
+--
+-- PostgreSQL database dump complete
+--
+
+
+CREATE VIEW "view1" AS SELECT * FROM (select id, text, bool, url, select_one, select_many, file_one, file_many, number, email, datetime, json, rel_one, rel_many, point, created from demo1);
+CREATE VIEW "view2" AS SELECT * FROM (SELECT view1.id, view1.bool as state, view1.file_many, view1.rel_many from view1);
+CREATE VIEW "numeric_id_view" AS SELECT * FROM (SELECT CAST("id" as TEXT) "id","email" FROM (select (ROW_NUMBER() OVER()) as id, email from clients));
\ No newline at end of file
diff --git a/server/core_backend-server/tests/data/data.sqlite-dump.sql b/server/core_backend-server/tests/data/data.sqlite-dump.sql
new file mode 100644
index 0000000..02fa998
--- /dev/null
+++ b/server/core_backend-server/tests/data/data.sqlite-dump.sql
@@ -0,0 +1,261 @@
+PRAGMA foreign_keys=OFF;
+BEGIN TRANSACTION;
+CREATE TABLE `_migrations` (file VARCHAR(255) PRIMARY KEY NOT NULL, applied INTEGER NOT NULL);
+INSERT INTO _migrations VALUES('1640988000_init.go',1665395386);
+INSERT INTO _migrations VALUES('1673167670_multi_match_migrate.go',1674485474882542);
+INSERT INTO _migrations VALUES('1677152688_rename_authentik_to_oidc.go',1678107894196945);
+INSERT INTO _migrations VALUES('1679943780_normalize_single_multiple_values.go',1680612240224966);
+INSERT INTO _migrations VALUES('1679943781_add_indexes_column.go',1680612240225611);
+INSERT INTO _migrations VALUES('1685164450_check_fk.go',1691746422498469);
+INSERT INTO _migrations VALUES('1689579878_renormalize_single_multiple_values.go',1691746422518206);
+INSERT INTO _migrations VALUES('1690319366_reset_null_values.go',1691746422524214);
+INSERT INTO _migrations VALUES('1690454337_transform_relations_to_views.go',1691746422528322);
+INSERT INTO _migrations VALUES('1691746861_created_view3.js',1691746861006404);
+INSERT INTO _migrations VALUES('1691746871_updated_view3.js',1691746871088040);
+INSERT INTO _migrations VALUES('1691746903_updated_view3.js',1691746903261135);
+INSERT INTO _migrations VALUES('1691747509_updated_numeric_id_view.js',1691747509618098);
+INSERT INTO _migrations VALUES('1691747531_updated_numeric_id_view.js',1691747531135925);
+INSERT INTO _migrations VALUES('1691747757_updated_numeric_id_view.js',1691747757587507);
+INSERT INTO _migrations VALUES('1691747912_resave_views.go',1691748137353973);
+INSERT INTO _migrations VALUES('1691747913_resave_views.go',1700504813174477);
+INSERT INTO _migrations VALUES('1692609521_copy_display_fields.go',1700504813176541);
+INSERT INTO _migrations VALUES('1701496825_allow_single_oauth2_provider_in_multiple_auth_collections.go',1701851393247905);
+INSERT INTO _migrations VALUES('1702134272_set_default_json_max_size.go',1702153002153382);
+INSERT INTO _migrations VALUES('1717233556_v0.23_migrate.go',1718885452550907);
+INSERT INTO _migrations VALUES('1719427055_updated_nologin.js',1719427055398268);
+INSERT INTO _migrations VALUES('1719427146_updated_users.js',1719427146443227);
+INSERT INTO _migrations VALUES('1719427201_updated_users.js',1719427201183755);
+INSERT INTO _migrations VALUES('1719427256_updated_users.js',1719427256670615);
+INSERT INTO _migrations VALUES('1719590348_updated_clients.js',1719590348495815);
+INSERT INTO _migrations VALUES('1720595195_updated_superusers.js',1720595195991995);
+INSERT INTO _migrations VALUES('1720862691_updated_numeric_id_view.js',1720862691263317);
+INSERT INTO _migrations VALUES('1720862697_updated_numeric_id_view.js',1720862697604141);
+INSERT INTO _migrations VALUES('1720862718_updated_view1.js',1720862718468637);
+INSERT INTO _migrations VALUES('1720862724_updated_view1.js',1720862724486655);
+INSERT INTO _migrations VALUES('1720862730_updated_view2.js',1720862730874909);
+INSERT INTO _migrations VALUES('1720862738_updated_view2.js',1720862738769086);
+INSERT INTO _migrations VALUES('1720862814_updated_numeric_id_view.js',1720862814980193);
+INSERT INTO _migrations VALUES('1720862822_updated_numeric_id_view.js',1720862822105793);
+INSERT INTO _migrations VALUES('1720863228_updated_numeric_id_view.js',1720863228586333);
+INSERT INTO _migrations VALUES('1720863270_updated_numeric_id_view.js',1720863270461984);
+INSERT INTO _migrations VALUES('1720863324_updated_numeric_id_view.js',1720863324872674);
+INSERT INTO _migrations VALUES('1720865157_updated_numeric_id_view.js',1720865157366879);
+INSERT INTO _migrations VALUES('1720865165_updated_view1.js',1720865165743836);
+INSERT INTO _migrations VALUES('1720865172_updated_view2.js',1720865172373325);
+INSERT INTO _migrations VALUES('1720865176_updated_view2.js',1720865176952277);
+INSERT INTO _migrations VALUES('1720865181_updated_view1.js',1720865181999132);
+INSERT INTO _migrations VALUES('1720865200_updated_view2.js',1720865200364699);
+INSERT INTO _migrations VALUES('1721987625_updated_authOrigins.js',1721987625054154);
+INSERT INTO _migrations VALUES('1721987631_updated_authOrigins.js',1721987631008720);
+INSERT INTO _migrations VALUES('1721987781_updated_authOrigins.js',1721987781298849);
+INSERT INTO _migrations VALUES('1721987788_updated_authOrigins.js',1721987788166593);
+INSERT INTO _migrations VALUES('1722443467_updated_otps.js',1722443467352142);
+INSERT INTO _migrations VALUES('1722443484_updated_mfas.js',1722443484760600);
+INSERT INTO _migrations VALUES('1722443494_updated_mfas.js',1722443494222859);
+INSERT INTO _migrations VALUES('1722443544_updated_authOrigins.js',1722443544810664);
+INSERT INTO _migrations VALUES('1722443631_updated_externalAuths.js',1722443631679710);
+INSERT INTO _migrations VALUES('1722443663_updated_superusers.js',1722443663936374);
+INSERT INTO _migrations VALUES('1724072848_updated_superusers.js',1724072848003576);
+INSERT INTO _migrations VALUES('1725192864_updated_view2.js',1725192864550539);
+INSERT INTO _migrations VALUES('1725192864_updated_view1.js',1725192864554724);
+INSERT INTO _migrations VALUES('1725192864_updated_demo1.js',1725192864567727);
+INSERT INTO _migrations VALUES('1725192928_updated_demo4.js',1725192928513955);
+INSERT INTO _migrations VALUES('1725792578_updated__superusers.js',1725792578533745);
+INSERT INTO _migrations VALUES('1726224305_updated_users.js',1726224305917687);
+INSERT INTO _migrations VALUES('1726224493_updated_users.js',1726224493523356);
+INSERT INTO _migrations VALUES('1640988000_aux_init.go',1729794875351351);
+INSERT INTO _migrations VALUES('1717233557_v0.23_migrate2.go',1729794875412697);
+INSERT INTO _migrations VALUES('1717233558_v0.23_migrate3.go',1730738463660106);
+INSERT INTO _migrations VALUES('1717233559_v0.23_migrate4.go',1732030183936141);
+INSERT INTO _migrations VALUES('1743591869_updated_demo1.js',1743591869355669);
+INSERT INTO _migrations VALUES('1761219736_updated_view1.js',1761219736410514);
+INSERT INTO _migrations VALUES('1762785011_update_default_auth_alert_templates.go',1762787986774549);
+INSERT INTO _migrations VALUES('1762788048_updated_users.js',1762788048394996);
+INSERT INTO _migrations VALUES('1762788810_updated_clients.js',1762788810586927);
+INSERT INTO _migrations VALUES('1762788817_updated_users.js',1762788817890021);
+INSERT INTO _migrations VALUES('1762788829_updated__superusers.js',1762788829638737);
+INSERT INTO _migrations VALUES('1762788846_updated_nologin.js',1762788846329028);
+CREATE TABLE `_collections` (
+				`id`         TEXT PRIMARY KEY,
+				`system`     BOOLEAN DEFAULT FALSE NOT NULL,
+				`type`       TEXT DEFAULT "base" NOT NULL,
+				`name`       TEXT UNIQUE NOT NULL,
+				"fields"     JSON DEFAULT "[]" NOT NULL,
+				`listRule`   TEXT DEFAULT NULL,
+				`viewRule`   TEXT DEFAULT NULL,
+				`createRule` TEXT DEFAULT NULL,
+				`updateRule` TEXT DEFAULT NULL,
+				`deleteRule` TEXT DEFAULT NULL,
+				`options`    JSON DEFAULT "{}" NOT NULL,
+				`created`    TEXT DEFAULT "" NOT NULL,
+				`updated`    TEXT DEFAULT "" NOT NULL
+			, `indexes` JSON DEFAULT "[]" NOT NULL);
+INSERT INTO _collections VALUES('_pb_users_auth_',0,'auth','users','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"cost":10,"hidden":true,"id":"_pbf_auth_password_","max":0,"min":8,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"autogeneratePattern":"[a-zA-Z0-9_]{50}","hidden":true,"id":"_pbf_auth_tokenKey_","max":60,"min":30,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"_pbf_auth_email_","name":"email","onlyDomains":null,"presentable":false,"required":false,"system":true,"type":"email"},{"hidden":false,"id":"_pbf_auth_emailVisibility_","name":"emailVisibility","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"_pbf_auth_verified_","name":"verified","presentable":false,"required":false,"system":true,"type":"bool"},{"autogeneratePattern":"users[0-9]{5}","hidden":false,"id":"_pbf_auth_username_","max":150,"min":3,"name":"username","pattern":"^[\\w][\\w\\.\\-]*$","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"users_name","max":0,"min":0,"name":"name","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"users_avatar","maxSelect":1,"maxSize":5242880,"mimeTypes":["image/jpg","image/jpeg","image/png","image/svg+xml","image/gif"],"name":"avatar","presentable":false,"protected":false,"required":false,"system":false,"thumbs":["70x50","70x50t","70x50b","70x50f","0x50","70x0"],"type":"file"},{"hidden":false,"id":"xtecur3m","maxSelect":5,"maxSize":5242880,"mimeTypes":null,"name":"file","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"cascadeDelete":false,"collectionId":"sz5l5z67tg7gku0","hidden":false,"id":"lkeigvv3","maxSelect":1,"minSelect":0,"name":"rel","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]',NULL,'id = @request.auth.id','','id = @request.auth.id','id = @request.auth.id','{"authRule":"","manageRule":null,"authAlert":{"enabled":true,"emailTemplate":{"subject":"Login from a new location","body":"\u003cp\u003eHello {RECORD:name}{RECORD:tokenKey},\u003c/p\u003e\n\u003cp\u003eWe noticed a login to your {APP_NAME} account from a new location:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003e{ALERT_INFO}\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003eIf this was you, you may disregard this email.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eIf this wasn''t you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}},"oauth2":{"providers":[{"pkce":null,"name":"gitlab","clientId":"test1","clientSecret":"test2","authURL":"","tokenURL":"","userInfoURL":"","displayName":"","extra":null},{"pkce":null,"name":"google","clientId":"test","clientSecret":"test2","authURL":"","tokenURL":"","userInfoURL":"","displayName":"","extra":null}],"mappedFields":{"id":"","name":"","username":"username","avatarURL":""},"enabled":true},"passwordAuth":{"enabled":true,"identityFields":["email","username"]},"mfa":{"enabled":true,"duration":1800,"rule":""},"otp":{"enabled":true,"duration":300,"length":8,"emailTemplate":{"subject":"OTP for {APP_NAME}","body":"\u003cp\u003eHello {RECORD:name}{RECORD:tokenKey},\u003c/p\u003e\n\u003cp\u003eYour one-time password is: \u003cstrong\u003e{OTP}\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask for the one-time password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}},"authToken":{"secret":"PjVU4hAV7CZIWbCByJHkDcMUlSEWCLI6M5aWSZOpEq0a3rYxKT","duration":1209600},"passwordResetToken":{"secret":"BC6jYPe4JXpQGGNzu6VXtYw0yhKoH2mh2ezIJClOJQuZYrd4Ol","duration":1800},"emailChangeToken":{"secret":"eON2TTJZiGCEi7mvUvwMLADj8CMHQzwZN3gmyMjQb24EY08ATP","duration":1800},"verificationToken":{"secret":"dgGGHlzzdCJ2C5MjXGoondllwSXkJHyL50FuvLvXGHNmBhvGKO","duration":604800},"fileToken":{"secret":"4Ax9zDm2Rwtny81dGaGQrJQBnIx5wVOuNe89X6v7NbNzrAZhvn","duration":180},"verificationTemplate":{"subject":"Verify your {APP_NAME} email","body":"\u003cp\u003eHello {RECORD:name}{RECORD:tokenKey},\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"},"resetPasswordTemplate":{"subject":"Reset your {APP_NAME} password","body":"\u003cp\u003eHello {RECORD:name}{RECORD:tokenKey},\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"},"confirmEmailChangeTemplate":{"subject":"Confirm your {APP_NAME} new email address","body":"\u003cp\u003eHello {RECORD:name}{RECORD:tokenKey},\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}}','2022-10-10 09:49:46.145Z','2025-11-10 15:33:37.841Z','["CREATE UNIQUE INDEX `__pb_users_auth__username_idx` ON `users` (username)","CREATE UNIQUE INDEX `__pb_users_auth__email_idx` ON `users` (email) WHERE email != ''''","CREATE UNIQUE INDEX `__pb_users_auth__tokenKey_idx` ON `users` (tokenKey)","CREATE INDEX `__pb_users_auth__created_idx` ON `users` (`created`)"]');
+INSERT INTO _collections VALUES('wsmn24bux7wo113',0,'base','demo1','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"u7spsiph","max":0,"min":0,"name":"text","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"puk534el","name":"bool","presentable":false,"required":false,"system":false,"type":"bool"},{"exceptDomains":null,"hidden":false,"id":"ktas5n7b","name":"url","onlyDomains":null,"presentable":false,"required":false,"system":false,"type":"url"},{"hidden":false,"id":"dc4abz4i","maxSelect":1,"name":"select_one","presentable":false,"required":false,"system":false,"type":"select","values":["optionA","optionB","optionC"]},{"hidden":false,"id":"owtlq7zl","maxSelect":3,"name":"select_many","presentable":false,"required":false,"system":false,"type":"select","values":["optionA","optionB","optionC"]},{"hidden":false,"id":"4ulkdevf","maxSelect":1,"maxSize":5242880,"mimeTypes":null,"name":"file_one","presentable":false,"protected":true,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"fjzhrsvq","maxSelect":99,"maxSize":5242880,"mimeTypes":null,"name":"file_many","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"1z1ld0i5","max":null,"min":null,"name":"number","onlyInt":false,"presentable":false,"required":false,"system":false,"type":"number"},{"exceptDomains":null,"hidden":false,"id":"khvhpwgj","name":"email","onlyDomains":null,"presentable":false,"required":false,"system":false,"type":"email"},{"hidden":false,"id":"ro6p02gk","max":"","min":"","name":"datetime","presentable":false,"required":false,"system":false,"type":"date"},{"hidden":false,"id":"ei2fg4v1","maxSize":5242880,"name":"json","presentable":false,"required":false,"system":false,"type":"json"},{"cascadeDelete":false,"collectionId":"wsmn24bux7wo113","hidden":false,"id":"zaedritp","maxSelect":1,"minSelect":0,"name":"rel_one","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":true,"collectionId":"_pb_users_auth_","hidden":false,"id":"t9bpk2ug","maxSelect":9999,"minSelect":0,"name":"rel_many","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"geoPoint3081106212","name":"point","presentable":false,"required":false,"system":false,"type":"geoPoint"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]',NULL,NULL,NULL,NULL,NULL,'{}','2022-10-10 09:51:19.868Z','2025-04-02 11:04:29.260Z','["CREATE INDEX `_wsmn24bux7wo113_created_idx` ON `demo1` (`created`)"]');
+INSERT INTO _collections VALUES('sz5l5z67tg7gku0',0,'base','demo2','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"mkrguaaf","max":0,"min":2,"name":"title","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"hidden":false,"id":"izkl5z2s","name":"active","presentable":false,"required":false,"system":false,"type":"bool"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]','','','','','','{}','2022-10-10 09:51:28.452Z','2023-03-20 16:39:25.211Z','["CREATE INDEX `idx_demo2_created` ON `demo2` (`created`)","CREATE UNIQUE INDEX \"idx_unique_demo2_title\" on \"demo2\" (\"title\")","CREATE INDEX \"idx_demo2_active\" ON \"demo2\" (\n\"active\"\n)"]');
+INSERT INTO _collections VALUES('wzlqyes4orhoygb',0,'base','demo3','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"w5z2x0nq","max":0,"min":0,"name":"title","pattern":"","presentable":true,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"tgqrbwio","maxSelect":99,"maxSize":5242880,"mimeTypes":null,"name":"files","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]','@request.auth.id != "" && @request.auth.collectionName != "users"','@request.auth.id != "" && @request.auth.collectionName != "users"','@request.auth.id != "" && @request.auth.collectionName != "users"','@request.auth.id != "" && @request.auth.collectionName != "users"','@request.auth.id != "" && @request.auth.collectionName != "users"','{}','2022-10-10 09:51:36.853Z','2023-11-20 18:26:53.176Z','["CREATE INDEX `_wzlqyes4orhoygb_created_idx` ON `demo3` (`created`)"]');
+INSERT INTO _collections VALUES('4d1blo5cuycfaca',0,'base','demo4','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"erkxnabw","max":0,"min":0,"name":"title","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"t5jskeyz","maxSelect":1,"minSelect":0,"name":"rel_one_no_cascade","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"ldrcjhk8","maxSelect":1,"minSelect":0,"name":"rel_one_no_cascade_required","presentable":false,"required":true,"system":false,"type":"relation"},{"cascadeDelete":true,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"pl5lcd4y","maxSelect":1,"minSelect":0,"name":"rel_one_cascade","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"jz0oue3z","maxSelect":999,"minSelect":0,"name":"rel_many_no_cascade","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"bsxyqrhb","maxSelect":999,"minSelect":0,"name":"rel_many_no_cascade_required","presentable":false,"required":true,"system":false,"type":"relation"},{"cascadeDelete":true,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"kwmchnf7","maxSelect":999,"minSelect":0,"name":"rel_many_cascade","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"pmynkqk5","maxSelect":1,"minSelect":0,"name":"rel_one_unique","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"wzlqyes4orhoygb","hidden":false,"id":"mjzyk9vb","maxSelect":999,"minSelect":0,"name":"rel_many_unique","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"4d1blo5cuycfaca","hidden":false,"id":"dagiyxj4","maxSelect":1,"minSelect":0,"name":"self_rel_one","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"4d1blo5cuycfaca","hidden":false,"id":"tsrki8kc","maxSelect":999,"minSelect":0,"name":"self_rel_many","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"4wpx0hhx","maxSize":5242880,"name":"json_array","presentable":false,"required":false,"system":false,"type":"json"},{"hidden":false,"id":"ufpwiqnx","maxSize":5242880,"name":"json_object","presentable":false,"required":false,"system":false,"type":"json"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]','','','@request.auth.collectionName = ''users''','@request.auth.collectionName = ''users''','','{}','2022-10-10 09:51:47.770Z','2024-09-01 12:15:28.332Z','["CREATE INDEX `_4d1blo5cuycfaca_created_idx` ON `demo4` (`created`)","CREATE UNIQUE INDEX `idx_luoQV2A` ON `demo4` (`rel_one_unique`) WHERE rel_one_unique != ''''","CREATE UNIQUE INDEX `idx_IjL94ze` ON `demo4` (`rel_many_unique`) WHERE rel_many_unique != ''[]''"]');
+INSERT INTO _collections VALUES('v851q4r790rhknl',0,'auth','clients','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"cost":10,"hidden":true,"id":"_pbf_auth_password_","max":0,"min":8,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"autogeneratePattern":"[a-zA-Z0-9_]{50}","hidden":true,"id":"_pbf_auth_tokenKey_","max":60,"min":30,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"_pbf_auth_email_","name":"email","onlyDomains":null,"presentable":false,"required":true,"system":true,"type":"email"},{"hidden":false,"id":"_pbf_auth_emailVisibility_","name":"emailVisibility","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"_pbf_auth_verified_","name":"verified","presentable":false,"required":false,"system":true,"type":"bool"},{"autogeneratePattern":"users[0-9]{5}","hidden":false,"id":"_pbf_auth_username_","max":150,"min":3,"name":"username","pattern":"^[\\w][\\w\\.\\-]*$","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"lacorw19","max":0,"min":0,"name":"name","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]',NULL,NULL,NULL,NULL,NULL,'{"authRule":"verified=true","manageRule":null,"authAlert":{"enabled":true,"emailTemplate":{"subject":"Login from a new location","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eWe noticed a login to your {APP_NAME} account from a new location:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003e{ALERT_INFO}\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eIf this wasn''t you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIf this was you, you may disregard this email.\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}},"oauth2":{"providers":[],"mappedFields":{"id":"","name":"","username":"username","avatarURL":""},"enabled":false},"passwordAuth":{"enabled":true,"identityFields":["email","username"]},"mfa":{"enabled":false,"duration":1800,"rule":""},"otp":{"enabled":false,"duration":300,"length":8,"emailTemplate":{"subject":"OTP for {APP_NAME}","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eYour one-time password is: \u003cstrong\u003e{OTP}\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask for the one-time password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}},"authToken":{"secret":"PjVU4hAV7CZIWbCByJHkDcMUlSEWCLI6M5aWSZOpEq0a3rYxKT","duration":1209600},"passwordResetToken":{"secret":"BC6jYPe4JXpQGGNzu6VXtYw0yhKoH2mh2ezIJClOJQuZYrd4Ol","duration":1800},"emailChangeToken":{"secret":"eON2TTJZiGCEi7mvUvwMLADj8CMHQzwZN3gmyMjQb24EY08ATP","duration":1800},"verificationToken":{"secret":"dgGGHlzzdCJ2C5MjXGoondllwSXkJHyL50FuvLvXGHNmBhvGKO","duration":604800},"fileToken":{"secret":"4Ax9zDm2Rwtny81dGaGQrJQBnIx5wVOuNe89X6v7NbNzrAZhvn","duration":180},"verificationTemplate":{"subject":"Verify your {APP_NAME} email","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"},"resetPasswordTemplate":{"subject":"Reset your {APP_NAME} password","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"},"confirmEmailChangeTemplate":{"subject":"Confirm your {APP_NAME} new email address","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}}','2022-10-11 09:41:36.712Z','2025-11-10 15:33:30.519Z','["CREATE UNIQUE INDEX `_v851q4r790rhknl_username_idx` ON `clients` (username)","CREATE UNIQUE INDEX `_v851q4r790rhknl_email_idx` ON `clients` (email) WHERE email != ''''","CREATE UNIQUE INDEX `_v851q4r790rhknl_tokenKey_idx` ON `clients` (tokenKey)","CREATE INDEX `_v851q4r790rhknl_created_idx` ON `clients` (`created`)"]');
+INSERT INTO _collections VALUES('kpv709sk2lqbqk8',1,'auth','nologin','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"cost":10,"hidden":true,"id":"_pbf_auth_password_","max":0,"min":8,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"autogeneratePattern":"[a-zA-Z0-9_]{50}","hidden":true,"id":"_pbf_auth_tokenKey_","max":60,"min":30,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"_pbf_auth_email_","name":"email","onlyDomains":null,"presentable":false,"required":true,"system":true,"type":"email"},{"hidden":false,"id":"_pbf_auth_emailVisibility_","name":"emailVisibility","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"_pbf_auth_verified_","name":"verified","presentable":false,"required":false,"system":true,"type":"bool"},{"autogeneratePattern":"users[0-9]{5}","hidden":false,"id":"_pbf_auth_username_","max":150,"min":3,"name":"username","pattern":"^[\\w][\\w\\.\\-]*$","presentable":false,"primaryKey":false,"required":true,"system":false,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"x8zzktwe","max":0,"min":0,"name":"name","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]','','','','','','{"authRule":"","manageRule":"@request.auth.collectionName = ''users''","authAlert":{"enabled":true,"emailTemplate":{"subject":"Login from a new location","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eWe noticed a login to your {APP_NAME} account from a new location:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003e{ALERT_INFO}\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eIf this wasn''t you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIf this was you, you may disregard this email.\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}},"oauth2":{"providers":[{"pkce":null,"name":"gitlab","clientId":"test","clientSecret":"test","authURL":"","tokenURL":"","userInfoURL":"","displayName":"","extra":null}],"mappedFields":{"id":"","name":"","username":"username","avatarURL":""},"enabled":false},"passwordAuth":{"enabled":false,"identityFields":["email"]},"mfa":{"enabled":false,"duration":1800,"rule":""},"otp":{"enabled":false,"duration":300,"length":8,"emailTemplate":{"subject":"OTP for {APP_NAME}","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eYour one-time password is: \u003cstrong\u003e{OTP}\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask for the one-time password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}},"authToken":{"secret":"PjVU4hAV7CZIWbCByJHkDcMUlSEWCLI6M5aWSZOpEq0a3rYxKT","duration":1209600},"passwordResetToken":{"secret":"BC6jYPe4JXpQGGNzu6VXtYw0yhKoH2mh2ezIJClOJQuZYrd4Ol","duration":1800},"emailChangeToken":{"secret":"eON2TTJZiGCEi7mvUvwMLADj8CMHQzwZN3gmyMjQb24EY08ATP","duration":1800},"verificationToken":{"secret":"dgGGHlzzdCJ2C5MjXGoondllwSXkJHyL50FuvLvXGHNmBhvGKO","duration":604800},"fileToken":{"secret":"4Ax9zDm2Rwtny81dGaGQrJQBnIx5wVOuNe89X6v7NbNzrAZhvn","duration":180},"verificationTemplate":{"subject":"Verify your {APP_NAME} email","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"},"resetPasswordTemplate":{"subject":"Reset your {APP_NAME} password","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"},"confirmEmailChangeTemplate":{"subject":"Confirm your {APP_NAME} new email address","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}}','2022-10-12 10:39:21.294Z','2025-11-10 15:34:06.288Z','["CREATE UNIQUE INDEX `_kpv709sk2lqbqk8_username_idx` ON `nologin` (username)","CREATE UNIQUE INDEX `_kpv709sk2lqbqk8_email_idx` ON `nologin` (email) WHERE email != ''''","CREATE UNIQUE INDEX `_kpv709sk2lqbqk8_tokenKey_idx` ON `nologin` (tokenKey)","CREATE INDEX `_kpv709sk2lqbqk8_created_idx` ON \"nologin\" (`created`)"]');
+INSERT INTO _collections VALUES('9n89pl5vkct6330',0,'base','demo5','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"_pbf_text_id_","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"sozvpexq","maxSelect":1,"name":"select_one","presentable":false,"required":false,"system":false,"type":"select","values":["a","b","c","d"]},{"hidden":false,"id":"qlq1nxlc","maxSelect":5,"name":"select_many","presentable":false,"required":false,"system":false,"type":"select","values":["a","b","c","d","e"]},{"cascadeDelete":false,"collectionId":"4d1blo5cuycfaca","hidden":false,"id":"ajrrsq1a","maxSelect":1,"minSelect":0,"name":"rel_one","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":false,"collectionId":"4d1blo5cuycfaca","hidden":false,"id":"soxhs0ou","maxSelect":5,"minSelect":0,"name":"rel_many","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"kvbyzuqj","max":null,"min":null,"name":"total","onlyInt":false,"presentable":false,"required":false,"system":false,"type":"number"},{"hidden":false,"id":"ob7dsrcl","maxSelect":1,"maxSize":5242880,"mimeTypes":null,"name":"file","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"_pbf_autodate_created_","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"},{"hidden":false,"id":"_pbf_autodate_updated_","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":false,"type":"autodate"}]','select_many:length = 3','rel_many.self_rel_many.rel_many_cascade.files:length = 1','@request.body.total = 3','@request.body.total = 3','@request.query.test:isset = true','{}','2023-01-07 13:13:08.733Z','2023-04-04 13:10:52.723Z','["CREATE INDEX `_9n89pl5vkct6330_created_idx` ON `demo5` (`created`)"]');
+INSERT INTO _collections VALUES('v9gwnfh02gjq1q0',0,'view','view1','[{"autogeneratePattern":"","hidden":false,"id":"text3208210256","max":0,"min":0,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"_clone_r09R","max":0,"min":0,"name":"text","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":false,"type":"text"},{"hidden":false,"id":"_clone_8o57","name":"bool","presentable":false,"required":false,"system":false,"type":"bool"},{"exceptDomains":null,"hidden":false,"id":"_clone_y2Ow","name":"url","onlyDomains":null,"presentable":false,"required":false,"system":false,"type":"url"},{"hidden":false,"id":"_clone_jFNd","maxSelect":1,"name":"select_one","presentable":false,"required":false,"system":false,"type":"select","values":["optionA","optionB","optionC"]},{"hidden":false,"id":"_clone_mNKL","maxSelect":3,"name":"select_many","presentable":false,"required":false,"system":false,"type":"select","values":["optionA","optionB","optionC"]},{"hidden":false,"id":"_clone_diFB","maxSelect":1,"maxSize":5242880,"mimeTypes":null,"name":"file_one","presentable":false,"protected":true,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"_clone_dViH","maxSelect":99,"maxSize":5242880,"mimeTypes":null,"name":"file_many","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"hidden":false,"id":"_clone_dIjh","max":null,"min":null,"name":"number","onlyInt":false,"presentable":false,"required":false,"system":false,"type":"number"},{"exceptDomains":null,"hidden":false,"id":"_clone_5R4l","name":"email","onlyDomains":null,"presentable":false,"required":false,"system":false,"type":"email"},{"hidden":false,"id":"_clone_LZkS","max":"","min":"","name":"datetime","presentable":false,"required":false,"system":false,"type":"date"},{"hidden":false,"id":"_clone_yiCN","maxSize":5242880,"name":"json","presentable":false,"required":false,"system":false,"type":"json"},{"cascadeDelete":false,"collectionId":"wsmn24bux7wo113","hidden":false,"id":"_clone_UJXf","maxSelect":1,"minSelect":0,"name":"rel_one","presentable":false,"required":false,"system":false,"type":"relation"},{"cascadeDelete":true,"collectionId":"_pb_users_auth_","hidden":false,"id":"_clone_0li1","maxSelect":9999,"minSelect":0,"name":"rel_many","presentable":false,"required":false,"system":false,"type":"relation"},{"hidden":false,"id":"_clone_VWxh","name":"point","presentable":false,"required":false,"system":false,"type":"geoPoint"},{"hidden":false,"id":"_clone_b5hm","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":false,"type":"autodate"}]','@request.auth.id != "" && bool = true','@request.auth.id != "" && bool = true',NULL,NULL,NULL,'{"viewQuery":"select id, text, bool, url, select_one, select_many, file_one, file_many, number, email, datetime, json, rel_one, rel_many, point, created from demo1"}','2023-02-12 18:58:12.315Z','2025-10-23 11:42:16.302Z','[]');
+INSERT INTO _collections VALUES('ib3m2700k5hlsjz',0,'view','view2','[{"autogeneratePattern":"","hidden":false,"id":"text3208210256","max":0,"min":0,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"_clone_77Ik","name":"state","presentable":false,"required":false,"system":false,"type":"bool"},{"hidden":false,"id":"_clone_IbSu","maxSelect":99,"maxSize":5242880,"mimeTypes":null,"name":"file_many","presentable":false,"protected":false,"required":false,"system":false,"thumbs":null,"type":"file"},{"cascadeDelete":true,"collectionId":"_pb_users_auth_","hidden":false,"id":"_clone_Asz0","maxSelect":9999,"minSelect":0,"name":"rel_many","presentable":false,"required":false,"system":false,"type":"relation"}]','','',NULL,NULL,NULL,'{"viewQuery":"SELECT view1.id, view1.bool as state, view1.file_many, view1.rel_many from view1\n"}','2023-02-17 19:42:54.278Z','2024-11-19 15:29:43.857Z','[]');
+INSERT INTO _collections VALUES('zahsr9d2mix2fvk',0,'view','numeric_id_view','[{"autogeneratePattern":"","hidden":false,"id":"text3208210256","max":0,"min":0,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"_clone_jO9O","name":"email","onlyDomains":null,"presentable":false,"required":true,"system":true,"type":"email"}]','','',NULL,NULL,NULL,'{"viewQuery":"select (ROW_NUMBER() OVER()) as id, email from clients"}','2023-08-11 09:41:00.997Z','2024-11-19 15:29:43.901Z','[]');
+INSERT INTO _collections VALUES('pbc_3142635823',1,'auth','_superusers','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"cost":0,"hidden":true,"id":"password901924565","max":0,"min":8,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"autogeneratePattern":"[a-zA-Z0-9_]{50}","hidden":true,"id":"text2504183744","max":60,"min":30,"name":"tokenKey","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"exceptDomains":null,"hidden":false,"id":"email3885137012","name":"email","onlyDomains":null,"presentable":false,"required":true,"system":true,"type":"email"},{"hidden":false,"id":"bool1547992806","name":"emailVisibility","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"bool256245529","name":"verified","presentable":false,"required":false,"system":true,"type":"bool"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"}]',NULL,NULL,NULL,NULL,NULL,'{"authRule":"","manageRule":null,"authAlert":{"enabled":true,"emailTemplate":{"subject":"Login from a new location","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eWe noticed a login to your {APP_NAME} account from a new location:\u003c/p\u003e\n\u003cp\u003e\u003cem\u003e{ALERT_INFO}\u003c/em\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eIf this wasn''t you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIf this was you, you may disregard this email.\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}},"oauth2":{"providers":null,"mappedFields":{"id":"","name":"","username":"","avatarURL":""},"enabled":false},"passwordAuth":{"enabled":true,"identityFields":["email"]},"mfa":{"enabled":false,"duration":1800,"rule":""},"otp":{"enabled":false,"duration":300,"length":8,"emailTemplate":{"subject":"OTP for {APP_NAME}","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eYour one-time password is: \u003cstrong\u003e{OTP}\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask for the one-time password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}},"authToken":{"secret":"MyN3nDlzmHnuCjd35vb6cyIdqNr7Os0PmgiPVDMxmbFToSpBvS","duration":1209600},"passwordResetToken":{"secret":"fPSpFm9rxjj4mdeWYfyQ5OZQ4UWpyainTO0dqrJe3LHEYEDduq","duration":1800},"emailChangeToken":{"secret":"unYNiYeuIxH7BCV09NIb81abe2bkPgaexMYdDQ6uOOIFh74urD","duration":1800},"verificationToken":{"secret":"uhr68rXLVjPBWALFtw8uEHeQwDdN4t0MiTLr2pBWVkEQnNICe1","duration":259200},"fileToken":{"secret":"sjJAjTNPrOcRDmnIKwQm7qY9FyjuXTG5KNcaqw4U1TSDVfu4r9","duration":180},"verificationTemplate":{"subject":"Verify your {APP_NAME} email","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eThank you for joining us at {APP_NAME}.\u003c/p\u003e\n\u003cp\u003eClick on the button below to verify your email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eVerify\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"},"resetPasswordTemplate":{"subject":"Reset your {APP_NAME} password","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to reset your password.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eReset password\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask to reset your password, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"},"confirmEmailChangeTemplate":{"subject":"Confirm your {APP_NAME} new email address","body":"\u003cp\u003eHello,\u003c/p\u003e\n\u003cp\u003eClick on the button below to confirm your new email address.\u003c/p\u003e\n\u003cp\u003e\n  \u003ca class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\"\u003eConfirm new email\u003c/a\u003e\n\u003c/p\u003e\n\u003cp\u003e\u003ci\u003eIf you didn''t ask to change your email address, you can ignore this email.\u003c/i\u003e\u003c/p\u003e\n\u003cp\u003e\n  Thanks,\u003cbr/\u003e\n  {APP_NAME} team\n\u003c/p\u003e"}}','2024-06-20 09:29:22.826Z','2025-11-10 15:33:49.591Z','["CREATE UNIQUE INDEX `idx_tokenKey__pbc_3323866339` ON `_superusers` (`tokenKey`)","CREATE UNIQUE INDEX `idx_email__pbc_3323866339` ON `_superusers` (`email`) WHERE `email` != ''''"]');
+INSERT INTO _collections VALUES('pbc_2281828961',1,'base','_externalAuths','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text455797646","max":0,"min":0,"name":"collectionRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text127846527","max":0,"min":0,"name":"recordRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text2462348188","max":0,"min":0,"name":"provider","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text1044722854","max":0,"min":0,"name":"providerId","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"}]','@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId','@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId',NULL,NULL,'@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId','{}','2024-06-20 09:29:22.862Z','2024-07-31 16:33:51.596Z','["CREATE UNIQUE INDEX `idx_externalAuths_record_provider` ON `externalAuths` (collectionRef, recordRef, provider)","CREATE UNIQUE INDEX `idx_externalAuths_collection_provider` ON `externalAuths` (collectionRef, provider, providerId)"]');
+INSERT INTO _collections VALUES('pbc_2279338944',1,'base','_mfas','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text455797646","max":0,"min":0,"name":"collectionRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text127846527","max":0,"min":0,"name":"recordRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text1582905952","max":0,"min":0,"name":"method","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"}]','@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId','@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId',NULL,NULL,NULL,'{}','2024-06-20 09:29:22.894Z','2024-10-24 18:34:35.352Z','["CREATE INDEX `idx_mfas_collectionRef_recordRef` ON `mfas` (\n  `collectionRef`,\n  `recordRef`\n)"]');
+INSERT INTO _collections VALUES('pbc_1638494021',1,'base','_otps','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text455797646","max":0,"min":0,"name":"collectionRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text127846527","max":0,"min":0,"name":"recordRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"cost":8,"hidden":true,"id":"password901924565","max":0,"min":0,"name":"password","pattern":"","presentable":false,"required":true,"system":true,"type":"password"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"},{"autogeneratePattern":"","hidden":true,"id":"text3866985172","max":0,"min":0,"name":"sentTo","pattern":"","presentable":false,"primaryKey":false,"required":false,"system":true,"type":"text"}]','@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId','@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId',NULL,NULL,NULL,'{}','2024-06-20 09:29:22.901Z','2024-11-19 15:29:43.633Z','["CREATE INDEX `idx_otps_collectionRef_recordRef` ON `otps` (\n  `collectionRef`,\n  `recordRef`\n)"]');
+INSERT INTO _collections VALUES('pbc_4275539003',1,'base','_authOrigins','[{"autogeneratePattern":"[a-z0-9]{15}","hidden":false,"id":"text3208210256","max":15,"min":15,"name":"id","pattern":"^[a-z0-9]+$","presentable":false,"primaryKey":true,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text455797646","max":0,"min":0,"name":"collectionRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text127846527","max":0,"min":0,"name":"recordRef","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"autogeneratePattern":"","hidden":false,"id":"text4228609354","max":0,"min":0,"name":"fingerprint","pattern":"","presentable":false,"primaryKey":false,"required":true,"system":true,"type":"text"},{"hidden":false,"id":"autodate2990389176","name":"created","onCreate":true,"onUpdate":false,"presentable":false,"system":true,"type":"autodate"},{"hidden":false,"id":"autodate3332085495","name":"updated","onCreate":true,"onUpdate":true,"presentable":false,"system":true,"type":"autodate"}]','@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId','@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId',NULL,NULL,'@request.auth.id != '''' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId','{}','2024-06-20 12:10:52.542Z','2024-07-31 16:32:24.722Z','["CREATE UNIQUE INDEX `idx_authOrigins_unique_pairs` ON `authDevices` (collectionRef, recordRef, fingerprint)"]');
+CREATE TABLE `users` (`avatar` TEXT DEFAULT '', `created` TEXT DEFAULT '' NOT NULL, `email` TEXT DEFAULT '' NOT NULL, `emailVisibility` BOOLEAN DEFAULT FALSE NOT NULL, `id` TEXT PRIMARY KEY, `name` TEXT DEFAULT '', "password" TEXT NOT NULL, `tokenKey` TEXT NOT NULL, `updated` TEXT DEFAULT '' NOT NULL, `username` TEXT NOT NULL, `verified` BOOLEAN DEFAULT FALSE NOT NULL, "file" TEXT DEFAULT '', "rel" TEXT DEFAULT '');
+INSERT INTO users VALUES('300_1SEi6Q6U72.png','2022-10-10 10:36:26.879Z','test@example.com',0,'4q1xlclmfloku33','test1','$2a$13$uULN32dHTkWQIALJP1N54.22HW/K9/qkXqcmsfz2hOA1wGeuUDbfG','tfYe7rCTX4D2KuWQY3pJjBifgsrMbecyXBatEPjrSfGEGS2jh6','2022-10-12 11:46:10.490Z','users75657',0,'[]','llvuca81nly1qls');
+INSERT INTO users VALUES('','2022-10-10 10:36:59.438Z','test2@example.com',0,'oap640cot4yru2s','','$2a$13$RC6/uXsHWM1ZV1v0cPJLRuWPXxyNINDmUDIHTq1x1dM.K.TBgWzFK','AQbE30CNb8Ncwr6Sg0sfvDJGJuepriTJN24EHZqO5DsEBTk1kA','2022-10-11 18:37:20.744Z','test2_username',1,'["test_kfd2wYLxkz.txt"]','');
+INSERT INTO users VALUES('','2022-10-10 10:37:33.119Z','test3@example.com',1,'bgs820n361vj1qd','test3','$2a$13$qzF1J0ePG5.fvBrm0fVrtez5RRBjPOUoezvYRbTQGAfsT85d4XH2K','x6vHUi00LvM5bFeGIpwXN9xuol8k1BknfTmlySQ7YQWoTLKOa7','2022-10-12 11:46:02.462Z','users69238',1,'[]','0yxhwia2amd8gec');
+CREATE TABLE `demo1` (`created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY, `updated` TEXT DEFAULT '' NOT NULL, "text" TEXT DEFAULT '', "bool" Boolean DEFAULT FALSE, "url" TEXT DEFAULT '', "select_one" TEXT DEFAULT '', "file_one" TEXT DEFAULT '', "file_many" TEXT DEFAULT '', "number" REAL DEFAULT 0, "email" TEXT DEFAULT '', "datetime" TEXT DEFAULT '', "json" JSON DEFAULT NULL, "rel_one" TEXT DEFAULT '', "select_many" TEXT DEFAULT '', "rel_many" JSON DEFAULT '[]' NOT NULL, "point" JSON DEFAULT '{"lat":0,"lon":0}' NOT NULL);
+INSERT INTO demo1 VALUES('2022-10-14 10:13:12.397Z','84nmscqy84lsi1t','2023-01-04 20:11:20.732Z','test',1,'https://example.copm','optionB','test_d61b33QdDU.txt','["test_QZFjKjXchk.txt","300_WlbFWSGmW9.png","logo_vcfJJG5TAh.svg","test_MaWC6mWyrP.txt","test_tC1Yc87DfC.txt"]',123456.0,'test@example.com','2022-10-01 12:00:00.000Z',replace(replace('[\r\n  1,\r\n  2,\r\n  3\r\n]','\r',char(13)),'\n',char(10)),'','["optionB","optionC"]','["oap640cot4yru2s"]','{"lat":0,"lon":0}');
+INSERT INTO demo1 VALUES('2022-10-14 10:14:04.685Z','al1h9ijdeojtsjy','2025-04-02 11:05:26.292Z','test2',0,'','optionB','300_Jsjq7RdBgA.png','[]',456.0,'test2@example.com','','null','84nmscqy84lsi1t','["optionB"]','["bgs820n361vj1qd","4q1xlclmfloku33","oap640cot4yru2s"]','{"lon":23.333157,"lat":42.654318}');
+INSERT INTO demo1 VALUES('2022-10-14 10:36:21.012Z','imy661ixudk5izi','2025-04-02 11:05:03.433Z','lorem ipsum',0,'','','','[]',0.0,'','','null','','[]','[]','{"lon":-74.006015,"lat":40.712728}');
+CREATE TABLE `demo2` (`created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY, `title` TEXT DEFAULT '', `updated` TEXT DEFAULT '' NOT NULL, "active" Boolean DEFAULT FALSE);
+INSERT INTO demo2 VALUES('2022-10-12 11:42:51.509Z','llvuca81nly1qls','test1','2022-10-12 11:42:51.509Z',0);
+INSERT INTO demo2 VALUES('2022-10-12 11:42:55.076Z','achvryl401bhse3','test2','2022-10-14 10:52:46.726Z',1);
+INSERT INTO demo2 VALUES('2022-10-12 11:42:58.215Z','0yxhwia2amd8gec','test3','2022-10-14 10:52:49.596Z',1);
+CREATE TABLE `demo3` (`created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY, `title` TEXT DEFAULT '', `updated` TEXT DEFAULT '' NOT NULL, "files" TEXT DEFAULT '');
+INSERT INTO demo3 VALUES('2022-10-14 11:41:09.381Z','1tmknxy2868d869','test1','2022-10-14 11:41:09.381Z','[]');
+INSERT INTO demo3 VALUES('2022-10-14 11:41:12.548Z','lcl9d87w22ml6jy','test2','2022-10-14 14:08:29.095Z','["test_FLurQTgrY8.txt","300_UhLKX91HVb.png"]');
+INSERT INTO demo3 VALUES('2022-10-14 11:41:15.689Z','7nwo8tuiatetxdm','test3','2022-10-14 14:08:16.072Z','["test_JnXeKEwgwr.txt"]');
+INSERT INTO demo3 VALUES('2022-10-14 11:41:18.877Z','mk5fmymtx4wsprk','test4','2022-10-14 14:08:06.446Z','["300_JdfBOieXAW.png"]');
+CREATE TABLE `demo4` (`created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY, `title` TEXT DEFAULT '', `updated` TEXT DEFAULT '' NOT NULL, "rel_one_no_cascade" TEXT DEFAULT '', "rel_one_no_cascade_required" TEXT DEFAULT '', "rel_one_cascade" TEXT DEFAULT '', "self_rel_one" TEXT DEFAULT '', "json_array" JSON DEFAULT NULL, "json_object" JSON DEFAULT NULL, "rel_one_unique" TEXT DEFAULT '' NOT NULL, "rel_many_no_cascade" JSON DEFAULT '[]' NOT NULL, "rel_many_no_cascade_required" JSON DEFAULT '[]' NOT NULL, "rel_many_cascade" JSON DEFAULT '[]' NOT NULL, "rel_many_unique" JSON DEFAULT '[]' NOT NULL, "self_rel_many" JSON DEFAULT '[]' NOT NULL);
+INSERT INTO demo4 VALUES('2022-10-14 14:15:43.771Z','qzaqccwrmva4o1n','test1','2022-10-20 19:23:59.427Z','mk5fmymtx4wsprk','lcl9d87w22ml6jy','7nwo8tuiatetxdm','i9naidtvr6qsgb4',replace(replace('[\r\n  1\r\n]','\r',char(13)),'\n',char(10)),'{"a": 123}','','["1tmknxy2868d869"]','["lcl9d87w22ml6jy","1tmknxy2868d869"]','["mk5fmymtx4wsprk"]','[]','["i9naidtvr6qsgb4","qzaqccwrmva4o1n"]');
+INSERT INTO demo4 VALUES('2022-10-14 17:35:18.647Z','i9naidtvr6qsgb4','test2','2022-10-20 19:23:39.645Z','','lcl9d87w22ml6jy','','qzaqccwrmva4o1n','[1, 2, 3]','{"a": {"b": "test"}}','','[]','["7nwo8tuiatetxdm"]','[]','[]','[]');
+CREATE TABLE `clients` (`created` TEXT DEFAULT '' NOT NULL, `email` TEXT DEFAULT '' NOT NULL, `emailVisibility` BOOLEAN DEFAULT FALSE NOT NULL, `id` TEXT PRIMARY KEY, `name` TEXT DEFAULT '', "password" TEXT NOT NULL, `tokenKey` TEXT NOT NULL, `updated` TEXT DEFAULT '' NOT NULL, `username` TEXT NOT NULL, `verified` BOOLEAN DEFAULT FALSE NOT NULL);
+INSERT INTO clients VALUES('2022-10-11 09:42:15.113Z','test@example.com',0,'gk390qegs4y47wn','','$2a$13$utsLtiNVf226R7hhXXyOM.kHTyTcVLRNqTIrT44Fw8JZbxMhIK0uu','rMb1gUpn27s53t66gOGscSHfYsa272cgOgn4nhTZIl4fIC8XP8','2022-10-11 09:42:15.113Z','clients57772',1);
+INSERT INTO clients VALUES('2022-10-11 09:42:25.984Z','test2@example.com',0,'o1y0dd0spd786md','test_name','$2a$13$D/8j2Q7NzN5g/INiVn8qPOa2O3qkyZj7U82CXOyqzBFV0B9OdWhvC','RunSD73nFfH3sNScreizPcZYNkiPls2YjmFYPNo73cWKsDnZVm','2022-10-14 11:44:33.150Z','clients43362',0);
+CREATE TABLE IF NOT EXISTS "nologin" (`created` TEXT DEFAULT '' NOT NULL, `email` TEXT DEFAULT '' NOT NULL, `emailVisibility` BOOLEAN DEFAULT FALSE NOT NULL, `id` TEXT PRIMARY KEY, `name` TEXT DEFAULT '', "password" TEXT NOT NULL, `tokenKey` TEXT NOT NULL, `updated` TEXT DEFAULT '' NOT NULL, `username` TEXT NOT NULL, `verified` BOOLEAN DEFAULT FALSE NOT NULL);
+INSERT INTO nologin VALUES('2022-10-12 10:39:47.633Z','test@example.com',0,'dc49k6jgejn40h3','test','$2a$13$395zl/w/nUmeo.vov5t6SO0/RsoE4suJnKLN2SzP41sJCe6PBAePq','6mi4JvnX8uIxS7JiO8LWl150Af8mnAGWkWRImHL2YB4XhOYf9c','2022-10-12 10:39:47.633Z','test_username',0);
+INSERT INTO nologin VALUES('2022-10-12 10:39:59.058Z','test2@example.com',1,'phhq3wr65cap535','','$2a$13$ldkBOjQbXIXP3.xvJ8AXJep5I3kMzmXWu7wC75mP5RN4qK7mwQIK.','9Bsj2ogZ5b0Q3daAKZ5ZZrUuVb7lWHO0YDD4d5TbPCLfYE3COY','2022-10-14 12:03:49.335Z','viewers74618',0);
+INSERT INTO nologin VALUES('2022-10-14 12:16:52.515Z','test3@example.com',0,'oos036e9xvqeexy','','$2a$13$oXNjS0xVi4aYHSaQ10bTOOMRvVFBY2t474S3UjM8.5BNnL5WB1Gce','uYafEN2cDgImHKMW4SfZ6tayrENAJVVWOTDxFXatOs2AO0KEMY','2022-10-14 12:16:52.515Z','nologin84738',1);
+CREATE TABLE `demo5` (`created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY NOT NULL, `rel_many` TEXT DEFAULT '', `rel_one` TEXT DEFAULT '', `select_many` TEXT DEFAULT '', `select_one` TEXT DEFAULT '', `updated` TEXT DEFAULT '' NOT NULL, "total" REAL DEFAULT 0, "file" TEXT DEFAULT '');
+INSERT INTO demo5 VALUES('2023-01-07 13:13:24.249Z','qjeql998mtp1azp','["qzaqccwrmva4o1n","i9naidtvr6qsgb4"]','i9naidtvr6qsgb4','["b","c","a"]','b','2023-02-18 11:51:08.128Z',0.0,'logo_vcf_jjg5_tah_9MtIHytOmZ.svg');
+INSERT INTO demo5 VALUES('2023-01-07 13:13:28.337Z','la4y2w4o98acwuj','[]','','[]','','2023-02-18 11:50:46.943Z',2.0,'300_uh_lkx91_hvb_Da8K5pl069.png');
+CREATE TABLE IF NOT EXISTS "_superusers" (`created` TEXT DEFAULT '' NOT NULL, `email` TEXT DEFAULT '' NOT NULL, `emailVisibility` BOOLEAN DEFAULT FALSE NOT NULL, `id` TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL, `password` TEXT DEFAULT '' NOT NULL, `tokenKey` TEXT DEFAULT '' NOT NULL, `updated` TEXT DEFAULT '' NOT NULL, `verified` BOOLEAN DEFAULT FALSE NOT NULL);
+INSERT INTO _superusers VALUES('2022-10-10 09:50:06.449Z','test@example.com',0,'sywbhecnh46rhm0','$2a$13$6PP1fpShEsQHpZElw4.BN.vMl/2CMIKc2kpumJM//T4qV4RGUgb6i','O4rvW9FSUyTA3xUuQmXR3wHF2db9bHs19nBHeSgVTxerOsTAl4','2022-10-10 09:50:06.449Z',1);
+INSERT INTO _superusers VALUES('2022-10-10 11:22:27.982Z','test2@example.com',0,'sbmbsdb40jyxf7h','$2a$13$1U32ttl.v1VtQkIH.a.z2.VVrU2IFwkW41TnY2OgyMcjADv34ynMK','cvg1nk1dKRFlazQH8nCKuFYwczdReQx6ZJimxXvei0uDyTkgEb','2022-10-10 11:22:31.096Z',1);
+INSERT INTO _superusers VALUES('2022-10-10 11:22:50.693Z','test3@example.com',0,'9q2trqumvlyr3bd','$2a$13$gqXkfs0WjqTtUNRjRDxAHuLul1sxmA.elEfYuL0KT0ef5cMDt9Fjm','ezLvEu7DRFtUp9BI6nxtXCpgtp7qWaNQLdD6dDwjIVB0mA0uUr','2022-10-10 11:22:54.907Z',1);
+INSERT INTO _superusers VALUES('2024-07-26 12:17:43.787Z','test4@example.com',0,'q911776rrfy658l','$2a$10$0CUWH81tPWUhxKqksZnO/eDfJiWTTG/xg7v5Yg8RhcLIGWY3oeCHe','B4LS_3ZiIlL_TQ97_W_u2_82__W1_l64037w_x211_F_BM_J4_','2024-07-26 12:17:43.787Z',1);
+CREATE TABLE IF NOT EXISTS "_externalAuths" (`collectionRef` TEXT DEFAULT '' NOT NULL, `created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL, `provider` TEXT DEFAULT '' NOT NULL, `providerId` TEXT DEFAULT '' NOT NULL, `recordRef` TEXT DEFAULT '' NOT NULL, `updated` TEXT DEFAULT '' NOT NULL);
+INSERT INTO _externalAuths VALUES('_pb_users_auth_','2023-01-01 01:02:03.456Z','clmflokuq1xl341','google','test123','4q1xlclmfloku33','2022-01-01 01:01:01.123Z');
+INSERT INTO _externalAuths VALUES('_pb_users_auth_','2022-01-01 01:01:01.123Z','dlmflokuq1xl342','gitlab','test123','4q1xlclmfloku33','2022-01-01 01:01:01.123Z');
+INSERT INTO _externalAuths VALUES('v851q4r790rhknl','2024-07-29 11:56:28.439Z','f1z5b3843pzc964','google','test456','gk390qegs4y47wn','2024-07-29 11:56:35.151Z');
+INSERT INTO _externalAuths VALUES('_pb_users_auth_','2024-07-29 11:57:28.598Z','5eto7nmys833164','github','test456','bgs820n361vj1qd','2024-07-29 11:57:28.598Z');
+CREATE TABLE `_params` (`created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL, `updated` TEXT DEFAULT '' NOT NULL, `value` JSON DEFAULT NULL);
+INSERT INTO _params VALUES('','settings','2024-09-11 15:34:33.155Z',X'7b22736d7470223a7b22656e61626c6564223a66616c73652c22706f7274223a3538372c22686f7374223a22736d74702e6578616d706c652e636f6d222c22757365726e616d65223a22222c22617574684d6574686f64223a22222c22746c73223a66616c73652c226c6f63616c4e616d65223a22227d2c226261636b757073223a7b2263726f6e223a22222c2263726f6e4d61784b656570223a302c227333223a7b22656e61626c6564223a66616c73652c226275636b6574223a22222c22726567696f6e223a22222c22656e64706f696e74223a22222c226163636573734b6579223a22222c22666f726365506174685374796c65223a66616c73657d7d2c227333223a7b22656e61626c6564223a66616c73652c226275636b6574223a22222c22726567696f6e223a22222c22656e64706f696e74223a22222c226163636573734b6579223a22222c22666f726365506174685374796c65223a66616c73657d2c226d657461223a7b226170704e616d65223a2261636d655f74657374222c2261707055524c223a22687474703a2f2f6c6f63616c686f73743a38303930222c2273656e6465724e616d65223a22537570706f7274222c2273656e64657241646472657373223a22737570706f7274406578616d706c652e636f6d222c2268696465436f6e74726f6c73223a66616c73657d2c226c6f6773223a7b226d617844617973223a352c226d696e4c6576656c223a302c226c6f674950223a66616c73657d2c226261746368223a7b22656e61626c6564223a747275652c226d61785265717565737473223a35302c2274696d656f7574223a352c226d6178426f647953697a65223a307d2c22726174654c696d697473223a7b2272756c6573223a5b7b226c6162656c223a222a3a61757468222c226d61785265717565737473223a322c226475726174696f6e223a337d2c7b226c6162656c223a222a3a637265617465222c226d61785265717565737473223a32302c226475726174696f6e223a357d2c7b226c6162656c223a222f6170692f6261746368222c226d61785265717565737473223a332c226475726174696f6e223a317d2c7b226c6162656c223a222f6170692f222c226d61785265717565737473223a3330302c226475726174696f6e223a31307d5d2c22656e61626c6564223a66616c73657d2c227472757374656450726f7879223a7b2268656164657273223a5b5d2c227573654c6566746d6f73744950223a66616c73657d7d');
+CREATE TABLE IF NOT EXISTS "_mfas" (`collectionRef` TEXT DEFAULT '' NOT NULL, `created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL, `method` TEXT DEFAULT '' NOT NULL, `recordRef` TEXT DEFAULT '' NOT NULL, `updated` TEXT DEFAULT '' NOT NULL);
+CREATE TABLE IF NOT EXISTS "_otps" (`collectionRef` TEXT DEFAULT '' NOT NULL, `created` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL, `password` TEXT DEFAULT '' NOT NULL, `recordRef` TEXT DEFAULT '' NOT NULL, `updated` TEXT DEFAULT '' NOT NULL, "sentTo" TEXT DEFAULT '' NOT NULL);
+CREATE TABLE IF NOT EXISTS "_authOrigins" (`collectionRef` TEXT DEFAULT '' NOT NULL, `created` TEXT DEFAULT '' NOT NULL, `fingerprint` TEXT DEFAULT '' NOT NULL, `id` TEXT PRIMARY KEY DEFAULT ('r'||lower(hex(randomblob(7)))) NOT NULL, `recordRef` TEXT DEFAULT '' NOT NULL, `updated` TEXT DEFAULT '' NOT NULL);
+INSERT INTO _authOrigins VALUES('pbc_3142635823','2024-07-13 09:24:15.442Z','6afbfe481c31c08c55a746cccb88ece0','5f29jy38bf5zm3f','sywbhecnh46rhm0','2024-11-04 16:41:03.658Z');
+INSERT INTO _authOrigins VALUES('pbc_3142635823','2024-07-26 12:10:47.102Z','22bbbcbed36e25321f384ccf99f60057','dmy260k6ksjr4ib','sbmbsdb40jyxf7h','2024-11-04 16:41:03.656Z');
+INSERT INTO _authOrigins VALUES('pbc_3142635823','2024-07-26 12:11:38.697Z','6afbfe481c31c08c55a746cccb88ece0','ic55o70g4f8pcl4','sbmbsdb40jyxf7h','2024-11-04 16:41:03.654Z');
+INSERT INTO _authOrigins VALUES('pbc_3142635823','2024-07-26 12:12:17.972Z','dc879cfc889d0f1c1f3258d6f3a828fe','5798yh833k6w6w0','sbmbsdb40jyxf7h','2024-11-04 16:41:03.650Z');
+INSERT INTO _authOrigins VALUES('v851q4r790rhknl','2024-07-26 12:22:37.681Z','22bbbcbed36e25321f384ccf99f60057','9r2j0m74260ur8i','gk390qegs4y47wn','2024-07-26 12:22:37.681Z');
+ANALYZE sqlite_schema;
+INSERT INTO sqlite_stat1 VALUES('authOrigins','idx_authOrigins_unique_pairs','7 4 3 1');
+INSERT INTO sqlite_stat1 VALUES('authOrigins','sqlite_autoindex_authOrigins_1','7 1');
+INSERT INTO sqlite_stat1 VALUES('_params','sqlite_autoindex__params_1','1 1');
+INSERT INTO sqlite_stat1 VALUES('externalAuths','idx_externalAuths_collection_provider','4 2 1 1');
+INSERT INTO sqlite_stat1 VALUES('externalAuths','idx_externalAuths_record_provider','4 2 2 1');
+INSERT INTO sqlite_stat1 VALUES('externalAuths','sqlite_autoindex_externalAuths_1','4 1');
+INSERT INTO sqlite_stat1 VALUES('superusers','sqlite_autoindex_superusers_1','4 1');
+INSERT INTO sqlite_stat1 VALUES('demo5','_9n89pl5vkct6330_created_idx','2 1');
+INSERT INTO sqlite_stat1 VALUES('demo5','sqlite_autoindex_demo5_1','2 1');
+INSERT INTO sqlite_stat1 VALUES('users','__pb_users_auth__created_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('users','__pb_users_auth__tokenKey_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('users','__pb_users_auth__email_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('users','__pb_users_auth__username_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('users','sqlite_autoindex_users_1','3 1');
+INSERT INTO sqlite_stat1 VALUES('nologin','_kpv709sk2lqbqk8_created_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('nologin','_kpv709sk2lqbqk8_tokenKey_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('nologin','_kpv709sk2lqbqk8_email_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('nologin','_kpv709sk2lqbqk8_username_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('nologin','sqlite_autoindex_nologin_1','3 1');
+INSERT INTO sqlite_stat1 VALUES('demo2','idx_demo2_active','3 2');
+INSERT INTO sqlite_stat1 VALUES('demo2','idx_unique_demo2_title','3 1');
+INSERT INTO sqlite_stat1 VALUES('demo2','idx_demo2_created','3 1');
+INSERT INTO sqlite_stat1 VALUES('demo2','sqlite_autoindex_demo2_1','3 1');
+INSERT INTO sqlite_stat1 VALUES('_migrations','sqlite_autoindex__migrations_1','54 1');
+INSERT INTO sqlite_stat1 VALUES('demo3','_wzlqyes4orhoygb_created_idx','4 1');
+INSERT INTO sqlite_stat1 VALUES('demo3','sqlite_autoindex_demo3_1','4 1');
+INSERT INTO sqlite_stat1 VALUES('clients','_v851q4r790rhknl_created_idx','2 1');
+INSERT INTO sqlite_stat1 VALUES('clients','_v851q4r790rhknl_tokenKey_idx','2 1');
+INSERT INTO sqlite_stat1 VALUES('clients','_v851q4r790rhknl_email_idx','2 1');
+INSERT INTO sqlite_stat1 VALUES('clients','_v851q4r790rhknl_username_idx','2 1');
+INSERT INTO sqlite_stat1 VALUES('clients','sqlite_autoindex_clients_1','2 1');
+INSERT INTO sqlite_stat1 VALUES('demo4','idx_IjL94ze','0 0');
+INSERT INTO sqlite_stat1 VALUES('demo4','idx_luoQV2A','0 0');
+INSERT INTO sqlite_stat1 VALUES('demo4','_4d1blo5cuycfaca_created_idx','2 1');
+INSERT INTO sqlite_stat1 VALUES('demo4','sqlite_autoindex_demo4_1','2 1');
+INSERT INTO sqlite_stat1 VALUES('_superusers','idx_email__pbc_3323866339','4 1');
+INSERT INTO sqlite_stat1 VALUES('_superusers','idx_tokenKey__pbc_3323866339','4 1');
+INSERT INTO sqlite_stat1 VALUES('_superusers','sqlite_autoindex__superusers_1','4 1');
+INSERT INTO sqlite_stat1 VALUES('_authOrigins','idx_authOrigins_unique_pairs','6 3 2 1');
+INSERT INTO sqlite_stat1 VALUES('_authOrigins','sqlite_autoindex__authOrigins_1','6 1');
+INSERT INTO sqlite_stat1 VALUES('_externalAuths','idx_externalAuths_collection_provider','4 2 1 1');
+INSERT INTO sqlite_stat1 VALUES('_externalAuths','idx_externalAuths_record_provider','4 2 2 1');
+INSERT INTO sqlite_stat1 VALUES('_externalAuths','sqlite_autoindex__externalAuths_1','4 1');
+INSERT INTO sqlite_stat1 VALUES('_collections','idx__collections_type','16 6');
+INSERT INTO sqlite_stat1 VALUES('_collections','sqlite_autoindex__collections_2','16 1');
+INSERT INTO sqlite_stat1 VALUES('_collections','sqlite_autoindex__collections_1','16 1');
+INSERT INTO sqlite_stat1 VALUES('demo1','_wsmn24bux7wo113_created_idx','3 1');
+INSERT INTO sqlite_stat1 VALUES('demo1','sqlite_autoindex_demo1_1','3 1');
+ANALYZE sqlite_schema;
+CREATE INDEX `_wzlqyes4orhoygb_created_idx` ON `demo3` (`created`);
+CREATE INDEX `idx_demo2_created` ON `demo2` (`created`);
+CREATE UNIQUE INDEX "idx_unique_demo2_title" on "demo2" ("title");
+CREATE INDEX "idx_demo2_active" ON "demo2" (
+"active"
+);
+CREATE INDEX `_9n89pl5vkct6330_created_idx` ON `demo5` (`created`);
+CREATE UNIQUE INDEX `_kpv709sk2lqbqk8_username_idx` ON `nologin` (`username`);
+CREATE UNIQUE INDEX `_kpv709sk2lqbqk8_email_idx` ON `nologin` (`email`) WHERE email != '';
+CREATE UNIQUE INDEX `_kpv709sk2lqbqk8_tokenKey_idx` ON `nologin` (`tokenKey`);
+CREATE INDEX `_kpv709sk2lqbqk8_created_idx` ON `nologin` (`created`);
+CREATE UNIQUE INDEX `__pb_users_auth__username_idx` ON `users` (`username`);
+CREATE UNIQUE INDEX `__pb_users_auth__email_idx` ON `users` (`email`) WHERE email != '';
+CREATE UNIQUE INDEX `__pb_users_auth__tokenKey_idx` ON `users` (`tokenKey`);
+CREATE INDEX `__pb_users_auth__created_idx` ON `users` (`created`);
+CREATE UNIQUE INDEX `_v851q4r790rhknl_username_idx` ON `clients` (`username`);
+CREATE UNIQUE INDEX `_v851q4r790rhknl_email_idx` ON `clients` (`email`) WHERE email != '';
+CREATE UNIQUE INDEX `_v851q4r790rhknl_tokenKey_idx` ON `clients` (`tokenKey`);
+CREATE INDEX `_v851q4r790rhknl_created_idx` ON `clients` (`created`);
+CREATE INDEX `idx_mfas_collectionRef_recordRef` ON "_mfas" (
+  `collectionRef`,
+  `recordRef`
+);
+CREATE UNIQUE INDEX `idx_authOrigins_unique_pairs` ON "_authOrigins" (
+  `collectionRef`,
+  `recordRef`,
+  `fingerprint`
+);
+CREATE UNIQUE INDEX `idx_externalAuths_record_provider` ON "_externalAuths" (
+  `collectionRef`,
+  `recordRef`,
+  `provider`
+);
+CREATE UNIQUE INDEX `idx_externalAuths_collection_provider` ON "_externalAuths" (
+  `collectionRef`,
+  `provider`,
+  `providerId`
+);
+CREATE INDEX `_4d1blo5cuycfaca_created_idx` ON `demo4` (`created`);
+CREATE UNIQUE INDEX `idx_luoQV2A` ON `demo4` (`rel_one_unique`) WHERE rel_one_unique != '';
+CREATE UNIQUE INDEX `idx_IjL94ze` ON `demo4` (`rel_many_unique`) WHERE rel_many_unique != '[]';
+CREATE UNIQUE INDEX `idx_tokenKey__pbc_3323866339` ON `_superusers` (`tokenKey`);
+CREATE UNIQUE INDEX `idx_email__pbc_3323866339` ON `_superusers` (`email`) WHERE `email` != '';
+CREATE INDEX idx__collections_type on `_collections` (`type`);
+CREATE INDEX `idx_otps_collectionRef_recordRef` ON `_otps` (
+  `collectionRef`,
+  `recordRef`
+);
+CREATE VIEW `view2` AS SELECT * FROM (SELECT view1.id, view1.bool as state, view1.file_many, view1.rel_many from view1);
+CREATE VIEW `numeric_id_view` AS SELECT * FROM (SELECT CAST(`id` as TEXT) `id`,`email` FROM (select (ROW_NUMBER() OVER()) as id, email from clients));
+CREATE INDEX `_wsmn24bux7wo113_created_idx` ON `demo1` (`created`);
+CREATE VIEW `view1` AS SELECT * FROM (select id, text, bool, url, select_one, select_many, file_one, file_many, number, email, datetime, json, rel_one, rel_many, point, created from demo1);
+COMMIT;
diff --git a/server/core_backend-server/tests/data/lost+found/test.txt b/server/core_backend-server/tests/data/lost+found/test.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/server/core_backend-server/tests/data/lost+found/test.txt
@@ -0,0 +1 @@
+test
diff --git a/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/300_uh_lkx91_hvb_Da8K5pl069.png b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/300_uh_lkx91_hvb_Da8K5pl069.png
new file mode 100644
index 0000000..f6ce991
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/300_uh_lkx91_hvb_Da8K5pl069.png differ
diff --git a/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/300_uh_lkx91_hvb_Da8K5pl069.png.attrs b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/300_uh_lkx91_hvb_Da8K5pl069.png.attrs
new file mode 100644
index 0000000..06e64d6
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/300_uh_lkx91_hvb_Da8K5pl069.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":{"original-filename":"300_UhLKX91HVb.png"},"md5":"zZhZjzVvCvpcxtMAJie3GQ=="}
diff --git a/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/thumbs_300_uh_lkx91_hvb_Da8K5pl069.png/100x100_300_uh_lkx91_hvb_Da8K5pl069.png b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/thumbs_300_uh_lkx91_hvb_Da8K5pl069.png/100x100_300_uh_lkx91_hvb_Da8K5pl069.png
new file mode 100644
index 0000000..1b87677
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/thumbs_300_uh_lkx91_hvb_Da8K5pl069.png/100x100_300_uh_lkx91_hvb_Da8K5pl069.png differ
diff --git a/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/thumbs_300_uh_lkx91_hvb_Da8K5pl069.png/100x100_300_uh_lkx91_hvb_Da8K5pl069.png.attrs b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/thumbs_300_uh_lkx91_hvb_Da8K5pl069.png/100x100_300_uh_lkx91_hvb_Da8K5pl069.png.attrs
new file mode 100644
index 0000000..64e4c1d
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/la4y2w4o98acwuj/thumbs_300_uh_lkx91_hvb_Da8K5pl069.png/100x100_300_uh_lkx91_hvb_Da8K5pl069.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"R7TqfvF8HP3C4+FO2eZ9tg=="}
diff --git a/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/qjeql998mtp1azp/logo_vcf_jjg5_tah_9MtIHytOmZ.svg b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/qjeql998mtp1azp/logo_vcf_jjg5_tah_9MtIHytOmZ.svg
new file mode 100644
index 0000000..5b5de95
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/qjeql998mtp1azp/logo_vcf_jjg5_tah_9MtIHytOmZ.svg
@@ -0,0 +1,9 @@
+<svg width="40" height="40" viewBox="0 0 40 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="25.536" y="13.4861" width="1.71467" height="16.7338" transform="rotate(45.9772 25.536 13.4861)" fill="white"/>
+<path d="M26 14H36.8C37.4628 14 38 14.5373 38 15.2V36.8C38 37.4628 37.4628 38 36.8 38H15.2C14.5373 38 14 37.4628 14 36.8V26" fill="white"/>
+<path d="M26 14H36.8C37.4628 14 38 14.5373 38 15.2V36.8C38 37.4628 37.4628 38 36.8 38H15.2C14.5373 38 14 37.4628 14 36.8V26" stroke="#16161a" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M26 14V3.2C26 2.53726 25.4628 2 24.8 2H3.2C2.53726 2 2 2.53726 2 3.2V24.8C2 25.4628 2.53726 26 3.2 26H14" fill="white"/>
+<path d="M26 14V3.2C26 2.53726 25.4628 2 24.8 2H3.2C2.53726 2 2 2.53726 2 3.2V24.8C2 25.4628 2.53726 26 3.2 26H14" stroke="#16161a" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M10 20C9.44772 20 9 19.5523 9 19V8C9 7.44772 9.44772 7 10 7H13.7531C14.4801 7 15.1591 7.07311 15.7901 7.21932C16.4348 7.35225 16.9904 7.58487 17.4568 7.91718C17.9369 8.2362 18.3141 8.6682 18.5885 9.21319C18.8628 9.74489 19 10.4029 19 11.1871C19 11.9448 18.856 12.6028 18.5679 13.161C18.2936 13.7193 17.9163 14.1779 17.4362 14.5368C16.9561 14.8957 16.4005 15.1616 15.7695 15.3344C15.1385 15.5072 14.4664 15.5936 13.7531 15.5936H13.0247C12.4724 15.5936 12.0247 16.0413 12.0247 16.5936V19C12.0247 19.5523 11.577 20 11.0247 20H10ZM12.0247 12.2607C12.0247 12.813 12.4724 13.2607 13.0247 13.2607H13.5679C15.214 13.2607 16.037 12.5695 16.037 11.1871C16.037 10.5092 15.8244 10.0307 15.3992 9.75153C14.9877 9.47239 14.3772 9.33282 13.5679 9.33282H13.0247C12.4724 9.33282 12.0247 9.78054 12.0247 10.3328V12.2607Z" fill="#16161a"/>
+<path d="M22 33C21.4477 33 21 32.5523 21 32V21C21 20.4477 21.4477 20 22 20H25.4877C26.1844 20 26.8265 20.0532 27.4139 20.1595C28.015 20.2526 28.5342 20.4254 28.9713 20.6779C29.4085 20.9305 29.75 21.2628 29.9959 21.6748C30.2555 22.0869 30.3852 22.6053 30.3852 23.2301C30.3852 23.5225 30.3374 23.8149 30.2418 24.1074C30.1598 24.3998 30.0232 24.6723 29.832 24.9248C29.6407 25.1774 29.4016 25.4034 29.1148 25.6028C28.837 25.7958 28.5081 25.939 28.1279 26.0323C28.1058 26.0378 28.0902 26.0575 28.0902 26.0802V26.0802C28.0902 26.1039 28.1073 26.1242 28.1306 26.1286C29.0669 26.3034 29.7774 26.6332 30.2623 27.1181C30.7541 27.6099 31 28.2945 31 29.1718C31 29.8364 30.8702 30.408 30.6107 30.8865C30.3511 31.365 29.9891 31.7638 29.5246 32.0828C29.0601 32.3885 28.5137 32.6212 27.8852 32.7807C27.2705 32.9269 26.6011 33 25.8771 33H22ZM24.0123 24.2239C24.0123 24.7762 24.46 25.2239 25.0123 25.2239H25.3443C26.082 25.2239 26.6148 25.0844 26.9426 24.8052C27.2705 24.5261 27.4344 24.1339 27.4344 23.6288C27.4344 23.1503 27.2637 22.8113 26.9221 22.612C26.5943 22.3993 26.0751 22.2929 25.3648 22.2929H25.0123C24.46 22.2929 24.0123 22.7407 24.0123 23.2929V24.2239ZM24.0123 29.7071C24.0123 30.2593 24.46 30.7071 25.0123 30.7071H25.6311C27.2432 30.7071 28.0492 30.1222 28.0492 28.9525C28.0492 28.3809 27.8511 27.9688 27.4549 27.7163C27.0724 27.4637 26.4645 27.3374 25.6311 27.3374H25.0123C24.46 27.3374 24.0123 27.7851 24.0123 28.3374V29.7071Z" fill="#16161a"/>
+</svg>
diff --git a/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/qjeql998mtp1azp/logo_vcf_jjg5_tah_9MtIHytOmZ.svg.attrs b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/qjeql998mtp1azp/logo_vcf_jjg5_tah_9MtIHytOmZ.svg.attrs
new file mode 100644
index 0000000..749a85e
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/9n89pl5vkct6330/qjeql998mtp1azp/logo_vcf_jjg5_tah_9MtIHytOmZ.svg.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/svg+xml","user.metadata":{"original-filename":"logo_vcfJJG5TAh.svg"},"md5":"9/B7afas4c3O6vbFcbpOug=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png
new file mode 100644
index 0000000..f6ce991
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png differ
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png.attrs
new file mode 100644
index 0000000..e78288f
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/300_1SEi6Q6U72.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"zZhZjzVvCvpcxtMAJie3GQ=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/0x50_300_1SEi6Q6U72.png b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/0x50_300_1SEi6Q6U72.png
new file mode 100644
index 0000000..21cedaf
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/0x50_300_1SEi6Q6U72.png differ
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/0x50_300_1SEi6Q6U72.png.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/0x50_300_1SEi6Q6U72.png.attrs
new file mode 100644
index 0000000..25de6a1
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/0x50_300_1SEi6Q6U72.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"iqCiUST0LvGibMMM1qxZAA=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/100x100_300_1SEi6Q6U72.png b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/100x100_300_1SEi6Q6U72.png
new file mode 100644
index 0000000..1b87677
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/100x100_300_1SEi6Q6U72.png differ
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/100x100_300_1SEi6Q6U72.png.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/100x100_300_1SEi6Q6U72.png.attrs
new file mode 100644
index 0000000..64e4c1d
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/100x100_300_1SEi6Q6U72.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"R7TqfvF8HP3C4+FO2eZ9tg=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x0_300_1SEi6Q6U72.png b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x0_300_1SEi6Q6U72.png
new file mode 100644
index 0000000..8eef56d
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x0_300_1SEi6Q6U72.png differ
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x0_300_1SEi6Q6U72.png.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x0_300_1SEi6Q6U72.png.attrs
new file mode 100644
index 0000000..a382ad3
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x0_300_1SEi6Q6U72.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"XQUKRr4ZwZ9MTo2kR+KfIg=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50_300_1SEi6Q6U72.png b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50_300_1SEi6Q6U72.png
new file mode 100644
index 0000000..e261a55
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50_300_1SEi6Q6U72.png differ
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50_300_1SEi6Q6U72.png.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50_300_1SEi6Q6U72.png.attrs
new file mode 100644
index 0000000..df305ab
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50_300_1SEi6Q6U72.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"EoyFICWlQdYZgUYTEMsp/A=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50b_300_1SEi6Q6U72.png b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50b_300_1SEi6Q6U72.png
new file mode 100644
index 0000000..77b1107
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50b_300_1SEi6Q6U72.png differ
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50b_300_1SEi6Q6U72.png.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50b_300_1SEi6Q6U72.png.attrs
new file mode 100644
index 0000000..0a7f165
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50b_300_1SEi6Q6U72.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"Pb/AI46vKOtcBW9bOsdREA=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50f_300_1SEi6Q6U72.png b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50f_300_1SEi6Q6U72.png
new file mode 100644
index 0000000..21cedaf
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50f_300_1SEi6Q6U72.png differ
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50f_300_1SEi6Q6U72.png.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50f_300_1SEi6Q6U72.png.attrs
new file mode 100644
index 0000000..25de6a1
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50f_300_1SEi6Q6U72.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"iqCiUST0LvGibMMM1qxZAA=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50t_300_1SEi6Q6U72.png b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50t_300_1SEi6Q6U72.png
new file mode 100644
index 0000000..beeaf73
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50t_300_1SEi6Q6U72.png differ
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50t_300_1SEi6Q6U72.png.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50t_300_1SEi6Q6U72.png.attrs
new file mode 100644
index 0000000..7774ef0
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/4q1xlclmfloku33/thumbs_300_1SEi6Q6U72.png/70x50t_300_1SEi6Q6U72.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"rcwrlxKlvwTgDpsHLHzBqA=="}
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt b/server/core_backend-server/tests/data/storage/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt
@@ -0,0 +1 @@
+test
diff --git a/server/core_backend-server/tests/data/storage/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt.attrs b/server/core_backend-server/tests/data/storage/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt.attrs
new file mode 100644
index 0000000..3396b8b
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/_pb_users_auth_/oap640cot4yru2s/test_kfd2wYLxkz.txt.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":null,"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/300_WlbFWSGmW9.png b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/300_WlbFWSGmW9.png
new file mode 100644
index 0000000..f6ce991
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/300_WlbFWSGmW9.png differ
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/300_WlbFWSGmW9.png.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/300_WlbFWSGmW9.png.attrs
new file mode 100644
index 0000000..e78288f
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/300_WlbFWSGmW9.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"zZhZjzVvCvpcxtMAJie3GQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/logo_vcfJJG5TAh.svg b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/logo_vcfJJG5TAh.svg
new file mode 100644
index 0000000..5b5de95
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/logo_vcfJJG5TAh.svg
@@ -0,0 +1,9 @@
+<svg width="40" height="40" viewBox="0 0 40 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect x="25.536" y="13.4861" width="1.71467" height="16.7338" transform="rotate(45.9772 25.536 13.4861)" fill="white"/>
+<path d="M26 14H36.8C37.4628 14 38 14.5373 38 15.2V36.8C38 37.4628 37.4628 38 36.8 38H15.2C14.5373 38 14 37.4628 14 36.8V26" fill="white"/>
+<path d="M26 14H36.8C37.4628 14 38 14.5373 38 15.2V36.8C38 37.4628 37.4628 38 36.8 38H15.2C14.5373 38 14 37.4628 14 36.8V26" stroke="#16161a" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M26 14V3.2C26 2.53726 25.4628 2 24.8 2H3.2C2.53726 2 2 2.53726 2 3.2V24.8C2 25.4628 2.53726 26 3.2 26H14" fill="white"/>
+<path d="M26 14V3.2C26 2.53726 25.4628 2 24.8 2H3.2C2.53726 2 2 2.53726 2 3.2V24.8C2 25.4628 2.53726 26 3.2 26H14" stroke="#16161a" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M10 20C9.44772 20 9 19.5523 9 19V8C9 7.44772 9.44772 7 10 7H13.7531C14.4801 7 15.1591 7.07311 15.7901 7.21932C16.4348 7.35225 16.9904 7.58487 17.4568 7.91718C17.9369 8.2362 18.3141 8.6682 18.5885 9.21319C18.8628 9.74489 19 10.4029 19 11.1871C19 11.9448 18.856 12.6028 18.5679 13.161C18.2936 13.7193 17.9163 14.1779 17.4362 14.5368C16.9561 14.8957 16.4005 15.1616 15.7695 15.3344C15.1385 15.5072 14.4664 15.5936 13.7531 15.5936H13.0247C12.4724 15.5936 12.0247 16.0413 12.0247 16.5936V19C12.0247 19.5523 11.577 20 11.0247 20H10ZM12.0247 12.2607C12.0247 12.813 12.4724 13.2607 13.0247 13.2607H13.5679C15.214 13.2607 16.037 12.5695 16.037 11.1871C16.037 10.5092 15.8244 10.0307 15.3992 9.75153C14.9877 9.47239 14.3772 9.33282 13.5679 9.33282H13.0247C12.4724 9.33282 12.0247 9.78054 12.0247 10.3328V12.2607Z" fill="#16161a"/>
+<path d="M22 33C21.4477 33 21 32.5523 21 32V21C21 20.4477 21.4477 20 22 20H25.4877C26.1844 20 26.8265 20.0532 27.4139 20.1595C28.015 20.2526 28.5342 20.4254 28.9713 20.6779C29.4085 20.9305 29.75 21.2628 29.9959 21.6748C30.2555 22.0869 30.3852 22.6053 30.3852 23.2301C30.3852 23.5225 30.3374 23.8149 30.2418 24.1074C30.1598 24.3998 30.0232 24.6723 29.832 24.9248C29.6407 25.1774 29.4016 25.4034 29.1148 25.6028C28.837 25.7958 28.5081 25.939 28.1279 26.0323C28.1058 26.0378 28.0902 26.0575 28.0902 26.0802V26.0802C28.0902 26.1039 28.1073 26.1242 28.1306 26.1286C29.0669 26.3034 29.7774 26.6332 30.2623 27.1181C30.7541 27.6099 31 28.2945 31 29.1718C31 29.8364 30.8702 30.408 30.6107 30.8865C30.3511 31.365 29.9891 31.7638 29.5246 32.0828C29.0601 32.3885 28.5137 32.6212 27.8852 32.7807C27.2705 32.9269 26.6011 33 25.8771 33H22ZM24.0123 24.2239C24.0123 24.7762 24.46 25.2239 25.0123 25.2239H25.3443C26.082 25.2239 26.6148 25.0844 26.9426 24.8052C27.2705 24.5261 27.4344 24.1339 27.4344 23.6288C27.4344 23.1503 27.2637 22.8113 26.9221 22.612C26.5943 22.3993 26.0751 22.2929 25.3648 22.2929H25.0123C24.46 22.2929 24.0123 22.7407 24.0123 23.2929V24.2239ZM24.0123 29.7071C24.0123 30.2593 24.46 30.7071 25.0123 30.7071H25.6311C27.2432 30.7071 28.0492 30.1222 28.0492 28.9525C28.0492 28.3809 27.8511 27.9688 27.4549 27.7163C27.0724 27.4637 26.4645 27.3374 25.6311 27.3374H25.0123C24.46 27.3374 24.0123 27.7851 24.0123 28.3374V29.7071Z" fill="#16161a"/>
+</svg>
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/logo_vcfJJG5TAh.svg.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/logo_vcfJJG5TAh.svg.attrs
new file mode 100644
index 0000000..7938a5a
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/logo_vcfJJG5TAh.svg.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/svg+xml","user.metadata":null,"md5":"9/B7afas4c3O6vbFcbpOug=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_MaWC6mWyrP.txt b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_MaWC6mWyrP.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_MaWC6mWyrP.txt
@@ -0,0 +1 @@
+test
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_MaWC6mWyrP.txt.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_MaWC6mWyrP.txt.attrs
new file mode 100644
index 0000000..921ce26
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_MaWC6mWyrP.txt.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":{"original-filename":"test.txt"},"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_QZFjKjXchk.txt b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_QZFjKjXchk.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_QZFjKjXchk.txt
@@ -0,0 +1 @@
+test
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_QZFjKjXchk.txt.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_QZFjKjXchk.txt.attrs
new file mode 100644
index 0000000..3396b8b
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_QZFjKjXchk.txt.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":null,"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_d61b33QdDU.txt b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_d61b33QdDU.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_d61b33QdDU.txt
@@ -0,0 +1 @@
+test
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_d61b33QdDU.txt.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_d61b33QdDU.txt.attrs
new file mode 100644
index 0000000..3396b8b
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_d61b33QdDU.txt.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":null,"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_tC1Yc87DfC.txt b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_tC1Yc87DfC.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_tC1Yc87DfC.txt
@@ -0,0 +1 @@
+test
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_tC1Yc87DfC.txt.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_tC1Yc87DfC.txt.attrs
new file mode 100644
index 0000000..921ce26
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/test_tC1Yc87DfC.txt.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":{"original-filename":"test.txt"},"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/thumbs_300_WlbFWSGmW9.png/100x100_300_WlbFWSGmW9.png b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/thumbs_300_WlbFWSGmW9.png/100x100_300_WlbFWSGmW9.png
new file mode 100644
index 0000000..1b87677
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/thumbs_300_WlbFWSGmW9.png/100x100_300_WlbFWSGmW9.png differ
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/thumbs_300_WlbFWSGmW9.png/100x100_300_WlbFWSGmW9.png.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/thumbs_300_WlbFWSGmW9.png/100x100_300_WlbFWSGmW9.png.attrs
new file mode 100644
index 0000000..64e4c1d
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/84nmscqy84lsi1t/thumbs_300_WlbFWSGmW9.png/100x100_300_WlbFWSGmW9.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"R7TqfvF8HP3C4+FO2eZ9tg=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png
new file mode 100644
index 0000000..f6ce991
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png differ
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png.attrs
new file mode 100644
index 0000000..e78288f
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/300_Jsjq7RdBgA.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"zZhZjzVvCvpcxtMAJie3GQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/100x100_300_Jsjq7RdBgA.png b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/100x100_300_Jsjq7RdBgA.png
new file mode 100644
index 0000000..1b87677
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/100x100_300_Jsjq7RdBgA.png differ
diff --git a/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/100x100_300_Jsjq7RdBgA.png.attrs b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/100x100_300_Jsjq7RdBgA.png.attrs
new file mode 100644
index 0000000..64e4c1d
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wsmn24bux7wo113/al1h9ijdeojtsjy/thumbs_300_Jsjq7RdBgA.png/100x100_300_Jsjq7RdBgA.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"R7TqfvF8HP3C4+FO2eZ9tg=="}
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/7nwo8tuiatetxdm/test_JnXeKEwgwr.txt b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/7nwo8tuiatetxdm/test_JnXeKEwgwr.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/7nwo8tuiatetxdm/test_JnXeKEwgwr.txt
@@ -0,0 +1 @@
+test
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/7nwo8tuiatetxdm/test_JnXeKEwgwr.txt.attrs b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/7nwo8tuiatetxdm/test_JnXeKEwgwr.txt.attrs
new file mode 100644
index 0000000..3396b8b
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/7nwo8tuiatetxdm/test_JnXeKEwgwr.txt.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":null,"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/300_UhLKX91HVb.png b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/300_UhLKX91HVb.png
new file mode 100644
index 0000000..f6ce991
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/300_UhLKX91HVb.png differ
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/300_UhLKX91HVb.png.attrs b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/300_UhLKX91HVb.png.attrs
new file mode 100644
index 0000000..e78288f
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/300_UhLKX91HVb.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"zZhZjzVvCvpcxtMAJie3GQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/test_FLurQTgrY8.txt b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/test_FLurQTgrY8.txt
new file mode 100644
index 0000000..9daeafb
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/test_FLurQTgrY8.txt
@@ -0,0 +1 @@
+test
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/test_FLurQTgrY8.txt.attrs b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/test_FLurQTgrY8.txt.attrs
new file mode 100644
index 0000000..3396b8b
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/test_FLurQTgrY8.txt.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"text/plain; charset=utf-8","user.metadata":null,"md5":"2Oj8otwPiW/Xy0ywAxuiSQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/thumbs_300_UhLKX91HVb.png/100x100_300_UhLKX91HVb.png b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/thumbs_300_UhLKX91HVb.png/100x100_300_UhLKX91HVb.png
new file mode 100644
index 0000000..1b87677
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/thumbs_300_UhLKX91HVb.png/100x100_300_UhLKX91HVb.png differ
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/thumbs_300_UhLKX91HVb.png/100x100_300_UhLKX91HVb.png.attrs b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/thumbs_300_UhLKX91HVb.png/100x100_300_UhLKX91HVb.png.attrs
new file mode 100644
index 0000000..64e4c1d
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/lcl9d87w22ml6jy/thumbs_300_UhLKX91HVb.png/100x100_300_UhLKX91HVb.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"R7TqfvF8HP3C4+FO2eZ9tg=="}
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/300_JdfBOieXAW.png b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/300_JdfBOieXAW.png
new file mode 100644
index 0000000..f6ce991
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/300_JdfBOieXAW.png differ
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/300_JdfBOieXAW.png.attrs b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/300_JdfBOieXAW.png.attrs
new file mode 100644
index 0000000..e78288f
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/300_JdfBOieXAW.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"zZhZjzVvCvpcxtMAJie3GQ=="}
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/thumbs_300_JdfBOieXAW.png/100x100_300_JdfBOieXAW.png b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/thumbs_300_JdfBOieXAW.png/100x100_300_JdfBOieXAW.png
new file mode 100644
index 0000000..1b87677
Binary files /dev/null and b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/thumbs_300_JdfBOieXAW.png/100x100_300_JdfBOieXAW.png differ
diff --git a/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/thumbs_300_JdfBOieXAW.png/100x100_300_JdfBOieXAW.png.attrs b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/thumbs_300_JdfBOieXAW.png/100x100_300_JdfBOieXAW.png.attrs
new file mode 100644
index 0000000..64e4c1d
--- /dev/null
+++ b/server/core_backend-server/tests/data/storage/wzlqyes4orhoygb/mk5fmymtx4wsprk/thumbs_300_JdfBOieXAW.png/100x100_300_JdfBOieXAW.png.attrs
@@ -0,0 +1 @@
+{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null,"md5":"R7TqfvF8HP3C4+FO2eZ9tg=="}
diff --git a/server/core_backend-server/tests/dynamic_stubs.go b/server/core_backend-server/tests/dynamic_stubs.go
new file mode 100644
index 0000000..d51e3b5
--- /dev/null
+++ b/server/core_backend-server/tests/dynamic_stubs.go
@@ -0,0 +1,179 @@
+package tests
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func StubOTPRecords(app core.App) error {
+	superuser2, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		return err
+	}
+	superuser2.SetRaw("stubId", "superuser2")
+
+	superuser3, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test3@example.com")
+	if err != nil {
+		return err
+	}
+	superuser3.SetRaw("stubId", "superuser3")
+
+	user1, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		return err
+	}
+	user1.SetRaw("stubId", "user1")
+
+	now := types.NowDateTime()
+	old := types.NowDateTime().Add(-1 * time.Hour)
+
+	stubs := map[*core.Record][]types.DateTime{
+		superuser2: {now, now.Add(-1 * time.Millisecond), old, now.Add(-2 * time.Millisecond), old.Add(-1 * time.Millisecond)},
+		superuser3: {now.Add(-3 * time.Millisecond), now.Add(-2 * time.Minute)},
+		user1:      {old},
+	}
+	for record, idDates := range stubs {
+		for i, date := range idDates {
+			otp := core.NewOTP(app)
+			otp.Id = record.GetString("stubId") + "_" + strconv.Itoa(i)
+			otp.SetRecordRef(record.Id)
+			otp.SetCollectionRef(record.Collection().Id)
+			otp.SetPassword("test123")
+			otp.SetRaw("created", date)
+			if err := app.SaveNoValidate(otp); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func StubMFARecords(app core.App) error {
+	superuser2, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test2@example.com")
+	if err != nil {
+		return err
+	}
+	superuser2.SetRaw("stubId", "superuser2")
+
+	superuser3, err := app.FindAuthRecordByEmail(core.CollectionNameSuperusers, "test3@example.com")
+	if err != nil {
+		return err
+	}
+	superuser3.SetRaw("stubId", "superuser3")
+
+	user1, err := app.FindAuthRecordByEmail("users", "test@example.com")
+	if err != nil {
+		return err
+	}
+	user1.SetRaw("stubId", "user1")
+
+	now := types.NowDateTime()
+	old := types.NowDateTime().Add(-1 * time.Hour)
+
+	type mfaData struct {
+		method string
+		date   types.DateTime
+	}
+
+	stubs := map[*core.Record][]mfaData{
+		superuser2: {
+			{core.MFAMethodOTP, now},
+			{core.MFAMethodOTP, old},
+			{core.MFAMethodPassword, now.Add(-2 * time.Minute)},
+			{core.MFAMethodPassword, now.Add(-1 * time.Millisecond)},
+			{core.MFAMethodOAuth2, old.Add(-1 * time.Millisecond)},
+		},
+		superuser3: {
+			{core.MFAMethodOAuth2, now.Add(-3 * time.Millisecond)},
+			{core.MFAMethodPassword, now.Add(-3 * time.Minute)},
+		},
+		user1: {
+			{core.MFAMethodOAuth2, old},
+		},
+	}
+	for record, idDates := range stubs {
+		for i, data := range idDates {
+			otp := core.NewMFA(app)
+			otp.Id = record.GetString("stubId") + "_" + strconv.Itoa(i)
+			otp.SetRecordRef(record.Id)
+			otp.SetCollectionRef(record.Collection().Id)
+			otp.SetMethod(data.method)
+			otp.SetRaw("created", data.date)
+			if err := app.SaveNoValidate(otp); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func StubLogsData(app *TestApp) error {
+	/* SQLite:
+	_, err := app.AuxDB().NewQuery(`
+		delete from {{_logs}};
+
+		insert into {{_logs}} (
+			[[id]],
+			[[level]],
+			[[message]],
+			[[data]],
+			[[created]],
+			[[updated]]
+		)
+		values
+		(
+			"873f2133-9f38-44fb-bf82-c8f53b310d91",
+			0,
+			"test_message1",
+			'{"status":200}',
+			"2022-05-01 10:00:00.123Z",
+			"2022-05-01 10:00:00.123Z"
+		),
+		(
+			"f2133873-44fb-9f38-bf82-c918f53b310d",
+			8,
+			"test_message2",
+			'{"status":400}',
+			"2022-05-02 10:00:00.123Z",
+			"2022-05-02 10:00:00.123Z"
+		);
+	`).Execute()
+	*/
+	// PostgreSQL:
+	_, err := app.AuxDB().NewQuery(`
+		delete from {{_logs}};
+
+		insert into {{_logs}} (
+			[[id]],
+			[[level]],
+			[[message]],
+			[[data]],
+			[[created]],
+			[[updated]]
+		)
+		values
+		(
+			'873f2133-9f38-44fb-bf82-c8f53b310d91',
+			0,
+			'test_message1',
+			'{"status":200}',
+			'2022-05-01 10:00:00.123Z',
+			'2022-05-01 10:00:00.123Z'
+		),
+		(
+			'f2133873-44fb-9f38-bf82-c918f53b310d',
+			8,
+			'test_message2',
+			'{"status":400}',
+			'2022-05-02 10:00:00.123Z',
+			'2022-05-02 10:00:00.123Z'
+		);
+	`).Execute()
+
+	return err
+}
diff --git a/server/core_backend-server/tests/issues/issue_35_test.go b/server/core_backend-server/tests/issues/issue_35_test.go
new file mode 100644
index 0000000..dfee252
--- /dev/null
+++ b/server/core_backend-server/tests/issues/issue_35_test.go
@@ -0,0 +1,37 @@
+package issues
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+)
+
+// https://github.com/fondoger/pocketbase/issues/35
+func TestIssue35_DateTimeFieldWithEmptyValue(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	collection := core.NewBaseCollection("test_issue_35")
+	collection.Fields.Add(&core.DateField{
+		Name: "updated",
+	})
+
+	err := app.Save(collection)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record := core.NewRecord(collection)
+	record.Set("updated", "2025-09-01")
+	err = app.Save(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	record = core.NewRecord(collection)
+	err = app.Save(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/server/core_backend-server/tests/issues/issue_49_test.go b/server/core_backend-server/tests/issues/issue_49_test.go
new file mode 100644
index 0000000..910be55
--- /dev/null
+++ b/server/core_backend-server/tests/issues/issue_49_test.go
@@ -0,0 +1,55 @@
+package issues
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+// https://github.com/fondoger/pocketbase/issues/49
+func TestIssue49_DateTimeFieldComparison(t *testing.T) {
+	app, _ := tests.NewTestApp()
+	defer app.Cleanup()
+
+	// Create a collection with a DateTime field `updated`
+	collection := core.NewBaseCollection("test_issue_49")
+	collection.Fields.Add(&core.DateField{
+		Name: "updated",
+	})
+	err := app.Save(collection)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resolver := core.NewRecordFieldResolver(app, collection, nil, false)
+
+	// Insert a record with a specific date
+	record := core.NewRecord(collection)
+	record.Set("updated", "2025-09-01")
+	err = app.Save(record)
+	if err != nil {
+		t.Fatal(err)
+	}
+	record2 := core.NewRecord(collection)
+	record2.Set("updated", "2025-08-01")
+	err = app.Save(record2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Test filtering records where `updated` > "2025-08-31"
+	whereExpr, _ := search.FilterData(`updated > "2025-08-31"`).BuildExpr(resolver)
+	query := app.RecordQuery(collection).Select("COUNT(*) as count")
+	_ = resolver.UpdateQuery(query)
+
+	var count int
+	err = query.AndWhere(whereExpr).Row(&count)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if count != 1 {
+		t.Fatalf("Expected 1 record, got %d", count)
+	}
+}
diff --git a/server/core_backend-server/tests/issues/prepared_statements.py b/server/core_backend-server/tests/issues/prepared_statements.py
new file mode 100644
index 0000000..c03ab07
--- /dev/null
+++ b/server/core_backend-server/tests/issues/prepared_statements.py
@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+# pip install psycopg[binary]
+
+import psycopg
+
+dsn = "postgresql://user:pass@127.0.0.1/pb-data"
+
+
+# cur.execute("PREPARE q AS SELECT $1::int + 1")
+# cur.execute("EXECUTE q(41)")
+# print(cur.fetchone()[0])  # 42
+# cur.execute("DEALLOCATE q")
+
+def expect_error(callback, substr):
+    try:
+        callback()
+        assert False, "Expected exception, but none was raised"
+    except Exception as e:
+        assert substr in str(e), f"Expected exception message to contain '{substr}', got '{str(e)}'"
+
+def expect_good(callback):
+    try:
+        callback()
+    except Exception as e:
+        assert False, f"Expected no exception, but got: {str(e)}"
+
+cur = psycopg.connect(dsn).cursor()
+expect_good(
+    lambda: cur.execute("PREPARE q AS select $1 is distinct from $2")
+)
+
+cur = psycopg.connect(dsn).cursor()
+expect_good(
+    lambda: cur.execute("PREPARE q AS select null is distinct from null")
+)
+
+cur = psycopg.connect(dsn).cursor()
+expect_error(
+    lambda: cur.execute("PREPARE q AS select null is distinct from $1"),
+    "could not determine data type of parameter $1",
+)
+
+
+cur = psycopg.connect(dsn).cursor()
+expect_good(
+    lambda: cur.execute("PREPARE q AS select 1 as res where $1 = $2")
+)
+cur.execute("SELECT 1 AS res WHERE %s = %s", (5, 5))
+res = cur.fetchone()[0]
+assert res == 1
+
+
+
diff --git a/server/core_backend-server/tests/mailer.go b/server/core_backend-server/tests/mailer.go
new file mode 100644
index 0000000..15d6190
--- /dev/null
+++ b/server/core_backend-server/tests/mailer.go
@@ -0,0 +1,81 @@
+package tests
+
+import (
+	"slices"
+	"sync"
+
+	"github.com/pocketbase/pocketbase/tools/mailer"
+)
+
+var _ mailer.Mailer = (*TestMailer)(nil)
+
+// TestMailer is a mock [mailer.Mailer] implementation.
+type TestMailer struct {
+	mux      sync.Mutex
+	messages []*mailer.Message
+}
+
+// Send implements [mailer.Mailer] interface.
+func (tm *TestMailer) Send(m *mailer.Message) error {
+	tm.mux.Lock()
+	defer tm.mux.Unlock()
+
+	tm.messages = append(tm.messages, m)
+	return nil
+}
+
+// Reset clears any previously test collected data.
+func (tm *TestMailer) Reset() {
+	tm.mux.Lock()
+	defer tm.mux.Unlock()
+
+	tm.messages = nil
+}
+
+// TotalSend returns the total number of sent messages.
+func (tm *TestMailer) TotalSend() int {
+	tm.mux.Lock()
+	defer tm.mux.Unlock()
+
+	return len(tm.messages)
+}
+
+// Messages returns a shallow copy of all of the collected test messages.
+func (tm *TestMailer) Messages() []*mailer.Message {
+	tm.mux.Lock()
+	defer tm.mux.Unlock()
+
+	return slices.Clone(tm.messages)
+}
+
+// FirstMessage returns a shallow copy of the first sent message.
+//
+// Returns an empty mailer.Message struct if there are no sent messages.
+func (tm *TestMailer) FirstMessage() mailer.Message {
+	tm.mux.Lock()
+	defer tm.mux.Unlock()
+
+	var m mailer.Message
+
+	if len(tm.messages) > 0 {
+		return *tm.messages[0]
+	}
+
+	return m
+}
+
+// LastMessage returns a shallow copy of the last sent message.
+//
+// Returns an empty mailer.Message struct if there are no sent messages.
+func (tm *TestMailer) LastMessage() mailer.Message {
+	tm.mux.Lock()
+	defer tm.mux.Unlock()
+
+	var m mailer.Message
+
+	if len(tm.messages) > 0 {
+		return *tm.messages[len(tm.messages)-1]
+	}
+
+	return m
+}
diff --git a/server/core_backend-server/tests/request.go b/server/core_backend-server/tests/request.go
new file mode 100644
index 0000000..55b16b6
--- /dev/null
+++ b/server/core_backend-server/tests/request.go
@@ -0,0 +1,63 @@
+package tests
+
+import (
+	"bytes"
+	"io"
+	"mime/multipart"
+	"os"
+)
+
+// MockMultipartData creates a mocked multipart/form-data payload.
+//
+// Example
+//
+//	data, mp, err := tests.MockMultipartData(
+//		map[string]string{"title": "new"},
+//		"file1",
+//		"file2",
+//		...
+//	)
+func MockMultipartData(data map[string]string, fileFields ...string) (*bytes.Buffer, *multipart.Writer, error) {
+	body := new(bytes.Buffer)
+	mp := multipart.NewWriter(body)
+	defer mp.Close()
+
+	// write data fields
+	for k, v := range data {
+		mp.WriteField(k, v)
+	}
+
+	// write file fields
+	for _, fileField := range fileFields {
+		// create a test temporary file
+		err := func() error {
+			tmpFile, err := os.CreateTemp(os.TempDir(), "tmpfile-*.txt")
+			if err != nil {
+				return err
+			}
+
+			if _, err := tmpFile.Write([]byte("test")); err != nil {
+				return err
+			}
+			tmpFile.Seek(0, 0)
+			defer tmpFile.Close()
+			defer os.Remove(tmpFile.Name())
+
+			// stub uploaded file
+			w, err := mp.CreateFormFile(fileField, tmpFile.Name())
+			if err != nil {
+				return err
+			}
+			if _, err := io.Copy(w, tmpFile); err != nil {
+				return err
+			}
+
+			return nil
+		}()
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	return body, mp, nil
+}
diff --git a/server/core_backend-server/tests/validation_errors.go b/server/core_backend-server/tests/validation_errors.go
new file mode 100644
index 0000000..c0a37f9
--- /dev/null
+++ b/server/core_backend-server/tests/validation_errors.go
@@ -0,0 +1,32 @@
+package tests
+
+import (
+	"errors"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+)
+
+// TestValidationErrors checks whether the provided rawErrors are
+// instance of [validation.Errors] and contains the expectedErrors keys.
+func TestValidationErrors(t *testing.T, rawErrors error, expectedErrors []string) {
+	var errs validation.Errors
+
+	if rawErrors != nil && !errors.As(rawErrors, &errs) {
+		t.Fatalf("Failed to parse errors, expected to find validation.Errors, got %T\n%v", rawErrors, rawErrors)
+	}
+
+	if len(errs) != len(expectedErrors) {
+		keys := make([]string, 0, len(errs))
+		for k := range errs {
+			keys = append(keys, k)
+		}
+		t.Fatalf("Expected error keys \n%v\ngot\n%v\n%v", expectedErrors, keys, errs)
+	}
+
+	for _, k := range expectedErrors {
+		if _, ok := errs[k]; !ok {
+			t.Fatalf("Missing expected error key %q in %v", k, errs)
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/archive/create.go b/server/core_backend-server/tools/archive/create.go
new file mode 100644
index 0000000..fcd20ca
--- /dev/null
+++ b/server/core_backend-server/tools/archive/create.go
@@ -0,0 +1,91 @@
+package archive
+
+import (
+	"archive/zip"
+	"compress/flate"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Create creates a new zip archive from src dir content and saves it in dest path.
+//
+// You can specify skipPaths to skip/ignore certain directories and files (relative to src)
+// preventing adding them in the final archive.
+func Create(src string, dest string, skipPaths ...string) error {
+	if err := os.MkdirAll(filepath.Dir(dest), os.ModePerm); err != nil {
+		return err
+	}
+
+	zf, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+
+	zw := zip.NewWriter(zf)
+
+	// register a custom Deflate compressor
+	zw.RegisterCompressor(zip.Deflate, func(out io.Writer) (io.WriteCloser, error) {
+		return flate.NewWriter(out, flate.BestSpeed)
+	})
+
+	err = zipAddFS(zw, os.DirFS(src), skipPaths...)
+	if err != nil {
+		// try to cleanup at least the created zip file
+		return errors.Join(err, zw.Close(), zf.Close(), os.Remove(dest))
+	}
+
+	return errors.Join(zw.Close(), zf.Close())
+}
+
+// note remove after similar method is added in the std lib (https://github.com/golang/go/issues/54898)
+func zipAddFS(w *zip.Writer, fsys fs.FS, skipPaths ...string) error {
+	return fs.WalkDir(fsys, ".", func(name string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if d.IsDir() {
+			return nil
+		}
+
+		// skip
+		for _, ignore := range skipPaths {
+			if ignore == name ||
+				strings.HasPrefix(filepath.Clean(name)+string(os.PathSeparator), filepath.Clean(ignore)+string(os.PathSeparator)) {
+				return nil
+			}
+		}
+
+		info, err := d.Info()
+		if err != nil {
+			return err
+		}
+
+		h, err := zip.FileInfoHeader(info)
+		if err != nil {
+			return err
+		}
+
+		h.Name = name
+		h.Method = zip.Deflate
+
+		fw, err := w.CreateHeader(h)
+		if err != nil {
+			return err
+		}
+
+		f, err := fsys.Open(name)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+
+		_, err = io.Copy(fw, f)
+
+		return err
+	})
+}
diff --git a/server/core_backend-server/tools/archive/create_test.go b/server/core_backend-server/tools/archive/create_test.go
new file mode 100644
index 0000000..f75eb8e
--- /dev/null
+++ b/server/core_backend-server/tools/archive/create_test.go
@@ -0,0 +1,125 @@
+package archive_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/archive"
+)
+
+func TestCreateFailure(t *testing.T) {
+	testDir := createTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	zipPath := filepath.Join(os.TempDir(), "pb_test.zip")
+	defer os.RemoveAll(zipPath)
+
+	missingDir := filepath.Join(os.TempDir(), "missing")
+
+	if err := archive.Create(missingDir, zipPath); err == nil {
+		t.Fatal("Expected to fail due to missing directory or file")
+	}
+
+	if _, err := os.Stat(zipPath); err == nil {
+		t.Fatalf("Expected the zip file not to be created")
+	}
+}
+
+func TestCreateSuccess(t *testing.T) {
+	testDir := createTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	zipName := "pb_test.zip"
+	zipPath := filepath.Join(os.TempDir(), zipName)
+	defer os.RemoveAll(zipPath)
+
+	// zip testDir content (excluding test and a/b/c dir)
+	if err := archive.Create(testDir, zipPath, "a/b/c", "test"); err != nil {
+		t.Fatalf("Failed to create archive: %v", err)
+	}
+
+	info, err := os.Stat(zipPath)
+	if err != nil {
+		t.Fatalf("Failed to retrieve the generated zip file: %v", err)
+	}
+
+	if name := info.Name(); name != zipName {
+		t.Fatalf("Expected zip with name %q, got %q", zipName, name)
+	}
+
+	expectedSize := int64(544)
+	if size := info.Size(); size != expectedSize {
+		t.Fatalf("Expected zip with size %d, got %d", expectedSize, size)
+	}
+}
+
+// -------------------------------------------------------------------
+
+// note: make sure to call os.RemoveAll(dir) after you are done
+// working with the created test dir.
+func createTestDir(t *testing.T) string {
+	dir, err := os.MkdirTemp(os.TempDir(), "pb_zip_test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := os.MkdirAll(filepath.Join(dir, "a/b/c"), os.ModePerm); err != nil {
+		t.Fatal(err)
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "test"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "test2"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "a/test"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "a/b/sub1"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "a/b/c/sub2"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "a/b/c/sub3"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	// symbolic link
+	if err := os.Symlink(filepath.Join(dir, "test"), filepath.Join(dir, "test_symlink")); err != nil {
+		t.Fatal(err)
+	}
+
+	return dir
+}
diff --git a/server/core_backend-server/tools/archive/extract.go b/server/core_backend-server/tools/archive/extract.go
new file mode 100644
index 0000000..a9d581e
--- /dev/null
+++ b/server/core_backend-server/tools/archive/extract.go
@@ -0,0 +1,77 @@
+package archive
+
+import (
+	"archive/zip"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Extract extracts the zip archive at "src" to "dest".
+//
+// Note that only dirs and regular files will be extracted.
+// Symbolic links, named pipes, sockets, or any other irregular files
+// are skipped because they come with too many edge cases and ambiguities.
+func Extract(src, dest string) error {
+	zr, err := zip.OpenReader(src)
+	if err != nil {
+		return err
+	}
+	defer zr.Close()
+
+	// normalize dest path to check later for Zip Slip
+	dest = filepath.Clean(dest) + string(os.PathSeparator)
+
+	for _, f := range zr.File {
+		err := extractFile(f, dest)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// extractFile extracts the provided zipFile into "basePath/zipFileName" path,
+// creating all the necessary path directories.
+func extractFile(zipFile *zip.File, basePath string) error {
+	path := filepath.Join(basePath, zipFile.Name)
+
+	// check for Zip Slip
+	if !strings.HasPrefix(path, basePath) {
+		return fmt.Errorf("invalid file path: %s", path)
+	}
+
+	r, err := zipFile.Open()
+	if err != nil {
+		return err
+	}
+	defer r.Close()
+
+	// allow only dirs or regular files
+	if zipFile.FileInfo().IsDir() {
+		if err := os.MkdirAll(path, os.ModePerm); err != nil {
+			return err
+		}
+	} else if zipFile.FileInfo().Mode().IsRegular() {
+		// ensure that the file path directories are created
+		if err := os.MkdirAll(filepath.Dir(path), os.ModePerm); err != nil {
+			return err
+		}
+
+		f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, zipFile.Mode())
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+
+		_, err = io.Copy(f, r)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/tools/archive/extract_test.go b/server/core_backend-server/tools/archive/extract_test.go
new file mode 100644
index 0000000..16e2617
--- /dev/null
+++ b/server/core_backend-server/tools/archive/extract_test.go
@@ -0,0 +1,88 @@
+package archive_test
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/archive"
+)
+
+func TestExtractFailure(t *testing.T) {
+	testDir := createTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	missingZipPath := filepath.Join(os.TempDir(), "pb_missing_test.zip")
+	extractedPath := filepath.Join(os.TempDir(), "pb_zip_extract")
+	defer os.RemoveAll(extractedPath)
+
+	if err := archive.Extract(missingZipPath, extractedPath); err == nil {
+		t.Fatal("Expected Extract to fail due to missing zipPath")
+	}
+
+	if _, err := os.Stat(extractedPath); err == nil {
+		t.Fatalf("Expected %q to not be created", extractedPath)
+	}
+}
+
+func TestExtractSuccess(t *testing.T) {
+	testDir := createTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	zipPath := filepath.Join(os.TempDir(), "pb_test.zip")
+	defer os.RemoveAll(zipPath)
+
+	extractedPath := filepath.Join(os.TempDir(), "pb_zip_extract")
+	defer os.RemoveAll(extractedPath)
+
+	// zip testDir content (with exclude)
+	if err := archive.Create(testDir, zipPath, "a/b/c", "test2", "sub2"); err != nil {
+		t.Fatalf("Failed to create archive: %v", err)
+	}
+
+	if err := archive.Extract(zipPath, extractedPath); err != nil {
+		t.Fatalf("Failed to extract %q in %q", zipPath, extractedPath)
+	}
+
+	availableFiles := []string{}
+
+	walkErr := filepath.WalkDir(extractedPath, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if d.IsDir() {
+			return nil
+		}
+
+		availableFiles = append(availableFiles, path)
+
+		return nil
+	})
+	if walkErr != nil {
+		t.Fatalf("Failed to read the extracted dir: %v", walkErr)
+	}
+
+	// (note: symbolic links and other regular files should be missing)
+	expectedFiles := []string{
+		filepath.Join(extractedPath, "test"),
+		filepath.Join(extractedPath, "a/test"),
+		filepath.Join(extractedPath, "a/b/sub1"),
+	}
+
+	if len(availableFiles) != len(expectedFiles) {
+		t.Fatalf("Expected \n%v, \ngot \n%v", expectedFiles, availableFiles)
+	}
+
+ExpectedLoop:
+	for _, expected := range expectedFiles {
+		for _, available := range availableFiles {
+			if available == expected {
+				continue ExpectedLoop
+			}
+		}
+
+		t.Fatalf("Missing file %q in \n%v", expected, availableFiles)
+	}
+}
diff --git a/server/core_backend-server/tools/auth/apple.go b/server/core_backend-server/tools/auth/apple.go
new file mode 100644
index 0000000..00801f6
--- /dev/null
+++ b/server/core_backend-server/tools/auth/apple.go
@@ -0,0 +1,165 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/auth/internal/jwk"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameAppleNative] = func() Provider {
+		return NewAppleProvider(NameAppleNative)
+	}
+	Providers[NameAppleWeb] = func() Provider {
+		return NewAppleProvider(NameAppleWeb)
+	}
+	EquivalentProviders[NameAppleNative] = []string{NameAppleWeb}
+	EquivalentProviders[NameAppleWeb] = []string{NameAppleNative}
+	// Keep old "apple" provider for backward compatibility
+	Providers["apple"] = func() Provider {
+		return NewAppleProvider(NameAppleWeb)
+	}
+}
+
+var _ Provider = (*Apple)(nil)
+
+// NameAppleNative is the unique name of the Apple provider.
+const NameAppleNative string = "apple_native"
+const NameAppleWeb string = "apple_web"
+
+// Apple allows authentication via Apple OAuth2.
+//
+// OIDC differences: https://bitbucket.org/openid/connect/src/master/How-Sign-in-with-Apple-differs-from-OpenID-Connect.md.
+type Apple struct {
+	BaseProvider
+
+	jwksURL string
+}
+
+// NewAppleProvider creates a new Apple provider instance with some defaults.
+func NewAppleProvider(providerName string) *Apple {
+	var displayName string
+	if providerName == NameAppleNative {
+		displayName = "Apple (Native)"
+	} else {
+		displayName = "Apple (Web/Android)"
+	}
+	return &Apple{
+		BaseProvider: BaseProvider{
+			ctx:         context.Background(),
+			displayName: displayName,
+			pkce:        true,
+			scopes:      []string{"name", "email"},
+			authURL:     "https://appleid.apple.com/auth/authorize",
+			tokenURL:    "https://appleid.apple.com/auth/token",
+		},
+		jwksURL: "https://appleid.apple.com/auth/keys",
+	}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the provided token.
+//
+// API reference: https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple#Retrieve-the-users-information-from-Apple-ID-servers.
+func (p *Apple) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		EmailVerified any    `json:"email_verified"` // could be string or bool
+		Email         string `json:"email"`
+		Id            string `json:"sub"`
+
+		// not returned at the time of writing and it is usually
+		// manually populated in apis.recordAuthWithOAuth2
+		Name string `json:"name"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if cast.ToBool(extracted.EmailVerified) {
+		user.Email = extracted.Email
+	}
+
+	return user, nil
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo interface.
+//
+// Note that Apple doesn't have a UserInfo endpoint and claims about
+// the users are included in the id_token (without the name - see #7090).
+func (p *Apple) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	idToken, _ := token.Extra("id_token").(string)
+
+	claims, err := p.parseAndVerifyIdToken(idToken)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(claims)
+}
+
+func (p *Apple) parseAndVerifyIdToken(idToken string) (jwt.MapClaims, error) {
+	if idToken == "" {
+		return nil, errors.New("empty id_token")
+	}
+
+	// extract the token claims
+	// ---
+	claims := jwt.MapClaims{}
+	_, _, err := jwt.NewParser().ParseUnverified(idToken, claims)
+	if err != nil {
+		return nil, err
+	}
+
+	// validate common claims per https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user#3383769
+	// ---
+	jwtValidator := jwt.NewValidator(
+		jwt.WithExpirationRequired(),
+		jwt.WithIssuedAt(),
+		jwt.WithLeeway(idTokenLeeway),
+		jwt.WithIssuer("https://appleid.apple.com"),
+		jwt.WithAudience(p.clientId),
+	)
+	err = jwtValidator.Validate(claims)
+	if err != nil {
+		return nil, err
+	}
+
+	// validate id_token signature
+	//
+	// note: this step could be technically considered optional because we trust
+	// the token which is a result of direct TLS communication with the provider
+	// (see also https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation)
+	// ---
+	err = jwk.ValidateTokenSignature(p.ctx, idToken, p.jwksURL)
+	if err != nil {
+		return nil, fmt.Errorf("id_token validation failed: %w", err)
+	}
+
+	return claims, nil
+}
diff --git a/server/core_backend-server/tools/auth/auth.go b/server/core_backend-server/tools/auth/auth.go
new file mode 100644
index 0000000..64cb6ee
--- /dev/null
+++ b/server/core_backend-server/tools/auth/auth.go
@@ -0,0 +1,180 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+// ProviderFactoryFunc defines a function for initializing a new OAuth2 provider.
+type ProviderFactoryFunc func() Provider
+
+// Providers defines a map with all of the available OAuth2 providers.
+//
+// To register a new provider append a new entry in the map.
+var Providers = map[string]ProviderFactoryFunc{}
+
+// Some platforms use two different ClientID/ClientSecret pairs for native sign-in and Web sign-in flows.
+// Known platforms are: Apple
+// See: https://github.com/pocketbase/pocketbase/issues/6151
+//
+// Two providers are equivalent only if:
+// 1. They are from same platform (Such as Apple)
+// 2. The providerId (AuthUser.Id) are the same in different providers.
+var EquivalentProviders = map[string][]string{}
+
+// ProgrammaticEnabledProviders allows developers add oauth2 providers via Golang SDK.
+// ```example.go
+//
+//	auth.Providers["provider_name"] = func() Provider {
+//		provider := &CustomProvider{}
+//		provider.SetClientId("client-id")   		// Optional
+//		provider.SetClientSecret("client-secret")	// Optional
+//		return provider
+//	}
+//	auth.ProgrammaticEnabledProviders["users"] = []string{"provider_name"}
+//
+// ```
+var ProgrammaticEnabledProviders = map[string][]string{}
+
+// NewProviderByName returns a new preconfigured provider instance by its name identifier.
+func NewProviderByName(name string) (Provider, error) {
+	factory, ok := Providers[name]
+	if !ok {
+		return nil, errors.New("missing provider " + name)
+	}
+
+	return factory(), nil
+}
+
+// Provider defines a common interface for an OAuth2 client.
+type Provider interface {
+	// Context returns the context associated with the provider (if any).
+	Context() context.Context
+
+	// SetContext assigns the specified context to the current provider.
+	SetContext(ctx context.Context)
+
+	// PKCE indicates whether the provider can use the PKCE flow.
+	PKCE() bool
+
+	// SetPKCE toggles the state whether the provider can use the PKCE flow or not.
+	SetPKCE(enable bool)
+
+	// DisplayName usually returns provider name as it is officially written
+	// and it could be used directly in the UI.
+	DisplayName() string
+
+	// SetDisplayName sets the provider's display name.
+	SetDisplayName(displayName string)
+
+	// Scopes returns the provider access permissions that will be requested.
+	Scopes() []string
+
+	// SetScopes sets the provider access permissions that will be requested later.
+	SetScopes(scopes []string)
+
+	// ClientId returns the provider client's app ID.
+	ClientId() string
+
+	// SetClientId sets the provider client's ID.
+	SetClientId(clientId string)
+
+	// ClientSecret returns the provider client's app secret.
+	ClientSecret() string
+
+	// SetClientSecret sets the provider client's app secret.
+	SetClientSecret(secret string)
+
+	// RedirectURL returns the end address to redirect the user
+	// going through the OAuth flow.
+	RedirectURL() string
+
+	// SetRedirectURL sets the provider's RedirectURL.
+	SetRedirectURL(url string)
+
+	// AuthURL returns the provider's authorization service url.
+	AuthURL() string
+
+	// SetAuthURL sets the provider's AuthURL.
+	SetAuthURL(url string)
+
+	// TokenURL returns the provider's token exchange service url.
+	TokenURL() string
+
+	// SetTokenURL sets the provider's TokenURL.
+	SetTokenURL(url string)
+
+	// UserInfoURL returns the provider's user info api url.
+	UserInfoURL() string
+
+	// SetUserInfoURL sets the provider's UserInfoURL.
+	SetUserInfoURL(url string)
+
+	// Extra returns a shallow copy of any custom config data
+	// that the provider may be need.
+	Extra() map[string]any
+
+	// SetExtra updates the provider's custom config data.
+	SetExtra(data map[string]any)
+
+	// Client returns an http client using the provided token.
+	Client(token *oauth2.Token) *http.Client
+
+	// BuildAuthURL returns a URL to the provider's consent page
+	// that asks for permissions for the required scopes explicitly.
+	BuildAuthURL(state string, opts ...oauth2.AuthCodeOption) string
+
+	// FetchToken converts an authorization code to token.
+	FetchToken(code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)
+
+	// FetchRawUserInfo requests and marshalizes into `result` the
+	// the OAuth user api response.
+	FetchRawUserInfo(token *oauth2.Token) ([]byte, error)
+
+	// FetchAuthUser is similar to FetchRawUserInfo, but normalizes and
+	// marshalizes the user api response into a standardized AuthUser struct.
+	FetchAuthUser(token *oauth2.Token) (user *AuthUser, err error)
+}
+
+// wrapFactory is a helper that wraps a Provider specific factory
+// function and returns its result as Provider interface.
+func wrapFactory[T Provider](factory func() T) ProviderFactoryFunc {
+	return func() Provider {
+		return factory()
+	}
+}
+
+// AuthUser defines a standardized OAuth2 user data structure.
+type AuthUser struct {
+	Expiry       types.DateTime `json:"expiry"`
+	RawUser      map[string]any `json:"rawUser"`
+	Id           string         `json:"id"`
+	Name         string         `json:"name"`
+	Username     string         `json:"username"`
+	Email        string         `json:"email"`
+	AvatarURL    string         `json:"avatarURL"`
+	AccessToken  string         `json:"accessToken"`
+	RefreshToken string         `json:"refreshToken"`
+
+	// @todo
+	// deprecated: use AvatarURL instead
+	// AvatarUrl will be removed after dropping v0.22 support
+	AvatarUrl string `json:"avatarUrl"`
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+//
+// @todo remove after dropping v0.22 support
+func (au AuthUser) MarshalJSON() ([]byte, error) {
+	type alias AuthUser // prevent recursion
+
+	au2 := alias(au)
+	au2.AvatarUrl = au.AvatarURL // ensure that the legacy field is populated
+
+	return json.Marshal(au2)
+}
diff --git a/server/core_backend-server/tools/auth/auth_test.go b/server/core_backend-server/tools/auth/auth_test.go
new file mode 100644
index 0000000..8df747e
--- /dev/null
+++ b/server/core_backend-server/tools/auth/auth_test.go
@@ -0,0 +1,317 @@
+package auth_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/auth"
+)
+
+func TestProvidersCount(t *testing.T) {
+	expected := 34
+
+	if total := len(auth.Providers); total != expected {
+		t.Fatalf("Expected %d providers, got %d", expected, total)
+	}
+}
+
+func TestNewProviderByName(t *testing.T) {
+	var err error
+	var p auth.Provider
+
+	// invalid
+	p, err = auth.NewProviderByName("invalid")
+	if err == nil {
+		t.Error("Expected error, got nil")
+	}
+	if p != nil {
+		t.Errorf("Expected provider to be nil, got %v", p)
+	}
+
+	// google
+	p, err = auth.NewProviderByName(auth.NameGoogle)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Google); !ok {
+		t.Error("Expected to be instance of *auth.Google")
+	}
+
+	// facebook
+	p, err = auth.NewProviderByName(auth.NameFacebook)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Facebook); !ok {
+		t.Error("Expected to be instance of *auth.Facebook")
+	}
+
+	// github
+	p, err = auth.NewProviderByName(auth.NameGithub)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Github); !ok {
+		t.Error("Expected to be instance of *auth.Github")
+	}
+
+	// gitlab
+	p, err = auth.NewProviderByName(auth.NameGitlab)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Gitlab); !ok {
+		t.Error("Expected to be instance of *auth.Gitlab")
+	}
+
+	// twitter
+	p, err = auth.NewProviderByName(auth.NameTwitter)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Twitter); !ok {
+		t.Error("Expected to be instance of *auth.Twitter")
+	}
+
+	// discord
+	p, err = auth.NewProviderByName(auth.NameDiscord)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Discord); !ok {
+		t.Error("Expected to be instance of *auth.Discord")
+	}
+
+	// microsoft
+	p, err = auth.NewProviderByName(auth.NameMicrosoft)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Microsoft); !ok {
+		t.Error("Expected to be instance of *auth.Microsoft")
+	}
+
+	// spotify
+	p, err = auth.NewProviderByName(auth.NameSpotify)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Spotify); !ok {
+		t.Error("Expected to be instance of *auth.Spotify")
+	}
+
+	// kakao
+	p, err = auth.NewProviderByName(auth.NameKakao)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Kakao); !ok {
+		t.Error("Expected to be instance of *auth.Kakao")
+	}
+
+	// twitch
+	p, err = auth.NewProviderByName(auth.NameTwitch)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Twitch); !ok {
+		t.Error("Expected to be instance of *auth.Twitch")
+	}
+
+	// strava
+	p, err = auth.NewProviderByName(auth.NameStrava)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Strava); !ok {
+		t.Error("Expected to be instance of *auth.Strava")
+	}
+
+	// gitee
+	p, err = auth.NewProviderByName(auth.NameGitee)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Gitee); !ok {
+		t.Error("Expected to be instance of *auth.Gitee")
+	}
+
+	// livechat
+	p, err = auth.NewProviderByName(auth.NameLivechat)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Livechat); !ok {
+		t.Error("Expected to be instance of *auth.Livechat")
+	}
+
+	// gitea
+	p, err = auth.NewProviderByName(auth.NameGitea)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Gitea); !ok {
+		t.Error("Expected to be instance of *auth.Gitea")
+	}
+
+	// oidc
+	p, err = auth.NewProviderByName(auth.NameOIDC)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.OIDC); !ok {
+		t.Error("Expected to be instance of *auth.OIDC")
+	}
+
+	// oidc2
+	p, err = auth.NewProviderByName(auth.NameOIDC + "2")
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.OIDC); !ok {
+		t.Error("Expected to be instance of *auth.OIDC")
+	}
+
+	// oidc3
+	p, err = auth.NewProviderByName(auth.NameOIDC + "3")
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.OIDC); !ok {
+		t.Error("Expected to be instance of *auth.OIDC")
+	}
+
+	// apple
+	p, err = auth.NewProviderByName(auth.NameAppleWeb)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Apple); !ok {
+		t.Error("Expected to be instance of *auth.Apple")
+	}
+
+	// instagram
+	p, err = auth.NewProviderByName(auth.NameInstagram)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Instagram); !ok {
+		t.Error("Expected to be instance of *auth.Instagram")
+	}
+
+	// vk
+	p, err = auth.NewProviderByName(auth.NameVK)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.VK); !ok {
+		t.Error("Expected to be instance of *auth.VK")
+	}
+
+	// yandex
+	p, err = auth.NewProviderByName(auth.NameYandex)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Yandex); !ok {
+		t.Error("Expected to be instance of *auth.Yandex")
+	}
+
+	// patreon
+	p, err = auth.NewProviderByName(auth.NamePatreon)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Patreon); !ok {
+		t.Error("Expected to be instance of *auth.Patreon")
+	}
+
+	// mailcow
+	p, err = auth.NewProviderByName(auth.NameMailcow)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Mailcow); !ok {
+		t.Error("Expected to be instance of *auth.Mailcow")
+	}
+
+	// bitbucket
+	p, err = auth.NewProviderByName(auth.NameBitbucket)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Bitbucket); !ok {
+		t.Error("Expected to be instance of *auth.Bitbucket")
+	}
+
+	// planningcenter
+	p, err = auth.NewProviderByName(auth.NamePlanningcenter)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Planningcenter); !ok {
+		t.Error("Expected to be instance of *auth.Planningcenter")
+	}
+
+	// notion
+	p, err = auth.NewProviderByName(auth.NameNotion)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Notion); !ok {
+		t.Error("Expected to be instance of *auth.Notion")
+	}
+
+	// monday
+	p, err = auth.NewProviderByName(auth.NameMonday)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Monday); !ok {
+		t.Error("Expected to be instance of *auth.Monday")
+	}
+
+	// wakatime
+	p, err = auth.NewProviderByName(auth.NameWakatime)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Wakatime); !ok {
+		t.Error("Expected to be instance of *auth.Wakatime")
+	}
+
+	// box
+	p, err = auth.NewProviderByName(auth.NameBox)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Box); !ok {
+		t.Error("Expected to be instance of *auth.Box")
+	}
+
+	// linear
+	p, err = auth.NewProviderByName(auth.NameLinear)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Linear); !ok {
+		t.Error("Expected to be instance of *auth.Linear")
+	}
+
+	// trakt
+	p, err = auth.NewProviderByName(auth.NameTrakt)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Trakt); !ok {
+		t.Error("Expected to be instance of *auth.Trakt")
+	}
+
+	// lark
+	p, err = auth.NewProviderByName(auth.NameLark)
+	if err != nil {
+		t.Errorf("Expected nil, got error %v", err)
+	}
+	if _, ok := p.(*auth.Lark); !ok {
+		t.Error("Expected to be instance of *auth.Lark")
+	}
+}
diff --git a/server/core_backend-server/tools/auth/base_provider.go b/server/core_backend-server/tools/auth/base_provider.go
new file mode 100644
index 0000000..a99edbc
--- /dev/null
+++ b/server/core_backend-server/tools/auth/base_provider.go
@@ -0,0 +1,203 @@
+package auth
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"maps"
+	"net/http"
+
+	"golang.org/x/oauth2"
+)
+
+// BaseProvider defines common fields and methods used by OAuth2 client providers.
+type BaseProvider struct {
+	ctx          context.Context
+	clientId     string
+	clientSecret string
+	displayName  string
+	redirectURL  string
+	authURL      string
+	tokenURL     string
+	userInfoURL  string
+	scopes       []string
+	pkce         bool
+	extra        map[string]any
+}
+
+// Context implements Provider.Context() interface method.
+func (p *BaseProvider) Context() context.Context {
+	return p.ctx
+}
+
+// SetContext implements Provider.SetContext() interface method.
+func (p *BaseProvider) SetContext(ctx context.Context) {
+	p.ctx = ctx
+}
+
+// PKCE implements Provider.PKCE() interface method.
+func (p *BaseProvider) PKCE() bool {
+	return p.pkce
+}
+
+// SetPKCE implements Provider.SetPKCE() interface method.
+func (p *BaseProvider) SetPKCE(enable bool) {
+	p.pkce = enable
+}
+
+// DisplayName implements Provider.DisplayName() interface method.
+func (p *BaseProvider) DisplayName() string {
+	return p.displayName
+}
+
+// SetDisplayName implements Provider.SetDisplayName() interface method.
+func (p *BaseProvider) SetDisplayName(displayName string) {
+	p.displayName = displayName
+}
+
+// Scopes implements Provider.Scopes() interface method.
+func (p *BaseProvider) Scopes() []string {
+	return p.scopes
+}
+
+// SetScopes implements Provider.SetScopes() interface method.
+func (p *BaseProvider) SetScopes(scopes []string) {
+	p.scopes = scopes
+}
+
+// ClientId implements Provider.ClientId() interface method.
+func (p *BaseProvider) ClientId() string {
+	return p.clientId
+}
+
+// SetClientId implements Provider.SetClientId() interface method.
+func (p *BaseProvider) SetClientId(clientId string) {
+	p.clientId = clientId
+}
+
+// ClientSecret implements Provider.ClientSecret() interface method.
+func (p *BaseProvider) ClientSecret() string {
+	return p.clientSecret
+}
+
+// SetClientSecret implements Provider.SetClientSecret() interface method.
+func (p *BaseProvider) SetClientSecret(secret string) {
+	p.clientSecret = secret
+}
+
+// RedirectURL implements Provider.RedirectURL() interface method.
+func (p *BaseProvider) RedirectURL() string {
+	return p.redirectURL
+}
+
+// SetRedirectURL implements Provider.SetRedirectURL() interface method.
+func (p *BaseProvider) SetRedirectURL(url string) {
+	p.redirectURL = url
+}
+
+// AuthURL implements Provider.AuthURL() interface method.
+func (p *BaseProvider) AuthURL() string {
+	return p.authURL
+}
+
+// SetAuthURL implements Provider.SetAuthURL() interface method.
+func (p *BaseProvider) SetAuthURL(url string) {
+	p.authURL = url
+}
+
+// TokenURL implements Provider.TokenURL() interface method.
+func (p *BaseProvider) TokenURL() string {
+	return p.tokenURL
+}
+
+// SetTokenURL implements Provider.SetTokenURL() interface method.
+func (p *BaseProvider) SetTokenURL(url string) {
+	p.tokenURL = url
+}
+
+// UserInfoURL implements Provider.UserInfoURL() interface method.
+func (p *BaseProvider) UserInfoURL() string {
+	return p.userInfoURL
+}
+
+// SetUserInfoURL implements Provider.SetUserInfoURL() interface method.
+func (p *BaseProvider) SetUserInfoURL(url string) {
+	p.userInfoURL = url
+}
+
+// Extra implements Provider.Extra() interface method.
+func (p *BaseProvider) Extra() map[string]any {
+	return maps.Clone(p.extra)
+}
+
+// SetExtra implements Provider.SetExtra() interface method.
+func (p *BaseProvider) SetExtra(data map[string]any) {
+	p.extra = data
+}
+
+// BuildAuthURL implements Provider.BuildAuthURL() interface method.
+func (p *BaseProvider) BuildAuthURL(state string, opts ...oauth2.AuthCodeOption) string {
+	return p.oauth2Config().AuthCodeURL(state, opts...)
+}
+
+// FetchToken implements Provider.FetchToken() interface method.
+func (p *BaseProvider) FetchToken(code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error) {
+	return p.oauth2Config().Exchange(p.ctx, code, opts...)
+}
+
+// Client implements Provider.Client() interface method.
+func (p *BaseProvider) Client(token *oauth2.Token) *http.Client {
+	return p.oauth2Config().Client(p.ctx, token)
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo() interface method.
+func (p *BaseProvider) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	req, err := http.NewRequestWithContext(p.ctx, "GET", p.userInfoURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return p.sendRawUserInfoRequest(req, token)
+}
+
+// sendRawUserInfoRequest sends the specified user info request and return its raw response body.
+func (p *BaseProvider) sendRawUserInfoRequest(req *http.Request, token *oauth2.Token) ([]byte, error) {
+	client := p.Client(token)
+
+	res, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	result, err := io.ReadAll(res.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	// http.Client.Get doesn't treat non 2xx responses as error
+	if res.StatusCode >= 400 {
+		return nil, fmt.Errorf(
+			"failed to fetch OAuth2 user profile via %s (%d):\n%s",
+			p.userInfoURL,
+			res.StatusCode,
+			string(result),
+		)
+	}
+
+	return result, nil
+}
+
+// oauth2Config constructs a oauth2.Config instance based on the provider settings.
+func (p *BaseProvider) oauth2Config() *oauth2.Config {
+	return &oauth2.Config{
+		RedirectURL:  p.redirectURL,
+		ClientID:     p.clientId,
+		ClientSecret: p.clientSecret,
+		Scopes:       p.scopes,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  p.authURL,
+			TokenURL: p.tokenURL,
+		},
+	}
+}
diff --git a/server/core_backend-server/tools/auth/base_provider_test.go b/server/core_backend-server/tools/auth/base_provider_test.go
new file mode 100644
index 0000000..047abc3
--- /dev/null
+++ b/server/core_backend-server/tools/auth/base_provider_test.go
@@ -0,0 +1,269 @@
+package auth
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"testing"
+
+	"golang.org/x/oauth2"
+)
+
+func TestContext(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.Scopes()
+	if before != nil {
+		t.Errorf("Expected nil context, got %v", before)
+	}
+
+	b.SetContext(context.Background())
+
+	after := b.Scopes()
+	if after != nil {
+		t.Error("Expected non-nil context")
+	}
+}
+
+func TestDisplayName(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.DisplayName()
+	if before != "" {
+		t.Fatalf("Expected displayName to be empty, got %v", before)
+	}
+
+	b.SetDisplayName("test")
+
+	after := b.DisplayName()
+	if after != "test" {
+		t.Fatalf("Expected displayName to be 'test', got %v", after)
+	}
+}
+
+func TestPKCE(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.PKCE()
+	if before != false {
+		t.Fatalf("Expected pkce to be %v, got %v", false, before)
+	}
+
+	b.SetPKCE(true)
+
+	after := b.PKCE()
+	if after != true {
+		t.Fatalf("Expected pkce to be %v, got %v", true, after)
+	}
+}
+
+func TestScopes(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.Scopes()
+	if len(before) != 0 {
+		t.Fatalf("Expected 0 scopes, got %v", before)
+	}
+
+	b.SetScopes([]string{"test1", "test2"})
+
+	after := b.Scopes()
+	if len(after) != 2 {
+		t.Fatalf("Expected 2 scopes, got %v", after)
+	}
+}
+
+func TestClientId(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.ClientId()
+	if before != "" {
+		t.Fatalf("Expected clientId to be empty, got %v", before)
+	}
+
+	b.SetClientId("test")
+
+	after := b.ClientId()
+	if after != "test" {
+		t.Fatalf("Expected clientId to be 'test', got %v", after)
+	}
+}
+
+func TestClientSecret(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.ClientSecret()
+	if before != "" {
+		t.Fatalf("Expected clientSecret to be empty, got %v", before)
+	}
+
+	b.SetClientSecret("test")
+
+	after := b.ClientSecret()
+	if after != "test" {
+		t.Fatalf("Expected clientSecret to be 'test', got %v", after)
+	}
+}
+
+func TestRedirectURL(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.RedirectURL()
+	if before != "" {
+		t.Fatalf("Expected RedirectURL to be empty, got %v", before)
+	}
+
+	b.SetRedirectURL("test")
+
+	after := b.RedirectURL()
+	if after != "test" {
+		t.Fatalf("Expected RedirectURL to be 'test', got %v", after)
+	}
+}
+
+func TestAuthURL(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.AuthURL()
+	if before != "" {
+		t.Fatalf("Expected authURL to be empty, got %v", before)
+	}
+
+	b.SetAuthURL("test")
+
+	after := b.AuthURL()
+	if after != "test" {
+		t.Fatalf("Expected authURL to be 'test', got %v", after)
+	}
+}
+
+func TestTokenURL(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.TokenURL()
+	if before != "" {
+		t.Fatalf("Expected tokenURL to be empty, got %v", before)
+	}
+
+	b.SetTokenURL("test")
+
+	after := b.TokenURL()
+	if after != "test" {
+		t.Fatalf("Expected tokenURL to be 'test', got %v", after)
+	}
+}
+
+func TestUserInfoURL(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.UserInfoURL()
+	if before != "" {
+		t.Fatalf("Expected userInfoURL to be empty, got %v", before)
+	}
+
+	b.SetUserInfoURL("test")
+
+	after := b.UserInfoURL()
+	if after != "test" {
+		t.Fatalf("Expected userInfoURL to be 'test', got %v", after)
+	}
+}
+
+func TestExtra(t *testing.T) {
+	b := BaseProvider{}
+
+	before := b.Extra()
+	if before != nil {
+		t.Fatalf("Expected extra to be empty, got %v", before)
+	}
+
+	extra := map[string]any{"a": 1, "b": 2}
+
+	b.SetExtra(extra)
+
+	after := b.Extra()
+
+	rawExtra, err := json.Marshal(extra)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rawAfter, err := json.Marshal(after)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !bytes.Equal(rawExtra, rawAfter) {
+		t.Fatalf("Expected extra to be\n%s\ngot\n%s", rawExtra, rawAfter)
+	}
+
+	// ensure that it was shallow copied
+	after["b"] = 3
+	if d := b.Extra(); d["b"] != 2 {
+		t.Fatalf("Expected extra to remain unchanged, got\n%v", d)
+	}
+}
+
+func TestBuildAuthURL(t *testing.T) {
+	b := BaseProvider{
+		authURL:      "authURL_test",
+		tokenURL:     "tokenURL_test",
+		redirectURL:  "redirectURL_test",
+		clientId:     "clientId_test",
+		clientSecret: "clientSecret_test",
+		scopes:       []string{"test_scope"},
+	}
+
+	expected := "authURL_test?access_type=offline&client_id=clientId_test&prompt=consent&redirect_uri=redirectURL_test&response_type=code&scope=test_scope&state=state_test"
+	result := b.BuildAuthURL("state_test", oauth2.AccessTypeOffline, oauth2.ApprovalForce)
+
+	if result != expected {
+		t.Errorf("Expected auth url %q, got %q", expected, result)
+	}
+}
+
+func TestClient(t *testing.T) {
+	b := BaseProvider{}
+
+	result := b.Client(&oauth2.Token{})
+	if result == nil {
+		t.Error("Expected *http.Client instance, got nil")
+	}
+}
+
+func TestOauth2Config(t *testing.T) {
+	b := BaseProvider{
+		authURL:      "authURL_test",
+		tokenURL:     "tokenURL_test",
+		redirectURL:  "redirectURL_test",
+		clientId:     "clientId_test",
+		clientSecret: "clientSecret_test",
+		scopes:       []string{"test"},
+	}
+
+	result := b.oauth2Config()
+
+	if result.RedirectURL != b.RedirectURL() {
+		t.Errorf("Expected redirectURL %s, got %s", b.RedirectURL(), result.RedirectURL)
+	}
+
+	if result.ClientID != b.ClientId() {
+		t.Errorf("Expected clientId %s, got %s", b.ClientId(), result.ClientID)
+	}
+
+	if result.ClientSecret != b.ClientSecret() {
+		t.Errorf("Expected clientSecret %s, got %s", b.ClientSecret(), result.ClientSecret)
+	}
+
+	if result.Endpoint.AuthURL != b.AuthURL() {
+		t.Errorf("Expected authURL %s, got %s", b.AuthURL(), result.Endpoint.AuthURL)
+	}
+
+	if result.Endpoint.TokenURL != b.TokenURL() {
+		t.Errorf("Expected authURL %s, got %s", b.TokenURL(), result.Endpoint.TokenURL)
+	}
+
+	if len(result.Scopes) != len(b.Scopes()) || result.Scopes[0] != b.Scopes()[0] {
+		t.Errorf("Expected scopes %s, got %s", b.Scopes(), result.Scopes)
+	}
+}
diff --git a/server/core_backend-server/tools/auth/bitbucket.go b/server/core_backend-server/tools/auth/bitbucket.go
new file mode 100644
index 0000000..ca5d877
--- /dev/null
+++ b/server/core_backend-server/tools/auth/bitbucket.go
@@ -0,0 +1,136 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameBitbucket] = wrapFactory(NewBitbucketProvider)
+}
+
+var _ Provider = (*Bitbucket)(nil)
+
+// NameBitbucket is the unique name of the Bitbucket provider.
+const NameBitbucket = "bitbucket"
+
+// Bitbucket is an auth provider for Bitbucket.
+type Bitbucket struct {
+	BaseProvider
+}
+
+// NewBitbucketProvider creates a new Bitbucket provider instance with some defaults.
+func NewBitbucketProvider() *Bitbucket {
+	return &Bitbucket{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Bitbucket",
+		pkce:        false,
+		scopes:      []string{"account"},
+		authURL:     "https://bitbucket.org/site/oauth2/authorize",
+		tokenURL:    "https://bitbucket.org/site/oauth2/access_token",
+		userInfoURL: "https://api.bitbucket.org/2.0/user",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Bitbucket's user API.
+//
+// API reference: https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-get
+func (p *Bitbucket) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		UUID          string `json:"uuid"`
+		Username      string `json:"username"`
+		DisplayName   string `json:"display_name"`
+		AccountStatus string `json:"account_status"`
+		Links         struct {
+			Avatar struct {
+				Href string `json:"href"`
+			} `json:"avatar"`
+		} `json:"links"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if extracted.AccountStatus != "active" {
+		return nil, errors.New("the Bitbucket user is not active")
+	}
+
+	email, err := p.fetchPrimaryEmail(token)
+	if err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.UUID,
+		Name:         extracted.DisplayName,
+		Username:     extracted.Username,
+		Email:        email,
+		AvatarURL:    extracted.Links.Avatar.Href,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
+
+// fetchPrimaryEmail sends an API request to retrieve the first
+// verified primary email.
+//
+// NB! This method can succeed and still return an empty email.
+// Error responses that are result of insufficient scopes permissions are ignored.
+//
+// API reference: https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-emails-get
+func (p *Bitbucket) fetchPrimaryEmail(token *oauth2.Token) (string, error) {
+	response, err := p.Client(token).Get(p.userInfoURL + "/emails")
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+
+	// ignore common http errors caused by insufficient scope permissions
+	// (the email field is optional, aka. return the auth user without it)
+	if response.StatusCode >= 400 {
+		return "", nil
+	}
+
+	data, err := io.ReadAll(response.Body)
+	if err != nil {
+		return "", err
+	}
+
+	expected := struct {
+		Values []struct {
+			Email     string `json:"email"`
+			IsPrimary bool   `json:"is_primary"`
+		} `json:"values"`
+	}{}
+	if err := json.Unmarshal(data, &expected); err != nil {
+		return "", err
+	}
+
+	for _, v := range expected.Values {
+		if v.IsPrimary {
+			return v.Email, nil
+		}
+	}
+
+	return "", nil
+}
diff --git a/server/core_backend-server/tools/auth/box.go b/server/core_backend-server/tools/auth/box.go
new file mode 100644
index 0000000..47b54f3
--- /dev/null
+++ b/server/core_backend-server/tools/auth/box.go
@@ -0,0 +1,81 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameBox] = wrapFactory(NewBoxProvider)
+}
+
+var _ Provider = (*Box)(nil)
+
+// NameBox is the unique name of the Box provider.
+const NameBox = "box"
+
+// Box is an auth provider for Box.
+type Box struct {
+	BaseProvider
+}
+
+// NewBoxProvider creates a new Box provider instance with some defaults.
+func NewBoxProvider() *Box {
+	return &Box{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Box",
+		pkce:        true,
+		scopes:      []string{"root_readonly"},
+		authURL:     "https://account.box.com/api/oauth2/authorize",
+		tokenURL:    "https://api.box.com/oauth2/token",
+		userInfoURL: "https://api.box.com/2.0/users/me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Box's user API.
+//
+// API reference: https://developer.box.com/reference/get-users-me/
+func (p *Box) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id        string `json:"id"`
+		Name      string `json:"name"`
+		Login     string `json:"login"`
+		AvatarURL string `json:"avatar_url"`
+		Status    string `json:"status"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if extracted.Status != "active" {
+		return nil, fmt.Errorf("Box user account is not active (status: %q)", extracted.Status)
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		AvatarURL:    extracted.AvatarURL,
+		Email:        extracted.Login, // Box requires verified email for OAuth authorization
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/discord.go b/server/core_backend-server/tools/auth/discord.go
new file mode 100644
index 0000000..41e78b4
--- /dev/null
+++ b/server/core_backend-server/tools/auth/discord.go
@@ -0,0 +1,91 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameDiscord] = wrapFactory(NewDiscordProvider)
+}
+
+var _ Provider = (*Discord)(nil)
+
+// NameDiscord is the unique name of the Discord provider.
+const NameDiscord string = "discord"
+
+// Discord allows authentication via Discord OAuth2.
+type Discord struct {
+	BaseProvider
+}
+
+// NewDiscordProvider creates a new Discord provider instance with some defaults.
+func NewDiscordProvider() *Discord {
+	// https://discord.com/developers/docs/topics/oauth2
+	// https://discord.com/developers/docs/resources/user#get-current-user
+	return &Discord{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Discord",
+		pkce:        true,
+		scopes:      []string{"identify", "email"},
+		authURL:     "https://discord.com/api/oauth2/authorize",
+		tokenURL:    "https://discord.com/api/oauth2/token",
+		userInfoURL: "https://discord.com/api/users/@me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance from Discord's user api.
+//
+// API reference:  https://discord.com/developers/docs/resources/user#user-object
+func (p *Discord) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id            string `json:"id"`
+		Username      string `json:"username"`
+		Discriminator string `json:"discriminator"`
+		Avatar        string `json:"avatar"`
+		Email         string `json:"email"`
+		Verified      bool   `json:"verified"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	// Build a full avatar URL using the avatar hash provided in the API response
+	// https://discord.com/developers/docs/reference#image-formatting
+	avatarURL := fmt.Sprintf("https://cdn.discordapp.com/avatars/%s/%s.png", extracted.Id, extracted.Avatar)
+
+	// Concatenate the user's username and discriminator into a single username string
+	username := fmt.Sprintf("%s#%s", extracted.Username, extracted.Discriminator)
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         username,
+		Username:     extracted.Username,
+		AvatarURL:    avatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if extracted.Verified {
+		user.Email = extracted.Email
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/facebook.go b/server/core_backend-server/tools/auth/facebook.go
new file mode 100644
index 0000000..b3f08c0
--- /dev/null
+++ b/server/core_backend-server/tools/auth/facebook.go
@@ -0,0 +1,78 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/facebook"
+)
+
+func init() {
+	Providers[NameFacebook] = wrapFactory(NewFacebookProvider)
+}
+
+var _ Provider = (*Facebook)(nil)
+
+// NameFacebook is the unique name of the Facebook provider.
+const NameFacebook string = "facebook"
+
+// Facebook allows authentication via Facebook OAuth2.
+type Facebook struct {
+	BaseProvider
+}
+
+// NewFacebookProvider creates new Facebook provider instance with some defaults.
+func NewFacebookProvider() *Facebook {
+	return &Facebook{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Facebook",
+		pkce:        true,
+		scopes:      []string{"email"},
+		authURL:     facebook.Endpoint.AuthURL,
+		tokenURL:    facebook.Endpoint.TokenURL,
+		userInfoURL: "https://graph.facebook.com/me?fields=name,email,picture.type(large)",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Facebook's user api.
+//
+// API reference: https://developers.facebook.com/docs/graph-api/reference/user/
+func (p *Facebook) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id      string
+		Name    string
+		Email   string
+		Picture struct {
+			Data struct{ Url string }
+		}
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		Email:        extracted.Email,
+		AvatarURL:    extracted.Picture.Data.Url,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/gitea.go b/server/core_backend-server/tools/auth/gitea.go
new file mode 100644
index 0000000..721efaf
--- /dev/null
+++ b/server/core_backend-server/tools/auth/gitea.go
@@ -0,0 +1,78 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameGitea] = wrapFactory(NewGiteaProvider)
+}
+
+var _ Provider = (*Gitea)(nil)
+
+// NameGitea is the unique name of the Gitea provider.
+const NameGitea string = "gitea"
+
+// Gitea allows authentication via Gitea OAuth2.
+type Gitea struct {
+	BaseProvider
+}
+
+// NewGiteaProvider creates new Gitea provider instance with some defaults.
+func NewGiteaProvider() *Gitea {
+	return &Gitea{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Gitea",
+		pkce:        true,
+		scopes:      []string{"read:user", "user:email"},
+		authURL:     "https://gitea.com/login/oauth/authorize",
+		tokenURL:    "https://gitea.com/login/oauth/access_token",
+		userInfoURL: "https://gitea.com/api/v1/user",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on Gitea's user api.
+//
+// API reference: https://try.gitea.io/api/swagger#/user/userGetCurrent
+func (p *Gitea) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Name      string `json:"full_name"`
+		Username  string `json:"login"`
+		Email     string `json:"email"`
+		AvatarURL string `json:"avatar_url"`
+		Id        int64  `json:"id"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           strconv.FormatInt(extracted.Id, 10),
+		Name:         extracted.Name,
+		Username:     extracted.Username,
+		Email:        extracted.Email,
+		AvatarURL:    extracted.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/gitee.go b/server/core_backend-server/tools/auth/gitee.go
new file mode 100644
index 0000000..ae0b07b
--- /dev/null
+++ b/server/core_backend-server/tools/auth/gitee.go
@@ -0,0 +1,142 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"strconv"
+
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameGitee] = wrapFactory(NewGiteeProvider)
+}
+
+var _ Provider = (*Gitee)(nil)
+
+// NameGitee is the unique name of the Gitee provider.
+const NameGitee string = "gitee"
+
+// Gitee allows authentication via Gitee OAuth2.
+type Gitee struct {
+	BaseProvider
+}
+
+// NewGiteeProvider creates new Gitee provider instance with some defaults.
+func NewGiteeProvider() *Gitee {
+	return &Gitee{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Gitee",
+		pkce:        true,
+		scopes:      []string{"user_info", "emails"},
+		authURL:     "https://gitee.com/oauth/authorize",
+		tokenURL:    "https://gitee.com/oauth/token",
+		userInfoURL: "https://gitee.com/api/v5/user",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the Gitee's user api.
+//
+// API reference: https://gitee.com/api/v5/swagger#/getV5User
+func (p *Gitee) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Login     string `json:"login"`
+		Name      string `json:"name"`
+		Email     string `json:"email"`
+		AvatarURL string `json:"avatar_url"`
+		Id        int64  `json:"id"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           strconv.FormatInt(extracted.Id, 10),
+		Name:         extracted.Name,
+		Username:     extracted.Login,
+		AvatarURL:    extracted.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if extracted.Email != "" && is.EmailFormat.Validate(extracted.Email) == nil {
+		// valid public primary email
+		user.Email = extracted.Email
+	} else {
+		// send an additional optional request to retrieve the email
+		email, err := p.fetchPrimaryEmail(token)
+		if err != nil {
+			return nil, err
+		}
+		user.Email = email
+	}
+
+	return user, nil
+}
+
+// fetchPrimaryEmail sends an API request to retrieve the verified primary email,
+// in case the user hasn't set "Public email address" or has unchecked
+// the "Access your emails data" permission during authentication.
+//
+// NB! This method can succeed and still return an empty email.
+// Error responses that are result of insufficient scopes permissions are ignored.
+//
+// API reference: https://gitee.com/api/v5/swagger#/getV5Emails
+func (p *Gitee) fetchPrimaryEmail(token *oauth2.Token) (string, error) {
+	client := p.Client(token)
+
+	response, err := client.Get("https://gitee.com/api/v5/emails")
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+
+	// ignore common http errors caused by insufficient scope permissions
+	if response.StatusCode == 401 || response.StatusCode == 403 || response.StatusCode == 404 {
+		return "", nil
+	}
+
+	content, err := io.ReadAll(response.Body)
+	if err != nil {
+		return "", err
+	}
+
+	emails := []struct {
+		Email string
+		State string
+		Scope []string
+	}{}
+	if err := json.Unmarshal(content, &emails); err != nil {
+		// ignore unmarshal error in case "Keep my email address private"
+		// was set because response.Body will be something like:
+		// {"email":"12285415+test@user.noreply.gitee.com"}
+		return "", nil
+	}
+
+	// extract the first verified primary email
+	for _, email := range emails {
+		for _, scope := range email.Scope {
+			if email.State == "confirmed" && scope == "primary" && is.EmailFormat.Validate(email.Email) == nil {
+				return email.Email, nil
+			}
+		}
+	}
+
+	return "", nil
+}
diff --git a/server/core_backend-server/tools/auth/github.go b/server/core_backend-server/tools/auth/github.go
new file mode 100644
index 0000000..f4aa72f
--- /dev/null
+++ b/server/core_backend-server/tools/auth/github.go
@@ -0,0 +1,136 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"strconv"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/github"
+)
+
+func init() {
+	Providers[NameGithub] = wrapFactory(NewGithubProvider)
+}
+
+var _ Provider = (*Github)(nil)
+
+// NameGithub is the unique name of the Github provider.
+const NameGithub string = "github"
+
+// Github allows authentication via Github OAuth2.
+type Github struct {
+	BaseProvider
+}
+
+// NewGithubProvider creates new Github provider instance with some defaults.
+func NewGithubProvider() *Github {
+	return &Github{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "GitHub",
+		pkce:        true, // technically is not supported yet but it is safe as the PKCE params are just ignored
+		scopes:      []string{"read:user", "user:email"},
+		authURL:     github.Endpoint.AuthURL,
+		tokenURL:    github.Endpoint.TokenURL,
+		userInfoURL: "https://api.github.com/user",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the Github's user api.
+//
+// API reference: https://docs.github.com/en/rest/reference/users#get-the-authenticated-user
+func (p *Github) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Login     string `json:"login"`
+		Name      string `json:"name"`
+		Email     string `json:"email"`
+		AvatarURL string `json:"avatar_url"`
+		Id        int64  `json:"id"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           strconv.FormatInt(extracted.Id, 10),
+		Name:         extracted.Name,
+		Username:     extracted.Login,
+		Email:        extracted.Email,
+		AvatarURL:    extracted.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	// in case user has set "Keep my email address private", send an
+	// **optional** API request to retrieve the verified primary email
+	if user.Email == "" {
+		email, err := p.fetchPrimaryEmail(token)
+		if err != nil {
+			return nil, err
+		}
+		user.Email = email
+	}
+
+	return user, nil
+}
+
+// fetchPrimaryEmail sends an API request to retrieve the verified
+// primary email, in case "Keep my email address private" was set.
+//
+// NB! This method can succeed and still return an empty email.
+// Error responses that are result of insufficient scopes permissions are ignored.
+//
+// API reference: https://docs.github.com/en/rest/users/emails?apiVersion=2022-11-28
+func (p *Github) fetchPrimaryEmail(token *oauth2.Token) (string, error) {
+	client := p.Client(token)
+
+	response, err := client.Get(p.userInfoURL + "/emails")
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+
+	// ignore common http errors caused by insufficient scope permissions
+	// (the email field is optional, aka. return the auth user without it)
+	if response.StatusCode == 401 || response.StatusCode == 403 || response.StatusCode == 404 {
+		return "", nil
+	}
+
+	content, err := io.ReadAll(response.Body)
+	if err != nil {
+		return "", err
+	}
+
+	emails := []struct {
+		Email    string
+		Verified bool
+		Primary  bool
+	}{}
+	if err := json.Unmarshal(content, &emails); err != nil {
+		return "", err
+	}
+
+	// extract the verified primary email
+	for _, email := range emails {
+		if email.Verified && email.Primary {
+			return email.Email, nil
+		}
+	}
+
+	return "", nil
+}
diff --git a/server/core_backend-server/tools/auth/gitlab.go b/server/core_backend-server/tools/auth/gitlab.go
new file mode 100644
index 0000000..837197b
--- /dev/null
+++ b/server/core_backend-server/tools/auth/gitlab.go
@@ -0,0 +1,78 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameGitlab] = wrapFactory(NewGitlabProvider)
+}
+
+var _ Provider = (*Gitlab)(nil)
+
+// NameGitlab is the unique name of the Gitlab provider.
+const NameGitlab string = "gitlab"
+
+// Gitlab allows authentication via Gitlab OAuth2.
+type Gitlab struct {
+	BaseProvider
+}
+
+// NewGitlabProvider creates new Gitlab provider instance with some defaults.
+func NewGitlabProvider() *Gitlab {
+	return &Gitlab{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "GitLab",
+		pkce:        true,
+		scopes:      []string{"read_user"},
+		authURL:     "https://gitlab.com/oauth/authorize",
+		tokenURL:    "https://gitlab.com/oauth/token",
+		userInfoURL: "https://gitlab.com/api/v4/user",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the Gitlab's user api.
+//
+// API reference: https://docs.gitlab.com/ee/api/users.html#for-admin
+func (p *Gitlab) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Name      string `json:"name"`
+		Username  string `json:"username"`
+		Email     string `json:"email"`
+		AvatarURL string `json:"avatar_url"`
+		Id        int64  `json:"id"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           strconv.FormatInt(extracted.Id, 10),
+		Name:         extracted.Name,
+		Username:     extracted.Username,
+		Email:        extracted.Email,
+		AvatarURL:    extracted.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/google.go b/server/core_backend-server/tools/auth/google.go
new file mode 100644
index 0000000..086cc97
--- /dev/null
+++ b/server/core_backend-server/tools/auth/google.go
@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameGoogle] = wrapFactory(NewGoogleProvider)
+}
+
+var _ Provider = (*Google)(nil)
+
+// NameGoogle is the unique name of the Google provider.
+const NameGoogle string = "google"
+
+// Google allows authentication via Google OAuth2.
+type Google struct {
+	BaseProvider
+}
+
+// NewGoogleProvider creates new Google provider instance with some defaults.
+func NewGoogleProvider() *Google {
+	return &Google{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Google",
+		pkce:        true,
+		scopes: []string{
+			"https://www.googleapis.com/auth/userinfo.profile",
+			"https://www.googleapis.com/auth/userinfo.email",
+		},
+		authURL:     "https://accounts.google.com/o/oauth2/v2/auth",
+		tokenURL:    "https://oauth2.googleapis.com/token",
+		userInfoURL: "https://www.googleapis.com/oauth2/v3/userinfo",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the Google's user api.
+func (p *Google) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id            string `json:"sub"`
+		Name          string `json:"name"`
+		Picture       string `json:"picture"`
+		Email         string `json:"email"`
+		EmailVerified bool   `json:"email_verified"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		AvatarURL:    extracted.Picture,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if extracted.EmailVerified {
+		user.Email = extracted.Email
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/instagram.go b/server/core_backend-server/tools/auth/instagram.go
new file mode 100644
index 0000000..9de0f60
--- /dev/null
+++ b/server/core_backend-server/tools/auth/instagram.go
@@ -0,0 +1,82 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameInstagram] = wrapFactory(NewInstagramProvider)
+}
+
+var _ Provider = (*Instagram)(nil)
+
+// NameInstagram is the unique name of the Instagram provider.
+const NameInstagram string = "instagram2" // "2" suffix to avoid conflicts with the old deprecated version
+
+// Instagram allows authentication via Instagram Login OAuth2.
+type Instagram struct {
+	BaseProvider
+}
+
+// NewInstagramProvider creates new Instagram provider instance with some defaults.
+func NewInstagramProvider() *Instagram {
+	return &Instagram{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Instagram",
+		pkce:        true,
+		scopes:      []string{"instagram_business_basic"},
+		authURL:     "https://www.instagram.com/oauth/authorize",
+		tokenURL:    "https://api.instagram.com/oauth/access_token",
+		userInfoURL: "https://graph.instagram.com/me?fields=id,username,account_type,user_id,name,profile_picture_url,followers_count,follows_count,media_count",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Instagram Login user api response.
+//
+// API reference: https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/get-started#fields
+func (p *Instagram) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	// include list of granted permissions to RawUser's payload
+	if _, ok := rawUser["permissions"]; !ok {
+		if permissions := token.Extra("permissions"); permissions != nil {
+			rawUser["permissions"] = permissions
+		}
+	}
+
+	extracted := struct {
+		Id        string `json:"user_id"`
+		Name      string `json:"name"`
+		Username  string `json:"username"`
+		AvatarURL string `json:"profile_picture_url"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Username:     extracted.Username,
+		Name:         extracted.Name,
+		AvatarURL:    extracted.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/internal/jwk/jwk.go b/server/core_backend-server/tools/auth/internal/jwk/jwk.go
new file mode 100644
index 0000000..c2bbfe8
--- /dev/null
+++ b/server/core_backend-server/tools/auth/internal/jwk/jwk.go
@@ -0,0 +1,163 @@
+// Package jwk implements some common utilities for interacting with JWKs
+// (mostly used with OIDC providers).
+package jwk
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"math/big"
+	"net/http"
+	"strings"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type JWK struct {
+	Kty string `json:"kty"`
+	Kid string `json:"kid"`
+	Use string `json:"use"`
+	Alg string `json:"alg"`
+	// RS256 (RSA)
+	E string `json:"e"`
+	N string `json:"n"`
+	// Ed25519 (OKP)
+	Crv string `json:"crv"`
+	X   string `json:"x"`
+}
+
+// PublicKey reconstructs and returns the public key from the current JWK.
+func (key *JWK) PublicKey() (any, error) {
+	switch key.Kty {
+	case "RSA":
+		// RFC 7518
+		// https://datatracker.ietf.org/doc/html/rfc7518#section-6.3
+		// https://datatracker.ietf.org/doc/html/rfc7517#appendix-A.1
+		exponent, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(key.E, "="))
+		if err != nil {
+			return nil, err
+		}
+
+		modulus, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(key.N, "="))
+		if err != nil {
+			return nil, err
+		}
+
+		return &rsa.PublicKey{
+			E: int(big.NewInt(0).SetBytes(exponent).Uint64()),
+			N: big.NewInt(0).SetBytes(modulus),
+		}, nil
+	case "OKP":
+		// RFC 8037
+		// https://datatracker.ietf.org/doc/html/rfc8037#section-2
+		// https://datatracker.ietf.org/doc/html/rfc8037#appendix-A
+		if key.Crv != "Ed25519" {
+			return nil, fmt.Errorf("unsupported OKP curve (must be Ed25519): %q", key.Crv)
+		}
+
+		x, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(key.X, "="))
+		if err != nil {
+			return nil, err
+		}
+
+		if l := len(x); l != ed25519.PublicKeySize {
+			return nil, fmt.Errorf("invalid Ed25519 key length: %d", l)
+		}
+
+		return ed25519.PublicKey(x), nil
+	default:
+		return nil, fmt.Errorf("unsupported kty (must be RSA or OKP): %q", key.Kty)
+	}
+}
+
+// Fetch retrieves the JSON Web Key Set located at jwksURL and returns
+// the first key that matches the specified kid.
+func Fetch(ctx context.Context, jwksURL string, kid string) (*JWK, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", jwksURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	rawBody, err := io.ReadAll(res.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	// http.Client.Get doesn't treat non 2xx responses as error
+	if res.StatusCode >= 400 {
+		return nil, fmt.Errorf(
+			"failed to fetch JSON Web Key Set from %s (%d):\n%s",
+			jwksURL,
+			res.StatusCode,
+			string(rawBody),
+		)
+	}
+
+	jwks := struct {
+		Keys []*JWK
+	}{}
+
+	err = json.Unmarshal(rawBody, &jwks)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, key := range jwks.Keys {
+		if key.Kid == kid {
+			return key, nil
+		}
+	}
+
+	return nil, fmt.Errorf("JWK with kid %q was not found", kid)
+}
+
+// ValidateTokenSignature validates the signature of a token with the
+// public key retrievied from a remote JWKS.
+func ValidateTokenSignature(ctx context.Context, token string, jwksURL string) error {
+	// extract the kid token header
+	// ---
+	t, _, err := jwt.NewParser().ParseUnverified(token, jwt.MapClaims{})
+	if err != nil {
+		return err
+	}
+
+	kid, _ := t.Header["kid"].(string)
+	if kid == "" {
+		return errors.New("missing kid header value")
+	}
+
+	// fetch the public key set
+	// ---
+	key, err := Fetch(ctx, jwksURL, kid)
+	if err != nil {
+		return err
+	}
+
+	// verify the signature
+	// ---
+	parser := jwt.NewParser(jwt.WithValidMethods([]string{key.Alg}))
+
+	parsedToken, err := parser.Parse(token, func(t *jwt.Token) (any, error) {
+		return key.PublicKey()
+	})
+	if err != nil {
+		return err
+	}
+
+	if !parsedToken.Valid {
+		return errors.New("the parsed token is invalid")
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/tools/auth/internal/jwk/jwk_test.go b/server/core_backend-server/tools/auth/internal/jwk/jwk_test.go
new file mode 100644
index 0000000..df4a48e
--- /dev/null
+++ b/server/core_backend-server/tools/auth/internal/jwk/jwk_test.go
@@ -0,0 +1,314 @@
+package jwk_test
+
+import (
+	"context"
+	"crypto"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/auth/internal/jwk"
+)
+
+type publicKey interface {
+	Equal(x crypto.PublicKey) bool
+}
+
+func TestJWK_PublicKey(t *testing.T) {
+	t.Parallel()
+
+	rsaPrivate, err := rsa.GenerateKey(rand.Reader, 1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name        string
+		key         *jwk.JWK
+		expectError bool
+		expectKey   crypto.PublicKey
+	}{
+		{
+			"empty",
+			&jwk.JWK{},
+			true,
+			nil,
+		},
+		{
+			"invalid kty",
+			&jwk.JWK{
+				Kty: "invalid",
+				Alg: "RS256",
+				E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(rsaPrivate.E)).Bytes()),
+				N:   base64.RawURLEncoding.EncodeToString(rsaPrivate.N.Bytes()),
+			},
+			true,
+			nil,
+		},
+		{
+			"RSA",
+			&jwk.JWK{
+				Kty: "RSA",
+				Alg: "RS256",
+				E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(rsaPrivate.E)).Bytes()),
+				N:   base64.RawURLEncoding.EncodeToString(rsaPrivate.N.Bytes()),
+			},
+			false,
+			&rsaPrivate.PublicKey,
+		},
+		{
+			"OKP with unsupported curve",
+			&jwk.JWK{
+				Kty: "OKP",
+				Crv: "invalid",
+				X:   base64.RawURLEncoding.EncodeToString([]byte(strings.Repeat("a", ed25519.PublicKeySize))),
+			},
+			true,
+			nil,
+		},
+		{
+			"OKP with invalid public key length",
+			&jwk.JWK{
+				Kty: "OKP",
+				Crv: "Ed25519",
+				X:   base64.RawURLEncoding.EncodeToString([]byte(strings.Repeat("a", ed25519.PublicKeySize-1))),
+			},
+			true,
+			nil,
+		},
+		{
+			"valid OKP",
+			&jwk.JWK{
+				Kty: "OKP",
+				Crv: "Ed25519",
+				X:   base64.RawURLEncoding.EncodeToString([]byte(strings.Repeat("a", ed25519.PublicKeySize))),
+			},
+			false,
+			ed25519.PublicKey([]byte(strings.Repeat("a", ed25519.PublicKeySize))),
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result, err := s.key.PublicKey()
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr && result == nil {
+				return
+			}
+
+			k, ok := result.(publicKey)
+			if !ok {
+				t.Fatalf("The returned public key %T doesn't satisfy the expected common interface", k)
+			}
+
+			if !k.Equal(s.expectKey) {
+				t.Fatalf("The returned public key doesn't match with the expected one:\n%v\n%v", k, s.expectKey)
+			}
+		})
+	}
+}
+
+func TestFetch(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		if req.URL.Query().Has("error") {
+			res.WriteHeader(http.StatusBadRequest)
+		}
+
+		fmt.Fprintf(res, `{
+			"keys": [
+				{
+					"kid": "abc",
+					"kty": "OKP",
+					"crv": "Ed25519",
+					"x":   "test_x"
+				},
+				{
+					"kid": "def",
+					"kty": "RSA",
+					"alg": "RS256",
+					"n":   "test_n",
+					"e":   "test_e"
+				}
+			]
+		}`)
+	}))
+	defer server.Close()
+
+	scenarios := []struct {
+		name        string
+		kid         string
+		expectError bool
+		contains    []string
+	}{
+		{
+			"error response",
+			"def",
+			true,
+			nil,
+		},
+		{
+			"non-matching kid",
+			"missing",
+			true,
+			nil,
+		},
+		{
+			"matching kid",
+			"def",
+			false,
+			[]string{
+				`"kid":"def"`,
+				`"kty":"RSA"`,
+				`"alg":"RS256"`,
+				`"n":"test_n"`,
+				`"e":"test_e"`,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			url := server.URL
+			if s.expectError {
+				url += "?error"
+			}
+
+			key, err := jwk.Fetch(context.Background(), url, s.kid)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			raw, err := json.Marshal(key)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			for _, substr := range s.contains {
+				if !strings.Contains(rawStr, substr) {
+					t.Fatalf("Missing expected substring\n%s\nin\n%s", substr, rawStr)
+				}
+			}
+		})
+	}
+}
+
+func TestValidateTokenSignature(t *testing.T) {
+	t.Parallel()
+
+	rsaPrivate, err := rsa.GenerateKey(rand.Reader, 1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ed25519Public, ed25519Private, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	nonmatchingKidToken := jwt.New(&jwt.SigningMethodEd25519{})
+	nonmatchingKidToken.Header["kid"] = "missing"
+	nonmatchingKidTokenStr, err := nonmatchingKidToken.SignedString(ed25519Private)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	key1Token := jwt.New(&jwt.SigningMethodEd25519{})
+	key1Token.Header["kid"] = "key1"
+	key1TokenStr, err := key1Token.SignedString(ed25519Private)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	key2Token := jwt.New(jwt.SigningMethodRS256)
+	key2Token.Header["kid"] = "key2"
+	key2TokenStr, err := key2Token.SignedString(rsaPrivate)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		_ = json.NewEncoder(res).Encode(map[string]any{"keys": []*jwk.JWK{
+			{
+				Kid: "key1",
+				Kty: "OKP",
+				Alg: "EdDSA",
+				Crv: "Ed25519",
+				X:   base64.RawURLEncoding.EncodeToString(ed25519Public),
+			},
+			{
+				Kid: "key2",
+				Kty: "RSA",
+				Alg: "RS256",
+				E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(rsaPrivate.E)).Bytes()),
+				N:   base64.RawURLEncoding.EncodeToString(rsaPrivate.N.Bytes()),
+			},
+		}})
+	}))
+	defer server.Close()
+
+	scenarios := []struct {
+		name        string
+		token       string
+		expectError bool
+	}{
+		{
+			"empty token",
+			"",
+			true,
+		},
+		{
+			"invlaid token",
+			"abc",
+			true,
+		},
+		{
+			"no matching kid",
+			nonmatchingKidTokenStr,
+			true,
+		},
+		{
+			"valid Ed25519 token",
+			key1TokenStr,
+			false,
+		},
+		{
+			"valid RSA token",
+			key2TokenStr,
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := jwk.ValidateTokenSignature(
+				context.Background(),
+				s.token,
+				server.URL,
+			)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/auth/kakao.go b/server/core_backend-server/tools/auth/kakao.go
new file mode 100644
index 0000000..849718a
--- /dev/null
+++ b/server/core_backend-server/tools/auth/kakao.go
@@ -0,0 +1,86 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/kakao"
+)
+
+func init() {
+	Providers[NameKakao] = wrapFactory(NewKakaoProvider)
+}
+
+var _ Provider = (*Kakao)(nil)
+
+// NameKakao is the unique name of the Kakao provider.
+const NameKakao string = "kakao"
+
+// Kakao allows authentication via Kakao OAuth2.
+type Kakao struct {
+	BaseProvider
+}
+
+// NewKakaoProvider creates a new Kakao provider instance with some defaults.
+func NewKakaoProvider() *Kakao {
+	return &Kakao{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Kakao",
+		pkce:        true,
+		scopes:      []string{"account_email", "profile_nickname", "profile_image"},
+		authURL:     kakao.Endpoint.AuthURL,
+		tokenURL:    kakao.Endpoint.TokenURL,
+		userInfoURL: "https://kapi.kakao.com/v2/user/me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Kakao's user api.
+//
+// API reference: https://developers.kakao.com/docs/latest/en/kakaologin/rest-api#req-user-info-response
+func (p *Kakao) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Profile struct {
+			Nickname string `json:"nickname"`
+			ImageURL string `json:"profile_image"`
+		} `json:"properties"`
+		KakaoAccount struct {
+			Email           string `json:"email"`
+			IsEmailVerified bool   `json:"is_email_verified"`
+			IsEmailValid    bool   `json:"is_email_valid"`
+		} `json:"kakao_account"`
+		Id int64 `json:"id"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           strconv.FormatInt(extracted.Id, 10),
+		Username:     extracted.Profile.Nickname,
+		AvatarURL:    extracted.Profile.ImageURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if extracted.KakaoAccount.IsEmailValid && extracted.KakaoAccount.IsEmailVerified {
+		user.Email = extracted.KakaoAccount.Email
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/lark.go b/server/core_backend-server/tools/auth/lark.go
new file mode 100644
index 0000000..7466f86
--- /dev/null
+++ b/server/core_backend-server/tools/auth/lark.go
@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameLark] = wrapFactory(NewLarkProvider)
+}
+
+var _ Provider = (*Lark)(nil)
+
+// NameLark is the unique name of the Lark provider.
+const NameLark string = "lark"
+
+// Lark allows authentication via Lark OAuth2.
+type Lark struct {
+	BaseProvider
+}
+
+// NewLarkProvider creates new Lark provider instance with some defaults.
+func NewLarkProvider() *Lark {
+	return &Lark{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Lark",
+		pkce:        true,
+		// Lark has two domains with the same API: feishu.cn and larksuite.com.
+		// The former is used in China and the latter is used in the other regions.
+		// We choose feishu.cn as a default, matching the behavior of Lark's official SDK.
+		// Endpoint URLs can be overridden from the frontend if needed.
+		// SDK Reference: https://github.com/larksuite/oapi-sdk-go
+		authURL:     "https://accounts.feishu.cn/open-apis/authen/v1/authorize",
+		tokenURL:    "https://open.feishu.cn/open-apis/authen/v2/oauth/token",
+		userInfoURL: "https://open.feishu.cn/open-apis/authen/v1/user_info",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the Lark's user api.
+//
+// API reference: https://open.feishu.cn/document/server-docs/authentication-management/login-state-management/get
+func (p *Lark) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data struct {
+			// https://open.feishu.cn/document/platform-overveiw/basic-concepts/user-identity-introduction/introduction#3f2d4b63
+			UnionId   string `json:"union_id"`
+			Name      string `json:"name"`
+			AvatarURL string `json:"avatar_url"`
+		} `json:"data"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data.UnionId,
+		Name:         extracted.Data.Name,
+		AvatarURL:    extracted.Data.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/linear.go b/server/core_backend-server/tools/auth/linear.go
new file mode 100644
index 0000000..d5bab3c
--- /dev/null
+++ b/server/core_backend-server/tools/auth/linear.go
@@ -0,0 +1,109 @@
+package auth
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameLinear] = wrapFactory(NewLinearProvider)
+}
+
+var _ Provider = (*Linear)(nil)
+
+// NameLinear is the unique name of the Linear provider.
+const NameLinear string = "linear"
+
+// Linear allows authentication via Linear OAuth2.
+type Linear struct {
+	BaseProvider
+}
+
+// NewLinearProvider creates new Linear provider instance with some defaults.
+//
+// API reference: https://developers.linear.app/docs/oauth/authentication
+func NewLinearProvider() *Linear {
+	return &Linear{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Linear",
+		pkce:        false, // Linear doesn't support PKCE at the moment and returns an error if enabled
+		scopes:      []string{"read"},
+		authURL:     "https://linear.app/oauth/authorize",
+		tokenURL:    "https://api.linear.app/oauth/token",
+		userInfoURL: "https://api.linear.app/graphql",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Linear's user api.
+//
+// API reference: https://developers.linear.app/docs/graphql/working-with-the-graphql-api#authentication
+func (p *Linear) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data struct {
+			Viewer struct {
+				Id          string `json:"id"`
+				DisplayName string `json:"displayName"`
+				Name        string `json:"name"`
+				Email       string `json:"email"`
+				AvatarURL   string `json:"avatarUrl"`
+				Active      bool   `json:"active"`
+			} `json:"viewer"`
+		} `json:"data"`
+	}{}
+
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if !extracted.Data.Viewer.Active {
+		return nil, errors.New("the Linear user account is not active")
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data.Viewer.Id,
+		Name:         extracted.Data.Viewer.Name,
+		Username:     extracted.Data.Viewer.DisplayName,
+		Email:        extracted.Data.Viewer.Email,
+		AvatarURL:    extracted.Data.Viewer.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo interface method.
+//
+// Linear doesn't have a UserInfo endpoint and information on the user
+// is retrieved using their GraphQL API (https://developers.linear.app/docs/graphql/working-with-the-graphql-api#queries-and-mutations)
+func (p *Linear) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	query := []byte(`{"query": "query Me { viewer { id displayName name email avatarUrl active } }"}`)
+	bodyReader := bytes.NewReader(query)
+
+	req, err := http.NewRequestWithContext(p.ctx, "POST", p.userInfoURL, bodyReader)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	return p.sendRawUserInfoRequest(req, token)
+}
diff --git a/server/core_backend-server/tools/auth/livechat.go b/server/core_backend-server/tools/auth/livechat.go
new file mode 100644
index 0000000..2272091
--- /dev/null
+++ b/server/core_backend-server/tools/auth/livechat.go
@@ -0,0 +1,79 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameLivechat] = wrapFactory(NewLivechatProvider)
+}
+
+var _ Provider = (*Livechat)(nil)
+
+// NameLivechat is the unique name of the Livechat provider.
+const NameLivechat = "livechat"
+
+// Livechat allows authentication via Livechat OAuth2.
+type Livechat struct {
+	BaseProvider
+}
+
+// NewLivechatProvider creates new Livechat provider instance with some defaults.
+func NewLivechatProvider() *Livechat {
+	return &Livechat{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "LiveChat",
+		pkce:        true,
+		scopes:      []string{}, // default scopes are specified from the provider dashboard
+		authURL:     "https://accounts.livechat.com/",
+		tokenURL:    "https://accounts.livechat.com/token",
+		userInfoURL: "https://accounts.livechat.com/v2/accounts/me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser based on the Livechat accounts API.
+//
+// API reference: https://developers.livechat.com/docs/authorization
+func (p *Livechat) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id            string `json:"account_id"`
+		Name          string `json:"name"`
+		Email         string `json:"email"`
+		EmailVerified bool   `json:"email_verified"`
+		AvatarURL     string `json:"avatar_url"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		AvatarURL:    extracted.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if extracted.EmailVerified {
+		user.Email = extracted.Email
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/mailcow.go b/server/core_backend-server/tools/auth/mailcow.go
new file mode 100644
index 0000000..7e802be
--- /dev/null
+++ b/server/core_backend-server/tools/auth/mailcow.go
@@ -0,0 +1,84 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameMailcow] = wrapFactory(NewMailcowProvider)
+}
+
+var _ Provider = (*Mailcow)(nil)
+
+// NameMailcow is the unique name of the mailcow provider.
+const NameMailcow string = "mailcow"
+
+// Mailcow allows authentication via mailcow OAuth2.
+type Mailcow struct {
+	BaseProvider
+}
+
+// NewMailcowProvider creates a new mailcow provider instance with some defaults.
+func NewMailcowProvider() *Mailcow {
+	return &Mailcow{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "mailcow",
+		pkce:        true,
+		scopes:      []string{"profile"},
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on mailcow's user api.
+//
+// API reference: https://github.com/mailcow/mailcow-dockerized/blob/master/data/web/oauth/profile.php
+func (p *Mailcow) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id       string `json:"id"`
+		Username string `json:"username"`
+		Email    string `json:"email"`
+		FullName string `json:"full_name"`
+		Active   int    `json:"active"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if extracted.Active != 1 {
+		return nil, errors.New("the mailcow user is not active")
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.FullName,
+		Username:     extracted.Username,
+		Email:        extracted.Email,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	// mailcow usernames are usually just the email adresses, so we just take the part in front of the @
+	if strings.Contains(user.Username, "@") {
+		user.Username = strings.Split(user.Username, "@")[0]
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/microsoft.go b/server/core_backend-server/tools/auth/microsoft.go
new file mode 100644
index 0000000..9873258
--- /dev/null
+++ b/server/core_backend-server/tools/auth/microsoft.go
@@ -0,0 +1,76 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/microsoft"
+)
+
+func init() {
+	Providers[NameMicrosoft] = wrapFactory(NewMicrosoftProvider)
+}
+
+var _ Provider = (*Microsoft)(nil)
+
+// NameMicrosoft is the unique name of the Microsoft provider.
+const NameMicrosoft string = "microsoft"
+
+// Microsoft allows authentication via AzureADEndpoint OAuth2.
+type Microsoft struct {
+	BaseProvider
+}
+
+// NewMicrosoftProvider creates new Microsoft AD provider instance with some defaults.
+func NewMicrosoftProvider() *Microsoft {
+	endpoints := microsoft.AzureADEndpoint("")
+	return &Microsoft{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Microsoft",
+		pkce:        true,
+		scopes:      []string{"User.Read"},
+		authURL:     endpoints.AuthURL,
+		tokenURL:    endpoints.TokenURL,
+		userInfoURL: "https://graph.microsoft.com/v1.0/me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Microsoft's user api.
+//
+// API reference:  https://learn.microsoft.com/en-us/azure/active-directory/develop/userinfo
+// Graph explorer: https://developer.microsoft.com/en-us/graph/graph-explorer
+func (p *Microsoft) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id    string `json:"id"`
+		Name  string `json:"displayName"`
+		Email string `json:"mail"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		Email:        extracted.Email,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/monday.go b/server/core_backend-server/tools/auth/monday.go
new file mode 100644
index 0000000..3076c49
--- /dev/null
+++ b/server/core_backend-server/tools/auth/monday.go
@@ -0,0 +1,108 @@
+package auth
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameMonday] = wrapFactory(NewMondayProvider)
+}
+
+var _ Provider = (*Monday)(nil)
+
+// NameMonday is the unique name of the Monday provider.
+const NameMonday = "monday"
+
+// Monday is an auth provider for monday.com.
+type Monday struct {
+	BaseProvider
+}
+
+// NewMondayProvider creates a new Monday provider instance with some defaults.
+func NewMondayProvider() *Monday {
+	return &Monday{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "monday.com",
+		pkce:        true,
+		scopes:      []string{"me:read"},
+		authURL:     "https://auth.monday.com/oauth2/authorize",
+		tokenURL:    "https://auth.monday.com/oauth2/token",
+		userInfoURL: "https://api.monday.com/v2",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Monday's user api.
+//
+// API reference: https://developer.monday.com/api-reference/reference/me
+func (p *Monday) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data struct {
+			Me struct {
+				Id         string `json:"id"`
+				Enabled    bool   `json:"enabled"`
+				Name       string `json:"name"`
+				Email      string `json:"email"`
+				IsVerified bool   `json:"is_verified"`
+				Avatar     string `json:"photo_small"`
+			} `json:"me"`
+		} `json:"data"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if !extracted.Data.Me.Enabled {
+		return nil, errors.New("the monday.com user account is not enabled")
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data.Me.Id,
+		Name:         extracted.Data.Me.Name,
+		AvatarURL:    extracted.Data.Me.Avatar,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	if extracted.Data.Me.IsVerified {
+		user.Email = extracted.Data.Me.Email
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo interface.
+//
+// monday.com doesn't have a UserInfo endpoint and information on the user
+// is retrieved using their GraphQL API (https://developer.monday.com/api-reference/reference/me#queries)
+func (p *Monday) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	query := []byte(`{"query": "query { me { id enabled name email is_verified photo_small }}"}`)
+	bodyReader := bytes.NewReader(query)
+
+	req, err := http.NewRequestWithContext(p.ctx, "POST", p.userInfoURL, bodyReader)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	return p.sendRawUserInfoRequest(req, token)
+}
diff --git a/server/core_backend-server/tools/auth/notion.go b/server/core_backend-server/tools/auth/notion.go
new file mode 100644
index 0000000..5138e21
--- /dev/null
+++ b/server/core_backend-server/tools/auth/notion.go
@@ -0,0 +1,106 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameNotion] = wrapFactory(NewNotionProvider)
+}
+
+var _ Provider = (*Notion)(nil)
+
+// NameNotion is the unique name of the Notion provider.
+const NameNotion string = "notion"
+
+// Notion allows authentication via Notion OAuth2.
+type Notion struct {
+	BaseProvider
+}
+
+// NewNotionProvider creates new Notion provider instance with some defaults.
+func NewNotionProvider() *Notion {
+	return &Notion{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Notion",
+		pkce:        true,
+		authURL:     "https://api.notion.com/v1/oauth/authorize",
+		tokenURL:    "https://api.notion.com/v1/oauth/token",
+		userInfoURL: "https://api.notion.com/v1/users/me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Notion's User api.
+// API reference: https://developers.notion.com/reference/get-self
+func (p *Notion) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		AvatarURL string `json:"avatar_url"`
+		Bot       struct {
+			Owner struct {
+				Type string `json:"type"`
+				User struct {
+					AvatarURL string `json:"avatar_url"`
+					Id        string `json:"id"`
+					Name      string `json:"name"`
+					Person    struct {
+						Email string `json:"email"`
+					} `json:"person"`
+				} `json:"user"`
+			} `json:"owner"`
+			WorkspaceName string `json:"workspace_name"`
+		} `json:"bot"`
+		Id        string `json:"id"`
+		Name      string `json:"name"`
+		Object    string `json:"object"`
+		RequestId string `json:"request_id"`
+		Type      string `json:"type"`
+	}{}
+
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Bot.Owner.User.Id,
+		Name:         extracted.Bot.Owner.User.Name,
+		Email:        extracted.Bot.Owner.User.Person.Email,
+		AvatarURL:    extracted.Bot.Owner.User.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo interface method.
+//
+// This differ from BaseProvider because Notion requires a version header for all requests
+// (https://developers.notion.com/reference/versioning).
+func (p *Notion) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	req, err := http.NewRequestWithContext(p.ctx, "GET", p.userInfoURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Notion-Version", "2022-06-28")
+
+	return p.sendRawUserInfoRequest(req, token)
+}
diff --git a/server/core_backend-server/tools/auth/oidc.go b/server/core_backend-server/tools/auth/oidc.go
new file mode 100644
index 0000000..ddfdffb
--- /dev/null
+++ b/server/core_backend-server/tools/auth/oidc.go
@@ -0,0 +1,186 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/auth/internal/jwk"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
+	"golang.org/x/oauth2"
+)
+
+// idTokenLeeway is the optional leeway for the id_token timestamp fields validation.
+//
+// It can be changed externally using the PB_ID_TOKEN_LEEWAY env variable
+// (the value must be in seconds, e.g. "PB_ID_TOKEN_LEEWAY=60" for 1 minute).
+var idTokenLeeway time.Duration = 5 * time.Minute
+
+func init() {
+	Providers[NameOIDC] = wrapFactory(NewOIDCProvider)
+	Providers[NameOIDC+"2"] = wrapFactory(NewOIDCProvider)
+	Providers[NameOIDC+"3"] = wrapFactory(NewOIDCProvider)
+
+	if leewayStr := os.Getenv("PB_ID_TOKEN_LEEWAY"); leewayStr != "" {
+		leeway, err := strconv.Atoi(leewayStr)
+		if err == nil {
+			idTokenLeeway = time.Duration(leeway) * time.Second
+		}
+	}
+}
+
+var _ Provider = (*OIDC)(nil)
+
+// NameOIDC is the unique name of the OpenID Connect (OIDC) provider.
+const NameOIDC string = "oidc"
+
+// OIDC allows authentication via OpenID Connect (OIDC) OAuth2 provider.
+//
+// If specified the user data is fetched from the userInfoURL.
+// Otherwise - from the id_token payload.
+//
+// The provider support the following Extra config options:
+//   - "jwksURL" - url to the keys to validate the id_token signature (optional and used only when reading the user data from the id_token)
+//   - "issuers" - list of valid issuers for the iss id_token claim (optioanl and used only when reading the user data from the id_token)
+type OIDC struct {
+	BaseProvider
+}
+
+// NewOIDCProvider creates new OpenID Connect (OIDC) provider instance with some defaults.
+func NewOIDCProvider() *OIDC {
+	return &OIDC{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "OIDC",
+		pkce:        true,
+		scopes: []string{
+			"openid", // minimal requirement to return the id
+			"email",
+			"profile",
+		},
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the provider's user api.
+//
+// API reference: https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+func (p *OIDC) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id            string `json:"sub"`
+		Name          string `json:"name"`
+		Username      string `json:"preferred_username"`
+		Picture       string `json:"picture"`
+		Email         string `json:"email"`
+		EmailVerified any    `json:"email_verified"` // see #6657
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		Username:     extracted.Username,
+		AvatarURL:    extracted.Picture,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if cast.ToBool(extracted.EmailVerified) {
+		user.Email = extracted.Email
+	}
+
+	return user, nil
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo interface method.
+//
+// It either fetch the data from p.userInfoURL, or if not set - returns the id_token claims.
+func (p *OIDC) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	if p.userInfoURL != "" {
+		return p.BaseProvider.FetchRawUserInfo(token)
+	}
+
+	claims, err := p.parseIdToken(token)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(claims)
+}
+
+func (p *OIDC) parseIdToken(token *oauth2.Token) (jwt.MapClaims, error) {
+	idToken := token.Extra("id_token").(string)
+	if idToken == "" {
+		return nil, errors.New("empty id_token")
+	}
+
+	claims := jwt.MapClaims{}
+	_, _, err := jwt.NewParser().ParseUnverified(idToken, claims)
+	if err != nil {
+		return nil, err
+	}
+
+	// validate common claims
+	jwtValidator := jwt.NewValidator(
+		jwt.WithIssuedAt(),
+		jwt.WithLeeway(idTokenLeeway),
+		jwt.WithAudience(p.clientId),
+	)
+	err = jwtValidator.Validate(claims)
+	if err != nil {
+		return nil, err
+	}
+
+	// validate iss (if "issuers" extra config is set)
+	issuers := cast.ToStringSlice(p.Extra()["issuers"])
+	if len(issuers) > 0 {
+		var isIssValid bool
+		claimIssuer, _ := claims.GetIssuer()
+
+		for _, issuer := range issuers {
+			if security.Equal(claimIssuer, issuer) {
+				isIssValid = true
+				break
+			}
+		}
+
+		if !isIssValid {
+			return nil, fmt.Errorf("iss must be one of %v, got %#v", issuers, claims["iss"])
+		}
+	}
+
+	// validate signature (if "jwksURL" extra config is set)
+	//
+	// note: this step could be technically considered optional because we trust
+	// the token which is a result of direct TLS communication with the provider
+	// (see also https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation)
+	jwksURL := cast.ToString(p.Extra()["jwksURL"])
+	if jwksURL != "" {
+		err = jwk.ValidateTokenSignature(p.ctx, idToken, jwksURL)
+		if err != nil {
+			return nil, fmt.Errorf("id_token validation failed: %w", err)
+		}
+	}
+
+	return claims, nil
+}
diff --git a/server/core_backend-server/tools/auth/patreon.go b/server/core_backend-server/tools/auth/patreon.go
new file mode 100644
index 0000000..ccccc79
--- /dev/null
+++ b/server/core_backend-server/tools/auth/patreon.go
@@ -0,0 +1,88 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/endpoints"
+)
+
+func init() {
+	Providers[NamePatreon] = wrapFactory(NewPatreonProvider)
+}
+
+var _ Provider = (*Patreon)(nil)
+
+// NamePatreon is the unique name of the Patreon provider.
+const NamePatreon string = "patreon"
+
+// Patreon allows authentication via Patreon OAuth2.
+type Patreon struct {
+	BaseProvider
+}
+
+// NewPatreonProvider creates new Patreon provider instance with some defaults.
+func NewPatreonProvider() *Patreon {
+	return &Patreon{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Patreon",
+		pkce:        true,
+		scopes:      []string{"identity", "identity[email]"},
+		authURL:     endpoints.Patreon.AuthURL,
+		tokenURL:    endpoints.Patreon.TokenURL,
+		userInfoURL: "https://www.patreon.com/api/oauth2/v2/identity?fields%5Buser%5D=full_name,email,vanity,image_url,is_email_verified",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Patreons's identity api.
+//
+// API reference:
+// https://docs.patreon.com/#get-api-oauth2-v2-identity
+// https://docs.patreon.com/#user-v2
+func (p *Patreon) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data struct {
+			Id         string `json:"id"`
+			Attributes struct {
+				Email           string `json:"email"`
+				Name            string `json:"full_name"`
+				Username        string `json:"vanity"`
+				AvatarURL       string `json:"image_url"`
+				IsEmailVerified bool   `json:"is_email_verified"`
+			} `json:"attributes"`
+		} `json:"data"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data.Id,
+		Username:     extracted.Data.Attributes.Username,
+		Name:         extracted.Data.Attributes.Name,
+		AvatarURL:    extracted.Data.Attributes.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if extracted.Data.Attributes.IsEmailVerified {
+		user.Email = extracted.Data.Attributes.Email
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/planningcenter.go b/server/core_backend-server/tools/auth/planningcenter.go
new file mode 100644
index 0000000..2d834dc
--- /dev/null
+++ b/server/core_backend-server/tools/auth/planningcenter.go
@@ -0,0 +1,85 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NamePlanningcenter] = wrapFactory(NewPlanningcenterProvider)
+}
+
+var _ Provider = (*Planningcenter)(nil)
+
+// NamePlanningcenter is the unique name of the Planningcenter provider.
+const NamePlanningcenter string = "planningcenter"
+
+// Planningcenter allows authentication via Planningcenter OAuth2.
+type Planningcenter struct {
+	BaseProvider
+}
+
+// NewPlanningcenterProvider creates a new Planningcenter provider instance with some defaults.
+func NewPlanningcenterProvider() *Planningcenter {
+	return &Planningcenter{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Planning Center",
+		pkce:        true,
+		scopes:      []string{"people"},
+		authURL:     "https://api.planningcenteronline.com/oauth/authorize",
+		tokenURL:    "https://api.planningcenteronline.com/oauth/token",
+		userInfoURL: "https://api.planningcenteronline.com/people/v2/me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Planningcenter's user api.
+//
+// API reference: https://developer.planning.center/docs/#/overview/authentication
+func (p *Planningcenter) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data struct {
+			Id         string `json:"id"`
+			Attributes struct {
+				Status    string `json:"status"`
+				Name      string `json:"name"`
+				AvatarURL string `json:"avatar"`
+				// don't map the email because users can have multiple assigned
+				// and it's not clear if they are verified
+			}
+		}
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if extracted.Data.Attributes.Status != "active" {
+		return nil, errors.New("the user is not active")
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data.Id,
+		Name:         extracted.Data.Attributes.Name,
+		AvatarURL:    extracted.Data.Attributes.AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/spotify.go b/server/core_backend-server/tools/auth/spotify.go
new file mode 100644
index 0000000..7e6b970
--- /dev/null
+++ b/server/core_backend-server/tools/auth/spotify.go
@@ -0,0 +1,87 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/spotify"
+)
+
+func init() {
+	Providers[NameSpotify] = wrapFactory(NewSpotifyProvider)
+}
+
+var _ Provider = (*Spotify)(nil)
+
+// NameSpotify is the unique name of the Spotify provider.
+const NameSpotify string = "spotify"
+
+// Spotify allows authentication via Spotify OAuth2.
+type Spotify struct {
+	BaseProvider
+}
+
+// NewSpotifyProvider creates a new Spotify provider instance with some defaults.
+func NewSpotifyProvider() *Spotify {
+	return &Spotify{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Spotify",
+		pkce:        true,
+		scopes: []string{
+			"user-read-private",
+			// currently Spotify doesn't return information whether the email is verified or not
+			// "user-read-email",
+		},
+		authURL:     spotify.Endpoint.AuthURL,
+		tokenURL:    spotify.Endpoint.TokenURL,
+		userInfoURL: "https://api.spotify.com/v1/me",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Spotify's user api.
+//
+// API reference: https://developer.spotify.com/documentation/web-api/reference/#/operations/get-current-users-profile
+func (p *Spotify) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id     string `json:"id"`
+		Name   string `json:"display_name"`
+		Images []struct {
+			URL string `json:"url"`
+		} `json:"images"`
+		// don't map the email because per the official docs
+		// the email field is "unverified" and there is no proof
+		// that it actually belongs to the user
+		// Email  string `json:"email"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if len(extracted.Images) > 0 {
+		user.AvatarURL = extracted.Images[0].URL
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/strava.go b/server/core_backend-server/tools/auth/strava.go
new file mode 100644
index 0000000..836af0f
--- /dev/null
+++ b/server/core_backend-server/tools/auth/strava.go
@@ -0,0 +1,85 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameStrava] = wrapFactory(NewStravaProvider)
+}
+
+var _ Provider = (*Strava)(nil)
+
+// NameStrava is the unique name of the Strava provider.
+const NameStrava string = "strava"
+
+// Strava allows authentication via Strava OAuth2.
+type Strava struct {
+	BaseProvider
+}
+
+// NewStravaProvider creates new Strava provider instance with some defaults.
+func NewStravaProvider() *Strava {
+	return &Strava{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Strava",
+		pkce:        true,
+		scopes: []string{
+			"profile:read_all",
+		},
+		authURL:     "https://www.strava.com/oauth/authorize",
+		tokenURL:    "https://www.strava.com/api/v3/oauth/token",
+		userInfoURL: "https://www.strava.com/api/v3/athlete",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Strava's user api.
+//
+// API reference: https://developers.strava.com/docs/authentication/
+func (p *Strava) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id              int64  `json:"id"`
+		FirstName       string `json:"firstname"`
+		LastName        string `json:"lastname"`
+		Username        string `json:"username"`
+		ProfileImageURL string `json:"profile"`
+
+		// At the time of writing, Strava OAuth2 doesn't support returning the user email address
+		// Email string `json:"email"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Name:         extracted.FirstName + " " + extracted.LastName,
+		Username:     extracted.Username,
+		AvatarURL:    extracted.ProfileImageURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if extracted.Id != 0 {
+		user.Id = strconv.FormatInt(extracted.Id, 10)
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/trakt.go b/server/core_backend-server/tools/auth/trakt.go
new file mode 100644
index 0000000..b6bfdcd
--- /dev/null
+++ b/server/core_backend-server/tools/auth/trakt.go
@@ -0,0 +1,102 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameTrakt] = wrapFactory(NewTraktProvider)
+}
+
+var _ Provider = (*Trakt)(nil)
+
+// NameTrakt is the unique name of the Trakt provider.
+const NameTrakt string = "trakt"
+
+// Trakt allows authentication via Trakt OAuth2.
+type Trakt struct {
+	BaseProvider
+}
+
+// NewTraktProvider creates new Trakt provider instance with some defaults.
+func NewTraktProvider() *Trakt {
+	return &Trakt{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Trakt",
+		pkce:        true,
+		authURL:     "https://trakt.tv/oauth/authorize",
+		tokenURL:    "https://api.trakt.tv/oauth/token",
+		userInfoURL: "https://api.trakt.tv/users/settings",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on Trakt's user settings API.
+// API reference: https://trakt.docs.apiary.io/#reference/users/settings/retrieve-settings
+func (p *Trakt) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		User struct {
+			Username string `json:"username"`
+			Name     string `json:"name"`
+			Ids      struct {
+				Slug string `json:"slug"`
+				UUID string `json:"uuid"`
+			} `json:"ids"`
+			Images struct {
+				Avatar struct {
+					Full string `json:"full"`
+				} `json:"avatar"`
+			} `json:"images"`
+		} `json:"user"`
+	}{}
+
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.User.Ids.UUID,
+		Username:     extracted.User.Username,
+		Name:         extracted.User.Name,
+		AvatarURL:    extracted.User.Images.Avatar.Full,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo interface method.
+//
+// This differ from BaseProvider because Trakt requires a number of
+// mandatory headers for all requests
+// (https://trakt.docs.apiary.io/#introduction/required-headers).
+func (p *Trakt) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	req, err := http.NewRequestWithContext(p.ctx, "GET", p.userInfoURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Content-type", "application/json")
+	req.Header.Set("trakt-api-key", p.clientId)
+	req.Header.Set("trakt-api-version", "2")
+
+	return p.sendRawUserInfoRequest(req, token)
+}
diff --git a/server/core_backend-server/tools/auth/twitch.go b/server/core_backend-server/tools/auth/twitch.go
new file mode 100644
index 0000000..17db99e
--- /dev/null
+++ b/server/core_backend-server/tools/auth/twitch.go
@@ -0,0 +1,100 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/twitch"
+)
+
+func init() {
+	Providers[NameTwitch] = wrapFactory(NewTwitchProvider)
+}
+
+var _ Provider = (*Twitch)(nil)
+
+// NameTwitch is the unique name of the Twitch provider.
+const NameTwitch string = "twitch"
+
+// Twitch allows authentication via Twitch OAuth2.
+type Twitch struct {
+	BaseProvider
+}
+
+// NewTwitchProvider creates new Twitch provider instance with some defaults.
+func NewTwitchProvider() *Twitch {
+	return &Twitch{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Twitch",
+		pkce:        true,
+		scopes:      []string{"user:read:email"},
+		authURL:     twitch.Endpoint.AuthURL,
+		tokenURL:    twitch.Endpoint.TokenURL,
+		userInfoURL: "https://api.twitch.tv/helix/users",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based the Twitch's user api.
+//
+// API reference: https://dev.twitch.tv/docs/api/reference#get-users
+func (p *Twitch) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data []struct {
+			Id              string `json:"id"`
+			Login           string `json:"login"`
+			DisplayName     string `json:"display_name"`
+			Email           string `json:"email"`
+			ProfileImageURL string `json:"profile_image_url"`
+		} `json:"data"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if len(extracted.Data) == 0 {
+		return nil, errors.New("failed to fetch AuthUser data")
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data[0].Id,
+		Name:         extracted.Data[0].DisplayName,
+		Username:     extracted.Data[0].Login,
+		Email:        extracted.Data[0].Email,
+		AvatarURL:    extracted.Data[0].ProfileImageURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
+
+// FetchRawUserInfo implements Provider.FetchRawUserInfo interface method.
+//
+// This differ from BaseProvider because Twitch requires the Client-Id header.
+func (p *Twitch) FetchRawUserInfo(token *oauth2.Token) ([]byte, error) {
+	req, err := http.NewRequestWithContext(p.ctx, "GET", p.userInfoURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Client-Id", p.clientId)
+
+	return p.sendRawUserInfoRequest(req, token)
+}
diff --git a/server/core_backend-server/tools/auth/twitter.go b/server/core_backend-server/tools/auth/twitter.go
new file mode 100644
index 0000000..9272e5f
--- /dev/null
+++ b/server/core_backend-server/tools/auth/twitter.go
@@ -0,0 +1,86 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameTwitter] = wrapFactory(NewTwitterProvider)
+}
+
+var _ Provider = (*Twitter)(nil)
+
+// NameTwitter is the unique name of the Twitter provider.
+const NameTwitter string = "twitter"
+
+// Twitter allows authentication via Twitter OAuth2.
+type Twitter struct {
+	BaseProvider
+}
+
+// NewTwitterProvider creates new Twitter provider instance with some defaults.
+func NewTwitterProvider() *Twitter {
+	return &Twitter{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "X/Twitter",
+		pkce:        true,
+		scopes: []string{
+			"users.read",
+			"users.email",
+
+			// we don't actually use this scope, but for some reason the `/2/users/me` endpoint fails with 403 without it
+			// (see https://docs.x.com/fundamentals/authentication/guides/v2-authentication-mapping#x-api-v2-authentication-mapping)
+			"tweet.read",
+		},
+		authURL:     "https://x.com/i/oauth2/authorize",
+		tokenURL:    "https://api.x.com/2/oauth2/token",
+		userInfoURL: "https://api.x.com/2/users/me?user.fields=id,name,username,profile_image_url,confirmed_email",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Twitter's user api.
+//
+// API reference: https://docs.x.com/x-api/users/user-lookup-me
+func (p *Twitter) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data struct {
+			Id              string `json:"id"`
+			Name            string `json:"name"`
+			Username        string `json:"username"`
+			Email           string `json:"confirmed_email"`
+			ProfileImageURL string `json:"profile_image_url"`
+		} `json:"data"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data.Id,
+		Name:         extracted.Data.Name,
+		Username:     extracted.Data.Username,
+		Email:        extracted.Data.Email,
+		AvatarURL:    extracted.Data.ProfileImageURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/vk.go b/server/core_backend-server/tools/auth/vk.go
new file mode 100644
index 0000000..acba3f5
--- /dev/null
+++ b/server/core_backend-server/tools/auth/vk.go
@@ -0,0 +1,94 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/vk"
+)
+
+func init() {
+	Providers[NameVK] = wrapFactory(NewVKProvider)
+}
+
+var _ Provider = (*VK)(nil)
+
+// NameVK is the unique name of the VK provider.
+const NameVK string = "vk"
+
+// VK allows authentication via VK OAuth2.
+type VK struct {
+	BaseProvider
+}
+
+// NewVKProvider creates new VK provider instance with some defaults.
+//
+// Docs: https://dev.vk.com/api/oauth-parameters
+func NewVKProvider() *VK {
+	return &VK{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "ВКонтакте",
+		pkce:        false, // VK currently doesn't support PKCE and throws an error if PKCE params are send
+		scopes:      []string{"email"},
+		authURL:     vk.Endpoint.AuthURL,
+		tokenURL:    vk.Endpoint.TokenURL,
+		userInfoURL: "https://api.vk.com/method/users.get?fields=photo_max,screen_name&v=5.131",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on VK's user api.
+//
+// API reference: https://dev.vk.com/method/users.get
+func (p *VK) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Response []struct {
+			Id        int64  `json:"id"`
+			FirstName string `json:"first_name"`
+			LastName  string `json:"last_name"`
+			Username  string `json:"screen_name"`
+			AvatarURL string `json:"photo_max"`
+		} `json:"response"`
+	}{}
+
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	if len(extracted.Response) == 0 {
+		return nil, errors.New("missing response entry")
+	}
+
+	user := &AuthUser{
+		Id:           strconv.FormatInt(extracted.Response[0].Id, 10),
+		Name:         strings.TrimSpace(extracted.Response[0].FirstName + " " + extracted.Response[0].LastName),
+		Username:     extracted.Response[0].Username,
+		AvatarURL:    extracted.Response[0].AvatarURL,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if email := token.Extra("email"); email != nil {
+		user.Email = fmt.Sprint(email)
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/wakatime.go b/server/core_backend-server/tools/auth/wakatime.go
new file mode 100644
index 0000000..a69ead9
--- /dev/null
+++ b/server/core_backend-server/tools/auth/wakatime.go
@@ -0,0 +1,90 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+)
+
+func init() {
+	Providers[NameWakatime] = wrapFactory(NewWakatimeProvider)
+}
+
+var _ Provider = (*Wakatime)(nil)
+
+// NameWakatime is the unique name of the Wakatime provider.
+const NameWakatime = "wakatime"
+
+// Wakatime is an auth provider for Wakatime.
+type Wakatime struct {
+	BaseProvider
+}
+
+// NewWakatimeProvider creates a new Wakatime provider instance with some defaults.
+func NewWakatimeProvider() *Wakatime {
+	return &Wakatime{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "WakaTime",
+		pkce:        true,
+		scopes:      []string{"email"},
+		authURL:     "https://wakatime.com/oauth/authorize",
+		tokenURL:    "https://wakatime.com/oauth/token",
+		userInfoURL: "https://wakatime.com/api/v1/users/current",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on the Wakatime's user API.
+//
+// API reference: https://wakatime.com/developers#users
+func (p *Wakatime) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Data struct {
+			Id               string `json:"id"`
+			DisplayName      string `json:"display_name"`
+			Username         string `json:"username"`
+			Email            string `json:"email"`
+			Photo            string `json:"photo"`
+			IsPhotoPublic    bool   `json:"photo_public"`
+			IsEmailConfirmed bool   `json:"is_email_confirmed"`
+		} `json:"data"`
+	}{}
+
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Data.Id,
+		Name:         extracted.Data.DisplayName,
+		Username:     extracted.Data.Username,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	// note: we don't check for is_email_public field because PocketBase
+	// has its own emailVisibility flag which is false by default
+	if extracted.Data.IsEmailConfirmed {
+		user.Email = extracted.Data.Email
+	}
+
+	if extracted.Data.IsPhotoPublic {
+		user.AvatarURL = extracted.Data.Photo
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/auth/yandex.go b/server/core_backend-server/tools/auth/yandex.go
new file mode 100644
index 0000000..d4af1fa
--- /dev/null
+++ b/server/core_backend-server/tools/auth/yandex.go
@@ -0,0 +1,84 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/yandex"
+)
+
+func init() {
+	Providers[NameYandex] = wrapFactory(NewYandexProvider)
+}
+
+var _ Provider = (*Yandex)(nil)
+
+// NameYandex is the unique name of the Yandex provider.
+const NameYandex string = "yandex"
+
+// Yandex allows authentication via Yandex OAuth2.
+type Yandex struct {
+	BaseProvider
+}
+
+// NewYandexProvider creates new Yandex provider instance with some defaults.
+//
+// Docs: https://yandex.ru/dev/id/doc/en/
+func NewYandexProvider() *Yandex {
+	return &Yandex{BaseProvider{
+		ctx:         context.Background(),
+		displayName: "Yandex",
+		pkce:        true,
+		scopes:      []string{"login:email", "login:avatar", "login:info"},
+		authURL:     yandex.Endpoint.AuthURL,
+		tokenURL:    yandex.Endpoint.TokenURL,
+		userInfoURL: "https://login.yandex.ru/info",
+	}}
+}
+
+// FetchAuthUser returns an AuthUser instance based on Yandex's user api.
+//
+// API reference: https://yandex.ru/dev/id/doc/en/user-information#response-format
+func (p *Yandex) FetchAuthUser(token *oauth2.Token) (*AuthUser, error) {
+	data, err := p.FetchRawUserInfo(token)
+	if err != nil {
+		return nil, err
+	}
+
+	rawUser := map[string]any{}
+	if err := json.Unmarshal(data, &rawUser); err != nil {
+		return nil, err
+	}
+
+	extracted := struct {
+		Id            string `json:"id"`
+		Name          string `json:"real_name"`
+		Username      string `json:"login"`
+		Email         string `json:"default_email"`
+		IsAvatarEmpty bool   `json:"is_avatar_empty"`
+		AvatarId      string `json:"default_avatar_id"`
+	}{}
+	if err := json.Unmarshal(data, &extracted); err != nil {
+		return nil, err
+	}
+
+	user := &AuthUser{
+		Id:           extracted.Id,
+		Name:         extracted.Name,
+		Username:     extracted.Username,
+		Email:        extracted.Email,
+		RawUser:      rawUser,
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+	}
+
+	user.Expiry, _ = types.ParseDateTime(token.Expiry)
+
+	if !extracted.IsAvatarEmpty {
+		user.AvatarURL = "https://avatars.yandex.net/get-yapic/" + extracted.AvatarId + "/islands-200"
+	}
+
+	return user, nil
+}
diff --git a/server/core_backend-server/tools/cron/cron.go b/server/core_backend-server/tools/cron/cron.go
new file mode 100644
index 0000000..66dd07c
--- /dev/null
+++ b/server/core_backend-server/tools/cron/cron.go
@@ -0,0 +1,228 @@
+// Package cron implements a crontab-like service to execute and schedule
+// repeative tasks/jobs.
+//
+// Example:
+//
+//	c := cron.New()
+//	c.MustAdd("dailyReport", "0 0 * * *", func() { ... })
+//	c.Start()
+package cron
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+	"sync"
+	"time"
+)
+
+// Cron is a crontab-like struct for tasks/jobs scheduling.
+type Cron struct {
+	timezone   *time.Location
+	ticker     *time.Ticker
+	startTimer *time.Timer
+	tickerDone chan bool
+	jobs       []*Job
+	interval   time.Duration
+	mux        sync.RWMutex
+}
+
+// New create a new Cron struct with default tick interval of 1 minute
+// and timezone in UTC.
+//
+// You can change the default tick interval with Cron.SetInterval().
+// You can change the default timezone with Cron.SetTimezone().
+func New() *Cron {
+	return &Cron{
+		interval:   1 * time.Minute,
+		timezone:   time.UTC,
+		jobs:       []*Job{},
+		tickerDone: make(chan bool),
+	}
+}
+
+// SetInterval changes the current cron tick interval
+// (it usually should be >= 1 minute).
+func (c *Cron) SetInterval(d time.Duration) {
+	// update interval
+	c.mux.Lock()
+	wasStarted := c.ticker != nil
+	c.interval = d
+	c.mux.Unlock()
+
+	// restart the ticker
+	if wasStarted {
+		c.Start()
+	}
+}
+
+// SetTimezone changes the current cron tick timezone.
+func (c *Cron) SetTimezone(l *time.Location) {
+	c.mux.Lock()
+	defer c.mux.Unlock()
+
+	c.timezone = l
+}
+
+// MustAdd is similar to Add() but panic on failure.
+func (c *Cron) MustAdd(jobId string, cronExpr string, run func()) {
+	if err := c.Add(jobId, cronExpr, run); err != nil {
+		panic(err)
+	}
+}
+
+// Add registers a single cron job.
+//
+// If there is already a job with the provided id, then the old job
+// will be replaced with the new one.
+//
+// cronExpr is a regular cron expression, eg. "0 */3 * * *" (aka. at minute 0 past every 3rd hour).
+// Check cron.NewSchedule() for the supported tokens.
+func (c *Cron) Add(jobId string, cronExpr string, fn func()) error {
+	if fn == nil {
+		return errors.New("failed to add new cron job: fn must be non-nil function")
+	}
+
+	schedule, err := NewSchedule(cronExpr)
+	if err != nil {
+		return fmt.Errorf("failed to add new cron job: %w", err)
+	}
+
+	c.mux.Lock()
+	defer c.mux.Unlock()
+
+	// remove previous (if any)
+	c.jobs = slices.DeleteFunc(c.jobs, func(j *Job) bool {
+		return j.Id() == jobId
+	})
+
+	// add new
+	c.jobs = append(c.jobs, &Job{
+		id:       jobId,
+		fn:       fn,
+		schedule: schedule,
+	})
+
+	return nil
+}
+
+// Remove removes a single cron job by its id.
+func (c *Cron) Remove(jobId string) {
+	c.mux.Lock()
+	defer c.mux.Unlock()
+
+	if c.jobs == nil {
+		return // nothing to remove
+	}
+
+	c.jobs = slices.DeleteFunc(c.jobs, func(j *Job) bool {
+		return j.Id() == jobId
+	})
+}
+
+// RemoveAll removes all registered cron jobs.
+func (c *Cron) RemoveAll() {
+	c.mux.Lock()
+	defer c.mux.Unlock()
+
+	c.jobs = []*Job{}
+}
+
+// Total returns the current total number of registered cron jobs.
+func (c *Cron) Total() int {
+	c.mux.RLock()
+	defer c.mux.RUnlock()
+
+	return len(c.jobs)
+}
+
+// Jobs returns a shallow copy of the currently registered cron jobs.
+func (c *Cron) Jobs() []*Job {
+	c.mux.RLock()
+	defer c.mux.RUnlock()
+
+	copy := make([]*Job, len(c.jobs))
+	for i, j := range c.jobs {
+		copy[i] = j
+	}
+
+	return copy
+}
+
+// Stop stops the current cron ticker (if not already).
+//
+// You can resume the ticker by calling Start().
+func (c *Cron) Stop() {
+	c.mux.Lock()
+	defer c.mux.Unlock()
+
+	if c.startTimer != nil {
+		c.startTimer.Stop()
+		c.startTimer = nil
+	}
+
+	if c.ticker == nil {
+		return // already stopped
+	}
+
+	c.tickerDone <- true
+	c.ticker.Stop()
+	c.ticker = nil
+}
+
+// Start starts the cron ticker.
+//
+// Calling Start() on already started cron will restart the ticker.
+func (c *Cron) Start() {
+	c.Stop()
+
+	// delay the ticker to start at 00 of 1 c.interval duration
+	now := time.Now()
+	next := now.Add(c.interval).Truncate(c.interval)
+	delay := next.Sub(now)
+
+	c.mux.Lock()
+	c.startTimer = time.AfterFunc(delay, func() {
+		c.mux.Lock()
+		c.ticker = time.NewTicker(c.interval)
+		c.mux.Unlock()
+
+		// run immediately at 00
+		c.runDue(time.Now())
+
+		// run after each tick
+		go func() {
+			for {
+				select {
+				case <-c.tickerDone:
+					return
+				case t := <-c.ticker.C:
+					c.runDue(t)
+				}
+			}
+		}()
+	})
+	c.mux.Unlock()
+}
+
+// HasStarted checks whether the current Cron ticker has been started.
+func (c *Cron) HasStarted() bool {
+	c.mux.RLock()
+	defer c.mux.RUnlock()
+
+	return c.ticker != nil
+}
+
+// runDue runs all registered jobs that are scheduled for the provided time.
+func (c *Cron) runDue(t time.Time) {
+	c.mux.RLock()
+	defer c.mux.RUnlock()
+
+	moment := NewMoment(t.In(c.timezone))
+
+	for _, j := range c.jobs {
+		if j.schedule.IsDue(moment) {
+			go j.Run()
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/cron/cron_test.go b/server/core_backend-server/tools/cron/cron_test.go
new file mode 100644
index 0000000..8b18dc1
--- /dev/null
+++ b/server/core_backend-server/tools/cron/cron_test.go
@@ -0,0 +1,305 @@
+package cron
+
+import (
+	"encoding/json"
+	"slices"
+	"testing"
+	"time"
+)
+
+func TestCronNew(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	expectedInterval := 1 * time.Minute
+	if c.interval != expectedInterval {
+		t.Fatalf("Expected default interval %v, got %v", expectedInterval, c.interval)
+	}
+
+	expectedTimezone := time.UTC
+	if c.timezone.String() != expectedTimezone.String() {
+		t.Fatalf("Expected default timezone %v, got %v", expectedTimezone, c.timezone)
+	}
+
+	if len(c.jobs) != 0 {
+		t.Fatalf("Expected no jobs by default, got \n%v", c.jobs)
+	}
+
+	if c.ticker != nil {
+		t.Fatal("Expected the ticker NOT to be initialized")
+	}
+}
+
+func TestCronSetInterval(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	interval := 2 * time.Minute
+
+	c.SetInterval(interval)
+
+	if c.interval != interval {
+		t.Fatalf("Expected interval %v, got %v", interval, c.interval)
+	}
+}
+
+func TestCronSetTimezone(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	timezone, _ := time.LoadLocation("Asia/Tokyo")
+
+	c.SetTimezone(timezone)
+
+	if c.timezone.String() != timezone.String() {
+		t.Fatalf("Expected timezone %v, got %v", timezone, c.timezone)
+	}
+}
+
+func TestCronAddAndRemove(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	if err := c.Add("test0", "* * * * *", nil); err == nil {
+		t.Fatal("Expected nil function error")
+	}
+
+	if err := c.Add("test1", "invalid", func() {}); err == nil {
+		t.Fatal("Expected invalid cron expression error")
+	}
+
+	if err := c.Add("test2", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := c.Add("test3", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := c.Add("test4", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	// overwrite test2
+	if err := c.Add("test2", "1 2 3 4 5", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := c.Add("test5", "1 2 3 4 5", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	// mock job deletion
+	c.Remove("test4")
+
+	// try to remove non-existing (should be no-op)
+	c.Remove("missing")
+
+	indexedJobs := make(map[string]*Job, len(c.jobs))
+	for _, j := range c.jobs {
+		indexedJobs[j.Id()] = j
+	}
+
+	// check job keys
+	{
+		expectedKeys := []string{"test3", "test2", "test5"}
+
+		if v := len(c.jobs); v != len(expectedKeys) {
+			t.Fatalf("Expected %d jobs, got %d", len(expectedKeys), v)
+		}
+
+		for _, k := range expectedKeys {
+			if indexedJobs[k] == nil {
+				t.Fatalf("Expected job with key %s, got nil", k)
+			}
+		}
+	}
+
+	// check the jobs schedule
+	{
+		expectedSchedules := map[string]string{
+			"test2": `{"minutes":{"1":{}},"hours":{"2":{}},"days":{"3":{}},"months":{"4":{}},"daysOfWeek":{"5":{}}}`,
+			"test3": `{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+			"test5": `{"minutes":{"1":{}},"hours":{"2":{}},"days":{"3":{}},"months":{"4":{}},"daysOfWeek":{"5":{}}}`,
+		}
+		for k, v := range expectedSchedules {
+			raw, err := json.Marshal(indexedJobs[k].schedule)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(raw) != v {
+				t.Fatalf("Expected %q schedule \n%s, \ngot \n%s", k, v, raw)
+			}
+		}
+	}
+}
+
+func TestCronMustAdd(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	defer func() {
+		if r := recover(); r == nil {
+			t.Errorf("test1 didn't panic")
+		}
+	}()
+
+	c.MustAdd("test1", "* * * * *", nil)
+
+	c.MustAdd("test2", "* * * * *", func() {})
+
+	if !slices.ContainsFunc(c.jobs, func(j *Job) bool { return j.Id() == "test2" }) {
+		t.Fatal("Couldn't find job test2")
+	}
+}
+
+func TestCronRemoveAll(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	if err := c.Add("test1", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := c.Add("test2", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := c.Add("test3", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	if v := len(c.jobs); v != 3 {
+		t.Fatalf("Expected %d jobs, got %d", 3, v)
+	}
+
+	c.RemoveAll()
+
+	if v := len(c.jobs); v != 0 {
+		t.Fatalf("Expected %d jobs, got %d", 0, v)
+	}
+}
+
+func TestCronTotal(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	if v := c.Total(); v != 0 {
+		t.Fatalf("Expected 0 jobs, got %v", v)
+	}
+
+	if err := c.Add("test1", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := c.Add("test2", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	// overwrite
+	if err := c.Add("test1", "* * * * *", func() {}); err != nil {
+		t.Fatal(err)
+	}
+
+	if v := c.Total(); v != 2 {
+		t.Fatalf("Expected 2 jobs, got %v", v)
+	}
+}
+
+func TestCronJobs(t *testing.T) {
+	t.Parallel()
+
+	c := New()
+
+	calls := ""
+
+	if err := c.Add("a", "1 * * * *", func() { calls += "a" }); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := c.Add("b", "2 * * * *", func() { calls += "b" }); err != nil {
+		t.Fatal(err)
+	}
+
+	// overwrite
+	if err := c.Add("b", "3 * * * *", func() { calls += "b" }); err != nil {
+		t.Fatal(err)
+	}
+
+	jobs := c.Jobs()
+
+	if len(jobs) != 2 {
+		t.Fatalf("Expected 2 jobs, got %v", len(jobs))
+	}
+
+	for _, j := range jobs {
+		j.Run()
+	}
+
+	expectedCalls := "ab"
+	if calls != expectedCalls {
+		t.Fatalf("Expected %q calls, got %q", expectedCalls, calls)
+	}
+}
+
+func TestCronStartStop(t *testing.T) {
+	t.Parallel()
+
+	test1 := 0
+	test2 := 0
+
+	c := New()
+
+	c.SetInterval(250 * time.Millisecond)
+
+	c.Add("test1", "* * * * *", func() {
+		test1++
+	})
+
+	c.Add("test2", "* * * * *", func() {
+		test2++
+	})
+
+	expectedCalls := 2
+
+	// call twice Start to check if the previous ticker will be reseted
+	c.Start()
+	c.Start()
+
+	time.Sleep(505 * time.Millisecond) // slightly larger to minimize flakiness
+
+	// call twice Stop to ensure that the second stop is no-op
+	c.Stop()
+	c.Stop()
+
+	if test1 != expectedCalls {
+		t.Fatalf("Expected %d test1, got %d", expectedCalls, test1)
+	}
+	if test2 != expectedCalls {
+		t.Fatalf("Expected %d test2, got %d", expectedCalls, test2)
+	}
+
+	// resume for 1 seconds
+	c.Start()
+
+	time.Sleep(1005 * time.Millisecond) // slightly larger to minimize flakiness
+
+	c.Stop()
+
+	expectedCalls += 4
+
+	if test1 != expectedCalls {
+		t.Fatalf("Expected %d test1, got %d", expectedCalls, test1)
+	}
+	if test2 != expectedCalls {
+		t.Fatalf("Expected %d test2, got %d", expectedCalls, test2)
+	}
+}
diff --git a/server/core_backend-server/tools/cron/job.go b/server/core_backend-server/tools/cron/job.go
new file mode 100644
index 0000000..8fcabd9
--- /dev/null
+++ b/server/core_backend-server/tools/cron/job.go
@@ -0,0 +1,41 @@
+package cron
+
+import "encoding/json"
+
+// Job defines a single registered cron job.
+type Job struct {
+	fn       func()
+	schedule *Schedule
+	id       string
+}
+
+// Id returns the cron job id.
+func (j *Job) Id() string {
+	return j.id
+}
+
+// Expression returns the plain cron job schedule expression.
+func (j *Job) Expression() string {
+	return j.schedule.rawExpr
+}
+
+// Run runs the cron job function.
+func (j *Job) Run() {
+	if j.fn != nil {
+		j.fn()
+	}
+}
+
+// MarshalJSON implements [json.Marshaler] and export the current
+// jobs data into valid JSON.
+func (j Job) MarshalJSON() ([]byte, error) {
+	plain := struct {
+		Id         string `json:"id"`
+		Expression string `json:"expression"`
+	}{
+		Id:         j.Id(),
+		Expression: j.Expression(),
+	}
+
+	return json.Marshal(plain)
+}
diff --git a/server/core_backend-server/tools/cron/job_test.go b/server/core_backend-server/tools/cron/job_test.go
new file mode 100644
index 0000000..9ce2e8e
--- /dev/null
+++ b/server/core_backend-server/tools/cron/job_test.go
@@ -0,0 +1,71 @@
+package cron
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestJobId(t *testing.T) {
+	expected := "test"
+
+	j := Job{id: expected}
+
+	if j.Id() != expected {
+		t.Fatalf("Expected job with id %q, got %q", expected, j.Id())
+	}
+}
+
+func TestJobExpr(t *testing.T) {
+	expected := "1 2 3 4 5"
+
+	s, err := NewSchedule(expected)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	j := Job{schedule: s}
+
+	if j.Expression() != expected {
+		t.Fatalf("Expected job with cron expression %q, got %q", expected, j.Expression())
+	}
+}
+
+func TestJobRun(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Errorf("Shouldn't panic: %v", r)
+		}
+	}()
+
+	calls := ""
+
+	j1 := Job{}
+	j2 := Job{fn: func() { calls += "2" }}
+
+	j1.Run()
+	j2.Run()
+
+	expected := "2"
+	if calls != expected {
+		t.Fatalf("Expected calls %q, got %q", expected, calls)
+	}
+}
+
+func TestJobMarshalJSON(t *testing.T) {
+	s, err := NewSchedule("1 2 3 4 5")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	j := Job{id: "test_id", schedule: s}
+
+	raw, err := json.Marshal(j)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `{"id":"test_id","expression":"1 2 3 4 5"}`
+	if str := string(raw); str != expected {
+		t.Fatalf("Expected\n%s\ngot\n%s", expected, str)
+	}
+}
diff --git a/server/core_backend-server/tools/cron/schedule.go b/server/core_backend-server/tools/cron/schedule.go
new file mode 100644
index 0000000..d019916
--- /dev/null
+++ b/server/core_backend-server/tools/cron/schedule.go
@@ -0,0 +1,218 @@
+package cron
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Moment represents a parsed single time moment.
+type Moment struct {
+	Minute    int `json:"minute"`
+	Hour      int `json:"hour"`
+	Day       int `json:"day"`
+	Month     int `json:"month"`
+	DayOfWeek int `json:"dayOfWeek"`
+}
+
+// NewMoment creates a new Moment from the specified time.
+func NewMoment(t time.Time) *Moment {
+	return &Moment{
+		Minute:    t.Minute(),
+		Hour:      t.Hour(),
+		Day:       t.Day(),
+		Month:     int(t.Month()),
+		DayOfWeek: int(t.Weekday()),
+	}
+}
+
+// Schedule stores parsed information for each time component when a cron job should run.
+type Schedule struct {
+	Minutes    map[int]struct{} `json:"minutes"`
+	Hours      map[int]struct{} `json:"hours"`
+	Days       map[int]struct{} `json:"days"`
+	Months     map[int]struct{} `json:"months"`
+	DaysOfWeek map[int]struct{} `json:"daysOfWeek"`
+
+	rawExpr string
+}
+
+// IsDue checks whether the provided Moment satisfies the current Schedule.
+func (s *Schedule) IsDue(m *Moment) bool {
+	if _, ok := s.Minutes[m.Minute]; !ok {
+		return false
+	}
+
+	if _, ok := s.Hours[m.Hour]; !ok {
+		return false
+	}
+
+	if _, ok := s.Days[m.Day]; !ok {
+		return false
+	}
+
+	if _, ok := s.DaysOfWeek[m.DayOfWeek]; !ok {
+		return false
+	}
+
+	if _, ok := s.Months[m.Month]; !ok {
+		return false
+	}
+
+	return true
+}
+
+var macros = map[string]string{
+	"@yearly":   "0 0 1 1 *",
+	"@annually": "0 0 1 1 *",
+	"@monthly":  "0 0 1 * *",
+	"@weekly":   "0 0 * * 0",
+	"@daily":    "0 0 * * *",
+	"@midnight": "0 0 * * *",
+	"@hourly":   "0 * * * *",
+}
+
+// NewSchedule creates a new Schedule from a cron expression.
+//
+// A cron expression could be a macro OR 5 segments separated by space,
+// representing: minute, hour, day of the month, month and day of the week.
+//
+// The following segment formats are supported:
+//   - wildcard: *
+//   - range:    1-30
+//   - step:     */n or 1-30/n
+//   - list:     1,2,3,10-20/n
+//
+// The following macros are supported:
+//   - @yearly (or @annually)
+//   - @monthly
+//   - @weekly
+//   - @daily (or @midnight)
+//   - @hourly
+func NewSchedule(cronExpr string) (*Schedule, error) {
+	if v, ok := macros[cronExpr]; ok {
+		cronExpr = v
+	}
+
+	segments := strings.Split(cronExpr, " ")
+	if len(segments) != 5 {
+		return nil, errors.New("invalid cron expression - must be a valid macro or to have exactly 5 space separated segments")
+	}
+
+	minutes, err := parseCronSegment(segments[0], 0, 59)
+	if err != nil {
+		return nil, err
+	}
+
+	hours, err := parseCronSegment(segments[1], 0, 23)
+	if err != nil {
+		return nil, err
+	}
+
+	days, err := parseCronSegment(segments[2], 1, 31)
+	if err != nil {
+		return nil, err
+	}
+
+	months, err := parseCronSegment(segments[3], 1, 12)
+	if err != nil {
+		return nil, err
+	}
+
+	daysOfWeek, err := parseCronSegment(segments[4], 0, 6)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Schedule{
+		Minutes:    minutes,
+		Hours:      hours,
+		Days:       days,
+		Months:     months,
+		DaysOfWeek: daysOfWeek,
+		rawExpr:    cronExpr,
+	}, nil
+}
+
+// parseCronSegment parses a single cron expression segment and
+// returns its time schedule slots.
+func parseCronSegment(segment string, min int, max int) (map[int]struct{}, error) {
+	slots := map[int]struct{}{}
+
+	list := strings.Split(segment, ",")
+	for _, p := range list {
+		stepParts := strings.Split(p, "/")
+
+		// step (*/n, 1-30/n)
+		var step int
+		switch len(stepParts) {
+		case 1:
+			step = 1
+		case 2:
+			parsedStep, err := strconv.Atoi(stepParts[1])
+			if err != nil {
+				return nil, err
+			}
+			if parsedStep < 1 || parsedStep > max {
+				return nil, fmt.Errorf("invalid segment step boundary - the step must be between 1 and the %d", max)
+			}
+			step = parsedStep
+		default:
+			return nil, errors.New("invalid segment step format - must be in the format */n or 1-30/n")
+		}
+
+		// find the min and max range of the segment part
+		var rangeMin, rangeMax int
+		if stepParts[0] == "*" {
+			rangeMin = min
+			rangeMax = max
+		} else {
+			// single digit (1) or range (1-30)
+			rangeParts := strings.Split(stepParts[0], "-")
+			switch len(rangeParts) {
+			case 1:
+				if step != 1 {
+					return nil, errors.New("invalid segement step - step > 1 could be used only with the wildcard or range format")
+				}
+				parsed, err := strconv.Atoi(rangeParts[0])
+				if err != nil {
+					return nil, err
+				}
+				if parsed < min || parsed > max {
+					return nil, errors.New("invalid segment value - must be between the min and max of the segment")
+				}
+				rangeMin = parsed
+				rangeMax = rangeMin
+			case 2:
+				parsedMin, err := strconv.Atoi(rangeParts[0])
+				if err != nil {
+					return nil, err
+				}
+				if parsedMin < min || parsedMin > max {
+					return nil, fmt.Errorf("invalid segment range minimum - must be between %d and %d", min, max)
+				}
+				rangeMin = parsedMin
+
+				parsedMax, err := strconv.Atoi(rangeParts[1])
+				if err != nil {
+					return nil, err
+				}
+				if parsedMax < parsedMin || parsedMax > max {
+					return nil, fmt.Errorf("invalid segment range maximum - must be between %d and %d", rangeMin, max)
+				}
+				rangeMax = parsedMax
+			default:
+				return nil, errors.New("invalid segment range format - the range must have 1 or 2 parts")
+			}
+		}
+
+		// fill the slots
+		for i := rangeMin; i <= rangeMax; i += step {
+			slots[i] = struct{}{}
+		}
+	}
+
+	return slots, nil
+}
diff --git a/server/core_backend-server/tools/cron/schedule_test.go b/server/core_backend-server/tools/cron/schedule_test.go
new file mode 100644
index 0000000..edc38e1
--- /dev/null
+++ b/server/core_backend-server/tools/cron/schedule_test.go
@@ -0,0 +1,409 @@
+package cron_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/cron"
+)
+
+func TestNewMoment(t *testing.T) {
+	t.Parallel()
+
+	date, err := time.Parse("2006-01-02 15:04", "2023-05-09 15:20")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	m := cron.NewMoment(date)
+
+	if m.Minute != 20 {
+		t.Fatalf("Expected m.Minute %d, got %d", 20, m.Minute)
+	}
+
+	if m.Hour != 15 {
+		t.Fatalf("Expected m.Hour %d, got %d", 15, m.Hour)
+	}
+
+	if m.Day != 9 {
+		t.Fatalf("Expected m.Day %d, got %d", 9, m.Day)
+	}
+
+	if m.Month != 5 {
+		t.Fatalf("Expected m.Month %d, got %d", 5, m.Month)
+	}
+
+	if m.DayOfWeek != 2 {
+		t.Fatalf("Expected m.DayOfWeek %d, got %d", 2, m.DayOfWeek)
+	}
+}
+
+func TestNewSchedule(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		cronExpr       string
+		expectError    bool
+		expectSchedule string
+	}{
+		{
+			"invalid",
+			true,
+			"",
+		},
+		{
+			"* * * *",
+			true,
+			"",
+		},
+		{
+			"* * * * * *",
+			true,
+			"",
+		},
+		{
+			"2/3 * * * *",
+			true,
+			"",
+		},
+		{
+			"* * * * *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"*/2 */3 */5 */4 */2",
+			false,
+			`{"minutes":{"0":{},"10":{},"12":{},"14":{},"16":{},"18":{},"2":{},"20":{},"22":{},"24":{},"26":{},"28":{},"30":{},"32":{},"34":{},"36":{},"38":{},"4":{},"40":{},"42":{},"44":{},"46":{},"48":{},"50":{},"52":{},"54":{},"56":{},"58":{},"6":{},"8":{}},"hours":{"0":{},"12":{},"15":{},"18":{},"21":{},"3":{},"6":{},"9":{}},"days":{"1":{},"11":{},"16":{},"21":{},"26":{},"31":{},"6":{}},"months":{"1":{},"5":{},"9":{}},"daysOfWeek":{"0":{},"2":{},"4":{},"6":{}}}`,
+		},
+
+		// minute segment
+		{
+			"-1 * * * *",
+			true,
+			"",
+		},
+		{
+			"60 * * * *",
+			true,
+			"",
+		},
+		{
+			"0 * * * *",
+			false,
+			`{"minutes":{"0":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"59 * * * *",
+			false,
+			`{"minutes":{"59":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"1,2,5,7,40-50/2 * * * *",
+			false,
+			`{"minutes":{"1":{},"2":{},"40":{},"42":{},"44":{},"46":{},"48":{},"5":{},"50":{},"7":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+
+		// hour segment
+		{
+			"* -1 * * *",
+			true,
+			"",
+		},
+		{
+			"* 24 * * *",
+			true,
+			"",
+		},
+		{
+			"* 0 * * *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"* 23 * * *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"23":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"* 3,4,8-16/3,7 * * *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"11":{},"14":{},"3":{},"4":{},"7":{},"8":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+
+		// day segment
+		{
+			"* * 0 * *",
+			true,
+			"",
+		},
+		{
+			"* * 32 * *",
+			true,
+			"",
+		},
+		{
+			"* * 1 * *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"* * 31 * *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"31":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"* * 5,6,20-30/3,1 * *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"20":{},"23":{},"26":{},"29":{},"5":{},"6":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+
+		// month segment
+		{
+			"* * * 0 *",
+			true,
+			"",
+		},
+		{
+			"* * * 13 *",
+			true,
+			"",
+		},
+		{
+			"* * * 1 *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"* * * 12 *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"12":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"* * * 1,4,5-10/2 *",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"4":{},"5":{},"7":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+
+		// day of week segment
+		{
+			"* * * * -1",
+			true,
+			"",
+		},
+		{
+			"* * * * 7",
+			true,
+			"",
+		},
+		{
+			"* * * * 0",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{}}}`,
+		},
+		{
+			"* * * * 6",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"6":{}}}`,
+		},
+		{
+			"* * * * 1,2-5/2",
+			false,
+			`{"minutes":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"32":{},"33":{},"34":{},"35":{},"36":{},"37":{},"38":{},"39":{},"4":{},"40":{},"41":{},"42":{},"43":{},"44":{},"45":{},"46":{},"47":{},"48":{},"49":{},"5":{},"50":{},"51":{},"52":{},"53":{},"54":{},"55":{},"56":{},"57":{},"58":{},"59":{},"6":{},"7":{},"8":{},"9":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"1":{},"2":{},"4":{}}}`,
+		},
+
+		// macros
+		{
+			"@yearly",
+			false,
+			`{"minutes":{"0":{}},"hours":{"0":{}},"days":{"1":{}},"months":{"1":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"@annually",
+			false,
+			`{"minutes":{"0":{}},"hours":{"0":{}},"days":{"1":{}},"months":{"1":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"@monthly",
+			false,
+			`{"minutes":{"0":{}},"hours":{"0":{}},"days":{"1":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"@weekly",
+			false,
+			`{"minutes":{"0":{}},"hours":{"0":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{}}}`,
+		},
+		{
+			"@daily",
+			false,
+			`{"minutes":{"0":{}},"hours":{"0":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"@midnight",
+			false,
+			`{"minutes":{"0":{}},"hours":{"0":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+		{
+			"@hourly",
+			false,
+			`{"minutes":{"0":{}},"hours":{"0":{},"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"days":{"1":{},"10":{},"11":{},"12":{},"13":{},"14":{},"15":{},"16":{},"17":{},"18":{},"19":{},"2":{},"20":{},"21":{},"22":{},"23":{},"24":{},"25":{},"26":{},"27":{},"28":{},"29":{},"3":{},"30":{},"31":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"months":{"1":{},"10":{},"11":{},"12":{},"2":{},"3":{},"4":{},"5":{},"6":{},"7":{},"8":{},"9":{}},"daysOfWeek":{"0":{},"1":{},"2":{},"3":{},"4":{},"5":{},"6":{}}}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.cronExpr, func(t *testing.T) {
+			schedule, err := cron.NewSchedule(s.cronExpr)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			encoded, err := json.Marshal(schedule)
+			if err != nil {
+				t.Fatalf("Failed to marshalize the result schedule: %v", err)
+			}
+			encodedStr := string(encoded)
+
+			if encodedStr != s.expectSchedule {
+				t.Fatalf("Expected \n%s, \ngot \n%s", s.expectSchedule, encodedStr)
+			}
+		})
+	}
+}
+
+func TestScheduleIsDue(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		cronExpr string
+		moment   *cron.Moment
+		expected bool
+	}{
+		{
+			"* * * * *",
+			&cron.Moment{},
+			false,
+		},
+		{
+			"* * * * *",
+			&cron.Moment{
+				Minute:    1,
+				Hour:      1,
+				Day:       1,
+				Month:     1,
+				DayOfWeek: 1,
+			},
+			true,
+		},
+		{
+			"5 * * * *",
+			&cron.Moment{
+				Minute:    1,
+				Hour:      1,
+				Day:       1,
+				Month:     1,
+				DayOfWeek: 1,
+			},
+			false,
+		},
+		{
+			"5 * * * *",
+			&cron.Moment{
+				Minute:    5,
+				Hour:      1,
+				Day:       1,
+				Month:     1,
+				DayOfWeek: 1,
+			},
+			true,
+		},
+		{
+			"* 2-6 * * 2,3",
+			&cron.Moment{
+				Minute:    1,
+				Hour:      2,
+				Day:       1,
+				Month:     1,
+				DayOfWeek: 1,
+			},
+			false,
+		},
+		{
+			"* 2-6 * * 2,3",
+			&cron.Moment{
+				Minute:    1,
+				Hour:      2,
+				Day:       1,
+				Month:     1,
+				DayOfWeek: 3,
+			},
+			true,
+		},
+		{
+			"* * 1,2,5,15-18 * *",
+			&cron.Moment{
+				Minute:    1,
+				Hour:      1,
+				Day:       6,
+				Month:     1,
+				DayOfWeek: 1,
+			},
+			false,
+		},
+		{
+			"* * 1,2,5,15-18/2 * *",
+			&cron.Moment{
+				Minute:    1,
+				Hour:      1,
+				Day:       2,
+				Month:     1,
+				DayOfWeek: 1,
+			},
+			true,
+		},
+		{
+			"* * 1,2,5,15-18/2 * *",
+			&cron.Moment{
+				Minute:    1,
+				Hour:      1,
+				Day:       18,
+				Month:     1,
+				DayOfWeek: 1,
+			},
+			false,
+		},
+		{
+			"* * 1,2,5,15-18/2 * *",
+			&cron.Moment{
+				Minute:    1,
+				Hour:      1,
+				Day:       17,
+				Month:     1,
+				DayOfWeek: 1,
+			},
+			true,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d-%s", i, s.cronExpr), func(t *testing.T) {
+			schedule, err := cron.NewSchedule(s.cronExpr)
+			if err != nil {
+				t.Fatalf("Unexpected cron error: %v", err)
+			}
+
+			result := schedule.IsDue(s.moment)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/dbutils/index.go b/server/core_backend-server/tools/dbutils/index.go
new file mode 100644
index 0000000..b437758
--- /dev/null
+++ b/server/core_backend-server/tools/dbutils/index.go
@@ -0,0 +1,225 @@
+package dbutils
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/tokenizer"
+)
+
+var (
+	indexRegex       = regexp.MustCompile(`(?im)create\s+(unique\s+)?\s*index\s*(if\s+not\s+exists\s+)?(\S*)\s+on\s+(\S*)\s*\(([\s\S]*)\)(?:\s*where\s+([\s\S]*))?`)
+	indexColumnRegex = regexp.MustCompile(`(?im)^([\s\S]+?)(?:\s+collate\s+([\w]+))?(?:\s+(asc|desc))?$`)
+)
+
+// IndexColumn represents a single parsed SQL index column.
+type IndexColumn struct {
+	Name    string `json:"name"` // identifier or expression
+	Collate string `json:"collate"`
+	Sort    string `json:"sort"`
+}
+
+// Index represents a single parsed SQL CREATE INDEX expression.
+type Index struct {
+	SchemaName string        `json:"schemaName"`
+	IndexName  string        `json:"indexName"`
+	TableName  string        `json:"tableName"`
+	Where      string        `json:"where"`
+	Columns    []IndexColumn `json:"columns"`
+	Unique     bool          `json:"unique"`
+	Optional   bool          `json:"optional"`
+}
+
+// IsValid checks if the current Index contains the minimum required fields to be considered valid.
+func (idx Index) IsValid() bool {
+	return idx.IndexName != "" && idx.TableName != "" && len(idx.Columns) > 0
+}
+
+// Build returns a "CREATE INDEX" SQL string from the current index parts.
+//
+// Returns empty string if idx.IsValid() is false.
+func (idx Index) Build() string {
+	if !idx.IsValid() {
+		return ""
+	}
+
+	var str strings.Builder
+
+	str.WriteString("CREATE ")
+
+	if idx.Unique {
+		str.WriteString("UNIQUE ")
+	}
+
+	str.WriteString("INDEX ")
+
+	if idx.Optional {
+		str.WriteString("IF NOT EXISTS ")
+	}
+
+	if idx.SchemaName != "" {
+		// str.WriteString("`"), // SQLite
+		str.WriteString(`"`) // PostgreSQL
+		str.WriteString(idx.SchemaName)
+		// str.WriteString("`.") // SQLite
+		str.WriteString(`".`) // PostgreSQL
+	}
+
+	// str.WriteString("`") // SQLite
+	str.WriteString(`"`) // PostgreSQL
+	str.WriteString(idx.IndexName)
+	// str.WriteString("` ") // SQLite
+	str.WriteString(`" `) // PostgreSQL
+
+	// str.WriteString("ON `") // SQLite
+	str.WriteString(`ON "`) // PostgreSQL
+	str.WriteString(idx.TableName)
+	// str.WriteString("` (") // SQLite
+	str.WriteString(`" (`) // PostgreSQL
+
+	if len(idx.Columns) > 1 {
+		str.WriteString("\n  ")
+	}
+
+	var hasCol bool
+	for _, col := range idx.Columns {
+		trimmedColName := strings.TrimSpace(col.Name)
+		if trimmedColName == "" {
+			continue
+		}
+
+		if hasCol {
+			str.WriteString(",\n  ")
+		}
+
+		if strings.Contains(col.Name, "(") || strings.Contains(col.Name, " ") {
+			// most likely an expression
+			str.WriteString(trimmedColName)
+		} else {
+			// regular identifier
+			// str.WriteString("`") // SQLite
+			str.WriteString(`"`) // PostgreSQL
+			str.WriteString(trimmedColName)
+			// str.WriteString("`") // SQLite
+			str.WriteString(`"`) // PostgreSQL
+		}
+
+		if col.Collate != "" {
+			str.WriteString(" COLLATE ")
+			str.WriteString(col.Collate)
+		}
+
+		if col.Sort != "" {
+			str.WriteString(" ")
+			str.WriteString(strings.ToUpper(col.Sort))
+		}
+
+		hasCol = true
+	}
+
+	if hasCol && len(idx.Columns) > 1 {
+		str.WriteString("\n")
+	}
+
+	str.WriteString(")")
+
+	if idx.Where != "" {
+		str.WriteString(" WHERE ")
+		str.WriteString(idx.Where)
+	}
+
+	return str.String()
+}
+
+// ParseIndex parses the provided "CREATE INDEX" SQL string into Index struct.
+func ParseIndex(createIndexExpr string) Index {
+	result := Index{}
+
+	matches := indexRegex.FindStringSubmatch(createIndexExpr)
+	if len(matches) != 7 {
+		return result
+	}
+
+	trimChars := "`\"'[]\r\n\t\f\v "
+
+	// Unique
+	// ---
+	result.Unique = strings.TrimSpace(matches[1]) != ""
+
+	// Optional (aka. "IF NOT EXISTS")
+	// ---
+	result.Optional = strings.TrimSpace(matches[2]) != ""
+
+	// SchemaName and IndexName
+	// ---
+	nameTk := tokenizer.NewFromString(matches[3])
+	nameTk.Separators('.')
+
+	nameParts, _ := nameTk.ScanAll()
+	if len(nameParts) == 2 {
+		result.SchemaName = strings.Trim(nameParts[0], trimChars)
+		result.IndexName = strings.Trim(nameParts[1], trimChars)
+	} else {
+		result.IndexName = strings.Trim(nameParts[0], trimChars)
+	}
+
+	// TableName
+	// ---
+	result.TableName = strings.Trim(matches[4], trimChars)
+
+	// Columns
+	// ---
+	columnsTk := tokenizer.NewFromString(matches[5])
+	columnsTk.Separators(',')
+
+	rawColumns, _ := columnsTk.ScanAll()
+
+	result.Columns = make([]IndexColumn, 0, len(rawColumns))
+
+	for _, col := range rawColumns {
+		colMatches := indexColumnRegex.FindStringSubmatch(col)
+		if len(colMatches) != 4 {
+			continue
+		}
+
+		trimmedName := strings.Trim(colMatches[1], trimChars)
+		if trimmedName == "" {
+			continue
+		}
+
+		result.Columns = append(result.Columns, IndexColumn{
+			Name:    trimmedName,
+			Collate: strings.TrimSpace(colMatches[2]),
+			Sort:    strings.ToUpper(colMatches[3]),
+		})
+	}
+
+	// WHERE expression
+	// ---
+	result.Where = strings.TrimSpace(matches[6])
+
+	return result
+}
+
+// FindSingleColumnUniqueIndex returns the first matching single column unique index.
+func FindSingleColumnUniqueIndex(indexes []string, column string) (Index, bool) {
+	var index Index
+
+	for _, idx := range indexes {
+		index := ParseIndex(idx)
+		if index.Unique && len(index.Columns) == 1 && strings.EqualFold(index.Columns[0].Name, column) {
+			return index, true
+		}
+	}
+
+	return index, false
+}
+
+// Deprecated: Use `_, ok := FindSingleColumnUniqueIndex(indexes, column)` instead.
+//
+// HasColumnUniqueIndex loosely checks whether the specified column has
+// a single column unique index (WHERE statements are ignored).
+func HasSingleColumnUniqueIndex(column string, indexes []string) bool {
+	_, ok := FindSingleColumnUniqueIndex(indexes, column)
+	return ok
+}
diff --git a/server/core_backend-server/tools/dbutils/index_test.go b/server/core_backend-server/tools/dbutils/index_test.go
new file mode 100644
index 0000000..ab7fe8a
--- /dev/null
+++ b/server/core_backend-server/tools/dbutils/index_test.go
@@ -0,0 +1,413 @@
+package dbutils_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+)
+
+func TestParseIndex(t *testing.T) {
+	scenarios := []struct {
+		index    string
+		expected dbutils.Index
+	}{
+		// invalid
+		{
+			`invalid`,
+			dbutils.Index{},
+		},
+		// simple (multiple spaces between the table and columns list)
+		{
+			`create index indexname on tablename   (col1)`,
+			dbutils.Index{
+				IndexName: "indexname",
+				TableName: "tablename",
+				Columns: []dbutils.IndexColumn{
+					{Name: "col1"},
+				},
+			},
+		},
+		// simple (no space between the table and the columns list)
+		{
+			`create index indexname on tablename(col1)`,
+			dbutils.Index{
+				IndexName: "indexname",
+				TableName: "tablename",
+				Columns: []dbutils.IndexColumn{
+					{Name: "col1"},
+				},
+			},
+		},
+		// all fields
+		{
+			`CREATE UNIQUE INDEX IF NOT EXISTS "schemaname".[indexname] on 'tablename' (
+				col0,
+				` + "`" + `col1` + "`" + `,
+				json_extract("col2", "$.a") asc,
+				"col3" collate NOCASE,
+				"col4" collate RTRIM desc
+			) where test = 1`,
+			dbutils.Index{
+				Unique:     true,
+				Optional:   true,
+				SchemaName: "schemaname",
+				IndexName:  "indexname",
+				TableName:  "tablename",
+				Columns: []dbutils.IndexColumn{
+					{Name: "col0"},
+					{Name: "col1"},
+					{Name: `json_extract("col2", "$.a")`, Sort: "ASC"},
+					{Name: `col3`, Collate: "NOCASE"},
+					{Name: `col4`, Collate: "RTRIM", Sort: "DESC"},
+				},
+				Where: "test = 1",
+			},
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("scenario_%d", i), func(t *testing.T) {
+			result := dbutils.ParseIndex(s.index)
+
+			resultRaw, err := json.Marshal(result)
+			if err != nil {
+				t.Fatalf("Faild to marshalize parse result: %v", err)
+			}
+
+			expectedRaw, err := json.Marshal(s.expected)
+			if err != nil {
+				t.Fatalf("Failed to marshalize expected index: %v", err)
+			}
+
+			if !bytes.Equal(resultRaw, expectedRaw) {
+				t.Errorf("Expected \n%s \ngot \n%s", expectedRaw, resultRaw)
+			}
+		})
+	}
+}
+
+func TestIndexIsValid(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		index    dbutils.Index
+		expected bool
+	}{
+		{
+			"empty",
+			dbutils.Index{},
+			false,
+		},
+		{
+			"no index name",
+			dbutils.Index{
+				TableName: "table",
+				Columns:   []dbutils.IndexColumn{{Name: "col"}},
+			},
+			false,
+		},
+		{
+			"no table name",
+			dbutils.Index{
+				IndexName: "index",
+				Columns:   []dbutils.IndexColumn{{Name: "col"}},
+			},
+			false,
+		},
+		{
+			"no columns",
+			dbutils.Index{
+				IndexName: "index",
+				TableName: "table",
+			},
+			false,
+		},
+		{
+			"min valid",
+			dbutils.Index{
+				IndexName: "index",
+				TableName: "table",
+				Columns:   []dbutils.IndexColumn{{Name: "col"}},
+			},
+			true,
+		},
+		{
+			"all fields",
+			dbutils.Index{
+				Optional:   true,
+				Unique:     true,
+				SchemaName: "schema",
+				IndexName:  "index",
+				TableName:  "table",
+				Columns:    []dbutils.IndexColumn{{Name: "col"}},
+				Where:      "test = 1 OR test = 2",
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.index.IsValid()
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestIndexBuild(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		index    dbutils.Index
+		expected string
+	}{
+		{
+			"empty",
+			dbutils.Index{},
+			"",
+		},
+		{
+			"no index name",
+			dbutils.Index{
+				TableName: "table",
+				Columns:   []dbutils.IndexColumn{{Name: "col"}},
+			},
+			"",
+		},
+		{
+			"no table name",
+			dbutils.Index{
+				IndexName: "index",
+				Columns:   []dbutils.IndexColumn{{Name: "col"}},
+			},
+			"",
+		},
+		{
+			"no columns",
+			dbutils.Index{
+				IndexName: "index",
+				TableName: "table",
+			},
+			"",
+		},
+		{
+			"min valid",
+			dbutils.Index{
+				IndexName: "index",
+				TableName: "table",
+				Columns:   []dbutils.IndexColumn{{Name: "col"}},
+			},
+			/* SQLite:
+			"CREATE INDEX `index` ON `table` (`col`)",
+			*/
+			// PostgreSQL:
+			`CREATE INDEX "index" ON "table" ("col")`,
+		},
+		{
+			"all fields",
+			dbutils.Index{
+				Optional:   true,
+				Unique:     true,
+				SchemaName: "schema",
+				IndexName:  "index",
+				TableName:  "table",
+				Columns: []dbutils.IndexColumn{
+					{Name: "col1", Collate: "NOCASE", Sort: "asc"},
+					{Name: "col2", Sort: "desc"},
+					{Name: `json_extract("col3", "$.a")`, Collate: "NOCASE"},
+				},
+				Where: "test = 1 OR test = 2",
+			},
+			/* SQLite:
+			"CREATE UNIQUE INDEX IF NOT EXISTS `schema`.`index` ON `table` (\n  `col1` COLLATE NOCASE ASC,\n  `col2` DESC,\n  " + `json_extract("col3", "$.a")` + " COLLATE NOCASE\n) WHERE test = 1 OR test = 2",
+			*/
+			// PostgreSQL:
+			strings.ReplaceAll(`CREATE UNIQUE INDEX IF NOT EXISTS "schema"."index" ON "table" (\n  "col1" COLLATE NOCASE ASC,\n  "col2" DESC,\n  `+`json_extract("col3", "$.a")`+` COLLATE NOCASE\n) WHERE test = 1 OR test = 2`, `\n`, "\n"),
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.index.Build()
+			if result != s.expected {
+				t.Fatalf("Expected \n%v \ngot \n%v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestHasSingleColumnUniqueIndex(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		column   string
+		indexes  []string
+		expected bool
+	}{
+		{
+			"empty indexes",
+			"test",
+			nil,
+			false,
+		},
+		{
+			"empty column",
+			"",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`)",
+			},
+			false,
+		},
+		{
+			"mismatched column",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test2`)",
+			},
+			false,
+		},
+		{
+			"non unique index",
+			"test",
+			[]string{
+				"CREATE INDEX `index1` ON `example` (`test`)",
+			},
+			false,
+		},
+		{
+			"matching columnd and unique index",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`)",
+			},
+			true,
+		},
+		{
+			"multiple columns",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`, `test2`)",
+			},
+			false,
+		},
+		{
+			"multiple indexes",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`, `test2`)",
+				"CREATE UNIQUE INDEX `index2` ON `example` (`test`)",
+			},
+			true,
+		},
+		{
+			"partial unique index",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index` ON `example` (`test`) where test != ''",
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := dbutils.HasSingleColumnUniqueIndex(s.column, s.indexes)
+			if result != s.expected {
+				t.Fatalf("Expected %v got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestFindSingleColumnUniqueIndex(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		column   string
+		indexes  []string
+		expected bool
+	}{
+		{
+			"empty indexes",
+			"test",
+			nil,
+			false,
+		},
+		{
+			"empty column",
+			"",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`)",
+			},
+			false,
+		},
+		{
+			"mismatched column",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test2`)",
+			},
+			false,
+		},
+		{
+			"non unique index",
+			"test",
+			[]string{
+				"CREATE INDEX `index1` ON `example` (`test`)",
+			},
+			false,
+		},
+		{
+			"matching columnd and unique index",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`)",
+			},
+			true,
+		},
+		{
+			"multiple columns",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`, `test2`)",
+			},
+			false,
+		},
+		{
+			"multiple indexes",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index1` ON `example` (`test`, `test2`)",
+				"CREATE UNIQUE INDEX `index2` ON `example` (`test`)",
+			},
+			true,
+		},
+		{
+			"partial unique index",
+			"test",
+			[]string{
+				"CREATE UNIQUE INDEX `index` ON `example` (`test`) where test != ''",
+			},
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			index, exists := dbutils.FindSingleColumnUniqueIndex(s.indexes, s.column)
+			if exists != s.expected {
+				t.Fatalf("Expected exists %v got %v", s.expected, exists)
+			}
+
+			if !exists && len(index.Columns) > 0 {
+				t.Fatal("Expected index.Columns to be empty")
+			}
+
+			if exists && !strings.EqualFold(index.Columns[0].Name, s.column) {
+				t.Fatalf("Expected to find column %q in %v", s.column, index)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/dbutils/json.go b/server/core_backend-server/tools/dbutils/json.go
new file mode 100644
index 0000000..8d7091b
--- /dev/null
+++ b/server/core_backend-server/tools/dbutils/json.go
@@ -0,0 +1,158 @@
+package dbutils
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+)
+
+// TODO: replace json with `jsonb` everywhere in the codebase
+// TODO: Use PostgreSQL's native JSON functions instead of manually simulate JSON functions like SQLite.
+
+// JSONEach returns JSON_EACH SQLite string expression with
+// some normalizations for non-json columns.
+func JSONEach(column string) string {
+	dbType := os.Getenv("DB_TYPE")
+	if dbType == "postgres" {
+		// PostgreSQL:
+		return fmt.Sprintf(
+			`jsonb_array_elements_text(CASE WHEN ([[%s]] IS JSON OR json_valid([[%s]]::text)) AND jsonb_typeof([[%s]]::jsonb) = 'array' THEN [[%s]]::jsonb ELSE jsonb_build_array([[%s]]) END)`,
+			column, column, column, column, column,
+		)
+	}
+
+	if dbType == "mysql" {
+		// MySQL:
+		return fmt.Sprintf(
+			`JSON_TABLE(CASE WHEN JSON_VALID([[%s]]) AND JSON_TYPE([[%s]])='ARRAY' THEN [[%s]] ELSE JSON_ARRAY([[%s]]) END, "$[*]" COLUMNS (value JSON PATH "$"))`,
+			column, column, column, column,
+		)
+	}
+
+	// SQLite (default):
+	return fmt.Sprintf(
+		`json_each(CASE WHEN iif(json_valid([[%s]]), json_type([[%s]])='array', FALSE) THEN [[%s]] ELSE json_array([[%s]]) END)`,
+		column, column, column, column,
+	)
+}
+
+// JSONEachByPlaceholder expands a given user input json array to multiple rows.
+// Use [JSONEach] if you want to expand a column value instead.
+// The [placeholder] is the parameter placeholder in SQL prepared statements.
+// We assume the parameter value is a marshalled JSON array.
+func JSONEachByPlaceholder(placeholder string) string {
+	dbType := os.Getenv("DB_TYPE")
+	if dbType == "postgres" {
+		// PostgreSQL:
+		return fmt.Sprintf(`jsonb_array_elements({:%s}::jsonb)`, placeholder)
+	}
+
+	if dbType == "mysql" {
+		// MySQL:
+		return fmt.Sprintf(`JSON_TABLE({:%s}, "$[*]" COLUMNS (value JSON PATH "$"))`, placeholder)
+	}
+
+	// SQLite (default):
+	return fmt.Sprintf("json_each({:%s})", placeholder)
+}
+
+// JsonArrayExistsStr is used to determine whether a JSON string array contains a string element.
+// Right now it only used to determine whether a JSON string ID array contains a specific ID.
+// Operation "?" definition: Does the string exist as a top-level key within the JSON value?
+// The type of the key is only supported to be string.
+// If we want to support other types, we may need to use `@>` operator instead.
+func JsonArrayExistsStr(column string, strValue string) dbx.Expression {
+	dbType := os.Getenv("DB_TYPE")
+	if dbType == "postgres" {
+		// PostgreSQL:
+		return dbx.NewExp(fmt.Sprintf("[[%s]] ? {:value}::text", column), dbx.Params{
+			"value": strValue,
+		})
+	}
+
+	if dbType == "mysql" {
+		// MySQL:
+		return dbx.NewExp(fmt.Sprintf(
+			"JSON_CONTAINS([[%s]], JSON_ARRAY({:value}))",
+			column,
+		), dbx.Params{"value": strValue})
+	}
+
+	// SQLite (default):
+	return dbx.NewExp(fmt.Sprintf(
+		"EXISTS (SELECT 1 FROM json_each([[%s]]) WHERE value = {:value})",
+		column,
+	), dbx.Params{"value": strValue})
+}
+
+// JSONArrayLength returns JSON_ARRAY_LENGTH SQLite string expression
+// with some normalizations for non-json columns.
+//
+// It works with both json and non-json column values.
+//
+// Returns 0 for empty string or NULL column values.
+func JSONArrayLength(column string) string {
+	dbType := os.Getenv("DB_TYPE")
+	if dbType == "postgres" {
+		// PostgreSQL:
+		return fmt.Sprintf(
+			`(CASE WHEN ([[%s]] IS JSON OR JSON_VALID([[%s]]::text)) AND jsonb_typeof([[%s]]::jsonb) = 'array' THEN jsonb_array_length([[%s]]::jsonb) ELSE 0 END)`,
+			column, column, column, column,
+		)
+	}
+
+	if dbType == "mysql" {
+		// MySQL:
+		return fmt.Sprintf(
+			`(CASE WHEN JSON_VALID([[%s]]) AND JSON_TYPE([[%s]])='ARRAY' THEN JSON_LENGTH([[%s]]) ELSE 0 END)`,
+			column, column, column,
+		)
+	}
+
+	// SQLite (default):
+	return fmt.Sprintf(
+		`json_array_length(CASE WHEN iif(json_valid([[%s]]), json_type([[%s]])='array', FALSE) THEN [[%s]] ELSE (CASE WHEN [[%s]] = '' OR [[%s]] IS NULL THEN json_array() ELSE json_array([[%s]]) END) END)`,
+		column, column, column, column, column, column,
+	)
+}
+
+// JSONExtract returns a JSON_EXTRACT SQLite string expression with
+// some normalizations for non-json columns.
+func JSONExtract(column string, path string) string {
+	// prefix the path with dot if it is not starting with array notation
+	if path != "" && !strings.HasPrefix(path, "[") {
+		path = "." + path
+	}
+
+	dbType := os.Getenv("DB_TYPE")
+	if dbType == "postgres" {
+		// PostgreSQL:
+		return fmt.Sprintf(
+			`JSON_QUERY_OR_NULL([[%s]], '$%s')::jsonb`,
+			column,
+			path,
+		)
+	}
+
+	if dbType == "mysql" {
+		// MySQL:
+		return fmt.Sprintf(
+			`JSON_EXTRACT([[%s]], '$%s')`,
+			column,
+			path,
+		)
+	}
+
+	// SQLite (default):
+	return fmt.Sprintf(
+		// note: the extra object wrapping is needed to workaround the cases where a json_extract is used with non-json columns.
+		"(CASE WHEN json_valid([[%s]]) THEN JSON_EXTRACT([[%s]], '$%s') ELSE JSON_EXTRACT(json_object('pb', [[%s]]), '$.pb%s') END)",
+		column,
+		column,
+		path,
+		column,
+		path,
+	)
+}
diff --git a/server/core_backend-server/tools/dbutils/json_test.go b/server/core_backend-server/tools/dbutils/json_test.go
new file mode 100644
index 0000000..05e6804
--- /dev/null
+++ b/server/core_backend-server/tools/dbutils/json_test.go
@@ -0,0 +1,84 @@
+package dbutils_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/dbutils"
+)
+
+func TestJSONEach(t *testing.T) {
+	result := dbutils.JSONEach("a.b")
+
+	/* SQLite:
+	expected := "json_each(CASE WHEN iif(json_valid([[a.b]]), json_type([[a.b]])='array', FALSE) THEN [[a.b]] ELSE json_array([[a.b]]) END)"
+	*/
+	// PostgreSQL:
+	expected := "jsonb_array_elements_text(CASE WHEN ([[a.b]] IS JSON OR json_valid([[a.b]]::text)) AND jsonb_typeof([[a.b]]::jsonb) = 'array' THEN [[a.b]]::jsonb ELSE jsonb_build_array([[a.b]]) END)"
+
+	if result != expected {
+		t.Fatalf("Expected\n%v\ngot\n%v", expected, result)
+	}
+}
+
+func TestJSONArrayLength(t *testing.T) {
+	result := dbutils.JSONArrayLength("a.b")
+
+	/* SQLite:
+	expected := "json_array_length(CASE WHEN iif(json_valid([[a.b]]), json_type([[a.b]])='array', FALSE) THEN [[a.b]] ELSE (CASE WHEN [[a.b]] = '' OR [[a.b]] IS NULL THEN json_array() ELSE json_array([[a.b]]) END) END)"
+	*/
+	// PostgreSQL:
+	expected := "(CASE WHEN ([[a.b]] IS JSON OR JSON_VALID([[a.b]]::text)) AND jsonb_typeof([[a.b]]::jsonb) = 'array' THEN jsonb_array_length([[a.b]]::jsonb) ELSE 0 END)"
+
+	if result != expected {
+		t.Fatalf("Expected\n%v\ngot\n%v", expected, result)
+	}
+}
+
+func TestJSONExtract(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		column   string
+		path     string
+		expected string
+	}{
+		{
+			"empty path",
+			"a.b",
+			"",
+			/* SQLite:
+			"(CASE WHEN json_valid([[a.b]]) THEN JSON_EXTRACT([[a.b]], '$') ELSE JSON_EXTRACT(json_object('pb', [[a.b]]), '$.pb') END)",
+			*/
+			// PostgreSQL:
+			`JSON_QUERY_OR_NULL([[a.b]], '$')::jsonb`,
+		},
+		{
+			"starting with array index",
+			"a.b",
+			"[1].a[2]",
+			/* SQLite:
+			"(CASE WHEN json_valid([[a.b]]) THEN JSON_EXTRACT([[a.b]], '$[1].a[2]') ELSE JSON_EXTRACT(json_object('pb', [[a.b]]), '$.pb[1].a[2]') END)",
+			*/
+			// PostgreSQL:
+			`JSON_QUERY_OR_NULL([[a.b]], '$[1].a[2]')::jsonb`,
+		},
+		{
+			"starting with key",
+			"a.b",
+			"a.b[2].c",
+			/* SQLite:
+			"(CASE WHEN json_valid([[a.b]]) THEN JSON_EXTRACT([[a.b]], '$.a.b[2].c') ELSE JSON_EXTRACT(json_object('pb', [[a.b]]), '$.pb.a.b[2].c') END)",
+			*/
+			`JSON_QUERY_OR_NULL([[a.b]], '$.a.b[2].c')::jsonb`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := dbutils.JSONExtract(s.column, s.path)
+
+			if result != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/blob/bucket.go b/server/core_backend-server/tools/filesystem/blob/bucket.go
new file mode 100644
index 0000000..23464be
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/blob/bucket.go
@@ -0,0 +1,731 @@
+// Package blob defines a lightweight abstration for interacting with
+// various storage services (local filesystem, S3, etc.).
+//
+// NB!
+// For compatibility with earlier PocketBase versions and to prevent
+// unnecessary breaking changes, this package is based and implemented
+// as a minimal, stripped down version of the previously used gocloud.dev/blob.
+// While there is no promise that it won't diverge in the future to accommodate
+// better some PocketBase specific use cases, currently it copies and
+// tries to follow as close as possible the same implementations,
+// conventions and rules for the key escaping/unescaping, blob read/write
+// interfaces and struct options as gocloud.dev/blob, therefore the
+// credits goes to the original Go Cloud Development Kit Authors.
+package blob
+
+import (
+	"bytes"
+	"context"
+	"crypto/md5"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"mime"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+	"unicode/utf8"
+)
+
+var (
+	ErrNotFound = errors.New("resource not found")
+	ErrClosed   = errors.New("bucket or blob is closed")
+)
+
+// Bucket provides an easy and portable way to interact with blobs
+// within a "bucket", including read, write, and list operations.
+// To create a Bucket, use constructors found in driver subpackages.
+type Bucket struct {
+	drv Driver
+
+	// mu protects the closed variable.
+	// Read locks are kept to allow holding a read lock for long-running calls,
+	// and thereby prevent closing until a call finishes.
+	mu     sync.RWMutex
+	closed bool
+}
+
+// NewBucket creates a new *Bucket based on a specific driver implementation.
+func NewBucket(drv Driver) *Bucket {
+	return &Bucket{drv: drv}
+}
+
+// ListOptions sets options for listing blobs via Bucket.List.
+type ListOptions struct {
+	// Prefix indicates that only blobs with a key starting with this prefix
+	// should be returned.
+	Prefix string
+
+	// Delimiter sets the delimiter used to define a hierarchical namespace,
+	// like a filesystem with "directories". It is highly recommended that you
+	// use "" or "/" as the Delimiter. Other values should work through this API,
+	// but service UIs generally assume "/".
+	//
+	// An empty delimiter means that the bucket is treated as a single flat
+	// namespace.
+	//
+	// A non-empty delimiter means that any result with the delimiter in its key
+	// after Prefix is stripped will be returned with ListObject.IsDir = true,
+	// ListObject.Key truncated after the delimiter, and zero values for other
+	// ListObject fields. These results represent "directories". Multiple results
+	// in a "directory" are returned as a single result.
+	Delimiter string
+
+	// PageSize sets the maximum number of objects to be returned.
+	// 0 means no maximum; driver implementations should choose a reasonable
+	// max. It is guaranteed to be >= 0.
+	PageSize int
+
+	// PageToken may be filled in with the NextPageToken from a previous
+	// ListPaged call.
+	PageToken []byte
+}
+
+// ListPage represents a page of results return from ListPaged.
+type ListPage struct {
+	// Objects is the slice of objects found. If ListOptions.PageSize > 0,
+	// it should have at most ListOptions.PageSize entries.
+	//
+	// Objects should be returned in lexicographical order of UTF-8 encoded keys,
+	// including across pages. I.e., all objects returned from a ListPage request
+	// made using a PageToken from a previous ListPage request's NextPageToken
+	// should have Key >= the Key for all objects from the previous request.
+	Objects []*ListObject `json:"objects"`
+
+	// NextPageToken should be left empty unless there are more objects
+	// to return. The value may be returned as ListOptions.PageToken on a
+	// subsequent ListPaged call, to fetch the next page of results.
+	// It can be an arbitrary []byte; it need not be a valid key.
+	NextPageToken []byte `json:"nextPageToken"`
+}
+
+// ListIterator iterates over List results.
+type ListIterator struct {
+	b       *Bucket
+	opts    *ListOptions
+	page    *ListPage
+	nextIdx int
+}
+
+// Next returns a *ListObject for the next blob.
+// It returns (nil, io.EOF) if there are no more.
+func (i *ListIterator) Next(ctx context.Context) (*ListObject, error) {
+	if i.page != nil {
+		// We've already got a page of results.
+		if i.nextIdx < len(i.page.Objects) {
+			// Next object is in the page; return it.
+			dobj := i.page.Objects[i.nextIdx]
+			i.nextIdx++
+			return &ListObject{
+				Key:     dobj.Key,
+				ModTime: dobj.ModTime,
+				Size:    dobj.Size,
+				MD5:     dobj.MD5,
+				IsDir:   dobj.IsDir,
+			}, nil
+		}
+
+		if len(i.page.NextPageToken) == 0 {
+			// Done with current page, and there are no more; return io.EOF.
+			return nil, io.EOF
+		}
+
+		// We need to load the next page.
+		i.opts.PageToken = i.page.NextPageToken
+	}
+
+	i.b.mu.RLock()
+	defer i.b.mu.RUnlock()
+
+	if i.b.closed {
+		return nil, ErrClosed
+	}
+
+	// Loading a new page.
+	p, err := i.b.drv.ListPaged(ctx, i.opts)
+	if err != nil {
+		return nil, wrapError(i.b.drv, err, "")
+	}
+
+	i.page = p
+	i.nextIdx = 0
+
+	return i.Next(ctx)
+}
+
+// ListObject represents a single blob returned from List.
+type ListObject struct {
+	// Key is the key for this blob.
+	Key string `json:"key"`
+
+	// ModTime is the time the blob was last modified.
+	ModTime time.Time `json:"modTime"`
+
+	// Size is the size of the blob's content in bytes.
+	Size int64 `json:"size"`
+
+	// MD5 is an MD5 hash of the blob contents or nil if not available.
+	MD5 []byte `json:"md5"`
+
+	// IsDir indicates that this result represents a "directory" in the
+	// hierarchical namespace, ending in ListOptions.Delimiter. Key can be
+	// passed as ListOptions.Prefix to list items in the "directory".
+	// Fields other than Key and IsDir will not be set if IsDir is true.
+	IsDir bool `json:"isDir"`
+}
+
+// List returns a ListIterator that can be used to iterate over blobs in a
+// bucket, in lexicographical order of UTF-8 encoded keys. The underlying
+// implementation fetches results in pages.
+//
+// A nil ListOptions is treated the same as the zero value.
+//
+// List is not guaranteed to include all recently-written blobs;
+// some services are only eventually consistent.
+func (b *Bucket) List(opts *ListOptions) *ListIterator {
+	if opts == nil {
+		opts = &ListOptions{}
+	}
+
+	dopts := &ListOptions{
+		Prefix:    opts.Prefix,
+		Delimiter: opts.Delimiter,
+	}
+
+	return &ListIterator{b: b, opts: dopts}
+}
+
+// FirstPageToken is the pageToken to pass to ListPage to retrieve the first page of results.
+var FirstPageToken = []byte("first page")
+
+// ListPage returns a page of ListObject results for blobs in a bucket, in lexicographical
+// order of UTF-8 encoded keys.
+//
+// To fetch the first page, pass FirstPageToken as the pageToken. For subsequent pages, pass
+// the pageToken returned from a previous call to ListPage.
+// It is not possible to "skip ahead" pages.
+//
+// Each call will return pageSize results, unless there are not enough blobs to fill the
+// page, in which case it will return fewer results (possibly 0).
+//
+// If there are no more blobs available, ListPage will return an empty pageToken. Note that
+// this may happen regardless of the number of returned results -- the last page might have
+// 0 results (i.e., if the last item was deleted), pageSize results, or anything in between.
+//
+// Calling ListPage with an empty pageToken will immediately return io.EOF. When looping
+// over pages, callers can either check for an empty pageToken, or they can make one more
+// call and check for io.EOF.
+//
+// The underlying implementation fetches results in pages, but one call to ListPage may
+// require multiple page fetches (and therefore, multiple calls to the BeforeList callback).
+//
+// A nil ListOptions is treated the same as the zero value.
+//
+// ListPage is not guaranteed to include all recently-written blobs;
+// some services are only eventually consistent.
+func (b *Bucket) ListPage(ctx context.Context, pageToken []byte, pageSize int, opts *ListOptions) (retval []*ListObject, nextPageToken []byte, err error) {
+	if opts == nil {
+		opts = &ListOptions{}
+	}
+	if pageSize <= 0 {
+		return nil, nil, fmt.Errorf("pageSize must be > 0 (%d)", pageSize)
+	}
+
+	// Nil pageToken means no more results.
+	if len(pageToken) == 0 {
+		return nil, nil, io.EOF
+	}
+
+	// FirstPageToken fetches the first page. Drivers use nil.
+	// The public API doesn't use nil for the first page because it would be too easy to
+	// keep fetching forever (since the last page return nil for the next pageToken).
+	if bytes.Equal(pageToken, FirstPageToken) {
+		pageToken = nil
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if b.closed {
+		return nil, nil, ErrClosed
+	}
+
+	dopts := &ListOptions{
+		Prefix:    opts.Prefix,
+		Delimiter: opts.Delimiter,
+		PageToken: pageToken,
+		PageSize:  pageSize,
+	}
+
+	retval = make([]*ListObject, 0, pageSize)
+	for len(retval) < pageSize {
+		p, err := b.drv.ListPaged(ctx, dopts)
+		if err != nil {
+			return nil, nil, wrapError(b.drv, err, "")
+		}
+
+		for _, dobj := range p.Objects {
+			retval = append(retval, &ListObject{
+				Key:     dobj.Key,
+				ModTime: dobj.ModTime,
+				Size:    dobj.Size,
+				MD5:     dobj.MD5,
+				IsDir:   dobj.IsDir,
+			})
+		}
+
+		// ListPaged may return fewer results than pageSize. If there are more results
+		// available, signalled by non-empty p.NextPageToken, try to fetch the remainder
+		// of the page.
+		// It does not work to ask for more results than we need, because then we'd have
+		// a NextPageToken on a non-page boundary.
+		dopts.PageSize = pageSize - len(retval)
+		dopts.PageToken = p.NextPageToken
+		if len(dopts.PageToken) == 0 {
+			dopts.PageToken = nil
+			break
+		}
+	}
+
+	return retval, dopts.PageToken, nil
+}
+
+// Attributes contains attributes about a blob.
+type Attributes struct {
+	// CacheControl specifies caching attributes that services may use
+	// when serving the blob.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
+	CacheControl string `json:"cacheControl"`
+
+	// ContentDisposition specifies whether the blob content is expected to be
+	// displayed inline or as an attachment.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
+	ContentDisposition string `json:"contentDisposition"`
+
+	// ContentEncoding specifies the encoding used for the blob's content, if any.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
+	ContentEncoding string `json:"contentEncoding"`
+
+	// ContentLanguage specifies the language used in the blob's content, if any.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
+	ContentLanguage string `json:"contentLanguage"`
+
+	// ContentType is the MIME type of the blob. It will not be empty.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+	ContentType string `json:"contentType"`
+
+	// Metadata holds key/value pairs associated with the blob.
+	// Keys are guaranteed to be in lowercase, even if the backend service
+	// has case-sensitive keys (although note that Metadata written via
+	// this package will always be lowercased). If there are duplicate
+	// case-insensitive keys (e.g., "foo" and "FOO"), only one value
+	// will be kept, and it is undefined which one.
+	Metadata map[string]string `json:"metadata"`
+
+	// CreateTime is the time the blob was created, if available. If not available,
+	// CreateTime will be the zero time.
+	CreateTime time.Time `json:"createTime"`
+
+	// ModTime is the time the blob was last modified.
+	ModTime time.Time `json:"modTime"`
+
+	// Size is the size of the blob's content in bytes.
+	Size int64 `json:"size"`
+
+	// MD5 is an MD5 hash of the blob contents or nil if not available.
+	MD5 []byte `json:"md5"`
+
+	// ETag for the blob; see https://en.wikipedia.org/wiki/HTTP_ETag.
+	ETag string `json:"etag"`
+}
+
+// Attributes returns attributes for the blob stored at key.
+//
+// If the blob does not exist, Attributes returns an error for which
+// gcerrors.Code will return gcerrors.NotFound.
+func (b *Bucket) Attributes(ctx context.Context, key string) (_ *Attributes, err error) {
+	if !utf8.ValidString(key) {
+		return nil, fmt.Errorf("Attributes key must be a valid UTF-8 string: %q", key)
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	if b.closed {
+		return nil, ErrClosed
+	}
+
+	a, err := b.drv.Attributes(ctx, key)
+	if err != nil {
+		return nil, wrapError(b.drv, err, key)
+	}
+
+	var md map[string]string
+	if len(a.Metadata) > 0 {
+		// Services are inconsistent, but at least some treat keys
+		// as case-insensitive. To make the behavior consistent, we
+		// force-lowercase them when writing and reading.
+		md = make(map[string]string, len(a.Metadata))
+		for k, v := range a.Metadata {
+			md[strings.ToLower(k)] = v
+		}
+	}
+
+	return &Attributes{
+		CacheControl:       a.CacheControl,
+		ContentDisposition: a.ContentDisposition,
+		ContentEncoding:    a.ContentEncoding,
+		ContentLanguage:    a.ContentLanguage,
+		ContentType:        a.ContentType,
+		Metadata:           md,
+		CreateTime:         a.CreateTime,
+		ModTime:            a.ModTime,
+		Size:               a.Size,
+		MD5:                a.MD5,
+		ETag:               a.ETag,
+	}, nil
+}
+
+// Exists returns true if a blob exists at key, false if it does not exist, or an error.
+//
+// It is a shortcut for calling Attributes and checking if it returns
+// an error with code ErrNotFound.
+func (b *Bucket) Exists(ctx context.Context, key string) (bool, error) {
+	_, err := b.Attributes(ctx, key)
+	if err == nil {
+		return true, nil
+	}
+
+	if errors.Is(err, ErrNotFound) {
+		return false, nil
+	}
+
+	return false, err
+}
+
+// NewReader is a shortcut for NewRangeReader with offset=0 and length=-1.
+func (b *Bucket) NewReader(ctx context.Context, key string) (*Reader, error) {
+	return b.newRangeReader(ctx, key, 0, -1)
+}
+
+// NewRangeReader returns a Reader to read content from the blob stored at key.
+// It reads at most length bytes starting at offset (>= 0).
+// If length is negative, it will read till the end of the blob.
+//
+// For the purposes of Seek, the returned Reader will start at offset and
+// end at the minimum of the actual end of the blob or (if length > 0) offset + length.
+//
+// Note that ctx is used for all reads performed during the lifetime of the reader.
+//
+// If the blob does not exist, NewRangeReader returns an ErrNotFound.
+// Exists is a lighter-weight wayto check for existence.
+//
+// The caller must call Close on the returned Reader when done reading.
+func (b *Bucket) NewRangeReader(ctx context.Context, key string, offset, length int64) (_ *Reader, err error) {
+	return b.newRangeReader(ctx, key, offset, length)
+}
+
+func (b *Bucket) newRangeReader(ctx context.Context, key string, offset, length int64) (_ *Reader, err error) {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	if b.closed {
+		return nil, ErrClosed
+	}
+
+	if offset < 0 {
+		return nil, fmt.Errorf("NewRangeReader offset must be non-negative (%d)", offset)
+	}
+
+	if !utf8.ValidString(key) {
+		return nil, fmt.Errorf("NewRangeReader key must be a valid UTF-8 string: %q", key)
+	}
+
+	var dr DriverReader
+	dr, err = b.drv.NewRangeReader(ctx, key, offset, length)
+	if err != nil {
+		return nil, wrapError(b.drv, err, key)
+	}
+
+	r := &Reader{
+		drv:         b.drv,
+		r:           dr,
+		key:         key,
+		ctx:         ctx,
+		baseOffset:  offset,
+		baseLength:  length,
+		savedOffset: -1,
+	}
+
+	_, file, lineno, ok := runtime.Caller(2)
+	runtime.SetFinalizer(r, func(r *Reader) {
+		if !r.closed {
+			var caller string
+			if ok {
+				caller = fmt.Sprintf(" (%s:%d)", file, lineno)
+			}
+			log.Printf("A blob.Reader reading from %q was never closed%s", key, caller)
+		}
+	})
+
+	return r, nil
+}
+
+// WriterOptions sets options for NewWriter.
+type WriterOptions struct {
+	// BufferSize changes the default size in bytes of the chunks that
+	// Writer will upload in a single request; larger blobs will be split into
+	// multiple requests.
+	//
+	// This option may be ignored by some drivers.
+	//
+	// If 0, the driver will choose a reasonable default.
+	//
+	// If the Writer is used to do many small writes concurrently, using a
+	// smaller BufferSize may reduce memory usage.
+	BufferSize int
+
+	// MaxConcurrency changes the default concurrency for parts of an upload.
+	//
+	// This option may be ignored by some drivers.
+	//
+	// If 0, the driver will choose a reasonable default.
+	MaxConcurrency int
+
+	// CacheControl specifies caching attributes that services may use
+	// when serving the blob.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
+	CacheControl string
+
+	// ContentDisposition specifies whether the blob content is expected to be
+	// displayed inline or as an attachment.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
+	ContentDisposition string
+
+	// ContentEncoding specifies the encoding used for the blob's content, if any.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
+	ContentEncoding string
+
+	// ContentLanguage specifies the language used in the blob's content, if any.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
+	ContentLanguage string
+
+	// ContentType specifies the MIME type of the blob being written. If not set,
+	// it will be inferred from the content using the algorithm described at
+	// http://mimesniff.spec.whatwg.org/.
+	// Set DisableContentTypeDetection to true to disable the above and force
+	// the ContentType to stay empty.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+	ContentType string
+
+	// When true, if ContentType is the empty string, it will stay the empty
+	// string rather than being inferred from the content.
+	// Note that while the blob will be written with an empty string ContentType,
+	// most providers will fill one in during reads, so don't expect an empty
+	// ContentType if you read the blob back.
+	DisableContentTypeDetection bool
+
+	// ContentMD5 is used as a message integrity check.
+	// If len(ContentMD5) > 0, the MD5 hash of the bytes written must match
+	// ContentMD5, or Close will return an error without completing the write.
+	// https://tools.ietf.org/html/rfc1864
+	ContentMD5 []byte
+
+	// Metadata holds key/value strings to be associated with the blob, or nil.
+	// Keys may not be empty, and are lowercased before being written.
+	// Duplicate case-insensitive keys (e.g., "foo" and "FOO") will result in
+	// an error.
+	Metadata map[string]string
+}
+
+// NewWriter returns a Writer that writes to the blob stored at key.
+// A nil WriterOptions is treated the same as the zero value.
+//
+// If a blob with this key already exists, it will be replaced.
+// The blob being written is not guaranteed to be readable until Close
+// has been called; until then, any previous blob will still be readable.
+// Even after Close is called, newly written blobs are not guaranteed to be
+// returned from List; some services are only eventually consistent.
+//
+// The returned Writer will store ctx for later use in Write and/or Close.
+// To abort a write, cancel ctx; otherwise, it must remain open until
+// Close is called.
+//
+// The caller must call Close on the returned Writer, even if the write is
+// aborted.
+func (b *Bucket) NewWriter(ctx context.Context, key string, opts *WriterOptions) (_ *Writer, err error) {
+	if !utf8.ValidString(key) {
+		return nil, fmt.Errorf("NewWriter key must be a valid UTF-8 string: %q", key)
+	}
+	if opts == nil {
+		opts = &WriterOptions{}
+	}
+	dopts := &WriterOptions{
+		CacheControl:                opts.CacheControl,
+		ContentDisposition:          opts.ContentDisposition,
+		ContentEncoding:             opts.ContentEncoding,
+		ContentLanguage:             opts.ContentLanguage,
+		ContentMD5:                  opts.ContentMD5,
+		BufferSize:                  opts.BufferSize,
+		MaxConcurrency:              opts.MaxConcurrency,
+		DisableContentTypeDetection: opts.DisableContentTypeDetection,
+	}
+
+	if len(opts.Metadata) > 0 {
+		// Services are inconsistent, but at least some treat keys
+		// as case-insensitive. To make the behavior consistent, we
+		// force-lowercase them when writing and reading.
+		md := make(map[string]string, len(opts.Metadata))
+		for k, v := range opts.Metadata {
+			if k == "" {
+				return nil, errors.New("WriterOptions.Metadata keys may not be empty strings")
+			}
+			if !utf8.ValidString(k) {
+				return nil, fmt.Errorf("WriterOptions.Metadata keys must be valid UTF-8 strings: %q", k)
+			}
+			if !utf8.ValidString(v) {
+				return nil, fmt.Errorf("WriterOptions.Metadata values must be valid UTF-8 strings: %q", v)
+			}
+			lowerK := strings.ToLower(k)
+			if _, found := md[lowerK]; found {
+				return nil, fmt.Errorf("WriterOptions.Metadata has a duplicate case-insensitive metadata key: %q", lowerK)
+			}
+			md[lowerK] = v
+		}
+		dopts.Metadata = md
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	if b.closed {
+		return nil, ErrClosed
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+
+	w := &Writer{
+		drv:        b.drv,
+		cancel:     cancel,
+		key:        key,
+		contentMD5: opts.ContentMD5,
+		md5hash:    md5.New(),
+	}
+
+	if opts.ContentType != "" || opts.DisableContentTypeDetection {
+		var ct string
+		if opts.ContentType != "" {
+			t, p, err := mime.ParseMediaType(opts.ContentType)
+			if err != nil {
+				cancel()
+				return nil, err
+			}
+			ct = mime.FormatMediaType(t, p)
+		}
+		dw, err := b.drv.NewTypedWriter(ctx, key, ct, dopts)
+		if err != nil {
+			cancel()
+			return nil, wrapError(b.drv, err, key)
+		}
+		w.w = dw
+	} else {
+		// Save the fields needed to called NewTypedWriter later, once we've gotten
+		// sniffLen bytes; see the comment on Writer.
+		w.ctx = ctx
+		w.opts = dopts
+		w.buf = bytes.NewBuffer([]byte{})
+	}
+
+	_, file, lineno, ok := runtime.Caller(1)
+	runtime.SetFinalizer(w, func(w *Writer) {
+		if !w.closed {
+			var caller string
+			if ok {
+				caller = fmt.Sprintf(" (%s:%d)", file, lineno)
+			}
+			log.Printf("A blob.Writer writing to %q was never closed%s", key, caller)
+		}
+	})
+
+	return w, nil
+}
+
+// Copy the blob stored at srcKey to dstKey.
+// A nil CopyOptions is treated the same as the zero value.
+//
+// If the source blob does not exist, Copy returns an ErrNotFound.
+//
+// If the destination blob already exists, it is overwritten.
+func (b *Bucket) Copy(ctx context.Context, dstKey, srcKey string) (err error) {
+	if !utf8.ValidString(srcKey) {
+		return fmt.Errorf("Copy srcKey must be a valid UTF-8 string: %q", srcKey)
+	}
+
+	if !utf8.ValidString(dstKey) {
+		return fmt.Errorf("Copy dstKey must be a valid UTF-8 string: %q", dstKey)
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if b.closed {
+		return ErrClosed
+	}
+
+	return wrapError(b.drv, b.drv.Copy(ctx, dstKey, srcKey), fmt.Sprintf("%s -> %s", srcKey, dstKey))
+}
+
+// Delete deletes the blob stored at key.
+//
+// If the blob does not exist, Delete returns an error for which
+// gcerrors.Code will return gcerrors.NotFound.
+func (b *Bucket) Delete(ctx context.Context, key string) (err error) {
+	if !utf8.ValidString(key) {
+		return fmt.Errorf("Delete key must be a valid UTF-8 string: %q", key)
+	}
+
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if b.closed {
+		return ErrClosed
+	}
+
+	return wrapError(b.drv, b.drv.Delete(ctx, key), key)
+}
+
+// Close releases any resources used for the bucket.
+//
+// @todo Consider removing it.
+func (b *Bucket) Close() error {
+	b.mu.Lock()
+	prev := b.closed
+	b.closed = true
+	b.mu.Unlock()
+
+	if prev {
+		return ErrClosed
+	}
+
+	return wrapError(b.drv, b.drv.Close(), "")
+}
+
+func wrapError(b Driver, err error, key string) error {
+	if err == nil {
+		return nil
+	}
+
+	// don't wrap or normalize EOF errors since there are many places
+	// in the standard library (e.g. io.ReadAll) that rely on checks
+	// such as "err == io.EOF" and they will fail
+	if errors.Is(err, io.EOF) {
+		return err
+	}
+
+	err = b.NormalizeError(err)
+
+	if key != "" {
+		err = fmt.Errorf("[key: %s] %w", key, err)
+	}
+
+	return err
+}
diff --git a/server/core_backend-server/tools/filesystem/blob/driver.go b/server/core_backend-server/tools/filesystem/blob/driver.go
new file mode 100644
index 0000000..b8dd727
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/blob/driver.go
@@ -0,0 +1,97 @@
+package blob
+
+import (
+	"context"
+	"io"
+	"time"
+)
+
+// ReaderAttributes contains a subset of attributes about a blob that are
+// accessible from Reader.
+type ReaderAttributes struct {
+	// ContentType is the MIME type of the blob object. It must not be empty.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
+	ContentType string `json:"contentType"`
+
+	// ModTime is the time the blob object was last modified.
+	ModTime time.Time `json:"modTime"`
+
+	// Size is the size of the object in bytes.
+	Size int64 `json:"size"`
+}
+
+// DriverReader reads an object from the blob.
+type DriverReader interface {
+	io.ReadCloser
+
+	// Attributes returns a subset of attributes about the blob.
+	// The portable type will not modify the returned ReaderAttributes.
+	Attributes() *ReaderAttributes
+}
+
+// DriverWriter writes an object to the blob.
+type DriverWriter interface {
+	io.WriteCloser
+}
+
+// Driver provides read, write and delete operations on objects within it on the
+// blob service.
+type Driver interface {
+	NormalizeError(err error) error
+
+	// Attributes returns attributes for the blob. If the specified object does
+	// not exist, Attributes must return an ErrNotFound.
+	// The portable type will not modify the returned Attributes.
+	Attributes(ctx context.Context, key string) (*Attributes, error)
+
+	// ListPaged lists objects in the bucket, in lexicographical order by
+	// UTF-8-encoded key, returning pages of objects at a time.
+	// Services are only required to be eventually consistent with respect
+	// to recently written or deleted objects. That is to say, there is no
+	// guarantee that an object that's been written will immediately be returned
+	// from ListPaged.
+	ListPaged(ctx context.Context, opts *ListOptions) (*ListPage, error)
+
+	// NewRangeReader returns a Reader that reads part of an object, reading at
+	// most length bytes starting at the given offset. If length is negative, it
+	// will read until the end of the object. If the specified object does not
+	// exist, NewRangeReader must return an ErrNotFound.
+	NewRangeReader(ctx context.Context, key string, offset, length int64) (DriverReader, error)
+
+	// NewTypedWriter returns Writer that writes to an object associated with key.
+	//
+	// A new object will be created unless an object with this key already exists.
+	// Otherwise any previous object with the same key will be replaced.
+	// The object may not be available (and any previous object will remain)
+	// until Close has been called.
+	//
+	// contentType sets the MIME type of the object to be written.
+	// opts is guaranteed to be non-nil.
+	//
+	// The caller must call Close on the returned Writer when done writing.
+	//
+	// Implementations should abort an ongoing write if ctx is later canceled,
+	// and do any necessary cleanup in Close. Close should then return ctx.Err().
+	//
+	// The returned Writer *may* also implement Uploader if the underlying
+	// implementation can take advantage of that. The Upload call is guaranteed
+	// to be the only non-Close call to the Writer..
+	NewTypedWriter(ctx context.Context, key, contentType string, opts *WriterOptions) (DriverWriter, error)
+
+	// Copy copies the object associated with srcKey to dstKey.
+	//
+	// If the source object does not exist, Copy must return an ErrNotFound.
+	//
+	// If the destination object already exists, it should be overwritten.
+	Copy(ctx context.Context, dstKey, srcKey string) error
+
+	// Delete deletes the object associated with key. If the specified object does
+	// not exist, Delete must return an ErrNotFound.
+	Delete(ctx context.Context, key string) error
+
+	// Close cleans up any resources used by the Bucket. Once Close is called,
+	// there will be no method calls to the Bucket other than As, ErrorAs, and
+	// ErrorCode. There may be open readers or writers that will receive calls.
+	// It is up to the driver as to how these will be handled.
+	Close() error
+}
diff --git a/server/core_backend-server/tools/filesystem/blob/hex.go b/server/core_backend-server/tools/filesystem/blob/hex.go
new file mode 100644
index 0000000..d41909e
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/blob/hex.go
@@ -0,0 +1,153 @@
+package blob
+
+import (
+	"fmt"
+	"strconv"
+)
+
+// Copied from gocloud.dev/blob to avoid nuances around the specific
+// HEX escaping/unescaping rules.
+//
+// -------------------------------------------------------------------
+// Copyright 2019 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// -------------------------------------------------------------------
+
+// HexEscape returns s, with all runes for which shouldEscape returns true
+// escaped to "__0xXXX__", where XXX is the hex representation of the rune
+// value. For example, " " would escape to "__0x20__".
+//
+// Non-UTF-8 strings will have their non-UTF-8 characters escaped to
+// unicode.ReplacementChar; the original value is lost. Please file an
+// issue if you need non-UTF8 support.
+//
+// Note: shouldEscape takes the whole string as a slice of runes and an
+// index. Passing it a single byte or a single rune doesn't provide
+// enough context for some escape decisions; for example, the caller might
+// want to escape the second "/" in "//" but not the first one.
+// We pass a slice of runes instead of the string or a slice of bytes
+// because some decisions will be made on a rune basis (e.g., encode
+// all non-ASCII runes).
+func HexEscape(s string, shouldEscape func(s []rune, i int) bool) string {
+	// Do a first pass to see which runes (if any) need escaping.
+	runes := []rune(s)
+	var toEscape []int
+	for i := range runes {
+		if shouldEscape(runes, i) {
+			toEscape = append(toEscape, i)
+		}
+	}
+	if len(toEscape) == 0 {
+		return s
+	}
+
+	// Each escaped rune turns into at most 14 runes ("__0x7fffffff__"),
+	// so allocate an extra 13 for each. We'll reslice at the end
+	// if we didn't end up using them.
+	escaped := make([]rune, len(runes)+13*len(toEscape))
+	n := 0 // current index into toEscape
+	j := 0 // current index into escaped
+	for i, r := range runes {
+		if n < len(toEscape) && i == toEscape[n] {
+			// We were asked to escape this rune.
+			for _, x := range fmt.Sprintf("__%#x__", r) {
+				escaped[j] = x
+				j++
+			}
+			n++
+		} else {
+			escaped[j] = r
+			j++
+		}
+	}
+
+	return string(escaped[0:j])
+}
+
+// unescape tries to unescape starting at r[i].
+// It returns a boolean indicating whether the unescaping was successful,
+// and (if true) the unescaped rune and the last index of r that was used
+// during unescaping.
+func unescape(r []rune, i int) (bool, rune, int) {
+	// Look for "__0x".
+	if r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '0' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != 'x' {
+		return false, 0, 0
+	}
+	i++
+
+	// Capture the digits until the next "_" (if any).
+	var hexdigits []rune
+	for ; i < len(r) && r[i] != '_'; i++ {
+		hexdigits = append(hexdigits, r[i])
+	}
+
+	// Look for the trailing "__".
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+	i++
+	if i >= len(r) || r[i] != '_' {
+		return false, 0, 0
+	}
+
+	// Parse the hex digits into an int32.
+	retval, err := strconv.ParseInt(string(hexdigits), 16, 32)
+	if err != nil {
+		return false, 0, 0
+	}
+
+	return true, rune(retval), i
+}
+
+// HexUnescape reverses HexEscape.
+func HexUnescape(s string) string {
+	var unescaped []rune
+
+	runes := []rune(s)
+	for i := 0; i < len(runes); i++ {
+		if ok, newR, newI := unescape(runes, i); ok {
+			// We unescaped some runes starting at i, resulting in the
+			// unescaped rune newR. The last rune used was newI.
+			if unescaped == nil {
+				// This is the first rune we've encountered that
+				// needed unescaping. Allocate a buffer and copy any
+				// previous runes.
+				unescaped = make([]rune, i)
+				copy(unescaped, runes)
+			}
+			unescaped = append(unescaped, newR)
+			i = newI
+		} else if unescaped != nil {
+			unescaped = append(unescaped, runes[i])
+		}
+	}
+
+	if unescaped == nil {
+		return s
+	}
+
+	return string(unescaped)
+}
diff --git a/server/core_backend-server/tools/filesystem/blob/reader.go b/server/core_backend-server/tools/filesystem/blob/reader.go
new file mode 100644
index 0000000..69a0d1e
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/blob/reader.go
@@ -0,0 +1,196 @@
+package blob
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"time"
+)
+
+// Largely copied from gocloud.dev/blob.Reader to minimize breaking changes.
+//
+// -------------------------------------------------------------------
+// Copyright 2019 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// -------------------------------------------------------------------
+
+var _ io.ReadSeekCloser = (*Reader)(nil)
+
+// Reader reads bytes from a blob.
+// It implements io.ReadSeekCloser, and must be closed after reads are finished.
+type Reader struct {
+	ctx            context.Context // Used to recreate r after Seeks
+	r              DriverReader
+	drv            Driver
+	key            string
+	baseOffset     int64 // The base offset provided to NewRangeReader.
+	baseLength     int64 // The length provided to NewRangeReader (may be negative).
+	relativeOffset int64 // Current offset (relative to baseOffset).
+	savedOffset    int64 // Last relativeOffset for r, saved after relativeOffset is changed in Seek, or -1 if no Seek.
+	closed         bool
+}
+
+// Read implements io.Reader (https://golang.org/pkg/io/#Reader).
+func (r *Reader) Read(p []byte) (int, error) {
+	if r.savedOffset != -1 {
+		// We've done one or more Seeks since the last read. We may have
+		// to recreate the Reader.
+		//
+		// Note that remembering the savedOffset and lazily resetting the
+		// reader like this allows the caller to Seek, then Seek again back,
+		// to the original offset, without having to recreate the reader.
+		// We only have to recreate the reader if we actually read after a Seek.
+		// This is an important optimization because it's common to Seek
+		// to (SeekEnd, 0) and use the return value to determine the size
+		// of the data, then Seek back to (SeekStart, 0).
+		saved := r.savedOffset
+		if r.relativeOffset == saved {
+			// Nope! We're at the same place we left off.
+			r.savedOffset = -1
+		} else {
+			// Yep! We've changed the offset. Recreate the reader.
+			length := r.baseLength
+			if length >= 0 {
+				length -= r.relativeOffset
+				if length < 0 {
+					// Shouldn't happen based on checks in Seek.
+					return 0, fmt.Errorf("invalid Seek (base length %d, relative offset %d)", r.baseLength, r.relativeOffset)
+				}
+			}
+			newR, err := r.drv.NewRangeReader(r.ctx, r.key, r.baseOffset+r.relativeOffset, length)
+			if err != nil {
+				return 0, wrapError(r.drv, err, r.key)
+			}
+			_ = r.r.Close()
+			r.savedOffset = -1
+			r.r = newR
+		}
+	}
+	n, err := r.r.Read(p)
+	r.relativeOffset += int64(n)
+	return n, wrapError(r.drv, err, r.key)
+}
+
+// Seek implements io.Seeker (https://golang.org/pkg/io/#Seeker).
+func (r *Reader) Seek(offset int64, whence int) (int64, error) {
+	if r.savedOffset == -1 {
+		// Save the current offset for our reader. If the Seek changes the
+		// offset, and then we try to read, we'll need to recreate the reader.
+		// See comment above in Read for why we do it lazily.
+		r.savedOffset = r.relativeOffset
+	}
+	// The maximum relative offset is the minimum of:
+	// 1. The actual size of the blob, minus our initial baseOffset.
+	// 2. The length provided to NewRangeReader (if it was non-negative).
+	maxRelativeOffset := r.Size() - r.baseOffset
+	if r.baseLength >= 0 && r.baseLength < maxRelativeOffset {
+		maxRelativeOffset = r.baseLength
+	}
+	switch whence {
+	case io.SeekStart:
+		r.relativeOffset = offset
+	case io.SeekCurrent:
+		r.relativeOffset += offset
+	case io.SeekEnd:
+		r.relativeOffset = maxRelativeOffset + offset
+	}
+	if r.relativeOffset < 0 {
+		// "Seeking to an offset before the start of the file is an error."
+		invalidOffset := r.relativeOffset
+		r.relativeOffset = 0
+		return 0, fmt.Errorf("Seek resulted in invalid offset %d, using 0", invalidOffset)
+	}
+	if r.relativeOffset > maxRelativeOffset {
+		// "Seeking to any positive offset is legal, but the behavior of subsequent
+		// I/O operations on the underlying object is implementation-dependent."
+		// We'll choose to set the offset to the EOF.
+		log.Printf("blob.Reader.Seek set an offset after EOF (base offset/length from NewRangeReader %d, %d; actual blob size %d; relative offset %d -> absolute offset %d).", r.baseOffset, r.baseLength, r.Size(), r.relativeOffset, r.baseOffset+r.relativeOffset)
+		r.relativeOffset = maxRelativeOffset
+	}
+	return r.relativeOffset, nil
+}
+
+// Close implements io.Closer (https://golang.org/pkg/io/#Closer).
+func (r *Reader) Close() error {
+	r.closed = true
+	err := wrapError(r.drv, r.r.Close(), r.key)
+	return err
+}
+
+// ContentType returns the MIME type of the blob.
+func (r *Reader) ContentType() string {
+	return r.r.Attributes().ContentType
+}
+
+// ModTime returns the time the blob was last modified.
+func (r *Reader) ModTime() time.Time {
+	return r.r.Attributes().ModTime
+}
+
+// Size returns the size of the blob content in bytes.
+func (r *Reader) Size() int64 {
+	return r.r.Attributes().Size
+}
+
+// WriteTo reads from r and writes to w until there's no more data or
+// an error occurs.
+// The return value is the number of bytes written to w.
+//
+// It implements the io.WriterTo interface.
+func (r *Reader) WriteTo(w io.Writer) (int64, error) {
+	// If the writer has a ReaderFrom method, use it to do the copy.
+	// Don't do this for our own *Writer to avoid infinite recursion.
+	// Avoids an allocation and a copy.
+	switch w.(type) {
+	case *Writer:
+	default:
+		if rf, ok := w.(io.ReaderFrom); ok {
+			n, err := rf.ReadFrom(r)
+			return n, err
+		}
+	}
+
+	_, nw, err := readFromWriteTo(r, w)
+	return nw, err
+}
+
+// readFromWriteTo is a helper for ReadFrom and WriteTo.
+// It reads data from r and writes to w, until EOF or a read/write error.
+// It returns the number of bytes read from r and the number of bytes
+// written to w.
+func readFromWriteTo(r io.Reader, w io.Writer) (int64, int64, error) {
+	// Note: can't use io.Copy because it will try to use r.WriteTo
+	// or w.WriteTo, which is recursive in this context.
+	buf := make([]byte, 4096)
+	var totalRead, totalWritten int64
+	for {
+		numRead, rerr := r.Read(buf)
+		if numRead > 0 {
+			totalRead += int64(numRead)
+			numWritten, werr := w.Write(buf[0:numRead])
+			totalWritten += int64(numWritten)
+			if werr != nil {
+				return totalRead, totalWritten, werr
+			}
+		}
+		if rerr == io.EOF {
+			// Done!
+			return totalRead, totalWritten, nil
+		}
+		if rerr != nil {
+			return totalRead, totalWritten, rerr
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/blob/writer.go b/server/core_backend-server/tools/filesystem/blob/writer.go
new file mode 100644
index 0000000..718a342
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/blob/writer.go
@@ -0,0 +1,184 @@
+package blob
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"hash"
+	"io"
+	"net/http"
+)
+
+// Largely copied from gocloud.dev/blob.Writer to minimize breaking changes.
+//
+// -------------------------------------------------------------------
+// Copyright 2019 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// -------------------------------------------------------------------
+
+var _ io.WriteCloser = (*Writer)(nil)
+
+// Writer writes bytes to a blob.
+//
+// It implements io.WriteCloser (https://golang.org/pkg/io/#Closer), and must be
+// closed after all writes are done.
+type Writer struct {
+	drv          Driver
+	w            DriverWriter
+	key          string
+	cancel       func() // cancels the ctx provided to NewTypedWriter if contentMD5 verification fails
+	contentMD5   []byte
+	md5hash      hash.Hash
+	bytesWritten int
+	closed       bool
+
+	// These fields are non-zero values only when w is nil (not yet created).
+	//
+	// A ctx is stored in the Writer since we need to pass it into NewTypedWriter
+	// when we finish detecting the content type of the blob and create the
+	// underlying driver.Writer. This step happens inside Write or Close and
+	// neither of them take a context.Context as an argument.
+	//
+	// All 3 fields are only initialized when we create the Writer without
+	// setting the w field, and are reset to zero values after w is created.
+	ctx  context.Context
+	opts *WriterOptions
+	buf  *bytes.Buffer
+}
+
+// sniffLen is the byte size of Writer.buf used to detect content-type.
+const sniffLen = 512
+
+// Write implements the io.Writer interface (https://golang.org/pkg/io/#Writer).
+//
+// Writes may happen asynchronously, so the returned error can be nil
+// even if the actual write eventually fails. The write is only guaranteed to
+// have succeeded if Close returns no error.
+func (w *Writer) Write(p []byte) (int, error) {
+	if len(w.contentMD5) > 0 {
+		if _, err := w.md5hash.Write(p); err != nil {
+			return 0, err
+		}
+	}
+
+	if w.w != nil {
+		return w.write(p)
+	}
+
+	// If w is not yet created due to no content-type being passed in, try to sniff
+	// the MIME type based on at most 512 bytes of the blob content of p.
+
+	// Detect the content-type directly if the first chunk is at least 512 bytes.
+	if w.buf.Len() == 0 && len(p) >= sniffLen {
+		return w.open(p)
+	}
+
+	// Store p in w.buf and detect the content-type when the size of content in
+	// w.buf is at least 512 bytes.
+	n, err := w.buf.Write(p)
+	if err != nil {
+		return 0, err
+	}
+
+	if w.buf.Len() >= sniffLen {
+		// Note that w.open will return the full length of the buffer; we don't want
+		// to return that as the length of this write since some of them were written in
+		// previous writes. Instead, we return the n from this write, above.
+		_, err := w.open(w.buf.Bytes())
+		return n, err
+	}
+
+	return n, nil
+}
+
+// Close closes the blob writer. The write operation is not guaranteed
+// to have succeeded until Close returns with no error.
+//
+// Close may return an error if the context provided to create the
+// Writer is canceled or reaches its deadline.
+func (w *Writer) Close() (err error) {
+	w.closed = true
+
+	// Verify the MD5 hash of what was written matches the ContentMD5 provided by the user.
+	if len(w.contentMD5) > 0 {
+		md5sum := w.md5hash.Sum(nil)
+		if !bytes.Equal(md5sum, w.contentMD5) {
+			// No match! Return an error, but first cancel the context and call the
+			// driver's Close function to ensure the write is aborted.
+			w.cancel()
+			if w.w != nil {
+				_ = w.w.Close()
+			}
+			return fmt.Errorf("the WriterOptions.ContentMD5 you specified (%X) did not match what was written (%X)", w.contentMD5, md5sum)
+		}
+	}
+
+	defer w.cancel()
+
+	if w.w != nil {
+		return wrapError(w.drv, w.w.Close(), w.key)
+	}
+
+	if _, err := w.open(w.buf.Bytes()); err != nil {
+		return err
+	}
+
+	return wrapError(w.drv, w.w.Close(), w.key)
+}
+
+// open tries to detect the MIME type of p and write it to the blob.
+// The error it returns is wrapped.
+func (w *Writer) open(p []byte) (int, error) {
+	ct := http.DetectContentType(p)
+
+	var err error
+	w.w, err = w.drv.NewTypedWriter(w.ctx, w.key, ct, w.opts)
+	if err != nil {
+		return 0, wrapError(w.drv, err, w.key)
+	}
+
+	// Set the 3 fields needed for lazy NewTypedWriter back to zero values
+	// (see the comment on Writer).
+	w.buf = nil
+	w.ctx = nil
+	w.opts = nil
+
+	return w.write(p)
+}
+
+func (w *Writer) write(p []byte) (int, error) {
+	n, err := w.w.Write(p)
+	w.bytesWritten += n
+	return n, wrapError(w.drv, err, w.key)
+}
+
+// ReadFrom reads from r and writes to w until EOF or error.
+// The return value is the number of bytes read from r.
+//
+// It implements the io.ReaderFrom interface.
+func (w *Writer) ReadFrom(r io.Reader) (int64, error) {
+	// If the reader has a WriteTo method, use it to do the copy.
+	// Don't do this for our own *Reader to avoid infinite recursion.
+	// Avoids an allocation and a copy.
+	switch r.(type) {
+	case *Reader:
+	default:
+		if wt, ok := r.(io.WriterTo); ok {
+			return wt.WriteTo(w)
+		}
+	}
+
+	nr, _, err := readFromWriteTo(r, w)
+	return nr, err
+}
diff --git a/server/core_backend-server/tools/filesystem/file.go b/server/core_backend-server/tools/filesystem/file.go
new file mode 100644
index 0000000..6cb5426
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/file.go
@@ -0,0 +1,278 @@
+package filesystem
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"os"
+	"path"
+	"regexp"
+	"strings"
+
+	"github.com/gabriel-vasile/mimetype"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// FileReader defines an interface for a file resource reader.
+type FileReader interface {
+	Open() (io.ReadSeekCloser, error)
+}
+
+// File defines a single file [io.ReadSeekCloser] resource.
+//
+// The file could be from a local path, multipart/form-data header, etc.
+type File struct {
+	Reader       FileReader `form:"-" json:"-" xml:"-"`
+	Name         string     `form:"name" json:"name" xml:"name"`
+	OriginalName string     `form:"originalName" json:"originalName" xml:"originalName"`
+	Size         int64      `form:"size" json:"size" xml:"size"`
+}
+
+// AsMap implements [core.mapExtractor] and returns a value suitable
+// to be used in an API rule expression.
+func (f *File) AsMap() map[string]any {
+	return map[string]any{
+		"name":         f.Name,
+		"originalName": f.OriginalName,
+		"size":         f.Size,
+	}
+}
+
+// NewFileFromPath creates a new File instance from the provided local file path.
+func NewFileFromPath(path string) (*File, error) {
+	f := &File{}
+
+	info, err := os.Stat(path)
+	if err != nil {
+		return nil, err
+	}
+
+	f.Reader = &PathReader{Path: path}
+	f.Size = info.Size()
+	f.OriginalName = info.Name()
+	f.Name = normalizeName(f.Reader, f.OriginalName)
+
+	return f, nil
+}
+
+// NewFileFromBytes creates a new File instance from the provided byte slice.
+func NewFileFromBytes(b []byte, name string) (*File, error) {
+	size := len(b)
+	if size == 0 {
+		return nil, errors.New("cannot create an empty file")
+	}
+
+	f := &File{}
+
+	f.Reader = &BytesReader{b}
+	f.Size = int64(size)
+	f.OriginalName = name
+	f.Name = normalizeName(f.Reader, f.OriginalName)
+
+	return f, nil
+}
+
+// NewFileFromMultipart creates a new File from the provided multipart header.
+func NewFileFromMultipart(mh *multipart.FileHeader) (*File, error) {
+	f := &File{}
+
+	f.Reader = &MultipartReader{Header: mh}
+	f.Size = mh.Size
+	f.OriginalName = mh.Filename
+	f.Name = normalizeName(f.Reader, f.OriginalName)
+
+	return f, nil
+}
+
+// NewFileFromURL creates a new File from the provided url by
+// downloading the resource and load it as BytesReader.
+//
+// Example
+//
+//	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+//	defer cancel()
+//
+//	file, err := filesystem.NewFileFromURL(ctx, "https://example.com/image.png")
+func NewFileFromURL(ctx context.Context, url string) (*File, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode < 200 || res.StatusCode > 399 {
+		return nil, fmt.Errorf("failed to download url %s (%d)", url, res.StatusCode)
+	}
+
+	var buf bytes.Buffer
+
+	if _, err = io.Copy(&buf, res.Body); err != nil {
+		return nil, err
+	}
+
+	return NewFileFromBytes(buf.Bytes(), path.Base(url))
+}
+
+// -------------------------------------------------------------------
+
+var _ FileReader = (*MultipartReader)(nil)
+
+// MultipartReader defines a FileReader from [multipart.FileHeader].
+type MultipartReader struct {
+	Header *multipart.FileHeader
+}
+
+// Open implements the [filesystem.FileReader] interface.
+func (r *MultipartReader) Open() (io.ReadSeekCloser, error) {
+	return r.Header.Open()
+}
+
+// -------------------------------------------------------------------
+
+var _ FileReader = (*PathReader)(nil)
+
+// PathReader defines a FileReader from a local file path.
+type PathReader struct {
+	Path string
+}
+
+// Open implements the [filesystem.FileReader] interface.
+func (r *PathReader) Open() (io.ReadSeekCloser, error) {
+	return os.Open(r.Path)
+}
+
+// -------------------------------------------------------------------
+
+var _ FileReader = (*BytesReader)(nil)
+
+// BytesReader defines a FileReader from bytes content.
+type BytesReader struct {
+	Bytes []byte
+}
+
+// Open implements the [filesystem.FileReader] interface.
+func (r *BytesReader) Open() (io.ReadSeekCloser, error) {
+	return &bytesReadSeekCloser{bytes.NewReader(r.Bytes)}, nil
+}
+
+type bytesReadSeekCloser struct {
+	*bytes.Reader
+}
+
+// Close implements the [io.ReadSeekCloser] interface.
+func (r *bytesReadSeekCloser) Close() error {
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+var _ FileReader = (openFuncAsReader)(nil)
+
+// openFuncAsReader defines a FileReader from a bare Open function.
+type openFuncAsReader func() (io.ReadSeekCloser, error)
+
+// Open implements the [filesystem.FileReader] interface.
+func (r openFuncAsReader) Open() (io.ReadSeekCloser, error) {
+	return r()
+}
+
+// -------------------------------------------------------------------
+
+var extInvalidCharsRegex = regexp.MustCompile(`[^\w\.\*\-\+\=\#]+`)
+
+const randomAlphabet = "abcdefghijklmnopqrstuvwxyz0123456789"
+
+func normalizeName(fr FileReader, name string) string {
+	// cut the name even if it is not multibyte safe to avoid operating on too large strings
+	// ---
+	originalLength := len(name)
+	if originalLength > 300 {
+		name = name[originalLength-300:]
+	}
+
+	// extension
+	// ---
+	originalExt := extractExtension(name)
+	cleanExt := "." + strings.Trim(extInvalidCharsRegex.ReplaceAllString(originalExt, ""), ".")
+	if cleanExt == "." {
+		// try to detect the extension from the file content
+		cleanExt, _ = detectExtension(fr)
+	}
+	if extLength := len(cleanExt); extLength > 20 {
+		// keep only the last 20 characters (it is multibyte safe after the regex replace)
+		cleanExt = "." + strings.Trim(cleanExt[extLength-20:], ".")
+	}
+
+	// name
+	//
+	// note: leading dot is trimmed to prevent various subtle issues with files
+	// sync programs as they sometimes have special handling for "invisible" files
+	// ---
+	cleanName := inflector.Snakecase(strings.Trim(strings.TrimSuffix(name, originalExt), "."))
+	if length := len(cleanName); length < 3 {
+		// the name is too short so we concatenate an additional random part
+		cleanName += security.RandomStringWithAlphabet(10, randomAlphabet)
+	} else if length > 100 {
+		// keep only the first 100 characters (it is multibyte safe after Snakecase)
+		cleanName = cleanName[:100]
+	}
+
+	return fmt.Sprintf(
+		"%s_%s%s",
+		cleanName,
+		security.RandomStringWithAlphabet(10, randomAlphabet), // ensure that there is always a random part
+		cleanExt,
+	)
+}
+
+// extractExtension extracts the extension (with leading dot) from name.
+//
+// This differ from filepath.Ext() by supporting double extensions (eg. ".tar.gz").
+//
+// Returns an empty string if no match is found.
+//
+// Example:
+// extractExtension("test.txt")      // .txt
+// extractExtension("test.tar.gz")   // .tar.gz
+// extractExtension("test.a.tar.gz") // .tar.gz
+func extractExtension(name string) string {
+	primaryDot := strings.LastIndex(name, ".")
+
+	if primaryDot == -1 {
+		return ""
+	}
+
+	// look for secondary extension
+	secondaryDot := strings.LastIndex(name[:primaryDot], ".")
+	if secondaryDot >= 0 {
+		return name[secondaryDot:]
+	}
+
+	return name[primaryDot:]
+}
+
+// detectExtension tries to detect the extension from file mime type.
+func detectExtension(fr FileReader) (string, error) {
+	r, err := fr.Open()
+	if err != nil {
+		return "", err
+	}
+	defer r.Close()
+
+	mt, err := mimetype.DetectReader(r)
+	if err != nil {
+		return "", err
+	}
+
+	return mt.Extension(), nil
+}
diff --git a/server/core_backend-server/tools/filesystem/file_test.go b/server/core_backend-server/tools/filesystem/file_test.go
new file mode 100644
index 0000000..b5bca2c
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/file_test.go
@@ -0,0 +1,236 @@
+package filesystem_test
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tests"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+)
+
+func TestFileAsMap(t *testing.T) {
+	file, err := filesystem.NewFileFromBytes([]byte("test"), "test123.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	result := file.AsMap()
+
+	if len(result) != 3 {
+		t.Fatalf("Expected map with %d keys, got\n%v", 3, result)
+	}
+
+	if result["size"] != int64(4) {
+		t.Fatalf("Expected size %d, got %#v", 4, result["size"])
+	}
+
+	if str, ok := result["name"].(string); !ok || !strings.HasPrefix(str, "test123") {
+		t.Fatalf("Expected name to have prefix %q, got %#v", "test123", result["name"])
+	}
+
+	if result["originalName"] != "test123.txt" {
+		t.Fatalf("Expected originalName %q, got %#v", "test123.txt", result["originalName"])
+	}
+}
+
+func TestNewFileFromPath(t *testing.T) {
+	testDir := createTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	// missing file
+	_, err := filesystem.NewFileFromPath("missing")
+	if err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	// existing file
+	originalName := "image_!@ special"
+	normalizedNamePattern := regexp.QuoteMeta("image_special_") + `\w{10}` + regexp.QuoteMeta(".png")
+	f, err := filesystem.NewFileFromPath(filepath.Join(testDir, originalName))
+	if err != nil {
+		t.Fatalf("Expected nil error, got %v", err)
+	}
+	if f.OriginalName != originalName {
+		t.Fatalf("Expected OriginalName %q, got %q", originalName, f.OriginalName)
+	}
+	if match, err := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
+		t.Fatalf("Expected Name to match %v, got %q (%v)", normalizedNamePattern, f.Name, err)
+	}
+	if f.Size != 73 {
+		t.Fatalf("Expected Size %v, got %v", 73, f.Size)
+	}
+	if _, ok := f.Reader.(*filesystem.PathReader); !ok {
+		t.Fatalf("Expected Reader to be PathReader, got %v", f.Reader)
+	}
+}
+
+func TestNewFileFromBytes(t *testing.T) {
+	// nil bytes
+	if _, err := filesystem.NewFileFromBytes(nil, "photo.jpg"); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	// zero bytes
+	if _, err := filesystem.NewFileFromBytes([]byte{}, "photo.jpg"); err == nil {
+		t.Fatal("Expected error, got nil")
+	}
+
+	originalName := "image_!@ special"
+	normalizedNamePattern := regexp.QuoteMeta("image_special_") + `\w{10}` + regexp.QuoteMeta(".txt")
+	f, err := filesystem.NewFileFromBytes([]byte("text\n"), originalName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if f.Size != 5 {
+		t.Fatalf("Expected Size %v, got %v", 5, f.Size)
+	}
+	if f.OriginalName != originalName {
+		t.Fatalf("Expected OriginalName %q, got %q", originalName, f.OriginalName)
+	}
+	if match, err := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
+		t.Fatalf("Expected Name to match %v, got %q (%v)", normalizedNamePattern, f.Name, err)
+	}
+}
+
+func TestNewFileFromMultipart(t *testing.T) {
+	formData, mp, err := tests.MockMultipartData(nil, "test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest("", "/", formData)
+	req.Header.Set("Content-Type", mp.FormDataContentType())
+	req.ParseMultipartForm(32 << 20)
+
+	_, mh, err := req.FormFile("test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f, err := filesystem.NewFileFromMultipart(mh)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	originalNamePattern := regexp.QuoteMeta("tmpfile-") + `\w+` + regexp.QuoteMeta(".txt")
+	if match, err := regexp.Match(originalNamePattern, []byte(f.OriginalName)); !match {
+		t.Fatalf("Expected OriginalName to match %v, got %q (%v)", originalNamePattern, f.OriginalName, err)
+	}
+
+	normalizedNamePattern := regexp.QuoteMeta("tmpfile_") + `\w+\_\w{10}` + regexp.QuoteMeta(".txt")
+	if match, err := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
+		t.Fatalf("Expected Name to match %v, got %q (%v)", normalizedNamePattern, f.Name, err)
+	}
+
+	if f.Size != 4 {
+		t.Fatalf("Expected Size %v, got %v", 4, f.Size)
+	}
+
+	if _, ok := f.Reader.(*filesystem.MultipartReader); !ok {
+		t.Fatalf("Expected Reader to be MultipartReader, got %v", f.Reader)
+	}
+}
+
+func TestNewFileFromURLTimeout(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/error" {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+
+		fmt.Fprintf(w, "test")
+	}))
+	defer srv.Close()
+
+	// cancelled context
+	{
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		f, err := filesystem.NewFileFromURL(ctx, srv.URL+"/cancel")
+		if err == nil {
+			t.Fatal("[ctx_cancel] Expected error, got nil")
+		}
+		if f != nil {
+			t.Fatalf("[ctx_cancel] Expected file to be nil, got %v", f)
+		}
+	}
+
+	// error response
+	{
+		f, err := filesystem.NewFileFromURL(context.Background(), srv.URL+"/error")
+		if err == nil {
+			t.Fatal("[error_status] Expected error, got nil")
+		}
+		if f != nil {
+			t.Fatalf("[error_status] Expected file to be nil, got %v", f)
+		}
+	}
+
+	// valid response
+	{
+		originalName := "image_!@ special"
+		normalizedNamePattern := regexp.QuoteMeta("image_special_") + `\w{10}` + regexp.QuoteMeta(".txt")
+
+		f, err := filesystem.NewFileFromURL(context.Background(), srv.URL+"/"+originalName)
+		if err != nil {
+			t.Fatalf("[valid] Unexpected error %v", err)
+		}
+		if f == nil {
+			t.Fatal("[valid] Expected non-nil file")
+		}
+
+		// check the created file fields
+		if f.OriginalName != originalName {
+			t.Fatalf("Expected OriginalName %q, got %q", originalName, f.OriginalName)
+		}
+		if match, err := regexp.Match(normalizedNamePattern, []byte(f.Name)); !match {
+			t.Fatalf("Expected Name to match %v, got %q (%v)", normalizedNamePattern, f.Name, err)
+		}
+		if f.Size != 4 {
+			t.Fatalf("Expected Size %v, got %v", 4, f.Size)
+		}
+		if _, ok := f.Reader.(*filesystem.BytesReader); !ok {
+			t.Fatalf("Expected Reader to be BytesReader, got %v", f.Reader)
+		}
+	}
+}
+
+func TestFileNameNormalizations(t *testing.T) {
+	scenarios := []struct {
+		name    string
+		pattern string
+	}{
+		{"", `^\w{10}_\w{10}\.txt$`},
+		{".png", `^\w{10}_\w{10}\.png$`},
+		{".tar.gz", `^\w{10}_\w{10}\.tar\.gz$`},
+		{"a.tar.gz", `^a\w{10}_\w{10}\.tar\.gz$`},
+		{"....abc", `^\w{10}_\w{10}\.abc$`},
+		{"a.b.c.?.?.?.2", `^a_b_c_\w{10}\.2$`},
+		{"a.b.c.d.tar.gz", `^a_b_c_d_\w{10}\.tar\.gz$`},
+		{"abcd", `^abcd_\w{10}\.txt$`},
+		{".abcd.123.", `^abcd_\w{10}\.123$`},
+		{"a  b! c d  . 456", `^a_b_c_d_\w{10}\.456$`},                                              // normalize spaces
+		{strings.Repeat("a", 101) + "." + strings.Repeat("b", 21), `^a{100}_\w{10}\.b{20}$`},       // name and extension length cut
+		{"abc" + strings.Repeat("d", 290) + "." + strings.Repeat("b", 9), `^d{100}_\w{10}\.b{9}$`}, // initial total length cut
+	}
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i)+"_"+s.name, func(t *testing.T) {
+			f, err := filesystem.NewFileFromBytes([]byte("abc"), s.name)
+			if err != nil {
+				t.Fatal(err)
+			}
+			match, err := regexp.Match(s.pattern, []byte(f.Name))
+			if !match {
+				t.Fatalf("Expected Name to match %v, got %q (%v)", s.pattern, f.Name, err)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/filesystem.go b/server/core_backend-server/tools/filesystem/filesystem.go
new file mode 100644
index 0000000..2f11584
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/filesystem.go
@@ -0,0 +1,577 @@
+package filesystem
+
+import (
+	"context"
+	"errors"
+	"image"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/disintegration/imaging"
+	"github.com/fatih/color"
+	"github.com/gabriel-vasile/mimetype"
+	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/fileblob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/list"
+
+	// explicit webp decoder because disintegration/imaging does not support webp
+	_ "golang.org/x/image/webp"
+)
+
+// note: the same as blob.ErrNotFound for backward compatibility with earlier versions
+var ErrNotFound = blob.ErrNotFound
+
+const metadataOriginalName = "original-filename"
+
+type System struct {
+	ctx    context.Context
+	bucket *blob.Bucket
+}
+
+// NewS3 initializes an S3 filesystem instance.
+//
+// NB! Make sure to call `Close()` after you are done working with it.
+func NewS3(
+	bucketName string,
+	region string,
+	endpoint string,
+	accessKey string,
+	secretKey string,
+	s3ForcePathStyle bool,
+) (*System, error) {
+	ctx := context.Background() // default context
+
+	client := &s3.S3{
+		Bucket:       bucketName,
+		Region:       region,
+		Endpoint:     endpoint,
+		AccessKey:    accessKey,
+		SecretKey:    secretKey,
+		UsePathStyle: s3ForcePathStyle,
+	}
+
+	drv, err := s3blob.New(client)
+	if err != nil {
+		return nil, err
+	}
+
+	return &System{ctx: ctx, bucket: blob.NewBucket(drv)}, nil
+}
+
+// NewLocal initializes a new local filesystem instance.
+//
+// NB! Make sure to call `Close()` after you are done working with it.
+func NewLocal(dirPath string) (*System, error) {
+	ctx := context.Background() // default context
+
+	// makes sure that the directory exist
+	if err := os.MkdirAll(dirPath, os.ModePerm); err != nil {
+		return nil, err
+	}
+
+	drv, err := fileblob.New(dirPath, &fileblob.Options{
+		NoTempDir: true,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &System{ctx: ctx, bucket: blob.NewBucket(drv)}, nil
+}
+
+// SetContext assigns the specified context to the current filesystem.
+func (s *System) SetContext(ctx context.Context) {
+	s.ctx = ctx
+}
+
+// Close releases any resources used for the related filesystem.
+func (s *System) Close() error {
+	return s.bucket.Close()
+}
+
+// Exists checks if file with fileKey path exists or not.
+func (s *System) Exists(fileKey string) (bool, error) {
+	return s.bucket.Exists(s.ctx, fileKey)
+}
+
+// Attributes returns the attributes for the file with fileKey path.
+//
+// If the file doesn't exist it returns ErrNotFound.
+func (s *System) Attributes(fileKey string) (*blob.Attributes, error) {
+	return s.bucket.Attributes(s.ctx, fileKey)
+}
+
+// GetReader returns a file content reader for the given fileKey.
+//
+// NB! Make sure to call Close() on the file after you are done working with it.
+//
+// If the file doesn't exist returns ErrNotFound.
+func (s *System) GetReader(fileKey string) (*blob.Reader, error) {
+	return s.bucket.NewReader(s.ctx, fileKey)
+}
+
+// Deprecated: Please use GetReader(fileKey) instead.
+func (s *System) GetFile(fileKey string) (*blob.Reader, error) {
+	color.Yellow("Deprecated: Please replace GetFile with GetReader.")
+	return s.GetReader(fileKey)
+}
+
+// GetReuploadableFile constructs a new reuploadable File value
+// from the associated fileKey blob.Reader.
+//
+// If preserveName is false then the returned File.Name will have
+// a new randomly generated suffix, otherwise it will reuse the original one.
+//
+// This method could be useful in case you want to clone an existing
+// Record file and assign it to a new Record (e.g. in a Record duplicate action).
+//
+// If you simply want to copy an existing file to a new location you
+// could check the Copy(srcKey, dstKey) method.
+func (s *System) GetReuploadableFile(fileKey string, preserveName bool) (*File, error) {
+	attrs, err := s.Attributes(fileKey)
+	if err != nil {
+		return nil, err
+	}
+
+	name := path.Base(fileKey)
+	originalName := attrs.Metadata[metadataOriginalName]
+	if originalName == "" {
+		originalName = name
+	}
+
+	file := &File{}
+	file.Size = attrs.Size
+	file.OriginalName = originalName
+	file.Reader = openFuncAsReader(func() (io.ReadSeekCloser, error) {
+		return s.GetReader(fileKey)
+	})
+
+	if preserveName {
+		file.Name = name
+	} else {
+		file.Name = normalizeName(file.Reader, originalName)
+	}
+
+	return file, nil
+}
+
+// Copy copies the file stored at srcKey to dstKey.
+//
+// If srcKey file doesn't exist, it returns ErrNotFound.
+//
+// If dstKey file already exists, it is overwritten.
+func (s *System) Copy(srcKey, dstKey string) error {
+	return s.bucket.Copy(s.ctx, dstKey, srcKey)
+}
+
+// List returns a flat list with info for all files under the specified prefix.
+func (s *System) List(prefix string) ([]*blob.ListObject, error) {
+	files := []*blob.ListObject{}
+
+	iter := s.bucket.List(&blob.ListOptions{
+		Prefix: prefix,
+	})
+
+	for {
+		obj, err := iter.Next(s.ctx)
+		if err != nil {
+			if !errors.Is(err, io.EOF) {
+				return nil, err
+			}
+			break
+		}
+		files = append(files, obj)
+	}
+
+	return files, nil
+}
+
+// Upload writes content into the fileKey location.
+func (s *System) Upload(content []byte, fileKey string) error {
+	opts := &blob.WriterOptions{
+		ContentType: mimetype.Detect(content).String(),
+	}
+
+	w, writerErr := s.bucket.NewWriter(s.ctx, fileKey, opts)
+	if writerErr != nil {
+		return writerErr
+	}
+
+	if _, err := w.Write(content); err != nil {
+		return errors.Join(err, w.Close())
+	}
+
+	return w.Close()
+}
+
+// UploadFile uploads the provided File to the fileKey location.
+func (s *System) UploadFile(file *File, fileKey string) error {
+	f, err := file.Reader.Open()
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	mt, err := mimetype.DetectReader(f)
+	if err != nil {
+		return err
+	}
+
+	// rewind
+	f.Seek(0, io.SeekStart)
+
+	originalName := file.OriginalName
+	if len(originalName) > 255 {
+		// keep only the first 255 chars as a very rudimentary measure
+		// to prevent the metadata to grow too big in size
+		originalName = originalName[:255]
+	}
+	opts := &blob.WriterOptions{
+		ContentType: mt.String(),
+		Metadata: map[string]string{
+			metadataOriginalName: originalName,
+		},
+	}
+
+	w, err := s.bucket.NewWriter(s.ctx, fileKey, opts)
+	if err != nil {
+		return err
+	}
+
+	if _, err := w.ReadFrom(f); err != nil {
+		w.Close()
+		return err
+	}
+
+	return w.Close()
+}
+
+// UploadMultipart uploads the provided multipart file to the fileKey location.
+func (s *System) UploadMultipart(fh *multipart.FileHeader, fileKey string) error {
+	f, err := fh.Open()
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	mt, err := mimetype.DetectReader(f)
+	if err != nil {
+		return err
+	}
+
+	// rewind
+	f.Seek(0, io.SeekStart)
+
+	originalName := fh.Filename
+	if len(originalName) > 255 {
+		// keep only the first 255 chars as a very rudimentary measure
+		// to prevent the metadata to grow too big in size
+		originalName = originalName[:255]
+	}
+	opts := &blob.WriterOptions{
+		ContentType: mt.String(),
+		Metadata: map[string]string{
+			metadataOriginalName: originalName,
+		},
+	}
+
+	w, err := s.bucket.NewWriter(s.ctx, fileKey, opts)
+	if err != nil {
+		return err
+	}
+
+	_, err = w.ReadFrom(f)
+	if err != nil {
+		w.Close()
+		return err
+	}
+
+	return w.Close()
+}
+
+// Delete deletes stored file at fileKey location.
+//
+// If the file doesn't exist returns ErrNotFound.
+func (s *System) Delete(fileKey string) error {
+	return s.bucket.Delete(s.ctx, fileKey)
+}
+
+// DeletePrefix deletes everything starting with the specified prefix.
+//
+// The prefix could be subpath (ex. "/a/b/") or filename prefix (ex. "/a/b/file_").
+func (s *System) DeletePrefix(prefix string) []error {
+	failed := []error{}
+
+	if prefix == "" {
+		failed = append(failed, errors.New("prefix mustn't be empty"))
+		return failed
+	}
+
+	dirsMap := map[string]struct{}{}
+
+	var isPrefixDir bool
+
+	// treat the prefix as directory only if it ends with trailing slash
+	if strings.HasSuffix(prefix, "/") {
+		isPrefixDir = true
+		dirsMap[strings.TrimRight(prefix, "/")] = struct{}{}
+	}
+
+	// delete all files with the prefix
+	// ---
+	iter := s.bucket.List(&blob.ListOptions{
+		Prefix: prefix,
+	})
+	for {
+		obj, err := iter.Next(s.ctx)
+		if err != nil {
+			if !errors.Is(err, io.EOF) {
+				failed = append(failed, err)
+			}
+			break
+		}
+
+		if err := s.Delete(obj.Key); err != nil {
+			failed = append(failed, err)
+		} else if isPrefixDir {
+			slashIdx := strings.LastIndex(obj.Key, "/")
+			if slashIdx > -1 {
+				dirsMap[obj.Key[:slashIdx]] = struct{}{}
+			}
+		}
+	}
+	// ---
+
+	// try to delete the empty remaining dir objects
+	// (this operation usually is optional and there is no need to strictly check the result)
+	// ---
+	// fill dirs slice
+	dirs := make([]string, 0, len(dirsMap))
+	for d := range dirsMap {
+		dirs = append(dirs, d)
+	}
+
+	// sort the child dirs first, aka. ["a/b/c", "a/b", "a"]
+	sort.SliceStable(dirs, func(i, j int) bool {
+		return len(strings.Split(dirs[i], "/")) > len(strings.Split(dirs[j], "/"))
+	})
+
+	// delete dirs
+	for _, d := range dirs {
+		if d != "" {
+			s.Delete(d)
+		}
+	}
+	// ---
+
+	return failed
+}
+
+// Checks if the provided dir prefix doesn't have any files.
+//
+// A trailing slash will be appended to a non-empty dir string argument
+// to ensure that the checked prefix is a "directory".
+//
+// Returns "false" in case the has at least one file, otherwise - "true".
+func (s *System) IsEmptyDir(dir string) bool {
+	if dir != "" && !strings.HasSuffix(dir, "/") {
+		dir += "/"
+	}
+
+	iter := s.bucket.List(&blob.ListOptions{
+		Prefix: dir,
+	})
+
+	_, err := iter.Next(s.ctx)
+
+	return err != nil && errors.Is(err, io.EOF)
+}
+
+var inlineServeContentTypes = []string{
+	// image
+	"image/png", "image/jpg", "image/jpeg", "image/gif", "image/webp", "image/x-icon", "image/bmp",
+	// video
+	"video/webm", "video/mp4", "video/3gpp", "video/quicktime", "video/x-ms-wmv",
+	// audio
+	"audio/basic", "audio/aiff", "audio/mpeg", "audio/midi", "audio/mp3", "audio/wave",
+	"audio/wav", "audio/x-wav", "audio/x-mpeg", "audio/x-m4a", "audio/aac",
+	// document
+	"application/pdf", "application/x-pdf",
+}
+
+// manualExtensionContentTypes is a map of file extensions to content types.
+var manualExtensionContentTypes = map[string]string{
+	".svg": "image/svg+xml",   // (see https://github.com/whatwg/mimesniff/issues/7)
+	".css": "text/css",        // (see https://github.com/gabriel-vasile/mimetype/pull/113)
+	".js":  "text/javascript", // (see https://github.com/pocketbase/pocketbase/issues/6597)
+	".mjs": "text/javascript",
+}
+
+// forceAttachmentParam is the name of the request query parameter to
+// force "Content-Disposition: attachment" header.
+const forceAttachmentParam = "download"
+
+// Serve serves the file at fileKey location to an HTTP response.
+//
+// If the `download` query parameter is used the file will be always served for
+// download no matter of its type (aka. with "Content-Disposition: attachment").
+//
+// Internally this method uses [http.ServeContent] so Range requests,
+// If-Match, If-Unmodified-Since, etc. headers are handled transparently.
+func (s *System) Serve(res http.ResponseWriter, req *http.Request, fileKey string, name string) error {
+	br, readErr := s.GetReader(fileKey)
+	if readErr != nil {
+		return readErr
+	}
+	defer br.Close()
+
+	var forceAttachment bool
+	if raw := req.URL.Query().Get(forceAttachmentParam); raw != "" {
+		forceAttachment, _ = strconv.ParseBool(raw)
+	}
+
+	disposition := "attachment"
+	realContentType := br.ContentType()
+	if !forceAttachment && list.ExistInSlice(realContentType, inlineServeContentTypes) {
+		disposition = "inline"
+	}
+
+	// make an exception for specific content types and force a custom
+	// content type to send in the response so that it can be loaded properly
+	extContentType := realContentType
+	if ct, found := manualExtensionContentTypes[filepath.Ext(name)]; found {
+		extContentType = ct
+	}
+
+	setHeaderIfMissing(res, "Content-Disposition", disposition+"; filename="+name)
+	setHeaderIfMissing(res, "Content-Type", extContentType)
+	setHeaderIfMissing(res, "Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'unsafe-inline'; sandbox")
+
+	// set a default cache-control header
+	// (valid for 30 days but the cache is allowed to reuse the file for any requests
+	// that are made in the last day while revalidating the res in the background)
+	setHeaderIfMissing(res, "Cache-Control", "max-age=2592000, stale-while-revalidate=86400")
+
+	http.ServeContent(res, req, name, br.ModTime(), br)
+
+	return nil
+}
+
+// note: expects key to be in a canonical form (eg. "accept-encoding" should be "Accept-Encoding").
+func setHeaderIfMissing(res http.ResponseWriter, key string, value string) {
+	if _, ok := res.Header()[key]; !ok {
+		res.Header().Set(key, value)
+	}
+}
+
+var ThumbSizeRegex = regexp.MustCompile(`^(\d+)x(\d+)(t|b|f)?$`)
+
+// CreateThumb creates a new thumb image for the file at originalKey location.
+// The new thumb file is stored at thumbKey location.
+//
+// thumbSize is in the format:
+// - 0xH  (eg. 0x100)    - resize to H height preserving the aspect ratio
+// - Wx0  (eg. 300x0)    - resize to W width preserving the aspect ratio
+// - WxH  (eg. 300x100)  - resize and crop to WxH viewbox (from center)
+// - WxHt (eg. 300x100t) - resize and crop to WxH viewbox (from top)
+// - WxHb (eg. 300x100b) - resize and crop to WxH viewbox (from bottom)
+// - WxHf (eg. 300x100f) - fit inside a WxH viewbox (without cropping)
+func (s *System) CreateThumb(originalKey string, thumbKey, thumbSize string) error {
+	sizeParts := ThumbSizeRegex.FindStringSubmatch(thumbSize)
+	if len(sizeParts) != 4 {
+		return errors.New("thumb size must be in WxH, WxHt, WxHb or WxHf format")
+	}
+
+	width, _ := strconv.Atoi(sizeParts[1])
+	height, _ := strconv.Atoi(sizeParts[2])
+	resizeType := sizeParts[3]
+
+	if width == 0 && height == 0 {
+		return errors.New("thumb width and height cannot be zero at the same time")
+	}
+
+	// fetch the original
+	r, readErr := s.GetReader(originalKey)
+	if readErr != nil {
+		return readErr
+	}
+	defer r.Close()
+
+	// create imaging object from the original reader
+	// (note: only the first frame for animated image formats)
+	img, decodeErr := imaging.Decode(r, imaging.AutoOrientation(true))
+	if decodeErr != nil {
+		return decodeErr
+	}
+
+	var thumbImg *image.NRGBA
+
+	if width == 0 || height == 0 {
+		// force resize preserving aspect ratio
+		thumbImg = imaging.Resize(img, width, height, imaging.Linear)
+	} else {
+		switch resizeType {
+		case "f":
+			// fit
+			thumbImg = imaging.Fit(img, width, height, imaging.Linear)
+		case "t":
+			// fill and crop from top
+			thumbImg = imaging.Fill(img, width, height, imaging.Top, imaging.Linear)
+		case "b":
+			// fill and crop from bottom
+			thumbImg = imaging.Fill(img, width, height, imaging.Bottom, imaging.Linear)
+		default:
+			// fill and crop from center
+			thumbImg = imaging.Fill(img, width, height, imaging.Center, imaging.Linear)
+		}
+	}
+
+	originalContentType := r.ContentType()
+
+	opts := &blob.WriterOptions{
+		ContentType: originalContentType,
+	}
+
+	var format imaging.Format
+
+	switch originalContentType {
+	case "image/jpeg":
+		format = imaging.JPEG
+	case "image/gif":
+		format = imaging.GIF
+	case "image/tiff":
+		format = imaging.TIFF
+	case "image/bmp":
+		format = imaging.BMP
+	default:
+		// fallback to PNG (this includes webp!)
+		opts.ContentType = "image/png"
+		format = imaging.PNG
+	}
+
+	// open a thumb storage writer (aka. prepare for upload)
+	w, err := s.bucket.NewWriter(s.ctx, thumbKey, opts)
+	if err != nil {
+		return err
+	}
+
+	// thumb encode (aka. upload)
+	err = imaging.Encode(w, thumbImg, format)
+	if err != nil {
+		w.Close()
+		return err
+	}
+
+	// check for close errors to ensure that the thumb was really saved
+	return w.Close()
+}
diff --git a/server/core_backend-server/tools/filesystem/filesystem_test.go b/server/core_backend-server/tools/filesystem/filesystem_test.go
new file mode 100644
index 0000000..c530e25
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/filesystem_test.go
@@ -0,0 +1,1045 @@
+package filesystem_test
+
+import (
+	"bytes"
+	"errors"
+	"image"
+	"image/jpeg"
+	"image/png"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gabriel-vasile/mimetype"
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+)
+
+func TestFileSystemExists(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	scenarios := []struct {
+		file   string
+		exists bool
+	}{
+		{"sub1.txt", false},
+		{"test/sub1.txt", true},
+		{"test/sub2.txt", true},
+		{"image.png", true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.file, func(t *testing.T) {
+			exists, err := fsys.Exists(s.file)
+
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if exists != s.exists {
+				t.Fatalf("Expected exists %v, got %v", s.exists, exists)
+			}
+		})
+	}
+}
+
+func TestFileSystemAttributes(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	scenarios := []struct {
+		file              string
+		expectError       bool
+		expectContentType string
+	}{
+		{"sub1.txt", true, ""},
+		{"test/sub1.txt", false, "application/octet-stream"},
+		{"test/sub2.txt", false, "application/octet-stream"},
+		{"image.png", false, "image/png"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.file, func(t *testing.T) {
+			attr, err := fsys.Attributes(s.file)
+
+			hasErr := err != nil
+
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+
+			if hasErr && !errors.Is(err, filesystem.ErrNotFound) {
+				t.Fatalf("Expected ErrNotFound err, got %q", err)
+			}
+
+			if !hasErr && attr.ContentType != s.expectContentType {
+				t.Fatalf("Expected attr.ContentType to be %q, got %q", s.expectContentType, attr.ContentType)
+			}
+		})
+	}
+}
+
+func TestFileSystemDelete(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	if err := fsys.Delete("missing.txt"); err == nil || !errors.Is(err, filesystem.ErrNotFound) {
+		t.Fatalf("Expected ErrNotFound error, got %v", err)
+	}
+
+	if err := fsys.Delete("image.png"); err != nil {
+		t.Fatalf("Expected nil, got error %v", err)
+	}
+}
+
+func TestFileSystemDeletePrefixWithoutTrailingSlash(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	if errs := fsys.DeletePrefix(""); len(errs) == 0 {
+		t.Fatal("Expected error, got nil", errs)
+	}
+
+	if errs := fsys.DeletePrefix("missing"); len(errs) != 0 {
+		t.Fatalf("Not existing prefix shouldn't error, got %v", errs)
+	}
+
+	if errs := fsys.DeletePrefix("test"); len(errs) != 0 {
+		t.Fatalf("Expected nil, got errors %v", errs)
+	}
+
+	// ensure that the test/* files are deleted
+	if exists, _ := fsys.Exists("test/sub1.txt"); exists {
+		t.Fatalf("Expected test/sub1.txt to be deleted")
+	}
+	if exists, _ := fsys.Exists("test/sub2.txt"); exists {
+		t.Fatalf("Expected test/sub2.txt to be deleted")
+	}
+
+	// the test directory should remain since the prefix didn't have trailing slash
+	if _, err := os.Stat(filepath.Join(dir, "test")); os.IsNotExist(err) {
+		t.Fatal("Expected the prefix dir to remain")
+	}
+}
+
+func TestFileSystemDeletePrefixWithTrailingSlash(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	if errs := fsys.DeletePrefix("missing/"); len(errs) != 0 {
+		t.Fatalf("Not existing prefix shouldn't error, got %v", errs)
+	}
+
+	if errs := fsys.DeletePrefix("test/"); len(errs) != 0 {
+		t.Fatalf("Expected nil, got errors %v", errs)
+	}
+
+	// ensure that the test/* files are deleted
+	if exists, _ := fsys.Exists("test/sub1.txt"); exists {
+		t.Fatalf("Expected test/sub1.txt to be deleted")
+	}
+	if exists, _ := fsys.Exists("test/sub2.txt"); exists {
+		t.Fatalf("Expected test/sub2.txt to be deleted")
+	}
+
+	// the test directory should be also deleted since the prefix has trailing slash
+	if _, err := os.Stat(filepath.Join(dir, "test")); !os.IsNotExist(err) {
+		t.Fatal("Expected the prefix dir to be deleted")
+	}
+}
+
+func TestFileSystemIsEmptyDir(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	scenarios := []struct {
+		dir      string
+		expected bool
+	}{
+		{"", false}, // special case that shouldn't be suffixed with delimiter to search for any files within the bucket
+		{"/", true},
+		{"missing", true},
+		{"missing/", true},
+		{"test", false},
+		{"test/", false},
+		{"empty", true},
+		{"empty/", true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.dir, func(t *testing.T) {
+			result := fsys.IsEmptyDir(s.dir)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestFileSystemUploadMultipart(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	// create multipart form file
+	body := new(bytes.Buffer)
+	mp := multipart.NewWriter(body)
+	w, err := mp.CreateFormFile("test", "test")
+	if err != nil {
+		t.Fatalf("Failed creating form file: %v", err)
+	}
+	w.Write([]byte("demo"))
+	mp.Close()
+
+	req := httptest.NewRequest(http.MethodPost, "/", body)
+	req.Header.Add("Content-Type", mp.FormDataContentType())
+
+	file, fh, err := req.FormFile("test")
+	if err != nil {
+		t.Fatalf("Failed to fetch form file: %v", err)
+	}
+	defer file.Close()
+	// ---
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	fileKey := "newdir/newkey.txt"
+
+	uploadErr := fsys.UploadMultipart(fh, fileKey)
+	if uploadErr != nil {
+		t.Fatal(uploadErr)
+	}
+
+	if exists, _ := fsys.Exists(fileKey); !exists {
+		t.Fatalf("Expected %q to exist", fileKey)
+	}
+
+	attrs, err := fsys.Attributes(fileKey)
+	if err != nil {
+		t.Fatalf("Failed to fetch file attributes: %v", err)
+	}
+	if name, ok := attrs.Metadata["original-filename"]; !ok || name != "test" {
+		t.Fatalf("Expected original-filename to be %q, got %q", "test", name)
+	}
+}
+
+func TestFileSystemUploadFile(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	fileKey := "newdir/newkey.txt"
+
+	file, err := filesystem.NewFileFromPath(filepath.Join(dir, "image.svg"))
+	if err != nil {
+		t.Fatalf("Failed to load test file: %v", err)
+	}
+
+	file.OriginalName = "test.txt"
+
+	uploadErr := fsys.UploadFile(file, fileKey)
+	if uploadErr != nil {
+		t.Fatal(uploadErr)
+	}
+
+	if exists, _ := fsys.Exists(fileKey); !exists {
+		t.Fatalf("Expected %q to exist", fileKey)
+	}
+
+	attrs, err := fsys.Attributes(fileKey)
+	if err != nil {
+		t.Fatalf("Failed to fetch file attributes: %v", err)
+	}
+	if name, ok := attrs.Metadata["original-filename"]; !ok || name != file.OriginalName {
+		t.Fatalf("Expected original-filename to be %q, got %q", file.OriginalName, name)
+	}
+}
+
+func TestFileSystemUpload(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	fileKey := "newdir/newkey.txt"
+
+	uploadErr := fsys.Upload([]byte("demo"), fileKey)
+	if uploadErr != nil {
+		t.Fatal(uploadErr)
+	}
+
+	if exists, _ := fsys.Exists(fileKey); !exists {
+		t.Fatalf("Expected %s to exist", fileKey)
+	}
+}
+
+func TestFileSystemServe(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	csp := "default-src 'none'; media-src 'self'; style-src 'unsafe-inline'; sandbox"
+	cacheControl := "max-age=2592000, stale-while-revalidate=86400"
+
+	scenarios := []struct {
+		path          string
+		name          string
+		query         map[string]string
+		headers       map[string]string
+		expectError   bool
+		expectHeaders map[string]string
+	}{
+		{
+			// missing
+			"missing.txt",
+			"test_name.txt",
+			nil,
+			nil,
+			true,
+			nil,
+		},
+		{
+			// existing regular file
+			"test/sub1.txt",
+			"test_name.txt",
+			nil,
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "attachment; filename=test_name.txt",
+				"Content-Type":            "application/octet-stream",
+				"Content-Length":          "4",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
+		{
+			// png inline
+			"image.png",
+			"test_name.png",
+			nil,
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "inline; filename=test_name.png",
+				"Content-Type":            "image/png",
+				"Content-Length":          "73",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
+		{
+			// png with forced attachment
+			"image.png",
+			"test_name_download.png",
+			map[string]string{"download": "1"},
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "attachment; filename=test_name_download.png",
+				"Content-Type":            "image/png",
+				"Content-Length":          "73",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
+		{
+			// svg exception
+			"image.svg",
+			"test_name.svg",
+			nil,
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "attachment; filename=test_name.svg",
+				"Content-Type":            "image/svg+xml",
+				"Content-Length":          "0",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
+		{
+			// css exception
+			"style.css",
+			"test_name.css",
+			nil,
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "attachment; filename=test_name.css",
+				"Content-Type":            "text/css",
+				"Content-Length":          "0",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
+		{
+			// js exception
+			"main.js",
+			"test_name.js",
+			nil,
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "attachment; filename=test_name.js",
+				"Content-Type":            "text/javascript",
+				"Content-Length":          "0",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
+		{
+			// mjs exception
+			"main.mjs",
+			"test_name.mjs",
+			nil,
+			nil,
+			false,
+			map[string]string{
+				"Content-Disposition":     "attachment; filename=test_name.mjs",
+				"Content-Type":            "text/javascript",
+				"Content-Length":          "0",
+				"Content-Security-Policy": csp,
+				"Cache-Control":           cacheControl,
+			},
+		},
+		{
+			// custom header
+			"test/sub2.txt",
+			"test_name.txt",
+			nil,
+			map[string]string{
+				"Content-Disposition":     "1",
+				"Content-Type":            "2",
+				"Content-Length":          "1",
+				"Content-Security-Policy": "4",
+				"Cache-Control":           "5",
+				"X-Custom":                "6",
+			},
+			false,
+			map[string]string{
+				"Content-Disposition":     "1",
+				"Content-Type":            "2",
+				"Content-Length":          "4", // overwriten by http.ServeContent
+				"Content-Security-Policy": "4",
+				"Cache-Control":           "5",
+				"X-Custom":                "6",
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.path, func(t *testing.T) {
+			res := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/", nil)
+
+			query := req.URL.Query()
+			for k, v := range s.query {
+				query.Set(k, v)
+			}
+			req.URL.RawQuery = query.Encode()
+
+			for k, v := range s.headers {
+				res.Header().Set(k, v)
+			}
+
+			err := fsys.Serve(res, req, s.path, s.name)
+			hasErr := err != nil
+
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasError %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if s.expectError {
+				return
+			}
+
+			result := res.Result()
+			defer result.Body.Close()
+
+			for hName, hValue := range s.expectHeaders {
+				v := result.Header.Get(hName)
+				if v != hValue {
+					t.Errorf("Expected value %q for header %q, got %q", hValue, hName, v)
+				}
+			}
+		})
+	}
+}
+
+func TestFileSystemGetReader(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	scenarios := []struct {
+		file            string
+		expectError     bool
+		expectedContent string
+	}{
+		{"test/missing.txt", true, ""},
+		{"test/sub1.txt", false, "sub1"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.file, func(t *testing.T) {
+			f, err := fsys.GetReader(s.file)
+			defer func() {
+				if f != nil {
+					f.Close()
+				}
+			}()
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+
+			if hasErr {
+				if !errors.Is(err, filesystem.ErrNotFound) {
+					t.Fatalf("Expected ErrNotFound error, got %v", err)
+				}
+				return
+			}
+
+			raw, err := io.ReadAll(f)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if str := string(raw); str != s.expectedContent {
+				t.Fatalf("Expected content\n%s\ngot\n%s", s.expectedContent, str)
+			}
+		})
+	}
+}
+
+func TestFileSystemGetReuploadableFile(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	t.Run("missing.txt", func(t *testing.T) {
+		_, err := fsys.GetReuploadableFile("missing.txt", false)
+		if err == nil {
+			t.Fatal("Expected error, got nil")
+		}
+	})
+
+	testReader := func(t *testing.T, f *filesystem.File, expectedContent string) {
+		r, err := f.Reader.Open()
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer r.Close()
+
+		raw, err := io.ReadAll(r)
+		if err != nil {
+			t.Fatal(err)
+		}
+		rawStr := string(raw)
+
+		if rawStr != expectedContent {
+			t.Fatalf("Expected content %q, got %q", expectedContent, rawStr)
+		}
+	}
+
+	t.Run("existing (preserve name)", func(t *testing.T) {
+		file, err := fsys.GetReuploadableFile("test/sub1.txt", true)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if v := file.OriginalName; v != "sub1.txt" {
+			t.Fatalf("Expected originalName %q, got %q", "sub1.txt", v)
+		}
+
+		if v := file.Size; v != 4 {
+			t.Fatalf("Expected size %d, got %d", 4, v)
+		}
+
+		if v := file.Name; v != "sub1.txt" {
+			t.Fatalf("Expected name to be preserved, got %q", v)
+		}
+
+		testReader(t, file, "sub1")
+	})
+
+	t.Run("existing (new random suffix name)", func(t *testing.T) {
+		file, err := fsys.GetReuploadableFile("test/sub1.txt", false)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if v := file.OriginalName; v != "sub1.txt" {
+			t.Fatalf("Expected originalName %q, got %q", "sub1.txt", v)
+		}
+
+		if v := file.Size; v != 4 {
+			t.Fatalf("Expected size %d, got %d", 4, v)
+		}
+
+		if v := file.Name; v == "sub1.txt" || len(v) <= len("sub1.txt.png") {
+			t.Fatalf("Expected name to have new random suffix, got %q", v)
+		}
+
+		testReader(t, file, "sub1")
+	})
+}
+
+func TestFileSystemCopy(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	src := "image.png"
+	dst := "image.png_copy"
+
+	// copy missing file
+	if err := fsys.Copy(dst, src); err == nil {
+		t.Fatalf("Expected to fail copying %q to %q, got nil", dst, src)
+	}
+
+	// copy existing file
+	if err := fsys.Copy(src, dst); err != nil {
+		t.Fatalf("Failed to copy %q to %q: %v", src, dst, err)
+	}
+
+	f, err := fsys.GetReader(dst)
+	if err != nil {
+		t.Fatalf("Missing copied file %q: %v", dst, err)
+	}
+	defer f.Close()
+
+	if f.Size() != 73 {
+		t.Fatalf("Expected file size %d, got %d", 73, f.Size())
+	}
+}
+
+func TestFileSystemList(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	scenarios := []struct {
+		prefix   string
+		expected []string
+	}{
+		{
+			"",
+			[]string{
+				"image.png",
+				"image.jpg",
+				"image.svg",
+				"image.webp",
+				"image_!@ special",
+				"image_noext",
+				"style.css",
+				"main.js",
+				"main.mjs",
+				"test/sub1.txt",
+				"test/sub2.txt",
+			},
+		},
+		{
+			"test",
+			[]string{
+				"test/sub1.txt",
+				"test/sub2.txt",
+			},
+		},
+		{
+			"missing",
+			[]string{},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run("prefix_"+s.prefix, func(t *testing.T) {
+			objs, err := fsys.List(s.prefix)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(s.expected) != len(objs) {
+				t.Fatalf("Expected %d files, got \n%v", len(s.expected), objs)
+			}
+
+			for _, obj := range objs {
+				var exists bool
+				for _, name := range s.expected {
+					if name == obj.Key {
+						exists = true
+						break
+					}
+				}
+
+				if !exists {
+					t.Fatalf("Unexpected file %q", obj.Key)
+				}
+			}
+		})
+	}
+}
+
+func TestFileSystemServeSingleRange(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	res := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/", nil)
+	req.Header.Add("Range", "bytes=0-20")
+
+	if err := fsys.Serve(res, req, "image.png", "image.png"); err != nil {
+		t.Fatal(err)
+	}
+
+	result := res.Result()
+
+	if result.StatusCode != http.StatusPartialContent {
+		t.Fatalf("Expected StatusCode %d, got %d", http.StatusPartialContent, result.StatusCode)
+	}
+
+	expectedRange := "bytes 0-20/73"
+	if cr := result.Header.Get("Content-Range"); cr != expectedRange {
+		t.Fatalf("Expected Content-Range %q, got %q", expectedRange, cr)
+	}
+
+	if l := result.Header.Get("Content-Length"); l != "21" {
+		t.Fatalf("Expected Content-Length %v, got %v", 21, l)
+	}
+}
+
+func TestFileSystemServeMultiRange(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	res := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/", nil)
+	req.Header.Add("Range", "bytes=0-20, 25-30")
+
+	if err := fsys.Serve(res, req, "image.png", "image.png"); err != nil {
+		t.Fatal(err)
+	}
+
+	result := res.Result()
+
+	if result.StatusCode != http.StatusPartialContent {
+		t.Fatalf("Expected StatusCode %d, got %d", http.StatusPartialContent, result.StatusCode)
+	}
+
+	if ct := result.Header.Get("Content-Type"); !strings.HasPrefix(ct, "multipart/byteranges; boundary=") {
+		t.Fatalf("Expected Content-Type to be multipart/byteranges, got %v", ct)
+	}
+}
+
+func TestFileSystemCreateThumb(t *testing.T) {
+	dir := createTestDir(t)
+	defer os.RemoveAll(dir)
+
+	fsys, err := filesystem.NewLocal(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fsys.Close()
+
+	scenarios := []struct {
+		file             string
+		thumb            string
+		size             string
+		expectedMimeType string
+	}{
+		// missing
+		{"missing.txt", "thumb_test_missing", "100x100", ""},
+		// non-image existing file
+		{"test/sub1.txt", "thumb_test_sub1", "100x100", ""},
+		// existing image file with existing thumb path = should fail
+		{"image.png", "test", "100x100", ""},
+		// existing image file with invalid thumb size
+		{"image.png", "thumb0", "invalid", ""},
+		// existing image file with 0xH thumb size
+		{"image.png", "thumb_0xH", "0x100", "image/png"},
+		// existing image file with Wx0 thumb size
+		{"image.png", "thumb_Wx0", "100x0", "image/png"},
+		// existing image file with WxH thumb size
+		{"image.png", "thumb_WxH", "100x100", "image/png"},
+		// existing image file with WxHt thumb size
+		{"image.png", "thumb_WxHt", "100x100t", "image/png"},
+		// existing image file with WxHb thumb size
+		{"image.png", "thumb_WxHb", "100x100b", "image/png"},
+		// existing image file with WxHf thumb size
+		{"image.png", "thumb_WxHf", "100x100f", "image/png"},
+		// jpg
+		{"image.jpg", "thumb.jpg", "100x100", "image/jpeg"},
+		// webp (should produce png)
+		{"image.webp", "thumb.webp", "100x100", "image/png"},
+		// without extension (should extract the mimetype from its stored ContentType)
+		{"image_noext", "image_noext.jpeg", "100x100", "image/jpeg"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.file+"_"+s.thumb+"_"+s.size, func(t *testing.T) {
+			err := fsys.CreateThumb(s.file, s.thumb, s.size)
+
+			expectErr := s.expectedMimeType == ""
+
+			hasErr := err != nil
+			if hasErr != expectErr {
+				t.Fatalf("Expected hasErr to be %v, got %v (%v)", expectErr, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			f, err := fsys.GetReader(s.thumb)
+			if err != nil {
+				t.Fatalf("Missing expected thumb %s (%v)", s.thumb, err)
+			}
+			defer f.Close()
+
+			attrsMimeType := f.ContentType()
+
+			mt, err := mimetype.DetectReader(f)
+			if err != nil {
+				t.Fatalf("Failed to detect thumb %s mimetype (%v)", s.thumb, err)
+			}
+			fileMimeType := mt.String()
+
+			if fileMimeType != s.expectedMimeType {
+				t.Fatalf("Expected thumb file %s MimeType %q, got %q", s.thumb, s.expectedMimeType, fileMimeType)
+			}
+
+			if attrsMimeType != s.expectedMimeType {
+				t.Fatalf("Expected thumb attrs %s MimeType %q, got %q", s.thumb, s.expectedMimeType, attrsMimeType)
+			}
+		})
+	}
+}
+
+// ---
+
+func createTestDir(t *testing.T) string {
+	dir, err := os.MkdirTemp(os.TempDir(), "pb_test")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.MkdirAll(filepath.Join(dir, "empty"), os.ModePerm)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.MkdirAll(filepath.Join(dir, "test"), os.ModePerm)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.WriteFile(filepath.Join(dir, "test/sub1.txt"), []byte("sub1"), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.WriteFile(filepath.Join(dir, "test/sub2.txt"), []byte("sub2"), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// png
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "image.png"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 png
+		_ = png.Encode(file, imgRect)
+		file.Close()
+		err = os.WriteFile(filepath.Join(dir, "image.png.attrs"), []byte(`{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/png","user.metadata":null}`), 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// jpg
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "image.jpg"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 jpg
+		_ = jpeg.Encode(file, imgRect, nil)
+		file.Close()
+		err = os.WriteFile(filepath.Join(dir, "image.jpg.attrs"), []byte(`{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/jpeg","user.metadata":null}`), 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// svg
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "image.svg"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		file.Close()
+	}
+
+	// webp
+	{
+		err := os.WriteFile(filepath.Join(dir, "image.webp"), []byte{
+			82, 73, 70, 70, 36, 0, 0, 0, 87, 69, 66, 80, 86, 80, 56, 32,
+			24, 0, 0, 0, 48, 1, 0, 157, 1, 42, 1, 0, 1, 0, 2, 0, 52, 37,
+			164, 0, 3, 112, 0, 254, 251, 253, 80, 0,
+		}, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// invalid/special characters
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "image_!@ special"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 png
+		_ = png.Encode(file, imgRect)
+		file.Close()
+	}
+
+	// no extension
+	{
+		fullPath := filepath.Join(dir, "image_noext")
+		file, err := os.OpenFile(fullPath, os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		imgRect := image.Rect(0, 0, 1, 1) // tiny 1x1 jpg
+		_ = jpeg.Encode(file, imgRect, nil)
+		file.Close()
+		err = os.WriteFile(fullPath+".attrs", []byte(`{"user.cache_control":"","user.content_disposition":"","user.content_encoding":"","user.content_language":"","user.content_type":"image/jpeg","user.metadata":null}`), 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// css
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "style.css"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		file.Close()
+	}
+
+	// js
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "main.js"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		file.Close()
+	}
+
+	// mjs
+	{
+		file, err := os.OpenFile(filepath.Join(dir, "main.mjs"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		file.Close()
+	}
+
+	return dir
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/fileblob/attrs.go b/server/core_backend-server/tools/filesystem/internal/fileblob/attrs.go
new file mode 100644
index 0000000..3f30ed3
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/fileblob/attrs.go
@@ -0,0 +1,84 @@
+package fileblob
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+)
+
+// Largely copied from gocloud.dev/blob/fileblob to apply the same
+// retrieve and write side-car .attrs rules.
+//
+// -------------------------------------------------------------------
+// Copyright 2018 The Go Cloud Development Kit Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// -------------------------------------------------------------------
+
+const attrsExt = ".attrs"
+
+var errAttrsExt = fmt.Errorf("file extension %q is reserved", attrsExt)
+
+// xattrs stores extended attributes for an object. The format is like
+// filesystem extended attributes, see
+// https://www.freedesktop.org/wiki/CommonExtendedAttributes.
+type xattrs struct {
+	CacheControl       string            `json:"user.cache_control"`
+	ContentDisposition string            `json:"user.content_disposition"`
+	ContentEncoding    string            `json:"user.content_encoding"`
+	ContentLanguage    string            `json:"user.content_language"`
+	ContentType        string            `json:"user.content_type"`
+	Metadata           map[string]string `json:"user.metadata"`
+	MD5                []byte            `json:"md5"`
+}
+
+// setAttrs creates a "path.attrs" file along with blob to store the attributes,
+// it uses JSON format.
+func setAttrs(path string, xa xattrs) error {
+	f, err := os.Create(path + attrsExt)
+	if err != nil {
+		return err
+	}
+
+	if err := json.NewEncoder(f).Encode(xa); err != nil {
+		f.Close()
+		os.Remove(f.Name())
+		return err
+	}
+
+	return f.Close()
+}
+
+// getAttrs looks at the "path.attrs" file to retrieve the attributes and
+// decodes them into a xattrs struct. It doesn't return error when there is no
+// such .attrs file.
+func getAttrs(path string) (xattrs, error) {
+	f, err := os.Open(path + attrsExt)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// Handle gracefully for non-existent .attr files.
+			return xattrs{
+				ContentType: "application/octet-stream",
+			}, nil
+		}
+		return xattrs{}, err
+	}
+
+	xa := new(xattrs)
+	if err := json.NewDecoder(f).Decode(xa); err != nil {
+		f.Close()
+		return xattrs{}, err
+	}
+
+	return *xa, f.Close()
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/fileblob/fileblob.go b/server/core_backend-server/tools/filesystem/internal/fileblob/fileblob.go
new file mode 100644
index 0000000..fa19e4c
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/fileblob/fileblob.go
@@ -0,0 +1,714 @@
+// Package fileblob provides a blob.Bucket driver implementation.
+//
+// NB! To minimize breaking changes with older PocketBase releases,
+// the driver is a stripped down and adapted version of the previously
+// used gocloud.dev/blob/fileblob, hence many of the below doc comments,
+// struct options and interface implementations are the same.
+//
+// To avoid partial writes, fileblob writes to a temporary file and then renames
+// the temporary file to the final path on Close. By default, it creates these
+// temporary files in `os.TempDir`. If `os.TempDir` is on a different mount than
+// your base bucket path, the `os.Rename` will fail with `invalid cross-device link`.
+// To avoid this, either configure the temp dir to use by setting the environment
+// variable `TMPDIR`, or set `Options.NoTempDir` to `true` (fileblob will create
+// the temporary files next to the actual files instead of in a temporary directory).
+//
+// By default fileblob stores blob metadata in "sidecar" files under the original
+// filename with an additional ".attrs" suffix.
+// This behaviour can be changed via `Options.Metadata`;
+// writing of those metadata files can be suppressed by setting it to
+// `MetadataDontWrite` or its equivalent "metadata=skip" in the URL for the opener.
+// In either case, absent any stored metadata many `blob.Attributes` fields
+// will be set to default values.
+//
+// The blob abstraction supports all UTF-8 strings; to make this work with services lacking
+// full UTF-8 support, strings must be escaped (during writes) and unescaped
+// (during reads). The following escapes are performed for fileblob:
+//   - Blob keys: ASCII characters 0-31 are escaped to "__0x<hex>__".
+//     If os.PathSeparator != "/", it is also escaped.
+//     Additionally, the "/" in "../", the trailing "/" in "//", and a trailing
+//     "/" is key names are escaped in the same way.
+//     On Windows, the characters "<>:"|?*" are also escaped.
+//
+// Example:
+//
+//	drv, _ := fileblob.New("/path/to/dir", nil)
+//	bucket := blob.NewBucket(drv)
+package fileblob
+
+import (
+	"context"
+	"crypto/md5"
+	"errors"
+	"fmt"
+	"hash"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
+)
+
+const defaultPageSize = 1000
+
+type metadataOption string // Not exported as subject to change.
+
+// Settings for Options.Metadata.
+const (
+	// Metadata gets written to a separate file.
+	MetadataInSidecar metadataOption = ""
+
+	// Writes won't carry metadata, as per the package docstring.
+	MetadataDontWrite metadataOption = "skip"
+)
+
+// Options sets options for constructing a *blob.Bucket backed by fileblob.
+type Options struct {
+	// Refers to the strategy for how to deal with metadata (such as blob.Attributes).
+	// For supported values please see the Metadata* constants.
+	// If left unchanged, 'MetadataInSidecar' will be used.
+	Metadata metadataOption
+
+	// The FileMode to use when creating directories for the top-level directory
+	// backing the bucket (when CreateDir is true), and for subdirectories for keys.
+	// Defaults to 0777.
+	DirFileMode os.FileMode
+
+	// If true, create the directory backing the Bucket if it does not exist
+	// (using os.MkdirAll).
+	CreateDir bool
+
+	// If true, don't use os.TempDir for temporary files, but instead place them
+	// next to the actual files. This may result in "stranded" temporary files
+	// (e.g., if the application is killed before the file cleanup runs).
+	//
+	// If your bucket directory is on a different mount than os.TempDir, you will
+	// need to set this to true, as os.Rename will fail across mount points.
+	NoTempDir bool
+}
+
+// New creates a new instance of the fileblob driver backed by the
+// filesystem and rooted at dir, which must exist.
+func New(dir string, opts *Options) (blob.Driver, error) {
+	if opts == nil {
+		opts = &Options{}
+	}
+	if opts.DirFileMode == 0 {
+		opts.DirFileMode = os.FileMode(0o777)
+	}
+
+	absdir, err := filepath.Abs(dir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to convert %s into an absolute path: %v", dir, err)
+	}
+
+	// Optionally, create the directory if it does not already exist.
+	info, err := os.Stat(absdir)
+	if err != nil && opts.CreateDir && os.IsNotExist(err) {
+		err = os.MkdirAll(absdir, opts.DirFileMode)
+		if err != nil {
+			return nil, fmt.Errorf("tried to create directory but failed: %v", err)
+		}
+		info, err = os.Stat(absdir)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if !info.IsDir() {
+		return nil, fmt.Errorf("%s is not a directory", absdir)
+	}
+
+	return &driver{dir: absdir, opts: opts}, nil
+}
+
+type driver struct {
+	opts *Options
+	dir  string
+}
+
+// Close implements [blob/Driver.Close].
+func (drv *driver) Close() error {
+	return nil
+}
+
+// NormalizeError implements [blob/Driver.NormalizeError].
+func (drv *driver) NormalizeError(err error) error {
+	if os.IsNotExist(err) {
+		return errors.Join(err, blob.ErrNotFound)
+	}
+
+	return err
+}
+
+// path returns the full path for a key.
+func (drv *driver) path(key string) (string, error) {
+	path := filepath.Join(drv.dir, escapeKey(key))
+
+	if strings.HasSuffix(path, attrsExt) {
+		return "", errAttrsExt
+	}
+
+	return path, nil
+}
+
+// forKey returns the full path, os.FileInfo, and attributes for key.
+func (drv *driver) forKey(key string) (string, os.FileInfo, *xattrs, error) {
+	path, err := drv.path(key)
+	if err != nil {
+		return "", nil, nil, err
+	}
+
+	info, err := os.Stat(path)
+	if err != nil {
+		return "", nil, nil, err
+	}
+
+	if info.IsDir() {
+		return "", nil, nil, os.ErrNotExist
+	}
+
+	xa, err := getAttrs(path)
+	if err != nil {
+		return "", nil, nil, err
+	}
+
+	return path, info, &xa, nil
+}
+
+// ListPaged implements [blob/Driver.ListPaged].
+func (drv *driver) ListPaged(ctx context.Context, opts *blob.ListOptions) (*blob.ListPage, error) {
+	var pageToken string
+	if len(opts.PageToken) > 0 {
+		pageToken = string(opts.PageToken)
+	}
+
+	pageSize := opts.PageSize
+	if pageSize == 0 {
+		pageSize = defaultPageSize
+	}
+
+	// If opts.Delimiter != "", lastPrefix contains the last "directory" key we
+	// added. It is used to avoid adding it again; all files in this "directory"
+	// are collapsed to the single directory entry.
+	var lastPrefix string
+	var lastKeyAdded string
+
+	// If the Prefix contains a "/", we can set the root of the Walk
+	// to the path specified by the Prefix as any files below the path will not
+	// match the Prefix.
+	// Note that we use "/" explicitly and not os.PathSeparator, as the opts.Prefix
+	// is in the unescaped form.
+	root := drv.dir
+	if i := strings.LastIndex(opts.Prefix, "/"); i > -1 {
+		root = filepath.Join(root, opts.Prefix[:i])
+	}
+
+	var result blob.ListPage
+
+	// Do a full recursive scan of the root directory.
+	err := filepath.WalkDir(root, func(path string, info fs.DirEntry, err error) error {
+		if err != nil {
+			// Couldn't read this file/directory for some reason; just skip it.
+			return nil
+		}
+
+		// Skip the self-generated attribute files.
+		if strings.HasSuffix(path, attrsExt) {
+			return nil
+		}
+
+		// os.Walk returns the root directory; skip it.
+		if path == drv.dir {
+			return nil
+		}
+
+		// Strip the <drv.dir> prefix from path.
+		prefixLen := len(drv.dir)
+		// Include the separator for non-root.
+		if drv.dir != "/" {
+			prefixLen++
+		}
+		path = path[prefixLen:]
+
+		// Unescape the path to get the key.
+		key := unescapeKey(path)
+
+		// Skip all directories. If opts.Delimiter is set, we'll create
+		// pseudo-directories later.
+		// Note that returning nil means that we'll still recurse into it;
+		// we're just not adding a result for the directory itself.
+		if info.IsDir() {
+			key += "/"
+			// Avoid recursing into subdirectories if the directory name already
+			// doesn't match the prefix; any files in it are guaranteed not to match.
+			if len(key) > len(opts.Prefix) && !strings.HasPrefix(key, opts.Prefix) {
+				return filepath.SkipDir
+			}
+			// Similarly, avoid recursing into subdirectories if we're making
+			// "directories" and all of the files in this subdirectory are guaranteed
+			// to collapse to a "directory" that we've already added.
+			if lastPrefix != "" && strings.HasPrefix(key, lastPrefix) {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+
+		// Skip files/directories that don't match the Prefix.
+		if !strings.HasPrefix(key, opts.Prefix) {
+			return nil
+		}
+
+		var md5 []byte
+		if xa, err := getAttrs(path); err == nil {
+			// Note: we only have the MD5 hash for blobs that we wrote.
+			// For other blobs, md5 will remain nil.
+			md5 = xa.MD5
+		}
+
+		fi, err := info.Info()
+		if err != nil {
+			return err
+		}
+
+		obj := &blob.ListObject{
+			Key:     key,
+			ModTime: fi.ModTime(),
+			Size:    fi.Size(),
+			MD5:     md5,
+		}
+
+		// If using Delimiter, collapse "directories".
+		if opts.Delimiter != "" {
+			// Strip the prefix, which may contain Delimiter.
+			keyWithoutPrefix := key[len(opts.Prefix):]
+			// See if the key still contains Delimiter.
+			// If no, it's a file and we just include it.
+			// If yes, it's a file in a "sub-directory" and we want to collapse
+			// all files in that "sub-directory" into a single "directory" result.
+			if idx := strings.Index(keyWithoutPrefix, opts.Delimiter); idx != -1 {
+				prefix := opts.Prefix + keyWithoutPrefix[0:idx+len(opts.Delimiter)]
+				// We've already included this "directory"; don't add it.
+				if prefix == lastPrefix {
+					return nil
+				}
+				// Update the object to be a "directory".
+				obj = &blob.ListObject{
+					Key:   prefix,
+					IsDir: true,
+				}
+				lastPrefix = prefix
+			}
+		}
+
+		// If there's a pageToken, skip anything before it.
+		if pageToken != "" && obj.Key <= pageToken {
+			return nil
+		}
+
+		// If we've already got a full page of results, set NextPageToken and stop.
+		// Unless the current object is a directory, in which case there may
+		// still be objects coming that are alphabetically before it (since
+		// we appended the delimiter). In that case, keep going; we'll trim the
+		// extra entries (if any) before returning.
+		if len(result.Objects) == pageSize && !obj.IsDir {
+			result.NextPageToken = []byte(result.Objects[pageSize-1].Key)
+			return io.EOF
+		}
+
+		result.Objects = append(result.Objects, obj)
+
+		// Normally, objects are added in the correct order (by Key).
+		// However, sometimes adding the file delimiter messes that up
+		// (e.g., if the file delimiter is later in the alphabet than the last character of a key).
+		// Detect if this happens and swap if needed.
+		if len(result.Objects) > 1 && obj.Key < lastKeyAdded {
+			i := len(result.Objects) - 1
+			result.Objects[i-1], result.Objects[i] = result.Objects[i], result.Objects[i-1]
+			lastKeyAdded = result.Objects[i].Key
+		} else {
+			lastKeyAdded = obj.Key
+		}
+
+		return nil
+	})
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+
+	if len(result.Objects) > pageSize {
+		result.Objects = result.Objects[0:pageSize]
+		result.NextPageToken = []byte(result.Objects[pageSize-1].Key)
+	}
+
+	return &result, nil
+}
+
+// Attributes implements [blob/Driver.Attributes].
+func (drv *driver) Attributes(ctx context.Context, key string) (*blob.Attributes, error) {
+	_, info, xa, err := drv.forKey(key)
+	if err != nil {
+		return nil, err
+	}
+
+	return &blob.Attributes{
+		CacheControl:       xa.CacheControl,
+		ContentDisposition: xa.ContentDisposition,
+		ContentEncoding:    xa.ContentEncoding,
+		ContentLanguage:    xa.ContentLanguage,
+		ContentType:        xa.ContentType,
+		Metadata:           xa.Metadata,
+		// CreateTime left as the zero time.
+		ModTime: info.ModTime(),
+		Size:    info.Size(),
+		MD5:     xa.MD5,
+		ETag:    fmt.Sprintf("\"%x-%x\"", info.ModTime().UnixNano(), info.Size()),
+	}, nil
+}
+
+// NewRangeReader implements [blob/Driver.NewRangeReader].
+func (drv *driver) NewRangeReader(ctx context.Context, key string, offset, length int64) (blob.DriverReader, error) {
+	path, info, xa, err := drv.forKey(key)
+	if err != nil {
+		return nil, err
+	}
+
+	// @todo consider replacing with os.Root
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+
+	if offset > 0 {
+		if _, err := f.Seek(offset, io.SeekStart); err != nil {
+			return nil, err
+		}
+	}
+
+	r := io.Reader(f)
+	if length >= 0 {
+		r = io.LimitReader(r, length)
+	}
+
+	return &reader{
+		r: r,
+		c: f,
+		attrs: &blob.ReaderAttributes{
+			ContentType: xa.ContentType,
+			ModTime:     info.ModTime(),
+			Size:        info.Size(),
+		},
+	}, nil
+}
+
+func createTemp(path string, noTempDir bool) (*os.File, error) {
+	// Use a custom createTemp function rather than os.CreateTemp() as
+	// os.CreateTemp() sets the permissions of the tempfile to 0600, rather than
+	// 0666, making it inconsistent with the directories and attribute files.
+	try := 0
+	for {
+		// Append the current time with nanosecond precision and .tmp to the
+		// base path. If the file already exists try again. Nanosecond changes enough
+		// between each iteration to make a conflict unlikely. Using the full
+		// time lowers the chance of a collision with a file using a similar
+		// pattern, but has undefined behavior after the year 2262.
+		var name string
+		if noTempDir {
+			name = path
+		} else {
+			name = filepath.Join(os.TempDir(), filepath.Base(path))
+		}
+		name += "." + strconv.FormatInt(time.Now().UnixNano(), 16) + ".tmp"
+
+		f, err := os.OpenFile(name, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o666)
+		if os.IsExist(err) {
+			if try++; try < 10000 {
+				continue
+			}
+			return nil, &os.PathError{Op: "createtemp", Path: path + ".*.tmp", Err: os.ErrExist}
+		}
+
+		return f, err
+	}
+}
+
+// NewTypedWriter implements [blob/Driver.NewTypedWriter].
+func (drv *driver) NewTypedWriter(ctx context.Context, key, contentType string, opts *blob.WriterOptions) (blob.DriverWriter, error) {
+	path, err := drv.path(key)
+	if err != nil {
+		return nil, err
+	}
+
+	err = os.MkdirAll(filepath.Dir(path), drv.opts.DirFileMode)
+	if err != nil {
+		return nil, err
+	}
+
+	f, err := createTemp(path, drv.opts.NoTempDir)
+	if err != nil {
+		return nil, err
+	}
+
+	if drv.opts.Metadata == MetadataDontWrite {
+		w := &writer{
+			ctx:  ctx,
+			File: f,
+			path: path,
+		}
+		return w, nil
+	}
+
+	var metadata map[string]string
+	if len(opts.Metadata) > 0 {
+		metadata = opts.Metadata
+	}
+
+	return &writerWithSidecar{
+		ctx:        ctx,
+		f:          f,
+		path:       path,
+		contentMD5: opts.ContentMD5,
+		md5hash:    md5.New(),
+		attrs: xattrs{
+			CacheControl:       opts.CacheControl,
+			ContentDisposition: opts.ContentDisposition,
+			ContentEncoding:    opts.ContentEncoding,
+			ContentLanguage:    opts.ContentLanguage,
+			ContentType:        contentType,
+			Metadata:           metadata,
+		},
+	}, nil
+}
+
+// Copy implements [blob/Driver.Copy].
+func (drv *driver) Copy(ctx context.Context, dstKey, srcKey string) error {
+	// Note: we could use NewRangeReader here, but since we need to copy all of
+	// the metadata (from xa), it's more efficient to do it directly.
+	srcPath, _, xa, err := drv.forKey(srcKey)
+	if err != nil {
+		return err
+	}
+
+	f, err := os.Open(srcPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	// We'll write the copy using Writer, to avoid re-implementing making of a
+	// temp file, cleaning up after partial failures, etc.
+	wopts := blob.WriterOptions{
+		CacheControl:       xa.CacheControl,
+		ContentDisposition: xa.ContentDisposition,
+		ContentEncoding:    xa.ContentEncoding,
+		ContentLanguage:    xa.ContentLanguage,
+		Metadata:           xa.Metadata,
+	}
+
+	// Create a cancelable context so we can cancel the write if there are problems.
+	writeCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	w, err := drv.NewTypedWriter(writeCtx, dstKey, xa.ContentType, &wopts)
+	if err != nil {
+		return err
+	}
+
+	_, err = io.Copy(w, f)
+	if err != nil {
+		cancel() // cancel before Close cancels the write
+		w.Close()
+		return err
+	}
+
+	return w.Close()
+}
+
+// Delete implements [blob/Driver.Delete].
+func (b *driver) Delete(ctx context.Context, key string) error {
+	path, err := b.path(key)
+	if err != nil {
+		return err
+	}
+
+	err = os.Remove(path)
+	if err != nil {
+		return err
+	}
+
+	err = os.Remove(path + attrsExt)
+	if err != nil && !os.IsNotExist(err) {
+		return err
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+type reader struct {
+	r     io.Reader
+	c     io.Closer
+	attrs *blob.ReaderAttributes
+}
+
+func (r *reader) Read(p []byte) (int, error) {
+	if r.r == nil {
+		return 0, io.EOF
+	}
+	return r.r.Read(p)
+}
+
+func (r *reader) Close() error {
+	if r.c == nil {
+		return nil
+	}
+	return r.c.Close()
+}
+
+// Attributes implements [blob/DriverReader.Attributes].
+func (r *reader) Attributes() *blob.ReaderAttributes {
+	return r.attrs
+}
+
+// -------------------------------------------------------------------
+
+// writerWithSidecar implements the strategy of storing metadata in a distinct file.
+type writerWithSidecar struct {
+	ctx        context.Context
+	md5hash    hash.Hash
+	f          *os.File
+	path       string
+	attrs      xattrs
+	contentMD5 []byte
+}
+
+func (w *writerWithSidecar) Write(p []byte) (n int, err error) {
+	n, err = w.f.Write(p)
+	if err != nil {
+		// Don't hash the unwritten tail twice when writing is resumed.
+		w.md5hash.Write(p[:n])
+		return n, err
+	}
+
+	if _, err := w.md5hash.Write(p); err != nil {
+		return n, err
+	}
+
+	return n, nil
+}
+
+func (w *writerWithSidecar) Close() error {
+	err := w.f.Close()
+	if err != nil {
+		return err
+	}
+
+	// Always delete the temp file. On success, it will have been
+	// renamed so the Remove will fail.
+	defer func() {
+		_ = os.Remove(w.f.Name())
+	}()
+
+	// Check if the write was cancelled.
+	if err := w.ctx.Err(); err != nil {
+		return err
+	}
+
+	md5sum := w.md5hash.Sum(nil)
+	w.attrs.MD5 = md5sum
+
+	// Write the attributes file.
+	if err := setAttrs(w.path, w.attrs); err != nil {
+		return err
+	}
+
+	// Rename the temp file to path.
+	if err := os.Rename(w.f.Name(), w.path); err != nil {
+		_ = os.Remove(w.path + attrsExt)
+		return err
+	}
+
+	return nil
+}
+
+// writer is a file with a temporary name until closed.
+//
+// Embedding os.File allows the likes of io.Copy to use optimizations,
+// which is why it is not folded into writerWithSidecar.
+type writer struct {
+	*os.File
+	ctx  context.Context
+	path string
+}
+
+func (w *writer) Close() error {
+	err := w.File.Close()
+	if err != nil {
+		return err
+	}
+
+	// Always delete the temp file. On success, it will have been renamed so
+	// the Remove will fail.
+	tempname := w.Name()
+	defer os.Remove(tempname)
+
+	// Check if the write was cancelled.
+	if err := w.ctx.Err(); err != nil {
+		return err
+	}
+
+	// Rename the temp file to path.
+	return os.Rename(tempname, w.path)
+}
+
+// -------------------------------------------------------------------
+
+// escapeKey does all required escaping for UTF-8 strings to work the filesystem.
+func escapeKey(s string) string {
+	s = blob.HexEscape(s, func(r []rune, i int) bool {
+		c := r[i]
+		switch {
+		case c < 32:
+			return true
+		// We're going to replace '/' with os.PathSeparator below. In order for this
+		// to be reversible, we need to escape raw os.PathSeparators.
+		case os.PathSeparator != '/' && c == os.PathSeparator:
+			return true
+		// For "../", escape the trailing slash.
+		case i > 1 && c == '/' && r[i-1] == '.' && r[i-2] == '.':
+			return true
+		// For "//", escape the trailing slash.
+		case i > 0 && c == '/' && r[i-1] == '/':
+			return true
+		// Escape the trailing slash in a key.
+		case c == '/' && i == len(r)-1:
+			return true
+		// https://docs.microsoft.com/en-us/windows/desktop/fileio/naming-a-file
+		case os.PathSeparator == '\\' && (c == '>' || c == '<' || c == ':' || c == '"' || c == '|' || c == '?' || c == '*'):
+			return true
+		}
+		return false
+	})
+
+	// Replace "/" with os.PathSeparator if needed, so that the local filesystem
+	// can use subdirectories.
+	if os.PathSeparator != '/' {
+		s = strings.ReplaceAll(s, "/", string(os.PathSeparator))
+	}
+
+	return s
+}
+
+// unescapeKey reverses escapeKey.
+func unescapeKey(s string) string {
+	if os.PathSeparator != '/' {
+		s = strings.ReplaceAll(s, string(os.PathSeparator), "/")
+	}
+
+	return blob.HexUnescape(s)
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/copy_object.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/copy_object.go
new file mode 100644
index 0000000..de26bad
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/copy_object.go
@@ -0,0 +1,59 @@
+package s3
+
+import (
+	"context"
+	"encoding/xml"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html#API_CopyObject_ResponseSyntax
+type CopyObjectResponse struct {
+	CopyObjectResult  xml.Name  `json:"copyObjectResult" xml:"CopyObjectResult"`
+	ETag              string    `json:"etag" xml:"ETag"`
+	LastModified      time.Time `json:"lastModified" xml:"LastModified"`
+	ChecksumType      string    `json:"checksumType" xml:"ChecksumType"`
+	ChecksumCRC32     string    `json:"checksumCRC32" xml:"ChecksumCRC32"`
+	ChecksumCRC32C    string    `json:"checksumCRC32C" xml:"ChecksumCRC32C"`
+	ChecksumCRC64NVME string    `json:"checksumCRC64NVME" xml:"ChecksumCRC64NVME"`
+	ChecksumSHA1      string    `json:"checksumSHA1" xml:"ChecksumSHA1"`
+	ChecksumSHA256    string    `json:"checksumSHA256" xml:"ChecksumSHA256"`
+}
+
+// CopyObject copies a single object from srcKey to dstKey destination.
+// (both keys are expected to be operating within the same bucket).
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html
+func (s3 *S3) CopyObject(ctx context.Context, srcKey string, dstKey string, optReqFuncs ...func(*http.Request)) (*CopyObjectResponse, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, s3.URL(dstKey), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// per the doc the header value must be URL-encoded
+	req.Header.Set("x-amz-copy-source", url.PathEscape(s3.Bucket+"/"+strings.TrimLeft(srcKey, "/")))
+
+	// apply optional request funcs
+	for _, fn := range optReqFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	result := &CopyObjectResponse{}
+
+	err = xml.NewDecoder(resp.Body).Decode(result)
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/copy_object_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/copy_object_test.go
new file mode 100644
index 0000000..04fdb4a
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/copy_object_test.go
@@ -0,0 +1,67 @@
+package s3_test
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3CopyObject(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodPut,
+			URL:    "http://test_bucket.example.com/%40dst_test",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":       "test",
+					"x-amz-copy-source": "test_bucket%2F@src_test",
+					"Authorization":     "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Body: io.NopCloser(strings.NewReader(`
+					<CopyObjectResult>
+						<LastModified>2025-01-01T01:02:03.456Z</LastModified>
+						<ETag>test_etag</ETag>
+					</CopyObjectResult>
+				`)),
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	copyResp, err := s3Client.CopyObject(context.Background(), "@src_test", "@dst_test", func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if copyResp.ETag != "test_etag" {
+		t.Fatalf("Expected ETag %q, got %q", "test_etag", copyResp.ETag)
+	}
+
+	if date := copyResp.LastModified.Format("2006-01-02T15:04:05.000Z"); date != "2025-01-01T01:02:03.456Z" {
+		t.Fatalf("Expected LastModified %q, got %q", "2025-01-01T01:02:03.456Z", date)
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/delete_object.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/delete_object.go
new file mode 100644
index 0000000..a46c8ab
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/delete_object.go
@@ -0,0 +1,31 @@
+package s3
+
+import (
+	"context"
+	"net/http"
+)
+
+// DeleteObject deletes a single object by its key.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html
+func (s3 *S3) DeleteObject(ctx context.Context, key string, optFuncs ...func(*http.Request)) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, s3.URL(key), nil)
+	if err != nil {
+		return err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	return nil
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/delete_object_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/delete_object_test.go
new file mode 100644
index 0000000..48d245c
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/delete_object_test.go
@@ -0,0 +1,48 @@
+package s3_test
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3DeleteObject(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodDelete,
+			URL:    "http://test_bucket.example.com/test_key",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	err := s3Client.DeleteObject(context.Background(), "test_key", func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/error.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/error.go
new file mode 100644
index 0000000..e8d76af
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/error.go
@@ -0,0 +1,49 @@
+package s3
+
+import (
+	"encoding/xml"
+	"strconv"
+	"strings"
+)
+
+var _ error = (*ResponseError)(nil)
+
+// ResponseError defines a general S3 response error.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html
+type ResponseError struct {
+	XMLName   xml.Name `json:"-" xml:"Error"`
+	Code      string   `json:"code" xml:"Code"`
+	Message   string   `json:"message" xml:"Message"`
+	RequestId string   `json:"requestId" xml:"RequestId"`
+	Resource  string   `json:"resource" xml:"Resource"`
+	Raw       []byte   `json:"-" xml:"-"`
+	Status    int      `json:"status" xml:"Status"`
+}
+
+// Error implements the std error interface.
+func (err *ResponseError) Error() string {
+	var strBuilder strings.Builder
+
+	strBuilder.WriteString(strconv.Itoa(err.Status))
+	strBuilder.WriteString(" ")
+
+	if err.Code != "" {
+		strBuilder.WriteString(err.Code)
+	} else {
+		strBuilder.WriteString("S3ResponseError")
+	}
+
+	if err.Message != "" {
+		strBuilder.WriteString(": ")
+		strBuilder.WriteString(err.Message)
+	}
+
+	if len(err.Raw) > 0 {
+		strBuilder.WriteString("\n(RAW: ")
+		strBuilder.Write(err.Raw)
+		strBuilder.WriteString(")")
+	}
+
+	return strBuilder.String()
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/error_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/error_test.go
new file mode 100644
index 0000000..4728c39
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/error_test.go
@@ -0,0 +1,86 @@
+package s3_test
+
+import (
+	"encoding/json"
+	"encoding/xml"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+)
+
+func TestResponseErrorSerialization(t *testing.T) {
+	raw := `
+		<?xml version="1.0" encoding="UTF-8"?>
+		<Error>
+		  <Code>test_code</Code>
+		  <Message>test_message</Message>
+		  <RequestId>test_request_id</RequestId>
+		  <Resource>test_resource</Resource>
+		</Error>
+	`
+
+	respErr := &s3.ResponseError{
+		Status: 123,
+		Raw:    []byte("test"),
+	}
+
+	err := xml.Unmarshal([]byte(raw), &respErr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	jsonRaw, err := json.Marshal(respErr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jsonStr := string(jsonRaw)
+
+	expected := `{"code":"test_code","message":"test_message","requestId":"test_request_id","resource":"test_resource","status":123}`
+
+	if expected != jsonStr {
+		t.Fatalf("Expected JSON\n%s\ngot\n%s", expected, jsonStr)
+	}
+}
+
+func TestResponseErrorErrorInterface(t *testing.T) {
+	scenarios := []struct {
+		name     string
+		err      *s3.ResponseError
+		expected string
+	}{
+		{
+			"empty",
+			&s3.ResponseError{},
+			"0 S3ResponseError",
+		},
+		{
+			"with code and message (nil raw)",
+			&s3.ResponseError{
+				Status:  123,
+				Code:    "test_code",
+				Message: "test_message",
+			},
+			"123 test_code: test_message",
+		},
+		{
+			"with code and message (non-nil raw)",
+			&s3.ResponseError{
+				Status:  123,
+				Code:    "test_code",
+				Message: "test_message",
+				Raw:     []byte("test_raw"),
+			},
+			"123 test_code: test_message\n(RAW: test_raw)",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.err.Error()
+
+			if result != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/get_object.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/get_object.go
new file mode 100644
index 0000000..e83f38f
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/get_object.go
@@ -0,0 +1,43 @@
+package s3
+
+import (
+	"context"
+	"io"
+	"net/http"
+)
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html#API_GetObject_ResponseElements
+type GetObjectResponse struct {
+	Body io.ReadCloser `json:"-" xml:"-"`
+
+	HeadObjectResponse
+}
+
+// GetObject retrieves a single object by its key.
+//
+// NB! Make sure to call GetObjectResponse.Body.Close() after done working with the result.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html
+func (s3 *S3) GetObject(ctx context.Context, key string, optFuncs ...func(*http.Request)) (*GetObjectResponse, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, s3.URL(key), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return nil, err
+	}
+
+	result := &GetObjectResponse{Body: resp.Body}
+	result.load(resp.Header)
+
+	return result, nil
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/get_object_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/get_object_test.go
new file mode 100644
index 0000000..3dde3b0
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/get_object_test.go
@@ -0,0 +1,92 @@
+package s3_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3GetObject(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodGet,
+			URL:    "http://test_bucket.example.com/test_key",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Header: http.Header{
+					"Last-Modified":       []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+					"Cache-Control":       []string{"test_cache"},
+					"Content-Disposition": []string{"test_disposition"},
+					"Content-Encoding":    []string{"test_encoding"},
+					"Content-Language":    []string{"test_language"},
+					"Content-Type":        []string{"test_type"},
+					"Content-Range":       []string{"test_range"},
+					"Etag":                []string{"test_etag"},
+					"Content-Length":      []string{"100"},
+					"x-amz-meta-AbC":      []string{"test_meta_a"},
+					"x-amz-meta-Def":      []string{"test_meta_b"},
+				},
+				Body: io.NopCloser(strings.NewReader("test")),
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	resp, err := s3Client.GetObject(context.Background(), "test_key", func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// check body
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bodyStr := string(body)
+
+	if bodyStr != "test" {
+		t.Fatalf("Expected body\n%q\ngot\n%q", "test", bodyStr)
+	}
+
+	// check serialized attributes
+	raw, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expected := `{"metadata":{"abc":"test_meta_a","def":"test_meta_b"},"lastModified":"2025-02-01T03:04:05Z","cacheControl":"test_cache","contentDisposition":"test_disposition","contentEncoding":"test_encoding","contentLanguage":"test_language","contentType":"test_type","contentRange":"test_range","etag":"test_etag","contentLength":100}`
+
+	if rawStr != expected {
+		t.Fatalf("Expected attributes\n%s\ngot\n%s", expected, rawStr)
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/head_object.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/head_object.go
new file mode 100644
index 0000000..ff5d7ab
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/head_object.go
@@ -0,0 +1,89 @@
+package s3
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+	"time"
+)
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html#API_HeadObject_ResponseElements
+type HeadObjectResponse struct {
+	// Metadata is the extra data that is stored with the S3 object (aka. the "x-amz-meta-*" header values).
+	//
+	// The map keys are normalized to lower-case.
+	Metadata map[string]string `json:"metadata"`
+
+	// LastModified date and time when the object was last modified.
+	LastModified time.Time `json:"lastModified"`
+
+	// CacheControl specifies caching behavior along the request/reply chain.
+	CacheControl string `json:"cacheControl"`
+
+	// ContentDisposition specifies presentational information for the object.
+	ContentDisposition string `json:"contentDisposition"`
+
+	// ContentEncoding indicates what content encodings have been applied to the object
+	// and thus what decoding mechanisms must be applied to obtain the
+	// media-type referenced by the Content-Type header field.
+	ContentEncoding string `json:"contentEncoding"`
+
+	// ContentLanguage indicates the language the content is in.
+	ContentLanguage string `json:"contentLanguage"`
+
+	// ContentType is a standard MIME type describing the format of the object data.
+	ContentType string `json:"contentType"`
+
+	// ContentRange is the portion of the object usually returned in the response for a GET request.
+	ContentRange string `json:"contentRange"`
+
+	// ETag is an opaque identifier assigned by a web
+	// server to a specific version of a resource found at a URL.
+	ETag string `json:"etag"`
+
+	// ContentLength is size of the body in bytes.
+	ContentLength int64 `json:"contentLength"`
+}
+
+// load parses and load the header values into the current HeadObjectResponse fields.
+func (o *HeadObjectResponse) load(headers http.Header) {
+	o.LastModified, _ = time.Parse(time.RFC1123, headers.Get("Last-Modified"))
+	o.CacheControl = headers.Get("Cache-Control")
+	o.ContentDisposition = headers.Get("Content-Disposition")
+	o.ContentEncoding = headers.Get("Content-Encoding")
+	o.ContentLanguage = headers.Get("Content-Language")
+	o.ContentType = headers.Get("Content-Type")
+	o.ContentRange = headers.Get("Content-Range")
+	o.ETag = headers.Get("ETag")
+	o.ContentLength, _ = strconv.ParseInt(headers.Get("Content-Length"), 10, 0)
+	o.Metadata = extractMetadata(headers)
+}
+
+// HeadObject sends a HEAD request for a single object to check its
+// existence and to retrieve its metadata.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html
+func (s3 *S3) HeadObject(ctx context.Context, key string, optFuncs ...func(*http.Request)) (*HeadObjectResponse, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodHead, s3.URL(key), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	result := &HeadObjectResponse{}
+	result.load(resp.Header)
+
+	return result, nil
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/head_object_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/head_object_test.go
new file mode 100644
index 0000000..e2bf979
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/head_object_test.go
@@ -0,0 +1,77 @@
+package s3_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3HeadObject(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodHead,
+			URL:    "http://test_bucket.example.com/test_key",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Header: http.Header{
+					"Last-Modified":       []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+					"Cache-Control":       []string{"test_cache"},
+					"Content-Disposition": []string{"test_disposition"},
+					"Content-Encoding":    []string{"test_encoding"},
+					"Content-Language":    []string{"test_language"},
+					"Content-Type":        []string{"test_type"},
+					"Content-Range":       []string{"test_range"},
+					"Etag":                []string{"test_etag"},
+					"Content-Length":      []string{"100"},
+					"x-amz-meta-AbC":      []string{"test_meta_a"},
+					"x-amz-meta-Def":      []string{"test_meta_b"},
+				},
+				Body: http.NoBody,
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	resp, err := s3Client.HeadObject(context.Background(), "test_key", func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	raw, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expected := `{"metadata":{"abc":"test_meta_a","def":"test_meta_b"},"lastModified":"2025-02-01T03:04:05Z","cacheControl":"test_cache","contentDisposition":"test_disposition","contentEncoding":"test_encoding","contentLanguage":"test_language","contentType":"test_type","contentRange":"test_range","etag":"test_etag","contentLength":100}`
+
+	if rawStr != expected {
+		t.Fatalf("Expected response\n%s\ngot\n%s", expected, rawStr)
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/list_objects.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/list_objects.go
new file mode 100644
index 0000000..77c2794
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/list_objects.go
@@ -0,0 +1,165 @@
+package s3
+
+import (
+	"context"
+	"encoding/xml"
+	"net/http"
+	"net/url"
+	"strconv"
+	"time"
+)
+
+// ListParams defines optional parameters for the ListObject request.
+type ListParams struct {
+	// ContinuationToken indicates that the list is being continued on this bucket with a token.
+	// ContinuationToken is obfuscated and is not a real key.
+	// You can use this ContinuationToken for pagination of the list results.
+	ContinuationToken string `json:"continuationToken"`
+
+	// Delimiter is a character that you use to group keys.
+	//
+	// For directory buckets, "/" is the only supported delimiter.
+	Delimiter string `json:"delimiter"`
+
+	// Prefix limits the response to keys that begin with the specified prefix.
+	Prefix string `json:"prefix"`
+
+	// Encoding type is used to encode the object keys in the response.
+	// Responses are encoded only in UTF-8.
+	// An object key can contain any Unicode character.
+	// However, the XML 1.0 parser can't parse certain characters,
+	// such as characters with an ASCII value from 0 to 10.
+	// For characters that aren't supported in XML 1.0, you can add
+	// this parameter to request that S3 encode the keys in the response.
+	//
+	// Valid Values: url
+	EncodingType string `json:"encodingType"`
+
+	// StartAfter is where you want S3 to start listing from.
+	// S3 starts listing after this specified key.
+	// StartAfter can be any key in the bucket.
+	//
+	// This functionality is not supported for directory buckets.
+	StartAfter string `json:"startAfter"`
+
+	// MaxKeys Sets the maximum number of keys returned in the response.
+	// By default, the action returns up to 1,000 key names.
+	// The response might contain fewer keys but will never contain more.
+	MaxKeys int `json:"maxKeys"`
+
+	// FetchOwner returns the owner field with each key in the result.
+	FetchOwner bool `json:"fetchOwner"`
+}
+
+// Encode encodes the parameters in a properly formatted query string.
+func (l *ListParams) Encode() string {
+	query := url.Values{}
+
+	query.Add("list-type", "2")
+
+	if l.ContinuationToken != "" {
+		query.Add("continuation-token", l.ContinuationToken)
+	}
+
+	if l.Delimiter != "" {
+		query.Add("delimiter", l.Delimiter)
+	}
+
+	if l.Prefix != "" {
+		query.Add("prefix", l.Prefix)
+	}
+
+	if l.EncodingType != "" {
+		query.Add("encoding-type", l.EncodingType)
+	}
+
+	if l.FetchOwner {
+		query.Add("fetch-owner", "true")
+	}
+
+	if l.MaxKeys > 0 {
+		query.Add("max-keys", strconv.Itoa(l.MaxKeys))
+	}
+
+	if l.StartAfter != "" {
+		query.Add("start-after", l.StartAfter)
+	}
+
+	return query.Encode()
+}
+
+// ListObjects retrieves paginated objects list.
+//
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html
+func (s3 *S3) ListObjects(ctx context.Context, params ListParams, optReqFuncs ...func(*http.Request)) (*ListObjectsResponse, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, s3.URL("?"+params.Encode()), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optReqFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := s3.SignAndSend(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	result := &ListObjectsResponse{}
+
+	err = xml.NewDecoder(resp.Body).Decode(result)
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html#API_ListObjectsV2_ResponseSyntax
+type ListObjectsResponse struct {
+	XMLName               xml.Name `json:"-" xml:"ListBucketResult"`
+	EncodingType          string   `json:"encodingType" xml:"EncodingType"`
+	Name                  string   `json:"name" xml:"Name"`
+	Prefix                string   `json:"prefix" xml:"Prefix"`
+	Delimiter             string   `json:"delimiter" xml:"Delimiter"`
+	ContinuationToken     string   `json:"continuationToken" xml:"ContinuationToken"`
+	NextContinuationToken string   `json:"nextContinuationToken" xml:"NextContinuationToken"`
+	StartAfter            string   `json:"startAfter" xml:"StartAfter"`
+
+	CommonPrefixes []*ListObjectCommonPrefix `json:"commonPrefixes" xml:"CommonPrefixes"`
+
+	Contents []*ListObjectContent `json:"contents" xml:"Contents"`
+
+	KeyCount    int  `json:"keyCount" xml:"KeyCount"`
+	MaxKeys     int  `json:"maxKeys" xml:"MaxKeys"`
+	IsTruncated bool `json:"isTruncated" xml:"IsTruncated"`
+}
+
+type ListObjectCommonPrefix struct {
+	Prefix string `json:"prefix" xml:"Prefix"`
+}
+
+type ListObjectContent struct {
+	Owner struct {
+		DisplayName string `json:"displayName" xml:"DisplayName"`
+		ID          string `json:"id" xml:"ID"`
+	} `json:"owner" xml:"Owner"`
+
+	ChecksumAlgorithm string    `json:"checksumAlgorithm" xml:"ChecksumAlgorithm"`
+	ETag              string    `json:"etag" xml:"ETag"`
+	Key               string    `json:"key" xml:"Key"`
+	StorageClass      string    `json:"storageClass" xml:"StorageClass"`
+	LastModified      time.Time `json:"lastModified" xml:"LastModified"`
+
+	RestoreStatus struct {
+		RestoreExpiryDate   time.Time `json:"restoreExpiryDate" xml:"RestoreExpiryDate"`
+		IsRestoreInProgress bool      `json:"isRestoreInProgress" xml:"IsRestoreInProgress"`
+	} `json:"restoreStatus" xml:"RestoreStatus"`
+
+	Size int64 `json:"size" xml:"Size"`
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/list_objects_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/list_objects_test.go
new file mode 100644
index 0000000..cd0b7f7
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/list_objects_test.go
@@ -0,0 +1,157 @@
+package s3_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3ListParamsEncode(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name     string
+		params   s3.ListParams
+		expected string
+	}{
+		{
+			"blank",
+			s3.ListParams{},
+			"list-type=2",
+		},
+		{
+			"filled",
+			s3.ListParams{
+				ContinuationToken: "test_ct",
+				Delimiter:         "test_delimiter",
+				Prefix:            "test_prefix",
+				EncodingType:      "test_et",
+				StartAfter:        "test_sa",
+				MaxKeys:           1,
+				FetchOwner:        true,
+			},
+			"continuation-token=test_ct&delimiter=test_delimiter&encoding-type=test_et&fetch-owner=true&list-type=2&max-keys=1&prefix=test_prefix&start-after=test_sa",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.params.Encode()
+			if result != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestS3ListObjects(t *testing.T) {
+	t.Parallel()
+
+	listParams := s3.ListParams{
+		ContinuationToken: "test_ct",
+		Delimiter:         "test_delimiter",
+		Prefix:            "test_prefix",
+		EncodingType:      "test_et",
+		StartAfter:        "test_sa",
+		MaxKeys:           10,
+		FetchOwner:        true,
+	}
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodGet,
+			URL:    "http://test_bucket.example.com/?" + listParams.Encode(),
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Body: io.NopCloser(strings.NewReader(`
+					<?xml version="1.0" encoding="UTF-8"?>
+					<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+						<Name>example</Name>
+						<EncodingType>test_encoding</EncodingType>
+						<Prefix>a/</Prefix>
+						<Delimiter>/</Delimiter>
+						<ContinuationToken>ct</ContinuationToken>
+						<NextContinuationToken>nct</NextContinuationToken>
+						<StartAfter>example0.txt</StartAfter>
+						<KeyCount>1</KeyCount>
+						<MaxKeys>3</MaxKeys>
+						<IsTruncated>true</IsTruncated>
+						<Contents>
+							<Key>example1.txt</Key>
+							<LastModified>2025-01-01T01:02:03.123Z</LastModified>
+							<ChecksumAlgorithm>test_ca</ChecksumAlgorithm>
+							<ETag>test_etag1</ETag>
+							<Size>123</Size>
+							<StorageClass>STANDARD</StorageClass>
+							<Owner>
+								<DisplayName>owner_dn</DisplayName>
+								<ID>owner_id</ID>
+							</Owner>
+							<RestoreStatus>
+								<RestoreExpiryDate>2025-01-02T01:02:03.123Z</RestoreExpiryDate>
+								<IsRestoreInProgress>true</IsRestoreInProgress>
+							</RestoreStatus>
+						</Contents>
+						<Contents>
+							<Key>example2.txt</Key>
+							<LastModified>2025-01-02T01:02:03.123Z</LastModified>
+							<ETag>test_etag2</ETag>
+							<Size>456</Size>
+							<StorageClass>STANDARD</StorageClass>
+						</Contents>
+						<CommonPrefixes>
+							<Prefix>a/b/</Prefix>
+						</CommonPrefixes>
+						<CommonPrefixes>
+							<Prefix>a/c/</Prefix>
+						</CommonPrefixes>
+					</ListBucketResult>
+				`)),
+			},
+		},
+	)
+
+	s3Client := &s3.S3{
+		Client:    httpClient,
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	resp, err := s3Client.ListObjects(context.Background(), listParams, func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	raw, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	expected := `{"encodingType":"test_encoding","name":"example","prefix":"a/","delimiter":"/","continuationToken":"ct","nextContinuationToken":"nct","startAfter":"example0.txt","commonPrefixes":[{"prefix":"a/b/"},{"prefix":"a/c/"}],"contents":[{"owner":{"displayName":"owner_dn","id":"owner_id"},"checksumAlgorithm":"test_ca","etag":"test_etag1","key":"example1.txt","storageClass":"STANDARD","lastModified":"2025-01-01T01:02:03.123Z","restoreStatus":{"restoreExpiryDate":"2025-01-02T01:02:03.123Z","isRestoreInProgress":true},"size":123},{"owner":{"displayName":"","id":""},"checksumAlgorithm":"","etag":"test_etag2","key":"example2.txt","storageClass":"STANDARD","lastModified":"2025-01-02T01:02:03.123Z","restoreStatus":{"restoreExpiryDate":"0001-01-01T00:00:00Z","isRestoreInProgress":false},"size":456}],"keyCount":1,"maxKeys":3,"isTruncated":true}`
+
+	if rawStr != expected {
+		t.Fatalf("Expected response\n%s\ngot\n%s", expected, rawStr)
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3.go
new file mode 100644
index 0000000..3165888
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3.go
@@ -0,0 +1,394 @@
+// Package s3 implements a lightweight client for interacting with the
+// REST APIs of any S3 compatible service.
+//
+// It implements only the minimal functionality required by PocketBase
+// such as objects list, get, copy, delete and upload.
+//
+// For more details why we don't use the official aws-sdk-go-v2, you could check
+// https://github.com/pocketbase/pocketbase/discussions/6562.
+//
+// Example:
+//
+//	client := &s3.S3{
+//		Endpoint:     "example.com",
+//		Region:       "us-east-1",
+//		Bucket:       "test",
+//		AccessKey:    "...",
+//		SecretKey:    "...",
+//		UsePathStyle: true,
+//	}
+//	resp, err := client.GetObject(context.Background(), "abc.txt")
+package s3
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+	"time"
+)
+
+const (
+	awsS3ServiceCode     = "s3"
+	awsSignAlgorithm     = "AWS4-HMAC-SHA256"
+	awsTerminationString = "aws4_request"
+	metadataPrefix       = "x-amz-meta-"
+	dateTimeFormat       = "20060102T150405Z"
+)
+
+type HTTPClient interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+type S3 struct {
+	// Client specifies a custom HTTP client to send the request with.
+	//
+	// If not explicitly set, fallbacks to http.DefaultClient.
+	Client HTTPClient
+
+	Bucket       string
+	Region       string
+	Endpoint     string // can be with or without the schema
+	AccessKey    string
+	SecretKey    string
+	UsePathStyle bool
+}
+
+// URL constructs an S3 request URL based on the current configuration.
+//
+// Note that the path will be URL escaped based on the AWS [UriEncode rules]
+// for broader compatibility with some providers that expect the same
+// path format as the one in the canonical signed header
+// (see also https://github.com/pocketbase/pocketbase/issues/7153).
+//
+// [UriEncode rules]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+func (s3 *S3) URL(path string) string {
+	scheme := "https"
+	endpoint := strings.TrimRight(s3.Endpoint, "/")
+	if after, ok := strings.CutPrefix(endpoint, "https://"); ok {
+		endpoint = after
+	} else if after, ok := strings.CutPrefix(endpoint, "http://"); ok {
+		endpoint = after
+		scheme = "http"
+	}
+
+	// to prevent double escaping we first parse/unescape it
+	parsed, err := url.Parse(path)
+	if err != nil {
+		// truly rare case, keep the path as it is
+	} else {
+		path = escapePath(parsed.Path)
+
+		// the rest is usually not expected to be part of the S3 path but it is kept to avoid surprises
+		// (it will be further escaped if necessery by the Go HTTP client)
+		if parsed.RawQuery != "" {
+			path += "?" + parsed.RawQuery
+		}
+		if parsed.RawFragment != "" {
+			path += "#" + parsed.RawFragment
+		}
+	}
+
+	path = strings.TrimLeft(path, "/")
+
+	if s3.UsePathStyle {
+		return fmt.Sprintf("%s://%s/%s/%s", scheme, endpoint, s3.Bucket, path)
+	}
+
+	return fmt.Sprintf("%s://%s.%s/%s", scheme, s3.Bucket, endpoint, path)
+}
+
+// SignAndSend signs the provided request per AWS Signature v4 and sends it.
+//
+// It automatically normalizes all 40x/50x responses to ResponseError.
+//
+// Note: Don't forget to call resp.Body.Close() after done with the result.
+func (s3 *S3) SignAndSend(req *http.Request) (*http.Response, error) {
+	s3.sign(req)
+
+	client := s3.Client
+	if client == nil {
+		client = http.DefaultClient
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.StatusCode >= 400 {
+		defer resp.Body.Close()
+
+		respErr := &ResponseError{
+			Status: resp.StatusCode,
+		}
+
+		respErr.Raw, err = io.ReadAll(resp.Body)
+		if err != nil && !errors.Is(err, io.EOF) {
+			return nil, errors.Join(err, respErr)
+		}
+
+		if len(respErr.Raw) > 0 {
+			err = xml.Unmarshal(respErr.Raw, respErr)
+			if err != nil {
+				return nil, errors.Join(err, respErr)
+			}
+		}
+
+		return nil, respErr
+	}
+
+	return resp, nil
+}
+
+// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-signed-request-steps
+func (s3 *S3) sign(req *http.Request) {
+	// fallback to the Unsigned payload option
+	// (data integrity checks could be still applied via the content-md5 or x-amz-checksum-* headers)
+	if req.Header.Get("x-amz-content-sha256") == "" {
+		req.Header.Set("x-amz-content-sha256", "UNSIGNED-PAYLOAD")
+	}
+
+	reqDateTime, _ := time.Parse(dateTimeFormat, req.Header.Get("x-amz-date"))
+	if reqDateTime.IsZero() {
+		reqDateTime = time.Now().UTC()
+		req.Header.Set("x-amz-date", reqDateTime.Format(dateTimeFormat))
+	}
+
+	req.Header.Set("host", req.URL.Host)
+
+	date := reqDateTime.Format("20060102")
+
+	dateTime := reqDateTime.Format(dateTimeFormat)
+
+	// 1. Create canonical request
+	// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-canonical-request
+	// ---------------------------------------------------------------
+	canonicalHeaders, signedHeaders := canonicalAndSignedHeaders(req)
+
+	canonicalParts := []string{
+		req.Method,
+		escapePath(req.URL.Path),
+		escapeQuery(req.URL.Query()),
+		canonicalHeaders,
+		signedHeaders,
+		req.Header.Get("x-amz-content-sha256"),
+	}
+
+	// 2. Create a hash of the canonical request
+	// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-canonical-request-hash
+	// ---------------------------------------------------------------
+	hashedCanonicalRequest := sha256Hex([]byte(strings.Join(canonicalParts, "\n")))
+
+	// 3. Create a string to sign
+	// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-string-to-sign
+	// ---------------------------------------------------------------
+	scope := strings.Join([]string{
+		date,
+		s3.Region,
+		awsS3ServiceCode,
+		awsTerminationString,
+	}, "/")
+
+	stringToSign := strings.Join([]string{
+		awsSignAlgorithm,
+		dateTime,
+		scope,
+		hashedCanonicalRequest,
+	}, "\n")
+
+	// 4. Derive a signing key for SigV4
+	// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#derive-signing-key
+	// ---------------------------------------------------------------
+	dateKey := hmacSHA256([]byte("AWS4"+s3.SecretKey), date)
+	dateRegionKey := hmacSHA256(dateKey, s3.Region)
+	dateRegionServiceKey := hmacSHA256(dateRegionKey, awsS3ServiceCode)
+	signingKey := hmacSHA256(dateRegionServiceKey, awsTerminationString)
+	signature := hex.EncodeToString(hmacSHA256(signingKey, stringToSign))
+
+	// 5. Add the signature to the request
+	// https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#add-signature-to-request
+	authorization := fmt.Sprintf(
+		"%s Credential=%s/%s, SignedHeaders=%s, Signature=%s",
+		awsSignAlgorithm,
+		s3.AccessKey,
+		scope,
+		signedHeaders,
+		signature,
+	)
+
+	req.Header.Set("authorization", authorization)
+}
+
+func sha256Hex(content []byte) string {
+	h := sha256.New()
+	h.Write(content)
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+func hmacSHA256(key []byte, content string) []byte {
+	mac := hmac.New(sha256.New, key)
+	mac.Write([]byte(content))
+	return mac.Sum(nil)
+}
+
+func canonicalAndSignedHeaders(req *http.Request) (string, string) {
+	signed := []string{}
+	canonical := map[string]string{}
+
+	for key, values := range req.Header {
+		normalizedKey := strings.ToLower(key)
+
+		if normalizedKey != "host" &&
+			normalizedKey != "content-type" &&
+			!strings.HasPrefix(normalizedKey, "x-amz-") {
+			continue
+		}
+
+		signed = append(signed, normalizedKey)
+
+		// for each value:
+		// trim any leading or trailing spaces
+		// convert sequential spaces to a single space
+		normalizedValues := make([]string, len(values))
+		for i, v := range values {
+			normalizedValues[i] = strings.ReplaceAll(strings.TrimSpace(v), "  ", " ")
+		}
+
+		canonical[normalizedKey] = strings.Join(normalizedValues, ",")
+	}
+
+	slices.Sort(signed)
+
+	var sortedCanonical strings.Builder
+	for _, key := range signed {
+		sortedCanonical.WriteString(key)
+		sortedCanonical.WriteString(":")
+		sortedCanonical.WriteString(canonical[key])
+		sortedCanonical.WriteString("\n")
+	}
+
+	return sortedCanonical.String(), strings.Join(signed, ";")
+}
+
+// extractMetadata parses and extracts and the metadata from the specified request headers.
+//
+// The metadata keys are all lowercased and without the "x-amz-meta-" prefix.
+func extractMetadata(headers http.Header) map[string]string {
+	result := map[string]string{}
+
+	for k, v := range headers {
+		if len(v) == 0 {
+			continue
+		}
+
+		metadataKey, ok := strings.CutPrefix(strings.ToLower(k), metadataPrefix)
+		if !ok {
+			continue
+		}
+
+		result[metadataKey] = v[0]
+	}
+
+	return result
+}
+
+// escapeQuery returns the URI encoded request query parameters according to the AWS S3 spec requirements
+// (it is similar to url.Values.Encode but instead of url.QueryEscape uses our own escape method).
+func escapeQuery(values url.Values) string {
+	if len(values) == 0 {
+		return ""
+	}
+
+	var buf strings.Builder
+
+	keys := make([]string, 0, len(values))
+	for k := range values {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+
+	for _, k := range keys {
+		vs := values[k]
+		keyEscaped := escape(k)
+		for _, values := range vs {
+			if buf.Len() > 0 {
+				buf.WriteByte('&')
+			}
+			buf.WriteString(keyEscaped)
+			buf.WriteByte('=')
+			buf.WriteString(escape(values))
+		}
+	}
+
+	return buf.String()
+}
+
+// escapePath returns the URI encoded request path according to the AWS S3 spec requirements.
+func escapePath(path string) string {
+	parts := strings.Split(path, "/")
+
+	for i, part := range parts {
+		parts[i] = escape(part)
+	}
+
+	return strings.Join(parts, "/")
+}
+
+const upperhex = "0123456789ABCDEF"
+
+// escape is similar to the std url.escape but implements the AWS [UriEncode requirements]:
+//   - URI encode every byte except the unreserved characters: 'A'-'Z', 'a'-'z', '0'-'9', '-', '.', '_', and '~'.
+//   - The space character is a reserved character and must be encoded as "%20" (and not as "+").
+//   - Each URI encoded byte is formed by a '%' and the two-digit hexadecimal value of the byte.
+//   - Letters in the hexadecimal value must be uppercase, for example "%1A".
+//
+// [UriEncode requirements]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+func escape(s string) string {
+	hexCount := 0
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		if shouldEscape(c) {
+			hexCount++
+		}
+	}
+
+	if hexCount == 0 {
+		return s
+	}
+
+	result := make([]byte, len(s)+2*hexCount)
+
+	j := 0
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		if shouldEscape(c) {
+			result[j] = '%'
+			result[j+1] = upperhex[c>>4]
+			result[j+2] = upperhex[c&15]
+			j += 3
+		} else {
+			result[j] = c
+			j++
+		}
+	}
+
+	return string(result)
+}
+
+// > "URI encode every byte except the unreserved characters: 'A'-'Z', 'a'-'z', '0'-'9', '-', '.', '_', and '~'."
+func shouldEscape(c byte) bool {
+	isUnreserved := (c >= 'A' && c <= 'Z') ||
+		(c >= 'a' && c <= 'z') ||
+		(c >= '0' && c <= '9') ||
+		c == '-' || c == '.' || c == '_' || c == '~'
+
+	return !isUnreserved
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3_escape_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3_escape_test.go
new file mode 100644
index 0000000..fedc330
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3_escape_test.go
@@ -0,0 +1,35 @@
+package s3
+
+import (
+	"net/url"
+	"testing"
+)
+
+func TestEscapePath(t *testing.T) {
+	t.Parallel()
+
+	escaped := escapePath("/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~ !@#$%^&*()+={}[]?><\\|,`'\"/@sub1/@sub2/a/b/c/1/2/3")
+
+	expected := "/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~%20%21%40%23%24%25%5E%26%2A%28%29%2B%3D%7B%7D%5B%5D%3F%3E%3C%5C%7C%2C%60%27%22/%40sub1/%40sub2/a/b/c/1/2/3"
+
+	if escaped != expected {
+		t.Fatalf("Expected\n%s\ngot\n%s", expected, escaped)
+	}
+}
+
+func TestEscapeQuery(t *testing.T) {
+	t.Parallel()
+
+	escaped := escapeQuery(url.Values{
+		"abc": []string{"123"},
+		"/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~ !@#$%^&*()+={}[]?><\\|,`'\"": []string{
+			"/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~ !@#$%^&*()+={}[]?><\\|,`'\"",
+		},
+	})
+
+	expected := "%2FABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~%20%21%40%23%24%25%5E%26%2A%28%29%2B%3D%7B%7D%5B%5D%3F%3E%3C%5C%7C%2C%60%27%22=%2FABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~%20%21%40%23%24%25%5E%26%2A%28%29%2B%3D%7B%7D%5B%5D%3F%3E%3C%5C%7C%2C%60%27%22&abc=123"
+
+	if escaped != expected {
+		t.Fatalf("Expected\n%s\ngot\n%s", expected, escaped)
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3_test.go
new file mode 100644
index 0000000..edb1cc4
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/s3_test.go
@@ -0,0 +1,262 @@
+package s3_test
+
+import (
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestS3URL(t *testing.T) {
+	t.Parallel()
+
+	path := "/test_key/a/b c@d?a=@1&b=!2#@a b c"
+
+	// note: query params and fragments are kept as it is
+	// since they are later escaped if necessery by the Go HTTP client
+	expectedPath := "/test_key/a/b%20c%40d?a=@1&b=!2#@a b c"
+
+	scenarios := []struct {
+		name     string
+		s3Client *s3.S3
+		expected string
+	}{
+		{
+			"no schema",
+			&s3.S3{
+				Region:    "test_region",
+				Bucket:    "test_bucket",
+				Endpoint:  "example.com/",
+				AccessKey: "123",
+				SecretKey: "abc",
+			},
+			"https://test_bucket.example.com" + expectedPath,
+		},
+		{
+			"with https schema",
+			&s3.S3{
+				Region:    "test_region",
+				Bucket:    "test_bucket",
+				Endpoint:  "https://example.com/",
+				AccessKey: "123",
+				SecretKey: "abc",
+			},
+			"https://test_bucket.example.com" + expectedPath,
+		},
+		{
+			"with http schema",
+			&s3.S3{
+				Region:    "test_region",
+				Bucket:    "test_bucket",
+				Endpoint:  "http://example.com/",
+				AccessKey: "123",
+				SecretKey: "abc",
+			},
+			"http://test_bucket.example.com" + expectedPath,
+		},
+		{
+			"path style addressing (non-explicit schema)",
+			&s3.S3{
+				Region:       "test_region",
+				Bucket:       "test_bucket",
+				Endpoint:     "example.com/",
+				AccessKey:    "123",
+				SecretKey:    "abc",
+				UsePathStyle: true,
+			},
+			"https://example.com/test_bucket" + expectedPath,
+		},
+		{
+			"path style addressing (explicit schema)",
+			&s3.S3{
+				Region:       "test_region",
+				Bucket:       "test_bucket",
+				Endpoint:     "http://example.com/",
+				AccessKey:    "123",
+				SecretKey:    "abc",
+				UsePathStyle: true,
+			},
+			"http://example.com/test_bucket" + expectedPath,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.s3Client.URL(path)
+			if result != s.expected {
+				t.Fatalf("Expected URL\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestS3SignAndSend(t *testing.T) {
+	t.Parallel()
+
+	testResponse := func() *http.Response {
+		return &http.Response{
+			Body: io.NopCloser(strings.NewReader("test_response")),
+		}
+	}
+
+	scenarios := []struct {
+		name     string
+		path     string
+		reqFunc  func(req *http.Request)
+		s3Client *s3.S3
+	}{
+		{
+			"minimal",
+			"/test",
+			func(req *http.Request) {
+				req.Header.Set("x-amz-date", "20250102T150405Z")
+			},
+			&s3.S3{
+				Region:    "test_region",
+				Bucket:    "test_bucket",
+				Endpoint:  "https://example.com/",
+				AccessKey: "123",
+				SecretKey: "abc",
+				Client: tests.NewClient(&tests.RequestStub{
+					Method:   http.MethodGet,
+					URL:      "https://test_bucket.example.com/test",
+					Response: testResponse(),
+					Match: func(req *http.Request) bool {
+						return tests.ExpectHeaders(req.Header, map[string]string{
+							"Authorization":        "AWS4-HMAC-SHA256 Credential=123/20250102/test_region/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=ea093662bc1deef08dfb4ac35453dfaad5ea89edf102e9dd3b7156c9a27e4c1f",
+							"Host":                 "test_bucket.example.com",
+							"X-Amz-Content-Sha256": "UNSIGNED-PAYLOAD",
+							"X-Amz-Date":           "20250102T150405Z",
+						})
+					},
+				}),
+			},
+		},
+		{
+			"minimal with different access and secret keys",
+			"/test",
+			func(req *http.Request) {
+				req.Header.Set("x-amz-date", "20250102T150405Z")
+			},
+			&s3.S3{
+				Region:    "test_region",
+				Bucket:    "test_bucket",
+				Endpoint:  "https://example.com/",
+				AccessKey: "456",
+				SecretKey: "def",
+				Client: tests.NewClient(&tests.RequestStub{
+					Method:   http.MethodGet,
+					URL:      "https://test_bucket.example.com/test",
+					Response: testResponse(),
+					Match: func(req *http.Request) bool {
+						return tests.ExpectHeaders(req.Header, map[string]string{
+							"Authorization":        "AWS4-HMAC-SHA256 Credential=456/20250102/test_region/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=17510fa1f724403dd0a563b61c9b31d1d718f877fcbd75455620d17a8afce5fb",
+							"Host":                 "test_bucket.example.com",
+							"X-Amz-Content-Sha256": "UNSIGNED-PAYLOAD",
+							"X-Amz-Date":           "20250102T150405Z",
+						})
+					},
+				}),
+			},
+		},
+		{
+			"minimal with special characters",
+			"/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 -_.~!@&*():=$()?a=1&@b=@2#@a b c",
+			func(req *http.Request) {
+				req.Header.Set("x-amz-date", "20250102T150405Z")
+			},
+			&s3.S3{
+				Region:    "test_region",
+				Bucket:    "test_bucket",
+				Endpoint:  "https://example.com/",
+				AccessKey: "456",
+				SecretKey: "def",
+				Client: tests.NewClient(&tests.RequestStub{
+					Method:   http.MethodGet,
+					URL:      "https://test_bucket.example.com/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789%20-_.~%21%40%26%2A%28%29%3A%3D%24%28%29?a=1&@b=@2#@a%20b%20c",
+					Response: testResponse(),
+					Match: func(req *http.Request) bool {
+						return tests.ExpectHeaders(req.Header, map[string]string{
+							"Authorization":        "AWS4-HMAC-SHA256 Credential=456/20250102/test_region/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=9458a033554f52913801b3de16f54409b36ed25c6da3aed14e64439500e2c5e1",
+							"Host":                 "test_bucket.example.com",
+							"X-Amz-Content-Sha256": "UNSIGNED-PAYLOAD",
+							"X-Amz-Date":           "20250102T150405Z",
+						})
+					},
+				}),
+			},
+		},
+		{
+			"with extra headers",
+			"/test",
+			func(req *http.Request) {
+				req.Header.Set("x-amz-date", "20250102T150405Z")
+				req.Header.Set("x-amz-content-sha256", "test_sha256")
+				req.Header.Set("x-amz-example", "123")
+				req.Header.Set("x-amz-meta-a", "456")
+				req.Header.Set("content-type", "image/png")
+				req.Header.Set("x-test", "789") // shouldn't be included in the signing headers
+			},
+			&s3.S3{
+				Region:    "test_region",
+				Bucket:    "test_bucket",
+				Endpoint:  "https://example.com/",
+				AccessKey: "123",
+				SecretKey: "abc",
+				Client: tests.NewClient(&tests.RequestStub{
+					Method:   http.MethodGet,
+					URL:      "https://test_bucket.example.com/test",
+					Response: testResponse(),
+					Match: func(req *http.Request) bool {
+						return tests.ExpectHeaders(req.Header, map[string]string{
+							"authorization":        "AWS4-HMAC-SHA256 Credential=123/20250102/test_region/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date;x-amz-example;x-amz-meta-a, Signature=86dccbcd012c33073dc99e9d0a9e0b717a4d8c11c37848cfa9a4a02716bc0db3",
+							"host":                 "test_bucket.example.com",
+							"x-amz-date":           "20250102T150405Z",
+							"x-amz-content-sha256": "test_sha256",
+							"x-amz-example":        "123",
+							"x-amz-meta-a":         "456",
+							"x-test":               "789",
+						})
+					},
+				}),
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodGet, s.s3Client.URL(s.path), strings.NewReader("test_request"))
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if s.reqFunc != nil {
+				s.reqFunc(req)
+			}
+
+			resp, err := s.s3Client.SignAndSend(req)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer resp.Body.Close()
+
+			err = s.s3Client.Client.(*tests.Client).AssertNoRemaining()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			expectedBody := "test_response"
+
+			body, err := io.ReadAll(resp.Body)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if str := string(body); str != expectedBody {
+				t.Fatalf("Expected body %q, got %q", expectedBody, str)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/tests/client.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/tests/client.go
new file mode 100644
index 0000000..b06fb22
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/tests/client.go
@@ -0,0 +1,111 @@
+// Package tests contains various tests helpers and utilities to assist
+// with the S3 client testing.
+package tests
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"slices"
+	"strings"
+	"sync"
+)
+
+// NewClient creates a new test Client loaded with the specified RequestStubs.
+func NewClient(stubs ...*RequestStub) *Client {
+	return &Client{stubs: stubs}
+}
+
+type RequestStub struct {
+	Method   string
+	URL      string // plain string or regex pattern wrapped in "^pattern$"
+	Match    func(req *http.Request) bool
+	Response *http.Response
+}
+
+type Client struct {
+	stubs []*RequestStub
+	mu    sync.Mutex
+}
+
+// AssertNoRemaining asserts that current client has no unprocessed requests remaining.
+func (c *Client) AssertNoRemaining() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if len(c.stubs) == 0 {
+		return nil
+	}
+
+	msgParts := make([]string, 0, len(c.stubs)+1)
+	msgParts = append(msgParts, "not all stub requests were processed:")
+	for _, stub := range c.stubs {
+		msgParts = append(msgParts, "- "+stub.Method+" "+stub.URL)
+	}
+
+	return errors.New(strings.Join(msgParts, "\n"))
+}
+
+// Do implements the [s3.HTTPClient] interface.
+func (c *Client) Do(req *http.Request) (*http.Response, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	for i, stub := range c.stubs {
+		if req.Method != stub.Method {
+			continue
+		}
+
+		urlPattern := stub.URL
+		if !strings.HasPrefix(urlPattern, "^") && !strings.HasSuffix(urlPattern, "$") {
+			urlPattern = "^" + regexp.QuoteMeta(urlPattern) + "$"
+		}
+
+		urlRegex, err := regexp.Compile(urlPattern)
+		if err != nil {
+			return nil, err
+		}
+
+		if !urlRegex.MatchString(req.URL.String()) {
+			continue
+		}
+
+		if stub.Match != nil && !stub.Match(req) {
+			continue
+		}
+
+		// remove from the remaining stubs
+		c.stubs = slices.Delete(c.stubs, i, i+1)
+
+		response := stub.Response
+		if response == nil {
+			response = &http.Response{}
+		}
+		if response.Header == nil {
+			response.Header = http.Header{}
+		}
+		if response.Body == nil {
+			response.Body = http.NoBody
+		}
+
+		response.Request = req
+
+		return response, nil
+	}
+
+	var body []byte
+	if req.Body != nil {
+		defer req.Body.Close()
+		body, _ = io.ReadAll(req.Body)
+	}
+
+	return nil, fmt.Errorf(
+		"the below request doesn't have a corresponding stub:\n%s %s\nHeaders: %v\nBody: %q",
+		req.Method,
+		req.URL.String(),
+		req.Header,
+		body,
+	)
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/tests/headers.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/tests/headers.go
new file mode 100644
index 0000000..21464c7
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/tests/headers.go
@@ -0,0 +1,33 @@
+package tests
+
+import (
+	"net/http"
+	"regexp"
+	"strings"
+)
+
+// ExpectHeaders checks whether specified headers match the expectations.
+// The expectations map entry key is the header name.
+// The expectations map entry value is the first header value. If wrapped with `^...$`
+// it is compared as regular expression.
+func ExpectHeaders(headers http.Header, expectations map[string]string) bool {
+	for h, expected := range expectations {
+		v := headers.Get(h)
+
+		pattern := expected
+		if !strings.HasPrefix(pattern, "^") && !strings.HasSuffix(pattern, "$") {
+			pattern = "^" + regexp.QuoteMeta(pattern) + "$"
+		}
+
+		expectedRegex, err := regexp.Compile(pattern)
+		if err != nil {
+			return false
+		}
+
+		if !expectedRegex.MatchString(v) {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/uploader.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/uploader.go
new file mode 100644
index 0000000..1c12ba3
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/uploader.go
@@ -0,0 +1,416 @@
+package s3
+
+import (
+	"bytes"
+	"context"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+
+	"golang.org/x/sync/errgroup"
+)
+
+var ErrUsedUploader = errors.New("the Uploader has been already used")
+
+const (
+	defaultMaxConcurrency int = 5
+	defaultMinPartSize    int = 6 << 20
+)
+
+// Uploader handles the upload of a single S3 object.
+//
+// If the Payload size is less than the configured MinPartSize it sends
+// a single (PutObject) request, otherwise performs chunked/multipart upload.
+type Uploader struct {
+	// S3 is the S3 client instance performing the upload object request (required).
+	S3 *S3
+
+	// Payload is the object content to upload (required).
+	Payload io.Reader
+
+	// Key is the destination key of the uploaded object (required).
+	Key string
+
+	// Metadata specifies the optional metadata to write with the object upload.
+	Metadata map[string]string
+
+	// MaxConcurrency specifies the max number of workers to use when
+	// performing chunked/multipart upload.
+	//
+	// If zero or negative, defaults to 5.
+	//
+	// This option is used only when the Payload size is > MinPartSize.
+	MaxConcurrency int
+
+	// MinPartSize specifies the min Payload size required to perform
+	// chunked/multipart upload.
+	//
+	// If zero or negative, defaults to ~6MB.
+	MinPartSize int
+
+	uploadId       string
+	uploadedParts  []*mpPart
+	lastPartNumber int
+	mu             sync.Mutex // guards lastPartNumber and the uploadedParts slice
+	used           bool
+}
+
+// Upload processes the current Uploader instance.
+//
+// Users can specify an optional optReqFuncs that will be passed down to all Upload internal requests
+// (single upload, multipart init, multipart parts upload, multipart complete, multipart abort).
+//
+// Note that after this call the Uploader should be discarded (aka. no longer can be used).
+func (u *Uploader) Upload(ctx context.Context, optReqFuncs ...func(*http.Request)) error {
+	if u.used {
+		return ErrUsedUploader
+	}
+
+	err := u.validateAndNormalize()
+	if err != nil {
+		return err
+	}
+
+	initPart, _, err := u.nextPart()
+	if err != nil && !errors.Is(err, io.EOF) {
+		return err
+	}
+
+	if len(initPart) < u.MinPartSize {
+		return u.singleUpload(ctx, initPart, optReqFuncs...)
+	}
+
+	err = u.multipartInit(ctx, optReqFuncs...)
+	if err != nil {
+		return fmt.Errorf("multipart init error: %w", err)
+	}
+
+	err = u.multipartUpload(ctx, initPart, optReqFuncs...)
+	if err != nil {
+		return errors.Join(
+			u.multipartAbort(ctx, optReqFuncs...),
+			fmt.Errorf("multipart upload error: %w", err),
+		)
+	}
+
+	err = u.multipartComplete(ctx, optReqFuncs...)
+	if err != nil {
+		return errors.Join(
+			u.multipartAbort(ctx, optReqFuncs...),
+			fmt.Errorf("multipart complete error: %w", err),
+		)
+	}
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+func (u *Uploader) validateAndNormalize() error {
+	if u.S3 == nil {
+		return errors.New("Uploader.S3 must be a non-empty and properly initialized S3 client instance")
+	}
+
+	if u.Key == "" {
+		return errors.New("Uploader.Key is required")
+	}
+
+	if u.Payload == nil {
+		return errors.New("Uploader.Payload must be non-nill")
+	}
+
+	if u.MaxConcurrency <= 0 {
+		u.MaxConcurrency = defaultMaxConcurrency
+	}
+
+	if u.MinPartSize <= 0 {
+		u.MinPartSize = defaultMinPartSize
+	}
+
+	return nil
+}
+
+func (u *Uploader) singleUpload(ctx context.Context, part []byte, optReqFuncs ...func(*http.Request)) error {
+	if u.used {
+		return ErrUsedUploader
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, u.S3.URL(u.Key), bytes.NewReader(part))
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("Content-Length", strconv.Itoa(len(part)))
+
+	for k, v := range u.Metadata {
+		req.Header.Set(metadataPrefix+k, v)
+	}
+
+	// apply optional request funcs
+	for _, fn := range optReqFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := u.S3.SignAndSend(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	return nil
+}
+
+// -------------------------------------------------------------------
+
+type mpPart struct {
+	XMLName    xml.Name `xml:"Part"`
+	ETag       string   `xml:"ETag"`
+	PartNumber int      `xml:"PartNumber"`
+}
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html
+func (u *Uploader) multipartInit(ctx context.Context, optReqFuncs ...func(*http.Request)) error {
+	if u.used {
+		return ErrUsedUploader
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, u.S3.URL(u.Key+"?uploads"), nil)
+	if err != nil {
+		return err
+	}
+
+	for k, v := range u.Metadata {
+		req.Header.Set(metadataPrefix+k, v)
+	}
+
+	// apply optional request funcs
+	for _, fn := range optReqFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := u.S3.SignAndSend(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	body := &struct {
+		XMLName  xml.Name `xml:"InitiateMultipartUploadResult"`
+		UploadId string   `xml:"UploadId"`
+	}{}
+
+	err = xml.NewDecoder(resp.Body).Decode(body)
+	if err != nil {
+		return err
+	}
+
+	u.uploadId = body.UploadId
+
+	return nil
+}
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html
+func (u *Uploader) multipartAbort(ctx context.Context, optReqFuncs ...func(*http.Request)) error {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+
+	u.used = true
+
+	// ensure that the specified abort context is always valid to allow cleanup
+	var abortCtx = ctx
+	if abortCtx.Err() != nil {
+		abortCtx = context.Background()
+	}
+
+	query := url.Values{"uploadId": []string{u.uploadId}}
+
+	req, err := http.NewRequestWithContext(abortCtx, http.MethodDelete, u.S3.URL(u.Key+"?"+query.Encode()), nil)
+	if err != nil {
+		return err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optReqFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := u.S3.SignAndSend(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	return nil
+}
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_CompleteMultipartUpload.html
+func (u *Uploader) multipartComplete(ctx context.Context, optReqFuncs ...func(*http.Request)) error {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+
+	u.used = true
+
+	// the list of parts must be sorted in ascending order
+	slices.SortFunc(u.uploadedParts, func(a, b *mpPart) int {
+		if a.PartNumber < b.PartNumber {
+			return -1
+		}
+		if a.PartNumber > b.PartNumber {
+			return 1
+		}
+		return 0
+	})
+
+	// build a request payload with the uploaded parts
+	xmlParts := &struct {
+		XMLName xml.Name `xml:"CompleteMultipartUpload"`
+		Parts   []*mpPart
+	}{
+		Parts: u.uploadedParts,
+	}
+	rawXMLParts, err := xml.Marshal(xmlParts)
+	if err != nil {
+		return err
+	}
+	reqPayload := strings.NewReader(xml.Header + string(rawXMLParts))
+
+	query := url.Values{"uploadId": []string{u.uploadId}}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, u.S3.URL(u.Key+"?"+query.Encode()), reqPayload)
+	if err != nil {
+		return err
+	}
+
+	// apply optional request funcs
+	for _, fn := range optReqFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := u.S3.SignAndSend(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	return nil
+}
+
+func (u *Uploader) nextPart() ([]byte, int, error) {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+
+	part := make([]byte, u.MinPartSize)
+	n, err := io.ReadFull(u.Payload, part)
+
+	// normalize io.EOF errors and ensure that io.EOF is returned only when there were no read bytes
+	if err != nil && (errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF)) {
+		if n == 0 {
+			err = io.EOF
+		} else {
+			err = nil
+		}
+	}
+
+	u.lastPartNumber++
+
+	return part[0:n], u.lastPartNumber, err
+}
+
+func (u *Uploader) multipartUpload(ctx context.Context, initPart []byte, optReqFuncs ...func(*http.Request)) error {
+	var g errgroup.Group
+	g.SetLimit(u.MaxConcurrency)
+
+	totalWorkers := u.MaxConcurrency
+
+	if len(initPart) != 0 {
+		totalWorkers--
+		initPartNumber := u.lastPartNumber
+		g.Go(func() error {
+			mp, err := u.uploadPart(ctx, initPartNumber, initPart, optReqFuncs...)
+			if err != nil {
+				return err
+			}
+
+			u.mu.Lock()
+			u.uploadedParts = append(u.uploadedParts, mp)
+			u.mu.Unlock()
+
+			return nil
+		})
+	}
+
+	totalWorkers = max(totalWorkers, 1)
+
+	for i := 0; i < totalWorkers; i++ {
+		g.Go(func() error {
+			for {
+				part, num, err := u.nextPart()
+				if err != nil {
+					if errors.Is(err, io.EOF) {
+						break
+					}
+					return err
+				}
+
+				mp, err := u.uploadPart(ctx, num, part, optReqFuncs...)
+				if err != nil {
+					return err
+				}
+
+				u.mu.Lock()
+				u.uploadedParts = append(u.uploadedParts, mp)
+				u.mu.Unlock()
+			}
+
+			return nil
+		})
+	}
+
+	return g.Wait()
+}
+
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPart.html
+func (u *Uploader) uploadPart(ctx context.Context, partNumber int, partData []byte, optReqFuncs ...func(*http.Request)) (*mpPart, error) {
+	query := url.Values{}
+	query.Set("uploadId", u.uploadId)
+	query.Set("partNumber", strconv.Itoa(partNumber))
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, u.S3.URL(u.Key+"?"+query.Encode()), bytes.NewReader(partData))
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Content-Length", strconv.Itoa(len(partData)))
+
+	// apply optional request funcs
+	for _, fn := range optReqFuncs {
+		if fn != nil {
+			fn(req)
+		}
+	}
+
+	resp, err := u.S3.SignAndSend(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	return &mpPart{
+		PartNumber: partNumber,
+		ETag:       resp.Header.Get("ETag"),
+	}, nil
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3/uploader_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/uploader_test.go
new file mode 100644
index 0000000..1665202
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3/uploader_test.go
@@ -0,0 +1,471 @@
+package s3_test
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestUploaderRequiredFields(t *testing.T) {
+	t.Parallel()
+
+	s3Client := &s3.S3{
+		Client:    tests.NewClient(&tests.RequestStub{Method: "PUT", URL: `^.+$`}), // match every upload
+		Region:    "test_region",
+		Bucket:    "test_bucket",
+		Endpoint:  "http://example.com",
+		AccessKey: "123",
+		SecretKey: "abc",
+	}
+
+	payload := strings.NewReader("test")
+
+	scenarios := []struct {
+		name          string
+		uploader      *s3.Uploader
+		expectedError bool
+	}{
+		{
+			"blank",
+			&s3.Uploader{},
+			true,
+		},
+		{
+			"no Key",
+			&s3.Uploader{S3: s3Client, Payload: payload},
+			true,
+		},
+		{
+			"no S3",
+			&s3.Uploader{Key: "abc", Payload: payload},
+			true,
+		},
+		{
+			"no Payload",
+			&s3.Uploader{S3: s3Client, Key: "abc"},
+			true,
+		},
+		{
+			"with S3, Key and Payload",
+			&s3.Uploader{S3: s3Client, Key: "abc", Payload: payload},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := s.uploader.Upload(context.Background())
+
+			hasErr := err != nil
+			if hasErr != s.expectedError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectedError, hasErr)
+			}
+		})
+	}
+}
+
+func TestUploaderSingleUpload(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodPut,
+			URL:    "http://test_bucket.example.com/test_key",
+			Match: func(req *http.Request) bool {
+				body, err := io.ReadAll(req.Body)
+				if err != nil {
+					return false
+				}
+
+				return string(body) == "abcdefg" && tests.ExpectHeaders(req.Header, map[string]string{
+					"Content-Length": "7",
+					"x-amz-meta-a":   "123",
+					"x-amz-meta-b":   "456",
+					"test_header":    "test",
+					"Authorization":  "^.+Credential=123/.+$",
+				})
+			},
+		},
+	)
+
+	uploader := &s3.Uploader{
+		S3: &s3.S3{
+			Client:    httpClient,
+			Region:    "test_region",
+			Bucket:    "test_bucket",
+			Endpoint:  "http://example.com",
+			AccessKey: "123",
+			SecretKey: "abc",
+		},
+		Key:         "test_key",
+		Payload:     strings.NewReader("abcdefg"),
+		Metadata:    map[string]string{"a": "123", "b": "456"},
+		MinPartSize: 8,
+	}
+
+	err := uploader.Upload(context.Background(), func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestUploaderMultipartUploadSuccess(t *testing.T) {
+	t.Parallel()
+
+	maxConcurrencies := []int{-1, 0, 1, 10}
+
+	for _, mc := range maxConcurrencies {
+		t.Run("MaxConcurrency_"+strconv.Itoa(mc), func(t *testing.T) {
+			httpClient := tests.NewClient(
+				&tests.RequestStub{
+					Method: http.MethodPost,
+					URL:    "http://test_bucket.example.com/test_key?uploads",
+					Match: func(req *http.Request) bool {
+						return tests.ExpectHeaders(req.Header, map[string]string{
+							"x-amz-meta-a":  "123",
+							"x-amz-meta-b":  "456",
+							"test_header":   "test",
+							"Authorization": "^.+Credential=123/.+$",
+						})
+					},
+					Response: &http.Response{
+						Body: io.NopCloser(strings.NewReader(`
+					<?xml version="1.0" encoding="UTF-8"?>
+					<InitiateMultipartUploadResult>
+					   <Bucket>test_bucket</Bucket>
+					   <Key>test_key</Key>
+					   <UploadId>test_id</UploadId>
+					</InitiateMultipartUploadResult>
+				`)),
+					},
+				},
+				&tests.RequestStub{
+					Method: http.MethodPut,
+					URL:    "http://test_bucket.example.com/test_key?partNumber=1&uploadId=test_id",
+					Match: func(req *http.Request) bool {
+						body, err := io.ReadAll(req.Body)
+						if err != nil {
+							return false
+						}
+
+						return string(body) == "abc" && tests.ExpectHeaders(req.Header, map[string]string{
+							"Content-Length": "3",
+							"test_header":    "test",
+							"Authorization":  "^.+Credential=123/.+$",
+						})
+					},
+					Response: &http.Response{
+						Header: http.Header{"Etag": []string{"etag1"}},
+					},
+				},
+				&tests.RequestStub{
+					Method: http.MethodPut,
+					URL:    "http://test_bucket.example.com/test_key?partNumber=2&uploadId=test_id",
+					Match: func(req *http.Request) bool {
+						body, err := io.ReadAll(req.Body)
+						if err != nil {
+							return false
+						}
+
+						return string(body) == "def" && tests.ExpectHeaders(req.Header, map[string]string{
+							"Content-Length": "3",
+							"test_header":    "test",
+							"Authorization":  "^.+Credential=123/.+$",
+						})
+					},
+					Response: &http.Response{
+						Header: http.Header{"Etag": []string{"etag2"}},
+					},
+				},
+				&tests.RequestStub{
+					Method: http.MethodPut,
+					URL:    "http://test_bucket.example.com/test_key?partNumber=3&uploadId=test_id",
+					Match: func(req *http.Request) bool {
+						body, err := io.ReadAll(req.Body)
+						if err != nil {
+							return false
+						}
+						return string(body) == "g" && tests.ExpectHeaders(req.Header, map[string]string{
+							"Content-Length": "1",
+							"test_header":    "test",
+							"Authorization":  "^.+Credential=123/.+$",
+						})
+					},
+					Response: &http.Response{
+						Header: http.Header{"Etag": []string{"etag3"}},
+					},
+				},
+				&tests.RequestStub{
+					Method: http.MethodPost,
+					URL:    "http://test_bucket.example.com/test_key?uploadId=test_id",
+					Match: func(req *http.Request) bool {
+						body, err := io.ReadAll(req.Body)
+						if err != nil {
+							return false
+						}
+
+						expected := `<CompleteMultipartUpload><Part><ETag>etag1</ETag><PartNumber>1</PartNumber></Part><Part><ETag>etag2</ETag><PartNumber>2</PartNumber></Part><Part><ETag>etag3</ETag><PartNumber>3</PartNumber></Part></CompleteMultipartUpload>`
+
+						return strings.Contains(string(body), expected) && tests.ExpectHeaders(req.Header, map[string]string{
+							"test_header":   "test",
+							"Authorization": "^.+Credential=123/.+$",
+						})
+					},
+				},
+			)
+
+			uploader := &s3.Uploader{
+				S3: &s3.S3{
+					Client:    httpClient,
+					Region:    "test_region",
+					Bucket:    "test_bucket",
+					Endpoint:  "http://example.com",
+					AccessKey: "123",
+					SecretKey: "abc",
+				},
+				Key:            "test_key",
+				Payload:        strings.NewReader("abcdefg"),
+				Metadata:       map[string]string{"a": "123", "b": "456"},
+				MinPartSize:    3,
+				MaxConcurrency: mc,
+			}
+
+			err := uploader.Upload(context.Background(), func(r *http.Request) {
+				r.Header.Set("test_header", "test")
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			err = httpClient.AssertNoRemaining()
+			if err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func TestUploaderMultipartUploadPartFailure(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodPost,
+			URL:    "http://test_bucket.example.com/test_key?uploads",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"x-amz-meta-a":  "123",
+					"x-amz-meta-b":  "456",
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Body: io.NopCloser(strings.NewReader(`
+					<?xml version="1.0" encoding="UTF-8"?>
+					<InitiateMultipartUploadResult>
+					   <Bucket>test_bucket</Bucket>
+					   <Key>test_key</Key>
+					   <UploadId>test_id</UploadId>
+					</InitiateMultipartUploadResult>
+				`)),
+			},
+		},
+		&tests.RequestStub{
+			Method: http.MethodPut,
+			URL:    "http://test_bucket.example.com/test_key?partNumber=1&uploadId=test_id",
+			Match: func(req *http.Request) bool {
+				body, err := io.ReadAll(req.Body)
+				if err != nil {
+					return false
+				}
+				return string(body) == "abc" && tests.ExpectHeaders(req.Header, map[string]string{
+					"Content-Length": "3",
+					"test_header":    "test",
+					"Authorization":  "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Header: http.Header{"Etag": []string{"etag1"}},
+			},
+		},
+		&tests.RequestStub{
+			Method: http.MethodPut,
+			URL:    "http://test_bucket.example.com/test_key?partNumber=2&uploadId=test_id",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				StatusCode: 400,
+			},
+		},
+		&tests.RequestStub{
+			Method: http.MethodDelete,
+			URL:    "http://test_bucket.example.com/test_key?uploadId=test_id",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+		},
+	)
+
+	uploader := &s3.Uploader{
+		S3: &s3.S3{
+			Client:    httpClient,
+			Region:    "test_region",
+			Bucket:    "test_bucket",
+			Endpoint:  "http://example.com",
+			AccessKey: "123",
+			SecretKey: "abc",
+		},
+		Key:         "test_key",
+		Payload:     strings.NewReader("abcdefg"),
+		Metadata:    map[string]string{"a": "123", "b": "456"},
+		MinPartSize: 3,
+	}
+
+	err := uploader.Upload(context.Background(), func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err == nil {
+		t.Fatal("Expected non-nil error")
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestUploaderMultipartUploadCompleteFailure(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodPost,
+			URL:    "http://test_bucket.example.com/test_key?uploads",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"x-amz-meta-a":  "123",
+					"x-amz-meta-b":  "456",
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Body: io.NopCloser(strings.NewReader(`
+					<?xml version="1.0" encoding="UTF-8"?>
+					<InitiateMultipartUploadResult>
+					   <Bucket>test_bucket</Bucket>
+					   <Key>test_key</Key>
+					   <UploadId>test_id</UploadId>
+					</InitiateMultipartUploadResult>
+				`)),
+			},
+		},
+		&tests.RequestStub{
+			Method: http.MethodPut,
+			URL:    "http://test_bucket.example.com/test_key?partNumber=1&uploadId=test_id",
+			Match: func(req *http.Request) bool {
+				body, err := io.ReadAll(req.Body)
+				if err != nil {
+					return false
+				}
+				return string(body) == "abc" && tests.ExpectHeaders(req.Header, map[string]string{
+					"Content-Length": "3",
+					"test_header":    "test",
+					"Authorization":  "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Header: http.Header{"Etag": []string{"etag1"}},
+			},
+		},
+		&tests.RequestStub{
+			Method: http.MethodPut,
+			URL:    "http://test_bucket.example.com/test_key?partNumber=2&uploadId=test_id",
+			Match: func(req *http.Request) bool {
+				body, err := io.ReadAll(req.Body)
+				if err != nil {
+					return false
+				}
+				return string(body) == "def" && tests.ExpectHeaders(req.Header, map[string]string{
+					"Content-Length": "3",
+					"test_header":    "test",
+					"Authorization":  "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				Header: http.Header{"Etag": []string{"etag2"}},
+			},
+		},
+		&tests.RequestStub{
+			Method: http.MethodPost,
+			URL:    "http://test_bucket.example.com/test_key?uploadId=test_id",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+			Response: &http.Response{
+				StatusCode: 400,
+			},
+		},
+		&tests.RequestStub{
+			Method: http.MethodDelete,
+			URL:    "http://test_bucket.example.com/test_key?uploadId=test_id",
+			Match: func(req *http.Request) bool {
+				return tests.ExpectHeaders(req.Header, map[string]string{
+					"test_header":   "test",
+					"Authorization": "^.+Credential=123/.+$",
+				})
+			},
+		},
+	)
+
+	uploader := &s3.Uploader{
+		S3: &s3.S3{
+			Client:    httpClient,
+			Region:    "test_region",
+			Bucket:    "test_bucket",
+			Endpoint:  "http://example.com",
+			AccessKey: "123",
+			SecretKey: "abc",
+		},
+		Key:         "test_key",
+		Payload:     strings.NewReader("abcdef"),
+		Metadata:    map[string]string{"a": "123", "b": "456"},
+		MinPartSize: 3,
+	}
+
+	err := uploader.Upload(context.Background(), func(r *http.Request) {
+		r.Header.Set("test_header", "test")
+	})
+	if err == nil {
+		t.Fatal("Expected non-nil error")
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3blob.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3blob.go
new file mode 100644
index 0000000..c0143e4
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3blob.go
@@ -0,0 +1,487 @@
+// Package s3blob provides a blob.Bucket S3 driver implementation.
+//
+// NB! To minimize breaking changes with older PocketBase releases,
+// the driver is based of the previously used gocloud.dev/blob/s3blob,
+// hence many of the below doc comments, struct options and interface
+// implementations are the same.
+//
+// The blob abstraction supports all UTF-8 strings; to make this work with services lacking
+// full UTF-8 support, strings must be escaped (during writes) and unescaped
+// (during reads). The following escapes are performed for s3blob:
+//   - Blob keys: ASCII characters 0-31 are escaped to "__0x<hex>__".
+//     Additionally, the "/" in "../" is escaped in the same way.
+//   - Metadata keys: Escaped using URL encoding, then additionally "@:=" are
+//     escaped using "__0x<hex>__". These characters were determined by
+//     experimentation.
+//   - Metadata values: Escaped using URL encoding.
+//
+// Example:
+//
+//	drv, _ := s3blob.New(&s3.S3{
+//		Bucket:    "bucketName",
+//		Region:    "region",
+//		Endpoint:  "endpoint",
+//		AccessKey: "accessKey",
+//		SecretKey: "secretKey",
+//	})
+//	bucket := blob.NewBucket(drv)
+package s3blob
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+)
+
+const defaultPageSize = 1000
+
+// New creates a new instance of the S3 driver backed by the the internal S3 client.
+func New(s3Client *s3.S3) (blob.Driver, error) {
+	if s3Client.Bucket == "" {
+		return nil, errors.New("s3blob.New: missing bucket name")
+	}
+
+	if s3Client.Endpoint == "" {
+		return nil, errors.New("s3blob.New: missing endpoint")
+	}
+
+	if s3Client.Region == "" {
+		return nil, errors.New("s3blob.New: missing region")
+	}
+
+	return &driver{s3: s3Client}, nil
+}
+
+type driver struct {
+	s3 *s3.S3
+}
+
+// Close implements [blob/Driver.Close].
+func (drv *driver) Close() error {
+	return nil // nothing to close
+}
+
+// NormalizeError implements [blob/Driver.NormalizeError].
+func (drv *driver) NormalizeError(err error) error {
+	// already normalized
+	if errors.Is(err, blob.ErrNotFound) {
+		return err
+	}
+
+	// normalize base on its S3 error status or code
+	var ae *s3.ResponseError
+	if errors.As(err, &ae) {
+		if ae.Status == 404 {
+			return errors.Join(err, blob.ErrNotFound)
+		}
+
+		switch ae.Code {
+		case "NoSuchBucket", "NoSuchKey", "NotFound":
+			return errors.Join(err, blob.ErrNotFound)
+		}
+	}
+
+	return err
+}
+
+// ListPaged implements [blob/Driver.ListPaged].
+func (drv *driver) ListPaged(ctx context.Context, opts *blob.ListOptions) (*blob.ListPage, error) {
+	pageSize := opts.PageSize
+	if pageSize == 0 {
+		pageSize = defaultPageSize
+	}
+
+	listParams := s3.ListParams{
+		MaxKeys: pageSize,
+	}
+	if len(opts.PageToken) > 0 {
+		listParams.ContinuationToken = string(opts.PageToken)
+	}
+	if opts.Prefix != "" {
+		listParams.Prefix = escapeKey(opts.Prefix)
+	}
+	if opts.Delimiter != "" {
+		listParams.Delimiter = escapeKey(opts.Delimiter)
+	}
+
+	resp, err := drv.s3.ListObjects(ctx, listParams)
+	if err != nil {
+		return nil, err
+	}
+
+	page := blob.ListPage{}
+	if resp.NextContinuationToken != "" {
+		page.NextPageToken = []byte(resp.NextContinuationToken)
+	}
+
+	if n := len(resp.Contents) + len(resp.CommonPrefixes); n > 0 {
+		page.Objects = make([]*blob.ListObject, n)
+		for i, obj := range resp.Contents {
+			page.Objects[i] = &blob.ListObject{
+				Key:     unescapeKey(obj.Key),
+				ModTime: obj.LastModified,
+				Size:    obj.Size,
+				MD5:     eTagToMD5(obj.ETag),
+			}
+		}
+
+		for i, prefix := range resp.CommonPrefixes {
+			page.Objects[i+len(resp.Contents)] = &blob.ListObject{
+				Key:   unescapeKey(prefix.Prefix),
+				IsDir: true,
+			}
+		}
+
+		if len(resp.Contents) > 0 && len(resp.CommonPrefixes) > 0 {
+			// S3 gives us blobs and "directories" in separate lists; sort them.
+			sort.Slice(page.Objects, func(i, j int) bool {
+				return page.Objects[i].Key < page.Objects[j].Key
+			})
+		}
+	}
+
+	return &page, nil
+}
+
+// Attributes implements [blob/Driver.Attributes].
+func (drv *driver) Attributes(ctx context.Context, key string) (*blob.Attributes, error) {
+	key = escapeKey(key)
+
+	resp, err := drv.s3.HeadObject(ctx, key)
+	if err != nil {
+		return nil, err
+	}
+
+	md := make(map[string]string, len(resp.Metadata))
+	for k, v := range resp.Metadata {
+		// See the package comments for more details on escaping of metadata keys & values.
+		md[blob.HexUnescape(urlUnescape(k))] = urlUnescape(v)
+	}
+
+	return &blob.Attributes{
+		CacheControl:       resp.CacheControl,
+		ContentDisposition: resp.ContentDisposition,
+		ContentEncoding:    resp.ContentEncoding,
+		ContentLanguage:    resp.ContentLanguage,
+		ContentType:        resp.ContentType,
+		Metadata:           md,
+		// CreateTime not supported; left as the zero time.
+		ModTime: resp.LastModified,
+		Size:    resp.ContentLength,
+		MD5:     eTagToMD5(resp.ETag),
+		ETag:    resp.ETag,
+	}, nil
+}
+
+// NewRangeReader implements [blob/Driver.NewRangeReader].
+func (drv *driver) NewRangeReader(ctx context.Context, key string, offset, length int64) (blob.DriverReader, error) {
+	key = escapeKey(key)
+
+	var byteRange string
+	if offset > 0 && length < 0 {
+		byteRange = fmt.Sprintf("bytes=%d-", offset)
+	} else if length == 0 {
+		// AWS doesn't support a zero-length read; we'll read 1 byte and then
+		// ignore it in favor of http.NoBody below.
+		byteRange = fmt.Sprintf("bytes=%d-%d", offset, offset)
+	} else if length >= 0 {
+		byteRange = fmt.Sprintf("bytes=%d-%d", offset, offset+length-1)
+	}
+
+	reqOpt := func(req *http.Request) {
+		if byteRange != "" {
+			req.Header.Set("Range", byteRange)
+		}
+	}
+
+	resp, err := drv.s3.GetObject(ctx, key, reqOpt)
+	if err != nil {
+		return nil, err
+	}
+
+	body := resp.Body
+	if length == 0 {
+		body = http.NoBody
+	}
+
+	return &reader{
+		body: body,
+		attrs: &blob.ReaderAttributes{
+			ContentType: resp.ContentType,
+			ModTime:     resp.LastModified,
+			Size:        getSize(resp.ContentLength, resp.ContentRange),
+		},
+	}, nil
+}
+
+// NewTypedWriter implements [blob/Driver.NewTypedWriter].
+func (drv *driver) NewTypedWriter(ctx context.Context, key string, contentType string, opts *blob.WriterOptions) (blob.DriverWriter, error) {
+	key = escapeKey(key)
+
+	u := &s3.Uploader{
+		S3:  drv.s3,
+		Key: key,
+	}
+
+	if opts.BufferSize != 0 {
+		u.MinPartSize = opts.BufferSize
+	}
+
+	if opts.MaxConcurrency != 0 {
+		u.MaxConcurrency = opts.MaxConcurrency
+	}
+
+	md := make(map[string]string, len(opts.Metadata))
+	for k, v := range opts.Metadata {
+		// See the package comments for more details on escaping of metadata keys & values.
+		k = blob.HexEscape(url.PathEscape(k), func(runes []rune, i int) bool {
+			c := runes[i]
+			return c == '@' || c == ':' || c == '='
+		})
+		md[k] = url.PathEscape(v)
+	}
+	u.Metadata = md
+
+	var reqOptions []func(*http.Request)
+	reqOptions = append(reqOptions, func(r *http.Request) {
+		r.Header.Set("Content-Type", contentType)
+
+		if opts.CacheControl != "" {
+			r.Header.Set("Cache-Control", opts.CacheControl)
+		}
+		if opts.ContentDisposition != "" {
+			r.Header.Set("Content-Disposition", opts.ContentDisposition)
+		}
+		if opts.ContentEncoding != "" {
+			r.Header.Set("Content-Encoding", opts.ContentEncoding)
+		}
+		if opts.ContentLanguage != "" {
+			r.Header.Set("Content-Language", opts.ContentLanguage)
+		}
+		if len(opts.ContentMD5) > 0 {
+			r.Header.Set("Content-MD5", base64.StdEncoding.EncodeToString(opts.ContentMD5))
+		}
+	})
+
+	return &writer{
+		ctx:        ctx,
+		uploader:   u,
+		donec:      make(chan struct{}),
+		reqOptions: reqOptions,
+	}, nil
+}
+
+// Copy implements [blob/Driver.Copy].
+func (drv *driver) Copy(ctx context.Context, dstKey, srcKey string) error {
+	dstKey = escapeKey(dstKey)
+	srcKey = escapeKey(srcKey)
+	_, err := drv.s3.CopyObject(ctx, srcKey, dstKey)
+	return err
+}
+
+// Delete implements [blob/Driver.Delete].
+func (drv *driver) Delete(ctx context.Context, key string) error {
+	key = escapeKey(key)
+	return drv.s3.DeleteObject(ctx, key)
+}
+
+// -------------------------------------------------------------------
+
+// reader reads an S3 object. It implements io.ReadCloser.
+type reader struct {
+	attrs *blob.ReaderAttributes
+	body  io.ReadCloser
+}
+
+// Read implements [io/ReadCloser.Read].
+func (r *reader) Read(p []byte) (int, error) {
+	return r.body.Read(p)
+}
+
+// Close closes the reader itself. It must be called when done reading.
+func (r *reader) Close() error {
+	return r.body.Close()
+}
+
+// Attributes implements [blob/DriverReader.Attributes].
+func (r *reader) Attributes() *blob.ReaderAttributes {
+	return r.attrs
+}
+
+// -------------------------------------------------------------------
+
+// writer writes an S3 object, it implements io.WriteCloser.
+type writer struct {
+	ctx      context.Context
+	err      error // written before donec closes
+	uploader *s3.Uploader
+
+	// Ends of an io.Pipe, created when the first byte is written.
+	pw *io.PipeWriter
+	pr *io.PipeReader
+
+	donec chan struct{} // closed when done writing
+
+	reqOptions []func(*http.Request)
+}
+
+// Write appends p to w.pw. User must call Close to close the w after done writing.
+func (w *writer) Write(p []byte) (int, error) {
+	// Avoid opening the pipe for a zero-length write;
+	// the concrete can do these for empty blobs.
+	if len(p) == 0 {
+		return 0, nil
+	}
+
+	if w.pw == nil {
+		// We'll write into pw and use pr as an io.Reader for the
+		// Upload call to S3.
+		w.pr, w.pw = io.Pipe()
+		w.open(w.pr, true)
+	}
+
+	return w.pw.Write(p)
+}
+
+// r may be nil if we're Closing and no data was written.
+// If closePipeOnError is true, w.pr will be closed if there's an
+// error uploading to S3.
+func (w *writer) open(r io.Reader, closePipeOnError bool) {
+	// This goroutine will keep running until Close, unless there's an error.
+	go func() {
+		defer func() {
+			close(w.donec)
+		}()
+
+		if r == nil {
+			// AWS doesn't like a nil Body.
+			r = http.NoBody
+		}
+
+		w.uploader.Payload = r
+
+		err := w.uploader.Upload(w.ctx, w.reqOptions...)
+		if err != nil {
+			if closePipeOnError {
+				w.pr.CloseWithError(err)
+			}
+			w.err = err
+		}
+	}()
+}
+
+// Close completes the writer and closes it. Any error occurring during write
+// will be returned. If a writer is closed before any Write is called, Close
+// will create an empty file at the given key.
+func (w *writer) Close() error {
+	if w.pr != nil {
+		defer w.pr.Close()
+	}
+
+	if w.pw == nil {
+		// We never got any bytes written. We'll write an http.NoBody.
+		w.open(nil, false)
+	} else if err := w.pw.Close(); err != nil {
+		return err
+	}
+
+	<-w.donec
+
+	return w.err
+}
+
+// -------------------------------------------------------------------
+
+// etagToMD5 processes an ETag header and returns an MD5 hash if possible.
+// S3's ETag header is sometimes a quoted hexstring of the MD5. Other times,
+// notably when the object was uploaded in multiple parts, it is not.
+// We do the best we can.
+// Some links about ETag:
+// https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html
+// https://github.com/aws/aws-sdk-net/issues/815
+// https://teppen.io/2018/06/23/aws_s3_etags/
+func eTagToMD5(etag string) []byte {
+	// No header at all.
+	if etag == "" {
+		return nil
+	}
+
+	// Strip the expected leading and trailing quotes.
+	if len(etag) < 2 || etag[0] != '"' || etag[len(etag)-1] != '"' {
+		return nil
+	}
+	unquoted := etag[1 : len(etag)-1]
+
+	// Un-hex; we return nil on error. In particular, we'll get an error here
+	// for multi-part uploaded blobs, whose ETag will contain a "-" and so will
+	// never be a legal hex encoding.
+	md5, err := hex.DecodeString(unquoted)
+	if err != nil {
+		return nil
+	}
+
+	return md5
+}
+
+func getSize(contentLength int64, contentRange string) int64 {
+	// Default size to ContentLength, but that's incorrect for partial-length reads,
+	// where ContentLength refers to the size of the returned Body, not the entire
+	// size of the blob. ContentRange has the full size.
+	size := contentLength
+	if contentRange != "" {
+		// Sample: bytes 10-14/27 (where 27 is the full size).
+		parts := strings.Split(contentRange, "/")
+		if len(parts) == 2 {
+			if i, err := strconv.ParseInt(parts[1], 10, 64); err == nil {
+				size = i
+			}
+		}
+	}
+
+	return size
+}
+
+// escapeKey does all required escaping for UTF-8 strings to work with S3.
+func escapeKey(key string) string {
+	return blob.HexEscape(key, func(r []rune, i int) bool {
+		c := r[i]
+
+		// S3 doesn't handle these characters (determined via experimentation).
+		if c < 32 {
+			return true
+		}
+
+		// For "../", escape the trailing slash.
+		if i > 1 && c == '/' && r[i-1] == '.' && r[i-2] == '.' {
+			return true
+		}
+
+		return false
+	})
+}
+
+// unescapeKey reverses escapeKey.
+func unescapeKey(key string) string {
+	return blob.HexUnescape(key)
+}
+
+// urlUnescape reverses URLEscape using url.PathUnescape. If the unescape
+// returns an error, it returns s.
+func urlUnescape(s string) string {
+	if u, err := url.PathUnescape(s); err == nil {
+		return u
+	}
+
+	return s
+}
diff --git a/server/core_backend-server/tools/filesystem/internal/s3blob/s3blob_test.go b/server/core_backend-server/tools/filesystem/internal/s3blob/s3blob_test.go
new file mode 100644
index 0000000..20d0f3b
--- /dev/null
+++ b/server/core_backend-server/tools/filesystem/internal/s3blob/s3blob_test.go
@@ -0,0 +1,605 @@
+package s3blob_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem/blob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3"
+	"github.com/pocketbase/pocketbase/tools/filesystem/internal/s3blob/s3/tests"
+)
+
+func TestNew(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name        string
+		s3Client    *s3.S3
+		expectError bool
+	}{
+		{
+			"blank",
+			&s3.S3{},
+			true,
+		},
+		{
+			"no bucket",
+			&s3.S3{Region: "b", Endpoint: "c"},
+			true,
+		},
+		{
+			"no endpoint",
+			&s3.S3{Bucket: "a", Region: "b"},
+			true,
+		},
+		{
+			"no region",
+			&s3.S3{Bucket: "a", Endpoint: "c"},
+			true,
+		},
+		{
+			"with bucket, endpoint and region",
+			&s3.S3{Bucket: "a", Region: "b", Endpoint: "c"},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			drv, err := s3blob.New(s.s3Client)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if err == nil && drv == nil {
+				t.Fatal("Expected non-nil driver instance")
+			}
+		})
+	}
+}
+
+func TestDriverClose(t *testing.T) {
+	t.Parallel()
+
+	drv, err := s3blob.New(&s3.S3{Bucket: "a", Region: "b", Endpoint: "c"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = drv.Close()
+	if err != nil {
+		t.Fatalf("Expected nil, got error %v", err)
+	}
+}
+
+func TestDriverNormilizeError(t *testing.T) {
+	t.Parallel()
+
+	drv, err := s3blob.New(&s3.S3{Bucket: "a", Region: "b", Endpoint: "c"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name              string
+		err               error
+		expectErrNotFound bool
+	}{
+		{
+			"plain error",
+			errors.New("test"),
+			false,
+		},
+		{
+			"response error with only status (non-404)",
+			&s3.ResponseError{Status: 123},
+			false,
+		},
+		{
+			"response error with only status (404)",
+			&s3.ResponseError{Status: 404},
+			true,
+		},
+		{
+			"response error with custom code",
+			&s3.ResponseError{Code: "test"},
+			false,
+		},
+		{
+			"response error with NoSuchBucket code",
+			&s3.ResponseError{Code: "NoSuchBucket"},
+			true,
+		},
+		{
+			"response error with NoSuchKey code",
+			&s3.ResponseError{Code: "NoSuchKey"},
+			true,
+		},
+		{
+			"response error with NotFound code",
+			&s3.ResponseError{Code: "NotFound"},
+			true,
+		},
+		{
+			"wrapped response error with NotFound code", // ensures that the entire error's tree is checked
+			fmt.Errorf("test: %w", &s3.ResponseError{Code: "NotFound"}),
+			true,
+		},
+		{
+			"already normalized error",
+			fmt.Errorf("test: %w", blob.ErrNotFound),
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := drv.NormalizeError(s.err)
+			if err == nil {
+				t.Fatal("Expected non-nil error")
+			}
+
+			isErrNotFound := errors.Is(err, blob.ErrNotFound)
+			if isErrNotFound != s.expectErrNotFound {
+				t.Fatalf("Expected isErrNotFound %v, got %v (%v)", s.expectErrNotFound, isErrNotFound, err)
+			}
+		})
+	}
+}
+
+func TestDriverDeleteEscaping(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(&tests.RequestStub{
+		Method: http.MethodDelete,
+		URL:    "https://test_bucket.example.com/..__0x2f__abc/test/",
+	})
+
+	drv, err := s3blob.New(&s3.S3{
+		Bucket:   "test_bucket",
+		Region:   "test_region",
+		Endpoint: "https://example.com",
+		Client:   httpClient,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = drv.Delete(context.Background(), "../abc/test/")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDriverCopyEscaping(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(&tests.RequestStub{
+		Method: http.MethodPut,
+		URL:    "https://test_bucket.example.com/..__0x2f__a/",
+		Match: func(req *http.Request) bool {
+			return tests.ExpectHeaders(req.Header, map[string]string{
+				"x-amz-copy-source": "test_bucket%2F..__0x2f__b%2F",
+			})
+		},
+		Response: &http.Response{
+			Body: io.NopCloser(strings.NewReader(`<CopyObjectResult></CopyObjectResult>`)),
+		},
+	})
+
+	drv, err := s3blob.New(&s3.S3{
+		Bucket:   "test_bucket",
+		Region:   "test_region",
+		Endpoint: "https://example.com",
+		Client:   httpClient,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = drv.Copy(context.Background(), "../a/", "../b/")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDriverAttributes(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(&tests.RequestStub{
+		Method: http.MethodHead,
+		URL:    "https://test_bucket.example.com/..__0x2f__a/",
+		Response: &http.Response{
+			Header: http.Header{
+				"Last-Modified":       []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+				"Cache-Control":       []string{"test_cache"},
+				"Content-Disposition": []string{"test_disposition"},
+				"Content-Encoding":    []string{"test_encoding"},
+				"Content-Language":    []string{"test_language"},
+				"Content-Type":        []string{"test_type"},
+				"Content-Range":       []string{"test_range"},
+				"Etag":                []string{`"ce5be8b6f53645c596306c4572ece521"`},
+				"Content-Length":      []string{"100"},
+				"x-amz-meta-AbC%40":   []string{"%40test_meta_a"},
+				"x-amz-meta-Def":      []string{"test_meta_b"},
+			},
+			Body: http.NoBody,
+		},
+	})
+
+	drv, err := s3blob.New(&s3.S3{
+		Bucket:   "test_bucket",
+		Region:   "test_region",
+		Endpoint: "https://example.com",
+		Client:   httpClient,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	attrs, err := drv.Attributes(context.Background(), "../a/")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	raw, err := json.Marshal(attrs)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `{"cacheControl":"test_cache","contentDisposition":"test_disposition","contentEncoding":"test_encoding","contentLanguage":"test_language","contentType":"test_type","metadata":{"abc@":"@test_meta_a","def":"test_meta_b"},"createTime":"0001-01-01T00:00:00Z","modTime":"2025-02-01T03:04:05Z","size":100,"md5":"zlvotvU2RcWWMGxFcuzlIQ==","etag":"\"ce5be8b6f53645c596306c4572ece521\""}`
+	if str := string(raw); str != expected {
+		t.Fatalf("Expected attributes\n%s\ngot\n%s", expected, str)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDriverListPaged(t *testing.T) {
+	t.Parallel()
+
+	listResponse := func() *http.Response {
+		return &http.Response{
+			Body: io.NopCloser(strings.NewReader(`
+				<?xml version="1.0" encoding="UTF-8"?>
+				<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+					<Name>example</Name>
+					<ContinuationToken>ct</ContinuationToken>
+					<NextContinuationToken>test_next</NextContinuationToken>
+					<StartAfter>example0.txt</StartAfter>
+					<KeyCount>1</KeyCount>
+					<MaxKeys>3</MaxKeys>
+					<Contents>
+						<Key>..__0x2f__prefixB/test/example.txt</Key>
+						<LastModified>2025-01-01T01:02:03.123Z</LastModified>
+						<ETag>"ce5be8b6f53645c596306c4572ece521"</ETag>
+						<Size>123</Size>
+					</Contents>
+					<Contents>
+						<Key>prefixA/..__0x2f__escape.txt</Key>
+						<LastModified>2025-01-02T01:02:03.123Z</LastModified>
+						<Size>456</Size>
+					</Contents>
+					<CommonPrefixes>
+						<Prefix>prefixA</Prefix>
+					</CommonPrefixes>
+					<CommonPrefixes>
+						<Prefix>..__0x2f__prefixB</Prefix>
+					</CommonPrefixes>
+				</ListBucketResult>
+			`)),
+		}
+	}
+
+	expectedPage := `{"objects":[{"key":"../prefixB","modTime":"0001-01-01T00:00:00Z","size":0,"md5":null,"isDir":true},{"key":"../prefixB/test/example.txt","modTime":"2025-01-01T01:02:03.123Z","size":123,"md5":"zlvotvU2RcWWMGxFcuzlIQ==","isDir":false},{"key":"prefixA","modTime":"0001-01-01T00:00:00Z","size":0,"md5":null,"isDir":true},{"key":"prefixA/../escape.txt","modTime":"2025-01-02T01:02:03.123Z","size":456,"md5":null,"isDir":false}],"nextPageToken":"dGVzdF9uZXh0"}`
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method:   http.MethodGet,
+			URL:      "https://test_bucket.example.com/?list-type=2&max-keys=1000",
+			Response: listResponse(),
+		},
+		&tests.RequestStub{
+			Method:   http.MethodGet,
+			URL:      "https://test_bucket.example.com/?continuation-token=test_token&delimiter=test_delimiter&list-type=2&max-keys=123&prefix=test_prefix",
+			Response: listResponse(),
+		},
+	)
+
+	drv, err := s3blob.New(&s3.S3{
+		Bucket:   "test_bucket",
+		Region:   "test_region",
+		Endpoint: "https://example.com",
+		Client:   httpClient,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		name     string
+		opts     *blob.ListOptions
+		expected string
+	}{
+		{
+			"empty options",
+			&blob.ListOptions{},
+			expectedPage,
+		},
+		{
+			"filled options",
+			&blob.ListOptions{Prefix: "test_prefix", Delimiter: "test_delimiter", PageSize: 123, PageToken: []byte("test_token")},
+			expectedPage,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			page, err := drv.ListPaged(context.Background(), s.opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := json.Marshal(page)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if str := string(raw); s.expected != str {
+				t.Fatalf("Expected page result\n%s\ngot\n%s", s.expected, str)
+			}
+		})
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDriverNewRangeReader(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		offset        int64
+		length        int64
+		httpClient    *tests.Client
+		expectedAttrs string
+	}{
+		{
+			0,
+			0,
+			tests.NewClient(&tests.RequestStub{
+				Method: http.MethodGet,
+				URL:    "https://test_bucket.example.com/..__0x2f__abc/test.txt",
+				Match: func(req *http.Request) bool {
+					return tests.ExpectHeaders(req.Header, map[string]string{
+						"Range": "bytes=0-0",
+					})
+				},
+				Response: &http.Response{
+					Header: http.Header{
+						"Last-Modified":  []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+						"Content-Type":   []string{"test_ct"},
+						"Content-Length": []string{"123"},
+					},
+					Body: io.NopCloser(strings.NewReader("test")),
+				},
+			}),
+			`{"contentType":"test_ct","modTime":"2025-02-01T03:04:05Z","size":123}`,
+		},
+		{
+			10,
+			-1,
+			tests.NewClient(&tests.RequestStub{
+				Method: http.MethodGet,
+				URL:    "https://test_bucket.example.com/..__0x2f__abc/test.txt",
+				Match: func(req *http.Request) bool {
+					return tests.ExpectHeaders(req.Header, map[string]string{
+						"Range": "bytes=10-",
+					})
+				},
+				Response: &http.Response{
+					Header: http.Header{
+						"Last-Modified":  []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+						"Content-Type":   []string{"test_ct"},
+						"Content-Range":  []string{"bytes 1-1/456"}, // should take precedence over content-length
+						"Content-Length": []string{"123"},
+					},
+					Body: io.NopCloser(strings.NewReader("test")),
+				},
+			}),
+			`{"contentType":"test_ct","modTime":"2025-02-01T03:04:05Z","size":456}`,
+		},
+		{
+			10,
+			0,
+			tests.NewClient(&tests.RequestStub{
+				Method: http.MethodGet,
+				URL:    "https://test_bucket.example.com/..__0x2f__abc/test.txt",
+				Match: func(req *http.Request) bool {
+					return tests.ExpectHeaders(req.Header, map[string]string{
+						"Range": "bytes=10-10",
+					})
+				},
+				Response: &http.Response{
+					Header: http.Header{
+						"Last-Modified": []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+						"Content-Type":  []string{"test_ct"},
+						// no range and length headers
+						// "Content-Range":  []string{"bytes 1-1/456"},
+						// "Content-Length": []string{"123"},
+					},
+					Body: io.NopCloser(strings.NewReader("test")),
+				},
+			}),
+			`{"contentType":"test_ct","modTime":"2025-02-01T03:04:05Z","size":0}`,
+		},
+		{
+			10,
+			20,
+			tests.NewClient(&tests.RequestStub{
+				Method: http.MethodGet,
+				URL:    "https://test_bucket.example.com/..__0x2f__abc/test.txt",
+				Match: func(req *http.Request) bool {
+					return tests.ExpectHeaders(req.Header, map[string]string{
+						"Range": "bytes=10-29",
+					})
+				},
+				Response: &http.Response{
+					Header: http.Header{
+						"Last-Modified": []string{"Mon, 01 Feb 2025 03:04:05 GMT"},
+						"Content-Type":  []string{"test_ct"},
+						// with range header but invalid format -> content-length takes precedence
+						"Content-Range":  []string{"bytes invalid-456"},
+						"Content-Length": []string{"123"},
+					},
+					Body: io.NopCloser(strings.NewReader("test")),
+				},
+			}),
+			`{"contentType":"test_ct","modTime":"2025-02-01T03:04:05Z","size":123}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("offset_%d_length_%d", s.offset, s.length), func(t *testing.T) {
+			drv, err := s3blob.New(&s3.S3{
+				Bucket:   "test_bucket",
+				Region:   "tesst_region",
+				Endpoint: "https://example.com",
+				Client:   s.httpClient,
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			r, err := drv.NewRangeReader(context.Background(), "../abc/test.txt", s.offset, s.length)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer r.Close()
+
+			// the response body should be always replaced with http.NoBody
+			if s.length == 0 {
+				body := make([]byte, 1)
+				n, err := r.Read(body)
+				if n != 0 || !errors.Is(err, io.EOF) {
+					t.Fatalf("Expected body to be http.NoBody, got %v (%v)", body, err)
+				}
+			}
+
+			rawAttrs, err := json.Marshal(r.Attributes())
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if str := string(rawAttrs); str != s.expectedAttrs {
+				t.Fatalf("Expected attributes\n%s\ngot\n%s", s.expectedAttrs, str)
+			}
+
+			err = s.httpClient.AssertNoRemaining()
+			if err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+func TestDriverNewTypedWriter(t *testing.T) {
+	t.Parallel()
+
+	httpClient := tests.NewClient(
+		&tests.RequestStub{
+			Method: http.MethodPut,
+			URL:    "https://test_bucket.example.com/..__0x2f__abc/test/",
+			Match: func(req *http.Request) bool {
+				body, err := io.ReadAll(req.Body)
+				if err != nil {
+					return false
+				}
+
+				return string(body) == "test" && tests.ExpectHeaders(req.Header, map[string]string{
+					"cache-control":       "test_cache_control",
+					"content-disposition": "test_content_disposition",
+					"content-encoding":    "test_content_encoding",
+					"content-language":    "test_content_language",
+					"content-type":        "test_ct",
+					"content-md5":         "dGVzdA==",
+				})
+			},
+		},
+	)
+
+	drv, err := s3blob.New(&s3.S3{
+		Bucket:   "test_bucket",
+		Region:   "test_region",
+		Endpoint: "https://example.com",
+		Client:   httpClient,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	options := &blob.WriterOptions{
+		CacheControl:       "test_cache_control",
+		ContentDisposition: "test_content_disposition",
+		ContentEncoding:    "test_content_encoding",
+		ContentLanguage:    "test_content_language",
+		ContentType:        "test_content_type", // should be ignored
+		ContentMD5:         []byte("test"),
+		Metadata:           map[string]string{"@test_meta_a": "@test"},
+	}
+
+	w, err := drv.NewTypedWriter(context.Background(), "../abc/test/", "test_ct", options)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	n, err := w.Write(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != 0 {
+		t.Fatalf("Expected nil write to result in %d written bytes, got %d", 0, n)
+	}
+
+	n, err = w.Write([]byte("test"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != 4 {
+		t.Fatalf("Expected nil write to result in %d written bytes, got %d", 4, n)
+	}
+
+	err = w.Close()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = httpClient.AssertNoRemaining()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/server/core_backend-server/tools/hook/event.go b/server/core_backend-server/tools/hook/event.go
new file mode 100644
index 0000000..12bceec
--- /dev/null
+++ b/server/core_backend-server/tools/hook/event.go
@@ -0,0 +1,45 @@
+package hook
+
+// Resolver defines a common interface for a Hook event (see [Event]).
+type Resolver interface {
+	// Next triggers the next handler in the hook's chain (if any).
+	Next() error
+
+	// note: kept only for the generic interface; may get removed in the future
+	nextFunc() func() error
+	setNextFunc(f func() error)
+}
+
+var _ Resolver = (*Event)(nil)
+
+// Event implements [Resolver] and it is intended to be used as a base
+// Hook event that you can embed in your custom typed event structs.
+//
+// Example:
+//
+//	type CustomEvent struct {
+//		hook.Event
+//
+//		SomeField int
+//	}
+type Event struct {
+	next func() error
+}
+
+// Next calls the next hook handler.
+func (e *Event) Next() error {
+	if e.next != nil {
+		return e.next()
+	}
+	return nil
+}
+
+// nextFunc returns the function that Next calls.
+func (e *Event) nextFunc() func() error {
+	return e.next
+}
+
+// setNextFunc sets the function that Next calls.
+func (e *Event) setNextFunc(f func() error) {
+	e.next = f
+}
diff --git a/server/core_backend-server/tools/hook/event_test.go b/server/core_backend-server/tools/hook/event_test.go
new file mode 100644
index 0000000..89b15ef
--- /dev/null
+++ b/server/core_backend-server/tools/hook/event_test.go
@@ -0,0 +1,29 @@
+package hook
+
+import "testing"
+
+func TestEventNext(t *testing.T) {
+	calls := 0
+
+	e := Event{}
+
+	if e.nextFunc() != nil {
+		t.Fatalf("Expected nextFunc to be nil")
+	}
+
+	e.setNextFunc(func() error {
+		calls++
+		return nil
+	})
+
+	if e.nextFunc() == nil {
+		t.Fatalf("Expected nextFunc to be non-nil")
+	}
+
+	e.Next()
+	e.Next()
+
+	if calls != 2 {
+		t.Fatalf("Expected %d calls, got %d", 2, calls)
+	}
+}
diff --git a/server/core_backend-server/tools/hook/hook.go b/server/core_backend-server/tools/hook/hook.go
new file mode 100644
index 0000000..722ed9f
--- /dev/null
+++ b/server/core_backend-server/tools/hook/hook.go
@@ -0,0 +1,178 @@
+package hook
+
+import (
+	"sort"
+	"sync"
+
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+// Handler defines a single Hook handler.
+// Multiple handlers can share the same id.
+// If Id is not explicitly set it will be autogenerated by Hook.Add and Hook.AddHandler.
+type Handler[T Resolver] struct {
+	// Func defines the handler function to execute.
+	//
+	// Note that users need to call e.Next() in order to proceed with
+	// the execution of the hook chain.
+	Func func(T) error
+
+	// Id is the unique identifier of the handler.
+	//
+	// It could be used later to remove the handler from a hook via [Hook.Remove].
+	//
+	// If missing, an autogenerated value will be assigned when adding
+	// the handler to a hook.
+	Id string
+
+	// Priority allows changing the default exec priority of the handler within a hook.
+	//
+	// If 0, the handler will be executed in the same order it was registered.
+	Priority int
+}
+
+// Hook defines a generic concurrent safe structure for managing event hooks.
+//
+// When using custom event it must embed the base [hook.Event].
+//
+// Example:
+//
+//	type CustomEvent struct {
+//		hook.Event
+//		SomeField int
+//	}
+//
+//	h := Hook[*CustomEvent]{}
+//
+//	h.BindFunc(func(e *CustomEvent) error {
+//		println(e.SomeField)
+//
+//		return e.Next()
+//	})
+//
+//	h.Trigger(&CustomEvent{ SomeField: 123 })
+type Hook[T Resolver] struct {
+	handlers []*Handler[T]
+	mu       sync.RWMutex
+}
+
+// Bind registers the provided handler to the current hooks queue.
+//
+// If handler.Id is empty it is updated with autogenerated value.
+//
+// If a handler from the current hook list has Id matching handler.Id
+// then the old handler is replaced with the new one.
+func (h *Hook[T]) Bind(handler *Handler[T]) string {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	var exists bool
+
+	if handler.Id == "" {
+		handler.Id = generateHookId()
+
+		// ensure that it doesn't exist
+	DUPLICATE_CHECK:
+		for _, existing := range h.handlers {
+			if existing.Id == handler.Id {
+				handler.Id = generateHookId()
+				goto DUPLICATE_CHECK
+			}
+		}
+	} else {
+		// replace existing
+		for i, existing := range h.handlers {
+			if existing.Id == handler.Id {
+				h.handlers[i] = handler
+				exists = true
+				break
+			}
+		}
+	}
+
+	// append new
+	if !exists {
+		h.handlers = append(h.handlers, handler)
+	}
+
+	// sort handlers by Priority, preserving the original order of equal items
+	sort.SliceStable(h.handlers, func(i, j int) bool {
+		return h.handlers[i].Priority < h.handlers[j].Priority
+	})
+
+	return handler.Id
+}
+
+// BindFunc is similar to Bind but registers a new handler from just the provided function.
+//
+// The registered handler is added with a default 0 priority and the id will be autogenerated.
+//
+// If you want to register a handler with custom priority or id use the [Hook.Bind] method.
+func (h *Hook[T]) BindFunc(fn func(e T) error) string {
+	return h.Bind(&Handler[T]{Func: fn})
+}
+
+// Unbind removes one or many hook handler by their id.
+func (h *Hook[T]) Unbind(idsToRemove ...string) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	for _, id := range idsToRemove {
+		for i := len(h.handlers) - 1; i >= 0; i-- {
+			if h.handlers[i].Id == id {
+				h.handlers = append(h.handlers[:i], h.handlers[i+1:]...)
+				break // for now stop on the first occurrence since we don't allow handlers with duplicated ids
+			}
+		}
+	}
+}
+
+// UnbindAll removes all registered handlers.
+func (h *Hook[T]) UnbindAll() {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	h.handlers = nil
+}
+
+// Length returns to total number of registered hook handlers.
+func (h *Hook[T]) Length() int {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+
+	return len(h.handlers)
+}
+
+// Trigger executes all registered hook handlers one by one
+// with the specified event as an argument.
+//
+// Optionally, this method allows also to register additional one off
+// handler funcs that will be temporary appended to the handlers queue.
+//
+// NB! Each hook handler must call event.Next() in order the hook chain to proceed.
+func (h *Hook[T]) Trigger(event T, oneOffHandlerFuncs ...func(T) error) error {
+	h.mu.RLock()
+	handlers := make([]func(T) error, 0, len(h.handlers)+len(oneOffHandlerFuncs))
+	for _, handler := range h.handlers {
+		handlers = append(handlers, handler.Func)
+	}
+	handlers = append(handlers, oneOffHandlerFuncs...)
+	h.mu.RUnlock()
+
+	event.setNextFunc(nil) // reset in case the event is being reused
+
+	for i := len(handlers) - 1; i >= 0; i-- {
+		i := i
+		old := event.nextFunc()
+		event.setNextFunc(func() error {
+			event.setNextFunc(old)
+			return handlers[i](event)
+		})
+	}
+
+	return event.Next()
+}
+
+func generateHookId() string {
+	return security.PseudorandomString(20)
+}
diff --git a/server/core_backend-server/tools/hook/hook_test.go b/server/core_backend-server/tools/hook/hook_test.go
new file mode 100644
index 0000000..36bd945
--- /dev/null
+++ b/server/core_backend-server/tools/hook/hook_test.go
@@ -0,0 +1,162 @@
+package hook
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestHookAddHandlerAndAdd(t *testing.T) {
+	calls := ""
+
+	h := Hook[*Event]{}
+
+	h.BindFunc(func(e *Event) error { calls += "1"; return e.Next() })
+	h.BindFunc(func(e *Event) error { calls += "2"; return e.Next() })
+	h3Id := h.BindFunc(func(e *Event) error { calls += "3"; return e.Next() })
+	h.Bind(&Handler[*Event]{
+		Id:   h3Id, // should replace 3
+		Func: func(e *Event) error { calls += "3'"; return e.Next() },
+	})
+	h.Bind(&Handler[*Event]{
+		Func:     func(e *Event) error { calls += "4"; return e.Next() },
+		Priority: -2,
+	})
+	h.Bind(&Handler[*Event]{
+		Func:     func(e *Event) error { calls += "5"; return e.Next() },
+		Priority: -1,
+	})
+	h.Bind(&Handler[*Event]{
+		Func: func(e *Event) error { calls += "6"; return e.Next() },
+	})
+	h.Bind(&Handler[*Event]{
+		Func: func(e *Event) error { calls += "7"; e.Next(); return errors.New("test") }, // error shouldn't stop the chain
+	})
+
+	h.Trigger(
+		&Event{},
+		func(e *Event) error { calls += "8"; return e.Next() },
+		func(e *Event) error { calls += "9"; return nil }, // skip next
+		func(e *Event) error { calls += "10"; return e.Next() },
+	)
+
+	if total := len(h.handlers); total != 7 {
+		t.Fatalf("Expected %d handlers, found %d", 7, total)
+	}
+
+	expectedCalls := "45123'6789"
+
+	if calls != expectedCalls {
+		t.Fatalf("Expected calls sequence %q, got %q", expectedCalls, calls)
+	}
+}
+
+func TestHookLength(t *testing.T) {
+	h := Hook[*Event]{}
+
+	if l := h.Length(); l != 0 {
+		t.Fatalf("Expected 0 hook handlers, got %d", l)
+	}
+
+	h.BindFunc(func(e *Event) error { return e.Next() })
+	h.BindFunc(func(e *Event) error { return e.Next() })
+
+	if l := h.Length(); l != 2 {
+		t.Fatalf("Expected 2 hook handlers, got %d", l)
+	}
+}
+
+func TestHookUnbind(t *testing.T) {
+	h := Hook[*Event]{}
+
+	calls := ""
+
+	id0 := h.BindFunc(func(e *Event) error { calls += "0"; return e.Next() })
+	id1 := h.BindFunc(func(e *Event) error { calls += "1"; return e.Next() })
+	h.BindFunc(func(e *Event) error { calls += "2"; return e.Next() })
+	h.Bind(&Handler[*Event]{
+		Func: func(e *Event) error { calls += "3"; return e.Next() },
+	})
+
+	h.Unbind("missing") // should do nothing and not panic
+
+	if total := len(h.handlers); total != 4 {
+		t.Fatalf("Expected %d handlers, got %d", 4, total)
+	}
+
+	h.Unbind(id1, id0)
+
+	if total := len(h.handlers); total != 2 {
+		t.Fatalf("Expected %d handlers, got %d", 2, total)
+	}
+
+	err := h.Trigger(&Event{}, func(e *Event) error { calls += "4"; return e.Next() })
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expectedCalls := "234"
+
+	if calls != expectedCalls {
+		t.Fatalf("Expected calls sequence %q, got %q", expectedCalls, calls)
+	}
+}
+
+func TestHookUnbindAll(t *testing.T) {
+	h := Hook[*Event]{}
+
+	h.UnbindAll() // should do nothing and not panic
+
+	h.BindFunc(func(e *Event) error { return nil })
+	h.BindFunc(func(e *Event) error { return nil })
+
+	if total := len(h.handlers); total != 2 {
+		t.Fatalf("Expected %d handlers before UnbindAll, found %d", 2, total)
+	}
+
+	h.UnbindAll()
+
+	if total := len(h.handlers); total != 0 {
+		t.Fatalf("Expected no handlers after UnbindAll, found %d", total)
+	}
+}
+
+func TestHookTriggerErrorPropagation(t *testing.T) {
+	err := errors.New("test")
+
+	scenarios := []struct {
+		name          string
+		handlers      []func(*Event) error
+		expectedError error
+	}{
+		{
+			"without error",
+			[]func(*Event) error{
+				func(e *Event) error { return e.Next() },
+				func(e *Event) error { return e.Next() },
+			},
+			nil,
+		},
+		{
+			"with error",
+			[]func(*Event) error{
+				func(e *Event) error { return e.Next() },
+				func(e *Event) error { e.Next(); return err },
+				func(e *Event) error { return e.Next() },
+			},
+			err,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			h := Hook[*Event]{}
+			for _, handler := range s.handlers {
+				h.BindFunc(handler)
+			}
+			result := h.Trigger(&Event{})
+			if result != s.expectedError {
+				t.Fatalf("Expected %v, got %v", s.expectedError, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/hook/tagged.go b/server/core_backend-server/tools/hook/tagged.go
new file mode 100644
index 0000000..4363979
--- /dev/null
+++ b/server/core_backend-server/tools/hook/tagged.go
@@ -0,0 +1,84 @@
+package hook
+
+import (
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+// Tagger defines an interface for event data structs that support tags/groups/categories/etc.
+// Usually used together with TaggedHook.
+type Tagger interface {
+	Resolver
+
+	Tags() []string
+}
+
+// wrapped local Hook embedded struct to limit the public API surface.
+type mainHook[T Tagger] struct {
+	*Hook[T]
+}
+
+// NewTaggedHook creates a new TaggedHook with the provided main hook and optional tags.
+func NewTaggedHook[T Tagger](hook *Hook[T], tags ...string) *TaggedHook[T] {
+	return &TaggedHook[T]{
+		mainHook[T]{hook},
+		tags,
+	}
+}
+
+// TaggedHook defines a proxy hook which register handlers that are triggered only
+// if the TaggedHook.tags are empty or includes at least one of the event data tag(s).
+type TaggedHook[T Tagger] struct {
+	mainHook[T]
+
+	tags []string
+}
+
+// CanTriggerOn checks if the current TaggedHook can be triggered with
+// the provided event data tags.
+//
+// It returns always true if the hook doens't have any tags.
+func (h *TaggedHook[T]) CanTriggerOn(tagsToCheck []string) bool {
+	if len(h.tags) == 0 {
+		return true // match all
+	}
+
+	for _, t := range tagsToCheck {
+		if list.ExistInSlice(t, h.tags) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Bind registers the provided handler to the current hooks queue.
+//
+// It is similar to [Hook.Bind] with the difference that the handler
+// function is invoked only if the event data tags satisfy h.CanTriggerOn.
+func (h *TaggedHook[T]) Bind(handler *Handler[T]) string {
+	fn := handler.Func
+
+	handler.Func = func(e T) error {
+		if h.CanTriggerOn(e.Tags()) {
+			return fn(e)
+		}
+
+		return e.Next()
+	}
+
+	return h.mainHook.Bind(handler)
+}
+
+// BindFunc registers a new handler with the specified function.
+//
+// It is similar to [Hook.Bind] with the difference that the handler
+// function is invoked only if the event data tags satisfy h.CanTriggerOn.
+func (h *TaggedHook[T]) BindFunc(fn func(e T) error) string {
+	return h.mainHook.BindFunc(func(e T) error {
+		if h.CanTriggerOn(e.Tags()) {
+			return fn(e)
+		}
+
+		return e.Next()
+	})
+}
diff --git a/server/core_backend-server/tools/hook/tagged_test.go b/server/core_backend-server/tools/hook/tagged_test.go
new file mode 100644
index 0000000..7fa4ce3
--- /dev/null
+++ b/server/core_backend-server/tools/hook/tagged_test.go
@@ -0,0 +1,84 @@
+package hook
+
+import (
+	"strings"
+	"testing"
+)
+
+type mockTagsEvent struct {
+	Event
+	tags []string
+}
+
+func (m mockTagsEvent) Tags() []string {
+	return m.tags
+}
+
+func TestTaggedHook(t *testing.T) {
+	calls := ""
+
+	base := &Hook[*mockTagsEvent]{}
+	base.BindFunc(func(e *mockTagsEvent) error { calls += "f0"; return e.Next() })
+
+	hA := NewTaggedHook(base)
+	hA.BindFunc(func(e *mockTagsEvent) error { calls += "a1"; return e.Next() })
+	hA.Bind(&Handler[*mockTagsEvent]{
+		Func:     func(e *mockTagsEvent) error { calls += "a2"; return e.Next() },
+		Priority: -1,
+	})
+
+	hB := NewTaggedHook(base, "b1", "b2")
+	hB.BindFunc(func(e *mockTagsEvent) error { calls += "b1"; return e.Next() })
+	hB.Bind(&Handler[*mockTagsEvent]{
+		Func:     func(e *mockTagsEvent) error { calls += "b2"; return e.Next() },
+		Priority: -2,
+	})
+
+	hC := NewTaggedHook(base, "c1", "c2")
+	hC.BindFunc(func(e *mockTagsEvent) error { calls += "c1"; return e.Next() })
+	hC.Bind(&Handler[*mockTagsEvent]{
+		Func:     func(e *mockTagsEvent) error { calls += "c2"; return e.Next() },
+		Priority: -3,
+	})
+
+	scenarios := []struct {
+		event         *mockTagsEvent
+		expectedCalls string
+	}{
+		{
+			&mockTagsEvent{},
+			"a2f0a1",
+		},
+		{
+			&mockTagsEvent{tags: []string{"missing"}},
+			"a2f0a1",
+		},
+		{
+			&mockTagsEvent{tags: []string{"b2"}},
+			"b2a2f0a1b1",
+		},
+		{
+			&mockTagsEvent{tags: []string{"c1"}},
+			"c2a2f0a1c1",
+		},
+		{
+			&mockTagsEvent{tags: []string{"b1", "c2"}},
+			"c2b2a2f0a1b1c1",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(strings.Join(s.event.tags, "_"), func(t *testing.T) {
+			calls = "" // reset
+
+			err := base.Trigger(s.event)
+			if err != nil {
+				t.Fatalf("Unexpected trigger error: %v", err)
+			}
+
+			if calls != s.expectedCalls {
+				t.Fatalf("Expected calls sequence %q, got %q", s.expectedCalls, calls)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/inflector/inflector.go b/server/core_backend-server/tools/inflector/inflector.go
new file mode 100644
index 0000000..6458af1
--- /dev/null
+++ b/server/core_backend-server/tools/inflector/inflector.go
@@ -0,0 +1,113 @@
+package inflector
+
+import (
+	"regexp"
+	"strings"
+	"unicode"
+)
+
+var columnifyRemoveRegex = regexp.MustCompile(`[^\w\.\*\-\_\@\#]+`)
+var snakecaseSplitRegex = regexp.MustCompile(`[\W_]+`)
+
+// UcFirst converts the first character of a string into uppercase.
+func UcFirst(str string) string {
+	if str == "" {
+		return ""
+	}
+
+	s := []rune(str)
+
+	return string(unicode.ToUpper(s[0])) + string(s[1:])
+}
+
+// Columnify strips invalid db identifier characters.
+func Columnify(str string) string {
+	return columnifyRemoveRegex.ReplaceAllString(str, "")
+}
+
+// Sentenize converts and normalizes string into a sentence.
+func Sentenize(str string) string {
+	str = strings.TrimSpace(str)
+	if str == "" {
+		return ""
+	}
+
+	str = UcFirst(str)
+
+	lastChar := str[len(str)-1:]
+	if lastChar != "." && lastChar != "?" && lastChar != "!" {
+		return str + "."
+	}
+
+	return str
+}
+
+// Sanitize sanitizes `str` by removing all characters satisfying `removePattern`.
+// Returns an error if the pattern is not valid regex string.
+func Sanitize(str string, removePattern string) (string, error) {
+	exp, err := regexp.Compile(removePattern)
+	if err != nil {
+		return "", err
+	}
+
+	return exp.ReplaceAllString(str, ""), nil
+}
+
+// Snakecase removes all non word characters and converts any english text into a snakecase.
+// "ABBREVIATIONS" are preserved, eg. "myTestDB" will become "my_test_db".
+func Snakecase(str string) string {
+	var result strings.Builder
+
+	// split at any non word character and underscore
+	words := snakecaseSplitRegex.Split(str, -1)
+
+	for _, word := range words {
+		if word == "" {
+			continue
+		}
+
+		if result.Len() > 0 {
+			result.WriteString("_")
+		}
+
+		for i, c := range word {
+			if unicode.IsUpper(c) && i > 0 &&
+				// is not a following uppercase character
+				!unicode.IsUpper(rune(word[i-1])) {
+				result.WriteString("_")
+			}
+
+			result.WriteRune(c)
+		}
+	}
+
+	return strings.ToLower(result.String())
+}
+
+// Camelize converts the provided string to its "CamelCased" version
+// (non alphanumeric characters are removed).
+//
+// For example:
+//
+//	inflector.Camelize("send_email") // "SendEmail"
+func Camelize(str string) string {
+	var result strings.Builder
+
+	var isPrevSpecial bool
+
+	for _, c := range str {
+		if !unicode.IsLetter(c) && !unicode.IsNumber(c) {
+			isPrevSpecial = true
+			continue
+		}
+
+		if isPrevSpecial || result.Len() == 0 {
+			isPrevSpecial = false
+			result.WriteRune(unicode.ToUpper(c))
+		} else {
+			result.WriteRune(c)
+		}
+	}
+
+	return result.String()
+}
diff --git a/server/core_backend-server/tools/inflector/inflector_test.go b/server/core_backend-server/tools/inflector/inflector_test.go
new file mode 100644
index 0000000..0b96dd2
--- /dev/null
+++ b/server/core_backend-server/tools/inflector/inflector_test.go
@@ -0,0 +1,175 @@
+package inflector_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/inflector"
+)
+
+func TestUcFirst(t *testing.T) {
+	scenarios := []struct {
+		val      string
+		expected string
+	}{
+		{"", ""},
+		{" ", " "},
+		{"Test", "Test"},
+		{"test", "Test"},
+		{"test test2", "Test test2"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.val), func(t *testing.T) {
+			result := inflector.UcFirst(s.val)
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestColumnify(t *testing.T) {
+	scenarios := []struct {
+		val      string
+		expected string
+	}{
+		{"", ""},
+		{"   ", ""},
+		{"123", "123"},
+		{"Test.", "Test."},
+		{" test ", "test"},
+		{"test1.test2", "test1.test2"},
+		{"@test!abc", "@testabc"},
+		{"#test?abc", "#testabc"},
+		{"123test(123)#", "123test123#"},
+		{"test1--test2", "test1--test2"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.val), func(t *testing.T) {
+			result := inflector.Columnify(s.val)
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestSentenize(t *testing.T) {
+	scenarios := []struct {
+		val      string
+		expected string
+	}{
+		{"", ""},
+		{"   ", ""},
+		{".", "."},
+		{"?", "?"},
+		{"!", "!"},
+		{"Test", "Test."},
+		{" test ", "Test."},
+		{"hello world", "Hello world."},
+		{"hello world.", "Hello world."},
+		{"hello world!", "Hello world!"},
+		{"hello world?", "Hello world?"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.val), func(t *testing.T) {
+			result := inflector.Sentenize(s.val)
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestSanitize(t *testing.T) {
+	scenarios := []struct {
+		val       string
+		pattern   string
+		expected  string
+		expectErr bool
+	}{
+		{"", ``, "", false},
+		{" ", ``, " ", false},
+		{" ", ` `, "", false},
+		{"", `[A-Z]`, "", false},
+		{"abcABC", `[A-Z]`, "abc", false},
+		{"abcABC", `[A-Z`, "", true}, // invalid pattern
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.val), func(t *testing.T) {
+			result, err := inflector.Sanitize(s.val, s.pattern)
+			hasErr := err != nil
+
+			if s.expectErr != hasErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectErr, hasErr, err)
+			}
+
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestSnakecase(t *testing.T) {
+	scenarios := []struct {
+		val      string
+		expected string
+	}{
+		{"", ""},
+		{"  ", ""},
+		{"!@#$%^", ""},
+		{"...", ""},
+		{"_", ""},
+		{"John Doe", "john_doe"},
+		{"John_Doe", "john_doe"},
+		{".a!b@c#d$e%123. ", "a_b_c_d_e_123"},
+		{"HelloWorld", "hello_world"},
+		{"HelloWorld1HelloWorld2", "hello_world1_hello_world2"},
+		{"TEST", "test"},
+		{"testABR", "test_abr"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.val), func(t *testing.T) {
+			result := inflector.Snakecase(s.val)
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestCamelize(t *testing.T) {
+	scenarios := []struct {
+		val      string
+		expected string
+	}{
+		{"", ""},
+		{" ", ""},
+		{"Test", "Test"},
+		{"test", "Test"},
+		{"testTest2", "TestTest2"},
+		{"TestTest2", "TestTest2"},
+		{"test test2", "TestTest2"},
+		{"test-test2", "TestTest2"},
+		{"test'test2", "TestTest2"},
+		{"test1test2", "Test1test2"},
+		{"1test-test2", "1testTest2"},
+		{"123", "123"},
+		{"123a", "123a"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.val), func(t *testing.T) {
+			result := inflector.Camelize(s.val)
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/inflector/singularize.go b/server/core_backend-server/tools/inflector/singularize.go
new file mode 100644
index 0000000..07aab24
--- /dev/null
+++ b/server/core_backend-server/tools/inflector/singularize.go
@@ -0,0 +1,89 @@
+package inflector
+
+import (
+	"log"
+	"regexp"
+
+	"github.com/pocketbase/pocketbase/tools/store"
+)
+
+var compiledPatterns = store.New[string, *regexp.Regexp](nil)
+
+// note: the patterns are extracted from popular Ruby/PHP/Node.js inflector packages
+var singularRules = []struct {
+	pattern     string // lazily compiled
+	replacement string
+}{
+	{"(?i)([nrlm]ese|deer|fish|sheep|measles|ois|pox|media|ss)$", "${1}"},
+	{"(?i)^(sea[- ]bass)$", "${1}"},
+	{"(?i)(s)tatuses$", "${1}tatus"},
+	{"(?i)(f)eet$", "${1}oot"},
+	{"(?i)(t)eeth$", "${1}ooth"},
+	{"(?i)^(.*)(menu)s$", "${1}${2}"},
+	{"(?i)(quiz)zes$", "${1}"},
+	{"(?i)(matr)ices$", "${1}ix"},
+	{"(?i)(vert|ind)ices$", "${1}ex"},
+	{"(?i)^(ox)en", "${1}"},
+	{"(?i)(alias)es$", "${1}"},
+	{"(?i)(alumn|bacill|cact|foc|fung|nucle|radi|stimul|syllab|termin|viri?)i$", "${1}us"},
+	{"(?i)([ftw]ax)es", "${1}"},
+	{"(?i)(cris|ax|test)es$", "${1}is"},
+	{"(?i)(shoe)s$", "${1}"},
+	{"(?i)(o)es$", "${1}"},
+	{"(?i)ouses$", "ouse"},
+	{"(?i)([^a])uses$", "${1}us"},
+	{"(?i)([m|l])ice$", "${1}ouse"},
+	{"(?i)(x|ch|ss|sh)es$", "${1}"},
+	{"(?i)(m)ovies$", "${1}ovie"},
+	{"(?i)(s)eries$", "${1}eries"},
+	{"(?i)([^aeiouy]|qu)ies$", "${1}y"},
+	{"(?i)([lr])ves$", "${1}f"},
+	{"(?i)(tive)s$", "${1}"},
+	{"(?i)(hive)s$", "${1}"},
+	{"(?i)(drive)s$", "${1}"},
+	{"(?i)([^fo])ves$", "${1}fe"},
+	{"(?i)(^analy)ses$", "${1}sis"},
+	{"(?i)(analy|diagno|^ba|(p)arenthe|(p)rogno|(s)ynop|(t)he)ses$", "${1}${2}sis"},
+	{"(?i)([ti])a$", "${1}um"},
+	{"(?i)(p)eople$", "${1}erson"},
+	{"(?i)(m)en$", "${1}an"},
+	{"(?i)(c)hildren$", "${1}hild"},
+	{"(?i)(n)ews$", "${1}ews"},
+	{"(?i)(n)etherlands$", "${1}etherlands"},
+	{"(?i)eaus$", "eau"},
+	{"(?i)(currenc)ies$", "${1}y"},
+	{"(?i)^(.*us)$", "${1}"},
+	{"(?i)s$", ""},
+}
+
+// Singularize converts the specified word into its singular version.
+//
+// For example:
+//
+//	inflector.Singularize("people") // "person"
+func Singularize(word string) string {
+	if word == "" {
+		return ""
+	}
+
+	for _, rule := range singularRules {
+		re := compiledPatterns.GetOrSet(rule.pattern, func() *regexp.Regexp {
+			re, err := regexp.Compile(rule.pattern)
+			if err != nil {
+				return nil
+			}
+			return re
+		})
+		if re == nil {
+			// log only for debug purposes
+			log.Println("[Singularize] failed to retrieve/compile rule pattern " + rule.pattern)
+			continue
+		}
+
+		if re.MatchString(word) {
+			return re.ReplaceAllString(word, rule.replacement)
+		}
+	}
+
+	return word
+}
diff --git a/server/core_backend-server/tools/inflector/singularize_test.go b/server/core_backend-server/tools/inflector/singularize_test.go
new file mode 100644
index 0000000..70ed2ab
--- /dev/null
+++ b/server/core_backend-server/tools/inflector/singularize_test.go
@@ -0,0 +1,76 @@
+package inflector_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/inflector"
+)
+
+func TestSingularize(t *testing.T) {
+	scenarios := []struct {
+		word     string
+		expected string
+	}{
+		{"abcnese", "abcnese"},
+		{"deer", "deer"},
+		{"sheep", "sheep"},
+		{"measles", "measles"},
+		{"pox", "pox"},
+		{"media", "media"},
+		{"bliss", "bliss"},
+		{"sea-bass", "sea-bass"},
+		{"Statuses", "Status"},
+		{"Feet", "Foot"},
+		{"Teeth", "Tooth"},
+		{"abcmenus", "abcmenu"},
+		{"Quizzes", "Quiz"},
+		{"Matrices", "Matrix"},
+		{"Vertices", "Vertex"},
+		{"Indices", "Index"},
+		{"Aliases", "Alias"},
+		{"Alumni", "Alumnus"},
+		{"Bacilli", "Bacillus"},
+		{"Cacti", "Cactus"},
+		{"Fungi", "Fungus"},
+		{"Nuclei", "Nucleus"},
+		{"Radii", "Radius"},
+		{"Stimuli", "Stimulus"},
+		{"Syllabi", "Syllabus"},
+		{"Termini", "Terminus"},
+		{"Viri", "Virus"},
+		{"Faxes", "Fax"},
+		{"Crises", "Crisis"},
+		{"Axes", "Axis"},
+		{"Shoes", "Shoe"},
+		{"abcoes", "abco"},
+		{"Houses", "House"},
+		{"Mice", "Mouse"},
+		{"abcxes", "abcx"},
+		{"Movies", "Movie"},
+		{"Series", "Series"},
+		{"abcquies", "abcquy"},
+		{"Relatives", "Relative"},
+		{"Drives", "Drive"},
+		{"aardwolves", "aardwolf"},
+		{"Analyses", "Analysis"},
+		{"Diagnoses", "Diagnosis"},
+		{"People", "Person"},
+		{"Men", "Man"},
+		{"Children", "Child"},
+		{"News", "News"},
+		{"Netherlands", "Netherlands"},
+		{"Tableaus", "Tableau"},
+		{"Currencies", "Currency"},
+		{"abcs", "abc"},
+		{"abc", "abc"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.word, func(t *testing.T) {
+			result := inflector.Singularize(s.word)
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/list/list.go b/server/core_backend-server/tools/list/list.go
new file mode 100644
index 0000000..76c41ee
--- /dev/null
+++ b/server/core_backend-server/tools/list/list.go
@@ -0,0 +1,163 @@
+package list
+
+import (
+	"encoding/json"
+	"regexp"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/spf13/cast"
+)
+
+var cachedPatterns = store.New[string, *regexp.Regexp](nil)
+
+// SubtractSlice returns a new slice with only the "base" elements
+// that don't exist in "subtract".
+func SubtractSlice[T comparable](base []T, subtract []T) []T {
+	var result = make([]T, 0, len(base))
+
+	for _, b := range base {
+		if !ExistInSlice(b, subtract) {
+			result = append(result, b)
+		}
+	}
+
+	return result
+}
+
+// ExistInSlice checks whether a comparable element exists in a slice of the same type.
+func ExistInSlice[T comparable](item T, list []T) bool {
+	for _, v := range list {
+		if v == item {
+			return true
+		}
+	}
+
+	return false
+}
+
+// ExistInSliceWithRegex checks whether a string exists in a slice
+// either by direct match, or by a regular expression (eg. `^\w+$`).
+//
+// Note: Only list items starting with '^' and ending with '$' are treated as regular expressions!
+func ExistInSliceWithRegex(str string, list []string) bool {
+	for _, field := range list {
+		isRegex := strings.HasPrefix(field, "^") && strings.HasSuffix(field, "$")
+
+		if !isRegex {
+			// check for direct match
+			if str == field {
+				return true
+			}
+			continue
+		}
+
+		// check for regex match
+		pattern := cachedPatterns.Get(field)
+		if pattern == nil {
+			var err error
+			pattern, err = regexp.Compile(field)
+			if err != nil {
+				continue
+			}
+			// "cache" the pattern to avoid compiling it every time
+			// (the limit size is arbitrary and it is there to prevent the cache growing too big)
+			//
+			// @todo consider replacing with TTL or LRU type cache
+			cachedPatterns.SetIfLessThanLimit(field, pattern, 500)
+		}
+
+		if pattern != nil && pattern.MatchString(str) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// ToInterfaceSlice converts a generic slice to slice of interfaces.
+func ToInterfaceSlice[T any](list []T) []any {
+	result := make([]any, len(list))
+
+	for i := range list {
+		result[i] = list[i]
+	}
+
+	return result
+}
+
+// NonzeroUniques returns only the nonzero unique values from a slice.
+func NonzeroUniques[T comparable](list []T) []T {
+	result := make([]T, 0, len(list))
+	existMap := make(map[T]struct{}, len(list))
+
+	var zeroVal T
+
+	for _, val := range list {
+		if val == zeroVal {
+			continue
+		}
+		if _, ok := existMap[val]; ok {
+			continue
+		}
+		existMap[val] = struct{}{}
+		result = append(result, val)
+	}
+
+	return result
+}
+
+// ToUniqueStringSlice casts `value` to a slice of non-zero unique strings.
+func ToUniqueStringSlice(value any) (result []string) {
+	switch val := value.(type) {
+	case nil:
+		// nothing to cast
+	case []string:
+		result = val
+	case string:
+		if val == "" {
+			break
+		}
+
+		// check if it is a json encoded array of strings
+		if strings.Contains(val, "[") {
+			if err := json.Unmarshal([]byte(val), &result); err != nil {
+				// not a json array, just add the string as single array element
+				result = append(result, val)
+			}
+		} else {
+			// just add the string as single array element
+			result = append(result, val)
+		}
+	case json.Marshaler: // eg. JSONArray
+		raw, _ := val.MarshalJSON()
+		_ = json.Unmarshal(raw, &result)
+	default:
+		result = cast.ToStringSlice(value)
+	}
+
+	return NonzeroUniques(result)
+}
+
+// ToChunks splits list into chunks.
+//
+// Zero or negative chunkSize argument is normalized to 1.
+//
+// See https://go.dev/wiki/SliceTricks#batching-with-minimal-allocation.
+func ToChunks[T any](list []T, chunkSize int) [][]T {
+	if chunkSize <= 0 {
+		chunkSize = 1
+	}
+
+	chunks := make([][]T, 0, (len(list)+chunkSize-1)/chunkSize)
+
+	if len(list) == 0 {
+		return chunks
+	}
+
+	for chunkSize < len(list) {
+		list, chunks = list[chunkSize:], append(chunks, list[0:chunkSize:chunkSize])
+	}
+
+	return append(chunks, list)
+}
diff --git a/server/core_backend-server/tools/list/list_test.go b/server/core_backend-server/tools/list/list_test.go
new file mode 100644
index 0000000..d169a75
--- /dev/null
+++ b/server/core_backend-server/tools/list/list_test.go
@@ -0,0 +1,310 @@
+package list_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestSubtractSliceString(t *testing.T) {
+	scenarios := []struct {
+		base     []string
+		subtract []string
+		expected string
+	}{
+		{
+			[]string{},
+			[]string{},
+			`[]`,
+		},
+		{
+			[]string{},
+			[]string{"1", "2", "3", "4"},
+			`[]`,
+		},
+		{
+			[]string{"1", "2", "3", "4"},
+			[]string{},
+			`["1","2","3","4"]`,
+		},
+		{
+			[]string{"1", "2", "3", "4"},
+			[]string{"1", "2", "3", "4"},
+			`[]`,
+		},
+		{
+			[]string{"1", "2", "3", "4", "7"},
+			[]string{"2", "4", "5", "6"},
+			`["1","3","7"]`,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.expected), func(t *testing.T) {
+			result := list.SubtractSlice(s.base, s.subtract)
+
+			raw, err := json.Marshal(result)
+			if err != nil {
+				t.Fatalf("Failed to serialize: %v", err)
+			}
+
+			strResult := string(raw)
+
+			if strResult != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, strResult)
+			}
+		})
+	}
+}
+
+func TestSubtractSliceInt(t *testing.T) {
+	scenarios := []struct {
+		base     []int
+		subtract []int
+		expected string
+	}{
+		{
+			[]int{},
+			[]int{},
+			`[]`,
+		},
+		{
+			[]int{},
+			[]int{1, 2, 3, 4},
+			`[]`,
+		},
+		{
+			[]int{1, 2, 3, 4},
+			[]int{},
+			`[1,2,3,4]`,
+		},
+		{
+			[]int{1, 2, 3, 4},
+			[]int{1, 2, 3, 4},
+			`[]`,
+		},
+		{
+			[]int{1, 2, 3, 4, 7},
+			[]int{2, 4, 5, 6},
+			`[1,3,7]`,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.expected), func(t *testing.T) {
+			result := list.SubtractSlice(s.base, s.subtract)
+
+			raw, err := json.Marshal(result)
+			if err != nil {
+				t.Fatalf("Failed to serialize: %v", err)
+			}
+
+			strResult := string(raw)
+
+			if strResult != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, strResult)
+			}
+		})
+	}
+}
+
+func TestExistInSliceString(t *testing.T) {
+	scenarios := []struct {
+		item     string
+		list     []string
+		expected bool
+	}{
+		{"", []string{""}, true},
+		{"", []string{"1", "2", "test 123"}, false},
+		{"test", []string{}, false},
+		{"test", []string{"TEST"}, false},
+		{"test", []string{"1", "2", "test 123"}, false},
+		{"test", []string{"1", "2", "test"}, true},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.item), func(t *testing.T) {
+			result := list.ExistInSlice(s.item, s.list)
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestExistInSliceInt(t *testing.T) {
+	scenarios := []struct {
+		item     int
+		list     []int
+		expected bool
+	}{
+		{0, []int{}, false},
+		{0, []int{0}, true},
+		{4, []int{1, 2, 3}, false},
+		{1, []int{1, 2, 3}, true},
+		{-1, []int{0, 1, 2, 3}, false},
+		{-1, []int{0, -1, -2, -3, -4}, true},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%d", i, s.item), func(t *testing.T) {
+			result := list.ExistInSlice(s.item, s.list)
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestExistInSliceWithRegex(t *testing.T) {
+	scenarios := []struct {
+		item     string
+		list     []string
+		expected bool
+	}{
+		{"", []string{``}, true},
+		{"", []string{`^\W+$`}, false},
+		{" ", []string{`^\W+$`}, true},
+		{"test", []string{`^\invalid[+$`}, false}, // invalid regex
+		{"test", []string{`^\W+$`, "test"}, true},
+		{`^\W+$`, []string{`^\W+$`, "test"}, false}, // direct match shouldn't work for this case
+		{`\W+$`, []string{`\W+$`, "test"}, true},    // direct match should work for this case because it is not an actual supported pattern format
+		{"!?@", []string{`\W+$`, "test"}, false},    // the method requires the pattern elems to start with '^'
+		{"!?@", []string{`^\W+`, "test"}, false},    // the method requires the pattern elems to end with '$'
+		{"!?@", []string{`^\W+$`, "test"}, true},
+		{"!?@test", []string{`^\W+$`, "test"}, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.item), func(t *testing.T) {
+			result := list.ExistInSliceWithRegex(s.item, s.list)
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestToInterfaceSlice(t *testing.T) {
+	scenarios := []struct {
+		items []string
+	}{
+		{[]string{}},
+		{[]string{""}},
+		{[]string{"1", "test"}},
+		{[]string{"test1", "test1", "test2", "test3"}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.items), func(t *testing.T) {
+			result := list.ToInterfaceSlice(s.items)
+
+			if len(result) != len(s.items) {
+				t.Fatalf("Expected length %d, got %d", len(s.items), len(result))
+			}
+
+			for j, v := range result {
+				if v != s.items[j] {
+					t.Fatalf("Result list item doesn't match with the original list item, got %v VS %v", v, s.items[j])
+				}
+			}
+		})
+	}
+}
+
+func TestNonzeroUniquesString(t *testing.T) {
+	scenarios := []struct {
+		items    []string
+		expected []string
+	}{
+		{[]string{}, []string{}},
+		{[]string{""}, []string{}},
+		{[]string{"1", "test"}, []string{"1", "test"}},
+		{[]string{"test1", "", "test2", "Test2", "test1", "test3"}, []string{"test1", "test2", "Test2", "test3"}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.items), func(t *testing.T) {
+			result := list.NonzeroUniques(s.items)
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected length %d, got %d", len(s.expected), len(result))
+			}
+
+			for j, v := range result {
+				if v != s.expected[j] {
+					t.Fatalf("Result list item doesn't match with the expected list item, got %v VS %v", v, s.expected[j])
+				}
+			}
+		})
+	}
+}
+
+func TestToUniqueStringSlice(t *testing.T) {
+	scenarios := []struct {
+		value    any
+		expected []string
+	}{
+		{nil, []string{}},
+		{"", []string{}},
+		{[]any{}, []string{}},
+		{[]int{}, []string{}},
+		{"test", []string{"test"}},
+		{[]int{1, 2, 3}, []string{"1", "2", "3"}},
+		{[]any{0, 1, "test", ""}, []string{"0", "1", "test"}},
+		{[]string{"test1", "test2", "test1"}, []string{"test1", "test2"}},
+		{`["test1", "test2", "test2"]`, []string{"test1", "test2"}},
+		{types.JSONArray[string]{"test1", "test2", "test1"}, []string{"test1", "test2"}},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			result := list.ToUniqueStringSlice(s.value)
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected length %d, got %d", len(s.expected), len(result))
+			}
+
+			for j, v := range result {
+				if v != s.expected[j] {
+					t.Fatalf("Result list item doesn't match with the expected list item, got %v vs %v", v, s.expected[j])
+				}
+			}
+		})
+	}
+}
+
+func TestToChunks(t *testing.T) {
+	scenarios := []struct {
+		items     []any
+		chunkSize int
+		expected  string
+	}{
+		{nil, 2, "[]"},
+		{[]any{}, 2, "[]"},
+		{[]any{1, 2, 3, 4}, -1, "[[1],[2],[3],[4]]"},
+		{[]any{1, 2, 3, 4}, 0, "[[1],[2],[3],[4]]"},
+		{[]any{1, 2, 3, 4}, 2, "[[1,2],[3,4]]"},
+		{[]any{1, 2, 3, 4, 5}, 2, "[[1,2],[3,4],[5]]"},
+		{[]any{1, 2, 3, 4, 5}, 10, "[[1,2,3,4,5]]"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.items), func(t *testing.T) {
+			result := list.ToChunks(s.items, s.chunkSize)
+
+			raw, err := json.Marshal(result)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, rawStr)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/logger/batch_handler.go b/server/core_backend-server/tools/logger/batch_handler.go
new file mode 100644
index 0000000..e4d3437
--- /dev/null
+++ b/server/core_backend-server/tools/logger/batch_handler.go
@@ -0,0 +1,325 @@
+package logger
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"sync"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+var _ slog.Handler = (*BatchHandler)(nil)
+
+// BatchOptions are options for the BatchHandler.
+type BatchOptions struct {
+	// WriteFunc processes the batched logs.
+	WriteFunc func(ctx context.Context, logs []*Log) error
+
+	// BeforeAddFunc is optional function that is invoked every time
+	// before a new log is added to the batch queue.
+	//
+	// Return false to skip adding the log into the batch queue.
+	BeforeAddFunc func(ctx context.Context, log *Log) bool
+
+	// Level reports the minimum level to log.
+	// Levels with lower levels are discarded.
+	// If nil, the Handler uses [slog.LevelInfo].
+	Level slog.Leveler
+
+	// BatchSize specifies how many logs to accumulate before calling WriteFunc.
+	// If not set or 0, fallback to 100 by default.
+	BatchSize int
+}
+
+// NewBatchHandler creates a slog compatible handler that writes JSON
+// logs on batches (default to 100), using the given options.
+//
+// Panics if [BatchOptions.WriteFunc] is not defined.
+//
+// Example:
+//
+//	l := slog.New(logger.NewBatchHandler(logger.BatchOptions{
+//	    WriteFunc: func(ctx context.Context, logs []*Log) error {
+//	        for _, l := range logs {
+//	            fmt.Println(l.Level, l.Message, l.Data)
+//	        }
+//	        return nil
+//	    }
+//	}))
+//	l.Info("Example message", "title", "lorem ipsum")
+func NewBatchHandler(options BatchOptions) *BatchHandler {
+	h := &BatchHandler{
+		mux:     &sync.Mutex{},
+		options: &options,
+	}
+
+	if h.options.WriteFunc == nil {
+		panic("options.WriteFunc must be set")
+	}
+
+	if h.options.Level == nil {
+		h.options.Level = slog.LevelInfo
+	}
+
+	if h.options.BatchSize == 0 {
+		h.options.BatchSize = 100
+	}
+
+	h.logs = make([]*Log, 0, h.options.BatchSize)
+
+	return h
+}
+
+// BatchHandler is a slog handler that writes records on batches.
+//
+// The log records attributes are formatted in JSON.
+//
+// Requires the [BatchOptions.WriteFunc] option to be defined.
+type BatchHandler struct {
+	mux     *sync.Mutex
+	parent  *BatchHandler
+	options *BatchOptions
+	group   string
+	attrs   []slog.Attr
+	logs    []*Log
+}
+
+// Enabled reports whether the handler handles records at the given level.
+//
+// The handler ignores records whose level is lower.
+func (h *BatchHandler) Enabled(ctx context.Context, level slog.Level) bool {
+	return level >= h.options.Level.Level()
+}
+
+// WithGroup returns a new BatchHandler that starts a group.
+//
+// All logger attributes will be resolved under the specified group name.
+func (h *BatchHandler) WithGroup(name string) slog.Handler {
+	if name == "" {
+		return h
+	}
+
+	return &BatchHandler{
+		parent:  h,
+		mux:     h.mux,
+		options: h.options,
+		group:   name,
+	}
+}
+
+// WithAttrs returns a new BatchHandler loaded with the specified attributes.
+func (h *BatchHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
+	if len(attrs) == 0 {
+		return h
+	}
+
+	return &BatchHandler{
+		parent:  h,
+		mux:     h.mux,
+		options: h.options,
+		attrs:   attrs,
+	}
+}
+
+// Handle formats the slog.Record argument as JSON object and adds it
+// to the batch queue.
+//
+// If the batch queue threshold has been reached, the WriteFunc option
+// is invoked with the accumulated logs which in turn will reset the batch queue.
+func (h *BatchHandler) Handle(ctx context.Context, r slog.Record) error {
+	if h.group != "" {
+		h.mux.Lock()
+		attrs := make([]any, 0, len(h.attrs)+r.NumAttrs())
+		for _, a := range h.attrs {
+			attrs = append(attrs, a)
+		}
+		h.mux.Unlock()
+
+		r.Attrs(func(a slog.Attr) bool {
+			attrs = append(attrs, a)
+			return true
+		})
+
+		r = slog.NewRecord(r.Time, r.Level, r.Message, r.PC)
+		r.AddAttrs(slog.Group(h.group, attrs...))
+	} else if len(h.attrs) > 0 {
+		r = r.Clone()
+
+		h.mux.Lock()
+		r.AddAttrs(h.attrs...)
+		h.mux.Unlock()
+	}
+
+	if h.parent != nil {
+		return h.parent.Handle(ctx, r)
+	}
+
+	data := make(map[string]any, r.NumAttrs())
+
+	r.Attrs(func(a slog.Attr) bool {
+		if err := h.resolveAttr(data, a); err != nil {
+			return false
+		}
+		return true
+	})
+
+	log := &Log{
+		Time:    r.Time,
+		Level:   r.Level,
+		Message: r.Message,
+		Data:    types.JSONMap[any](data),
+	}
+
+	if h.options.BeforeAddFunc != nil && !h.options.BeforeAddFunc(ctx, log) {
+		return nil
+	}
+
+	h.mux.Lock()
+	h.logs = append(h.logs, log)
+	totalLogs := len(h.logs)
+	h.mux.Unlock()
+
+	if totalLogs >= h.options.BatchSize {
+		if err := h.WriteAll(ctx); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// SetLevel updates the handler options level to the specified one.
+func (h *BatchHandler) SetLevel(level slog.Level) {
+	h.mux.Lock()
+	h.options.Level = level
+	h.mux.Unlock()
+}
+
+// WriteAll writes all accumulated Log entries and resets the batch queue.
+func (h *BatchHandler) WriteAll(ctx context.Context) error {
+	if h.parent != nil {
+		// invoke recursively the parent level handler since the most
+		// top level one is holding the logs queue.
+		return h.parent.WriteAll(ctx)
+	}
+
+	h.mux.Lock()
+
+	totalLogs := len(h.logs)
+
+	// no logs to write
+	if totalLogs == 0 {
+		h.mux.Unlock()
+		return nil
+	}
+
+	// create a copy of the logs slice to prevent blocking during write
+	logs := make([]*Log, totalLogs)
+	copy(logs, h.logs)
+	h.logs = h.logs[:0] // reset
+
+	h.mux.Unlock()
+
+	return h.options.WriteFunc(ctx, logs)
+}
+
+// resolveAttr writes attr into data.
+func (h *BatchHandler) resolveAttr(data map[string]any, attr slog.Attr) error {
+	// ensure that the attr value is resolved before doing anything else
+	attr.Value = attr.Value.Resolve()
+
+	if attr.Equal(slog.Attr{}) {
+		return nil // ignore empty attrs
+	}
+
+	switch attr.Value.Kind() {
+	case slog.KindGroup:
+		attrs := attr.Value.Group()
+		if len(attrs) == 0 {
+			return nil // ignore empty groups
+		}
+
+		// create a submap to wrap the resolved group attributes
+		groupData := make(map[string]any, len(attrs))
+
+		for _, subAttr := range attrs {
+			h.resolveAttr(groupData, subAttr)
+		}
+
+		if len(groupData) > 0 {
+			data[attr.Key] = groupData
+		}
+	default:
+		data[attr.Key] = normalizeLogAttrValue(attr.Value.Any())
+	}
+
+	return nil
+}
+
+func normalizeLogAttrValue(rawAttrValue any) any {
+	switch attrV := rawAttrValue.(type) {
+	case validation.Errors:
+		out := make(map[string]any, len(attrV))
+		for k, v := range attrV {
+			out[k] = serializeLogError(v)
+		}
+		return out
+	case map[string]validation.Error:
+		out := make(map[string]any, len(attrV))
+		for k, v := range attrV {
+			out[k] = serializeLogError(v)
+		}
+		return out
+	case map[string]error:
+		out := make(map[string]any, len(attrV))
+		for k, v := range attrV {
+			out[k] = serializeLogError(v)
+		}
+		return out
+	case map[string]any:
+		out := make(map[string]any, len(attrV))
+		for k, v := range attrV {
+			switch vv := v.(type) {
+			case error:
+				out[k] = serializeLogError(vv)
+			default:
+				out[k] = normalizeLogAttrValue(vv)
+			}
+		}
+		return out
+	case error:
+		// check for wrapped validation.Errors
+		var ve validation.Errors
+		if errors.As(attrV, &ve) {
+			out := make(map[string]any, len(ve))
+			for k, v := range ve {
+				out[k] = serializeLogError(v)
+			}
+			return map[string]any{
+				"data": out,
+				"raw":  serializeLogError(attrV),
+			}
+		}
+		return serializeLogError(attrV)
+	default:
+		return attrV
+	}
+}
+
+func serializeLogError(err error) any {
+	if err == nil {
+		return nil
+	}
+
+	// prioritize a json structured format (e.g. validation.Errors)
+	jsonErr, ok := err.(json.Marshaler)
+	if ok {
+		return jsonErr
+	}
+
+	// fallback to its original string representation
+	return err.Error()
+}
diff --git a/server/core_backend-server/tools/logger/batch_handler_test.go b/server/core_backend-server/tools/logger/batch_handler_test.go
new file mode 100644
index 0000000..c394ec4
--- /dev/null
+++ b/server/core_backend-server/tools/logger/batch_handler_test.go
@@ -0,0 +1,354 @@
+package logger
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"testing"
+	"time"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+)
+
+func TestNewBatchHandlerPanic(t *testing.T) {
+	defer func() {
+		if r := recover(); r == nil {
+			t.Errorf("Expected to panic.")
+		}
+	}()
+
+	NewBatchHandler(BatchOptions{})
+}
+
+func TestNewBatchHandlerDefaults(t *testing.T) {
+	h := NewBatchHandler(BatchOptions{
+		WriteFunc: func(ctx context.Context, logs []*Log) error {
+			return nil
+		},
+	})
+
+	if h.options.BatchSize != 100 {
+		t.Fatalf("Expected default BatchSize %d, got %d", 100, h.options.BatchSize)
+	}
+
+	if h.options.Level != slog.LevelInfo {
+		t.Fatalf("Expected default Level Info, got %v", h.options.Level)
+	}
+
+	if h.options.BeforeAddFunc != nil {
+		t.Fatal("Expected default BeforeAddFunc to be nil")
+	}
+
+	if h.options.WriteFunc == nil {
+		t.Fatal("Expected default WriteFunc to be set")
+	}
+
+	if h.group != "" {
+		t.Fatalf("Expected empty group, got %s", h.group)
+	}
+
+	if len(h.attrs) != 0 {
+		t.Fatalf("Expected empty attrs, got %v", h.attrs)
+	}
+
+	if len(h.logs) != 0 {
+		t.Fatalf("Expected empty logs queue, got %v", h.logs)
+	}
+}
+
+func TestBatchHandlerEnabled(t *testing.T) {
+	h := NewBatchHandler(BatchOptions{
+		Level: slog.LevelWarn,
+		WriteFunc: func(ctx context.Context, logs []*Log) error {
+			return nil
+		},
+	})
+
+	l := slog.New(h)
+
+	scenarios := []struct {
+		level    slog.Level
+		expected bool
+	}{
+		{slog.LevelDebug, false},
+		{slog.LevelInfo, false},
+		{slog.LevelWarn, true},
+		{slog.LevelError, true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("Level %v", s.level), func(t *testing.T) {
+			result := l.Enabled(context.Background(), s.level)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestBatchHandlerSetLevel(t *testing.T) {
+	h := NewBatchHandler(BatchOptions{
+		Level: slog.LevelWarn,
+		WriteFunc: func(ctx context.Context, logs []*Log) error {
+			return nil
+		},
+	})
+
+	if h.options.Level != slog.LevelWarn {
+		t.Fatalf("Expected the initial level to be %d, got %d", slog.LevelWarn, h.options.Level)
+	}
+
+	h.SetLevel(slog.LevelDebug)
+
+	if h.options.Level != slog.LevelDebug {
+		t.Fatalf("Expected the updated level to be %d, got %d", slog.LevelDebug, h.options.Level)
+	}
+}
+
+func TestBatchHandlerWithAttrsAndWithGroup(t *testing.T) {
+	h0 := NewBatchHandler(BatchOptions{
+		WriteFunc: func(ctx context.Context, logs []*Log) error {
+			return nil
+		},
+	})
+
+	h1 := h0.WithAttrs([]slog.Attr{slog.Int("test1", 1)}).(*BatchHandler)
+	h2 := h1.WithGroup("h2_group").(*BatchHandler)
+	h3 := h2.WithAttrs([]slog.Attr{slog.Int("test2", 2)}).(*BatchHandler)
+
+	scenarios := []struct {
+		name           string
+		handler        *BatchHandler
+		expectedParent *BatchHandler
+		expectedGroup  string
+		expectedAttrs  int
+	}{
+		{
+			"h0",
+			h0,
+			nil,
+			"",
+			0,
+		},
+		{
+			"h1",
+			h1,
+			h0,
+			"",
+			1,
+		},
+		{
+			"h2",
+			h2,
+			h1,
+			"h2_group",
+			0,
+		},
+		{
+			"h3",
+			h3,
+			h2,
+			"",
+			1,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			if s.handler.group != s.expectedGroup {
+				t.Fatalf("Expected group %q, got %q", s.expectedGroup, s.handler.group)
+			}
+
+			if s.handler.parent != s.expectedParent {
+				t.Fatalf("Expected parent %v, got %v", s.expectedParent, s.handler.parent)
+			}
+
+			if totalAttrs := len(s.handler.attrs); totalAttrs != s.expectedAttrs {
+				t.Fatalf("Expected %d attrs, got %d", s.expectedAttrs, totalAttrs)
+			}
+		})
+	}
+}
+
+func TestBatchHandlerHandle(t *testing.T) {
+	ctx := context.Background()
+
+	beforeLogs := []*Log{}
+	writeLogs := []*Log{}
+
+	h := NewBatchHandler(BatchOptions{
+		BatchSize: 3,
+		BeforeAddFunc: func(_ context.Context, log *Log) bool {
+			beforeLogs = append(beforeLogs, log)
+
+			// skip test2 log
+			return log.Message != "test2"
+		},
+		WriteFunc: func(_ context.Context, logs []*Log) error {
+			writeLogs = logs
+			return nil
+		},
+	})
+
+	h.Handle(ctx, slog.NewRecord(time.Now(), slog.LevelInfo, "test1", 0))
+	h.Handle(ctx, slog.NewRecord(time.Now(), slog.LevelInfo, "test2", 0))
+	h.Handle(ctx, slog.NewRecord(time.Now(), slog.LevelInfo, "test3", 0))
+
+	// no batch write
+	{
+		checkLogMessages([]string{"test1", "test2", "test3"}, beforeLogs, t)
+
+		checkLogMessages([]string{"test1", "test3"}, h.logs, t)
+
+		// should be empty because no batch write has happened yet
+		if totalWriteLogs := len(writeLogs); totalWriteLogs != 0 {
+			t.Fatalf("Expected %d writeLogs, got %d", 0, totalWriteLogs)
+		}
+	}
+
+	// add one more log to trigger the batch write
+	{
+		h.Handle(ctx, slog.NewRecord(time.Now(), slog.LevelInfo, "test4", 0))
+
+		// should be empty after the batch write
+		checkLogMessages([]string{}, h.logs, t)
+
+		checkLogMessages([]string{"test1", "test3", "test4"}, writeLogs, t)
+	}
+}
+
+func TestBatchHandlerWriteAll(t *testing.T) {
+	ctx := context.Background()
+
+	beforeLogs := []*Log{}
+	writeLogs := []*Log{}
+
+	h := NewBatchHandler(BatchOptions{
+		BatchSize: 3,
+		BeforeAddFunc: func(_ context.Context, log *Log) bool {
+			beforeLogs = append(beforeLogs, log)
+			return true
+		},
+		WriteFunc: func(_ context.Context, logs []*Log) error {
+			writeLogs = logs
+			return nil
+		},
+	})
+
+	h.Handle(ctx, slog.NewRecord(time.Now(), slog.LevelInfo, "test1", 0))
+	h.Handle(ctx, slog.NewRecord(time.Now(), slog.LevelInfo, "test2", 0))
+
+	checkLogMessages([]string{"test1", "test2"}, beforeLogs, t)
+	checkLogMessages([]string{"test1", "test2"}, h.logs, t)
+	checkLogMessages([]string{}, writeLogs, t) // empty because the batch size hasn't been reached
+
+	// force trigger the batch write
+	h.WriteAll(ctx)
+
+	checkLogMessages([]string{"test1", "test2"}, beforeLogs, t)
+	checkLogMessages([]string{}, h.logs, t) // reset
+	checkLogMessages([]string{"test1", "test2"}, writeLogs, t)
+}
+
+func TestBatchHandlerAttrsFormat(t *testing.T) {
+	ctx := context.Background()
+
+	beforeLogs := []*Log{}
+
+	h0 := NewBatchHandler(BatchOptions{
+		BeforeAddFunc: func(_ context.Context, log *Log) bool {
+			beforeLogs = append(beforeLogs, log)
+			return true
+		},
+		WriteFunc: func(_ context.Context, logs []*Log) error {
+			return nil
+		},
+	})
+
+	h1 := h0.WithAttrs([]slog.Attr{slog.Int("a", 1), slog.String("b", "123")})
+
+	h2 := h1.WithGroup("sub").WithAttrs([]slog.Attr{
+		slog.Int("c", 3),
+		slog.Any("d", map[string]any{"d.1": 1}),
+		slog.Any("e", errors.New("example error")),
+	})
+
+	record := slog.NewRecord(time.Now(), slog.LevelInfo, "hello", 0)
+	record.AddAttrs(slog.String("name", "test"))
+
+	h0.Handle(ctx, record)
+	h1.Handle(ctx, record)
+	h2.Handle(ctx, record)
+
+	// errors serialization checks
+	errorsRecord := slog.NewRecord(time.Now(), slog.LevelError, "details", 0)
+	errorsRecord.Add("validation.Errors", validation.Errors{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": errors.New("plain"),
+	})
+	errorsRecord.Add("wrapped_validation.Errors", fmt.Errorf("wrapped: %w", validation.Errors{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": errors.New("plain"),
+	}))
+	errorsRecord.Add("map[string]any", map[string]any{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": errors.New("plain"),
+		"c": "test_any",
+		"d": map[string]any{
+			"nestedA": validation.NewError("nested_code", "nested_message"),
+			"nestedB": errors.New("nested_plain"),
+		},
+	})
+	errorsRecord.Add("map[string]error", map[string]error{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": errors.New("plain"),
+	})
+	errorsRecord.Add("map[string]validation.Error", map[string]validation.Error{
+		"a": validation.NewError("validation_code", "validation_message"),
+		"b": nil,
+	})
+	errorsRecord.Add("plain_error", errors.New("plain"))
+	h0.Handle(ctx, errorsRecord)
+
+	expected := []string{
+		`{"name":"test"}`,
+		`{"a":1,"b":"123","name":"test"}`,
+		`{"a":1,"b":"123","sub":{"c":3,"d":{"d.1":1},"e":"example error","name":"test"}}`,
+		`{"map[string]any":{"a":"validation_message","b":"plain","c":"test_any","d":{"nestedA":"nested_message","nestedB":"nested_plain"}},"map[string]error":{"a":"validation_message","b":"plain"},"map[string]validation.Error":{"a":"validation_message","b":null},"plain_error":"plain","validation.Errors":{"a":"validation_message","b":"plain"},"wrapped_validation.Errors":{"data":{"a":"validation_message","b":"plain"},"raw":"wrapped: a: validation_message; b: plain."}}`,
+	}
+
+	if len(beforeLogs) != len(expected) {
+		t.Fatalf("Expected %d logs, got %d", len(expected), len(beforeLogs))
+	}
+
+	for i, data := range expected {
+		t.Run(fmt.Sprintf("log handler %d", i), func(t *testing.T) {
+			log := beforeLogs[i]
+			raw, _ := log.Data.MarshalJSON()
+			if string(raw) != data {
+				t.Fatalf("Expected \n%s \ngot \n%s", data, raw)
+			}
+		})
+	}
+}
+
+func checkLogMessages(expected []string, logs []*Log, t *testing.T) {
+	if len(logs) != len(expected) {
+		t.Fatalf("Expected %d batched logs, got %d (expected: %v)", len(expected), len(logs), expected)
+	}
+
+	for _, message := range expected {
+		exists := false
+		for _, l := range logs {
+			if l.Message == message {
+				exists = true
+				continue
+			}
+		}
+		if !exists {
+			t.Fatalf("Missing %q log message", message)
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/logger/log.go b/server/core_backend-server/tools/logger/log.go
new file mode 100644
index 0000000..e017ff1
--- /dev/null
+++ b/server/core_backend-server/tools/logger/log.go
@@ -0,0 +1,17 @@
+package logger
+
+import (
+	"log/slog"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// Log is similar to [slog.Record] bit contains the log attributes as
+// preformatted JSON map.
+type Log struct {
+	Time    time.Time
+	Data    types.JSONMap[any]
+	Message string
+	Level   slog.Level
+}
diff --git a/server/core_backend-server/tools/mailer/html2text.go b/server/core_backend-server/tools/mailer/html2text.go
new file mode 100644
index 0000000..1f1f02f
--- /dev/null
+++ b/server/core_backend-server/tools/mailer/html2text.go
@@ -0,0 +1,118 @@
+package mailer
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/list"
+	"golang.org/x/net/html"
+)
+
+var whitespaceRegex = regexp.MustCompile(`\s+`)
+
+var tagsToSkip = []string{
+	"style", "script", "iframe", "applet", "object", "svg", "img",
+	"button", "form", "textarea", "input", "select", "option", "template",
+}
+
+var inlineTags = []string{
+	"a", "span", "small", "strike", "strong",
+	"sub", "sup", "em", "b", "u", "i",
+}
+
+// Very rudimentary auto HTML to Text mail body converter.
+//
+// Caveats:
+// - This method doesn't check for correctness of the HTML document.
+// - Links will be converted to "[text](url)" format.
+// - List items (<li>) are prefixed with "- ".
+// - Indentation is stripped (both tabs and spaces).
+// - Trailing spaces are preserved.
+// - Multiple consequence newlines are collapsed as one unless multiple <br> tags are used.
+func html2Text(htmlDocument string) (string, error) {
+	doc, err := html.Parse(strings.NewReader(htmlDocument))
+	if err != nil {
+		return "", err
+	}
+
+	var builder strings.Builder
+	var canAddNewLine bool
+
+	// see https://pkg.go.dev/golang.org/x/net/html#Parse
+	var f func(*html.Node, *strings.Builder)
+	f = func(n *html.Node, activeBuilder *strings.Builder) {
+		isLink := n.Type == html.ElementNode && n.Data == "a"
+
+		if isLink {
+			var linkBuilder strings.Builder
+			activeBuilder = &linkBuilder
+		} else if activeBuilder == nil {
+			activeBuilder = &builder
+		}
+
+		switch n.Type {
+		case html.TextNode:
+			txt := whitespaceRegex.ReplaceAllString(n.Data, " ")
+
+			// the prev node has new line so it is safe to trim the indentation
+			if !canAddNewLine {
+				txt = strings.TrimLeft(txt, " ")
+			}
+
+			if txt != "" {
+				activeBuilder.WriteString(txt)
+				canAddNewLine = true
+			}
+		case html.ElementNode:
+			if n.Data == "br" {
+				// always write new lines when <br> tag is used
+				activeBuilder.WriteString("\r\n")
+				canAddNewLine = false
+			} else if canAddNewLine && !list.ExistInSlice(n.Data, inlineTags) {
+				activeBuilder.WriteString("\r\n")
+				canAddNewLine = false
+			}
+
+			// prefix list items with dash
+			if n.Data == "li" {
+				activeBuilder.WriteString("- ")
+			}
+		}
+
+		for c := n.FirstChild; c != nil; c = c.NextSibling {
+			if c.Type != html.ElementNode || !list.ExistInSlice(c.Data, tagsToSkip) {
+				f(c, activeBuilder)
+			}
+		}
+
+		// format links as [label](href)
+		if isLink {
+			linkTxt := strings.TrimSpace(activeBuilder.String())
+			if linkTxt == "" {
+				linkTxt = "LINK"
+			}
+
+			builder.WriteString("[")
+			builder.WriteString(linkTxt)
+			builder.WriteString("]")
+
+			// link href attr extraction
+			for _, a := range n.Attr {
+				if a.Key == "href" {
+					if a.Val != "" {
+						builder.WriteString("(")
+						builder.WriteString(a.Val)
+						builder.WriteString(")")
+					}
+					break
+				}
+			}
+
+			activeBuilder.Reset()
+		}
+	}
+
+	f(doc, &builder)
+
+	return strings.TrimSpace(builder.String()), nil
+}
diff --git a/server/core_backend-server/tools/mailer/html2text_test.go b/server/core_backend-server/tools/mailer/html2text_test.go
new file mode 100644
index 0000000..d6304d2
--- /dev/null
+++ b/server/core_backend-server/tools/mailer/html2text_test.go
@@ -0,0 +1,131 @@
+package mailer
+
+import (
+	"testing"
+)
+
+func TestHTML2Text(t *testing.T) {
+	scenarios := []struct {
+		html     string
+		expected string
+	}{
+		{
+			"",
+			"",
+		},
+		{
+			"ab  c",
+			"ab c",
+		},
+		{
+			"<!-- test html comment -->",
+			"",
+		},
+		{
+			"<!-- test html comment -->   a   ",
+			"a",
+		},
+		{
+			"<span>a</span>b<span>c</span>",
+			"abc",
+		},
+		{
+			`<a href="a/b/c">test</span>`,
+			"[test](a/b/c)",
+		},
+		{
+			`<a href="">test</span>`,
+			"[test]",
+		},
+		{
+			"<span>a</span>  <span>b</span>",
+			"a b",
+		},
+		{
+			"<span>a</span>   b   <span>c</span>",
+			"a b c",
+		},
+		{
+			"<span>a</span>   b   <div>c</div>",
+			"a b \r\nc",
+		},
+		{
+			`
+				<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+				<html xmlns="http://www.w3.org/1999/xhtml">
+				<head>
+				    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+				    <meta name="viewport" content="width=device-width,initial-scale=1" />
+				    <style>
+				        body {
+				            padding: 0;
+				        }
+				    </style>
+				</head>
+				<body>
+					<!-- test html comment -->
+					<style>
+					    body {
+					        padding: 0;
+					    }
+					</style>
+				    <div class="wrapper">
+				        <div class="content">
+				            <p>Lorem ipsum</p>
+				            <p>Dolor sit amet</p>
+				            <p>
+				            	<a href="a/b/c">Verify</a>
+				            </p>
+				            <br>
+				            <p>
+				            	<a href="a/b/c"><strong>Verify2.1</strong> <strong>Verify2.2</strong></a>
+				            </p>
+				            <br>
+				            <br>
+				            <div>
+				            	<div>
+				            		<div>
+							            <ul>
+							            	<li>ul.test1</li>
+							            	<li>ul.test2</li>
+							            	<li>ul.test3</li>
+							            </ul>
+							            <ol>
+							            	<li>ol.test1</li>
+							            	<li>ol.test2</li>
+							            	<li>ol.test3</li>
+							            </ol>
+				            		</div>
+				            	</div>
+				            </div>
+				            <select>
+				            	<option>Option 1</option>
+				            	<option>Option 2</option>
+				            </select>
+				            <textarea>test</textarea>
+				            <input type="text" value="test" />
+				            <button>test</button>
+				            <p>
+				                Thanks,<br/>
+				                PocketBase team
+				            </p>
+				        </div>
+				    </div>
+				</body>
+				</html>
+			`,
+			"Lorem ipsum \r\nDolor sit amet \r\n[Verify](a/b/c)  \r\n[Verify2.1 Verify2.2](a/b/c)  \r\n\r\n- ul.test1 \r\n- ul.test2 \r\n- ul.test3  \r\n- ol.test1 \r\n- ol.test2 \r\n- ol.test3         \r\nThanks,\r\nPocketBase team",
+		},
+	}
+
+	for i, s := range scenarios {
+		result, err := html2Text(s.html)
+		if err != nil {
+			t.Errorf("(%d) Unexpected error %v", i, err)
+		}
+
+		if result != s.expected {
+			t.Errorf("(%d) Expected \n(%q)\n%v,\n\ngot:\n\n(%q)\n%v", i, s.expected, s.expected, result, result)
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/mailer/mailer.go b/server/core_backend-server/tools/mailer/mailer.go
new file mode 100644
index 0000000..c87e2e8
--- /dev/null
+++ b/server/core_backend-server/tools/mailer/mailer.go
@@ -0,0 +1,72 @@
+package mailer
+
+import (
+	"bytes"
+	"io"
+	"net/mail"
+
+	"github.com/gabriel-vasile/mimetype"
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+// Message defines a generic email message struct.
+type Message struct {
+	From              mail.Address         `json:"from"`
+	To                []mail.Address       `json:"to"`
+	Bcc               []mail.Address       `json:"bcc"`
+	Cc                []mail.Address       `json:"cc"`
+	Subject           string               `json:"subject"`
+	HTML              string               `json:"html"`
+	Text              string               `json:"text"`
+	Headers           map[string]string    `json:"headers"`
+	Attachments       map[string]io.Reader `json:"attachments"`
+	InlineAttachments map[string]io.Reader `json:"inlineAttachments"`
+}
+
+// Mailer defines a base mail client interface.
+type Mailer interface {
+	// Send sends an email with the provided Message.
+	Send(message *Message) error
+}
+
+// SendInterceptor is optional interface for registering mail send hooks.
+type SendInterceptor interface {
+	OnSend() *hook.Hook[*SendEvent]
+}
+
+type SendEvent struct {
+	hook.Event
+	Message *Message
+}
+
+// addressesToStrings converts the provided address to a list of serialized RFC 5322 strings.
+//
+// To export only the email part of mail.Address, you can set withName to false.
+func addressesToStrings(addresses []mail.Address, withName bool) []string {
+	result := make([]string, len(addresses))
+
+	for i, addr := range addresses {
+		if withName && addr.Name != "" {
+			result[i] = addr.String()
+		} else {
+			// keep only the email part to avoid wrapping in angle-brackets
+			result[i] = addr.Address
+		}
+	}
+
+	return result
+}
+
+// detectReaderMimeType reads the first couple bytes of the reader to detect its MIME type.
+//
+// Returns a new combined reader from the partial read + the remaining of the original reader.
+func detectReaderMimeType(r io.Reader) (io.Reader, string, error) {
+	readCopy := new(bytes.Buffer)
+
+	mime, err := mimetype.DetectReader(io.TeeReader(r, readCopy))
+	if err != nil {
+		return nil, "", err
+	}
+
+	return io.MultiReader(readCopy, r), mime.String(), nil
+}
diff --git a/server/core_backend-server/tools/mailer/mailer_test.go b/server/core_backend-server/tools/mailer/mailer_test.go
new file mode 100644
index 0000000..571f9ea
--- /dev/null
+++ b/server/core_backend-server/tools/mailer/mailer_test.go
@@ -0,0 +1,77 @@
+package mailer
+
+import (
+	"fmt"
+	"io"
+	"net/mail"
+	"strings"
+	"testing"
+)
+
+func TestAddressesToStrings(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		withName  bool
+		addresses []mail.Address
+		expected  []string
+	}{
+		{
+			true,
+			[]mail.Address{{Name: "John Doe", Address: "test1@example.com"}, {Name: "Jane Doe", Address: "test2@example.com"}},
+			[]string{`"John Doe" <test1@example.com>`, `"Jane Doe" <test2@example.com>`},
+		},
+		{
+			true,
+			[]mail.Address{{Name: "John Doe", Address: "test1@example.com"}, {Address: "test2@example.com"}},
+			[]string{`"John Doe" <test1@example.com>`, `test2@example.com`},
+		},
+		{
+			false,
+			[]mail.Address{{Name: "John Doe", Address: "test1@example.com"}, {Name: "Jane Doe", Address: "test2@example.com"}},
+			[]string{`test1@example.com`, `test2@example.com`},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("%v_%v", s.withName, s.addresses), func(t *testing.T) {
+			result := addressesToStrings(s.addresses, s.withName)
+
+			if len(s.expected) != len(result) {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, result)
+			}
+
+			for k, v := range s.expected {
+				if v != result[k] {
+					t.Fatalf("Expected %d address %q, got %q", k, v, result[k])
+				}
+			}
+		})
+	}
+}
+
+func TestDetectReaderMimeType(t *testing.T) {
+	t.Parallel()
+
+	str := "#!/bin/node\n" + strings.Repeat("a", 10000) // ensure that it is large enough to remain after the signature sniffing
+
+	r, mime, err := detectReaderMimeType(strings.NewReader(str))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expectedMime := "text/javascript"
+	if mime != expectedMime {
+		t.Fatalf("Expected mime %q, got %q", expectedMime, mime)
+	}
+
+	raw, err := io.ReadAll(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rawStr := string(raw)
+
+	if rawStr != str {
+		t.Fatalf("Expected content\n%s\ngot\n%s", str, rawStr)
+	}
+}
diff --git a/server/core_backend-server/tools/mailer/sendmail.go b/server/core_backend-server/tools/mailer/sendmail.go
new file mode 100644
index 0000000..b1dbaec
--- /dev/null
+++ b/server/core_backend-server/tools/mailer/sendmail.go
@@ -0,0 +1,99 @@
+package mailer
+
+import (
+	"bytes"
+	"errors"
+	"mime"
+	"net/http"
+	"os/exec"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+var _ Mailer = (*Sendmail)(nil)
+
+// Sendmail implements [mailer.Mailer] interface and defines a mail
+// client that sends emails via the "sendmail" *nix command.
+//
+// This client is usually recommended only for development and testing.
+type Sendmail struct {
+	onSend *hook.Hook[*SendEvent]
+}
+
+// OnSend implements [mailer.SendInterceptor] interface.
+func (c *Sendmail) OnSend() *hook.Hook[*SendEvent] {
+	if c.onSend == nil {
+		c.onSend = &hook.Hook[*SendEvent]{}
+	}
+	return c.onSend
+}
+
+// Send implements [mailer.Mailer] interface.
+func (c *Sendmail) Send(m *Message) error {
+	if c.onSend != nil {
+		return c.onSend.Trigger(&SendEvent{Message: m}, func(e *SendEvent) error {
+			return c.send(e.Message)
+		})
+	}
+
+	return c.send(m)
+}
+
+func (c *Sendmail) send(m *Message) error {
+	toAddresses := addressesToStrings(m.To, false)
+
+	headers := make(http.Header)
+	headers.Set("Subject", mime.QEncoding.Encode("utf-8", m.Subject))
+	headers.Set("From", m.From.String())
+	headers.Set("Content-Type", "text/html; charset=UTF-8")
+	headers.Set("To", strings.Join(toAddresses, ","))
+
+	cmdPath, err := findSendmailPath()
+	if err != nil {
+		return err
+	}
+
+	var buffer bytes.Buffer
+
+	// write
+	// ---
+	if err := headers.Write(&buffer); err != nil {
+		return err
+	}
+	if _, err := buffer.Write([]byte("\r\n")); err != nil {
+		return err
+	}
+	if m.HTML != "" {
+		if _, err := buffer.Write([]byte(m.HTML)); err != nil {
+			return err
+		}
+	} else {
+		if _, err := buffer.Write([]byte(m.Text)); err != nil {
+			return err
+		}
+	}
+	// ---
+
+	sendmail := exec.Command(cmdPath, strings.Join(toAddresses, ","))
+	sendmail.Stdin = &buffer
+
+	return sendmail.Run()
+}
+
+func findSendmailPath() (string, error) {
+	options := []string{
+		"/usr/sbin/sendmail",
+		"/usr/bin/sendmail",
+		"sendmail",
+	}
+
+	for _, option := range options {
+		path, err := exec.LookPath(option)
+		if err == nil {
+			return path, err
+		}
+	}
+
+	return "", errors.New("failed to locate a sendmail executable path")
+}
diff --git a/server/core_backend-server/tools/mailer/smtp.go b/server/core_backend-server/tools/mailer/smtp.go
new file mode 100644
index 0000000..3f1f745
--- /dev/null
+++ b/server/core_backend-server/tools/mailer/smtp.go
@@ -0,0 +1,211 @@
+package mailer
+
+import (
+	"errors"
+	"fmt"
+	"net/smtp"
+	"strings"
+
+	"github.com/domodwyer/mailyak/v3"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+var _ Mailer = (*SMTPClient)(nil)
+
+const (
+	SMTPAuthPlain = "PLAIN"
+	SMTPAuthLogin = "LOGIN"
+)
+
+// SMTPClient defines a SMTP mail client structure that implements
+// `mailer.Mailer` interface.
+type SMTPClient struct {
+	onSend *hook.Hook[*SendEvent]
+
+	TLS      bool
+	Port     int
+	Host     string
+	Username string
+	Password string
+
+	// SMTP auth method to use
+	// (if not explicitly set, defaults to "PLAIN")
+	AuthMethod string
+
+	// LocalName is optional domain name used for the EHLO/HELO exchange
+	// (if not explicitly set, defaults to "localhost").
+	//
+	// This is required only by some SMTP servers, such as Gmail SMTP-relay.
+	LocalName string
+}
+
+// OnSend implements [mailer.SendInterceptor] interface.
+func (c *SMTPClient) OnSend() *hook.Hook[*SendEvent] {
+	if c.onSend == nil {
+		c.onSend = &hook.Hook[*SendEvent]{}
+	}
+	return c.onSend
+}
+
+// Send implements [mailer.Mailer] interface.
+func (c *SMTPClient) Send(m *Message) error {
+	if c.onSend != nil {
+		return c.onSend.Trigger(&SendEvent{Message: m}, func(e *SendEvent) error {
+			return c.send(e.Message)
+		})
+	}
+
+	return c.send(m)
+}
+
+func (c *SMTPClient) send(m *Message) error {
+	var smtpAuth smtp.Auth
+	if c.Username != "" || c.Password != "" {
+		switch c.AuthMethod {
+		case SMTPAuthLogin:
+			smtpAuth = &smtpLoginAuth{c.Username, c.Password}
+		default:
+			smtpAuth = smtp.PlainAuth("", c.Username, c.Password, c.Host)
+		}
+	}
+
+	// create mail instance
+	var yak *mailyak.MailYak
+	if c.TLS {
+		var tlsErr error
+		yak, tlsErr = mailyak.NewWithTLS(fmt.Sprintf("%s:%d", c.Host, c.Port), smtpAuth, nil)
+		if tlsErr != nil {
+			return tlsErr
+		}
+	} else {
+		yak = mailyak.New(fmt.Sprintf("%s:%d", c.Host, c.Port), smtpAuth)
+	}
+
+	if c.LocalName != "" {
+		yak.LocalName(c.LocalName)
+	}
+
+	if m.From.Name != "" {
+		yak.FromName(m.From.Name)
+	}
+	yak.From(m.From.Address)
+	yak.Subject(m.Subject)
+	yak.HTML().Set(m.HTML)
+
+	if m.Text == "" {
+		// try to generate a plain text version of the HTML
+		if plain, err := html2Text(m.HTML); err == nil {
+			yak.Plain().Set(plain)
+		}
+	} else {
+		yak.Plain().Set(m.Text)
+	}
+
+	if len(m.To) > 0 {
+		yak.To(addressesToStrings(m.To, true)...)
+	}
+
+	if len(m.Bcc) > 0 {
+		yak.Bcc(addressesToStrings(m.Bcc, true)...)
+	}
+
+	if len(m.Cc) > 0 {
+		yak.Cc(addressesToStrings(m.Cc, true)...)
+	}
+
+	// add regular attachements (if any)
+	for name, data := range m.Attachments {
+		r, mime, err := detectReaderMimeType(data)
+		if err != nil {
+			return err
+		}
+		yak.AttachWithMimeType(name, r, mime)
+	}
+
+	// add inline attachments (if any)
+	for name, data := range m.InlineAttachments {
+		r, mime, err := detectReaderMimeType(data)
+		if err != nil {
+			return err
+		}
+		yak.AttachInlineWithMimeType(name, r, mime)
+	}
+
+	// add custom headers (if any)
+	var hasMessageId bool
+	for k, v := range m.Headers {
+		if strings.EqualFold(k, "Message-ID") {
+			hasMessageId = true
+		}
+		yak.AddHeader(k, v)
+	}
+	if !hasMessageId {
+		// add a default message id if missing
+		fromParts := strings.Split(m.From.Address, "@")
+		if len(fromParts) == 2 {
+			yak.AddHeader("Message-ID", fmt.Sprintf("<%s@%s>",
+				security.PseudorandomString(15),
+				fromParts[1],
+			))
+		}
+	}
+
+	return yak.Send()
+}
+
+// -------------------------------------------------------------------
+// AUTH LOGIN
+// -------------------------------------------------------------------
+
+var _ smtp.Auth = (*smtpLoginAuth)(nil)
+
+// smtpLoginAuth defines an AUTH that implements the LOGIN authentication mechanism.
+//
+// AUTH LOGIN is obsolete[1] but some mail services like outlook requires it [2].
+//
+// NB!
+// It will only send the credentials if the connection is using TLS or is connected to localhost.
+// Otherwise authentication will fail with an error, without sending the credentials.
+//
+// [1]: https://github.com/golang/go/issues/40817
+// [2]: https://support.microsoft.com/en-us/office/outlook-com-no-longer-supports-auth-plain-authentication-07f7d5e9-1697-465f-84d2-4513d4ff0145?ui=en-us&rs=en-us&ad=us
+type smtpLoginAuth struct {
+	username, password string
+}
+
+// Start initializes an authentication with the server.
+//
+// It is part of the [smtp.Auth] interface.
+func (a *smtpLoginAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
+	// Must have TLS, or else localhost server.
+	// Note: If TLS is not true, then we can't trust ANYTHING in ServerInfo.
+	// In particular, it doesn't matter if the server advertises LOGIN auth.
+	// That might just be the attacker saying
+	// "it's ok, you can trust me with your password."
+	if !server.TLS && !isLocalhost(server.Name) {
+		return "", nil, errors.New("unencrypted connection")
+	}
+
+	return "LOGIN", nil, nil
+}
+
+// Next "continues" the auth process by feeding the server with the requested data.
+//
+// It is part of the [smtp.Auth] interface.
+func (a *smtpLoginAuth) Next(fromServer []byte, more bool) ([]byte, error) {
+	if more {
+		switch strings.ToLower(string(fromServer)) {
+		case "username:":
+			return []byte(a.username), nil
+		case "password:":
+			return []byte(a.password), nil
+		}
+	}
+
+	return nil, nil
+}
+
+func isLocalhost(name string) bool {
+	return name == "localhost" || name == "127.0.0.1" || name == "::1"
+}
diff --git a/server/core_backend-server/tools/mailer/smtp_test.go b/server/core_backend-server/tools/mailer/smtp_test.go
new file mode 100644
index 0000000..49797d5
--- /dev/null
+++ b/server/core_backend-server/tools/mailer/smtp_test.go
@@ -0,0 +1,166 @@
+package mailer
+
+import (
+	"net/smtp"
+	"testing"
+)
+
+func TestLoginAuthStart(t *testing.T) {
+	auth := smtpLoginAuth{username: "test", password: "123456"}
+
+	scenarios := []struct {
+		name        string
+		serverInfo  *smtp.ServerInfo
+		expectError bool
+	}{
+		{
+			"localhost without tls",
+			&smtp.ServerInfo{TLS: false, Name: "localhost"},
+			false,
+		},
+		{
+			"localhost with tls",
+			&smtp.ServerInfo{TLS: true, Name: "localhost"},
+			false,
+		},
+		{
+			"127.0.0.1 without tls",
+			&smtp.ServerInfo{TLS: false, Name: "127.0.0.1"},
+			false,
+		},
+		{
+			"127.0.0.1 with tls",
+			&smtp.ServerInfo{TLS: false, Name: "127.0.0.1"},
+			false,
+		},
+		{
+			"::1 without tls",
+			&smtp.ServerInfo{TLS: false, Name: "::1"},
+			false,
+		},
+		{
+			"::1 with tls",
+			&smtp.ServerInfo{TLS: false, Name: "::1"},
+			false,
+		},
+		{
+			"non-localhost without tls",
+			&smtp.ServerInfo{TLS: false, Name: "example.com"},
+			true,
+		},
+		{
+			"non-localhost with tls",
+			&smtp.ServerInfo{TLS: true, Name: "example.com"},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			method, resp, err := auth.Start(s.serverInfo)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if len(resp) != 0 {
+				t.Fatalf("Expected empty data response, got %v", resp)
+			}
+
+			if method != "LOGIN" {
+				t.Fatalf("Expected LOGIN, got %v", method)
+			}
+		})
+	}
+}
+
+func TestLoginAuthNext(t *testing.T) {
+	auth := smtpLoginAuth{username: "test", password: "123456"}
+
+	{
+		// example|false
+		r1, err := auth.Next([]byte("example:"), false)
+		if err != nil {
+			t.Fatalf("[example|false] Unexpected error %v", err)
+		}
+		if len(r1) != 0 {
+			t.Fatalf("[example|false] Expected empty part, got %v", r1)
+		}
+
+		// example|true
+		r2, err := auth.Next([]byte("example:"), true)
+		if err != nil {
+			t.Fatalf("[example|true] Unexpected error %v", err)
+		}
+		if len(r2) != 0 {
+			t.Fatalf("[example|true] Expected empty part, got %v", r2)
+		}
+	}
+
+	// ---------------------------------------------------------------
+
+	{
+		// username:|false
+		r1, err := auth.Next([]byte("username:"), false)
+		if err != nil {
+			t.Fatalf("[username|false] Unexpected error %v", err)
+		}
+		if len(r1) != 0 {
+			t.Fatalf("[username|false] Expected empty part, got %v", r1)
+		}
+
+		// username:|true
+		r2, err := auth.Next([]byte("username:"), true)
+		if err != nil {
+			t.Fatalf("[username|true] Unexpected error %v", err)
+		}
+		if str := string(r2); str != auth.username {
+			t.Fatalf("[username|true] Expected %s, got %s", auth.username, str)
+		}
+
+		// uSeRnAmE:|true
+		r3, err := auth.Next([]byte("uSeRnAmE:"), true)
+		if err != nil {
+			t.Fatalf("[uSeRnAmE|true] Unexpected error %v", err)
+		}
+		if str := string(r3); str != auth.username {
+			t.Fatalf("[uSeRnAmE|true] Expected %s, got %s", auth.username, str)
+		}
+	}
+
+	// ---------------------------------------------------------------
+
+	{
+		// password:|false
+		r1, err := auth.Next([]byte("password:"), false)
+		if err != nil {
+			t.Fatalf("[password|false] Unexpected error %v", err)
+		}
+		if len(r1) != 0 {
+			t.Fatalf("[password|false] Expected empty part, got %v", r1)
+		}
+
+		// password:|true
+		r2, err := auth.Next([]byte("password:"), true)
+		if err != nil {
+			t.Fatalf("[password|true] Unexpected error %v", err)
+		}
+		if str := string(r2); str != auth.password {
+			t.Fatalf("[password|true] Expected %s, got %s", auth.password, str)
+		}
+
+		// pAsSwOrD:|true
+		r3, err := auth.Next([]byte("pAsSwOrD:"), true)
+		if err != nil {
+			t.Fatalf("[pAsSwOrD|true] Unexpected error %v", err)
+		}
+		if str := string(r3); str != auth.password {
+			t.Fatalf("[pAsSwOrD|true] Expected %s, got %s", auth.password, str)
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/osutils/cmd.go b/server/core_backend-server/tools/osutils/cmd.go
new file mode 100644
index 0000000..d21f886
--- /dev/null
+++ b/server/core_backend-server/tools/osutils/cmd.go
@@ -0,0 +1,65 @@
+package osutils
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+)
+
+// LaunchURL attempts to open the provided url in the user's default browser.
+//
+// It is platform dependent and it uses:
+//   - "open" on macOS
+//   - "rundll32" on Windows
+//   - "xdg-open" on everything else (Linux, FreeBSD, etc.)
+func LaunchURL(url string) error {
+	if err := is.URL.Validate(url); err != nil {
+		return err
+	}
+
+	switch runtime.GOOS {
+	case "darwin":
+		return exec.Command("open", url).Start()
+	case "windows":
+		// not sure if this is the best command but seems to be the most reliable based on the comments in
+		// https://stackoverflow.com/questions/3739327/launching-a-website-via-the-windows-commandline#answer-49115945
+		return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
+	default:
+		return exec.Command("xdg-open", url).Start()
+	}
+}
+
+// YesNoPrompt performs a console prompt that asks the user for Yes/No answer.
+//
+// If the user just press Enter (aka. doesn't type anything) it returns the fallback value.
+func YesNoPrompt(message string, fallback bool) bool {
+	options := "Y/n"
+	if !fallback {
+		options = "y/N"
+	}
+
+	r := bufio.NewReader(os.Stdin)
+
+	var s string
+	for {
+		fmt.Fprintf(os.Stderr, "%s (%s) ", message, options)
+
+		s, _ = r.ReadString('\n')
+
+		s = strings.ToLower(strings.TrimSpace(s))
+
+		switch s {
+		case "":
+			return fallback
+		case "y", "yes":
+			return true
+		case "n", "no":
+			return false
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/osutils/cmd_test.go b/server/core_backend-server/tools/osutils/cmd_test.go
new file mode 100644
index 0000000..38beeab
--- /dev/null
+++ b/server/core_backend-server/tools/osutils/cmd_test.go
@@ -0,0 +1,66 @@
+package osutils_test
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/osutils"
+)
+
+func TestYesNoPrompt(t *testing.T) {
+	scenarios := []struct {
+		stdin    string
+		fallback bool
+		expected bool
+	}{
+		{"", false, false},
+		{"", true, true},
+
+		// yes
+		{"y", false, true},
+		{"Y", false, true},
+		{"Yes", false, true},
+		{"yes", false, true},
+
+		// no
+		{"n", true, false},
+		{"N", true, false},
+		{"No", true, false},
+		{"no", true, false},
+
+		// invalid -> no/yes
+		{"invalid|no", true, false},
+		{"invalid|yes", false, true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("%s_%v", s.stdin, s.fallback), func(t *testing.T) {
+			stdinread, stdinwrite, err := os.Pipe()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			parts := strings.Split(s.stdin, "|")
+			for _, p := range parts {
+				if _, err := stdinwrite.WriteString(p + "\n"); err != nil {
+					t.Fatalf("Failed to write test stdin part %q: %v", p, err)
+				}
+			}
+
+			if err = stdinwrite.Close(); err != nil {
+				t.Fatal(err)
+			}
+
+			defer func(oldStdin *os.File) { os.Stdin = oldStdin }(os.Stdin)
+			os.Stdin = stdinread
+
+			result := osutils.YesNoPrompt("test", s.fallback)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/osutils/dir.go b/server/core_backend-server/tools/osutils/dir.go
new file mode 100644
index 0000000..2d2c819
--- /dev/null
+++ b/server/core_backend-server/tools/osutils/dir.go
@@ -0,0 +1,79 @@
+package osutils
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+// MoveDirContent moves the src dir content, that is not listed in the exclude list,
+// to dest dir (it will be created if missing).
+//
+// The rootExclude argument is used to specify a list of src root entries to exclude.
+//
+// Note that this method doesn't delete the old src dir.
+//
+// It is an alternative to os.Rename() for the cases where we can't
+// rename/delete the src dir (see https://github.com/pocketbase/pocketbase/issues/2519).
+func MoveDirContent(src string, dest string, rootExclude ...string) error {
+	entries, err := os.ReadDir(src)
+	if err != nil {
+		return err
+	}
+
+	// make sure that the dest dir exist
+	manuallyCreatedDestDir := false
+	if _, err := os.Stat(dest); err != nil {
+		if err := os.Mkdir(dest, os.ModePerm); err != nil {
+			return err
+		}
+		manuallyCreatedDestDir = true
+	}
+
+	moved := map[string]string{}
+
+	tryRollback := func() []error {
+		errs := []error{}
+
+		for old, new := range moved {
+			if err := os.Rename(new, old); err != nil {
+				errs = append(errs, err)
+			}
+		}
+
+		// try to delete manually the created dest dir if all moved files were restored
+		if manuallyCreatedDestDir && len(errs) == 0 {
+			if err := os.Remove(dest); err != nil {
+				errs = append(errs, err)
+			}
+		}
+
+		return errs
+	}
+
+	for _, entry := range entries {
+		basename := entry.Name()
+
+		if list.ExistInSlice(basename, rootExclude) {
+			continue
+		}
+
+		old := filepath.Join(src, basename)
+		new := filepath.Join(dest, basename)
+
+		if err := os.Rename(old, new); err != nil {
+			if errs := tryRollback(); len(errs) > 0 {
+				errs = append(errs, err)
+				err = errors.Join(errs...)
+			}
+
+			return err
+		}
+
+		moved[old] = new
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/tools/osutils/dir_test.go b/server/core_backend-server/tools/osutils/dir_test.go
new file mode 100644
index 0000000..f690e99
--- /dev/null
+++ b/server/core_backend-server/tools/osutils/dir_test.go
@@ -0,0 +1,142 @@
+package osutils_test
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestMoveDirContent(t *testing.T) {
+	testDir := createTestDir(t)
+	defer os.RemoveAll(testDir)
+
+	exclude := []string{
+		"missing",
+		"test2",
+		"b",
+	}
+
+	// missing dest path
+	// ---
+	dir1 := filepath.Join(filepath.Dir(testDir), "a", "b", "c", "d", "_pb_move_dir_content_test_"+security.PseudorandomString(4))
+	defer os.RemoveAll(dir1)
+
+	if err := osutils.MoveDirContent(testDir, dir1, exclude...); err == nil {
+		t.Fatal("Expected path error, got nil")
+	}
+
+	// existing parent dir
+	// ---
+	dir2 := filepath.Join(filepath.Dir(testDir), "_pb_move_dir_content_test_"+security.PseudorandomString(4))
+	defer os.RemoveAll(dir2)
+
+	if err := osutils.MoveDirContent(testDir, dir2, exclude...); err != nil {
+		t.Fatalf("Expected dir2 to be created, got error: %v", err)
+	}
+
+	// find all files
+	files := []string{}
+	filepath.WalkDir(dir2, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if d.IsDir() {
+			return nil
+		}
+
+		files = append(files, path)
+
+		return nil
+	})
+
+	expectedFiles := []string{
+		filepath.Join(dir2, "test1"),
+		filepath.Join(dir2, "a", "a1"),
+		filepath.Join(dir2, "a", "a2"),
+	}
+
+	if len(files) != len(expectedFiles) {
+		t.Fatalf("Expected %d files, got %d: \n%v", len(expectedFiles), len(files), files)
+	}
+
+	for _, expected := range expectedFiles {
+		if !list.ExistInSlice(expected, files) {
+			t.Fatalf("Missing expected file %q in \n%v", expected, files)
+		}
+	}
+}
+
+// -------------------------------------------------------------------
+
+// note: make sure to call os.RemoveAll(dir) after you are done
+// working with the created test dir.
+func createTestDir(t *testing.T) string {
+	dir, err := os.MkdirTemp(os.TempDir(), "test_dir")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// create sub directories
+	if err := os.MkdirAll(filepath.Join(dir, "a"), os.ModePerm); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(dir, "b"), os.ModePerm); err != nil {
+		t.Fatal(err)
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "test1"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "test2"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "a/a1"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "a/a2"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "b/b2"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	{
+		f, err := os.OpenFile(filepath.Join(dir, "b/b2"), os.O_WRONLY|os.O_CREATE, 0644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.Close()
+	}
+
+	return dir
+}
diff --git a/server/core_backend-server/tools/osutils/run.go b/server/core_backend-server/tools/osutils/run.go
new file mode 100644
index 0000000..4253cb8
--- /dev/null
+++ b/server/core_backend-server/tools/osutils/run.go
@@ -0,0 +1,32 @@
+package osutils
+
+import (
+	"os"
+	"strings"
+)
+
+var runDirs = []string{os.TempDir(), cacheDir()}
+
+// IsProbablyGoRun loosely checks if the current program was started with "go run".
+func IsProbablyGoRun() bool {
+	for _, dir := range runDirs {
+		if dir != "" && strings.HasPrefix(os.Args[0], dir) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func cacheDir() string {
+	dir := os.Getenv("GOCACHE")
+	if dir == "off" {
+		return ""
+	}
+
+	if dir == "" {
+		dir, _ = os.UserCacheDir()
+	}
+
+	return dir
+}
diff --git a/server/core_backend-server/tools/osutils/run_test.go b/server/core_backend-server/tools/osutils/run_test.go
new file mode 100644
index 0000000..c726556
--- /dev/null
+++ b/server/core_backend-server/tools/osutils/run_test.go
@@ -0,0 +1,45 @@
+package osutils
+
+import (
+	"os"
+	"strconv"
+	"testing"
+)
+
+func TestIsProbablyGoRun(t *testing.T) {
+	scenarios := []struct {
+		arg0     string
+		runDirs  []string
+		expected bool
+	}{
+		{"", nil, false},
+		{"/a/b", nil, false},
+		{"/a/b", []string{""}, false},
+		{"/a/b", []string{"/b/"}, false},
+		{"/a/b", []string{"/a/"}, true},
+		{"/a/b", []string{"", "/b/", "/a/"}, true},
+	}
+
+	originalArgs := os.Args
+	defer func() {
+		os.Args = originalArgs
+	}()
+
+	originalRunDirs := runDirs
+	defer func() {
+		runDirs = originalRunDirs
+	}()
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i)+"_"+s.arg0, func(t *testing.T) {
+			os.Args = []string{s.arg0}
+			runDirs = s.runDirs
+
+			result := IsProbablyGoRun()
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/picker/excerpt_modifier.go b/server/core_backend-server/tools/picker/excerpt_modifier.go
new file mode 100644
index 0000000..a60c842
--- /dev/null
+++ b/server/core_backend-server/tools/picker/excerpt_modifier.go
@@ -0,0 +1,150 @@
+package picker
+
+import (
+	"errors"
+	"regexp"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/spf13/cast"
+	"golang.org/x/net/html"
+)
+
+func init() {
+	Modifiers["excerpt"] = func(args ...string) (Modifier, error) {
+		return newExcerptModifier(args...)
+	}
+}
+
+var whitespaceRegex = regexp.MustCompile(`\s+`)
+
+var excludeTags = []string{
+	"head", "style", "script", "iframe", "embed", "applet", "object",
+	"svg", "img", "picture", "dialog", "template", "button", "form",
+	"textarea", "input", "select", "option",
+}
+
+var inlineTags = []string{
+	"a", "abbr", "acronym", "b", "bdo", "big", "br", "button",
+	"cite", "code", "em", "i", "label", "q", "small", "span",
+	"strong", "strike", "sub", "sup", "time",
+}
+
+var _ Modifier = (*excerptModifier)(nil)
+
+type excerptModifier struct {
+	max          int  // approximate max excerpt length
+	withEllipsis bool // if enabled will add ellipsis when the plain text length > max
+}
+
+// newExcerptModifier validates the specified raw string arguments and
+// initializes a new excerptModifier.
+//
+// This method is usually invoked in initModifer().
+func newExcerptModifier(args ...string) (*excerptModifier, error) {
+	totalArgs := len(args)
+
+	if totalArgs == 0 {
+		return nil, errors.New("max argument is required - expected (max, withEllipsis?)")
+	}
+
+	if totalArgs > 2 {
+		return nil, errors.New("too many arguments - expected (max, withEllipsis?)")
+	}
+
+	max := cast.ToInt(args[0])
+	if max == 0 {
+		return nil, errors.New("max argument must be > 0")
+	}
+
+	var withEllipsis bool
+	if totalArgs > 1 {
+		withEllipsis = cast.ToBool(args[1])
+	}
+
+	return &excerptModifier{max, withEllipsis}, nil
+}
+
+// Modify implements the [Modifier.Modify] interface method.
+//
+// It returns a plain text excerpt/short-description from a formatted
+// html string (non-string values are kept untouched).
+func (m *excerptModifier) Modify(value any) (any, error) {
+	strValue, ok := value.(string)
+	if !ok {
+		// not a string -> return as it is without applying the modifier
+		// (we don't throw an error because the modifier could be applied for a missing expand field)
+		return value, nil
+	}
+
+	var builder strings.Builder
+
+	doc, err := html.Parse(strings.NewReader(strValue))
+	if err != nil {
+		return "", err
+	}
+
+	var hasPrevSpace bool
+
+	// for all node types and more details check
+	// https://pkg.go.dev/golang.org/x/net/html#Parse
+	var stripTags func(*html.Node)
+	stripTags = func(n *html.Node) {
+		switch n.Type {
+		case html.TextNode:
+			// collapse multiple spaces into one
+			txt := whitespaceRegex.ReplaceAllString(n.Data, " ")
+
+			if hasPrevSpace {
+				txt = strings.TrimLeft(txt, " ")
+			}
+
+			if txt != "" {
+				hasPrevSpace = strings.HasSuffix(txt, " ")
+
+				builder.WriteString(txt)
+			}
+		}
+
+		// excerpt max has been reached => no need to further iterate
+		// (+2 for the extra whitespace suffix/prefix that will be trimmed later)
+		if builder.Len() > m.max+2 {
+			return
+		}
+
+		for c := n.FirstChild; c != nil; c = c.NextSibling {
+			if c.Type != html.ElementNode || !list.ExistInSlice(c.Data, excludeTags) {
+				isBlock := c.Type == html.ElementNode && !list.ExistInSlice(c.Data, inlineTags)
+
+				if isBlock && !hasPrevSpace {
+					builder.WriteString(" ")
+					hasPrevSpace = true
+				}
+
+				stripTags(c)
+
+				if isBlock && !hasPrevSpace {
+					builder.WriteString(" ")
+					hasPrevSpace = true
+				}
+			}
+		}
+	}
+	stripTags(doc)
+
+	result := strings.TrimSpace(builder.String())
+
+	if len(result) > m.max {
+		// note: casted to []rune to properly account for multi-byte chars
+		runes := []rune(result)
+		if len(runes) > m.max {
+			result = string(runes[:m.max])
+			result = strings.TrimSpace(result)
+			if m.withEllipsis {
+				result += "..."
+			}
+		}
+	}
+
+	return result, nil
+}
diff --git a/server/core_backend-server/tools/picker/excerpt_modifier_test.go b/server/core_backend-server/tools/picker/excerpt_modifier_test.go
new file mode 100644
index 0000000..7e5fe70
--- /dev/null
+++ b/server/core_backend-server/tools/picker/excerpt_modifier_test.go
@@ -0,0 +1,170 @@
+package picker
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/spf13/cast"
+)
+
+func TestNewExcerptModifier(t *testing.T) {
+	scenarios := []struct {
+		name        string
+		args        []string
+		expectError bool
+	}{
+		{
+			"no arguments",
+			nil,
+			true,
+		},
+		{
+			"too many arguments",
+			[]string{"12", "false", "something"},
+			true,
+		},
+		{
+			"non-numeric max argument",
+			[]string{"something"}, // should fallback to 0 which is not allowed
+			true,
+		},
+		{
+			"numeric max argument",
+			[]string{"12"},
+			false,
+		},
+		{
+			"non-bool withEllipsis argument",
+			[]string{"12", "something"}, // should fallback to false which is allowed
+			false,
+		},
+		{
+			"truthy withEllipsis argument",
+			[]string{"12", "t"},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			m, err := newExcerptModifier(s.args...)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				if m != nil {
+					t.Fatalf("Expected nil modifier, got %v", m)
+				}
+
+				return
+			}
+
+			var argMax int
+			if len(s.args) > 0 {
+				argMax = cast.ToInt(s.args[0])
+			}
+
+			var argWithEllipsis bool
+			if len(s.args) > 1 {
+				argWithEllipsis = cast.ToBool(s.args[1])
+			}
+
+			if m.max != argMax {
+				t.Fatalf("Expected max %d, got %d", argMax, m.max)
+			}
+
+			if m.withEllipsis != argWithEllipsis {
+				t.Fatalf("Expected withEllipsis %v, got %v", argWithEllipsis, m.withEllipsis)
+			}
+		})
+	}
+}
+
+func TestExcerptModifierModify(t *testing.T) {
+	html := ` <script>var a = 123;</script>   <p>Hello</p><div id="test_id">t   est<b>12
+	3</b><span>456</span></div><span>word <b>7</b> 89<span>!<b>?</b><b> a </b><b>b </b>c</span>#<h1>title</h1>`
+
+	plainText := "Hello t est12 3456 word 7 89!? a b c# title"
+
+	scenarios := []struct {
+		name     string
+		args     []string
+		value    string
+		expected string
+	}{
+		// without ellipsis
+		{
+			"only max < len(plainText)",
+			[]string{"2"},
+			html,
+			plainText[:2],
+		},
+		{
+			"only max = len(plainText)",
+			[]string{fmt.Sprint(len(plainText))},
+			html,
+			plainText,
+		},
+		{
+			"only max > len(plainText)",
+			[]string{fmt.Sprint(len(plainText) + 5)},
+			html,
+			plainText,
+		},
+
+		// with ellipsis
+		{
+			"with ellipsis and max < len(plainText)",
+			[]string{"2", "t"},
+			html,
+			plainText[:2] + "...",
+		},
+		{
+			"with ellipsis and max = len(plainText)",
+			[]string{fmt.Sprint(len(plainText)), "t"},
+			html,
+			plainText,
+		},
+		{
+			"with ellipsis and max > len(plainText)",
+			[]string{fmt.Sprint(len(plainText) + 5), "t"},
+			html,
+			plainText,
+		},
+
+		// multibyte chars
+		{
+			"mutibyte chars <= max",
+			[]string{"4", "t"},
+			"аб\nв ",
+			"аб в",
+		},
+		{
+			"mutibyte chars > max",
+			[]string{"3", "t"},
+			"аб\nв ",
+			"аб...",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			m, err := newExcerptModifier(s.args...)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			raw, err := m.Modify(s.value)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if v := cast.ToString(raw); v != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, v)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/picker/modifiers.go b/server/core_backend-server/tools/picker/modifiers.go
new file mode 100644
index 0000000..6572e0c
--- /dev/null
+++ b/server/core_backend-server/tools/picker/modifiers.go
@@ -0,0 +1,41 @@
+package picker
+
+import (
+	"fmt"
+
+	"github.com/pocketbase/pocketbase/tools/tokenizer"
+)
+
+var Modifiers = map[string]ModifierFactoryFunc{}
+
+type ModifierFactoryFunc func(args ...string) (Modifier, error)
+
+type Modifier interface {
+	// Modify executes the modifier and returns a new modified value.
+	Modify(value any) (any, error)
+}
+
+func initModifer(rawModifier string) (Modifier, error) {
+	t := tokenizer.NewFromString(rawModifier)
+	t.Separators('(', ')', ',', ' ')
+	t.IgnoreParenthesis(true)
+
+	parts, err := t.ScanAll()
+	if err != nil {
+		return nil, err
+	}
+
+	if len(parts) == 0 {
+		return nil, fmt.Errorf("invalid or empty modifier expression %q", rawModifier)
+	}
+
+	name := parts[0]
+	args := parts[1:]
+
+	factory, ok := Modifiers[name]
+	if !ok {
+		return nil, fmt.Errorf("missing or invalid modifier %q", name)
+	}
+
+	return factory(args...)
+}
diff --git a/server/core_backend-server/tools/picker/pick.go b/server/core_backend-server/tools/picker/pick.go
new file mode 100644
index 0000000..2cd23aa
--- /dev/null
+++ b/server/core_backend-server/tools/picker/pick.go
@@ -0,0 +1,184 @@
+package picker
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/search"
+	"github.com/pocketbase/pocketbase/tools/tokenizer"
+)
+
+// Pick converts data into a []any, map[string]any, etc. (using json marshal->unmarshal)
+// containing only the fields from the parsed rawFields expression.
+//
+// rawFields is a comma separated string of the fields to include.
+// Nested fields should be listed with dot-notation.
+// Fields value modifiers are also supported using the `:modifier(args)` format (see Modifiers).
+//
+// Example:
+//
+//	data := map[string]any{"a": 1, "b": 2, "c": map[string]any{"c1": 11, "c2": 22}}
+//	Pick(data, "a,c.c1") // map[string]any{"a": 1, "c": map[string]any{"c1": 11}}
+func Pick(data any, rawFields string) (any, error) {
+	parsedFields, err := parseFields(rawFields)
+	if err != nil {
+		return nil, err
+	}
+
+	// marshalize the provided data to ensure that the related json.Marshaler
+	// implementations are invoked, and then convert it back to a plain
+	// json value that we can further operate on.
+	//
+	// @todo research other approaches to avoid the double serialization
+	// ---
+	encoded, err := json.Marshal(data)
+	if err != nil {
+		return nil, err
+	}
+
+	var decoded any
+	if err := json.Unmarshal(encoded, &decoded); err != nil {
+		return nil, err
+	}
+	// ---
+
+	// special cases to preserve the same fields format when used with single item or search results data.
+	var isSearchResult bool
+	switch data.(type) {
+	case search.Result, *search.Result:
+		isSearchResult = true
+	}
+
+	if isSearchResult {
+		if decodedMap, ok := decoded.(map[string]any); ok {
+			pickParsedFields(decodedMap["items"], parsedFields)
+		}
+	} else {
+		pickParsedFields(decoded, parsedFields)
+	}
+
+	return decoded, nil
+}
+
+func parseFields(rawFields string) (map[string]Modifier, error) {
+	t := tokenizer.NewFromString(rawFields)
+
+	fields, err := t.ScanAll()
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[string]Modifier, len(fields))
+
+	for _, f := range fields {
+		parts := strings.SplitN(strings.TrimSpace(f), ":", 2)
+
+		if len(parts) > 1 {
+			m, err := initModifer(parts[1])
+			if err != nil {
+				return nil, err
+			}
+			result[parts[0]] = m
+		} else {
+			result[parts[0]] = nil
+		}
+	}
+
+	return result, nil
+}
+
+func pickParsedFields(data any, fields map[string]Modifier) error {
+	switch v := data.(type) {
+	case map[string]any:
+		pickMapFields(v, fields)
+	case []map[string]any:
+		for _, item := range v {
+			if err := pickMapFields(item, fields); err != nil {
+				return err
+			}
+		}
+	case []any:
+		if len(v) == 0 {
+			return nil // nothing to pick
+		}
+
+		if _, ok := v[0].(map[string]any); !ok {
+			return nil // for now ignore non-map values
+		}
+
+		for _, item := range v {
+			if err := pickMapFields(item.(map[string]any), fields); err != nil {
+				return nil
+			}
+		}
+	}
+
+	return nil
+}
+
+func pickMapFields(data map[string]any, fields map[string]Modifier) error {
+	if len(fields) == 0 {
+		return nil // nothing to pick
+	}
+
+	if m, ok := fields["*"]; ok {
+		// append all missing root level data keys
+		for k := range data {
+			var exists bool
+
+			for f := range fields {
+				if strings.HasPrefix(f+".", k+".") {
+					exists = true
+					break
+				}
+			}
+
+			if !exists {
+				fields[k] = m
+			}
+		}
+	}
+
+DataLoop:
+	for k := range data {
+		matchingFields := make(map[string]Modifier, len(fields))
+		for f, m := range fields {
+			if strings.HasPrefix(f+".", k+".") {
+				matchingFields[f] = m
+				continue
+			}
+		}
+
+		if len(matchingFields) == 0 {
+			delete(data, k)
+			continue DataLoop
+		}
+
+		// remove the current key from the matching fields path
+		for f, m := range matchingFields {
+			remains := strings.TrimSuffix(strings.TrimPrefix(f+".", k+"."), ".")
+
+			// final key
+			if remains == "" {
+				if m != nil {
+					var err error
+					data[k], err = m.Modify(data[k])
+					if err != nil {
+						return err
+					}
+				}
+				continue DataLoop
+			}
+
+			// cleanup the old field key and continue with the rest of the field path
+			delete(matchingFields, f)
+			matchingFields[remains] = m
+		}
+
+		if err := pickParsedFields(data[k], matchingFields); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/tools/picker/pick_test.go b/server/core_backend-server/tools/picker/pick_test.go
new file mode 100644
index 0000000..95add58
--- /dev/null
+++ b/server/core_backend-server/tools/picker/pick_test.go
@@ -0,0 +1,276 @@
+package picker_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/picker"
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+func TestPickFields(t *testing.T) {
+	scenarios := []struct {
+		name        string
+		data        any
+		fields      string
+		expectError bool
+		result      string
+	}{
+		{
+			"empty fields",
+			map[string]any{"a": 1, "b": 2, "c": "test"},
+			"",
+			false,
+			`{"a":1,"b":2,"c":"test"}`,
+		},
+		{
+			"missing fields",
+			map[string]any{"a": 1, "b": 2, "c": "test"},
+			"missing",
+			false,
+			`{}`,
+		},
+		{
+			"non map data",
+			"test",
+			"a,b,test",
+			false,
+			`"test"`,
+		},
+		{
+			"non slice of map data",
+			[]any{"a", "b", "test"},
+			"a,test",
+			false,
+			`["a","b","test"]`,
+		},
+		{
+			"map with no matching field",
+			map[string]any{"a": 1, "b": 2, "c": "test"},
+			"missing", // test individual fields trim
+			false,
+			`{}`,
+		},
+		{
+			"map with existing and missing fields",
+			map[string]any{"a": 1, "b": 2, "c": "test"},
+			"a,  c  ,missing", // test individual fields trim
+			false,
+			`{"a":1,"c":"test"}`,
+		},
+		{
+			"slice of maps with existing and missing fields",
+			[]any{
+				map[string]any{"a": 11, "b": 11, "c": "test1"},
+				map[string]any{"a": 22, "b": 22, "c": "test2"},
+			},
+			"a,  c  ,missing", // test individual fields trim
+			false,
+			`[{"a":11,"c":"test1"},{"a":22,"c":"test2"}]`,
+		},
+		{
+			"nested fields with mixed map and any slices",
+			map[string]any{
+				"a": 1,
+				"b": 2,
+				"c": "test",
+				"anySlice": []any{
+					map[string]any{
+						"A": []int{1, 2, 3},
+						"B": []any{"1", "2", 3},
+						"C": "test",
+						"D": map[string]any{
+							"DA": 1,
+							"DB": 2,
+						},
+					},
+					map[string]any{
+						"A": "test",
+					},
+				},
+				"mapSlice": []map[string]any{
+					{
+						"A": []int{1, 2, 3},
+						"B": []any{"1", "2", 3},
+						"C": "test",
+						"D": []any{
+							map[string]any{"DA": 1},
+						},
+					},
+					{
+						"B": []any{"1", "2", 3},
+						"D": []any{
+							map[string]any{"DA": 2},
+							map[string]any{"DA": 3},
+							map[string]any{"DB": 4}, // will result to empty since there is no DA
+						},
+					},
+				},
+				"fullMap": []map[string]any{
+					{
+						"A": []int{1, 2, 3},
+						"B": []any{"1", "2", 3},
+						"C": "test",
+					},
+					{
+						"B": []any{"1", "2", 3},
+						"D": []any{
+							map[string]any{"DA": 2},
+							map[string]any{"DA": 3}, // will result to empty since there is no DA
+						},
+					},
+				},
+			},
+			"a, c, anySlice.A, mapSlice.C, mapSlice.D.DA, anySlice.D,fullMap",
+			false,
+			`{"a":1,"anySlice":[{"A":[1,2,3],"D":{"DA":1,"DB":2}},{"A":"test"}],"c":"test","fullMap":[{"A":[1,2,3],"B":["1","2",3],"C":"test"},{"B":["1","2",3],"D":[{"DA":2},{"DA":3}]}],"mapSlice":[{"C":"test","D":[{"DA":1}]},{"D":[{"DA":2},{"DA":3},{}]}]}`,
+		},
+		{
+			"SearchResult",
+			search.Result{
+				Page:       1,
+				PerPage:    10,
+				TotalItems: 20,
+				TotalPages: 30,
+				Items: []any{
+					map[string]any{"a": 11, "b": 11, "c": "test1"},
+					map[string]any{"a": 22, "b": 22, "c": "test2"},
+				},
+			},
+			"a,c,missing",
+			false,
+			`{"items":[{"a":11,"c":"test1"},{"a":22,"c":"test2"}],"page":1,"perPage":10,"totalItems":20,"totalPages":30}`,
+		},
+		{
+			"*SearchResult",
+			&search.Result{
+				Page:       1,
+				PerPage:    10,
+				TotalItems: 20,
+				TotalPages: 30,
+				Items: []any{
+					map[string]any{"a": 11, "b": 11, "c": "test1"},
+					map[string]any{"a": 22, "b": 22, "c": "test2"},
+				},
+			},
+			"a,c",
+			false,
+			`{"items":[{"a":11,"c":"test1"},{"a":22,"c":"test2"}],"page":1,"perPage":10,"totalItems":20,"totalPages":30}`,
+		},
+		{
+			"root wildcard",
+			&search.Result{
+				Page:       1,
+				PerPage:    10,
+				TotalItems: 20,
+				TotalPages: 30,
+				Items: []any{
+					map[string]any{"a": 11, "b": 11, "c": "test1"},
+					map[string]any{"a": 22, "b": 22, "c": "test2"},
+				},
+			},
+			"*",
+			false,
+			`{"items":[{"a":11,"b":11,"c":"test1"},{"a":22,"b":22,"c":"test2"}],"page":1,"perPage":10,"totalItems":20,"totalPages":30}`,
+		},
+		{
+			"root wildcard with nested exception",
+			map[string]any{
+				"id":    "123",
+				"title": "lorem",
+				"rel": map[string]any{
+					"id":    "456",
+					"title": "rel_title",
+				},
+			},
+			"*,rel.id",
+			false,
+			`{"id":"123","rel":{"id":"456"},"title":"lorem"}`,
+		},
+		{
+			"sub wildcard",
+			map[string]any{
+				"id":    "123",
+				"title": "lorem",
+				"rel": map[string]any{
+					"id":    "456",
+					"title": "rel_title",
+					"sub": map[string]any{
+						"id":    "789",
+						"title": "sub_title",
+					},
+				},
+			},
+			"id,rel.*",
+			false,
+			`{"id":"123","rel":{"id":"456","sub":{"id":"789","title":"sub_title"},"title":"rel_title"}}`,
+		},
+		{
+			"sub wildcard with nested exception",
+			map[string]any{
+				"id":    "123",
+				"title": "lorem",
+				"rel": map[string]any{
+					"id":    "456",
+					"title": "rel_title",
+					"sub": map[string]any{
+						"id":    "789",
+						"title": "sub_title",
+					},
+				},
+			},
+			"id,rel.*,rel.sub.id",
+			false,
+			`{"id":"123","rel":{"id":"456","sub":{"id":"789"},"title":"rel_title"}}`,
+		},
+		{
+			"invalid excerpt modifier",
+			map[string]any{"a": 1, "b": 2, "c": "test"},
+			"*:excerpt",
+			true,
+			`{"a":1,"b":2,"c":"test"}`,
+		},
+		{
+			"valid excerpt modifier",
+			map[string]any{
+				"id":    "123",
+				"title": "lorem",
+				"rel": map[string]any{
+					"id":    "456",
+					"title": "<p>rel_title</p>",
+					"sub": map[string]any{
+						"id":    "789",
+						"title": "sub_title",
+					},
+				},
+			},
+			"*:excerpt(2),rel.title:excerpt(3, true)",
+			false,
+			`{"id":"12","rel":{"title":"rel..."},"title":"lo"}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result, err := picker.Pick(s.data, s.fields)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			serialized, err := json.Marshal(result)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if v := string(serialized); v != s.result {
+				t.Fatalf("Expected body\n%s \ngot \n%s", s.result, v)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/router/error.go b/server/core_backend-server/tools/router/error.go
new file mode 100644
index 0000000..2c437cd
--- /dev/null
+++ b/server/core_backend-server/tools/router/error.go
@@ -0,0 +1,231 @@
+package router
+
+import (
+	"database/sql"
+	"errors"
+	"io/fs"
+	"net/http"
+	"strings"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+)
+
+// SafeErrorItem defines a common error interface for a printable public safe error.
+type SafeErrorItem interface {
+	// Code represents a fixed unique identifier of the error (usually used as translation key).
+	Code() string
+
+	// Error is the default English human readable error message that will be returned.
+	Error() string
+}
+
+// SafeErrorParamsResolver defines an optional interface for specifying dynamic error parameters.
+type SafeErrorParamsResolver interface {
+	// Params defines a map with dynamic parameters to return as part of the public safe error view.
+	Params() map[string]any
+}
+
+// SafeErrorResolver defines an error interface for resolving the public safe error fields.
+type SafeErrorResolver interface {
+	// Resolve allows modifying and returning a new public safe error data map.
+	Resolve(errData map[string]any) any
+}
+
+// ApiError defines the struct for a basic api error response.
+type ApiError struct {
+	rawData any
+
+	Data    map[string]any `json:"data"`
+	Message string         `json:"message"`
+	Status  int            `json:"status"`
+}
+
+// Error makes it compatible with the `error` interface.
+func (e *ApiError) Error() string {
+	return e.Message
+}
+
+// RawData returns the unformatted error data (could be an internal error, text, etc.)
+func (e *ApiError) RawData() any {
+	return e.rawData
+}
+
+// Is reports whether the current ApiError wraps the target.
+func (e *ApiError) Is(target error) bool {
+	err, ok := e.rawData.(error)
+	if ok {
+		return errors.Is(err, target)
+	}
+
+	apiErr, ok := target.(*ApiError)
+
+	return ok && e == apiErr
+}
+
+// NewNotFoundError creates and returns 404 ApiError.
+func NewNotFoundError(message string, rawErrData any) *ApiError {
+	if message == "" {
+		message = "The requested resource wasn't found."
+	}
+
+	return NewApiError(http.StatusNotFound, message, rawErrData)
+}
+
+// NewBadRequestError creates and returns 400 ApiError.
+func NewBadRequestError(message string, rawErrData any) *ApiError {
+	if message == "" {
+		message = "Something went wrong while processing your request."
+	}
+
+	return NewApiError(http.StatusBadRequest, message, rawErrData)
+}
+
+// NewForbiddenError creates and returns 403 ApiError.
+func NewForbiddenError(message string, rawErrData any) *ApiError {
+	if message == "" {
+		message = "You are not allowed to perform this request."
+	}
+
+	return NewApiError(http.StatusForbidden, message, rawErrData)
+}
+
+// NewUnauthorizedError creates and returns 401 ApiError.
+func NewUnauthorizedError(message string, rawErrData any) *ApiError {
+	if message == "" {
+		message = "Missing or invalid authentication."
+	}
+
+	return NewApiError(http.StatusUnauthorized, message, rawErrData)
+}
+
+// NewInternalServerError creates and returns 500 ApiError.
+func NewInternalServerError(message string, rawErrData any) *ApiError {
+	if message == "" {
+		message = "Something went wrong while processing your request."
+	}
+
+	return NewApiError(http.StatusInternalServerError, message, rawErrData)
+}
+
+func NewTooManyRequestsError(message string, rawErrData any) *ApiError {
+	if message == "" {
+		message = "Too Many Requests."
+	}
+
+	return NewApiError(http.StatusTooManyRequests, message, rawErrData)
+}
+
+// NewApiError creates and returns new normalized ApiError instance.
+func NewApiError(status int, message string, rawErrData any) *ApiError {
+	if message == "" {
+		message = http.StatusText(status)
+	}
+
+	return &ApiError{
+		rawData: rawErrData,
+		Data:    safeErrorsData(rawErrData),
+		Status:  status,
+		Message: strings.TrimSpace(inflector.Sentenize(message)),
+	}
+}
+
+// ToApiError wraps err into ApiError instance (if not already).
+func ToApiError(err error) *ApiError {
+	var apiErr *ApiError
+
+	if !errors.As(err, &apiErr) {
+		// no ApiError found -> assign a generic one
+		if errors.Is(err, sql.ErrNoRows) || errors.Is(err, fs.ErrNotExist) {
+			apiErr = NewNotFoundError("", err)
+		} else {
+			apiErr = NewBadRequestError("", err)
+		}
+	}
+
+	return apiErr
+}
+
+// -------------------------------------------------------------------
+
+func safeErrorsData(data any) map[string]any {
+	switch v := data.(type) {
+	case validation.Errors:
+		return resolveSafeErrorsData(v)
+	case error:
+		validationErrors := validation.Errors{}
+		if errors.As(v, &validationErrors) {
+			return resolveSafeErrorsData(validationErrors)
+		}
+		return map[string]any{} // not nil to ensure that is json serialized as object
+	case map[string]validation.Error:
+		return resolveSafeErrorsData(v)
+	case map[string]SafeErrorItem:
+		return resolveSafeErrorsData(v)
+	case map[string]error:
+		return resolveSafeErrorsData(v)
+	case map[string]string:
+		return resolveSafeErrorsData(v)
+	case map[string]any:
+		return resolveSafeErrorsData(v)
+	default:
+		return map[string]any{} // not nil to ensure that is json serialized as object
+	}
+}
+
+func resolveSafeErrorsData[T any](data map[string]T) map[string]any {
+	result := map[string]any{}
+
+	for name, err := range data {
+		if isNestedError(err) {
+			result[name] = safeErrorsData(err)
+		} else {
+			result[name] = resolveSafeErrorItem(err)
+		}
+	}
+
+	return result
+}
+
+func isNestedError(err any) bool {
+	switch err.(type) {
+	case validation.Errors,
+		map[string]validation.Error,
+		map[string]SafeErrorItem,
+		map[string]error,
+		map[string]string,
+		map[string]any:
+		return true
+	}
+
+	return false
+}
+
+// resolveSafeErrorItem extracts from each validation error its
+// public safe error code and message.
+func resolveSafeErrorItem(err any) any {
+	data := map[string]any{}
+
+	if obj, ok := err.(SafeErrorItem); ok {
+		// extract the specific error code and message
+		data["code"] = obj.Code()
+		data["message"] = inflector.Sentenize(obj.Error())
+	} else {
+		// fallback to the default public safe values
+		data["code"] = "validation_invalid_value"
+		data["message"] = "Invalid value."
+	}
+
+	if s, ok := err.(SafeErrorParamsResolver); ok {
+		params := s.Params()
+		if len(params) > 0 {
+			data["params"] = params
+		}
+	}
+
+	if s, ok := err.(SafeErrorResolver); ok {
+		return s.Resolve(data)
+	}
+
+	return data
+}
diff --git a/server/core_backend-server/tools/router/error_test.go b/server/core_backend-server/tools/router/error_test.go
new file mode 100644
index 0000000..8ced893
--- /dev/null
+++ b/server/core_backend-server/tools/router/error_test.go
@@ -0,0 +1,358 @@
+package router_test
+
+import (
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"strconv"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+func TestNewApiErrorWithRawData(t *testing.T) {
+	t.Parallel()
+
+	e := router.NewApiError(
+		300,
+		"message_test",
+		"rawData_test",
+	)
+
+	result, _ := json.Marshal(e)
+	expected := `{"data":{},"message":"Message_test.","status":300}`
+
+	if string(result) != expected {
+		t.Errorf("Expected\n%v\ngot\n%v", expected, string(result))
+	}
+
+	if e.Error() != "Message_test." {
+		t.Errorf("Expected %q, got %q", "Message_test.", e.Error())
+	}
+
+	if e.RawData() != "rawData_test" {
+		t.Errorf("Expected rawData\n%v\ngot\n%v", "rawData_test", e.RawData())
+	}
+}
+
+func TestNewApiErrorWithValidationData(t *testing.T) {
+	t.Parallel()
+
+	e := router.NewApiError(
+		300,
+		"message_test",
+		map[string]any{
+			"err1": errors.New("test error"), // should be normalized
+			"err2": validation.ErrRequired,
+			"err3": validation.Errors{
+				"err3.1": errors.New("test error"), // should be normalized
+				"err3.2": validation.ErrRequired,
+				"err3.3": validation.Errors{
+					"err3.3.1": validation.ErrRequired,
+				},
+			},
+			"err4": &mockSafeErrorItem{},
+			"err5": map[string]error{
+				"err5.1": validation.ErrRequired,
+			},
+		},
+	)
+
+	result, _ := json.Marshal(e)
+	expected := `{"data":{"err1":{"code":"validation_invalid_value","message":"Invalid value."},"err2":{"code":"validation_required","message":"Cannot be blank."},"err3":{"err3.1":{"code":"validation_invalid_value","message":"Invalid value."},"err3.2":{"code":"validation_required","message":"Cannot be blank."},"err3.3":{"err3.3.1":{"code":"validation_required","message":"Cannot be blank."}}},"err4":{"code":"mock_code","message":"Mock_error.","mock_resolve":123},"err5":{"err5.1":{"code":"validation_required","message":"Cannot be blank."}}},"message":"Message_test.","status":300}`
+
+	if string(result) != expected {
+		t.Errorf("Expected \n%v, \ngot \n%v", expected, string(result))
+	}
+
+	if e.Error() != "Message_test." {
+		t.Errorf("Expected %q, got %q", "Message_test.", e.Error())
+	}
+
+	if e.RawData() == nil {
+		t.Error("Expected non-nil rawData")
+	}
+}
+
+func TestNewNotFoundError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"data":{},"message":"The requested resource wasn't found.","status":404}`},
+		{"demo", "rawData_test", `{"data":{},"message":"Demo.","status":404}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"data":{"err1":{"code":"test_code","message":"Test_message."}},"message":"Demo.","status":404}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			e := router.NewNotFoundError(s.message, s.data)
+			result, _ := json.Marshal(e)
+
+			if str := string(result); str != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestNewBadRequestError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"data":{},"message":"Something went wrong while processing your request.","status":400}`},
+		{"demo", "rawData_test", `{"data":{},"message":"Demo.","status":400}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"data":{"err1":{"code":"test_code","message":"Test_message."}},"message":"Demo.","status":400}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			e := router.NewBadRequestError(s.message, s.data)
+			result, _ := json.Marshal(e)
+
+			if str := string(result); str != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestNewForbiddenError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"data":{},"message":"You are not allowed to perform this request.","status":403}`},
+		{"demo", "rawData_test", `{"data":{},"message":"Demo.","status":403}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"data":{"err1":{"code":"test_code","message":"Test_message."}},"message":"Demo.","status":403}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			e := router.NewForbiddenError(s.message, s.data)
+			result, _ := json.Marshal(e)
+
+			if str := string(result); str != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestNewUnauthorizedError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"data":{},"message":"Missing or invalid authentication.","status":401}`},
+		{"demo", "rawData_test", `{"data":{},"message":"Demo.","status":401}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"data":{"err1":{"code":"test_code","message":"Test_message."}},"message":"Demo.","status":401}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			e := router.NewUnauthorizedError(s.message, s.data)
+			result, _ := json.Marshal(e)
+
+			if str := string(result); str != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestNewInternalServerError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"data":{},"message":"Something went wrong while processing your request.","status":500}`},
+		{"demo", "rawData_test", `{"data":{},"message":"Demo.","status":500}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message")}, `{"data":{"err1":{"code":"test_code","message":"Test_message."}},"message":"Demo.","status":500}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			e := router.NewInternalServerError(s.message, s.data)
+			result, _ := json.Marshal(e)
+
+			if str := string(result); str != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestNewTooManyRequestsError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		message  string
+		data     any
+		expected string
+	}{
+		{"", nil, `{"data":{},"message":"Too Many Requests.","status":429}`},
+		{"demo", "rawData_test", `{"data":{},"message":"Demo.","status":429}`},
+		{"demo", validation.Errors{"err1": validation.NewError("test_code", "test_message").SetParams(map[string]any{"test": 123})}, `{"data":{"err1":{"code":"test_code","message":"Test_message.","params":{"test":123}}},"message":"Demo.","status":429}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			e := router.NewTooManyRequestsError(s.message, s.data)
+			result, _ := json.Marshal(e)
+
+			if str := string(result); str != s.expected {
+				t.Fatalf("Expected\n%v\ngot\n%v", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestApiErrorIs(t *testing.T) {
+	t.Parallel()
+
+	err0 := router.NewInternalServerError("", nil)
+	err1 := router.NewInternalServerError("", nil)
+	err2 := errors.New("test")
+	err3 := fmt.Errorf("wrapped: %w", err0)
+
+	scenarios := []struct {
+		name     string
+		err      error
+		target   error
+		expected bool
+	}{
+		{
+			"nil error",
+			err0,
+			nil,
+			false,
+		},
+		{
+			"non ApiError",
+			err0,
+			err1,
+			false,
+		},
+		{
+			"different ApiError",
+			err0,
+			err2,
+			false,
+		},
+		{
+			"same ApiError",
+			err0,
+			err0,
+			true,
+		},
+		{
+			"wrapped ApiError",
+			err3,
+			err0,
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			is := errors.Is(s.err, s.target)
+
+			if is != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, is)
+			}
+		})
+	}
+}
+
+func TestToApiError(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name     string
+		err      error
+		expected string
+	}{
+		{
+			"regular error",
+			errors.New("test"),
+			`{"data":{},"message":"Something went wrong while processing your request.","status":400}`,
+		},
+		{
+			"fs.ErrNotExist",
+			fs.ErrNotExist,
+			`{"data":{},"message":"The requested resource wasn't found.","status":404}`,
+		},
+		{
+			"sql.ErrNoRows",
+			sql.ErrNoRows,
+			`{"data":{},"message":"The requested resource wasn't found.","status":404}`,
+		},
+		{
+			"ApiError",
+			router.NewForbiddenError("test", nil),
+			`{"data":{},"message":"Test.","status":403}`,
+		},
+		{
+			"wrapped ApiError",
+			fmt.Errorf("wrapped: %w", router.NewForbiddenError("test", nil)),
+			`{"data":{},"message":"Test.","status":403}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			raw, err := json.Marshal(router.ToApiError(s.err))
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(raw)
+
+			if rawStr != s.expected {
+				t.Fatalf("Expected error\n%vgot\n%v", s.expected, rawStr)
+			}
+		})
+	}
+}
+
+// -------------------------------------------------------------------
+
+var (
+	_ router.SafeErrorItem     = (*mockSafeErrorItem)(nil)
+	_ router.SafeErrorResolver = (*mockSafeErrorItem)(nil)
+)
+
+type mockSafeErrorItem struct {
+}
+
+func (m *mockSafeErrorItem) Code() string {
+	return "mock_code"
+}
+
+func (m *mockSafeErrorItem) Error() string {
+	return "mock_error"
+}
+
+func (m *mockSafeErrorItem) Resolve(errData map[string]any) any {
+	errData["mock_resolve"] = 123
+	return errData
+}
diff --git a/server/core_backend-server/tools/router/event.go b/server/core_backend-server/tools/router/event.go
new file mode 100644
index 0000000..a822c59
--- /dev/null
+++ b/server/core_backend-server/tools/router/event.go
@@ -0,0 +1,398 @@
+package router
+
+import (
+	"encoding/json"
+	"encoding/xml"
+	"errors"
+	"io"
+	"io/fs"
+	"net"
+	"net/http"
+	"net/netip"
+	"path/filepath"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/filesystem"
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/picker"
+	"github.com/pocketbase/pocketbase/tools/store"
+)
+
+var ErrUnsupportedContentType = NewBadRequestError("Unsupported Content-Type", nil)
+var ErrInvalidRedirectStatusCode = NewInternalServerError("Invalid redirect status code", nil)
+var ErrFileNotFound = NewNotFoundError("File not found", nil)
+
+const IndexPage = "index.html"
+
+// Event specifies based Route handler event that is usually intended
+// to be embedded as part of a custom event struct.
+//
+// NB! It is expected that the Response and Request fields are always set.
+type Event struct {
+	Response http.ResponseWriter
+	Request  *http.Request
+
+	hook.Event
+
+	data store.Store[string, any]
+}
+
+// RWUnwrapper specifies that an http.ResponseWriter could be "unwrapped"
+// (usually used with [http.ResponseController]).
+type RWUnwrapper interface {
+	Unwrap() http.ResponseWriter
+}
+
+// Written reports whether the current response has already been written.
+//
+// This method always returns false if e.ResponseWritter doesn't implement the WriteTracker interface
+// (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+func (e *Event) Written() bool {
+	written, _ := getWritten(e.Response)
+	return written
+}
+
+// Status reports the status code of the current response.
+//
+// This method always returns 0 if e.Response doesn't implement the StatusTracker interface
+// (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+func (e *Event) Status() int {
+	status, _ := getStatus(e.Response)
+	return status
+}
+
+// Flush flushes buffered data to the current response.
+//
+// Returns [http.ErrNotSupported] if e.Response doesn't implement the [http.Flusher] interface
+// (all router package handlers receives a ResponseWritter that implements it unless explicitly replaced with a custom one).
+func (e *Event) Flush() error {
+	return http.NewResponseController(e.Response).Flush()
+}
+
+// IsTLS reports whether the connection on which the request was received is TLS.
+func (e *Event) IsTLS() bool {
+	return e.Request.TLS != nil
+}
+
+// SetCookie is an alias for [http.SetCookie].
+//
+// SetCookie adds a Set-Cookie header to the current response's headers.
+// The provided cookie must have a valid Name.
+// Invalid cookies may be silently dropped.
+func (e *Event) SetCookie(cookie *http.Cookie) {
+	http.SetCookie(e.Response, cookie)
+}
+
+// RemoteIP returns the IP address of the client that sent the request.
+//
+// IPv6 addresses are returned expanded.
+// For example, "2001:db8::1" becomes "2001:0db8:0000:0000:0000:0000:0000:0001".
+//
+// Note that if you are behind reverse proxy(ies), this method returns
+// the IP of the last connecting proxy.
+func (e *Event) RemoteIP() string {
+	ip, _, _ := net.SplitHostPort(e.Request.RemoteAddr)
+	parsed, _ := netip.ParseAddr(ip)
+	return parsed.StringExpanded()
+}
+
+// FindUploadedFiles extracts all form files of "key" from a http request
+// and returns a slice with filesystem.File instances (if any).
+func (e *Event) FindUploadedFiles(key string) ([]*filesystem.File, error) {
+	if e.Request.MultipartForm == nil {
+		err := e.Request.ParseMultipartForm(DefaultMaxMemory)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if e.Request.MultipartForm == nil || e.Request.MultipartForm.File == nil || len(e.Request.MultipartForm.File[key]) == 0 {
+		return nil, http.ErrMissingFile
+	}
+
+	result := make([]*filesystem.File, 0, len(e.Request.MultipartForm.File[key]))
+
+	for _, fh := range e.Request.MultipartForm.File[key] {
+		file, err := filesystem.NewFileFromMultipart(fh)
+		if err != nil {
+			return nil, err
+		}
+
+		result = append(result, file)
+	}
+
+	return result, nil
+}
+
+// Store
+// -------------------------------------------------------------------
+
+// Get retrieves single value from the current event data store.
+func (e *Event) Get(key string) any {
+	return e.data.Get(key)
+}
+
+// GetAll returns a copy of the current event data store.
+func (e *Event) GetAll() map[string]any {
+	return e.data.GetAll()
+}
+
+// Set saves single value into the current event data store.
+func (e *Event) Set(key string, value any) {
+	e.data.Set(key, value)
+}
+
+// SetAll saves all items from m into the current event data store.
+func (e *Event) SetAll(m map[string]any) {
+	for k, v := range m {
+		e.Set(k, v)
+	}
+}
+
+// Response writers
+// -------------------------------------------------------------------
+
+const headerContentType = "Content-Type"
+
+func (e *Event) setResponseHeaderIfEmpty(key, value string) {
+	header := e.Response.Header()
+	if header.Get(key) == "" {
+		header.Set(key, value)
+	}
+}
+
+// String writes a plain string response.
+func (e *Event) String(status int, data string) error {
+	e.setResponseHeaderIfEmpty(headerContentType, "text/plain; charset=utf-8")
+	e.Response.WriteHeader(status)
+	_, err := e.Response.Write([]byte(data))
+	return err
+}
+
+// HTML writes an HTML response.
+func (e *Event) HTML(status int, data string) error {
+	e.setResponseHeaderIfEmpty(headerContentType, "text/html; charset=utf-8")
+	e.Response.WriteHeader(status)
+	_, err := e.Response.Write([]byte(data))
+	return err
+}
+
+const jsonFieldsParam = "fields"
+
+// JSON writes a JSON response.
+//
+// It also provides a generic response data fields picker if the "fields" query parameter is set.
+// For example, if you are requesting `?fields=a,b` for `e.JSON(200, map[string]int{ "a":1, "b":2, "c":3 })`,
+// it should result in a JSON response like: `{"a":1, "b": 2}`.
+func (e *Event) JSON(status int, data any) error {
+	e.setResponseHeaderIfEmpty(headerContentType, "application/json")
+	e.Response.WriteHeader(status)
+
+	rawFields := e.Request.URL.Query().Get(jsonFieldsParam)
+
+	// error response or no fields to pick
+	if rawFields == "" || status < 200 || status > 299 {
+		return json.NewEncoder(e.Response).Encode(data)
+	}
+
+	// pick only the requested fields
+	modified, err := picker.Pick(data, rawFields)
+	if err != nil {
+		return err
+	}
+
+	return json.NewEncoder(e.Response).Encode(modified)
+}
+
+// XML writes an XML response.
+// It automatically prepends the generic [xml.Header] string to the response.
+func (e *Event) XML(status int, data any) error {
+	e.setResponseHeaderIfEmpty(headerContentType, "application/xml; charset=utf-8")
+	e.Response.WriteHeader(status)
+	if _, err := e.Response.Write([]byte(xml.Header)); err != nil {
+		return err
+	}
+	return xml.NewEncoder(e.Response).Encode(data)
+}
+
+// Stream streams the specified reader into the response.
+func (e *Event) Stream(status int, contentType string, reader io.Reader) error {
+	e.Response.Header().Set(headerContentType, contentType)
+	e.Response.WriteHeader(status)
+	_, err := io.Copy(e.Response, reader)
+	return err
+}
+
+// Blob writes a blob (bytes slice) response.
+func (e *Event) Blob(status int, contentType string, b []byte) error {
+	e.setResponseHeaderIfEmpty(headerContentType, contentType)
+	e.Response.WriteHeader(status)
+	_, err := e.Response.Write(b)
+	return err
+}
+
+// FileFS serves the specified filename from fsys.
+//
+// It is similar to [echo.FileFS] for consistency with earlier versions.
+func (e *Event) FileFS(fsys fs.FS, filename string) error {
+	f, err := fsys.Open(filename)
+	if err != nil {
+		return ErrFileNotFound
+	}
+	defer f.Close()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return err
+	}
+
+	// if it is a directory try to open its index.html file
+	if fi.IsDir() {
+		filename = filepath.ToSlash(filepath.Join(filename, IndexPage))
+		f, err = fsys.Open(filename)
+		if err != nil {
+			return ErrFileNotFound
+		}
+		defer f.Close()
+
+		fi, err = f.Stat()
+		if err != nil {
+			return err
+		}
+	}
+
+	ff, ok := f.(io.ReadSeeker)
+	if !ok {
+		return errors.New("[FileFS] file does not implement io.ReadSeeker")
+	}
+
+	http.ServeContent(e.Response, e.Request, fi.Name(), fi.ModTime(), ff)
+
+	return nil
+}
+
+// NoContent writes a response with no body (ex. 204).
+func (e *Event) NoContent(status int) error {
+	e.Response.WriteHeader(status)
+	return nil
+}
+
+// Redirect writes a redirect response to the specified url.
+// The status code must be in between 300 – 399 range.
+func (e *Event) Redirect(status int, url string) error {
+	if status < 300 || status > 399 {
+		return ErrInvalidRedirectStatusCode
+	}
+	e.Response.Header().Set("Location", url)
+	e.Response.WriteHeader(status)
+	return nil
+}
+
+// ApiError helpers
+// -------------------------------------------------------------------
+
+func (e *Event) Error(status int, message string, errData any) *ApiError {
+	return NewApiError(status, message, errData)
+}
+
+func (e *Event) BadRequestError(message string, errData any) *ApiError {
+	return NewBadRequestError(message, errData)
+}
+
+func (e *Event) NotFoundError(message string, errData any) *ApiError {
+	return NewNotFoundError(message, errData)
+}
+
+func (e *Event) ForbiddenError(message string, errData any) *ApiError {
+	return NewForbiddenError(message, errData)
+}
+
+func (e *Event) UnauthorizedError(message string, errData any) *ApiError {
+	return NewUnauthorizedError(message, errData)
+}
+
+func (e *Event) TooManyRequestsError(message string, errData any) *ApiError {
+	return NewTooManyRequestsError(message, errData)
+}
+
+func (e *Event) InternalServerError(message string, errData any) *ApiError {
+	return NewInternalServerError(message, errData)
+}
+
+// Binders
+// -------------------------------------------------------------------
+
+const DefaultMaxMemory = 32 << 20 // 32mb
+
+// BindBody unmarshal the request body into the provided dst.
+//
+// dst must be either a struct pointer or map[string]any.
+//
+// The rules how the body will be scanned depends on the request Content-Type.
+//
+// Currently the following Content-Types are supported:
+//   - application/json
+//   - text/xml, application/xml
+//   - multipart/form-data, application/x-www-form-urlencoded
+//
+// Respectively the following struct tags are supported (again, which one will be used depends on the Content-Type):
+//   - "json" (json body)- uses the builtin Go json package for unmarshaling.
+//   - "xml" (xml body) - uses the builtin Go xml package for unmarshaling.
+//   - "form" (form data) - utilizes the custom [router.UnmarshalRequestData] method.
+//
+// NB! When dst is a struct make sure that it doesn't have public fields
+// that shouldn't be bindable and it is advisible such fields to be unexported
+// or have a separate struct just for the binding. For example:
+//
+//	data := struct{
+//	   somethingPrivate string
+//
+//	   Title string `json:"title" form:"title"`
+//	   Total int    `json:"total" form:"total"`
+//	}
+//	err := e.BindBody(&data)
+func (e *Event) BindBody(dst any) error {
+	if e.Request.ContentLength == 0 {
+		return nil
+	}
+
+	contentType := e.Request.Header.Get(headerContentType)
+
+	if strings.HasPrefix(contentType, "application/json") {
+		dec := json.NewDecoder(e.Request.Body)
+		err := dec.Decode(dst)
+		if err == nil {
+			// manually call Reread because single call of json.Decoder.Decode()
+			// doesn't ensure that the entire body is a valid json string
+			// and it is not guaranteed that it will reach EOF to trigger the reread reset
+			// (ex. in case of trailing spaces or invalid trailing parts like: `{"test":1},something`)
+			if body, ok := e.Request.Body.(Rereader); ok {
+				body.Reread()
+			}
+		}
+		return err
+	}
+
+	if strings.HasPrefix(contentType, "multipart/form-data") {
+		if err := e.Request.ParseMultipartForm(DefaultMaxMemory); err != nil {
+			return err
+		}
+
+		return UnmarshalRequestData(e.Request.Form, dst, "", "")
+	}
+
+	if strings.HasPrefix(contentType, "application/x-www-form-urlencoded") {
+		if err := e.Request.ParseForm(); err != nil {
+			return err
+		}
+
+		return UnmarshalRequestData(e.Request.Form, dst, "", "")
+	}
+
+	if strings.HasPrefix(contentType, "text/xml") ||
+		strings.HasPrefix(contentType, "application/xml") {
+		return xml.NewDecoder(e.Request.Body).Decode(dst)
+	}
+
+	return ErrUnsupportedContentType
+}
diff --git a/server/core_backend-server/tools/router/event_test.go b/server/core_backend-server/tools/router/event_test.go
new file mode 100644
index 0000000..9d7dc99
--- /dev/null
+++ b/server/core_backend-server/tools/router/event_test.go
@@ -0,0 +1,959 @@
+package router_test
+
+import (
+	"bytes"
+	"crypto/tls"
+	"encoding/json"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+type unwrapTester struct {
+	http.ResponseWriter
+}
+
+func (ut unwrapTester) Unwrap() http.ResponseWriter {
+	return ut.ResponseWriter
+}
+
+func TestEventWritten(t *testing.T) {
+	t.Parallel()
+
+	res1 := httptest.NewRecorder()
+
+	res2 := httptest.NewRecorder()
+	res2.Write([]byte("test"))
+
+	res3 := &router.ResponseWriter{ResponseWriter: unwrapTester{httptest.NewRecorder()}}
+
+	res4 := &router.ResponseWriter{ResponseWriter: unwrapTester{httptest.NewRecorder()}}
+	res4.Write([]byte("test"))
+
+	scenarios := []struct {
+		name     string
+		response http.ResponseWriter
+		expected bool
+	}{
+		{
+			name:     "non-written non-WriteTracker",
+			response: res1,
+			expected: false,
+		},
+		{
+			name:     "written non-WriteTracker",
+			response: res2,
+			expected: false,
+		},
+		{
+			name:     "non-written WriteTracker",
+			response: res3,
+			expected: false,
+		},
+		{
+			name:     "written WriteTracker",
+			response: res4,
+			expected: true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			event := router.Event{
+				Response: s.response,
+			}
+
+			result := event.Written()
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestEventStatus(t *testing.T) {
+	t.Parallel()
+
+	res1 := httptest.NewRecorder()
+
+	res2 := httptest.NewRecorder()
+	res2.WriteHeader(123)
+
+	res3 := &router.ResponseWriter{ResponseWriter: unwrapTester{httptest.NewRecorder()}}
+
+	res4 := &router.ResponseWriter{ResponseWriter: unwrapTester{httptest.NewRecorder()}}
+	res4.WriteHeader(123)
+
+	scenarios := []struct {
+		name     string
+		response http.ResponseWriter
+		expected int
+	}{
+		{
+			name:     "non-written non-StatusTracker",
+			response: res1,
+			expected: 0,
+		},
+		{
+			name:     "written non-StatusTracker",
+			response: res2,
+			expected: 0,
+		},
+		{
+			name:     "non-written StatusTracker",
+			response: res3,
+			expected: 0,
+		},
+		{
+			name:     "written StatusTracker",
+			response: res4,
+			expected: 123,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			event := router.Event{
+				Response: s.response,
+			}
+
+			result := event.Status()
+
+			if result != s.expected {
+				t.Fatalf("Expected %d, got %d", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestEventIsTLS(t *testing.T) {
+	t.Parallel()
+
+	req, err := http.NewRequest(http.MethodGet, "/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	event := router.Event{Request: req}
+
+	// without TLS
+	if event.IsTLS() {
+		t.Fatalf("Expected IsTLS false")
+	}
+
+	// dummy TLS state
+	req.TLS = new(tls.ConnectionState)
+
+	// with TLS
+	if !event.IsTLS() {
+		t.Fatalf("Expected IsTLS true")
+	}
+}
+
+func TestEventSetCookie(t *testing.T) {
+	t.Parallel()
+
+	event := router.Event{
+		Response: httptest.NewRecorder(),
+	}
+
+	cookie := event.Response.Header().Get("set-cookie")
+	if cookie != "" {
+		t.Fatalf("Expected empty cookie string, got %q", cookie)
+	}
+
+	event.SetCookie(&http.Cookie{Name: "test", Value: "a"})
+
+	expected := "test=a"
+
+	cookie = event.Response.Header().Get("set-cookie")
+	if cookie != expected {
+		t.Fatalf("Expected cookie %q, got %q", expected, cookie)
+	}
+}
+
+func TestEventRemoteIP(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		remoteAddr string
+		expected   string
+	}{
+		{"", "invalid IP"},
+		{"1.2.3.4", "invalid IP"},
+		{"1.2.3.4:8198", "1.2.3.4"},
+		{"[0000:0000:0000:0000:0000:0000:0000:0002]:80", "0000:0000:0000:0000:0000:0000:0000:0002"},
+		{"[::2]:80", "0000:0000:0000:0000:0000:0000:0000:0002"}, // should always return the expanded version
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.remoteAddr, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodGet, "/", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			req.RemoteAddr = s.remoteAddr
+
+			event := router.Event{Request: req}
+
+			ip := event.RemoteIP()
+
+			if ip != s.expected {
+				t.Fatalf("Expected IP %q, got %q", s.expected, ip)
+			}
+		})
+	}
+}
+
+func TestFindUploadedFiles(t *testing.T) {
+	scenarios := []struct {
+		filename        string
+		expectedPattern string
+	}{
+		{"ab.png", `^ab\w{10}_\w{10}\.png$`},
+		{"test", `^test_\w{10}\.txt$`},
+		{"a b c d!@$.j!@$pg", `^a_b_c_d_\w{10}\.jpg$`},
+		{strings.Repeat("a", 150), `^a{100}_\w{10}\.txt$`},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.filename, func(t *testing.T) {
+			// create multipart form file body
+			body := new(bytes.Buffer)
+			mp := multipart.NewWriter(body)
+			w, err := mp.CreateFormFile("test", s.filename)
+			if err != nil {
+				t.Fatal(err)
+			}
+			w.Write([]byte("test"))
+			mp.Close()
+			// ---
+
+			req := httptest.NewRequest(http.MethodPost, "/", body)
+			req.Header.Add("Content-Type", mp.FormDataContentType())
+
+			event := router.Event{Request: req}
+
+			result, err := event.FindUploadedFiles("test")
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(result) != 1 {
+				t.Fatalf("Expected 1 file, got %d", len(result))
+			}
+
+			if result[0].Size != 4 {
+				t.Fatalf("Expected the file size to be 4 bytes, got %d", result[0].Size)
+			}
+
+			pattern, err := regexp.Compile(s.expectedPattern)
+			if err != nil {
+				t.Fatalf("Invalid filename pattern %q: %v", s.expectedPattern, err)
+			}
+			if !pattern.MatchString(result[0].Name) {
+				t.Fatalf("Expected filename to match %s, got filename %s", s.expectedPattern, result[0].Name)
+			}
+		})
+	}
+}
+
+func TestFindUploadedFilesMissing(t *testing.T) {
+	body := new(bytes.Buffer)
+	mp := multipart.NewWriter(body)
+	mp.Close()
+
+	req := httptest.NewRequest(http.MethodPost, "/", body)
+	req.Header.Add("Content-Type", mp.FormDataContentType())
+
+	event := router.Event{Request: req}
+
+	result, err := event.FindUploadedFiles("test")
+	if err == nil {
+		t.Error("Expected error, got nil")
+	}
+
+	if result != nil {
+		t.Errorf("Expected result to be nil, got %v", result)
+	}
+}
+
+func TestEventSetGet(t *testing.T) {
+	event := router.Event{}
+
+	// get before any set (ensures that doesn't panic)
+	if v := event.Get("test"); v != nil {
+		t.Fatalf("Expected nil value, got %v", v)
+	}
+
+	event.Set("a", 123)
+	event.Set("b", 456)
+
+	scenarios := []struct {
+		key      string
+		expected any
+	}{
+		{"", nil},
+		{"missing", nil},
+		{"a", 123},
+		{"b", 456},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.key), func(t *testing.T) {
+			result := event.Get(s.key)
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestEventSetAllGetAll(t *testing.T) {
+	data := map[string]any{
+		"a": 123,
+		"b": 456,
+	}
+	rawData, err := json.Marshal(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	event := router.Event{}
+	event.SetAll(data)
+
+	// modify the data to ensure that the map was shallow coppied
+	data["c"] = 789
+
+	result := event.GetAll()
+	rawResult, err := json.Marshal(result)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(rawResult) == 0 || !bytes.Equal(rawData, rawResult) {
+		t.Fatalf("Expected\n%v\ngot\n%v", rawData, rawResult)
+	}
+}
+
+func TestEventString(t *testing.T) {
+	scenarios := []testResponseWriteScenario[string]{
+		{
+			name:            "no explicit content-type",
+			status:          123,
+			headers:         nil,
+			body:            "test",
+			expectedStatus:  123,
+			expectedHeaders: map[string]string{"content-type": "text/plain; charset=utf-8"},
+			expectedBody:    "test",
+		},
+		{
+			name:            "with explicit content-type",
+			status:          123,
+			headers:         map[string]string{"content-type": "text/test"},
+			body:            "test",
+			expectedStatus:  123,
+			expectedHeaders: map[string]string{"content-type": "text/test"},
+			expectedBody:    "test",
+		},
+	}
+
+	for _, s := range scenarios {
+		testEventResponseWrite(t, s, func(e *router.Event) error {
+			return e.String(s.status, s.body)
+		})
+	}
+}
+
+func TestEventHTML(t *testing.T) {
+	scenarios := []testResponseWriteScenario[string]{
+		{
+			name:            "no explicit content-type",
+			status:          123,
+			headers:         nil,
+			body:            "test",
+			expectedStatus:  123,
+			expectedHeaders: map[string]string{"content-type": "text/html; charset=utf-8"},
+			expectedBody:    "test",
+		},
+		{
+			name:            "with explicit content-type",
+			status:          123,
+			headers:         map[string]string{"content-type": "text/test"},
+			body:            "test",
+			expectedStatus:  123,
+			expectedHeaders: map[string]string{"content-type": "text/test"},
+			expectedBody:    "test",
+		},
+	}
+
+	for _, s := range scenarios {
+		testEventResponseWrite(t, s, func(e *router.Event) error {
+			return e.HTML(s.status, s.body)
+		})
+	}
+}
+
+func TestEventJSON(t *testing.T) {
+	body := map[string]any{"a": 123, "b": 456, "c": "test"}
+	expectedPickedBody := `{"a":123,"c":"test"}` + "\n"
+	expectedFullBody := `{"a":123,"b":456,"c":"test"}` + "\n"
+
+	scenarios := []testResponseWriteScenario[any]{
+		{
+			name:            "no explicit content-type",
+			status:          200,
+			headers:         nil,
+			body:            body,
+			expectedStatus:  200,
+			expectedHeaders: map[string]string{"content-type": "application/json"},
+			expectedBody:    expectedPickedBody,
+		},
+		{
+			name:            "with explicit content-type (200)",
+			status:          200,
+			headers:         map[string]string{"content-type": "application/test"},
+			body:            body,
+			expectedStatus:  200,
+			expectedHeaders: map[string]string{"content-type": "application/test"},
+			expectedBody:    expectedPickedBody,
+		},
+		{
+			name:            "with explicit content-type (400)", // no fields picker
+			status:          400,
+			headers:         map[string]string{"content-type": "application/test"},
+			body:            body,
+			expectedStatus:  400,
+			expectedHeaders: map[string]string{"content-type": "application/test"},
+			expectedBody:    expectedFullBody,
+		},
+	}
+
+	for _, s := range scenarios {
+		testEventResponseWrite(t, s, func(e *router.Event) error {
+			e.Request.URL.RawQuery = "fields=a,c" // ensures that the picker is invoked
+			return e.JSON(s.status, s.body)
+		})
+	}
+}
+
+func TestEventXML(t *testing.T) {
+	scenarios := []testResponseWriteScenario[string]{
+		{
+			name:            "no explicit content-type",
+			status:          234,
+			headers:         nil,
+			body:            "test",
+			expectedStatus:  234,
+			expectedHeaders: map[string]string{"content-type": "application/xml; charset=utf-8"},
+			expectedBody:    xml.Header + "<string>test</string>",
+		},
+		{
+			name:            "with explicit content-type",
+			status:          234,
+			headers:         map[string]string{"content-type": "text/test"},
+			body:            "test",
+			expectedStatus:  234,
+			expectedHeaders: map[string]string{"content-type": "text/test"},
+			expectedBody:    xml.Header + "<string>test</string>",
+		},
+	}
+
+	for _, s := range scenarios {
+		testEventResponseWrite(t, s, func(e *router.Event) error {
+			return e.XML(s.status, s.body)
+		})
+	}
+}
+
+func TestEventStream(t *testing.T) {
+	scenarios := []testResponseWriteScenario[string]{
+		{
+			name:            "stream",
+			status:          234,
+			headers:         map[string]string{"content-type": "text/test"},
+			body:            "test",
+			expectedStatus:  234,
+			expectedHeaders: map[string]string{"content-type": "text/test"},
+			expectedBody:    "test",
+		},
+	}
+
+	for _, s := range scenarios {
+		testEventResponseWrite(t, s, func(e *router.Event) error {
+			return e.Stream(s.status, s.headers["content-type"], strings.NewReader(s.body))
+		})
+	}
+}
+
+func TestEventBlob(t *testing.T) {
+	scenarios := []testResponseWriteScenario[[]byte]{
+		{
+			name:            "blob",
+			status:          234,
+			headers:         map[string]string{"content-type": "text/test"},
+			body:            []byte("test"),
+			expectedStatus:  234,
+			expectedHeaders: map[string]string{"content-type": "text/test"},
+			expectedBody:    "test",
+		},
+	}
+
+	for _, s := range scenarios {
+		testEventResponseWrite(t, s, func(e *router.Event) error {
+			return e.Blob(s.status, s.headers["content-type"], s.body)
+		})
+	}
+}
+
+func TestEventNoContent(t *testing.T) {
+	s := testResponseWriteScenario[any]{
+		name:            "no content",
+		status:          234,
+		headers:         map[string]string{"content-type": "text/test"},
+		body:            nil,
+		expectedStatus:  234,
+		expectedHeaders: map[string]string{"content-type": "text/test"},
+		expectedBody:    "",
+	}
+
+	testEventResponseWrite(t, s, func(e *router.Event) error {
+		return e.NoContent(s.status)
+	})
+}
+
+func TestEventFlush(t *testing.T) {
+	rec := httptest.NewRecorder()
+
+	event := &router.Event{
+		Response: unwrapTester{&router.ResponseWriter{ResponseWriter: rec}},
+	}
+	event.Response.Write([]byte("test"))
+	event.Flush()
+
+	if !rec.Flushed {
+		t.Fatal("Expected response to be flushed")
+	}
+}
+
+func TestEventRedirect(t *testing.T) {
+	scenarios := []testResponseWriteScenario[any]{
+		{
+			name:           "non-30x status",
+			status:         200,
+			expectedStatus: 200,
+			expectedError:  router.ErrInvalidRedirectStatusCode,
+		},
+		{
+			name:            "30x status",
+			status:          302,
+			headers:         map[string]string{"location": "test"}, // should be overwritten with the argument
+			expectedStatus:  302,
+			expectedHeaders: map[string]string{"location": "example"},
+		},
+	}
+
+	for _, s := range scenarios {
+		testEventResponseWrite(t, s, func(e *router.Event) error {
+			return e.Redirect(s.status, "example")
+		})
+	}
+}
+
+func TestEventFileFS(t *testing.T) {
+	// stub test files
+	// ---
+	dir, err := os.MkdirTemp("", "EventFileFS")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
+
+	err = os.WriteFile(filepath.Join(dir, "index.html"), []byte("index"), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.WriteFile(filepath.Join(dir, "test.txt"), []byte("test"), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// create sub directory with an index.html file inside it
+	err = os.MkdirAll(filepath.Join(dir, "sub1"), os.ModePerm)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = os.WriteFile(filepath.Join(dir, "sub1", "index.html"), []byte("sub1 index"), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.MkdirAll(filepath.Join(dir, "sub2"), os.ModePerm)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = os.WriteFile(filepath.Join(dir, "sub2", "test.txt"), []byte("sub2 test"), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// ---
+
+	scenarios := []struct {
+		name     string
+		path     string
+		expected string
+	}{
+		{"missing file", "", ""},
+		{"root with no explicit file", "", ""},
+		{"root with explicit file", "test.txt", "test"},
+		{"sub dir with no explicit file", "sub1", "sub1 index"},
+		{"sub dir with no explicit file (no index.html)", "sub2", ""},
+		{"sub dir explicit file", "sub2/test.txt", "sub2 test"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodGet, "/", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			rec := httptest.NewRecorder()
+
+			event := &router.Event{
+				Request:  req,
+				Response: rec,
+			}
+
+			err = event.FileFS(os.DirFS(dir), s.path)
+
+			hasErr := err != nil
+			expectErr := s.expected == ""
+			if hasErr != expectErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", expectErr, hasErr, err)
+			}
+
+			result := rec.Result()
+
+			raw, err := io.ReadAll(result.Body)
+			result.Body.Close()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(raw) != s.expected {
+				t.Fatalf("Expected body\n%s\ngot\n%s", s.expected, raw)
+			}
+
+			// ensure that the proper file headers are added
+			// (aka. http.ServeContent is invoked)
+			length, _ := strconv.Atoi(result.Header.Get("content-length"))
+			if length != len(s.expected) {
+				t.Fatalf("Expected Content-Length %d, got %d", len(s.expected), length)
+			}
+		})
+	}
+}
+
+func TestEventError(t *testing.T) {
+	err := new(router.Event).Error(123, "message_test", map[string]any{"a": validation.Required, "b": "test"})
+
+	result, _ := json.Marshal(err)
+	expected := `{"data":{"a":{"code":"validation_invalid_value","message":"Invalid value."},"b":{"code":"validation_invalid_value","message":"Invalid value."}},"message":"Message_test.","status":123}`
+
+	if string(result) != expected {
+		t.Errorf("Expected\n%s\ngot\n%s", expected, result)
+	}
+}
+
+func TestEventBadRequestError(t *testing.T) {
+	err := new(router.Event).BadRequestError("message_test", map[string]any{"a": validation.Required, "b": "test"})
+
+	result, _ := json.Marshal(err)
+	expected := `{"data":{"a":{"code":"validation_invalid_value","message":"Invalid value."},"b":{"code":"validation_invalid_value","message":"Invalid value."}},"message":"Message_test.","status":400}`
+
+	if string(result) != expected {
+		t.Errorf("Expected\n%s\ngot\n%s", expected, result)
+	}
+}
+
+func TestEventNotFoundError(t *testing.T) {
+	err := new(router.Event).NotFoundError("message_test", map[string]any{"a": validation.Required, "b": "test"})
+
+	result, _ := json.Marshal(err)
+	expected := `{"data":{"a":{"code":"validation_invalid_value","message":"Invalid value."},"b":{"code":"validation_invalid_value","message":"Invalid value."}},"message":"Message_test.","status":404}`
+
+	if string(result) != expected {
+		t.Errorf("Expected\n%s\ngot\n%s", expected, result)
+	}
+}
+
+func TestEventForbiddenError(t *testing.T) {
+	err := new(router.Event).ForbiddenError("message_test", map[string]any{"a": validation.Required, "b": "test"})
+
+	result, _ := json.Marshal(err)
+	expected := `{"data":{"a":{"code":"validation_invalid_value","message":"Invalid value."},"b":{"code":"validation_invalid_value","message":"Invalid value."}},"message":"Message_test.","status":403}`
+
+	if string(result) != expected {
+		t.Errorf("Expected\n%s\ngot\n%s", expected, result)
+	}
+}
+
+func TestEventUnauthorizedError(t *testing.T) {
+	err := new(router.Event).UnauthorizedError("message_test", map[string]any{"a": validation.Required, "b": "test"})
+
+	result, _ := json.Marshal(err)
+	expected := `{"data":{"a":{"code":"validation_invalid_value","message":"Invalid value."},"b":{"code":"validation_invalid_value","message":"Invalid value."}},"message":"Message_test.","status":401}`
+
+	if string(result) != expected {
+		t.Errorf("Expected\n%s\ngot\n%s", expected, result)
+	}
+}
+
+func TestEventTooManyRequestsError(t *testing.T) {
+	err := new(router.Event).TooManyRequestsError("message_test", map[string]any{"a": validation.Required, "b": "test"})
+
+	result, _ := json.Marshal(err)
+	expected := `{"data":{"a":{"code":"validation_invalid_value","message":"Invalid value."},"b":{"code":"validation_invalid_value","message":"Invalid value."}},"message":"Message_test.","status":429}`
+
+	if string(result) != expected {
+		t.Errorf("Expected\n%s\ngot\n%s", expected, result)
+	}
+}
+
+func TestEventInternalServerError(t *testing.T) {
+	err := new(router.Event).InternalServerError("message_test", map[string]any{"a": validation.Required, "b": "test"})
+
+	result, _ := json.Marshal(err)
+	expected := `{"data":{"a":{"code":"validation_invalid_value","message":"Invalid value."},"b":{"code":"validation_invalid_value","message":"Invalid value."}},"message":"Message_test.","status":500}`
+
+	if string(result) != expected {
+		t.Errorf("Expected\n%s\ngot\n%s", expected, result)
+	}
+}
+
+func TestEventBindBody(t *testing.T) {
+	type testDstStruct struct {
+		A int    `json:"a" xml:"a" form:"a"`
+		B int    `json:"b" xml:"b" form:"b"`
+		C string `json:"c" xml:"c" form:"c"`
+	}
+
+	emptyDst := `{"a":0,"b":0,"c":""}`
+
+	queryDst := `a=123&b=-456&c=test`
+
+	xmlDst := `
+		<?xml version="1.0" encoding="UTF-8" ?>
+		<root>
+			<a>123</a>
+			<b>-456</b>
+			<c>test</c>
+		</root>
+	`
+
+	jsonDst := `{"a":123,"b":-456,"c":"test"}`
+
+	// multipart
+	mpBody := &bytes.Buffer{}
+	mpWriter := multipart.NewWriter(mpBody)
+	mpWriter.WriteField("@jsonPayload", `{"a":123}`)
+	mpWriter.WriteField("b", "-456")
+	mpWriter.WriteField("c", "test")
+	if err := mpWriter.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	scenarios := []struct {
+		contentType string
+		body        io.Reader
+		expectDst   string
+		expectError bool
+	}{
+		{
+			contentType: "",
+			body:        strings.NewReader(jsonDst),
+			expectDst:   emptyDst,
+			expectError: true,
+		},
+		{
+			contentType: "application/rtf", // unsupported
+			body:        strings.NewReader(jsonDst),
+			expectDst:   emptyDst,
+			expectError: true,
+		},
+		// empty body
+		{
+			contentType: "application/json;charset=emptybody",
+			body:        strings.NewReader(""),
+			expectDst:   emptyDst,
+		},
+		// json
+		{
+			contentType: "application/json",
+			body:        strings.NewReader(jsonDst),
+			expectDst:   jsonDst,
+		},
+		{
+			contentType: "application/json;charset=abc",
+			body:        strings.NewReader(jsonDst),
+			expectDst:   jsonDst,
+		},
+		// xml
+		{
+			contentType: "text/xml",
+			body:        strings.NewReader(xmlDst),
+			expectDst:   jsonDst,
+		},
+		{
+			contentType: "text/xml;charset=abc",
+			body:        strings.NewReader(xmlDst),
+			expectDst:   jsonDst,
+		},
+		{
+			contentType: "application/xml",
+			body:        strings.NewReader(xmlDst),
+			expectDst:   jsonDst,
+		},
+		{
+			contentType: "application/xml;charset=abc",
+			body:        strings.NewReader(xmlDst),
+			expectDst:   jsonDst,
+		},
+		// x-www-form-urlencoded
+		{
+			contentType: "application/x-www-form-urlencoded",
+			body:        strings.NewReader(queryDst),
+			expectDst:   jsonDst,
+		},
+		{
+			contentType: "application/x-www-form-urlencoded;charset=abc",
+			body:        strings.NewReader(queryDst),
+			expectDst:   jsonDst,
+		},
+		// multipart
+		{
+			contentType: mpWriter.FormDataContentType(),
+			body:        mpBody,
+			expectDst:   jsonDst,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.contentType, func(t *testing.T) {
+			req, err := http.NewRequest(http.MethodPost, "/", s.body)
+			if err != nil {
+				t.Fatal(err)
+			}
+			req.Header.Add("content-type", s.contentType)
+
+			event := &router.Event{Request: req}
+
+			dst := testDstStruct{}
+
+			err = event.BindBody(&dst)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			dstRaw, err := json.Marshal(dst)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(dstRaw) != s.expectDst {
+				t.Fatalf("Expected dst\n%s\ngot\n%s", s.expectDst, dstRaw)
+			}
+		})
+	}
+}
+
+// -------------------------------------------------------------------
+
+type testResponseWriteScenario[T any] struct {
+	name            string
+	status          int
+	headers         map[string]string
+	body            T
+	expectedStatus  int
+	expectedHeaders map[string]string
+	expectedBody    string
+	expectedError   error
+}
+
+func testEventResponseWrite[T any](
+	t *testing.T,
+	scenario testResponseWriteScenario[T],
+	writeFunc func(e *router.Event) error,
+) {
+	t.Run(scenario.name, func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		rec := httptest.NewRecorder()
+		event := &router.Event{
+			Request:  req,
+			Response: &router.ResponseWriter{ResponseWriter: rec},
+		}
+
+		for k, v := range scenario.headers {
+			event.Response.Header().Add(k, v)
+		}
+
+		err = writeFunc(event)
+		if (scenario.expectedError != nil || err != nil) && !errors.Is(err, scenario.expectedError) {
+			t.Fatalf("Expected error %v, got %v", scenario.expectedError, err)
+		}
+
+		result := rec.Result()
+
+		if result.StatusCode != scenario.expectedStatus {
+			t.Fatalf("Expected status code %d, got %d", scenario.expectedStatus, result.StatusCode)
+		}
+
+		resultBody, err := io.ReadAll(result.Body)
+		result.Body.Close()
+		if err != nil {
+			t.Fatalf("Failed to read response body: %v", err)
+		}
+
+		resultBody, err = json.Marshal(string(resultBody))
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		expectedBody, err := json.Marshal(scenario.expectedBody)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if !bytes.Equal(resultBody, expectedBody) {
+			t.Fatalf("Expected body\n%s\ngot\n%s", expectedBody, resultBody)
+		}
+
+		for k, ev := range scenario.expectedHeaders {
+			if v := result.Header.Get(k); v != ev {
+				t.Fatalf("Expected %q header to be %q, got %q", k, ev, v)
+			}
+		}
+	})
+}
diff --git a/server/core_backend-server/tools/router/group.go b/server/core_backend-server/tools/router/group.go
new file mode 100644
index 0000000..b6f7524
--- /dev/null
+++ b/server/core_backend-server/tools/router/group.go
@@ -0,0 +1,231 @@
+package router
+
+import (
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+// (note: the struct is named RouterGroup instead of Group so that it can
+// be embedded in the Router without conflicting with the Group method)
+
+// RouterGroup represents a collection of routes and other sub groups
+// that share common pattern prefix and middlewares.
+type RouterGroup[T hook.Resolver] struct {
+	excludedMiddlewares map[string]struct{}
+	children            []any // Route or RouterGroup
+
+	Prefix      string
+	Middlewares []*hook.Handler[T]
+}
+
+// Group creates and register a new child Group into the current one
+// with the specified prefix.
+//
+// The prefix follows the standard Go net/http ServeMux pattern format ("[HOST]/[PATH]")
+// and will be concatenated recursively into the final route path, meaning that
+// only the root level group could have HOST as part of the prefix.
+//
+// Returns the newly created group to allow chaining and registering
+// sub-routes and group specific middlewares.
+func (group *RouterGroup[T]) Group(prefix string) *RouterGroup[T] {
+	newGroup := &RouterGroup[T]{}
+	newGroup.Prefix = prefix
+
+	group.children = append(group.children, newGroup)
+
+	return newGroup
+}
+
+// BindFunc registers one or multiple middleware functions to the current group.
+//
+// The registered middleware functions are "anonymous" and with default priority,
+// aka. executes in the order they were registered.
+//
+// If you need to specify a named middleware (ex. so that it can be removed)
+// or middleware with custom exec prirority, use [RouterGroup.Bind] method.
+func (group *RouterGroup[T]) BindFunc(middlewareFuncs ...func(e T) error) *RouterGroup[T] {
+	for _, m := range middlewareFuncs {
+		group.Middlewares = append(group.Middlewares, &hook.Handler[T]{Func: m})
+	}
+
+	return group
+}
+
+// Bind registers one or multiple middleware handlers to the current group.
+func (group *RouterGroup[T]) Bind(middlewares ...*hook.Handler[T]) *RouterGroup[T] {
+	group.Middlewares = append(group.Middlewares, middlewares...)
+
+	// unmark the newly added middlewares in case they were previously "excluded"
+	if group.excludedMiddlewares != nil {
+		for _, m := range middlewares {
+			if m.Id != "" {
+				delete(group.excludedMiddlewares, m.Id)
+			}
+		}
+	}
+
+	return group
+}
+
+// Unbind removes one or more middlewares with the specified id(s)
+// from the current group and its children (if any).
+//
+// Anonymous middlewares are not removable, aka. this method does nothing
+// if the middleware id is an empty string.
+func (group *RouterGroup[T]) Unbind(middlewareIds ...string) *RouterGroup[T] {
+	for _, middlewareId := range middlewareIds {
+		if middlewareId == "" {
+			continue
+		}
+
+		// remove from the group middlwares
+		for i := len(group.Middlewares) - 1; i >= 0; i-- {
+			if group.Middlewares[i].Id == middlewareId {
+				group.Middlewares = append(group.Middlewares[:i], group.Middlewares[i+1:]...)
+			}
+		}
+
+		// remove from the group children
+		for i := len(group.children) - 1; i >= 0; i-- {
+			switch v := group.children[i].(type) {
+			case *RouterGroup[T]:
+				v.Unbind(middlewareId)
+			case *Route[T]:
+				v.Unbind(middlewareId)
+			}
+		}
+
+		// add to the exclude list
+		if group.excludedMiddlewares == nil {
+			group.excludedMiddlewares = map[string]struct{}{}
+		}
+		group.excludedMiddlewares[middlewareId] = struct{}{}
+	}
+
+	return group
+}
+
+// Route registers a single route into the current group.
+//
+// Note that the final route path will be the concatenation of all parent groups prefixes + the route path.
+// The path follows the standard Go net/http ServeMux format ("[HOST]/[PATH]"),
+// meaning that only a top level group route could have HOST as part of the prefix.
+//
+// Returns the newly created route to allow attaching route-only middlewares.
+func (group *RouterGroup[T]) Route(method string, path string, action func(e T) error) *Route[T] {
+	route := &Route[T]{
+		Method: method,
+		Path:   path,
+		Action: action,
+	}
+
+	group.children = append(group.children, route)
+
+	return route
+}
+
+// Any is a shorthand for [RouterGroup.AddRoute] with "" as route method (aka. matches any method).
+func (group *RouterGroup[T]) Any(path string, action func(e T) error) *Route[T] {
+	return group.Route("", path, action)
+}
+
+// GET is a shorthand for [RouterGroup.AddRoute] with GET as route method.
+func (group *RouterGroup[T]) GET(path string, action func(e T) error) *Route[T] {
+	return group.Route(http.MethodGet, path, action)
+}
+
+// SEARCH is a shorthand for [RouterGroup.AddRoute] with SEARCH as route method.
+func (group *RouterGroup[T]) SEARCH(path string, action func(e T) error) *Route[T] {
+	return group.Route("SEARCH", path, action)
+}
+
+// POST is a shorthand for [RouterGroup.AddRoute] with POST as route method.
+func (group *RouterGroup[T]) POST(path string, action func(e T) error) *Route[T] {
+	return group.Route(http.MethodPost, path, action)
+}
+
+// DELETE is a shorthand for [RouterGroup.AddRoute] with DELETE as route method.
+func (group *RouterGroup[T]) DELETE(path string, action func(e T) error) *Route[T] {
+	return group.Route(http.MethodDelete, path, action)
+}
+
+// PATCH is a shorthand for [RouterGroup.AddRoute] with PATCH as route method.
+func (group *RouterGroup[T]) PATCH(path string, action func(e T) error) *Route[T] {
+	return group.Route(http.MethodPatch, path, action)
+}
+
+// PUT is a shorthand for [RouterGroup.AddRoute] with PUT as route method.
+func (group *RouterGroup[T]) PUT(path string, action func(e T) error) *Route[T] {
+	return group.Route(http.MethodPut, path, action)
+}
+
+// HEAD is a shorthand for [RouterGroup.AddRoute] with HEAD as route method.
+func (group *RouterGroup[T]) HEAD(path string, action func(e T) error) *Route[T] {
+	return group.Route(http.MethodHead, path, action)
+}
+
+// OPTIONS is a shorthand for [RouterGroup.AddRoute] with OPTIONS as route method.
+func (group *RouterGroup[T]) OPTIONS(path string, action func(e T) error) *Route[T] {
+	return group.Route(http.MethodOptions, path, action)
+}
+
+// HasRoute checks whether the specified route pattern (method + path)
+// is registered in the current group or its children.
+//
+// This could be useful to conditionally register and checks for routes
+// in order prevent panic on duplicated routes.
+//
+// Note that routes with anonymous and named wildcard placeholder are treated as equal,
+// aka. "GET /abc/" is considered the same as "GET /abc/{something...}".
+func (group *RouterGroup[T]) HasRoute(method string, path string) bool {
+	pattern := path
+	if method != "" {
+		pattern = strings.ToUpper(method) + " " + pattern
+	}
+
+	return group.hasRoute(pattern, nil)
+}
+
+func (group *RouterGroup[T]) hasRoute(pattern string, parents []*RouterGroup[T]) bool {
+	for _, child := range group.children {
+		switch v := child.(type) {
+		case *RouterGroup[T]:
+			if v.hasRoute(pattern, append(parents, group)) {
+				return true
+			}
+		case *Route[T]:
+			var result string
+
+			if v.Method != "" {
+				result += v.Method + " "
+			}
+
+			// add parent groups prefixes
+			for _, p := range parents {
+				result += p.Prefix
+			}
+
+			// add current group prefix
+			result += group.Prefix
+
+			// add current route path
+			result += v.Path
+
+			if result == pattern || // direct match
+				// compares without the named wildcard, aka. /abc/{test...} is equal to /abc/
+				stripWildcard(result) == stripWildcard(pattern) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+var wildcardPlaceholderRegex = regexp.MustCompile(`/{.+\.\.\.}$`)
+
+func stripWildcard(pattern string) string {
+	return wildcardPlaceholderRegex.ReplaceAllString(pattern, "/")
+}
diff --git a/server/core_backend-server/tools/router/group_test.go b/server/core_backend-server/tools/router/group_test.go
new file mode 100644
index 0000000..aeafca4
--- /dev/null
+++ b/server/core_backend-server/tools/router/group_test.go
@@ -0,0 +1,430 @@
+package router
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+func TestRouterGroupGroup(t *testing.T) {
+	t.Parallel()
+
+	g0 := RouterGroup[*Event]{}
+
+	g1 := g0.Group("test1")
+	g2 := g0.Group("test2")
+
+	if total := len(g0.children); total != 2 {
+		t.Fatalf("Expected %d child groups, got %d", 2, total)
+	}
+
+	if g1.Prefix != "test1" {
+		t.Fatalf("Expected g1 with prefix %q, got %q", "test1", g1.Prefix)
+	}
+	if g2.Prefix != "test2" {
+		t.Fatalf("Expected g2 with prefix %q, got %q", "test2", g2.Prefix)
+	}
+}
+
+func TestRouterGroupBindFunc(t *testing.T) {
+	t.Parallel()
+
+	g := RouterGroup[*Event]{}
+
+	calls := ""
+
+	// append one function
+	g.BindFunc(func(e *Event) error {
+		calls += "a"
+		return nil
+	})
+
+	// append multiple functions
+	g.BindFunc(
+		func(e *Event) error {
+			calls += "b"
+			return nil
+		},
+		func(e *Event) error {
+			calls += "c"
+			return nil
+		},
+	)
+
+	if total := len(g.Middlewares); total != 3 {
+		t.Fatalf("Expected %d middlewares, got %v", 3, total)
+	}
+
+	for _, h := range g.Middlewares {
+		_ = h.Func(nil)
+	}
+
+	if calls != "abc" {
+		t.Fatalf("Expected calls sequence %q, got %q", "abc", calls)
+	}
+}
+
+func TestRouterGroupBind(t *testing.T) {
+	t.Parallel()
+
+	g := RouterGroup[*Event]{
+		// mock excluded middlewares to check whether the entry will be deleted
+		excludedMiddlewares: map[string]struct{}{"test2": {}},
+	}
+
+	calls := ""
+
+	// append one handler
+	g.Bind(&hook.Handler[*Event]{
+		Func: func(e *Event) error {
+			calls += "a"
+			return nil
+		},
+	})
+
+	// append multiple handlers
+	g.Bind(
+		&hook.Handler[*Event]{
+			Id: "test1",
+			Func: func(e *Event) error {
+				calls += "b"
+				return nil
+			},
+		},
+		&hook.Handler[*Event]{
+			Id: "test2",
+			Func: func(e *Event) error {
+				calls += "c"
+				return nil
+			},
+		},
+	)
+
+	if total := len(g.Middlewares); total != 3 {
+		t.Fatalf("Expected %d middlewares, got %v", 3, total)
+	}
+
+	for _, h := range g.Middlewares {
+		_ = h.Func(nil)
+	}
+
+	if calls != "abc" {
+		t.Fatalf("Expected calls %q, got %q", "abc", calls)
+	}
+
+	// ensures that the previously excluded middleware was removed
+	if len(g.excludedMiddlewares) != 0 {
+		t.Fatalf("Expected test2 to be removed from the excludedMiddlewares list, got %v", g.excludedMiddlewares)
+	}
+}
+
+func TestRouterGroupUnbind(t *testing.T) {
+	t.Parallel()
+
+	g := RouterGroup[*Event]{}
+
+	calls := ""
+
+	// anonymous middlewares
+	g.Bind(&hook.Handler[*Event]{
+		Func: func(e *Event) error {
+			calls += "a"
+			return nil // unused value
+		},
+	})
+
+	// middlewares with id
+	g.Bind(&hook.Handler[*Event]{
+		Id: "test1",
+		Func: func(e *Event) error {
+			calls += "b"
+			return nil // unused value
+		},
+	})
+	g.Bind(&hook.Handler[*Event]{
+		Id: "test2",
+		Func: func(e *Event) error {
+			calls += "c"
+			return nil // unused value
+		},
+	})
+	g.Bind(&hook.Handler[*Event]{
+		Id: "test3",
+		Func: func(e *Event) error {
+			calls += "d"
+			return nil // unused value
+		},
+	})
+
+	// remove
+	g.Unbind("") // should be no-op
+	g.Unbind("test1", "test3")
+
+	if total := len(g.Middlewares); total != 2 {
+		t.Fatalf("Expected %d middlewares, got %v", 2, total)
+	}
+
+	for _, h := range g.Middlewares {
+		if err := h.Func(nil); err != nil {
+			continue
+		}
+	}
+
+	if calls != "ac" {
+		t.Fatalf("Expected calls %q, got %q", "ac", calls)
+	}
+
+	// ensure that the ids were added in the exclude list
+	excluded := []string{"test1", "test3"}
+	if len(g.excludedMiddlewares) != len(excluded) {
+		t.Fatalf("Expected excludes %v, got %v", excluded, g.excludedMiddlewares)
+	}
+	for id := range g.excludedMiddlewares {
+		if !slices.Contains(excluded, id) {
+			t.Fatalf("Expected %q to be marked as excluded", id)
+		}
+	}
+}
+
+func TestRouterGroupRoute(t *testing.T) {
+	t.Parallel()
+
+	group := RouterGroup[*Event]{}
+
+	sub := group.Group("sub")
+
+	var called bool
+	route := group.Route(http.MethodPost, "/test", func(e *Event) error {
+		called = true
+		return nil
+	})
+
+	// ensure that the route was registered only to the main one
+	// ---
+	if len(sub.children) != 0 {
+		t.Fatalf("Expected no sub children, got %d", len(sub.children))
+	}
+
+	if len(group.children) != 2 {
+		t.Fatalf("Expected %d group children, got %d", 2, len(group.children))
+	}
+	// ---
+
+	// check the registered route
+	// ---
+	if route != group.children[1] {
+		t.Fatalf("Expected group children %v, got %v", route, group.children[1])
+	}
+
+	if route.Method != http.MethodPost {
+		t.Fatalf("Expected route method %q, got %q", http.MethodPost, route.Method)
+	}
+
+	if route.Path != "/test" {
+		t.Fatalf("Expected route path %q, got %q", "/test", route.Path)
+	}
+
+	route.Action(nil)
+	if !called {
+		t.Fatal("Expected route action to be called")
+	}
+}
+
+func TestRouterGroupRouteAliases(t *testing.T) {
+	t.Parallel()
+
+	group := RouterGroup[*Event]{}
+
+	testErr := errors.New("test")
+
+	testAction := func(e *Event) error {
+		return testErr
+	}
+
+	scenarios := []struct {
+		route        *Route[*Event]
+		expectMethod string
+		expectPath   string
+	}{
+		{
+			group.Any("/test", testAction),
+			"",
+			"/test",
+		},
+		{
+			group.GET("/test", testAction),
+			http.MethodGet,
+			"/test",
+		},
+		{
+			group.SEARCH("/test", testAction),
+			"SEARCH",
+			"/test",
+		},
+		{
+			group.POST("/test", testAction),
+			http.MethodPost,
+			"/test",
+		},
+		{
+			group.DELETE("/test", testAction),
+			http.MethodDelete,
+			"/test",
+		},
+		{
+			group.PATCH("/test", testAction),
+			http.MethodPatch,
+			"/test",
+		},
+		{
+			group.PUT("/test", testAction),
+			http.MethodPut,
+			"/test",
+		},
+		{
+			group.HEAD("/test", testAction),
+			http.MethodHead,
+			"/test",
+		},
+		{
+			group.OPTIONS("/test", testAction),
+			http.MethodOptions,
+			"/test",
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s_%s", i, s.expectMethod, s.expectPath), func(t *testing.T) {
+			if s.route.Method != s.expectMethod {
+				t.Fatalf("Expected method %q, got %q", s.expectMethod, s.route.Method)
+			}
+
+			if s.route.Path != s.expectPath {
+				t.Fatalf("Expected path %q, got %q", s.expectPath, s.route.Path)
+			}
+
+			if err := s.route.Action(nil); !errors.Is(err, testErr) {
+				t.Fatal("Expected test action")
+			}
+		})
+	}
+}
+
+func TestRouterGroupHasRoute(t *testing.T) {
+	t.Parallel()
+
+	group := RouterGroup[*Event]{}
+
+	group.Any("/any", nil)
+
+	group.GET("/base", nil)
+	group.DELETE("/base", nil)
+
+	sub := group.Group("/sub1")
+	sub.GET("/a", nil)
+	sub.POST("/a", nil)
+
+	sub2 := sub.Group("/sub2")
+	sub2.GET("/b", nil)
+	sub2.GET("/b/{test}", nil)
+
+	// special cases to test the normalizations
+	group.GET("/c/", nil)          // the same as /c/{test...}
+	group.GET("/d/{test...}", nil) // the same as /d/
+
+	scenarios := []struct {
+		method   string
+		path     string
+		expected bool
+	}{
+		{
+			http.MethodGet,
+			"",
+			false,
+		},
+		{
+			"",
+			"/any",
+			true,
+		},
+		{
+			http.MethodPost,
+			"/base",
+			false,
+		},
+		{
+			http.MethodGet,
+			"/base",
+			true,
+		},
+		{
+			http.MethodDelete,
+			"/base",
+			true,
+		},
+		{
+			http.MethodGet,
+			"/sub1",
+			false,
+		},
+		{
+			http.MethodGet,
+			"/sub1/a",
+			true,
+		},
+		{
+			http.MethodPost,
+			"/sub1/a",
+			true,
+		},
+		{
+			http.MethodDelete,
+			"/sub1/a",
+			false,
+		},
+		{
+			http.MethodGet,
+			"/sub2/b",
+			false,
+		},
+		{
+			http.MethodGet,
+			"/sub1/sub2/b",
+			true,
+		},
+		{
+			http.MethodGet,
+			"/sub1/sub2/b/{test}",
+			true,
+		},
+		{
+			http.MethodGet,
+			"/sub1/sub2/b/{test2}",
+			false,
+		},
+		{
+			http.MethodGet,
+			"/c/{test...}",
+			true,
+		},
+		{
+			http.MethodGet,
+			"/d/",
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.method+"_"+s.path, func(t *testing.T) {
+			has := group.HasRoute(s.method, s.path)
+
+			if has != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, has)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/router/rereadable_read_closer.go b/server/core_backend-server/tools/router/rereadable_read_closer.go
new file mode 100644
index 0000000..0e5f5d8
--- /dev/null
+++ b/server/core_backend-server/tools/router/rereadable_read_closer.go
@@ -0,0 +1,60 @@
+package router
+
+import (
+	"bytes"
+	"io"
+)
+
+var (
+	_ io.ReadCloser = (*RereadableReadCloser)(nil)
+	_ Rereader      = (*RereadableReadCloser)(nil)
+)
+
+// Rereader defines an interface for rewindable readers.
+type Rereader interface {
+	Reread()
+}
+
+// RereadableReadCloser defines a wrapper around a io.ReadCloser reader
+// allowing to read the original reader multiple times.
+type RereadableReadCloser struct {
+	io.ReadCloser
+
+	copy   *bytes.Buffer
+	active io.Reader
+}
+
+// Read implements the standard io.Reader interface.
+//
+// It reads up to len(b) bytes into b and at at the same time writes
+// the read data into an internal bytes buffer.
+//
+// On EOF the r is "rewinded" to allow reading from r multiple times.
+func (r *RereadableReadCloser) Read(b []byte) (int, error) {
+	if r.active == nil {
+		if r.copy == nil {
+			r.copy = &bytes.Buffer{}
+		}
+		r.active = io.TeeReader(r.ReadCloser, r.copy)
+	}
+
+	n, err := r.active.Read(b)
+	if err == io.EOF {
+		r.Reread()
+	}
+
+	return n, err
+}
+
+// Reread satisfies the [Rereader] interface and resets the r internal state to allow rereads.
+//
+// note: not named Reset to avoid conflicts with other reader interfaces.
+func (r *RereadableReadCloser) Reread() {
+	if r.copy == nil || r.copy.Len() == 0 {
+		return // nothing to reset or it has been already reset
+	}
+
+	oldCopy := r.copy
+	r.copy = &bytes.Buffer{}
+	r.active = io.TeeReader(oldCopy, r.copy)
+}
diff --git a/server/core_backend-server/tools/router/rereadable_read_closer_test.go b/server/core_backend-server/tools/router/rereadable_read_closer_test.go
new file mode 100644
index 0000000..2334ee6
--- /dev/null
+++ b/server/core_backend-server/tools/router/rereadable_read_closer_test.go
@@ -0,0 +1,28 @@
+package router_test
+
+import (
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+func TestRereadableReadCloser(t *testing.T) {
+	content := "test"
+
+	rereadable := &router.RereadableReadCloser{
+		ReadCloser: io.NopCloser(strings.NewReader(content)),
+	}
+
+	// read multiple times
+	for i := 0; i < 3; i++ {
+		result, err := io.ReadAll(rereadable)
+		if err != nil {
+			t.Fatalf("[read:%d] %v", i, err)
+		}
+		if str := string(result); str != content {
+			t.Fatalf("[read:%d] Expected %q, got %q", i, content, result)
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/router/route.go b/server/core_backend-server/tools/router/route.go
new file mode 100644
index 0000000..351096d
--- /dev/null
+++ b/server/core_backend-server/tools/router/route.go
@@ -0,0 +1,73 @@
+package router
+
+import "github.com/pocketbase/pocketbase/tools/hook"
+
+type Route[T hook.Resolver] struct {
+	excludedMiddlewares map[string]struct{}
+
+	Action      func(e T) error
+	Method      string
+	Path        string
+	Middlewares []*hook.Handler[T]
+}
+
+// BindFunc registers one or multiple middleware functions to the current route.
+//
+// The registered middleware functions are "anonymous" and with default priority,
+// aka. executes in the order they were registered.
+//
+// If you need to specify a named middleware (ex. so that it can be removed)
+// or middleware with custom exec prirority, use the [Route.Bind] method.
+func (route *Route[T]) BindFunc(middlewareFuncs ...func(e T) error) *Route[T] {
+	for _, m := range middlewareFuncs {
+		route.Middlewares = append(route.Middlewares, &hook.Handler[T]{Func: m})
+	}
+
+	return route
+}
+
+// Bind registers one or multiple middleware handlers to the current route.
+func (route *Route[T]) Bind(middlewares ...*hook.Handler[T]) *Route[T] {
+	route.Middlewares = append(route.Middlewares, middlewares...)
+
+	// unmark the newly added middlewares in case they were previously "excluded"
+	if route.excludedMiddlewares != nil {
+		for _, m := range middlewares {
+			if m.Id != "" {
+				delete(route.excludedMiddlewares, m.Id)
+			}
+		}
+	}
+
+	return route
+}
+
+// Unbind removes one or more middlewares with the specified id(s) from the current route.
+//
+// It also adds the removed middleware ids to an exclude list so that they could be skipped from
+// the execution chain in case the middleware is registered in a parent group.
+//
+// Anonymous middlewares are considered non-removable, aka. this method
+// does nothing if the middleware id is an empty string.
+func (route *Route[T]) Unbind(middlewareIds ...string) *Route[T] {
+	for _, middlewareId := range middlewareIds {
+		if middlewareId == "" {
+			continue
+		}
+
+		// remove from the route's middlewares
+		for i := len(route.Middlewares) - 1; i >= 0; i-- {
+			if route.Middlewares[i].Id == middlewareId {
+				route.Middlewares = append(route.Middlewares[:i], route.Middlewares[i+1:]...)
+			}
+		}
+
+		// add to the exclude list
+		if route.excludedMiddlewares == nil {
+			route.excludedMiddlewares = map[string]struct{}{}
+		}
+		route.excludedMiddlewares[middlewareId] = struct{}{}
+	}
+
+	return route
+}
diff --git a/server/core_backend-server/tools/router/route_test.go b/server/core_backend-server/tools/router/route_test.go
new file mode 100644
index 0000000..ef6e541
--- /dev/null
+++ b/server/core_backend-server/tools/router/route_test.go
@@ -0,0 +1,168 @@
+package router
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+func TestRouteBindFunc(t *testing.T) {
+	t.Parallel()
+
+	r := Route[*Event]{}
+
+	calls := ""
+
+	// append one function
+	r.BindFunc(func(e *Event) error {
+		calls += "a"
+		return nil
+	})
+
+	// append multiple functions
+	r.BindFunc(
+		func(e *Event) error {
+			calls += "b"
+			return nil
+		},
+		func(e *Event) error {
+			calls += "c"
+			return nil
+		},
+	)
+
+	if total := len(r.Middlewares); total != 3 {
+		t.Fatalf("Expected %d middlewares, got %v", 3, total)
+	}
+
+	for _, h := range r.Middlewares {
+		_ = h.Func(nil)
+	}
+
+	if calls != "abc" {
+		t.Fatalf("Expected calls sequence %q, got %q", "abc", calls)
+	}
+}
+
+func TestRouteBind(t *testing.T) {
+	t.Parallel()
+
+	r := Route[*Event]{
+		// mock excluded middlewares to check whether the entry will be deleted
+		excludedMiddlewares: map[string]struct{}{"test2": {}},
+	}
+
+	calls := ""
+
+	// append one handler
+	r.Bind(&hook.Handler[*Event]{
+		Func: func(e *Event) error {
+			calls += "a"
+			return nil
+		},
+	})
+
+	// append multiple handlers
+	r.Bind(
+		&hook.Handler[*Event]{
+			Id: "test1",
+			Func: func(e *Event) error {
+				calls += "b"
+				return nil
+			},
+		},
+		&hook.Handler[*Event]{
+			Id: "test2",
+			Func: func(e *Event) error {
+				calls += "c"
+				return nil
+			},
+		},
+	)
+
+	if total := len(r.Middlewares); total != 3 {
+		t.Fatalf("Expected %d middlewares, got %v", 3, total)
+	}
+
+	for _, h := range r.Middlewares {
+		_ = h.Func(nil)
+	}
+
+	if calls != "abc" {
+		t.Fatalf("Expected calls %q, got %q", "abc", calls)
+	}
+
+	// ensures that the previously excluded middleware was removed
+	if len(r.excludedMiddlewares) != 0 {
+		t.Fatalf("Expected test2 to be removed from the excludedMiddlewares list, got %v", r.excludedMiddlewares)
+	}
+}
+
+func TestRouteUnbind(t *testing.T) {
+	t.Parallel()
+
+	r := Route[*Event]{}
+
+	calls := ""
+
+	// anonymous middlewares
+	r.Bind(&hook.Handler[*Event]{
+		Func: func(e *Event) error {
+			calls += "a"
+			return nil // unused value
+		},
+	})
+
+	// middlewares with id
+	r.Bind(&hook.Handler[*Event]{
+		Id: "test1",
+		Func: func(e *Event) error {
+			calls += "b"
+			return nil // unused value
+		},
+	})
+	r.Bind(&hook.Handler[*Event]{
+		Id: "test2",
+		Func: func(e *Event) error {
+			calls += "c"
+			return nil // unused value
+		},
+	})
+	r.Bind(&hook.Handler[*Event]{
+		Id: "test3",
+		Func: func(e *Event) error {
+			calls += "d"
+			return nil // unused value
+		},
+	})
+
+	// remove
+	r.Unbind("") // should be no-op
+	r.Unbind("test1", "test3")
+
+	if total := len(r.Middlewares); total != 2 {
+		t.Fatalf("Expected %d middlewares, got %v", 2, total)
+	}
+
+	for _, h := range r.Middlewares {
+		if err := h.Func(nil); err != nil {
+			continue
+		}
+	}
+
+	if calls != "ac" {
+		t.Fatalf("Expected calls %q, got %q", "ac", calls)
+	}
+
+	// ensure that the id was added in the exclude list
+	excluded := []string{"test1", "test3"}
+	if len(r.excludedMiddlewares) != len(excluded) {
+		t.Fatalf("Expected excludes %v, got %v", excluded, r.excludedMiddlewares)
+	}
+	for id := range r.excludedMiddlewares {
+		if !slices.Contains(excluded, id) {
+			t.Fatalf("Expected %q to be marked as excluded", id)
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/router/router.go b/server/core_backend-server/tools/router/router.go
new file mode 100644
index 0000000..d789ff5
--- /dev/null
+++ b/server/core_backend-server/tools/router/router.go
@@ -0,0 +1,329 @@
+package router
+
+import (
+	"bufio"
+	"encoding/json"
+	"errors"
+	"io"
+	"log"
+	"net"
+	"net/http"
+
+	"github.com/pocketbase/pocketbase/tools/hook"
+)
+
+type EventCleanupFunc func()
+
+// EventFactoryFunc defines the function responsible for creating a Route specific event
+// based on the provided request handler ServeHTTP data.
+//
+// Optionally return a clean up function that will be invoked right after the route execution.
+type EventFactoryFunc[T hook.Resolver] func(w http.ResponseWriter, r *http.Request) (T, EventCleanupFunc)
+
+// Router defines a thin wrapper around the standard Go [http.ServeMux] by
+// adding support for routing sub-groups, middlewares and other common utils.
+//
+// Example:
+//
+//	r := NewRouter[*MyEvent](eventFactory)
+//
+//	// middlewares
+//	r.BindFunc(m1, m2)
+//
+//	// routes
+//	r.GET("/test", handler1)
+//
+//	// sub-routers/groups
+//	api := r.Group("/api")
+//	api.GET("/admins", handler2)
+//
+//	// generate a http.ServeMux instance based on the router configurations
+//	mux, _ := r.BuildMux()
+//
+//	http.ListenAndServe("localhost:8090", mux)
+type Router[T hook.Resolver] struct {
+	// @todo consider renaming the type to just Group and replace the embed type
+	// with an alias after Go 1.24 adds support for generic type aliases
+	*RouterGroup[T]
+
+	eventFactory EventFactoryFunc[T]
+}
+
+// NewRouter creates a new Router instance with the provided event factory function.
+func NewRouter[T hook.Resolver](eventFactory EventFactoryFunc[T]) *Router[T] {
+	return &Router[T]{
+		RouterGroup:  &RouterGroup[T]{},
+		eventFactory: eventFactory,
+	}
+}
+
+// BuildMux constructs a new mux [http.Handler] instance from the current router configurations.
+func (r *Router[T]) BuildMux() (http.Handler, error) {
+	// Note that some of the default std Go handlers like the [http.NotFoundHandler]
+	// cannot be currently extended and requires defining a custom "catch-all" route
+	// so that the group middlewares could be executed.
+	//
+	// https://github.com/golang/go/issues/65648
+	if !r.HasRoute("", "/") {
+		r.Route("", "/", func(e T) error {
+			return NewNotFoundError("", nil)
+		})
+	}
+
+	mux := http.NewServeMux()
+
+	if err := r.loadMux(mux, r.RouterGroup, nil); err != nil {
+		return nil, err
+	}
+
+	return mux, nil
+}
+
+func (r *Router[T]) loadMux(mux *http.ServeMux, group *RouterGroup[T], parents []*RouterGroup[T]) error {
+	for _, child := range group.children {
+		switch v := child.(type) {
+		case *RouterGroup[T]:
+			if err := r.loadMux(mux, v, append(parents, group)); err != nil {
+				return err
+			}
+		case *Route[T]:
+			routeHook := &hook.Hook[T]{}
+
+			var pattern string
+
+			if v.Method != "" {
+				pattern = v.Method + " "
+			}
+
+			// add parent groups middlewares
+			for _, p := range parents {
+				pattern += p.Prefix
+				for _, h := range p.Middlewares {
+					if _, ok := p.excludedMiddlewares[h.Id]; !ok {
+						if _, ok = group.excludedMiddlewares[h.Id]; !ok {
+							if _, ok = v.excludedMiddlewares[h.Id]; !ok {
+								routeHook.Bind(h)
+							}
+						}
+					}
+				}
+			}
+
+			// add current groups middlewares
+			pattern += group.Prefix
+			for _, h := range group.Middlewares {
+				if _, ok := group.excludedMiddlewares[h.Id]; !ok {
+					if _, ok = v.excludedMiddlewares[h.Id]; !ok {
+						routeHook.Bind(h)
+					}
+				}
+			}
+
+			// add current route middlewares
+			pattern += v.Path
+			for _, h := range v.Middlewares {
+				if _, ok := v.excludedMiddlewares[h.Id]; !ok {
+					routeHook.Bind(h)
+				}
+			}
+
+			mux.HandleFunc(pattern, func(resp http.ResponseWriter, req *http.Request) {
+				// wrap the response to add write and status tracking
+				resp = &ResponseWriter{ResponseWriter: resp}
+
+				// wrap the request body to allow multiple reads
+				req.Body = &RereadableReadCloser{ReadCloser: req.Body}
+
+				event, cleanupFunc := r.eventFactory(resp, req)
+
+				// trigger the handler hook chain
+				err := routeHook.Trigger(event, v.Action)
+				if err != nil {
+					ErrorHandler(resp, req, err)
+				}
+
+				if cleanupFunc != nil {
+					cleanupFunc()
+				}
+			})
+		default:
+			return errors.New("invalid Group item type")
+		}
+	}
+
+	return nil
+}
+
+func ErrorHandler(resp http.ResponseWriter, req *http.Request, err error) {
+	if err == nil {
+		return
+	}
+
+	if ok, _ := getWritten(resp); ok {
+		return // a response was already written (aka. already handled)
+	}
+
+	header := resp.Header()
+	if header.Get("Content-Type") == "" {
+		header.Set("Content-Type", "application/json")
+	}
+
+	apiErr := ToApiError(err)
+
+	resp.WriteHeader(apiErr.Status)
+
+	if req.Method != http.MethodHead {
+		if jsonErr := json.NewEncoder(resp).Encode(apiErr); jsonErr != nil {
+			log.Println(jsonErr) // truly rare case, log to stderr only for dev purposes
+		}
+	}
+}
+
+// -------------------------------------------------------------------
+
+type WriteTracker interface {
+	// Written reports whether a write operation has occurred.
+	Written() bool
+}
+
+type StatusTracker interface {
+	// Status reports the written response status code.
+	Status() int
+}
+
+type flushErrorer interface {
+	FlushError() error
+}
+
+var (
+	_ WriteTracker  = (*ResponseWriter)(nil)
+	_ StatusTracker = (*ResponseWriter)(nil)
+	_ http.Flusher  = (*ResponseWriter)(nil)
+	_ http.Hijacker = (*ResponseWriter)(nil)
+	_ http.Pusher   = (*ResponseWriter)(nil)
+	_ io.ReaderFrom = (*ResponseWriter)(nil)
+	_ flushErrorer  = (*ResponseWriter)(nil)
+)
+
+// ResponseWriter wraps a http.ResponseWriter to track its write state.
+type ResponseWriter struct {
+	http.ResponseWriter
+
+	written bool
+	status  int
+}
+
+func (rw *ResponseWriter) WriteHeader(status int) {
+	if rw.written {
+		return
+	}
+
+	rw.written = true
+	rw.status = status
+	rw.ResponseWriter.WriteHeader(status)
+}
+
+func (rw *ResponseWriter) Write(b []byte) (int, error) {
+	if !rw.written {
+		rw.WriteHeader(http.StatusOK)
+	}
+
+	return rw.ResponseWriter.Write(b)
+}
+
+// Written implements [WriteTracker] and returns whether the current response body has been already written.
+func (rw *ResponseWriter) Written() bool {
+	return rw.written
+}
+
+// Written implements [StatusTracker] and returns the written status code of the current response.
+func (rw *ResponseWriter) Status() int {
+	return rw.status
+}
+
+// Flush implements [http.Flusher] and allows an HTTP handler to flush buffered data to the client.
+// This method is no-op if the wrapped writer doesn't support it.
+func (rw *ResponseWriter) Flush() {
+	_ = rw.FlushError()
+}
+
+// FlushError is similar to [Flush] but returns [http.ErrNotSupported]
+// if the wrapped writer doesn't support it.
+func (rw *ResponseWriter) FlushError() error {
+	err := http.NewResponseController(rw.ResponseWriter).Flush()
+	if err == nil || !errors.Is(err, http.ErrNotSupported) {
+		rw.written = true
+	}
+	return err
+}
+
+// Hijack implements [http.Hijacker] and allows an HTTP handler to take over the current connection.
+func (rw *ResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	return http.NewResponseController(rw.ResponseWriter).Hijack()
+}
+
+// Pusher implements [http.Pusher] to indicate HTTP/2 server push support.
+func (rw *ResponseWriter) Push(target string, opts *http.PushOptions) error {
+	w := rw.ResponseWriter
+	for {
+		switch p := w.(type) {
+		case http.Pusher:
+			return p.Push(target, opts)
+		case RWUnwrapper:
+			w = p.Unwrap()
+		default:
+			return http.ErrNotSupported
+		}
+	}
+}
+
+// ReaderFrom implements [io.ReaderFrom] by checking if the underlying writer supports it.
+// Otherwise calls [io.Copy].
+func (rw *ResponseWriter) ReadFrom(r io.Reader) (n int64, err error) {
+	if !rw.written {
+		rw.WriteHeader(http.StatusOK)
+	}
+
+	w := rw.ResponseWriter
+	for {
+		switch rf := w.(type) {
+		case io.ReaderFrom:
+			return rf.ReadFrom(r)
+		case RWUnwrapper:
+			w = rf.Unwrap()
+		default:
+			return io.Copy(rw.ResponseWriter, r)
+		}
+	}
+}
+
+// Unwrap returns the underlying ResponseWritter instance (usually used by [http.ResponseController]).
+func (rw *ResponseWriter) Unwrap() http.ResponseWriter {
+	return rw.ResponseWriter
+}
+
+func getWritten(rw http.ResponseWriter) (bool, error) {
+	for {
+		switch w := rw.(type) {
+		case WriteTracker:
+			return w.Written(), nil
+		case RWUnwrapper:
+			rw = w.Unwrap()
+		default:
+			return false, http.ErrNotSupported
+		}
+	}
+}
+
+func getStatus(rw http.ResponseWriter) (int, error) {
+	for {
+		switch w := rw.(type) {
+		case StatusTracker:
+			return w.Status(), nil
+		case RWUnwrapper:
+			rw = w.Unwrap()
+		default:
+			return 0, http.ErrNotSupported
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/router/router_test.go b/server/core_backend-server/tools/router/router_test.go
new file mode 100644
index 0000000..c71cb70
--- /dev/null
+++ b/server/core_backend-server/tools/router/router_test.go
@@ -0,0 +1,253 @@
+package router_test
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/hook"
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+func TestRouter(t *testing.T) {
+	calls := ""
+
+	r := router.NewRouter(func(w http.ResponseWriter, r *http.Request) (*router.Event, router.EventCleanupFunc) {
+		return &router.Event{
+				Response: w,
+				Request:  r,
+			},
+			func() {
+				calls += ":cleanup"
+			}
+	})
+
+	r.BindFunc(func(e *router.Event) error {
+		calls += "root_m:"
+
+		err := e.Next()
+
+		if err != nil {
+			calls += "/error"
+		}
+
+		return err
+	})
+
+	r.Any("/any", func(e *router.Event) error {
+		calls += "/any"
+		return nil
+	})
+
+	r.GET("/a", func(e *router.Event) error {
+		calls += "/a"
+		return nil
+	})
+
+	g1 := r.Group("/a/b").BindFunc(func(e *router.Event) error {
+		calls += "a_b_group_m:"
+		return e.Next()
+	})
+	g1.GET("/1", func(e *router.Event) error {
+		calls += "/1_get"
+		return nil
+	}).BindFunc(func(e *router.Event) error {
+		calls += "1_get_m:"
+		return e.Next()
+	})
+	g1.POST("/1", func(e *router.Event) error {
+		calls += "/1_post"
+		return nil
+	})
+	g1.GET("/{param}", func(e *router.Event) error {
+		calls += "/" + e.Request.PathValue("param")
+		return errors.New("test") // should be normalized to an ApiError
+	})
+
+	mux, err := r.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ts := httptest.NewServer(mux)
+	defer ts.Close()
+
+	client := ts.Client()
+
+	scenarios := []struct {
+		method string
+		path   string
+		calls  string
+	}{
+		{http.MethodGet, "/any", "root_m:/any:cleanup"},
+		{http.MethodOptions, "/any", "root_m:/any:cleanup"},
+		{http.MethodPatch, "/any", "root_m:/any:cleanup"},
+		{http.MethodPut, "/any", "root_m:/any:cleanup"},
+		{http.MethodPost, "/any", "root_m:/any:cleanup"},
+		{http.MethodDelete, "/any", "root_m:/any:cleanup"},
+		// ---
+		{http.MethodPost, "/a", "root_m:/error:cleanup"}, // missing
+		{http.MethodGet, "/a", "root_m:/a:cleanup"},
+		{http.MethodHead, "/a", "root_m:/a:cleanup"}, // auto registered with the GET
+		{http.MethodGet, "/a/b/1", "root_m:a_b_group_m:1_get_m:/1_get:cleanup"},
+		{http.MethodHead, "/a/b/1", "root_m:a_b_group_m:1_get_m:/1_get:cleanup"},
+		{http.MethodPost, "/a/b/1", "root_m:a_b_group_m:/1_post:cleanup"},
+		{http.MethodGet, "/a/b/456", "root_m:a_b_group_m:/456/error:cleanup"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.method+"_"+s.path, func(t *testing.T) {
+			calls = "" // reset
+
+			req, err := http.NewRequest(s.method, ts.URL+s.path, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			_, err = client.Do(req)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if calls != s.calls {
+				t.Fatalf("Expected calls\n%q\ngot\n%q", s.calls, calls)
+			}
+		})
+	}
+}
+
+func TestRouterUnbind(t *testing.T) {
+	calls := ""
+
+	r := router.NewRouter(func(w http.ResponseWriter, r *http.Request) (*router.Event, router.EventCleanupFunc) {
+		return &router.Event{
+				Response: w,
+				Request:  r,
+			},
+			func() {
+				calls += ":cleanup"
+			}
+	})
+	r.Bind(&hook.Handler[*router.Event]{
+		Id: "root_1",
+		Func: func(e *router.Event) error {
+			calls += "root_1:"
+			return e.Next()
+		},
+	})
+	r.Bind(&hook.Handler[*router.Event]{
+		Id: "root_2",
+		Func: func(e *router.Event) error {
+			calls += "root_2:"
+			return e.Next()
+		},
+	})
+	r.Bind(&hook.Handler[*router.Event]{
+		Id: "root_3",
+		Func: func(e *router.Event) error {
+			calls += "root_3:"
+			return e.Next()
+		},
+	})
+	r.GET("/action", func(e *router.Event) error {
+		calls += "root_action"
+		return nil
+	}).Unbind("root_1")
+
+	ga := r.Group("/group_a")
+	ga.Unbind("root_1")
+	ga.Bind(&hook.Handler[*router.Event]{
+		Id: "group_a_1",
+		Func: func(e *router.Event) error {
+			calls += "group_a_1:"
+			return e.Next()
+		},
+	})
+	ga.Bind(&hook.Handler[*router.Event]{
+		Id: "group_a_2",
+		Func: func(e *router.Event) error {
+			calls += "group_a_2:"
+			return e.Next()
+		},
+	})
+	ga.Bind(&hook.Handler[*router.Event]{
+		Id: "group_a_3",
+		Func: func(e *router.Event) error {
+			calls += "group_a_3:"
+			return e.Next()
+		},
+	})
+	ga.GET("/action", func(e *router.Event) error {
+		calls += "group_a_action"
+		return nil
+	}).Unbind("root_2", "group_b_1", "group_a_1")
+
+	gb := r.Group("/group_b")
+	gb.Unbind("root_2")
+	gb.Bind(&hook.Handler[*router.Event]{
+		Id: "group_b_1",
+		Func: func(e *router.Event) error {
+			calls += "group_b_1:"
+			return e.Next()
+		},
+	})
+	gb.Bind(&hook.Handler[*router.Event]{
+		Id: "group_b_2",
+		Func: func(e *router.Event) error {
+			calls += "group_b_2:"
+			return e.Next()
+		},
+	})
+	gb.Bind(&hook.Handler[*router.Event]{
+		Id: "group_b_3",
+		Func: func(e *router.Event) error {
+			calls += "group_b_3:"
+			return e.Next()
+		},
+	})
+	gb.GET("/action", func(e *router.Event) error {
+		calls += "group_b_action"
+		return nil
+	}).Unbind("group_b_3", "group_a_3", "root_3")
+
+	mux, err := r.BuildMux()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ts := httptest.NewServer(mux)
+	defer ts.Close()
+
+	client := ts.Client()
+
+	scenarios := []struct {
+		method string
+		path   string
+		calls  string
+	}{
+		{http.MethodGet, "/action", "root_2:root_3:root_action:cleanup"},
+		{http.MethodGet, "/group_a/action", "root_3:group_a_2:group_a_3:group_a_action:cleanup"},
+		{http.MethodGet, "/group_b/action", "root_1:group_b_1:group_b_2:group_b_action:cleanup"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.method+"_"+s.path, func(t *testing.T) {
+			calls = "" // reset
+
+			req, err := http.NewRequest(s.method, ts.URL+s.path, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			_, err = client.Do(req)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if calls != s.calls {
+				t.Fatalf("Expected calls\n%q\ngot\n%q", s.calls, calls)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/router/unmarshal_request_data.go b/server/core_backend-server/tools/router/unmarshal_request_data.go
new file mode 100644
index 0000000..099a915
--- /dev/null
+++ b/server/core_backend-server/tools/router/unmarshal_request_data.go
@@ -0,0 +1,342 @@
+package router
+
+import (
+	"encoding"
+	"encoding/json"
+	"errors"
+	"reflect"
+	"regexp"
+	"strconv"
+)
+
+var textUnmarshalerType = reflect.TypeOf((*encoding.TextUnmarshaler)(nil)).Elem()
+
+// JSONPayloadKey is the key for the special UnmarshalRequestData case
+// used for reading serialized json payload without normalization.
+const JSONPayloadKey string = "@jsonPayload"
+
+// UnmarshalRequestData unmarshals url.Values type of data (query, multipart/form-data, etc.) into dst.
+//
+// dst must be a pointer to a map[string]any or struct.
+//
+// If dst is a map[string]any, each data value will be inferred and
+// converted to its bool, numeric, or string equivalent value
+// (refer to inferValue() for the exact rules).
+//
+// If dst is a struct, the following field types are supported:
+//   - bool
+//   - string
+//   - int, int8, int16, int32, int64
+//   - uint, uint8, uint16, uint32, uint64
+//   - float32, float64
+//   - serialized json string if submitted under the special "@jsonPayload" key
+//   - encoding.TextUnmarshaler
+//   - pointer and slice variations of the above primitives (ex. *string, []string, *[]string []*string, etc.)
+//   - named/anonymous struct fields
+//     Dot-notation is used to target nested fields, ex. "nestedStructField.title".
+//   - embedded struct fields
+//     The embedded struct fields are treated by default as if they were defined in their parent struct.
+//     If the embedded struct has a tag matching structTagKey then to set its fields the data keys must be prefixed with that tag
+//     similar to the regular nested struct fields.
+//
+// structTagKey and structPrefix are used only when dst is a struct.
+//
+// structTagKey represents the tag to use to match a data entry with a struct field (defaults to "form").
+// If the struct field doesn't have the structTagKey tag, then the exported struct field name will be used as it is.
+//
+// structPrefix could be provided if all of the data keys are prefixed with a common string
+// and you want the struct field to match only the value without the structPrefix
+// (ex. for "user.name", "user.email" data keys and structPrefix "user", it will match "name" and "email" struct fields).
+//
+// Note that while the method was inspired by binders from echo, gorrila/schema, ozzo-routing
+// and other similar common routing packages, it is not intended to be a drop-in replacement.
+//
+// @todo Consider adding support for dot-notation keys, in addition to the prefix, (ex. parent.child.title) to express nested object keys.
+func UnmarshalRequestData(data map[string][]string, dst any, structTagKey string, structPrefix string) error {
+	if len(data) == 0 {
+		return nil // nothing to unmarshal
+	}
+
+	dstValue := reflect.ValueOf(dst)
+	if dstValue.Kind() != reflect.Pointer {
+		return errors.New("dst must be a pointer")
+	}
+
+	dstValue = dereference(dstValue)
+
+	dstType := dstValue.Type()
+
+	switch dstType.Kind() {
+	case reflect.Map: // map[string]any
+		if dstType.Elem().Kind() != reflect.Interface {
+			return errors.New("dst map value type must be any/interface{}")
+		}
+
+		for k, v := range data {
+			if k == JSONPayloadKey {
+				continue // unmarshaled separately
+			}
+
+			total := len(v)
+
+			if total == 1 {
+				dstValue.SetMapIndex(reflect.ValueOf(k), reflect.ValueOf(inferValue(v[0])))
+			} else {
+				normalized := make([]any, total)
+				for i, vItem := range v {
+					normalized[i] = inferValue(vItem)
+				}
+				dstValue.SetMapIndex(reflect.ValueOf(k), reflect.ValueOf(normalized))
+			}
+		}
+	case reflect.Struct:
+		// set a default tag key
+		if structTagKey == "" {
+			structTagKey = "form"
+		}
+
+		err := unmarshalInStructValue(data, dstValue, structTagKey, structPrefix)
+		if err != nil {
+			return err
+		}
+	default:
+		return errors.New("dst must be a map[string]any or struct")
+	}
+
+	// @jsonPayload
+	//
+	// Special case to scan serialized json string without
+	// normalization alongside the other data values
+	// ---------------------------------------------------------------
+	jsonPayloadValues := data[JSONPayloadKey]
+	for _, payload := range jsonPayloadValues {
+		if err := json.Unmarshal([]byte(payload), dst); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// unmarshalInStructValue unmarshals data into the provided struct reflect.Value fields.
+func unmarshalInStructValue(
+	data map[string][]string,
+	dstStructValue reflect.Value,
+	structTagKey string,
+	structPrefix string,
+) error {
+	dstStructType := dstStructValue.Type()
+
+	for i := 0; i < dstStructValue.NumField(); i++ {
+		fieldType := dstStructType.Field(i)
+
+		tag := fieldType.Tag.Get(structTagKey)
+
+		if tag == "-" || (!fieldType.Anonymous && !fieldType.IsExported()) {
+			continue // disabled or unexported non-anonymous struct field
+		}
+
+		fieldValue := dereference(dstStructValue.Field(i))
+
+		ft := fieldType.Type
+		if ft.Kind() == reflect.Ptr {
+			ft = ft.Elem()
+		}
+
+		isSlice := ft.Kind() == reflect.Slice
+		if isSlice {
+			ft = ft.Elem()
+		}
+
+		name := tag
+		if name == "" && !fieldType.Anonymous {
+			name = fieldType.Name
+		}
+		if name != "" && structPrefix != "" {
+			name = structPrefix + "." + name
+		}
+
+		// (*)encoding.TextUnmarshaler field
+		// ---
+		if ft.Implements(textUnmarshalerType) || reflect.PointerTo(ft).Implements(textUnmarshalerType) {
+			values, ok := data[name]
+			if !ok || len(values) == 0 || !fieldValue.CanSet() {
+				continue // no value to load or the field cannot be set
+			}
+
+			if isSlice {
+				n := len(values)
+				slice := reflect.MakeSlice(fieldValue.Type(), n, n)
+				for i, v := range values {
+					unmarshaler, ok := dereference(slice.Index(i)).Addr().Interface().(encoding.TextUnmarshaler)
+					if ok {
+						if err := unmarshaler.UnmarshalText([]byte(v)); err != nil {
+							return err
+						}
+					}
+				}
+				fieldValue.Set(slice)
+			} else {
+				unmarshaler, ok := fieldValue.Addr().Interface().(encoding.TextUnmarshaler)
+				if ok {
+					if err := unmarshaler.UnmarshalText([]byte(values[0])); err != nil {
+						return err
+					}
+				}
+			}
+			continue
+		}
+
+		// "regular" field
+		// ---
+		if ft.Kind() != reflect.Struct {
+			values, ok := data[name]
+			if !ok || len(values) == 0 || !fieldValue.CanSet() {
+				continue // no value to load
+			}
+
+			if isSlice {
+				n := len(values)
+				slice := reflect.MakeSlice(fieldValue.Type(), n, n)
+				for i, v := range values {
+					if err := setRegularReflectedValue(dereference(slice.Index(i)), v); err != nil {
+						return err
+					}
+				}
+				fieldValue.Set(slice)
+			} else {
+				if err := setRegularReflectedValue(fieldValue, values[0]); err != nil {
+					return err
+				}
+			}
+			continue
+		}
+
+		// structs (embedded or nested)
+		// ---
+		// slice of structs
+		if isSlice {
+			// populating slice of structs is not supported at the moment
+			// because the filling rules are ambiguous
+			continue
+		}
+
+		if tag != "" {
+			structPrefix = tag
+		} else {
+			structPrefix = name // name is empty for anonymous structs -> no prefix
+		}
+
+		if err := unmarshalInStructValue(data, fieldValue, structTagKey, structPrefix); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// dereference returns the underlying value v points to.
+func dereference(v reflect.Value) reflect.Value {
+	for v.Kind() == reflect.Ptr {
+		if v.IsNil() {
+			// initialize with a new value and continue searching
+			v.Set(reflect.New(v.Type().Elem()))
+		}
+		v = v.Elem()
+	}
+	return v
+}
+
+// setRegularReflectedValue sets and casts value into rv.
+func setRegularReflectedValue(rv reflect.Value, value string) error {
+	switch rv.Kind() {
+	case reflect.String:
+		rv.SetString(value)
+	case reflect.Bool:
+		if value == "" {
+			value = "f"
+		}
+
+		v, err := strconv.ParseBool(value)
+		if err != nil {
+			return err
+		}
+
+		rv.SetBool(v)
+	case reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Int:
+		if value == "" {
+			value = "0"
+		}
+
+		v, err := strconv.ParseInt(value, 0, 64)
+		if err != nil {
+			return err
+		}
+
+		rv.SetInt(v)
+	case reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uint:
+		if value == "" {
+			value = "0"
+		}
+
+		v, err := strconv.ParseUint(value, 0, 64)
+		if err != nil {
+			return err
+		}
+
+		rv.SetUint(v)
+	case reflect.Float32, reflect.Float64:
+		if value == "" {
+			value = "0"
+		}
+
+		v, err := strconv.ParseFloat(value, 64)
+		if err != nil {
+			return err
+		}
+
+		rv.SetFloat(v)
+	case reflect.Interface:
+		if rv.CanSet() {
+			rv.Set(reflect.ValueOf(inferValue(value)))
+		}
+	default:
+		return errors.New("unknown value type " + rv.Kind().String())
+	}
+
+	return nil
+}
+
+var inferNumberCharsRegex = regexp.MustCompile(`^[\-\.\d]+$`)
+
+// In order to support more seamlessly both json and multipart/form-data requests,
+// the following normalization rules are applied for plain multipart string values:
+//   - "true" is converted to the json "true"
+//   - "false" is converted to the json "false"
+//   - numeric strings are converted to json number ONLY if the resulted
+//     minimal number string representation is the same as the provided raw string
+//     (aka. scientific notations, "Infinity", "0.0", "0001", etc. are kept as string)
+//   - any other string (empty string too) is left as it is
+func inferValue(raw string) any {
+	switch raw {
+	case "":
+		return raw
+	case "true":
+		return true
+	case "false":
+		return false
+	default:
+		// try to convert to number
+		//
+		// note: expects the provided raw string to match exactly with the minimal string representation of the parsed float
+		if (raw[0] == '-' || (raw[0] >= '0' && raw[0] <= '9')) &&
+			inferNumberCharsRegex.Match([]byte(raw)) {
+			v, err := strconv.ParseFloat(raw, 64)
+			if err == nil && strconv.FormatFloat(v, 'f', -1, 64) == raw {
+				return v
+			}
+		}
+
+		return raw
+	}
+}
diff --git a/server/core_backend-server/tools/router/unmarshal_request_data_test.go b/server/core_backend-server/tools/router/unmarshal_request_data_test.go
new file mode 100644
index 0000000..797719a
--- /dev/null
+++ b/server/core_backend-server/tools/router/unmarshal_request_data_test.go
@@ -0,0 +1,483 @@
+package router_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/router"
+)
+
+func pointer[T any](val T) *T {
+	return &val
+}
+
+func TestUnmarshalRequestData(t *testing.T) {
+	t.Parallel()
+
+	mapData := map[string][]string{
+		"number1": {"1"},
+		"number2": {"2", "3"},
+		"number3": {"2.1", "-3.4"},
+		"number4": {"0", "-0", "0.0001"},
+		"string0": {""},
+		"string1": {"a"},
+		"string2": {"b", "c"},
+		"string3": {
+			"0.0",
+			"-0.0",
+			"000.1",
+			"000001",
+			"-000001",
+			"1.6E-35",
+			"-1.6E-35",
+			"10e100",
+			"1_000_000",
+			"1.000.000",
+			" 123 ",
+			"0b1",
+			"0xFF",
+			"1234A",
+			"Infinity",
+			"-Infinity",
+			"undefined",
+			"null",
+		},
+		"bool1":        {"true"},
+		"bool2":        {"true", "false"},
+		"mixed":        {"true", "123", "test"},
+		"@jsonPayload": {`{"json_a":null,"json_b":123}`, `{"json_c":[1,2,3]}`},
+	}
+
+	structData := map[string][]string{
+		"anyTag":         {"a", "b"},
+		"AnyPtr":         {"b"},
+		"AnySlice":       {"a", "b", "false", ""},
+		"anySlicePtrTag": {"d", "true"},
+		"AnySliceOfPtr":  {"f", "123.456"},
+
+		"stringTag":         {"a", "b"},
+		"StringPtr":         {"b"},
+		"StringSlice":       {"a", "b", "c", ""},
+		"stringSlicePtrTag": {"d", "e"},
+		"StringSliceOfPtr":  {"f", "g"},
+
+		"boolTag":         {"true"},
+		"BoolPtr":         {"true"},
+		"BoolSlice":       {"true", "false", ""},
+		"boolSlicePtrTag": {"false", "false", "true"},
+		"BoolSliceOfPtr":  {"false", "true", "false"},
+
+		"int8Tag":         {"-1", "2"},
+		"Int8Ptr":         {"3"},
+		"Int8Slice":       {"4", "5", ""},
+		"int8SlicePtrTag": {"5", "6"},
+		"Int8SliceOfPtr":  {"7", "8"},
+
+		"int16Tag":         {"-1", "2"},
+		"Int16Ptr":         {"3"},
+		"Int16Slice":       {"4", "5", ""},
+		"int16SlicePtrTag": {"5", "6"},
+		"Int16SliceOfPtr":  {"7", "8"},
+
+		"int32Tag":         {"-1", "2"},
+		"Int32Ptr":         {"3"},
+		"Int32Slice":       {"4", "5", ""},
+		"int32SlicePtrTag": {"5", "6"},
+		"Int32SliceOfPtr":  {"7", "8"},
+
+		"int64Tag":         {"-1", "2"},
+		"Int64Ptr":         {"3"},
+		"Int64Slice":       {"4", "5", ""},
+		"int64SlicePtrTag": {"5", "6"},
+		"Int64SliceOfPtr":  {"7", "8"},
+
+		"intTag":         {"-1", "2"},
+		"IntPtr":         {"3"},
+		"IntSlice":       {"4", "5", ""},
+		"intSlicePtrTag": {"5", "6"},
+		"IntSliceOfPtr":  {"7", "8"},
+
+		"uint8Tag":         {"1", "2"},
+		"Uint8Ptr":         {"3"},
+		"Uint8Slice":       {"4", "5", ""},
+		"uint8SlicePtrTag": {"5", "6"},
+		"Uint8SliceOfPtr":  {"7", "8"},
+
+		"uint16Tag":         {"1", "2"},
+		"Uint16Ptr":         {"3"},
+		"Uint16Slice":       {"4", "5", ""},
+		"uint16SlicePtrTag": {"5", "6"},
+		"Uint16SliceOfPtr":  {"7", "8"},
+
+		"uint32Tag":         {"1", "2"},
+		"Uint32Ptr":         {"3"},
+		"Uint32Slice":       {"4", "5", ""},
+		"uint32SlicePtrTag": {"5", "6"},
+		"Uint32SliceOfPtr":  {"7", "8"},
+
+		"uint64Tag":         {"1", "2"},
+		"Uint64Ptr":         {"3"},
+		"Uint64Slice":       {"4", "5", ""},
+		"uint64SlicePtrTag": {"5", "6"},
+		"Uint64SliceOfPtr":  {"7", "8"},
+
+		"uintTag":         {"1", "2"},
+		"UintPtr":         {"3"},
+		"UintSlice":       {"4", "5", ""},
+		"uintSlicePtrTag": {"5", "6"},
+		"UintSliceOfPtr":  {"7", "8"},
+
+		"float32Tag":         {"-1.2"},
+		"Float32Ptr":         {"1.5", "2.0"},
+		"Float32Slice":       {"1", "2.3", "-0.3", ""},
+		"float32SlicePtrTag": {"-1.3", "3"},
+		"Float32SliceOfPtr":  {"0", "1.2"},
+
+		"float64Tag":         {"-1.2"},
+		"Float64Ptr":         {"1.5", "2.0"},
+		"Float64Slice":       {"1", "2.3", "-0.3", ""},
+		"float64SlicePtrTag": {"-1.3", "3"},
+		"Float64SliceOfPtr":  {"0", "1.2"},
+
+		"timeTag":         {"2009-11-10T15:00:00Z"},
+		"TimePtr":         {"2009-11-10T14:00:00Z", "2009-11-10T15:00:00Z"},
+		"TimeSlice":       {"2009-11-10T14:00:00Z", "2009-11-10T15:00:00Z"},
+		"timeSlicePtrTag": {"2009-11-10T15:00:00Z", "2009-11-10T16:00:00Z"},
+		"TimeSliceOfPtr":  {"2009-11-10T17:00:00Z", "2009-11-10T18:00:00Z"},
+
+		// @jsonPayload fields
+		"@jsonPayload": {
+			`{"payloadA":"test", "shouldBeIgnored": "abc"}`,
+			`{"payloadB":[1,2,3], "payloadC":true}`,
+		},
+
+		// unexported fields or `-` tags
+		"unexperted":                           {"test"},
+		"SkipExported":                         {"test"},
+		"unexportedStructFieldWithoutTag.Name": {"test"},
+		"unexportedStruct.Name":                {"test"},
+
+		// structs
+		"StructWithoutTag.Name": {"test1"},
+		"exportedStruct.Name":   {"test2"},
+
+		// embedded
+		"embed_name":         {"test3"},
+		"embed2.embed_name2": {"test4"},
+	}
+
+	type embed1 struct {
+		Name string `form:"embed_name"  json:"embed_name"`
+	}
+
+	type embed2 struct {
+		Name string `form:"embed_name2" json:"embed_name2"`
+	}
+
+	//nolint
+	type TestStruct struct {
+		Any           any `form:"anyTag" query:"anyTag2"`
+		AnyPtr        *any
+		AnySlice      []any
+		AnySlicePtr   *[]any `form:"anySlicePtrTag"`
+		AnySliceOfPtr []*any
+
+		String           string `form:"stringTag" query:"stringTag2"`
+		StringPtr        *string
+		StringSlice      []string
+		StringSlicePtr   *[]string `form:"stringSlicePtrTag"`
+		StringSliceOfPtr []*string
+
+		Bool           bool `form:"boolTag" query:"boolTag2"`
+		BoolPtr        *bool
+		BoolSlice      []bool
+		BoolSlicePtr   *[]bool `form:"boolSlicePtrTag"`
+		BoolSliceOfPtr []*bool
+
+		Int8           int8 `form:"int8Tag" query:"int8Tag2"`
+		Int8Ptr        *int8
+		Int8Slice      []int8
+		Int8SlicePtr   *[]int8 `form:"int8SlicePtrTag"`
+		Int8SliceOfPtr []*int8
+
+		Int16           int16 `form:"int16Tag" query:"int16Tag2"`
+		Int16Ptr        *int16
+		Int16Slice      []int16
+		Int16SlicePtr   *[]int16 `form:"int16SlicePtrTag"`
+		Int16SliceOfPtr []*int16
+
+		Int32           int32 `form:"int32Tag" query:"int32Tag2"`
+		Int32Ptr        *int32
+		Int32Slice      []int32
+		Int32SlicePtr   *[]int32 `form:"int32SlicePtrTag"`
+		Int32SliceOfPtr []*int32
+
+		Int64           int64 `form:"int64Tag" query:"int64Tag2"`
+		Int64Ptr        *int64
+		Int64Slice      []int64
+		Int64SlicePtr   *[]int64 `form:"int64SlicePtrTag"`
+		Int64SliceOfPtr []*int64
+
+		Int           int `form:"intTag" query:"intTag2"`
+		IntPtr        *int
+		IntSlice      []int
+		IntSlicePtr   *[]int `form:"intSlicePtrTag"`
+		IntSliceOfPtr []*int
+
+		Uint8           uint8 `form:"uint8Tag" query:"uint8Tag2"`
+		Uint8Ptr        *uint8
+		Uint8Slice      []uint8
+		Uint8SlicePtr   *[]uint8 `form:"uint8SlicePtrTag"`
+		Uint8SliceOfPtr []*uint8
+
+		Uint16           uint16 `form:"uint16Tag" query:"uint16Tag2"`
+		Uint16Ptr        *uint16
+		Uint16Slice      []uint16
+		Uint16SlicePtr   *[]uint16 `form:"uint16SlicePtrTag"`
+		Uint16SliceOfPtr []*uint16
+
+		Uint32           uint32 `form:"uint32Tag" query:"uint32Tag2"`
+		Uint32Ptr        *uint32
+		Uint32Slice      []uint32
+		Uint32SlicePtr   *[]uint32 `form:"uint32SlicePtrTag"`
+		Uint32SliceOfPtr []*uint32
+
+		Uint64           uint64 `form:"uint64Tag" query:"uint64Tag2"`
+		Uint64Ptr        *uint64
+		Uint64Slice      []uint64
+		Uint64SlicePtr   *[]uint64 `form:"uint64SlicePtrTag"`
+		Uint64SliceOfPtr []*uint64
+
+		Uint           uint `form:"uintTag" query:"uintTag2"`
+		UintPtr        *uint
+		UintSlice      []uint
+		UintSlicePtr   *[]uint `form:"uintSlicePtrTag"`
+		UintSliceOfPtr []*uint
+
+		Float32           float32 `form:"float32Tag" query:"float32Tag2"`
+		Float32Ptr        *float32
+		Float32Slice      []float32
+		Float32SlicePtr   *[]float32 `form:"float32SlicePtrTag"`
+		Float32SliceOfPtr []*float32
+
+		Float64           float64 `form:"float64Tag" query:"float64Tag2"`
+		Float64Ptr        *float64
+		Float64Slice      []float64
+		Float64SlicePtr   *[]float64 `form:"float64SlicePtrTag"`
+		Float64SliceOfPtr []*float64
+
+		// encoding.TextUnmarshaler
+		Time           time.Time `form:"timeTag" query:"timeTag2"`
+		TimePtr        *time.Time
+		TimeSlice      []time.Time
+		TimeSlicePtr   *[]time.Time `form:"timeSlicePtrTag"`
+		TimeSliceOfPtr []*time.Time
+
+		// @jsonPayload fields
+		JSONPayloadA string `form:"shouldBeIgnored" json:"payloadA"`
+		JSONPayloadB []int  `json:"payloadB"`
+		JSONPayloadC bool   `json:"-"`
+
+		// unexported fields or `-` tags
+		unexported                      string
+		SkipExported                    string `form:"-"`
+		unexportedStructFieldWithoutTag struct {
+			Name string `json:"unexportedStructFieldWithoutTag_name"`
+		}
+		unexportedStructFieldWithTag struct {
+			Name string `json:"unexportedStructFieldWithTag_name"`
+		} `form:"unexportedStruct"`
+
+		// structs
+		StructWithoutTag struct {
+			Name string `json:"StructWithoutTag_name"`
+		}
+		StructWithTag struct {
+			Name string `json:"StructWithTag_name"`
+		} `form:"exportedStruct"`
+
+		// embedded
+		embed1
+		embed2 `form:"embed2"`
+	}
+
+	scenarios := []struct {
+		name   string
+		data   map[string][]string
+		dst    any
+		tag    string
+		prefix string
+		error  bool
+		result string
+	}{
+		{
+			name:   "nil data",
+			data:   nil,
+			dst:    pointer(map[string]any{}),
+			error:  false,
+			result: `{}`,
+		},
+		{
+			name:  "non-pointer map[string]any",
+			data:  mapData,
+			dst:   map[string]any{},
+			error: true,
+		},
+		{
+			name:  "unsupported *map[string]string",
+			data:  mapData,
+			dst:   pointer(map[string]string{}),
+			error: true,
+		},
+		{
+			name:  "unsupported *map[string][]string",
+			data:  mapData,
+			dst:   pointer(map[string][]string{}),
+			error: true,
+		},
+		{
+			name:   "*map[string]any",
+			data:   mapData,
+			dst:    pointer(map[string]any{}),
+			result: `{"bool1":true,"bool2":[true,false],"json_a":null,"json_b":123,"json_c":[1,2,3],"mixed":[true,123,"test"],"number1":1,"number2":[2,3],"number3":[2.1,-3.4],"number4":[0,-0,0.0001],"string0":"","string1":"a","string2":["b","c"],"string3":["0.0","-0.0","000.1","000001","-000001","1.6E-35","-1.6E-35","10e100","1_000_000","1.000.000"," 123 ","0b1","0xFF","1234A","Infinity","-Infinity","undefined","null"]}`,
+		},
+		{
+			name:   "valid pointer struct (all fields)",
+			data:   structData,
+			dst:    &TestStruct{},
+			result: `{"Any":"a","AnyPtr":"b","AnySlice":["a","b",false,""],"AnySlicePtr":["d",true],"AnySliceOfPtr":["f",123.456],"String":"a","StringPtr":"b","StringSlice":["a","b","c",""],"StringSlicePtr":["d","e"],"StringSliceOfPtr":["f","g"],"Bool":true,"BoolPtr":true,"BoolSlice":[true,false,false],"BoolSlicePtr":[false,false,true],"BoolSliceOfPtr":[false,true,false],"Int8":-1,"Int8Ptr":3,"Int8Slice":[4,5,0],"Int8SlicePtr":[5,6],"Int8SliceOfPtr":[7,8],"Int16":-1,"Int16Ptr":3,"Int16Slice":[4,5,0],"Int16SlicePtr":[5,6],"Int16SliceOfPtr":[7,8],"Int32":-1,"Int32Ptr":3,"Int32Slice":[4,5,0],"Int32SlicePtr":[5,6],"Int32SliceOfPtr":[7,8],"Int64":-1,"Int64Ptr":3,"Int64Slice":[4,5,0],"Int64SlicePtr":[5,6],"Int64SliceOfPtr":[7,8],"Int":-1,"IntPtr":3,"IntSlice":[4,5,0],"IntSlicePtr":[5,6],"IntSliceOfPtr":[7,8],"Uint8":1,"Uint8Ptr":3,"Uint8Slice":"BAUA","Uint8SlicePtr":"BQY=","Uint8SliceOfPtr":[7,8],"Uint16":1,"Uint16Ptr":3,"Uint16Slice":[4,5,0],"Uint16SlicePtr":[5,6],"Uint16SliceOfPtr":[7,8],"Uint32":1,"Uint32Ptr":3,"Uint32Slice":[4,5,0],"Uint32SlicePtr":[5,6],"Uint32SliceOfPtr":[7,8],"Uint64":1,"Uint64Ptr":3,"Uint64Slice":[4,5,0],"Uint64SlicePtr":[5,6],"Uint64SliceOfPtr":[7,8],"Uint":1,"UintPtr":3,"UintSlice":[4,5,0],"UintSlicePtr":[5,6],"UintSliceOfPtr":[7,8],"Float32":-1.2,"Float32Ptr":1.5,"Float32Slice":[1,2.3,-0.3,0],"Float32SlicePtr":[-1.3,3],"Float32SliceOfPtr":[0,1.2],"Float64":-1.2,"Float64Ptr":1.5,"Float64Slice":[1,2.3,-0.3,0],"Float64SlicePtr":[-1.3,3],"Float64SliceOfPtr":[0,1.2],"Time":"2009-11-10T15:00:00Z","TimePtr":"2009-11-10T14:00:00Z","TimeSlice":["2009-11-10T14:00:00Z","2009-11-10T15:00:00Z"],"TimeSlicePtr":["2009-11-10T15:00:00Z","2009-11-10T16:00:00Z"],"TimeSliceOfPtr":["2009-11-10T17:00:00Z","2009-11-10T18:00:00Z"],"payloadA":"test","payloadB":[1,2,3],"SkipExported":"","StructWithoutTag":{"StructWithoutTag_name":"test1"},"StructWithTag":{"StructWithTag_name":"test2"},"embed_name":"test3","embed_name2":"test4"}`,
+		},
+		{
+			name:  "non-pointer struct",
+			data:  structData,
+			dst:   TestStruct{},
+			error: true,
+		},
+		{
+			name:  "invalid struct uint value",
+			data:  map[string][]string{"uintTag": {"-1"}},
+			dst:   &TestStruct{},
+			error: true,
+		},
+		{
+			name:  "invalid struct int value",
+			data:  map[string][]string{"intTag": {"abc"}},
+			dst:   &TestStruct{},
+			error: true,
+		},
+		{
+			name:  "invalid struct bool value",
+			data:  map[string][]string{"boolTag": {"abc"}},
+			dst:   &TestStruct{},
+			error: true,
+		},
+		{
+			name:  "invalid struct float value",
+			data:  map[string][]string{"float64Tag": {"abc"}},
+			dst:   &TestStruct{},
+			error: true,
+		},
+		{
+			name:  "invalid struct TextUnmarshaler value",
+			data:  map[string][]string{"timeTag": {"123"}},
+			dst:   &TestStruct{},
+			error: true,
+		},
+		{
+			name: "custom tagKey",
+			data: map[string][]string{
+				"tag1": {"a"},
+				"tag2": {"b"},
+				"tag3": {"c"},
+				"Item": {"d"},
+			},
+			dst: &struct {
+				Item string `form:"tag1" query:"tag2" json:"tag2"`
+			}{},
+			tag:    "query",
+			result: `{"tag2":"b"}`,
+		},
+		{
+			name: "custom prefix",
+			data: map[string][]string{
+				"test.A":     {"1"},
+				"A":          {"2"},
+				"test.alias": {"3"},
+			},
+			dst: &struct {
+				A string
+				B string `form:"alias"`
+			}{},
+			prefix: "test",
+			result: `{"A":"1","B":"3"}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			err := router.UnmarshalRequestData(s.data, s.dst, s.tag, s.prefix)
+
+			hasErr := err != nil
+			if hasErr != s.error {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.error, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			raw, err := json.Marshal(s.dst)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if !bytes.Equal(raw, []byte(s.result)) {
+				t.Fatalf("Expected dst \n%s\ngot\n%s", s.result, raw)
+			}
+		})
+	}
+}
+
+// note: extra unexported checks in addition to the above test as there
+// is no easy way to print nested structs with all their fields.
+func TestUnmarshalRequestDataUnexportedFields(t *testing.T) {
+	t.Parallel()
+
+	//nolint:all
+	type TestStruct struct {
+		Exported string
+
+		unexported string
+		// to ensure that the reflection doesn't take tags with higher priority than the exported state
+		unexportedWithTag string `form:"unexportedWithTag" json:"unexportedWithTag"`
+	}
+
+	dst := &TestStruct{}
+
+	err := router.UnmarshalRequestData(map[string][]string{
+		"Exported": {"test"}, // just for reference
+
+		"Unexported":        {"test"},
+		"unexported":        {"test"},
+		"UnexportedWithTag": {"test"},
+		"unexportedWithTag": {"test"},
+	}, dst, "", "")
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if dst.Exported != "test" {
+		t.Fatalf("Expected the Exported field to be %q, got %q", "test", dst.Exported)
+	}
+
+	if dst.unexported != "" {
+		t.Fatalf("Expected the unexported field to remain empty, got %q", dst.unexported)
+	}
+
+	if dst.unexportedWithTag != "" {
+		t.Fatalf("Expected the unexportedWithTag field to remain empty, got %q", dst.unexportedWithTag)
+	}
+}
diff --git a/server/core_backend-server/tools/routine/routine.go b/server/core_backend-server/tools/routine/routine.go
new file mode 100644
index 0000000..afddd30
--- /dev/null
+++ b/server/core_backend-server/tools/routine/routine.go
@@ -0,0 +1,32 @@
+package routine
+
+import (
+	"log"
+	"runtime/debug"
+	"sync"
+)
+
+// FireAndForget executes f() in a new go routine and auto recovers if panic.
+//
+// **Note:** Use this only if you are not interested in the result of f()
+// and don't want to block the parent go routine.
+func FireAndForget(f func(), wg ...*sync.WaitGroup) {
+	if len(wg) > 0 && wg[0] != nil {
+		wg[0].Add(1)
+	}
+
+	go func() {
+		if len(wg) > 0 && wg[0] != nil {
+			defer wg[0].Done()
+		}
+
+		defer func() {
+			if err := recover(); err != nil {
+				log.Printf("RECOVERED FROM PANIC (safe to ignore): %v", err)
+				log.Println(string(debug.Stack()))
+			}
+		}()
+
+		f()
+	}()
+}
diff --git a/server/core_backend-server/tools/routine/routine_test.go b/server/core_backend-server/tools/routine/routine_test.go
new file mode 100644
index 0000000..dcb6ace
--- /dev/null
+++ b/server/core_backend-server/tools/routine/routine_test.go
@@ -0,0 +1,27 @@
+package routine_test
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/routine"
+)
+
+func TestFireAndForget(t *testing.T) {
+	called := false
+
+	fn := func() {
+		called = true
+		panic("test")
+	}
+
+	wg := &sync.WaitGroup{}
+
+	routine.FireAndForget(fn, wg)
+
+	wg.Wait()
+
+	if !called {
+		t.Error("Expected fn to be called.")
+	}
+}
diff --git a/server/core_backend-server/tools/search/filter.go b/server/core_backend-server/tools/search/filter.go
new file mode 100644
index 0000000..1e397e5
--- /dev/null
+++ b/server/core_backend-server/tools/search/filter.go
@@ -0,0 +1,1042 @@
+package search
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/ganigeorgiev/fexpr"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/store"
+	"github.com/spf13/cast"
+)
+
+// FilterData is a filter expression string following the `fexpr` package grammar.
+//
+// The filter string can also contain dbx placeholder parameters (eg. "title = {:name}"),
+// that will be safely replaced and properly quoted inplace with the placeholderReplacements values.
+//
+// Example:
+//
+//	var filter FilterData = "id = null || (name = 'test' && status = true) || (total >= {:min} && total <= {:max})"
+//	resolver := search.NewSimpleFieldResolver("id", "name", "status")
+//	expr, err := filter.BuildExpr(resolver, dbx.Params{"min": 100, "max": 200})
+type FilterData string
+
+func isPostgres() bool {
+	dbType := strings.ToLower(os.Getenv("DB_TYPE"))
+	return dbType == "postgres" || dbType == "postgresql"
+}
+
+// parsedFilterData holds a cache with previously parsed filter data expressions
+// (initialized with some preallocated empty data map)
+var parsedFilterData = store.New(make(map[string][]fexpr.ExprGroup, 50))
+
+// BuildExpr parses the current filter data and returns a new db WHERE expression.
+//
+// The filter string can also contain dbx placeholder parameters (eg. "title = {:name}"),
+// that will be safely replaced and properly quoted inplace with the placeholderReplacements values.
+//
+// The parsed expressions are limited up to DefaultFilterExprLimit.
+// Use [FilterData.BuildExprWithLimit] if you want to set a custom limit.
+func (f FilterData) BuildExpr(
+	fieldResolver FieldResolver,
+	placeholderReplacements ...dbx.Params,
+) (dbx.Expression, error) {
+	return f.BuildExprWithLimit(fieldResolver, DefaultFilterExprLimit, placeholderReplacements...)
+}
+
+// BuildExpr parses the current filter data and returns a new db WHERE expression.
+//
+// The filter string can also contain dbx placeholder parameters (eg. "title = {:name}"),
+// that will be safely replaced and properly quoted inplace with the placeholderReplacements values.
+func (f FilterData) BuildExprWithLimit(
+	fieldResolver FieldResolver,
+	maxExpressions int,
+	placeholderReplacements ...dbx.Params,
+) (dbx.Expression, error) {
+	raw := string(f)
+
+	// replace the placeholder params in the raw string filter
+	for _, p := range placeholderReplacements {
+		for key, value := range p {
+			var replacement string
+			switch v := value.(type) {
+			case nil:
+				replacement = "null"
+			case bool, float64, float32, int, int64, int32, int16, int8, uint, uint64, uint32, uint16, uint8:
+				replacement = cast.ToString(v)
+			default:
+				replacement = cast.ToString(v)
+
+				// try to json serialize as fallback
+				if replacement == "" {
+					raw, _ := json.Marshal(v)
+					replacement = string(raw)
+				}
+
+				replacement = strconv.Quote(replacement)
+			}
+			raw = strings.ReplaceAll(raw, "{:"+key+"}", replacement)
+		}
+	}
+
+	cacheKey := raw + "/" + strconv.Itoa(maxExpressions)
+
+	if data, ok := parsedFilterData.GetOk(cacheKey); ok {
+		return buildParsedFilterExpr(data, fieldResolver, &maxExpressions)
+	}
+
+	data, err := fexpr.Parse(raw)
+	if err != nil {
+		// depending on the users demand we may allow empty expressions
+		// (aka. expressions consisting only of whitespaces or comments)
+		// but for now disallow them as it seems unnecessary
+		// if errors.Is(err, fexpr.ErrEmpty) {
+		// return dbx.NewExp("1=1"), nil
+		// }
+
+		return nil, err
+	}
+
+	// store in cache
+	// (the limit size is arbitrary and it is there to prevent the cache growing too big)
+	parsedFilterData.SetIfLessThanLimit(cacheKey, data, 500)
+
+	return buildParsedFilterExpr(data, fieldResolver, &maxExpressions)
+}
+
+func buildParsedFilterExpr(data []fexpr.ExprGroup, fieldResolver FieldResolver, maxExpressions *int) (dbx.Expression, error) {
+	if len(data) == 0 {
+		return nil, fexpr.ErrEmpty
+	}
+
+	result := &concatExpr{separator: " "}
+
+	for _, group := range data {
+		var expr dbx.Expression
+		var exprErr error
+
+		switch item := group.Item.(type) {
+		case fexpr.Expr:
+			if *maxExpressions <= 0 {
+				return nil, ErrFilterExprLimit
+			}
+
+			*maxExpressions--
+
+			expr, exprErr = resolveTokenizedExpr(item, fieldResolver)
+		case fexpr.ExprGroup:
+			expr, exprErr = buildParsedFilterExpr([]fexpr.ExprGroup{item}, fieldResolver, maxExpressions)
+		case []fexpr.ExprGroup:
+			expr, exprErr = buildParsedFilterExpr(item, fieldResolver, maxExpressions)
+		default:
+			exprErr = errors.New("unsupported expression item")
+		}
+
+		if exprErr != nil {
+			return nil, exprErr
+		}
+
+		if len(result.parts) > 0 {
+			var op string
+			if group.Join == fexpr.JoinOr {
+				op = "OR"
+			} else {
+				op = "AND"
+			}
+			result.parts = append(result.parts, &opExpr{op})
+		}
+
+		result.parts = append(result.parts, expr)
+	}
+
+	return result, nil
+}
+
+func resolveTokenizedExpr(expr fexpr.Expr, fieldResolver FieldResolver) (dbx.Expression, error) {
+	lResult, lErr := resolveToken(expr.Left, fieldResolver)
+	if lErr != nil || lResult.Identifier == "" {
+		return nil, fmt.Errorf("invalid left operand %q - %v", expr.Left.Literal, lErr)
+	}
+
+	rResult, rErr := resolveToken(expr.Right, fieldResolver)
+	if rErr != nil || rResult.Identifier == "" {
+		return nil, fmt.Errorf("invalid right operand %q - %v", expr.Right.Literal, rErr)
+	}
+
+	return buildResolversExpr(lResult, expr.Op, rResult)
+}
+
+func buildResolversExpr(
+	left *ResolverResult,
+	op fexpr.SignOp,
+	right *ResolverResult,
+) (dbx.Expression, error) {
+	var expr dbx.Expression
+
+	switch op {
+	case fexpr.SignEq, fexpr.SignAnyEq:
+		expr = resolveEqualExpr(true, left, right)
+	case fexpr.SignNeq, fexpr.SignAnyNeq:
+		expr = resolveEqualExpr(false, left, right)
+	case fexpr.SignLike, fexpr.SignAnyLike:
+		// the right side is a column and therefor wrap it with "%" for contains like behavior
+		if len(right.Params) == 0 {
+			expr = dbx.NewExp(fmt.Sprintf("%s LIKE ('%%' || %s || '%%') ESCAPE '\\'", left.Identifier, right.Identifier), left.Params)
+		} else {
+			expr = dbx.NewExp(fmt.Sprintf("%s LIKE %s ESCAPE '\\'", left.Identifier, right.Identifier), mergeParams(left.Params, wrapLikeParams(right.Params)))
+		}
+	case fexpr.SignNlike, fexpr.SignAnyNlike:
+		// the right side is a column and therefor wrap it with "%" for not-contains like behavior
+		if len(right.Params) == 0 {
+			expr = dbx.NewExp(fmt.Sprintf("%s NOT LIKE ('%%' || %s || '%%') ESCAPE '\\'", left.Identifier, right.Identifier), left.Params)
+		} else {
+			expr = dbx.NewExp(fmt.Sprintf("%s NOT LIKE %s ESCAPE '\\'", left.Identifier, right.Identifier), mergeParams(left.Params, wrapLikeParams(right.Params)))
+		}
+	case fexpr.SignLt, fexpr.SignAnyLt:
+		if isPostgres() {
+			expr = resolveOrderingExpr("<", left, right)
+		} else {
+			expr = dbx.NewExp(fmt.Sprintf("%s < %s", left.Identifier, right.Identifier), mergeParams(left.Params, right.Params))
+		}
+	case fexpr.SignLte, fexpr.SignAnyLte:
+		if isPostgres() {
+			expr = resolveOrderingExpr("<=", left, right)
+		} else {
+			expr = dbx.NewExp(fmt.Sprintf("%s <= %s", left.Identifier, right.Identifier), mergeParams(left.Params, right.Params))
+		}
+	case fexpr.SignGt, fexpr.SignAnyGt:
+		if isPostgres() {
+			expr = resolveOrderingExpr(">", left, right)
+		} else {
+			expr = dbx.NewExp(fmt.Sprintf("%s > %s", left.Identifier, right.Identifier), mergeParams(left.Params, right.Params))
+		}
+	case fexpr.SignGte, fexpr.SignAnyGte:
+		if isPostgres() {
+			expr = resolveOrderingExpr(">=", left, right)
+		} else {
+			expr = dbx.NewExp(fmt.Sprintf("%s >= %s", left.Identifier, right.Identifier), mergeParams(left.Params, right.Params))
+		}
+	}
+
+	if expr == nil {
+		return nil, fmt.Errorf("unknown expression operator %q", op)
+	}
+
+	// multi-match expressions
+	if !isAnyMatchOp(op) {
+		if left.MultiMatchSubQuery != nil && right.MultiMatchSubQuery != nil {
+			mm := &manyVsManyExpr{
+				left:  left,
+				right: right,
+				op:    op,
+			}
+
+			expr = dbx.Enclose(dbx.And(expr, mm))
+		} else if left.MultiMatchSubQuery != nil {
+			mm := &manyVsOneExpr{
+				noCoalesce:   left.NoCoalesce,
+				subQuery:     left.MultiMatchSubQuery,
+				op:           op,
+				otherOperand: right,
+			}
+
+			expr = dbx.Enclose(dbx.And(expr, mm))
+		} else if right.MultiMatchSubQuery != nil {
+			mm := &manyVsOneExpr{
+				noCoalesce:   right.NoCoalesce,
+				subQuery:     right.MultiMatchSubQuery,
+				op:           op,
+				otherOperand: left,
+				inverse:      true,
+			}
+
+			expr = dbx.Enclose(dbx.And(expr, mm))
+		}
+	}
+
+	if left.AfterBuild != nil {
+		expr = left.AfterBuild(expr)
+	}
+
+	if right.AfterBuild != nil {
+		expr = right.AfterBuild(expr)
+	}
+
+	return expr, nil
+}
+
+var normalizedIdentifiers = map[string]string{
+	"null": "NULL",
+}
+
+func getNormalizedIdentifiers() map[string]string {
+	if isPostgres() {
+		return map[string]string{
+			"null":  "NULL",
+			"true":  "TRUE",
+			"false": "FALSE",
+		}
+	}
+	return map[string]string{
+		"null":  "NULL",
+		"true":  "1",
+		"false": "0",
+	}
+}
+
+func resolveToken(token fexpr.Token, fieldResolver FieldResolver) (*ResolverResult, error) {
+	switch token.Type {
+	case fexpr.TokenIdentifier:
+		// check for macros
+		// ---
+		if macroFunc, ok := identifierMacros[token.Literal]; ok {
+			placeholder := "t" + security.PseudorandomString(8)
+
+			macroValue, err := macroFunc()
+			if err != nil {
+				return nil, err
+			}
+
+			return &ResolverResult{
+				Identifier: "{:" + placeholder + "}",
+				Params:     dbx.Params{placeholder: macroValue},
+			}, nil
+		}
+
+		// custom resolver
+		// ---
+		result, err := fieldResolver.Resolve(token.Literal)
+		if err != nil || result.Identifier == "" {
+			for k, v := range getNormalizedIdentifiers() {
+				if strings.EqualFold(k, token.Literal) {
+					return &ResolverResult{Identifier: v}, nil
+				}
+			}
+			return nil, err
+		}
+
+		return result, err
+	case fexpr.TokenText:
+		if isPostgres() {
+			// PostgreSQL only:
+			// if we know it is a emty string, use the empty string directly.
+			if token.Literal == "" {
+				return &ResolverResult{Identifier: `''`}, nil
+			}
+		}
+
+		placeholder := "t" + security.PseudorandomString(8)
+
+		return &ResolverResult{
+			Identifier: "{:" + placeholder + "}",
+			Params:     dbx.Params{placeholder: token.Literal},
+		}, nil
+	case fexpr.TokenNumber:
+		if !isPostgres() {
+			placeholder := "t" + security.PseudorandomString(8)
+
+			return &ResolverResult{
+				Identifier: "{:" + placeholder + "}",
+				Params:     dbx.Params{placeholder: cast.ToFloat64(token.Literal)},
+			}, nil
+		}
+
+		// PostgreSQL:
+		// handle a special case (where 1 = 1) where both left and right identifiers are numeric numbers.
+		// Eg: To prevent SQL injection, for query "1=1", dbx will generate "select xxx where $1 = $2" (prepared statement) with params [1, 1].
+		// because we didn't specify the type for both $1 and $2, so PostgreSQL will treat them as text, and expect all params to be text types.
+		// And it failed to cast numeric type `1` to text `"1"` and throws an error:
+		// Error: `failed to encode args[0]: unable to encode 1 into text format for text (OID 25): cannot find encode plan;`
+		// Related Issue:
+		// - https://github.com/jackc/pgx/issues/798,
+		// - https://github.com/jackc/pgx/issues/2307
+		// This is not caused by an issue of pgx, but by the strong type validation of PostgreSQL.
+		//
+		// To fix it, we have two options:
+		// Option 1: add a explict type cast: "{:" + placeholder + "}::numeric",
+		// Option 2: use the number literal directly without a param placeholder.
+		// We have to convert user input to float64 to remove any harmful characters to avoid SQL injection.
+		safeNumberStr := strconv.FormatFloat(cast.ToFloat64(token.Literal), 'f', -1, 64)
+		return &ResolverResult{
+			Identifier: safeNumberStr,
+			Params:     dbx.Params{},
+		}, nil
+	case fexpr.TokenFunction:
+		fn, ok := TokenFunctions[token.Literal]
+		if !ok {
+			return nil, fmt.Errorf("unknown function %q", token.Literal)
+		}
+
+		args, _ := token.Meta.([]fexpr.Token)
+		return fn(func(argToken fexpr.Token) (*ResolverResult, error) {
+			return resolveToken(argToken, fieldResolver)
+		}, args...)
+	}
+
+	return nil, fmt.Errorf("unsupported token type %q", token.Type)
+}
+
+// Resolves = and != expressions in an attempt to minimize the COALESCE
+// usage and to gracefully handle null vs empty string normalizations.
+//
+// The expression `a = "" OR a is null` tends to perform better than
+// `COALESCE(a, "") = ""` since the direct match can be accomplished
+// with a seek while the COALESCE will induce a table scan.
+func resolveEqualExpr(equal bool, left, right *ResolverResult) dbx.Expression {
+	isLeftEmpty := isEmptyIdentifier(left) || (len(left.Params) == 1 && hasEmptyParamValue(left))
+	isRightEmpty := isEmptyIdentifier(right) || (len(right.Params) == 1 && hasEmptyParamValue(right))
+
+	/* SQLite:
+	equalOp := "="
+	nullEqualOp := "IS"
+	*/
+	equalOp := "="
+	nullEqualOp := "IS NOT DISTINCT FROM"
+	concatOp := "OR"
+	nullExpr := "IS NULL"
+
+	if !isPostgres() {
+		nullEqualOp = "IS"
+	}
+
+	if !equal {
+		if !isPostgres() {
+			// always use `IS NOT` instead of `!=` because direct non-equal comparisons
+			// to nullable column values that are actually NULL yields to NULL instead of TRUE, eg.:
+			// `'example' != nullableColumn` -> NULL even if nullableColumn row value is NULL
+			// Note: `select 'non-null-string' != NULL` returns NULL instead of True.
+			equalOp = "IS NOT"
+			nullEqualOp = equalOp
+		} else {
+			// PostgreSQL:
+			// In PostgreSQL, `IS NOT` only works for NULL values, but not for empty strings.
+			// `IS DISTINCT FROM` works like SQLite's `IS NOT`.
+			equalOp = "IS DISTINCT FROM"
+			nullEqualOp = equalOp
+			concatOp = "AND"
+			nullExpr = "IS NOT NULL"
+		}
+	}
+
+	// no coalesce (eg. compare to a json field)
+	// a IS b
+	// a IS NOT b
+	if left.NoCoalesce || right.NoCoalesce {
+		if !isPostgres() {
+			return dbx.NewExp(
+				fmt.Sprintf("%s %s %s", left.Identifier, nullEqualOp, right.Identifier),
+				mergeParams(left.Params, right.Params),
+			)
+		}
+		return dbx.NewExp(
+			typeAwareJoinNoCoalesce(left, nullEqualOp, right),
+			mergeParams(left.Params, right.Params),
+		)
+	}
+
+	// both operands are empty
+	if isLeftEmpty && isRightEmpty {
+		return dbx.NewExp(fmt.Sprintf("'' %s ''", equalOp), mergeParams(left.Params, right.Params))
+	}
+
+	// direct compare since at least one of the operands is known to be non-empty
+	// eg. a = 'example'
+	if isKnownNonEmptyIdentifier(left) || isKnownNonEmptyIdentifier(right) {
+		if !isPostgres() {
+			leftIdentifier := left.Identifier
+			if isLeftEmpty {
+				leftIdentifier = "''"
+			}
+			rightIdentifier := right.Identifier
+			if isRightEmpty {
+				rightIdentifier = "''"
+			}
+			return dbx.NewExp(
+				fmt.Sprintf("%s %s %s", leftIdentifier, equalOp, rightIdentifier),
+				mergeParams(left.Params, right.Params),
+			)
+		}
+		return dbx.NewExp(
+			typeAwareJoinNoCoalesce(left, equalOp, right),
+			mergeParams(left.Params, right.Params),
+		)
+	}
+
+	// Hint: In PocketBase's world, NULL is treated the same as empty.
+	// "" = b OR b IS NULL
+	// "" IS NOT b AND b IS NOT NULL
+	if isLeftEmpty {
+		if !isPostgres() {
+			return dbx.NewExp(
+				fmt.Sprintf("('' %s %s %s %s %s)", equalOp, right.Identifier, concatOp, right.Identifier, nullExpr),
+				mergeParams(left.Params, right.Params),
+			)
+		}
+		return dbx.NewExp(
+			fmt.Sprintf("('' %s %s %s %s %s)", equalOp, withNonJsonbType(right.Identifier, "text"), concatOp, right.Identifier, nullExpr),
+			mergeParams(left.Params, right.Params),
+		)
+	}
+
+	// a = "" OR a IS NULL
+	// a IS NOT "" AND a IS NOT NULL
+	if isRightEmpty {
+		if !isPostgres() {
+			return dbx.NewExp(
+				fmt.Sprintf("(%s %s '' %s %s %s)", left.Identifier, equalOp, concatOp, left.Identifier, nullExpr),
+				mergeParams(left.Params, right.Params),
+			)
+		}
+		return dbx.NewExp(
+			fmt.Sprintf("(%s %s '' %s %s %s)", withNonJsonbType(left.Identifier, "text"), equalOp, concatOp, left.Identifier, nullExpr),
+			mergeParams(left.Params, right.Params),
+		)
+	}
+
+	if !isPostgres() {
+		// fallback to a COALESCE comparison
+		return dbx.NewExp(
+			fmt.Sprintf(
+				"COALESCE(%s, '') %s COALESCE(%s, '')",
+				left.Identifier,
+				equalOp,
+				right.Identifier,
+			),
+			mergeParams(left.Params, right.Params),
+		)
+	}
+	// PostgreSQL:
+	return dbx.NewExp(
+		fmt.Sprintf("%s %s %s", castToJsonb(left), nullEqualOp, castToJsonb(right)),
+		mergeParams(left.Params, right.Params),
+	)
+}
+
+// PostgreSQL only:
+func resolveOrderingExpr(op string, l, r *ResolverResult) dbx.Expression {
+	left := l.Identifier
+	right := r.Identifier
+	lType := inferDeterministicType(l)
+	rType := inferDeterministicType(r)
+
+	// If both sides have different deterministic types, try to convert one side to the other side's type.
+	// Eg:
+	// - jsonb('2025') > 2024   => Invalid, Convert to numeric
+	if lType != "" && rType != "" && lType != rType {
+		// If either type is numeric, convert to numeric
+		if lType == "numeric" {
+			right = withNonJsonbType(right, "numeric")
+		} else if rType == "numeric" {
+			left = withNonJsonbType(left, "numeric")
+		} else {
+			// Otherwise, convert both sides to text type for comparison.
+			//
+			// Possible cases:
+			// - date vs non-numeric:  '2025-05-01'::date > '2025-05-01'::text
+			// - bool vs non-numeric:  true > 'true'::text
+			// - text vs non-numeric:  'abc'::text > '2025-05-01'::date
+			// - jsonb vs non-numeric: to_jsonb('abc') > '2025-05-01'::text
+			//
+			// We cannot cast date, bool, text, jsonb types to numeric types. (false::numeric throws errors)
+			// So we simply cast both sides to text type for comparison.
+			//
+			// Note: we cannot simply use `to_jsonb()` here to erase the type because
+			// jsonb does byte-wise comparison instead of semantic comparison. Eg:
+			// to_jsonb('2026'::text) < to_jsonb(2026)  => Valid, returns false
+			left = withNonJsonbType(left, "text")
+			right = withNonJsonbType(right, "text")
+		}
+	}
+
+	return dbx.NewExp(
+		fmt.Sprintf("%s %s %s", left, op, right),
+		mergeParams(l.Params, r.Params),
+	)
+}
+
+// PostgreSQL only:
+// PostgreSQL lets us write '2024-09-03' and use it as a date, timestamp, text, etc., without explicit casts every time.
+// Normally, when we use `SELECT col_text = 'abc'`, the type of 'abc' can be automatically infered to `text`.
+// However, when used with `to_jsonb('abc')` function, the type of 'abc' is not determistic, because to_jsonb() can
+// handle many different types. So we need to add explicit type hints before using in to_jsonb().
+//
+// Currently, it only affects:
+// 1. NULL
+// 2. String Params in PreparedStatements.
+// 3. Numeric Params in PreparedStatements.
+//
+// Only used with `to_jsonb`
+func castToJsonb(identifier *ResolverResult) string {
+	if isNullIdentifier(identifier) {
+		return "to_jsonb(NULL::text)"
+	}
+	if tp := inferPolymorphicLiteral(identifier); tp != "" {
+		return fmt.Sprintf("to_jsonb(%s::%s)", identifier.Identifier, tp)
+	}
+	return fmt.Sprintf("to_jsonb(%s)", identifier.Identifier)
+}
+
+// There are some json types:
+// 1. null    -> Undetermine Polymorphic Type, can be any PostgreSQL types
+// 2. text    -> Undetermine Polymorphic Type, can be Date, TimeStamp, text, etc.
+// 3. numbers -> Deterministic type, always numeric, no type cast needed
+// 4. bool    -> Deterministic type, always boolean, no type cast needed
+//
+// Only NULL and text types are considered polymorphic types.
+func inferPolymorphicLiteral(result *ResolverResult) string {
+	// Note: result cannot be "NULL" identifier when called in [inferPolymorphicLiteral],
+	// because we already handled "NULL" seperately before calling this function.
+	// See [resolveEqualExpr] for details.
+	if isNullIdentifier(result) {
+		return "null"
+	}
+
+	if result.Identifier == `''` {
+		return "text"
+	}
+
+	if len(result.Params) == 1 {
+		for _, p := range result.Params {
+			switch p.(type) {
+			case nil:
+				panic("Unexpected nil type, nil is supposed to be parsed as NULL identifier")
+			case string:
+				return "text"
+			}
+		}
+	}
+	return ""
+}
+
+// There are some json types:
+// 1. null    -> Undetermine Polymorphic Type, can be any PostgreSQL types
+// 2. text    -> Undetermine Polymorphic Type, can be Date, TimeStamp, text, etc.
+// 3. numbers -> Deterministic type, always numeric, no type cast needed
+// 4. bool    -> Deterministic type, always boolean, no type cast needed
+func inferDeterministicType(result *ResolverResult) string {
+	// If there is a explict type cast suffix, then we can use it to determine the type.
+	match := regexRightMostTypeCast.FindStringSubmatch(strings.TrimRight(result.Identifier, " "))
+	if len(match) > 0 {
+		// can be any explict type: "text", "jsonb", "numeric", etc.
+		return match[1]
+	}
+
+	// If the type is boolean, we can use it directly.
+	if strings.ToLower(result.Identifier) == "true" || strings.ToLower(result.Identifier) == "false" {
+		return "boolean"
+	}
+
+	// If the type is numbers, we can use it directly.
+	if _, err := strconv.ParseFloat(result.Identifier, 64); err == nil {
+		return "numeric"
+	}
+	if strings.HasPrefix(result.Identifier, "{:") && len(result.Params) == 1 {
+		for _, p := range result.Params {
+			switch p.(type) {
+			case int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64, float32, float64:
+				return "numeric"
+			}
+		}
+	}
+
+	return ""
+}
+
+var regexRightMostTypeCast = regexp.MustCompile(`::(\w+)$`)
+
+// PostgreSQL only:
+// If either left or right identifier has a specific type cast, we need to add the same type cast to the other identifier.
+func typeAwareJoinNoCoalesce(l *ResolverResult, op string, r *ResolverResult) string {
+	left := strings.TrimRight(l.Identifier, " ")
+	right := strings.TrimRight(r.Identifier, " ")
+
+	leftType := inferDeterministicType(l)
+	rightType := inferDeterministicType(r)
+	if len(leftType) > 0 && len(rightType) > 0 {
+		// If left and right identifiers have different type cast, force cast both identifiers
+		// to `jsonb`` type to bypass PostgreSQL's strict type validation error.
+		if leftType != rightType {
+			if leftType != "jsonb" {
+				left = castToJsonb(l)
+			}
+			if rightType != "jsonb" {
+				right = castToJsonb(r)
+			}
+		}
+		// If both identifiers have the same type cast, return it directly.
+		return fmt.Sprintf("%s %s %s", left, op, right)
+	}
+	// If none of the identifiers have type cast
+	if len(leftType) == 0 && len(rightType) == 0 {
+		// Handle special cases:
+		// `PREPARE statement AS SELECT null IS DISTINCT FROM $1` will throw error: "could not determine data type of parameter $1"
+		if isNullIdentifier(l) && inferPolymorphicLiteral(r) == "text" {
+			right = withNonJsonbType(right, "text")
+		} else if isNullIdentifier(r) && inferPolymorphicLiteral(l) == "text" {
+			left = withNonJsonbType(left, "text")
+		}
+		return fmt.Sprintf("%s %s %s", left, op, right)
+	}
+	if len(leftType) > 0 {
+		if leftType == "jsonb" {
+			// implict cast is not possible for jsonb type
+			right = castToJsonb(r)
+		}
+
+		// LeftType is Deterministic, RightType is Polymorphic, allow PostgreSQL to do auto implict cast.
+		return fmt.Sprintf("%s %s %s", left, op, right)
+	}
+	if len(rightType) > 0 {
+		if rightType == "jsonb" {
+			left = castToJsonb(l)
+		}
+
+		return fmt.Sprintf("%s %s %s", left, op, right)
+	}
+	panic("should not reach here")
+}
+
+// PostgreSQL only:
+func withNonJsonbType(identifier string, targetType string) string {
+	// Note:
+	// DO NOT drop existing type cast before adding a new cast.
+	// Reason: `1::numeric::text` is valid but `1::text` is invalid.
+	suffix := "::" + targetType
+	if strings.HasSuffix(identifier, suffix) {
+		return identifier
+	}
+	return identifier + suffix
+}
+
+func hasEmptyParamValue(result *ResolverResult) bool {
+	for _, p := range result.Params {
+		switch v := p.(type) {
+		case nil:
+			return true
+		case string:
+			if v == "" {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+func isKnownNonEmptyIdentifier(result *ResolverResult) bool {
+	switch strings.ToLower(result.Identifier) {
+	case "1", "0", "false", `true`:
+		return true
+	}
+
+	if len(result.Params) == 0 {
+		if _, err := strconv.ParseFloat(result.Identifier, 64); err == nil {
+			return true
+		}
+	}
+
+	return len(result.Params) > 0 && !hasEmptyParamValue(result) && !isEmptyIdentifier(result)
+}
+
+func isNullIdentifier(result *ResolverResult) bool {
+	return strings.EqualFold(result.Identifier, "null")
+}
+
+func isEmptyIdentifier(result *ResolverResult) bool {
+	switch strings.ToLower(result.Identifier) {
+	case "", "null", "''", `""`, "``":
+		return true
+	default:
+		return false
+	}
+}
+
+func isAnyMatchOp(op fexpr.SignOp) bool {
+	switch op {
+	case
+		fexpr.SignAnyEq,
+		fexpr.SignAnyNeq,
+		fexpr.SignAnyLike,
+		fexpr.SignAnyNlike,
+		fexpr.SignAnyLt,
+		fexpr.SignAnyLte,
+		fexpr.SignAnyGt,
+		fexpr.SignAnyGte:
+		return true
+	}
+
+	return false
+}
+
+// mergeParams returns new dbx.Params where each provided params item
+// is merged in the order they are specified.
+func mergeParams(params ...dbx.Params) dbx.Params {
+	result := dbx.Params{}
+
+	for _, p := range params {
+		for k, v := range p {
+			result[k] = v
+		}
+	}
+
+	return result
+}
+
+// @todo consider adding support for custom single character wildcard
+//
+// wrapLikeParams wraps each provided param value string with `%`
+// if the param doesn't contain an explicit wildcard (`%`) character already.
+func wrapLikeParams(params dbx.Params) dbx.Params {
+	result := dbx.Params{}
+
+	for k, v := range params {
+		vStr := cast.ToString(v)
+		if !containsUnescapedChar(vStr, '%') {
+			// note: this is done to minimize the breaking changes and to preserve the original autoescape behavior
+			vStr = escapeUnescapedChars(vStr, '\\', '%', '_')
+			vStr = "%" + vStr + "%"
+		}
+		result[k] = vStr
+	}
+
+	return result
+}
+
+func escapeUnescapedChars(str string, escapeChars ...rune) string {
+	rs := []rune(str)
+	total := len(rs)
+	result := make([]rune, 0, total)
+
+	var match bool
+
+	for i := total - 1; i >= 0; i-- {
+		if match {
+			// check if already escaped
+			if rs[i] != '\\' {
+				result = append(result, '\\')
+			}
+			match = false
+		} else {
+			for _, ec := range escapeChars {
+				if rs[i] == ec {
+					match = true
+					break
+				}
+			}
+		}
+
+		result = append(result, rs[i])
+
+		// in case the matching char is at the beginning
+		if i == 0 && match {
+			result = append(result, '\\')
+		}
+	}
+
+	// reverse
+	for i, j := 0, len(result)-1; i < j; i, j = i+1, j-1 {
+		result[i], result[j] = result[j], result[i]
+	}
+
+	return string(result)
+}
+
+func containsUnescapedChar(str string, ch rune) bool {
+	var prev rune
+
+	for _, c := range str {
+		if c == ch && prev != '\\' {
+			return true
+		}
+
+		if c == '\\' && prev == '\\' {
+			prev = rune(0) // reset escape sequence
+		} else {
+			prev = c
+		}
+	}
+
+	return false
+}
+
+// -------------------------------------------------------------------
+
+var _ dbx.Expression = (*opExpr)(nil)
+
+// opExpr defines an expression that contains a raw sql operator string.
+type opExpr struct {
+	op string
+}
+
+// Build converts the expression into a SQL fragment.
+//
+// Implements [dbx.Expression] interface.
+func (e *opExpr) Build(db *dbx.DB, params dbx.Params) string {
+	return e.op
+}
+
+// -------------------------------------------------------------------
+
+var _ dbx.Expression = (*concatExpr)(nil)
+
+// concatExpr defines an expression that concatenates multiple
+// other expressions with a specified separator.
+type concatExpr struct {
+	separator string
+	parts     []dbx.Expression
+}
+
+// Build converts the expression into a SQL fragment.
+//
+// Implements [dbx.Expression] interface.
+func (e *concatExpr) Build(db *dbx.DB, params dbx.Params) string {
+	if len(e.parts) == 0 {
+		return ""
+	}
+
+	stringParts := make([]string, 0, len(e.parts))
+
+	for _, p := range e.parts {
+		if p == nil {
+			continue
+		}
+
+		if sql := p.Build(db, params); sql != "" {
+			stringParts = append(stringParts, sql)
+		}
+	}
+
+	// skip extra parenthesis for single concat expression
+	if len(stringParts) == 1 &&
+		// check for already concatenated raw/plain expressions
+		!strings.Contains(strings.ToUpper(stringParts[0]), " AND ") &&
+		!strings.Contains(strings.ToUpper(stringParts[0]), " OR ") {
+		return stringParts[0]
+	}
+
+	return "(" + strings.Join(stringParts, e.separator) + ")"
+}
+
+// -------------------------------------------------------------------
+
+var _ dbx.Expression = (*manyVsManyExpr)(nil)
+
+// manyVsManyExpr constructs a multi-match many<->many db where expression.
+//
+// Expects leftSubQuery and rightSubQuery to return a subquery with a
+// single "multiMatchValue" column.
+type manyVsManyExpr struct {
+	left  *ResolverResult
+	right *ResolverResult
+	op    fexpr.SignOp
+}
+
+// Build converts the expression into a SQL fragment.
+//
+// Implements [dbx.Expression] interface.
+func (e *manyVsManyExpr) Build(db *dbx.DB, params dbx.Params) string {
+	if e.left.MultiMatchSubQuery == nil || e.right.MultiMatchSubQuery == nil {
+		return "0=1"
+	}
+
+	lAlias := "__ml" + security.PseudorandomString(8)
+	rAlias := "__mr" + security.PseudorandomString(8)
+
+	whereExpr, buildErr := buildResolversExpr(
+		&ResolverResult{
+			NoCoalesce: e.left.NoCoalesce,
+			Identifier: "[[" + lAlias + ".multiMatchValue]]",
+		},
+		e.op,
+		&ResolverResult{
+			NoCoalesce: e.right.NoCoalesce,
+			Identifier: "[[" + rAlias + ".multiMatchValue]]",
+			// note: the AfterBuild needs to be handled only once and it
+			// doesn't matter whether it is applied on the left or right subquery operand
+			AfterBuild: dbx.Not, // inverse for the not-exist expression
+		},
+	)
+
+	if buildErr != nil {
+		return "0=1"
+	}
+
+	return fmt.Sprintf(
+		/* SQLite:
+		"NOT EXISTS (SELECT 1 FROM (%s) {{%s}} LEFT JOIN (%s) {{%s}} WHERE %s)",
+		*/
+		// PostgreSQL:
+		"NOT EXISTS (SELECT 1 FROM (%s) {{%s}} LEFT JOIN (%s) {{%s}} ON 1 = 1 WHERE %s)",
+		e.left.MultiMatchSubQuery.Build(db, params),
+		lAlias,
+		e.right.MultiMatchSubQuery.Build(db, params),
+		rAlias,
+		whereExpr.Build(db, params),
+	)
+}
+
+// -------------------------------------------------------------------
+
+var _ dbx.Expression = (*manyVsOneExpr)(nil)
+
+// manyVsOneExpr constructs a multi-match many<->one db where expression.
+//
+// Expects subQuery to return a subquery with a single "multiMatchValue" column.
+//
+// You can set inverse=false to reverse the condition sides (aka. one<->many).
+type manyVsOneExpr struct {
+	otherOperand *ResolverResult
+	subQuery     dbx.Expression
+	op           fexpr.SignOp
+	inverse      bool
+	noCoalesce   bool
+}
+
+// Build converts the expression into a SQL fragment.
+//
+// Implements [dbx.Expression] interface.
+func (e *manyVsOneExpr) Build(db *dbx.DB, params dbx.Params) string {
+	if e.subQuery == nil {
+		return "0=1"
+	}
+
+	alias := "__sm" + security.PseudorandomString(8)
+
+	r1 := &ResolverResult{
+		NoCoalesce: e.noCoalesce,
+		Identifier: "[[" + alias + ".multiMatchValue]]",
+		AfterBuild: dbx.Not, // inverse for the not-exist expression
+	}
+
+	r2 := &ResolverResult{
+		Identifier: e.otherOperand.Identifier,
+		Params:     e.otherOperand.Params,
+	}
+
+	var whereExpr dbx.Expression
+	var buildErr error
+
+	if e.inverse {
+		whereExpr, buildErr = buildResolversExpr(r2, e.op, r1)
+	} else {
+		whereExpr, buildErr = buildResolversExpr(r1, e.op, r2)
+	}
+
+	if buildErr != nil {
+		return "0=1"
+	}
+
+	return fmt.Sprintf(
+		"NOT EXISTS (SELECT 1 FROM (%s) {{%s}} WHERE %s)",
+		e.subQuery.Build(db, params),
+		alias,
+		whereExpr.Build(db, params),
+	)
+}
diff --git a/server/core_backend-server/tools/search/filter_test.go b/server/core_backend-server/tools/search/filter_test.go
new file mode 100644
index 0000000..a3fd197
--- /dev/null
+++ b/server/core_backend-server/tools/search/filter_test.go
@@ -0,0 +1,470 @@
+package search_test
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"regexp"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+func TestFilterDataBuildExpr(t *testing.T) {
+	resolver := search.NewSimpleFieldResolver("test1", "test2", "test3", `^test4_\w+$`, `^test5\.[\w\.\:]*\w+$`)
+
+	scenarios := []struct {
+		name          string
+		filterData    search.FilterData
+		expectError   bool
+		expectPattern string
+	}{
+		{
+			"empty",
+			"",
+			true,
+			"",
+		},
+		{
+			"invalid format",
+			"(test1 > 1",
+			true,
+			"",
+		},
+		{
+			"invalid operator",
+			"test1 + 123",
+			true,
+			"",
+		},
+		{
+			"unknown field",
+			"test1 = 'example' && unknown > 1",
+			true,
+			"",
+		},
+		{
+			"simple expression",
+			"test1 > 1",
+			false,
+			/* SQLite:
+			"[[test1]] > {:TEST}",
+			*/
+			// PostgreSQL:
+			"[[test1]] > 1",
+		},
+		{
+			"empty string vs null",
+			"'' = null && null != ''",
+			false,
+			/* SQLite:
+			"('' = '' AND '' IS NOT '')",
+			*/
+			// PostgreSQL:
+			"('' = '' AND '' IS DISTINCT FROM '')",
+		},
+		{
+			"like with 2 columns",
+			"test1 ~ test2",
+			false,
+			"[[test1]] LIKE ('%' || [[test2]] || '%') ESCAPE '\\'",
+		},
+		{
+			"like with right column operand",
+			"'lorem' ~ test1",
+			false,
+			"{:TEST} LIKE ('%' || [[test1]] || '%') ESCAPE '\\'",
+		},
+		{
+			"like with left column operand and text as right operand",
+			"test1 ~ 'lorem'",
+			false,
+			"[[test1]] LIKE {:TEST} ESCAPE '\\'",
+		},
+		{
+			"not like with 2 columns",
+			"test1 !~ test2",
+			false,
+			"[[test1]] NOT LIKE ('%' || [[test2]] || '%') ESCAPE '\\'",
+		},
+		{
+			"not like with right column operand",
+			"'lorem' !~ test1",
+			false,
+			"{:TEST} NOT LIKE ('%' || [[test1]] || '%') ESCAPE '\\'",
+		},
+		{
+			"like with left column operand and text as right operand",
+			"test1 !~ 'lorem'",
+			false,
+			"[[test1]] NOT LIKE {:TEST} ESCAPE '\\'",
+		},
+		{
+			"nested json no coalesce",
+			"test5.a = test5.b || test5.c != test5.d",
+			false,
+			/* SQLite:
+			"(JSON_EXTRACT([[test5]], '$.a') IS JSON_EXTRACT([[test5]], '$.b') OR JSON_EXTRACT([[test5]], '$.c') IS NOT JSON_EXTRACT([[test5]], '$.d'))",
+			,
+			*/
+			// PostgreSQL:
+			`(JSON_QUERY([[test5]]::jsonb, '$.a')::jsonb IS NOT DISTINCT FROM JSON_QUERY([[test5]]::jsonb, '$.b')::jsonb OR JSON_QUERY([[test5]]::jsonb, '$.c')::jsonb IS DISTINCT FROM JSON_QUERY([[test5]]::jsonb, '$.d')::jsonb)`,
+		},
+		{
+			"macros",
+			`
+				test4_1 > @now &&
+				test4_2 > @second &&
+				test4_3 > @minute &&
+				test4_4 > @hour &&
+				test4_5 > @day &&
+				test4_6 > @year &&
+				test4_7 > @month &&
+				test4_9 > @weekday &&
+				test4_9 > @todayStart &&
+				test4_10 > @todayEnd &&
+				test4_11 > @monthStart &&
+				test4_12 > @monthEnd &&
+				test4_13 > @yearStart &&
+				test4_14 > @yearEnd
+			`,
+			false,
+			/* SQLite:
+			"([[test4_1]] > {:TEST} AND [[test4_2]] > {:TEST} AND [[test4_3]] > {:TEST} AND [[test4_4]] > {:TEST} AND [[test4_5]] > {:TEST} AND [[test4_6]] > {:TEST} AND [[test4_7]] > {:TEST} AND [[test4_9]] > {:TEST} AND [[test4_9]] > {:TEST} AND [[test4_10]] > {:TEST} AND [[test4_11]] > {:TEST} AND [[test4_12]] > {:TEST} AND [[test4_13]] > {:TEST} AND [[test4_14]] > {:TEST})",
+			*/
+			// PostgreSQL:
+			`([[test4_1]] > {:TEST} AND [[test4_2]] > {:TEST} AND [[test4_3]] > {:TEST} AND [[test4_4]] > {:TEST} AND [[test4_5]] > {:TEST} AND [[test4_6]] > {:TEST} AND [[test4_7]] > {:TEST} AND [[test4_9]] > {:TEST} AND [[test4_9]] > {:TEST} AND [[test4_10]] > {:TEST} AND [[test4_11]] > {:TEST} AND [[test4_12]] > {:TEST} AND [[test4_13]] > {:TEST} AND [[test4_14]] > {:TEST})`,
+		},
+		{
+			"complex expression",
+			"((test1 > 1) || (test2 != 2)) && test3 ~ '%%example' && test4_sub = null",
+			false,
+			/* SQLite:
+			"(([[test1]] > {:TEST} OR [[test2]] IS NOT {:TEST}) AND [[test3]] LIKE {:TEST} ESCAPE '\\' AND ([[test4_sub]] = '' OR [[test4_sub]] IS NULL))",
+			*/
+			// PostgreSQL:
+			`(([[test1]] > 1 OR [[test2]] IS DISTINCT FROM 2) AND [[test3]] LIKE {:TEST} ESCAPE '\' AND ([[test4_sub]]::text = '' OR [[test4_sub]] IS NULL))`,
+		},
+		{
+			"combination of special literals (null, true, false)",
+			"test1=true && test2 != false && null = test3 || null != test4_sub",
+			false,
+			/* SQLite:
+			"([[test1]] = 1 AND [[test2]] IS NOT 0 AND ('' = [[test3]] OR [[test3]] IS NULL) OR ('' IS NOT [[test4_sub]] AND [[test4_sub]] IS NOT NULL))",
+			*/
+			// PostgreSQL:
+			`([[test1]] = TRUE AND [[test2]] IS DISTINCT FROM FALSE AND ('' = [[test3]]::text OR [[test3]] IS NULL) OR ('' IS DISTINCT FROM [[test4_sub]]::text AND [[test4_sub]] IS NOT NULL))`,
+		},
+		{
+			"all operators",
+			"(test1 = test2 || test2 != test3) && (test2 ~ 'example' || test2 !~ '%%abc') && 'switch1%%' ~ test1 && 'switch2' !~ test2 && test3 > 1 && test3 >= 0 && test3 <= 4 && 2 < 5",
+			false,
+			/* SQLite:
+			"((COALESCE([[test1]], '') = COALESCE([[test2]], '') OR COALESCE([[test2]], '') IS NOT COALESCE([[test3]], '')) AND ([[test2]] LIKE {:TEST} ESCAPE '\\' OR [[test2]] NOT LIKE {:TEST} ESCAPE '\\') AND {:TEST} LIKE ('%' || [[test1]] || '%') ESCAPE '\\' AND {:TEST} NOT LIKE ('%' || [[test2]] || '%') ESCAPE '\\' AND [[test3]] > {:TEST} AND [[test3]] >= {:TEST} AND [[test3]] <= {:TEST} AND {:TEST} < {:TEST})",
+			*/
+			// PostgreSQL:
+			`((to_jsonb([[test1]]) IS NOT DISTINCT FROM to_jsonb([[test2]]) OR to_jsonb([[test2]]) IS DISTINCT FROM to_jsonb([[test3]])) AND ([[test2]] LIKE {:TEST} ESCAPE '\' OR [[test2]] NOT LIKE {:TEST} ESCAPE '\') AND {:TEST} LIKE ('%' || [[test1]] || '%') ESCAPE '\' AND {:TEST} NOT LIKE ('%' || [[test2]] || '%') ESCAPE '\' AND [[test3]] > 1 AND [[test3]] >= 0 AND [[test3]] <= 4 AND 2 < 5)`,
+		},
+		{
+			"geoDistance function",
+			"geoDistance(1,2,3,4) < 567",
+			false,
+			/* SQLite:
+			"(6371 * acos(cos(radians({:TEST})) * cos(radians({:TEST})) * cos(radians({:TEST}) - radians({:TEST})) + sin(radians({:TEST})) * sin(radians({:TEST})))) < {:TEST}",
+			*/
+			// PostgreSQL:
+			`(6371 * acos(cos(radians(2)) * cos(radians(4)) * cos(radians(3) - radians(1)) + sin(radians(2)) * sin(radians(4)))) < 567`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			expr, err := s.filterData.BuildExpr(resolver)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("[%s] Expected hasErr %v, got %v (%v)", s.name, s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			dummyDB := &dbx.DB{}
+
+			rawSql := expr.Build(dummyDB, dbx.Params{})
+
+			// replace TEST placeholder with .+ regex pattern
+			expectPattern := strings.ReplaceAll(
+				"^"+regexp.QuoteMeta(s.expectPattern)+"$",
+				"TEST",
+				`\w+`,
+			)
+
+			pattern := regexp.MustCompile(expectPattern)
+			if !pattern.MatchString(rawSql) {
+				t.Fatalf("[%s] Pattern %v don't match with expression: \n%v", s.name, expectPattern, rawSql)
+			}
+		})
+	}
+}
+
+func TestFilterDataBuildExprWithParams(t *testing.T) {
+	// create a dummy db
+	/* SQLite:
+	sqlDB, err := sql.Open("sqlite", "file::memory:?cache=shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	db := dbx.NewFromDB(sqlDB, "sqlite")
+	*/
+	// PostgreSQL:
+	db, cleanup := search.NewTestDBX()
+	defer cleanup()
+
+	calledQueries := []string{}
+	db.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	db.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+
+	date, err := time.Parse("2006-01-02", "2023-01-01")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	resolver := search.NewSimpleFieldResolver(`^test\w+$`)
+
+	filter := search.FilterData(`
+		test1 = {:test1} ||
+		test2 = {:test2} ||
+		test3a = {:test3} ||
+		test3b = {:test3} ||
+		test4 = {:test4} ||
+		test5 = {:test5} ||
+		test6 = {:test6} ||
+		test7 = {:test7} ||
+		test8 = {:test8} ||
+		test9 = {:test9} ||
+		test10 = {:test10} ||
+		test11 = {:test11} ||
+		test12 = {:test12}
+	`)
+
+	replacements := []dbx.Params{
+		{"test1": true},
+		{"test2": false},
+		{"test3": 123.456},
+		{"test4": nil},
+		{"test5": "", "test6": "simple", "test7": `'single_quotes'`, "test8": `"double_quotes"`, "test9": `escape\"quote`},
+		{"test10": date},
+		{"test11": []string{"a", "b", `"quote`}},
+		{"test12": map[string]any{"a": 123, "b": `quote"`}},
+	}
+
+	expr, err := filter.BuildExpr(resolver, replacements...)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	db.Select().Where(expr).Build().Execute()
+
+	if len(calledQueries) != 1 {
+		t.Fatalf("Expected 1 query, got %d", len(calledQueries))
+	}
+
+	/* SQLite:
+	expectedQuery := `SELECT * WHERE ([[test1]] = 1 OR [[test2]] = 0 OR [[test3a]] = 123.456 OR [[test3b]] = 123.456 OR ([[test4]] = '' OR [[test4]] IS NULL) OR [[test5]] = '""' OR [[test6]] = 'simple' OR [[test7]] = '''single_quotes''' OR [[test8]] = '"double_quotes"' OR [[test9]] = 'escape\\"quote' OR [[test10]] = '2023-01-01 00:00:00 +0000 UTC' OR [[test11]] = '["a","b","\\"quote"]' OR [[test12]] = '{"a":123,"b":"quote\\""}')`
+	*/
+	// PostgreSQL:
+	expectedQuery := `SELECT * WHERE ([[test1]] = TRUE OR [[test2]] = FALSE OR [[test3a]] = 123.456 OR [[test3b]] = 123.456 OR ([[test4]]::text = '' OR [[test4]] IS NULL) OR [[test5]] = '""' OR [[test6]] = 'simple' OR [[test7]] = '''single_quotes''' OR [[test8]] = '"double_quotes"' OR [[test9]] = 'escape\\"quote' OR [[test10]] = '2023-01-01 00:00:00 +0000 UTC' OR [[test11]] = '["a","b","\\"quote"]' OR [[test12]] = '{"a":123,"b":"quote\\""}')`
+	if expectedQuery != calledQueries[0] {
+		t.Fatalf("Expected query \n%s, \ngot \n%s", expectedQuery, calledQueries[0])
+	}
+}
+
+func TestFilterDataBuildExprWithLimit(t *testing.T) {
+	resolver := search.NewSimpleFieldResolver(`^\w+$`)
+
+	scenarios := []struct {
+		limit       int
+		filter      search.FilterData
+		expectError bool
+	}{
+		{1, "1 = 1", false},
+		{0, "1 = 1", true}, // new cache entry should be created
+		{2, "1 = 1 || 1 = 1", false},
+		{1, "1 = 1 || 1 = 1", true},
+		{3, "1 = 1 || 1 = 1", false},
+		{6, "(1=1 || 1=1) && (1=1 || (1=1 || 1=1)) && (1=1)", false},
+		{5, "(1=1 || 1=1) && (1=1 || (1=1 || 1=1)) && (1=1)", true},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("limit_%d:%d", i, s.limit), func(t *testing.T) {
+			_, err := s.filter.BuildExprWithLimit(resolver, s.limit)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+		})
+	}
+}
+
+func TestLikeParamsWrapping(t *testing.T) {
+	// create a dummy db
+	/* SQLite:
+	sqlDB, err := sql.Open("sqlite", "file::memory:?cache=shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	db := dbx.NewFromDB(sqlDB, "sqlite")
+	*/
+	// PostgreSQL:
+	db, cleanup := search.NewTestDBX()
+	defer cleanup()
+
+	calledQueries := []string{}
+	db.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+	db.ExecLogFunc = func(ctx context.Context, t time.Duration, sql string, result sql.Result, err error) {
+		calledQueries = append(calledQueries, sql)
+	}
+
+	resolver := search.NewSimpleFieldResolver(`^test\w+$`)
+
+	filter := search.FilterData(`
+		test1 ~ {:p1} ||
+		test2 ~ {:p2} ||
+		test3 ~ {:p3} ||
+		test4 ~ {:p4} ||
+		test5 ~ {:p5} ||
+		test6 ~ {:p6} ||
+		test7 ~ {:p7} ||
+		test8 ~ {:p8} ||
+		test9 ~ {:p9} ||
+		test10 ~ {:p10} ||
+		test11 ~ {:p11} ||
+		test12 ~ {:p12}
+	`)
+
+	replacements := []dbx.Params{
+		{"p1": `abc`},
+		{"p2": `ab%c`},
+		{"p3": `ab\%c`},
+		{"p4": `%ab\%c`},
+		{"p5": `ab\\%c`},
+		{"p6": `ab\\\%c`},
+		{"p7": `ab_c`},
+		{"p8": `ab\_c`},
+		{"p9": `%ab_c`},
+		{"p10": `ab\c`},
+		{"p11": `_ab\c_`},
+		{"p12": `ab\c%`},
+	}
+
+	expr, err := filter.BuildExpr(resolver, replacements...)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	db.Select().Where(expr).Build().Execute()
+
+	if len(calledQueries) != 1 {
+		t.Fatalf("Expected 1 query, got %d", len(calledQueries))
+	}
+
+	expectedQuery := `SELECT * WHERE ([[test1]] LIKE '%abc%' ESCAPE '\' OR [[test2]] LIKE 'ab%c' ESCAPE '\' OR [[test3]] LIKE 'ab\\%c' ESCAPE '\' OR [[test4]] LIKE '%ab\\%c' ESCAPE '\' OR [[test5]] LIKE 'ab\\\\%c' ESCAPE '\' OR [[test6]] LIKE 'ab\\\\\\%c' ESCAPE '\' OR [[test7]] LIKE '%ab\_c%' ESCAPE '\' OR [[test8]] LIKE '%ab\\\_c%' ESCAPE '\' OR [[test9]] LIKE '%ab_c' ESCAPE '\' OR [[test10]] LIKE '%ab\\c%' ESCAPE '\' OR [[test11]] LIKE '%\_ab\\c\_%' ESCAPE '\' OR [[test12]] LIKE 'ab\\c%' ESCAPE '\')`
+	if expectedQuery != calledQueries[0] {
+		t.Fatalf("Expected query \n%s, \ngot \n%s", expectedQuery, calledQueries[0])
+	}
+}
+
+// PostgreSQL Only:
+func TestEqualOperater(t *testing.T) {
+	db, cleanup := search.NewTestDBX()
+	defer cleanup()
+
+	_, err := db.DB.DB().Exec(`
+		CREATE TABLE demo (
+		    id        INTEGER,
+			col_int   INTEGER,
+			col_bool  BOOLEAN,
+			col_text  TEXT
+		);
+		INSERT INTO demo (id, col_int, col_bool, col_text) VALUES (1, NULL, NULL, NULL);
+		INSERT INTO demo (id, col_int, col_bool, col_text) VALUES (2, 0, FALSE, '');
+		INSERT INTO demo (id, col_int, col_bool, col_text) VALUES (3, 1, TRUE, 'abc');
+	`)
+	if err != nil {
+		panic(err)
+	}
+
+	scenarios := []struct {
+		filter string
+		ids    []int
+	}{
+		{"col_int = NULL", []int{1}},
+		{"col_int != NULL", []int{2, 3}},
+		{"col_int = 0", []int{2}},
+		{"col_int = 1", []int{3}},
+		{"col_bool = NULL", []int{1}},
+		{"col_bool != NULL", []int{2, 3}},
+		{"col_bool = false", []int{2}},
+		{"col_bool = true", []int{3}},
+		{"col_text = 'abc'", []int{3}},
+		{"col_text = NULL", []int{1, 2}}, // For text columns, pocketbase treats NULL and empty string as equal
+		{"col_text != NULL", []int{3}},   // For text columns, pocketbase treats NULL and empty string as equal
+		{"col_text = ''", []int{1, 2}},   // For text columns, pocketbase treats NULL and empty string as equal
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.filter, func(t *testing.T) {
+			rows, err := QueryRowsByFilter(db.DB, s.filter)
+			if err != nil {
+				t.Fatalf("Error executing filter '%s': %v", s.filter, err)
+				return
+			}
+			if len(rows) != len(s.ids) {
+				t.Fatalf("Filter '%s': expected %d rows, got %d", s.filter, len(s.ids), len(rows))
+			}
+
+			rowIds := make([]int, len(rows))
+			for i, row := range rows {
+				rowIds[i] = row.Id
+			}
+
+			if !slices.Equal(rowIds, s.ids) {
+				t.Fatalf("Filter '%s': expected IDs %v, got %v", s.filter, s.ids, rowIds)
+			}
+		})
+	}
+}
+
+func QueryRowsByFilter(db *dbx.DB, filter string) ([]Row, error) {
+	var rows []Row
+
+	resolver := search.NewSimpleFieldResolver(`^col_\w+$`)
+	expr, _ := search.FilterData(filter).BuildExpr(resolver)
+	print(expr.Build(db, dbx.Params{}))
+	err := db.Select("id", "col_int", "col_bool", "col_text").From("demo").Where(expr).Build().All(&rows)
+	if err != nil {
+		return nil, err
+	}
+	return rows, nil
+}
+
+type Row struct {
+	Id      int     `db:"id"`
+	ColInt  *int    `db:"col_int"`
+	ColBool *bool   `db:"col_bool"`
+	ColText *string `db:"col_text"`
+}
diff --git a/server/core_backend-server/tools/search/identifier_macros.go b/server/core_backend-server/tools/search/identifier_macros.go
new file mode 100644
index 0000000..b0314de
--- /dev/null
+++ b/server/core_backend-server/tools/search/identifier_macros.go
@@ -0,0 +1,135 @@
+package search
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// note: used primarily for the tests
+var timeNow = func() time.Time {
+	return time.Now()
+}
+
+var identifierMacros = map[string]func() (any, error){
+	"@now": func() (any, error) {
+		today := timeNow().UTC()
+
+		d, err := types.ParseDateTime(today)
+		if err != nil {
+			return "", fmt.Errorf("@now: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@yesterday": func() (any, error) {
+		yesterday := timeNow().UTC().AddDate(0, 0, -1)
+
+		d, err := types.ParseDateTime(yesterday)
+		if err != nil {
+			return "", fmt.Errorf("@yesterday: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@tomorrow": func() (any, error) {
+		tomorrow := timeNow().UTC().AddDate(0, 0, 1)
+
+		d, err := types.ParseDateTime(tomorrow)
+		if err != nil {
+			return "", fmt.Errorf("@tomorrow: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@second": func() (any, error) {
+		return timeNow().UTC().Second(), nil
+	},
+	"@minute": func() (any, error) {
+		return timeNow().UTC().Minute(), nil
+	},
+	"@hour": func() (any, error) {
+		return timeNow().UTC().Hour(), nil
+	},
+	"@day": func() (any, error) {
+		return timeNow().UTC().Day(), nil
+	},
+	"@month": func() (any, error) {
+		return int(timeNow().UTC().Month()), nil
+	},
+	"@weekday": func() (any, error) {
+		return int(timeNow().UTC().Weekday()), nil
+	},
+	"@year": func() (any, error) {
+		return timeNow().UTC().Year(), nil
+	},
+	"@todayStart": func() (any, error) {
+		today := timeNow().UTC()
+		start := time.Date(today.Year(), today.Month(), today.Day(), 0, 0, 0, 0, time.UTC)
+
+		d, err := types.ParseDateTime(start)
+		if err != nil {
+			return "", fmt.Errorf("@todayStart: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@todayEnd": func() (any, error) {
+		today := timeNow().UTC()
+
+		start := time.Date(today.Year(), today.Month(), today.Day(), 23, 59, 59, 999999999, time.UTC)
+
+		d, err := types.ParseDateTime(start)
+		if err != nil {
+			return "", fmt.Errorf("@todayEnd: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@monthStart": func() (any, error) {
+		today := timeNow().UTC()
+		start := time.Date(today.Year(), today.Month(), 1, 0, 0, 0, 0, time.UTC)
+
+		d, err := types.ParseDateTime(start)
+		if err != nil {
+			return "", fmt.Errorf("@monthStart: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@monthEnd": func() (any, error) {
+		today := timeNow().UTC()
+		start := time.Date(today.Year(), today.Month(), 1, 23, 59, 59, 999999999, time.UTC)
+		end := start.AddDate(0, 1, -1)
+
+		d, err := types.ParseDateTime(end)
+		if err != nil {
+			return "", fmt.Errorf("@monthEnd: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@yearStart": func() (any, error) {
+		today := timeNow().UTC()
+		start := time.Date(today.Year(), 1, 1, 0, 0, 0, 0, time.UTC)
+
+		d, err := types.ParseDateTime(start)
+		if err != nil {
+			return "", fmt.Errorf("@yearStart: %w", err)
+		}
+
+		return d.String(), nil
+	},
+	"@yearEnd": func() (any, error) {
+		today := timeNow().UTC()
+		end := time.Date(today.Year(), 12, 31, 23, 59, 59, 999999999, time.UTC)
+
+		d, err := types.ParseDateTime(end)
+		if err != nil {
+			return "", fmt.Errorf("@yearEnd: %w", err)
+		}
+
+		return d.String(), nil
+	},
+}
diff --git a/server/core_backend-server/tools/search/identifier_macros_test.go b/server/core_backend-server/tools/search/identifier_macros_test.go
new file mode 100644
index 0000000..0c58df4
--- /dev/null
+++ b/server/core_backend-server/tools/search/identifier_macros_test.go
@@ -0,0 +1,58 @@
+package search
+
+import (
+	"testing"
+	"time"
+)
+
+func TestIdentifierMacros(t *testing.T) {
+	originalTimeNow := timeNow
+
+	timeNow = func() time.Time {
+		return time.Date(2023, 2, 3, 4, 5, 6, 7, time.UTC)
+	}
+
+	testMacros := map[string]any{
+		"@now":        "2023-02-03 04:05:06.000Z",
+		"@yesterday":  "2023-02-02 04:05:06.000Z",
+		"@tomorrow":   "2023-02-04 04:05:06.000Z",
+		"@second":     6,
+		"@minute":     5,
+		"@hour":       4,
+		"@day":        3,
+		"@month":      2,
+		"@weekday":    5,
+		"@year":       2023,
+		"@todayStart": "2023-02-03 00:00:00.000Z",
+		"@todayEnd":   "2023-02-03 23:59:59.999Z",
+		"@monthStart": "2023-02-01 00:00:00.000Z",
+		"@monthEnd":   "2023-02-28 23:59:59.999Z",
+		"@yearStart":  "2023-01-01 00:00:00.000Z",
+		"@yearEnd":    "2023-12-31 23:59:59.999Z",
+	}
+
+	if len(testMacros) != len(identifierMacros) {
+		t.Fatalf("Expected %d macros, got %d", len(testMacros), len(identifierMacros))
+	}
+
+	for key, expected := range testMacros {
+		t.Run(key, func(t *testing.T) {
+			macro, ok := identifierMacros[key]
+			if !ok {
+				t.Fatalf("Missing macro %s", key)
+			}
+
+			result, err := macro()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if result != expected {
+				t.Fatalf("Expected %q, got %q", expected, result)
+			}
+		})
+	}
+
+	// restore
+	timeNow = originalTimeNow
+}
diff --git a/server/core_backend-server/tools/search/provider.go b/server/core_backend-server/tools/search/provider.go
new file mode 100644
index 0000000..51dc3f6
--- /dev/null
+++ b/server/core_backend-server/tools/search/provider.go
@@ -0,0 +1,360 @@
+package search
+
+import (
+	"errors"
+	"math"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	// DefaultPerPage specifies the default number of returned search result items.
+	DefaultPerPage int = 30
+
+	// DefaultFilterExprLimit specifies the default filter expressions limit.
+	DefaultFilterExprLimit int = 200
+
+	// DefaultSortExprLimit specifies the default sort expressions limit.
+	DefaultSortExprLimit int = 8
+
+	// MaxPerPage specifies the max allowed search result items returned in a single page.
+	MaxPerPage int = 1000
+
+	// MaxFilterLength specifies the max allowed individual search filter parsable length.
+	MaxFilterLength int = 3500
+
+	// MaxSortFieldLength specifies the max allowed individual sort field parsable length.
+	MaxSortFieldLength int = 255
+)
+
+// Common search errors.
+var (
+	ErrEmptyQuery           = errors.New("search query is not set")
+	ErrSortExprLimit        = errors.New("max sort expressions limit reached")
+	ErrFilterExprLimit      = errors.New("max filter expressions limit reached")
+	ErrFilterLengthLimit    = errors.New("max filter length limit reached")
+	ErrSortFieldLengthLimit = errors.New("max sort field length limit reached")
+)
+
+// URL search query params
+const (
+	PageQueryParam      string = "page"
+	PerPageQueryParam   string = "perPage"
+	SortQueryParam      string = "sort"
+	FilterQueryParam    string = "filter"
+	SkipTotalQueryParam string = "skipTotal"
+)
+
+// Result defines the returned search result structure.
+type Result struct {
+	Items      any `json:"items"`
+	Page       int `json:"page"`
+	PerPage    int `json:"perPage"`
+	TotalItems int `json:"totalItems"`
+	TotalPages int `json:"totalPages"`
+}
+
+// Provider represents a single configured search provider instance.
+type Provider struct {
+	fieldResolver      FieldResolver
+	query              *dbx.SelectQuery
+	countCol           string
+	sort               []SortField
+	filter             []FilterData
+	page               int
+	perPage            int
+	skipTotal          bool
+	maxFilterExprLimit int
+	maxSortExprLimit   int
+}
+
+// NewProvider initializes and returns a new search provider.
+//
+// Example:
+//
+//	baseQuery := db.Select("*").From("user")
+//	fieldResolver := search.NewSimpleFieldResolver("id", "name")
+//	models := []*YourDataStruct{}
+//
+//	result, err := search.NewProvider(fieldResolver).
+//		Query(baseQuery).
+//		ParseAndExec("page=2&filter=id>0&sort=-email", &models)
+func NewProvider(fieldResolver FieldResolver) *Provider {
+	return &Provider{
+		fieldResolver:      fieldResolver,
+		countCol:           "id",
+		page:               1,
+		perPage:            DefaultPerPage,
+		sort:               []SortField{},
+		filter:             []FilterData{},
+		maxFilterExprLimit: DefaultFilterExprLimit,
+		maxSortExprLimit:   DefaultSortExprLimit,
+	}
+}
+
+// MaxFilterExprLimit changes the default max allowed filter expressions.
+//
+// Note that currently the limit is applied individually for each separate filter.
+func (s *Provider) MaxFilterExprLimit(max int) *Provider {
+	s.maxFilterExprLimit = max
+	return s
+}
+
+// MaxSortExprLimit changes the default max allowed sort expressions.
+func (s *Provider) MaxSortExprLimit(max int) *Provider {
+	s.maxSortExprLimit = max
+	return s
+}
+
+// Query sets the base query that will be used to fetch the search items.
+func (s *Provider) Query(query *dbx.SelectQuery) *Provider {
+	s.query = query
+	return s
+}
+
+// SkipTotal changes the `skipTotal` field of the current search provider.
+func (s *Provider) SkipTotal(skipTotal bool) *Provider {
+	s.skipTotal = skipTotal
+	return s
+}
+
+// CountCol allows changing the default column (id) that is used
+// to generate the COUNT SQL query statement.
+//
+// This field is ignored if skipTotal is true.
+func (s *Provider) CountCol(name string) *Provider {
+	s.countCol = name
+	return s
+}
+
+// Page sets the `page` field of the current search provider.
+//
+// Normalization on the `page` value is done during `Exec()`.
+func (s *Provider) Page(page int) *Provider {
+	s.page = page
+	return s
+}
+
+// PerPage sets the `perPage` field of the current search provider.
+//
+// Normalization on the `perPage` value is done during `Exec()`.
+func (s *Provider) PerPage(perPage int) *Provider {
+	s.perPage = perPage
+	return s
+}
+
+// Sort sets the `sort` field of the current search provider.
+func (s *Provider) Sort(sort []SortField) *Provider {
+	s.sort = sort
+	return s
+}
+
+// AddSort appends the provided SortField to the existing provider's sort field.
+func (s *Provider) AddSort(field SortField) *Provider {
+	s.sort = append(s.sort, field)
+	return s
+}
+
+// Filter sets the `filter` field of the current search provider.
+func (s *Provider) Filter(filter []FilterData) *Provider {
+	s.filter = filter
+	return s
+}
+
+// AddFilter appends the provided FilterData to the existing provider's filter field.
+func (s *Provider) AddFilter(filter FilterData) *Provider {
+	if filter != "" {
+		s.filter = append(s.filter, filter)
+	}
+	return s
+}
+
+// Parse parses the search query parameter from the provided query string
+// and assigns the found fields to the current search provider.
+//
+// The data from the "sort" and "filter" query parameters are appended
+// to the existing provider's `sort` and `filter` fields
+// (aka. using `AddSort` and `AddFilter`).
+func (s *Provider) Parse(urlQuery string) error {
+	params, err := url.ParseQuery(urlQuery)
+	if err != nil {
+		return err
+	}
+
+	if raw := params.Get(SkipTotalQueryParam); raw != "" {
+		v, err := strconv.ParseBool(raw)
+		if err != nil {
+			return err
+		}
+		s.SkipTotal(v)
+	}
+
+	if raw := params.Get(PageQueryParam); raw != "" {
+		v, err := strconv.Atoi(raw)
+		if err != nil {
+			return err
+		}
+		s.Page(v)
+	}
+
+	if raw := params.Get(PerPageQueryParam); raw != "" {
+		v, err := strconv.Atoi(raw)
+		if err != nil {
+			return err
+		}
+		s.PerPage(v)
+	}
+
+	if raw := params.Get(SortQueryParam); raw != "" {
+		for _, sortField := range ParseSortFromString(raw) {
+			s.AddSort(sortField)
+		}
+	}
+
+	if raw := params.Get(FilterQueryParam); raw != "" {
+		s.AddFilter(FilterData(raw))
+	}
+
+	return nil
+}
+
+// Exec executes the search provider and fills/scans
+// the provided `items` slice with the found models.
+func (s *Provider) Exec(items any) (*Result, error) {
+	if s.query == nil {
+		return nil, ErrEmptyQuery
+	}
+
+	// shallow clone the provider's query
+	modelsQuery := *s.query
+
+	// build filters
+	for _, f := range s.filter {
+		if len(f) > MaxFilterLength {
+			return nil, ErrFilterLengthLimit
+		}
+		expr, err := f.BuildExprWithLimit(s.fieldResolver, s.maxFilterExprLimit)
+		if err != nil {
+			return nil, err
+		}
+		if expr != nil {
+			modelsQuery.AndWhere(expr)
+		}
+	}
+
+	// apply sorting
+	if len(s.sort) > s.maxSortExprLimit {
+		return nil, ErrSortExprLimit
+	}
+	for _, sortField := range s.sort {
+		if len(sortField.Name) > MaxSortFieldLength {
+			return nil, ErrSortFieldLengthLimit
+		}
+		expr, err := sortField.BuildExpr(s.fieldResolver)
+		if err != nil {
+			return nil, err
+		}
+		if expr != "" {
+			// ensure that _rowid_ expressions are always prefixed with the first FROM table
+			if sortField.Name == rowidSortKey && !strings.Contains(expr, ".") {
+				queryInfo := modelsQuery.Info()
+				if len(queryInfo.From) > 0 {
+					expr = "[[" + inflector.Columnify(queryInfo.From[0]) + "]]." + expr
+				}
+			}
+
+			modelsQuery.AndOrderBy(expr)
+		}
+	}
+
+	// apply field resolver query modifications (if any)
+	if err := s.fieldResolver.UpdateQuery(&modelsQuery); err != nil {
+		return nil, err
+	}
+
+	// normalize page
+	if s.page <= 0 {
+		s.page = 1
+	}
+
+	// normalize perPage
+	if s.perPage <= 0 {
+		s.perPage = DefaultPerPage
+	} else if s.perPage > MaxPerPage {
+		s.perPage = MaxPerPage
+	}
+
+	// negative value to differentiate from the zero default
+	totalCount := -1
+	totalPages := -1
+
+	// prepare a count query from the base one
+	countQuery := modelsQuery // shallow clone
+	countExec := func() error {
+		queryInfo := countQuery.Info()
+		countCol := s.countCol
+		if len(queryInfo.From) > 0 {
+			countCol = queryInfo.From[0] + "." + countCol
+		}
+
+		// note: countQuery is shallow cloned and slice/map in-place modifications should be avoided
+		err := countQuery.Distinct(false).
+			Select("COUNT(DISTINCT [[" + countCol + "]])").
+			OrderBy( /* reset */ ).
+			Row(&totalCount)
+		if err != nil {
+			return err
+		}
+
+		totalPages = int(math.Ceil(float64(totalCount) / float64(s.perPage)))
+
+		return nil
+	}
+
+	// apply pagination to the original query and fetch the models
+	modelsExec := func() error {
+		modelsQuery.Limit(int64(s.perPage))
+		modelsQuery.Offset(int64(s.perPage * (s.page - 1)))
+
+		return modelsQuery.All(items)
+	}
+
+	if !s.skipTotal {
+		// execute the 2 queries concurrently
+		errg := new(errgroup.Group)
+		errg.Go(countExec)
+		errg.Go(modelsExec)
+		if err := errg.Wait(); err != nil {
+			return nil, err
+		}
+	} else {
+		if err := modelsExec(); err != nil {
+			return nil, err
+		}
+	}
+
+	result := &Result{
+		Page:       s.page,
+		PerPage:    s.perPage,
+		TotalItems: totalCount,
+		TotalPages: totalPages,
+		Items:      items,
+	}
+
+	return result, nil
+}
+
+// ParseAndExec is a short convenient method to trigger both
+// `Parse()` and `Exec()` in a single call.
+func (s *Provider) ParseAndExec(urlQuery string, modelsSlice any) (*Result, error) {
+	if err := s.Parse(urlQuery); err != nil {
+		return nil, err
+	}
+
+	return s.Exec(modelsSlice)
+}
diff --git a/server/core_backend-server/tools/search/provider_test.go b/server/core_backend-server/tools/search/provider_test.go
new file mode 100644
index 0000000..4a27e50
--- /dev/null
+++ b/server/core_backend-server/tools/search/provider_test.go
@@ -0,0 +1,853 @@
+package search
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	_ "github.com/jackc/pgx/v5/stdlib"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/security"
+	_ "modernc.org/sqlite"
+)
+
+func TestNewProvider(t *testing.T) {
+	r := &testFieldResolver{}
+	p := NewProvider(r)
+
+	if p.page != 1 {
+		t.Fatalf("Expected page %d, got %d", 1, p.page)
+	}
+
+	if p.perPage != DefaultPerPage {
+		t.Fatalf("Expected perPage %d, got %d", DefaultPerPage, p.perPage)
+	}
+
+	if p.maxFilterExprLimit != DefaultFilterExprLimit {
+		t.Fatalf("Expected maxFilterExprLimit %d, got %d", DefaultFilterExprLimit, p.maxFilterExprLimit)
+	}
+
+	if p.maxSortExprLimit != DefaultSortExprLimit {
+		t.Fatalf("Expected maxSortExprLimit %d, got %d", DefaultSortExprLimit, p.maxSortExprLimit)
+	}
+}
+
+func TestMaxFilterExprLimit(t *testing.T) {
+	p := NewProvider(&testFieldResolver{})
+
+	testVals := []int{0, -10, 10}
+
+	for _, val := range testVals {
+		t.Run("max_"+strconv.Itoa(val), func(t *testing.T) {
+			p.MaxFilterExprLimit(val)
+
+			if p.maxFilterExprLimit != val {
+				t.Fatalf("Expected maxFilterExprLimit to change to %d, got %d", val, p.maxFilterExprLimit)
+			}
+		})
+	}
+}
+
+func TestMaxSortExprLimit(t *testing.T) {
+	p := NewProvider(&testFieldResolver{})
+
+	testVals := []int{0, -10, 10}
+
+	for _, val := range testVals {
+		t.Run("max_"+strconv.Itoa(val), func(t *testing.T) {
+			p.MaxSortExprLimit(val)
+
+			if p.maxSortExprLimit != val {
+				t.Fatalf("Expected maxSortExprLimit to change to %d, got %d", val, p.maxSortExprLimit)
+			}
+		})
+	}
+}
+
+func TestProviderQuery(t *testing.T) {
+	db := dbx.NewFromDB(nil, "")
+	query := db.Select("id").From("test")
+	querySql := query.Build().SQL()
+
+	r := &testFieldResolver{}
+	p := NewProvider(r).Query(query)
+
+	expected := p.query.Build().SQL()
+
+	if querySql != expected {
+		t.Fatalf("Expected %v, got %v", expected, querySql)
+	}
+}
+
+func TestProviderSkipTotal(t *testing.T) {
+	p := NewProvider(&testFieldResolver{})
+
+	if p.skipTotal {
+		t.Fatalf("Expected the default skipTotal to be %v, got %v", false, p.skipTotal)
+	}
+
+	p.SkipTotal(true)
+
+	if !p.skipTotal {
+		t.Fatalf("Expected skipTotal to change to %v, got %v", true, p.skipTotal)
+	}
+}
+
+func TestProviderCountCol(t *testing.T) {
+	p := NewProvider(&testFieldResolver{})
+
+	if p.countCol != "id" {
+		t.Fatalf("Expected the default countCol to be %s, got %s", "id", p.countCol)
+	}
+
+	p.CountCol("test")
+
+	if p.countCol != "test" {
+		t.Fatalf("Expected colCount to change to %s, got %s", "test", p.countCol)
+	}
+}
+
+func TestProviderPage(t *testing.T) {
+	r := &testFieldResolver{}
+	p := NewProvider(r).Page(10)
+
+	if p.page != 10 {
+		t.Fatalf("Expected page %v, got %v", 10, p.page)
+	}
+}
+
+func TestProviderPerPage(t *testing.T) {
+	r := &testFieldResolver{}
+	p := NewProvider(r).PerPage(456)
+
+	if p.perPage != 456 {
+		t.Fatalf("Expected perPage %v, got %v", 456, p.perPage)
+	}
+}
+
+func TestProviderSort(t *testing.T) {
+	initialSort := []SortField{{"test1", SortAsc}, {"test2", SortAsc}}
+	r := &testFieldResolver{}
+	p := NewProvider(r).
+		Sort(initialSort).
+		AddSort(SortField{"test3", SortDesc})
+
+	encoded, _ := json.Marshal(p.sort)
+	expected := `[{"name":"test1","direction":"ASC"},{"name":"test2","direction":"ASC"},{"name":"test3","direction":"DESC"}]`
+
+	if string(encoded) != expected {
+		t.Fatalf("Expected sort %v, got \n%v", expected, string(encoded))
+	}
+}
+
+func TestProviderFilter(t *testing.T) {
+	initialFilter := []FilterData{"test1", "test2"}
+	r := &testFieldResolver{}
+	p := NewProvider(r).
+		Filter(initialFilter).
+		AddFilter("test3")
+
+	encoded, _ := json.Marshal(p.filter)
+	expected := `["test1","test2","test3"]`
+
+	if string(encoded) != expected {
+		t.Fatalf("Expected filter %v, got \n%v", expected, string(encoded))
+	}
+}
+
+func TestProviderParse(t *testing.T) {
+	initialPage := 2
+	initialPerPage := 123
+	initialSort := []SortField{{"test1", SortAsc}, {"test2", SortAsc}}
+	initialFilter := []FilterData{"test1", "test2"}
+
+	scenarios := []struct {
+		query         string
+		expectError   bool
+		expectPage    int
+		expectPerPage int
+		expectSort    string
+		expectFilter  string
+	}{
+		// empty
+		{
+			"",
+			false,
+			initialPage,
+			initialPerPage,
+			`[{"name":"test1","direction":"ASC"},{"name":"test2","direction":"ASC"}]`,
+			`["test1","test2"]`,
+		},
+		// invalid query
+		{
+			"invalid;",
+			true,
+			initialPage,
+			initialPerPage,
+			`[{"name":"test1","direction":"ASC"},{"name":"test2","direction":"ASC"}]`,
+			`["test1","test2"]`,
+		},
+		// invalid page
+		{
+			"page=a",
+			true,
+			initialPage,
+			initialPerPage,
+			`[{"name":"test1","direction":"ASC"},{"name":"test2","direction":"ASC"}]`,
+			`["test1","test2"]`,
+		},
+		// invalid perPage
+		{
+			"perPage=a",
+			true,
+			initialPage,
+			initialPerPage,
+			`[{"name":"test1","direction":"ASC"},{"name":"test2","direction":"ASC"}]`,
+			`["test1","test2"]`,
+		},
+		// valid query parameters
+		{
+			"page=3&perPage=456&filter=test3&sort=-a,b,+c&other=123",
+			false,
+			3,
+			456,
+			`[{"name":"test1","direction":"ASC"},{"name":"test2","direction":"ASC"},{"name":"a","direction":"DESC"},{"name":"b","direction":"ASC"},{"name":"c","direction":"ASC"}]`,
+			`["test1","test2","test3"]`,
+		},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.query), func(t *testing.T) {
+			r := &testFieldResolver{}
+			p := NewProvider(r).
+				Page(initialPage).
+				PerPage(initialPerPage).
+				Sort(initialSort).
+				Filter(initialFilter)
+
+			err := p.Parse(s.query)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if p.page != s.expectPage {
+				t.Fatalf("Expected page %v, got %v", s.expectPage, p.page)
+			}
+
+			if p.perPage != s.expectPerPage {
+				t.Fatalf("Expected perPage %v, got %v", s.expectPerPage, p.perPage)
+			}
+
+			encodedSort, _ := json.Marshal(p.sort)
+			if string(encodedSort) != s.expectSort {
+				t.Fatalf("Expected sort %v, got \n%v", s.expectSort, string(encodedSort))
+			}
+
+			encodedFilter, _ := json.Marshal(p.filter)
+			if string(encodedFilter) != s.expectFilter {
+				t.Fatalf("Expected filter %v, got \n%v", s.expectFilter, string(encodedFilter))
+			}
+		})
+	}
+}
+
+func TestProviderExecEmptyQuery(t *testing.T) {
+	p := NewProvider(&testFieldResolver{}).
+		Query(nil)
+
+	_, err := p.Exec(&[]testTableStruct{})
+	if err == nil {
+		t.Fatalf("Expected error with empty query, got nil")
+	}
+}
+
+func TestProviderExecNonEmptyQuery(t *testing.T) {
+	testDB, cleanup := createTestDB()
+	defer cleanup()
+
+	query := testDB.Select("*").
+		From("test").
+		Where(dbx.Not(dbx.HashExp{"test1": nil})).
+		OrderBy("test1 ASC")
+
+	scenarios := []struct {
+		name          string
+		page          int
+		perPage       int
+		sort          []SortField
+		filter        []FilterData
+		skipTotal     bool
+		expectError   bool
+		expectResult  string
+		expectQueries []string
+	}{
+		{
+			"page normalization",
+			-1,
+			10,
+			[]SortField{},
+			[]FilterData{},
+			false,
+			false,
+			`{"items":[{"test1":1,"test2":"test2.1","test3":""},{"test1":2,"test2":"test2.2","test3":""}],"page":1,"perPage":10,"totalItems":2,"totalPages":1}`,
+			[]string{
+				/* SQLite:
+				"SELECT COUNT(DISTINCT [[test.id]]) FROM `test` WHERE NOT (`test1` IS NULL)",
+				"SELECT * FROM `test` WHERE NOT (`test1` IS NULL) ORDER BY `test1` ASC LIMIT 10",
+				*/
+				// PostgreSQL:
+				`SELECT COUNT(DISTINCT [[test.id]]) FROM "test" WHERE NOT ("test1" IS NULL)`,
+				`SELECT * FROM "test" WHERE NOT ("test1" IS NULL) ORDER BY "test1" ASC LIMIT 10`,
+			},
+		},
+		{
+			"perPage normalization",
+			10,
+			0, // fallback to default
+			[]SortField{},
+			[]FilterData{},
+			false,
+			false,
+			`{"items":[],"page":10,"perPage":30,"totalItems":2,"totalPages":1}`,
+			[]string{
+				/* SQLite:
+				"SELECT COUNT(DISTINCT [[test.id]]) FROM `test` WHERE NOT (`test1` IS NULL)",
+				"SELECT * FROM `test` WHERE NOT (`test1` IS NULL) ORDER BY `test1` ASC LIMIT 30 OFFSET 270",
+				*/
+				// PostgreSQL:
+				`SELECT COUNT(DISTINCT [[test.id]]) FROM "test" WHERE NOT ("test1" IS NULL)`,
+				`SELECT * FROM "test" WHERE NOT ("test1" IS NULL) ORDER BY "test1" ASC LIMIT 30 OFFSET 270`,
+			},
+		},
+		{
+			"invalid sort field",
+			1,
+			10,
+			[]SortField{{"unknown", SortAsc}},
+			[]FilterData{},
+			false,
+			true,
+			"",
+			nil,
+		},
+		{
+			"invalid filter",
+			1,
+			10,
+			[]SortField{},
+			[]FilterData{"test2 = 'test2.1'", "invalid"},
+			false,
+			true,
+			"",
+			nil,
+		},
+		{
+			"valid sort and filter fields",
+			1,
+			5555, // will be limited by MaxPerPage
+			[]SortField{{"test2", SortDesc}},
+			[]FilterData{"test2 != null", "test1 >= 2"},
+			false,
+			false,
+			`{"items":[{"test1":2,"test2":"test2.2","test3":""}],"page":1,"perPage":` + fmt.Sprint(MaxPerPage) + `,"totalItems":1,"totalPages":1}`,
+			[]string{
+				/* SQLite:
+				"SELECT COUNT(DISTINCT [[test.id]]) FROM `test` WHERE ((NOT (`test1` IS NULL)) AND (((test2 IS NOT '' AND test2 IS NOT NULL)))) AND (test1 >= 2)",
+				"SELECT * FROM `test` WHERE ((NOT (`test1` IS NULL)) AND (((test2 IS NOT '' AND test2 IS NOT NULL)))) AND (test1 >= 2) ORDER BY `test1` ASC, `test2` DESC LIMIT " + fmt.Sprint(MaxPerPage),
+				*/
+				// PostgreSQL:
+				`SELECT COUNT(DISTINCT [[test.id]]) FROM "test" WHERE ((NOT ("test1" IS NULL)) AND (((test2::text IS DISTINCT FROM '' AND test2 IS NOT NULL)))) AND (test1 >= 2)`,
+				`SELECT * FROM "test" WHERE ((NOT ("test1" IS NULL)) AND (((test2::text IS DISTINCT FROM '' AND test2 IS NOT NULL)))) AND (test1 >= 2) ORDER BY "test1" ASC, "test2" DESC LIMIT ` + fmt.Sprint(MaxPerPage),
+			},
+		},
+		{
+			"valid sort and filter fields (skipTotal=1)",
+			1,
+			5555, // will be limited by MaxPerPage
+			[]SortField{{"test2", SortDesc}},
+			[]FilterData{"test2 != null", "test1 >= 2"},
+			true,
+			false,
+			`{"items":[{"test1":2,"test2":"test2.2","test3":""}],"page":1,"perPage":` + fmt.Sprint(MaxPerPage) + `,"totalItems":-1,"totalPages":-1}`,
+			[]string{
+				/* SQLite:
+				"SELECT * FROM `test` WHERE ((NOT (`test1` IS NULL)) AND (((test2 IS NOT '' AND test2 IS NOT NULL)))) AND (test1 >= 2) ORDER BY `test1` ASC, `test2` DESC LIMIT " + fmt.Sprint(MaxPerPage),
+				*/
+				// PostgreSQL:
+				`SELECT * FROM "test" WHERE ((NOT ("test1" IS NULL)) AND (((test2::text IS DISTINCT FROM '' AND test2 IS NOT NULL)))) AND (test1 >= 2) ORDER BY "test1" ASC, "test2" DESC LIMIT ` + fmt.Sprint(MaxPerPage),
+			},
+		},
+		{
+			"valid sort and filter fields (zero results)",
+			1,
+			10,
+			[]SortField{{"test3", SortAsc}},
+			[]FilterData{"test3 != ''"},
+			false,
+			false,
+			`{"items":[],"page":1,"perPage":10,"totalItems":0,"totalPages":0}`,
+			[]string{
+				/* SQLite:
+				"SELECT COUNT(DISTINCT [[test.id]]) FROM `test` WHERE (NOT (`test1` IS NULL)) AND (((test3 IS NOT '' AND test3 IS NOT NULL)))",
+				"SELECT * FROM `test` WHERE (NOT (`test1` IS NULL)) AND (((test3 IS NOT '' AND test3 IS NOT NULL))) ORDER BY `test1` ASC, `test3` ASC LIMIT 10",
+				*/
+				// PostgreSQL:
+				`SELECT COUNT(DISTINCT [[test.id]]) FROM "test" WHERE (NOT ("test1" IS NULL)) AND (((test3::text IS DISTINCT FROM '' AND test3 IS NOT NULL)))`,
+				`SELECT * FROM "test" WHERE (NOT ("test1" IS NULL)) AND (((test3::text IS DISTINCT FROM '' AND test3 IS NOT NULL))) ORDER BY "test1" ASC, "test3" ASC LIMIT 10`,
+			},
+		},
+		{
+			"valid sort and filter fields (zero results; skipTotal=1)",
+			1,
+			10,
+			[]SortField{{"test3", SortAsc}},
+			[]FilterData{"test3 != ''"},
+			true,
+			false,
+			`{"items":[],"page":1,"perPage":10,"totalItems":-1,"totalPages":-1}`,
+			[]string{
+				/* SQLite:
+				"SELECT * FROM `test` WHERE (NOT (`test1` IS NULL)) AND (((test3 IS NOT '' AND test3 IS NOT NULL))) ORDER BY `test1` ASC, `test3` ASC LIMIT 10",
+				*/
+				// PostgreSQL:
+				`SELECT * FROM "test" WHERE (NOT ("test1" IS NULL)) AND (((test3::text IS DISTINCT FROM '' AND test3 IS NOT NULL))) ORDER BY "test1" ASC, "test3" ASC LIMIT 10`,
+			},
+		},
+		{
+			"pagination test",
+			2,
+			1,
+			[]SortField{},
+			[]FilterData{},
+			false,
+			false,
+			`{"items":[{"test1":2,"test2":"test2.2","test3":""}],"page":2,"perPage":1,"totalItems":2,"totalPages":2}`,
+			[]string{
+				/* SQLite:
+				"SELECT COUNT(DISTINCT [[test.id]]) FROM `test` WHERE NOT (`test1` IS NULL)",
+				"SELECT * FROM `test` WHERE NOT (`test1` IS NULL) ORDER BY `test1` ASC LIMIT 1 OFFSET 1",
+				*/
+				// PostgreSQL:
+				`SELECT COUNT(DISTINCT [[test.id]]) FROM "test" WHERE NOT ("test1" IS NULL)`,
+				`SELECT * FROM "test" WHERE NOT ("test1" IS NULL) ORDER BY "test1" ASC LIMIT 1 OFFSET 1`,
+			},
+		},
+		{
+			"pagination test (skipTotal=1)",
+			2,
+			1,
+			[]SortField{},
+			[]FilterData{},
+			true,
+			false,
+			`{"items":[{"test1":2,"test2":"test2.2","test3":""}],"page":2,"perPage":1,"totalItems":-1,"totalPages":-1}`,
+			[]string{
+				/* SQLite:
+				"SELECT * FROM `test` WHERE NOT (`test1` IS NULL) ORDER BY `test1` ASC LIMIT 1 OFFSET 1",
+				*/
+				// PostgreSQL:
+				`SELECT * FROM "test" WHERE NOT ("test1" IS NULL) ORDER BY "test1" ASC LIMIT 1 OFFSET 1`,
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testDB.CalledQueries = []string{} // reset
+
+			testResolver := &testFieldResolver{}
+			p := NewProvider(testResolver).
+				Query(query).
+				Page(s.page).
+				PerPage(s.perPage).
+				Sort(s.sort).
+				SkipTotal(s.skipTotal).
+				Filter(s.filter)
+
+			result, err := p.Exec(&[]testTableStruct{})
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if testResolver.UpdateQueryCalls != 1 {
+				t.Fatalf("Expected resolver.Update to be called %d, got %d", 1, testResolver.UpdateQueryCalls)
+			}
+
+			encoded, _ := json.Marshal(result)
+			if string(encoded) != s.expectResult {
+				t.Fatalf("Expected result %v, got \n%v", s.expectResult, string(encoded))
+			}
+
+			if len(s.expectQueries) != len(testDB.CalledQueries) {
+				t.Fatalf("Expected %d queries, got %d: \n%v", len(s.expectQueries), len(testDB.CalledQueries), testDB.CalledQueries)
+			}
+
+			for _, q := range testDB.CalledQueries {
+				if !list.ExistInSliceWithRegex(q, s.expectQueries) {
+					t.Fatalf("Didn't expect query \n%v \nin \n%v", q, s.expectQueries)
+				}
+			}
+		})
+	}
+}
+
+func TestProviderFilterAndSortLimits(t *testing.T) {
+	testDB, cleanup := createTestDB()
+	defer cleanup()
+
+	query := testDB.Select("*").
+		From("test").
+		Where(dbx.Not(dbx.HashExp{"test1": nil})).
+		OrderBy("test1 ASC")
+
+	scenarios := []struct {
+		name               string
+		filter             []FilterData
+		sort               []SortField
+		maxFilterExprLimit int
+		maxSortExprLimit   int
+		expectError        bool
+	}{
+		// filter
+		{
+			"<= max filter length",
+			[]FilterData{
+				"1=2",
+				/* SQLite:
+				FilterData("1='" + strings.Repeat("a", MaxFilterLength-4) + "'"),
+				*/
+				// PostgreSQL:
+				FilterData("'1'='" + strings.Repeat("a", MaxFilterLength-6) + "'"),
+			},
+			[]SortField{},
+			1,
+			0,
+			false,
+		},
+		{
+			"> max filter length",
+			[]FilterData{
+				"1=2",
+				FilterData("1='" + strings.Repeat("a", MaxFilterLength-3) + "'"),
+			},
+			[]SortField{},
+			1,
+			0,
+			true,
+		},
+		{
+			"<= max filter exprs",
+			[]FilterData{
+				"1=2",
+				"(1=1 || 1=1) && (1=1 || (1=1 || 1=1)) && (1=1)",
+			},
+			[]SortField{},
+			6,
+			0,
+			false,
+		},
+		{
+			"> max filter exprs",
+			[]FilterData{
+				"1=2",
+				"(1=1 || 1=1) && (1=1 || (1=1 || 1=1)) && (1=1)",
+			},
+			[]SortField{},
+			5,
+			0,
+			true,
+		},
+
+		// sort
+		{
+			"<= max sort field length",
+			[]FilterData{},
+			[]SortField{
+				{"id", SortAsc},
+				{"test1", SortDesc},
+				{strings.Repeat("a", MaxSortFieldLength), SortDesc},
+			},
+			0,
+			10,
+			false,
+		},
+		{
+			"> max sort field length",
+			[]FilterData{},
+			[]SortField{
+				{"id", SortAsc},
+				{"test1", SortDesc},
+				{strings.Repeat("b", MaxSortFieldLength+1), SortDesc},
+			},
+			0,
+			10,
+			true,
+		},
+		{
+			"<= max sort exprs",
+			[]FilterData{},
+			[]SortField{
+				{"id", SortAsc},
+				{"test1", SortDesc},
+			},
+			0,
+			2,
+			false,
+		},
+		{
+			"> max sort exprs",
+			[]FilterData{},
+			[]SortField{
+				{"id", SortAsc},
+				{"test1", SortDesc},
+			},
+			0,
+			1,
+			true,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testResolver := &testFieldResolver{}
+			p := NewProvider(testResolver).
+				Query(query).
+				Sort(s.sort).
+				Filter(s.filter).
+				MaxFilterExprLimit(s.maxFilterExprLimit).
+				MaxSortExprLimit(s.maxSortExprLimit)
+
+			_, err := p.Exec(&[]testTableStruct{})
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v", s.expectError, hasErr)
+			}
+		})
+	}
+}
+
+func TestProviderParseAndExec(t *testing.T) {
+	testDB, cleanup := createTestDB()
+	defer cleanup()
+
+	query := testDB.Select("*").
+		From("test").
+		Where(dbx.Not(dbx.HashExp{"test1": nil})).
+		OrderBy("test1 ASC")
+
+	scenarios := []struct {
+		name         string
+		queryString  string
+		expectError  bool
+		expectResult string
+	}{
+		{
+			"no extra query params (aka. use the provider presets)",
+			"",
+			false,
+			`{"items":[],"page":2,"perPage":123,"totalItems":2,"totalPages":1}`,
+		},
+		{
+			"invalid query",
+			"invalid;",
+			true,
+			"",
+		},
+		{
+			"invalid page",
+			"page=a",
+			true,
+			"",
+		},
+		{
+			"invalid perPage",
+			"perPage=a",
+			true,
+			"",
+		},
+		{
+			"invalid skipTotal",
+			"skipTotal=a",
+			true,
+			"",
+		},
+		{
+			"invalid sorting field",
+			"sort=-unknown",
+			true,
+			"",
+		},
+		{
+			"invalid filter field",
+			"filter=unknown>1",
+			true,
+			"",
+		},
+		{
+			"page > existing",
+			"page=3&perPage=9999",
+			false,
+			`{"items":[],"page":3,"perPage":1000,"totalItems":2,"totalPages":1}`,
+		},
+		{
+			"valid query params",
+			"page=1&perPage=9999&filter=test1>1&sort=-test2,test3",
+			false,
+			`{"items":[{"test1":2,"test2":"test2.2","test3":""}],"page":1,"perPage":1000,"totalItems":1,"totalPages":1}`,
+		},
+		{
+			"valid query params with skipTotal=1",
+			"page=1&perPage=9999&filter=test1>1&sort=-test2,test3&skipTotal=1",
+			false,
+			`{"items":[{"test1":2,"test2":"test2.2","test3":""}],"page":1,"perPage":1000,"totalItems":-1,"totalPages":-1}`,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			testDB.CalledQueries = []string{} // reset
+
+			testResolver := &testFieldResolver{}
+			provider := NewProvider(testResolver).
+				Query(query).
+				Page(2).
+				PerPage(123).
+				Sort([]SortField{{"test2", SortAsc}}).
+				Filter([]FilterData{"test1 > 0"})
+
+			result, err := provider.ParseAndExec(s.queryString, &[]testTableStruct{})
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if testResolver.UpdateQueryCalls != 1 {
+				t.Fatalf("Expected resolver.Update to be called %d, got %d", 1, testResolver.UpdateQueryCalls)
+			}
+
+			expectedQueries := 2
+			if provider.skipTotal {
+				expectedQueries = 1
+			}
+
+			if len(testDB.CalledQueries) != expectedQueries {
+				t.Fatalf("Expected %d db queries, got %d: \n%v", expectedQueries, len(testDB.CalledQueries), testDB.CalledQueries)
+			}
+
+			encoded, _ := json.Marshal(result)
+			if string(encoded) != s.expectResult {
+				t.Fatalf("Expected result \n%v\ngot\n%v", s.expectResult, string(encoded))
+			}
+		})
+	}
+}
+
+// -------------------------------------------------------------------
+// Helpers
+// -------------------------------------------------------------------
+
+type testTableStruct struct {
+	Test1 int    `db:"test1" json:"test1"`
+	Test2 string `db:"test2" json:"test2"`
+	Test3 string `db:"test3" json:"test3"`
+}
+
+type testDB struct {
+	*dbx.DB
+	CalledQueries []string
+}
+
+// NB! Don't forget to call `defer cleanup()` at the end of the test.
+func createTestDB() (*testDB, func()) {
+	/* SQLite:
+	// using a shared cache to allow multiple connections access to
+	// the same in memory database https://www.sqlite.org/inmemorydb.html
+	sqlDB, err := sql.Open("sqlite", "file::memory:?cache=shared")
+	if err != nil {
+		return nil, err
+	}
+
+	db := testDB{DB: dbx.NewFromDB(sqlDB, "sqlite")}
+	*/
+	db, cleanup := NewTestDBX()
+
+	db.CreateTable("test", map[string]string{
+		"id":                                    "int default 0",
+		"test1":                                 "int default 0",
+		"test2":                                 "text default ''",
+		"test3":                                 "text default ''",
+		strings.Repeat("a", MaxSortFieldLength): "text default ''",
+		strings.Repeat("b", MaxSortFieldLength+1): "text default ''",
+	}).Execute()
+	db.Insert("test", dbx.Params{"id": 1, "test1": 1, "test2": "test2.1"}).Execute()
+	db.Insert("test", dbx.Params{"id": 2, "test1": 2, "test2": "test2.2"}).Execute()
+	db.QueryLogFunc = func(ctx context.Context, t time.Duration, sql string, rows *sql.Rows, err error) {
+		db.CalledQueries = append(db.CalledQueries, sql)
+	}
+
+	return db, cleanup
+}
+
+func NewTestDBX() (db *testDB, cleanup func()) {
+	dbName := security.RandomString(5)
+	exec.Command("sh", "-c", fmt.Sprintf("PGPASSWORD=pass createdb -h 127.0.0.1 -U user %s", dbName)).Run()
+
+	sqlDB, err := sql.Open("pgx", fmt.Sprintf("postgres://user:pass@localhost:6432/%s?sslmode=disable", dbName))
+	if err != nil {
+		panic(err)
+	}
+
+	testDB := testDB{DB: dbx.NewFromDB(sqlDB, "pgx")}
+	cleanup = func() {
+		if err := sqlDB.Close(); err != nil {
+			panic(err)
+		}
+		exec.Command("sh", "-c", fmt.Sprintf("PGPASSWORD=pass dropdb --if-exists -h 127.0.0.1 -U user %s", dbName)).Run()
+	}
+
+	return &testDB, cleanup
+}
+
+// ---
+
+type testFieldResolver struct {
+	UpdateQueryCalls int
+	ResolveCalls     int
+}
+
+func (t *testFieldResolver) UpdateQuery(query *dbx.SelectQuery) error {
+	t.UpdateQueryCalls++
+	return nil
+}
+
+func (t *testFieldResolver) Resolve(field string) (*ResolverResult, error) {
+	t.ResolveCalls++
+
+	if field == "unknown" {
+		return nil, errors.New("test error")
+	}
+
+	return &ResolverResult{Identifier: field}, nil
+}
diff --git a/server/core_backend-server/tools/search/simple_field_resolver.go b/server/core_backend-server/tools/search/simple_field_resolver.go
new file mode 100644
index 0000000..7c3a55c
--- /dev/null
+++ b/server/core_backend-server/tools/search/simple_field_resolver.go
@@ -0,0 +1,131 @@
+package search
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/list"
+)
+
+// ResolverResult defines a single FieldResolver.Resolve() successfully parsed result.
+type ResolverResult struct {
+	// Identifier is the plain SQL identifier/column that will be used
+	// in the final db expression as left or right operand.
+	Identifier string
+
+	// NoCoalesce instructs to not use COALESCE or NULL fallbacks
+	// when building the identifier expression.
+	NoCoalesce bool
+
+	// Params is a map with db placeholder->value pairs that will be added
+	// to the query when building both resolved operands/sides in a single expression.
+	Params dbx.Params
+
+	// MultiMatchSubQuery is an optional sub query expression that will be added
+	// in addition to the combined ResolverResult expression during build.
+	MultiMatchSubQuery dbx.Expression
+
+	// AfterBuild is an optional function that will be called after building
+	// and combining the result of both resolved operands/sides in a single expression.
+	AfterBuild func(expr dbx.Expression) dbx.Expression
+}
+
+// FieldResolver defines an interface for managing search fields.
+type FieldResolver interface {
+	// UpdateQuery allows to updated the provided db query based on the
+	// resolved search fields (eg. adding joins aliases, etc.).
+	//
+	// Called internally by `search.Provider` before executing the search request.
+	UpdateQuery(query *dbx.SelectQuery) error
+
+	// Resolve parses the provided field and returns a properly
+	// formatted db identifier (eg. NULL, quoted column, placeholder parameter, etc.).
+	Resolve(field string) (*ResolverResult, error)
+}
+
+// NewSimpleFieldResolver creates a new `SimpleFieldResolver` with the
+// provided `allowedFields`.
+//
+// Each `allowedFields` could be a plain string (eg. "name")
+// or a regexp pattern (eg. `^\w+[\w\.]*$`).
+func NewSimpleFieldResolver(allowedFields ...string) *SimpleFieldResolver {
+	return &SimpleFieldResolver{
+		allowedFields: allowedFields,
+	}
+}
+
+// SimpleFieldResolver defines a generic search resolver that allows
+// only its listed fields to be resolved and take part in a search query.
+//
+// If `allowedFields` are empty no fields filtering is applied.
+type SimpleFieldResolver struct {
+	allowedFields []string
+}
+
+// UpdateQuery implements `search.UpdateQuery` interface.
+func (r *SimpleFieldResolver) UpdateQuery(query *dbx.SelectQuery) error {
+	// nothing to update...
+	return nil
+}
+
+// Resolve implements `search.Resolve` interface.
+//
+// Returns error if `field` is not in `r.allowedFields`.
+func (r *SimpleFieldResolver) Resolve(field string) (*ResolverResult, error) {
+	if !list.ExistInSliceWithRegex(field, r.allowedFields) {
+		return nil, fmt.Errorf("failed to resolve field %q", field)
+	}
+
+	parts := strings.Split(field, ".")
+
+	// single regular field
+	if len(parts) == 1 {
+		return &ResolverResult{
+			Identifier: "[[" + inflector.Columnify(parts[0]) + "]]",
+		}, nil
+	}
+
+	// treat as json path
+	var jsonPath strings.Builder
+	jsonPath.WriteString("$")
+	for _, part := range parts[1:] {
+		if _, err := strconv.Atoi(part); err == nil {
+			jsonPath.WriteString("[")
+			jsonPath.WriteString(inflector.Columnify(part))
+			jsonPath.WriteString("]")
+		} else {
+			jsonPath.WriteString(".")
+			jsonPath.WriteString(inflector.Columnify(part))
+		}
+	}
+
+	dbType := strings.ToLower(os.Getenv("DB_TYPE"))
+	identifier := ""
+	if dbType == "postgres" || dbType == "postgresql" {
+		// PostgreSQL:
+		// Note: we have to cast it to text because PostgreSQL always
+		// requires a determistic type for any expression. We will do
+		// more type casting while building the final db expression.
+		identifier = fmt.Sprintf(
+			"JSON_QUERY([[%s]]::jsonb, '%s')::jsonb",
+			inflector.Columnify(parts[0]),
+			jsonPath.String(),
+		)
+	} else {
+		// SQLite:
+		identifier = fmt.Sprintf(
+			"JSON_EXTRACT([[%s]], '%s')",
+			inflector.Columnify(parts[0]),
+			jsonPath.String(),
+		)
+	}
+
+	return &ResolverResult{
+		NoCoalesce: true,
+		Identifier: identifier,
+	}, nil
+}
diff --git a/server/core_backend-server/tools/search/simple_field_resolver_test.go b/server/core_backend-server/tools/search/simple_field_resolver_test.go
new file mode 100644
index 0000000..fb31182
--- /dev/null
+++ b/server/core_backend-server/tools/search/simple_field_resolver_test.go
@@ -0,0 +1,91 @@
+package search_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+func TestSimpleFieldResolverUpdateQuery(t *testing.T) {
+	r := search.NewSimpleFieldResolver("test")
+
+	scenarios := []struct {
+		fieldName   string
+		expectQuery string
+	}{
+		// missing field (the query shouldn't change)
+		{"", `SELECT "id" FROM "test"`},
+		// unknown field (the query shouldn't change)
+		{"unknown", `SELECT "id" FROM "test"`},
+		// allowed field (the query shouldn't change)
+		{"test", `SELECT "id" FROM "test"`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.fieldName), func(t *testing.T) {
+			db := dbx.NewFromDB(nil, "")
+			query := db.Select("id").From("test")
+
+			r.Resolve(s.fieldName)
+
+			if err := r.UpdateQuery(nil); err != nil {
+				t.Fatalf("UpdateQuery failed with error %v", err)
+			}
+
+			rawQuery := query.Build().SQL()
+
+			if rawQuery != s.expectQuery {
+				t.Fatalf("Expected query %v, got \n%v", s.expectQuery, rawQuery)
+			}
+		})
+	}
+}
+
+func TestSimpleFieldResolverResolve(t *testing.T) {
+	r := search.NewSimpleFieldResolver("test", `^test_regex\d+$`, "Test columnify!", "data.test")
+
+	scenarios := []struct {
+		fieldName   string
+		expectError bool
+		expectName  string
+	}{
+		{"", true, ""},
+		{" ", true, ""},
+		{"unknown", true, ""},
+		{"test", false, "[[test]]"},
+		{"test.sub", true, ""},
+		{"test_regex", true, ""},
+		{"test_regex1", false, "[[test_regex1]]"},
+		{"Test columnify!", false, "[[Testcolumnify]]"},
+		/* SQLite:
+		{"data.test", false, "JSON_EXTRACT([[data]], '$.test')"},
+		*/
+		// PostgreSQL:
+		{"data.test", false, "JSON_QUERY([[data]]::jsonb, '$.test')::jsonb"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.fieldName), func(t *testing.T) {
+			r, err := r.Resolve(s.fieldName)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if r.Identifier != s.expectName {
+				t.Fatalf("Expected r.Identifier %q, got %q", s.expectName, r.Identifier)
+			}
+
+			if len(r.Params) != 0 {
+				t.Fatalf("r.Params should be empty, got %v", r.Params)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/search/sort.go b/server/core_backend-server/tools/search/sort.go
new file mode 100644
index 0000000..dda2eac
--- /dev/null
+++ b/server/core_backend-server/tools/search/sort.go
@@ -0,0 +1,77 @@
+package search
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+const (
+	randomSortKey string = "@random"
+	rowidSortKey  string = "@rowid"
+)
+
+// sort field directions
+const (
+	SortAsc  string = "ASC"
+	SortDesc string = "DESC"
+)
+
+// SortField defines a single search sort field.
+type SortField struct {
+	Name      string `json:"name"`
+	Direction string `json:"direction"`
+}
+
+// BuildExpr resolves the sort field into a valid db sort expression.
+func (s *SortField) BuildExpr(fieldResolver FieldResolver) (string, error) {
+	// special case for random sort
+	if s.Name == randomSortKey {
+		return "RANDOM()", nil
+	}
+
+	// special case for the builtin SQLite rowid column
+	if s.Name == rowidSortKey {
+		dbType := strings.ToLower(os.Getenv("DB_TYPE"))
+		if dbType == "postgres" || dbType == "postgresql" {
+			return fmt.Sprintf("[[ctid]] %s", s.Direction), nil
+		}
+		if dbType == "mysql" {
+			// MySQL doesn't have rowid, fallback to id
+			return fmt.Sprintf("[[id]] %s", s.Direction), nil
+		}
+		// default to SQLite
+		return fmt.Sprintf("[[_rowid_]] %s", s.Direction), nil
+	}
+
+	result, err := fieldResolver.Resolve(s.Name)
+
+	// invalidate empty fields and non-column identifiers
+	if err != nil || len(result.Params) > 0 || result.Identifier == "" || strings.ToLower(result.Identifier) == "null" {
+		return "", fmt.Errorf("invalid sort field %q", s.Name)
+	}
+
+	return fmt.Sprintf("%s %s", result.Identifier, s.Direction), nil
+}
+
+// ParseSortFromString parses the provided string expression
+// into a slice of SortFields.
+//
+// Example:
+//
+//	fields := search.ParseSortFromString("-name,+created")
+func ParseSortFromString(str string) (fields []SortField) {
+	data := strings.Split(str, ",")
+
+	for _, field := range data {
+		// trim whitespaces
+		field = strings.TrimSpace(field)
+		if strings.HasPrefix(field, "-") {
+			fields = append(fields, SortField{strings.TrimPrefix(field, "-"), SortDesc})
+		} else {
+			fields = append(fields, SortField{strings.TrimPrefix(field, "+"), SortAsc})
+		}
+	}
+
+	return
+}
diff --git a/server/core_backend-server/tools/search/sort_test.go b/server/core_backend-server/tools/search/sort_test.go
new file mode 100644
index 0000000..92f2113
--- /dev/null
+++ b/server/core_backend-server/tools/search/sort_test.go
@@ -0,0 +1,82 @@
+package search_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/search"
+)
+
+func TestSortFieldBuildExpr(t *testing.T) {
+	resolver := search.NewSimpleFieldResolver("test1", "test2", "test3", "test4.sub")
+
+	scenarios := []struct {
+		sortField        search.SortField
+		expectError      bool
+		expectExpression string
+	}{
+		// empty
+		{search.SortField{"", search.SortDesc}, true, ""},
+		// unknown field
+		{search.SortField{"unknown", search.SortAsc}, true, ""},
+		// placeholder field
+		{search.SortField{"'test'", search.SortAsc}, true, ""},
+		// null field
+		{search.SortField{"null", search.SortAsc}, true, ""},
+		// allowed field - asc
+		{search.SortField{"test1", search.SortAsc}, false, "[[test1]] ASC"},
+		// allowed field - desc
+		{search.SortField{"test1", search.SortDesc}, false, "[[test1]] DESC"},
+		// special @random field (ignore direction)
+		{search.SortField{"@random", search.SortDesc}, false, "RANDOM()"},
+		// special _rowid_ field
+		/* SQLite:
+		{search.SortField{"@rowid", search.SortDesc}, false, "[[_rowid_]] DESC"},
+		*/
+		// PostgreSQL:
+		{search.SortField{"@rowid", search.SortDesc}, false, "[[ctid]] DESC"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("%s_%s", s.sortField.Name, s.sortField.Name), func(t *testing.T) {
+			result, err := s.sortField.BuildExpr(resolver)
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if result != s.expectExpression {
+				t.Fatalf("Expected expression %v, got %v", s.expectExpression, result)
+			}
+		})
+	}
+}
+
+func TestParseSortFromString(t *testing.T) {
+	scenarios := []struct {
+		value    string
+		expected string
+	}{
+		{"", `[{"name":"","direction":"ASC"}]`},
+		{"test", `[{"name":"test","direction":"ASC"}]`},
+		{"+test", `[{"name":"test","direction":"ASC"}]`},
+		{"-test", `[{"name":"test","direction":"DESC"}]`},
+		{"test1,-test2,+test3", `[{"name":"test1","direction":"ASC"},{"name":"test2","direction":"DESC"},{"name":"test3","direction":"ASC"}]`},
+		{"@random,-test", `[{"name":"@random","direction":"ASC"},{"name":"test","direction":"DESC"}]`},
+		{"-@rowid,-test", `[{"name":"@rowid","direction":"DESC"},{"name":"test","direction":"DESC"}]`},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.value, func(t *testing.T) {
+			result := search.ParseSortFromString(s.value)
+			encoded, _ := json.Marshal(result)
+			encodedStr := string(encoded)
+
+			if encodedStr != s.expected {
+				t.Fatalf("Expected expression %s, got %s", s.expected, encodedStr)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/search/token_functions.go b/server/core_backend-server/tools/search/token_functions.go
new file mode 100644
index 0000000..15f2471
--- /dev/null
+++ b/server/core_backend-server/tools/search/token_functions.go
@@ -0,0 +1,56 @@
+package search
+
+import (
+	"fmt"
+
+	"github.com/ganigeorgiev/fexpr"
+)
+
+var TokenFunctions = map[string]func(
+	argTokenResolverFunc func(fexpr.Token) (*ResolverResult, error),
+	args ...fexpr.Token,
+) (*ResolverResult, error){
+	// geoDistance(lonA, latA, lonB, latB) calculates the Haversine
+	// distance between 2 points in kilometres (https://www.movable-type.co.uk/scripts/latlong.html).
+	//
+	// The accepted arguments at the moment could be either a plain number or a column identifier (including NULL).
+	// If the column identifier cannot be resolved and converted to a numeric value, it resolves to NULL.
+	//
+	// Similar to the built-in SQLite functions, geoDistance doesn't apply
+	// a "match-all" constraints in case there are multiple relation fields arguments.
+	// Or in other words, if a collection has "orgs" multiple relation field pointing to "orgs" collection that has "office" as "geoPoint" field,
+	// then the filter: `geoDistance(orgs.office.lon, orgs.office.lat, 1, 2) < 200`
+	// will evaluate to true if for at-least-one of the "orgs.office" records the function result in a value satisfying the condition (aka. "result < 200").
+	"geoDistance": func(argTokenResolverFunc func(fexpr.Token) (*ResolverResult, error), args ...fexpr.Token) (*ResolverResult, error) {
+		if len(args) != 4 {
+			return nil, fmt.Errorf("[geoDistance] expected 4 arguments, got %d", len(args))
+		}
+
+		resolvedArgs := make([]*ResolverResult, 4)
+		for i, arg := range args {
+			if arg.Type != fexpr.TokenIdentifier && arg.Type != fexpr.TokenNumber {
+				return nil, fmt.Errorf("[geoDistance] argument %d must be an identifier or number", i)
+			}
+			resolved, err := argTokenResolverFunc(arg)
+			if err != nil {
+				return nil, fmt.Errorf("[geoDistance] failed to resolve argument %d: %w", i, err)
+			}
+			resolvedArgs[i] = resolved
+		}
+
+		lonA := resolvedArgs[0].Identifier
+		latA := resolvedArgs[1].Identifier
+		lonB := resolvedArgs[2].Identifier
+		latB := resolvedArgs[3].Identifier
+
+		return &ResolverResult{
+			NoCoalesce: true,
+			Identifier: `(6371 * acos(` +
+				`cos(radians(` + latA + `)) * cos(radians(` + latB + `)) * ` +
+				`cos(radians(` + lonB + `) - radians(` + lonA + `)) + ` +
+				`sin(radians(` + latA + `)) * sin(radians(` + latB + `))` +
+				`))`,
+			Params: mergeParams(resolvedArgs[0].Params, resolvedArgs[1].Params, resolvedArgs[2].Params, resolvedArgs[3].Params),
+		}, nil
+	},
+}
diff --git a/server/core_backend-server/tools/search/token_functions_test.go b/server/core_backend-server/tools/search/token_functions_test.go
new file mode 100644
index 0000000..f4555c3
--- /dev/null
+++ b/server/core_backend-server/tools/search/token_functions_test.go
@@ -0,0 +1,265 @@
+package search
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/ganigeorgiev/fexpr"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestTokenFunctionsGeoDistance(t *testing.T) {
+	t.Parallel()
+
+	fn, ok := TokenFunctions["geoDistance"]
+	if !ok {
+		t.Error("Expected geoDistance token function to be registered.")
+	}
+
+	baseTokenResolver := func(t fexpr.Token) (*ResolverResult, error) {
+		placeholder := "t" + security.PseudorandomString(5)
+		return &ResolverResult{Identifier: "{:" + placeholder + "}", Params: map[string]any{placeholder: t.Literal}}, nil
+	}
+
+	scenarios := []struct {
+		name      string
+		args      []fexpr.Token
+		resolver  func(t fexpr.Token) (*ResolverResult, error)
+		result    *ResolverResult
+		expectErr bool
+	}{
+		{
+			"no args",
+			nil,
+			baseTokenResolver,
+			nil,
+			true,
+		},
+		{
+			"< 4 args",
+			[]fexpr.Token{
+				{Literal: "1", Type: fexpr.TokenNumber},
+				{Literal: "2", Type: fexpr.TokenNumber},
+				{Literal: "3", Type: fexpr.TokenNumber},
+			},
+			baseTokenResolver,
+			nil,
+			true,
+		},
+		{
+			"> 4 args",
+			[]fexpr.Token{
+				{Literal: "1", Type: fexpr.TokenNumber},
+				{Literal: "2", Type: fexpr.TokenNumber},
+				{Literal: "3", Type: fexpr.TokenNumber},
+				{Literal: "4", Type: fexpr.TokenNumber},
+				{Literal: "5", Type: fexpr.TokenNumber},
+			},
+			baseTokenResolver,
+			nil,
+			true,
+		},
+		{
+			"unsupported function argument",
+			[]fexpr.Token{
+				{Literal: "1", Type: fexpr.TokenFunction},
+				{Literal: "2", Type: fexpr.TokenNumber},
+				{Literal: "3", Type: fexpr.TokenNumber},
+				{Literal: "4", Type: fexpr.TokenNumber},
+			},
+			baseTokenResolver,
+			nil,
+			true,
+		},
+		{
+			"unsupported text argument",
+			[]fexpr.Token{
+				{Literal: "1", Type: fexpr.TokenText},
+				{Literal: "2", Type: fexpr.TokenNumber},
+				{Literal: "3", Type: fexpr.TokenNumber},
+				{Literal: "4", Type: fexpr.TokenNumber},
+			},
+			baseTokenResolver,
+			nil,
+			true,
+		},
+		{
+			"4 valid arguments but with resolver error",
+			[]fexpr.Token{
+				{Literal: "1", Type: fexpr.TokenNumber},
+				{Literal: "2", Type: fexpr.TokenNumber},
+				{Literal: "3", Type: fexpr.TokenNumber},
+				{Literal: "4", Type: fexpr.TokenNumber},
+			},
+			func(t fexpr.Token) (*ResolverResult, error) {
+				return nil, errors.New("test")
+			},
+			nil,
+			true,
+		},
+		{
+			"4 valid arguments",
+			[]fexpr.Token{
+				{Literal: "1", Type: fexpr.TokenNumber},
+				{Literal: "2", Type: fexpr.TokenNumber},
+				{Literal: "3", Type: fexpr.TokenNumber},
+				{Literal: "4", Type: fexpr.TokenNumber},
+			},
+			baseTokenResolver,
+			&ResolverResult{
+				NoCoalesce: true,
+				Identifier: `(6371 * acos(cos(radians({:latA})) * cos(radians({:latB})) * cos(radians({:lonB}) - radians({:lonA})) + sin(radians({:latA})) * sin(radians({:latB}))))`,
+				Params: map[string]any{
+					"lonA": 1,
+					"latA": 2,
+					"lonB": 3,
+					"latB": 4,
+				},
+			},
+			false,
+		},
+		{
+			"mixed arguments",
+			[]fexpr.Token{
+				{Literal: "null", Type: fexpr.TokenIdentifier},
+				{Literal: "2", Type: fexpr.TokenNumber},
+				{Literal: "false", Type: fexpr.TokenIdentifier},
+				{Literal: "4", Type: fexpr.TokenNumber},
+			},
+			baseTokenResolver,
+			&ResolverResult{
+				NoCoalesce: true,
+				Identifier: `(6371 * acos(cos(radians({:latA})) * cos(radians({:latB})) * cos(radians({:lonB}) - radians({:lonA})) + sin(radians({:latA})) * sin(radians({:latB}))))`,
+				Params: map[string]any{
+					"lonA": "null",
+					"latA": 2,
+					"lonB": false,
+					"latB": 4,
+				},
+			},
+			false,
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result, err := fn(s.resolver, s.args...)
+
+			hasErr := err != nil
+			if hasErr != s.expectErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectErr, hasErr, err)
+			}
+
+			testCompareResults(t, s.result, result)
+		})
+	}
+}
+
+func TestTokenFunctionsGeoDistanceExec(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := createTestDB()
+	defer cleanup()
+
+	fn, ok := TokenFunctions["geoDistance"]
+	if !ok {
+		t.Error("Expected geoDistance token function to be registered.")
+	}
+
+	result, err := fn(
+		func(t fexpr.Token) (*ResolverResult, error) {
+			placeholder := "t" + security.PseudorandomString(5)
+			return &ResolverResult{Identifier: "{:" + placeholder + "}", Params: map[string]any{placeholder: t.Literal}}, nil
+		},
+		fexpr.Token{Literal: "23.23033854945808", Type: fexpr.TokenNumber},
+		fexpr.Token{Literal: "42.713146090563384", Type: fexpr.TokenNumber},
+		fexpr.Token{Literal: "23.44920680886216", Type: fexpr.TokenNumber},
+		fexpr.Token{Literal: "42.7078484153991", Type: fexpr.TokenNumber},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	column := []float64{}
+	err = testDB.NewQuery("select " + result.Identifier).Bind(result.Params).Column(&column)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(column) != 1 {
+		t.Fatalf("Expected exactly 1 column value as result, got %v", column)
+	}
+
+	expected := "17.89"
+	distance := fmt.Sprintf("%.2f", column[0])
+	if distance != expected {
+		t.Fatalf("Expected distance value %s, got %s", expected, distance)
+	}
+}
+
+// -------------------------------------------------------------------
+
+func testCompareResults(t *testing.T, a, b *ResolverResult) {
+	testDB, cleanup := createTestDB()
+	defer cleanup() // Updated to use cleanup instead of testDB.Close()
+
+	aIsNil := a == nil
+	bIsNil := b == nil
+	if aIsNil != bIsNil {
+		t.Fatalf("Expected aIsNil and bIsNil to be the same, got %v vs %v", aIsNil, bIsNil)
+	}
+
+	if aIsNil && bIsNil {
+		return
+	}
+
+	aHasAfterBuild := a.AfterBuild == nil
+	bHasAfterBuild := b.AfterBuild == nil
+	if aHasAfterBuild != bHasAfterBuild {
+		t.Fatalf("Expected aHasAfterBuild and bHasAfterBuild to be the same, got %v vs %v", aHasAfterBuild, bHasAfterBuild)
+	}
+
+	var aAfterBuild string
+	if a.AfterBuild != nil {
+		aAfterBuild = a.AfterBuild(dbx.NewExp("test")).Build(testDB.DB, a.Params)
+	}
+	var bAfterBuild string
+	if b.AfterBuild != nil {
+		bAfterBuild = b.AfterBuild(dbx.NewExp("test")).Build(testDB.DB, a.Params)
+	}
+	if aAfterBuild != bAfterBuild {
+		t.Fatalf("Expected bAfterBuild and bAfterBuild to be the same, got\n%s\nvs\n%s", aAfterBuild, bAfterBuild)
+	}
+
+	var aMultiMatchSubQuery string
+	if a.MultiMatchSubQuery != nil {
+		aMultiMatchSubQuery = a.MultiMatchSubQuery.Build(testDB.DB, a.Params)
+	}
+	var bMultiMatchSubQuery string
+	if b.MultiMatchSubQuery != nil {
+		bMultiMatchSubQuery = b.MultiMatchSubQuery.Build(testDB.DB, b.Params)
+	}
+	if aMultiMatchSubQuery != bMultiMatchSubQuery {
+		t.Fatalf("Expected bMultiMatchSubQuery and bMultiMatchSubQuery to be the same, got\n%s\nvs\n%s", aMultiMatchSubQuery, bMultiMatchSubQuery)
+	}
+
+	if a.NoCoalesce != b.NoCoalesce {
+		t.Fatalf("Expected NoCoalesce to match, got %v vs %v", a.NoCoalesce, b.NoCoalesce)
+	}
+
+	// loose placeholders replacement
+	var aResolved = a.Identifier
+	for k, v := range a.Params {
+		aResolved = strings.ReplaceAll(aResolved, "{:"+k+"}", fmt.Sprintf("%v", v))
+	}
+	var bResolved = b.Identifier
+	for k, v := range b.Params {
+		bResolved = strings.ReplaceAll(bResolved, "{:"+k+"}", fmt.Sprintf("%v", v))
+	}
+	if aResolved != bResolved {
+		t.Fatalf("Expected resolved identifiers to match, got\n%s\nvs\n%s", aResolved, bResolved)
+	}
+}
diff --git a/server/core_backend-server/tools/security/crypto.go b/server/core_backend-server/tools/security/crypto.go
new file mode 100644
index 0000000..4577873
--- /dev/null
+++ b/server/core_backend-server/tools/security/crypto.go
@@ -0,0 +1,62 @@
+package security
+
+import (
+	"crypto/hmac"
+	"crypto/md5"
+	"crypto/sha256"
+	"crypto/sha512"
+	"crypto/subtle"
+	"encoding/base64"
+	"fmt"
+	"strings"
+)
+
+// S256Challenge creates base64 encoded sha256 challenge string derived from code.
+// The padding of the result base64 string is stripped per [RFC 7636].
+//
+// [RFC 7636]: https://datatracker.ietf.org/doc/html/rfc7636#section-4.2
+func S256Challenge(code string) string {
+	h := sha256.New()
+	h.Write([]byte(code))
+	return strings.TrimRight(base64.URLEncoding.EncodeToString(h.Sum(nil)), "=")
+}
+
+// MD5 creates md5 hash from the provided plain text.
+func MD5(text string) string {
+	h := md5.New()
+	h.Write([]byte(text))
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+
+// SHA256 creates sha256 hash as defined in FIPS 180-4 from the provided text.
+func SHA256(text string) string {
+	h := sha256.New()
+	h.Write([]byte(text))
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+
+// SHA512 creates sha512 hash as defined in FIPS 180-4 from the provided text.
+func SHA512(text string) string {
+	h := sha512.New()
+	h.Write([]byte(text))
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+
+// HS256 creates a HMAC hash with sha256 digest algorithm.
+func HS256(text string, secret string) string {
+	h := hmac.New(sha256.New, []byte(secret))
+	h.Write([]byte(text))
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+
+// HS512 creates a HMAC hash with sha512 digest algorithm.
+func HS512(text string, secret string) string {
+	h := hmac.New(sha512.New, []byte(secret))
+	h.Write([]byte(text))
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+
+// Equal compares two hash strings for equality without leaking timing information.
+func Equal(hash1 string, hash2 string) bool {
+	return subtle.ConstantTimeCompare([]byte(hash1), []byte(hash2)) == 1
+}
diff --git a/server/core_backend-server/tools/security/crypto_test.go b/server/core_backend-server/tools/security/crypto_test.go
new file mode 100644
index 0000000..36134d4
--- /dev/null
+++ b/server/core_backend-server/tools/security/crypto_test.go
@@ -0,0 +1,156 @@
+package security_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestS256Challenge(t *testing.T) {
+	scenarios := []struct {
+		code     string
+		expected string
+	}{
+		{"", "47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU"},
+		{"123", "pmWkWSBCL51Bfkhn79xPuKBKHz__H6B-mY6G9_eieuM"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.code, func(t *testing.T) {
+			result := security.S256Challenge(s.code)
+
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestMD5(t *testing.T) {
+	scenarios := []struct {
+		code     string
+		expected string
+	}{
+		{"", "d41d8cd98f00b204e9800998ecf8427e"},
+		{"123", "202cb962ac59075b964b07152d234b70"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.code, func(t *testing.T) {
+			result := security.MD5(s.code)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestSHA256(t *testing.T) {
+	scenarios := []struct {
+		code     string
+		expected string
+	}{
+		{"", "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
+		{"123", "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.code, func(t *testing.T) {
+			result := security.SHA256(s.code)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestSHA512(t *testing.T) {
+	scenarios := []struct {
+		code     string
+		expected string
+	}{
+		{"", "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e"},
+		{"123", "3c9909afec25354d551dae21590bb26e38d53f2173b8d3dc3eee4c047e7ab1c1eb8b85103e3be7ba613b31bb5c9c36214dc9f14a42fd7a2fdb84856bca5c44c2"},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.code, func(t *testing.T) {
+			result := security.SHA512(s.code)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestHS256(t *testing.T) {
+	scenarios := []struct {
+		text     string
+		secret   string
+		expected string
+	}{
+		{" ", "test", "9fb4e4a12d50728683a222b4fc466a69ee977332cfcdd6b9ebb44c7121dbd99f"},
+		{" ", "test2", "d792417a504716e22805d940125ec12e68e8cb18fc84674703bd96c59f1e1228"},
+		{"hello", "test", "f151ea24bda91a18e89b8bb5793ef324b2a02133cce15a28a719acbd2e58a986"},
+		{"hello", "test2", "16436e8dcbf3d7b5b0455573b27e6372699beb5bfe94e6a2a371b14b4ae068f4"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d-%s", i, s.text), func(t *testing.T) {
+			result := security.HS256(s.text, s.secret)
+
+			if result != s.expected {
+				t.Fatalf("Expected \n%v, \ngot \n%v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestHS512(t *testing.T) {
+	scenarios := []struct {
+		text     string
+		secret   string
+		expected string
+	}{
+		{" ", "test", "eb3bdb0352c95c38880c1f645fc7e1d1332644f938f50de0d73876e42d6f302e599bb526531ba79940e8b314369aaef3675322d8d851f9fc6ea9ed121286d196"},
+		{" ", "test2", "8b69e84e9252af78ae8b1c4bed3c9f737f69a3df33064cfbefe76b36d19d1827285e543cdf066cdc8bd556cc0cd0e212d52e9c12a50cd16046181ff127f4cf7f"},
+		{"hello", "test", "44f280e11103e295c26cd61dd1cdd8178b531b860466867c13b1c37a26b6389f8af110efbe0bb0717b9d9c87f6fe1c97b3b1690936578890e5669abf279fe7fd"},
+		{"hello", "test2", "d7f10b1b66941b20817689b973ca9dfc971090e28cfb8becbddd6824569b323eca6a0cdf2c387aa41e15040007dca5a011dd4e4bb61cfd5011aa7354d866f6ef"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d-%q", i, s.text), func(t *testing.T) {
+			result := security.HS512(s.text, s.secret)
+
+			if result != s.expected {
+				t.Fatalf("Expected \n%v, \ngot \n%v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestEqual(t *testing.T) {
+	scenarios := []struct {
+		hash1    string
+		hash2    string
+		expected bool
+	}{
+		{"", "", true},
+		{"abc", "abd", false},
+		{"abc", "abc", true},
+	}
+
+	for _, s := range scenarios {
+		t.Run(fmt.Sprintf("%qVS%q", s.hash1, s.hash2), func(t *testing.T) {
+			result := security.Equal(s.hash1, s.hash2)
+
+			if result != s.expected {
+				t.Fatalf("Expected %v, got %v", s.expected, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/security/encrypt.go b/server/core_backend-server/tools/security/encrypt.go
new file mode 100644
index 0000000..7e25e9e
--- /dev/null
+++ b/server/core_backend-server/tools/security/encrypt.go
@@ -0,0 +1,62 @@
+package security
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	crand "crypto/rand"
+	"encoding/base64"
+	"io"
+)
+
+// Encrypt encrypts "data" with the specified "key" (must be valid 32 char AES key).
+//
+// This method uses AES-256-GCM block cypher mode.
+func Encrypt(data []byte, key string) (string, error) {
+	block, err := aes.NewCipher([]byte(key))
+	if err != nil {
+		return "", err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+
+	// populates the nonce with a cryptographically secure random sequence
+	if _, err := io.ReadFull(crand.Reader, nonce); err != nil {
+		return "", err
+	}
+
+	cipherByte := gcm.Seal(nonce, nonce, data, nil)
+
+	result := base64.StdEncoding.EncodeToString(cipherByte)
+
+	return result, nil
+}
+
+// Decrypt decrypts encrypted text with key (must be valid 32 chars AES key).
+//
+// This method uses AES-256-GCM block cypher mode.
+func Decrypt(cipherText string, key string) ([]byte, error) {
+	block, err := aes.NewCipher([]byte(key))
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	nonceSize := gcm.NonceSize()
+
+	cipherByte, err := base64.StdEncoding.DecodeString(cipherText)
+	if err != nil {
+		return nil, err
+	}
+
+	nonce, cipherByteClean := cipherByte[:nonceSize], cipherByte[nonceSize:]
+	return gcm.Open(nil, nonce, cipherByteClean, nil)
+}
diff --git a/server/core_backend-server/tools/security/encrypt_test.go b/server/core_backend-server/tools/security/encrypt_test.go
new file mode 100644
index 0000000..1931672
--- /dev/null
+++ b/server/core_backend-server/tools/security/encrypt_test.go
@@ -0,0 +1,80 @@
+package security_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestEncrypt(t *testing.T) {
+	scenarios := []struct {
+		data        string
+		key         string
+		expectError bool
+	}{
+		{"", "", true},
+		{"123", "test", true}, // key must be valid 32 char aes string
+		{"123", "abcdabcdabcdabcdabcdabcdabcdabcd", false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.data), func(t *testing.T) {
+			result, err := security.Encrypt([]byte(s.data), s.key)
+
+			hasErr := err != nil
+
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				if result != "" {
+					t.Fatalf("Expected empty Encrypt result on error, got %q", result)
+				}
+
+				return
+			}
+
+			// try to decrypt
+			decrypted, err := security.Decrypt(result, s.key)
+			if err != nil || string(decrypted) != s.data {
+				t.Fatalf("Expected decrypted value to match with the data input, got %q (%v)", decrypted, err)
+			}
+		})
+	}
+}
+
+func TestDecrypt(t *testing.T) {
+	scenarios := []struct {
+		cipher       string
+		key          string
+		expectError  bool
+		expectedData string
+	}{
+		{"", "", true, ""},
+		{"123", "test", true, ""}, // key must be valid 32 char aes string
+		{"8kcEqilvvYKYcfnSr0aSC54gmnQCsB02SaB8ATlnA==", "abcdabcdabcdabcdabcdabcdabcdabcd", true, ""}, // illegal base64 encoded cipherText
+		{"8kcEqilvv+YKYcfnSr0aSC54gmnQCsB02SaB8ATlnA==", "abcdabcdabcdabcdabcdabcdabcdabcd", false, "123"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.key), func(t *testing.T) {
+			result, err := security.Decrypt(s.cipher, s.key)
+
+			hasErr := err != nil
+
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if hasErr {
+				return
+			}
+
+			if str := string(result); str != s.expectedData {
+				t.Fatalf("Expected %q, got %q", s.expectedData, str)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/security/jwt.go b/server/core_backend-server/tools/security/jwt.go
new file mode 100644
index 0000000..9169468
--- /dev/null
+++ b/server/core_backend-server/tools/security/jwt.go
@@ -0,0 +1,56 @@
+package security
+
+import (
+	"errors"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// ParseUnverifiedJWT parses JWT and returns its claims
+// but DOES NOT verify the signature.
+//
+// It verifies only the exp, iat and nbf claims.
+func ParseUnverifiedJWT(token string) (jwt.MapClaims, error) {
+	claims := jwt.MapClaims{}
+
+	parser := &jwt.Parser{}
+	_, _, err := parser.ParseUnverified(token, claims)
+
+	if err == nil {
+		err = jwt.NewValidator(jwt.WithIssuedAt()).Validate(claims)
+	}
+
+	return claims, err
+}
+
+// ParseJWT verifies and parses JWT and returns its claims.
+func ParseJWT(token string, verificationKey string) (jwt.MapClaims, error) {
+	parser := jwt.NewParser(jwt.WithValidMethods([]string{"HS256"}))
+
+	parsedToken, err := parser.Parse(token, func(t *jwt.Token) (any, error) {
+		return []byte(verificationKey), nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if claims, ok := parsedToken.Claims.(jwt.MapClaims); ok && parsedToken.Valid {
+		return claims, nil
+	}
+
+	return nil, errors.New("unable to parse token")
+}
+
+// NewJWT generates and returns new HS256 signed JWT.
+func NewJWT(payload jwt.MapClaims, signingKey string, duration time.Duration) (string, error) {
+	claims := jwt.MapClaims{
+		"exp": time.Now().Add(duration).Unix(),
+	}
+
+	for k, v := range payload {
+		claims[k] = v
+	}
+
+	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(signingKey))
+}
diff --git a/server/core_backend-server/tools/security/jwt_test.go b/server/core_backend-server/tools/security/jwt_test.go
new file mode 100644
index 0000000..afb636d
--- /dev/null
+++ b/server/core_backend-server/tools/security/jwt_test.go
@@ -0,0 +1,185 @@
+package security_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestParseUnverifiedJWT(t *testing.T) {
+	// invalid formatted JWT
+	result1, err1 := security.ParseUnverifiedJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCJ9")
+	if err1 == nil {
+		t.Error("Expected error got nil")
+	}
+	if len(result1) > 0 {
+		t.Error("Expected no parsed claims, got", result1)
+	}
+
+	// properly formatted JWT with INVALID claims
+	// {"name": "test", "exp":1516239022}
+	result2, err2 := security.ParseUnverifiedJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCIsImV4cCI6MTUxNjIzOTAyMn0.xYHirwESfSEW3Cq2BL47CEASvD_p_ps3QCA54XtNktU")
+	if err2 == nil {
+		t.Error("Expected error got nil")
+	}
+	if len(result2) != 2 || result2["name"] != "test" {
+		t.Errorf("Expected to have 2 claims, got %v", result2)
+	}
+
+	// properly formatted JWT with VALID claims (missing exp)
+	// {"name": "test"}
+	result3, err3 := security.ParseUnverifiedJWT("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCJ9.ml0QsTms3K9wMygTu41ZhKlTyjmW9zHQtoS8FUsCCjU")
+	if err3 != nil {
+		t.Error("Expected nil, got", err3)
+	}
+	if len(result3) != 1 || result3["name"] != "test" {
+		t.Errorf("Expected to have 1 claim, got %v", result3)
+	}
+
+	// properly formatted JWT with VALID claims (valid exp)
+	// {"name": "test", "exp": 2524604461}
+	result4, err4 := security.ParseUnverifiedJWT("eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuYW1lIjoidGVzdCIsImV4cCI6MjUyNDYwNDQ2MX0.VIEO73GP5QRQOSfHgQhaqeuYqcx59vL3xlxmFP-fytQ")
+	if err4 != nil {
+		t.Error("Expected nil, got", err4)
+	}
+	if len(result4) != 2 || result4["name"] != "test" {
+		t.Errorf("Expected to have 2 claims, got %v", result4)
+	}
+}
+
+func TestParseJWT(t *testing.T) {
+	scenarios := []struct {
+		name         string
+		token        string
+		secret       string
+		expectError  bool
+		expectClaims jwt.MapClaims
+	}{
+		{
+			"invalid formatted JWT",
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCJ9",
+			"test",
+			true,
+			nil,
+		},
+		{
+			"properly formatted JWT with INVALID claims and INVALID secret",
+			// {"name": "test", "exp": 1516239022}
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCIsImV4cCI6MTUxNjIzOTAyMn0.xYHirwESfSEW3Cq2BL47CEASvD_p_ps3QCA54XtNktU",
+			"invalid",
+			true,
+			nil,
+		},
+		{
+			"properly formatted JWT with INVALID claims and VALID secret",
+			// {"name": "test", "exp": 1516239022}
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCIsImV4cCI6MTUxNjIzOTAyMn0.xYHirwESfSEW3Cq2BL47CEASvD_p_ps3QCA54XtNktU",
+			"test",
+			true,
+			nil,
+		},
+		{
+			"properly formatted JWT with VALID claims and INVALID secret",
+			// {"name": "test", "exp": 2524604461}
+			"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuYW1lIjoidGVzdCIsImV4cCI6MjUyNDYwNDQ2MX0.VIEO73GP5QRQOSfHgQhaqeuYqcx59vL3xlxmFP-fytQ",
+			"invalid",
+			true,
+			nil,
+		},
+		{
+			"properly formatted JWT with VALID claims and VALID secret",
+			// {"name": "test", "exp": 2524604461}
+			"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJuYW1lIjoidGVzdCIsImV4cCI6MjUyNDYwNDQ2MX0.VIEO73GP5QRQOSfHgQhaqeuYqcx59vL3xlxmFP-fytQ",
+			"test",
+			false,
+			jwt.MapClaims{"name": "test", "exp": 2524604461.0},
+		},
+		{
+			"properly formatted JWT with VALID claims (without exp) and VALID secret",
+			// {"name": "test"}
+			"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCJ9.ml0QsTms3K9wMygTu41ZhKlTyjmW9zHQtoS8FUsCCjU",
+			"test",
+			false,
+			jwt.MapClaims{"name": "test"},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result, err := security.ParseJWT(s.token, s.secret)
+
+			hasErr := err != nil
+
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if len(result) != len(s.expectClaims) {
+				t.Fatalf("Expected %v claims got %v", s.expectClaims, result)
+			}
+
+			for k, v := range s.expectClaims {
+				v2, ok := result[k]
+				if !ok {
+					t.Fatalf("Missing expected claim %q", k)
+				}
+				if v != v2 {
+					t.Fatalf("Expected %v for %q claim, got %v", v, k, v2)
+				}
+			}
+		})
+	}
+}
+
+func TestNewJWT(t *testing.T) {
+	scenarios := []struct {
+		name        string
+		claims      jwt.MapClaims
+		key         string
+		duration    time.Duration
+		expectError bool
+	}{
+		{"empty, zero duration", jwt.MapClaims{}, "", 0, true},
+		{"empty, 10 seconds duration", jwt.MapClaims{}, "", 10 * time.Second, false},
+		{"non-empty, 10 seconds duration", jwt.MapClaims{"name": "test"}, "test", 10 * time.Second, false},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			token, tokenErr := security.NewJWT(s.claims, s.key, s.duration)
+			if tokenErr != nil {
+				t.Fatalf("Expected NewJWT to succeed, got error %v", tokenErr)
+			}
+
+			claims, parseErr := security.ParseJWT(token, s.key)
+
+			hasParseErr := parseErr != nil
+			if hasParseErr != s.expectError {
+				t.Fatalf("Expected hasParseErr to be %v, got %v (%v)", s.expectError, hasParseErr, parseErr)
+			}
+
+			if s.expectError {
+				return
+			}
+
+			if _, ok := claims["exp"]; !ok {
+				t.Fatalf("Missing required claim exp, got %v", claims)
+			}
+
+			// clear exp claim to match with the scenario ones
+			delete(claims, "exp")
+
+			if len(claims) != len(s.claims) {
+				t.Fatalf("Expected %v claims, got %v", s.claims, claims)
+			}
+
+			for k, v := range claims {
+				if v != s.claims[k] {
+					t.Fatalf("Expected %v for %q claim, got %v", s.claims[k], k, v)
+				}
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/security/random.go b/server/core_backend-server/tools/security/random.go
new file mode 100644
index 0000000..b931c84
--- /dev/null
+++ b/server/core_backend-server/tools/security/random.go
@@ -0,0 +1,59 @@
+package security
+
+import (
+	cryptoRand "crypto/rand"
+	"math/big"
+	mathRand "math/rand/v2"
+)
+
+const defaultRandomAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+
+// RandomString generates a cryptographically random string with the specified length.
+//
+// The generated string matches [A-Za-z0-9]+ and it's transparent to URL-encoding.
+func RandomString(length int) string {
+	return RandomStringWithAlphabet(length, defaultRandomAlphabet)
+}
+
+// RandomStringWithAlphabet generates a cryptographically random string
+// with the specified length and characters set.
+//
+// It panics if for some reason rand.Int returns a non-nil error.
+func RandomStringWithAlphabet(length int, alphabet string) string {
+	b := make([]byte, length)
+	max := big.NewInt(int64(len(alphabet)))
+
+	for i := range b {
+		n, err := cryptoRand.Int(cryptoRand.Reader, max)
+		if err != nil {
+			panic(err)
+		}
+		b[i] = alphabet[n.Int64()]
+	}
+
+	return string(b)
+}
+
+// PseudorandomString generates a pseudorandom string with the specified length.
+//
+// The generated string matches [A-Za-z0-9]+ and it's transparent to URL-encoding.
+//
+// For a cryptographically random string (but a little bit slower) use RandomString instead.
+func PseudorandomString(length int) string {
+	return PseudorandomStringWithAlphabet(length, defaultRandomAlphabet)
+}
+
+// PseudorandomStringWithAlphabet generates a pseudorandom string
+// with the specified length and characters set.
+//
+// For a cryptographically random (but a little bit slower) use RandomStringWithAlphabet instead.
+func PseudorandomStringWithAlphabet(length int, alphabet string) string {
+	b := make([]byte, length)
+	max := len(alphabet)
+
+	for i := range b {
+		b[i] = alphabet[mathRand.IntN(max)]
+	}
+
+	return string(b)
+}
diff --git a/server/core_backend-server/tools/security/random_by_regex.go b/server/core_backend-server/tools/security/random_by_regex.go
new file mode 100644
index 0000000..c7eb78f
--- /dev/null
+++ b/server/core_backend-server/tools/security/random_by_regex.go
@@ -0,0 +1,187 @@
+package security
+
+import (
+	cryptoRand "crypto/rand"
+	"errors"
+	"fmt"
+	"math/big"
+	"regexp/syntax"
+	"strings"
+
+	"github.com/google/uuid"
+)
+
+const defaultMaxRepeat = 6
+
+var anyCharNotNLPairs = []rune{'A', 'Z', 'a', 'z', '0', '9'}
+
+const PredefinedAutoGeneratePattern_uuidv7 = "<uuidv7>"
+
+// RandomStringByRegex generates a random string matching the regex pattern.
+// If optFlags is not set, fallbacks to [syntax.Perl].
+//
+// NB! While the source of the randomness comes from [crypto/rand] this method
+// is not recommended to be used on its own in critical secure contexts because
+// the generated length could vary too much on the used pattern and may not be
+// as secure as simply calling [security.RandomString].
+// If you still insist on using it for such purposes, consider at least
+// a large enough minimum length for the generated string, e.g. `[a-z0-9]{30}`.
+//
+// This function is inspired by github.com/pipe01/revregexp, github.com/lucasjones/reggen and other similar packages.
+func RandomStringByRegex(pattern string, optFlags ...syntax.Flags) (string, error) {
+	if pattern == PredefinedAutoGeneratePattern_uuidv7 {
+		id, _ := uuid.NewV7()
+		return id.String(), nil
+	}
+	var flags syntax.Flags
+	if len(optFlags) == 0 {
+		flags = syntax.Perl
+	} else {
+		for _, f := range optFlags {
+			flags |= f
+		}
+	}
+
+	r, err := syntax.Parse(pattern, flags)
+	if err != nil {
+		return "", err
+	}
+
+	var sb = new(strings.Builder)
+
+	err = writeRandomStringByRegex(r, sb)
+	if err != nil {
+		return "", err
+	}
+
+	return sb.String(), nil
+}
+
+func writeRandomStringByRegex(r *syntax.Regexp, sb *strings.Builder) error {
+	// https://pkg.go.dev/regexp/syntax#Op
+	switch r.Op {
+	case syntax.OpCharClass:
+		c, err := randomRuneFromPairs(r.Rune)
+		if err != nil {
+			return err
+		}
+		_, err = sb.WriteRune(c)
+		return err
+	case syntax.OpAnyChar, syntax.OpAnyCharNotNL:
+		c, err := randomRuneFromPairs(anyCharNotNLPairs)
+		if err != nil {
+			return err
+		}
+		_, err = sb.WriteRune(c)
+		return err
+	case syntax.OpAlternate:
+		idx, err := randomNumber(len(r.Sub))
+		if err != nil {
+			return err
+		}
+		return writeRandomStringByRegex(r.Sub[idx], sb)
+	case syntax.OpConcat:
+		var err error
+		for _, sub := range r.Sub {
+			err = writeRandomStringByRegex(sub, sb)
+			if err != nil {
+				break
+			}
+		}
+		return err
+	case syntax.OpRepeat:
+		return repeatRandomStringByRegex(r.Sub[0], sb, r.Min, r.Max)
+	case syntax.OpQuest:
+		return repeatRandomStringByRegex(r.Sub[0], sb, 0, 1)
+	case syntax.OpPlus:
+		return repeatRandomStringByRegex(r.Sub[0], sb, 1, -1)
+	case syntax.OpStar:
+		return repeatRandomStringByRegex(r.Sub[0], sb, 0, -1)
+	case syntax.OpCapture:
+		return writeRandomStringByRegex(r.Sub[0], sb)
+	case syntax.OpLiteral:
+		_, err := sb.WriteString(string(r.Rune))
+		return err
+	default:
+		return fmt.Errorf("unsupported pattern operator %d", r.Op)
+	}
+}
+
+func repeatRandomStringByRegex(r *syntax.Regexp, sb *strings.Builder, min int, max int) error {
+	if max < 0 {
+		max = defaultMaxRepeat
+	}
+
+	if max < min {
+		max = min
+	}
+
+	n := min
+	if max != min {
+		randRange, err := randomNumber(max - min)
+		if err != nil {
+			return err
+		}
+		n += randRange
+	}
+
+	var err error
+	for i := 0; i < n; i++ {
+		err = writeRandomStringByRegex(r, sb)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func randomRuneFromPairs(pairs []rune) (rune, error) {
+	if len(pairs)%2 != 0 {
+		return 0, fmt.Errorf("invalid pairs slice: odd number of elements")
+	}
+
+	// Pre-calculate the cumulative size of all ranges to make the selection process more efficient.
+	cumulativeSizes := make([]int, len(pairs)/2)
+	totalRunes := 0
+	for i := 0; i < len(pairs); i += 2 {
+		start, end := pairs[i], pairs[i+1]
+		if start > end {
+			return 0, fmt.Errorf("invalid range: start '%c' > end '%c'", start, end)
+		}
+		totalRunes += int(end - start + 1)
+		cumulativeSizes[i/2] = totalRunes
+	}
+
+	if totalRunes == 0 {
+		return 0, errors.New("no runes to choose from")
+	}
+
+	// Select a random number in the range of total runes.
+	runeNumber, err := randomNumber(totalRunes)
+	if err != nil {
+		return 0, fmt.Errorf("failed to generate random number: %w", err)
+	}
+
+	// Find which range the selected number falls into using the pre-calculated cumulative sizes.
+	for i, size := range cumulativeSizes {
+		if runeNumber < size {
+			startRune := pairs[i*2]
+			previousSize := 0
+			if i > 0 {
+				previousSize = cumulativeSizes[i-1]
+			}
+			return startRune + rune(runeNumber-previousSize), nil
+		}
+	}
+
+	// This part should be unreachable if the logic is correct.
+	// It indicates a bug in this function or in randomNumber.
+	panic("unreachable: failed to find a rune")
+}
+
+func randomNumber(maxSoft int) (int, error) {
+	randRange, err := cryptoRand.Int(cryptoRand.Reader, big.NewInt(int64(maxSoft)))
+
+	return int(randRange.Int64()), err
+}
diff --git a/server/core_backend-server/tools/security/random_by_regex_test.go b/server/core_backend-server/tools/security/random_by_regex_test.go
new file mode 100644
index 0000000..208e855
--- /dev/null
+++ b/server/core_backend-server/tools/security/random_by_regex_test.go
@@ -0,0 +1,75 @@
+package security_test
+
+import (
+	"fmt"
+	"regexp"
+	"regexp/syntax"
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestRandomStringByRegex(t *testing.T) {
+	generated := []string{}
+
+	scenarios := []struct {
+		pattern     string
+		flags       []syntax.Flags
+		expectError bool
+	}{
+		{``, nil, true},
+		{`test`, nil, false},
+		{`\d+`, []syntax.Flags{syntax.POSIX}, true},
+		{`\d+`, nil, false},
+		{`\d*`, nil, false},
+		{`\d{1,20}`, nil, false},
+		{`\d{5}`, nil, false},
+		{`\d{0,}-abc`, nil, false},
+		{`[a-zA-Z_]*`, nil, false},
+		{`[^a-zA-Z]{5,30}`, nil, false},
+		{`\w+_abc`, nil, false},
+		{`[2-9]{10}-\w+`, nil, false},
+		{`(a|b|c)`, nil, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%q", i, s.pattern), func(t *testing.T) {
+			var run func(int)
+			run = func(attempt int) {
+				str, err := security.RandomStringByRegex(s.pattern, s.flags...)
+
+				hasErr := err != nil
+				if hasErr != s.expectError {
+					t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+				}
+
+				if hasErr {
+					return
+				}
+
+				r, err := regexp.Compile(s.pattern)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if !r.Match([]byte(str)) {
+					t.Fatalf("Expected %q to match pattern %v", str, s.pattern)
+				}
+
+				if slices.Contains(generated, str) {
+					if attempt > 3 {
+						t.Fatalf("The generated string %q already exists in\n%v", str, generated)
+					}
+
+					// rerun
+					run(attempt + 1)
+					return
+				}
+
+				generated = append(generated, str)
+			}
+
+			run(1)
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/security/random_test.go b/server/core_backend-server/tools/security/random_test.go
new file mode 100644
index 0000000..d0f8ece
--- /dev/null
+++ b/server/core_backend-server/tools/security/random_test.go
@@ -0,0 +1,111 @@
+package security_test
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/security"
+)
+
+func TestRandomString(t *testing.T) {
+	testRandomString(t, security.RandomString)
+}
+
+func TestRandomStringWithAlphabet(t *testing.T) {
+	testRandomStringWithAlphabet(t, security.RandomStringWithAlphabet)
+}
+
+func TestPseudorandomString(t *testing.T) {
+	testRandomString(t, security.PseudorandomString)
+}
+
+func TestPseudorandomStringWithAlphabet(t *testing.T) {
+	testRandomStringWithAlphabet(t, security.PseudorandomStringWithAlphabet)
+}
+
+// -------------------------------------------------------------------
+
+func testRandomStringWithAlphabet(t *testing.T, randomFunc func(n int, alphabet string) string) {
+	scenarios := []struct {
+		alphabet      string
+		expectPattern string
+	}{
+		{"0123456789_", `[0-9_]+`},
+		{"abcdef123", `[abcdef123]+`},
+		{"!@#$%^&*()", `[\!\@\#\$\%\^\&\*\(\)]+`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%q", i, s.alphabet), func(t *testing.T) {
+			generated := make([]string, 0, 500)
+			length := 10
+
+			for j := 0; j < 500; j++ {
+				var run func(int)
+				run = func(attempt int) {
+					result := randomFunc(length, s.alphabet)
+
+					if len(result) != length {
+						t.Fatalf("(%d) Expected the length of the string to be %d, got %d", j, length, len(result))
+					}
+
+					reg := regexp.MustCompile(s.expectPattern)
+					if match := reg.MatchString(result); !match {
+						t.Fatalf("(%d) The generated string should have only %s characters, got %q", j, s.expectPattern, result)
+					}
+
+					if slices.Contains(generated, result) {
+						if attempt > 3 {
+							t.Fatalf("(%d) Repeating random string - found %q in %q", j, result, generated)
+						}
+
+						// rerun
+						run(attempt + 1)
+						return
+					}
+
+					generated = append(generated, result)
+				}
+
+				run(1)
+			}
+		})
+	}
+}
+
+func testRandomString(t *testing.T, randomFunc func(n int) string) {
+	generated := make([]string, 0, 500)
+	reg := regexp.MustCompile(`[a-zA-Z0-9]+`)
+	length := 10
+
+	for i := 0; i < 500; i++ {
+		var run func(int)
+		run = func(attempt int) {
+			result := randomFunc(length)
+
+			if len(result) != length {
+				t.Fatalf("(%d) Expected the length of the string to be %d, got %d", i, length, len(result))
+			}
+
+			if match := reg.MatchString(result); !match {
+				t.Fatalf("(%d) The generated string should have only [a-zA-Z0-9]+ characters, got %q", i, result)
+			}
+
+			if slices.Contains(generated, result) {
+				if attempt > 3 {
+					t.Fatalf("(%d) Repeating random string - found %q in \n%v", i, result, generated)
+				}
+
+				// rerun
+				run(attempt + 1)
+				return
+			}
+
+			generated = append(generated, result)
+		}
+
+		run(1)
+	}
+}
diff --git a/server/core_backend-server/tools/sort/topological_sort.go b/server/core_backend-server/tools/sort/topological_sort.go
new file mode 100644
index 0000000..e465a1a
--- /dev/null
+++ b/server/core_backend-server/tools/sort/topological_sort.go
@@ -0,0 +1,161 @@
+package sort
+
+import (
+	"errors"
+	"fmt"
+)
+
+// NodeState represents the state of a node during DFS traversal
+type NodeState int
+
+const (
+	UNVISITED NodeState = 0 // unvisited
+	VISITING  NodeState = 1 // visiting (in the DFS stack)
+	VISITED   NodeState = 2 // visited
+)
+
+// CycleError means that a cycle was detected in the graph during topological sorting
+var CycleError = errors.New("graph contains a cycle")
+
+// TopologicalSortReachable sorts the nodes reachable from startNodeID in topological order.
+// allNodes: a map of all nodes (nodeID -> node)
+// graph: an adjacency list representation of the graph (nodeID -> []neighborIDs)
+// startNodeID: the ID of the starting node for traversal
+// Returns: a slice of nodes in topological order reachable from startNodeID; or an error if a cycle is detected
+func TopologicalSortReachable[T any](allNodes map[string]T, graph map[string][]string, startNodeID string) ([]T, error) {
+	if _, ok := graph[startNodeID]; !ok {
+		return nil, fmt.Errorf("start node '%s' not found in the graph", startNodeID)
+	}
+	if _, ok := allNodes[startNodeID]; !ok {
+		return nil, fmt.Errorf("start node '%s' not found in the allNodes", startNodeID)
+	}
+
+	visitedStatus := make(map[string]NodeState)
+	sortedNodes := make([]T, 0)
+
+	// Init all nodes to UNVISITED
+	for node := range allNodes {
+		visitedStatus[node] = UNVISITED
+	}
+
+	// dfsVisit is a recursive function that performs DFS on the graph
+	// It returns an error if a cycle is detected
+	var dfsVisit func(node string) error
+	dfsVisit = func(node string) error {
+		// Mark the current node as VISITING
+		visitedStatus[node] = VISITING
+
+		// Iterate through all neighbors of the current node
+		neighbors := graph[node]
+		for _, neighbor := range neighbors {
+			neighborStatus, statusExists := visitedStatus[neighbor]
+			if !statusExists {
+				return fmt.Errorf("The key '%s' is in the graph, but not in allNodes", neighbor)
+			}
+
+			switch neighborStatus {
+			case VISITING:
+				// If the neighbor is already being visited, a cycle is detected
+				return fmt.Errorf("%w: detected edge from %s to %s", CycleError, node, neighbor)
+			case UNVISITED:
+				// If the neighbor has not been visited yet, recursively visit it
+				if err := dfsVisit(neighbor); err != nil {
+					return err
+				}
+			case VISITED:
+				continue
+			}
+		}
+
+		// All neighbors of the current node have been visited
+		// Mark the current node as VISITED
+		visitedStatus[node] = VISITED
+		// Append the current node to the end of the result list (to be reversed later)
+		sortedNodes = append(sortedNodes, allNodes[node])
+		return nil
+	}
+
+	// Start DFS from the specified startNodeID
+	if err := dfsVisit(startNodeID); err != nil {
+		return nil, err
+	}
+
+	// Reverse sortedIDs to get the correct topological order
+	for i, j := 0, len(sortedNodes)-1; i < j; i, j = i+1, j-1 {
+		sortedNodes[i], sortedNodes[j] = sortedNodes[j], sortedNodes[i]
+	}
+
+	return sortedNodes, nil
+}
+
+// TopologicalSortAll sorts the nodes in topological order (DFS implementation).
+// allNodes: a map of all nodes (nodeID -> node data of type T)
+// graph: an adjacency list representation of the graph (nodeID -> []neighborIDs)
+// Returns: a slice of nodes (of type T) in topological order; or an error if a cycle is detected
+func TopologicalSortAll[T any](allNodes map[string]T, graph map[string][]string) ([]T, error) {
+	// visited map tracks the state of each node (UNVISITED, VISITING, VISITED)
+	visited := make(map[string]NodeState)
+	// result slice will store the nodes in topological order (built in reverse)
+	result := make([]T, 0, len(allNodes))
+
+	// Define the recursive DFS function using a closure to capture visited, graph, allNodes, and result
+	var dfs func(nodeID string) error
+	dfs = func(nodeID string) error {
+		// Check the current state of the node
+		state := visited[nodeID]
+		switch state {
+		case VISITING:
+			// If we encounter a node marked as VISITING, we have found a back edge, indicating a cycle.
+			return CycleError
+		case VISITED:
+			// If the node is already VISITED, we have already processed this node and its descendants.
+			return nil // No error, just skip
+		case UNVISITED:
+			// Mark the node as VISITING (currently in the recursion stack)
+			visited[nodeID] = VISITING
+
+			// Recursively visit all neighbors of the current node
+			neighbors, exists := graph[nodeID]
+			if exists { // Check if the node has outgoing edges listed in the graph
+				for _, neighborID := range neighbors {
+					// Important: Ensure neighbor exists in allNodes before recursing.
+					// If the graph might contain edges to nodes not in allNodes, handle appropriately.
+					// Assuming graph only refers to nodes present in allNodes based on typical usage.
+					if _, nodeExists := allNodes[neighborID]; !nodeExists {
+						return fmt.Errorf("neighbor node '%s' not found in allNodes", neighborID)
+					}
+
+					if err := dfs(neighborID); err != nil {
+						return err
+					}
+				}
+			}
+
+			// After visiting all neighbors (and their subtrees), mark the node as VISITED.
+			visited[nodeID] = VISITED
+			// Add the node's data to the *end* of the result slice.
+			// Since we add nodes *after* all their dependencies are processed,
+			// this builds the topological sort in reverse order.
+			result = append(result, allNodes[nodeID])
+			return nil // No error for this path
+		}
+		return fmt.Errorf("Expected error. This should not happen.")
+	}
+
+	// Iterate through all nodes provided in allNodes map.
+	// This ensures we handle disconnected components in the graph.
+	for nodeID := range allNodes {
+		if visited[nodeID] == UNVISITED {
+			if err := dfs(nodeID); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	// Reverse the slice to get the correct topological order.
+	for i, j := 0, len(result)-1; i < j; i, j = i+1, j-1 {
+		result[i], result[j] = result[j], result[i]
+	}
+
+	return result, nil
+}
diff --git a/server/core_backend-server/tools/sort/topological_sort_test.go b/server/core_backend-server/tools/sort/topological_sort_test.go
new file mode 100644
index 0000000..a7fed9e
--- /dev/null
+++ b/server/core_backend-server/tools/sort/topological_sort_test.go
@@ -0,0 +1,483 @@
+package sort
+
+import (
+	"errors"
+	"fmt"
+	"reflect" // Needed for deep slice comparison
+	"testing"
+)
+
+func TestTopologicalSortReachable(t *testing.T) {
+	// Define test cases using a table
+	testCases := []struct {
+		name        string              // Name for the test case
+		graph       map[string][]string // Input graph
+		startNodeID string              // Input start node
+		wantResult  []string            // Expected successful result (nil if error expected)
+		wantErr     error               // Expected error (nil if success expected) - use errors.Is for matching
+	}{
+		{
+			name: "Basic DAG from B",
+			graph: map[string][]string{
+				"A": {"C"},
+				"B": {"C", "D"},
+				"C": {"E"},
+				"D": {"F"},
+				"E": {"F"},
+				"F": {},
+				"G": {"A", "B"},
+			},
+			startNodeID: "B",
+			// Note: Topological sort can have multiple valid orders.
+			// We expect one valid order here. A more robust test might
+			// verify the dependency constraints instead of exact order.
+			// Let's assume the implementation might produce this order:
+			wantResult: []string{"B", "D", "C", "E", "F"},
+			// Alternative valid result: []string{"B", "C", "D", "E", "F"}
+			// If your implementation consistently gives the alternative, update wantResult.
+			wantErr: nil,
+		},
+		{
+			name: "Disconnected component from 1",
+			graph: map[string][]string{
+				"1": {"3"},
+				"2": {"3"},
+				"3": {"4"},
+				"4": {},
+				"5": {"6"},
+				"6": {},
+			},
+			startNodeID: "1",
+			wantResult:  []string{"1", "3", "4"},
+			wantErr:     nil,
+		},
+		{
+			name: "Graph with cycle",
+			graph: map[string][]string{
+				"X": {"Y"},
+				"Y": {"Z"},
+				"Z": {"X"}, // Cycle Z -> X
+				"W": {"X"},
+			},
+			startNodeID: "W",
+			wantResult:  nil,        // Expecting an error, so result should be nil
+			wantErr:     CycleError, // Expect the specific CycleError type
+		},
+		{
+			name: "Start node not found",
+			graph: map[string][]string{
+				"A": {"B"},
+			},
+			startNodeID: "C",
+			wantResult:  nil,
+			wantErr:     fmt.Errorf("start node 'C' not found in the graph"), // Expect specific error message/type
+		},
+		{
+			name: "Start node exists but no outgoing edges",
+			graph: map[string][]string{
+				"A": {},
+				"B": {"A"},
+			},
+			startNodeID: "A",
+			wantResult:  []string{"A"},
+			wantErr:     nil,
+		},
+		{
+			name: "Start node is isolated",
+			graph: map[string][]string{
+				"X": {"Y"},
+				"Z": {}, // Isolated node
+			},
+			startNodeID: "Z",
+			wantResult:  []string{"Z"},
+			wantErr:     nil,
+		},
+		{
+			name:        "Empty graph",
+			graph:       map[string][]string{},
+			startNodeID: "A",
+			wantResult:  nil,
+			wantErr:     fmt.Errorf("start node 'A' not found in the graph"),
+		},
+	}
+
+	// Iterate over test cases
+	for _, tc := range testCases {
+		// Run each case as a subtest
+		t.Run(tc.name, func(t *testing.T) {
+			allNodes := make(map[string]string) // 使用空结构体节省空间
+			for node, neighbors := range tc.graph {
+				allNodes[node] = node
+				for _, neighbor := range neighbors {
+					allNodes[neighbor] = neighbor
+				}
+			}
+			gotResult, gotErr := TopologicalSortReachable(allNodes, tc.graph, tc.startNodeID)
+
+			// --- Assertions ---
+
+			// 1. Check for unexpected errors
+			if tc.wantErr == nil && gotErr != nil {
+				t.Fatalf("TopologicalSortReachable() returned an unexpected error: %v", gotErr)
+			}
+
+			// 2. Check if expected error occurred and has the right type/value
+			if tc.wantErr != nil {
+				if gotErr == nil {
+					t.Fatalf("TopologicalSortReachable() expected error '%v', but got nil", tc.wantErr)
+				}
+				// Use errors.Is for checking wrapped errors like CycleError
+				// Use direct comparison for specific fmt.Errorf instances (if messages must match exactly)
+				if errors.Is(tc.wantErr, CycleError) { // Check if it's CycleError or wraps it
+					if !errors.Is(gotErr, CycleError) {
+						t.Errorf("TopologicalSortReachable() expected error type '%T', but got type '%T' (%v)", CycleError, gotErr, gotErr)
+					}
+				} else if tc.wantErr.Error() != gotErr.Error() { // For other specific errors, compare messages
+					t.Errorf("TopologicalSortReachable() expected error '%v', but got '%v'", tc.wantErr, gotErr)
+				}
+				// Also check if result is nil on error
+				if gotResult != nil {
+					t.Errorf("TopologicalSortReachable() expected nil result on error, but got %v", gotResult)
+				}
+			}
+
+			// 3. Check the result slice if no error was expected
+			if tc.wantErr == nil {
+				// Use reflect.DeepEqual for comparing slice contents
+				if !reflect.DeepEqual(gotResult, tc.wantResult) {
+					// Handle the potential ambiguity for the first test case
+					if tc.name == "Basic DAG from B" {
+						alternativeWant := []string{"B", "C", "D", "E", "F"}
+						if !reflect.DeepEqual(gotResult, alternativeWant) {
+							t.Errorf("TopologicalSortReachable() = %v, want %v (or %v)", gotResult, tc.wantResult, alternativeWant)
+						}
+					} else {
+						t.Errorf("TopologicalSortReachable() = %v, want %v", gotResult, tc.wantResult)
+					}
+				}
+			}
+		})
+	}
+}
+
+// Helper type for testing
+type TestNode struct {
+	ID string
+}
+
+// TestTopologicalSortAll tests the TopologicalSortAll function
+func TestTopologicalSortAll(t *testing.T) {
+	// Helper to get ID from TestNode
+	getNodeID := func(n TestNode) string { return n.ID }
+
+	// Define test cases
+	testCases := []struct {
+		name        string
+		allNodes    map[string]TestNode
+		graph       map[string][]string
+		expectError error
+		// We don't specify expectedResult slice because multiple valid sorts can exist.
+		// Instead, we'll use isValidTopologicalSort.
+	}{
+		{
+			name:        "Empty Graph",
+			allNodes:    map[string]TestNode{},
+			graph:       map[string][]string{},
+			expectError: nil,
+		},
+		{
+			name: "Single Node",
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+			},
+			graph: map[string][]string{
+				"A": {},
+			},
+			expectError: nil,
+		},
+		{
+			name: "Simple Linear Chain", // A -> B -> C
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+				"B": {ID: "B"},
+				"C": {ID: "C"},
+			},
+			graph: map[string][]string{
+				"A": {"B"},
+				"B": {"C"},
+				"C": {},
+			},
+			expectError: nil,
+		},
+		{
+			name: "Multiple Independent Nodes", // A, B
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+				"B": {ID: "B"},
+			},
+			graph: map[string][]string{
+				"A": {},
+				"B": {},
+			},
+			expectError: nil,
+		},
+		{
+			name: "DAG with Multiple Paths", // A->B, A->C, B->D, C->D
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+				"B": {ID: "B"},
+				"C": {ID: "C"},
+				"D": {ID: "D"},
+			},
+			graph: map[string][]string{
+				"A": {"B", "C"},
+				"B": {"D"},
+				"C": {"D"},
+				"D": {},
+			},
+			expectError: nil,
+		},
+		{
+			name: "Disconnected Components", // A->B, C->D
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+				"B": {ID: "B"},
+				"C": {ID: "C"},
+				"D": {ID: "D"},
+			},
+			graph: map[string][]string{
+				"A": {"B"},
+				"B": {},
+				"C": {"D"},
+				"D": {},
+			},
+			expectError: nil,
+		},
+		{
+			name: "More Complex DAG", // 5->{11,2}, 7->{11,8}, 3->{8,10}, 11->{2,9,10}, 8->9
+			allNodes: map[string]TestNode{
+				"2":  {ID: "2"},
+				"3":  {ID: "3"},
+				"5":  {ID: "5"},
+				"7":  {ID: "7"},
+				"8":  {ID: "8"},
+				"9":  {ID: "9"},
+				"10": {ID: "10"},
+				"11": {ID: "11"},
+			},
+			graph: map[string][]string{
+				"5":  {"11", "2"},
+				"7":  {"11", "8"},
+				"3":  {"8", "10"},
+				"11": {"2", "9", "10"},
+				"8":  {"9"},
+				"2":  {},
+				"9":  {},
+				"10": {},
+			},
+			expectError: nil,
+			// Possible sorts: [3, 5, 7, 8, 11, 2, 9, 10], [5, 7, 3, 11, 8, 10, 9, 2], etc.
+		},
+		{
+			name: "Simple Cycle", // A -> B, B -> A
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+				"B": {ID: "B"},
+			},
+			graph: map[string][]string{
+				"A": {"B"},
+				"B": {"A"},
+			},
+			expectError: CycleError,
+		},
+		{
+			name: "Longer Cycle", // A -> B -> C -> A
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+				"B": {ID: "B"},
+				"C": {ID: "C"},
+			},
+			graph: map[string][]string{
+				"A": {"B"},
+				"B": {"C"},
+				"C": {"A"},
+			},
+			expectError: CycleError,
+		},
+		{
+			name: "Self Loop", // A -> A
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+			},
+			graph: map[string][]string{
+				"A": {"A"},
+			},
+			expectError: CycleError,
+		},
+		{
+			name: "Cycle within Larger Graph", // A->B, B->C, C->D, D->B (cycle BCD), E->A
+			allNodes: map[string]TestNode{
+				"A": {ID: "A"},
+				"B": {ID: "B"},
+				"C": {ID: "C"},
+				"D": {ID: "D"},
+				"E": {ID: "E"},
+			},
+			graph: map[string][]string{
+				"A": {"B"},
+				"B": {"C"},
+				"C": {"D"},
+				"D": {"B"}, // Cycle back to B
+				"E": {"A"},
+			},
+			expectError: CycleError,
+		},
+	}
+
+	// Run test cases
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// --- Run the function under test ---
+			result, err := TopologicalSortAll(tc.allNodes, tc.graph)
+			// --- ---
+
+			// Check error expectation
+			if tc.expectError != nil {
+				if err == nil {
+					t.Errorf("Expected error '%v', but got nil", tc.expectError)
+				} else if !errors.Is(err, tc.expectError) { // Use errors.Is for potential wrapping
+					t.Errorf("Expected error '%v', but got '%v'", tc.expectError, err)
+				}
+				// If error was expected, don't check the result slice (should be nil)
+				if result != nil {
+					t.Errorf("Expected nil result on error, but got %v", result)
+				}
+				return // End test case for expected error
+			}
+
+			// If no error was expected, check if one occurred
+			if err != nil {
+				t.Fatalf("Expected no error, but got: %v", err)
+			}
+
+			// Validate the topological sort result
+			if ok, reason := isValidTopologicalSort(tc.allNodes, tc.graph, result, getNodeID); !ok {
+				// The helper function prints details, just mark failure here
+				// Convert result to IDs for easier debugging output
+				resultIDs := make([]string, len(result))
+				for i, n := range result {
+					resultIDs[i] = getNodeID(n)
+				}
+				t.Errorf("Result %v is not a valid topological sort for the given graph: %s", resultIDs, reason)
+			} else {
+				// Optional: Log the valid sort found
+				resultIDs := make([]string, len(result))
+				for i, n := range result {
+					resultIDs[i] = getNodeID(n)
+				}
+				t.Logf("Valid topological sort found: %v", resultIDs)
+			}
+		})
+	}
+}
+
+func isValidTopologicalSort[T any](
+	allNodes map[string]T,
+	graph map[string][]string,
+	result []T,
+	idGetter func(T) string,
+) (bool, string) {
+
+	// --- Check 1: Length Mismatch ---
+	// The result must contain the same number of nodes as expected.
+	if len(result) != len(allNodes) {
+		return false, fmt.Sprintf("length mismatch: expected %d nodes, but result has %d", len(allNodes), len(result))
+	}
+
+	// Handle the trivial case of an empty graph explicitly for clarity
+	if len(allNodes) == 0 {
+		if len(result) == 0 {
+			return true, "" // Empty graph has an empty valid sort
+		}
+		// Already covered by length check above, but reinforces logic
+		// return false, "length mismatch: expected 0 nodes for empty graph, but result is not empty"
+	}
+
+	// --- Check 2: Node Set Verification (Completeness & Uniqueness) ---
+	// Build a map to track nodes seen in the result and their positions.
+	nodePositions := make(map[string]int, len(result))
+	seenIDs := make(map[string]bool, len(result))
+	resultIDs := make([]string, len(result)) // Keep IDs for potential error messages
+
+	for i, node := range result {
+		nodeID := idGetter(node)
+		resultIDs[i] = nodeID // Store for error messages
+
+		// 2a: Check if the node from the result is one of the expected nodes.
+		if _, expected := allNodes[nodeID]; !expected {
+			return false, fmt.Sprintf("unexpected node: result contains node '%s' which was not in the expected set of nodes", nodeID)
+		}
+
+		// 2b: Check for duplicate nodes in the result.
+		if seenIDs[nodeID] {
+			return false, fmt.Sprintf("duplicate node: node '%s' appears more than once in the result", nodeID)
+		}
+
+		// Mark node as seen and record its position.
+		seenIDs[nodeID] = true
+		nodePositions[nodeID] = i
+	}
+
+	// 2c: Verify all expected nodes were present in the result.
+	// This check is technically redundant if the length check passed and no duplicates were found,
+	// but it adds clarity and catches potential logic errors elsewhere.
+	if len(seenIDs) != len(allNodes) {
+		// This case implies len(result) == len(allNodes) but len(seenIDs) < len(allNodes),
+		// meaning duplicates *must* have existed, which should have been caught earlier.
+		// Or, it implies a node in `result` wasn't in `allNodes`, also caught earlier.
+		// It primarily guards against unexpected states or logic flaws.
+		return false, fmt.Sprintf("missing nodes: expected %d unique nodes, but result only contains %d unique nodes from the expected set", len(allNodes), len(seenIDs))
+	}
+
+	// --- Check 3: Dependency Order Verification ---
+	// Iterate through all defined edges in the graph.
+	for uID, neighbors := range graph {
+		// Get the position of the source node 'u'.
+		// We only care about edges where the source node 'uID' was actually expected
+		// to be part of the sort (i.e., it's a key in allNodes).
+		if _, uIsExpected := allNodes[uID]; !uIsExpected {
+			continue // Skip edges originating from nodes not in the defined set.
+		}
+
+		uPos, uOk := nodePositions[uID]
+		if !uOk {
+			// This indicates that an expected node 'uID' (which is part of an edge in the graph)
+			// was NOT found in the 'result' slice. This contradicts Check 2c passing.
+			// This signifies a logic error either here or in Check 2, or inconsistent input state.
+			return false, fmt.Sprintf("internal validation error: expected node '%s' (source of edge) not found in result positions map, though it should be present", uID)
+		}
+
+		// Check each dependency (edge u -> v).
+		for _, vID := range neighbors {
+			// Similarly, only check dependencies where the target node 'vID' was expected.
+			if _, vIsExpected := allNodes[vID]; !vIsExpected {
+				continue // Skip edges pointing to nodes not in the defined set.
+			}
+
+			vPos, vOk := nodePositions[vID]
+			if !vOk {
+				// An expected node 'vID' (target of an edge) was not found in the result.
+				return false, fmt.Sprintf("internal validation error: expected node '%s' (target of edge from '%s') not found in result positions map, though it should be present", vID, uID)
+			}
+
+			// The core topological sort check: u must come before v.
+			if uPos >= vPos {
+				return false, fmt.Sprintf("dependency violation: node '%s' must appear before '%s' (due to edge %s -> %s), but positions are %d and %d in result %v", uID, vID, uID, vID, uPos, vPos, resultIDs)
+			}
+		}
+	}
+
+	// --- Success ---
+	// If all checks passed, the result is a valid topological sort.
+	return true, ""
+}
diff --git a/server/core_backend-server/tools/store/store.go b/server/core_backend-server/tools/store/store.go
new file mode 100644
index 0000000..0c39571
--- /dev/null
+++ b/server/core_backend-server/tools/store/store.go
@@ -0,0 +1,250 @@
+package store
+
+import (
+	"encoding/json"
+	"sync"
+)
+
+// @todo remove after https://github.com/golang/go/issues/20135
+const ShrinkThreshold = 200 // the number is arbitrary chosen
+
+// Store defines a concurrent safe in memory key-value data store.
+type Store[K comparable, T any] struct {
+	data    map[K]T
+	mu      sync.RWMutex
+	deleted int64
+}
+
+// New creates a new Store[T] instance with a shallow copy of the provided data (if any).
+func New[K comparable, T any](data map[K]T) *Store[K, T] {
+	s := &Store[K, T]{}
+
+	s.Reset(data)
+
+	return s
+}
+
+// Reset clears the store and replaces the store data with a
+// shallow copy of the provided newData.
+func (s *Store[K, T]) Reset(newData map[K]T) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if len(newData) > 0 {
+		s.data = make(map[K]T, len(newData))
+		for k, v := range newData {
+			s.data[k] = v
+		}
+	} else {
+		s.data = make(map[K]T)
+	}
+
+	s.deleted = 0
+}
+
+// Length returns the current number of elements in the store.
+func (s *Store[K, T]) Length() int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	return len(s.data)
+}
+
+// RemoveAll removes all the existing store entries.
+func (s *Store[K, T]) RemoveAll() {
+	s.Reset(nil)
+}
+
+// Remove removes a single entry from the store.
+//
+// Remove does nothing if key doesn't exist in the store.
+func (s *Store[K, T]) Remove(key K) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.data, key)
+	s.deleted++
+
+	// reassign to a new map so that the old one can be gc-ed because it doesn't shrink
+	//
+	// @todo remove after https://github.com/golang/go/issues/20135
+	if s.deleted >= ShrinkThreshold {
+		newData := make(map[K]T, len(s.data))
+		for k, v := range s.data {
+			newData[k] = v
+		}
+		s.data = newData
+		s.deleted = 0
+	}
+}
+
+// Has checks if element with the specified key exist or not.
+func (s *Store[K, T]) Has(key K) bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	_, ok := s.data[key]
+
+	return ok
+}
+
+// Get returns a single element value from the store.
+//
+// If key is not set, the zero T value is returned.
+func (s *Store[K, T]) Get(key K) T {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	return s.data[key]
+}
+
+// GetOk is similar to Get but returns also a boolean indicating whether the key exists or not.
+func (s *Store[K, T]) GetOk(key K) (T, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	v, ok := s.data[key]
+
+	return v, ok
+}
+
+// GetAll returns a shallow copy of the current store data.
+func (s *Store[K, T]) GetAll() map[K]T {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var clone = make(map[K]T, len(s.data))
+
+	for k, v := range s.data {
+		clone[k] = v
+	}
+
+	return clone
+}
+
+// Values returns a slice with all of the current store values.
+func (s *Store[K, T]) Values() []T {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var values = make([]T, 0, len(s.data))
+
+	for _, v := range s.data {
+		values = append(values, v)
+	}
+
+	return values
+}
+
+// Set sets (or overwrite if already exists) a new value for key.
+func (s *Store[K, T]) Set(key K, value T) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.data == nil {
+		s.data = make(map[K]T)
+	}
+
+	s.data[key] = value
+}
+
+// SetFunc sets (or overwrite if already exists) a new value resolved
+// from the function callback for the provided key.
+//
+// The function callback receives as argument the old store element value (if exists).
+// If there is no old store element, the argument will be the T zero value.
+//
+// Example:
+//
+//	s := store.New[string, int](nil)
+//	s.SetFunc("count", func(old int) int {
+//	    return old + 1
+//	})
+func (s *Store[K, T]) SetFunc(key K, fn func(old T) T) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.data == nil {
+		s.data = make(map[K]T)
+	}
+
+	s.data[key] = fn(s.data[key])
+}
+
+// GetOrSet retrieves a single existing value for the provided key
+// or stores a new one if it doesn't exist.
+func (s *Store[K, T]) GetOrSet(key K, setFunc func() T) T {
+	// lock only reads to minimize locks contention
+	s.mu.RLock()
+	v, ok := s.data[key]
+	s.mu.RUnlock()
+
+	if !ok {
+		s.mu.Lock()
+		v = setFunc()
+		if s.data == nil {
+			s.data = make(map[K]T)
+		}
+		s.data[key] = v
+		s.mu.Unlock()
+	}
+
+	return v
+}
+
+// SetIfLessThanLimit sets (or overwrite if already exist) a new value for key.
+//
+// This method is similar to Set() but **it will skip adding new elements**
+// to the store if the store length has reached the specified limit.
+// false is returned if maxAllowedElements limit is reached.
+func (s *Store[K, T]) SetIfLessThanLimit(key K, value T, maxAllowedElements int) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.data == nil {
+		s.data = make(map[K]T)
+	}
+
+	// check for existing item
+	_, ok := s.data[key]
+
+	if !ok && len(s.data) >= maxAllowedElements {
+		// cannot add more items
+		return false
+	}
+
+	// add/overwrite item
+	s.data[key] = value
+
+	return true
+}
+
+// UnmarshalJSON implements [json.Unmarshaler] and imports the
+// provided JSON data into the store.
+//
+// The store entries that match with the ones from the data will be overwritten with the new value.
+func (s *Store[K, T]) UnmarshalJSON(data []byte) error {
+	raw := map[K]T{}
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.data == nil {
+		s.data = make(map[K]T)
+	}
+
+	for k, v := range raw {
+		s.data[k] = v
+	}
+
+	return nil
+}
+
+// MarshalJSON implements [json.Marshaler] and export the current
+// store data into valid JSON.
+func (s *Store[K, T]) MarshalJSON() ([]byte, error) {
+	return json.Marshal(s.GetAll())
+}
diff --git a/server/core_backend-server/tools/store/store_test.go b/server/core_backend-server/tools/store/store_test.go
new file mode 100644
index 0000000..24f2874
--- /dev/null
+++ b/server/core_backend-server/tools/store/store_test.go
@@ -0,0 +1,416 @@
+package store_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"slices"
+	"strconv"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/store"
+)
+
+func TestNew(t *testing.T) {
+	data := map[string]int{"test1": 1, "test2": 2}
+	originalRawData, err := json.Marshal(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	s := store.New(data)
+	s.Set("test3", 3) // add 1 item
+	s.Remove("test1") // remove 1 item
+
+	// check if data was shallow copied
+	rawData, _ := json.Marshal(data)
+	if !bytes.Equal(originalRawData, rawData) {
+		t.Fatalf("Expected data \n%s, \ngot \n%s", originalRawData, rawData)
+	}
+
+	if s.Has("test1") {
+		t.Fatalf("Expected test1 to be deleted, got %v", s.Get("test1"))
+	}
+
+	if v := s.Get("test2"); v != 2 {
+		t.Fatalf("Expected test2 to be %v, got %v", 2, v)
+	}
+
+	if v := s.Get("test3"); v != 3 {
+		t.Fatalf("Expected test3 to be %v, got %v", 3, v)
+	}
+}
+
+func TestReset(t *testing.T) {
+	s := store.New(map[string]int{"test1": 1})
+
+	data := map[string]int{"test2": 2}
+	originalRawData, err := json.Marshal(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	s.Reset(data)
+	s.Set("test3", 3)
+
+	// check if data was shallow copied
+	rawData, _ := json.Marshal(data)
+	if !bytes.Equal(originalRawData, rawData) {
+		t.Fatalf("Expected data \n%s, \ngot \n%s", originalRawData, rawData)
+	}
+
+	if s.Has("test1") {
+		t.Fatalf("Expected test1 to be deleted, got %v", s.Get("test1"))
+	}
+
+	if v := s.Get("test2"); v != 2 {
+		t.Fatalf("Expected test2 to be %v, got %v", 2, v)
+	}
+
+	if v := s.Get("test3"); v != 3 {
+		t.Fatalf("Expected test3 to be %v, got %v", 3, v)
+	}
+}
+
+func TestLength(t *testing.T) {
+	s := store.New(map[string]int{"test1": 1})
+	s.Set("test2", 2)
+
+	if v := s.Length(); v != 2 {
+		t.Fatalf("Expected length %d, got %d", 2, v)
+	}
+}
+
+func TestRemoveAll(t *testing.T) {
+	s := store.New(map[string]bool{"test1": true, "test2": true})
+
+	keys := []string{"test1", "test2"}
+
+	s.RemoveAll()
+
+	for i, key := range keys {
+		if s.Has(key) {
+			t.Errorf("(%d) Expected %q to be removed", i, key)
+		}
+	}
+}
+
+func TestRemove(t *testing.T) {
+	s := store.New(map[string]bool{"test": true})
+
+	keys := []string{"test", "missing"}
+
+	for i, key := range keys {
+		s.Remove(key)
+		if s.Has(key) {
+			t.Errorf("(%d) Expected %q to be removed", i, key)
+		}
+	}
+}
+
+func TestHas(t *testing.T) {
+	s := store.New(map[string]int{"test1": 0, "test2": 1})
+
+	scenarios := []struct {
+		key   string
+		exist bool
+	}{
+		{"test1", true},
+		{"test2", true},
+		{"missing", false},
+	}
+
+	for i, scenario := range scenarios {
+		exist := s.Has(scenario.key)
+		if exist != scenario.exist {
+			t.Errorf("(%d) Expected %v, got %v", i, scenario.exist, exist)
+		}
+	}
+}
+
+func TestGet(t *testing.T) {
+	s := store.New(map[string]int{"test1": 0, "test2": 1})
+
+	scenarios := []struct {
+		key    string
+		expect int
+	}{
+		{"test1", 0},
+		{"test2", 1},
+		{"missing", 0}, // should auto fallback to the zero value
+	}
+
+	for _, scenario := range scenarios {
+		t.Run(scenario.key, func(t *testing.T) {
+			val := s.Get(scenario.key)
+			if val != scenario.expect {
+				t.Fatalf("Expected %v, got %v", scenario.expect, val)
+			}
+		})
+	}
+}
+
+func TestGetOk(t *testing.T) {
+	s := store.New(map[string]int{"test1": 0, "test2": 1})
+
+	scenarios := []struct {
+		key         string
+		expectValue int
+		expectOk    bool
+	}{
+		{"test1", 0, true},
+		{"test2", 1, true},
+		{"missing", 0, false}, // should auto fallback to the zero value
+	}
+
+	for _, scenario := range scenarios {
+		t.Run(scenario.key, func(t *testing.T) {
+			val, ok := s.GetOk(scenario.key)
+
+			if ok != scenario.expectOk {
+				t.Fatalf("Expected ok %v, got %v", scenario.expectOk, ok)
+			}
+
+			if val != scenario.expectValue {
+				t.Fatalf("Expected %v, got %v", scenario.expectValue, val)
+			}
+		})
+	}
+}
+
+func TestGetAll(t *testing.T) {
+	data := map[string]int{
+		"a": 1,
+		"b": 2,
+	}
+
+	s := store.New(data)
+
+	// fetch and delete each key to make sure that it was shallow copied
+	result := s.GetAll()
+	for k := range result {
+		delete(result, k)
+	}
+
+	// refetch again
+	result = s.GetAll()
+
+	if len(result) != len(data) {
+		t.Fatalf("Expected %d, got %d items", len(data), len(result))
+	}
+
+	for k := range result {
+		if result[k] != data[k] {
+			t.Fatalf("Expected %s to be %v, got %v", k, data[k], result[k])
+		}
+	}
+}
+
+func TestValues(t *testing.T) {
+	data := map[string]int{
+		"a": 1,
+		"b": 2,
+	}
+
+	values := store.New(data).Values()
+
+	expected := []int{1, 2}
+
+	if len(values) != len(expected) {
+		t.Fatalf("Expected %d values, got %d", len(expected), len(values))
+	}
+
+	for _, v := range expected {
+		if !slices.Contains(values, v) {
+			t.Fatalf("Missing value %v in\n%v", v, values)
+		}
+	}
+}
+
+func TestSet(t *testing.T) {
+	s := store.Store[string, int]{}
+
+	data := map[string]int{"test1": 0, "test2": 1, "test3": 3}
+
+	// set values
+	for k, v := range data {
+		s.Set(k, v)
+	}
+
+	// verify that the values are set
+	for k, v := range data {
+		if !s.Has(k) {
+			t.Errorf("Expected key %q", k)
+		}
+
+		val := s.Get(k)
+		if val != v {
+			t.Errorf("Expected %v, got %v for key %q", v, val, k)
+		}
+	}
+}
+
+func TestSetFunc(t *testing.T) {
+	s := store.Store[string, int]{}
+
+	// non existing value
+	s.SetFunc("test", func(old int) int {
+		if old != 0 {
+			t.Fatalf("Expected old value %d, got %d", 0, old)
+		}
+		return old + 2
+	})
+	if v := s.Get("test"); v != 2 {
+		t.Fatalf("Expected the stored value to be %d, got %d", 2, v)
+	}
+
+	// increment existing value
+	s.SetFunc("test", func(old int) int {
+		if old != 2 {
+			t.Fatalf("Expected old value %d, got %d", 2, old)
+		}
+		return old + 1
+	})
+	if v := s.Get("test"); v != 3 {
+		t.Fatalf("Expected the stored value to be %d, got %d", 3, v)
+	}
+}
+
+func TestGetOrSet(t *testing.T) {
+	s := store.New(map[string]int{
+		"test1": 0,
+		"test2": 1,
+		"test3": 3,
+	})
+
+	scenarios := []struct {
+		key      string
+		value    int
+		expected int
+	}{
+		{"test2", 20, 1},
+		{"test3", 2, 3},
+		{"test_new", 20, 20},
+		{"test_new", 50, 20}, // should return the previously inserted value
+	}
+
+	for _, scenario := range scenarios {
+		t.Run(scenario.key, func(t *testing.T) {
+			result := s.GetOrSet(scenario.key, func() int {
+				return scenario.value
+			})
+
+			if result != scenario.expected {
+				t.Fatalf("Expected %v, got %v", scenario.expected, result)
+			}
+		})
+	}
+}
+
+func TestSetIfLessThanLimit(t *testing.T) {
+	s := store.Store[string, int]{}
+
+	limit := 2
+
+	// set values
+	scenarios := []struct {
+		key      string
+		value    int
+		expected bool
+	}{
+		{"test1", 1, true},
+		{"test2", 2, true},
+		{"test3", 3, false},
+		{"test2", 4, true}, // overwrite
+	}
+
+	for i, scenario := range scenarios {
+		result := s.SetIfLessThanLimit(scenario.key, scenario.value, limit)
+
+		if result != scenario.expected {
+			t.Errorf("(%d) Expected result %v, got %v", i, scenario.expected, result)
+		}
+
+		if !scenario.expected && s.Has(scenario.key) {
+			t.Errorf("(%d) Expected key %q to not be set", i, scenario.key)
+		}
+
+		val := s.Get(scenario.key)
+		if scenario.expected && val != scenario.value {
+			t.Errorf("(%d) Expected value %v, got %v", i, scenario.value, val)
+		}
+	}
+}
+
+func TestUnmarshalJSON(t *testing.T) {
+	s := store.Store[string, string]{}
+	s.Set("b", "old")   // should be overwritten
+	s.Set("c", "test3") // ensures that the old values are not removed
+
+	raw := []byte(`{"a":"test1", "b":"test2"}`)
+	if err := json.Unmarshal(raw, &s); err != nil {
+		t.Fatal(err)
+	}
+
+	if v := s.Get("a"); v != "test1" {
+		t.Fatalf("Expected store.a to be %q, got %q", "test1", v)
+	}
+
+	if v := s.Get("b"); v != "test2" {
+		t.Fatalf("Expected store.b to be %q, got %q", "test2", v)
+	}
+
+	if v := s.Get("c"); v != "test3" {
+		t.Fatalf("Expected store.c to be %q, got %q", "test3", v)
+	}
+}
+
+func TestMarshalJSON(t *testing.T) {
+	s := &store.Store[string, string]{}
+	s.Set("a", "test1")
+	s.Set("b", "test2")
+
+	expected := []byte(`{"a":"test1", "b":"test2"}`)
+
+	result, err := json.Marshal(s)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if bytes.Equal(result, expected) {
+		t.Fatalf("Expected\n%s\ngot\n%s", expected, result)
+	}
+}
+
+func TestShrink(t *testing.T) {
+	s := &store.Store[string, int]{}
+
+	total := 1000
+
+	for i := 0; i < total; i++ {
+		s.Set(strconv.Itoa(i), i)
+	}
+
+	if s.Length() != total {
+		t.Fatalf("Expected %d items, got %d", total, s.Length())
+	}
+
+	// trigger map "shrink"
+	for i := 0; i < store.ShrinkThreshold; i++ {
+		s.Remove(strconv.Itoa(i))
+	}
+
+	// ensure that after the deletion, the new map was copied properly
+	if s.Length() != total-store.ShrinkThreshold {
+		t.Fatalf("Expected %d items, got %d", total-store.ShrinkThreshold, s.Length())
+	}
+
+	for k := range s.GetAll() {
+		kInt, err := strconv.Atoi(k)
+		if err != nil {
+			t.Fatalf("failed to convert %s into int: %v", k, err)
+		}
+		if kInt < store.ShrinkThreshold {
+			t.Fatalf("Key %q should have been deleted", k)
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/subscriptions/broker.go b/server/core_backend-server/tools/subscriptions/broker.go
new file mode 100644
index 0000000..82cf30d
--- /dev/null
+++ b/server/core_backend-server/tools/subscriptions/broker.go
@@ -0,0 +1,65 @@
+package subscriptions
+
+import (
+	"fmt"
+
+	"github.com/pocketbase/pocketbase/tools/list"
+	"github.com/pocketbase/pocketbase/tools/store"
+)
+
+// Broker defines a struct for managing subscriptions clients.
+type Broker struct {
+	store *store.Store[string, Client]
+}
+
+// NewBroker initializes and returns a new Broker instance.
+func NewBroker() *Broker {
+	return &Broker{
+		store: store.New[string, Client](nil),
+	}
+}
+
+// Clients returns a shallow copy of all registered clients indexed
+// with their connection id.
+func (b *Broker) Clients() map[string]Client {
+	return b.store.GetAll()
+}
+
+// ChunkedClients splits the current clients into a chunked slice.
+func (b *Broker) ChunkedClients(chunkSize int) [][]Client {
+	return list.ToChunks(b.store.Values(), chunkSize)
+}
+
+// TotalClients returns the total number of registered clients.
+func (b *Broker) TotalClients() int {
+	return b.store.Length()
+}
+
+// ClientById finds a registered client by its id.
+//
+// Returns non-nil error when client with clientId is not registered.
+func (b *Broker) ClientById(clientId string) (Client, error) {
+	client, ok := b.store.GetOk(clientId)
+	if !ok {
+		return nil, fmt.Errorf("no client associated with connection ID %q", clientId)
+	}
+
+	return client, nil
+}
+
+// Register adds a new client to the broker instance.
+func (b *Broker) Register(client Client) {
+	b.store.Set(client.Id(), client)
+}
+
+// Unregister removes a single client by its id and marks it as discarded.
+//
+// If client with clientId doesn't exist, this method does nothing.
+func (b *Broker) Unregister(clientId string) {
+	client := b.store.Get(clientId)
+	if client == nil {
+		return
+	}
+	client.Discard()
+	b.store.Remove(clientId)
+}
diff --git a/server/core_backend-server/tools/subscriptions/broker_test.go b/server/core_backend-server/tools/subscriptions/broker_test.go
new file mode 100644
index 0000000..74955d6
--- /dev/null
+++ b/server/core_backend-server/tools/subscriptions/broker_test.go
@@ -0,0 +1,134 @@
+package subscriptions_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+func TestNewBroker(t *testing.T) {
+	b := subscriptions.NewBroker()
+
+	if b.Clients() == nil {
+		t.Fatal("Expected clients map to be initialized")
+	}
+}
+
+func TestClients(t *testing.T) {
+	b := subscriptions.NewBroker()
+
+	if total := len(b.Clients()); total != 0 {
+		t.Fatalf("Expected no clients, got %v", total)
+	}
+
+	b.Register(subscriptions.NewDefaultClient())
+	b.Register(subscriptions.NewDefaultClient())
+
+	// check if it is a shallow copy
+	clients := b.Clients()
+	for k := range clients {
+		delete(clients, k)
+	}
+
+	// should return a new copy
+	if total := len(b.Clients()); total != 2 {
+		t.Fatalf("Expected 2 clients, got %v", total)
+	}
+}
+
+func TestChunkedClients(t *testing.T) {
+	b := subscriptions.NewBroker()
+
+	chunks := b.ChunkedClients(2)
+	if total := len(chunks); total != 0 {
+		t.Fatalf("Expected %d chunks, got %d", 0, total)
+	}
+
+	b.Register(subscriptions.NewDefaultClient())
+	b.Register(subscriptions.NewDefaultClient())
+	b.Register(subscriptions.NewDefaultClient())
+
+	chunks = b.ChunkedClients(2)
+	if total := len(chunks); total != 2 {
+		t.Fatalf("Expected %d chunks, got %d", 2, total)
+	}
+
+	if total := len(chunks[0]); total != 2 {
+		t.Fatalf("Expected the first chunk to have 2 clients, got %d", total)
+	}
+
+	if total := len(chunks[1]); total != 1 {
+		t.Fatalf("Expected the second chunk to have 1 client, got %d", total)
+	}
+}
+
+func TestTotalClients(t *testing.T) {
+	b := subscriptions.NewBroker()
+
+	if total := b.TotalClients(); total != 0 {
+		t.Fatalf("Expected no clients, got %d", total)
+	}
+
+	b.Register(subscriptions.NewDefaultClient())
+	b.Register(subscriptions.NewDefaultClient())
+
+	if total := b.TotalClients(); total != 2 {
+		t.Fatalf("Expected %d clients, got %d", 2, total)
+	}
+}
+
+func TestClientById(t *testing.T) {
+	b := subscriptions.NewBroker()
+
+	clientA := subscriptions.NewDefaultClient()
+	clientB := subscriptions.NewDefaultClient()
+	b.Register(clientA)
+	b.Register(clientB)
+
+	resultClient, err := b.ClientById(clientA.Id())
+	if err != nil {
+		t.Fatalf("Expected client with id %s, got error %v", clientA.Id(), err)
+	}
+	if resultClient.Id() != clientA.Id() {
+		t.Fatalf("Expected client %s, got %s", clientA.Id(), resultClient.Id())
+	}
+
+	if c, err := b.ClientById("missing"); err == nil {
+		t.Fatalf("Expected error, found client %v", c)
+	}
+}
+
+func TestRegister(t *testing.T) {
+	b := subscriptions.NewBroker()
+
+	client := subscriptions.NewDefaultClient()
+	b.Register(client)
+
+	if _, err := b.ClientById(client.Id()); err != nil {
+		t.Fatalf("Expected client with id %s, got error %v", client.Id(), err)
+	}
+}
+
+func TestUnregister(t *testing.T) {
+	b := subscriptions.NewBroker()
+
+	clientA := subscriptions.NewDefaultClient()
+	clientB := subscriptions.NewDefaultClient()
+	b.Register(clientA)
+	b.Register(clientB)
+
+	if _, err := b.ClientById(clientA.Id()); err != nil {
+		t.Fatalf("Expected client with id %s, got error %v", clientA.Id(), err)
+	}
+
+	b.Unregister(clientA.Id())
+
+	if c, err := b.ClientById(clientA.Id()); err == nil {
+		t.Fatalf("Expected error, found client %v", c)
+	}
+
+	// clientB shouldn't have been removed
+	if _, err := b.ClientById(clientB.Id()); err != nil {
+		t.Fatalf("Expected client with id %s, got error %v", clientB.Id(), err)
+	}
+}
diff --git a/server/core_backend-server/tools/subscriptions/client.go b/server/core_backend-server/tools/subscriptions/client.go
new file mode 100644
index 0000000..0cd2a58
--- /dev/null
+++ b/server/core_backend-server/tools/subscriptions/client.go
@@ -0,0 +1,307 @@
+package subscriptions
+
+import (
+	"encoding/json"
+	"net/url"
+	"strings"
+	"sync"
+
+	"github.com/pocketbase/pocketbase/tools/inflector"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/spf13/cast"
+)
+
+const optionsParam = "options"
+
+// SubscriptionOptions defines the request options (query params, headers, etc.)
+// for a single subscription topic.
+type SubscriptionOptions struct {
+	Query   map[string]string `json:"query"`
+	Headers map[string]string `json:"headers"`
+}
+
+// Client is an interface for a generic subscription client.
+type Client interface {
+	// Id Returns the unique id of the client.
+	Id() string
+
+	// Channel returns the client's communication channel.
+	//
+	// NB! The channel shouldn't be used after calling Discard().
+	Channel() chan Message
+
+	// Subscriptions returns a shallow copy of the client subscriptions matching the prefixes.
+	// If no prefix is specified, returns all subscriptions.
+	Subscriptions(prefixes ...string) map[string]SubscriptionOptions
+
+	// RawSubscriptions returns a slice of all subscription strings that the client is subscribed to.
+	RawSubscriptions() []string
+
+	// Subscribe subscribes the client to the provided subscriptions list.
+	//
+	// Each subscription can also have "options" (json serialized SubscriptionOptions) as query parameter.
+	//
+	// Example:
+	//
+	// 	Subscribe(
+	// 	    "subscriptionA",
+	// 	    `subscriptionB?options={"query":{"a":1},"headers":{"x_token":"abc"}}`,
+	// 	)
+	Subscribe(subs ...string)
+
+	// Unsubscribe unsubscribes the client from the provided subscriptions list.
+	Unsubscribe(subs ...string)
+
+	// HasSubscription checks if the client is subscribed to `sub`.
+	HasSubscription(sub string) bool
+
+	// Set stores any value to the client's context.
+	Set(key string, value any)
+
+	// Unset removes a single value from the client's context.
+	Unset(key string)
+
+	// Get retrieves the key value from the client's context.
+	Get(key string) any
+
+	// Discard marks the client as "discarded" (and closes its channel),
+	// meaning that it shouldn't be used anymore for sending new messages.
+	//
+	// It is safe to call Discard() multiple times.
+	Discard()
+
+	// IsDiscarded indicates whether the client has been "discarded"
+	// and should no longer be used.
+	IsDiscarded() bool
+
+	// Send sends the specified message to the client's channel (if not discarded).
+	Send(m Message)
+}
+
+// ensures that DefaultClient satisfies the Client interface
+var _ Client = (*DefaultClient)(nil)
+
+// DefaultClient defines a generic subscription client.
+type DefaultClient struct {
+	store         map[string]any
+	subscriptions map[string]SubscriptionOptions
+	channel       chan Message
+	id            string
+	mu            sync.RWMutex
+	isDiscarded   bool
+}
+
+// NewDefaultClient creates and returns a new DefaultClient instance.
+func NewDefaultClient(optionalClientId ...string) *DefaultClient {
+	var clientId string
+	if len(optionalClientId) > 0 && optionalClientId[0] != "" {
+		clientId = optionalClientId[0]
+	} else {
+		clientId = security.RandomString(40)
+	}
+
+	return &DefaultClient{
+		id:            clientId,
+		store:         map[string]any{},
+		channel:       make(chan Message),
+		subscriptions: map[string]SubscriptionOptions{},
+	}
+}
+
+// Id implements the [Client.Id] interface method.
+func (c *DefaultClient) Id() string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	return c.id
+}
+
+// Channel implements the [Client.Channel] interface method.
+func (c *DefaultClient) Channel() chan Message {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	return c.channel
+}
+
+// Subscriptions implements the [Client.Subscriptions] interface method.
+//
+// It returns a shallow copy of the client subscriptions matching the prefixes.
+// If no prefix is specified, returns all subscriptions.
+func (c *DefaultClient) Subscriptions(prefixes ...string) map[string]SubscriptionOptions {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	// no prefix -> return copy of all subscriptions
+	if len(prefixes) == 0 {
+		result := make(map[string]SubscriptionOptions, len(c.subscriptions))
+
+		for s, options := range c.subscriptions {
+			result[s] = options
+		}
+
+		return result
+	}
+
+	result := make(map[string]SubscriptionOptions)
+
+	for _, prefix := range prefixes {
+		for s, options := range c.subscriptions {
+			// "?" ensures that the options query start character is always there
+			// so that it can be used as an end separator when looking only for the main subscription topic
+			if strings.HasPrefix(s+"?", prefix) {
+				result[s] = options
+			}
+		}
+	}
+
+	return result
+}
+
+// Subscribe implements the [Client.Subscribe] interface method.
+//
+// Empty subscriptions (aka. "") are ignored.
+func (c *DefaultClient) Subscribe(subs ...string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	for _, s := range subs {
+		if s == "" {
+			continue // skip empty
+		}
+
+		// extract subscription options (if any)
+		rawOptions := struct {
+			// note: any instead of string to minimize the breaking changes with earlier versions
+			Query   map[string]any `json:"query"`
+			Headers map[string]any `json:"headers"`
+		}{}
+		u, err := url.Parse(s)
+		if err == nil {
+			raw := u.Query().Get(optionsParam)
+			if raw != "" {
+				json.Unmarshal([]byte(raw), &rawOptions)
+			}
+		}
+
+		options := SubscriptionOptions{
+			Query:   make(map[string]string, len(rawOptions.Query)),
+			Headers: make(map[string]string, len(rawOptions.Headers)),
+		}
+
+		// normalize query
+		// (currently only single string values are supported for consistency with the default routes handling)
+		for k, v := range rawOptions.Query {
+			options.Query[k] = cast.ToString(v)
+		}
+
+		// normalize headers name and values, eg. "X-Token" is converted to "x_token"
+		// (currently only single string values are supported for consistency with the default routes handling)
+		for k, v := range rawOptions.Headers {
+			options.Headers[inflector.Snakecase(k)] = cast.ToString(v)
+		}
+
+		c.subscriptions[s] = options
+	}
+}
+
+// Unsubscribe implements the [Client.Unsubscribe] interface method.
+//
+// If subs is not set, this method removes all registered client's subscriptions.
+func (c *DefaultClient) Unsubscribe(subs ...string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if len(subs) > 0 {
+		for _, s := range subs {
+			delete(c.subscriptions, s)
+		}
+	} else {
+		// unsubscribe all
+		for s := range c.subscriptions {
+			delete(c.subscriptions, s)
+		}
+	}
+}
+
+// HasSubscription implements the [Client.HasSubscription] interface method.
+func (c *DefaultClient) HasSubscription(sub string) bool {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	_, ok := c.subscriptions[sub]
+
+	return ok
+}
+
+// Get implements the [Client.Get] interface method.
+func (c *DefaultClient) Get(key string) any {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	return c.store[key]
+}
+
+// Set implements the [Client.Set] interface method.
+func (c *DefaultClient) Set(key string, value any) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.store[key] = value
+}
+
+// Unset implements the [Client.Unset] interface method.
+func (c *DefaultClient) Unset(key string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	delete(c.store, key)
+}
+
+// Discard implements the [Client.Discard] interface method.
+func (c *DefaultClient) Discard() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.isDiscarded {
+		return
+	}
+
+	close(c.channel)
+
+	c.isDiscarded = true
+}
+
+// IsDiscarded implements the [Client.IsDiscarded] interface method.
+func (c *DefaultClient) IsDiscarded() bool {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	return c.isDiscarded
+}
+
+// Send sends the specified message to the client's channel (if not discarded).
+func (c *DefaultClient) Send(m Message) {
+	if c.IsDiscarded() {
+		return
+	}
+
+	// "gracefully" handle panics since channel close is not blocking and could cause races
+	defer func() {
+		recover()
+	}()
+
+	c.channel <- m
+}
+
+func (c *DefaultClient) RawSubscriptions() []string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	subs := make([]string, 0, len(c.subscriptions))
+	for key := range c.subscriptions {
+		subs = append(subs, key)
+	}
+
+	return subs
+}
diff --git a/server/core_backend-server/tools/subscriptions/client_test.go b/server/core_backend-server/tools/subscriptions/client_test.go
new file mode 100644
index 0000000..1f5a916
--- /dev/null
+++ b/server/core_backend-server/tools/subscriptions/client_test.go
@@ -0,0 +1,244 @@
+package subscriptions_test
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+func TestNewDefaultClient(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	if c.Channel() == nil {
+		t.Errorf("Expected channel to be initialized")
+	}
+
+	if c.Subscriptions() == nil {
+		t.Errorf("Expected subscriptions map to be initialized")
+	}
+
+	if c.Id() == "" {
+		t.Errorf("Expected unique id to be set")
+	}
+}
+
+func TestId(t *testing.T) {
+	clients := []*subscriptions.DefaultClient{
+		subscriptions.NewDefaultClient(),
+		subscriptions.NewDefaultClient(),
+		subscriptions.NewDefaultClient(),
+		subscriptions.NewDefaultClient(),
+	}
+
+	ids := map[string]struct{}{}
+	for i, c := range clients {
+		// check uniqueness
+		if _, ok := ids[c.Id()]; ok {
+			t.Errorf("(%d) Expected unique id, got %v", i, c.Id())
+		} else {
+			ids[c.Id()] = struct{}{}
+		}
+
+		// check length
+		if len(c.Id()) != 40 {
+			t.Errorf("(%d) Expected unique id to have 40 chars length, got %v", i, c.Id())
+		}
+	}
+}
+
+func TestChannel(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	if c.Channel() == nil {
+		t.Fatalf("Expected channel to be initialized, got")
+	}
+}
+
+func TestSubscriptions(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	if len(c.Subscriptions()) != 0 {
+		t.Fatalf("Expected subscriptions to be empty")
+	}
+
+	c.Subscribe("sub1", "sub11", "sub2")
+
+	scenarios := []struct {
+		prefixes []string
+		expected []string
+	}{
+		{nil, []string{"sub1", "sub11", "sub2"}},
+		{[]string{"missing"}, nil},
+		{[]string{"sub1"}, []string{"sub1", "sub11"}},
+		{[]string{"sub2"}, []string{"sub2"}}, // with extra query start char
+	}
+
+	for _, s := range scenarios {
+		t.Run(strings.Join(s.prefixes, ","), func(t *testing.T) {
+			subs := c.Subscriptions(s.prefixes...)
+
+			if len(subs) != len(s.expected) {
+				t.Fatalf("Expected %d subscriptions, got %d", len(s.expected), len(subs))
+			}
+
+			for _, s := range s.expected {
+				if _, ok := subs[s]; !ok {
+					t.Fatalf("Missing subscription %q in \n%v", s, subs)
+				}
+			}
+		})
+	}
+}
+
+func TestSubscribe(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	subs := []string{"", "sub1", "sub2", "sub3"}
+	expected := []string{"sub1", "sub2", "sub3"}
+
+	c.Subscribe(subs...) // empty string should be skipped
+
+	if len(c.Subscriptions()) != 3 {
+		t.Fatalf("Expected 3 subscriptions, got %v", c.Subscriptions())
+	}
+
+	for i, s := range expected {
+		if !c.HasSubscription(s) {
+			t.Errorf("(%d) Expected sub %s", i, s)
+		}
+	}
+}
+
+func TestSubscribeOptions(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	sub1 := "test1"
+	sub2 := `test2?options={"query":{"name":123},"headers":{"X-Token":456}}`
+
+	c.Subscribe(sub1, sub2)
+
+	subs := c.Subscriptions()
+
+	scenarios := []struct {
+		name            string
+		expectedOptions string
+	}{
+		{sub1, `{"query":{},"headers":{}}`},
+		{sub2, `{"query":{"name":"123"},"headers":{"x_token":"456"}}`},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			options, ok := subs[s.name]
+			if !ok {
+				t.Fatalf("Missing subscription \n%q \nin \n%v", s.name, subs)
+			}
+
+			rawBytes, err := json.Marshal(options)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rawStr := string(rawBytes)
+
+			if rawStr != s.expectedOptions {
+				t.Fatalf("Expected options\n%v\ngot\n%v", s.expectedOptions, rawStr)
+			}
+		})
+	}
+}
+
+func TestUnsubscribe(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	c.Subscribe("sub1", "sub2", "sub3")
+
+	c.Unsubscribe("sub1")
+
+	if c.HasSubscription("sub1") {
+		t.Fatalf("Expected sub1 to be removed")
+	}
+
+	c.Unsubscribe( /* all */ )
+	if len(c.Subscriptions()) != 0 {
+		t.Fatalf("Expected all subscriptions to be removed, got %v", c.Subscriptions())
+	}
+}
+
+func TestHasSubscription(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	if c.HasSubscription("missing") {
+		t.Error("Expected false, got true")
+	}
+
+	c.Subscribe("sub")
+
+	if !c.HasSubscription("sub") {
+		t.Error("Expected true, got false")
+	}
+}
+
+func TestSetAndGet(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	c.Set("demo", 1)
+
+	result, _ := c.Get("demo").(int)
+
+	if result != 1 {
+		t.Errorf("Expected 1, got %v", result)
+	}
+}
+
+func TestDiscard(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	if v := c.IsDiscarded(); v {
+		t.Fatal("Expected false, got true")
+	}
+
+	c.Discard()
+
+	if v := c.IsDiscarded(); !v {
+		t.Fatal("Expected true, got false")
+	}
+}
+
+func TestSend(t *testing.T) {
+	c := subscriptions.NewDefaultClient()
+
+	received := []string{}
+	go func() {
+		for m := range c.Channel() {
+			received = append(received, m.Name)
+		}
+	}()
+
+	c.Send(subscriptions.Message{Name: "m1"})
+	c.Send(subscriptions.Message{Name: "m2"})
+	c.Discard()
+	c.Send(subscriptions.Message{Name: "m3"})
+	c.Send(subscriptions.Message{Name: "m4"})
+	time.Sleep(5 * time.Millisecond)
+
+	expected := []string{"m1", "m2"}
+
+	if len(received) != len(expected) {
+		t.Fatalf("Expected %d messages, got %d", len(expected), len(received))
+	}
+	for _, name := range expected {
+		var exists bool
+		for _, n := range received {
+			if n == name {
+				exists = true
+				break
+			}
+		}
+		if !exists {
+			t.Fatalf("Missing expected %q message, got %v", name, received)
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/subscriptions/message.go b/server/core_backend-server/tools/subscriptions/message.go
new file mode 100644
index 0000000..4d78647
--- /dev/null
+++ b/server/core_backend-server/tools/subscriptions/message.go
@@ -0,0 +1,37 @@
+package subscriptions
+
+import (
+	"io"
+)
+
+// Message defines a client's channel data.
+type Message struct {
+	Name string `json:"name"`
+	Data []byte `json:"data"`
+}
+
+// WriteSSE writes the current message in a SSE format into the provided writer.
+//
+// For example, writing to a router.Event:
+//
+//	m := Message{Name: "users/create", Data: []byte{...}}
+//	m.WriteSSE(e.Response, "yourEventId")
+//	e.Flush()
+func (m *Message) WriteSSE(w io.Writer, eventId string) error {
+	parts := [][]byte{
+		[]byte("id:" + eventId + "\n"),
+		[]byte("event:" + m.Name + "\n"),
+		[]byte("data:"),
+		m.Data,
+		[]byte("\n\n"),
+	}
+
+	for _, part := range parts {
+		_, err := w.Write(part)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/tools/subscriptions/message_test.go b/server/core_backend-server/tools/subscriptions/message_test.go
new file mode 100644
index 0000000..6483c9b
--- /dev/null
+++ b/server/core_backend-server/tools/subscriptions/message_test.go
@@ -0,0 +1,25 @@
+package subscriptions_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/subscriptions"
+)
+
+func TestMessageWrite(t *testing.T) {
+	m := subscriptions.Message{
+		Name: "test_name",
+		Data: []byte("test_data"),
+	}
+
+	var sb strings.Builder
+
+	m.WriteSSE(&sb, "test_id")
+
+	expected := "id:test_id\nevent:test_name\ndata:test_data\n\n"
+
+	if v := sb.String(); v != expected {
+		t.Fatalf("Expected writer content\n%q\ngot\n%q", expected, v)
+	}
+}
diff --git a/server/core_backend-server/tools/template/registry.go b/server/core_backend-server/tools/template/registry.go
new file mode 100644
index 0000000..2440206
--- /dev/null
+++ b/server/core_backend-server/tools/template/registry.go
@@ -0,0 +1,141 @@
+// Package template is a thin wrapper around the standard html/template
+// and text/template packages that implements a convenient registry to
+// load and cache templates on the fly concurrently.
+//
+// It was created to assist the JSVM plugin HTML rendering, but could be used in other Go code.
+//
+// Example:
+//
+//	registry := template.NewRegistry()
+//
+//	html1, err := registry.LoadFiles(
+//		// the files set wil be parsed only once and then cached
+//		"layout.html",
+//		"content.html",
+//	).Render(map[string]any{"name": "John"})
+//
+//	html2, err := registry.LoadFiles(
+//		// reuse the already parsed and cached files set
+//		"layout.html",
+//		"content.html",
+//	).Render(map[string]any{"name": "Jane"})
+package template
+
+import (
+	"fmt"
+	"html/template"
+	"io/fs"
+	"path/filepath"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/tools/store"
+)
+
+// NewRegistry creates and initializes a new templates registry with
+// some defaults (eg. global "raw" template function for unescaped HTML).
+//
+// Use the Registry.Load* methods to load templates into the registry.
+func NewRegistry() *Registry {
+	return &Registry{
+		cache: store.New[string, *Renderer](nil),
+		funcs: template.FuncMap{
+			"raw": func(str string) template.HTML {
+				return template.HTML(str)
+			},
+		},
+	}
+}
+
+// Registry defines a templates registry that is safe to be used by multiple goroutines.
+//
+// Use the Registry.Load* methods to load templates into the registry.
+type Registry struct {
+	cache *store.Store[string, *Renderer]
+	funcs template.FuncMap
+}
+
+// AddFuncs registers new global template functions.
+//
+// The key of each map entry is the function name that will be used in the templates.
+// If a function with the map entry name already exists it will be replaced with the new one.
+//
+// The value of each map entry is a function that must have either a
+// single return value, or two return values of which the second has type error.
+//
+// Example:
+//
+//	r.AddFuncs(map[string]any{
+//	  "toUpper": func(str string) string {
+//	      return strings.ToUppser(str)
+//	  },
+//	  ...
+//	})
+func (r *Registry) AddFuncs(funcs map[string]any) *Registry {
+	for name, f := range funcs {
+		r.funcs[name] = f
+	}
+
+	return r
+}
+
+// LoadFiles caches (if not already) the specified filenames set as a
+// single template and returns a ready to use Renderer instance.
+//
+// There must be at least 1 filename specified.
+func (r *Registry) LoadFiles(filenames ...string) *Renderer {
+	key := strings.Join(filenames, ",")
+
+	found := r.cache.Get(key)
+
+	if found == nil {
+		// parse and cache
+		tpl, err := template.New(filepath.Base(filenames[0])).Funcs(r.funcs).ParseFiles(filenames...)
+		found = &Renderer{template: tpl, parseError: err}
+		r.cache.Set(key, found)
+	}
+
+	return found
+}
+
+// LoadString caches (if not already) the specified inline string as a
+// single template and returns a ready to use Renderer instance.
+func (r *Registry) LoadString(text string) *Renderer {
+	found := r.cache.Get(text)
+
+	if found == nil {
+		// parse and cache (using the text as key)
+		tpl, err := template.New("").Funcs(r.funcs).Parse(text)
+		found = &Renderer{template: tpl, parseError: err}
+		r.cache.Set(text, found)
+	}
+
+	return found
+}
+
+// LoadFS caches (if not already) the specified fs and globPatterns
+// pair as single template and returns a ready to use Renderer instance.
+//
+// There must be at least 1 file matching the provided globPattern(s)
+// (note that most file names serves as glob patterns matching themselves).
+func (r *Registry) LoadFS(fsys fs.FS, globPatterns ...string) *Renderer {
+	key := fmt.Sprintf("%v%v", fsys, globPatterns)
+
+	found := r.cache.Get(key)
+
+	if found == nil {
+		// find the first file to use as template name (it is required when specifying Funcs)
+		var firstFilename string
+		if len(globPatterns) > 0 {
+			list, _ := fs.Glob(fsys, globPatterns[0])
+			if len(list) > 0 {
+				firstFilename = filepath.Base(list[0])
+			}
+		}
+
+		tpl, err := template.New(firstFilename).Funcs(r.funcs).ParseFS(fsys, globPatterns...)
+		found = &Renderer{template: tpl, parseError: err}
+		r.cache.Set(key, found)
+	}
+
+	return found
+}
diff --git a/server/core_backend-server/tools/template/registry_test.go b/server/core_backend-server/tools/template/registry_test.go
new file mode 100644
index 0000000..c037fe3
--- /dev/null
+++ b/server/core_backend-server/tools/template/registry_test.go
@@ -0,0 +1,250 @@
+package template
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func checkRegistryFuncs(t *testing.T, r *Registry, expectedFuncs ...string) {
+	if v := len(r.funcs); v != len(expectedFuncs) {
+		t.Fatalf("Expected total %d funcs, got %d", len(expectedFuncs), v)
+	}
+
+	for _, name := range expectedFuncs {
+		if _, ok := r.funcs[name]; !ok {
+			t.Fatalf("Missing %q func", name)
+		}
+	}
+}
+
+func TestNewRegistry(t *testing.T) {
+	r := NewRegistry()
+
+	if r.cache == nil {
+		t.Fatalf("Expected cache store to be initialized, got nil")
+	}
+
+	if v := r.cache.Length(); v != 0 {
+		t.Fatalf("Expected cache store length to be 0, got %d", v)
+	}
+
+	checkRegistryFuncs(t, r, "raw")
+}
+
+func TestRegistryAddFuncs(t *testing.T) {
+	r := NewRegistry()
+
+	r.AddFuncs(map[string]any{
+		"test": func(a string) string { return a + "-TEST" },
+	})
+
+	checkRegistryFuncs(t, r, "raw", "test")
+
+	result, err := r.LoadString(`{{.|test}}`).Render("example")
+	if err != nil {
+		t.Fatalf("Unexpected Render() error, got %v", err)
+	}
+
+	expected := "example-TEST"
+	if result != expected {
+		t.Fatalf("Expected Render() result %q, got %q", expected, result)
+	}
+}
+
+func TestRegistryLoadFiles(t *testing.T) {
+	r := NewRegistry()
+
+	t.Run("invalid or missing files", func(t *testing.T) {
+		r.LoadFiles("file1.missing", "file2.missing")
+
+		key := "file1.missing,file2.missing"
+		renderer := r.cache.Get(key)
+
+		if renderer == nil {
+			t.Fatal("Expected renderer to be initialized even if invalid, got nil")
+		}
+
+		if renderer.template != nil {
+			t.Fatalf("Expected renderer template to be nil, got %v", renderer.template)
+		}
+
+		if renderer.parseError == nil {
+			t.Fatalf("Expected renderer parseError to be set, got nil")
+		}
+	})
+
+	t.Run("valid files", func(t *testing.T) {
+		// create test templates
+		dir, err := os.MkdirTemp(os.TempDir(), "template_test")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "base.html"), []byte(`Base:{{template "content" .}}`), 0644); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "content.html"), []byte(`{{define "content"}}Content:{{.|raw}}{{end}}`), 0644); err != nil {
+			t.Fatal(err)
+		}
+		defer os.RemoveAll(dir)
+
+		files := []string{filepath.Join(dir, "base.html"), filepath.Join(dir, "content.html")}
+
+		r.LoadFiles(files...)
+
+		renderer := r.cache.Get(strings.Join(files, ","))
+
+		if renderer == nil {
+			t.Fatal("Expected renderer to be initialized even if invalid, got nil")
+		}
+
+		if renderer.template == nil {
+			t.Fatal("Expected renderer template to be set, got nil")
+		}
+
+		if renderer.parseError != nil {
+			t.Fatalf("Expected renderer parseError to be nil, got %v", renderer.parseError)
+		}
+
+		result, err := renderer.Render("<h1>123</h1>")
+		if err != nil {
+			t.Fatalf("Unexpected Render() error, got %v", err)
+		}
+
+		expected := "Base:Content:<h1>123</h1>"
+		if result != expected {
+			t.Fatalf("Expected Render() result %q, got %q", expected, result)
+		}
+	})
+}
+
+func TestRegistryLoadString(t *testing.T) {
+	r := NewRegistry()
+
+	t.Run("invalid template string", func(t *testing.T) {
+		txt := `test {{define "content"}}`
+
+		r.LoadString(txt)
+
+		renderer := r.cache.Get(txt)
+
+		if renderer == nil {
+			t.Fatal("Expected renderer to be initialized even if invalid, got nil")
+		}
+
+		if renderer.template != nil {
+			t.Fatalf("Expected renderer template to be nil, got %v", renderer.template)
+		}
+
+		if renderer.parseError == nil {
+			t.Fatalf("Expected renderer parseError to be set, got nil")
+		}
+	})
+
+	t.Run("valid template string", func(t *testing.T) {
+		txt := `test {{.|raw}}`
+
+		r.LoadString(txt)
+
+		renderer := r.cache.Get(txt)
+
+		if renderer == nil {
+			t.Fatal("Expected renderer to be initialized even if invalid, got nil")
+		}
+
+		if renderer.template == nil {
+			t.Fatal("Expected renderer template to be set, got nil")
+		}
+
+		if renderer.parseError != nil {
+			t.Fatalf("Expected renderer parseError to be nil, got %v", renderer.parseError)
+		}
+
+		result, err := renderer.Render("<h1>123</h1>")
+		if err != nil {
+			t.Fatalf("Unexpected Render() error, got %v", err)
+		}
+
+		expected := "test <h1>123</h1>"
+		if result != expected {
+			t.Fatalf("Expected Render() result %q, got %q", expected, result)
+		}
+	})
+}
+
+func TestRegistryLoadFS(t *testing.T) {
+	r := NewRegistry()
+
+	t.Run("invalid fs", func(t *testing.T) {
+		fs := os.DirFS("__missing__")
+
+		files := []string{"missing1", "missing2"}
+
+		key := fmt.Sprintf("%v%v", fs, files)
+
+		r.LoadFS(fs, files...)
+
+		renderer := r.cache.Get(key)
+
+		if renderer == nil {
+			t.Fatal("Expected renderer to be initialized even if invalid, got nil")
+		}
+
+		if renderer.template != nil {
+			t.Fatalf("Expected renderer template to be nil, got %v", renderer.template)
+		}
+
+		if renderer.parseError == nil {
+			t.Fatalf("Expected renderer parseError to be set, got nil")
+		}
+	})
+
+	t.Run("valid fs", func(t *testing.T) {
+		// create test templates
+		dir, err := os.MkdirTemp(os.TempDir(), "template_test2")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "base.html"), []byte(`Base:{{template "content" .}}`), 0644); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "content.html"), []byte(`{{define "content"}}Content:{{.|raw}}{{end}}`), 0644); err != nil {
+			t.Fatal(err)
+		}
+		defer os.RemoveAll(dir)
+
+		fs := os.DirFS(dir)
+
+		files := []string{"base.html", "content.html"}
+
+		key := fmt.Sprintf("%v%v", fs, files)
+
+		r.LoadFS(fs, files...)
+
+		renderer := r.cache.Get(key)
+
+		if renderer == nil {
+			t.Fatal("Expected renderer to be initialized even if invalid, got nil")
+		}
+
+		if renderer.template == nil {
+			t.Fatal("Expected renderer template to be set, got nil")
+		}
+
+		if renderer.parseError != nil {
+			t.Fatalf("Expected renderer parseError to be nil, got %v", renderer.parseError)
+		}
+
+		result, err := renderer.Render("<h1>123</h1>")
+		if err != nil {
+			t.Fatalf("Unexpected Render() error, got %v", err)
+		}
+
+		expected := "Base:Content:<h1>123</h1>"
+		if result != expected {
+			t.Fatalf("Expected Render() result %q, got %q", expected, result)
+		}
+	})
+}
diff --git a/server/core_backend-server/tools/template/renderer.go b/server/core_backend-server/tools/template/renderer.go
new file mode 100644
index 0000000..7a2d85d
--- /dev/null
+++ b/server/core_backend-server/tools/template/renderer.go
@@ -0,0 +1,33 @@
+package template
+
+import (
+	"bytes"
+	"errors"
+	"html/template"
+)
+
+// Renderer defines a single parsed template.
+type Renderer struct {
+	template   *template.Template
+	parseError error
+}
+
+// Render executes the template with the specified data as the dot object
+// and returns the result as plain string.
+func (r *Renderer) Render(data any) (string, error) {
+	if r.parseError != nil {
+		return "", r.parseError
+	}
+
+	if r.template == nil {
+		return "", errors.New("invalid or nil template")
+	}
+
+	buf := new(bytes.Buffer)
+
+	if err := r.template.Execute(buf, data); err != nil {
+		return "", err
+	}
+
+	return buf.String(), nil
+}
diff --git a/server/core_backend-server/tools/template/renderer_test.go b/server/core_backend-server/tools/template/renderer_test.go
new file mode 100644
index 0000000..7c75111
--- /dev/null
+++ b/server/core_backend-server/tools/template/renderer_test.go
@@ -0,0 +1,63 @@
+package template
+
+import (
+	"errors"
+	"html/template"
+	"testing"
+)
+
+func TestRendererRender(t *testing.T) {
+	tpl, _ := template.New("").Parse("Hello {{.Name}}!")
+	tpl.Option("missingkey=error") // enforce execute errors
+
+	scenarios := map[string]struct {
+		renderer       *Renderer
+		data           any
+		expectedHasErr bool
+		expectedResult string
+	}{
+		"with nil template": {
+			&Renderer{},
+			nil,
+			true,
+			"",
+		},
+		"with parse error": {
+			&Renderer{
+				template:   tpl,
+				parseError: errors.New("test"),
+			},
+			nil,
+			true,
+			"",
+		},
+		"with execute error": {
+			&Renderer{template: tpl},
+			nil,
+			true,
+			"",
+		},
+		"no error": {
+			&Renderer{template: tpl},
+			struct{ Name string }{"world"},
+			false,
+			"Hello world!",
+		},
+	}
+
+	for name, s := range scenarios {
+		t.Run(name, func(t *testing.T) {
+			result, err := s.renderer.Render(s.data)
+
+			hasErr := err != nil
+
+			if s.expectedHasErr != hasErr {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectedHasErr, hasErr, err)
+			}
+
+			if s.expectedResult != result {
+				t.Fatalf("Expected result %v, got %v", s.expectedResult, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/tokenizer/tokenizer.go b/server/core_backend-server/tools/tokenizer/tokenizer.go
new file mode 100644
index 0000000..934d369
--- /dev/null
+++ b/server/core_backend-server/tools/tokenizer/tokenizer.go
@@ -0,0 +1,221 @@
+// Package tokenizer implements a rudimentary tokens parser of buffered
+// io.Reader while respecting quotes and parenthesis boundaries.
+//
+// Example
+//
+//	tk := tokenizer.NewFromString("a, b, (c, d)")
+//	result, _ := tk.ScanAll() // ["a", "b", "(c, d)"]
+package tokenizer
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// eof represents a marker rune for the end of the reader.
+const eof = rune(0)
+
+// DefaultSeparators is a list with the default token separator characters.
+var DefaultSeparators = []rune{','}
+
+var whitespaceChars = []rune{'\t', '\n', '\v', '\f', '\r', ' ', 0x85, 0xA0}
+
+// NewFromString creates new Tokenizer from the provided string.
+func NewFromString(str string) *Tokenizer {
+	return New(strings.NewReader(str))
+}
+
+// NewFromBytes creates new Tokenizer from the provided bytes slice.
+func NewFromBytes(b []byte) *Tokenizer {
+	return New(bytes.NewReader(b))
+}
+
+// New creates new Tokenizer from the provided reader with DefaultSeparators.
+func New(r io.Reader) *Tokenizer {
+	t := &Tokenizer{r: bufio.NewReader(r)}
+
+	t.Separators(DefaultSeparators...)
+
+	return t
+}
+
+// Tokenizer defines a struct that parses a reader into tokens while
+// respecting quotes and parenthesis boundaries.
+type Tokenizer struct {
+	r *bufio.Reader
+
+	trimCutset        string
+	separators        []rune
+	keepSeparator     bool
+	keepEmptyTokens   bool
+	ignoreParenthesis bool
+}
+
+// Separators defines the provided separatos of the current Tokenizer.
+func (t *Tokenizer) Separators(separators ...rune) {
+	t.separators = separators
+
+	t.rebuildTrimCutset()
+}
+
+// KeepSeparator defines whether to keep the separator rune as part
+// of the token (default to false).
+func (t *Tokenizer) KeepSeparator(state bool) {
+	t.keepSeparator = state
+}
+
+// KeepEmptyTokens defines whether to keep empty tokens on Scan() (default to false).
+func (t *Tokenizer) KeepEmptyTokens(state bool) {
+	t.keepEmptyTokens = state
+}
+
+// IgnoreParenthesis defines whether to ignore the parenthesis boundaries
+// and to treat the '(' and ')' as regular characters.
+func (t *Tokenizer) IgnoreParenthesis(state bool) {
+	t.ignoreParenthesis = state
+}
+
+// Scan reads and returns the next available token from the Tokenizer's buffer (trimmed!).
+//
+// Empty tokens are skipped if t.keepEmptyTokens is not set (which is the default).
+//
+// Returns [io.EOF] error when there are no more tokens to scan.
+func (t *Tokenizer) Scan() (string, error) {
+	ch := t.read()
+	if ch == eof {
+		return "", io.EOF
+	}
+	t.unread()
+
+	token, err := t.readToken()
+	if err != nil {
+		return "", err
+	}
+
+	if !t.keepEmptyTokens && token == "" {
+		return t.Scan()
+	}
+
+	return token, err
+}
+
+// ScanAll reads the entire Tokenizer's buffer and return all found tokens.
+func (t *Tokenizer) ScanAll() ([]string, error) {
+	tokens := []string{}
+
+	for {
+		token, err := t.Scan()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+
+			return nil, err
+		}
+
+		tokens = append(tokens, token)
+	}
+
+	return tokens, nil
+}
+
+// readToken reads a single token from the buffer and returns it.
+func (t *Tokenizer) readToken() (string, error) {
+	var buf bytes.Buffer
+	var parenthesis int
+	var quoteCh rune
+	var prevCh rune
+
+	for {
+		ch := t.read()
+
+		if ch == eof {
+			break
+		}
+
+		if !t.isEscapeRune(prevCh) {
+			if !t.ignoreParenthesis && ch == '(' && quoteCh == eof {
+				parenthesis++ // opening parenthesis
+			} else if !t.ignoreParenthesis && ch == ')' && parenthesis > 0 && quoteCh == eof {
+				parenthesis-- // closing parenthesis
+			} else if t.isQuoteRune(ch) {
+				switch quoteCh {
+				case ch:
+					quoteCh = eof // closing quote
+				case eof:
+					quoteCh = ch // opening quote
+				}
+			}
+		}
+
+		if t.isSeperatorRune(ch) && parenthesis == 0 && quoteCh == eof {
+			if t.keepSeparator {
+				buf.WriteRune(ch)
+			}
+			break
+		}
+
+		prevCh = ch
+		buf.WriteRune(ch)
+	}
+
+	if parenthesis > 0 || quoteCh != eof {
+		return "", fmt.Errorf("unbalanced parenthesis or quoted expression: %q", buf.String())
+	}
+
+	return strings.Trim(buf.String(), t.trimCutset), nil
+}
+
+// read reads the next rune from the buffered reader.
+// Returns the `rune(0)` if an error or `io.EOF` occurs.
+func (t *Tokenizer) read() rune {
+	ch, _, err := t.r.ReadRune()
+	if err != nil {
+		return eof
+	}
+
+	return ch
+}
+
+// unread places the previously read rune back on the reader.
+func (t *Tokenizer) unread() error {
+	return t.r.UnreadRune()
+}
+
+// rebuildTrimCutset rebuilds the tokenizer trimCutset based on its separator runes.
+func (t *Tokenizer) rebuildTrimCutset() {
+	var cutset strings.Builder
+
+	for _, w := range whitespaceChars {
+		if t.isSeperatorRune(w) {
+			continue
+		}
+		cutset.WriteRune(w)
+	}
+
+	t.trimCutset = cutset.String()
+}
+
+// isSeperatorRune checks if a rune is a token part separator.
+func (t *Tokenizer) isSeperatorRune(ch rune) bool {
+	for _, r := range t.separators {
+		if ch == r {
+			return true
+		}
+	}
+
+	return false
+}
+
+// isQuoteRune checks if a rune is a quote.
+func (t *Tokenizer) isQuoteRune(ch rune) bool {
+	return ch == '\'' || ch == '"' || ch == '`'
+}
+
+// isEscapeRune checks if a rune is an escape character.
+func (t *Tokenizer) isEscapeRune(ch rune) bool {
+	return ch == '\\'
+}
diff --git a/server/core_backend-server/tools/tokenizer/tokenizer_test.go b/server/core_backend-server/tools/tokenizer/tokenizer_test.go
new file mode 100644
index 0000000..c9aab59
--- /dev/null
+++ b/server/core_backend-server/tools/tokenizer/tokenizer_test.go
@@ -0,0 +1,303 @@
+package tokenizer
+
+import (
+	"io"
+	"strings"
+	"testing"
+)
+
+func TestFactories(t *testing.T) {
+	expectedContent := "test"
+
+	scenarios := []struct {
+		name string
+		tk   *Tokenizer
+	}{
+		{
+			"New()",
+			New(strings.NewReader(expectedContent)),
+		},
+		{
+			"NewFromString()",
+			NewFromString(expectedContent),
+		},
+		{
+			"NewFromBytes()",
+			NewFromBytes([]byte(expectedContent)),
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			content, _ := s.tk.r.ReadString(0)
+
+			if content != expectedContent {
+				t.Fatalf("Expected reader with content %q, got %q", expectedContent, content)
+			}
+
+			if s.tk.keepSeparator != false {
+				t.Fatal("Expected keepSeparator false, got true")
+			}
+
+			if s.tk.ignoreParenthesis != false {
+				t.Fatal("Expected ignoreParenthesis false, got true")
+			}
+
+			if len(s.tk.separators) != len(DefaultSeparators) {
+				t.Fatalf("Expected \n%v, \ngot \n%v", DefaultSeparators, s.tk.separators)
+			}
+
+			for _, r := range s.tk.separators {
+				exists := false
+				for _, def := range s.tk.separators {
+					if r == def {
+						exists = true
+						break
+					}
+				}
+				if !exists {
+					t.Fatalf("Unexpected sepator %s", string(r))
+				}
+			}
+		})
+	}
+}
+
+func TestScan(t *testing.T) {
+	tk := NewFromString("abc, 123.456, (abc)")
+
+	expectedTokens := []string{"abc", "123.456", "(abc)"}
+
+	for _, token := range expectedTokens {
+		result, err := tk.Scan()
+		if err != nil {
+			t.Fatalf("Expected token %q, got error %v", token, err)
+		}
+
+		if result != token {
+			t.Fatalf("Expected token %q, got error %v", token, result)
+		}
+	}
+
+	// scan the last character
+	token, err := tk.Scan()
+	if err != io.EOF {
+		t.Fatalf("Expected EOF error, got %v", err)
+	}
+	if token != "" || err != io.EOF {
+		t.Fatalf("Expected empty token, got %q", token)
+	}
+}
+
+func TestScanAll(t *testing.T) {
+	scenarios := []struct {
+		name              string
+		content           string
+		separators        []rune
+		keepSeparator     bool
+		keepEmptyTokens   bool
+		ignoreParenthesis bool
+		expectError       bool
+		expectTokens      []string
+	}{
+		{
+			name:              "empty string",
+			content:           "",
+			separators:        DefaultSeparators,
+			keepSeparator:     false,
+			keepEmptyTokens:   false,
+			ignoreParenthesis: false,
+			expectError:       false,
+			expectTokens:      nil,
+		},
+		{
+			name:              "unbalanced parenthesis",
+			content:           `(a,b() c`,
+			separators:        DefaultSeparators,
+			keepSeparator:     false,
+			keepEmptyTokens:   false,
+			ignoreParenthesis: false,
+			expectError:       true,
+			expectTokens:      []string{},
+		},
+		{
+			name:              "unmatching quotes",
+			content:           `'asd"`,
+			separators:        DefaultSeparators,
+			keepSeparator:     false,
+			keepEmptyTokens:   false,
+			ignoreParenthesis: false,
+			expectError:       true,
+			expectTokens:      []string{},
+		},
+		{
+			name:              "no separators",
+			content:           `a, b, c, d, e 123, "abc"`,
+			separators:        nil,
+			keepSeparator:     false,
+			keepEmptyTokens:   false,
+			ignoreParenthesis: false,
+			expectError:       false,
+			expectTokens:      []string{`a, b, c, d, e 123, "abc"`},
+		},
+		{
+			name: "default separators",
+			content: `a, b , c  , d e  , "a,b,  c  " , ,, ,	  (123, 456)
+			`,
+			separators:        DefaultSeparators,
+			keepSeparator:     false,
+			keepEmptyTokens:   false,
+			ignoreParenthesis: false,
+			expectError:       false,
+			expectTokens: []string{
+				"a",
+				"b",
+				"c",
+				"d e",
+				`"a,b,  c  "`,
+				`(123, 456)`,
+			},
+		},
+		{
+			name:              "keep separators",
+			content:           `a, b, c, d  e, "a,b,  c  ",	(123, 456)`,
+			separators:        []rune{',', ' '}, // the space should be removed from the cutset
+			keepSeparator:     true,
+			keepEmptyTokens:   true,
+			ignoreParenthesis: false,
+			expectError:       false,
+			expectTokens: []string{
+				"a,",
+				" ",
+				"b,",
+				" ",
+				"c,",
+				" ",
+				"d ",
+				" ",
+				"e,",
+				" ",
+				`"a,b,  c  ",`,
+				`(123, 456)`,
+			},
+		},
+		{
+			name:              "custom separators",
+			content:           `a | b c  d &(e + f) &  "g & h" & & &`,
+			separators:        []rune{'|', '&'},
+			keepSeparator:     false,
+			keepEmptyTokens:   false,
+			ignoreParenthesis: false,
+			expectError:       false,
+			expectTokens: []string{
+				"a",
+				"b c  d",
+				"(e + f)",
+				`"g & h"`,
+			},
+		},
+		{
+			name:              "ignoring parenthesis",
+			content:           `a, b, (c,d)`,
+			separators:        DefaultSeparators,
+			keepSeparator:     false,
+			keepEmptyTokens:   false,
+			ignoreParenthesis: true,
+			expectError:       false,
+			expectTokens: []string{
+				"a",
+				"b",
+				"(c",
+				"d)",
+			},
+		},
+		{
+			name:              "keep empty tokens",
+			content:           `a, b, (c, d), ,, , e, , f`,
+			separators:        DefaultSeparators,
+			keepSeparator:     false,
+			keepEmptyTokens:   true,
+			ignoreParenthesis: false,
+			expectError:       false,
+			expectTokens: []string{
+				"a",
+				"b",
+				"(c, d)",
+				"",
+				"",
+				"",
+				"e",
+				"",
+				"f",
+			},
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			tk := NewFromString(s.content)
+
+			tk.Separators(s.separators...)
+			tk.KeepSeparator(s.keepSeparator)
+			tk.KeepEmptyTokens(s.keepEmptyTokens)
+			tk.IgnoreParenthesis(s.ignoreParenthesis)
+
+			tokens, err := tk.ScanAll()
+
+			hasErr := err != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected hasErr %v, got %v (%v)", s.expectError, hasErr, err)
+			}
+
+			if len(tokens) != len(s.expectTokens) {
+				t.Fatalf("Expected \n%v (%d), \ngot \n%v (%d)", s.expectTokens, len(s.expectTokens), tokens, len(tokens))
+			}
+
+			for _, tok := range tokens {
+				exists := false
+				for _, def := range s.expectTokens {
+					if tok == def {
+						exists = true
+						break
+					}
+				}
+				if !exists {
+					t.Fatalf("Unexpected token %q", tok)
+				}
+			}
+		})
+	}
+}
+
+func TestTrimCutset(t *testing.T) {
+	scenarios := []struct {
+		name           string
+		separators     []rune
+		expectedCutset string
+	}{
+		{
+			"default factory separators",
+			nil,
+			"\t\n\v\f\r \u0085\u00a0",
+		},
+		{
+			"custom separators",
+			[]rune{'\t', ' ', '\r', ','},
+			"\n\v\f\u0085\u00a0",
+		},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			tk := NewFromString("")
+
+			if len(s.separators) > 0 {
+				tk.Separators(s.separators...)
+			}
+
+			if tk.trimCutset != s.expectedCutset {
+				t.Fatalf("Expected cutset %q, got %q", s.expectedCutset, tk.trimCutset)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/types/datetime.go b/server/core_backend-server/tools/types/datetime.go
new file mode 100644
index 0000000..04dcbf4
--- /dev/null
+++ b/server/core_backend-server/tools/types/datetime.go
@@ -0,0 +1,162 @@
+package types
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"time"
+
+	"github.com/spf13/cast"
+)
+
+// DefaultDateLayout specifies the default app date strings layout.
+const DefaultDateLayout = "2006-01-02 15:04:05.000Z"
+
+// NowDateTime returns new DateTime instance with the current local time.
+func NowDateTime() DateTime {
+	return DateTime{t: time.Now()}
+}
+
+// ParseDateTime creates a new DateTime from the provided value
+// (could be [cast.ToTime] supported string, [time.Time], etc.).
+func ParseDateTime(value any) (DateTime, error) {
+	d := DateTime{}
+	err := d.Scan(value)
+	return d, err
+}
+
+// DateTime represents a [time.Time] instance in UTC that is wrapped
+// and serialized using the app default date layout.
+type DateTime struct {
+	t time.Time
+}
+
+// Time returns the internal [time.Time] instance.
+func (d DateTime) Time() time.Time {
+	return d.t
+}
+
+// Add returns a new DateTime based on the current DateTime + the specified duration.
+func (d DateTime) Add(duration time.Duration) DateTime {
+	d.t = d.t.Add(duration)
+	return d
+}
+
+// Sub returns a [time.Duration] by subtracting the specified DateTime from the current one.
+//
+// If the result exceeds the maximum (or minimum) value that can be stored in a [time.Duration],
+// the maximum (or minimum) duration will be returned.
+func (d DateTime) Sub(u DateTime) time.Duration {
+	return d.Time().Sub(u.Time())
+}
+
+// AddDate returns a new DateTime based on the current one + duration.
+//
+// It follows the same rules as [time.AddDate].
+func (d DateTime) AddDate(years, months, days int) DateTime {
+	d.t = d.t.AddDate(years, months, days)
+	return d
+}
+
+// After reports whether the current DateTime instance is after u.
+func (d DateTime) After(u DateTime) bool {
+	return d.Time().After(u.Time())
+}
+
+// Before reports whether the current DateTime instance is before u.
+func (d DateTime) Before(u DateTime) bool {
+	return d.Time().Before(u.Time())
+}
+
+// Compare compares the current DateTime instance with u.
+// If the current instance is before u, it returns -1.
+// If the current instance is after u, it returns +1.
+// If they're the same, it returns 0.
+func (d DateTime) Compare(u DateTime) int {
+	return d.Time().Compare(u.Time())
+}
+
+// Equal reports whether the current DateTime and u represent the same time instant.
+// Two DateTime can be equal even if they are in different locations.
+// For example, 6:00 +0200 and 4:00 UTC are Equal.
+func (d DateTime) Equal(u DateTime) bool {
+	return d.Time().Equal(u.Time())
+}
+
+// Unix returns the current DateTime as a Unix time, aka.
+// the number of seconds elapsed since January 1, 1970 UTC.
+func (d DateTime) Unix() int64 {
+	return d.Time().Unix()
+}
+
+// IsZero checks whether the current DateTime instance has zero time value.
+func (d DateTime) IsZero() bool {
+	return d.Time().IsZero()
+}
+
+// String serializes the current DateTime instance into a formatted
+// UTC date string.
+//
+// The zero value is serialized to an empty string.
+func (d DateTime) String() string {
+	t := d.Time()
+	if t.IsZero() {
+		return ""
+	}
+	return t.UTC().Format(DefaultDateLayout)
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+func (d DateTime) MarshalJSON() ([]byte, error) {
+	return []byte(`"` + d.String() + `"`), nil
+}
+
+// UnmarshalJSON implements the [json.Unmarshaler] interface.
+func (d *DateTime) UnmarshalJSON(b []byte) error {
+	var raw string
+	if err := json.Unmarshal(b, &raw); err != nil {
+		return err
+	}
+	return d.Scan(raw)
+}
+
+// Value implements the [driver.Valuer] interface.
+func (d DateTime) Value() (driver.Value, error) {
+	if d.IsZero() { // PostgreSQL only
+		return nil, nil
+	}
+
+	return d.String(), nil
+}
+
+// Scan implements [sql.Scanner] interface to scan the provided value
+// into the current DateTime instance.
+func (d *DateTime) Scan(value any) error {
+	switch v := value.(type) {
+	case time.Time:
+		d.t = v
+	case DateTime:
+		d.t = v.Time()
+	case string:
+		if v == "" {
+			d.t = time.Time{}
+		} else {
+			t, err := time.Parse(DefaultDateLayout, v)
+			if err != nil {
+				// check for other common date layouts
+				t = cast.ToTime(v)
+			}
+			d.t = t
+		}
+	case int, int64, int32, uint, uint64, uint32:
+		d.t = cast.ToTime(v)
+	default:
+		str := cast.ToString(v)
+		if str == "" {
+			d.t = time.Time{}
+		} else {
+			d.t = cast.ToTime(str)
+		}
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/tools/types/datetime_test.go b/server/core_backend-server/tools/types/datetime_test.go
new file mode 100644
index 0000000..007c3e8
--- /dev/null
+++ b/server/core_backend-server/tools/types/datetime_test.go
@@ -0,0 +1,422 @@
+package types_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestNowDateTime(t *testing.T) {
+	now := time.Now().UTC().Format("2006-01-02 15:04:05") // without ms part for test consistency
+	dt := types.NowDateTime()
+
+	if !strings.Contains(dt.String(), now) {
+		t.Fatalf("Expected %q, got %q", now, dt.String())
+	}
+}
+
+func TestParseDateTime(t *testing.T) {
+	nowTime := time.Now().UTC()
+	nowDateTime, _ := types.ParseDateTime(nowTime)
+	nowStr := nowTime.Format(types.DefaultDateLayout)
+
+	scenarios := []struct {
+		value    any
+		expected string
+	}{
+		{nil, ""},
+		{"", ""},
+		{"invalid", ""},
+		{nowDateTime, nowStr},
+		{nowTime, nowStr},
+		{1641024040, "2022-01-01 08:00:40.000Z"},
+		{int32(1641024040), "2022-01-01 08:00:40.000Z"},
+		{int64(1641024040), "2022-01-01 08:00:40.000Z"},
+		{uint(1641024040), "2022-01-01 08:00:40.000Z"},
+		{uint64(1641024040), "2022-01-01 08:00:40.000Z"},
+		{uint32(1641024040), "2022-01-01 08:00:40.000Z"},
+		{"2022-01-01 11:23:45.678", "2022-01-01 11:23:45.678Z"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			dt, err := types.ParseDateTime(s.value)
+			if err != nil {
+				t.Fatalf("Failed to parse %v: %v", s.value, err)
+			}
+
+			if dt.String() != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, dt.String())
+			}
+		})
+	}
+}
+
+func TestDateTimeTime(t *testing.T) {
+	str := "2022-01-01 11:23:45.678Z"
+
+	expected, err := time.Parse(types.DefaultDateLayout, str)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dt, err := types.ParseDateTime(str)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	result := dt.Time()
+
+	if !expected.Equal(result) {
+		t.Fatalf("Expected time %v, got %v", expected, result)
+	}
+}
+
+func TestDateTimeAdd(t *testing.T) {
+	t.Parallel()
+
+	d1, _ := types.ParseDateTime("2024-01-01 10:00:00.123Z")
+
+	d2 := d1.Add(1 * time.Hour)
+
+	if d1.String() != "2024-01-01 10:00:00.123Z" {
+		t.Fatalf("Expected d1 to remain unchanged, got %s", d1.String())
+	}
+
+	expected := "2024-01-01 11:00:00.123Z"
+	if d2.String() != expected {
+		t.Fatalf("Expected d2 %s, got %s", expected, d2.String())
+	}
+}
+
+func TestDateTimeSub(t *testing.T) {
+	t.Parallel()
+
+	d1, _ := types.ParseDateTime("2024-01-01 10:00:00.123Z")
+	d2, _ := types.ParseDateTime("2024-01-01 10:30:00.123Z")
+
+	result := d2.Sub(d1)
+
+	if result.Minutes() != 30 {
+		t.Fatalf("Expected %v minutes diff, got %v", 30, result.Minutes())
+	}
+}
+
+func TestDateTimeAddDate(t *testing.T) {
+	t.Parallel()
+
+	d1, _ := types.ParseDateTime("2024-01-01 10:00:00.123Z")
+
+	d2 := d1.AddDate(1, 2, 3)
+
+	if d1.String() != "2024-01-01 10:00:00.123Z" {
+		t.Fatalf("Expected d1 to remain unchanged, got %s", d1.String())
+	}
+
+	expected := "2025-03-04 10:00:00.123Z"
+	if d2.String() != expected {
+		t.Fatalf("Expected d2 %s, got %s", expected, d2.String())
+	}
+}
+
+func TestDateTimeAfter(t *testing.T) {
+	t.Parallel()
+
+	d1, _ := types.ParseDateTime("2024-01-01 10:00:00.123Z")
+	d2, _ := types.ParseDateTime("2024-01-02 10:00:00.123Z")
+	d3, _ := types.ParseDateTime("2024-01-03 10:00:00.123Z")
+
+	scenarios := []struct {
+		a      types.DateTime
+		b      types.DateTime
+		expect bool
+	}{
+		// d1
+		{d1, d1, false},
+		{d1, d2, false},
+		{d1, d3, false},
+		// d2
+		{d2, d1, true},
+		{d2, d2, false},
+		{d2, d3, false},
+		// d3
+		{d3, d1, true},
+		{d3, d2, true},
+		{d3, d3, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("after_%d", i), func(t *testing.T) {
+			if v := s.a.After(s.b); v != s.expect {
+				t.Fatalf("Expected %v, got %v", s.expect, v)
+			}
+		})
+	}
+}
+
+func TestDateTimeBefore(t *testing.T) {
+	t.Parallel()
+
+	d1, _ := types.ParseDateTime("2024-01-01 10:00:00.123Z")
+	d2, _ := types.ParseDateTime("2024-01-02 10:00:00.123Z")
+	d3, _ := types.ParseDateTime("2024-01-03 10:00:00.123Z")
+
+	scenarios := []struct {
+		a      types.DateTime
+		b      types.DateTime
+		expect bool
+	}{
+		// d1
+		{d1, d1, false},
+		{d1, d2, true},
+		{d1, d3, true},
+		// d2
+		{d2, d1, false},
+		{d2, d2, false},
+		{d2, d3, true},
+		// d3
+		{d3, d1, false},
+		{d3, d2, false},
+		{d3, d3, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("before_%d", i), func(t *testing.T) {
+			if v := s.a.Before(s.b); v != s.expect {
+				t.Fatalf("Expected %v, got %v", s.expect, v)
+			}
+		})
+	}
+}
+
+func TestDateTimeCompare(t *testing.T) {
+	t.Parallel()
+
+	d1, _ := types.ParseDateTime("2024-01-01 10:00:00.123Z")
+	d2, _ := types.ParseDateTime("2024-01-02 10:00:00.123Z")
+	d3, _ := types.ParseDateTime("2024-01-03 10:00:00.123Z")
+
+	scenarios := []struct {
+		a      types.DateTime
+		b      types.DateTime
+		expect int
+	}{
+		// d1
+		{d1, d1, 0},
+		{d1, d2, -1},
+		{d1, d3, -1},
+		// d2
+		{d2, d1, 1},
+		{d2, d2, 0},
+		{d2, d3, -1},
+		// d3
+		{d3, d1, 1},
+		{d3, d2, 1},
+		{d3, d3, 0},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("compare_%d", i), func(t *testing.T) {
+			if v := s.a.Compare(s.b); v != s.expect {
+				t.Fatalf("Expected %v, got %v", s.expect, v)
+			}
+		})
+	}
+}
+
+func TestDateTimeEqual(t *testing.T) {
+	t.Parallel()
+
+	d1, _ := types.ParseDateTime("2024-01-01 10:00:00.123Z")
+	d2, _ := types.ParseDateTime("2024-01-01 10:00:00.123Z")
+	d3, _ := types.ParseDateTime("2024-01-01 10:00:00.124Z")
+
+	scenarios := []struct {
+		a      types.DateTime
+		b      types.DateTime
+		expect bool
+	}{
+		{d1, d1, true},
+		{d1, d2, true},
+		{d1, d3, false},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("equal_%d", i), func(t *testing.T) {
+			if v := s.a.Equal(s.b); v != s.expect {
+				t.Fatalf("Expected %v, got %v", s.expect, v)
+			}
+		})
+	}
+}
+
+func TestDateTimeUnix(t *testing.T) {
+	scenarios := []struct {
+		date     string
+		expected int64
+	}{
+		{"", -62135596800},
+		{"2022-01-01 11:23:45.678Z", 1641036225},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.date), func(t *testing.T) {
+			dt, err := types.ParseDateTime(s.date)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			v := dt.Unix()
+
+			if v != s.expected {
+				t.Fatalf("Expected %d, got %d", s.expected, v)
+			}
+		})
+	}
+}
+
+func TestDateTimeIsZero(t *testing.T) {
+	dt0 := types.DateTime{}
+	if !dt0.IsZero() {
+		t.Fatalf("Expected zero datatime, got %v", dt0)
+	}
+
+	dt1 := types.NowDateTime()
+	if dt1.IsZero() {
+		t.Fatalf("Expected non-zero datatime, got %v", dt1)
+	}
+}
+
+func TestDateTimeString(t *testing.T) {
+	dt0 := types.DateTime{}
+	if dt0.String() != "" {
+		t.Fatalf("Expected empty string for zer datetime, got %q", dt0.String())
+	}
+
+	expected := "2022-01-01 11:23:45.678Z"
+	dt1, _ := types.ParseDateTime(expected)
+	if dt1.String() != expected {
+		t.Fatalf("Expected %q, got %v", expected, dt1)
+	}
+}
+
+func TestDateTimeMarshalJSON(t *testing.T) {
+	scenarios := []struct {
+		date     string
+		expected string
+	}{
+		{"", `""`},
+		{"2022-01-01 11:23:45.678", `"2022-01-01 11:23:45.678Z"`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.date), func(t *testing.T) {
+			dt, err := types.ParseDateTime(s.date)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			result, err := dt.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(result) != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, string(result))
+			}
+		})
+	}
+}
+
+func TestDateTimeUnmarshalJSON(t *testing.T) {
+	scenarios := []struct {
+		date     string
+		expected string
+	}{
+		{"", ""},
+		{"invalid_json", ""},
+		{"'123'", ""},
+		{"2022-01-01 11:23:45.678", ""},
+		{`"2022-01-01 11:23:45.678"`, "2022-01-01 11:23:45.678Z"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.date), func(t *testing.T) {
+			dt := types.DateTime{}
+			dt.UnmarshalJSON([]byte(s.date))
+
+			if dt.String() != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, dt.String())
+			}
+		})
+	}
+}
+
+func TestDateTimeValue(t *testing.T) {
+	scenarios := []struct {
+		value    any
+		expected any
+	}{
+		/* SQLite:
+		{"", ""},
+		{"invalid", ""},
+		*/
+		// PostgreSQL:
+		{"", nil},
+		{"invalid", nil},
+		{1641024040, "2022-01-01 08:00:40.000Z"},
+		{"2022-01-01 11:23:45.678", "2022-01-01 11:23:45.678Z"},
+		{types.NowDateTime(), types.NowDateTime().String()},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.value), func(t *testing.T) {
+			dt, _ := types.ParseDateTime(s.value)
+
+			result, err := dt.Value()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestDateTimeScan(t *testing.T) {
+	now := time.Now().UTC().Format("2006-01-02 15:04:05") // without ms part for test consistency
+
+	scenarios := []struct {
+		value    any
+		expected string
+	}{
+		{nil, ""},
+		{"", ""},
+		{"invalid", ""},
+		{types.NowDateTime(), now},
+		{time.Now(), now},
+		{1.0, ""},
+		{1641024040, "2022-01-01 08:00:40.000Z"},
+		{"2022-01-01 11:23:45.678", "2022-01-01 11:23:45.678Z"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			dt := types.DateTime{}
+
+			err := dt.Scan(s.value)
+			if err != nil {
+				t.Fatalf("Failed to parse %v: %v", s.value, err)
+			}
+
+			if !strings.Contains(dt.String(), s.expected) {
+				t.Fatalf("Expected %q, got %q", s.expected, dt.String())
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/types/geo_point.go b/server/core_backend-server/tools/types/geo_point.go
new file mode 100644
index 0000000..286120d
--- /dev/null
+++ b/server/core_backend-server/tools/types/geo_point.go
@@ -0,0 +1,84 @@
+package types
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+)
+
+// GeoPoint defines a struct for storing geo coordinates as serialized json object
+// (e.g. {lon:0,lat:0}).
+//
+// Note: using object notation and not a plain array to avoid the confusion
+// as there doesn't seem to be a fixed standard for the coordinates order.
+type GeoPoint struct {
+	Lon float64 `form:"lon" json:"lon"`
+	Lat float64 `form:"lat" json:"lat"`
+}
+
+// String returns the string representation of the current GeoPoint instance.
+func (p GeoPoint) String() string {
+	raw, _ := json.Marshal(p)
+	return string(raw)
+}
+
+// AsMap implements [core.mapExtractor] and returns a value suitable
+// to be used in an API rule expression.
+func (p GeoPoint) AsMap() map[string]any {
+	return map[string]any{
+		"lon": p.Lon,
+		"lat": p.Lat,
+	}
+}
+
+// Value implements the [driver.Valuer] interface.
+func (p GeoPoint) Value() (driver.Value, error) {
+	data, err := json.Marshal(p)
+	return string(data), err
+}
+
+// Scan implements [sql.Scanner] interface to scan the provided value
+// into the current GeoPoint instance.
+//
+// The value argument could be nil (no-op), another GeoPoint instance,
+// map or serialized json object with lat-lon props.
+func (p *GeoPoint) Scan(value any) error {
+	var err error
+
+	switch v := value.(type) {
+	case nil:
+		// no cast needed
+	case *GeoPoint:
+		p.Lon = v.Lon
+		p.Lat = v.Lat
+	case GeoPoint:
+		p.Lon = v.Lon
+		p.Lat = v.Lat
+	case JSONRaw:
+		if len(v) != 0 {
+			err = json.Unmarshal(v, p)
+		}
+	case []byte:
+		if len(v) != 0 {
+			err = json.Unmarshal(v, p)
+		}
+	case string:
+		if len(v) != 0 {
+			err = json.Unmarshal([]byte(v), p)
+		}
+	default:
+		var raw []byte
+		raw, err = json.Marshal(v)
+		if err != nil {
+			err = fmt.Errorf("unable to marshalize value for scanning: %w", err)
+		} else {
+			err = json.Unmarshal(raw, p)
+		}
+	}
+
+	if err != nil {
+		return fmt.Errorf("[GeoPoint] unable to scan value %v: %w", value, err)
+	}
+
+	return nil
+}
diff --git a/server/core_backend-server/tools/types/geo_point_test.go b/server/core_backend-server/tools/types/geo_point_test.go
new file mode 100644
index 0000000..fa7c5d5
--- /dev/null
+++ b/server/core_backend-server/tools/types/geo_point_test.go
@@ -0,0 +1,116 @@
+package types_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestGeoPointAsMap(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name     string
+		point    types.GeoPoint
+		expected map[string]any
+	}{
+		{"zero", types.GeoPoint{}, map[string]any{"lon": 0.0, "lat": 0.0}},
+		{"non-zero", types.GeoPoint{Lon: -10, Lat: 20.123}, map[string]any{"lon": -10.0, "lat": 20.123}},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			result := s.point.AsMap()
+
+			if len(result) != len(s.expected) {
+				t.Fatalf("Expected %d keys, got %d: %v", len(s.expected), len(result), result)
+			}
+
+			for k, v := range s.expected {
+				found, ok := result[k]
+				if !ok {
+					t.Fatalf("Missing expected %q key: %v", k, result)
+				}
+
+				if found != v {
+					t.Fatalf("Expected %q key value %v, got %v", k, v, found)
+				}
+			}
+		})
+	}
+}
+
+func TestGeoPointStringAndValue(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		name     string
+		point    types.GeoPoint
+		expected string
+	}{
+		{"zero", types.GeoPoint{}, `{"lon":0,"lat":0}`},
+		{"non-zero", types.GeoPoint{Lon: -10, Lat: 20.123}, `{"lon":-10,"lat":20.123}`},
+	}
+
+	for _, s := range scenarios {
+		t.Run(s.name, func(t *testing.T) {
+			str := s.point.String()
+
+			val, err := s.point.Value()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if str != val {
+				t.Fatalf("Expected String and Value to return the same value")
+			}
+
+			if str != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, str)
+			}
+		})
+	}
+}
+
+func TestGeoPointScan(t *testing.T) {
+	t.Parallel()
+
+	scenarios := []struct {
+		value     any
+		expectErr bool
+		expectStr string
+	}{
+		{nil, false, `{"lon":1,"lat":2}`},
+		{"", false, `{"lon":1,"lat":2}`},
+		{types.JSONRaw{}, false, `{"lon":1,"lat":2}`},
+		{[]byte{}, false, `{"lon":1,"lat":2}`},
+		{`{}`, false, `{"lon":1,"lat":2}`},
+		{`[]`, true, `{"lon":1,"lat":2}`},
+		{0, true, `{"lon":1,"lat":2}`},
+		{`{"lon":"1.23","lat":"4.56"}`, true, `{"lon":1,"lat":2}`},
+		{`{"lon":1.23,"lat":4.56}`, false, `{"lon":1.23,"lat":4.56}`},
+		{[]byte(`{"lon":1.23,"lat":4.56}`), false, `{"lon":1.23,"lat":4.56}`},
+		{types.JSONRaw(`{"lon":1.23,"lat":4.56}`), false, `{"lon":1.23,"lat":4.56}`},
+		{types.GeoPoint{}, false, `{"lon":0,"lat":0}`},
+		{types.GeoPoint{Lon: 1.23, Lat: 4.56}, false, `{"lon":1.23,"lat":4.56}`},
+		{&types.GeoPoint{Lon: 1.23, Lat: 4.56}, false, `{"lon":1.23,"lat":4.56}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			point := types.GeoPoint{Lon: 1, Lat: 2}
+
+			err := point.Scan(s.value)
+
+			hasErr := err != nil
+			if hasErr != s.expectErr {
+				t.Errorf("Expected hasErr %v, got %v (%v)", s.expectErr, hasErr, err)
+			}
+
+			if str := point.String(); str != s.expectStr {
+				t.Errorf("Expected\n%s\ngot\n%s", s.expectStr, str)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/types/json_array.go b/server/core_backend-server/tools/types/json_array.go
new file mode 100644
index 0000000..024fd7b
--- /dev/null
+++ b/server/core_backend-server/tools/types/json_array.go
@@ -0,0 +1,58 @@
+package types
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+)
+
+// JSONArray defines a slice that is safe for json and db read/write.
+type JSONArray[T any] []T
+
+// internal alias to prevent recursion during marshalization.
+type jsonArrayAlias[T any] JSONArray[T]
+
+// MarshalJSON implements the [json.Marshaler] interface.
+func (m JSONArray[T]) MarshalJSON() ([]byte, error) {
+	// initialize an empty map to ensure that `[]` is returned as json
+	if m == nil {
+		m = JSONArray[T]{}
+	}
+
+	return json.Marshal(jsonArrayAlias[T](m))
+}
+
+// String returns the string representation of the current json array.
+func (m JSONArray[T]) String() string {
+	v, _ := m.MarshalJSON()
+	return string(v)
+}
+
+// Value implements the [driver.Valuer] interface.
+func (m JSONArray[T]) Value() (driver.Value, error) {
+	data, err := json.Marshal(m)
+
+	return string(data), err
+}
+
+// Scan implements [sql.Scanner] interface to scan the provided value
+// into the current JSONArray[T] instance.
+func (m *JSONArray[T]) Scan(value any) error {
+	var data []byte
+	switch v := value.(type) {
+	case nil:
+		// no cast needed
+	case []byte:
+		data = v
+	case string:
+		data = []byte(v)
+	default:
+		return fmt.Errorf("failed to unmarshal JSONArray value: %q", value)
+	}
+
+	if len(data) == 0 {
+		data = []byte("[]")
+	}
+
+	return json.Unmarshal(data, m)
+}
diff --git a/server/core_backend-server/tools/types/json_array_test.go b/server/core_backend-server/tools/types/json_array_test.go
new file mode 100644
index 0000000..27aa16f
--- /dev/null
+++ b/server/core_backend-server/tools/types/json_array_test.go
@@ -0,0 +1,124 @@
+package types_test
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestJSONArrayMarshalJSON(t *testing.T) {
+	scenarios := []struct {
+		json     json.Marshaler
+		expected string
+	}{
+		{new(types.JSONArray[any]), "[]"},
+		{types.JSONArray[any]{}, `[]`},
+		{types.JSONArray[int]{1, 2, 3}, `[1,2,3]`},
+		{types.JSONArray[string]{"test1", "test2", "test3"}, `["test1","test2","test3"]`},
+		{types.JSONArray[any]{1, "test"}, `[1,"test"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.expected), func(t *testing.T) {
+			result, err := s.json.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(result) != s.expected {
+				t.Fatalf("Expected %s, got %s", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONArrayString(t *testing.T) {
+	scenarios := []struct {
+		json     fmt.Stringer
+		expected string
+	}{
+		{new(types.JSONArray[any]), "[]"},
+		{types.JSONArray[any]{}, `[]`},
+		{types.JSONArray[int]{1, 2, 3}, `[1,2,3]`},
+		{types.JSONArray[string]{"test1", "test2", "test3"}, `["test1","test2","test3"]`},
+		{types.JSONArray[any]{1, "test"}, `[1,"test"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.expected), func(t *testing.T) {
+			result := s.json.String()
+
+			if result != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONArrayValue(t *testing.T) {
+	scenarios := []struct {
+		json     driver.Valuer
+		expected driver.Value
+	}{
+		{new(types.JSONArray[any]), `[]`},
+		{types.JSONArray[any]{}, `[]`},
+		{types.JSONArray[int]{1, 2, 3}, `[1,2,3]`},
+		{types.JSONArray[string]{"test1", "test2", "test3"}, `["test1","test2","test3"]`},
+		{types.JSONArray[any]{1, "test"}, `[1,"test"]`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.expected), func(t *testing.T) {
+			result, err := s.json.Value()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if result != s.expected {
+				t.Fatalf("Expected %s, got %#v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONArrayScan(t *testing.T) {
+	scenarios := []struct {
+		value       any
+		expectError bool
+		expectJSON  string
+	}{
+		{``, false, `[]`},
+		{[]byte{}, false, `[]`},
+		{nil, false, `[]`},
+		{123, true, `[]`},
+		{`""`, true, `[]`},
+		{`invalid_json`, true, `[]`},
+		{`"test"`, true, `[]`},
+		{`1,2,3`, true, `[]`},
+		{`[1, 2, 3`, true, `[]`},
+		{`[1, 2, 3]`, false, `[1,2,3]`},
+		{[]byte(`[1, 2, 3]`), false, `[1,2,3]`},
+		{`[1, "test"]`, false, `[1,"test"]`},
+		{`[]`, false, `[]`},
+	}
+
+	for i, s := range scenarios {
+		arr := types.JSONArray[any]{}
+		scanErr := arr.Scan(s.value)
+
+		hasErr := scanErr != nil
+		if hasErr != s.expectError {
+			t.Errorf("(%d) Expected %v, got %v (%v)", i, s.expectError, hasErr, scanErr)
+			continue
+		}
+
+		result, _ := arr.MarshalJSON()
+
+		if string(result) != s.expectJSON {
+			t.Errorf("(%d) Expected %s, got %v", i, s.expectJSON, string(result))
+		}
+	}
+}
diff --git a/server/core_backend-server/tools/types/json_map.go b/server/core_backend-server/tools/types/json_map.go
new file mode 100644
index 0000000..87b0fc8
--- /dev/null
+++ b/server/core_backend-server/tools/types/json_map.go
@@ -0,0 +1,73 @@
+package types
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+)
+
+// JSONMap defines a map that is safe for json and db read/write.
+type JSONMap[T any] map[string]T
+
+// MarshalJSON implements the [json.Marshaler] interface.
+func (m JSONMap[T]) MarshalJSON() ([]byte, error) {
+	type alias JSONMap[T] // prevent recursion
+
+	// initialize an empty map to ensure that `{}` is returned as json
+	if m == nil {
+		m = JSONMap[T]{}
+	}
+
+	return json.Marshal(alias(m))
+}
+
+// String returns the string representation of the current json map.
+func (m JSONMap[T]) String() string {
+	v, _ := m.MarshalJSON()
+	return string(v)
+}
+
+// Get retrieves a single value from the current JSONMap[T].
+//
+// This helper was added primarily to assist the goja integration since custom map types
+// don't have direct access to the map keys (https://pkg.go.dev/github.com/dop251/goja#hdr-Maps_with_methods).
+func (m JSONMap[T]) Get(key string) T {
+	return m[key]
+}
+
+// Set sets a single value in the current JSONMap[T].
+//
+// This helper was added primarily to assist the goja integration since custom map types
+// don't have direct access to the map keys (https://pkg.go.dev/github.com/dop251/goja#hdr-Maps_with_methods).
+func (m JSONMap[T]) Set(key string, value T) {
+	m[key] = value
+}
+
+// Value implements the [driver.Valuer] interface.
+func (m JSONMap[T]) Value() (driver.Value, error) {
+	data, err := json.Marshal(m)
+
+	return string(data), err
+}
+
+// Scan implements [sql.Scanner] interface to scan the provided value
+// into the current JSONMap[T] instance.
+func (m *JSONMap[T]) Scan(value any) error {
+	var data []byte
+	switch v := value.(type) {
+	case nil:
+		// no cast needed
+	case []byte:
+		data = v
+	case string:
+		data = []byte(v)
+	default:
+		return fmt.Errorf("failed to unmarshal JSONMap[T] value: %q", value)
+	}
+
+	if len(data) == 0 {
+		data = []byte("{}")
+	}
+
+	return json.Unmarshal(data, m)
+}
diff --git a/server/core_backend-server/tools/types/json_map_test.go b/server/core_backend-server/tools/types/json_map_test.go
new file mode 100644
index 0000000..56ea95a
--- /dev/null
+++ b/server/core_backend-server/tools/types/json_map_test.go
@@ -0,0 +1,164 @@
+package types_test
+
+import (
+	"database/sql/driver"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestJSONMapMarshalJSON(t *testing.T) {
+	scenarios := []struct {
+		json     types.JSONMap[any]
+		expected string
+	}{
+		{nil, "{}"},
+		{types.JSONMap[any]{}, `{}`},
+		{types.JSONMap[any]{"test1": 123, "test2": "lorem"}, `{"test1":123,"test2":"lorem"}`},
+		{types.JSONMap[any]{"test": []int{1, 2, 3}}, `{"test":[1,2,3]}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.expected), func(t *testing.T) {
+			result, err := s.json.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(result) != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONMapMarshalString(t *testing.T) {
+	scenarios := []struct {
+		json     types.JSONMap[any]
+		expected string
+	}{
+		{nil, "{}"},
+		{types.JSONMap[any]{}, `{}`},
+		{types.JSONMap[any]{"test1": 123, "test2": "lorem"}, `{"test1":123,"test2":"lorem"}`},
+		{types.JSONMap[any]{"test": []int{1, 2, 3}}, `{"test":[1,2,3]}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.expected), func(t *testing.T) {
+			result := s.json.String()
+
+			if result != s.expected {
+				t.Fatalf("Expected\n%s\ngot\n%s", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONMapGet(t *testing.T) {
+	scenarios := []struct {
+		json     types.JSONMap[any]
+		key      string
+		expected any
+	}{
+		{nil, "test", nil},
+		{types.JSONMap[any]{"test": 123}, "test", 123},
+		{types.JSONMap[any]{"test": 123}, "missing", nil},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.key), func(t *testing.T) {
+			result := s.json.Get(s.key)
+			if result != s.expected {
+				t.Fatalf("Expected %s, got %#v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONMapSet(t *testing.T) {
+	scenarios := []struct {
+		key   string
+		value any
+	}{
+		{"a", nil},
+		{"a", 123},
+		{"b", "test"},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.key), func(t *testing.T) {
+			j := types.JSONMap[any]{}
+
+			j.Set(s.key, s.value)
+
+			if v := j[s.key]; v != s.value {
+				t.Fatalf("Expected %s, got %#v", s.value, v)
+			}
+		})
+	}
+}
+
+func TestJSONMapValue(t *testing.T) {
+	scenarios := []struct {
+		json     types.JSONMap[any]
+		expected driver.Value
+	}{
+		{nil, `{}`},
+		{types.JSONMap[any]{}, `{}`},
+		{types.JSONMap[any]{"test1": 123, "test2": "lorem"}, `{"test1":123,"test2":"lorem"}`},
+		{types.JSONMap[any]{"test": []int{1, 2, 3}}, `{"test":[1,2,3]}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.expected), func(t *testing.T) {
+			result, err := s.json.Value()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if result != s.expected {
+				t.Fatalf("Expected %s, got %#v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONArrayMapScan(t *testing.T) {
+	scenarios := []struct {
+		value       any
+		expectError bool
+		expectJSON  string
+	}{
+		{``, false, `{}`},
+		{nil, false, `{}`},
+		{[]byte{}, false, `{}`},
+		{`{}`, false, `{}`},
+		{123, true, `{}`},
+		{`""`, true, `{}`},
+		{`invalid_json`, true, `{}`},
+		{`"test"`, true, `{}`},
+		{`1,2,3`, true, `{}`},
+		{`{"test": 1`, true, `{}`},
+		{`{"test": 1}`, false, `{"test":1}`},
+		{[]byte(`{"test": 1}`), false, `{"test":1}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			arr := types.JSONMap[any]{}
+			scanErr := arr.Scan(s.value)
+
+			hasErr := scanErr != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected %v, got %v (%v)", s.expectError, hasErr, scanErr)
+			}
+
+			result, _ := arr.MarshalJSON()
+
+			if string(result) != s.expectJSON {
+				t.Fatalf("Expected %s, got %s", s.expectJSON, result)
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/types/json_raw.go b/server/core_backend-server/tools/types/json_raw.go
new file mode 100644
index 0000000..8ed58c2
--- /dev/null
+++ b/server/core_backend-server/tools/types/json_raw.go
@@ -0,0 +1,84 @@
+package types
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"errors"
+)
+
+// JSONRaw defines a json value type that is safe for db read/write.
+type JSONRaw []byte
+
+// ParseJSONRaw creates a new JSONRaw instance from the provided value
+// (could be JSONRaw, int, float, string, []byte, etc.).
+func ParseJSONRaw(value any) (JSONRaw, error) {
+	result := JSONRaw{}
+	err := result.Scan(value)
+	return result, err
+}
+
+// String returns the current JSONRaw instance as a json encoded string.
+func (j JSONRaw) String() string {
+	raw, _ := j.MarshalJSON()
+	return string(raw)
+}
+
+// MarshalJSON implements the [json.Marshaler] interface.
+func (j JSONRaw) MarshalJSON() ([]byte, error) {
+	if len(j) == 0 {
+		return []byte("null"), nil
+	}
+
+	return j, nil
+}
+
+// UnmarshalJSON implements the [json.Unmarshaler] interface.
+func (j *JSONRaw) UnmarshalJSON(b []byte) error {
+	if j == nil {
+		return errors.New("JSONRaw: UnmarshalJSON on nil pointer")
+	}
+
+	*j = append((*j)[0:0], b...)
+
+	return nil
+}
+
+// Value implements the [driver.Valuer] interface.
+func (j JSONRaw) Value() (driver.Value, error) {
+	if len(j) == 0 {
+		return nil, nil
+	}
+
+	return j.String(), nil
+}
+
+// Scan implements [sql.Scanner] interface to scan the provided value
+// into the current JSONRaw instance.
+func (j *JSONRaw) Scan(value any) error {
+	var data []byte
+
+	switch v := value.(type) {
+	case nil:
+		// no cast is needed
+	case []byte:
+		if len(v) != 0 {
+			data = v
+		}
+	case string:
+		if v != "" {
+			data = []byte(v)
+		}
+	case JSONRaw:
+		if len(v) != 0 {
+			data = []byte(v)
+		}
+	default:
+		bytes, err := json.Marshal(v)
+		if err != nil {
+			return err
+		}
+		data = bytes
+	}
+
+	return j.UnmarshalJSON(data)
+}
diff --git a/server/core_backend-server/tools/types/json_raw_test.go b/server/core_backend-server/tools/types/json_raw_test.go
new file mode 100644
index 0000000..31c8eb2
--- /dev/null
+++ b/server/core_backend-server/tools/types/json_raw_test.go
@@ -0,0 +1,189 @@
+package types_test
+
+import (
+	"database/sql/driver"
+	"fmt"
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestParseJSONRaw(t *testing.T) {
+	scenarios := []struct {
+		value       any
+		expectError bool
+		expectJSON  string
+	}{
+		{nil, false, `null`},
+		{``, false, `null`},
+		{[]byte{}, false, `null`},
+		{types.JSONRaw{}, false, `null`},
+		{`{}`, false, `{}`},
+		{`[]`, false, `[]`},
+		{123, false, `123`},
+		{`""`, false, `""`},
+		{`test`, false, `test`},
+		{`{"invalid"`, false, `{"invalid"`}, // treated as a byte casted string
+		{`{"test":1}`, false, `{"test":1}`},
+		{[]byte(`[1,2,3]`), false, `[1,2,3]`},
+		{[]int{1, 2, 3}, false, `[1,2,3]`},
+		{map[string]int{"test": 1}, false, `{"test":1}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			raw, parseErr := types.ParseJSONRaw(s.value)
+
+			hasErr := parseErr != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected %v, got %v (%v)", s.expectError, hasErr, parseErr)
+			}
+
+			result, _ := raw.MarshalJSON()
+
+			if string(result) != s.expectJSON {
+				t.Fatalf("Expected %s, got %s", s.expectJSON, string(result))
+			}
+		})
+	}
+}
+
+func TestJSONRawString(t *testing.T) {
+	scenarios := []struct {
+		json     types.JSONRaw
+		expected string
+	}{
+		{nil, `null`},
+		{types.JSONRaw{}, `null`},
+		{types.JSONRaw([]byte(`123`)), `123`},
+		{types.JSONRaw(`{"demo":123}`), `{"demo":123}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.expected), func(t *testing.T) {
+			result := s.json.String()
+			if result != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONRawMarshalJSON(t *testing.T) {
+	scenarios := []struct {
+		json     types.JSONRaw
+		expected string
+	}{
+		{nil, `null`},
+		{types.JSONRaw{}, `null`},
+		{types.JSONRaw([]byte(`123`)), `123`},
+		{types.JSONRaw(`{"demo":123}`), `{"demo":123}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.expected), func(t *testing.T) {
+			result, err := s.json.MarshalJSON()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if string(result) != s.expected {
+				t.Fatalf("Expected %q, got %q", s.expected, string(result))
+			}
+		})
+	}
+}
+
+func TestJSONRawUnmarshalJSON(t *testing.T) {
+	scenarios := []struct {
+		json         []byte
+		expectString string
+	}{
+		{nil, `null`},
+		{[]byte{0, 1, 2}, "\x00\x01\x02"},
+		{[]byte("123"), "123"},
+		{[]byte("test"), "test"},
+		{[]byte(`{"test":123}`), `{"test":123}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%s", i, s.expectString), func(t *testing.T) {
+			raw := types.JSONRaw{}
+
+			err := raw.UnmarshalJSON(s.json)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if raw.String() != s.expectString {
+				t.Fatalf("Expected %q, got %q", s.expectString, raw.String())
+			}
+		})
+	}
+}
+
+func TestJSONRawValue(t *testing.T) {
+	scenarios := []struct {
+		json     types.JSONRaw
+		expected driver.Value
+	}{
+		{nil, nil},
+		{types.JSONRaw{}, nil},
+		{types.JSONRaw(``), nil},
+		{types.JSONRaw(`test`), `test`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.json), func(t *testing.T) {
+			result, err := s.json.Value()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if result != s.expected {
+				t.Fatalf("Expected %s, got %v", s.expected, result)
+			}
+		})
+	}
+}
+
+func TestJSONRawScan(t *testing.T) {
+	scenarios := []struct {
+		value       any
+		expectError bool
+		expectJSON  string
+	}{
+		{nil, false, `null`},
+		{``, false, `null`},
+		{[]byte{}, false, `null`},
+		{types.JSONRaw{}, false, `null`},
+		{types.JSONRaw(`test`), false, `test`},
+		{`{}`, false, `{}`},
+		{`[]`, false, `[]`},
+		{123, false, `123`},
+		{`""`, false, `""`},
+		{`test`, false, `test`},
+		{`{"invalid"`, false, `{"invalid"`}, // treated as a byte casted string
+		{`{"test":1}`, false, `{"test":1}`},
+		{[]byte(`[1,2,3]`), false, `[1,2,3]`},
+		{[]int{1, 2, 3}, false, `[1,2,3]`},
+		{map[string]int{"test": 1}, false, `{"test":1}`},
+	}
+
+	for i, s := range scenarios {
+		t.Run(fmt.Sprintf("%d_%#v", i, s.value), func(t *testing.T) {
+			raw := types.JSONRaw{}
+			scanErr := raw.Scan(s.value)
+			hasErr := scanErr != nil
+			if hasErr != s.expectError {
+				t.Fatalf("Expected %v, got %v (%v)", s.expectError, hasErr, scanErr)
+			}
+
+			result, _ := raw.MarshalJSON()
+
+			if string(result) != s.expectJSON {
+				t.Fatalf("Expected %s, got %v", s.expectJSON, string(result))
+			}
+		})
+	}
+}
diff --git a/server/core_backend-server/tools/types/types.go b/server/core_backend-server/tools/types/types.go
new file mode 100644
index 0000000..c07d805
--- /dev/null
+++ b/server/core_backend-server/tools/types/types.go
@@ -0,0 +1,8 @@
+// Package types implements some commonly used db serializable types
+// like datetime, json, etc.
+package types
+
+// Pointer is a generic helper that returns val as *T.
+func Pointer[T any](val T) *T {
+	return &val
+}
diff --git a/server/core_backend-server/tools/types/types_test.go b/server/core_backend-server/tools/types/types_test.go
new file mode 100644
index 0000000..615ac4c
--- /dev/null
+++ b/server/core_backend-server/tools/types/types_test.go
@@ -0,0 +1,24 @@
+package types_test
+
+import (
+	"testing"
+
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+func TestPointer(t *testing.T) {
+	s1 := types.Pointer("")
+	if s1 == nil || *s1 != "" {
+		t.Fatalf("Expected empty string pointer, got %#v", s1)
+	}
+
+	s2 := types.Pointer("test")
+	if s2 == nil || *s2 != "test" {
+		t.Fatalf("Expected 'test' string pointer, got %#v", s2)
+	}
+
+	s3 := types.Pointer(123)
+	if s3 == nil || *s3 != 123 {
+		t.Fatalf("Expected 123 string pointer, got %#v", s3)
+	}
+}
diff --git a/server/pb_migrations/1746786764_updated_services.js b/server/pb_migrations/1746786764_updated_services.js
new file mode 100644
index 0000000..93d25d2
--- /dev/null
+++ b/server/pb_migrations/1746786764_updated_services.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": null,
+    "deleteRule": null,
+    "listRule": null,
+    "updateRule": null,
+    "viewRule": null
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1746786820_updated_services.js b/server/pb_migrations/1746786820_updated_services.js
new file mode 100644
index 0000000..966c93f
--- /dev/null
+++ b/server/pb_migrations/1746786820_updated_services.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": "id = @request.auth.id",
+    "deleteRule": "id = @request.auth.id",
+    "listRule": "id = @request.auth.id",
+    "updateRule": "id = @request.auth.id",
+    "viewRule": "id = @request.auth.id"
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": null,
+    "deleteRule": null,
+    "listRule": null,
+    "updateRule": null,
+    "viewRule": null
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1746786864_updated_services.js b/server/pb_migrations/1746786864_updated_services.js
new file mode 100644
index 0000000..187b077
--- /dev/null
+++ b/server/pb_migrations/1746786864_updated_services.js
@@ -0,0 +1,20 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "listRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "listRule": "id = @request.auth.id"
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1746787173_updated_services.js b/server/pb_migrations/1746787173_updated_services.js
new file mode 100644
index 0000000..abdef5b
--- /dev/null
+++ b/server/pb_migrations/1746787173_updated_services.js
@@ -0,0 +1,26 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": "id = @request.auth.id",
+    "deleteRule": "id = @request.auth.id",
+    "updateRule": "id = @request.auth.id",
+    "viewRule": "id = @request.auth.id"
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1746787500_updated_services.js b/server/pb_migrations/1746787500_updated_services.js
new file mode 100644
index 0000000..19ab1c4
--- /dev/null
+++ b/server/pb_migrations/1746787500_updated_services.js
@@ -0,0 +1,20 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "listRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "listRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1746787517_updated_services.js b/server/pb_migrations/1746787517_updated_services.js
new file mode 100644
index 0000000..2679b11
--- /dev/null
+++ b/server/pb_migrations/1746787517_updated_services.js
@@ -0,0 +1,26 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1746787595_updated_uptime_data.js b/server/pb_migrations/1746787595_updated_uptime_data.js
new file mode 100644
index 0000000..882c962
--- /dev/null
+++ b/server/pb_migrations/1746787595_updated_uptime_data.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_67962705")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_67962705")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1746787681_updated_alert_configurations.js b/server/pb_migrations/1746787681_updated_alert_configurations.js
new file mode 100644
index 0000000..a6f9db0
--- /dev/null
+++ b/server/pb_migrations/1746787681_updated_alert_configurations.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1748029497_updated__superusers.js b/server/pb_migrations/1748029497_updated__superusers.js
new file mode 100644
index 0000000..03d617f
--- /dev/null
+++ b/server/pb_migrations/1748029497_updated__superusers.js
@@ -0,0 +1,67 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3142635823")
+
+  // add field
+  collection.fields.addAt(6, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text3687080900",
+    "max": 0,
+    "min": 0,
+    "name": "full_name",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // add field
+  collection.fields.addAt(7, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text4166911607",
+    "max": 0,
+    "min": 0,
+    "name": "username",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // add field
+  collection.fields.addAt(8, new Field({
+    "hidden": false,
+    "id": "select2063623452",
+    "maxSelect": 1,
+    "name": "status",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "select",
+    "values": [
+      "active",
+      "inactive"
+    ]
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3142635823")
+
+  // remove field
+  collection.fields.removeById("text3687080900")
+
+  // remove field
+  collection.fields.removeById("text4166911607")
+
+  // remove field
+  collection.fields.removeById("select2063623452")
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1750241370_updated_ping_data.js b/server/pb_migrations/1750241370_updated_ping_data.js
new file mode 100644
index 0000000..f197b25
--- /dev/null
+++ b/server/pb_migrations/1750241370_updated_ping_data.js
@@ -0,0 +1,61 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1168766540")
+
+  // remove field
+  collection.fields.removeById("text1404634243")
+
+  // update field
+  collection.fields.addAt(15, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text258142582",
+    "max": 0,
+    "min": 0,
+    "name": "region_name",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1168766540")
+
+  // add field
+  collection.fields.addAt(17, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text1404634243",
+    "max": 0,
+    "min": 0,
+    "name": "agent_ip_address",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // update field
+  collection.fields.addAt(15, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text258142582",
+    "max": 0,
+    "min": 0,
+    "name": "region",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1750241407_updated_regional_service.js b/server/pb_migrations/1750241407_updated_regional_service.js
new file mode 100644
index 0000000..84a577c
--- /dev/null
+++ b/server/pb_migrations/1750241407_updated_regional_service.js
@@ -0,0 +1,42 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_171698555")
+
+  // update field
+  collection.fields.addAt(1, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text258142582",
+    "max": 0,
+    "min": 0,
+    "name": "region_name",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_171698555")
+
+  // update field
+  collection.fields.addAt(1, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text258142582",
+    "max": 0,
+    "min": 0,
+    "name": "region",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1750414552_deleted_server_processes.js b/server/pb_migrations/1750414552_deleted_server_processes.js
new file mode 100644
index 0000000..79af47c
--- /dev/null
+++ b/server/pb_migrations/1750414552_deleted_server_processes.js
@@ -0,0 +1,144 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  try {
+    const collection = app.findCollectionByNameOrId("pbc_2018671343");
+    return app.delete(collection);
+  } catch (e) {
+    console.warn("Skip delete (server_processes):", e?.message);
+  }
+}, (app) => {
+  try {
+    const collection = new Collection({
+      "createRule": "",
+      "deleteRule": "",
+      "fields": [
+        {
+          "autogeneratePattern": "[a-z0-9]{15}",
+          "hidden": false,
+          "id": "text3208210256",
+          "max": 15,
+          "min": 15,
+          "name": "id",
+          "pattern": "^[a-z0-9]+$",
+          "presentable": false,
+          "primaryKey": true,
+          "required": true,
+          "system": true,
+          "type": "text"
+        },
+        {
+          "autogeneratePattern": "",
+          "hidden": false,
+          "id": "text407168695",
+          "max": 0,
+          "min": 0,
+          "name": "server_id",
+          "pattern": "",
+          "presentable": false,
+          "primaryKey": false,
+          "required": false,
+          "system": false,
+          "type": "text"
+        },
+        {
+          "autogeneratePattern": "",
+          "hidden": false,
+          "id": "text1431356653",
+          "max": 0,
+          "min": 0,
+          "name": "pid",
+          "pattern": "",
+          "presentable": false,
+          "primaryKey": false,
+          "required": false,
+          "system": false,
+          "type": "text"
+        },
+        {
+          "autogeneratePattern": "",
+          "hidden": false,
+          "id": "text1579384326",
+          "max": 0,
+          "min": 0,
+          "name": "name",
+          "pattern": "",
+          "presentable": false,
+          "primaryKey": false,
+          "required": false,
+          "system": false,
+          "type": "text"
+        },
+        {
+          "hidden": false,
+          "id": "number1391558374",
+          "max": null,
+          "min": null,
+          "name": "memory_percent",
+          "onlyInt": false,
+          "presentable": false,
+          "required": false,
+          "system": false,
+          "type": "number"
+        },
+        {
+          "hidden": false,
+          "id": "number2651913466",
+          "max": null,
+          "min": null,
+          "name": "cpu_percent",
+          "onlyInt": false,
+          "presentable": false,
+          "required": false,
+          "system": false,
+          "type": "number"
+        },
+        {
+          "autogeneratePattern": "",
+          "hidden": false,
+          "id": "text2063623452",
+          "max": 0,
+          "min": 0,
+          "name": "status",
+          "pattern": "",
+          "presentable": false,
+          "primaryKey": false,
+          "required": false,
+          "system": false,
+          "type": "text"
+        },
+        {
+          "hidden": false,
+          "id": "autodate2990389176",
+          "name": "created",
+          "onCreate": true,
+          "onUpdate": false,
+          "presentable": false,
+          "system": false,
+          "type": "autodate"
+        },
+        {
+          "hidden": false,
+          "id": "autodate3332085495",
+          "name": "updated",
+          "onCreate": true,
+          "onUpdate": true,
+          "presentable": false,
+          "system": false,
+          "type": "autodate"
+        }
+      ],
+      "id": "pbc_2018671343",
+      "indexes": [],
+      "listRule": "",
+      "name": "server_processes",
+      "system": false,
+      "type": "base",
+      "updateRule": "",
+      "viewRule": ""
+    });
+
+    return app.save(collection);
+  } catch (e) {
+    console.warn("Skip rollback (server_processes):", e?.message);
+  }
+});
diff --git a/server/pb_migrations/1750414561_deleted_server_notifications.js b/server/pb_migrations/1750414561_deleted_server_notifications.js
new file mode 100644
index 0000000..aa7c6c9
--- /dev/null
+++ b/server/pb_migrations/1750414561_deleted_server_notifications.js
@@ -0,0 +1,178 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+
+  try {
+    const collection = app.findCollectionByNameOrId("pbc_3414192583");
+    return app.delete(collection);
+  } catch (e) {
+    console.warn("Skip delete (server_notifications):", e?.message);
+  }
+}, (app) => {
+  try {
+    const collection = new Collection({
+      "createRule": "",
+      "deleteRule": "",
+      "fields": [
+        {
+          "autogeneratePattern": "[a-z0-9]{15}",
+          "hidden": false,
+          "id": "text3208210256",
+          "max": 15,
+          "min": 15,
+          "name": "id",
+          "pattern": "^[a-z0-9]+$",
+          "presentable": false,
+          "primaryKey": true,
+          "required": true,
+          "system": true,
+          "type": "text"
+        },
+        {
+          "autogeneratePattern": "",
+          "hidden": false,
+          "id": "text407168695",
+          "max": 0,
+          "min": 0,
+          "name": "server_id",
+          "pattern": "",
+          "presentable": false,
+          "primaryKey": false,
+          "required": false,
+          "system": false,
+          "type": "text"
+        },
+        {
+          "autogeneratePattern": "",
+          "hidden": false,
+          "id": "text3065852031",
+          "max": 0,
+          "min": 0,
+          "name": "message",
+          "pattern": "",
+          "presentable": false,
+          "primaryKey": false,
+          "required": false,
+          "system": false,
+          "type": "text"
+        },
+        {
+          "autogeneratePattern": "",
+          "hidden": false,
+          "id": "text887233555",
+          "max": 0,
+          "min": 0,
+          "name": "notification_type",
+          "pattern": "",
+          "presentable": false,
+          "primaryKey": false,
+          "required": false,
+          "system": false,
+          "type": "text"
+        },
+        {
+          "hidden": false,
+          "id": "date3805952114",
+          "max": "",
+          "min": "",
+          "name": "read_at",
+          "presentable": false,
+          "required": false,
+          "system": false,
+          "type": "date"
+        },
+        {
+          "hidden": false,
+          "id": "number1377725610",
+          "max": null,
+          "min": null,
+          "name": "cpu_threshold",
+          "onlyInt": false,
+          "presentable": false,
+          "required": false,
+          "system": false,
+          "type": "number"
+        },
+        {
+          "hidden": false,
+          "id": "number3087505384",
+          "max": null,
+          "min": null,
+          "name": "ram_threshold",
+          "onlyInt": false,
+          "presentable": false,
+          "required": false,
+          "system": false,
+          "type": "number"
+        },
+        {
+          "hidden": false,
+          "id": "number2833320134",
+          "max": null,
+          "min": null,
+          "name": "disk_threshold",
+          "onlyInt": false,
+          "presentable": false,
+          "required": false,
+          "system": false,
+          "type": "number"
+        },
+        {
+          "hidden": false,
+          "id": "number1826572927",
+          "max": null,
+          "min": null,
+          "name": "network_threshold",
+          "onlyInt": false,
+          "presentable": false,
+          "required": false,
+          "system": false,
+          "type": "number"
+        },
+        {
+          "hidden": false,
+          "id": "number2184331740",
+          "max": null,
+          "min": null,
+          "name": "notification_config_id",
+          "onlyInt": false,
+          "presentable": false,
+          "required": false,
+          "system": false,
+          "type": "number"
+        },
+        {
+          "hidden": false,
+          "id": "autodate2990389176",
+          "name": "created",
+          "onCreate": true,
+          "onUpdate": false,
+          "presentable": false,
+          "system": false,
+          "type": "autodate"
+        },
+        {
+          "hidden": false,
+          "id": "autodate3332085495",
+          "name": "updated",
+          "onCreate": true,
+          "onUpdate": true,
+          "presentable": false,
+          "system": false,
+          "type": "autodate"
+        }
+      ],
+      "id": "pbc_3414192583",
+      "indexes": [],
+      "listRule": "",
+      "name": "server_notifications",
+      "system": false,
+      "type": "base",
+      "updateRule": "",
+      "viewRule": ""
+    });
+
+    return app.save(collection);
+  } catch (e) {
+    console.warn("Skip rollback (server_notifications):", e?.message);
+  }
+});
diff --git a/server/pb_migrations/1750502263_updated_regional_service.js b/server/pb_migrations/1750502263_updated_regional_service.js
new file mode 100644
index 0000000..230a6ea
--- /dev/null
+++ b/server/pb_migrations/1750502263_updated_regional_service.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_171698555")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_171698555")
+
+  // update collection data
+  unmarshal({
+    "createRule": null,
+    "deleteRule": null,
+    "listRule": null,
+    "updateRule": null,
+    "viewRule": null
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1752916282_updated_webhook_configs.js b/server/pb_migrations/1752916282_updated_webhook_configs.js
new file mode 100644
index 0000000..79f94a7
--- /dev/null
+++ b/server/pb_migrations/1752916282_updated_webhook_configs.js
@@ -0,0 +1,125 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_45665081")
+
+  // remove field
+  collection.fields.removeById("select4246785570")
+
+  // add field
+  collection.fields.addAt(9, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text1579384326",
+    "max": 0,
+    "min": 0,
+    "name": "name",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // add field
+  collection.fields.addAt(10, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text1582905952",
+    "max": 0,
+    "min": 0,
+    "name": "method",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // add field
+  collection.fields.addAt(11, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text1414600993",
+    "max": 0,
+    "min": 0,
+    "name": "payload_template",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // update field
+  collection.fields.addAt(7, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text2168550802",
+    "max": 0,
+    "min": 0,
+    "name": "trigger_events",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_45665081")
+
+  // add field
+  collection.fields.addAt(4, new Field({
+    "hidden": false,
+    "id": "select4246785570",
+    "maxSelect": 1,
+    "name": "event_filters",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "select",
+    "values": [
+      "down",
+      "up",
+      "ssl_expired",
+      "warning",
+      "ssl_ok",
+      "high_cpu",
+      "high_memory",
+      "agent_offline",
+      "custom_alert"
+    ]
+  }))
+
+  // remove field
+  collection.fields.removeById("text1579384326")
+
+  // remove field
+  collection.fields.removeById("text1582905952")
+
+  // remove field
+  collection.fields.removeById("text1414600993")
+
+  // update field
+  collection.fields.addAt(8, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text2168550802",
+    "max": 0,
+    "min": 0,
+    "name": "timeout",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1752921327_updated_alert_configurations.js b/server/pb_migrations/1752921327_updated_alert_configurations.js
new file mode 100644
index 0000000..728ff90
--- /dev/null
+++ b/server/pb_migrations/1752921327_updated_alert_configurations.js
@@ -0,0 +1,42 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update field
+  collection.fields.addAt(10, new Field({
+    "hidden": false,
+    "id": "select1358543748",
+    "maxSelect": 1,
+    "name": "status",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "select",
+    "values": [
+      "disabled",
+      "enabled"
+    ]
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update field
+  collection.fields.addAt(10, new Field({
+    "hidden": false,
+    "id": "select1358543748",
+    "maxSelect": 1,
+    "name": "enabled",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "select",
+    "values": [
+      "true",
+      "false"
+    ]
+  }))
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1752921397_updated_alert_configurations.js b/server/pb_migrations/1752921397_updated_alert_configurations.js
new file mode 100644
index 0000000..fad5689
--- /dev/null
+++ b/server/pb_migrations/1752921397_updated_alert_configurations.js
@@ -0,0 +1,29 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // add field
+  collection.fields.addAt(14, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text1553704459",
+    "max": 0,
+    "min": 0,
+    "name": "webhook_id",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // remove field
+  collection.fields.removeById("text1553704459")
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1753085447_updated_server_metrics.js b/server/pb_migrations/1753085447_updated_server_metrics.js
new file mode 100644
index 0000000..c0ecf6c
--- /dev/null
+++ b/server/pb_migrations/1753085447_updated_server_metrics.js
@@ -0,0 +1,29 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1998570700")
+
+  // add field
+  collection.fields.addAt(19, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text3065852031",
+    "max": 0,
+    "min": 0,
+    "name": "message",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1998570700")
+
+  // remove field
+  collection.fields.removeById("text3065852031")
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1753102275_updated_server_metrics.js b/server/pb_migrations/1753102275_updated_server_metrics.js
new file mode 100644
index 0000000..acce145
--- /dev/null
+++ b/server/pb_migrations/1753102275_updated_server_metrics.js
@@ -0,0 +1,61 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1998570700")
+
+  // add field
+  collection.fields.addAt(20, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text772177811",
+    "max": 0,
+    "min": 0,
+    "name": "detail",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // update field
+  collection.fields.addAt(19, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text3065852031",
+    "max": 0,
+    "min": 0,
+    "name": "error_message",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1998570700")
+
+  // remove field
+  collection.fields.removeById("text772177811")
+
+  // update field
+  collection.fields.addAt(19, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text3065852031",
+    "max": 0,
+    "min": 0,
+    "name": "message",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1753102296_updated_server_metrics.js b/server/pb_migrations/1753102296_updated_server_metrics.js
new file mode 100644
index 0000000..262830d
--- /dev/null
+++ b/server/pb_migrations/1753102296_updated_server_metrics.js
@@ -0,0 +1,42 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1998570700")
+
+  // update field
+  collection.fields.addAt(20, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text772177811",
+    "max": 0,
+    "min": 0,
+    "name": "details",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1998570700")
+
+  // update field
+  collection.fields.addAt(20, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text772177811",
+    "max": 0,
+    "min": 0,
+    "name": "detail",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1755250344_updated_alert_configurations.js b/server/pb_migrations/1755250344_updated_alert_configurations.js
new file mode 100644
index 0000000..9f38333
--- /dev/null
+++ b/server/pb_migrations/1755250344_updated_alert_configurations.js
@@ -0,0 +1,72 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // add field
+  collection.fields.addAt(20, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text1654359675",
+    "max": 0,
+    "min": 0,
+    "name": "ntfy_endpoint",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // update field
+  collection.fields.addAt(9, new Field({
+    "hidden": false,
+    "id": "select887233555",
+    "maxSelect": 1,
+    "name": "notification_type",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "select",
+    "values": [
+      "telegram",
+      "signal",
+      "discord",
+      "slack",
+      "webhook",
+      "google_chat",
+      "email",
+      "ntfy"
+    ]
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // remove field
+  collection.fields.removeById("text1654359675")
+
+  // update field
+  collection.fields.addAt(9, new Field({
+    "hidden": false,
+    "id": "select887233555",
+    "maxSelect": 1,
+    "name": "notification_type",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "select",
+    "values": [
+      "telegram",
+      "signal",
+      "discord",
+      "slack",
+      "webhook",
+      "google_chat",
+      "email"
+    ]
+  }))
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1756994399_updated__superusers.js b/server/pb_migrations/1756994399_updated__superusers.js
new file mode 100644
index 0000000..c6f5aa1
--- /dev/null
+++ b/server/pb_migrations/1756994399_updated__superusers.js
@@ -0,0 +1,29 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3142635823")
+
+  // add field
+  collection.fields.addAt(9, new Field({
+    "hidden": false,
+    "id": "file376926767",
+    "maxSelect": 1,
+    "maxSize": 0,
+    "mimeTypes": [],
+    "name": "avatar",
+    "presentable": false,
+    "protected": false,
+    "required": false,
+    "system": false,
+    "thumbs": [],
+    "type": "file"
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3142635823")
+
+  // remove field
+  collection.fields.removeById("file376926767")
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757161629_updated_alert_configurations.js b/server/pb_migrations/1757161629_updated_alert_configurations.js
new file mode 100644
index 0000000..092fd4b
--- /dev/null
+++ b/server/pb_migrations/1757161629_updated_alert_configurations.js
@@ -0,0 +1,78 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // add field
+  collection.fields.addAt(23, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text3401535476",
+    "max": 0,
+    "min": 0,
+    "name": "server_url",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // update field
+  collection.fields.addAt(9, new Field({
+    "hidden": false,
+    "id": "select887233555",
+    "maxSelect": 1,
+    "name": "notification_type",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "select",
+    "values": [
+      "telegram",
+      "signal",
+      "discord",
+      "slack",
+      "webhook",
+      "google_chat",
+      "email",
+      "ntfy",
+      "pushover",
+      "notifiarr",
+      "gotify"
+    ]
+  }))
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // remove field
+  collection.fields.removeById("text3401535476")
+
+  // update field
+  collection.fields.addAt(9, new Field({
+    "hidden": false,
+    "id": "select887233555",
+    "maxSelect": 1,
+    "name": "notification_type",
+    "presentable": false,
+    "required": false,
+    "system": false,
+    "type": "select",
+    "values": [
+      "telegram",
+      "signal",
+      "discord",
+      "slack",
+      "webhook",
+      "google_chat",
+      "email",
+      "ntfy",
+      "pushover",
+      "notifiarr"
+    ]
+  }))
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757233868_updated_data_settings.js b/server/pb_migrations/1757233868_updated_data_settings.js
new file mode 100644
index 0000000..c23f163
--- /dev/null
+++ b/server/pb_migrations/1757233868_updated_data_settings.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2889059272")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2889059272")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757233934_updated_incidents.js b/server/pb_migrations/1757233934_updated_incidents.js
new file mode 100644
index 0000000..18f6efa
--- /dev/null
+++ b/server/pb_migrations/1757233934_updated_incidents.js
@@ -0,0 +1,26 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2189087560")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2189087560")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757233957_updated_maintenance.js b/server/pb_migrations/1757233957_updated_maintenance.js
new file mode 100644
index 0000000..628d82b
--- /dev/null
+++ b/server/pb_migrations/1757233957_updated_maintenance.js
@@ -0,0 +1,24 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1738231158")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1738231158")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "updateRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757233963_updated_incidents.js b/server/pb_migrations/1757233963_updated_incidents.js
new file mode 100644
index 0000000..2289889
--- /dev/null
+++ b/server/pb_migrations/1757233963_updated_incidents.js
@@ -0,0 +1,20 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2189087560")
+
+  // update collection data
+  unmarshal({
+    "listRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2189087560")
+
+  // update collection data
+  unmarshal({
+    "listRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757233983_updated_operational_page.js b/server/pb_migrations/1757233983_updated_operational_page.js
new file mode 100644
index 0000000..cad9695
--- /dev/null
+++ b/server/pb_migrations/1757233983_updated_operational_page.js
@@ -0,0 +1,24 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3662317132")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3662317132")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "updateRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757234002_updated_ping_data.js b/server/pb_migrations/1757234002_updated_ping_data.js
new file mode 100644
index 0000000..c12c81f
--- /dev/null
+++ b/server/pb_migrations/1757234002_updated_ping_data.js
@@ -0,0 +1,20 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1168766540")
+
+  // update collection data
+  unmarshal({
+    "deleteRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1168766540")
+
+  // update collection data
+  unmarshal({
+    "deleteRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757234055_updated_alert_configurations.js b/server/pb_migrations/1757234055_updated_alert_configurations.js
new file mode 100644
index 0000000..a6f9db0
--- /dev/null
+++ b/server/pb_migrations/1757234055_updated_alert_configurations.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1757769533_updated_alert_configurations.js b/server/pb_migrations/1757769533_updated_alert_configurations.js
new file mode 100644
index 0000000..24a5dea
--- /dev/null
+++ b/server/pb_migrations/1757769533_updated_alert_configurations.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1760189594_deleted_webhook.js b/server/pb_migrations/1760189594_deleted_webhook.js
new file mode 100644
index 0000000..c85a557
--- /dev/null
+++ b/server/pb_migrations/1760189594_deleted_webhook.js
@@ -0,0 +1,211 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_45665081");
+
+  return app.delete(collection);
+}, (app) => {
+  const collection = new Collection({
+    "createRule": null,
+    "deleteRule": null,
+    "fields": [
+      {
+        "autogeneratePattern": "[a-z0-9]{15}",
+        "hidden": false,
+        "id": "text3208210256",
+        "max": 15,
+        "min": 15,
+        "name": "id",
+        "pattern": "^[a-z0-9]+$",
+        "presentable": false,
+        "primaryKey": true,
+        "required": true,
+        "system": true,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text2809058197",
+        "max": 0,
+        "min": 0,
+        "name": "user_id",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text4101391790",
+        "max": 0,
+        "min": 0,
+        "name": "url",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "hidden": false,
+        "id": "select1358543748",
+        "maxSelect": 1,
+        "name": "enabled",
+        "presentable": false,
+        "required": false,
+        "system": false,
+        "type": "select",
+        "values": [
+          "on",
+          "off"
+        ]
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text1554180325",
+        "max": 0,
+        "min": 0,
+        "name": "secret",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text4144189317",
+        "max": 0,
+        "min": 0,
+        "name": "headers",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text2129530235",
+        "max": 0,
+        "min": 0,
+        "name": "retry_count",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text2168550802",
+        "max": 0,
+        "min": 0,
+        "name": "trigger_events",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text1843675174",
+        "max": 0,
+        "min": 0,
+        "name": "description",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text1579384326",
+        "max": 0,
+        "min": 0,
+        "name": "name",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text1582905952",
+        "max": 0,
+        "min": 0,
+        "name": "method",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "autogeneratePattern": "",
+        "hidden": false,
+        "id": "text1414600993",
+        "max": 0,
+        "min": 0,
+        "name": "payload_template",
+        "pattern": "",
+        "presentable": false,
+        "primaryKey": false,
+        "required": false,
+        "system": false,
+        "type": "text"
+      },
+      {
+        "hidden": false,
+        "id": "autodate2990389176",
+        "name": "created",
+        "onCreate": true,
+        "onUpdate": false,
+        "presentable": false,
+        "system": false,
+        "type": "autodate"
+      },
+      {
+        "hidden": false,
+        "id": "autodate3332085495",
+        "name": "updated",
+        "onCreate": true,
+        "onUpdate": true,
+        "presentable": false,
+        "system": false,
+        "type": "autodate"
+      }
+    ],
+    "id": "pbc_45665081",
+    "indexes": [],
+    "listRule": null,
+    "name": "webhook",
+    "system": false,
+    "type": "base",
+    "updateRule": null,
+    "viewRule": null
+  });
+
+  return app.save(collection);
+})
diff --git a/server/pb_migrations/1760190053_updated_data_settings.js b/server/pb_migrations/1760190053_updated_data_settings.js
new file mode 100644
index 0000000..e65160f
--- /dev/null
+++ b/server/pb_migrations/1760190053_updated_data_settings.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2889059272")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2889059272")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1760190072_updated_incidents.js b/server/pb_migrations/1760190072_updated_incidents.js
new file mode 100644
index 0000000..955eeff
--- /dev/null
+++ b/server/pb_migrations/1760190072_updated_incidents.js
@@ -0,0 +1,24 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2189087560")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "updateRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2189087560")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1760190080_updated_maintenance.js b/server/pb_migrations/1760190080_updated_maintenance.js
new file mode 100644
index 0000000..8fc6f83
--- /dev/null
+++ b/server/pb_migrations/1760190080_updated_maintenance.js
@@ -0,0 +1,24 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1738231158")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "updateRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1738231158")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1760190087_updated_operational_page.js b/server/pb_migrations/1760190087_updated_operational_page.js
new file mode 100644
index 0000000..e88b76f
--- /dev/null
+++ b/server/pb_migrations/1760190087_updated_operational_page.js
@@ -0,0 +1,24 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3662317132")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "updateRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3662317132")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1760190091_updated_ping_data.js b/server/pb_migrations/1760190091_updated_ping_data.js
new file mode 100644
index 0000000..cb4d63f
--- /dev/null
+++ b/server/pb_migrations/1760190091_updated_ping_data.js
@@ -0,0 +1,20 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1168766540")
+
+  // update collection data
+  unmarshal({
+    "deleteRule": ""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1168766540")
+
+  // update collection data
+  unmarshal({
+    "deleteRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125544_updated_alert_configurations.js b/server/pb_migrations/1772125544_updated_alert_configurations.js
new file mode 100644
index 0000000..a6f9db0
--- /dev/null
+++ b/server/pb_migrations/1772125544_updated_alert_configurations.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125552_updated_data_settings.js b/server/pb_migrations/1772125552_updated_data_settings.js
new file mode 100644
index 0000000..c23f163
--- /dev/null
+++ b/server/pb_migrations/1772125552_updated_data_settings.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2889059272")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2889059272")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125560_updated_dns_data.js b/server/pb_migrations/1772125560_updated_dns_data.js
new file mode 100644
index 0000000..51ee7d9
--- /dev/null
+++ b/server/pb_migrations/1772125560_updated_dns_data.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_285611395")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_285611395")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125568_updated_docker_metrics.js b/server/pb_migrations/1772125568_updated_docker_metrics.js
new file mode 100644
index 0000000..7316271
--- /dev/null
+++ b/server/pb_migrations/1772125568_updated_docker_metrics.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3168803865")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3168803865")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125575_updated_dockers.js b/server/pb_migrations/1772125575_updated_dockers.js
new file mode 100644
index 0000000..138e682
--- /dev/null
+++ b/server/pb_migrations/1772125575_updated_dockers.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_583547467")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_583547467")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125583_updated_incidents.js b/server/pb_migrations/1772125583_updated_incidents.js
new file mode 100644
index 0000000..9cf2d7d
--- /dev/null
+++ b/server/pb_migrations/1772125583_updated_incidents.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2189087560")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2189087560")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125590_updated_maintenance.js b/server/pb_migrations/1772125590_updated_maintenance.js
new file mode 100644
index 0000000..effd597
--- /dev/null
+++ b/server/pb_migrations/1772125590_updated_maintenance.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1738231158")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1738231158")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125598_updated_operational_page.js b/server/pb_migrations/1772125598_updated_operational_page.js
new file mode 100644
index 0000000..2c3afa3
--- /dev/null
+++ b/server/pb_migrations/1772125598_updated_operational_page.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3662317132")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3662317132")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125605_updated_ping_data.js b/server/pb_migrations/1772125605_updated_ping_data.js
new file mode 100644
index 0000000..4eb4fd3
--- /dev/null
+++ b/server/pb_migrations/1772125605_updated_ping_data.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1168766540")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1168766540")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125613_updated_regional_service.js b/server/pb_migrations/1772125613_updated_regional_service.js
new file mode 100644
index 0000000..c491bdf
--- /dev/null
+++ b/server/pb_migrations/1772125613_updated_regional_service.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_171698555")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_171698555")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125622_updated_server_metrics.js b/server/pb_migrations/1772125622_updated_server_metrics.js
new file mode 100644
index 0000000..5679b2d
--- /dev/null
+++ b/server/pb_migrations/1772125622_updated_server_metrics.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1998570700")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1998570700")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125668_updated_server_notification_templates.js b/server/pb_migrations/1772125668_updated_server_notification_templates.js
new file mode 100644
index 0000000..677a1eb
--- /dev/null
+++ b/server/pb_migrations/1772125668_updated_server_notification_templates.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1965843930")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1965843930")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125679_updated_server_threshold_templates.js b/server/pb_migrations/1772125679_updated_server_threshold_templates.js
new file mode 100644
index 0000000..f5f4005
--- /dev/null
+++ b/server/pb_migrations/1772125679_updated_server_threshold_templates.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1464856393")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1464856393")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125685_updated_servers.js b/server/pb_migrations/1772125685_updated_servers.js
new file mode 100644
index 0000000..fdfe4cc
--- /dev/null
+++ b/server/pb_migrations/1772125685_updated_servers.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3738798621")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3738798621")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125695_updated_service_group.js b/server/pb_migrations/1772125695_updated_service_group.js
new file mode 100644
index 0000000..dcee93f
--- /dev/null
+++ b/server/pb_migrations/1772125695_updated_service_group.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_763794515")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_763794515")
+
+  // update collection data
+  unmarshal({
+    "createRule": null,
+    "deleteRule": null,
+    "listRule": null,
+    "updateRule": null,
+    "viewRule": null
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125706_updated_service_notification_templates.js b/server/pb_migrations/1772125706_updated_service_notification_templates.js
new file mode 100644
index 0000000..252ff78
--- /dev/null
+++ b/server/pb_migrations/1772125706_updated_service_notification_templates.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1572233440")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1572233440")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125715_updated_services.js b/server/pb_migrations/1772125715_updated_services.js
new file mode 100644
index 0000000..64b7ef1
--- /dev/null
+++ b/server/pb_migrations/1772125715_updated_services.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_863811952")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125722_updated_services_metrics.js b/server/pb_migrations/1772125722_updated_services_metrics.js
new file mode 100644
index 0000000..9a40537
--- /dev/null
+++ b/server/pb_migrations/1772125722_updated_services_metrics.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3575570325")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_3575570325")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125729_updated_ssl_certificates.js b/server/pb_migrations/1772125729_updated_ssl_certificates.js
new file mode 100644
index 0000000..7ddafe2
--- /dev/null
+++ b/server/pb_migrations/1772125729_updated_ssl_certificates.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1836745630")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1836745630")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125736_updated_ssl_history.js b/server/pb_migrations/1772125736_updated_ssl_history.js
new file mode 100644
index 0000000..6cb321f
--- /dev/null
+++ b/server/pb_migrations/1772125736_updated_ssl_history.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1753185970")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1753185970")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125744_updated_ssl_notification_templates.js b/server/pb_migrations/1772125744_updated_ssl_notification_templates.js
new file mode 100644
index 0000000..1d1c15a
--- /dev/null
+++ b/server/pb_migrations/1772125744_updated_ssl_notification_templates.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_351174173")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_351174173")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125752_updated_status_page_components.js b/server/pb_migrations/1772125752_updated_status_page_components.js
new file mode 100644
index 0000000..982cdf7
--- /dev/null
+++ b/server/pb_migrations/1772125752_updated_status_page_components.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1636150439")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1636150439")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125758_updated_tcp_data.js b/server/pb_migrations/1772125758_updated_tcp_data.js
new file mode 100644
index 0000000..e1c471d
--- /dev/null
+++ b/server/pb_migrations/1772125758_updated_tcp_data.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2331916230")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2331916230")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772125766_updated_uptime_data.js b/server/pb_migrations/1772125766_updated_uptime_data.js
new file mode 100644
index 0000000..882c962
--- /dev/null
+++ b/server/pb_migrations/1772125766_updated_uptime_data.js
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_67962705")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_67962705")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/1772200000_updated_alert_configurations_matrix.js b/server/pb_migrations/1772200000_updated_alert_configurations_matrix.js
new file mode 100644
index 0000000..02cc1a2
--- /dev/null
+++ b/server/pb_migrations/1772200000_updated_alert_configurations_matrix.js
@@ -0,0 +1,73 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  // add matrix_homeserver field
+  collection.fields.addAt(collection.fields.length, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text_matrix_homeserver",
+    "max": 0,
+    "min": 0,
+    "name": "matrix_homeserver",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // add matrix_room_id field
+  collection.fields.addAt(collection.fields.length, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text_matrix_room_id",
+    "max": 0,
+    "min": 0,
+    "name": "matrix_room_id",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // add matrix_access_token field
+  collection.fields.addAt(collection.fields.length, new Field({
+    "autogeneratePattern": "",
+    "hidden": false,
+    "id": "text_matrix_access_token",
+    "max": 0,
+    "min": 0,
+    "name": "matrix_access_token",
+    "pattern": "",
+    "presentable": false,
+    "primaryKey": false,
+    "required": false,
+    "system": false,
+    "type": "text"
+  }))
+
+  // add "matrix" to the notification_type select field values
+  const notifTypeField = collection.fields.getByName("notification_type")
+  if (notifTypeField && notifTypeField.values) {
+    notifTypeField.values.push("matrix")
+  }
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_1938176441")
+
+  collection.fields.removeById("text_matrix_homeserver")
+  collection.fields.removeById("text_matrix_room_id")
+  collection.fields.removeById("text_matrix_access_token")
+
+  const notifTypeField = collection.fields.getByName("notification_type")
+  if (notifTypeField && notifTypeField.values) {
+    notifTypeField.values = notifTypeField.values.filter(v => v !== "matrix")
+  }
+
+  return app.save(collection)
+})
diff --git a/server/pb_migrations/pb_schema.json b/server/pb_migrations/pb_schema.json
new file mode 100644
index 0000000..bc77385
--- /dev/null
+++ b/server/pb_migrations/pb_schema.json
@@ -0,0 +1,6678 @@
+[
+    {
+        "id": "pbc_3142635823",
+        "listRule": null,
+        "viewRule": null,
+        "createRule": null,
+        "updateRule": null,
+        "deleteRule": null,
+        "name": "_superusers",
+        "type": "auth",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "cost": 0,
+                "hidden": true,
+                "id": "password901924565",
+                "max": 0,
+                "min": 8,
+                "name": "password",
+                "pattern": "",
+                "presentable": false,
+                "required": true,
+                "system": true,
+                "type": "password"
+            },
+            {
+                "autogeneratePattern": "[a-zA-Z0-9]{50}",
+                "hidden": true,
+                "id": "text2504183744",
+                "max": 60,
+                "min": 30,
+                "name": "tokenKey",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "exceptDomains": null,
+                "hidden": false,
+                "id": "email3885137012",
+                "name": "email",
+                "onlyDomains": null,
+                "presentable": false,
+                "required": true,
+                "system": true,
+                "type": "email"
+            },
+            {
+                "hidden": false,
+                "id": "bool1547992806",
+                "name": "emailVisibility",
+                "presentable": false,
+                "required": false,
+                "system": true,
+                "type": "bool"
+            },
+            {
+                "hidden": false,
+                "id": "bool256245529",
+                "name": "verified",
+                "presentable": false,
+                "required": false,
+                "system": true,
+                "type": "bool"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3687080900",
+                "max": 0,
+                "min": 0,
+                "name": "full_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4166911607",
+                "max": 0,
+                "min": 0,
+                "name": "username",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "active",
+                    "inactive"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [
+            "CREATE UNIQUE INDEX `idx_tokenKey_pbc_3142635823` ON `_superusers` (`tokenKey`)",
+            "CREATE UNIQUE INDEX `idx_email_pbc_3142635823` ON `_superusers` (`email`) WHERE `email` != ''"
+        ],
+        "system": true,
+        "authRule": "",
+        "manageRule": null,
+        "authAlert": {
+            "enabled": true,
+            "emailTemplate": {
+                "subject": "Login from a new location",
+                "body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location.</p>\n<p>If this was you, you may disregard this email.</p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+            }
+        },
+        "oauth2": {
+            "mappedFields": {
+                "id": "",
+                "name": "",
+                "username": "",
+                "avatarURL": ""
+            },
+            "enabled": false
+        },
+        "passwordAuth": {
+            "enabled": true,
+            "identityFields": [
+                "email"
+            ]
+        },
+        "mfa": {
+            "enabled": false,
+            "duration": 1800,
+            "rule": ""
+        },
+        "otp": {
+            "enabled": false,
+            "duration": 180,
+            "length": 8,
+            "emailTemplate": {
+                "subject": "OTP for {APP_NAME}",
+                "body": "<p>Hello,</p>\n<p>Your one-time password is: <strong>{OTP}</strong></p>\n<p><i>If you didn't ask for the one-time password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+            }
+        },
+        "authToken": {
+            "duration": 86400
+        },
+        "passwordResetToken": {
+            "duration": 1800
+        },
+        "emailChangeToken": {
+            "duration": 1800
+        },
+        "verificationToken": {
+            "duration": 259200
+        },
+        "fileToken": {
+            "duration": 180
+        },
+        "verificationTemplate": {
+            "subject": "Verify your {APP_NAME} email",
+            "body": "<p>Hello,</p>\n<p>Thank you for joining us at {APP_NAME}.</p>\n<p>Click on the button below to verify your email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Verify</a>\n</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+        },
+        "resetPasswordTemplate": {
+            "subject": "Reset your {APP_NAME} password",
+            "body": "<p>Hello,</p>\n<p>Click on the button below to reset your password.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Reset password</a>\n</p>\n<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+        },
+        "confirmEmailChangeTemplate": {
+            "subject": "Confirm your {APP_NAME} new email address",
+            "body": "<p>Hello,</p>\n<p>Click on the button below to confirm your new email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Confirm new email</a>\n</p>\n<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+        }
+    },
+    {
+        "id": "_pb_users_auth_",
+        "listRule": "id = @request.auth.id",
+        "viewRule": "id = @request.auth.id",
+        "createRule": "",
+        "updateRule": "id = @request.auth.id",
+        "deleteRule": "id = @request.auth.id",
+        "name": "users",
+        "type": "auth",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "cost": 0,
+                "hidden": true,
+                "id": "password901924565",
+                "max": 0,
+                "min": 8,
+                "name": "password",
+                "pattern": "",
+                "presentable": false,
+                "required": true,
+                "system": true,
+                "type": "password"
+            },
+            {
+                "autogeneratePattern": "[a-zA-Z0-9]{50}",
+                "hidden": true,
+                "id": "text2504183744",
+                "max": 60,
+                "min": 30,
+                "name": "tokenKey",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "exceptDomains": null,
+                "hidden": false,
+                "id": "email3885137012",
+                "name": "email",
+                "onlyDomains": null,
+                "presentable": false,
+                "required": true,
+                "system": true,
+                "type": "email"
+            },
+            {
+                "hidden": false,
+                "id": "bool1547992806",
+                "name": "emailVisibility",
+                "presentable": false,
+                "required": false,
+                "system": true,
+                "type": "bool"
+            },
+            {
+                "hidden": false,
+                "id": "bool256245529",
+                "name": "verified",
+                "presentable": false,
+                "required": false,
+                "system": true,
+                "type": "bool"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 255,
+                "min": 0,
+                "name": "full_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "file376926767",
+                "maxSelect": 1,
+                "maxSize": 0,
+                "mimeTypes": [
+                    "image/jpeg",
+                    "image/png",
+                    "image/svg+xml",
+                    "image/gif",
+                    "image/webp"
+                ],
+                "name": "avatar",
+                "presentable": false,
+                "protected": false,
+                "required": false,
+                "system": false,
+                "thumbs": null,
+                "type": "file"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4166911607",
+                "max": 0,
+                "min": 0,
+                "name": "username",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [
+            "CREATE UNIQUE INDEX `idx_tokenKey__pb_users_auth_` ON `users` (`tokenKey`)",
+            "CREATE UNIQUE INDEX `idx_email__pb_users_auth_` ON `users` (`email`) WHERE `email` != ''"
+        ],
+        "system": false,
+        "authRule": "",
+        "manageRule": null,
+        "authAlert": {
+            "enabled": true,
+            "emailTemplate": {
+                "subject": "Login from a new location",
+                "body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location.</p>\n<p>If this was you, you may disregard this email.</p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+            }
+        },
+        "oauth2": {
+            "mappedFields": {
+                "id": "",
+                "name": "",
+                "username": "",
+                "avatarURL": "avatar"
+            },
+            "enabled": false
+        },
+        "passwordAuth": {
+            "enabled": true,
+            "identityFields": [
+                "email"
+            ]
+        },
+        "mfa": {
+            "enabled": false,
+            "duration": 1800,
+            "rule": ""
+        },
+        "otp": {
+            "enabled": false,
+            "duration": 180,
+            "length": 8,
+            "emailTemplate": {
+                "subject": "OTP for {APP_NAME}",
+                "body": "<p>Hello,</p>\n<p>Your one-time password is: <strong>{OTP}</strong></p>\n<p><i>If you didn't ask for the one-time password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+            }
+        },
+        "authToken": {
+            "duration": 604800
+        },
+        "passwordResetToken": {
+            "duration": 1800
+        },
+        "emailChangeToken": {
+            "duration": 1800
+        },
+        "verificationToken": {
+            "duration": 259200
+        },
+        "fileToken": {
+            "duration": 180
+        },
+        "verificationTemplate": {
+            "subject": "Verify your {APP_NAME} email",
+            "body": "<p>Hello,</p>\n<p>Thank you for joining us at {APP_NAME}.</p>\n<p>Click on the button below to verify your email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Verify</a>\n</p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+        },
+        "resetPasswordTemplate": {
+            "subject": "Reset your {APP_NAME} password",
+            "body": "<p>Hello,</p>\n<p>Click on the button below to reset your password.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Reset password</a>\n</p>\n<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+        },
+        "confirmEmailChangeTemplate": {
+            "subject": "Confirm your {APP_NAME} new email address",
+            "body": "<p>Hello,</p>\n<p>Click on the button below to confirm your new email address.</p>\n<p>\n  <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Confirm new email</a>\n</p>\n<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>\n<p>\n  Thanks,<br/>\n  {APP_NAME} team\n</p>"
+        }
+    },
+    {
+        "id": "pbc_4275539003",
+        "listRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "viewRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "createRule": null,
+        "updateRule": null,
+        "deleteRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "name": "_authOrigins",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text455797646",
+                "max": 0,
+                "min": 0,
+                "name": "collectionRef",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text127846527",
+                "max": 0,
+                "min": 0,
+                "name": "recordRef",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4228609354",
+                "max": 0,
+                "min": 0,
+                "name": "fingerprint",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [
+            "CREATE UNIQUE INDEX `idx_authOrigins_unique_pairs` ON `_authOrigins` (collectionRef, recordRef, fingerprint)"
+        ],
+        "system": true
+    },
+    {
+        "id": "pbc_2281828961",
+        "listRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "viewRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "createRule": null,
+        "updateRule": null,
+        "deleteRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "name": "_externalAuths",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text455797646",
+                "max": 0,
+                "min": 0,
+                "name": "collectionRef",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text127846527",
+                "max": 0,
+                "min": 0,
+                "name": "recordRef",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2462348188",
+                "max": 0,
+                "min": 0,
+                "name": "provider",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1044722854",
+                "max": 0,
+                "min": 0,
+                "name": "providerId",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [
+            "CREATE UNIQUE INDEX `idx_externalAuths_record_provider` ON `_externalAuths` (collectionRef, recordRef, provider)",
+            "CREATE UNIQUE INDEX `idx_externalAuths_collection_provider` ON `_externalAuths` (collectionRef, provider, providerId)"
+        ],
+        "system": true
+    },
+    {
+        "id": "pbc_2279338944",
+        "listRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "viewRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "createRule": null,
+        "updateRule": null,
+        "deleteRule": null,
+        "name": "_mfas",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text455797646",
+                "max": 0,
+                "min": 0,
+                "name": "collectionRef",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text127846527",
+                "max": 0,
+                "min": 0,
+                "name": "recordRef",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1582905952",
+                "max": 0,
+                "min": 0,
+                "name": "method",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [
+            "CREATE INDEX `idx_mfas_collectionRef_recordRef` ON `_mfas` (collectionRef,recordRef)"
+        ],
+        "system": true
+    },
+    {
+        "id": "pbc_1638494021",
+        "listRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "viewRule": "@request.auth.id != '' && recordRef = @request.auth.id && collectionRef = @request.auth.collectionId",
+        "createRule": null,
+        "updateRule": null,
+        "deleteRule": null,
+        "name": "_otps",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text455797646",
+                "max": 0,
+                "min": 0,
+                "name": "collectionRef",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text127846527",
+                "max": 0,
+                "min": 0,
+                "name": "recordRef",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "cost": 8,
+                "hidden": true,
+                "id": "password901924565",
+                "max": 0,
+                "min": 0,
+                "name": "password",
+                "pattern": "",
+                "presentable": false,
+                "required": true,
+                "system": true,
+                "type": "password"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": true,
+                "id": "text3866985172",
+                "max": 0,
+                "min": 0,
+                "name": "sentTo",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": true,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [
+            "CREATE INDEX `idx_otps_collectionRef_recordRef` ON `_otps` (collectionRef, recordRef)"
+        ],
+        "system": true
+    },
+    {
+        "id": "pbc_1938176441",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "alert_configurations",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "channel_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1104941267",
+                "max": 0,
+                "min": 0,
+                "name": "telegram_chat_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2654632018",
+                "max": 0,
+                "min": 0,
+                "name": "discord_webhook_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text904114323",
+                "max": 0,
+                "min": 0,
+                "name": "signal_number",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text709732016",
+                "max": 0,
+                "min": 0,
+                "name": "notify_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3787265959",
+                "max": 0,
+                "min": 0,
+                "name": "bot_token",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2946855043",
+                "max": 0,
+                "min": 0,
+                "name": "slack_webhook_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select887233555",
+                "maxSelect": 1,
+                "name": "notification_type",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "telegram",
+                    "signal",
+                    "discord",
+                    "slack",
+                    "webhook",
+                    "google_chat",
+                    "email",
+                    "ntfy",
+                    "pushover",
+                    "notifiarr"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select1358543748",
+                "maxSelect": 1,
+                "name": "enabled",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "true",
+                    "false"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2962097998",
+                "max": 0,
+                "min": 0,
+                "name": "email_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3070882914",
+                "max": 0,
+                "min": 0,
+                "name": "email_sender_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2941943271",
+                "max": 0,
+                "min": 0,
+                "name": "smtp_port",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text393471132",
+                "max": 0,
+                "min": 0,
+                "name": "smtp_server",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2735050465",
+                "max": 0,
+                "min": 0,
+                "name": "google_chat_webhook_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1263996916",
+                "max": 0,
+                "min": 0,
+                "name": "signal_api_endpoint",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4212033756",
+                "max": 0,
+                "min": 0,
+                "name": "smtp_password",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text137129747",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3590941513",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_payload_template",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1654359675",
+                "max": 0,
+                "min": 0,
+                "name": "ntfy_endpoint",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2074277355",
+                "max": 0,
+                "min": 0,
+                "name": "api_token",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1636223522",
+                "max": 0,
+                "min": 0,
+                "name": "user_key",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_2889059272",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "data_settings",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1569706847",
+                "max": null,
+                "min": null,
+                "name": "retention_days",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1419719274",
+                "max": null,
+                "min": null,
+                "name": "server_retention_days",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3508549248",
+                "max": null,
+                "min": null,
+                "name": "uptime_retention_days",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2800013036",
+                "max": 0,
+                "min": 0,
+                "name": "backup",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_285611395",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "dns_data",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2554192817",
+                "max": 0,
+                "min": 0,
+                "name": "query_type",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3731179111",
+                "max": 0,
+                "min": 0,
+                "name": "resolve_ip",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2323266619",
+                "max": 0,
+                "min": 0,
+                "name": "msg_size",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3069659470",
+                "max": 0,
+                "min": 0,
+                "name": "question",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3671935525",
+                "max": 0,
+                "min": 0,
+                "name": "answer",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1257859836",
+                "max": 0,
+                "min": 0,
+                "name": "authority",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2273667377",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_3168803865",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "docker_metrics",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "docker_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text933879452",
+                "max": 0,
+                "min": 0,
+                "name": "ram_total",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4038915663",
+                "max": 0,
+                "min": 0,
+                "name": "ram_used",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3302315167",
+                "max": 0,
+                "min": 0,
+                "name": "ram_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1461425251",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_cores",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2062996636",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_usage",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1525183142",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2583550350",
+                "max": 0,
+                "min": 0,
+                "name": "disk_total",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1976676007",
+                "max": 0,
+                "min": 0,
+                "name": "disk_used",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1102580855",
+                "max": 0,
+                "min": 0,
+                "name": "disk_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1936777896",
+                "max": null,
+                "min": null,
+                "name": "network_rx_bytes",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3038767919",
+                "max": null,
+                "min": null,
+                "name": "network_tx_bytes",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3452919696",
+                "max": null,
+                "min": null,
+                "name": "network_rx_speed",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number195057175",
+                "max": null,
+                "min": null,
+                "name": "network_tx_speed",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_583547467",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "dockers",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1069831160",
+                "max": 0,
+                "min": 0,
+                "name": "docker_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3847340049",
+                "max": 0,
+                "min": 0,
+                "name": "hostname",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text587191692",
+                "max": 0,
+                "min": 0,
+                "name": "ip_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063420466",
+                "max": 0,
+                "min": 0,
+                "name": "os_template",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1563400775",
+                "max": 0,
+                "min": 0,
+                "name": "uptime",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number933879452",
+                "max": null,
+                "min": null,
+                "name": "ram_total",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number4038915663",
+                "max": null,
+                "min": null,
+                "name": "ram_used",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1461425251",
+                "max": null,
+                "min": null,
+                "name": "cpu_cores",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number2062996636",
+                "max": null,
+                "min": null,
+                "name": "cpu_usage",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number2583550350",
+                "max": null,
+                "min": null,
+                "name": "disk_total",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1976676007",
+                "max": null,
+                "min": null,
+                "name": "disk_used",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "date3415181003",
+                "max": "",
+                "min": "",
+                "name": "last_checked",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2782324286",
+                "max": 0,
+                "min": 0,
+                "name": "timestamp",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_2189087560",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "incidents",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text724990059",
+                "max": 0,
+                "min": 0,
+                "name": "title",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2314121105",
+                "max": 0,
+                "min": 0,
+                "name": "assigned_users",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3210298530",
+                "max": 0,
+                "min": 0,
+                "name": "resolution_time",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text723782963",
+                "max": 0,
+                "min": 0,
+                "name": "affected_systems",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1210058505",
+                "max": 0,
+                "min": 0,
+                "name": "root_cause",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text178040949",
+                "max": 0,
+                "min": 0,
+                "name": "resolution_steps",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2767280054",
+                "max": 0,
+                "min": 0,
+                "name": "lessons_learned",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4053573849",
+                "max": 0,
+                "min": 0,
+                "name": "operational_status_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select2722347397",
+                "maxSelect": 1,
+                "name": "impact_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "investigating",
+                    "found_root_cause",
+                    "identified",
+                    "monitoring",
+                    "resolved"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "server_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1655102503",
+                "maxSelect": 1,
+                "name": "priority",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "low",
+                    "medium",
+                    "high",
+                    "critical"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select3288973319",
+                "maxSelect": 1,
+                "name": "impact",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "minor",
+                    "major",
+                    "critical",
+                    "none"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1738231158",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "maintenance",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text724990059",
+                "max": 0,
+                "min": 0,
+                "name": "title",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date1345189255",
+                "max": "",
+                "min": "",
+                "name": "start_time",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "date1096160257",
+                "max": "",
+                "min": "",
+                "name": "end_time",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3922189066",
+                "max": 0,
+                "min": 0,
+                "name": "affected",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3725765462",
+                "max": 0,
+                "min": 0,
+                "name": "created_by",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1348078739",
+                "max": 0,
+                "min": 0,
+                "name": "notify_subscribers",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1655102503",
+                "maxSelect": 1,
+                "name": "priority",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "low",
+                    "medium",
+                    "high",
+                    "critical"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "scheduled",
+                    "completed",
+                    "cancelled",
+                    "in_progress"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4053573849",
+                "max": 0,
+                "min": 0,
+                "name": "operational_status_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1542800728",
+                "maxSelect": 1,
+                "name": "field",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "minor",
+                    "major",
+                    "critical",
+                    "none"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3490420651",
+                "max": 0,
+                "min": 0,
+                "name": "assigned_users",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_3662317132",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "operational_page",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text724990059",
+                "max": 0,
+                "min": 0,
+                "name": "title",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1811784642",
+                "maxSelect": 1,
+                "name": "is_public",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "true",
+                    "false"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2560465762",
+                "max": 0,
+                "min": 0,
+                "name": "slug",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2541086472",
+                "max": 0,
+                "min": 0,
+                "name": "theme",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text156371623",
+                "max": 0,
+                "min": 0,
+                "name": "logo_url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2466564623",
+                "max": 0,
+                "min": 0,
+                "name": "custom_domain",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3581369753",
+                "max": 0,
+                "min": 0,
+                "name": "custom_css",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1430013884",
+                "max": 0,
+                "min": 0,
+                "name": "page_style",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "operational",
+                    "degraded",
+                    "partial_outage",
+                    "major_outage",
+                    "maintenance"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1168766540",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "ping_data",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1341404999",
+                "max": 0,
+                "min": 0,
+                "name": "packet_loss",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text926446584",
+                "max": 0,
+                "min": 0,
+                "name": "latency",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2750318623",
+                "max": 0,
+                "min": 0,
+                "name": "max_rtt",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2645286934",
+                "max": 0,
+                "min": 0,
+                "name": "min_rtt",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text108668494",
+                "max": 0,
+                "min": 0,
+                "name": "packets_sent",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3848691274",
+                "max": 0,
+                "min": 0,
+                "name": "packets_recv",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2665772979",
+                "max": 0,
+                "min": 0,
+                "name": "avg_rtt",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text836103155",
+                "max": 0,
+                "min": 0,
+                "name": "rtts",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_171698555",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "regional_service",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1404634243",
+                "max": 0,
+                "min": 0,
+                "name": "agent_ip_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text704082790",
+                "max": 0,
+                "min": 0,
+                "name": "connection",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1597481275",
+                "max": 0,
+                "min": 0,
+                "name": "token",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1998570700",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "server_metrics",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "server_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text933879452",
+                "max": 0,
+                "min": 0,
+                "name": "ram_total",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4038915663",
+                "max": 0,
+                "min": 0,
+                "name": "ram_used",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3302315167",
+                "max": 0,
+                "min": 0,
+                "name": "ram_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1461425251",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_cores",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2062996636",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_usage",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1525183142",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2583550350",
+                "max": 0,
+                "min": 0,
+                "name": "disk_total",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1976676007",
+                "max": 0,
+                "min": 0,
+                "name": "disk_used",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1102580855",
+                "max": 0,
+                "min": 0,
+                "name": "disk_free",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1936777896",
+                "max": null,
+                "min": null,
+                "name": "network_rx_bytes",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3038767919",
+                "max": null,
+                "min": null,
+                "name": "network_tx_bytes",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3452919696",
+                "max": null,
+                "min": null,
+                "name": "network_rx_speed",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number195057175",
+                "max": null,
+                "min": null,
+                "name": "network_tx_speed",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text635908666",
+                "max": 0,
+                "min": 0,
+                "name": "agent_status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1907735298",
+                "max": 0,
+                "min": 0,
+                "name": "max_retries",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3065852031",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text772177811",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1965843930",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "server_notification_templates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2233324553",
+                "max": 0,
+                "min": 0,
+                "name": "ram_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3462525847",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3499937189",
+                "max": 0,
+                "min": 0,
+                "name": "disk_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3897838783",
+                "max": 0,
+                "min": 0,
+                "name": "network_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2761878292",
+                "max": 0,
+                "min": 0,
+                "name": "up_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3025025370",
+                "max": 0,
+                "min": 0,
+                "name": "down_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2718833336",
+                "max": 0,
+                "min": 0,
+                "name": "paused_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3489289583",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_temp_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2170408196",
+                "max": 0,
+                "min": 0,
+                "name": "disk_io_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4125531906",
+                "max": 0,
+                "min": 0,
+                "name": "placeholder",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1005957295",
+                "max": 0,
+                "min": 0,
+                "name": "warning_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text992877620",
+                "max": 0,
+                "min": 0,
+                "name": "restore_ram_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2334264704",
+                "max": 0,
+                "min": 0,
+                "name": "restore_cpu_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text808080362",
+                "max": 0,
+                "min": 0,
+                "name": "restore_disk_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2722458077",
+                "max": 0,
+                "min": 0,
+                "name": "restore_network_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text823542732",
+                "max": 0,
+                "min": 0,
+                "name": "restore_disk_io_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1526027363",
+                "max": 0,
+                "min": 0,
+                "name": "restore_cpu_temp_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1464856393",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "server_threshold_templates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2233324553",
+                "max": 0,
+                "min": 0,
+                "name": "ram_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3462525847",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3499937189",
+                "max": 0,
+                "min": 0,
+                "name": "disk_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3897838783",
+                "max": 0,
+                "min": 0,
+                "name": "network_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3837604842",
+                "max": 0,
+                "min": 0,
+                "name": "disk_io_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2623591511",
+                "max": 0,
+                "min": 0,
+                "name": "cpu_temp_threshold",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_3738798621",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "servers",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "server_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3847340049",
+                "max": 0,
+                "min": 0,
+                "name": "hostname",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text587191692",
+                "max": 0,
+                "min": 0,
+                "name": "ip_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063420466",
+                "max": 0,
+                "min": 0,
+                "name": "os_type",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "up",
+                    "down",
+                    "warning",
+                    "paused"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1563400775",
+                "max": 0,
+                "min": 0,
+                "name": "uptime",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number933879452",
+                "max": null,
+                "min": null,
+                "name": "ram_total",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number4038915663",
+                "max": null,
+                "min": null,
+                "name": "ram_used",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1461425251",
+                "max": null,
+                "min": null,
+                "name": "cpu_cores",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number2062996636",
+                "max": null,
+                "min": null,
+                "name": "cpu_usage",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number2583550350",
+                "max": null,
+                "min": null,
+                "name": "disk_total",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1976676007",
+                "max": null,
+                "min": null,
+                "name": "disk_used",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "date3415181003",
+                "max": "",
+                "min": "",
+                "name": "last_checked",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4290167602",
+                "max": 0,
+                "min": 0,
+                "name": "server_token",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2782324286",
+                "max": 0,
+                "min": 0,
+                "name": "timestamp",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text704082790",
+                "max": 0,
+                "min": 0,
+                "name": "connection",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text635908666",
+                "max": 0,
+                "min": 0,
+                "name": "agent_status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3661988513",
+                "max": 0,
+                "min": 0,
+                "name": "system_info",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1936777896",
+                "max": 0,
+                "min": 0,
+                "name": "network_rx_bytes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3038767919",
+                "max": 0,
+                "min": 0,
+                "name": "network_tx_bytes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3452919696",
+                "max": 0,
+                "min": 0,
+                "name": "network_rx_speed",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text195057175",
+                "max": 0,
+                "min": 0,
+                "name": "network_tx_speed",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number4097339557",
+                "max": null,
+                "min": null,
+                "name": "check_interval",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "select4065722285",
+                "maxSelect": 1,
+                "name": "docker",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "true",
+                    "false"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1907735298",
+                "max": 0,
+                "min": 0,
+                "name": "max_retries",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1080317331",
+                "max": 0,
+                "min": 0,
+                "name": "threshold_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1553704459",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "bool3215432513",
+                "name": "notification_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "bool"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_763794515",
+        "listRule": null,
+        "viewRule": null,
+        "createRule": null,
+        "updateRule": null,
+        "deleteRule": null,
+        "name": "service_group",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1572233440",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "service_notification_templates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2761878292",
+                "max": 0,
+                "min": 0,
+                "name": "up_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3025025370",
+                "max": 0,
+                "min": 0,
+                "name": "down_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3477829101",
+                "max": 0,
+                "min": 0,
+                "name": "maintenance_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text293022370",
+                "max": 0,
+                "min": 0,
+                "name": "incident_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3490715516",
+                "max": 0,
+                "min": 0,
+                "name": "resolved_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1005957295",
+                "max": 0,
+                "min": 0,
+                "name": "warning_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4125531906",
+                "max": 0,
+                "min": 0,
+                "name": "placeholder",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_863811952",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "services",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3475444733",
+                "max": 0,
+                "min": 0,
+                "name": "host",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1563400775",
+                "max": null,
+                "min": null,
+                "name": "uptime",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "date3415181003",
+                "max": "",
+                "min": "",
+                "name": "last_checked",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number1133600204",
+                "max": null,
+                "min": null,
+                "name": "port",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2812878347",
+                "max": 0,
+                "min": 0,
+                "name": "domain",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number3142844404",
+                "max": null,
+                "min": null,
+                "name": "heartbeat_interval",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1907735298",
+                "max": null,
+                "min": null,
+                "name": "max_retries",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1117643717",
+                "maxSelect": 1,
+                "name": "service_type",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "http",
+                    "tcp",
+                    "ping",
+                    "dns"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "up",
+                    "down",
+                    "warning",
+                    "paused"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4101391790",
+                "max": 0,
+                "min": 0,
+                "name": "url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select3434705756",
+                "maxSelect": 1,
+                "name": "alerts",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "muted",
+                    "unmuted"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "bool3215432513",
+                "name": "notification_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "bool"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1745692878",
+                "max": 0,
+                "min": 0,
+                "name": "regional_status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text318214333",
+                "max": 0,
+                "min": 0,
+                "name": "status_codes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2502838439",
+                "max": 0,
+                "min": 0,
+                "name": "keyword",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1841317061",
+                "max": 0,
+                "min": 0,
+                "name": "group_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1553704459",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_3575570325",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "services_metrics",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2422262506",
+                "max": 0,
+                "min": 0,
+                "name": "service_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3475444733",
+                "max": 0,
+                "min": 0,
+                "name": "host",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number1563400775",
+                "max": null,
+                "min": null,
+                "name": "uptime",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "date3415181003",
+                "max": "",
+                "min": "",
+                "name": "last_checked",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number1133600204",
+                "max": null,
+                "min": null,
+                "name": "port",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2812878347",
+                "max": 0,
+                "min": 0,
+                "name": "domain",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number3142844404",
+                "max": null,
+                "min": null,
+                "name": "heartbeat_interval",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number1907735298",
+                "max": null,
+                "min": null,
+                "name": "max_retries",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1117643717",
+                "maxSelect": 1,
+                "name": "service_type",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "http",
+                    "tcp",
+                    "ping",
+                    "dns"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select2063623452",
+                "maxSelect": 1,
+                "name": "status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "up",
+                    "down",
+                    "warning",
+                    "paused"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4101391790",
+                "max": 0,
+                "min": 0,
+                "name": "url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select4152017003",
+                "maxSelect": 1,
+                "name": "alerts",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "muted",
+                    "unmuted"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text318214333",
+                "max": 0,
+                "min": 0,
+                "name": "status_codes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1519612219",
+                "max": 0,
+                "min": 0,
+                "name": "keyword",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "region_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1404634243",
+                "max": 0,
+                "min": 0,
+                "name": "agent_ip_address",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1836745630",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "ssl_certificates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2812878347",
+                "max": 0,
+                "min": 0,
+                "name": "domain",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2910474005",
+                "max": 0,
+                "min": 0,
+                "name": "issuer_o",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2857577546",
+                "max": "",
+                "min": "",
+                "name": "last_notified",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number2281365985",
+                "max": null,
+                "min": null,
+                "name": "warning_threshold",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number219021052",
+                "max": null,
+                "min": null,
+                "name": "expiry_threshold",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3085370608",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2077745078",
+                "max": "",
+                "min": "",
+                "name": "valid_from",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number227839714",
+                "max": null,
+                "min": null,
+                "name": "serial_number",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2790380089",
+                "max": 0,
+                "min": 0,
+                "name": "issued_to",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date3449712486",
+                "max": "",
+                "min": "",
+                "name": "valid_till",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number1533826704",
+                "max": null,
+                "min": null,
+                "name": "validity_days",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number4007784154",
+                "max": null,
+                "min": null,
+                "name": "days_left",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "number437829758",
+                "max": null,
+                "min": null,
+                "name": "valid_days_to_expire",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3452125334",
+                "max": 0,
+                "min": 0,
+                "name": "resolved_ip",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2712104570",
+                "max": 0,
+                "min": 0,
+                "name": "issuer_cn",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1754636037",
+                "max": 0,
+                "min": 0,
+                "name": "cert_alg",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1208359189",
+                "max": 0,
+                "min": 0,
+                "name": "cert_sans",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4097339557",
+                "max": 0,
+                "min": 0,
+                "name": "check_interval",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2784829323",
+                "max": "",
+                "min": "",
+                "name": "check_at",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1553704459",
+                "max": 0,
+                "min": 0,
+                "name": "webhook_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1753185970",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "ssl_history",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2812878347",
+                "max": 0,
+                "min": 0,
+                "name": "cert_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1881225410",
+                "max": 0,
+                "min": 0,
+                "name": "days_before_expiry",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3062427817",
+                "max": 0,
+                "min": 0,
+                "name": "days_before_warning",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text98176952",
+                "max": 0,
+                "min": 0,
+                "name": "template_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "notification_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select3839288252",
+                "maxSelect": 1,
+                "name": "warning_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "sent",
+                    "pending",
+                    "failed"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select2670434693",
+                "maxSelect": 1,
+                "name": "expiry_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "sent",
+                    "pending",
+                    "failed"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "select3824245652",
+                "maxSelect": 1,
+                "name": "critical_status",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "sent",
+                    "pending",
+                    "failed"
+                ]
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_351174173",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "ssl_notification_templates",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2761878292",
+                "max": 0,
+                "min": 0,
+                "name": "expired",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3025025370",
+                "max": 0,
+                "min": 0,
+                "name": "exiring_soon",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1078893766",
+                "max": 0,
+                "min": 0,
+                "name": "warning",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4011498884",
+                "max": 0,
+                "min": 0,
+                "name": "placeholder",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_1636150439",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "status_page_components",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4053573849",
+                "max": 0,
+                "min": 0,
+                "name": "operational_status_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text407168695",
+                "max": 0,
+                "min": 0,
+                "name": "server_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "number4101605491",
+                "max": null,
+                "min": null,
+                "name": "display_order",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_2331916230",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "tcp_data",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1341404999",
+                "max": 0,
+                "min": 0,
+                "name": "connection",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text926446584",
+                "max": 0,
+                "min": 0,
+                "name": "latency",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2770808759",
+                "max": 0,
+                "min": 0,
+                "name": "port",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2273667377",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text873754891",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_67962705",
+        "listRule": "",
+        "viewRule": "",
+        "createRule": "",
+        "updateRule": "",
+        "deleteRule": "",
+        "name": "uptime_data",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text3982272998",
+                "max": 0,
+                "min": 0,
+                "name": "service_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "date2782324286",
+                "max": "",
+                "min": "",
+                "name": "timestamp",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "date"
+            },
+            {
+                "hidden": false,
+                "id": "number3275068127",
+                "max": null,
+                "min": null,
+                "name": "response_time",
+                "onlyInt": false,
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "number"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2063623452",
+                "max": 0,
+                "min": 0,
+                "name": "status",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1280981898",
+                "max": 0,
+                "min": 0,
+                "name": "packets",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text926446584",
+                "max": 0,
+                "min": 0,
+                "name": "latency",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text318214333",
+                "max": 0,
+                "min": 0,
+                "name": "status_codes",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1519612219",
+                "max": 0,
+                "min": 0,
+                "name": "keyword",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text737763667",
+                "max": 0,
+                "min": 0,
+                "name": "error_message",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1915095946",
+                "max": 0,
+                "min": 0,
+                "name": "details",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text258142582",
+                "max": 0,
+                "min": 0,
+                "name": "region_name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2552627541",
+                "max": 0,
+                "min": 0,
+                "name": "agent_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    },
+    {
+        "id": "pbc_45665081",
+        "listRule": null,
+        "viewRule": null,
+        "createRule": null,
+        "updateRule": null,
+        "deleteRule": null,
+        "name": "webhook",
+        "type": "base",
+        "fields": [
+            {
+                "autogeneratePattern": "[a-z0-9]{15}",
+                "hidden": false,
+                "id": "text3208210256",
+                "max": 15,
+                "min": 15,
+                "name": "id",
+                "pattern": "^[a-z0-9]+$",
+                "presentable": false,
+                "primaryKey": true,
+                "required": true,
+                "system": true,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2809058197",
+                "max": 0,
+                "min": 0,
+                "name": "user_id",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4101391790",
+                "max": 0,
+                "min": 0,
+                "name": "url",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "select1358543748",
+                "maxSelect": 1,
+                "name": "enabled",
+                "presentable": false,
+                "required": false,
+                "system": false,
+                "type": "select",
+                "values": [
+                    "on",
+                    "off"
+                ]
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1554180325",
+                "max": 0,
+                "min": 0,
+                "name": "secret",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text4144189317",
+                "max": 0,
+                "min": 0,
+                "name": "headers",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2129530235",
+                "max": 0,
+                "min": 0,
+                "name": "retry_count",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text2168550802",
+                "max": 0,
+                "min": 0,
+                "name": "trigger_events",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1843675174",
+                "max": 0,
+                "min": 0,
+                "name": "description",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1579384326",
+                "max": 0,
+                "min": 0,
+                "name": "name",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1582905952",
+                "max": 0,
+                "min": 0,
+                "name": "method",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "autogeneratePattern": "",
+                "hidden": false,
+                "id": "text1414600993",
+                "max": 0,
+                "min": 0,
+                "name": "payload_template",
+                "pattern": "",
+                "presentable": false,
+                "primaryKey": false,
+                "required": false,
+                "system": false,
+                "type": "text"
+            },
+            {
+                "hidden": false,
+                "id": "autodate2990389176",
+                "name": "created",
+                "onCreate": true,
+                "onUpdate": false,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            },
+            {
+                "hidden": false,
+                "id": "autodate3332085495",
+                "name": "updated",
+                "onCreate": true,
+                "onUpdate": true,
+                "presentable": false,
+                "system": false,
+                "type": "autodate"
+            }
+        ],
+        "indexes": [],
+        "system": false
+    }
+]
diff --git a/server/pocketbase b/server/pocketbase
new file mode 100755
index 0000000..db9958f
Binary files /dev/null and b/server/pocketbase differ
diff --git a/server/service-operation/.env b/server/service-operation/.env
new file mode 100644
index 0000000..acfcbf0
--- /dev/null
+++ b/server/service-operation/.env
@@ -0,0 +1,16 @@
+
+# Port configuration
+PORT=8091
+
+# Operation defaults
+DEFAULT_COUNT=4
+DEFAULT_TIMEOUT=15s
+MAX_COUNT=20
+MAX_TIMEOUT=30s
+
+# Logging
+ENABLE_LOGGING=true
+
+# PocketBase integration (no authentication required)
+POCKETBASE_ENABLED=true
+POCKETBASE_URL=http://localhost:8090
\ No newline at end of file
diff --git a/server/service-operation/.env.example b/server/service-operation/.env.example
new file mode 100644
index 0000000..17ab128
--- /dev/null
+++ b/server/service-operation/.env.example
@@ -0,0 +1,16 @@
+
+# Port configuration
+PORT=8091
+
+# Operation defaults
+DEFAULT_COUNT=4
+DEFAULT_TIMEOUT=10s
+MAX_COUNT=20
+MAX_TIMEOUT=30s
+
+# Logging
+ENABLE_LOGGING=true
+
+# PocketBase integration (no authentication required)
+POCKETBASE_ENABLED=true
+POCKETBASE_URL=http://localhost:8090
\ No newline at end of file
diff --git a/server/service-operation/README.md b/server/service-operation/README.md
new file mode 100644
index 0000000..16ad691
--- /dev/null
+++ b/server/service-operation/README.md
@@ -0,0 +1,131 @@
+
+# CheckCle Microservice Operation 
+
+A Go-based microservice for service operations including ICMP ping, DNS resolution, and TCP connectivity testing.
+
+## Features
+
+- **ICMP Ping**: Full ping functionality with packet statistics
+- **DNS Resolution**: A, AAAA, MX, and TXT record lookups
+- **TCP Connectivity**: Port connectivity testing
+- **SSL Certificate**: SSL Certificate Check
+- REST API endpoints
+- Health check endpoint
+- Configurable via environment variables
+- Comprehensive operation statistics
+
+## API Endpoints
+
+### POST /operation
+Perform various network operations (ping, dns, tcp).
+
+**Ping Request:**
+```json
+{
+  "type": "ping",
+  "host": "google.com",
+  "count": 4,
+  "timeout": 3
+}
+```
+
+**DNS Request:**
+```json
+{
+  "type": "dns",
+  "host": "google.com",
+  "query": "A",
+  "timeout": 3
+}
+```
+
+**TCP Request:**
+```json
+{
+  "type": "tcp",
+  "host": "google.com",
+  "port": 443,
+  "timeout": 3
+}
+```
+
+**Response:**
+```json
+{
+  "type": "ping",
+  "host": "google.com",
+  "success": true,
+  "response_time": "20ms",
+  "packets_sent": 4,
+  "packets_recv": 4,
+  "packet_loss": 0,
+  "min_rtt": "15ms",
+  "max_rtt": "25ms",
+  "avg_rtt": "20ms",
+  "rtts": ["15ms", "20ms", "25ms", "18ms"],
+  "start_time": "2023-12-01T10:00:00Z",
+  "end_time": "2023-12-01T10:00:03Z"
+}
+```
+
+### GET /operation/quick
+Quick operation test with query parameters.
+
+**Examples:**
+- `/operation/quick?type=ping&host=google.com&count=1`
+- `/operation/quick?type=dns&host=google.com&query=A`
+- `/operation/quick?type=tcp&host=google.com&port=443`
+
+### GET /health
+Health check endpoint.
+
+### Legacy Endpoints
+- `POST /ping` - Legacy ping endpoint (backward compatibility)
+- `GET /ping/quick` - Legacy quick ping endpoint
+
+## Operation Types
+
+### Ping (ICMP)
+- **Type**: `ping`
+- **Parameters**: `host`, `count`, `timeout`
+- **Features**: Packet loss calculation, RTT statistics, multiple packets
+
+### DNS Resolution
+- **Type**: `dns`
+- **Parameters**: `host`, `query` (A, AAAA, MX, TXT), `timeout`
+- **Features**: Multiple record types, resolution time tracking
+
+### TCP Connectivity
+- **Type**: `tcp`
+- **Parameters**: `host`, `port`, `timeout`
+- **Features**: Connection testing, response time measurement
+
+## Configuration
+
+Environment variables:
+
+- `PORT` - Service port (default: 8080)
+- `DEFAULT_COUNT` - Default ping count (default: 4)
+- `DEFAULT_TIMEOUT` - Default timeout (default: 3s)
+- `MAX_COUNT` - Maximum ping count (default: 20)
+- `MAX_TIMEOUT` - Maximum timeout (default: 30s)
+- `ENABLE_LOGGING` - Enable logging (default: true)
+
+## Running
+
+### Local Development
+```bash
+go run main.go
+```
+## Requirements
+
+- Go 1.21+
+- Root privileges for ICMP (on Linux)
+
+## Note
+
+This service requires elevated privileges to send ICMP packets. Run with sudo on Linux systems or use capabilities:
+
+```bash
+sudo setcap cap_net_raw=+ep ./service-operation
+```
diff --git a/server/service-operation/config/config.go b/server/service-operation/config/config.go
new file mode 100644
index 0000000..452952d
--- /dev/null
+++ b/server/service-operation/config/config.go
@@ -0,0 +1,71 @@
+package config
+
+import (
+	"os"
+	"strconv"
+	"time"
+)
+
+type Config struct {
+	Port           string
+	DefaultCount   int
+	DefaultTimeout time.Duration
+	MaxCount       int
+	MaxTimeout     time.Duration
+	EnableLogging  bool
+	
+	// PocketBase configuration (no auth required)
+	PocketBaseEnabled  bool
+	PocketBaseURL      string
+}
+
+func Load() *Config {
+	cfg := &Config{
+		Port:           getEnv("PORT", "8091"),
+		DefaultCount:   getEnvInt("DEFAULT_COUNT", 4),
+		DefaultTimeout: getEnvDuration("DEFAULT_TIMEOUT", 15*time.Second),
+		MaxCount:       getEnvInt("MAX_COUNT", 20),
+		MaxTimeout:     getEnvDuration("MAX_TIMEOUT", 30*time.Second),
+		EnableLogging:  getEnvBool("ENABLE_LOGGING", true),
+		
+		// PocketBase settings (no credentials needed)
+		PocketBaseEnabled:  getEnvBool("POCKETBASE_ENABLED", true),
+		PocketBaseURL:      getEnv("POCKETBASE_URL", ""),
+	}
+
+	return cfg
+}
+
+func getEnv(key, defaultValue string) string {
+	if value := os.Getenv(key); value != "" {
+		return value
+	}
+	return defaultValue
+}
+
+func getEnvInt(key string, defaultValue int) int {
+	if value := os.Getenv(key); value != "" {
+		if intValue, err := strconv.Atoi(value); err == nil {
+			return intValue
+		}
+	}
+	return defaultValue
+}
+
+func getEnvDuration(key string, defaultValue time.Duration) time.Duration {
+	if value := os.Getenv(key); value != "" {
+		if duration, err := time.ParseDuration(value); err == nil {
+			return duration
+		}
+	}
+	return defaultValue
+}
+
+func getEnvBool(key string, defaultValue bool) bool {
+	if value := os.Getenv(key); value != "" {
+		if boolValue, err := strconv.ParseBool(value); err == nil {
+			return boolValue
+		}
+	}
+	return defaultValue
+}
\ No newline at end of file
diff --git a/server/service-operation/data-retention/handler.go b/server/service-operation/data-retention/handler.go
new file mode 100644
index 0000000..514db3d
--- /dev/null
+++ b/server/service-operation/data-retention/handler.go
@@ -0,0 +1,59 @@
+package dataretention
+
+import (
+	"encoding/json"
+	"net/http"
+	"service-operation/pocketbase"
+)
+
+// Handler handles HTTP requests for data retention operations
+type Handler struct {
+	service *Service
+}
+
+// NewHandler creates a new data retention handler
+func NewHandler(pbClient *pocketbase.PocketBaseClient) *Handler {
+	return &Handler{
+		service: NewService(pbClient),
+	}
+}
+
+// GetSettings handles GET requests for data retention settings
+func (h *Handler) GetSettings(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	settings, err := h.service.GetDataSettings()
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(settings)
+}
+
+// TriggerCleanup handles POST requests to trigger manual cleanup
+func (h *Handler) TriggerCleanup(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	summary, err := h.service.CleanupOldRecords()
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(summary)
+}
+
+// SetupRoutes sets up the HTTP routes for data retention
+func (h *Handler) SetupRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("/data-retention/settings", h.GetSettings)
+	mux.HandleFunc("/data-retention/cleanup", h.TriggerCleanup)
+}
\ No newline at end of file
diff --git a/server/service-operation/data-retention/scheduler.go b/server/service-operation/data-retention/scheduler.go
new file mode 100644
index 0000000..a064cee
--- /dev/null
+++ b/server/service-operation/data-retention/scheduler.go
@@ -0,0 +1,63 @@
+package dataretention
+
+import (
+	"service-operation/pocketbase"
+	"time"
+)
+
+// Scheduler handles periodic data retention cleanup
+type Scheduler struct {
+	service  *Service
+	interval time.Duration
+	stopChan chan bool
+}
+
+// NewScheduler creates a new cleanup scheduler
+func NewScheduler(pbClient *pocketbase.PocketBaseClient, interval time.Duration) *Scheduler {
+	return &Scheduler{
+		service:  NewService(pbClient),
+		interval: interval,
+		stopChan: make(chan bool),
+	}
+}
+
+// Start begins the periodic cleanup process
+func (s *Scheduler) Start() {
+	// log.Printf("Starting data retention scheduler with interval: %v", s.interval)
+	
+	ticker := time.NewTicker(s.interval)
+	defer ticker.Stop()
+
+	// Run initial cleanup
+	go func() {
+		if err := s.service.ScheduleCleanup(); err != nil {
+			// log.Printf("Initial cleanup failed: %v", err)
+		}
+	}()
+
+	for {
+		select {
+		case <-ticker.C:
+			go func() {
+				if err := s.service.ScheduleCleanup(); err != nil {
+					// log.Printf("Scheduled cleanup failed: %v", err)
+				}
+			}()
+		case <-s.stopChan:
+			// log.Println("Data retention scheduler stopped")
+			return
+		}
+	}
+}
+
+// Stop stops the scheduler
+func (s *Scheduler) Stop() {
+	// log.Println("Stopping data retention scheduler...")
+	s.stopChan <- true
+}
+
+// RunOnce executes cleanup immediately (for manual triggers)
+func (s *Scheduler) RunOnce() (*CleanupSummary, error) {
+	// log.Println("Running manual data retention cleanup...")
+	return s.service.CleanupOldRecords()
+}
\ No newline at end of file
diff --git a/server/service-operation/data-retention/service.go b/server/service-operation/data-retention/service.go
new file mode 100644
index 0000000..75e224c
--- /dev/null
+++ b/server/service-operation/data-retention/service.go
@@ -0,0 +1,398 @@
+package dataretention
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"service-operation/pocketbase"
+	"sync"
+	"time"
+)
+
+// Service handles data retention operations
+type Service struct {
+	pbClient *pocketbase.PocketBaseClient
+}
+
+// NewService creates a new data retention service
+func NewService(pbClient *pocketbase.PocketBaseClient) *Service {
+	return &Service{
+		pbClient: pbClient,
+	}
+}
+
+// GetDataSettings fetches the current data retention settings
+func (s *Service) GetDataSettings() (*DataSettings, error) {
+	resp, err := s.pbClient.GetHTTPClient().Get(
+		fmt.Sprintf("%s/api/collections/data_settings/records", s.pbClient.GetBaseURL()),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch data settings: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to fetch data settings, status: %d", resp.StatusCode)
+	}
+
+	var response DataSettingsResponse
+	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
+		return nil, fmt.Errorf("failed to decode data settings response: %w", err)
+	}
+
+	if len(response.Items) == 0 {
+		return nil, fmt.Errorf("no data settings found")
+	}
+
+	return &response.Items[0], nil
+}
+
+// CleanupOldRecords performs cleanup of old records based on retention settings
+func (s *Service) CleanupOldRecords() (*CleanupSummary, error) {
+	startTime := time.Now()
+	
+	settings, err := s.GetDataSettings()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get data settings: %w", err)
+	}
+
+	// Check if cleanup should run (only once per day)
+	if !s.shouldRunCleanup(settings) {
+		// log.Println("Skipping cleanup - less than 24 hours since last run")
+		return &CleanupSummary{
+			StartTime: startTime,
+			EndTime:   time.Now(),
+			Duration:  0,
+			Results:   make([]CleanupResult, 0),
+		}, nil
+	}
+
+	summary := &CleanupSummary{
+		StartTime: startTime,
+		Results:   make([]CleanupResult, 0),
+	}
+
+	// Define collections and their corresponding retention days
+	uptimeCollections := []string{"dns_data", "ping_data", "tcp_data", "uptime_data", "services_metrics"}
+	serverCollections := []string{"server_metrics", "docker_metrics"}
+
+	// Process collections in parallel for better performance
+	var wg sync.WaitGroup
+	resultsChan := make(chan CleanupResult, len(uptimeCollections)+len(serverCollections))
+
+	// Cleanup uptime-related collections in parallel
+	if settings.UptimeRetentionDays > 0 {
+		cutoffDate := time.Now().AddDate(0, 0, -settings.UptimeRetentionDays)
+		// log.Printf("Cleaning uptime collections with %d days retention (cutoff: %s)", 
+		//	settings.UptimeRetentionDays, cutoffDate.Format("2006-01-02 15:04:05"))
+		for _, collection := range uptimeCollections {
+			wg.Add(1)
+			go func(col string) {
+				defer wg.Done()
+				result := s.cleanupCollection(col, cutoffDate)
+				resultsChan <- result
+			}(collection)
+		}
+	} else {
+		// log.Println("Skipping uptime collections cleanup - retention days is 0")
+	}
+
+	// Cleanup server-related collections in parallel
+	if settings.ServerRetentionDays > 0 {
+		cutoffDate := time.Now().AddDate(0, 0, -settings.ServerRetentionDays)
+		// log.Printf("Cleaning server collections with %d days retention (cutoff: %s)", 
+		//	settings.ServerRetentionDays, cutoffDate.Format("2006-01-02 15:04:05"))
+		for _, collection := range serverCollections {
+			wg.Add(1)
+			go func(col string) {
+				defer wg.Done()
+				result := s.cleanupCollection(col, cutoffDate)
+				resultsChan <- result
+			}(collection)
+		}
+	} else {
+		// log.Println("Skipping server collections cleanup - retention days is 0")
+	}
+
+	// Wait for all collections to complete and collect results
+	go func() {
+		wg.Wait()
+		close(resultsChan)
+	}()
+
+	// Collect all results
+	for result := range resultsChan {
+		summary.Results = append(summary.Results, result)
+		summary.TotalDeleted += result.RecordsDeleted
+	}
+
+	summary.EndTime = time.Now()
+	summary.Duration = summary.EndTime.Sub(summary.StartTime)
+
+	// Update last cleanup time after successful completion
+	if err := s.updateLastCleanupTime(); err != nil {
+		// log.Printf("Warning: Failed to update last cleanup time: %v", err)
+	}
+
+	// log.Printf("Data retention cleanup completed. Total records deleted: %d, Duration: %v", 
+	//	summary.TotalDeleted, summary.Duration)
+
+	return summary, nil
+}
+
+// cleanupCollection deletes records older than the cutoff date from a specific collection
+func (s *Service) cleanupCollection(collection string, cutoffDate time.Time) CleanupResult {
+	result := CleanupResult{
+		Collection: collection,
+	}
+
+	// Format cutoff date for PocketBase filter (RFC3339 format)
+	cutoffStr := cutoffDate.UTC().Format("2006-01-02T15:04:05.000Z")
+	
+	// Get records to delete (balanced batch size for performance vs rate limits)
+	batchSize := 50
+	totalDeleted := 0
+
+	for {
+		// Always fetch page 1 since we're deleting records (pagination shifts after deletes)
+		filter := fmt.Sprintf("created < '%s'", cutoffStr)
+		encodedFilter := url.QueryEscape(filter)
+		requestURL := fmt.Sprintf("%s/api/collections/%s/records?page=1&perPage=%d&filter=%s",
+			s.pbClient.GetBaseURL(), collection, batchSize, encodedFilter)
+
+		resp, err := s.pbClient.GetHTTPClient().Get(requestURL)
+		if err != nil {
+			result.Error = fmt.Sprintf("failed to fetch records: %v", err)
+			return result
+		}
+		defer resp.Body.Close()
+
+		// Check if response is successful
+		if resp.StatusCode != http.StatusOK {
+			result.Error = fmt.Sprintf("API request failed with status %d for collection %s", resp.StatusCode, collection)
+			return result
+		}
+
+		var response struct {
+			Items []struct {
+				ID string `json:"id"`
+			} `json:"items"`
+			TotalItems int `json:"totalItems"`
+		}
+
+		if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
+			result.Error = fmt.Sprintf("failed to decode response for collection %s: %v", collection, err)
+			return result
+		}
+
+		if len(response.Items) == 0 {
+			// log.Printf("No more old records found in collection %s", collection)
+			break // No more records to delete
+		}
+
+		// log.Printf("Found %d old records in collection %s (batch), total items in DB: %d", 
+		//	len(response.Items), collection, response.TotalItems)
+
+		// Delete records with conservative rate limiting to avoid 429 errors
+		semaphore := make(chan struct{}, 3) // Further reduced to 3 concurrent deletes
+		var deleteWg sync.WaitGroup
+		var mu sync.Mutex
+		batchDeleted := 0
+		rateLimitHit := false
+
+		for _, record := range response.Items {
+			deleteWg.Add(1)
+			go func(recordID string) {
+				defer deleteWg.Done()
+				semaphore <- struct{}{} // Acquire
+				defer func() { <-semaphore }() // Release
+
+				deleted := false
+				retryCount := 0
+				maxRetries := 5
+				
+				for !deleted && retryCount < maxRetries {
+					if err := s.deleteRecord(collection, recordID); err != nil {
+						if retryCount < maxRetries-1 {
+							// Progressive backoff with longer delays for rate limits
+							baseWait := time.Duration(1<<retryCount) * 500 * time.Millisecond
+							if retryCount >= 2 {
+								// Extra penalty for persistent rate limits
+								baseWait += time.Duration(retryCount) * 2 * time.Second
+							}
+							
+							mu.Lock()
+							rateLimitHit = true
+							mu.Unlock()
+							
+							time.Sleep(baseWait)
+							retryCount++
+							continue
+						} else {
+							// log.Printf("Failed to delete record %s from %s after %d retries: %v", 
+							//	recordID, collection, maxRetries, err)
+							break
+						}
+					} else {
+						deleted = true
+						mu.Lock()
+						batchDeleted++
+						mu.Unlock()
+					}
+				}
+				
+				// Increased delay between deletions with adaptive timing
+				mu.Lock()
+				currentRateLimitHit := rateLimitHit
+				mu.Unlock()
+				
+				if currentRateLimitHit {
+					time.Sleep(150 * time.Millisecond) // Longer delay if rate limits detected
+				} else {
+					time.Sleep(75 * time.Millisecond)  // Standard delay
+				}
+			}(record.ID)
+		}
+
+		deleteWg.Wait()
+		totalDeleted += batchDeleted
+
+		// If we got fewer records than batch size, we're done
+		if len(response.Items) < batchSize {
+			// log.Printf("Finished processing collection %s - no more old records", collection)
+			break
+		}
+		
+		// More conservative delay between batches with adaptive timing
+		if len(response.Items) > 0 {
+			mu.Lock()
+			currentRateLimitHit := rateLimitHit
+			mu.Unlock()
+			
+			baseDelay := 300 * time.Millisecond
+			if currentRateLimitHit {
+				baseDelay = 1 * time.Second // Much longer delay if rate limits were hit
+				// log.Printf("Processed batch for collection %s (%d deleted), rate limits detected - waiting longer before next batch...", collection, batchDeleted)
+			} else {
+				// log.Printf("Processed batch for collection %s (%d deleted), processing next batch...", collection, batchDeleted)
+			}
+			
+			time.Sleep(baseDelay)
+		}
+	}
+
+	result.RecordsDeleted = totalDeleted
+	
+	if totalDeleted > 0 {
+		// log.Printf("Deleted %d records from collection %s", totalDeleted, collection)
+	}
+
+	return result
+}
+
+// deleteRecord deletes a single record from a collection
+func (s *Service) deleteRecord(collection, recordID string) error {
+	requestURL := fmt.Sprintf("%s/api/collections/%s/records/%s", s.pbClient.GetBaseURL(), collection, recordID)
+	
+	req, err := http.NewRequest("DELETE", requestURL, nil)
+	if err != nil {
+		return err
+	}
+
+	resp, err := s.pbClient.GetHTTPClient().Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusNoContent && resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to delete record, status: %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// ScheduleCleanup runs cleanup based on schedule (can be called periodically)
+func (s *Service) ScheduleCleanup() error {
+	// log.Println("Starting scheduled data retention cleanup...")
+	
+	_, err := s.CleanupOldRecords()
+	if err != nil {
+		// log.Printf("Scheduled cleanup failed: %v", err)
+		return err
+	}
+
+	// log.Printf("Scheduled cleanup completed successfully. Summary: %+v", summary)
+	return nil
+}
+
+// shouldRunCleanup checks if cleanup should run based on last cleanup time (once per day)
+func (s *Service) shouldRunCleanup(settings *DataSettings) bool {
+	if settings.LastCleanup == "" {
+		// log.Println("No previous cleanup found, proceeding with cleanup...")
+		return true
+	}
+
+	lastCleanup, err := time.Parse(time.RFC3339, settings.LastCleanup)
+	if err != nil {
+		// log.Printf("Failed to parse last cleanup time '%s', proceeding with cleanup: %v", settings.LastCleanup, err)
+		return true
+	}
+
+	timeSinceLastCleanup := time.Since(lastCleanup)
+	minInterval := 24 * time.Hour
+
+	if timeSinceLastCleanup < minInterval {
+		// log.Printf("Last cleanup was %v ago (less than 24h), skipping cleanup", timeSinceLastCleanup)
+		return false
+	}
+
+	// log.Printf("Last cleanup was %v ago, proceeding with cleanup", timeSinceLastCleanup)
+	return true
+}
+
+// updateLastCleanupTime updates the last cleanup timestamp in data settings
+func (s *Service) updateLastCleanupTime() error {
+	settings, err := s.GetDataSettings()
+	if err != nil {
+		return fmt.Errorf("failed to get data settings: %w", err)
+	}
+
+	// Update the last cleanup time
+	now := time.Now().UTC().Format(time.RFC3339)
+	
+	// Create the update payload
+	updateData := map[string]interface{}{
+		"last_cleanup": now,
+	}
+
+	jsonData, err := json.Marshal(updateData)
+	if err != nil {
+		return fmt.Errorf("failed to marshal update data: %w", err)
+	}
+
+	// Update the record via PocketBase API
+	requestURL := fmt.Sprintf("%s/api/collections/data_settings/records/%s", s.pbClient.GetBaseURL(), settings.ID)
+	
+	req, err := http.NewRequest("PATCH", requestURL, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return fmt.Errorf("failed to create update request: %w", err)
+	}
+	
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := s.pbClient.GetHTTPClient().Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to update last cleanup time: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to update last cleanup time, status: %d", resp.StatusCode)
+	}
+
+	// log.Printf("Updated last cleanup time to: %s", now)
+	return nil
+}
\ No newline at end of file
diff --git a/server/service-operation/data-retention/types.go b/server/service-operation/data-retention/types.go
new file mode 100644
index 0000000..7ebdb1c
--- /dev/null
+++ b/server/service-operation/data-retention/types.go
@@ -0,0 +1,42 @@
+package dataretention
+
+import "time"
+
+// DataSettings represents the data retention configuration from PocketBase
+type DataSettings struct {
+	ID                    string `json:"id"`
+	CollectionId          string `json:"collectionId"`
+	CollectionName        string `json:"collectionName"`
+	RetentionDays         int    `json:"retention_days"`
+	ServerRetentionDays   int    `json:"server_retention_days"`
+	UptimeRetentionDays   int    `json:"uptime_retention_days"`
+	LastCleanup           string `json:"last_cleanup"`
+	Backup                string `json:"backup"`
+	Created               string `json:"created"`
+	Updated               string `json:"updated"`
+}
+
+// DataSettingsResponse represents the response from PocketBase
+type DataSettingsResponse struct {
+	Items      []DataSettings `json:"items"`
+	Page       int            `json:"page"`
+	PerPage    int            `json:"perPage"`
+	TotalItems int            `json:"totalItems"`
+	TotalPages int            `json:"totalPages"`
+}
+
+// CleanupResult represents the result of a cleanup operation
+type CleanupResult struct {
+	Collection     string `json:"collection"`
+	RecordsDeleted int    `json:"records_deleted"`
+	Error          string `json:"error,omitempty"`
+}
+
+// CleanupSummary represents the overall cleanup summary
+type CleanupSummary struct {
+	TotalDeleted int             `json:"total_deleted"`
+	Results      []CleanupResult `json:"results"`
+	StartTime    time.Time       `json:"start_time"`
+	EndTime      time.Time       `json:"end_time"`
+	Duration     time.Duration   `json:"duration"`
+}
\ No newline at end of file
diff --git a/server/service-operation/go.mod b/server/service-operation/go.mod
new file mode 100644
index 0000000..eeb5e5c
--- /dev/null
+++ b/server/service-operation/go.mod
@@ -0,0 +1,10 @@
+module service-operation
+
+go 1.21
+
+require (
+	github.com/gorilla/mux v1.8.1
+	golang.org/x/net v0.17.0
+)
+
+require golang.org/x/sys v0.13.0 // indirect
diff --git a/server/service-operation/go.sum b/server/service-operation/go.sum
new file mode 100644
index 0000000..afa7a8f
--- /dev/null
+++ b/server/service-operation/go.sum
@@ -0,0 +1,6 @@
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/server/service-operation/handlers/health_handler.go b/server/service-operation/handlers/health_handler.go
new file mode 100644
index 0000000..7c66df4
--- /dev/null
+++ b/server/service-operation/handlers/health_handler.go
@@ -0,0 +1,21 @@
+
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"time"
+)
+
+func (h *OperationHandler) HandleHealth(w http.ResponseWriter, r *http.Request) {
+	health := map[string]interface{}{
+		"status":    "healthy",
+		"service":   "service-operation",
+		"timestamp": time.Now().Unix(),
+		"version":   "1.0.0",
+		"operations": []string{"ping", "dns", "tcp", "http"},
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(health)
+}
\ No newline at end of file
diff --git a/server/service-operation/handlers/metrics_handler.go b/server/service-operation/handlers/metrics_handler.go
new file mode 100644
index 0000000..52bb09a
--- /dev/null
+++ b/server/service-operation/handlers/metrics_handler.go
@@ -0,0 +1,12 @@
+
+package handlers
+
+import (
+	"service-operation/shared/savers"
+	"service-operation/types"
+)
+
+func (h *OperationHandler) saveMetricsToPocketBase(result *types.OperationResult, serviceID string) {
+	metricsSaver := savers.NewMetricsSaver(h.pbClient)
+	metricsSaver.SaveMetricsToPocketBase(result, serviceID)
+}
\ No newline at end of file
diff --git a/server/service-operation/handlers/operation.go b/server/service-operation/handlers/operation.go
new file mode 100644
index 0000000..af96744
--- /dev/null
+++ b/server/service-operation/handlers/operation.go
@@ -0,0 +1,19 @@
+
+package handlers
+
+import (
+	"service-operation/config"
+	"service-operation/pocketbase"
+)
+
+type OperationHandler struct {
+	config   *config.Config
+	pbClient *pocketbase.PocketBaseClient
+}
+
+func NewOperationHandler(cfg *config.Config, pbClient *pocketbase.PocketBaseClient) *OperationHandler {
+	return &OperationHandler{
+		config:   cfg,
+		pbClient: pbClient,
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/handlers/operation_handler.go b/server/service-operation/handlers/operation_handler.go
new file mode 100644
index 0000000..1666c85
--- /dev/null
+++ b/server/service-operation/handlers/operation_handler.go
@@ -0,0 +1,108 @@
+
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"service-operation/operations"
+	"service-operation/types"
+)
+
+func (h *OperationHandler) HandleOperation(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	var req types.OperationRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid JSON payload", http.StatusBadRequest)
+		return
+	}
+
+	if req.Host == "" && req.URL == "" {
+		http.Error(w, "Host or URL is required", http.StatusBadRequest)
+		return
+	}
+
+	// Set defaults
+	if req.Count <= 0 {
+		req.Count = h.config.DefaultCount
+	}
+	if req.Count > h.config.MaxCount {
+		req.Count = h.config.MaxCount
+	}
+
+	if req.Timeout <= 0 {
+		req.Timeout = int(h.config.DefaultTimeout.Seconds())
+	}
+	if time.Duration(req.Timeout)*time.Second > h.config.MaxTimeout {
+		req.Timeout = int(h.config.MaxTimeout.Seconds())
+	}
+
+	timeout := time.Duration(req.Timeout) * time.Second
+	var result *types.OperationResult
+	var err error
+
+	switch req.Type {
+	case types.OperationPing:
+		pingOp := operations.NewPingOperation(timeout)
+		result, err = pingOp.Execute(req.Host, req.Count)
+		
+	case types.OperationDNS:
+		dnsOp := operations.NewDNSOperation(timeout)
+		query := req.Query
+		if query == "" {
+			query = "A"
+		}
+		result, err = dnsOp.Execute(req.Host, query)
+		
+	case types.OperationTCP:
+		if req.Port <= 0 {
+			http.Error(w, "Port is required for TCP operations", http.StatusBadRequest)
+			return
+		}
+		tcpOp := operations.NewTCPOperation(timeout)
+		result, err = tcpOp.Execute(req.Host, req.Port)
+		
+	case types.OperationHTTP:
+		httpOp := operations.NewHTTPOperation(timeout)
+		url := req.URL
+		if url == "" {
+			url = req.Host
+		}
+		method := req.Method
+		if method == "" {
+			method = "GET"
+		}
+		result, err = httpOp.Execute(url, method)
+		
+	case types.OperationSSL:
+		sslOp := operations.NewSSLOperation(timeout)
+		result, err = sslOp.Execute(req.Host)
+		
+	default:
+		http.Error(w, "Invalid operation type", http.StatusBadRequest)
+		return
+	}
+
+	if err != nil {
+		result = &types.OperationResult{
+			Type:    req.Type,
+			Host:    req.Host,
+			Port:    req.Port,
+			Success: false,
+			Error:   err.Error(),
+		}
+	}
+
+	// Save metrics to PocketBase if available
+	if h.pbClient != nil && h.pbClient.IsAuthenticated() {
+		go h.saveMetricsToPocketBase(result, req.ServiceID)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(result)
+}
\ No newline at end of file
diff --git a/server/service-operation/handlers/quick_operation_handler.go b/server/service-operation/handlers/quick_operation_handler.go
new file mode 100644
index 0000000..0ee7d25
--- /dev/null
+++ b/server/service-operation/handlers/quick_operation_handler.go
@@ -0,0 +1,67 @@
+
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+
+	"service-operation/types"
+)
+
+func (h *OperationHandler) HandleQuickOperation(w http.ResponseWriter, r *http.Request) {
+	opType := r.URL.Query().Get("type")
+	host := r.URL.Query().Get("host")
+	
+	if host == "" || opType == "" {
+		http.Error(w, "Type and host parameters are required", http.StatusBadRequest)
+		return
+	}
+
+	req := types.OperationRequest{
+		Type: types.OperationType(opType),
+		Host: host,
+	}
+
+	// Parse optional parameters
+	if countStr := r.URL.Query().Get("count"); countStr != "" {
+		if c, err := strconv.Atoi(countStr); err == nil && c > 0 && c <= h.config.MaxCount {
+			req.Count = c
+		}
+	}
+
+	if portStr := r.URL.Query().Get("port"); portStr != "" {
+		if p, err := strconv.Atoi(portStr); err == nil && p > 0 && p <= 65535 {
+			req.Port = p
+		}
+	}
+
+	if query := r.URL.Query().Get("query"); query != "" {
+		req.Query = query
+	}
+
+	if url := r.URL.Query().Get("url"); url != "" {
+		req.URL = url
+	}
+
+	if method := r.URL.Query().Get("method"); method != "" {
+		req.Method = method
+	}
+
+	if serviceID := r.URL.Query().Get("service_id"); serviceID != "" {
+		req.ServiceID = serviceID
+	}
+
+	// Forward to main handler
+	reqBody, _ := json.Marshal(req)
+	r.Body = http.NoBody
+	r.Method = http.MethodPost
+	r.Header.Set("Content-Type", "application/json")
+
+	// Create a new request with the body
+	newReq := r.Clone(r.Context())
+	newReq.Body = http.NoBody
+	newReq.ContentLength = int64(len(reqBody))
+
+	h.HandleOperation(w, newReq)
+}
\ No newline at end of file
diff --git a/server/service-operation/handlers/utils.go b/server/service-operation/handlers/utils.go
new file mode 100644
index 0000000..116731b
--- /dev/null
+++ b/server/service-operation/handlers/utils.go
@@ -0,0 +1,45 @@
+
+package handlers
+
+import (
+	"encoding/json"
+
+	"service-operation/types"
+)
+
+func getStatusString(success bool) string {
+	if success {
+		return "up"
+	}
+	return "down"
+}
+
+func formatResultDetails(result *types.OperationResult) string {
+	details := map[string]interface{}{
+		"type":          result.Type,
+		"response_time": result.ResponseTime,
+		"start_time":    result.StartTime,
+		"end_time":      result.EndTime,
+	}
+
+	// Add type-specific details
+	switch result.Type {
+	case types.OperationPing:
+		details["packets_sent"] = result.PacketsSent
+		details["packets_recv"] = result.PacketsRecv
+		details["packet_loss"] = result.PacketLoss
+		details["avg_rtt"] = result.AvgRTT
+	case types.OperationHTTP:
+		details["status_code"] = result.HTTPStatusCode
+		details["method"] = result.HTTPMethod
+		details["content_length"] = result.ContentLength
+	case types.OperationTCP:
+		details["tcp_connected"] = result.TCPConnected
+	case types.OperationDNS:
+		details["dns_records"] = result.DNSRecords
+		details["dns_type"] = result.DNSType
+	}
+
+	jsonData, _ := json.Marshal(details)
+	return string(jsonData)
+}
\ No newline at end of file
diff --git a/server/service-operation/main.go b/server/service-operation/main.go
new file mode 100644
index 0000000..37999aa
--- /dev/null
+++ b/server/service-operation/main.go
@@ -0,0 +1,183 @@
+package main
+
+import (
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/gorilla/mux"
+	"service-operation/config"
+	"service-operation/handlers"
+	"service-operation/monitoring"
+	"service-operation/pocketbase"
+	servermonitoring "service-operation/server-monitoring"
+	sslmonitoring "service-operation/ssl-monitoring"
+	uptimemonitoring "service-operation/uptime-monitoring"
+	dataretention "service-operation/data-retention"
+)
+
+func main() {
+	//log.Println("🚀 === STARTING SERVICE OPERATION SERVER ===")
+	
+	cfg := config.Load()
+	//log.Printf("📋 Configuration loaded:")
+	//log.Printf("  - Port: %s", cfg.Port)
+	//log.Printf("  - Backend PB Enabled: %t", cfg.PocketBaseEnabled)
+	if cfg.PocketBaseEnabled {
+		//log.Printf("  - PocketBase URL: %s", cfg.PocketBaseURL)
+	}
+	
+	// Initialize PocketBase client (no credentials required)
+	var pbClient *pocketbase.PocketBaseClient
+	var monitoringService *monitoring.MonitoringService
+	var sslMonitoringService *monitoring.SSLMonitoringService
+	var sslNotificationService *sslmonitoring.SSLMonitor
+	var serverMonitoringService *servermonitoring.ServerMonitoringService
+	var uptimeMonitoringService *uptimemonitoring.UptimeMonitor
+	var dataRetentionScheduler *dataretention.Scheduler
+	
+	if cfg.PocketBaseEnabled {
+		//log.Println("🔧 Initializing PocketBase client...")
+		var err error
+		pbClient, err = pocketbase.NewPocketBaseClient(cfg.PocketBaseURL)
+		if err != nil {
+			//log.Printf("⚠️  WARNING: Failed to initialize PocketBase client: %v", err)
+		} else {
+			//log.Println("✅ PocketBase client initialized successfully")
+			
+			//log.Println("🔍 Testing PocketBase connection...")
+			if err := pbClient.TestConnection(); err != nil {
+				//log.Printf("⚠️  WARNING: PocketBase connection test failed: %v", err)
+			} else {
+				//log.Println("✅ PocketBase connection test successful")
+				
+				// Initialize and start service monitoring with regional support
+				//log.Println("🔧 Initializing service monitoring...")
+				monitoringService = monitoring.NewMonitoringService(pbClient)
+				go monitoringService.Start()
+				//log.Println("✅ Service monitoring started with regional agent support")
+				
+				// Initialize and start SSL monitoring service (original)
+				//log.Println("🔧 Initializing SSL monitoring (original)...")
+				sslMonitoringService = monitoring.NewSSLMonitoringService(pbClient)
+				go sslMonitoringService.Start()
+				//log.Println("✅ SSL monitoring started (independent of regional agents)")
+				
+				// Initialize and start SSL notification service (new)
+				//log.Println("🔧 Initializing SSL notification monitoring...")
+				sslNotificationService = sslmonitoring.NewSSLMonitor(pbClient)
+				go sslNotificationService.Start()
+				//log.Println("✅ SSL notification monitoring started with Telegram support")
+				
+				// Initialize and start server monitoring service
+				//log.Println("🔧 Initializing server monitoring...")
+				serverMonitoringService = servermonitoring.NewServerMonitoringService(pbClient)
+				serverMonitoringService.Start()
+				//log.Println("✅ Server monitoring started with notification support")
+				
+				// Initialize and start uptime monitoring service
+				//log.Println("🔧 Initializing uptime monitoring...")
+				uptimeMonitoringService = uptimemonitoring.NewUptimeMonitor(pbClient)
+				go uptimeMonitoringService.Start()
+				//log.Println("✅ Uptime monitoring started with notification support")
+
+				// Initialize and start data retention scheduler
+				//log.Println("🔧 Initializing data retention scheduler...")
+				dataRetentionScheduler = dataretention.NewScheduler(pbClient, 24*time.Hour) // Run daily
+				go dataRetentionScheduler.Start()
+				//log.Println("✅ Data retention scheduler started (daily cleanup)")
+			}
+		}
+	}
+	
+	//log.Println("🔧 Initializing HTTP handlers...")
+	handler := handlers.NewOperationHandler(cfg, pbClient)
+
+	router := mux.NewRouter()
+
+	// Main operation endpoint
+	router.HandleFunc("/operation", handler.HandleOperation).Methods("POST")
+	
+	// Quick operation endpoint with query parameters
+	router.HandleFunc("/operation/quick", handler.HandleQuickOperation).Methods("GET")
+	
+	// Legacy ping endpoint for backward compatibility
+	router.HandleFunc("/ping", handler.HandleOperation).Methods("POST")
+	router.HandleFunc("/ping/quick", handler.HandleQuickOperation).Methods("GET")
+	
+	// Health check
+	router.HandleFunc("/health", handler.HandleHealth).Methods("GET")
+
+	log.Printf("=== 🌐 CHECKCLE SERVICE OPERATION SERVER READY ===")
+	log.Printf("🚀 Starting on port %s", cfg.Port)
+	if pbClient != nil {
+		log.Printf("✓Backend integration enabled at %s ", pbClient.GetBaseURL())
+	}
+	if monitoringService != nil {
+		log.Printf("✓Service monitoring enabled with regional agent support")
+	}
+	if sslMonitoringService != nil {
+		//log.Printf("🔒 SSL certificate monitoring enabled (independent)")
+	}
+	if sslNotificationService != nil {
+		log.Printf("✓SSL notification monitoring enabled with Telegram support")
+	}
+	if serverMonitoringService != nil {
+		log.Printf("✓Server monitoring enabled with notification support")
+	}
+	if uptimeMonitoringService != nil {
+		log.Printf("✓Uptime monitoring enabled with notification support")
+	}
+	log.Printf("✓Supported operations: ping, dns, tcp, http, ssl")
+	if dataRetentionScheduler != nil {
+		log.Printf("✓Data retention scheduler enabled (daily cleanup)")
+	}
+	
+
+	// Setup graceful shutdown
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
+	
+	go func() {
+		<-c
+		log.Println("🛑 === GRACEFUL SHUTDOWN INITIATED ===")
+		log.Println("🛑 Shutting down monitoring services...")
+		
+		if monitoringService != nil {
+			log.Println("🛑 Stopping service monitoring...")
+			monitoringService.Stop()
+		}
+		if sslMonitoringService != nil {
+			log.Println("🛑 Stopping SSL monitoring...")
+			sslMonitoringService.Stop()
+		}
+		if sslNotificationService != nil {
+			log.Println("🛑 Stopping SSL notification monitoring...")
+			sslNotificationService.Stop()
+		}
+		if serverMonitoringService != nil {
+			log.Println("🛑 Stopping server monitoring...")
+			serverMonitoringService.Stop()
+		}
+		if uptimeMonitoringService != nil {
+			log.Println("🛑 Stopping uptime monitoring...")
+			uptimeMonitoringService.Stop()
+		}
+		if dataRetentionScheduler != nil {
+			log.Println("🛑 Stopping data retention scheduler...")
+			dataRetentionScheduler.Stop()
+		}
+		
+		log.Println("✅ All services stopped gracefully")
+		log.Println("🛑 === SERVICE OPERATION SERVER STOPPED ===")
+		os.Exit(0)
+	}()
+
+	//log.Println("🌐 HTTP server starting...")
+	if err := http.ListenAndServe(":"+cfg.Port, router); err != nil {
+		log.Fatal("❌ FATAL: Failed to start HTTP server:", err)
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/monitoring/checker.go b/server/service-operation/monitoring/checker.go
new file mode 100644
index 0000000..a7c4a7a
--- /dev/null
+++ b/server/service-operation/monitoring/checker.go
@@ -0,0 +1,123 @@
+
+package monitoring
+
+import (
+	"log"
+	"strings"
+	"time"
+
+	"service-operation/operations"
+	"service-operation/pocketbase"
+	"service-operation/shared/savers"
+	"service-operation/types"
+)
+
+func (ms *MonitoringService) performCheck(service pocketbase.Service) {
+	// First, fetch the latest service status from PocketBase to ensure we have current data
+	latestService, err := ms.pbClient.GetService(service.ID)
+	if err != nil {
+		log.Printf("Failed to fetch latest service status for %s: %v", service.Name, err)
+		return
+	}
+
+	// Respect the service status - don't check paused services
+	if latestService.Status == "paused" {
+		return // Silently skip paused services
+	}
+
+	timeout := 10 * time.Second // Default timeout
+	var result *types.OperationResult
+	
+	serviceType := strings.ToLower(latestService.ServiceType)
+	
+	// Single log message for check start
+	//log.Printf("Checking %s (%s)", latestService.Name, serviceType)
+	
+	switch serviceType {
+	case "ping", "icmp":
+		pingOp := operations.NewPingOperation(timeout)
+		host := latestService.Host
+		if host == "" {
+			host = latestService.URL
+		}
+		result, err = pingOp.Execute(host, 1) // Single ping for monitoring
+		
+	case "dns":
+		dnsOp := operations.NewDNSOperation(timeout)
+		host := latestService.Host
+		if host == "" {
+			host = latestService.Domain
+		}
+		// Default to A record, but could be made configurable
+		queryType := "A"
+		result, err = dnsOp.Execute(host, queryType)
+		
+	case "tcp":
+		tcpOp := operations.NewTCPOperation(timeout)
+		host := latestService.Host
+		if host == "" {
+			host = latestService.URL
+		}
+		port := latestService.Port
+		if port <= 0 {
+			port = 80 // Default port
+		}
+		result, err = tcpOp.Execute(host, port)
+		
+	case "http", "https":
+		httpOp := operations.NewHTTPOperation(timeout)
+		url := latestService.URL
+		if url == "" {
+			url = latestService.Host
+		}
+		result, err = httpOp.Execute(url, "GET")
+		
+	default:
+		log.Printf("Unknown service type: %s for service %s", latestService.ServiceType, latestService.Name)
+		return
+	}
+
+	// Determine status based on result
+	status := "down"
+	errorMessage := ""
+	responseTime := int64(0)
+	
+	if err != nil {
+		errorMessage = err.Error()
+		log.Printf("❌ %s failed: %v", latestService.Name, err)
+	} else if result != nil {
+		responseTime = result.ResponseTime.Milliseconds()
+		if result.Success {
+			status = "up"
+			//log.Printf("✅ %s: %.0fms", latestService.Name, float64(responseTime))
+		} else {
+			status = "down"
+			errorMessage = result.Error
+			log.Printf("❌ %s failed: %s", latestService.Name, errorMessage)
+		}
+	}
+
+	// Only update service status if the service is not paused
+	// Check one more time before updating to prevent race conditions
+	currentService, err := ms.pbClient.GetService(latestService.ID)
+	if err != nil {
+		log.Printf("Failed to verify service status before update for %s: %v", latestService.Name, err)
+		return
+	}
+	
+	if currentService.Status == "paused" {
+		return // Silently skip status update for paused services
+	}
+
+	// Update service status in PocketBase only if not paused
+	if err := ms.pbClient.UpdateServiceStatus(latestService.ID, status, responseTime, errorMessage); err != nil {
+		log.Printf("Failed to update service status for %s: %v", latestService.Name, err)
+	}
+
+	// Save metrics data with regional information
+	if result != nil {
+		regionName, agentID := ms.GetRegionalInfo()
+		metricsSaver := savers.NewMetricsSaverWithRegion(ms.pbClient, regionName, agentID)
+		metricsSaver.SaveMetricsForService(*latestService, result)
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/monitoring/metrics_saver.go b/server/service-operation/monitoring/metrics_saver.go
new file mode 100644
index 0000000..1835e03
--- /dev/null
+++ b/server/service-operation/monitoring/metrics_saver.go
@@ -0,0 +1,33 @@
+
+package monitoring
+
+import (
+	"log"
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+// Simplified metrics saver for basic service status updates only
+func (ms *MonitoringService) saveMetrics(service pocketbase.Service, status string, responseTime int64, errorMessage string) {
+	// Save general metrics using the new structure
+	metrics := pocketbase.MetricsRecord{
+		ServiceName:  service.Name,
+		Host:         service.Host,
+		Uptime:       0, // This would need to be calculated based on your requirements
+		ResponseTime: responseTime,
+		LastChecked:  time.Now().Format(time.RFC3339),
+		Port:         service.Port,
+		ServiceType:  service.ServiceType,
+		Status:       status,
+		ErrorMessage: errorMessage,
+		CheckedAt:    time.Now().Format(time.RFC3339),
+	}
+
+	if err := ms.pbClient.SaveMetrics(metrics); err != nil {
+		log.Printf("Failed to save metrics for %s: %v", service.Name, err)
+	}
+}
+
+// This method is now removed to prevent duplicate saves
+// The shared savers handle everything in SaveMetricsForService
\ No newline at end of file
diff --git a/server/service-operation/monitoring/monitor.go b/server/service-operation/monitoring/monitor.go
new file mode 100644
index 0000000..ccd42d9
--- /dev/null
+++ b/server/service-operation/monitoring/monitor.go
@@ -0,0 +1,52 @@
+
+package monitoring
+
+import (
+	"log"
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+type ServiceMonitor struct {
+	service  pocketbase.Service
+	ticker   *time.Ticker
+	stopChan chan bool
+}
+
+func (ms *MonitoringService) startMonitor(service pocketbase.Service) {
+	if service.HeartbeatInterval <= 0 {
+		service.HeartbeatInterval = 60 // Default to 60 seconds
+	}
+
+	monitor := &ServiceMonitor{
+		service:  service,
+		ticker:   time.NewTicker(time.Duration(service.HeartbeatInterval) * time.Second),
+		stopChan: make(chan bool),
+	}
+
+	ms.activeServices[service.ID] = monitor
+
+	log.Printf("Starting monitor for service: %s (%s)", service.Name, service.ServiceType)
+
+	go func() {
+		// Perform initial check
+		ms.performCheck(service)
+		
+		for {
+			select {
+			case <-monitor.ticker.C:
+				ms.performCheck(service)
+			case <-monitor.stopChan:
+				monitor.ticker.Stop()
+				return
+			}
+		}
+	}()
+}
+
+func (ms *MonitoringService) stopMonitor(serviceID string, monitor *ServiceMonitor) {
+	log.Printf("Stopping monitor for service: %s", serviceID)
+	monitor.stopChan <- true
+	delete(ms.activeServices, serviceID)
+}
\ No newline at end of file
diff --git a/server/service-operation/monitoring/notification_monitor.go b/server/service-operation/monitoring/notification_monitor.go
new file mode 100644
index 0000000..8e4938d
--- /dev/null
+++ b/server/service-operation/monitoring/notification_monitor.go
@@ -0,0 +1,71 @@
+package monitoring
+
+import (
+	"log"
+
+	"service-operation/notification"
+	"service-operation/pocketbase"
+)
+
+// NotificationMonitor handles notification logic for the monitoring service
+type NotificationMonitor struct {
+	notifier     *notification.ServiceNotifier
+	lastStatuses map[string]string // Track last known status for each service
+}
+
+// NewNotificationMonitor creates a new notification monitor
+func NewNotificationMonitor(pbClient *pocketbase.PocketBaseClient) *NotificationMonitor {
+	return &NotificationMonitor{
+		notifier:     notification.NewServiceNotifier(pbClient),
+		lastStatuses: make(map[string]string),
+	}
+}
+
+// CheckAndNotify checks if notification should be sent and sends it
+func (nm *NotificationMonitor) CheckAndNotify(service pocketbase.Service, currentStatus string) {
+	// Skip if no notification configured
+	if service.NotificationID == "" {
+		return
+	}
+
+	// Get last known status
+	lastStatus, exists := nm.lastStatuses[service.ID]
+	
+	// Send notification if:
+	// 1. This is the first check (no previous status)
+	// 2. Status has changed
+	// 3. Service is currently down (always notify for down status)
+	shouldNotify := !exists || lastStatus != currentStatus || currentStatus == "down"
+
+	if shouldNotify {
+		log.Printf("Sending notification for service %s: %s -> %s", service.Name, lastStatus, currentStatus)
+		
+		// Send notification using custom method
+		if err := nm.notifier.NotifyCustom(
+			service.NotificationID,
+			service.TemplateID,
+			service.Name,
+			currentStatus,
+			nm.formatStatusMessage(service, currentStatus),
+		); err != nil {
+			log.Printf("Failed to send notification: %v", err)
+		}
+	}
+
+	// Update last known status
+	nm.lastStatuses[service.ID] = currentStatus
+}
+
+// formatStatusMessage creates a formatted message for the status change
+func (nm *NotificationMonitor) formatStatusMessage(service pocketbase.Service, status string) string {
+	switch status {
+	case "up":
+		return "Service is now operational"
+	case "down":
+		return "Service is currently unavailable"
+	case "warning":
+		return "Service is experiencing issues"
+	default:
+		return "Service status has changed"
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/monitoring/regional_monitor.go b/server/service-operation/monitoring/regional_monitor.go
new file mode 100644
index 0000000..1d49b8e
--- /dev/null
+++ b/server/service-operation/monitoring/regional_monitor.go
@@ -0,0 +1,114 @@
+
+package monitoring
+
+import (
+	"log"
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+type RegionalMonitor struct {
+	pbClient        *pocketbase.PocketBaseClient
+	regionalService *pocketbase.RegionalService
+	isOnline        bool
+	ticker          *time.Ticker
+	stopChan        chan bool
+}
+
+func NewRegionalMonitor(pbClient *pocketbase.PocketBaseClient) *RegionalMonitor {
+	return &RegionalMonitor{
+		pbClient: pbClient,
+		isOnline: false,
+		stopChan: make(chan bool),
+	}
+}
+
+func (rm *RegionalMonitor) Start() {
+	// Get or create the "Default" regional service
+	service, err := rm.pbClient.GetDefaultRegionalService()
+	if err != nil {
+		log.Printf("Warning: Could not get default regional service: %v", err)
+		log.Printf("Regional monitoring will continue with fallback values")
+		// Continue with fallback service
+		service = &pocketbase.RegionalService{
+			ID:              "default",
+			RegionName:      "Default",
+			Status:          "active",
+			AgentID:         "1",
+			AgentIPAddress:  "127.0.0.1",
+			Connection:      "offline",
+			Token:           "default-token",
+		}
+	}
+
+	rm.regionalService = service
+	rm.ticker = time.NewTicker(30 * time.Second) // Check connection every 30 seconds
+
+	// Initial connection status update
+	rm.updateConnectionStatus("online")
+	rm.isOnline = true
+
+	log.Printf("✓Default Regional monitor started for region: %s (Agent ID: %s)", 
+		service.RegionName, service.AgentID)
+
+	go func() {
+		for {
+			select {
+			case <-rm.ticker.C:
+				rm.checkConnection()
+			case <-rm.stopChan:
+				rm.ticker.Stop()
+				return
+			}
+		}
+	}()
+}
+
+func (rm *RegionalMonitor) Stop() {
+	if rm.regionalService != nil {
+		rm.updateConnectionStatus("offline")
+		log.Printf("Regional monitor stopped for region: %s", rm.regionalService.RegionName)
+	}
+	
+	if rm.ticker != nil {
+		rm.ticker.Stop()
+	}
+	
+	rm.stopChan <- true
+}
+
+func (rm *RegionalMonitor) checkConnection() {
+	// Test PocketBase connection to determine if we're online
+	err := rm.pbClient.TestConnection()
+	
+	if err != nil && rm.isOnline {
+		// We were online but now we're offline
+		rm.updateConnectionStatus("offline")
+		rm.isOnline = false
+		log.Printf("Regional agent went offline: %v", err)
+	} else if err == nil && !rm.isOnline {
+		// We were offline but now we're online
+		rm.updateConnectionStatus("online")
+		rm.isOnline = true
+		log.Printf("Regional agent back online")
+	}
+}
+
+func (rm *RegionalMonitor) updateConnectionStatus(status string) {
+	if rm.regionalService == nil {
+		return
+	}
+	
+	if err := rm.pbClient.UpdateRegionalServiceConnection(rm.regionalService.ID, status); err != nil {
+		// Don't log errors for update failures - might be due to collection access issues
+		// log.Printf("Failed to update regional service connection status: %v", err)
+	}
+}
+
+func (rm *RegionalMonitor) GetRegionalInfo() (string, string) {
+	if rm.regionalService == nil {
+		return "Default", "1" // Fallback values
+	}
+	return rm.regionalService.RegionName, rm.regionalService.AgentID
+}
\ No newline at end of file
diff --git a/server/service-operation/monitoring/service.go b/server/service-operation/monitoring/service.go
new file mode 100644
index 0000000..6173c4e
--- /dev/null
+++ b/server/service-operation/monitoring/service.go
@@ -0,0 +1,123 @@
+package monitoring
+
+import (
+	"log"
+	"sync"
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+type MonitoringService struct {
+	pbClient        *pocketbase.PocketBaseClient
+	activeServices  map[string]*ServiceMonitor
+	regionalMonitor *RegionalMonitor
+	mu              sync.RWMutex
+	stopChan        chan bool
+	isRunning       bool
+}
+
+func NewMonitoringService(pbClient *pocketbase.PocketBaseClient) *MonitoringService {
+	return &MonitoringService{
+		pbClient:        pbClient,
+		activeServices:  make(map[string]*ServiceMonitor),
+		regionalMonitor: NewRegionalMonitor(pbClient),
+		stopChan:        make(chan bool),
+		isRunning:       false,
+	}
+}
+
+func (ms *MonitoringService) Start() {
+	ms.mu.Lock()
+	defer ms.mu.Unlock()
+
+	if ms.isRunning {
+		log.Println("Monitoring service is already running")
+		return
+	}
+
+	ms.isRunning = true
+	//log.Println("Starting monitoring service...")
+
+	// Start regional monitoring
+	ms.regionalMonitor.Start()
+
+	// Start monitoring all services from PocketBase
+	go ms.monitoringLoop()
+}
+
+func (ms *MonitoringService) Stop() {
+	ms.mu.Lock()
+	defer ms.mu.Unlock()
+
+	if !ms.isRunning {
+		return
+	}
+
+	log.Println("Stopping monitoring service...")
+	ms.isRunning = false
+	
+	// Stop regional monitoring
+	ms.regionalMonitor.Stop()
+	
+	// Stop all active monitors
+	for serviceID, monitor := range ms.activeServices {
+		ms.stopMonitor(serviceID, monitor)
+	}
+
+	ms.stopChan <- true
+}
+
+func (ms *MonitoringService) GetRegionalInfo() (string, string) {
+	return ms.regionalMonitor.GetRegionalInfo()
+}
+
+func (ms *MonitoringService) monitoringLoop() {
+	ticker := time.NewTicker(30 * time.Second) // Check for new services every 30 seconds
+	defer ticker.Stop()
+
+	// Initial load of services
+	ms.loadAndStartServices()
+
+	for {
+		select {
+		case <-ticker.C:
+			ms.loadAndStartServices()
+		case <-ms.stopChan:
+			return
+		}
+	}
+}
+
+func (ms *MonitoringService) loadAndStartServices() {
+	// Only get services that are NOT paused
+	services, err := ms.pbClient.GetActiveServices()
+	if err != nil {
+		log.Printf("Failed to load services: %v", err)
+		return
+	}
+
+	ms.mu.Lock()
+	defer ms.mu.Unlock()
+
+	// Filter out paused services and start monitoring for active ones
+	activeServiceIDs := make(map[string]bool)
+	for _, service := range services {
+		if service.Status != "paused" {
+			activeServiceIDs[service.ID] = true
+			
+			// Start monitoring if not already active
+			if _, exists := ms.activeServices[service.ID]; !exists {
+				ms.startMonitor(service)
+			}
+		}
+	}
+
+	// Stop monitoring for paused or removed services
+	for serviceID, monitor := range ms.activeServices {
+		if !activeServiceIDs[serviceID] {
+			log.Printf("Stopping monitoring for service %s (paused or removed)", serviceID)
+			ms.stopMonitor(serviceID, monitor)
+		}
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/monitoring/ssl_monitor.go b/server/service-operation/monitoring/ssl_monitor.go
new file mode 100644
index 0000000..0103bd0
--- /dev/null
+++ b/server/service-operation/monitoring/ssl_monitor.go
@@ -0,0 +1,344 @@
+
+package monitoring
+
+import (
+	"fmt"
+	"time"
+
+	"service-operation/operations"
+	"service-operation/pocketbase"
+	"service-operation/types"
+)
+
+type SSLMonitoringService struct {
+	pbClient    *pocketbase.PocketBaseClient
+	stopChan    chan bool
+	retryQueue  map[string]int // Track retry count per certificate
+	maxRetries  int
+}
+
+func NewSSLMonitoringService(pbClient *pocketbase.PocketBaseClient) *SSLMonitoringService {
+	return &SSLMonitoringService{
+		pbClient:   pbClient,
+		stopChan:   make(chan bool),
+		retryQueue: make(map[string]int),
+		maxRetries: 3,
+	}
+}
+
+func (s *SSLMonitoringService) Start() {
+	ticker := time.NewTicker(1 * time.Minute) // Check every minute for scheduling
+	defer ticker.Stop()
+
+	// log.Println("SSL monitoring service started with interval and check_at scheduling")
+
+	for {
+		select {
+		case <-ticker.C:
+			s.checkSSLCertificates()
+		case <-s.stopChan:
+			// log.Println("SSL monitoring service stopped")
+			return
+		}
+	}
+}
+
+func (s *SSLMonitoringService) Stop() {
+	s.stopChan <- true
+}
+
+func (s *SSLMonitoringService) checkSSLCertificates() {
+	// log.Println("Fetching SSL certificates from PocketBase...")
+	
+	certificates, err := s.pbClient.GetSSLCertificates()
+	if err != nil {
+		// log.Printf("Failed to fetch SSL certificates: %v", err)
+		_ = err
+		return
+	}
+
+	// log.Printf("Found %d SSL certificates to check", len(certificates))
+
+	for _, cert := range certificates {
+		if s.shouldCheckCertificate(cert) {
+			go s.checkSingleCertificateWithRetry(cert)
+		}
+	}
+	
+	_ = certificates
+}
+
+func (s *SSLMonitoringService) shouldCheckCertificate(cert types.SSLCertificate) bool {
+	now := time.Now()
+	
+	// Priority 1: Check if check_at is set and is due
+	if cert.CheckAt != "" {
+		if checkAt, err := s.parseFlexibleTime(cert.CheckAt); err == nil {
+			if now.After(checkAt) || now.Equal(checkAt) {
+				// log.Printf("Certificate %s is due for manual check (check_at: %s)", 
+				//	cert.Domain, checkAt.Format("2006-01-02 15:04:05"))
+				_ = checkAt
+				return true
+			} else {
+				// log.Printf("Certificate %s scheduled for later check (check_at: %s)", 
+				//	cert.Domain, checkAt.Format("2006-01-02 15:04:05"))
+				_ = checkAt
+				return false
+			}
+		} else {
+			// log.Printf("Error parsing check_at for %s: %v", cert.Domain, err)
+			_ = err
+		}
+	}
+
+	// Priority 2: Check based on check_interval (in days) from last update
+	if cert.Updated == "" {
+		// log.Printf("Certificate %s has never been checked, scheduling check", cert.Domain)
+		return true
+	}
+
+	// Parse last check time from updated field
+	lastCheck, err := s.parseFlexibleTime(cert.Updated)
+	if err != nil {
+		// log.Printf("Error parsing last check time for %s, scheduling check: %v", cert.Domain, err)
+		_ = err
+		return true
+	}
+
+	// Get check interval in days (default to 1 day if not set or invalid)
+	checkIntervalDays := cert.CheckInterval
+	if checkIntervalDays <= 0 {
+		checkIntervalDays = 1 // Default to 1 day
+	}
+
+	// Adjust check interval based on certificate status for critical certificates
+	adjustedIntervalDays := s.adjustCheckIntervalDays(cert, checkIntervalDays)
+
+	// Calculate next check time based on days
+	nextCheck := lastCheck.Add(time.Duration(adjustedIntervalDays) * 24 * time.Hour)
+	shouldCheck := now.After(nextCheck)
+	
+	if shouldCheck {
+		// log.Printf("Certificate %s is due for interval check (last: %s, interval: %d days)", 
+		//	cert.Domain, lastCheck.Format("2006-01-02 15:04:05"), adjustedIntervalDays)
+		_ = lastCheck
+		_ = adjustedIntervalDays
+	} else {
+		// log.Printf("Certificate %s not due yet (next check: %s, interval: %d days)", 
+		//	cert.Domain, nextCheck.Format("2006-01-02 15:04:05"), adjustedIntervalDays)
+		_ = nextCheck
+		_ = adjustedIntervalDays
+	}
+	
+	return shouldCheck
+}
+
+// parseFlexibleTime tries multiple time formats to parse timestamps
+func (s *SSLMonitoringService) parseFlexibleTime(timeStr string) (time.Time, error) {
+	formats := []string{
+		time.RFC3339,
+		time.RFC3339Nano,
+		"2006-01-02 15:04:05.999Z",       // ISO 8601 with milliseconds (PocketBase format)
+		"2006-01-02 15:04:05.999999Z",    // ISO 8601 with microseconds
+		"2006-01-02 15:04:05Z",           // ISO 8601 without milliseconds
+		"2006-01-02T15:04:05.999Z",       // RFC3339 with milliseconds
+		"2006-01-02T15:04:05.999999Z",    // RFC3339 with microseconds
+		"2006-01-02T15:04:05Z",           // RFC3339 without milliseconds
+		"2006-01-02 15:04:05.999999999 -0700 MST",
+		"2006-01-02 15:04:05.999999 -0700 MST",
+		"2006-01-02 15:04:05 -0700 MST",
+		"2006-01-02 15:04:05.999999999",
+		"2006-01-02 15:04:05.999999",
+		"2006-01-02 15:04:05",
+		"2006-01-02T15:04:05.999999999Z",
+	}
+	
+	for _, format := range formats {
+		if t, err := time.Parse(format, timeStr); err == nil {
+			return t, nil
+		}
+	}
+	
+	return time.Time{}, fmt.Errorf("unable to parse time string: %s", timeStr)
+}
+
+// adjustCheckIntervalDays adjusts the check interval based on certificate status and days left
+func (s *SSLMonitoringService) adjustCheckIntervalDays(cert types.SSLCertificate, defaultIntervalDays int) int {
+	// Check more frequently for certificates that are expiring soon or have errors
+	if cert.DaysLeft <= 7 {
+		return 1 // Check daily for certificates expiring within 7 days
+	} else if cert.DaysLeft <= 30 {
+		// Check every 2 days for certificates expiring within 30 days
+		if defaultIntervalDays > 2 {
+			return 2
+		}
+	} else if cert.Status == "error" {
+		return 1 // Check daily for certificates with errors
+	}
+	
+	return defaultIntervalDays
+}
+
+func (s *SSLMonitoringService) checkSingleCertificateWithRetry(cert types.SSLCertificate) {
+	retryCount := s.retryQueue[cert.ID]
+	
+	// log.Printf("🔍 Checking SSL certificate for domain: %s (attempt %d/%d)", 
+	//	cert.Domain, retryCount+1, s.maxRetries+1)
+	
+	result, err := s.performSSLCheck(cert.Domain)
+	
+	if err != nil && retryCount < s.maxRetries {
+		// Increment retry count and schedule retry
+		s.retryQueue[cert.ID] = retryCount + 1
+		// log.Printf("SSL check failed for %s, will retry (%d/%d): %v", 
+		//	cert.Domain, retryCount+1, s.maxRetries, err)
+		
+		// Schedule retry with exponential backoff
+		go func() {
+			backoffDuration := time.Duration((retryCount + 1) * 30) * time.Second
+			time.Sleep(backoffDuration)
+			s.checkSingleCertificateWithRetry(cert)
+		}()
+		
+		_ = retryCount
+		_ = err
+		return
+	}
+	
+	// Reset retry count on success or max retries reached
+	delete(s.retryQueue, cert.ID)
+	
+	if err != nil {
+		// log.Printf("❌ SSL check failed for domain %s after %d attempts: %v", 
+		//	cert.Domain, s.maxRetries+1, err)
+		s.updateCertificateWithError(cert, err)
+		return
+	}
+
+	// Update certificate with successful results
+	s.updateCertificateWithResults(cert, result)
+}
+
+func (s *SSLMonitoringService) performSSLCheck(domain string) (*types.OperationResult, error) {
+	// log.Printf("Performing SSL check for domain: %s", domain)
+	sslOp := operations.NewSSLOperation(30 * time.Second)
+	result, err := sslOp.Execute(domain)
+	
+	if err != nil {
+		// log.Printf("SSL operation failed for %s: %v", domain, err)
+		_ = err
+		return nil, err
+	}
+	
+	if result == nil {
+		// log.Printf("SSL operation returned nil result for %s", domain)
+		return nil, fmt.Errorf("SSL check returned nil result")
+	}
+	
+	// log.Printf("SSL check completed for %s: success=%v, days_left=%d", 
+	//	domain, result.Success, result.SSLDaysLeft)
+	
+	_ = domain
+	_ = result
+	return result, nil
+}
+
+func (s *SSLMonitoringService) updateCertificateWithError(cert types.SSLCertificate, err error) {
+	// log.Printf("Updating certificate %s with error status", cert.Domain)
+	
+	updateData := map[string]interface{}{
+		"status":       "error",
+		"updated":      time.Now().Format(time.RFC3339),
+		"error_message": err.Error(),
+	}
+	
+	// Calculate next check time based on check_interval (in days) with shorter interval for errors
+	checkIntervalDays := cert.CheckInterval
+	if checkIntervalDays <= 0 {
+		checkIntervalDays = 1
+	}
+	// For errors, check again in half the normal interval (minimum 1 day)
+	errorIntervalDays := checkIntervalDays / 2
+	if errorIntervalDays < 1 {
+		errorIntervalDays = 1
+	}
+	
+	nextCheck := time.Now().Add(time.Duration(errorIntervalDays) * 24 * time.Hour)
+	updateData["check_at"] = nextCheck.Format(time.RFC3339)
+	
+	if updateErr := s.pbClient.UpdateSSLCertificate(cert.ID, updateData); updateErr != nil {
+		// log.Printf("Failed to update SSL certificate %s with error status: %v", cert.ID, updateErr)
+		_ = updateErr
+	} else {
+		// log.Printf("📝 Updated certificate %s with error status (next check in %d days)", 
+		//	cert.Domain, errorIntervalDays)
+		_ = errorIntervalDays
+	}
+	
+	_ = err
+	_ = updateData
+	_ = nextCheck
+}
+
+func (s *SSLMonitoringService) updateCertificateWithResults(cert types.SSLCertificate, result *types.OperationResult) {
+	status := getSSLStatus(result)
+	
+	// log.Printf("Updating certificate %s with results: status=%s, days_left=%d, issuer=%s", 
+	//	cert.Domain, status, result.SSLDaysLeft, result.SSLIssuer)
+	
+	updateData := map[string]interface{}{
+		"status":                 status,
+		"valid_from":            result.SSLValidFrom.Format(time.RFC3339),
+		"valid_till":            result.SSLValidTill.Format(time.RFC3339),
+		"days_left":             result.SSLDaysLeft,
+		"valid_days_to_expire":  result.SSLDaysLeft,
+		"resolved_ip":           result.SSLResolvedIP,
+		"issuer_cn":             result.SSLIssuer,      // Now contains organization name like "Google Trust Services"
+		"issued_to":             result.SSLSubject,     // Now contains organization name
+		"serial_number":         result.SSLSerialNumber,
+		"cert_alg":              result.SSLAlgorithm,
+		"cert_sans":             result.SSLSANs,
+		"updated":               time.Now().Format(time.RFC3339),
+		"error_message":         "", // Clear any previous error
+	}
+
+	// Calculate next check time based on check_interval (in days) and certificate status
+	checkIntervalDays := cert.CheckInterval
+	if checkIntervalDays <= 0 {
+		checkIntervalDays = 1 // Default to 1 day
+	}
+	
+	adjustedIntervalDays := s.adjustCheckIntervalDays(cert, checkIntervalDays)
+	nextCheck := time.Now().Add(time.Duration(adjustedIntervalDays) * 24 * time.Hour)
+	updateData["check_at"] = nextCheck.Format(time.RFC3339)
+
+	if err := s.pbClient.UpdateSSLCertificate(cert.ID, updateData); err != nil {
+		// log.Printf("Failed to update SSL certificate %s: %v", cert.ID, err)
+		_ = err
+	} else {
+		// log.Printf("✅ SSL certificate updated for %s: %s (%d days left, issuer: %s, next check in %d days)", 
+		//	cert.Domain, status, result.SSLDaysLeft, result.SSLIssuer, adjustedIntervalDays)
+		_ = status
+		_ = result
+		_ = adjustedIntervalDays
+	}
+	
+	_ = updateData
+	_ = nextCheck
+}
+
+func getSSLStatus(result *types.OperationResult) string {
+	if !result.Success {
+		return "error"
+	}
+	
+	if result.SSLDaysLeft <= 0 {
+		return "expired"
+	} else if result.SSLDaysLeft <= 7 {
+		return "critical" // Very urgent
+	} else if result.SSLDaysLeft <= 30 {
+		return "expiring_soon"
+	}
+	
+	return "valid"
+}
\ No newline at end of file
diff --git a/server/service-operation/monitoring/utils.go b/server/service-operation/monitoring/utils.go
new file mode 100644
index 0000000..efb79be
--- /dev/null
+++ b/server/service-operation/monitoring/utils.go
@@ -0,0 +1,10 @@
+
+package monitoring
+
+// This file previously contained saveDetailedDataByType which was causing duplicate saves
+// All detailed data saving is now handled by the shared savers in a single place
+// to prevent duplicate records in PocketBase
+
+// The monitoring service now uses only:
+// 1. SaveMetricsForService from shared/savers for complete data saving
+// 2. Direct service status updates for the services table
\ No newline at end of file
diff --git a/server/service-operation/notification/discord.go b/server/service-operation/notification/discord.go
new file mode 100644
index 0000000..54a7dff
--- /dev/null
+++ b/server/service-operation/notification/discord.go
@@ -0,0 +1,214 @@
+
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// DiscordService handles Discord notifications
+type DiscordService struct{}
+
+// NewDiscordService creates a new Discord notification service
+func NewDiscordService() *DiscordService {
+	return &DiscordService{}
+}
+
+// DiscordPayload represents the payload for Discord webhook
+type DiscordPayload struct {
+	Content string         `json:"content,omitempty"`
+	Embeds  []DiscordEmbed `json:"embeds,omitempty"`
+}
+
+// DiscordEmbed represents a Discord embed
+type DiscordEmbed struct {
+	Title       string              `json:"title,omitempty"`
+	Description string              `json:"description,omitempty"`
+	Color       int                 `json:"color,omitempty"`
+	Timestamp   string              `json:"timestamp,omitempty"`
+	Fields      []DiscordEmbedField `json:"fields,omitempty"`
+	Footer      *DiscordEmbedFooter `json:"footer,omitempty"`
+}
+
+// DiscordEmbedField represents a field in Discord embed
+type DiscordEmbedField struct {
+	Name   string `json:"name"`
+	Value  string `json:"value"`
+	Inline bool   `json:"inline,omitempty"`
+}
+
+// DiscordEmbedFooter represents footer in Discord embed
+type DiscordEmbedFooter struct {
+	Text string `json:"text"`
+}
+
+// SendNotification sends a notification via Discord webhook
+func (ds *DiscordService) SendNotification(config *AlertConfiguration, message string) error {
+	if config.DiscordWebhookURL == "" {
+		return fmt.Errorf("discord webhook URL is required")
+	}
+
+	// Create rich embed for better formatting
+	embed := ds.createDiscordEmbed(message)
+	
+	payload := DiscordPayload{
+		Embeds: []DiscordEmbed{embed},
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("failed to marshal Discord payload: %v", err)
+	}
+
+	resp, err := http.Post(config.DiscordWebhookURL, "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		return fmt.Errorf("discord webhook request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("discord webhook error, status: %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// createDiscordEmbed creates a formatted Discord embed from the message
+func (ds *DiscordService) createDiscordEmbed(message string) DiscordEmbed {
+	// Parse the message to extract structured information
+	lines := strings.Split(message, "\n")
+	
+	if len(lines) == 0 {
+		return DiscordEmbed{
+			Description: message,
+			Color:       ds.getDefaultColor(),
+			Timestamp:   time.Now().Format(time.RFC3339),
+		}
+	}
+
+	// Extract title from first line and determine status
+	title := strings.TrimSpace(lines[0])
+	color := ds.determineColorFromMessage(title)
+	
+	// Create fields from the remaining lines
+	var fields []DiscordEmbedField
+	
+	for i, line := range lines {
+		if i == 0 {
+			continue // Skip title line
+		}
+		
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		
+		// Parse field from "• Key: Value" format
+		if strings.HasPrefix(line, "•") || strings.HasPrefix(line, "-") {
+			line = strings.TrimPrefix(line, "•")
+			line = strings.TrimPrefix(line, "-")
+			line = strings.TrimSpace(line)
+			
+			parts := strings.SplitN(line, ":", 2)
+			if len(parts) == 2 {
+				fieldName := strings.TrimSpace(parts[0])
+				fieldValue := strings.TrimSpace(parts[1])
+				
+				if fieldName != "" && fieldValue != "" {
+					fields = append(fields, DiscordEmbedField{
+						Name:   fieldName,
+						Value:  fieldValue,
+						Inline: true,
+					})
+				}
+			} else {
+				// If not in key:value format, add as description field
+				fields = append(fields, DiscordEmbedField{
+					Name:   "Details",
+					Value:  line,
+					Inline: false,
+				})
+			}
+		}
+	}
+	
+	// If no structured fields found, use the entire message as description
+	if len(fields) == 0 {
+		// Remove the first line from description since it's used as title
+		description := ""
+		if len(lines) > 1 {
+			description = strings.Join(lines[1:], "\n")
+		}
+		
+		return DiscordEmbed{
+			Title:       title,
+			Description: description,
+			Color:       color,
+			Timestamp:   time.Now().Format(time.RFC3339),
+			Footer: &DiscordEmbedFooter{
+				Text: "CheckCle System Alert",
+			},
+		}
+	}
+
+	return DiscordEmbed{
+		Title:     title,
+		Color:     color,
+		Timestamp: time.Now().Format(time.RFC3339),
+		Fields:    fields,
+		Footer: &DiscordEmbedFooter{
+			Text: "CheckCle System Alert",
+		},
+	}
+}
+
+// determineColorFromMessage determines Discord embed color based on message content
+func (ds *DiscordService) determineColorFromMessage(message string) int {
+	messageLower := strings.ToLower(message)
+	
+	// Red for critical/error states
+	if strings.Contains(messageLower, "expired") || 
+	   strings.Contains(messageLower, "down") || 
+	   strings.Contains(messageLower, "failed") || 
+	   strings.Contains(messageLower, "error") || 
+	   strings.Contains(messageLower, "critical") ||
+	   strings.Contains(messageLower, "🚨") ||
+	   strings.Contains(messageLower, "🔴") {
+		return 15158332 // Red (#E74C3C)
+	}
+	
+	// Orange for warnings
+	if strings.Contains(messageLower, "expiring_soon") || 
+	   strings.Contains(messageLower, "expiring soon") || 
+	   strings.Contains(messageLower, "warning") || 
+	   strings.Contains(messageLower, "maintenance") || 
+	   strings.Contains(messageLower, "paused") ||
+	   strings.Contains(messageLower, "⚠️") ||
+	   strings.Contains(messageLower, "🟡") ||
+	   strings.Contains(messageLower, "🟠") {
+		return 15105570 // Orange (#E67E22)
+	}
+	
+	// Green for success/up states
+	if strings.Contains(messageLower, "up") || 
+	   strings.Contains(messageLower, "resolved") || 
+	   strings.Contains(messageLower, "success") || 
+	   strings.Contains(messageLower, "restored") || 
+	   strings.Contains(messageLower, "valid") ||
+	   strings.Contains(messageLower, "🟢") ||
+	   strings.Contains(messageLower, "✅") {
+		return 3066993 // Green (#2ECC71)
+	}
+	
+	// Blue for info/default
+	return 3447003 // Blue (#3498DB)
+}
+
+// getDefaultColor returns the default Discord embed color (blue)
+func (ds *DiscordService) getDefaultColor() int {
+	return 3447003 // Blue (#3498DB)
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/email.go b/server/service-operation/notification/email.go
new file mode 100644
index 0000000..e028ac4
--- /dev/null
+++ b/server/service-operation/notification/email.go
@@ -0,0 +1,532 @@
+package notification
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net/smtp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// EmailService handles email notifications
+type EmailService struct{}
+
+// NewEmailService creates a new email notification service
+func NewEmailService() *EmailService {
+	// log.Printf("✅ Email notification service initialized")
+	return &EmailService{}
+}
+
+// SendNotification sends a notification via email
+func (es *EmailService) SendNotification(config *AlertConfiguration, message string) error {
+	// log.Printf("📧 === SENDING EMAIL NOTIFICATION ===")
+	// log.Printf("🔔 Email notification request received")
+	// log.Printf("📊 Email Configuration:")
+	// log.Printf("  - Email Address: %s", config.EmailAddress)
+	// log.Printf("  - Sender Name: %s", config.EmailSenderName)
+	// log.Printf("  - SMTP Server: %s", config.SMTPServer)
+	// log.Printf("  - SMTP Port: %s", config.SMTPPort)
+	// log.Printf("  - SMTP Password present: %t", config.SMTPPassword != "")
+	// log.Printf("  - Message Length: %d chars", len(message))
+
+	// Validate email configuration
+	if config.EmailAddress == "" || config.SMTPServer == "" || config.SMTPPort == "" {
+		// log.Printf("❌ EMAIL CONFIGURATION ERROR: Missing required fields")
+		// log.Printf("  - Email Address present: %t", config.EmailAddress != "")
+		// log.Printf("  - SMTP Server present: %t", config.SMTPServer != "")
+		// log.Printf("  - SMTP Port present: %t", config.SMTPPort != "")
+		return fmt.Errorf("email configuration is incomplete")
+	}
+
+	if config.SMTPPassword == "" {
+		// log.Printf("⚠️  WARNING: SMTP password not provided - authentication may fail")
+	}
+
+	port, err := strconv.Atoi(config.SMTPPort)
+	if err != nil {
+		// log.Printf("❌ SMTP PORT ERROR: Invalid port '%s': %v", config.SMTPPort, err)
+		return fmt.Errorf("invalid SMTP port: %v", err)
+	}
+
+	// log.Printf("✅ Email configuration validation passed")
+	// log.Printf("🔧 Parsed SMTP Port: %d", port)
+
+	// Determine alert severity and get appropriate emoji/color
+	severity, emoji := es.parseMessageSeverity(message)
+	// log.Printf("📋 Message Analysis:")
+	// log.Printf("  - Detected Severity: %s", severity)
+	// log.Printf("  - Emoji: %s", emoji)
+
+	// Create enhanced email content
+	subject := es.createEmailSubject(config.EmailSenderName, severity)
+	htmlBody := es.createHTMLEmailBody(message, severity, emoji)
+	plainBody := es.createPlainEmailBody(message, severity, emoji)
+
+	// log.Printf("📝 Email Content Created:")
+	// log.Printf("  - Subject: %s", subject)
+	// log.Printf("  - HTML Body Length: %d chars", len(htmlBody))
+	// log.Printf("  - Plain Body Length: %d chars", len(plainBody))
+
+	// Prepare email message with both HTML and plain text
+	emailMessage := es.createMIMEMessage(config.EmailSenderName, config.EmailAddress, subject, htmlBody, plainBody)
+
+	// log.Printf("📤 Preparing to send email...")
+	// log.Printf("  - SMTP Server: %s:%d", config.SMTPServer, port)
+	// log.Printf("  - From: %s", config.EmailSenderName)
+	// log.Printf("  - To: %s", config.EmailAddress)
+
+	// Send email with enhanced SMTP handling
+	err = es.sendSMTPEmail(config.SMTPServer, port, config.EmailSenderName, config.EmailAddress, config.SMTPPassword, emailMessage)
+	if err != nil {
+		// log.Printf("❌ EMAIL SENDING FAILED: %v", err)
+		// log.Printf("❌ Error Details:")
+		// log.Printf("  - SMTP Server: %s:%d", config.SMTPServer, port)
+		// log.Printf("  - Error Type: %T", err)
+		// log.Printf("  - Error Message: %s", err.Error())
+		return fmt.Errorf("failed to send email: %v", err)
+	}
+
+	// log.Printf("✅ EMAIL SENT SUCCESSFULLY")
+	// log.Printf("✅ Email Details:")
+	// log.Printf("  - Recipient: %s", config.EmailAddress)
+	// log.Printf("  - Subject: %s", subject)
+	// log.Printf("  - Severity: %s", severity)
+	// log.Printf("  - Timestamp: %s", time.Now().Format("2006-01-02 15:04:05"))
+	// log.Printf("=== EMAIL NOTIFICATION COMPLETE ===")
+
+	return nil
+}
+
+// parseMessageSeverity analyzes the message to determine severity level
+func (es *EmailService) parseMessageSeverity(message string) (string, string) {
+	messageUpper := strings.ToUpper(message)
+	
+	// Check for critical indicators
+	if strings.Contains(messageUpper, "🚨") || strings.Contains(messageUpper, "CRITICAL") || 
+	   strings.Contains(messageUpper, "DOWN") || strings.Contains(messageUpper, "ERROR") ||
+	   strings.Contains(messageUpper, "FAILED") || strings.Contains(messageUpper, "🔴") {
+		return "CRITICAL", "🚨"
+	}
+	
+	// Check for warning indicators
+	if strings.Contains(messageUpper, "⚠️") || strings.Contains(messageUpper, "WARNING") || 
+	   strings.Contains(messageUpper, "🟡") || strings.Contains(messageUpper, "INCIDENT") {
+		return "WARNING", "⚠️"
+	}
+	
+	// Check for success indicators
+	if strings.Contains(messageUpper, "🟢") || strings.Contains(messageUpper, "UP") || 
+	   strings.Contains(messageUpper, "SUCCESS") || strings.Contains(messageUpper, "RESOLVED") ||
+	   strings.Contains(messageUpper, "RESTORED") {
+		return "SUCCESS", "✅"
+	}
+	
+	// Check for maintenance indicators
+	if strings.Contains(messageUpper, "🟠") || strings.Contains(messageUpper, "MAINTENANCE") || 
+	   strings.Contains(messageUpper, "PAUSED") {
+		return "MAINTENANCE", "🔧"
+	}
+	
+	// Default to info
+	return "INFO", "ℹ️"
+}
+
+// createEmailSubject creates an appropriate email subject
+func (es *EmailService) createEmailSubject(senderName, severity string) string {
+	prefix := "Service Alert"
+	if senderName != "" {
+		prefix = fmt.Sprintf("%s - Service Alert", senderName)
+	}
+	
+	switch severity {
+	case "CRITICAL":
+		return fmt.Sprintf("🚨 [CRITICAL] %s", prefix)
+	case "WARNING":
+		return fmt.Sprintf("⚠️ [WARNING] %s", prefix)
+	case "SUCCESS":
+		return fmt.Sprintf("✅ [RESOLVED] %s", prefix)
+	case "MAINTENANCE":
+		return fmt.Sprintf("🔧 [MAINTENANCE] %s", prefix)
+	default:
+		return fmt.Sprintf("ℹ️ [INFO] %s", prefix)
+	}
+}
+
+// createHTMLEmailBody creates a rich HTML email body
+func (es *EmailService) createHTMLEmailBody(message, severity, emoji string) string {
+	// Get color scheme based on severity
+	var bgColor, borderColor, textColor string
+	switch severity {
+	case "CRITICAL":
+		bgColor = "#fee2e2"
+		borderColor = "#dc2626"
+		textColor = "#991b1b"
+	case "WARNING":
+		bgColor = "#fef3c7"
+		borderColor = "#d97706"
+		textColor = "#92400e"
+	case "SUCCESS":
+		bgColor = "#dcfce7"
+		borderColor = "#16a34a"
+		textColor = "#15803d"
+	case "MAINTENANCE":
+		bgColor = "#fed7aa"
+		borderColor = "#ea580c"
+		textColor = "#c2410c"
+	default:
+		bgColor = "#dbeafe"
+		borderColor = "#2563eb"
+		textColor = "#1d4ed8"
+	}
+
+	// Format message content for HTML
+	htmlMessage := strings.ReplaceAll(message, "\n", "<br>")
+	
+	// Enhance bullet points and formatting
+	htmlMessage = strings.ReplaceAll(htmlMessage, " - ", "<br>&nbsp;&nbsp;• ")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Service:", "<strong>Service:</strong>")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Status:", "<strong>Status:</strong>")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Host:", "<strong>Host:</strong>")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Type:", "<strong>Type:</strong>")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Response time:", "<strong>Response time:</strong>")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Time:", "<strong>Time:</strong>")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Domain:", "<strong>Domain:</strong>")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Days Remaining:", "<strong>Days Remaining:</strong>")
+	htmlMessage = strings.ReplaceAll(htmlMessage, "Expiration Date:", "<strong>Expiration Date:</strong>")
+
+	return fmt.Sprintf(`
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Service Alert Notification</title>
+</head>
+<body style="margin: 0; padding: 20px; font-family: Arial, sans-serif; background-color: #f5f5f5;">
+    <div style="max-width: 600px; margin: 0 auto; background-color: white; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1);">
+        <!-- Header -->
+        <div style="background-color: %s; color: %s; padding: 20px; border-radius: 8px 8px 0 0; border-left: 4px solid %s;">
+            <h2 style="margin: 0; font-size: 18px;">
+                %s Service Alert Notification
+            </h2>
+        </div>
+        
+        <!-- Content -->
+        <div style="padding: 20px;">
+            <div style="background-color: #f8f9fa; padding: 15px; border-radius: 6px; border-left: 3px solid %s;">
+                <p style="margin: 0; font-size: 14px; line-height: 1.6; color: #333;">
+                    %s
+                </p>
+            </div>
+            
+            <!-- Footer -->
+            <div style="margin-top: 20px; padding-top: 15px; border-top: 1px solid #e5e7eb;">
+                <p style="margin: 0; font-size: 12px; color: #6b7280; text-align: center;">
+                    This is an automated notification from your monitoring system.<br>
+                    Generated at: %s
+                </p>
+            </div>
+        </div>
+    </div>
+</body>
+</html>`, 
+		bgColor, textColor, borderColor, emoji, borderColor, htmlMessage, time.Now().Format("2006-01-02 15:04:05 MST"))
+}
+
+// createPlainEmailBody creates a plain text email body
+func (es *EmailService) createPlainEmailBody(message, severity, emoji string) string {
+	separator := strings.Repeat("=", 50)
+	
+	return fmt.Sprintf(`%s
+%s SERVICE ALERT NOTIFICATION
+%s
+
+%s
+
+%s
+This is an automated notification from your monitoring system.
+Generated at: %s
+%s`, 
+		separator, 
+		emoji+" "+severity, 
+		separator, 
+		message, 
+		separator, 
+		time.Now().Format("2006-01-02 15:04:05 MST"),
+		separator)
+}
+
+// createMIMEMessage creates a MIME message with both HTML and plain text
+func (es *EmailService) createMIMEMessage(fromName, toEmail, subject, htmlBody, plainBody string) string {
+	boundary := fmt.Sprintf("boundary_%d", time.Now().Unix())
+	
+	headers := fmt.Sprintf(`From: %s
+To: %s
+Subject: %s
+MIME-Version: 1.0
+Content-Type: multipart/alternative; boundary="%s"
+
+`, fromName, toEmail, subject, boundary)
+
+	body := fmt.Sprintf(`--%s
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 7bit
+
+%s
+
+--%s
+Content-Type: text/html; charset=UTF-8
+Content-Transfer-Encoding: 7bit
+
+%s
+
+--%s--
+`, boundary, plainBody, boundary, htmlBody, boundary)
+
+	return headers + body
+}
+
+// sendSMTPEmail sends the email using SMTP with proper authentication
+func (es *EmailService) sendSMTPEmail(smtpServer string, port int, fromEmail, toEmail, password, message string) error {
+	addr := fmt.Sprintf("%s:%d", smtpServer, port)
+	
+	// log.Printf("🔌 Connecting to SMTP server: %s", addr)
+	
+	// Extract hostname from SMTP server for proper HELO
+	hostname := smtpServer
+	if strings.Contains(hostname, ".") {
+		// Use the SMTP server hostname for HELO
+		hostname = smtpServer
+	}
+	
+	// log.Printf("🔧 Using hostname for HELO: %s", hostname)
+	
+	// For port 587 (STARTTLS) - most common for authenticated SMTP
+	if port == 587 {
+		// log.Printf("🔐 Attempting STARTTLS connection with authentication...")
+		return es.sendWithSTARTTLSAuth(addr, hostname, fromEmail, toEmail, password, message)
+	}
+	
+	// For port 465 (SSL/TLS)
+	if port == 465 {
+		// log.Printf("🔒 Attempting SSL connection with authentication...")
+		return es.sendWithSSLAuth(addr, hostname, fromEmail, toEmail, password, message)
+	}
+	
+	// For port 25 (Plain SMTP with optional STARTTLS)
+	if port == 25 {
+		// log.Printf("📧 Attempting plain SMTP with optional STARTTLS...")
+		return es.sendWithSTARTTLSAuth(addr, hostname, fromEmail, toEmail, password, message)
+	}
+	
+	// Fallback to STARTTLS for any other port
+	// log.Printf("📧 Using STARTTLS with auth fallback for port %d...", port)
+	return es.sendWithSTARTTLSAuth(addr, hostname, fromEmail, toEmail, password, message)
+}
+
+// sendWithSTARTTLSAuth sends email with STARTTLS and authentication
+func (es *EmailService) sendWithSTARTTLSAuth(addr, hostname, fromEmail, toEmail, password, message string) error {
+	// log.Printf("🔐 Establishing STARTTLS connection to %s", addr)
+	
+	// Connect to server
+	client, err := smtp.Dial(addr)
+	if err != nil {
+		// log.Printf("❌ Failed to connect to SMTP server: %v", err)
+		return fmt.Errorf("failed to connect to SMTP server: %v", err)
+	}
+	defer client.Close()
+	
+	// Send EHLO with proper hostname
+	// log.Printf("👋 Sending EHLO with hostname: %s", hostname)
+	if err = client.Hello(hostname); err != nil {
+		// log.Printf("❌ EHLO failed: %v", err)
+		return fmt.Errorf("EHLO failed: %v", err)
+	}
+	
+	// Check if STARTTLS is supported and use it
+	if ok, _ := client.Extension("STARTTLS"); ok {
+		// log.Printf("🔐 STARTTLS supported, initiating TLS...")
+		tlsConfig := &tls.Config{
+			ServerName:         strings.Split(addr, ":")[0],
+			InsecureSkipVerify: false,
+		}
+		if err = client.StartTLS(tlsConfig); err != nil {
+			// log.Printf("❌ STARTTLS failed: %v", err)
+			return fmt.Errorf("STARTTLS failed: %v", err)
+		}
+		// log.Printf("✅ TLS connection established")
+	} else {
+		// log.Printf("⚠️  STARTTLS not supported by server, continuing with plain connection")
+	}
+	
+	// Check for AUTH support and authenticate if available
+	if ok, mechanisms := client.Extension("AUTH"); ok {
+		// Suppress unused variable warning
+		_ = mechanisms
+		// log.Printf("🔑 AUTH extension supported with mechanisms: %s", mechanisms)
+		
+		// Use the provided credentials for authentication
+		username := fromEmail
+		
+		// log.Printf("🔐 Attempting authentication for user: %s", username)
+		// log.Printf("🔑 Password provided: %t", password != "")
+		
+		if password != "" {
+			// Create auth mechanism - try PLAIN first as it's most common
+			auth := smtp.PlainAuth("", username, password, strings.Split(addr, ":")[0])
+			
+			if err := client.Auth(auth); err != nil {
+				// log.Printf("❌ Authentication failed: %v", err)
+				return fmt.Errorf("SMTP authentication failed: %v", err)
+			} else {
+				// log.Printf("✅ Authentication successful")
+			}
+		} else {
+			// log.Printf("⚠️  No password provided, skipping authentication")
+			return fmt.Errorf("SMTP password is required for authentication")
+		}
+	} else {
+		// log.Printf("ℹ️  AUTH extension not available, proceeding without authentication")
+	}
+	
+	// Set sender
+	// log.Printf("📤 Setting sender: %s", fromEmail)
+	if err = client.Mail(fromEmail); err != nil {
+		// log.Printf("❌ Failed to set sender: %v", err)
+		return fmt.Errorf("failed to set sender: %v", err)
+	}
+	
+	// Set recipient
+	// log.Printf("📥 Setting recipient: %s", toEmail)
+	if err = client.Rcpt(toEmail); err != nil {
+		// log.Printf("❌ Failed to set recipient: %v", err)
+		return fmt.Errorf("failed to set recipient: %v", err)
+	}
+	
+	// Send message
+	// log.Printf("📝 Sending message data...")
+	w, err := client.Data()
+	if err != nil {
+		// log.Printf("❌ Failed to initiate data transfer: %v", err)
+		return fmt.Errorf("failed to initiate data transfer: %v", err)
+	}
+	
+	_, err = w.Write([]byte(message))
+	if err != nil {
+		// log.Printf("❌ Failed to write message data: %v", err)
+		return fmt.Errorf("failed to write message data: %v", err)
+	}
+	
+	err = w.Close()
+	if err != nil {
+		// log.Printf("❌ Failed to close data writer: %v", err)
+		return fmt.Errorf("failed to close data writer: %v", err)
+	}
+	
+	// Quit gracefully
+	err = client.Quit()
+	if err != nil {
+		// log.Printf("⚠️  Warning during QUIT: %v", err)
+		// Don't return error for QUIT issues as email might have been sent
+	}
+	
+	// log.Printf("✅ Email sent successfully via STARTTLS")
+	return nil
+}
+
+// sendWithSSLAuth sends email with SSL/TLS and authentication (for port 465)
+func (es *EmailService) sendWithSSLAuth(addr, hostname, fromEmail, toEmail, password, message string) error {
+	// log.Printf("🔒 Establishing SSL/TLS connection to %s", addr)
+	
+	// Create TLS configuration
+	tlsConfig := &tls.Config{
+		InsecureSkipVerify: false,
+		ServerName:         strings.Split(addr, ":")[0],
+	}
+	
+	// Connect with TLS
+	conn, err := tls.Dial("tcp", addr, tlsConfig)
+	if err != nil {
+		// log.Printf("❌ Failed to establish TLS connection: %v", err)
+		return fmt.Errorf("failed to establish TLS connection: %v", err)
+	}
+	defer conn.Close()
+	
+	// Create SMTP client
+	client, err := smtp.NewClient(conn, strings.Split(addr, ":")[0])
+	if err != nil {
+		// log.Printf("❌ Failed to create SMTP client: %v", err)
+		return fmt.Errorf("failed to create SMTP client: %v", err)
+	}
+	defer client.Quit()
+	
+	// Send EHLO with proper hostname
+	// log.Printf("👋 Sending EHLO with hostname: %s", hostname)
+	if err = client.Hello(hostname); err != nil {
+		// log.Printf("❌ EHLO failed: %v", err)
+		return fmt.Errorf("EHLO failed: %v", err)
+	}
+	
+	// Authenticate if AUTH is supported and password is provided
+	if ok, mechanisms := client.Extension("AUTH"); ok {
+		// Suppress unused variable warning
+		_ = mechanisms
+		// log.Printf("🔑 AUTH extension supported with mechanisms: %s", mechanisms)
+		
+		username := fromEmail
+		
+		// log.Printf("🔐 Attempting authentication for user: %s", username)
+		// log.Printf("🔑 Password provided: %t", password != "")
+		
+		if password != "" {
+			auth := smtp.PlainAuth("", username, password, strings.Split(addr, ":")[0])
+			
+			if err := client.Auth(auth); err != nil {
+				// log.Printf("❌ Authentication failed: %v", err)
+				return fmt.Errorf("SMTP authentication failed: %v", err)
+			} else {
+				// log.Printf("✅ Authentication successful")
+			}
+		} else {
+			// log.Printf("⚠️  No password provided, skipping authentication")
+			return fmt.Errorf("SMTP password is required for authentication")
+		}
+	}
+	
+	// Set sender and recipient
+	// log.Printf("📤 Setting sender: %s", fromEmail)
+	if err := client.Mail(fromEmail); err != nil {
+		// log.Printf("❌ Failed to set sender: %v", err)
+		return fmt.Errorf("failed to set sender: %v", err)
+	}
+	
+	// log.Printf("📥 Setting recipient: %s", toEmail)
+	if err := client.Rcpt(toEmail); err != nil {
+		// log.Printf("❌ Failed to set recipient: %v", err)
+		return fmt.Errorf("failed to set recipient: %v", err)
+	}
+	
+	// Send message
+	// log.Printf("📝 Sending message data...")
+	w, err := client.Data()
+	if err != nil {
+		// log.Printf("❌ Failed to initiate data transfer: %v", err)
+		return fmt.Errorf("failed to initiate data transfer: %v", err)
+	}
+	
+	_, err = w.Write([]byte(message))
+	if err != nil {
+		// log.Printf("❌ Failed to write message data: %v", err)
+		return fmt.Errorf("failed to write message data: %v", err)
+	}
+	
+	err = w.Close()
+	if err != nil {
+		// log.Printf("❌ Failed to close data writer: %v", err)
+		return fmt.Errorf("failed to close data writer: %v", err)
+	}
+	
+	// log.Printf("✅ Email sent successfully via SSL/TLS")
+	return nil
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/google_chat.go b/server/service-operation/notification/google_chat.go
new file mode 100644
index 0000000..66dbdb5
--- /dev/null
+++ b/server/service-operation/notification/google_chat.go
@@ -0,0 +1,336 @@
+
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// GoogleChatService handles Google Chat notifications
+type GoogleChatService struct{}
+
+// NewGoogleChatService creates a new Google Chat notification service
+func NewGoogleChatService() *GoogleChatService {
+	return &GoogleChatService{}
+}
+
+// GoogleChatPayload represents the payload for Google Chat webhook
+type GoogleChatPayload struct {
+	Text string `json:"text"`
+}
+
+// SendNotification sends a notification via Google Chat webhook
+func (gcs *GoogleChatService) SendNotification(config *AlertConfiguration, message string) error {
+	// fmt.Printf("💬 [GOOGLE_CHAT] Attempting to send notification...\n")
+	// fmt.Printf("💬 [GOOGLE_CHAT] Config - Webhook URL present: %v\n", config.GoogleChatWebhookURL != "")
+	// fmt.Printf("💬 [GOOGLE_CHAT] Message: %s\n", message)
+
+	if config.GoogleChatWebhookURL == "" {
+		return fmt.Errorf("google chat webhook URL is required")
+	}
+
+	payload := GoogleChatPayload{
+		Text: message,
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		// fmt.Printf("❌ [GOOGLE_CHAT] JSON marshal error: %v\n", err)
+		return err
+	}
+
+	// fmt.Printf("💬 [GOOGLE_CHAT] Sending POST request to webhook...\n")
+	resp, err := http.Post(config.GoogleChatWebhookURL, "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		// fmt.Printf("❌ [GOOGLE_CHAT] HTTP error: %v\n", err)
+		return err
+	}
+	defer resp.Body.Close()
+
+	// fmt.Printf("💬 [GOOGLE_CHAT] Response status: %d\n", resp.StatusCode)
+
+	if resp.StatusCode != http.StatusOK {
+		// fmt.Printf("❌ [GOOGLE_CHAT] Webhook error, status: %d\n", resp.StatusCode)
+		return fmt.Errorf("google chat webhook error, status: %d", resp.StatusCode)
+	}
+
+	// fmt.Printf("✅ [GOOGLE_CHAT] Message sent successfully!\n")
+	return nil
+}
+
+// SendServerNotification sends a server-specific notification via Google Chat
+func (gcs *GoogleChatService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := gcs.generateServerMessage(payload, template, resourceType)
+	return gcs.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via Google Chat
+func (gcs *GoogleChatService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := gcs.generateServiceMessage(payload, template)
+	return gcs.SendNotification(config, message)
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (gcs *GoogleChatService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = gcs.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return gcs.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (gcs *GoogleChatService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = gcs.generateDefaultUptimeMessage(payload)
+	}
+	
+	return gcs.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (gcs *GoogleChatService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", gcs.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", gcs.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := gcs.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", gcs.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", gcs.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", gcs.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", gcs.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", gcs.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", gcs.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", gcs.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", gcs.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", gcs.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", gcs.safeString(payload.Threshold))
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", gcs.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", gcs.safeString(payload.ErrorMessage))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (gcs *GoogleChatService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (gcs *GoogleChatService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	// Status emoji mapping for Google Chat
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	case "maintenance", "paused":
+		statusEmoji = "🟠"
+	}
+	
+	message := fmt.Sprintf("%s Service %s is %s.", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf(" - Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf(" - Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf(" - Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf(" - Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf(" - Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf(" - Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, " - Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf(" - Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf(" - Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf(" - Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf(" - Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (gcs *GoogleChatService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	}
+	
+	return fmt.Sprintf("%s🖥️ Server %s (%s) status: %s", statusEmoji, payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/gotify.go b/server/service-operation/notification/gotify.go
new file mode 100644
index 0000000..d63a395
--- /dev/null
+++ b/server/service-operation/notification/gotify.go
@@ -0,0 +1,357 @@
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// GotifyService handles Gotify notifications
+type GotifyService struct{}
+
+// NewGotifyService creates a new Gotify notification service
+func NewGotifyService() *GotifyService {
+	return &GotifyService{}
+}
+
+// GotifyPayload represents the payload for Gotify API
+type GotifyPayload struct {
+	Message  string `json:"message"`
+	Title    string `json:"title,omitempty"`
+	Priority int    `json:"priority,omitempty"`
+}
+
+// GotifyResponse represents the response from Gotify API
+type GotifyResponse struct {
+	ID       int    `json:"id"`
+	AppID    int    `json:"appid"`
+	Message  string `json:"message"`
+	Title    string `json:"title"`
+	Priority int    `json:"priority"`
+	Date     string `json:"date"`
+}
+
+// SendNotification sends a notification via Gotify
+func (gs *GotifyService) SendNotification(config *AlertConfiguration, message string) error {
+	// fmt.Printf("📱 [GOTIFY] Attempting to send notification...\n")
+	// fmt.Printf("📱 [GOTIFY] Config - API Token: %s, Server URL: %s, Notify Name: %s\n", 
+	//     maskToken(config.APIToken), config.ServerURL, config.NotifyName)
+	// fmt.Printf("📱 [GOTIFY] Message: %s\n", message)
+
+	if config.APIToken == "" || config.ServerURL == "" {
+		return fmt.Errorf("Gotify API token and server URL are required")
+	}
+
+	// Prepare the payload
+	payload := GotifyPayload{
+		Message:  message,
+		Title:    config.NotifyName, // Use notify_name as the title
+		Priority: 5,                 // Default priority
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		// fmt.Printf("❌ [GOTIFY] JSON marshal error: %v\n", err)
+		return err
+	}
+
+	// fmt.Printf("📱 [GOTIFY] Payload: %s\n", string(jsonData))
+	// fmt.Printf("📱 [GOTIFY] Sending POST request to Gotify API...\n")
+
+	// Construct the Gotify API URL
+	apiURL := strings.TrimRight(config.ServerURL, "/") + "/message?token=" + config.APIToken
+
+	// Send the request to Gotify API
+	resp, err := http.Post(apiURL, "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		// fmt.Printf("❌ [GOTIFY] HTTP error: %v\n", err)
+		return err
+	}
+	defer resp.Body.Close()
+
+	// Check status code
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		// fmt.Printf("❌ [GOTIFY] HTTP status error: %d\n", resp.StatusCode)
+		return fmt.Errorf("Gotify API error: HTTP %d", resp.StatusCode)
+	}
+
+	// Parse the response
+	var gotifyResp GotifyResponse
+	if err := json.NewDecoder(resp.Body).Decode(&gotifyResp); err != nil {
+		// fmt.Printf("❌ [GOTIFY] Response decode error: %v\n", err)
+		return err
+	}
+
+	// fmt.Printf("📱 [GOTIFY] API response: %+v\n", gotifyResp)
+
+	// Check if the message was created successfully
+	if gotifyResp.ID == 0 {
+		// fmt.Printf("❌ [GOTIFY] API error: No message ID returned\n")
+		return fmt.Errorf("Gotify API error: message not created")
+	}
+
+	// fmt.Printf("✅ [GOTIFY] Message sent successfully! ID: %d\n", gotifyResp.ID)
+	return nil
+}
+
+// SendServerNotification sends a server-specific notification via Gotify
+func (gs *GotifyService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := gs.generateServerMessage(payload, template, resourceType)
+	return gs.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via Gotify
+func (gs *GotifyService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := gs.generateServiceMessage(payload, template)
+	return gs.SendNotification(config, message)
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (gs *GotifyService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = gs.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return gs.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (gs *GotifyService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = gs.generateDefaultUptimeMessage(payload)
+	}
+	
+	return gs.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (gs *GotifyService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${server_name}", payload.ServiceName) // server_name maps to service_name
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", gs.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", gs.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := gs.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", gs.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", gs.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", gs.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", gs.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", gs.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", gs.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", gs.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", gs.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", gs.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", gs.safeString(payload.Threshold))
+	
+	// Replace SSL certificate fields
+	message = strings.ReplaceAll(message, "${certificate_name}", gs.safeString(payload.CertificateName))
+	message = strings.ReplaceAll(message, "${expiry_date}", gs.safeString(payload.ExpiryDate))
+	message = strings.ReplaceAll(message, "${days_left}", gs.safeString(payload.DaysLeft))
+	message = strings.ReplaceAll(message, "${issuer_cn}", gs.safeString(payload.IssuerCN))
+	message = strings.ReplaceAll(message, "${issuer}", gs.safeString(payload.IssuerCN)) // alias
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", gs.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", gs.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${message}", gs.safeString(payload.Message))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (gs *GotifyService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (gs *GotifyService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	message := fmt.Sprintf("Service %s is %s.", payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf("Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf("Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf("Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf("Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf("Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf("Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, "Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf("Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf("Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf("Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf("Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (gs *GotifyService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	return fmt.Sprintf("Server %s (%s) status: %s", payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/integration.go b/server/service-operation/notification/integration.go
new file mode 100644
index 0000000..8c44e6a
--- /dev/null
+++ b/server/service-operation/notification/integration.go
@@ -0,0 +1,61 @@
+
+package notification
+
+import (
+	"log"
+	"time"
+
+	"service-operation/pocketbase"
+	"service-operation/types"
+)
+
+// ServiceNotifier provides an easy interface to send notifications for service events
+type ServiceNotifier struct {
+	manager *NotificationManager
+}
+
+// NewServiceNotifier creates a new service notifier
+func NewServiceNotifier(pbClient *pocketbase.PocketBaseClient) *ServiceNotifier {
+	return &ServiceNotifier{
+		manager: NewNotificationManager(pbClient),
+	}
+}
+
+// NotifyServiceStatus sends a notification for service status change
+func (sn *ServiceNotifier) NotifyServiceStatus(service pocketbase.Service, result *types.OperationResult) {
+	// Check if service has notification configured
+	if service.NotificationID == "" {
+		return
+	}
+
+	// Create notification payload
+	payload := &NotificationPayload{
+		ServiceName:  service.Name,
+		Status:       service.Status,
+		Host:         service.Host,
+		Port:         service.Port,
+		ServiceType:  service.ServiceType,
+		ResponseTime: result.ResponseTime.Milliseconds(),
+		Timestamp:    time.Now(),
+		ErrorMessage: result.Error,
+	}
+
+	// Send notification
+	if err := sn.manager.SendServiceNotification(payload, service.NotificationID, service.TemplateID); err != nil {
+		log.Printf("Failed to send notification for service %s: %v", service.Name, err)
+	} else {
+		log.Printf("Notification sent successfully for service %s", service.Name)
+	}
+}
+
+// NotifyCustom sends a custom notification
+func (sn *ServiceNotifier) NotifyCustom(notificationID, templateID, serviceName, status, message string) error {
+	payload := &NotificationPayload{
+		ServiceName: serviceName,
+		Status:      status,
+		Message:     message,
+		Timestamp:   time.Now(),
+	}
+
+	return sn.manager.SendServiceNotification(payload, notificationID, templateID)
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/manager.go b/server/service-operation/notification/manager.go
new file mode 100644
index 0000000..356f130
--- /dev/null
+++ b/server/service-operation/notification/manager.go
@@ -0,0 +1,72 @@
+
+package notification
+
+import (
+	// "log"
+
+	"service-operation/pocketbase"
+)
+
+// NotificationManager handles all notification operations
+type NotificationManager struct {
+	pbClient      *pocketbase.PocketBaseClient
+	services      map[string]NotificationService
+	serverManager *ServerNotificationManager
+	uptimeManager *UptimeNotificationManager
+	sslManager    *SSLNotificationManager
+}
+
+// NewNotificationManager creates a new notification manager
+func NewNotificationManager(pbClient *pocketbase.PocketBaseClient) *NotificationManager {
+	// Initialize notification services
+	services := make(map[string]NotificationService)
+	
+	// log.Printf("🔧 Initializing notification services...")
+	services["telegram"] = NewTelegramService()
+	services["signal"] = NewSignalService()
+	services["discord"] = NewDiscordService()
+	services["slack"] = NewSlackService()
+	services["google_chat"] = NewGoogleChatService()
+	services["email"] = NewEmailService()
+	services["webhook"] = NewWebhookService()
+	services["ntfy"] = NewNtfyService()
+	services["pushover"] = NewPushoverService()
+	services["notifiarr"] = NewNotifiarrService()
+	services["gotify"] = NewGotifyService()
+	services["matrix"] = NewMatrixService()
+
+	// log.Printf("✅ Notification services initialized: %v", getKeys(services))
+
+	// Create specialized managers
+	serverManager := NewServerNotificationManager(pbClient, services)
+	uptimeManager := NewUptimeNotificationManager(pbClient, services)
+	sslManager := NewSSLNotificationManager(pbClient, services)
+
+	return &NotificationManager{
+		pbClient:      pbClient,
+		services:      services,
+		serverManager: serverManager,
+		uptimeManager: uptimeManager,
+		sslManager:    sslManager,
+	}
+}
+
+// SendServiceNotification sends notification for a service based on its configuration
+func (nm *NotificationManager) SendServiceNotification(payload *NotificationPayload, notificationID, templateID string) error {
+	return nm.serverManager.SendServiceNotification(payload, notificationID, templateID)
+}
+
+// SendResourceNotification sends notification for specific resource alerts (CPU, RAM, Disk, etc.)
+func (nm *NotificationManager) SendResourceNotification(payload *NotificationPayload, notificationID, templateID, resourceType string) error {
+	return nm.serverManager.SendResourceNotification(payload, notificationID, templateID, resourceType)
+}
+
+// SendUptimeServiceNotification sends notification for uptime services using service templates
+func (nm *NotificationManager) SendUptimeServiceNotification(payload *NotificationPayload, notificationID, templateID string) error {
+	return nm.uptimeManager.SendUptimeServiceNotification(payload, notificationID, templateID)
+}
+
+// SendSSLNotification sends notification for SSL certificates using SSL templates
+func (nm *NotificationManager) SendSSLNotification(payload *NotificationPayload, notificationID, templateID string) error {
+	return nm.sslManager.SendSSLNotification(payload, notificationID, templateID)
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/matrix.go b/server/service-operation/notification/matrix.go
new file mode 100644
index 0000000..4e43ab9
--- /dev/null
+++ b/server/service-operation/notification/matrix.go
@@ -0,0 +1,379 @@
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"html"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// MatrixService handles Matrix chat notifications
+type MatrixService struct{}
+
+// NewMatrixService creates a new Matrix notification service
+func NewMatrixService() *MatrixService {
+	return &MatrixService{}
+}
+
+// matrixMessagePayload represents the payload for the Matrix Client-Server API
+type matrixMessagePayload struct {
+	MsgType       string `json:"msgtype"`
+	Body          string `json:"body"`
+	Format        string `json:"format,omitempty"`
+	FormattedBody string `json:"formatted_body,omitempty"`
+}
+
+// SendNotification sends a formatted message to a Matrix room.
+// It sends both a plain-text fallback body and an HTML formatted_body with
+// severity-based colors so clients that support Matrix's custom HTML format
+// display a rich, colored notification.
+func (ms *MatrixService) SendNotification(config *AlertConfiguration, message string) error {
+	if config.MatrixHomeserver == "" || config.MatrixRoomID == "" || config.MatrixAccessToken == "" {
+		return fmt.Errorf("matrix homeserver, room ID and access token are required")
+	}
+
+	// Encode the room ID for use in the URL path
+	encodedRoomID := url.PathEscape(config.MatrixRoomID)
+
+	// Use Unix nanoseconds as a unique transaction ID to prevent duplicate messages
+	txnID := fmt.Sprintf("%d", time.Now().UnixNano())
+
+	apiURL := fmt.Sprintf("%s/_matrix/client/v3/rooms/%s/send/m.room.message/%s",
+		strings.TrimRight(config.MatrixHomeserver, "/"),
+		encodedRoomID,
+		txnID,
+	)
+
+	payload := matrixMessagePayload{
+		MsgType:       "m.text",
+		Body:          message,
+		Format:        "org.matrix.custom.html",
+		FormattedBody: ms.buildHTMLBody(message),
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("matrix: failed to marshal payload: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPut, apiURL, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return fmt.Errorf("matrix: failed to create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+config.MatrixAccessToken)
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("matrix: HTTP request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("matrix: API returned status %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// buildHTMLBody converts a plain-text notification message into Matrix-compatible HTML.
+// The first line becomes a colored bold heading based on alert severity; subsequent
+// detail lines are rendered as a bullet list. Clients that don't support HTML fall
+// back to the plain Body field.
+func (ms *MatrixService) buildHTMLBody(plainText string) string {
+	lines := strings.Split(strings.TrimSpace(plainText), "\n")
+	if len(lines) == 0 {
+		return "<p>" + html.EscapeString(plainText) + "</p>"
+	}
+
+	title := strings.TrimSpace(lines[0])
+	color := ms.statusColor(title)
+
+	var sb strings.Builder
+	sb.WriteString(fmt.Sprintf("<p><strong><font color=%q>%s</font></strong></p>", color, html.EscapeString(title)))
+
+	var items []string
+	for _, line := range lines[1:] {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		// Strip leading bullet markers added by the plain-text generators
+		line = strings.TrimPrefix(line, "•")
+		line = strings.TrimPrefix(line, "-")
+		line = strings.TrimSpace(line)
+		if line != "" {
+			items = append(items, "<li>"+html.EscapeString(line)+"</li>")
+		}
+	}
+
+	if len(items) > 0 {
+		sb.WriteString("<ul>")
+		for _, item := range items {
+			sb.WriteString(item)
+		}
+		sb.WriteString("</ul>")
+	}
+
+	sb.WriteString("<p><em>CheckCle System Alert</em></p>")
+	return sb.String()
+}
+
+// statusColor returns an HTML hex color string that reflects the alert severity
+// detected from keywords and emoji in the message heading.
+func (ms *MatrixService) statusColor(message string) string {
+	lower := strings.ToLower(message)
+	if strings.Contains(lower, "🔴") || strings.Contains(lower, "down") ||
+		strings.Contains(lower, "expired") || strings.Contains(lower, "failed") ||
+		strings.Contains(lower, "critical") || strings.Contains(lower, "error") {
+		return "#E74C3C" // Red
+	}
+	if strings.Contains(lower, "🟡") || strings.Contains(lower, "warning") ||
+		strings.Contains(lower, "expiring") {
+		return "#F39C12" // Yellow
+	}
+	if strings.Contains(lower, "🟠") || strings.Contains(lower, "maintenance") ||
+		strings.Contains(lower, "paused") {
+		return "#E67E22" // Orange
+	}
+	if strings.Contains(lower, "🟢") || strings.Contains(lower, "up") ||
+		strings.Contains(lower, "resolved") || strings.Contains(lower, "restored") ||
+		strings.Contains(lower, "success") {
+		return "#2ECC71" // Green
+	}
+	return "#3498DB" // Blue — info / default
+}
+
+// SendServerNotification sends a server-specific notification via Matrix
+func (ms *MatrixService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := ms.generateServerMessage(payload, template, resourceType)
+	return ms.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via Matrix
+func (ms *MatrixService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := ms.generateServiceMessage(payload, template)
+	return ms.SendNotification(config, message)
+}
+
+func (ms *MatrixService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+
+	if templateMessage == "" {
+		templateMessage = ms.generateDefaultServerMessage(payload, resourceType)
+	}
+
+	return ms.replacePlaceholders(templateMessage, payload)
+}
+
+func (ms *MatrixService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+
+	if templateMessage == "" {
+		templateMessage = ms.generateDefaultUptimeMessage(payload)
+	}
+
+	return ms.replacePlaceholders(templateMessage, payload)
+}
+
+func (ms *MatrixService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", ms.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", ms.safeString(payload.Hostname))
+
+	u := ms.safeString(payload.URL)
+	if u == "N/A" && payload.Host != "" {
+		u = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", u)
+	message = strings.ReplaceAll(message, "${domain}", ms.safeString(payload.Domain))
+
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+
+	message = strings.ReplaceAll(message, "${region_name}", ms.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", ms.safeString(payload.AgentID))
+
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+
+	message = strings.ReplaceAll(message, "${cpu_usage}", ms.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", ms.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", ms.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", ms.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", ms.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", ms.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", ms.safeString(payload.Threshold))
+	message = strings.ReplaceAll(message, "${error_message}", ms.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", ms.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+
+	return message
+}
+
+func (ms *MatrixService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+func (ms *MatrixService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	case "maintenance", "paused":
+		statusEmoji = "🟠"
+	}
+
+	message := fmt.Sprintf("%s Service %s is %s.", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+
+	details := []string{}
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf(" - Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf(" - Host: %s", payload.Host))
+	}
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf(" - Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf(" - Port: %d", payload.Port))
+	}
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf(" - Domain: %s", payload.Domain))
+	}
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf(" - Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, " - Response time: N/A")
+	}
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf(" - Region: %s", payload.RegionName))
+	}
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf(" - Uptime: %d%%", payload.Uptime))
+	}
+	details = append(details, fmt.Sprintf(" - Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	return message
+}
+
+func (ms *MatrixService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	}
+	resource := strings.ToUpper(resourceType)
+	if resource == "" {
+		resource = "GENERAL"
+	}
+	return fmt.Sprintf("%s 🖥️ Server %s (%s) [%s] status: %s", statusEmoji, payload.ServiceName, payload.Hostname, resource, strings.ToUpper(payload.Status))
+}
diff --git a/server/service-operation/notification/notifiarr.go b/server/service-operation/notification/notifiarr.go
new file mode 100644
index 0000000..21a6538
--- /dev/null
+++ b/server/service-operation/notification/notifiarr.go
@@ -0,0 +1,416 @@
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+// NotifiarrService handles Notifiarr notifications
+type NotifiarrService struct{}
+
+// NewNotifiarrService creates a new Notifiarr notification service
+func NewNotifiarrService() *NotifiarrService {
+	return &NotifiarrService{}
+}
+
+// NotifiarrPayload represents the payload for Notifiarr API
+type NotifiarrPayload struct {
+	Notification NotifiarrNotification `json:"notification"`
+	Discord      NotifiarrDiscord      `json:"discord"`
+}
+
+type NotifiarrNotification struct {
+	Update bool   `json:"update"`
+	Name   string `json:"name"`
+	Event  string `json:"event,omitempty"`
+}
+
+type NotifiarrDiscord struct {
+	Color  string           `json:"color,omitempty"`
+	Ping   NotifiarrPing    `json:"ping,omitempty"`
+	Images NotifiarrImages  `json:"images,omitempty"`
+	Text   NotifiarrText    `json:"text"`
+	IDs    NotifiarrIDs     `json:"ids,omitempty"`
+}
+
+type NotifiarrPing struct {
+	PingUser int64 `json:"pingUser,omitempty"`
+	PingRole int64 `json:"pingRole,omitempty"`
+}
+
+type NotifiarrImages struct {
+	Thumbnail string `json:"thumbnail,omitempty"`
+	Image     string `json:"image,omitempty"`
+}
+
+type NotifiarrText struct {
+	Title       string `json:"title"`
+	Icon        string `json:"icon,omitempty"`
+	Content     string `json:"content,omitempty"`
+	Description string `json:"description"`
+	Fields      []any  `json:"fields,omitempty"`
+	Footer      string `json:"footer,omitempty"`
+}
+
+type NotifiarrIDs struct {
+	Channel int64 `json:"channel,omitempty"`
+}
+
+// SendNotification sends a notification via Notifiarr
+func (ns *NotifiarrService) SendNotification(config *AlertConfiguration, message string) error {
+	// fmt.Printf("📡 [NOTIFIARR] Attempting to send notification...\n")
+	// fmt.Printf("📡 [NOTIFIARR] Config - API Token present: %v\n", config.APIToken != "")
+	// fmt.Printf("📡 [NOTIFIARR] Message: %s\n", message)
+
+	if config.APIToken == "" {
+		return fmt.Errorf("notifiarr API token is required")
+	}
+
+	// Parse channel ID if provided
+	var channelID int64
+	if config.ChannelID != "" {
+		if parsed, err := strconv.ParseInt(config.ChannelID, 10, 64); err == nil {
+			channelID = parsed
+		}
+	}
+
+	url := fmt.Sprintf("https://notifiarr.com/api/v1/notification/passthrough/%s", config.APIToken)
+	// fmt.Printf("📡 [NOTIFIARR] API URL: %s\n", strings.Replace(url, config.APIToken, "[REDACTED]", 1))
+
+	// Create status-based color
+	color := ns.getStatusColor(message)
+	
+	payload := NotifiarrPayload{
+		Notification: NotifiarrNotification{
+			Update: false,
+			Name:   "This is an automated notification from CheckCle System",
+			Event:  "",
+		},
+		Discord: NotifiarrDiscord{
+			Color: color,
+			Text: NotifiarrText{
+				Title:       "Service Alert",
+				Description: message,
+				Footer:      "CheckCle Monitoring System",
+			},
+			IDs: NotifiarrIDs{
+				Channel: channelID,
+			},
+		},
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+
+	// fmt.Printf("📡 [NOTIFIARR] Sending POST request...\n")
+	resp, err := http.Post(url, "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		// fmt.Printf("❌ [NOTIFIARR] HTTP error: %v\n", err)
+		return err
+	}
+	defer resp.Body.Close()
+
+	// Check response status
+	if resp.StatusCode != http.StatusOK {
+		// fmt.Printf("❌ [NOTIFIARR] HTTP status error: %d\n", resp.StatusCode)
+		return fmt.Errorf("notifiarr API error: status code %d", resp.StatusCode)
+	}
+
+	// fmt.Printf("✅ [NOTIFIARR] Message sent successfully!\n")
+	return nil
+}
+
+// SendServerNotification sends a server-specific notification via Notifiarr
+func (ns *NotifiarrService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := ns.generateServerMessage(payload, template, resourceType)
+	return ns.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via Notifiarr
+func (ns *NotifiarrService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := ns.generateServiceMessage(payload, template)
+	return ns.SendNotification(config, message)
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (ns *NotifiarrService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ns.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return ns.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (ns *NotifiarrService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ns.generateDefaultUptimeMessage(payload)
+	}
+	
+	return ns.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (ns *NotifiarrService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", ns.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", ns.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := ns.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", ns.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", ns.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", ns.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", ns.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", ns.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", ns.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", ns.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", ns.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", ns.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", ns.safeString(payload.Threshold))
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", ns.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", ns.safeString(payload.ErrorMessage))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (ns *NotifiarrService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// getStatusColor returns appropriate color for status
+func (ns *NotifiarrService) getStatusColor(message string) string {
+	messageLower := strings.ToLower(message)
+	
+	if strings.Contains(messageLower, "down") || strings.Contains(messageLower, "error") || strings.Contains(messageLower, "failed") {
+		return "FF0000" // Red
+	} else if strings.Contains(messageLower, "up") || strings.Contains(messageLower, "restored") || strings.Contains(messageLower, "resolved") {
+		return "00FF00" // Green
+	} else if strings.Contains(messageLower, "warning") || strings.Contains(messageLower, "alert") {
+		return "FFA500" // Orange
+	}
+	
+	return "0099FF" // Blue (default)
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (ns *NotifiarrService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	// Status emoji mapping
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	case "maintenance", "paused":
+		statusEmoji = "🟠"
+	}
+	
+	message := fmt.Sprintf("%s Service %s is %s.", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf(" - Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf(" - Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf(" - Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf(" - Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf(" - Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf(" - Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, " - Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf(" - Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf(" - Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf(" - Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf(" - Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (ns *NotifiarrService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	}
+	
+	return fmt.Sprintf("%s 🖥️ Server %s (%s) status: %s", statusEmoji, payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/ntfy.go b/server/service-operation/notification/ntfy.go
new file mode 100644
index 0000000..9674445
--- /dev/null
+++ b/server/service-operation/notification/ntfy.go
@@ -0,0 +1,400 @@
+
+package notification
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// NtfyService handles NTFY push notifications
+type NtfyService struct{}
+
+// NewNtfyService creates a new NTFY notification service
+func NewNtfyService() *NtfyService {
+	return &NtfyService{}
+}
+
+// SendNotification sends a notification via NTFY
+func (ns *NtfyService) SendNotification(config *AlertConfiguration, message string) error {
+	if config.NtfyEndpoint == "" {
+		return fmt.Errorf("ntfy endpoint is required")
+	}
+
+	// Create HTTP request with plain text message
+	req, err := http.NewRequest("POST", config.NtfyEndpoint, strings.NewReader(message))
+	if err != nil {
+		return fmt.Errorf("failed to create NTFY request: %v", err)
+	}
+
+	// Set headers for NTFY
+	req.Header.Set("Content-Type", "text/plain; charset=utf-8")
+	req.Header.Set("Title", "🔔 CheckCle Service Alert")
+	req.Header.Set("Tags", "monitoring")
+	req.Header.Set("Priority", "default")
+	
+	// Add API token authentication if provided
+	if config.APIToken != "" {
+		req.Header.Set("Authorization", "Bearer "+config.APIToken)
+	}
+
+	// Send the request
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to send NTFY notification: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("ntfy API error, status: %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// SendServerNotification sends a server-specific notification via NTFY
+func (ns *NtfyService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := ns.generateServerMessage(payload, template, resourceType)
+	return ns.SendNotificationWithDetails(config, message, "🔔 Server Alert", resourceType)
+}
+
+// SendServiceNotification sends a service-specific notification via NTFY
+func (ns *NtfyService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := ns.generateServiceMessage(payload, template)
+	return ns.SendNotificationWithDetails(config, message, "🔔 Service Alert", "service")
+}
+
+// SendNotificationWithDetails sends a notification with custom title and tags
+func (ns *NtfyService) SendNotificationWithDetails(config *AlertConfiguration, message, title, alertType string) error {
+	if config.NtfyEndpoint == "" {
+		return fmt.Errorf("ntfy endpoint is required")
+	}
+
+	// Create HTTP request with plain text message
+	req, err := http.NewRequest("POST", config.NtfyEndpoint, strings.NewReader(message))
+	if err != nil {
+		return fmt.Errorf("failed to create NTFY request: %v", err)
+	}
+
+	// Set headers for NTFY with dynamic values
+	req.Header.Set("Content-Type", "text/plain; charset=utf-8")
+	req.Header.Set("Title", title)
+	
+	// Set appropriate tags and priority based on alert type and message content
+	tags := "monitoring"
+	priority := "default"
+	
+	// Determine priority and tags based on message content
+	messageLower := strings.ToLower(message)
+	if strings.Contains(messageLower, "down") || strings.Contains(messageLower, "critical") || strings.Contains(messageLower, "expired") {
+		priority = "high"
+		tags = "rotating_light,warning"
+	} else if strings.Contains(messageLower, "warning") || strings.Contains(messageLower, "expiring") {
+		priority = "default"
+		tags = "warning"
+	} else if strings.Contains(messageLower, "up") || strings.Contains(messageLower, "restored") || strings.Contains(messageLower, "resolved") {
+		priority = "default"
+		tags = "white_check_mark"
+	}
+	
+	// Add resource type specific tags
+	switch alertType {
+	case "cpu":
+		tags += ",cpu"
+	case "ram", "memory":
+		tags += ",memory"
+	case "disk":
+		tags += ",floppy_disk"
+	case "network":
+		tags += ",globe_with_meridians"
+	case "service":
+		tags += ",gear"
+	case "ssl":
+		tags += ",lock"
+	}
+	
+	req.Header.Set("Tags", tags)
+	req.Header.Set("Priority", priority)
+	
+	// Add API token authentication if provided
+	if config.APIToken != "" {
+		req.Header.Set("Authorization", "Bearer "+config.APIToken)
+	}
+
+	// Send the request
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to send NTFY notification: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("ntfy API error, status: %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (ns *NtfyService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ns.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return ns.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (ns *NtfyService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ns.generateDefaultUptimeMessage(payload)
+	}
+	
+	return ns.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (ns *NtfyService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", ns.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", ns.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := ns.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", ns.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", ns.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", ns.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", ns.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", ns.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", ns.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", ns.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", ns.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", ns.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", ns.safeString(payload.Threshold))
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", ns.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", ns.safeString(payload.ErrorMessage))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (ns *NtfyService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (ns *NtfyService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	// Status emoji mapping for NTFY
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	case "maintenance", "paused":
+		statusEmoji = "🟠"
+	}
+	
+	message := fmt.Sprintf("%s Service %s is %s.", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf("Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf("Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf("Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf("Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf("Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf("Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, "Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf("Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf("Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf("Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf("Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (ns *NtfyService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	}
+	
+	return fmt.Sprintf("%s🖥️ Server %s (%s) status: %s", statusEmoji, payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/pushover.go b/server/service-operation/notification/pushover.go
new file mode 100644
index 0000000..f7d737e
--- /dev/null
+++ b/server/service-operation/notification/pushover.go
@@ -0,0 +1,360 @@
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// PushoverService handles Pushover notifications
+type PushoverService struct{}
+
+// NewPushoverService creates a new Pushover notification service
+func NewPushoverService() *PushoverService {
+	return &PushoverService{}
+}
+
+// PushoverPayload represents the payload for Pushover API
+type PushoverPayload struct {
+	Token   string `json:"token"`
+	User    string `json:"user"`
+	Message string `json:"message"`
+	Title   string `json:"title,omitempty"`
+}
+
+// PushoverResponse represents the response from Pushover API
+type PushoverResponse struct {
+	Status  int      `json:"status"`
+	Request string   `json:"request"`
+	User    string   `json:"user,omitempty"`
+	Errors  []string `json:"errors,omitempty"`
+}
+
+// SendNotification sends a notification via Pushover
+func (ps *PushoverService) SendNotification(config *AlertConfiguration, message string) error {
+	// fmt.Printf("📱 [PUSHOVER] Attempting to send notification...\n")
+	// fmt.Printf("📱 [PUSHOVER] Config - API Token: %s, User Key: %s, Notify Name: %s\n", 
+	//     maskToken(config.APIToken), maskToken(config.UserKey), config.NotifyName)
+	// fmt.Printf("📱 [PUSHOVER] Message: %s\n", message)
+
+	if config.APIToken == "" || config.UserKey == "" {
+		return fmt.Errorf("Pushover API token and user key are required")
+	}
+
+	// Prepare the payload
+	payload := PushoverPayload{
+		Token:   config.APIToken,
+		User:    config.UserKey,
+		Message: message,
+		Title:   config.NotifyName, // Use notify_name as the title
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		// fmt.Printf("❌ [PUSHOVER] JSON marshal error: %v\n", err)
+		return err
+	}
+
+	// fmt.Printf("📱 [PUSHOVER] Payload: %s\n", string(jsonData))
+	// fmt.Printf("📱 [PUSHOVER] Sending POST request to Pushover API...\n")
+
+	// Send the request to Pushover API
+	resp, err := http.Post("https://api.pushover.net/1/messages.json", "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		// fmt.Printf("❌ [PUSHOVER] HTTP error: %v\n", err)
+		return err
+	}
+	defer resp.Body.Close()
+
+	// Parse the response
+	var pushoverResp PushoverResponse
+	if err := json.NewDecoder(resp.Body).Decode(&pushoverResp); err != nil {
+		// fmt.Printf("❌ [PUSHOVER] Response decode error: %v\n", err)
+		return err
+	}
+
+	// fmt.Printf("📱 [PUSHOVER] API response: %+v\n", pushoverResp)
+
+	// Check if the request was successful
+	if pushoverResp.Status != 1 {
+		errorMsg := "Unknown error"
+		if len(pushoverResp.Errors) > 0 {
+			errorMsg = strings.Join(pushoverResp.Errors, ", ")
+		}
+		// fmt.Printf("❌ [PUSHOVER] API error: %s\n", errorMsg)
+		return fmt.Errorf("Pushover API error: %s", errorMsg)
+	}
+
+	// fmt.Printf("✅ [PUSHOVER] Message sent successfully!\n")
+	return nil
+}
+
+// SendServerNotification sends a server-specific notification via Pushover
+func (ps *PushoverService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := ps.generateServerMessage(payload, template, resourceType)
+	return ps.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via Pushover
+func (ps *PushoverService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := ps.generateServiceMessage(payload, template)
+	return ps.SendNotification(config, message)
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (ps *PushoverService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ps.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return ps.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (ps *PushoverService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ps.generateDefaultUptimeMessage(payload)
+	}
+	
+	return ps.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (ps *PushoverService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${server_name}", payload.ServiceName) // server_name maps to service_name
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", ps.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", ps.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := ps.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", ps.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", ps.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", ps.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", ps.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", ps.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", ps.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", ps.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", ps.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", ps.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", ps.safeString(payload.Threshold))
+	
+	// Replace SSL certificate fields
+	message = strings.ReplaceAll(message, "${certificate_name}", ps.safeString(payload.CertificateName))
+	message = strings.ReplaceAll(message, "${expiry_date}", ps.safeString(payload.ExpiryDate))
+	message = strings.ReplaceAll(message, "${days_left}", ps.safeString(payload.DaysLeft))
+	message = strings.ReplaceAll(message, "${issuer_cn}", ps.safeString(payload.IssuerCN))
+	message = strings.ReplaceAll(message, "${issuer}", ps.safeString(payload.IssuerCN)) // alias
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", ps.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", ps.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${message}", ps.safeString(payload.Message))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (ps *PushoverService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (ps *PushoverService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	message := fmt.Sprintf("Service %s is %s.", payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf("Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf("Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf("Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf("Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf("Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf("Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, "Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf("Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf("Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf("Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf("Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (ps *PushoverService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	return fmt.Sprintf("Server %s (%s) status: %s", payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
+
+// maskToken masks a token for logging purposes
+func maskToken(token string) string {
+	if len(token) <= 8 {
+		return strings.Repeat("*", len(token))
+	}
+	return token[:4] + strings.Repeat("*", len(token)-8) + token[len(token)-4:]
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/server_manager.go b/server/service-operation/notification/server_manager.go
new file mode 100644
index 0000000..55d64ed
--- /dev/null
+++ b/server/service-operation/notification/server_manager.go
@@ -0,0 +1,480 @@
+
+package notification
+
+import (
+	"fmt"
+	"strings"
+
+	"service-operation/pocketbase"
+)
+
+// ServerNotificationManager handles server-specific notifications
+type ServerNotificationManager struct {
+	pbClient *pocketbase.PocketBaseClient
+	services map[string]NotificationService
+}
+
+// NewServerNotificationManager creates a new server notification manager
+func NewServerNotificationManager(pbClient *pocketbase.PocketBaseClient, services map[string]NotificationService) *ServerNotificationManager {
+	return &ServerNotificationManager{
+		pbClient: pbClient,
+		services: services,
+	}
+}
+
+// SendServiceNotification sends notification for a service based on its configuration
+func (snm *ServerNotificationManager) SendServiceNotification(payload *NotificationPayload, notificationID, templateID string) error {
+	// log.Printf("📨 SendServiceNotification called with notification_id: %s, template_id: %s", notificationID, templateID)
+	// log.Printf("📨 Payload: %+v", payload)
+	
+	if notificationID == "" {
+		// log.Printf("❌ Notification ID is required but was empty")
+		return fmt.Errorf("notification ID is required")
+	}
+
+	// Parse multiple notification IDs
+	notificationIDs := parseNotificationIDs(notificationID)
+	if len(notificationIDs) == 0 {
+		// log.Printf("❌ No valid notification IDs found")
+		return fmt.Errorf("no valid notification IDs found")
+	}
+
+	var errors []string
+	successCount := 0
+
+	// Send notification to each channel
+	for _, id := range notificationIDs {
+		// log.Printf("📤 Processing notification ID: %s", id)
+		
+		// Check if notification is enabled
+		if !isNotificationEnabled(snm.pbClient, id) {
+			// log.Printf("⚠️  Notification %s is disabled, skipping", id)
+			continue
+		}
+
+		// Get alert configuration
+		alertConfig, err := getAlertConfiguration(snm.pbClient, id)
+		if err != nil {
+			// log.Printf("❌ Failed to get alert configuration for %s: %v", id, err)
+			errors = append(errors, fmt.Sprintf("failed to get config for %s: %v", id, err))
+			continue
+		}
+
+		// Get template if provided
+		var template *ServerNotificationTemplate
+		if templateID != "" {
+			template, err = getNotificationTemplate(snm.pbClient, templateID)
+			if err != nil {
+				// log.Printf("⚠️  Warning: failed to get template %s for notification %s: %v", templateID, id, err)
+			}
+		}
+
+		// Generate message from template or use default
+		message := snm.generateMessage(payload, template)
+		// log.Printf("📝 Generated message for %s: %s", id, message)
+
+		// Send notification using appropriate service
+		service, exists := snm.services[alertConfig.NotificationType]
+		if !exists {
+			// log.Printf("❌ Unsupported notification type for %s: %s", id, alertConfig.NotificationType)
+			errors = append(errors, fmt.Sprintf("unsupported notification type for %s: %s", id, alertConfig.NotificationType))
+			continue
+		}
+
+		err = service.SendNotification(alertConfig, message)
+		if err != nil {
+			// log.Printf("❌ Failed to send notification via %s for %s: %v", alertConfig.NotificationType, id, err)
+			errors = append(errors, fmt.Sprintf("failed to send via %s for %s: %v", alertConfig.NotificationType, id, err))
+		} else {
+			// log.Printf("✅ Successfully sent notification via %s for %s", alertConfig.NotificationType, id)
+			successCount++
+		}
+	}
+
+	// Report results
+	if successCount > 0 {
+		// log.Printf("✅ Successfully sent %d out of %d notifications", successCount, len(notificationIDs))
+	}
+
+	if len(errors) > 0 {
+		// log.Printf("❌ Errors occurred: %v", errors)
+		if successCount == 0 {
+			return fmt.Errorf("all notifications failed: %v", errors)
+		}
+		// If some succeeded, just log errors but don't return error
+		// log.Printf("⚠️  Some notifications failed but %d succeeded", successCount)
+	}
+
+	return nil
+}
+
+// SendResourceNotification sends notification for specific resource alerts (CPU, RAM, Disk, etc.)
+func (snm *ServerNotificationManager) SendResourceNotification(payload *NotificationPayload, notificationID, templateID, resourceType string) error {
+	// log.Printf("📨 SendResourceNotification called for resource: %s", resourceType)
+	// log.Printf("📨 Notification ID: %s, Template ID: %s", notificationID, templateID)
+	// log.Printf("📨 Payload: %+v", payload)
+	
+	if notificationID == "" {
+		// log.Printf("❌ Notification ID is required but was empty")
+		return fmt.Errorf("notification ID is required")
+	}
+
+	// Parse multiple notification IDs
+	notificationIDs := parseNotificationIDs(notificationID)
+	if len(notificationIDs) == 0 {
+		// log.Printf("❌ No valid notification IDs found")
+		return fmt.Errorf("no valid notification IDs found")
+	}
+
+	var errors []string
+	successCount := 0
+
+	// Send notification to each channel
+	for _, id := range notificationIDs {
+		// log.Printf("📤 Processing resource notification ID: %s", id)
+		
+		// Check if notification is enabled
+		if !isNotificationEnabled(snm.pbClient, id) {
+			// log.Printf("⚠️  Notification %s is disabled, skipping", id)
+			continue
+		}
+
+		// Get alert configuration
+		alertConfig, err := getAlertConfiguration(snm.pbClient, id)
+		if err != nil {
+			// log.Printf("❌ Failed to get alert configuration for %s: %v", id, err)
+			errors = append(errors, fmt.Sprintf("failed to get config for %s: %v", id, err))
+			continue
+		}
+
+		// Get template if provided
+		var template *ServerNotificationTemplate
+		if templateID != "" {
+			template, err = getNotificationTemplate(snm.pbClient, templateID)
+			if err != nil {
+				// log.Printf("⚠️  Warning: failed to get template %s for notification %s: %v", templateID, id, err)
+			}
+		}
+
+		// Generate resource-specific message
+		message := snm.generateResourceMessage(payload, template, resourceType)
+		// log.Printf("📝 Generated resource message for %s: %s", id, message)
+
+		// Send notification
+		service, exists := snm.services[alertConfig.NotificationType]
+		if !exists {
+			// log.Printf("❌ Unsupported notification type for %s: %s", id, alertConfig.NotificationType)
+			errors = append(errors, fmt.Sprintf("unsupported notification type for %s: %s", id, alertConfig.NotificationType))
+			continue
+		}
+
+		err = service.SendNotification(alertConfig, message)
+		if err != nil {
+			// log.Printf("❌ Failed to send resource notification via %s for %s: %v", alertConfig.NotificationType, id, err)
+			errors = append(errors, fmt.Sprintf("failed to send via %s for %s: %v", alertConfig.NotificationType, id, err))
+		} else {
+			// log.Printf("✅ Successfully sent resource notification via %s for %s", alertConfig.NotificationType, id)
+			successCount++
+		}
+	}
+
+	// Report results
+	if successCount > 0 {
+		// log.Printf("✅ Successfully sent %d out of %d resource notifications", successCount, len(notificationIDs))
+	}
+
+	if len(errors) > 0 {
+		// log.Printf("❌ Resource notification errors occurred: %v", errors)
+		if successCount == 0 {
+			return fmt.Errorf("all resource notifications failed: %v", errors)
+		}
+		// If some succeeded, just log errors but don't return error
+		// log.Printf("⚠️  Some resource notifications failed but %d succeeded", successCount)
+	}
+
+	return nil
+}
+
+// generateResourceMessage creates notification message for specific resource alerts
+func (snm *ServerNotificationManager) generateResourceMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var baseMessage string
+
+	// Select appropriate resource message from template based on status
+	if template != nil {
+		// log.Printf("🔧 Using template for resource type: %s with status: %s", resourceType, payload.Status)
+		
+		// Check if this is a recovery/restore notification
+		if payload.Status == "up" {
+			// Use restore messages for recovery notifications
+			switch strings.ToLower(resourceType) {
+			case "cpu":
+				baseMessage = template.RestoreCPUMessage
+			case "ram", "memory":
+				baseMessage = template.RestoreRAMMessage
+			case "disk":
+				baseMessage = template.RestoreDiskMessage
+			case "network":
+				baseMessage = template.RestoreNetworkMessage
+			case "cpu_temp", "cpu_temperature":
+				baseMessage = template.RestoreCPUTempMessage
+			case "disk_io":
+				baseMessage = template.RestoreDiskIOMessage
+			default:
+				baseMessage = template.UpMessage // fallback to general up message
+			}
+		} else {
+			// Use regular alert messages for warning/down notifications
+			switch strings.ToLower(resourceType) {
+			case "cpu":
+				baseMessage = template.CPUMessage
+			case "ram", "memory":
+				baseMessage = template.RAMMessage
+			case "disk":
+				baseMessage = template.DiskMessage
+			case "network":
+				baseMessage = template.NetworkMessage
+			case "cpu_temp", "cpu_temperature":
+				baseMessage = template.CPUTempMessage
+			case "disk_io":
+				baseMessage = template.DiskIOMessage
+			default:
+				baseMessage = template.WarningMessage // fallback to warning message
+			}
+		}
+		
+		// log.Printf("📝 Template message selected for %s (status: %s): %s", resourceType, payload.Status, baseMessage)
+	}
+
+	// If no template or empty message, use default
+	if baseMessage == "" {
+		// log.Printf("🔧 Using default message for resource %s", resourceType)
+		baseMessage = snm.getDefaultResourceMessage(payload, resourceType)
+	}
+
+	// Replace placeholders with actual values
+	message := snm.replacePlaceholders(baseMessage, payload)
+	
+	// log.Printf("📝 Final resource message after placeholder replacement: %s", message)
+	return message
+}
+
+// getDefaultResourceMessage provides default messages for resource alerts
+func (snm *ServerNotificationManager) getDefaultResourceMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "⚠️"
+	statusText := "Alert"
+	
+	if payload.Status == "up" {
+		statusEmoji = "✅"
+		statusText = "Recovery"
+	} else if payload.Status == "down" {
+		statusEmoji = "❌"
+		statusText = "Critical"
+	}
+
+	switch strings.ToLower(resourceType) {
+	case "cpu":
+		if payload.Status == "up" {
+			return fmt.Sprintf("%s CPU %s: Server %s CPU usage has returned to normal: %s", statusEmoji, statusText, payload.ServiceName, payload.CPUUsage)
+		}
+		return fmt.Sprintf("%s CPU %s: Server %s CPU usage is %s", statusEmoji, statusText, payload.ServiceName, payload.CPUUsage)
+	case "ram", "memory":
+		if payload.Status == "up" {
+			return fmt.Sprintf("%s RAM %s: Server %s RAM usage has returned to normal: %s", statusEmoji, statusText, payload.ServiceName, payload.RAMUsage)
+		}
+		return fmt.Sprintf("%s RAM %s: Server %s RAM usage is %s", statusEmoji, statusText, payload.ServiceName, payload.RAMUsage)
+	case "disk":
+		if payload.Status == "up" {
+			return fmt.Sprintf("%s Disk %s: Server %s disk usage has returned to normal: %s", statusEmoji, statusText, payload.ServiceName, payload.DiskUsage)
+		}
+		return fmt.Sprintf("%s Disk %s: Server %s disk usage is %s", statusEmoji, statusText, payload.ServiceName, payload.DiskUsage)
+	case "network":
+		if payload.Status == "up" {
+			return fmt.Sprintf("%s Network %s: Server %s network usage has returned to normal: %s", statusEmoji, statusText, payload.ServiceName, payload.NetworkUsage)
+		}
+		return fmt.Sprintf("%s Network %s: Server %s network usage is %s", statusEmoji, statusText, payload.ServiceName, payload.NetworkUsage)
+	case "cpu_temp", "cpu_temperature":
+		if payload.Status == "up" {
+			return fmt.Sprintf("%s CPU Temperature %s: Server %s CPU temperature has returned to normal: %s", statusEmoji, statusText, payload.ServiceName, payload.CPUTemp)
+		}
+		return fmt.Sprintf("%s CPU Temperature %s: Server %s CPU temperature is %s", statusEmoji, statusText, payload.ServiceName, payload.CPUTemp)
+	case "disk_io":
+		if payload.Status == "up" {
+			return fmt.Sprintf("%s Disk I/O %s: Server %s disk I/O has returned to normal: %s", statusEmoji, statusText, payload.ServiceName, payload.DiskIO)
+		}
+		return fmt.Sprintf("%s Disk I/O %s: Server %s disk I/O is %s", statusEmoji, statusText, payload.ServiceName, payload.DiskIO)
+	default:
+		if payload.Status == "up" {
+			return fmt.Sprintf("%s Resource %s: Server %s %s has recovered", statusEmoji, statusText, payload.ServiceName, payload.Message)
+		}
+		return fmt.Sprintf("%s Resource %s: Server %s %s", statusEmoji, statusText, payload.ServiceName, payload.Message)
+	}
+}
+
+// generateMessage creates notification message from template or default
+func (snm *ServerNotificationManager) generateMessage(payload *NotificationPayload, template *ServerNotificationTemplate) string {
+	var baseMessage string
+
+	// Select appropriate message based on status and template
+	if template != nil {
+		// log.Printf("🔧 Using template for status: %s", strings.ToLower(payload.Status))
+		switch strings.ToLower(payload.Status) {
+		case "up":
+			baseMessage = template.UpMessage
+		case "down":
+			baseMessage = template.DownMessage
+		case "warning":
+			baseMessage = template.WarningMessage
+		case "paused":
+			baseMessage = template.PausedMessage
+		default:
+			baseMessage = template.UpMessage // fallback
+		}
+		// log.Printf("📝 Template message selected: %s", baseMessage)
+	}
+
+	// If no template or empty message, use default
+	if baseMessage == "" {
+		// log.Printf("🔧 Using default message (no template or empty template message)")
+		baseMessage = snm.getDefaultMessage(payload)
+	}
+
+	// Replace placeholders with actual values
+	message := snm.replacePlaceholders(baseMessage, payload)
+	
+	// log.Printf("📝 Final message after placeholder replacement: %s", message)
+	return message
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (snm *ServerNotificationManager) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Service/Server name placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${server_name}", payload.ServiceName) // For server notifications
+	
+	// Status placeholder
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	
+	// Host/IP placeholders
+	message = strings.ReplaceAll(message, "${host}", payload.Host)
+	message = strings.ReplaceAll(message, "${ip}", payload.Host) // Alternative placeholder
+	message = strings.ReplaceAll(message, "${ip_address}", payload.Host) // New server monitoring placeholder
+
+	// Hostname placeholder
+	message = strings.ReplaceAll(message, "${hostname}", payload.Hostname)
+	
+	// Port placeholder
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	// Response time placeholder
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	// Timestamp placeholders
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${date}", payload.Timestamp.Format("2006-01-02"))
+	
+	// Service type placeholder
+	message = strings.ReplaceAll(message, "${service_type}", payload.ServiceType)
+	
+	// Error message placeholder
+	if payload.ErrorMessage != "" {
+		message = strings.ReplaceAll(message, "${error}", payload.ErrorMessage)
+		message = strings.ReplaceAll(message, "${error_message}", payload.ErrorMessage)
+	} else {
+		message = strings.ReplaceAll(message, "${error}", "")
+		message = strings.ReplaceAll(message, "${error_message}", "")
+	}
+	
+	// Custom message placeholder
+	if payload.Message != "" {
+		message = strings.ReplaceAll(message, "${message}", payload.Message)
+	}
+
+	// Server monitoring specific placeholders
+	if payload.CPUUsage != "" {
+		message = strings.ReplaceAll(message, "${cpu_usage}", payload.CPUUsage)
+	} else {
+		message = strings.ReplaceAll(message, "${cpu_usage}", "N/A")
+	}
+
+	if payload.RAMUsage != "" {
+		message = strings.ReplaceAll(message, "${ram_usage}", payload.RAMUsage)
+	} else {
+		message = strings.ReplaceAll(message, "${ram_usage}", "N/A")
+	}
+
+	if payload.DiskUsage != "" {
+		message = strings.ReplaceAll(message, "${disk_usage}", payload.DiskUsage)
+	} else {
+		message = strings.ReplaceAll(message, "${disk_usage}", "N/A")
+	}
+
+	if payload.NetworkUsage != "" {
+		message = strings.ReplaceAll(message, "${network_usage}", payload.NetworkUsage)
+	} else {
+		message = strings.ReplaceAll(message, "${network_usage}", "N/A")
+	}
+
+	if payload.CPUTemp != "" {
+		message = strings.ReplaceAll(message, "${cpu_temp}", payload.CPUTemp)
+	} else {
+		message = strings.ReplaceAll(message, "${cpu_temp}", "N/A")
+	}
+
+	if payload.DiskIO != "" {
+		message = strings.ReplaceAll(message, "${disk_io}", payload.DiskIO)
+	} else {
+		message = strings.ReplaceAll(message, "${disk_io}", "N/A")
+	}
+
+	if payload.Threshold != "" {
+		message = strings.ReplaceAll(message, "${threshold}", payload.Threshold)
+	} else {
+		message = strings.ReplaceAll(message, "${threshold}", "N/A")
+	}
+
+	return message
+}
+
+// getDefaultMessage provides a default notification message
+func (snm *ServerNotificationManager) getDefaultMessage(payload *NotificationPayload) string {
+	statusEmoji := "✅"
+	if payload.Status == "down" {
+		statusEmoji = "❌"
+	} else if payload.Status == "warning" {
+		statusEmoji = "⚠️"
+	}
+
+	message := fmt.Sprintf("%s Server Alert\n\n", statusEmoji)
+	message += fmt.Sprintf("Server: %s\n", payload.ServiceName)
+	message += fmt.Sprintf("Status: %s\n", strings.ToUpper(payload.Status))
+	message += fmt.Sprintf("IP Address: %s\n", payload.Host)
+	
+	if payload.CPUUsage != "" {
+		message += fmt.Sprintf("CPU Usage: %s\n", payload.CPUUsage)
+	}
+	
+	if payload.RAMUsage != "" {
+		message += fmt.Sprintf("RAM Usage: %s\n", payload.RAMUsage)
+	}
+	
+	if payload.DiskUsage != "" {
+		message += fmt.Sprintf("Disk Usage: %s\n", payload.DiskUsage)
+	}
+	
+	message += fmt.Sprintf("Time: %s\n", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	if payload.ErrorMessage != "" {
+		message += fmt.Sprintf("Error: %s\n", payload.ErrorMessage)
+	}
+
+	return message
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/shared.go b/server/service-operation/notification/shared.go
new file mode 100644
index 0000000..1ef89ee
--- /dev/null
+++ b/server/service-operation/notification/shared.go
@@ -0,0 +1,141 @@
+
+package notification
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"service-operation/pocketbase"
+)
+
+// parseNotificationIDs parses comma-separated notification IDs
+func parseNotificationIDs(notificationID string) []string {
+	if notificationID == "" {
+		return []string{}
+	}
+	
+	// Split by comma and trim whitespace
+	ids := strings.Split(notificationID, ",")
+	var cleanIDs []string
+	for _, id := range ids {
+		cleanID := strings.TrimSpace(id)
+		if cleanID != "" {
+			cleanIDs = append(cleanIDs, cleanID)
+		}
+	}
+	
+	//log.Printf("📋 Parsed notification IDs: %v", cleanIDs)
+	return cleanIDs
+}
+
+// isNotificationEnabled checks if the notification is enabled
+func isNotificationEnabled(pbClient *pocketbase.PocketBaseClient, notificationID string) bool {
+	config, err := getAlertConfiguration(pbClient, notificationID)
+	if err != nil {
+		//log.Printf("❌ Error getting alert configuration for enabled check: %v", err)
+		return false
+	}
+	
+	enabled, err := strconv.ParseBool(config.Enabled)
+	if err != nil {
+		//log.Printf("❌ Error parsing enabled field: %v", err)
+		return false
+	}
+	
+	//log.Printf("ℹ️  Notification %s enabled status: %t", notificationID, enabled)
+	return enabled
+}
+
+// getAlertConfiguration fetches alert configuration from PocketBase
+func getAlertConfiguration(pbClient *pocketbase.PocketBaseClient, notificationID string) (*AlertConfiguration, error) {
+	url := fmt.Sprintf("%s/api/collections/alert_configurations/records/%s", pbClient.GetBaseURL(), notificationID)
+	//log.Printf("🌐 Fetching alert configuration from: %s", url)
+	
+	resp, err := http.Get(url)
+	if err != nil {
+		//log.Printf("❌ HTTP error fetching alert configuration: %v", err)
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		log.Printf("❌ Failed to fetch alert configuration, status: %d", resp.StatusCode)
+		return nil, fmt.Errorf("failed to fetch alert configuration, status: %d", resp.StatusCode)
+	}
+
+	var config AlertConfiguration
+	if err := json.NewDecoder(resp.Body).Decode(&config); err != nil {
+		//log.Printf("❌ Error decoding alert configuration JSON: %v", err)
+		return nil, err
+	}
+
+	//log.Printf("✅ Successfully fetched alert configuration: %+v", config)
+	return &config, nil
+}
+
+// getNotificationTemplate fetches server notification template from PocketBase
+func getNotificationTemplate(pbClient *pocketbase.PocketBaseClient, templateID string) (*ServerNotificationTemplate, error) {
+	url := fmt.Sprintf("%s/api/collections/server_notification_templates/records/%s", pbClient.GetBaseURL(), templateID)
+	//log.Printf("🌐 Fetching notification template from: %s", url)
+	
+	resp, err := http.Get(url)
+	if err != nil {
+		//log.Printf("❌ HTTP error fetching notification template: %v", err)
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		log.Printf("❌ Failed to fetch notification template, status: %d", resp.StatusCode)
+		return nil, fmt.Errorf("failed to fetch notification template, status: %d", resp.StatusCode)
+	}
+
+	var template ServerNotificationTemplate
+	if err := json.NewDecoder(resp.Body).Decode(&template); err != nil {
+		//log.Printf("❌ Error decoding notification template JSON: %v", err)
+		return nil, err
+	}
+
+	//log.Printf("✅ Successfully fetched notification template: %+v", template)
+	return &template, nil
+}
+
+// getServiceNotificationTemplate fetches service notification template from PocketBase
+func getServiceNotificationTemplate(pbClient *pocketbase.PocketBaseClient, templateID string) (*ServiceNotificationTemplate, error) {
+	url := fmt.Sprintf("%s/api/collections/service_notification_templates/records/%s", pbClient.GetBaseURL(), templateID)
+	//log.Printf("🌐 Fetching service notification template from: %s", url)
+	
+	resp, err := http.Get(url)
+	if err != nil {
+		//log.Printf("❌ HTTP error fetching service notification template: %v", err)
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		//log.Printf("❌ Failed to fetch service notification template, status: %d", resp.StatusCode)
+		return nil, fmt.Errorf("failed to fetch service notification template, status: %d", resp.StatusCode)
+	}
+
+	var template ServiceNotificationTemplate
+	if err := json.NewDecoder(resp.Body).Decode(&template); err != nil {
+		//log.Printf("❌ Error decoding service notification template JSON: %v", err)
+		return nil, err
+	}
+
+	//log.Printf("✅ Successfully fetched service notification template: %+v", template)
+	return &template, nil
+}
+
+// Helper function to get map keys
+func getKeys(m map[string]NotificationService) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	return keys
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/signal.go b/server/service-operation/notification/signal.go
new file mode 100644
index 0000000..1eb02bb
--- /dev/null
+++ b/server/service-operation/notification/signal.go
@@ -0,0 +1,371 @@
+
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// SignalService handles Signal notifications
+type SignalService struct{}
+
+// NewSignalService creates a new Signal notification service
+func NewSignalService() *SignalService {
+	return &SignalService{}
+}
+
+// SignalPayload represents the payload for Signal REST API
+type SignalPayload struct {
+	Number     string   `json:"number"`
+	Recipients []string `json:"recipients"`
+	Message    string   `json:"message"`
+}
+
+// SendNotification sends a notification via Signal REST API
+func (ss *SignalService) SendNotification(config *AlertConfiguration, message string) error {
+	// fmt.Printf("📱 [SIGNAL] Attempting to send notification...\n")
+	// fmt.Printf("📱 [SIGNAL] Config - Phone Number: %s, API Endpoint: %s\n", config.SignalNumber, config.SignalAPIEndpoint)
+	// fmt.Printf("📱 [SIGNAL] Message: %s\n", message)
+
+	if config.SignalNumber == "" {
+		return fmt.Errorf("signal phone number is required")
+	}
+
+	if config.SignalAPIEndpoint == "" {
+		return fmt.Errorf("signal API endpoint is required")
+	}
+
+	// Use the configured endpoint directly (it should already include the full path like /v2/send)
+	apiURL := config.SignalAPIEndpoint
+	// fmt.Printf("📱 [SIGNAL] API URL: %s\n", apiURL)
+
+	// Prepare payload for Signal REST API
+	payload := SignalPayload{
+		Number:     config.SignalNumber, // This should be the sender's number (registered with signal-cli)
+		Recipients: []string{config.SignalNumber}, // Send to the same number for now
+		Message:    message,
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		// fmt.Printf("❌ [SIGNAL] JSON marshal error: %v\n", err)
+		return fmt.Errorf("failed to marshal signal payload: %v", err)
+	}
+
+	// fmt.Printf("📱 [SIGNAL] Payload: %s\n", string(jsonData))
+	// fmt.Printf("📱 [SIGNAL] Sending POST request...\n")
+
+	// Send POST request to Signal REST API
+	resp, err := http.Post(apiURL, "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		// fmt.Printf("❌ [SIGNAL] HTTP error: %v\n", err)
+		return fmt.Errorf("failed to send signal request: %v", err)
+	}
+	defer resp.Body.Close()
+
+	// fmt.Printf("📱 [SIGNAL] Response Status: %d\n", resp.StatusCode)
+
+	// Check if the request was successful
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		// fmt.Printf("❌ [SIGNAL] HTTP Status error: %d\n", resp.StatusCode)
+		
+		// Try to read error response
+		var errorResponse map[string]interface{}
+		if err := json.NewDecoder(resp.Body).Decode(&errorResponse); err == nil {
+			// fmt.Printf("❌ [SIGNAL] Error response: %+v\n", errorResponse)
+			return fmt.Errorf("signal API error (status %d): %v", resp.StatusCode, errorResponse)
+		}
+		
+		return fmt.Errorf("signal API returned status %d", resp.StatusCode)
+	}
+
+	// Parse response
+	var result map[string]interface{}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		// fmt.Printf("❌ [SIGNAL] JSON decode error: %v\n", err)
+		// Don't fail if we can't decode response but got success status
+		// fmt.Printf("✅ [SIGNAL] Message sent successfully (response decode failed but status was OK)!\n")
+		return nil
+	}
+
+	// fmt.Printf("📱 [SIGNAL] Response: %+v\n", result)
+	// fmt.Printf("✅ [SIGNAL] Message sent successfully!\n")
+	return nil
+}
+
+// SendServerNotification sends a server-specific notification via Signal
+func (ss *SignalService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := ss.generateServerMessage(payload, template, resourceType)
+	return ss.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via Signal
+func (ss *SignalService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := ss.generateServiceMessage(payload, template)
+	return ss.SendNotification(config, message)
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (ss *SignalService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ss.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return ss.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (ss *SignalService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ss.generateDefaultUptimeMessage(payload)
+	}
+	
+	return ss.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (ss *SignalService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", ss.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", ss.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := ss.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", ss.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", ss.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", ss.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", ss.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", ss.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", ss.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", ss.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", ss.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", ss.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", ss.safeString(payload.Threshold))
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", ss.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", ss.safeString(payload.ErrorMessage))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (ss *SignalService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (ss *SignalService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	// Status emoji mapping
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	case "maintenance", "paused":
+		statusEmoji = "🟠"
+	}
+	
+	message := fmt.Sprintf("%s Service %s is %s.", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf(" - Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf(" - Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf(" - Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf(" - Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf(" - Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf(" - Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, " - Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf(" - Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf(" - Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf(" - Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf(" - Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (ss *SignalService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	}
+	
+	return fmt.Sprintf("%s 🖥️ Server %s (%s) status: %s", statusEmoji, payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/slack.go b/server/service-operation/notification/slack.go
new file mode 100644
index 0000000..3a9d825
--- /dev/null
+++ b/server/service-operation/notification/slack.go
@@ -0,0 +1,538 @@
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// SlackService handles Slack notifications
+type SlackService struct{}
+
+// NewSlackService creates a new Slack notification service
+func NewSlackService() *SlackService {
+	return &SlackService{}
+}
+
+// SlackPayload represents the payload for Slack webhook
+type SlackPayload struct {
+	Text        string            `json:"text"`
+	Username    string            `json:"username,omitempty"`
+	Channel     string            `json:"channel,omitempty"`
+	IconEmoji   string            `json:"icon_emoji,omitempty"`
+	Attachments []SlackAttachment `json:"attachments,omitempty"`
+	Blocks      []SlackBlock      `json:"blocks,omitempty"`
+}
+
+// SlackAttachment represents a Slack attachment
+type SlackAttachment struct {
+	Color     string `json:"color,omitempty"`
+	Title     string `json:"title,omitempty"`
+	Text      string `json:"text,omitempty"`
+	Timestamp int64  `json:"ts,omitempty"`
+	Fields    []SlackField `json:"fields,omitempty"`
+}
+
+// SlackField represents a field in Slack attachment
+type SlackField struct {
+	Title string `json:"title"`
+	Value string `json:"value"`
+	Short bool   `json:"short"`
+}
+
+// SlackBlock represents a Slack block element
+type SlackBlock struct {
+	Type string      `json:"type"`
+	Text *SlackText  `json:"text,omitempty"`
+}
+
+// SlackText represents text in Slack blocks
+type SlackText struct {
+	Type string `json:"type"`
+	Text string `json:"text"`
+}
+
+// SendNotification sends a notification via Slack webhook
+func (ss *SlackService) SendNotification(config *AlertConfiguration, message string) error {
+	if config.SlackWebhookURL == "" {
+		return fmt.Errorf("slack webhook URL is required")
+	}
+
+	// Parse and format the message for better Slack presentation
+	formattedPayload := ss.createSlackPayload(config, message)
+	
+	jsonData, err := json.Marshal(formattedPayload)
+	if err != nil {
+		return err
+	}
+
+	resp, err := http.Post(config.SlackWebhookURL, "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("slack webhook error, status: %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// SendServerNotification sends a server-specific notification via Slack
+func (ss *SlackService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := ss.generateServerMessage(payload, template, resourceType)
+	return ss.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via Slack
+func (ss *SlackService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := ss.generateServiceMessage(payload, template)
+	return ss.SendNotification(config, message)
+}
+
+// createSlackPayload creates a properly formatted Slack payload with rich formatting
+func (ss *SlackService) createSlackPayload(config *AlertConfiguration, message string) SlackPayload {
+	// Determine color based on message content
+	color := ss.getColorFromMessage(message)
+	
+	// Parse message for structured presentation
+	title, fields := ss.parseMessageForSlack(message)
+	
+	payload := SlackPayload{
+		Username:  config.NotifyName,
+		IconEmoji: ss.getEmojiFromMessage(message),
+		Text:      title,
+	}
+
+	// Create attachment for better formatting
+	if len(fields) > 0 {
+		attachment := SlackAttachment{
+			Color:     color,
+			Title:     title,
+			Timestamp: time.Now().Unix(),
+			Fields:    fields,
+		}
+		payload.Attachments = []SlackAttachment{attachment}
+		payload.Text = "" // Clear text when using attachments
+	}
+
+	return payload
+}
+
+// parseMessageForSlack parses the message to extract title and create structured fields
+func (ss *SlackService) parseMessageForSlack(message string) (string, []SlackField) {
+	lines := strings.Split(message, "\n")
+	if len(lines) == 0 {
+		return message, nil
+	}
+
+	title := strings.TrimSpace(lines[0])
+	var fields []SlackField
+
+	// Process bullet points and key-value pairs
+	for i, line := range lines {
+		if i == 0 {
+			continue // Skip title
+		}
+
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+
+		// Handle bullet points (•, -, *)
+		if strings.HasPrefix(line, "•") || strings.HasPrefix(line, "-") || strings.HasPrefix(line, "*") {
+			// Remove bullet and clean up
+			cleaned := strings.TrimSpace(strings.TrimPrefix(strings.TrimPrefix(strings.TrimPrefix(line, "•"), "-"), "*"))
+			
+			// Try to split on colon for key-value pairs
+			if strings.Contains(cleaned, ":") {
+				parts := strings.SplitN(cleaned, ":", 2)
+				if len(parts) == 2 {
+					key := strings.TrimSpace(parts[0])
+					value := strings.TrimSpace(parts[1])
+					fields = append(fields, SlackField{
+						Title: key,
+						Value: value,
+						Short: len(value) < 30, // Short fields for compact display
+					})
+				}
+			} else {
+				// Add as a single field
+				fields = append(fields, SlackField{
+					Title: "Info",
+					Value: cleaned,
+					Short: false,
+				})
+			}
+		} else if strings.Contains(line, ":") {
+			// Direct key-value pairs
+			parts := strings.SplitN(line, ":", 2)
+			if len(parts) == 2 {
+				key := strings.TrimSpace(parts[0])
+				value := strings.TrimSpace(parts[1])
+				fields = append(fields, SlackField{
+					Title: key,
+					Value: value,
+					Short: len(value) < 30,
+				})
+			}
+		}
+	}
+
+	return title, fields
+}
+
+// getColorFromMessage determines the appropriate color based on message content
+func (ss *SlackService) getColorFromMessage(message string) string {
+	lowerMsg := strings.ToLower(message)
+	
+	// Critical/Error states - Red
+	if strings.Contains(lowerMsg, "down") || strings.Contains(lowerMsg, "failed") || 
+	   strings.Contains(lowerMsg, "error") || strings.Contains(lowerMsg, "expired") ||
+	   strings.Contains(lowerMsg, "🔴") || strings.Contains(lowerMsg, "🚨") {
+		return "#FF0000" // Red
+	}
+	
+	// Warning states - Yellow/Orange
+	if strings.Contains(lowerMsg, "warning") || strings.Contains(lowerMsg, "expiring") ||
+	   strings.Contains(lowerMsg, "🟡") || strings.Contains(lowerMsg, "⚠️") {
+		return "#FFA500" // Orange
+	}
+	
+	// Success states - Green
+	if strings.Contains(lowerMsg, "up") || strings.Contains(lowerMsg, "restored") ||
+	   strings.Contains(lowerMsg, "resolved") || strings.Contains(lowerMsg, "🟢") ||
+	   strings.Contains(lowerMsg, "✅") {
+		return "#00FF00" // Green
+	}
+	
+	// Maintenance/Info states - Blue
+	if strings.Contains(lowerMsg, "maintenance") || strings.Contains(lowerMsg, "paused") ||
+	   strings.Contains(lowerMsg, "🟠") || strings.Contains(lowerMsg, "🔵") {
+		return "#0080FF" // Blue
+	}
+	
+	return "#808080" // Default gray
+}
+
+// getEmojiFromMessage extracts or determines appropriate emoji for the message
+func (ss *SlackService) getEmojiFromMessage(message string) string {
+	lowerMsg := strings.ToLower(message)
+	
+	// Check for specific service types first
+	if strings.Contains(lowerMsg, "server") {
+		if strings.Contains(lowerMsg, "down") || strings.Contains(lowerMsg, "failed") {
+			return ":red_circle:"
+		} else if strings.Contains(lowerMsg, "warning") {
+			return ":warning:"
+		} else if strings.Contains(lowerMsg, "up") || strings.Contains(lowerMsg, "restored") {
+			return ":white_check_mark:"
+		}
+		return ":desktop_computer:"
+	}
+	
+	// SSL Certificate notifications
+	if strings.Contains(lowerMsg, "certificate") || strings.Contains(lowerMsg, "ssl") {
+		if strings.Contains(lowerMsg, "expired") {
+			return ":no_entry:"
+		} else if strings.Contains(lowerMsg, "expiring") {
+			return ":warning:"
+		}
+		return ":lock:"
+	}
+	
+	// General status-based emojis
+	if strings.Contains(lowerMsg, "down") || strings.Contains(lowerMsg, "failed") {
+		return ":red_circle:"
+	} else if strings.Contains(lowerMsg, "warning") {
+		return ":warning:"
+	} else if strings.Contains(lowerMsg, "up") || strings.Contains(lowerMsg, "restored") {
+		return ":white_check_mark:"
+	} else if strings.Contains(lowerMsg, "maintenance") {
+		return ":construction:"
+	}
+	
+	return ":information_source:" // Default info emoji
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (ss *SlackService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ss.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return ss.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (ss *SlackService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ss.generateDefaultUptimeMessage(payload)
+	}
+	
+	return ss.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (ss *SlackService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", ss.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", ss.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := ss.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", ss.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", ss.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", ss.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", ss.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", ss.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", ss.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", ss.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", ss.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", ss.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", ss.safeString(payload.Threshold))
+	
+	// Replace SSL certificate fields
+	message = strings.ReplaceAll(message, "${certificate_name}", ss.safeString(payload.CertificateName))
+	message = strings.ReplaceAll(message, "${expiry_date}", ss.safeString(payload.ExpiryDate))
+	message = strings.ReplaceAll(message, "${days_left}", ss.safeString(payload.DaysLeft))
+	message = strings.ReplaceAll(message, "${issuer_cn}", ss.safeString(payload.IssuerCN))
+	message = strings.ReplaceAll(message, "${serial_number}", ss.safeString(payload.SerialNumber))
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", ss.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", ss.safeString(payload.ErrorMessage))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${date}", payload.Timestamp.Format("2006-01-02"))
+	
+	// Replace message placeholder
+	if payload.Message != "" {
+		message = strings.ReplaceAll(message, "${message}", payload.Message)
+	} else {
+		message = strings.ReplaceAll(message, "${message}", "N/A")
+	}
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (ss *SlackService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (ss *SlackService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	// Status emoji mapping
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	case "maintenance", "paused":
+		statusEmoji = "🟠"
+	}
+	
+	message := fmt.Sprintf("%s Service %s is %s", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf("• Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf("• Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf("• Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf("• Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf("• Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf("• Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, "• Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf("• Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf("• Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf("• Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf("• Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (ss *SlackService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	}
+	
+	return fmt.Sprintf("%s 🖥️ Server %s (%s) status: %s", statusEmoji, payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/ssl_manager.go b/server/service-operation/notification/ssl_manager.go
new file mode 100644
index 0000000..c8dcf22
--- /dev/null
+++ b/server/service-operation/notification/ssl_manager.go
@@ -0,0 +1,285 @@
+
+package notification
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"service-operation/pocketbase"
+)
+
+// SSLNotificationTemplate represents an SSL notification template
+type SSLNotificationTemplate struct {
+	ID           string `json:"id"`
+	Name         string `json:"name"`
+	Expired      string `json:"expired"`
+	ExpiringSoon string `json:"exiring_soon"`
+	Warning      string `json:"warning"`
+	Placeholder  string `json:"placeholder"`
+}
+
+// SSLNotificationManager handles SSL certificate notifications
+type SSLNotificationManager struct {
+	pbClient *pocketbase.PocketBaseClient
+	services map[string]NotificationService
+}
+
+// NewSSLNotificationManager creates a new SSL notification manager
+func NewSSLNotificationManager(pbClient *pocketbase.PocketBaseClient, services map[string]NotificationService) *SSLNotificationManager {
+	return &SSLNotificationManager{
+		pbClient: pbClient,
+		services: services,
+	}
+}
+
+// SendSSLNotification sends notification for SSL certificate status
+func (snm *SSLNotificationManager) SendSSLNotification(payload *NotificationPayload, notificationID, templateID string) error {
+	// log.Printf("📨 [SSL-MANAGER] IMMEDIATE send for certificate: %s, status: %s", payload.Domain, payload.Status)
+	// log.Printf("📨 [SSL-MANAGER] Notification ID: %s, Template ID: %s", notificationID, templateID)
+	
+	if notificationID == "" {
+		return fmt.Errorf("notification ID required for SSL certificate: %s", payload.Domain)
+	}
+
+	// Parse notification IDs
+	notificationIDs := parseNotificationIDs(notificationID)
+	if len(notificationIDs) == 0 {
+		return fmt.Errorf("no valid notification IDs for SSL certificate: %s", payload.Domain)
+	}
+
+	var errors []string
+	successCount := 0
+
+	// Send to each notification channel IMMEDIATELY
+	for _, id := range notificationIDs {
+		// log.Printf("📤 [SSL-SEND] Processing notification ID: %s for certificate %s", id, payload.Domain)
+		
+		// Check if enabled
+		if !isNotificationEnabled(snm.pbClient, id) {
+			// log.Printf("⚠️ Notification %s disabled for SSL certificate %s, skipping", id, payload.Domain)
+			_ = id
+			continue
+		}
+
+		// Get alert configuration
+		alertConfig, err := getAlertConfiguration(snm.pbClient, id)
+		if err != nil {
+			// log.Printf("❌ Failed to get alert config for %s (certificate: %s): %v", id, payload.Domain, err)
+			errors = append(errors, fmt.Sprintf("config error %s: %v", id, err))
+			continue
+		}
+
+		// log.Printf("📋 [SSL-CONFIG] Alert config for %s: Type=%s, ChatID=%s, Token present=%v", 
+		//	id, alertConfig.NotificationType, alertConfig.TelegramChatID, alertConfig.BotToken != "")
+
+		// Get SSL template
+		var sslTemplate *SSLNotificationTemplate
+		if templateID != "" {
+			sslTemplate, err = snm.getSSLNotificationTemplate(templateID)
+			if err != nil {
+				// log.Printf("⚠️ Template error for %s (certificate: %s): %v", templateID, payload.Domain, err)
+				_ = err
+			} else {
+				// log.Printf("📄 [SSL-TEMPLATE] Retrieved template: Expired=%s, ExpiringSoon=%s, Warning=%s", 
+				//	sslTemplate.Expired, sslTemplate.ExpiringSoon, sslTemplate.Warning)
+				_ = sslTemplate
+			}
+		}
+
+		// Generate message
+		message := snm.generateSSLMessage(payload, sslTemplate)
+		// log.Printf("📝 [SSL-MESSAGE] Generated for %s (%s): %s", payload.Domain, id, message)
+
+		// Get notification service
+		service, exists := snm.services[alertConfig.NotificationType]
+		if !exists {
+			// log.Printf("❌ Unsupported notification type for SSL: %s", alertConfig.NotificationType)
+			errors = append(errors, fmt.Sprintf("unsupported type %s", alertConfig.NotificationType))
+			continue
+		}
+
+		// SEND IMMEDIATELY - NO DELAYS
+		// log.Printf("⚡ [SSL-TELEGRAM] Sending via %s for SSL certificate %s", alertConfig.NotificationType, payload.Domain)
+		err = service.SendNotification(alertConfig, message)
+		if err != nil {
+			// log.Printf("❌ [SSL-FAILED] Failed to send via %s for %s: %v", alertConfig.NotificationType, payload.Domain, err)
+			errors = append(errors, fmt.Sprintf("send failed %s: %v", alertConfig.NotificationType, err))
+		} else {
+			// log.Printf("✅ [SSL-SUCCESS] Successfully sent via %s for %s", alertConfig.NotificationType, payload.Domain)
+			successCount++
+		}
+		
+		_ = alertConfig
+		_ = message
+	}
+
+	// Report results
+	if successCount > 0 {
+		// log.Printf("✅ [SSL-FINAL] Sent %d/%d SSL notifications for %s", successCount, len(notificationIDs), payload.Domain)
+		_ = successCount
+		_ = notificationIDs
+	}
+
+	if len(errors) > 0 && successCount == 0 {
+		return fmt.Errorf("all SSL notifications failed for %s: %v", payload.Domain, errors)
+	}
+
+	return nil
+}
+
+// getSSLNotificationTemplate fetches SSL notification template from PocketBase
+func (snm *SSLNotificationManager) getSSLNotificationTemplate(templateID string) (*SSLNotificationTemplate, error) {
+	url := fmt.Sprintf("%s/api/collections/ssl_notification_templates/records/%s", snm.pbClient.GetBaseURL(), templateID)
+	// log.Printf("🌐 Fetching SSL notification template from: %s", url)
+	
+	resp, err := http.Get(url)
+	if err != nil {
+		// log.Printf("❌ HTTP error fetching SSL notification template: %v", err)
+		_ = err
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		// log.Printf("❌ Failed to fetch SSL notification template, status: %d", resp.StatusCode)
+		return nil, fmt.Errorf("failed to fetch SSL notification template, status: %d", resp.StatusCode)
+	}
+
+	var template SSLNotificationTemplate
+	if err := json.NewDecoder(resp.Body).Decode(&template); err != nil {
+		// log.Printf("❌ Error decoding SSL notification template JSON: %v", err)
+		_ = err
+		return nil, err
+	}
+
+	// log.Printf("✅ Successfully fetched SSL notification template: %+v", template)
+	_ = url
+	_ = template
+	return &template, nil
+}
+
+// generateSSLMessage creates notification message for SSL certificates
+func (snm *SSLNotificationManager) generateSSLMessage(payload *NotificationPayload, template *SSLNotificationTemplate) string {
+	var baseMessage string
+
+	// Use template if available
+	if template != nil {
+		// log.Printf("🔧 Using SSL template for status: %s", strings.ToLower(payload.Status))
+		// log.Printf("🔧 [SSL-TEMPLATE-DEBUG] Available templates - Expired: '%s', ExpiringSoon: '%s', Warning: '%s'", 
+		//	template.Expired, template.ExpiringSoon, template.Warning)
+		
+		switch strings.ToLower(payload.Status) {
+		case "expired":
+			baseMessage = template.Expired
+			// log.Printf("🔧 [SSL-EXPIRED] Selected expired template: '%s'", baseMessage)
+		case "expiring_soon":
+			baseMessage = template.ExpiringSoon
+			// log.Printf("🔧 [SSL-EXPIRING] Selected expiring soon template: '%s'", baseMessage)
+		case "warning":
+			baseMessage = template.Warning
+			// log.Printf("🔧 [SSL-WARNING] Selected warning template: '%s'", baseMessage)
+		default:
+			baseMessage = template.Warning
+			// log.Printf("🔧 [SSL-DEFAULT] Using warning template for status '%s': '%s'", payload.Status, baseMessage)
+		}
+		
+		_ = baseMessage
+		_ = template
+	}
+
+	// Use default if no template or template message is empty
+	if baseMessage == "" {
+		// log.Printf("🔧 Using default SSL message (no template or empty template)")
+		baseMessage = snm.getDefaultSSLMessage(payload)
+	}
+
+	// Replace placeholders
+	message := snm.replaceSSLPlaceholders(baseMessage, payload)
+	
+	// log.Printf("📝 Final SSL message: %s", message)
+	_ = message
+	return message
+}
+
+// replaceSSLPlaceholders replaces all placeholders in the SSL message
+func (snm *SSLNotificationManager) replaceSSLPlaceholders(message string, payload *NotificationPayload) string {
+	// log.Printf("🔄 [SSL-REPLACE] Before replacement: %s", message)
+	// log.Printf("🔄 [SSL-DATA] Payload data - Domain: %s, ExpiryDate: %s, DaysLeft: %s, IssuerCN: %s", 
+	//	payload.Domain, payload.ExpiryDate, payload.DaysLeft, payload.IssuerCN)
+
+	// SSL Certificate specific placeholders - ensure all are replaced
+	message = strings.ReplaceAll(message, "${domain}", snm.safeString(payload.Domain))
+	message = strings.ReplaceAll(message, "${certificate_name}", snm.safeString(payload.CertificateName))
+	message = strings.ReplaceAll(message, "${expiry_date}", snm.safeString(payload.ExpiryDate))
+	message = strings.ReplaceAll(message, "${days_left}", snm.safeString(payload.DaysLeft))
+	message = strings.ReplaceAll(message, "${issuer_cn}", snm.safeString(payload.IssuerCN))
+	message = strings.ReplaceAll(message, "${serial_number}", snm.safeString(payload.SerialNumber))
+	
+	// Basic placeholders
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${service_name}", snm.safeString(payload.ServiceName))
+	message = strings.ReplaceAll(message, "${host}", snm.safeString(payload.Host))
+	
+	// Time placeholders
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("15:04:05"))
+	message = strings.ReplaceAll(message, "${date}", payload.Timestamp.Format("2006-01-02"))
+	
+	// Message placeholder
+	if payload.Message != "" {
+		message = strings.ReplaceAll(message, "${message}", payload.Message)
+	} else {
+		message = strings.ReplaceAll(message, "${message}", "N/A")
+	}
+
+	// log.Printf("🔄 [SSL-REPLACE] After replacement: %s", message)
+	_ = payload
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (snm *SSLNotificationManager) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// getDefaultSSLMessage provides a default notification message for SSL certificates
+func (snm *SSLNotificationManager) getDefaultSSLMessage(payload *NotificationPayload) string {
+	statusEmoji := "🔒"
+	if payload.Status == "expired" {
+		statusEmoji = "🚨"
+	} else if payload.Status == "expiring_soon" {
+		statusEmoji = "⚠️"
+	} else if payload.Status == "warning" {
+		statusEmoji = "🔔"
+	}
+
+	// Create the default message with all SSL details
+	message := fmt.Sprintf("%s SSL certificate for %s has %s", statusEmoji, payload.Domain, strings.ToUpper(payload.Status))
+	
+	// Add certificate details if available
+	if payload.CertificateName != "" && payload.CertificateName != payload.Domain {
+		message += fmt.Sprintf("\n • Certs Name: %s", payload.CertificateName)
+	}
+	
+	if payload.ExpiryDate != "" {
+		message += fmt.Sprintf("\n • Expiry Date: %s", payload.ExpiryDate)
+	}
+	
+	if payload.DaysLeft != "" {
+		message += fmt.Sprintf("\n • Days Left: %s", payload.DaysLeft)
+	}
+	
+	if payload.IssuerCN != "" {
+		message += fmt.Sprintf("\n • Issuer: %s", payload.IssuerCN)
+	}
+	
+	// Add timestamp
+	message += fmt.Sprintf("\n • Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05"))
+
+	return message
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/telegram.go b/server/service-operation/notification/telegram.go
new file mode 100644
index 0000000..838d61c
--- /dev/null
+++ b/server/service-operation/notification/telegram.go
@@ -0,0 +1,347 @@
+
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// TelegramService handles Telegram notifications
+type TelegramService struct{}
+
+// NewTelegramService creates a new Telegram notification service
+func NewTelegramService() *TelegramService {
+	return &TelegramService{}
+}
+
+// TelegramPayload represents the payload for Telegram API
+type TelegramPayload struct {
+	ChatID    string `json:"chat_id"`
+	Text      string `json:"text"`
+	ParseMode string `json:"parse_mode,omitempty"`
+}
+
+// SendNotification sends a notification via Telegram
+func (ts *TelegramService) SendNotification(config *AlertConfiguration, message string) error {
+	// fmt.Printf("📱 [TELEGRAM] Attempting to send notification...\n")
+	// fmt.Printf("📱 [TELEGRAM] Config - Chat ID: %s, Bot Token present: %v\n", config.TelegramChatID, config.BotToken != "")
+	// fmt.Printf("📱 [TELEGRAM] Message: %s\n", message)
+
+	if config.BotToken == "" || config.TelegramChatID == "" {
+		return fmt.Errorf("telegram bot token and chat ID are required")
+	}
+
+	url := fmt.Sprintf("https://api.telegram.org/bot%s/sendMessage", config.BotToken)
+	// fmt.Printf("📱 [TELEGRAM] API URL: %s\n", strings.Replace(url, config.BotToken, "[REDACTED]", 1))
+
+	payload := TelegramPayload{
+		ChatID: config.TelegramChatID,
+		Text:   message,
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+
+	// fmt.Printf("📱 [TELEGRAM] Sending POST request...\n")
+	resp, err := http.Post(url, "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		// fmt.Printf("❌ [TELEGRAM] HTTP error: %v\n", err)
+		return err
+	}
+	defer resp.Body.Close()
+
+	var result NotificationResponse
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		// fmt.Printf("❌ [TELEGRAM] JSON decode error: %v\n", err)
+		return err
+	}
+
+	// fmt.Printf("📱 [TELEGRAM] Response - OK: %v, Description: %s\n", result.OK, result.Description)
+
+	if !result.OK {
+		// fmt.Printf("❌ [TELEGRAM] API error: %s\n", result.Description)
+		return fmt.Errorf("telegram API error: %s", result.Description)
+	}
+
+	// fmt.Printf("✅ [TELEGRAM] Message sent successfully!\n")
+	return nil
+}
+
+// SendServerNotification sends a server-specific notification via Telegram
+func (ts *TelegramService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := ts.generateServerMessage(payload, template, resourceType)
+	return ts.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via Telegram
+func (ts *TelegramService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := ts.generateServiceMessage(payload, template)
+	return ts.SendNotification(config, message)
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (ts *TelegramService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ts.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return ts.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (ts *TelegramService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ts.generateDefaultUptimeMessage(payload)
+	}
+	
+	return ts.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (ts *TelegramService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", ts.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", ts.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := ts.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", ts.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", ts.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", ts.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", ts.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", ts.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", ts.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", ts.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", ts.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", ts.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", ts.safeString(payload.Threshold))
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", ts.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", ts.safeString(payload.ErrorMessage))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (ts *TelegramService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (ts *TelegramService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	// Status emoji mapping
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	case "maintenance", "paused":
+		statusEmoji = "🟠"
+	}
+	
+	message := fmt.Sprintf("%sService %s is %s.", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf(" - Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf(" - Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf(" - Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf(" - Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf(" - Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf(" - Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, " - Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf(" - Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf(" - Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf(" - Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf(" - Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (ts *TelegramService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	}
+	
+	return fmt.Sprintf("%s🖥️ Server %s (%s) status: %s", statusEmoji, payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/types.go b/server/service-operation/notification/types.go
new file mode 100644
index 0000000..0d5846e
--- /dev/null
+++ b/server/service-operation/notification/types.go
@@ -0,0 +1,124 @@
+
+package notification
+
+import "time"
+
+// NotificationPayload represents the data sent in notifications
+type NotificationPayload struct {
+	ServiceName   string    `json:"service_name"`
+	Status        string    `json:"status"`
+	Host          string    `json:"host"`
+	Hostname      string    `json:"hostname"`
+	Port          int       `json:"port"`
+	ServiceType   string    `json:"service_type"`
+	ResponseTime  int64     `json:"response_time"`
+	Timestamp     time.Time `json:"timestamp"`
+	Message       string    `json:"message"`
+	ErrorMessage  string    `json:"error_message,omitempty"`
+	
+	// Service-specific fields
+	URL           string    `json:"url,omitempty"`
+	Domain        string    `json:"domain,omitempty"`
+	RegionName    string    `json:"region_name,omitempty"`
+	AgentID       string    `json:"agent_id,omitempty"`
+	Uptime        int       `json:"uptime,omitempty"`
+	
+	// Server monitoring specific fields
+	CPUUsage      string    `json:"cpu_usage,omitempty"`
+	RAMUsage      string    `json:"ram_usage,omitempty"`
+	DiskUsage     string    `json:"disk_usage,omitempty"`
+	NetworkUsage  string    `json:"network_usage,omitempty"`
+	CPUTemp       string    `json:"cpu_temp,omitempty"`
+	DiskIO        string    `json:"disk_io,omitempty"`
+	Threshold     string    `json:"threshold,omitempty"`
+	
+	// SSL Certificate specific fields
+	CertificateName string    `json:"certificate_name,omitempty"`
+	ExpiryDate      string    `json:"expiry_date,omitempty"`
+	DaysLeft        string    `json:"days_left,omitempty"`
+	IssuerCN        string    `json:"issuer_cn,omitempty"`
+	SerialNumber    string    `json:"serial_number,omitempty"`
+}
+
+// AlertConfiguration represents an alert configuration from PocketBase
+type AlertConfiguration struct {
+	ID                    string `json:"id"`
+	NotificationType      string `json:"notification_type"`
+	TelegramChatID        string `json:"telegram_chat_id"`
+	DiscordWebhookURL     string `json:"discord_webhook_url"`
+	SignalNumber          string `json:"signal_number"`
+	SignalAPIEndpoint     string `json:"signal_api_endpoint"`
+	NotifyName            string `json:"notify_name"`
+	BotToken              string `json:"bot_token"`
+	TemplateID            string `json:"template_id"`
+	SlackWebhookURL       string `json:"slack_webhook_url"`
+	GoogleChatWebhookURL  string `json:"google_chat_webhook_url"`
+	Enabled               string `json:"enabled"` 
+	EmailAddress          string `json:"email_address"`
+	EmailSenderName       string `json:"email_sender_name"`
+	SMTPServer            string `json:"smtp_server"`
+	SMTPPassword          string `json:"smtp_password,omitempty"`
+	SMTPPort              string `json:"smtp_port"`
+	WebhookID             string `json:"webhook_id"`
+	ChannelID             string `json:"channel_id"`
+	WebhookURL            string `json:"webhook_url"`
+	WebhookPayloadTemplate string `json:"webhook_payload_template"`
+	NtfyEndpoint          string `json:"ntfy_endpoint"`
+	APIToken              string `json:"api_token"`
+	UserKey               string `json:"user_key"`
+	ServerURL             string `json:"server_url"`
+	MatrixHomeserver      string `json:"matrix_homeserver"`
+	MatrixRoomID          string `json:"matrix_room_id"`
+	MatrixAccessToken     string `json:"matrix_access_token"`
+}
+
+// ServerNotificationTemplate represents a server notification template
+type ServerNotificationTemplate struct {
+	ID             string `json:"id"`
+	Name           string `json:"name"`
+	UpMessage      string `json:"up_message"`
+	DownMessage    string `json:"down_message"`
+	WarningMessage string `json:"warning_message"`
+	PausedMessage  string `json:"paused_message"`
+	// Resource-specific messages
+	RAMMessage     string `json:"ram_message"`
+	CPUMessage     string `json:"cpu_message"`
+	DiskMessage    string `json:"disk_message"`
+	NetworkMessage string `json:"network_message"`
+	CPUTempMessage string `json:"cpu_temp_message"`
+	DiskIOMessage  string `json:"disk_io_message"`
+	// Resource restore messages
+	RestoreRAMMessage     string `json:"restore_ram_message"`
+	RestoreCPUMessage     string `json:"restore_cpu_message"`
+	RestoreDiskMessage    string `json:"restore_disk_message"`
+	RestoreNetworkMessage string `json:"restore_network_message"`
+	RestoreCPUTempMessage string `json:"restore_cpu_temp_message"`
+	RestoreDiskIOMessage  string `json:"restore_disk_io_message"`
+	Placeholder    string `json:"placeholder"`
+}
+
+// ServiceNotificationTemplate represents a service notification template
+type ServiceNotificationTemplate struct {
+	ID                  string `json:"id"`
+	Name                string `json:"name"`
+	UpMessage           string `json:"up_message"`
+	DownMessage         string `json:"down_message"`
+	MaintenanceMessage  string `json:"maintenance_message"`
+	IncidentMessage     string `json:"incident_message"`
+	ResolvedMessage     string `json:"resolved_message"`
+	WarningMessage      string `json:"warning_message"`
+	Placeholder         string `json:"placeholder"`
+}
+
+// NotificationResponse represents the response from notification APIs (like Telegram)
+type NotificationResponse struct {
+	OK          bool   `json:"ok"`
+	Description string `json:"description,omitempty"`
+	ErrorCode   int    `json:"error_code,omitempty"`
+	Result      interface{} `json:"result,omitempty"`
+}
+
+// NotificationService interface for different notification services
+type NotificationService interface {
+	SendNotification(config *AlertConfiguration, message string) error
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/uptime_manager.go b/server/service-operation/notification/uptime_manager.go
new file mode 100644
index 0000000..710a386
--- /dev/null
+++ b/server/service-operation/notification/uptime_manager.go
@@ -0,0 +1,244 @@
+package notification
+
+import (
+	"fmt"
+	// "log"
+	"strings"
+
+	"service-operation/pocketbase"
+)
+
+// UptimeNotificationManager handles uptime service notifications with IMMEDIATE sending
+type UptimeNotificationManager struct {
+	pbClient *pocketbase.PocketBaseClient
+	services map[string]NotificationService
+}
+
+// NewUptimeNotificationManager creates a new uptime notification manager
+func NewUptimeNotificationManager(pbClient *pocketbase.PocketBaseClient, services map[string]NotificationService) *UptimeNotificationManager {
+	return &UptimeNotificationManager{
+		pbClient: pbClient,
+		services: services,
+	}
+}
+
+// SendUptimeServiceNotification sends notification IMMEDIATELY - NO QUEUING
+func (unm *UptimeNotificationManager) SendUptimeServiceNotification(payload *NotificationPayload, notificationID, templateID string) error {
+	// log.Printf("📨 [UPTIME-MANAGER] IMMEDIATE send for service: %s, status: %s", payload.ServiceName, payload.Status)
+	// log.Printf("📨 [UPTIME-MANAGER] Notification ID: %s, Template ID: %s", notificationID, templateID)
+	
+	if notificationID == "" {
+		return fmt.Errorf("notification ID required for uptime service: %s", payload.ServiceName)
+	}
+
+	// Parse notification IDs
+	notificationIDs := parseNotificationIDs(notificationID)
+	if len(notificationIDs) == 0 {
+		return fmt.Errorf("no valid notification IDs for uptime service: %s", payload.ServiceName)
+	}
+
+	var errors []string
+	successCount := 0
+
+	// Send to each notification channel IMMEDIATELY
+	for _, id := range notificationIDs {
+		// log.Printf("📤 [UPTIME-SEND] Processing notification ID: %s for service %s", id, payload.ServiceName)
+		
+		// Check if enabled
+		if !isNotificationEnabled(unm.pbClient, id) {
+			// log.Printf("⚠️ Notification %s disabled for uptime service %s, skipping", id, payload.ServiceName)
+			continue
+		}
+
+		// Get alert configuration
+		alertConfig, err := getAlertConfiguration(unm.pbClient, id)
+		if err != nil {
+			// log.Printf("❌ Failed to get alert config for %s (service: %s): %v", id, payload.ServiceName, err)
+			errors = append(errors, fmt.Sprintf("config error %s: %v", id, err))
+			continue
+		}
+
+		// log.Printf("📋 [UPTIME-CONFIG] Alert config for %s: Type=%s, ChatID=%s, Token present=%v", 
+		//	id, alertConfig.NotificationType, alertConfig.TelegramChatID, alertConfig.BotToken != "")
+
+		// Get service template
+		var serviceTemplate *ServiceNotificationTemplate
+		if templateID != "" {
+			serviceTemplate, err = getServiceNotificationTemplate(unm.pbClient, templateID)
+			if err != nil {
+				// log.Printf("⚠️ Template error for %s (service: %s): %v", templateID, payload.ServiceName, err)
+			}
+		}
+
+		// Generate message
+		message := unm.generateUptimeMessage(payload, serviceTemplate)
+		// log.Printf("📝 [UPTIME-MESSAGE] Generated for %s (%s): %s", payload.ServiceName, id, message)
+
+		// Get notification service
+		service, exists := unm.services[alertConfig.NotificationType]
+		if !exists {
+			// log.Printf("❌ Unsupported notification type for uptime: %s", alertConfig.NotificationType)
+			errors = append(errors, fmt.Sprintf("unsupported type %s", alertConfig.NotificationType))
+			continue
+		}
+
+		// SEND IMMEDIATELY - NO DELAYS
+		// log.Printf("⚡ [UPTIME-TELEGRAM] Sending via %s for uptime service %s", alertConfig.NotificationType, payload.ServiceName)
+		err = service.SendNotification(alertConfig, message)
+		if err != nil {
+			// log.Printf("❌ [UPTIME-FAILED] Failed to send via %s for %s: %v", alertConfig.NotificationType, payload.ServiceName, err)
+			errors = append(errors, fmt.Sprintf("send failed %s: %v", alertConfig.NotificationType, err))
+		} else {
+			// log.Printf("✅ [UPTIME-SUCCESS] Successfully sent via %s for %s", alertConfig.NotificationType, payload.ServiceName)
+			successCount++
+		}
+	}
+
+	// Report results
+	if successCount > 0 {
+		// log.Printf("✅ [UPTIME-FINAL] Sent %d/%d uptime notifications for %s", successCount, len(notificationIDs), payload.ServiceName)
+	}
+
+	if len(errors) > 0 && successCount == 0 {
+		return fmt.Errorf("all uptime notifications failed for %s: %v", payload.ServiceName, errors)
+	}
+
+	return nil
+}
+
+// generateUptimeMessage creates notification message for uptime services
+func (unm *UptimeNotificationManager) generateUptimeMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var baseMessage string
+
+	// Use template if available
+	if template != nil {
+		// log.Printf("🔧 Using uptime template for status: %s", strings.ToLower(payload.Status))
+		switch strings.ToLower(payload.Status) {
+		case "up":
+			baseMessage = template.UpMessage
+		case "down":
+			baseMessage = template.DownMessage
+		case "maintenance":
+			baseMessage = template.MaintenanceMessage
+		case "incident":
+			baseMessage = template.IncidentMessage
+		case "resolved":
+			baseMessage = template.ResolvedMessage
+		case "warning":
+			baseMessage = template.WarningMessage
+		default:
+			baseMessage = template.WarningMessage
+		}
+	}
+
+	// Use default if no template
+	if baseMessage == "" {
+		// log.Printf("🔧 Using default uptime message (no template)")
+		baseMessage = unm.getDefaultUptimeMessage(payload)
+	}
+
+	// Replace placeholders
+	message := unm.replacePlaceholders(baseMessage, payload)
+	
+	// log.Printf("📝 Final uptime message: %s", message)
+	return message
+}
+
+// replacePlaceholders replaces all placeholders in the message
+func (unm *UptimeNotificationManager) replacePlaceholders(message string, payload *NotificationPayload) string {
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", payload.Host)
+	message = strings.ReplaceAll(message, "${ip}", payload.Host)
+	
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.URL != "" {
+		message = strings.ReplaceAll(message, "${url}", payload.URL)
+	} else {
+		message = strings.ReplaceAll(message, "${url}", "N/A")
+	}
+	
+	if payload.Domain != "" {
+		message = strings.ReplaceAll(message, "${domain}", payload.Domain)
+	} else {
+		message = strings.ReplaceAll(message, "${domain}", "N/A")
+	}
+	
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	if payload.RegionName != "" {
+		message = strings.ReplaceAll(message, "${region_name}", payload.RegionName)
+	} else {
+		message = strings.ReplaceAll(message, "${region_name}", "N/A")
+	}
+	
+	if payload.AgentID != "" {
+		message = strings.ReplaceAll(message, "${agent_id}", payload.AgentID)
+	} else {
+		message = strings.ReplaceAll(message, "${agent_id}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${date}", payload.Timestamp.Format("2006-01-02"))
+	
+	// Handle error message placeholder - critical for uptime services
+	if payload.ErrorMessage != "" {
+		message = strings.ReplaceAll(message, "${error}", payload.ErrorMessage)
+		message = strings.ReplaceAll(message, "${error_message}", payload.ErrorMessage)
+	} else {
+		message = strings.ReplaceAll(message, "${error}", "")
+		message = strings.ReplaceAll(message, "${error_message}", "")
+	}
+	
+	if payload.Message != "" {
+		message = strings.ReplaceAll(message, "${message}", payload.Message)
+	}
+
+	return message
+}
+
+// getDefaultUptimeMessage provides a default notification message for uptime services
+func (unm *UptimeNotificationManager) getDefaultUptimeMessage(payload *NotificationPayload) string {
+	statusEmoji := "✅"
+	if payload.Status == "down" {
+		statusEmoji = "❌"
+	} else if payload.Status == "warning" {
+		statusEmoji = "⚠️"
+	}
+
+	message := fmt.Sprintf("%s [UPTIME] %s is %s", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	if payload.Host != "" {
+		message += fmt.Sprintf(" | Host: %s", payload.Host)
+	}
+	
+	if payload.ResponseTime > 0 {
+		message += fmt.Sprintf(" | %dms", payload.ResponseTime)
+	}
+	
+	message += fmt.Sprintf(" | %s", payload.Timestamp.Format("15:04:05"))
+
+	return message
+}
\ No newline at end of file
diff --git a/server/service-operation/notification/webhook.go b/server/service-operation/notification/webhook.go
new file mode 100644
index 0000000..706df57
--- /dev/null
+++ b/server/service-operation/notification/webhook.go
@@ -0,0 +1,440 @@
+
+package notification
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"text/template"
+	"time"
+)
+
+// WebhookService handles webhook notifications
+type WebhookService struct{}
+
+// NewWebhookService creates a new webhook notification service
+func NewWebhookService() *WebhookService {
+	return &WebhookService{}
+}
+
+// WebhookPayload represents the payload for webhook
+type WebhookPayload struct {
+	Message     string `json:"message"`
+	NotifyName  string `json:"notify_name"`
+	Timestamp   string `json:"timestamp"`
+	ServiceName string `json:"service_name,omitempty"`
+	Status      string `json:"status,omitempty"`
+	Host        string `json:"host,omitempty"`
+	URL         string `json:"url,omitempty"`
+	Port        int    `json:"port,omitempty"`
+	ServiceType string `json:"service_type,omitempty"`
+	ResponseTime int64 `json:"response_time,omitempty"`
+	// Server monitoring fields
+	CPUUsage     string `json:"cpu_usage,omitempty"`
+	RAMUsage     string `json:"ram_usage,omitempty"`
+	DiskUsage    string `json:"disk_usage,omitempty"`
+	NetworkUsage string `json:"network_usage,omitempty"`
+	CPUTemp      string `json:"cpu_temp,omitempty"`
+	DiskIO       string `json:"disk_io,omitempty"`
+	Threshold    string `json:"threshold,omitempty"`
+	// SSL fields
+	CertificateName string `json:"certificate_name,omitempty"`
+	ExpiryDate      string `json:"expiry_date,omitempty"`
+	DaysLeft        string `json:"days_left,omitempty"`
+	IssuerCN        string `json:"issuer_cn,omitempty"`
+}
+
+// DiscordWebhookPayload represents Discord-specific webhook payload
+type DiscordWebhookPayload struct {
+	Content string `json:"content"`
+}
+
+// SendNotification sends a notification via webhook
+func (ws *WebhookService) SendNotification(config *AlertConfiguration, message string) error {
+	// fmt.Printf("📡 [WEBHOOK] Attempting to send notification...\n")
+	// fmt.Printf("📡 [WEBHOOK] Config - URL: %s, Notify Name: %s\n", config.WebhookURL, config.NotifyName)
+	// fmt.Printf("📡 [WEBHOOK] Message: %s\n", message)
+
+	// Use the webhook_url field from alert_configurations
+	if config.WebhookURL == "" {
+		return fmt.Errorf("webhook URL is required")
+	}
+
+	// Create payload using webhook_payload_template if available
+	var jsonData []byte
+	var err error
+
+	if config.WebhookPayloadTemplate != "" && strings.TrimSpace(config.WebhookPayloadTemplate) != "" {
+		// Use custom payload template
+		jsonData, err = ws.generateCustomPayload(config, message)
+		if err != nil {
+			// fmt.Printf("❌ [WEBHOOK] Custom payload generation error: %v\n", err)
+			return err
+		}
+	} else {
+		// Detect Discord webhook and use appropriate payload
+		if strings.Contains(strings.ToLower(config.WebhookURL), "discord") {
+			jsonData, err = ws.generateDiscordPayload(message)
+		} else {
+			// Use default payload structure for other webhooks
+			jsonData, err = ws.generateDefaultPayload(config, message)
+		}
+		
+		if err != nil {
+			// fmt.Printf("❌ [WEBHOOK] JSON marshal error: %v\n", err)
+			return err
+		}
+	}
+
+	// fmt.Printf("📡 [WEBHOOK] Payload: %s\n", string(jsonData))
+	// fmt.Printf("📡 [WEBHOOK] Sending POST request...\n")
+	
+	resp, err := http.Post(config.WebhookURL, "application/json", bytes.NewBuffer(jsonData))
+	if err != nil {
+		// fmt.Printf("❌ [WEBHOOK] HTTP error: %v\n", err)
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		// fmt.Printf("❌ [WEBHOOK] API error, status: %d\n", resp.StatusCode)
+		return fmt.Errorf("webhook error, status: %d", resp.StatusCode)
+	}
+
+	// fmt.Printf("✅ [WEBHOOK] Message sent successfully!\n")
+	return nil
+}
+
+// generateDiscordPayload generates a Discord-compatible webhook payload
+func (ws *WebhookService) generateDiscordPayload(message string) ([]byte, error) {
+	payload := DiscordWebhookPayload{
+		Content: message,
+	}
+	return json.Marshal(payload)
+}
+
+// generateDefaultPayload generates the default webhook payload
+func (ws *WebhookService) generateDefaultPayload(config *AlertConfiguration, message string) ([]byte, error) {
+	payload := WebhookPayload{
+		Message:    message,
+		NotifyName: config.NotifyName,
+		Timestamp:  time.Now().Format(time.RFC3339),
+	}
+	return json.Marshal(payload)
+}
+
+// generateCustomPayload generates payload using the custom template
+func (ws *WebhookService) generateCustomPayload(config *AlertConfiguration, message string) ([]byte, error) {
+	// Parse the template
+	tmpl, err := template.New("webhook").Parse(config.WebhookPayloadTemplate)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse webhook payload template: %v", err)
+	}
+
+	// Create template data
+	templateData := map[string]interface{}{
+		"message":     message,
+		"notify_name": config.NotifyName,
+		"timestamp":   time.Now().Format(time.RFC3339),
+	}
+
+	// Execute template
+	var buf bytes.Buffer
+	err = tmpl.Execute(&buf, templateData)
+	if err != nil {
+		return nil, fmt.Errorf("failed to execute webhook payload template: %v", err)
+	}
+
+	// Validate that the result is valid JSON
+	var jsonCheck interface{}
+	if err := json.Unmarshal(buf.Bytes(), &jsonCheck); err != nil {
+		return nil, fmt.Errorf("webhook payload template did not generate valid JSON: %v", err)
+	}
+
+	return buf.Bytes(), nil
+}
+
+// SendServerNotification sends a server-specific notification via webhook
+func (ws *WebhookService) SendServerNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) error {
+	message := ws.generateServerMessage(payload, template, resourceType)
+	return ws.SendNotification(config, message)
+}
+
+// SendServiceNotification sends a service-specific notification via webhook
+func (ws *WebhookService) SendServiceNotification(config *AlertConfiguration, payload *NotificationPayload, template *ServiceNotificationTemplate) error {
+	message := ws.generateServiceMessage(payload, template)
+	return ws.SendNotification(config, message)
+}
+
+// generateServerMessage creates a message for server notifications using server template
+func (ws *WebhookService) generateServerMessage(payload *NotificationPayload, template *ServerNotificationTemplate, resourceType string) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status and resource type
+	switch strings.ToLower(payload.Status) {
+	case "down":
+		templateMessage = template.DownMessage
+	case "up":
+		templateMessage = template.UpMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	case "paused":
+		templateMessage = template.PausedMessage
+	default:
+		// Handle resource-specific messages
+		switch resourceType {
+		case "cpu":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUMessage
+			} else {
+				templateMessage = template.CPUMessage
+			}
+		case "ram", "memory":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreRAMMessage
+			} else {
+				templateMessage = template.RAMMessage
+			}
+		case "disk":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskMessage
+			} else {
+				templateMessage = template.DiskMessage
+			}
+		case "network":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreNetworkMessage
+			} else {
+				templateMessage = template.NetworkMessage
+			}
+		case "cpu_temp", "cpu_temperature":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreCPUTempMessage
+			} else {
+				templateMessage = template.CPUTempMessage
+			}
+		case "disk_io":
+			if strings.Contains(strings.ToLower(payload.Status), "restore") {
+				templateMessage = template.RestoreDiskIOMessage
+			} else {
+				templateMessage = template.DiskIOMessage
+			}
+		default:
+			templateMessage = template.WarningMessage
+		}
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ws.generateDefaultServerMessage(payload, resourceType)
+	}
+	
+	return ws.replacePlaceholders(templateMessage, payload)
+}
+
+// generateServiceMessage creates a message for service notifications using service template
+func (ws *WebhookService) generateServiceMessage(payload *NotificationPayload, template *ServiceNotificationTemplate) string {
+	var templateMessage string
+	
+	// Select appropriate template message based on status
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		templateMessage = template.UpMessage
+	case "down":
+		templateMessage = template.DownMessage
+	case "maintenance":
+		templateMessage = template.MaintenanceMessage
+	case "incident":
+		templateMessage = template.IncidentMessage
+	case "resolved":
+		templateMessage = template.ResolvedMessage
+	case "warning":
+		templateMessage = template.WarningMessage
+	default:
+		templateMessage = template.WarningMessage
+	}
+	
+	// If no template message found, use a default
+	if templateMessage == "" {
+		templateMessage = ws.generateDefaultUptimeMessage(payload)
+	}
+	
+	return ws.replacePlaceholders(templateMessage, payload)
+}
+
+// replacePlaceholders replaces all placeholders in the message with actual values
+func (ws *WebhookService) replacePlaceholders(message string, payload *NotificationPayload) string {
+	// Replace basic placeholders
+	message = strings.ReplaceAll(message, "${service_name}", payload.ServiceName)
+	message = strings.ReplaceAll(message, "${server_name}", payload.ServiceName) // server_name maps to service_name
+	message = strings.ReplaceAll(message, "${status}", strings.ToUpper(payload.Status))
+	message = strings.ReplaceAll(message, "${host}", ws.safeString(payload.Host))
+	message = strings.ReplaceAll(message, "${hostname}", ws.safeString(payload.Hostname))
+	
+	// Replace URL with fallback to host
+	url := ws.safeString(payload.URL)
+	if url == "N/A" && payload.Host != "" {
+		url = payload.Host
+	}
+	message = strings.ReplaceAll(message, "${url}", url)
+	
+	// Replace domain
+	message = strings.ReplaceAll(message, "${domain}", ws.safeString(payload.Domain))
+	
+	// Replace service type
+	if payload.ServiceType != "" {
+		message = strings.ReplaceAll(message, "${service_type}", strings.ToUpper(payload.ServiceType))
+	} else {
+		message = strings.ReplaceAll(message, "${service_type}", "N/A")
+	}
+	
+	// Replace region and agent info
+	message = strings.ReplaceAll(message, "${region_name}", ws.safeString(payload.RegionName))
+	message = strings.ReplaceAll(message, "${agent_id}", ws.safeString(payload.AgentID))
+	
+	// Handle numeric fields safely
+	if payload.Port > 0 {
+		message = strings.ReplaceAll(message, "${port}", fmt.Sprintf("%d", payload.Port))
+	} else {
+		message = strings.ReplaceAll(message, "${port}", "N/A")
+	}
+	
+	if payload.ResponseTime > 0 {
+		message = strings.ReplaceAll(message, "${response_time}", fmt.Sprintf("%dms", payload.ResponseTime))
+	} else {
+		message = strings.ReplaceAll(message, "${response_time}", "N/A")
+	}
+	
+	if payload.Uptime > 0 {
+		message = strings.ReplaceAll(message, "${uptime}", fmt.Sprintf("%d%%", payload.Uptime))
+	} else {
+		message = strings.ReplaceAll(message, "${uptime}", "N/A")
+	}
+	
+	// Replace server monitoring fields
+	message = strings.ReplaceAll(message, "${cpu_usage}", ws.safeString(payload.CPUUsage))
+	message = strings.ReplaceAll(message, "${ram_usage}", ws.safeString(payload.RAMUsage))
+	message = strings.ReplaceAll(message, "${disk_usage}", ws.safeString(payload.DiskUsage))
+	message = strings.ReplaceAll(message, "${network_usage}", ws.safeString(payload.NetworkUsage))
+	message = strings.ReplaceAll(message, "${cpu_temp}", ws.safeString(payload.CPUTemp))
+	message = strings.ReplaceAll(message, "${disk_io}", ws.safeString(payload.DiskIO))
+	message = strings.ReplaceAll(message, "${threshold}", ws.safeString(payload.Threshold))
+	
+	// Replace SSL certificate fields
+	message = strings.ReplaceAll(message, "${certificate_name}", ws.safeString(payload.CertificateName))
+	message = strings.ReplaceAll(message, "${expiry_date}", ws.safeString(payload.ExpiryDate))
+	message = strings.ReplaceAll(message, "${days_left}", ws.safeString(payload.DaysLeft))
+	message = strings.ReplaceAll(message, "${issuer_cn}", ws.safeString(payload.IssuerCN))
+	message = strings.ReplaceAll(message, "${issuer}", ws.safeString(payload.IssuerCN)) // alias
+	
+	// Replace error message - important for uptime services
+	message = strings.ReplaceAll(message, "${error_message}", ws.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${error}", ws.safeString(payload.ErrorMessage))
+	message = strings.ReplaceAll(message, "${message}", ws.safeString(payload.Message))
+	
+	// Replace time placeholders
+	message = strings.ReplaceAll(message, "${time}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	message = strings.ReplaceAll(message, "${timestamp}", payload.Timestamp.Format("2006-01-02 15:04:05"))
+	
+	return message
+}
+
+// safeString returns the string value or "N/A" if empty
+func (ws *WebhookService) safeString(value string) string {
+	if value == "" {
+		return "N/A"
+	}
+	return value
+}
+
+// generateDefaultUptimeMessage creates a default uptime message with proper formatting
+func (ws *WebhookService) generateDefaultUptimeMessage(payload *NotificationPayload) string {
+	// Status emoji mapping
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	case "maintenance", "paused":
+		statusEmoji = "🟠"
+	}
+	
+	message := fmt.Sprintf("%s Service %s is %s.", statusEmoji, payload.ServiceName, strings.ToUpper(payload.Status))
+	
+	// Build formatted details
+	details := []string{}
+	
+	// Add URL or host
+	if payload.URL != "" {
+		details = append(details, fmt.Sprintf(" - Host URL: %s", payload.URL))
+	} else if payload.Host != "" {
+		details = append(details, fmt.Sprintf(" - Host: %s", payload.Host))
+	}
+	
+	// Add service type
+	if payload.ServiceType != "" {
+		details = append(details, fmt.Sprintf(" - Type: %s", strings.ToUpper(payload.ServiceType)))
+	}
+	
+	// Add port if available
+	if payload.Port > 0 {
+		details = append(details, fmt.Sprintf(" - Port: %d", payload.Port))
+	}
+	
+	// Add domain if available
+	if payload.Domain != "" {
+		details = append(details, fmt.Sprintf(" - Domain: %s", payload.Domain))
+	}
+	
+	// Add response time
+	if payload.ResponseTime > 0 {
+		details = append(details, fmt.Sprintf(" - Response time: %dms", payload.ResponseTime))
+	} else {
+		details = append(details, " - Response time: N/A")
+	}
+	
+	// Add region info
+	if payload.RegionName != "" {
+		details = append(details, fmt.Sprintf(" - Region: %s", payload.RegionName))
+	}
+	
+	// Add agent info
+	if payload.AgentID != "" {
+		details = append(details, fmt.Sprintf(" - Agent: %s", payload.AgentID))
+	}
+	
+	// Add uptime if available
+	if payload.Uptime > 0 {
+		details = append(details, fmt.Sprintf(" - Uptime: %d%%", payload.Uptime))
+	}
+	
+	// Add timestamp
+	details = append(details, fmt.Sprintf(" - Time: %s", payload.Timestamp.Format("2006-01-02 15:04:05")))
+	
+	// Combine message with details
+	if len(details) > 0 {
+		message += "\n" + strings.Join(details, "\n")
+	}
+	
+	return message
+}
+
+// generateDefaultServerMessage creates a default server message
+func (ws *WebhookService) generateDefaultServerMessage(payload *NotificationPayload, resourceType string) string {
+	statusEmoji := "🔵"
+	switch strings.ToLower(payload.Status) {
+	case "up":
+		statusEmoji = "🟢"
+	case "down":
+		statusEmoji = "🔴"
+	case "warning":
+		statusEmoji = "🟡"
+	}
+	
+	return fmt.Sprintf("%s 🖥️ Server %s (%s) status: %s", statusEmoji, payload.ServiceName, payload.Hostname, strings.ToUpper(payload.Status))
+}
\ No newline at end of file
diff --git a/server/service-operation/operations/dns.go b/server/service-operation/operations/dns.go
new file mode 100644
index 0000000..e78862e
--- /dev/null
+++ b/server/service-operation/operations/dns.go
@@ -0,0 +1,254 @@
+package operations
+
+import (
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"service-operation/types"
+)
+
+type DNSOperation struct {
+	timeout time.Duration
+}
+
+func NewDNSOperation(timeout time.Duration) *DNSOperation {
+	return &DNSOperation{timeout: timeout}
+}
+
+func (d *DNSOperation) Execute(host, query string) (*types.OperationResult, error) {
+	// Validate inputs
+	if host == "" {
+		return nil, fmt.Errorf("host cannot be empty")
+	}
+	
+	if query == "" {
+		query = "A" // Default to A record
+	}
+
+	result := &types.OperationResult{
+		Type:      types.OperationDNS,
+		Host:      host,
+		DNSType:   query,
+		StartTime: time.Now(),
+	}
+
+	start := time.Now()
+
+	// Resolve the host first to get detailed info
+	var resolvedIPs []string
+	var err error
+
+	switch strings.ToUpper(query) {
+	case "A":
+		resolvedIPs, err = d.performARecordLookup(host)
+		
+	case "AAAA":
+		resolvedIPs, err = d.performAAAARecordLookup(host)
+		
+	case "MX":
+		resolvedIPs, err = d.performMXRecordLookup(host)
+		
+	case "TXT":
+		resolvedIPs, err = d.performTXTRecordLookup(host)
+		
+	case "CNAME":
+		resolvedIPs, err = d.performCNAMERecordLookup(host)
+		
+	case "NS":
+		resolvedIPs, err = d.performNSRecordLookup(host)
+		
+	default:
+		// Default to A record lookup for unknown types
+		resolvedIPs, err = d.performARecordLookup(host)
+	}
+
+	result.ResponseTime = time.Since(start)
+	result.EndTime = time.Now()
+
+	if err != nil {
+		result.Error = err.Error()
+		result.Success = false
+		result.Details = d.createDetailedErrorMessage(err.Error(), host, query)
+	} else {
+		result.DNSRecords = resolvedIPs
+		result.Success = len(resolvedIPs) > 0
+		
+		if result.Success {
+			result.Details = d.createDetailedSuccessMessage(result, host, query, resolvedIPs)
+		} else {
+			result.Error = "No DNS records found"
+			result.Details = d.createDetailedErrorMessage("no records found", host, query)
+		}
+	}
+
+	return result, nil
+}
+
+func (d *DNSOperation) performARecordLookup(host string) ([]string, error) {
+	ips, err := net.LookupIP(host)
+	if err != nil {
+		return nil, err
+	}
+	
+	var ipv4Records []string
+	for _, ip := range ips {
+		if ipv4 := ip.To4(); ipv4 != nil {
+			ipv4Records = append(ipv4Records, ipv4.String())
+		}
+	}
+	
+	return ipv4Records, nil
+}
+
+func (d *DNSOperation) performAAAARecordLookup(host string) ([]string, error) {
+	ips, err := net.LookupIP(host)
+	if err != nil {
+		return nil, err
+	}
+	
+	var ipv6Records []string
+	for _, ip := range ips {
+		if ipv6 := ip.To16(); ipv6 != nil && ip.To4() == nil {
+			ipv6Records = append(ipv6Records, ipv6.String())
+		}
+	}
+	
+	return ipv6Records, nil
+}
+
+func (d *DNSOperation) performMXRecordLookup(host string) ([]string, error) {
+	mxRecords, err := net.LookupMX(host)
+	if err != nil {
+		return nil, err
+	}
+	
+	var records []string
+	for _, mx := range mxRecords {
+		records = append(records, fmt.Sprintf("%s (priority: %d)", mx.Host, mx.Pref))
+	}
+	
+	return records, nil
+}
+
+func (d *DNSOperation) performTXTRecordLookup(host string) ([]string, error) {
+	txtRecords, err := net.LookupTXT(host)
+	if err != nil {
+		return nil, err
+	}
+	
+	return txtRecords, nil
+}
+
+func (d *DNSOperation) performCNAMERecordLookup(host string) ([]string, error) {
+	cname, err := net.LookupCNAME(host)
+	if err != nil {
+		return nil, err
+	}
+	
+	return []string{cname}, nil
+}
+
+func (d *DNSOperation) performNSRecordLookup(host string) ([]string, error) {
+	nsRecords, err := net.LookupNS(host)
+	if err != nil {
+		return nil, err
+	}
+	
+	var records []string
+	for _, ns := range nsRecords {
+		records = append(records, ns.Host)
+	}
+	
+	return records, nil
+}
+
+func (d *DNSOperation) createDetailedSuccessMessage(result *types.OperationResult, host, queryType string, records []string) string {
+	var details strings.Builder
+	
+	// Success indicator with basic info
+	details.WriteString(fmt.Sprintf("🟢 DNS SUCCESS - %s query for %s", 
+		strings.ToUpper(queryType), host))
+	
+	// Response time
+	details.WriteString(fmt.Sprintf(" | Response time: %.2fms", 
+		float64(result.ResponseTime.Nanoseconds())/1000000))
+	
+	// Record count
+	details.WriteString(fmt.Sprintf(" | Records found: %d", len(records)))
+	
+	// Show first few records for context
+	if len(records) > 0 {
+		details.WriteString(" | ")
+		if len(records) <= 3 {
+			details.WriteString(fmt.Sprintf("Results: %s", strings.Join(records, ", ")))
+		} else {
+			details.WriteString(fmt.Sprintf("Results: %s... (+%d more)", 
+				strings.Join(records[:3], ", "), len(records)-3))
+		}
+	}
+	
+	return details.String()
+}
+
+func (d *DNSOperation) createDetailedErrorMessage(errorMsg, host, queryType string) string {
+	var details strings.Builder
+	
+	errorLower := strings.ToLower(errorMsg)
+	
+	if strings.Contains(errorLower, "timeout") {
+		details.WriteString("⏱️ DNS TIMEOUT - Query timed out")
+	} else if strings.Contains(errorLower, "no such host") || strings.Contains(errorLower, "host not found") {
+		details.WriteString("🔍 HOST NOT FOUND - DNS resolution failed")
+	} else if strings.Contains(errorLower, "no answer") || strings.Contains(errorLower, "no records found") {
+		details.WriteString("📝 NO RECORDS - No DNS records of requested type")
+	} else if strings.Contains(errorLower, "server failure") {
+		details.WriteString("🔧 SERVER FAILURE - DNS server error")
+	} else if strings.Contains(errorLower, "refused") {
+		details.WriteString("🚫 QUERY REFUSED - DNS server refused query")
+	} else {
+		details.WriteString("❌ DNS FAILED - Query error")
+	}
+	
+	// Add query details
+	details.WriteString(fmt.Sprintf(" | Query: %s %s", 
+		strings.ToUpper(queryType), host))
+	
+	// Add specific error details
+	if errorMsg != "" {
+		details.WriteString(fmt.Sprintf(" | Error: %s", d.getShortErrorMessage(errorMsg)))
+	}
+	
+	return details.String()
+}
+
+func (d *DNSOperation) getShortErrorMessage(errorMessage string) string {
+	if errorMessage == "" {
+		return "Unknown error"
+	}
+	
+	errorLower := strings.ToLower(errorMessage)
+	
+	if strings.Contains(errorLower, "timeout") {
+		return "Query timeout"
+	} else if strings.Contains(errorLower, "no such host") {
+		return "Host not found"
+	} else if strings.Contains(errorLower, "no answer") {
+		return "No records found"
+	} else if strings.Contains(errorLower, "server failure") {
+		return "DNS server failure"
+	} else if strings.Contains(errorLower, "refused") {
+		return "Query refused"
+	} else if strings.Contains(errorLower, "network unreachable") {
+		return "Network unreachable"
+	}
+	
+	// For other errors, take first 50 characters and clean it up
+	shortMsg := errorMessage
+	if len(shortMsg) > 50 {
+		shortMsg = shortMsg[:50] + "..."
+	}
+	
+	return shortMsg
+}
\ No newline at end of file
diff --git a/server/service-operation/operations/http.go b/server/service-operation/operations/http.go
new file mode 100644
index 0000000..887350c
--- /dev/null
+++ b/server/service-operation/operations/http.go
@@ -0,0 +1,136 @@
+
+package operations
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"service-operation/types"
+)
+
+type HTTPOperation struct {
+	timeout time.Duration
+	client  *http.Client
+}
+
+func NewHTTPOperation(timeout time.Duration) *HTTPOperation {
+	return &HTTPOperation{
+		timeout: timeout,
+		client: &http.Client{
+			Timeout: timeout,
+		},
+	}
+}
+
+func (h *HTTPOperation) Execute(url, method string) (*types.OperationResult, error) {
+	result := &types.OperationResult{
+		Type:       types.OperationHTTP,
+		StartTime:  time.Now(),
+		HTTPMethod: method,
+	}
+
+	// Default to GET if no method specified
+	if method == "" {
+		method = "GET"
+		result.HTTPMethod = "GET"
+	}
+
+	// Ensure URL has protocol
+	if !strings.HasPrefix(url, "http://") && !strings.HasPrefix(url, "https://") {
+		url = "https://" + url
+	}
+
+	start := time.Now()
+
+	req, err := http.NewRequest(method, url, nil)
+	if err != nil {
+		result.Error = fmt.Sprintf("Failed to create request: %v", err)
+		result.Success = false
+		result.EndTime = time.Now()
+		return result, nil
+	}
+
+	// Set a user agent
+	req.Header.Set("User-Agent", "ServiceOperation/1.0")
+
+	resp, err := h.client.Do(req)
+	
+	result.ResponseTime = time.Since(start)
+	result.EndTime = time.Now()
+
+	if err != nil {
+		// More detailed error messages
+		if strings.Contains(err.Error(), "timeout") {
+			result.Error = fmt.Sprintf("🕐 Request timeout after %.2fs - Server did not respond within the expected time", h.timeout.Seconds())
+		} else if strings.Contains(err.Error(), "connection refused") {
+			result.Error = "🚫 Connection refused - Server is not accepting connections on this port"
+		} else if strings.Contains(err.Error(), "no such host") {
+			result.Error = "🌐 DNS resolution failed - Host not found"
+		} else if strings.Contains(err.Error(), "certificate") {
+			result.Error = "🔒 SSL/TLS certificate error - Certificate verification failed"
+		} else {
+			result.Error = fmt.Sprintf("🔌 Connection error: %v", err)
+		}
+		result.Success = false
+		return result, nil
+	}
+	defer resp.Body.Close()
+
+	result.HTTPStatusCode = resp.StatusCode
+	result.ContentLength = resp.ContentLength
+	result.Success = resp.StatusCode >= 200 && resp.StatusCode < 400
+
+	// Capture important headers
+	result.HTTPHeaders = make(map[string]string)
+	for key, values := range resp.Header {
+		if len(values) > 0 {
+			switch strings.ToLower(key) {
+			case "content-type", "server", "cache-control", "content-encoding", "x-powered-by":
+				result.HTTPHeaders[key] = values[0]
+			}
+		}
+	}
+
+	// Read response body for keyword checking and additional details
+	body, err := io.ReadAll(resp.Body)
+	if err == nil && len(body) > 0 {
+		result.ResponseBody = string(body)
+		// Update content length if not set by server
+		if result.ContentLength <= 0 {
+			result.ContentLength = int64(len(body))
+		}
+	}
+
+	// Create detailed status message with emoji
+	if !result.Success {
+		switch {
+		case resp.StatusCode >= 500:
+			result.Error = fmt.Sprintf("🔥 Server Error (HTTP %d): %s - The server encountered an internal error", resp.StatusCode, resp.Status)
+		case resp.StatusCode >= 400:
+			result.Error = fmt.Sprintf("❌ Client Error (HTTP %d): %s - The request was invalid or unauthorized", resp.StatusCode, resp.Status)
+		case resp.StatusCode >= 300:
+			result.Error = fmt.Sprintf("↩️ Redirect (HTTP %d): %s - Resource has moved", resp.StatusCode, resp.Status)
+		default:
+			result.Error = fmt.Sprintf("⚠️ Unexpected Status (HTTP %d): %s", resp.StatusCode, resp.Status)
+		}
+	} else {
+		// Success message with emoji
+		switch resp.StatusCode {
+		case 200:
+			result.Error = "✅ OK - Request successful"
+		case 201:
+			result.Error = "🆕 Created - Resource created successfully"
+		case 202:
+			result.Error = "⏳ Accepted - Request accepted for processing"
+		case 204:
+			result.Error = "📭 No Content - Request successful, no content returned"
+		default:
+			result.Error = fmt.Sprintf("✅ Success (HTTP %d): %s", resp.StatusCode, resp.Status)
+		}
+	}
+
+	return result, nil
+}
\ No newline at end of file
diff --git a/server/service-operation/operations/ping.go b/server/service-operation/operations/ping.go
new file mode 100644
index 0000000..9b79923
--- /dev/null
+++ b/server/service-operation/operations/ping.go
@@ -0,0 +1,460 @@
+package operations
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"regexp"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+
+	"golang.org/x/net/icmp"
+	"golang.org/x/net/ipv4"
+	"service-operation/types"
+)
+
+type PingOperation struct {
+	timeout time.Duration
+}
+
+func NewPingOperation(timeout time.Duration) *PingOperation {
+	return &PingOperation{timeout: timeout}
+}
+
+func (p *PingOperation) Execute(host string, count int) (*types.OperationResult, error) {
+	// Validate host/IP
+	if host == "" {
+		return nil, fmt.Errorf("host cannot be empty")
+	}
+
+	// Always try system ping first for better reliability
+	result, err := p.executeSystemPing(host, count)
+	if err == nil && result.PacketsRecv > 0 {
+		return result, nil
+	}
+	
+	// If system ping fails, try raw ICMP as fallback
+	fmt.Printf("System ping failed (%v), trying raw ICMP\n", err)
+	rawResult, rawErr := p.executeRawICMP(host, count)
+	if rawErr == nil && rawResult.PacketsRecv > 0 {
+		return rawResult, nil
+	}
+	
+	// If both fail, return the system ping result with error info
+	if result != nil {
+		return result, nil
+	}
+	
+	return nil, fmt.Errorf("both system ping and raw ICMP failed: system_err=%v, raw_err=%v", err, rawErr)
+}
+
+func (p *PingOperation) executeSystemPing(host string, count int) (*types.OperationResult, error) {
+	result := &types.OperationResult{
+		Type:        types.OperationPing,
+		Host:        host,
+		PacketsSent: count,
+		StartTime:   time.Now(),
+	}
+
+	// Resolve host to get IP address for better details
+	ips, err := net.LookupIP(host)
+	var resolvedIP string
+	if err == nil && len(ips) > 0 {
+		resolvedIP = ips[0].String()
+	}
+
+	// Build ping command based on OS
+	var cmd *exec.Cmd
+	timeoutSeconds := int(p.timeout.Seconds())
+	if timeoutSeconds < 1 {
+		timeoutSeconds = 10 // Minimum 10 seconds timeout
+	}
+
+	switch runtime.GOOS {
+	case "linux":
+		// Linux ping: -c count -W timeout_in_seconds
+		cmd = exec.Command("ping", "-c", fmt.Sprintf("%d", count), "-W", fmt.Sprintf("%d", timeoutSeconds), host)
+	case "darwin":
+		// macOS ping: -c count -W timeout_in_milliseconds
+		cmd = exec.Command("ping", "-c", fmt.Sprintf("%d", count), "-W", fmt.Sprintf("%d", timeoutSeconds*1000), host)
+	case "windows":
+		// Windows ping: -n count -w timeout_in_milliseconds
+		cmd = exec.Command("ping", "-n", fmt.Sprintf("%d", count), "-w", fmt.Sprintf("%d", timeoutSeconds*1000), host)
+	default:
+		// Default to Linux-style
+		cmd = exec.Command("ping", "-c", fmt.Sprintf("%d", count), "-W", fmt.Sprintf("%d", timeoutSeconds), host)
+	}
+
+	// Set command timeout slightly longer than ping timeout
+	cmdTimeout := time.Duration(timeoutSeconds+5) * time.Second
+	done := make(chan error, 1)
+	var output []byte
+	var cmdErr error
+
+	go func() {
+		output, cmdErr = cmd.Output()
+		done <- cmdErr
+	}()
+
+	select {
+	case err := <-done:
+		result.EndTime = time.Now()
+		
+		if err != nil {
+			// Even if command fails, try to parse partial output
+			result.PacketLoss = 100.0
+			if len(output) > 0 {
+				p.parseSystemPingOutput(result, string(output), count)
+			}
+			// Set detailed error information
+			result.Error = p.createDetailedErrorMessage(err.Error(), host, resolvedIP)
+			return result, nil // Don't return error, return result with failure info
+		}
+		
+		// Parse successful output
+		if len(output) > 0 {
+			p.parseSystemPingOutput(result, string(output), count)
+		}
+
+		// Create detailed success message
+		if result.Success {
+			result.Details = p.createDetailedSuccessMessage(result, host, resolvedIP)
+		}
+		
+		return result, nil
+		
+	case <-time.After(cmdTimeout):
+		// Command timed out
+		if cmd.Process != nil {
+			cmd.Process.Kill()
+		}
+		result.EndTime = time.Now()
+		result.PacketLoss = 100.0
+		result.Error = fmt.Sprintf("Ping request timed out after %v", cmdTimeout)
+		result.Details = p.createDetailedErrorMessage("timeout", host, resolvedIP)
+		return result, fmt.Errorf("ping command timed out after %v", cmdTimeout)
+	}
+}
+
+func (p *PingOperation) createDetailedSuccessMessage(result *types.OperationResult, host, resolvedIP string) string {
+	var details strings.Builder
+	
+	// Success indicator with basic info
+	details.WriteString(fmt.Sprintf("🟢 PING SUCCESS - %d/%d packets received", 
+		result.PacketsRecv, result.PacketsSent))
+	
+	// Host and IP information
+	if resolvedIP != "" && resolvedIP != host {
+		details.WriteString(fmt.Sprintf(" | Host: %s (%s)", host, resolvedIP))
+	} else {
+		details.WriteString(fmt.Sprintf(" | Host: %s", host))
+	}
+	
+	// Timing information
+	if result.AvgRTT > 0 {
+		details.WriteString(fmt.Sprintf(" | Avg RTT: %.2fms", 
+			float64(result.AvgRTT.Nanoseconds())/1000000))
+	}
+	
+	if result.MinRTT > 0 && result.MaxRTT > 0 {
+		details.WriteString(fmt.Sprintf(" | Range: %.2f-%.2fms", 
+			float64(result.MinRTT.Nanoseconds())/1000000,
+			float64(result.MaxRTT.Nanoseconds())/1000000))
+	}
+	
+	// Packet loss information
+	if result.PacketLoss > 0 {
+		details.WriteString(fmt.Sprintf(" | Packet Loss: %.1f%%", result.PacketLoss))
+	} else {
+		details.WriteString(" | No packet loss")
+	}
+	
+	return details.String()
+}
+
+func (p *PingOperation) createDetailedErrorMessage(errorMsg, host, resolvedIP string) string {
+	var details strings.Builder
+	
+	errorLower := strings.ToLower(errorMsg)
+	
+	if strings.Contains(errorLower, "timeout") {
+		details.WriteString("⏱️ PING TIMEOUT - Host did not respond within timeout period")
+	} else if strings.Contains(errorLower, "unreachable") {
+		details.WriteString("🚫 HOST UNREACHABLE - Network path to host is blocked")
+	} else if strings.Contains(errorLower, "no route") {
+		details.WriteString("🛤️ NO ROUTE - No network route to destination")
+	} else if strings.Contains(errorLower, "name resolution") || strings.Contains(errorLower, "unknown host") {
+		details.WriteString("🔍 DNS RESOLUTION FAILED - Unable to resolve hostname")
+	} else if strings.Contains(errorLower, "permission denied") {
+		details.WriteString("🔐 PERMISSION DENIED - Insufficient privileges for ICMP")
+	} else {
+		details.WriteString("❌ PING FAILED - Connection error")
+	}
+	
+	// Add host information
+	if resolvedIP != "" && resolvedIP != host {
+		details.WriteString(fmt.Sprintf(" | Target: %s (%s)", host, resolvedIP))
+	} else {
+		details.WriteString(fmt.Sprintf(" | Target: %s", host))
+	}
+	
+	// Add specific error details
+	if errorMsg != "" {
+		details.WriteString(fmt.Sprintf(" | Error: %s", p.getShortErrorMessage(errorMsg)))
+	}
+	
+	return details.String()
+}
+
+func (p *PingOperation) getShortErrorMessage(errorMessage string) string {
+	if errorMessage == "" {
+		return "Unknown error"
+	}
+	
+	errorLower := strings.ToLower(errorMessage)
+	
+	if strings.Contains(errorLower, "timeout") {
+		return "Request timeout"
+	} else if strings.Contains(errorLower, "unreachable") {
+		return "Host unreachable"
+	} else if strings.Contains(errorLower, "no route") {
+		return "No route to host"
+	} else if strings.Contains(errorLower, "name resolution") || strings.Contains(errorLower, "unknown host") {
+		return "DNS resolution failed"
+	} else if strings.Contains(errorLower, "permission denied") {
+		return "Permission denied"
+	} else if strings.Contains(errorLower, "network is down") {
+		return "Network is down"
+	}
+	
+	// For other errors, take first 50 characters and clean it up
+	shortMsg := errorMessage
+	if len(shortMsg) > 50 {
+		shortMsg = shortMsg[:50] + "..."
+	}
+	
+	return shortMsg
+}
+
+func (p *PingOperation) parseSystemPingOutput(result *types.OperationResult, output string, expectedCount int) {
+	// Extract packet loss
+	lossRegex := regexp.MustCompile(`(\d+(?:\.\d+)?)%.*packet.*loss`)
+	if matches := lossRegex.FindStringSubmatch(output); len(matches) > 1 {
+		if loss, err := strconv.ParseFloat(matches[1], 64); err == nil {
+			result.PacketLoss = loss
+		}
+	}
+
+	// Extract timing information (Linux/macOS format)
+	timingRegex := regexp.MustCompile(`rtt min/avg/max/(?:mdev|stddev) = ([\d.]+)/([\d.]+)/([\d.]+)/([\d.]+) ms`)
+	if matches := timingRegex.FindStringSubmatch(output); len(matches) > 4 {
+		if min, err := strconv.ParseFloat(matches[1], 64); err == nil {
+			result.MinRTT = time.Duration(min * float64(time.Millisecond))
+		}
+		if avg, err := strconv.ParseFloat(matches[2], 64); err == nil {
+			result.AvgRTT = time.Duration(avg * float64(time.Millisecond))
+			result.ResponseTime = result.AvgRTT
+		}
+		if max, err := strconv.ParseFloat(matches[3], 64); err == nil {
+			result.MaxRTT = time.Duration(max * float64(time.Millisecond))
+		}
+	}
+
+	// Extract individual ping times and count successful pings
+	timeRegex := regexp.MustCompile(`time[<=]([\d.]+) ?ms`)
+	timeMatches := timeRegex.FindAllStringSubmatch(output, -1)
+	result.PacketsRecv = len(timeMatches)
+	
+	for _, match := range timeMatches {
+		if len(match) > 1 {
+			if t, err := strconv.ParseFloat(match[1], 64); err == nil {
+				rtt := time.Duration(t * float64(time.Millisecond))
+				result.RTTs = append(result.RTTs, rtt)
+				
+				// Update min/max if not set by summary stats
+				if result.MinRTT == 0 || rtt < result.MinRTT {
+					result.MinRTT = rtt
+				}
+				if result.MaxRTT == 0 || rtt > result.MaxRTT {
+					result.MaxRTT = rtt
+				}
+			}
+		}
+	}
+
+	// Calculate average RTT if not set by summary stats
+	if result.AvgRTT == 0 && len(result.RTTs) > 0 {
+		var total time.Duration
+		for _, rtt := range result.RTTs {
+			total += rtt
+		}
+		result.AvgRTT = total / time.Duration(len(result.RTTs))
+		result.ResponseTime = result.AvgRTT
+	}
+
+	// Recalculate packet loss if we have individual pings
+	if expectedCount > 0 {
+		result.PacketLoss = float64(expectedCount-result.PacketsRecv) / float64(expectedCount) * 100
+	}
+
+	// Mark as successful if we got any responses
+	if result.PacketsRecv > 0 {
+		result.Success = true
+	}
+
+	// Handle Windows output format if Linux/macOS parsing didn't work
+	if result.PacketsRecv == 0 && strings.Contains(strings.ToLower(output), "reply from") {
+		p.parseWindowsPingOutput(result, output, expectedCount)
+	}
+}
+
+func (p *PingOperation) parseWindowsPingOutput(result *types.OperationResult, output string, expectedCount int) {
+	// Windows: "Reply from 1.1.1.1: bytes=32 time=14ms TTL=56"
+	timeRegex := regexp.MustCompile(`time[<=]([\d.]+)ms`)
+	timeMatches := timeRegex.FindAllStringSubmatch(output, -1)
+	result.PacketsRecv = len(timeMatches)
+	
+	for _, match := range timeMatches {
+		if len(match) > 1 {
+			if t, err := strconv.ParseFloat(match[1], 64); err == nil {
+				rtt := time.Duration(t * float64(time.Millisecond))
+				result.RTTs = append(result.RTTs, rtt)
+				
+				if result.MinRTT == 0 || rtt < result.MinRTT {
+					result.MinRTT = rtt
+				}
+				if result.MaxRTT == 0 || rtt > result.MaxRTT {
+					result.MaxRTT = rtt
+				}
+			}
+		}
+	}
+
+	if len(result.RTTs) > 0 {
+		var total time.Duration
+		for _, rtt := range result.RTTs {
+			total += rtt
+		}
+		result.AvgRTT = total / time.Duration(len(result.RTTs))
+		result.ResponseTime = result.AvgRTT
+		result.Success = true
+	}
+
+	if expectedCount > 0 {
+		result.PacketLoss = float64(expectedCount-result.PacketsRecv) / float64(expectedCount) * 100
+	}
+}
+
+func (p *PingOperation) executeRawICMP(host string, count int) (*types.OperationResult, error) {
+	dst, err := net.ResolveIPAddr("ip4", host)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve host %s: %v", host, err)
+	}
+
+	// Try to create ICMP connection with better error handling
+	conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create ICMP connection (requires root/admin privileges): %v", err)
+	}
+	defer conn.Close()
+
+	result := &types.OperationResult{
+		Type:        types.OperationPing,
+		Host:        host,
+		PacketsSent: count,
+		StartTime:   time.Now(),
+	}
+
+	var totalRTT time.Duration
+	var minRTT, maxRTT time.Duration
+	pid := os.Getpid() & 0xffff
+
+	for i := 0; i < count; i++ {
+		message := &icmp.Message{
+			Type: ipv4.ICMPTypeEcho,
+			Code: 0,
+			Body: &icmp.Echo{
+				ID:   pid,
+				Seq:  i + 1,
+				Data: []byte(fmt.Sprintf("Hello, World! %d", i)),
+			},
+		}
+
+		data, err := message.Marshal(nil)
+		if err != nil {
+			continue
+		}
+
+		start := time.Now()
+		_, err = conn.WriteTo(data, dst)
+		if err != nil {
+			continue
+		}
+
+		// Set read deadline
+		err = conn.SetReadDeadline(time.Now().Add(p.timeout))
+		if err != nil {
+			continue
+		}
+
+		reply := make([]byte, 1500)
+		_, peer, err := conn.ReadFrom(reply)
+		if err != nil {
+			continue
+		}
+
+		rtt := time.Since(start)
+
+		// Parse the reply with better error handling - fix the type conversion
+		rm, err := icmp.ParseMessage(int(ipv4.ICMPTypeEchoReply), reply)
+		if err != nil {
+			continue
+		}
+
+		switch rm.Type {
+		case ipv4.ICMPTypeEchoReply:
+			if peer.String() == dst.String() {
+				echoReply, ok := rm.Body.(*icmp.Echo)
+				if ok && echoReply.ID == pid {
+					result.PacketsRecv++
+					totalRTT += rtt
+
+					if result.PacketsRecv == 1 || rtt < minRTT {
+						minRTT = rtt
+					}
+					if result.PacketsRecv == 1 || rtt > maxRTT {
+						maxRTT = rtt
+					}
+
+					result.RTTs = append(result.RTTs, rtt)
+				}
+			}
+		}
+
+		// Sleep between pings except for the last one
+		if i < count-1 {
+			time.Sleep(1 * time.Second)
+		}
+	}
+
+	result.EndTime = time.Now()
+	result.PacketLoss = float64(count-result.PacketsRecv) / float64(count) * 100
+
+	if result.PacketsRecv > 0 {
+		result.MinRTT = minRTT
+		result.MaxRTT = maxRTT
+		result.AvgRTT = totalRTT / time.Duration(result.PacketsRecv)
+		result.ResponseTime = result.AvgRTT
+		result.Success = true
+		// Create detailed success message for raw ICMP
+		result.Details = p.createDetailedSuccessMessage(result, host, dst.String())
+	} else {
+		result.Error = "No ICMP echo replies received"
+		result.Details = p.createDetailedErrorMessage("no replies", host, dst.String())
+	}
+
+	return result, nil
+}
\ No newline at end of file
diff --git a/server/service-operation/operations/ssl_extractor.go b/server/service-operation/operations/ssl_extractor.go
new file mode 100644
index 0000000..3a1ad77
--- /dev/null
+++ b/server/service-operation/operations/ssl_extractor.go
@@ -0,0 +1,57 @@
+
+package operations
+
+import (
+	"crypto/ecdsa"
+	"crypto/rsa"
+	"crypto/x509"
+	"fmt"
+	"net"
+)
+
+// extractSANs extracts Subject Alternative Names from certificate
+func (op *SSLOperation) extractSANs(cert *x509.Certificate) []string {
+	sans := make([]string, 0)
+	
+	// Add DNS names
+	sans = append(sans, cert.DNSNames...)
+	
+	// Add IP addresses
+	for _, ip := range cert.IPAddresses {
+		sans = append(sans, ip.String())
+	}
+	
+	// Add email addresses
+	sans = append(sans, cert.EmailAddresses...)
+	
+	// Add URIs
+	for _, uri := range cert.URIs {
+		sans = append(sans, uri.String())
+	}
+	
+	return sans
+}
+
+// getResolvedIP resolves the domain to its IP address
+func (op *SSLOperation) getResolvedIP(hostname string) string {
+	ips, err := net.LookupIP(hostname)
+	if err != nil || len(ips) == 0 {
+		return ""
+	}
+	return ips[0].String()
+}
+
+// getCertificateAlgorithm returns detailed algorithm information
+func (op *SSLOperation) getCertificateAlgorithm(cert *x509.Certificate) string {
+	algorithm := cert.SignatureAlgorithm.String()
+	
+	// Add key size information if available
+	switch pub := cert.PublicKey.(type) {
+	case *rsa.PublicKey:
+		algorithm += fmt.Sprintf(" (RSA %d-bit)", pub.N.BitLen())
+	case *ecdsa.PublicKey:
+		algorithm += fmt.Sprintf(" (ECDSA %d-bit)", pub.Curve.Params().BitSize)
+	}
+	
+	return algorithm
+}
\ No newline at end of file
diff --git a/server/service-operation/operations/ssl_operation.go b/server/service-operation/operations/ssl_operation.go
new file mode 100644
index 0000000..398adbe
--- /dev/null
+++ b/server/service-operation/operations/ssl_operation.go
@@ -0,0 +1,159 @@
+
+package operations
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"service-operation/types"
+)
+
+type SSLOperation struct {
+	timeout time.Duration
+}
+
+func NewSSLOperation(timeout time.Duration) *SSLOperation {
+	return &SSLOperation{
+		timeout: timeout,
+	}
+}
+
+func (op *SSLOperation) Execute(domain string) (*types.OperationResult, error) {
+	startTime := time.Now()
+	
+	// Clean and normalize domain
+	domain = op.normalizeDomain(domain)
+	
+	// Validate domain format
+	if domain == "" {
+		return op.createErrorResult(domain, startTime, "domain cannot be empty")
+	}
+	
+	// Add port if not present
+	host := domain
+	if !strings.Contains(host, ":") {
+		host = host + ":443"
+	}
+
+	// Set up TLS connection with timeout
+	dialer := &net.Dialer{
+		Timeout: op.timeout,
+	}
+	
+	// Create TLS config with proper verification
+	tlsConfig := &tls.Config{
+		ServerName:         strings.Split(host, ":")[0],
+		InsecureSkipVerify: false,
+		MinVersion:         tls.VersionTLS12,
+	}
+	
+	// Attempt TLS connection
+	conn, err := tls.DialWithDialer(dialer, "tcp", host, tlsConfig)
+	
+	endTime := time.Now()
+	responseTime := endTime.Sub(startTime)
+	
+	if err != nil {
+		return &types.OperationResult{
+			Type:         types.OperationSSL,
+			Host:         strings.Split(host, ":")[0],
+			Success:      false,
+			ResponseTime: responseTime,
+			Error:        fmt.Sprintf("TLS connection failed: %v", err),
+			StartTime:    startTime,
+			EndTime:      endTime,
+		}, nil
+	}
+	defer conn.Close()
+
+	// Get certificate chain information
+	state := conn.ConnectionState()
+	if len(state.PeerCertificates) == 0 {
+		return &types.OperationResult{
+			Type:         types.OperationSSL,
+			Host:         strings.Split(host, ":")[0],
+			Success:      false,
+			ResponseTime: responseTime,
+			Error:        "No certificates found in chain",
+			StartTime:    startTime,
+			EndTime:      endTime,
+		}, nil
+	}
+
+	cert := state.PeerCertificates[0]
+	hostname := strings.Split(host, ":")[0]
+	
+	// Perform comprehensive certificate validation
+	validationError := op.validateCertificate(cert, hostname)
+	
+	// Calculate days left until expiration
+	daysLeft := int(time.Until(cert.NotAfter).Hours() / 24)
+	
+	// Extract Subject Alternative Names
+	sans := op.extractSANs(cert)
+	
+	// Get resolved IP address
+	resolvedIP := op.getResolvedIP(hostname)
+	
+	// Extract certificate algorithm information
+	algorithm := op.getCertificateAlgorithm(cert)
+	
+	// Extract issuer organization (O=) instead of full distinguished name
+	issuerOrganization := op.extractIssuerOrganization(cert.Issuer)
+	
+	// Extract subject organization (O=) instead of full distinguished name
+	subjectOrganization := op.extractSubjectOrganization(cert.Subject)
+	
+	// Check if certificate is valid (not expired and passes validation)
+	isValid := validationError == nil && time.Now().Before(cert.NotAfter) && time.Now().After(cert.NotBefore)
+	
+	// Build detailed error message if validation failed
+	errorMsg := ""
+	if validationError != nil {
+		errorMsg = validationError.Error()
+	} else if time.Now().After(cert.NotAfter) {
+		errorMsg = "Certificate has expired"
+	} else if time.Now().Before(cert.NotBefore) {
+		errorMsg = "Certificate is not yet valid"
+	}
+
+	// Create comprehensive result
+	result := &types.OperationResult{
+		Type:         types.OperationSSL,
+		Host:         hostname,
+		Success:      isValid,
+		ResponseTime: responseTime,
+		Error:        errorMsg,
+		StartTime:    startTime,
+		EndTime:      endTime,
+		
+		// SSL specific fields - using organization instead of full DN
+		SSLValidFrom:     cert.NotBefore,
+		SSLValidTill:     cert.NotAfter,
+		SSLDaysLeft:      daysLeft,
+		SSLIssuer:        issuerOrganization,        // Now shows "Google Trust Services" instead of full DN
+		SSLSubject:       subjectOrganization,       // Now shows organization instead of full DN
+		SSLSerialNumber:  cert.SerialNumber.String(),
+		SSLAlgorithm:     algorithm,
+		SSLSANs:          strings.Join(sans, ","),
+		SSLResolvedIP:    resolvedIP,
+	}
+
+	return result, nil
+}
+
+// createErrorResult creates a standardized error result
+func (op *SSLOperation) createErrorResult(domain string, startTime time.Time, errorMsg string) (*types.OperationResult, error) {
+	return &types.OperationResult{
+		Type:         types.OperationSSL,
+		Host:         domain,
+		Success:      false,
+		ResponseTime: time.Since(startTime),
+		Error:        errorMsg,
+		StartTime:    startTime,
+		EndTime:      time.Now(),
+	}, nil
+}
\ No newline at end of file
diff --git a/server/service-operation/operations/ssl_utils.go b/server/service-operation/operations/ssl_utils.go
new file mode 100644
index 0000000..555b4b2
--- /dev/null
+++ b/server/service-operation/operations/ssl_utils.go
@@ -0,0 +1,88 @@
+
+package operations
+
+import (
+	"crypto/x509/pkix"
+	"fmt"
+	"strings"
+)
+
+// normalizeDomain cleans and normalizes the domain input
+func (op *SSLOperation) normalizeDomain(domain string) string {
+	// Remove protocol prefixes
+	domain = strings.Replace(domain, "https://", "", 1)
+	domain = strings.Replace(domain, "http://", "", 1)
+	
+	// Remove trailing slash and path
+	if idx := strings.Index(domain, "/"); idx != -1 {
+		domain = domain[:idx]
+	}
+	
+	// Trim whitespace
+	domain = strings.TrimSpace(domain)
+	
+	return domain
+}
+
+// formatDistinguishedName formats the certificate distinguished name
+func (op *SSLOperation) formatDistinguishedName(name pkix.Name) string {
+	var parts []string
+	
+	if name.CommonName != "" {
+		parts = append(parts, fmt.Sprintf("CN=%s", name.CommonName))
+	}
+	
+	for _, org := range name.Organization {
+		parts = append(parts, fmt.Sprintf("O=%s", org))
+	}
+	
+	for _, orgUnit := range name.OrganizationalUnit {
+		parts = append(parts, fmt.Sprintf("OU=%s", orgUnit))
+	}
+	
+	for _, country := range name.Country {
+		parts = append(parts, fmt.Sprintf("C=%s", country))
+	}
+	
+	for _, locality := range name.Locality {
+		parts = append(parts, fmt.Sprintf("L=%s", locality))
+	}
+	
+	for _, province := range name.Province {
+		parts = append(parts, fmt.Sprintf("ST=%s", province))
+	}
+	
+	return strings.Join(parts, ", ")
+}
+
+// extractIssuerOrganization extracts only the organization (O=) from the issuer distinguished name
+func (op *SSLOperation) extractIssuerOrganization(name pkix.Name) string {
+	// Return the first organization if available
+	if len(name.Organization) > 0 {
+		return name.Organization[0]
+	}
+	
+	// Fallback to Common Name if no organization
+	if name.CommonName != "" {
+		return name.CommonName
+	}
+	
+	// Last resort fallback
+	return "Unknown"
+}
+
+// extractSubjectOrganization extracts only the organization (O=) from the subject distinguished name
+func (op *SSLOperation) extractSubjectOrganization(name pkix.Name) string {
+	// Return the first organization if available
+	if len(name.Organization) > 0 {
+		return name.Organization[0]
+	}
+	
+	// Fallback to Common Name if no organization
+	if name.CommonName != "" {
+		return name.CommonName
+	}
+	
+	// Last resort fallback
+	return "Unknown"
+}
\ No newline at end of file
diff --git a/server/service-operation/operations/ssl_validator.go b/server/service-operation/operations/ssl_validator.go
new file mode 100644
index 0000000..602ea7f
--- /dev/null
+++ b/server/service-operation/operations/ssl_validator.go
@@ -0,0 +1,65 @@
+package operations
+
+import (
+	"crypto/x509"
+	"fmt"
+	"time"
+)
+
+// validateCertificate performs comprehensive certificate validation
+func (op *SSLOperation) validateCertificate(cert *x509.Certificate, hostname string) error {
+	now := time.Now()
+	
+	// Check if certificate is expired or not yet valid
+	if now.Before(cert.NotBefore) {
+		return fmt.Errorf("certificate is not yet valid (valid from: %v)", cert.NotBefore.Format("2006-01-02 15:04:05"))
+	}
+	if now.After(cert.NotAfter) {
+		return fmt.Errorf("certificate has expired (expired on: %v)", cert.NotAfter.Format("2006-01-02 15:04:05"))
+	}
+	
+	// Verify hostname matches certificate
+	if err := cert.VerifyHostname(hostname); err != nil {
+		return fmt.Errorf("hostname verification failed: %v", err)
+	}
+	
+	// Check key usage - certificates should have digital signature capability
+	if cert.KeyUsage&x509.KeyUsageDigitalSignature == 0 {
+		return fmt.Errorf("certificate missing required digital signature key usage")
+	}
+	
+	// Check if certificate is self-signed (basic check)
+	if cert.Issuer.CommonName == cert.Subject.CommonName && len(cert.Subject.Organization) == 0 {
+		return fmt.Errorf("certificate appears to be self-signed")
+	}
+	
+	// Validate certificate chain if intermediate certificates are present
+	if err := op.validateCertificateChain(cert); err != nil {
+		return fmt.Errorf("certificate chain validation failed: %v", err)
+	}
+	
+	return nil
+}
+
+// validateCertificateChain performs basic certificate chain validation
+func (op *SSLOperation) validateCertificateChain(cert *x509.Certificate) error {
+	// Check if the certificate has proper extensions for SSL/TLS
+	hasServerAuth := false
+	for _, usage := range cert.ExtKeyUsage {
+		if usage == x509.ExtKeyUsageServerAuth {
+			hasServerAuth = true
+			break
+		}
+	}
+	
+	if !hasServerAuth {
+		return fmt.Errorf("certificate does not have server authentication extension")
+	}
+	
+	// Check certificate version (should be v3 for modern certificates)
+	if cert.Version < 3 {
+		return fmt.Errorf("certificate version %d is outdated (should be v3)", cert.Version)
+	}
+	
+	return nil
+}
\ No newline at end of file
diff --git a/server/service-operation/operations/tcp.go b/server/service-operation/operations/tcp.go
new file mode 100644
index 0000000..1d0f4af
--- /dev/null
+++ b/server/service-operation/operations/tcp.go
@@ -0,0 +1,49 @@
+
+package operations
+
+import (
+	"fmt"
+	"net"
+	"time"
+
+	"service-operation/types"
+)
+
+type TCPOperation struct {
+	timeout time.Duration
+}
+
+func NewTCPOperation(timeout time.Duration) *TCPOperation {
+	return &TCPOperation{timeout: timeout}
+}
+
+func (t *TCPOperation) Execute(host string, port int) (*types.OperationResult, error) {
+	result := &types.OperationResult{
+		Type:      types.OperationTCP,
+		Host:      host,
+		Port:      port,
+		StartTime: time.Now(),
+	}
+
+	start := time.Now()
+	
+	address := fmt.Sprintf("%s:%d", host, port)
+	conn, err := net.DialTimeout("tcp", address, t.timeout)
+	
+	result.ResponseTime = time.Since(start)
+	result.EndTime = time.Now()
+
+	if err != nil {
+		result.Error = err.Error()
+		result.TCPConnected = false
+		result.Success = false
+		result.Details = fmt.Sprintf("Failed to connect to %s:%d - %s", host, port, err.Error())
+	} else {
+		conn.Close()
+		result.TCPConnected = true
+		result.Success = true
+		result.Details = fmt.Sprintf("Successfully connected to %s:%d", host, port)
+	}
+
+	return result, nil
+}
\ No newline at end of file
diff --git a/server/service-operation/ping/icmp.go b/server/service-operation/ping/icmp.go
new file mode 100644
index 0000000..3e6354d
--- /dev/null
+++ b/server/service-operation/ping/icmp.go
@@ -0,0 +1,117 @@
+
+package ping
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"time"
+
+	"golang.org/x/net/icmp"
+	"golang.org/x/net/ipv4"
+)
+
+type ICMPPinger struct {
+	timeout time.Duration
+}
+
+func NewICMPPinger(timeout time.Duration) *ICMPPinger {
+	return &ICMPPinger{timeout: timeout}
+}
+
+func (p *ICMPPinger) Ping(host string, count int) (*PingResult, error) {
+	dst, err := net.ResolveIPAddr("ip4", host)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve host %s: %v", host, err)
+	}
+
+	conn, err := icmp.ListenPacket("ip4:icmp", "0.0.0.0")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create ICMP connection: %v", err)
+	}
+	defer conn.Close()
+
+	result := &PingResult{
+		Host:        host,
+		PacketsSent: count,
+		StartTime:   time.Now(),
+	}
+
+	var totalRTT time.Duration
+	var minRTT, maxRTT time.Duration
+
+	for i := 0; i < count; i++ {
+		message := &icmp.Message{
+			Type: ipv4.ICMPTypeEcho,
+			Code: 0,
+			Body: &icmp.Echo{
+				ID:   os.Getpid() & 0xffff,
+				Seq:  i + 1,
+				Data: []byte("Hello, World!"),
+			},
+		}
+
+		data, err := message.Marshal(nil)
+		if err != nil {
+			continue
+		}
+
+		start := time.Now()
+		_, err = conn.WriteTo(data, dst)
+		if err != nil {
+			continue
+		}
+
+		err = conn.SetReadDeadline(time.Now().Add(p.timeout))
+		if err != nil {
+			continue
+		}
+
+		reply := make([]byte, 1500)
+		_, peer, err := conn.ReadFrom(reply)
+		if err != nil {
+			continue
+		}
+
+		rtt := time.Since(start)
+
+		// Parse the reply
+		rm, err := icmp.ParseMessage(ipv4.ICMPTypeEchoReply, reply)
+		if err != nil {
+			continue
+		}
+
+		switch rm.Type {
+		case ipv4.ICMPTypeEchoReply:
+			if peer.String() == dst.String() {
+				result.PacketsRecv++
+				totalRTT += rtt
+
+				if result.PacketsRecv == 1 || rtt < minRTT {
+					minRTT = rtt
+				}
+				if result.PacketsRecv == 1 || rtt > maxRTT {
+					maxRTT = rtt
+				}
+
+				result.RTTs = append(result.RTTs, rtt)
+			}
+		}
+
+		if i < count-1 {
+			time.Sleep(1 * time.Second)
+		}
+	}
+
+	result.EndTime = time.Now()
+	result.PacketLoss = float64(count-result.PacketsRecv) / float64(count) * 100
+
+	if result.PacketsRecv > 0 {
+		result.MinRTT = minRTT
+		result.MaxRTT = maxRTT
+		result.AvgRTT = totalRTT / time.Duration(result.PacketsRecv)
+		result.Success = true
+	}
+
+	return result, nil
+}
diff --git a/server/service-operation/ping/types.go b/server/service-operation/ping/types.go
new file mode 100644
index 0000000..e89be4e
--- /dev/null
+++ b/server/service-operation/ping/types.go
@@ -0,0 +1,25 @@
+
+package ping
+
+import "time"
+
+type PingResult struct {
+	Host        string          `json:"host"`
+	Success     bool            `json:"success"`
+	PacketsSent int             `json:"packets_sent"`
+	PacketsRecv int             `json:"packets_recv"`
+	PacketLoss  float64         `json:"packet_loss"`
+	MinRTT      time.Duration   `json:"min_rtt"`
+	MaxRTT      time.Duration   `json:"max_rtt"`
+	AvgRTT      time.Duration   `json:"avg_rtt"`
+	RTTs        []time.Duration `json:"rtts"`
+	StartTime   time.Time       `json:"start_time"`
+	EndTime     time.Time       `json:"end_time"`
+	Error       string          `json:"error,omitempty"`
+}
+
+type PingRequest struct {
+	Host    string `json:"host"`
+	Count   int    `json:"count,omitempty"`
+	Timeout int    `json:"timeout,omitempty"`
+}
diff --git a/server/service-operation/pocketbase/client.go b/server/service-operation/pocketbase/client.go
new file mode 100644
index 0000000..25bd76a
--- /dev/null
+++ b/server/service-operation/pocketbase/client.go
@@ -0,0 +1,52 @@
+
+package pocketbase
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+)
+
+type PocketBaseClient struct {
+	baseURL    string
+	httpClient *http.Client
+}
+
+func NewPocketBaseClient(baseURL string) (*PocketBaseClient, error) {
+	// Use provided baseURL or default to localhost
+	if baseURL == "" {
+		baseURL = "http://localhost:8090"
+	}
+	
+	client := &PocketBaseClient{
+		baseURL: baseURL,
+		httpClient: &http.Client{
+			Timeout: 30 * time.Second,
+		},
+	}
+	
+	return client, nil
+}
+
+func (c *PocketBaseClient) GetBaseURL() string {
+	return c.baseURL
+}
+
+func (c *PocketBaseClient) TestConnection() error {
+	resp, err := c.httpClient.Get(fmt.Sprintf("%s/api/health", c.baseURL))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("PocketBase health check failed with status: %d", resp.StatusCode)
+	}
+	
+	return nil
+}
+
+func (c *PocketBaseClient) IsAuthenticated() bool {
+	// Since we're using public access mode, always return true
+	return true
+}
\ No newline at end of file
diff --git a/server/service-operation/pocketbase/metrics.go b/server/service-operation/pocketbase/metrics.go
new file mode 100644
index 0000000..244274d
--- /dev/null
+++ b/server/service-operation/pocketbase/metrics.go
@@ -0,0 +1,22 @@
+
+package pocketbase
+
+func (c *PocketBaseClient) SaveMetrics(metrics MetricsRecord) error {
+	return c.createRecord("services_metrics", metrics)
+}
+
+func (c *PocketBaseClient) SavePingData(pingData PingDataRecord) error {
+	return c.createRecord("ping_data", pingData)
+}
+
+func (c *PocketBaseClient) SaveUptimeData(uptimeData UptimeDataRecord) error {
+	return c.createRecord("uptime_data", uptimeData)
+}
+
+func (c *PocketBaseClient) SaveDNSData(dnsData DNSDataRecord) error {
+	return c.createRecord("dns_data", dnsData)
+}
+
+func (c *PocketBaseClient) SaveTCPData(tcpData TCPDataRecord) error {
+	return c.createRecord("tcp_data", tcpData)
+}
\ No newline at end of file
diff --git a/server/service-operation/pocketbase/regional.go b/server/service-operation/pocketbase/regional.go
new file mode 100644
index 0000000..cfdadd0
--- /dev/null
+++ b/server/service-operation/pocketbase/regional.go
@@ -0,0 +1,117 @@
+
+package pocketbase
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+)
+
+func (c *PocketBaseClient) GetRegionalServices() ([]RegionalService, error) {
+	resp, err := c.httpClient.Get(fmt.Sprintf("%s/api/collections/regional_service/records", c.baseURL))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusForbidden {
+		// Collection might require authentication or doesn't exist
+		fmt.Printf("Warning: Cannot access regional_service collection (403). Regional monitoring will be disabled.\n")
+		return nil, fmt.Errorf("access denied to regional_service collection")
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to get regional services: status %d", resp.StatusCode)
+	}
+
+	var response RegionalServicesResponse
+	if err := c.parseResponse(resp, &response); err != nil {
+		return nil, err
+	}
+
+	return response.Items, nil
+}
+
+func (c *PocketBaseClient) GetDefaultRegionalService() (*RegionalService, error) {
+	services, err := c.GetRegionalServices()
+	if err != nil {
+		// Try to create a default regional service if we can't get existing ones
+		return c.CreateDefaultRegionalService()
+	}
+
+	// Look for a service with region_name "Default"
+	for _, service := range services {
+		if service.RegionName == "Default" {
+			return &service, nil
+		}
+	}
+
+	// If no default service found, try to create one
+	return c.CreateDefaultRegionalService()
+}
+
+func (c *PocketBaseClient) CreateDefaultRegionalService() (*RegionalService, error) {
+	defaultService := map[string]interface{}{
+		"region_name":       "Default",
+		"status":           "active",
+		"agent_id":         "1",
+		"agent_ip_address": "127.0.0.1",
+		"connection":       "offline",
+		"token":            fmt.Sprintf("default-%d", time.Now().Unix()),
+	}
+
+	err := c.createRecord("regional_service", defaultService)
+	if err != nil {
+		fmt.Printf("Warning: Could not create default regional service: %v\n", err)
+		// Return a fallback service for local operations
+		return &RegionalService{
+			ID:              "default",
+			RegionName:      "Default",
+			Status:          "active",
+			AgentID:         "1",
+			AgentIPAddress:  "127.0.0.1",
+			Connection:      "offline",
+			Token:           "default-token",
+		}, nil
+	}
+
+	// Try to fetch the created service
+	services, err := c.GetRegionalServices()
+	if err == nil {
+		for _, service := range services {
+			if service.RegionName == "Default" {
+				return &service, nil
+			}
+		}
+	}
+
+	// Return fallback if still can't get the created service
+	return &RegionalService{
+		ID:              "default",
+		RegionName:      "Default",
+		Status:          "active",
+		AgentID:         "1",
+		AgentIPAddress:  "127.0.0.1",
+		Connection:      "offline",
+		Token:           "default-token",
+	}, nil
+}
+
+func (c *PocketBaseClient) UpdateRegionalServiceConnection(serviceID, connection string) error {
+	// Determine status based on connection
+	status := "inactive"
+	if connection == "online" {
+		status = "active"
+	}
+
+	data := map[string]interface{}{
+		"connection": connection,
+		"status":     status,
+	}
+
+	return c.updateRecord("regional_service", serviceID, data)
+}
+
+func (c *PocketBaseClient) SaveSSLData(sslData SSLDataRecord) error {
+	return c.createRecord("ssl_data", sslData)
+}
\ No newline at end of file
diff --git a/server/service-operation/pocketbase/services.go b/server/service-operation/pocketbase/services.go
new file mode 100644
index 0000000..11ef4db
--- /dev/null
+++ b/server/service-operation/pocketbase/services.go
@@ -0,0 +1,155 @@
+
+package pocketbase
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+)
+
+func (c *PocketBaseClient) GetServices() ([]Service, error) {
+	req, err := http.NewRequest("GET", 
+		fmt.Sprintf("%s/api/collections/services/records", c.baseURL), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// No authentication header needed for public access
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to fetch services, status: %d", resp.StatusCode)
+	}
+
+	var servicesResponse ServicesResponse
+	if err := json.NewDecoder(resp.Body).Decode(&servicesResponse); err != nil {
+		return nil, err
+	}
+
+	return servicesResponse.Items, nil
+}
+
+func (c *PocketBaseClient) GetService(serviceID string) (*Service, error) {
+	req, err := http.NewRequest("GET", 
+		fmt.Sprintf("%s/api/collections/services/records/%s", c.baseURL, serviceID), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	// No authentication header needed for public access
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to fetch service %s, status: %d", serviceID, resp.StatusCode)
+	}
+
+	var service Service
+	if err := json.NewDecoder(resp.Body).Decode(&service); err != nil {
+		return nil, err
+	}
+
+	return &service, nil
+}
+
+func (c *PocketBaseClient) GetActiveServices() ([]Service, error) {
+	var allServices []Service
+	page := 1
+	perPage := 30 // Use default pagination size
+
+	for {
+		// Fetch services page by page with filter for non-paused services
+		req, err := http.NewRequest("GET", 
+			fmt.Sprintf("%s/api/collections/services/records?page=%d&perPage=%d&filter=(status!='paused')", 
+				c.baseURL, page, perPage), nil)
+		if err != nil {
+			return nil, err
+		}
+
+		// No authentication header needed for public access
+		resp, err := c.httpClient.Do(req)
+		if err != nil {
+			return nil, err
+		}
+		defer resp.Body.Close()
+
+		if resp.StatusCode != http.StatusOK {
+			return nil, fmt.Errorf("failed to fetch active services, status: %d", resp.StatusCode)
+		}
+
+		var servicesResponse ServicesResponse
+		if err := json.NewDecoder(resp.Body).Decode(&servicesResponse); err != nil {
+			return nil, err
+		}
+
+		// Add current page items to the result
+		allServices = append(allServices, servicesResponse.Items...)
+
+		// Check if we've fetched all pages
+		if page >= servicesResponse.TotalPages || len(servicesResponse.Items) == 0 {
+			break
+		}
+
+		page++
+	}
+
+	return allServices, nil
+}
+
+func (c *PocketBaseClient) UpdateServiceStatus(serviceID string, status string, responseTime int64, errorMessage string) error {
+	// First check if the service is paused before updating
+	service, err := c.GetService(serviceID)
+	if err != nil {
+		return fmt.Errorf("failed to check service status before update: %v", err)
+	}
+	
+	if service.Status == "paused" {
+		return fmt.Errorf("service %s is paused, skipping status update", serviceID)
+	}
+
+	updateData := map[string]interface{}{
+		"status":        status,
+		"response_time": responseTime,
+		"last_checked":  time.Now().Format(time.RFC3339),
+	}
+
+	if errorMessage != "" {
+		updateData["error_message"] = errorMessage
+	}
+
+	jsonData, err := json.Marshal(updateData)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequest("PATCH", 
+		fmt.Sprintf("%s/api/collections/services/records/%s", c.baseURL, serviceID),
+		bytes.NewBuffer(jsonData))
+	if err != nil {
+		return err
+	}
+
+	// No authentication header needed
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
+		return fmt.Errorf("failed to update service status, status: %d", resp.StatusCode)
+	}
+
+	return nil
+}
\ No newline at end of file
diff --git a/server/service-operation/pocketbase/ssl.go b/server/service-operation/pocketbase/ssl.go
new file mode 100644
index 0000000..6e39bfd
--- /dev/null
+++ b/server/service-operation/pocketbase/ssl.go
@@ -0,0 +1,104 @@
+package pocketbase
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"service-operation/types"
+)
+
+type SSLCertificatesResponse struct {
+	Page       int                      `json:"page"`
+	PerPage    int                      `json:"perPage"`
+	TotalItems int                      `json:"totalItems"`
+	TotalPages int                      `json:"totalPages"`
+	Items      []types.SSLCertificate   `json:"items"`
+}
+
+func (c *PocketBaseClient) GetSSLCertificates() ([]types.SSLCertificate, error) {
+	var allCertificates []types.SSLCertificate
+	page := 1
+	perPage := 200 // You can increase up to 500 if needed
+
+	for {
+		url := fmt.Sprintf(
+			"%s/api/collections/ssl_certificates/records?page=%d&perPage=%d",
+			c.baseURL, page, perPage,
+		)
+
+		resp, err := c.httpClient.Get(url)
+		if err != nil {
+			return nil, fmt.Errorf("failed to fetch SSL certificates: %v", err)
+		}
+		defer resp.Body.Close()
+
+		if resp.StatusCode != http.StatusOK {
+			return nil, fmt.Errorf("PocketBase returned status %d", resp.StatusCode)
+		}
+
+		var response SSLCertificatesResponse
+		if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
+			return nil, fmt.Errorf("failed to decode SSL certificates response: %v", err)
+		}
+
+		allCertificates = append(allCertificates, response.Items...)
+
+		if page >= response.TotalPages || len(response.Items) == 0 {
+			break
+		}
+		page++
+	}
+
+	return allCertificates, nil
+}
+
+func (c *PocketBaseClient) UpdateSSLCertificate(id string, data map[string]interface{}) error {
+	url := fmt.Sprintf("%s/api/collections/ssl_certificates/records/%s", c.baseURL, id)
+
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return fmt.Errorf("failed to marshal SSL certificate data: %v", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPatch, url, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return fmt.Errorf("failed to create SSL certificate update request: %v", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to update SSL certificate: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to update SSL certificate, status: %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+func (c *PocketBaseClient) GetSSLCertificateByID(id string) (*types.SSLCertificate, error) {
+	url := fmt.Sprintf("%s/api/collections/ssl_certificates/records/%s", c.baseURL, id)
+
+	resp, err := c.httpClient.Get(url)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch SSL certificate: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("PocketBase returned status %d", resp.StatusCode)
+	}
+
+	var cert types.SSLCertificate
+	if err := json.NewDecoder(resp.Body).Decode(&cert); err != nil {
+		return nil, fmt.Errorf("failed to decode SSL certificate response: %v", err)
+	}
+
+	return &cert, nil
+}
diff --git a/server/service-operation/pocketbase/types.go b/server/service-operation/pocketbase/types.go
new file mode 100644
index 0000000..77f1efd
--- /dev/null
+++ b/server/service-operation/pocketbase/types.go
@@ -0,0 +1,169 @@
+package pocketbase
+
+import "time"
+
+type AuthResponse struct {
+	Token  string      `json:"token"`
+	Record interface{} `json:"record"`
+}
+
+type MetricsRecord struct {
+	ServiceName       string `json:"service_name"`
+	Host              string `json:"host"`
+	Uptime            float64 `json:"uptime"`
+	ResponseTime      int64   `json:"response_time"`
+	LastChecked       string  `json:"last_checked"`
+	Port              int     `json:"port,omitempty"`
+	Domain            string  `json:"domain,omitempty"`
+	HeartbeatInterval int     `json:"heartbeat_interval,omitempty"`
+	MaxRetries        int     `json:"max_retries,omitempty"`
+	NotificationID    string  `json:"notification_id,omitempty"`
+	TemplateID        string  `json:"template_id,omitempty"`
+	ServiceType       string  `json:"service_type"`
+	Status            string  `json:"status"`
+	URL               string  `json:"url,omitempty"`
+	Alerts            string  `json:"alerts,omitempty"`
+	StatusCodes       string  `json:"status_codes,omitempty"`
+	Keyword           string  `json:"keyword,omitempty"`
+	ErrorMessage      string  `json:"error_message,omitempty"`
+	Details           string  `json:"details,omitempty"`
+	CheckedAt         string  `json:"checked_at"`
+}
+
+type PingDataRecord struct {
+	ServiceID     string    `json:"service_id"`
+	Timestamp     time.Time `json:"timestamp"`
+	ResponseTime  int64     `json:"response_time"`
+	Status        string    `json:"status"`
+	PacketLoss    string    `json:"packet_loss"`
+	Latency       string    `json:"latency"`
+	MaxRTT        string    `json:"max_rtt"`
+	MinRTT        string    `json:"min_rtt"`
+	PacketsSent   string    `json:"packets_sent"`
+	PacketsRecv   string    `json:"packets_recv"`
+	AvgRTT        string    `json:"avg_rtt"`
+	RTTs          string    `json:"rtts"`
+	Details       string    `json:"details,omitempty"`
+	ErrorMessage  string    `json:"error_message,omitempty"`
+	RegionName    string    `json:"region_name,omitempty"`
+	AgentID       string    `json:"agent_id,omitempty"`
+}
+
+type UptimeDataRecord struct {
+	ServiceID     string    `json:"service_id"`
+	Timestamp     time.Time `json:"timestamp"`
+	ResponseTime  int64     `json:"response_time"`
+	Status        string    `json:"status"`
+	Packets       string    `json:"packets"`
+	Latency       string    `json:"latency"`
+	StatusCodes   string    `json:"status_codes"`
+	Keyword       string    `json:"keyword"`
+	ErrorMessage  string    `json:"error_message"`
+	Details       string    `json:"details"`
+	Region        string    `json:"region,omitempty"`
+	RegionID      string    `json:"region_id,omitempty"`
+	RegionName    string    `json:"region_name,omitempty"`
+	AgentID       string    `json:"agent_id,omitempty"`
+}
+
+type DNSDataRecord struct {
+	ServiceID    string    `json:"service_id"`
+	Timestamp    time.Time `json:"timestamp"`
+	ResponseTime int64     `json:"response_time"`
+	Status       string    `json:"status"`
+	QueryType    string    `json:"query_type"`
+	ResolveIP    string    `json:"resolve_ip"`
+	MsgSize      string    `json:"msg_size"`
+	Question     string    `json:"question"`
+	Answer       string    `json:"answer"`
+	Authority    string    `json:"authority"`
+	ErrorMessage string    `json:"error_message,omitempty"`
+	Details      string    `json:"details,omitempty"`
+	RegionName   string    `json:"region_name,omitempty"`
+	AgentID      string    `json:"agent_id,omitempty"`
+}
+
+type TCPDataRecord struct {
+	ServiceID    string    `json:"service_id"`
+	Timestamp    time.Time `json:"timestamp"`
+	ResponseTime int64     `json:"response_time"`
+	Status       string    `json:"status"`
+	Connection   string    `json:"connection"`
+	Latency      string    `json:"latency"`
+	Port         string    `json:"port"`
+	ErrorMessage string    `json:"error_message,omitempty"`
+	Details      string    `json:"details,omitempty"`
+	RegionName   string    `json:"region_name,omitempty"`
+	AgentID      string    `json:"agent_id,omitempty"`
+}
+
+// SSL Data Record remains unchanged - no regional agent fields
+type SSLDataRecord struct {
+	ServiceID     string    `json:"service_id"`
+	Timestamp     time.Time `json:"timestamp"`
+	ResponseTime  int64     `json:"response_time"`
+	Status        string    `json:"status"`
+	ValidFrom     string    `json:"valid_from"`
+	ValidTill     string    `json:"valid_till"`
+	DaysLeft      int       `json:"days_left"`
+	Issuer        string    `json:"issuer"`
+	Subject       string    `json:"subject"`
+	SerialNumber  string    `json:"serial_number"`
+	Algorithm     string    `json:"algorithm"`
+	SANs          string    `json:"sans"`
+	ResolvedIP    string    `json:"resolved_ip"`
+	ErrorMessage  string    `json:"error_message,omitempty"`
+	Details       string    `json:"details,omitempty"`
+}
+
+// Regional Service record structure
+type RegionalService struct {
+	ID               string `json:"id"`
+	RegionName       string `json:"region_name"`
+	Status           string `json:"status"`
+	AgentID          string `json:"agent_id"`
+	AgentIPAddress   string `json:"agent_ip_address"`
+	Connection       string `json:"connection"`
+	Token            string `json:"token"`
+	Created          string `json:"created"`
+	Updated          string `json:"updated"`
+}
+
+type RegionalServicesResponse struct {
+	Page       int               `json:"page"`
+	PerPage    int               `json:"perPage"`
+	TotalItems int               `json:"totalItems"`
+	TotalPages int               `json:"totalPages"`
+	Items      []RegionalService `json:"items"`
+}
+
+type Service struct {
+	ID                 string    `json:"id"`
+	Name               string    `json:"name"`
+	Host               string    `json:"host"`
+	Uptime             float64   `json:"uptime"`
+	ResponseTime       int64     `json:"response_time"`
+	LastChecked        string    `json:"last_checked"`
+	Port               int       `json:"port"`
+	Domain             string    `json:"domain"`
+	HeartbeatInterval  int       `json:"heartbeat_interval"`
+	MaxRetries         int       `json:"max_retries"`
+	NotificationID     string    `json:"notification_id"`
+	TemplateID         string    `json:"template_id"`
+	ServiceType        string    `json:"service_type"`
+	Status             string    `json:"status"`
+	URL                string    `json:"url"`
+	Alerts             string    `json:"alerts"`
+	StatusCodes        string    `json:"status_codes"`
+	Keyword            string    `json:"keyword"`
+	Created            string    `json:"created"`
+	Updated            string    `json:"updated"`
+}
+
+type ServicesResponse struct {
+	Page       int       `json:"page"`
+	PerPage    int       `json:"perPage"`
+	TotalItems int       `json:"totalItems"`
+	TotalPages int       `json:"totalPages"`
+	Items      []Service `json:"items"`
+}
\ No newline at end of file
diff --git a/server/service-operation/pocketbase/utils.go b/server/service-operation/pocketbase/utils.go
new file mode 100644
index 0000000..d55e2af
--- /dev/null
+++ b/server/service-operation/pocketbase/utils.go
@@ -0,0 +1,124 @@
+
+package pocketbase
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+)
+
+func (c *PocketBaseClient) parseResponse(resp *http.Response, target interface{}) error {
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+
+	return json.Unmarshal(body, target)
+}
+
+func (c *PocketBaseClient) createRecord(collection string, data interface{}) error {
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequest("POST", 
+		fmt.Sprintf("%s/api/collections/%s/records", c.baseURL, collection),
+		bytes.NewBuffer(jsonData))
+	if err != nil {
+		return err
+	}
+
+	// No authentication header needed
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		// Read response body for better error details
+		bodyBytes, _ := io.ReadAll(resp.Body)
+		bodyString := string(bodyBytes)
+		
+		fmt.Printf("Failed to create record in %s collection. Status: %d, Response: %s\n", 
+			collection, resp.StatusCode, bodyString)
+		
+		return fmt.Errorf("failed to create record in %s, status: %d, response: %s", 
+			collection, resp.StatusCode, bodyString)
+	}
+
+	return nil
+}
+
+func (c *PocketBaseClient) updateRecord(collection string, recordID string, data interface{}) error {
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequest("PATCH", 
+		fmt.Sprintf("%s/api/collections/%s/records/%s", c.baseURL, collection, recordID),
+		bytes.NewBuffer(jsonData))
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		bodyBytes, _ := io.ReadAll(resp.Body)
+		bodyString := string(bodyBytes)
+		
+		fmt.Printf("Failed to update record in %s collection. Status: %d, Response: %s\n", 
+			collection, resp.StatusCode, bodyString)
+		
+		return fmt.Errorf("failed to update record in %s, status: %d, response: %s", 
+			collection, resp.StatusCode, bodyString)
+	}
+
+	return nil
+}
+
+// UpdateRecord is the public method for server monitoring that preserves other fields
+func (c *PocketBaseClient) UpdateRecord(collection string, id string, data map[string]interface{}) error {
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequest("PATCH",
+		fmt.Sprintf("%s/api/collections/%s/records/%s", c.baseURL, collection, id),
+		bytes.NewBuffer(jsonData))
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to update record, status: %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+func (c *PocketBaseClient) GetHTTPClient() *http.Client {
+	return c.httpClient
+}
\ No newline at end of file
diff --git a/server/service-operation/server-monitoring/debug.go b/server/service-operation/server-monitoring/debug.go
new file mode 100644
index 0000000..c7a2e93
--- /dev/null
+++ b/server/service-operation/server-monitoring/debug.go
@@ -0,0 +1,16 @@
+
+package servermonitoring
+
+import (
+	"time"
+)
+
+// LogServerUpdateAttempt logs when we attempt to update a server record
+func LogServerUpdateAttempt(serverID, operation, details string) {
+	// log.Printf("🔄 [UPDATE ATTEMPT] Server: %s | Operation: %s | Details: %s | Time: %s", 
+	//	serverID, operation, details, time.Now().Format("2006-01-02 15:04:05"))
+	_ = serverID
+	_ = operation
+	_ = details
+	_ = time.Now()
+}
\ No newline at end of file
diff --git a/server/service-operation/server-monitoring/debug_helper.go b/server/service-operation/server-monitoring/debug_helper.go
new file mode 100644
index 0000000..6f988ce
--- /dev/null
+++ b/server/service-operation/server-monitoring/debug_helper.go
@@ -0,0 +1,46 @@
+
+package servermonitoring
+
+// DebugServerFields helps debug server field preservation issues
+func (c *ServerPocketBaseClient) DebugServerFields(serverID string, operation string) {
+	// log.Printf("🔍 === DEBUG: %s for server %s ===", operation, serverID)
+	
+	servers, err := c.GetAllServers()
+	if err != nil {
+		// log.Printf("❌ Debug failed to fetch servers: %v", err)
+		_ = err
+		return
+	}
+	
+	for _, server := range servers {
+		if server.ID == serverID || server.ServerID == serverID {
+			// log.Printf("📊 Server Debug Info:")
+			// log.Printf("  - Server ID: %s", server.ID)
+			// log.Printf("  - Server Name: %s", server.Name)
+			// log.Printf("  - Status: %s", server.Status)
+			// log.Printf("  - Notification ID: '%s'", server.NotificationID)
+			// log.Printf("  - Template ID: '%s'", server.TemplateID)
+			// log.Printf("  - Threshold ID: '%s'", server.ThresholdID)
+			// log.Printf("  - Agent Status: %s", server.AgentStatus)
+			// log.Printf("  - Check Interval: %d", server.CheckInterval)
+			
+			// Check for empty strings vs nil
+			if server.NotificationID == "" {
+				// log.Printf("⚠️  WARNING: Notification ID is empty string")
+			}
+			if server.TemplateID == "" {
+				// log.Printf("⚠️  WARNING: Template ID is empty string")
+			}
+			if server.ThresholdID == "" {
+				// log.Printf("⚠️  WARNING: Threshold ID is empty string")
+			}
+			
+			_ = server
+			break
+		}
+	}
+	
+	// log.Printf("🔍 === END DEBUG: %s ===", operation)
+	_ = operation
+	_ = serverID
+}
\ No newline at end of file
diff --git a/server/service-operation/server-monitoring/integration.go b/server/service-operation/server-monitoring/integration.go
new file mode 100644
index 0000000..61c73f3
--- /dev/null
+++ b/server/service-operation/server-monitoring/integration.go
@@ -0,0 +1,40 @@
+
+package servermonitoring
+
+import (
+	"service-operation/pocketbase"
+)
+
+// ServerMonitoringService provides an easy interface for server monitoring
+type ServerMonitoringService struct {
+	monitor *ServerMonitor
+}
+
+// NewServerMonitoringService creates a new server monitoring service
+func NewServerMonitoringService(pbClient *pocketbase.PocketBaseClient) *ServerMonitoringService {
+	return &ServerMonitoringService{
+		monitor: NewServerMonitor(pbClient),
+	}
+}
+
+// Start starts the server monitoring service
+func (sms *ServerMonitoringService) Start() {
+	sms.monitor.Start()
+}
+
+// Stop stops the server monitoring service
+func (sms *ServerMonitoringService) Stop() {
+	sms.monitor.Stop()
+}
+
+// GetMonitor returns the underlying monitor for advanced usage
+func (sms *ServerMonitoringService) GetMonitor() *ServerMonitor {
+	return sms.monitor
+}
+
+// IsRunning returns whether the monitoring service is currently running
+func (sms *ServerMonitoringService) IsRunning() bool {
+	sms.monitor.mu.RLock()
+	defer sms.monitor.mu.RUnlock()
+	return sms.monitor.isRunning
+}
\ No newline at end of file
diff --git a/server/service-operation/server-monitoring/monitor.go b/server/service-operation/server-monitoring/monitor.go
new file mode 100644
index 0000000..f384253
--- /dev/null
+++ b/server/service-operation/server-monitoring/monitor.go
@@ -0,0 +1,462 @@
+
+package servermonitoring
+
+import (
+	"fmt"
+	"strconv"
+	"sync"
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+// StatusAlert tracks alert state for server status changes
+type StatusAlert struct {
+	IsActive     bool
+	Status       string
+	LastAlerted  time.Time
+	RetryCount   int
+}
+
+// ServerMonitor tracks server metrics and sends notifications
+type ServerMonitor struct {
+	pbClient            *ServerPocketBaseClient
+	notificationService *ServerNotificationService
+	thresholdMonitor    *ThresholdMonitor
+	lastStatuses        map[string]string // Track last known status for each server
+	activeStatusAlerts  map[string]*StatusAlert // Track status alerts with retry counts
+	mu                  sync.RWMutex
+	stopChan            chan bool
+	isRunning           bool
+}
+
+// NewServerMonitor creates a new server monitor
+func NewServerMonitor(pbClient *pocketbase.PocketBaseClient) *ServerMonitor {
+	// log.Println("🔧 Creating new ServerMonitor instance")
+	
+	serverPBClient := NewServerPocketBaseClient(pbClient)
+	notificationService := NewServerNotificationService(pbClient)
+	thresholdMonitor := NewThresholdMonitor(serverPBClient, notificationService)
+	
+	return &ServerMonitor{
+		pbClient:            serverPBClient,
+		notificationService: notificationService,
+		thresholdMonitor:    thresholdMonitor,
+		lastStatuses:        make(map[string]string),
+		activeStatusAlerts:  make(map[string]*StatusAlert),
+		stopChan:            make(chan bool),
+		isRunning:           false,
+	}
+}
+
+// Start begins monitoring servers
+func (sm *ServerMonitor) Start() {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+
+	if sm.isRunning {
+		// log.Println("⚠️  Server monitor is already running")
+		return
+	}
+
+	sm.isRunning = true
+	// log.Println("🚀 Starting server monitoring service...")
+
+	go sm.monitoringLoop()
+}
+
+// Stop stops monitoring servers
+func (sm *ServerMonitor) Stop() {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+
+	if !sm.isRunning {
+		// log.Println("⚠️  Server monitor is not running")
+		return
+	}
+
+	// log.Println("🛑 Stopping server monitoring service...")
+	sm.isRunning = false
+	sm.stopChan <- true
+}
+
+// monitoringLoop runs the main monitoring loop
+func (sm *ServerMonitor) monitoringLoop() {
+	// log.Println("🔄 Starting monitoring loop with 30-second intervals")
+	ticker := time.NewTicker(30 * time.Second) // Check every 30 seconds for more responsive monitoring
+	defer ticker.Stop()
+
+	// Initial check
+	// log.Println("🔍 Performing initial server check...")
+	sm.checkAllServers()
+
+	for {
+		select {
+		case <-ticker.C:
+			// log.Println("⏰ Timer triggered - checking all servers")
+			sm.checkAllServers()
+		case <-sm.stopChan:
+			// log.Println("🛑 Stop signal received - exiting monitoring loop")
+			return
+		}
+	}
+}
+
+// checkAllServers checks all servers for missing metrics
+func (sm *ServerMonitor) checkAllServers() {
+	// log.Println("📋 Fetching all servers from database...")
+	
+	servers, err := sm.pbClient.GetAllServers()
+	if err != nil {
+		// log.Printf("❌ CRITICAL ERROR: Failed to fetch servers: %v", err)
+		_ = err
+		return
+	}
+
+	// log.Printf("✅ Successfully fetched %d servers", len(servers))
+
+	if len(servers) == 0 {
+		// log.Println("⚠️  No servers found in database")
+		return
+	}
+
+	for i, server := range servers {
+		// log.Printf("🔍 [%d/%d] Processing server: %s (ID: %s)", i+1, len(servers), server.Name, server.ServerID)
+		sm.checkServerMetrics(server)
+		// log.Printf("✅ [%d/%d] Completed processing server: %s", i+1, len(servers), server.Name)
+		_ = i
+	}
+	
+	// log.Println("📋 Completed checking all servers")
+}
+
+// checkServerMetrics checks if a server has recent metrics and agent status
+func (sm *ServerMonitor) checkServerMetrics(server Server) {
+	// log.Printf("🔍 === DETAILED SERVER CHECK FOR: %s ===", server.Name)
+	
+	// Debug server fields BEFORE any operations
+	sm.pbClient.DebugServerFields(server.ID, "BEFORE_CHECK")
+	
+	// log.Printf("📊 Server Details:")
+	// log.Printf("  - ID: %s", server.ID)
+	// log.Printf("  - Server ID: %s", server.ServerID)
+	// log.Printf("  - Name: %s", server.Name)
+	// log.Printf("  - Current Status: %s", server.Status)
+	// log.Printf("  - Agent Status: %s", server.AgentStatus)
+	// log.Printf("  - Check Interval: %d minutes", server.CheckInterval)
+	// log.Printf("  - Notification ID: '%s'", server.NotificationID)
+	// log.Printf("  - Template ID: '%s'", server.TemplateID)
+	// log.Printf("  - Threshold ID: '%s'", server.ThresholdID)
+	// log.Printf("  - IP Address: %s", server.IPAddress)
+	// log.Printf("  - OS Type: %s", server.OSType)
+	// log.Printf("  - Max Retries: %s", server.MaxRetries)
+
+	// Track the notification configuration BEFORE any updates
+	beforeNotificationID := server.NotificationID
+	beforeTemplateID := server.TemplateID
+	_ = beforeNotificationID
+	_ = beforeTemplateID
+
+	// Skip paused servers
+	if server.Status == "paused" {
+		// log.Printf("⏸️  Server %s is paused - skipping monitoring", server.Name)
+		return
+	}
+
+	sm.mu.Lock()
+	lastStatus := sm.lastStatuses[server.ServerID]
+	sm.mu.Unlock()
+	
+	// log.Printf("📈 Status Tracking:")
+	// log.Printf("  - Last Known Status: '%s'", lastStatus)
+	// log.Printf("  - Current Database Status: '%s'", server.Status)
+
+	currentStatus := "up"
+	var message string
+	var statusReason string
+
+	// Check agent status first - if agent is stopped, server is definitely down
+	if server.AgentStatus == "stopped" {
+		currentStatus = "down"
+		statusReason = "agent is stopped"
+		message = fmt.Sprintf("🔴 Server %s is DOWN - Agent has stopped running", server.Name)
+		// log.Printf("❌ SERVER DOWN DETECTED: %s - Agent is stopped", server.Name)
+	} else if server.AgentStatus == "running" {
+		// log.Printf("✅ Agent is running for server %s - checking metrics...", server.Name)
+		
+		// If agent is running, check metrics
+		checkIntervalMinutes := time.Duration(server.CheckInterval) * time.Minute
+		gracePeriod := 30 * time.Second
+		metricsTimeout := checkIntervalMinutes + gracePeriod
+
+		// Minimum timeout of 2 minutes to avoid false positives
+		if metricsTimeout < 2*time.Minute {
+			metricsTimeout = 2 * time.Minute
+		}
+
+		// log.Printf("🕐 Metrics Check Configuration:")
+		// log.Printf("  - Check Interval: %v", checkIntervalMinutes)
+		// log.Printf("  - Grace Period: %v", gracePeriod)
+		// log.Printf("  - Total Timeout: %v", metricsTimeout)
+
+		// Get recent metrics for this server
+		// log.Printf("🔍 Fetching recent metrics for server %s...", server.Name)
+		metrics, err := sm.pbClient.GetLatestServerMetrics(server.ServerID, metricsTimeout)
+		if err != nil {
+			// log.Printf("❌ ERROR: Failed to fetch metrics for server %s: %v", server.Name, err)
+			_ = err
+			return
+		}
+
+		// log.Printf("📊 Metrics Query Results:")
+		// log.Printf("  - Found %d metrics within timeout period", len(metrics))
+		
+		if len(metrics) == 0 {
+			// No recent metrics found - server is down
+			currentStatus = "down"
+			statusReason = fmt.Sprintf("no metrics received in last %v", metricsTimeout)
+			message = fmt.Sprintf("🔴 Server %s is DOWN - No metrics received in the last %v (check interval: %d minutes)", 
+				server.Name, metricsTimeout, server.CheckInterval)
+			// log.Printf("❌ SERVER DOWN DETECTED: %s - No recent metrics", server.Name)
+		} else {
+			// Recent metrics found - server is up
+			currentStatus = "up"
+			latestMetric := metrics[0]
+			age := time.Since(latestMetric.CreatedTime)
+			statusReason = fmt.Sprintf("metrics received %v ago", age.Round(time.Second))
+			message = fmt.Sprintf("✅ Server %s is operational - Latest metrics received %v ago (check interval: %d minutes)", 
+				server.Name, age.Round(time.Second), server.CheckInterval)
+			// log.Printf("✅ SERVER UP: %s - Latest metric %v ago", server.Name, age.Round(time.Second))
+			
+			// log.Printf("📊 Latest Metric Details:")
+			// log.Printf("  - Metric ID: %s", latestMetric.ID)
+			// log.Printf("  - Created: %v", latestMetric.CreatedTime)
+			// log.Printf("  - Age: %v", age.Round(time.Second))
+			// log.Printf("  - Status: %s", latestMetric.Status)
+
+			// Check thresholds if server is up and has metrics
+			// log.Printf("🎯 Checking thresholds for server %s...", server.Name)
+			sm.thresholdMonitor.CheckServerThresholds(server, metrics)
+		}
+	} else {
+		// log.Printf("⚠️  Unknown agent status '%s' for server %s", server.AgentStatus, server.Name)
+		currentStatus = "up" // Default to up for unknown status
+		statusReason = fmt.Sprintf("unknown agent status: %s", server.AgentStatus)
+		message = fmt.Sprintf("⚠️  Server %s has unknown agent status: %s", server.Name, server.AgentStatus)
+	}
+
+	// log.Printf("📊 Status Determination:")
+	// log.Printf("  - Determined Status: %s", currentStatus)
+	// log.Printf("  - Reason: %s", statusReason)
+	// log.Printf("  - Message: %s", message)
+
+	// Check if status has changed
+	statusChanged := lastStatus != currentStatus && lastStatus != ""
+	isFirstCheck := lastStatus == ""
+	_ = statusChanged
+	_ = isFirstCheck
+
+	// log.Printf("🔄 Status Change Analysis:")
+	// log.Printf("  - Status Changed: %t", statusChanged)
+	// log.Printf("  - First Check: %t", isFirstCheck)
+	// log.Printf("  - Previous Status: '%s'", lastStatus)
+	// log.Printf("  - New Status: '%s'", currentStatus)
+
+	// Update last known status
+	sm.mu.Lock()
+	sm.lastStatuses[server.ServerID] = currentStatus
+	sm.mu.Unlock()
+
+	// Update server status in database if it changed
+	if server.Status != currentStatus {
+		// log.Printf("💾 === DATABASE UPDATE FOR: %s ===", server.Name)
+		// log.Printf("  - BEFORE UPDATE:")
+		// log.Printf("    * Status: %s → %s", server.Status, currentStatus)
+		// log.Printf("    * Notification ID: '%s'", beforeNotificationID)
+		// log.Printf("    * Template ID: '%s'", beforeTemplateID)
+		
+		// Log the update attempt
+		LogServerUpdateAttempt(server.ID, "UpdateServerStatus", fmt.Sprintf("Status change from %s to %s", server.Status, currentStatus))
+		
+		// Debug fields before update
+		sm.pbClient.DebugServerFields(server.ID, "BEFORE_UPDATE")
+		
+		if err := sm.pbClient.UpdateServerStatus(server.ID, currentStatus); err != nil {
+			// log.Printf("❌ CRITICAL ERROR: Failed to update server status for %s: %v", server.Name, err)
+			_ = err
+		} else {
+			// log.Printf("✅ Successfully updated database status for server %s", server.Name)
+			
+			// Debug fields after update
+			sm.pbClient.DebugServerFields(server.ID, "AFTER_UPDATE")
+		}
+	} else {
+		// log.Printf("ℹ️  Database status already matches current status (%s) for server %s", currentStatus, server.Name)
+	}
+
+	// Handle status notifications with retry logic
+	sm.handleStatusNotifications(server, currentStatus, message, statusChanged, isFirstCheck)
+
+	// Final status summary
+	// log.Printf("📊 === FINAL STATUS SUMMARY FOR: %s ===", server.Name)
+	// log.Printf("  - Final Status: %s (%s)", currentStatus, statusReason)
+	// log.Printf("  - Database Updated: %t", server.Status != currentStatus)
+	// log.Printf("  - Notification Config Preserved: ID='%s', Template='%s'", server.NotificationID, server.TemplateID)
+	
+	// Final debug after all operations
+	sm.pbClient.DebugServerFields(server.ID, "FINAL_CHECK")
+	
+	// log.Printf("=== END SERVER CHECK FOR: %s ===\n", server.Name)
+	_ = statusReason
+}
+
+// handleStatusNotifications handles sending notifications based on status changes and retry logic
+func (sm *ServerMonitor) handleStatusNotifications(server Server, currentStatus, message string, statusChanged, isFirstCheck bool) {
+	// log.Printf("📱 === NOTIFICATION ANALYSIS FOR: %s ===", server.Name)
+	// log.Printf("🔧 Notification Configuration:")
+	// log.Printf("  - Notification ID: '%s'", server.NotificationID)
+	// log.Printf("  - Template ID: '%s'", server.TemplateID)
+	// log.Printf("  - Has Notification Config: %t", server.NotificationID != "")
+	// log.Printf("  - Max Retries: %s", server.MaxRetries)
+
+	if server.NotificationID == "" {
+		// log.Printf("🔕 NOTIFICATION SKIPPED: No notification ID configured for server %s", server.Name)
+		return
+	}
+
+	// Parse max retries
+	maxRetries, err := strconv.Atoi(server.MaxRetries)
+	if err != nil {
+		// log.Printf("Invalid max_retries value '%s' for server %s, using default 3", server.MaxRetries, server.Name)
+		maxRetries = 3
+	}
+
+	// Determine if notification should be sent
+	shouldSendNotification := false
+	notificationReason := ""
+
+	if currentStatus == "down" {
+		if sm.shouldSendStatusAlert(server.ServerID, "down", maxRetries) {
+			shouldSendNotification = true
+			retryCount := sm.getStatusRetryCount(server.ServerID)
+			notificationReason = fmt.Sprintf("server down - retry %d/%d", retryCount+1, maxRetries)
+		} else {
+			notificationReason = "server down but max retries reached"
+		}
+	} else if currentStatus == "up" && sm.shouldSendRecoveryStatusAlert(server.ServerID) {
+		shouldSendNotification = true
+		notificationReason = "server recovery notification"
+	}
+
+	// log.Printf("🎯 Notification Decision:")
+	// log.Printf("  - Should Send: %t", shouldSendNotification)
+	// log.Printf("  - Reason: %s", notificationReason)
+
+	if shouldSendNotification {
+		// log.Printf("📤 SENDING NOTIFICATION for server %s", server.Name)
+		// log.Printf("📧 Notification Details:")
+		// log.Printf("  - Server Name: %s", server.Name)
+		// log.Printf("  - Status: %s", currentStatus)
+		// log.Printf("  - Message: %s", message)
+		// log.Printf("  - Notification ID: %s", server.NotificationID)
+		// log.Printf("  - Template ID: %s", server.TemplateID)
+		// log.Printf("  - Reason: %s", notificationReason)
+
+		err := sm.notificationService.SendServerNotification(server, currentStatus, message)
+		if err != nil {
+			// log.Printf("❌ NOTIFICATION FAILED for server %s: %v", server.Name, err)
+			_ = err
+		} else {
+			// log.Printf("✅ NOTIFICATION SENT SUCCESSFULLY for server %s", server.Name)
+			
+			// Update alert tracking based on status
+			if currentStatus == "down" {
+				sm.setStatusAlert(server.ServerID, "down")
+			} else if currentStatus == "up" {
+				sm.clearStatusAlert(server.ServerID)
+			}
+		}
+	} else {
+		// log.Printf("📱 NOTIFICATION SKIPPED for server %s: %s", server.Name, notificationReason)
+	}
+
+	_ = statusChanged
+	_ = isFirstCheck
+	_ = notificationReason
+}
+
+// shouldSendStatusAlert determines if a status alert should be sent based on retry count
+func (sm *ServerMonitor) shouldSendStatusAlert(serverID, status string, maxRetries int) bool {
+	sm.mu.RLock()
+	alert, exists := sm.activeStatusAlerts[serverID]
+	sm.mu.RUnlock()
+	
+	if !exists {
+		return true // No existing alert, send new one
+	}
+	
+	// Check if we've reached max retries
+	if alert.RetryCount >= maxRetries {
+		// log.Printf("🔇 Status alert for server %s has reached max retries (%d), not sending notification", serverID, maxRetries)
+		return false
+	}
+	
+	// Check if enough time has passed since last alert (resend every 5 minutes)
+	timeSinceLastAlert := time.Since(alert.LastAlerted)
+	return timeSinceLastAlert > 5*time.Minute
+}
+
+// getStatusRetryCount returns the current retry count for a status alert
+func (sm *ServerMonitor) getStatusRetryCount(serverID string) int {
+	sm.mu.RLock()
+	defer sm.mu.RUnlock()
+	
+	if alert, exists := sm.activeStatusAlerts[serverID]; exists {
+		return alert.RetryCount
+	}
+	return 0
+}
+
+// shouldSendRecoveryStatusAlert determines if a recovery alert should be sent
+func (sm *ServerMonitor) shouldSendRecoveryStatusAlert(serverID string) bool {
+	sm.mu.RLock()
+	defer sm.mu.RUnlock()
+	
+	_, exists := sm.activeStatusAlerts[serverID]
+	return exists // Send recovery only if there was an active alert
+}
+
+// setStatusAlert creates or updates a status alert with incremented retry count
+func (sm *ServerMonitor) setStatusAlert(serverID, status string) {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	
+	alert, exists := sm.activeStatusAlerts[serverID]
+	if exists {
+		// Update existing alert and increment retry count
+		alert.Status = status
+		alert.LastAlerted = time.Now()
+		alert.RetryCount++
+		// log.Printf("📊 Updated status alert for server %s - Retry count: %d", serverID, alert.RetryCount)
+	} else {
+		// Create new alert
+		sm.activeStatusAlerts[serverID] = &StatusAlert{
+			IsActive:    true,
+			Status:      status,
+			LastAlerted: time.Now(),
+			RetryCount:  1, // Start with 1 since we're sending the first notification
+		}
+		// log.Printf("🆕 Created new status alert for server %s - Retry count: 1", serverID)
+	}
+}
+
+// clearStatusAlert removes a status alert
+func (sm *ServerMonitor) clearStatusAlert(serverID string) {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	
+	if _, exists := sm.activeStatusAlerts[serverID]; exists {
+		// log.Printf("🗑️ Cleared status alert for server %s", serverID)
+		delete(sm.activeStatusAlerts, serverID)
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/server-monitoring/notification_service.go b/server/service-operation/server-monitoring/notification_service.go
new file mode 100644
index 0000000..63cc487
--- /dev/null
+++ b/server/service-operation/server-monitoring/notification_service.go
@@ -0,0 +1,236 @@
+
+package servermonitoring
+
+import (
+	"time"
+
+	"service-operation/notification"
+	"service-operation/pocketbase"
+)
+
+// ServerNotificationService handles server-specific notifications
+type ServerNotificationService struct {
+	notificationManager *notification.NotificationManager
+}
+
+// NewServerNotificationService creates a new server notification service
+func NewServerNotificationService(pbClient *pocketbase.PocketBaseClient) *ServerNotificationService {
+	// log.Println("🔧 Creating new ServerNotificationService instance")
+	return &ServerNotificationService{
+		notificationManager: notification.NewNotificationManager(pbClient),
+	}
+}
+
+// SendResourceNotification sends a resource-specific notification (CPU, RAM, Disk, etc.)
+func (sns *ServerNotificationService) SendResourceNotification(server Server, status string, message string, resourceType string) error {
+	return sns.SendResourceNotificationWithValues(server, status, message, resourceType, "N/A", "N/A")
+}
+
+// SendResourceNotificationWithValues sends a resource-specific notification with actual usage and threshold values
+func (sns *ServerNotificationService) SendResourceNotificationWithValues(server Server, status string, message string, resourceType string, usageValue string, thresholdValue string) error {
+	// log.Printf("📨 === SENDING RESOURCE NOTIFICATION WITH VALUES ===")
+	// log.Printf("🔔 SendResourceNotificationWithValues called for server: %s", server.Name)
+	// log.Printf("📊 Resource Notification Parameters:")
+	// log.Printf("  - Server Name: %s", server.Name)
+	// log.Printf("  - Resource Type: %s", resourceType)
+	// log.Printf("  - Status: %s", status)
+	// log.Printf("  - Message: %s", message)
+	// log.Printf("  - Usage Value: %s", usageValue)
+	// log.Printf("  - Threshold Value: %s", thresholdValue)
+	// log.Printf("  - Notification ID: '%s'", server.NotificationID)
+	// log.Printf("  - Template ID: '%s'", server.TemplateID)
+	
+	// Validate notification configuration
+	if server.NotificationID == "" {
+		// log.Printf("❌ NOTIFICATION FAILED: No notification ID configured for server %s", server.Name)
+		return nil
+	}
+
+	// Get server metrics for notification
+	cpuUsage, ramUsage, diskUsage, networkUsage, cpuTemp, diskIO := sns.getServerMetrics(server.ServerID)
+
+	// Override specific resource metric with actual value
+	switch resourceType {
+	case "cpu":
+		cpuUsage = usageValue
+	case "ram", "memory":
+		ramUsage = usageValue
+	case "disk":
+		diskUsage = usageValue
+	case "network":
+		networkUsage = usageValue
+	case "cpu_temp", "cpu_temperature":
+		cpuTemp = usageValue
+	case "disk_io":
+		diskIO = usageValue
+	}
+
+	// Convert to generic notification payload
+	notificationPayload := &notification.NotificationPayload{
+		ServiceName:  server.Name,
+		Status:       status,
+		Host:         server.IPAddress,
+		Hostname:     server.Hostname,
+		Port:         0,
+		ServiceType:  "server",
+		ResponseTime: 0,
+		Timestamp:    time.Now(),
+		Message:      message,
+		// Server monitoring metrics
+		CPUUsage:     cpuUsage,
+		RAMUsage:     ramUsage,
+		DiskUsage:    diskUsage,
+		NetworkUsage: networkUsage,
+		CPUTemp:      cpuTemp,
+		DiskIO:       diskIO,
+		Threshold:    thresholdValue,
+	}
+
+	// log.Printf("📤 About to call SendResourceNotification...")
+	// log.Printf("  - Resource Type: %s", resourceType)
+	// log.Printf("  - Notification ID: %s", server.NotificationID)
+	// log.Printf("  - Template ID: %s", server.TemplateID)
+	// log.Printf("  - Usage Value: %s", usageValue)
+	// log.Printf("  - Threshold Value: %s", thresholdValue)
+
+	// Send resource-specific notification using the notification manager
+	err := sns.notificationManager.SendResourceNotification(notificationPayload, server.NotificationID, server.TemplateID, resourceType)
+	if err != nil {
+		// log.Printf("❌ RESOURCE NOTIFICATION ERROR for server %s: %v", server.Name, err)
+		return err
+	}
+
+	// log.Printf("✅ RESOURCE NOTIFICATION SENT SUCCESSFULLY for server %s (%s)", server.Name, resourceType)
+	// log.Printf("=== RESOURCE NOTIFICATION COMPLETE ===")
+	
+	return nil
+}
+
+// SendServerNotification sends a notification for server status change
+func (sns *ServerNotificationService) SendServerNotification(server Server, status string, message string) error {
+	// log.Printf("📨 === SENDING SERVER NOTIFICATION ===")
+	// log.Printf("🔔 SendServerNotification called for server: %s", server.Name)
+	// log.Printf("📊 Notification Parameters:")
+	// log.Printf("  - Server Name: %s", server.Name)
+	// log.Printf("  - Server ID: %s", server.ServerID)
+	// log.Printf("  - Status: %s", status)
+	// log.Printf("  - Message: %s", message)
+	// log.Printf("  - Notification ID: '%s'", server.NotificationID)
+	// log.Printf("  - Template ID: '%s'", server.TemplateID)
+	// log.Printf("  - IP Address: %s", server.IPAddress)
+	// log.Printf("  - Hostname: %s", server.Hostname)
+	
+	// Validate notification configuration
+	if server.NotificationID == "" {
+		// log.Printf("❌ NOTIFICATION FAILED: No notification ID configured for server %s", server.Name)
+		return nil
+	}
+
+	// log.Printf("✅ Notification ID validation passed: %s", server.NotificationID)
+
+	// Get server metrics for notification
+	cpuUsage, ramUsage, diskUsage, networkUsage, cpuTemp, diskIO := sns.getServerMetrics(server.ServerID)
+
+	// Convert to generic notification payload
+	// log.Printf("🔄 Converting to generic notification payload...")
+	notificationPayload := &notification.NotificationPayload{
+		ServiceName:  server.Name,
+		Status:       status,
+		Host:         server.IPAddress,
+		Hostname:     server.Hostname,
+		Port:         0, // Servers don't have ports
+		ServiceType:  "server",
+		ResponseTime: 0,
+		Timestamp:    time.Now(),
+		Message:      message,
+		// Server monitoring metrics
+		CPUUsage:     cpuUsage,
+		RAMUsage:     ramUsage,
+		DiskUsage:    diskUsage,
+		NetworkUsage: networkUsage,
+		CPUTemp:      cpuTemp,
+		DiskIO:       diskIO,
+		Threshold:    "N/A", // Can be set based on server configuration
+	}
+
+	// log.Printf("📦 Generic notification payload created:")
+	// log.Printf("  - ServiceName: %s", notificationPayload.ServiceName)
+	// log.Printf("  - Status: %s", notificationPayload.Status)
+	// log.Printf("  - Host: %s", notificationPayload.Host)
+	// log.Printf("  - ServiceType: %s", notificationPayload.ServiceType)
+	// log.Printf("  - Message: %s", notificationPayload.Message)
+	// log.Printf("  - CPUUsage: %s", notificationPayload.CPUUsage)
+	// log.Printf("  - RAMUsage: %s", notificationPayload.RAMUsage)
+	// log.Printf("  - DiskUsage: %s", notificationPayload.DiskUsage)
+	// log.Printf("  - NetworkUsage: %s", notificationPayload.NetworkUsage)
+	// log.Printf("  - CPUTemp: %s", notificationPayload.CPUTemp)
+	// log.Printf("  - DiskIO: %s", notificationPayload.DiskIO)
+	// log.Printf("  - Timestamp: %v", notificationPayload.Timestamp)
+
+	// log.Printf("📤 About to call SendServiceNotification...")
+	// log.Printf("  - Notification ID: %s", server.NotificationID)
+	// log.Printf("  - Template ID: %s", server.TemplateID)
+
+	// Send notification using the notification manager
+	err := sns.notificationManager.SendServiceNotification(notificationPayload, server.NotificationID, server.TemplateID)
+	if err != nil {
+		// log.Printf("❌ NOTIFICATION MANAGER ERROR for server %s: %v", server.Name, err)
+		// log.Printf("❌ Error Details:")
+		// log.Printf("  - Error Type: %T", err)
+		// log.Printf("  - Error Message: %s", err.Error())
+		// log.Printf("  - Notification ID used: %s", server.NotificationID)
+		// log.Printf("  - Template ID used: %s", server.TemplateID)
+		return err
+	}
+
+	// log.Printf("✅ NOTIFICATION SENT SUCCESSFULLY for server %s", server.Name)
+	// log.Printf("✅ Notification Details:")
+	// log.Printf("  - Status: %s", status)
+	// log.Printf("  - Notification ID: %s", server.NotificationID)
+	// log.Printf("  - Template ID: %s", server.TemplateID)
+	// log.Printf("=== NOTIFICATION COMPLETE ===")
+	
+	return nil
+}
+
+// getServerMetrics retrieves the latest server metrics (placeholder implementation)
+// This should be replaced with actual metric retrieval from your monitoring system
+func (sns *ServerNotificationService) getServerMetrics(serverID string) (cpuUsage, ramUsage, diskUsage, networkUsage, cpuTemp, diskIO string) {
+	// TODO: Implement actual metric retrieval from your server monitoring system
+	// For now, returning placeholder values
+	// You should replace this with actual calls to your metrics collection system
+	
+	// log.Printf("🔍 Retrieving server metrics for server ID: %s", serverID)
+	
+	// These should be replaced with actual metric values from your monitoring system
+	cpuUsage = "N/A"
+	ramUsage = "N/A" 
+	diskUsage = "N/A"
+	networkUsage = "N/A"
+	cpuTemp = "N/A"
+	diskIO = "N/A"
+	
+	// Example of how you might retrieve metrics:
+	// You could query your metrics database, call an API, or read from system files
+	// For example:
+	// metrics, err := sns.getLatestMetrics(serverID)
+	// if err == nil {
+	//     cpuUsage = fmt.Sprintf("%.1f%%", metrics.CPUUsage)
+	//     ramUsage = fmt.Sprintf("%.1f%%", metrics.RAMUsage)
+	//     diskUsage = fmt.Sprintf("%.1f%%", metrics.DiskUsage)
+	//     networkUsage = fmt.Sprintf("%.2f MB/s", metrics.NetworkUsage)
+	//     cpuTemp = fmt.Sprintf("%.1f°C", metrics.CPUTemp)
+	//     diskIO = fmt.Sprintf("%.2f MB/s", metrics.DiskIO)
+	// }
+	
+	// log.Printf("📊 Retrieved server metrics:")
+	// log.Printf("  - CPU Usage: %s", cpuUsage)
+	// log.Printf("  - RAM Usage: %s", ramUsage)
+	// log.Printf("  - Disk Usage: %s", diskUsage)
+	// log.Printf("  - Network Usage: %s", networkUsage)
+	// log.Printf("  - CPU Temperature: %s", cpuTemp)
+	// log.Printf("  - Disk I/O: %s", diskIO)
+	
+	_ = serverID
+	return cpuUsage, ramUsage, diskUsage, networkUsage, cpuTemp, diskIO
+}
\ No newline at end of file
diff --git a/server/service-operation/server-monitoring/pocketbase_client.go b/server/service-operation/server-monitoring/pocketbase_client.go
new file mode 100644
index 0000000..179a262
--- /dev/null
+++ b/server/service-operation/server-monitoring/pocketbase_client.go
@@ -0,0 +1,287 @@
+package servermonitoring
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"net/url"
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+// ServerMetrics represents server metrics record in PocketBase
+type ServerMetrics struct {
+	ID             string `json:"id"`
+	ServerID       string `json:"server_id"`
+	Timestamp      string `json:"timestamp"` // Changed to string for custom parsing
+	RAMTotal       string `json:"ram_total"`
+	RAMUsed        string `json:"ram_used"`
+	RAMFree        string `json:"ram_free"`
+	CPUCores       string `json:"cpu_cores"`
+	CPUUsage       string `json:"cpu_usage"`
+	CPUFree        string `json:"cpu_free"`
+	DiskTotal      string `json:"disk_total"`
+	DiskUsed        string `json:"disk_used"`
+	DiskFree        string `json:"disk_free"`
+	Status         string `json:"status"`
+	NetworkRxBytes int64  `json:"network_rx_bytes"`
+	NetworkTxBytes int64  `json:"network_tx_bytes"`
+	NetworkRxSpeed int64  `json:"network_rx_speed"`
+	NetworkTxSpeed int64  `json:"network_tx_speed"`
+	Created        string `json:"created"` // Changed to string for custom parsing
+	Updated        string `json:"updated"` // Changed to string for custom parsing
+}
+
+// ParsedServerMetrics represents ServerMetrics with parsed time fields
+type ParsedServerMetrics struct {
+	ServerMetrics
+	CreatedTime   time.Time
+	UpdatedTime   time.Time
+	TimestampTime time.Time
+}
+
+// ParseServerMetrics converts ServerMetrics to ParsedServerMetrics with proper time parsing
+func ParseServerMetrics(sm ServerMetrics) (ParsedServerMetrics, error) {
+	psm := ParsedServerMetrics{ServerMetrics: sm}
+	
+	var err error
+	
+	// Parse Created time
+	if sm.Created != "" {
+		psm.CreatedTime, err = parsePocketBaseTime(sm.Created)
+		if err != nil {
+			log.Printf("Warning: Failed to parse Created time '%s': %v", sm.Created, err)
+		}
+	}
+	
+	// Parse Updated time
+	if sm.Updated != "" {
+		psm.UpdatedTime, err = parsePocketBaseTime(sm.Updated)
+		if err != nil {
+			log.Printf("Warning: Failed to parse Updated time '%s': %v", sm.Updated, err)
+		}
+	}
+	
+	// Parse Timestamp
+	if sm.Timestamp != "" {
+		psm.TimestampTime, err = parsePocketBaseTime(sm.Timestamp)
+		if err != nil {
+			log.Printf("Warning: Failed to parse Timestamp '%s': %v", sm.Timestamp, err)
+		}
+	}
+	
+	return psm, nil
+}
+
+// parsePocketBaseTime parses PocketBase time format "2025-08-11 13:09:13.243Z"
+func parsePocketBaseTime(timeStr string) (time.Time, error) {
+	// First try the PocketBase format with space separator
+	if t, err := time.Parse("2006-01-02 15:04:05.000Z", timeStr); err == nil {
+		return t, nil
+	}
+	
+	// Fallback to RFC3339 format with T separator
+	if t, err := time.Parse(time.RFC3339, timeStr); err == nil {
+		return t, nil
+	}
+	
+	// Fallback to RFC3339Nano format
+	if t, err := time.Parse(time.RFC3339Nano, timeStr); err == nil {
+		return t, nil
+	}
+	
+	return time.Time{}, fmt.Errorf("unable to parse time string: %s", timeStr)
+}
+
+// ServerPocketBaseClient is a wrapper around the PocketBase client for server monitoring
+type ServerPocketBaseClient struct {
+	client *pocketbase.PocketBaseClient
+}
+
+// NewServerPocketBaseClient creates a new server PocketBase client
+func NewServerPocketBaseClient(client *pocketbase.PocketBaseClient) *ServerPocketBaseClient {
+	return &ServerPocketBaseClient{
+		client: client,
+	}
+}
+
+// GetServerThreshold fetches threshold configuration for a server
+func (spc *ServerPocketBaseClient) GetServerThreshold(thresholdID string) (*ServerThreshold, error) {
+	if thresholdID == "" {
+		log.Printf("No threshold ID provided")
+		_ = thresholdID
+		return nil, nil
+	}
+
+	url := fmt.Sprintf("%s/api/collections/server_threshold_templates/records/%s", spc.client.GetBaseURL(), thresholdID)
+	//log.Printf("🔍 Fetching server threshold from: %s", url)
+
+	resp, err := http.Get(url)
+	if err != nil {
+		//log.Printf("❌ HTTP error fetching server threshold: %v", err)
+		_ = err
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		//log.Printf("❌ Failed to fetch server threshold, status: %d", resp.StatusCode)
+		return nil, fmt.Errorf("failed to fetch server threshold, status: %d", resp.StatusCode)
+	}
+
+	var threshold ServerThreshold
+	if err := json.NewDecoder(resp.Body).Decode(&threshold); err != nil {
+		//log.Printf("❌ Error decoding server threshold JSON: %v", err)
+		_ = err
+		return nil, err
+	}
+
+	//log.Printf("✅ Successfully fetched server threshold: %+v", threshold)
+	_ = url
+	_ = threshold
+	return &threshold, nil
+}
+
+// GetAllServers retrieves all servers from PocketBase
+func (spc *ServerPocketBaseClient) GetAllServers() ([]Server, error) {
+	url := fmt.Sprintf("%s/api/collections/servers/records?perPage=500", spc.client.GetBaseURL())
+	//log.Printf("🌐 Fetching all servers from: %s", url)
+
+	resp, err := http.Get(url)
+	if err != nil {
+		//log.Printf("❌ HTTP error fetching servers: %v", err)
+		_ = err
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		//log.Printf("❌ Failed to fetch servers, status: %d", resp.StatusCode)
+		return nil, fmt.Errorf("failed to fetch servers, status: %d", resp.StatusCode)
+	}
+
+	var response struct {
+		Items []Server `json:"items"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
+		//log.Printf("❌ Error decoding servers JSON: %v", err)
+		_ = err
+		return nil, err
+	}
+
+	//log.Printf("✅ Successfully fetched %d servers", len(response.Items))
+	_ = url
+	return response.Items, nil
+}
+
+// GetLatestServerMetrics retrieves the latest server metrics from PocketBase
+func (spc *ServerPocketBaseClient) GetLatestServerMetrics(serverID string, timeout time.Duration) ([]ParsedServerMetrics, error) {
+	// Calculate the time before which metrics are considered too old
+	cutoff := time.Now().Add(-timeout).UTC().Format("2006-01-02 15:04:05.000Z")
+
+	// Construct the filter string with proper formatting (no spaces around operators)
+	filter := fmt.Sprintf("server_id='%s'&&created>'%s'", serverID, cutoff)
+	
+	// URL encode the filter parameter
+	encodedFilter := url.QueryEscape(filter)
+
+	// Construct the URL with properly encoded parameters
+	requestURL := fmt.Sprintf("%s/api/collections/server_metrics/records?filter=%s&sort=-created&perPage=1", 
+		spc.client.GetBaseURL(), encodedFilter)
+	
+	//log.Printf("🌐 Fetching latest server metrics from: %s", requestURL)
+	//log.Printf("🔍 Filter used: %s", filter)
+	//log.Printf("🔍 Cutoff time: %s", cutoff)
+
+	resp, err := http.Get(requestURL)
+	if err != nil {
+		//log.Printf("❌ HTTP error fetching server metrics: %v", err)
+		_ = err
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		//log.Printf("❌ Failed to fetch server metrics, status: %d", resp.StatusCode)
+		return nil, fmt.Errorf("failed to fetch server metrics, status: %d", resp.StatusCode)
+	}
+
+	var response struct {
+		Items []ServerMetrics `json:"items"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
+		//log.Printf("❌ Error decoding server metrics JSON: %v", err)
+		_ = err
+		return nil, err
+	}
+
+	// Convert to ParsedServerMetrics
+	var parsedMetrics []ParsedServerMetrics
+	for _, metric := range response.Items {
+		parsed, err := ParseServerMetrics(metric)
+		if err != nil {
+			//log.Printf("❌ Error parsing server metric: %v", err)
+			_ = err
+			continue
+		}
+		parsedMetrics = append(parsedMetrics, parsed)
+	}
+
+	//log.Printf("✅ Successfully fetched and parsed %d server metrics", len(parsedMetrics))
+	_ = requestURL
+	_ = filter
+	_ = cutoff
+	return parsedMetrics, nil
+}
+
+// UpdateServerStatus updates the server status in PocketBase
+func (spc *ServerPocketBaseClient) UpdateServerStatus(serverID string, status string) error {
+	url := fmt.Sprintf("%s/api/collections/servers/records/%s", spc.client.GetBaseURL(), serverID)
+	//log.Printf("🌐 Updating server status at: %s", url)
+
+	payload := map[string]interface{}{
+		"status":       status,
+		"last_checked": time.Now().UTC().Format("2006-01-02 15:04:05.000Z"),
+	}
+	
+	payloadBytes, err := json.Marshal(payload)
+	if err != nil {
+		//log.Printf("❌ Error marshaling payload: %v", err)
+		_ = err
+		return err
+	}
+
+	//log.Printf("📝 Update payload: %s", string(payloadBytes))
+
+	req, err := http.NewRequest(http.MethodPatch, url, bytes.NewBuffer(payloadBytes))
+	if err != nil {
+		//log.Printf("❌ Error creating request: %v", err)
+		_ = err
+		return err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	httpClient := &http.Client{Timeout: 10 * time.Second}
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		//log.Printf("❌ HTTP error updating server status: %v", err)
+		_ = err
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		//log.Printf("❌ Failed to update server status, status: %d", resp.StatusCode)
+		return fmt.Errorf("failed to update server status, status: %d", resp.StatusCode)
+	}
+
+	//log.Printf("✅ Successfully updated server status to %s", status)
+	_ = url
+	_ = payloadBytes
+	_ = status
+	return nil
+}
\ No newline at end of file
diff --git a/server/service-operation/server-monitoring/threshold_monitor.go b/server/service-operation/server-monitoring/threshold_monitor.go
new file mode 100644
index 0000000..893da04
--- /dev/null
+++ b/server/service-operation/server-monitoring/threshold_monitor.go
@@ -0,0 +1,333 @@
+
+package servermonitoring
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// ThresholdAlert tracks alert state and retry count
+type ThresholdAlert struct {
+	IsActive     bool
+	Threshold    int
+	CurrentValue float64
+	LastAlerted  time.Time
+	RetryCount   int // Track how many times we've sent this alert
+}
+
+// ThresholdMonitor handles server threshold monitoring and alerting
+type ThresholdMonitor struct {
+	pbClient            *ServerPocketBaseClient
+	notificationService *ServerNotificationService
+	activeAlerts        map[string]*ThresholdAlert // serverID-metricType -> alert
+}
+
+// NewThresholdMonitor creates a new threshold monitor
+func NewThresholdMonitor(pbClient *ServerPocketBaseClient, notificationService *ServerNotificationService) *ThresholdMonitor {
+	return &ThresholdMonitor{
+		pbClient:            pbClient,
+		notificationService: notificationService,
+		activeAlerts:        make(map[string]*ThresholdAlert),
+	}
+}
+
+// CheckServerThresholds checks all thresholds for a server
+func (tm *ThresholdMonitor) CheckServerThresholds(server Server, metrics []ParsedServerMetrics) {
+	if server.ThresholdID == "" {
+		// log.Printf("No threshold configuration for server %s", server.Name)
+		return
+	}
+
+	// Get threshold configuration
+	threshold, err := tm.pbClient.GetServerThreshold(server.ThresholdID)
+	if err != nil {
+		// log.Printf("❌ Failed to get threshold config for server %s: %v", server.Name, err)
+		_ = err
+		return
+	}
+
+	if threshold == nil {
+		// log.Printf("No threshold configuration found for server %s", server.Name)
+		return
+	}
+
+	if len(metrics) == 0 {
+		// log.Printf("No metrics available for threshold checking on server %s", server.Name)
+		return
+	}
+
+	latestMetric := metrics[0]
+	// log.Printf("🎯 Checking thresholds for server %s with threshold config: %+v", server.Name, threshold)
+
+	// Parse MaxRetries from string to int
+	maxRetries, err := strconv.Atoi(server.MaxRetries)
+	if err != nil {
+		// log.Printf("Invalid max_retries value '%s' for server %s, using default 3", server.MaxRetries, server.Name)
+		maxRetries = 3
+	}
+
+	// Check CPU threshold
+	tm.checkCPUThreshold(server, latestMetric, threshold, maxRetries)
+
+	// Check RAM threshold
+	tm.checkRAMThreshold(server, latestMetric, threshold, maxRetries)
+
+	// Check Disk threshold
+	tm.checkDiskThreshold(server, latestMetric, threshold, maxRetries)
+}
+
+// checkCPUThreshold checks CPU usage against threshold
+func (tm *ThresholdMonitor) checkCPUThreshold(server Server, metric ParsedServerMetrics, threshold *ServerThreshold, maxRetries int) {
+	cpuThresholdValue, err := strconv.Atoi(threshold.CPUThreshold)
+	if err != nil {
+		// log.Printf("Invalid CPU threshold value '%s' for server %s", threshold.CPUThreshold, server.Name)
+		return
+	}
+
+	// Parse CPU usage from metric (format: "XX.XX%")
+	cpuUsageStr := strings.TrimSuffix(metric.CPUUsage, "%")
+	cpuUsage, err := strconv.ParseFloat(cpuUsageStr, 64)
+	if err != nil {
+		// log.Printf("Failed to parse CPU usage '%s' for server %s", metric.CPUUsage, server.Name)
+		return
+	}
+
+	alertKey := fmt.Sprintf("%s-cpu", server.ServerID)
+	
+	if cpuUsage > float64(cpuThresholdValue) {
+		// Threshold exceeded
+		if tm.shouldCreateAlert(alertKey, cpuUsage, float64(cpuThresholdValue), maxRetries) {
+			// log.Printf("🚨 CPU threshold exceeded for server %s: %.2f%% > %d%% (retry %d/%d)", 
+			//	server.Name, cpuUsage, cpuThresholdValue, tm.getRetryCount(alertKey)+1, maxRetries)
+			
+			message := fmt.Sprintf("🚨 CPU Alert: Server %s CPU usage is %.2f%% (threshold: %d%%)", 
+				server.Name, cpuUsage, cpuThresholdValue)
+			
+			tm.sendThresholdAlert(server, "cpu", message, cpuUsage, float64(cpuThresholdValue), fmt.Sprintf("%.2f%%", cpuUsage), fmt.Sprintf("%d%%", cpuThresholdValue))
+			tm.setAlert(alertKey, cpuUsage, float64(cpuThresholdValue))
+		} else {
+			// log.Printf("🔇 CPU threshold exceeded for server %s but max retries (%d) reached, skipping notification", server.Name, maxRetries)
+		}
+	} else {
+		// Check if we need to send recovery notification
+		if tm.shouldSendRecoveryAlert(alertKey) {
+			// log.Printf("✅ CPU recovered for server %s: %.2f%% <= %d%%", server.Name, cpuUsage, cpuThresholdValue)
+			
+			message := fmt.Sprintf("✅ CPU Recovery: Server %s CPU usage is back to normal: %.2f%% (threshold: %d%%)", 
+				server.Name, cpuUsage, cpuThresholdValue)
+			
+			tm.sendThresholdRecovery(server, "cpu", message, fmt.Sprintf("%.2f%%", cpuUsage), fmt.Sprintf("%d%%", cpuThresholdValue))
+			tm.clearAlert(alertKey)
+		}
+	}
+}
+
+// checkRAMThreshold checks RAM usage against threshold
+func (tm *ThresholdMonitor) checkRAMThreshold(server Server, metric ParsedServerMetrics, threshold *ServerThreshold, maxRetries int) {
+	ramThresholdValue, err := strconv.Atoi(threshold.RAMThreshold)
+	if err != nil {
+		// log.Printf("Invalid RAM threshold value '%s' for server %s", threshold.RAMThreshold, server.Name)
+		return
+	}
+
+	// Parse RAM usage from metric (format: "X.XX GB (XX.X%)")
+	ramUsageStr := metric.RAMUsed
+	if strings.Contains(ramUsageStr, "(") && strings.Contains(ramUsageStr, "%)") {
+		// Extract percentage from parentheses
+		start := strings.Index(ramUsageStr, "(") + 1
+		end := strings.Index(ramUsageStr, "%)")
+		if start < end {
+			ramPercentageStr := ramUsageStr[start:end]
+			ramUsage, err := strconv.ParseFloat(ramPercentageStr, 64)
+			if err != nil {
+				// log.Printf("Failed to parse RAM usage percentage '%s' for server %s", ramPercentageStr, server.Name)
+				return
+			}
+
+			alertKey := fmt.Sprintf("%s-ram", server.ServerID)
+			
+			if ramUsage > float64(ramThresholdValue) {
+				// Threshold exceeded
+				if tm.shouldCreateAlert(alertKey, ramUsage, float64(ramThresholdValue), maxRetries) {
+					// log.Printf("🚨 RAM threshold exceeded for server %s: %.2f%% > %d%% (retry %d/%d)", 
+					//	server.Name, ramUsage, ramThresholdValue, tm.getRetryCount(alertKey)+1, maxRetries)
+					
+					message := fmt.Sprintf("🚨 RAM Alert: Server %s RAM usage is %.2f%% (threshold: %d%%)", 
+						server.Name, ramUsage, ramThresholdValue)
+					
+					tm.sendThresholdAlert(server, "ram", message, ramUsage, float64(ramThresholdValue), fmt.Sprintf("%.2f%%", ramUsage), fmt.Sprintf("%d%%", ramThresholdValue))
+					tm.setAlert(alertKey, ramUsage, float64(ramThresholdValue))
+				} else {
+					// log.Printf("🔇 RAM threshold exceeded for server %s but max retries (%d) reached, skipping notification", server.Name, maxRetries)
+				}
+			} else {
+				// Check if we need to send recovery notification
+				if tm.shouldSendRecoveryAlert(alertKey) {
+					// log.Printf("✅ RAM recovered for server %s: %.2f%% <= %d%%", server.Name, ramUsage, ramThresholdValue)
+					
+					message := fmt.Sprintf("✅ RAM Recovery: Server %s RAM usage is back to normal: %.2f%% (threshold: %d%%)", 
+						server.Name, ramUsage, ramThresholdValue)
+					
+					tm.sendThresholdRecovery(server, "ram", message, fmt.Sprintf("%.2f%%", ramUsage), fmt.Sprintf("%d%%", ramThresholdValue))
+					tm.clearAlert(alertKey)
+				}
+			}
+		}
+	}
+}
+
+// checkDiskThreshold checks disk usage against threshold
+func (tm *ThresholdMonitor) checkDiskThreshold(server Server, metric ParsedServerMetrics, threshold *ServerThreshold, maxRetries int) {
+	diskThresholdValue, err := strconv.Atoi(threshold.DiskThreshold)
+	if err != nil {
+		// log.Printf("Invalid disk threshold value '%s' for server %s", threshold.DiskThreshold, server.Name)
+		return
+	}
+
+	// Parse disk usage from metric (format: "X.XX GB (XX.X%)")
+	diskUsageStr := metric.DiskUsed
+	if strings.Contains(diskUsageStr, "(") && strings.Contains(diskUsageStr, "%)") {
+		// Extract percentage from parentheses
+		start := strings.Index(diskUsageStr, "(") + 1
+		end := strings.Index(diskUsageStr, "%)")
+		if start < end {
+			diskPercentageStr := diskUsageStr[start:end]
+			diskUsage, err := strconv.ParseFloat(diskPercentageStr, 64)
+			if err != nil {
+				// log.Printf("Failed to parse disk usage percentage '%s' for server %s", diskPercentageStr, server.Name)
+				return
+			}
+
+			alertKey := fmt.Sprintf("%s-disk", server.ServerID)
+			
+			if diskUsage > float64(diskThresholdValue) {
+				// Threshold exceeded
+				if tm.shouldCreateAlert(alertKey, diskUsage, float64(diskThresholdValue), maxRetries) {
+					// log.Printf("🚨 Disk threshold exceeded for server %s: %.2f%% > %d%% (retry %d/%d)", 
+					//	server.Name, diskUsage, diskThresholdValue, tm.getRetryCount(alertKey)+1, maxRetries)
+					
+					message := fmt.Sprintf("🚨 Disk Alert: Server %s disk usage is %.2f%% (threshold: %d%%)", 
+						server.Name, diskUsage, diskThresholdValue)
+					
+					tm.sendThresholdAlert(server, "disk", message, diskUsage, float64(diskThresholdValue), fmt.Sprintf("%.2f%%", diskUsage), fmt.Sprintf("%d%%", diskThresholdValue))
+					tm.setAlert(alertKey, diskUsage, float64(diskThresholdValue))
+				} else {
+					// log.Printf("🔇 Disk threshold exceeded for server %s but max retries (%d) reached, skipping notification", server.Name, maxRetries)
+				}
+			} else {
+				// Check if we need to send recovery notification
+				if tm.shouldSendRecoveryAlert(alertKey) {
+					// log.Printf("✅ Disk recovered for server %s: %.2f%% <= %d%%", server.Name, diskUsage, diskThresholdValue)
+					
+					message := fmt.Sprintf("✅ Disk Recovery: Server %s disk usage is back to normal: %.2f%% (threshold: %d%%)", 
+						server.Name, diskUsage, diskThresholdValue)
+					
+					tm.sendThresholdRecovery(server, "disk", message, fmt.Sprintf("%.2f%%", diskUsage), fmt.Sprintf("%d%%", diskThresholdValue))
+					tm.clearAlert(alertKey)
+				}
+			}
+		}
+	}
+}
+
+// shouldCreateAlert determines if an alert should be created based on retry count and max retries
+func (tm *ThresholdMonitor) shouldCreateAlert(alertKey string, currentValue, threshold float64, maxRetries int) bool {
+	alert, exists := tm.activeAlerts[alertKey]
+	if !exists {
+		return true // No existing alert, create new one
+	}
+	
+	// Check if we've reached max retries
+	if alert.RetryCount >= maxRetries {
+		// log.Printf("🔇 Alert %s has reached max retries (%d), not sending notification", alertKey, maxRetries)
+		return false
+	}
+	
+	// Check if enough time has passed since last alert (resend every 5 minutes)
+	timeSinceLastAlert := time.Since(alert.LastAlerted)
+	return timeSinceLastAlert > 5*time.Minute
+}
+
+// getRetryCount returns the current retry count for an alert
+func (tm *ThresholdMonitor) getRetryCount(alertKey string) int {
+	if alert, exists := tm.activeAlerts[alertKey]; exists {
+		return alert.RetryCount
+	}
+	return 0
+}
+
+// shouldSendRecoveryAlert determines if a recovery alert should be sent
+func (tm *ThresholdMonitor) shouldSendRecoveryAlert(alertKey string) bool {
+	_, exists := tm.activeAlerts[alertKey]
+	return exists // Send recovery only if there was an active alert
+}
+
+// setAlert creates or updates an alert with incremented retry count
+func (tm *ThresholdMonitor) setAlert(alertKey string, currentValue, threshold float64) {
+	alert, exists := tm.activeAlerts[alertKey]
+	if exists {
+		// Update existing alert and increment retry count
+		alert.CurrentValue = currentValue
+		alert.LastAlerted = time.Now()
+		alert.RetryCount++
+		// log.Printf("📊 Updated alert %s - Retry count: %d", alertKey, alert.RetryCount)
+	} else {
+		// Create new alert
+		tm.activeAlerts[alertKey] = &ThresholdAlert{
+			IsActive:     true,
+			Threshold:    int(threshold),
+			CurrentValue: currentValue,
+			LastAlerted:  time.Now(),
+			RetryCount:   1, // Start with 1 since we're sending the first notification
+		}
+		// log.Printf("🆕 Created new alert %s - Retry count: 1", alertKey)
+	}
+}
+
+// clearAlert removes an alert
+func (tm *ThresholdMonitor) clearAlert(alertKey string) {
+	if _, exists := tm.activeAlerts[alertKey]; exists {
+		// log.Printf("🗑️ Cleared alert %s", alertKey)
+		delete(tm.activeAlerts, alertKey)
+	}
+}
+
+// sendThresholdAlert sends a threshold exceeded notification using resource-specific templates
+func (tm *ThresholdMonitor) sendThresholdAlert(server Server, metricType, message string, currentValue, threshold float64, usageStr, thresholdStr string) {
+	if server.NotificationID == "" {
+		// log.Printf("No notification ID configured for server %s", server.Name)
+		return
+	}
+
+	// log.Printf("📤 Sending resource-specific threshold alert for server %s (%s): %s", server.Name, metricType, message)
+	
+	// Use the new resource-specific notification method with actual values
+	err := tm.notificationService.SendResourceNotificationWithValues(server, "warning", message, metricType, usageStr, thresholdStr)
+	if err != nil {
+		// log.Printf("❌ Failed to send threshold alert for server %s: %v", server.Name, err)
+		_ = err
+	} else {
+		// log.Printf("✅ Threshold alert sent successfully for server %s", server.Name)
+	}
+}
+
+// sendThresholdRecovery sends a threshold recovery notification using resource-specific templates
+func (tm *ThresholdMonitor) sendThresholdRecovery(server Server, metricType, message, usageStr, thresholdStr string) {
+	if server.NotificationID == "" {
+		// log.Printf("No notification ID configured for server %s", server.Name)
+		return
+	}
+
+	// log.Printf("📤 Sending resource-specific threshold recovery for server %s (%s): %s", server.Name, metricType, message)
+	
+	// Use the new resource-specific notification method with actual values
+	err := tm.notificationService.SendResourceNotificationWithValues(server, "up", message, metricType, usageStr, thresholdStr)
+	if err != nil {
+		// log.Printf("❌ Failed to send threshold recovery for server %s: %v", server.Name, err)
+		_ = err
+	} else {
+		// log.Printf("✅ Threshold recovery sent successfully for server %s", server.Name)
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/server-monitoring/types.go b/server/service-operation/server-monitoring/types.go
new file mode 100644
index 0000000..1dc242d
--- /dev/null
+++ b/server/service-operation/server-monitoring/types.go
@@ -0,0 +1,77 @@
+
+package servermonitoring
+
+import "time"
+
+// Server represents a server record in PocketBase
+type Server struct {
+	CollectionId       string  `json:"collectionId"`
+	CollectionName     string  `json:"collectionName"`
+	ID                 string  `json:"id"`
+	ServerID           string  `json:"server_id"`
+	Name               string  `json:"name"`
+	Hostname           string  `json:"hostname"`
+	IPAddress          string  `json:"ip_address"`
+	OSType             string  `json:"os_type"`
+	Status             string  `json:"status"` // 'up' | 'down' | 'warning' | 'paused'
+	Uptime             string  `json:"uptime"`
+	RAMTotal           float64 `json:"ram_total"`
+	RAMUsed            float64 `json:"ram_used"`
+	CPUCores           int     `json:"cpu_cores"`
+	CPUUsage           float64 `json:"cpu_usage"`
+	DiskTotal          float64 `json:"disk_total"`
+	DiskUsed           float64 `json:"disk_used"`
+	LastChecked        string  `json:"last_checked"`
+	ServerToken        string  `json:"server_token"`
+	TemplateID         string  `json:"template_id"`
+	ThresholdID        string  `json:"threshold_id"`
+	NotificationID     string  `json:"notification_id"`
+	NotificationStatus bool    `json:"notification_status"`
+	MaxRetries         string  `json:"max_retries"`
+	Timestamp          string  `json:"timestamp"`
+	Connection         string  `json:"connection"`
+	AgentStatus        string  `json:"agent_status"`
+	SystemInfo         string  `json:"system_info"`
+	NetworkRxBytes     string  `json:"network_rx_bytes"`
+	NetworkTxBytes     string  `json:"network_tx_bytes"`
+	NetworkRxSpeed     string  `json:"network_rx_speed"`
+	NetworkTxSpeed     string  `json:"network_tx_speed"`
+	CheckInterval      int     `json:"check_interval"`
+	Docker             string  `json:"docker"`
+	Created            string  `json:"created"`
+	Updated            string  `json:"updated"`
+}
+
+// ServerStats represents server statistics
+type ServerStats struct {
+	Total   int `json:"total"`
+	Online  int `json:"online"`
+	Offline int `json:"offline"`
+	Warning int `json:"warning"`
+}
+
+// ServerThreshold represents threshold configuration for server monitoring
+type ServerThreshold struct {
+	ID                string `json:"id"`
+	Name              string `json:"name"`
+	CPUThreshold      string `json:"cpu_threshold"`
+	RAMThreshold      string `json:"ram_threshold"`
+	DiskThreshold     string `json:"disk_threshold"`
+	NetworkThreshold  string `json:"network_threshold"`
+	DiskIOThreshold   string `json:"disk_io_threshold"`
+	CPUTempThreshold  string `json:"cpu_temp_threshold"`
+	Created           string `json:"created"`
+	Updated           string `json:"updated"`
+}
+
+// ServerNotificationPayload represents server-specific notification data
+type ServerNotificationPayload struct {
+	ServerName string    `json:"server_name"`
+	ServerID   string    `json:"server_id"`
+	Hostname   string    `json:"hostname"`
+	IPAddress  string    `json:"ip_address"`
+	Status     string    `json:"status"`
+	OSType     string    `json:"os_type"`
+	Timestamp  time.Time `json:"timestamp"`
+	Message    string    `json:"message"`
+}
\ No newline at end of file
diff --git a/server/service-operation/shared/savers/dns_saver.go b/server/service-operation/shared/savers/dns_saver.go
new file mode 100644
index 0000000..5754f76
--- /dev/null
+++ b/server/service-operation/shared/savers/dns_saver.go
@@ -0,0 +1,74 @@
+
+package savers
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"service-operation/pocketbase"
+	"service-operation/types"
+)
+
+func (ms *MetricsSaver) SaveDNSDataToPocketBase(result *types.OperationResult, serviceID string) {
+	// Create a short, professional status message
+	var details string
+	
+	if result.Success {
+		// Success message with record count and query info
+		recordCount := len(result.DNSRecords)
+		details = fmt.Sprintf("✅ DNS %s Query OK - %d records found", 
+			strings.ToUpper(result.DNSType), recordCount)
+		
+		// Add response time
+		details += fmt.Sprintf(" | Response time: %.2fms", 
+			float64(result.ResponseTime.Nanoseconds())/1000000)
+		
+		// Add first few records for context
+		if recordCount > 0 {
+			if recordCount <= 2 {
+				details += fmt.Sprintf(" | Records: %s", strings.Join(result.DNSRecords, ", "))
+			} else {
+				details += fmt.Sprintf(" | Records: %s... (+%d more)", 
+					strings.Join(result.DNSRecords[:2], ", "), recordCount-2)
+			}
+		}
+	} else {
+		// Error message with query type
+		details = fmt.Sprintf("❌ DNS %s Query Failed - %s", 
+			strings.ToUpper(result.DNSType), 
+			GetShortErrorMessage(result.Error))
+		
+		// Add response time if available
+		if result.ResponseTime > 0 {
+			details += fmt.Sprintf(" | Response time: %.2fms", 
+				float64(result.ResponseTime.Nanoseconds())/1000000)
+		}
+	}
+
+	dnsData := pocketbase.DNSDataRecord{
+		ServiceID:    serviceID,
+		Timestamp:    time.Now(),
+		ResponseTime: result.ResponseTime.Milliseconds(),
+		Status:       GetStatusString(result.Success),
+		QueryType:    result.DNSType,
+		ResolveIP:    strings.Join(result.DNSRecords, ","),
+		MsgSize:      fmt.Sprintf("%d", len(result.DNSRecords)),
+		Question:     result.Host,
+		Answer:       strings.Join(result.DNSRecords, ","),
+		Authority:    "", // Not available in current implementation
+		ErrorMessage: result.Error,
+		Details:      details, // Short, clean message
+		RegionName:   ms.regionName, // Add regional fields
+		AgentID:      ms.agentID,
+	}
+
+	if err := ms.pbClient.SaveDNSData(dnsData); err != nil {
+		println("Failed to save DNS data to PocketBase:", err.Error())
+	}
+}
+
+// Method for monitoring service usage
+func (ms *MetricsSaver) SaveDNSDataForService(service pocketbase.Service, result *types.OperationResult) {
+	ms.SaveDNSDataToPocketBase(result, service.ID)
+}
\ No newline at end of file
diff --git a/server/service-operation/shared/savers/metrics_saver.go b/server/service-operation/shared/savers/metrics_saver.go
new file mode 100644
index 0000000..e9a64ca
--- /dev/null
+++ b/server/service-operation/shared/savers/metrics_saver.go
@@ -0,0 +1,145 @@
+package savers
+
+import (
+	"fmt"
+	"time"
+
+	"service-operation/pocketbase"
+	"service-operation/types"
+)
+
+type MetricsSaver struct {
+	pbClient    *pocketbase.PocketBaseClient
+	regionName  string
+	agentID     string
+}
+
+func NewMetricsSaver(pbClient *pocketbase.PocketBaseClient) *MetricsSaver {
+	return &MetricsSaver{
+		pbClient:   pbClient,
+		regionName: "Default", // Default fallback
+		agentID:    "1",       // Default fallback
+	}
+}
+
+func NewMetricsSaverWithRegion(pbClient *pocketbase.PocketBaseClient, regionName, agentID string) *MetricsSaver {
+	return &MetricsSaver{
+		pbClient:   pbClient,
+		regionName: regionName,
+		agentID:    agentID,
+	}
+}
+
+func (ms *MetricsSaver) SaveMetricsToPocketBase(result *types.OperationResult, serviceID string) {
+	// Save general metrics using the new structure
+	metrics := pocketbase.MetricsRecord{
+		ServiceName:  result.Host,
+		Host:         result.Host,
+		Uptime:       0, // This would need to be calculated based on your requirements
+		ResponseTime: result.ResponseTime.Milliseconds(),
+		LastChecked:  time.Now().Format(time.RFC3339),
+		Port:         result.Port,
+		ServiceType:  string(result.Type),
+		Status:       GetStatusString(result.Success),
+		ErrorMessage: result.Error,
+		Details:      FormatResultDetails(result),
+		CheckedAt:    time.Now().Format(time.RFC3339),
+	}
+
+	if err := ms.pbClient.SaveMetrics(metrics); err != nil {
+		// Log error but don't fail the operation
+		println("Failed to save metrics to PocketBase:", err.Error())
+	}
+
+	// Save detailed data based on operation type - only once per check
+	if serviceID != "" {
+		switch result.Type {
+		case types.OperationPing:
+			ms.SavePingDataToPocketBase(result, serviceID)
+		case types.OperationHTTP:
+			ms.SaveUptimeDataToPocketBase(result, serviceID)
+		case types.OperationDNS:
+			ms.SaveDNSDataToPocketBase(result, serviceID)
+		case types.OperationTCP:
+			ms.SaveTCPDataToPocketBase(result, serviceID)
+		case types.OperationSSL:
+			ms.SaveSSLDataToPocketBase(result, serviceID)
+		}
+	}
+}
+
+// Primary method for monitoring service usage - this prevents duplicates
+func (ms *MetricsSaver) SaveMetricsForService(service pocketbase.Service, result *types.OperationResult) {
+	// Save general metrics first - reduced logging
+	metrics := pocketbase.MetricsRecord{
+		ServiceName:  service.Name,
+		Host:         service.Host,
+		Uptime:       0, // This would need to be calculated based on your requirements
+		ResponseTime: result.ResponseTime.Milliseconds(),
+		LastChecked:  time.Now().Format(time.RFC3339),
+		Port:         service.Port,
+		ServiceType:  service.ServiceType,
+		Status:       GetStatusString(result.Success),
+		ErrorMessage: result.Error,
+		Details:      FormatResultDetails(result),
+		CheckedAt:    time.Now().Format(time.RFC3339),
+	}
+
+	if err := ms.pbClient.SaveMetrics(metrics); err != nil {
+		// Silent error - no logging to reduce output
+		return
+	}
+
+	// Save detailed data based on service type - only once per service with minimal logging
+	switch service.ServiceType {
+	case "ping", "icmp":
+		ms.SavePingDataToPocketBase(result, service.ID)
+	case "dns":
+		ms.SaveDNSDataToPocketBase(result, service.ID)
+	case "http", "https":
+		ms.SaveUptimeDataToPocketBase(result, service.ID)
+	case "tcp":
+		ms.SaveTCPDataToPocketBase(result, service.ID)
+	case "ssl":
+		ms.SaveSSLDataToPocketBase(result, service.ID)
+	}
+}
+
+// SSL Data saver - remains unchanged (no regional fields)
+func (ms *MetricsSaver) SaveSSLDataToPocketBase(result *types.OperationResult, serviceID string) {
+	// Create SSL data record without regional fields
+	var details string
+	
+	if result.Success {
+		details = fmt.Sprintf("✅ SSL Certificate Valid - Expires in %d days", result.SSLDaysLeft)
+		details += fmt.Sprintf(" | Valid until: %s", result.SSLValidTill.Format("2006-01-02"))
+		
+		if result.SSLIssuer != "" {
+			details += fmt.Sprintf(" | Issuer: %s", result.SSLIssuer)
+		}
+	} else {
+		details = fmt.Sprintf("❌ SSL Certificate Issue - %s", GetShortErrorMessage(result.Error))
+	}
+
+	sslData := pocketbase.SSLDataRecord{
+		ServiceID:     serviceID,
+		Timestamp:     time.Now(),
+		ResponseTime:  result.ResponseTime.Milliseconds(),
+		Status:        GetStatusString(result.Success),
+		ValidFrom:     result.SSLValidFrom.Format(time.RFC3339),
+		ValidTill:     result.SSLValidTill.Format(time.RFC3339),
+		DaysLeft:      result.SSLDaysLeft,
+		Issuer:        result.SSLIssuer,
+		Subject:       result.SSLSubject,
+		SerialNumber:  result.SSLSerialNumber,
+		Algorithm:     result.SSLAlgorithm,
+		SANs:          result.SSLSANs,
+		ResolvedIP:    result.SSLResolvedIP,
+		ErrorMessage:  result.Error,
+		Details:       details,
+	}
+
+	if err := ms.pbClient.SaveSSLData(sslData); err != nil {
+		println("Failed to save SSL data to PocketBase:", err.Error())
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/shared/savers/ping_saver.go b/server/service-operation/shared/savers/ping_saver.go
new file mode 100644
index 0000000..f91ddbc
--- /dev/null
+++ b/server/service-operation/shared/savers/ping_saver.go
@@ -0,0 +1,74 @@
+
+package savers
+
+import (
+	"fmt"
+	"time"
+
+	"service-operation/pocketbase"
+	"service-operation/types"
+)
+
+func (ms *MetricsSaver) SavePingDataToPocketBase(result *types.OperationResult, serviceID string) {
+	// Create a short, professional status message
+	var details string
+	
+	if result.Success {
+		// Success message with packet stats
+		details = fmt.Sprintf("✅ Ping OK - %d/%d packets received", 
+			result.PacketsRecv, result.PacketsSent)
+		
+		// Add loss percentage if there was any loss
+		if result.PacketLoss > 0 {
+			details += fmt.Sprintf(" (%.1f%% loss)", result.PacketLoss)
+		}
+		
+		// Add response time info
+		details += fmt.Sprintf(" | Avg: %.2fms", 
+			float64(result.AvgRTT.Nanoseconds())/1000000)
+		
+		// Add min/max if different from average (significant variance)
+		if result.MinRTT != result.MaxRTT {
+			details += fmt.Sprintf(", Min: %.2fms, Max: %.2fms", 
+				float64(result.MinRTT.Nanoseconds())/1000000,
+				float64(result.MaxRTT.Nanoseconds())/1000000)
+		}
+	} else {
+		// Error message
+		if result.PacketLoss >= 100 {
+			details = fmt.Sprintf("❌ Ping Failed - 100%% packet loss (%s)", 
+				GetShortErrorMessage(result.Error))
+		} else {
+			details = fmt.Sprintf("⚠️ Ping Partial - %.1f%% packet loss (%s)", 
+				result.PacketLoss, GetShortErrorMessage(result.Error))
+		}
+	}
+
+	pingData := pocketbase.PingDataRecord{
+		ServiceID:    serviceID,
+		Timestamp:    time.Now(),
+		ResponseTime: result.ResponseTime.Milliseconds(),
+		Status:       GetStatusString(result.Success),
+		PacketsSent:  fmt.Sprintf("%d", result.PacketsSent),
+		PacketsRecv:  fmt.Sprintf("%d", result.PacketsRecv),
+		PacketLoss:   fmt.Sprintf("%.1f%%", result.PacketLoss),
+		MinRTT:       fmt.Sprintf("%.2fms", float64(result.MinRTT.Nanoseconds())/1000000),
+		MaxRTT:       fmt.Sprintf("%.2fms", float64(result.MaxRTT.Nanoseconds())/1000000),
+		AvgRTT:       fmt.Sprintf("%.2fms", float64(result.AvgRTT.Nanoseconds())/1000000),
+		RTTs:         "", // Not currently tracked
+		Latency:      fmt.Sprintf("%.2fms", float64(result.AvgRTT.Nanoseconds())/1000000),
+		ErrorMessage: result.Error,
+		Details:      details, // Short, clean message
+		RegionName:   ms.regionName, // Add regional fields
+		AgentID:      ms.agentID,
+	}
+
+	if err := ms.pbClient.SavePingData(pingData); err != nil {
+		println("Failed to save ping data to PocketBase:", err.Error())
+	}
+}
+
+// Method for monitoring service usage
+func (ms *MetricsSaver) SavePingDataForService(service pocketbase.Service, result *types.OperationResult) {
+	ms.SavePingDataToPocketBase(result, service.ID)
+}
\ No newline at end of file
diff --git a/server/service-operation/shared/savers/tcp_saver.go b/server/service-operation/shared/savers/tcp_saver.go
new file mode 100644
index 0000000..28d8f71
--- /dev/null
+++ b/server/service-operation/shared/savers/tcp_saver.go
@@ -0,0 +1,66 @@
+
+package savers
+
+import (
+	"fmt"
+	"strconv"
+	"time"
+
+	"service-operation/pocketbase"
+	"service-operation/types"
+)
+
+func (ms *MetricsSaver) SaveTCPDataToPocketBase(result *types.OperationResult, serviceID string) {
+	// Create a short, professional status message
+	var details string
+	
+	if result.Success && result.TCPConnected {
+		// Success message with connection info
+		details = fmt.Sprintf("✅ TCP Connection OK - Port %d accessible", result.Port)
+		
+		// Add response time
+		details += fmt.Sprintf(" | Connection time: %.2fms", 
+			float64(result.ResponseTime.Nanoseconds())/1000000)
+	} else {
+		// Error message with port info
+		details = fmt.Sprintf("❌ TCP Connection Failed - Port %d unreachable", result.Port)
+		
+		if result.Error != "" {
+			details += fmt.Sprintf(" (%s)", GetShortErrorMessage(result.Error))
+		}
+		
+		// Add response time if available
+		if result.ResponseTime > 0 {
+			details += fmt.Sprintf(" | Timeout: %.2fms", 
+				float64(result.ResponseTime.Nanoseconds())/1000000)
+		}
+	}
+
+	connectionStatus := "disconnected"
+	if result.TCPConnected {
+		connectionStatus = "connected"
+	}
+
+	tcpData := pocketbase.TCPDataRecord{
+		ServiceID:    serviceID,
+		Timestamp:    time.Now(),
+		ResponseTime: result.ResponseTime.Milliseconds(),
+		Status:       GetStatusString(result.Success),
+		Connection:   connectionStatus,
+		Latency:      fmt.Sprintf("%.2fms", float64(result.ResponseTime.Nanoseconds())/1000000),
+		Port:         strconv.Itoa(result.Port),
+		ErrorMessage: result.Error,
+		Details:      details,
+		RegionName:   ms.regionName, // Add regional fields
+		AgentID:      ms.agentID,
+	}
+
+	if err := ms.pbClient.SaveTCPData(tcpData); err != nil {
+		fmt.Printf("Failed to save TCP data to PocketBase: %v\n", err)
+	}
+}
+
+// Method for monitoring service usage
+func (ms *MetricsSaver) SaveTCPDataForService(service pocketbase.Service, result *types.OperationResult) {
+	ms.SaveTCPDataToPocketBase(result, service.ID)
+}
\ No newline at end of file
diff --git a/server/service-operation/shared/savers/uptime_saver.go b/server/service-operation/shared/savers/uptime_saver.go
new file mode 100644
index 0000000..fe89bc1
--- /dev/null
+++ b/server/service-operation/shared/savers/uptime_saver.go
@@ -0,0 +1,74 @@
+
+package savers
+
+import (
+	"fmt"
+	"time"
+
+	"service-operation/pocketbase"
+	"service-operation/types"
+)
+
+func (ms *MetricsSaver) SaveUptimeDataToPocketBase(result *types.OperationResult, serviceID string) {
+	// Create a short, professional status message
+	var details string
+	
+	if result.Success {
+		// Success message with basic info
+		details = fmt.Sprintf("✅ HTTP %d OK - Response time: %.2fms", 
+			result.HTTPStatusCode, 
+			float64(result.ResponseTime.Nanoseconds())/1000000)
+		
+		// Add content info if available
+		if result.ContentLength > 0 {
+			details += fmt.Sprintf(" | Content: %s", FormatBytes(result.ContentLength))
+		}
+		
+		// Add server info if available
+		if server, exists := result.HTTPHeaders["Server"]; exists {
+			details += fmt.Sprintf(" | Server: %s", server)
+		}
+	} else {
+		// Error message with status code if available
+		if result.HTTPStatusCode > 0 {
+			details = fmt.Sprintf("❌ HTTP %d Error - %s", 
+				result.HTTPStatusCode, 
+				GetShortErrorMessage(result.Error))
+		} else {
+			details = fmt.Sprintf("🔌 Connection Error - %s", 
+				GetShortErrorMessage(result.Error))
+		}
+		
+		// Add response time if available
+		if result.ResponseTime > 0 {
+			details += fmt.Sprintf(" | Response time: %.2fms", 
+				float64(result.ResponseTime.Nanoseconds())/1000000)
+		}
+	}
+
+	uptimeData := pocketbase.UptimeDataRecord{
+		ServiceID:    serviceID,
+		Timestamp:    time.Now(),
+		ResponseTime: result.ResponseTime.Milliseconds(),
+		Status:       GetStatusString(result.Success),
+		Packets:      "N/A", // Not applicable for HTTP
+		Latency:      fmt.Sprintf("%.2fms", float64(result.ResponseTime.Nanoseconds())/1000000),
+		StatusCodes:  fmt.Sprintf("%d", result.HTTPStatusCode),
+		Keyword:      "", // Can be populated later if needed
+		ErrorMessage: result.Error,
+		Details:      details, // Short, clean message
+		Region:       ms.regionName, // Legacy field
+		RegionID:     ms.agentID,    // Legacy field
+		RegionName:   ms.regionName, // Add regional fields
+		AgentID:      ms.agentID,
+	}
+
+	if err := ms.pbClient.SaveUptimeData(uptimeData); err != nil {
+		println("Failed to save uptime data to PocketBase:", err.Error())
+	}
+}
+
+// Method for monitoring service usage
+func (ms *MetricsSaver) SaveUptimeDataForService(service pocketbase.Service, result *types.OperationResult) {
+	ms.SaveUptimeDataToPocketBase(result, service.ID)
+}
\ No newline at end of file
diff --git a/server/service-operation/shared/savers/utils.go b/server/service-operation/shared/savers/utils.go
new file mode 100644
index 0000000..f540b6f
--- /dev/null
+++ b/server/service-operation/shared/savers/utils.go
@@ -0,0 +1,89 @@
+
+package savers
+
+import (
+	"fmt"
+	"strings"
+
+	"service-operation/types"
+)
+
+// Helper function to format bytes in a readable way
+func FormatBytes(bytes int64) string {
+	if bytes < 1024 {
+		return fmt.Sprintf("%d B", bytes)
+	} else if bytes < 1024*1024 {
+		return fmt.Sprintf("%.1f KB", float64(bytes)/1024)
+	} else {
+		return fmt.Sprintf("%.1f MB", float64(bytes)/(1024*1024))
+	}
+}
+
+// Helper function to create short error messages
+func GetShortErrorMessage(errorMessage string) string {
+	if errorMessage == "" {
+		return "Unknown error"
+	}
+	
+	errorLower := strings.ToLower(errorMessage)
+	
+	if strings.Contains(errorLower, "timeout") {
+		return "Request timeout"
+	} else if strings.Contains(errorLower, "connection refused") {
+		return "Connection refused"
+	} else if strings.Contains(errorLower, "dns") || strings.Contains(errorLower, "no such host") {
+		return "DNS resolution failed"
+	} else if strings.Contains(errorLower, "certificate") || strings.Contains(errorLower, "ssl") || strings.Contains(errorLower, "tls") {
+		return "SSL certificate error"
+	} else if strings.Contains(errorLower, "server error") || strings.Contains(errorLower, "internal server error") {
+		return "Internal server error"
+	} else if strings.Contains(errorLower, "not found") {
+		return "Page not found"
+	} else if strings.Contains(errorLower, "unauthorized") {
+		return "Unauthorized access"
+	} else if strings.Contains(errorLower, "forbidden") {
+		return "Access forbidden"
+	}
+	
+	// For other errors, take first 50 characters and clean it up
+	shortMsg := errorMessage
+	if len(shortMsg) > 50 {
+		shortMsg = shortMsg[:50] + "..."
+	}
+	
+	return shortMsg
+}
+
+func GetStatusString(success bool) string {
+	if success {
+		return "up"
+	}
+	return "down"
+}
+
+func FormatResultDetails(result *types.OperationResult) string {
+	// This can be expanded based on operation type
+	if result.Details != "" {
+		return result.Details
+	}
+	
+	switch result.Type {
+	case types.OperationPing:
+		if result.Success {
+			return fmt.Sprintf("Ping successful - %d packets sent, %d received", result.PacketsSent, result.PacketsRecv)
+		}
+		return fmt.Sprintf("Ping failed - %s", result.Error)
+	case types.OperationHTTP:
+		if result.Success {
+			return fmt.Sprintf("HTTP %d - Response time: %.2fms", result.HTTPStatusCode, float64(result.ResponseTime.Nanoseconds())/1000000)
+		}
+		return fmt.Sprintf("HTTP failed - %s", result.Error)
+	case types.OperationDNS:
+		if result.Success {
+			return fmt.Sprintf("DNS %s query successful - %d records found", result.DNSType, len(result.DNSRecords))
+		}
+		return fmt.Sprintf("DNS query failed - %s", result.Error)
+	default:
+		return "Operation completed"
+	}
+}
\ No newline at end of file
diff --git a/server/service-operation/ssl-monitoring/monitor.go b/server/service-operation/ssl-monitoring/monitor.go
new file mode 100644
index 0000000..c368c62
--- /dev/null
+++ b/server/service-operation/ssl-monitoring/monitor.go
@@ -0,0 +1,98 @@
+
+package sslmonitoring
+
+import (
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+// SSLMonitor monitors SSL certificates and sends notifications
+type SSLMonitor struct {
+	client              *SSLClient
+	notificationService *SSLNotificationService
+	checkInterval       time.Duration
+	stopChan            chan bool
+}
+
+// NewSSLMonitor creates a new SSL monitor
+func NewSSLMonitor(pbClient *pocketbase.PocketBaseClient) *SSLMonitor {
+	// Initialize SSL client
+	sslClient := NewSSLClient(pbClient)
+	
+	// Initialize notification service
+	notificationService := NewSSLNotificationService(sslClient, pbClient)
+
+	// Set check interval to 30 seconds to match other services
+	checkInterval := 30 * time.Second
+
+	return &SSLMonitor{
+		client:              sslClient,
+		notificationService: notificationService,
+		checkInterval:       checkInterval,
+		stopChan:            make(chan bool, 1),
+	}
+}
+
+// Start begins monitoring SSL certificates
+func (sm *SSLMonitor) Start() {
+	// log.Printf("🚀 [SSL-MONITOR] Starting with check interval: %v", sm.checkInterval)
+	// log.Printf("⏰ [SSL-MONITOR] Startup grace period: 2 minutes (no notifications for valid certificates)")
+
+	// Run initial check
+	sm.checkCertificates()
+
+	// Set up periodic checking every 30 seconds
+	ticker := time.NewTicker(sm.checkInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			sm.checkCertificates()
+		case <-sm.stopChan:
+			// log.Println("🛑 [SSL-MONITOR] Monitoring stopped")
+			return
+		}
+	}
+}
+
+// Stop gracefully stops the SSL monitoring
+func (sm *SSLMonitor) Stop() {
+	// log.Printf("🛑 [SSL-MONITOR] Stopping SSL monitoring...")
+	select {
+	case sm.stopChan <- true:
+	default:
+	}
+}
+
+// checkCertificates fetches all SSL certificates and checks their notification requirements
+func (sm *SSLMonitor) checkCertificates() {
+	// log.Printf("🔍 [SSL-CHECK] Checking SSL certificates for expiration alerts...")
+
+	certificates, err := sm.client.GetSSLCertificates()
+	if err != nil {
+		// log.Printf("❌ [SSL-ERROR] Failed to fetch SSL certificates: %v", err)
+		return
+	}
+
+	// log.Printf("📊 [SSL-CERTIFICATES] Found %d certificates to check", len(certificates))
+
+	successCount := 0
+	errorCount := 0
+
+	for _, cert := range certificates {
+		// Check each certificate for notification requirements
+		if err := sm.notificationService.CheckAndNotifySSLCertificate(cert); err != nil {
+			// log.Printf("❌ [SSL-FAILED] Failed to process certificate %s: %v", cert.Domain, err)
+			errorCount++
+		} else {
+			successCount++
+		}
+	}
+
+	// log.Printf("✅ [SSL-SUMMARY] Processed %d certificates (success: %d, errors: %d)", 
+	//	len(certificates), successCount, errorCount)
+	_ = successCount // Prevent unused variable warning
+	_ = errorCount   // Prevent unused variable warning
+}
\ No newline at end of file
diff --git a/server/service-operation/ssl-monitoring/notification_service.go b/server/service-operation/ssl-monitoring/notification_service.go
new file mode 100644
index 0000000..c5ffdd1
--- /dev/null
+++ b/server/service-operation/ssl-monitoring/notification_service.go
@@ -0,0 +1,192 @@
+package sslmonitoring
+
+import (
+	"fmt"
+	"strconv"
+	"time"
+
+	"service-operation/notification"
+	"service-operation/pocketbase"
+)
+
+// SSLNotificationService handles SSL certificate notifications
+type SSLNotificationService struct {
+	client              *SSLClient
+	pbClient           *pocketbase.PocketBaseClient
+	notificationManager *notification.NotificationManager
+	statusTracker      *SSLStatusTracker
+}
+
+// NewSSLNotificationService creates a new SSL notification service
+func NewSSLNotificationService(client *SSLClient, pbClient *pocketbase.PocketBaseClient) *SSLNotificationService {
+	return &SSLNotificationService{
+		client:              client,
+		pbClient:           pbClient,
+		notificationManager: notification.NewNotificationManager(pbClient),
+		statusTracker:      NewSSLStatusTracker(pbClient), // Pass pbClient to status tracker
+	}
+}
+
+// CheckAndNotifySSLCertificate checks SSL certificate and sends notification if needed
+func (sns *SSLNotificationService) CheckAndNotifySSLCertificate(cert SSLCertificate) error {
+	// Always recalculate days left from the actual expiry date to ensure accuracy
+	actualDaysLeft := sns.calculateDaysLeft(cert.ValidTill)
+	
+	// Use the calculated value as it's more accurate
+	cert.DaysLeft = actualDaysLeft
+
+	// Determine current status based on thresholds with calculated days left
+	currentStatus := sns.determineSSLStatus(cert.DaysLeft, cert.WarningThreshold, cert.ExpiryThreshold)
+
+	// Check if notification should be sent
+	if !sns.shouldSendNotification(cert.ID, currentStatus) {
+		return nil
+	}
+
+	// Skip if no notification configuration
+	if cert.NotificationID == "" {
+		return nil
+	}
+
+	// Send notification
+	err := sns.sendSSLNotification(cert, currentStatus)
+	if err != nil {
+		return err
+	}
+
+	// Update tracking in database
+	sns.statusTracker.UpdateStatus(cert.ID, currentStatus)
+	sns.statusTracker.SetLastNotificationTime(cert.ID, time.Now())
+
+	return nil
+}
+
+// calculateDaysLeft calculates days remaining until expiration with better error handling
+func (sns *SSLNotificationService) calculateDaysLeft(validTill string) int {
+	// Try multiple date formats to parse the expiry date
+	var expiryTime time.Time
+	var err error
+	
+	// Common date formats - updated to handle PocketBase format correctly
+	formats := []string{
+		"2006-01-02 15:04:05.000Z",       // PocketBase format with space (most common)
+		"2006-01-02T15:04:05.000Z",       // ISO 8601 with milliseconds
+		time.RFC3339,                     // Standard RFC3339
+		time.RFC3339Nano,                 // RFC3339 with nanoseconds
+		"2006-01-02 15:04:05Z",           // Without milliseconds
+		"2006-01-02T15:04:05Z",           // ISO without milliseconds
+		"2006-01-02 15:04:05.999Z",       // Alternative milliseconds format
+		"2006-01-02T15:04:05.999Z",       // Alternative ISO milliseconds
+		"2006-01-02 15:04:05.000000Z",    // Microseconds format
+		"2006-01-02T15:04:05.000000Z",    // ISO microseconds format
+		"2006-01-02 15:04:05",            // Simple format without timezone
+		"2006-01-02",                     // Date only
+	}
+	
+	for _, format := range formats {
+		expiryTime, err = time.Parse(format, validTill)
+		if err == nil {
+			break
+		}
+	}
+	
+	if err != nil {
+		return 0
+	}
+	
+	now := time.Now()
+	duration := expiryTime.Sub(now)
+	daysLeft := int(duration.Hours() / 24)
+	
+	// If the result is negative, the certificate is expired
+	if daysLeft < 0 {
+		daysLeft = 0
+	}
+	
+	return daysLeft
+}
+
+// sendSSLNotification sends the actual notification
+func (sns *SSLNotificationService) sendSSLNotification(cert SSLCertificate, status string) error {
+	// Determine the correct issuer value - prioritize IssuerCN over IssuerO
+	issuerValue := ""
+	if cert.IssuerCN != "" {
+		issuerValue = cert.IssuerCN
+	} else if cert.IssuerO != "" {
+		issuerValue = cert.IssuerO
+	} else {
+		issuerValue = "Unknown"
+	}
+	
+	// Create notification payload with SSL-specific data using calculated values
+	payload := &notification.NotificationPayload{
+		ServiceName:     fmt.Sprintf("SSL Certificate - %s", cert.Domain),
+		Status:          status,
+		Host:            cert.Domain,
+		Domain:          cert.Domain,
+		ServiceType:     "ssl",
+		Timestamp:       time.Now(),
+		Message:         sns.generateStatusMessage(cert, status),
+		
+		// SSL-specific fields with calculated/corrected values
+		CertificateName: cert.Domain,
+		ExpiryDate:      cert.ValidTill,
+		DaysLeft:        strconv.Itoa(cert.DaysLeft), // Use the calculated value
+		IssuerCN:        issuerValue,
+		SerialNumber:    cert.SerialNumber,
+	}
+
+	// Send SSL notification using the manager
+	return sns.notificationManager.SendSSLNotification(payload, cert.NotificationID, cert.TemplateID)
+}
+
+// generateStatusMessage creates appropriate message based on certificate status using calculated days
+func (sns *SSLNotificationService) generateStatusMessage(cert SSLCertificate, status string) string {
+	switch status {
+	case "expired":
+		return fmt.Sprintf("SSL certificate for %s expired on %s", cert.Domain, cert.ValidTill)
+	case "expiring_soon":
+		return fmt.Sprintf("SSL certificate for %s expires in %d days on %s", cert.Domain, cert.DaysLeft, cert.ValidTill)
+	case "warning":
+		return fmt.Sprintf("SSL certificate for %s expires in %d days", cert.Domain, cert.DaysLeft)
+	default:
+		return fmt.Sprintf("SSL certificate for %s is valid (%d days remaining)", cert.Domain, cert.DaysLeft)
+	}
+}
+
+// shouldSendNotification determines if notification should be sent with enhanced logic
+func (sns *SSLNotificationService) shouldSendNotification(certID, currentStatus string) bool {
+	lastStatus := sns.statusTracker.GetLastStatus(certID)
+	lastNotified := sns.statusTracker.GetLastNotificationTime(certID)
+
+	// Send if status changed or first check
+	if lastStatus == "" || lastStatus != currentStatus {
+		return true
+	}
+
+	// For critical statuses (expired/expiring_soon), resend after 24 hours
+	if (currentStatus == "expired" || currentStatus == "expiring_soon") && 
+		!lastNotified.IsZero() && time.Since(lastNotified) > 24*time.Hour {
+		return true
+	}
+
+	// For warning status, resend after 7 days to avoid spam
+	if currentStatus == "warning" && 
+		!lastNotified.IsZero() && time.Since(lastNotified) > 7*24*time.Hour {
+		return true
+	}
+
+	return false
+}
+
+// determineSSLStatus determines SSL certificate status based on days left and thresholds
+func (sns *SSLNotificationService) determineSSLStatus(daysLeft, warningThreshold, expiryThreshold int) string {
+	if daysLeft <= 0 {
+		return "expired"
+	} else if daysLeft <= expiryThreshold {
+		return "expiring_soon"
+	} else if daysLeft <= warningThreshold {
+		return "warning"
+	}
+	return "valid"
+}
\ No newline at end of file
diff --git a/server/service-operation/ssl-monitoring/ssl_client.go b/server/service-operation/ssl-monitoring/ssl_client.go
new file mode 100644
index 0000000..29d204a
--- /dev/null
+++ b/server/service-operation/ssl-monitoring/ssl_client.go
@@ -0,0 +1,78 @@
+
+package sslmonitoring
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"service-operation/pocketbase"
+)
+
+// SSLClient handles SSL certificate data operations
+type SSLClient struct {
+	pbClient *pocketbase.PocketBaseClient
+}
+
+// NewSSLClient creates a new SSL client
+func NewSSLClient(pbClient *pocketbase.PocketBaseClient) *SSLClient {
+	return &SSLClient{
+		pbClient: pbClient,
+	}
+}
+
+// GetSSLCertificates fetches all SSL certificates from PocketBase
+func (sc *SSLClient) GetSSLCertificates() ([]SSLCertificate, error) {
+	url := fmt.Sprintf("%s/api/collections/ssl_certificates/records", sc.pbClient.GetBaseURL())
+	// log.Printf("🔍 [SSL-CLIENT] Fetching SSL certificates from: %s", url)
+	
+	resp, err := http.Get(url)
+	if err != nil {
+		// log.Printf("❌ [SSL-CLIENT] HTTP error: %v", err)
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		// log.Printf("❌ [SSL-CLIENT] Failed to fetch SSL certificates, status: %d", resp.StatusCode)
+		return nil, fmt.Errorf("failed to fetch SSL certificates, status: %d", resp.StatusCode)
+	}
+
+	var response struct {
+		Items []SSLCertificate `json:"items"`
+	}
+	
+	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
+		// log.Printf("❌ [SSL-CLIENT] Error decoding response: %v", err)
+		return nil, err
+	}
+
+	// log.Printf("✅ [SSL-CLIENT] Successfully fetched %d SSL certificates", len(response.Items))
+	return response.Items, nil
+}
+
+// UpdateSSLCertificate updates SSL certificate status and notification time
+func (sc *SSLClient) UpdateSSLCertificate(certID string, data map[string]interface{}) error {
+	url := fmt.Sprintf("%s/api/collections/ssl_certificates/records/%s", sc.pbClient.GetBaseURL(), certID)
+	
+	req, err := http.NewRequest(http.MethodPatch, url, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create SSL certificate update request: %v", err)
+	}
+	
+	req.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to update SSL certificate: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to update SSL certificate, status: %d", resp.StatusCode)
+	}
+
+	// log.Printf("✅ [SSL-CLIENT] Successfully updated SSL certificate: %s", certID)
+	return nil
+}
\ No newline at end of file
diff --git a/server/service-operation/ssl-monitoring/status_tracker.go b/server/service-operation/ssl-monitoring/status_tracker.go
new file mode 100644
index 0000000..ab7d089
--- /dev/null
+++ b/server/service-operation/ssl-monitoring/status_tracker.go
@@ -0,0 +1,111 @@
+
+package sslmonitoring
+
+import (
+	"sync"
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+// SSLStatusTracker tracks SSL certificate status changes and notification timing using database persistence
+type SSLStatusTracker struct {
+	pbClient *pocketbase.PocketBaseClient
+	mu       sync.RWMutex
+}
+
+// NewSSLStatusTracker creates a new SSL status tracker with database persistence
+func NewSSLStatusTracker(pbClient *pocketbase.PocketBaseClient) *SSLStatusTracker {
+	return &SSLStatusTracker{
+		pbClient: pbClient,
+	}
+}
+
+// GetLastStatus returns the last known status for an SSL certificate from database
+func (sst *SSLStatusTracker) GetLastStatus(certID string) string {
+	sst.mu.RLock()
+	defer sst.mu.RUnlock()
+	
+	cert, err := sst.pbClient.GetSSLCertificateByID(certID)
+	if err != nil {
+		// log.Printf("🔍 [SSL-TRACKER] Error getting last status for %s: %v", certID, err)
+		return ""
+	}
+	
+	status := cert.Status
+	// log.Printf("🔍 [SSL-TRACKER] GetLastStatus for %s: %s", certID, status)
+	return status
+}
+
+// UpdateStatus updates the last known status for an SSL certificate in database
+func (sst *SSLStatusTracker) UpdateStatus(certID, status string) {
+	sst.mu.Lock()
+	defer sst.mu.Unlock()
+	
+	// Get current certificate to preserve other fields
+	cert, err := sst.pbClient.GetSSLCertificateByID(certID)
+	if err != nil {
+		// log.Printf("📝 [SSL-TRACKER] Error getting certificate for status update %s: %v", certID, err)
+		return
+	}
+	
+	oldStatus := cert.Status
+	
+	// Update only the status field
+	updateData := map[string]interface{}{
+		"status": status,
+	}
+	
+	err = sst.pbClient.UpdateSSLCertificate(certID, updateData)
+	if err != nil {
+		// log.Printf("📝 [SSL-TRACKER] Error updating status for %s: %v", certID, err)
+		return
+	}
+	
+	// log.Printf("📝 [SSL-TRACKER] UpdateStatus for %s: %s -> %s", certID, oldStatus, status)
+	_ = oldStatus // Prevent unused variable warning
+}
+
+// GetLastNotificationTime returns the last time a notification was sent for an SSL certificate from database
+func (sst *SSLStatusTracker) GetLastNotificationTime(certID string) time.Time {
+	sst.mu.RLock()
+	defer sst.mu.RUnlock()
+	
+	cert, err := sst.pbClient.GetSSLCertificateByID(certID)
+	if err != nil {
+		// log.Printf("⏰ [SSL-TRACKER] Error getting last notification time for %s: %v", certID, err)
+		return time.Time{}
+	}
+	
+	if cert.LastNotified == "" {
+		// log.Printf("⏰ [SSL-TRACKER] GetLastNotificationTime for %s: never notified", certID)
+		return time.Time{}
+	}
+	
+	lastTime, err := time.Parse(time.RFC3339, cert.LastNotified)
+	if err != nil {
+		// log.Printf("⏰ [SSL-TRACKER] Error parsing last notification time for %s: %v", certID, err)
+		return time.Time{}
+	}
+	
+	// log.Printf("⏰ [SSL-TRACKER] GetLastNotificationTime for %s: %v", certID, lastTime)
+	return lastTime
+}
+
+// SetLastNotificationTime sets the last notification time for an SSL certificate in database
+func (sst *SSLStatusTracker) SetLastNotificationTime(certID string, t time.Time) {
+	sst.mu.Lock()
+	defer sst.mu.Unlock()
+	
+	updateData := map[string]interface{}{
+		"last_notified": t.Format(time.RFC3339),
+	}
+	
+	err := sst.pbClient.UpdateSSLCertificate(certID, updateData)
+	if err != nil {
+		// log.Printf("⏰ [SSL-TRACKER] Error setting last notification time for %s: %v", certID, err)
+		return
+	}
+	
+	// log.Printf("⏰ [SSL-TRACKER] SetLastNotificationTime for %s: %v", certID, t)
+}
\ No newline at end of file
diff --git a/server/service-operation/ssl-monitoring/types.go b/server/service-operation/ssl-monitoring/types.go
new file mode 100644
index 0000000..6520087
--- /dev/null
+++ b/server/service-operation/ssl-monitoring/types.go
@@ -0,0 +1,110 @@
+
+package sslmonitoring
+
+import (
+	"encoding/json"
+	"strconv"
+	"time"
+)
+
+type SSLCertificate struct {
+	ID                   string    `json:"id"`
+	CollectionID         string    `json:"collectionId"`
+	CollectionName       string    `json:"collectionName"`
+	Domain               string    `json:"domain"`
+	IssuerO              string    `json:"issuer_o"`
+	Status               string    `json:"status"`
+	LastNotified         string    `json:"last_notified"`
+	WarningThreshold     int       `json:"warning_threshold"`
+	ExpiryThreshold      int       `json:"expiry_threshold"`
+	NotificationChannel  string    `json:"notification_channel"`
+	NotificationID       string    `json:"notification_id"`
+	TemplateID           string    `json:"template_id"`
+	ValidFrom            string    `json:"valid_from"`
+	SerialNumber         string    `json:"serial_number"`
+	IssuedTo             string    `json:"issued_to"`
+	ValidTill            string    `json:"valid_till"`
+	ValidityDays         int       `json:"validity_days"`
+	DaysLeft             int       `json:"days_left"`
+	ValidDaysToExpire    int       `json:"valid_days_to_expire"`
+	ResolvedIP           string    `json:"resolved_ip"`
+	IssuerCN             string    `json:"issuer_cn"`
+	CertAlg              string    `json:"cert_alg"`
+	CertSans             string    `json:"cert_sans"`
+	CheckInterval        int       `json:"check_interval"`
+	CheckAt              string    `json:"check_at"`
+	Created              string    `json:"created"`
+	Updated              string    `json:"updated"`
+}
+
+// Custom unmarshaler to handle check_interval as both string and int, and serial_number as string
+func (s *SSLCertificate) UnmarshalJSON(data []byte) error {
+	// Create a temporary struct with flexible types
+	type Alias SSLCertificate
+	aux := &struct {
+		CheckInterval interface{} `json:"check_interval"`
+		SerialNumber  interface{} `json:"serial_number"`
+		*Alias
+	}{
+		Alias: (*Alias)(s),
+	}
+
+	if err := json.Unmarshal(data, &aux); err != nil {
+		return err
+	}
+
+	// Handle check_interval conversion
+	switch v := aux.CheckInterval.(type) {
+	case string:
+		if v == "" {
+			s.CheckInterval = 1440 // Default 24 hours in minutes
+		} else {
+			interval, err := strconv.Atoi(v)
+			if err != nil {
+				s.CheckInterval = 1440 // Default on error
+			} else {
+				s.CheckInterval = interval
+			}
+		}
+	case float64:
+		s.CheckInterval = int(v)
+	case int:
+		s.CheckInterval = v
+	default:
+		s.CheckInterval = 1440 // Default 24 hours in minutes
+	}
+
+	// Handle serial_number conversion to string
+	switch v := aux.SerialNumber.(type) {
+	case string:
+		s.SerialNumber = v
+	case float64:
+		// Handle scientific notation by converting to string
+		s.SerialNumber = strconv.FormatFloat(v, 'f', 0, 64)
+	case int64:
+		s.SerialNumber = strconv.FormatInt(v, 10)
+	case int:
+		s.SerialNumber = strconv.Itoa(v)
+	default:
+		s.SerialNumber = ""
+	}
+
+	return nil
+}
+
+type SSLCheckResult struct {
+	Domain               string        `json:"domain"`
+	Success              bool          `json:"success"`
+	Error                string        `json:"error,omitempty"`
+	ValidFrom            time.Time     `json:"valid_from"`
+	ValidTill            time.Time     `json:"valid_till"`
+	DaysLeft             int           `json:"days_left"`
+	Issuer               string        `json:"issuer"`
+	Subject              string        `json:"subject"`
+	SerialNumber         string        `json:"serial_number"`
+	Algorithm            string        `json:"algorithm"`
+	SANs                 []string      `json:"sans"`
+	ResponseTime         time.Duration `json:"response_time"`
+	ResolvedIP           string        `json:"resolved_ip"`
+	CheckedAt            time.Time     `json:"checked_at"`
+}
\ No newline at end of file
diff --git a/server/service-operation/types/operation.go b/server/service-operation/types/operation.go
new file mode 100644
index 0000000..f36cb0a
--- /dev/null
+++ b/server/service-operation/types/operation.go
@@ -0,0 +1,72 @@
+package types
+
+import "time"
+
+type OperationType string
+
+const (
+	OperationPing OperationType = "ping"
+	OperationDNS  OperationType = "dns"
+	OperationTCP  OperationType = "tcp"
+	OperationHTTP OperationType = "http"
+	OperationSSL  OperationType = "ssl"
+)
+
+type OperationRequest struct {
+	Type      OperationType `json:"type"`
+	Host      string        `json:"host"`
+	Port      int           `json:"port,omitempty"`    // For TCP
+	Count     int           `json:"count,omitempty"`   // For ping
+	Timeout   int           `json:"timeout,omitempty"` // In seconds
+	Query     string        `json:"query,omitempty"`   // For DNS
+	URL       string        `json:"url,omitempty"`     // For HTTP
+	Method    string        `json:"method,omitempty"`  // For HTTP (GET, POST, etc.)
+	ServiceID string        `json:"service_id,omitempty"` // For linking to specific service
+}
+
+type OperationResult struct {
+	Type        OperationType   `json:"type"`
+	Host        string          `json:"host"`
+	Port        int             `json:"port,omitempty"`
+	Success     bool            `json:"success"`
+	ResponseTime time.Duration  `json:"response_time"`
+	Error       string          `json:"error,omitempty"`
+	Details     string          `json:"details,omitempty"`
+	
+	// Ping specific fields
+	PacketsSent int             `json:"packets_sent,omitempty"`
+	PacketsRecv int             `json:"packets_recv,omitempty"`
+	PacketLoss  float64         `json:"packet_loss,omitempty"`
+	MinRTT      time.Duration   `json:"min_rtt,omitempty"`
+	MaxRTT      time.Duration   `json:"max_rtt,omitempty"`
+	AvgRTT      time.Duration   `json:"avg_rtt,omitempty"`
+	RTTs        []time.Duration `json:"rtts,omitempty"`
+	
+	// DNS specific fields
+	DNSRecords  []string        `json:"dns_records,omitempty"`
+	DNSType     string          `json:"dns_type,omitempty"`
+	
+	// TCP specific fields
+	TCPConnected bool           `json:"tcp_connected,omitempty"`
+	
+	// HTTP specific fields
+	HTTPStatusCode int          `json:"http_status_code,omitempty"`
+	HTTPMethod     string       `json:"http_method,omitempty"`
+	HTTPHeaders    map[string]string `json:"http_headers,omitempty"`
+	ContentLength  int64        `json:"content_length,omitempty"`
+	ResponseBody   string       `json:"response_body,omitempty"`
+	
+	// SSL specific fields
+	SSLValidFrom     time.Time   `json:"ssl_valid_from,omitempty"`
+	SSLValidTill     time.Time   `json:"ssl_valid_till,omitempty"`
+	SSLDaysLeft      int         `json:"ssl_days_left,omitempty"`
+	SSLIssuer        string      `json:"ssl_issuer,omitempty"`
+	SSLSubject       string      `json:"ssl_subject,omitempty"`
+	SSLSerialNumber  string      `json:"ssl_serial_number,omitempty"`
+	SSLAlgorithm     string      `json:"ssl_algorithm,omitempty"`
+	SSLSANs          string      `json:"ssl_sans,omitempty"`
+	SSLResolvedIP    string      `json:"ssl_resolved_ip,omitempty"`
+	
+	StartTime   time.Time       `json:"start_time"`
+	EndTime     time.Time       `json:"end_time"`
+}
\ No newline at end of file
diff --git a/server/service-operation/types/ssl.go b/server/service-operation/types/ssl.go
new file mode 100644
index 0000000..02e53dd
--- /dev/null
+++ b/server/service-operation/types/ssl.go
@@ -0,0 +1,108 @@
+
+package types
+
+import (
+	"encoding/json"
+	"strconv"
+	"time"
+)
+
+type SSLCertificate struct {
+	ID                   string    `json:"id"`
+	CollectionID         string    `json:"collectionId"`
+	CollectionName       string    `json:"collectionName"`
+	Domain               string    `json:"domain"`
+	IssuerO              string    `json:"issuer_o"`
+	Status               string    `json:"status"`
+	LastNotified         string    `json:"last_notified"`
+	WarningThreshold     int       `json:"warning_threshold"`
+	ExpiryThreshold      int       `json:"expiry_threshold"`
+	NotificationChannel  string    `json:"notification_channel"`
+	ValidFrom            string    `json:"valid_from"`
+	SerialNumber         string    `json:"serial_number"` // Changed to string to handle large numbers
+	IssuedTo             string    `json:"issued_to"`
+	ValidTill            string    `json:"valid_till"`
+	ValidityDays         int       `json:"validity_days"`
+	DaysLeft             int       `json:"days_left"`
+	ValidDaysToExpire    int       `json:"valid_days_to_expire"`
+	ResolvedIP           string    `json:"resolved_ip"`
+	IssuerCN             string    `json:"issuer_cn"`
+	CertAlg              string    `json:"cert_alg"`
+	CertSans             string    `json:"cert_sans"`
+	CheckInterval        int       `json:"check_interval"`
+	CheckAt              string    `json:"check_at"`
+	Created              string    `json:"created"`
+	Updated              string    `json:"updated"`
+}
+
+// Custom unmarshaler to handle check_interval as both string and int, and serial_number as string
+func (s *SSLCertificate) UnmarshalJSON(data []byte) error {
+	// Create a temporary struct with flexible types
+	type Alias SSLCertificate
+	aux := &struct {
+		CheckInterval interface{} `json:"check_interval"`
+		SerialNumber  interface{} `json:"serial_number"`
+		*Alias
+	}{
+		Alias: (*Alias)(s),
+	}
+
+	if err := json.Unmarshal(data, &aux); err != nil {
+		return err
+	}
+
+	// Handle check_interval conversion
+	switch v := aux.CheckInterval.(type) {
+	case string:
+		if v == "" {
+			s.CheckInterval = 1440 // Default 24 hours in minutes
+		} else {
+			interval, err := strconv.Atoi(v)
+			if err != nil {
+				s.CheckInterval = 1440 // Default on error
+			} else {
+				s.CheckInterval = interval
+			}
+		}
+	case float64:
+		s.CheckInterval = int(v)
+	case int:
+		s.CheckInterval = v
+	default:
+		s.CheckInterval = 1440 // Default 24 hours in minutes
+	}
+
+	// Handle serial_number conversion to string
+	switch v := aux.SerialNumber.(type) {
+	case string:
+		s.SerialNumber = v
+	case float64:
+		// Handle scientific notation by converting to string
+		s.SerialNumber = strconv.FormatFloat(v, 'f', 0, 64)
+	case int64:
+		s.SerialNumber = strconv.FormatInt(v, 10)
+	case int:
+		s.SerialNumber = strconv.Itoa(v)
+	default:
+		s.SerialNumber = ""
+	}
+
+	return nil
+}
+
+type SSLCheckResult struct {
+	Domain               string        `json:"domain"`
+	Success              bool          `json:"success"`
+	Error                string        `json:"error,omitempty"`
+	ValidFrom            time.Time     `json:"valid_from"`
+	ValidTill            time.Time     `json:"valid_till"`
+	DaysLeft             int           `json:"days_left"`
+	Issuer               string        `json:"issuer"`
+	Subject              string        `json:"subject"`
+	SerialNumber         string        `json:"serial_number"`
+	Algorithm            string        `json:"algorithm"`
+	SANs                 []string      `json:"sans"`
+	ResponseTime         time.Duration `json:"response_time"`
+	ResolvedIP           string        `json:"resolved_ip"`
+	CheckedAt            time.Time     `json:"checked_at"`
+}
\ No newline at end of file
diff --git a/server/service-operation/uptime-monitoring/client.go b/server/service-operation/uptime-monitoring/client.go
new file mode 100644
index 0000000..ff166fe
--- /dev/null
+++ b/server/service-operation/uptime-monitoring/client.go
@@ -0,0 +1,113 @@
+
+package uptimemonitoring
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+// UptimeClient handles uptime service operations
+type UptimeClient struct {
+	pbClient *pocketbase.PocketBaseClient
+}
+
+// MetricRecord represents a metric record from any collection
+type MetricRecord struct {
+	ID           string    `json:"id"`
+	ServiceID    string    `json:"service_id"`
+	Status       string    `json:"status"`
+	ResponseTime int       `json:"response_time"`
+	ErrorMessage string    `json:"error_message"` // Added missing ErrorMessage field
+	Timestamp    time.Time `json:"timestamp"`
+	Created      time.Time `json:"created"`
+}
+
+// NewUptimeClient creates a new uptime client
+func NewUptimeClient(pbClient *pocketbase.PocketBaseClient) *UptimeClient {
+	return &UptimeClient{
+		pbClient: pbClient,
+	}
+}
+
+// GetServices retrieves all services for monitoring
+func (uc *UptimeClient) GetServices() ([]UptimeService, error) {
+	url := fmt.Sprintf("%s/api/collections/services/records", uc.pbClient.GetBaseURL())
+	
+	resp, err := http.Get(url)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch services: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to fetch services, status: %d", resp.StatusCode)
+	}
+
+	var response struct {
+		Items []UptimeService `json:"items"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
+		return nil, fmt.Errorf("failed to decode services: %v", err)
+	}
+
+	// log.Printf("✅ Fetched %d services for monitoring", len(response.Items))
+	return response.Items, nil
+}
+
+// GetLatestMetricRecord gets the latest metric record for a service from specified collection
+func (uc *UptimeClient) GetLatestMetricRecord(serviceID, collection string) ([]MetricRecord, error) {
+	url := fmt.Sprintf("%s/api/collections/%s/records?filter=service_id='%s'&sort=-timestamp&perPage=1", 
+		uc.pbClient.GetBaseURL(), collection, serviceID)
+	
+	// log.Printf("🔍 [METRICS-QUERY] Getting latest record for service %s from %s", serviceID, collection)
+	
+	resp, err := http.Get(url)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch metric record: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to fetch metric record, status: %d", resp.StatusCode)
+	}
+
+	var response struct {
+		Items []struct {
+			ID           string `json:"id"`
+			ServiceID    string `json:"service_id"`
+			Status       string `json:"status"`
+			ResponseTime int    `json:"response_time"`
+			ErrorMessage string `json:"error_message"` // Added missing ErrorMessage field
+			Timestamp    string `json:"timestamp"`
+			Created      string `json:"created"`
+		} `json:"items"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
+		return nil, fmt.Errorf("failed to decode metric record: %v", err)
+	}
+
+	var records []MetricRecord
+	for _, item := range response.Items {
+		timestamp, _ := time.Parse(time.RFC3339, item.Timestamp)
+		created, _ := time.Parse(time.RFC3339, item.Created)
+		
+		records = append(records, MetricRecord{
+			ID:           item.ID,
+			ServiceID:    item.ServiceID,
+			Status:       item.Status,
+			ResponseTime: item.ResponseTime,
+			ErrorMessage: item.ErrorMessage, // Include ErrorMessage in the record
+			Timestamp:    timestamp,
+			Created:      created,
+		})
+	}
+
+	// log.Printf("📊 [METRICS-RESULT] Found %d records for service %s in %s", len(records), serviceID, collection)
+	return records, nil
+}
\ No newline at end of file
diff --git a/server/service-operation/uptime-monitoring/monitor.go b/server/service-operation/uptime-monitoring/monitor.go
new file mode 100644
index 0000000..0c89b8d
--- /dev/null
+++ b/server/service-operation/uptime-monitoring/monitor.go
@@ -0,0 +1,106 @@
+
+package uptimemonitoring
+
+import (
+	"time"
+
+	"service-operation/pocketbase"
+)
+
+// UptimeMonitor monitors uptime services and sends notifications
+type UptimeMonitor struct {
+	client              *UptimeClient
+	notificationService *UptimeNotificationService
+	checkInterval       time.Duration
+	stopChan            chan bool
+}
+
+// NewUptimeMonitor creates a new uptime monitor
+func NewUptimeMonitor(pbClient *pocketbase.PocketBaseClient) *UptimeMonitor {
+	// Initialize uptime client
+	uptimeClient := NewUptimeClient(pbClient)
+	
+	// Initialize notification service
+	notificationService := NewUptimeNotificationService(uptimeClient, pbClient)
+
+	// Set check interval to 30 seconds to match server monitoring
+	checkInterval := 30 * time.Second
+
+	return &UptimeMonitor{
+		client:              uptimeClient,
+		notificationService: notificationService,
+		checkInterval:       checkInterval,
+		stopChan:            make(chan bool, 1),
+	}
+}
+
+// Start begins monitoring uptime services
+func (um *UptimeMonitor) Start() {
+	// log.Printf("🚀 [UPTIME-MONITOR] Starting with check interval: %v", um.checkInterval)
+	// log.Printf("⏰ [UPTIME-MONITOR] Startup grace period: 2 minutes (no notifications for UP services)")
+
+	// Run initial check
+	um.checkServices()
+
+	// Set up periodic checking every 30 seconds
+	ticker := time.NewTicker(um.checkInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			um.checkServices()
+		case <-um.stopChan:
+			// log.Println("🛑 [UPTIME-MONITOR] Monitoring stopped")
+			return
+		}
+	}
+}
+
+// Stop gracefully stops the uptime monitoring
+func (um *UptimeMonitor) Stop() {
+	// log.Printf("🛑 [UPTIME-MONITOR] Stopping uptime monitoring...")
+	select {
+	case um.stopChan <- true:
+	default:
+	}
+}
+
+// checkServices fetches all services and checks their notification requirements
+func (um *UptimeMonitor) checkServices() {
+	// log.Printf("🔍 [UPTIME-CHECK] Checking uptime services for status changes...")
+
+	services, err := um.client.GetServices()
+	if err != nil {
+		// log.Printf("❌ [UPTIME-ERROR] Failed to fetch services: %v", err)
+		_ = err
+		return
+	}
+
+	// log.Printf("📊 [UPTIME-SERVICES] Found %d services to check", len(services))
+
+	successCount := 0
+	errorCount := 0
+
+	for _, service := range services {
+		// Skip paused services
+		if service.Status == "paused" {
+			// log.Printf("⏸️ [UPTIME-SKIP] Service %s is paused - skipping", service.Name)
+			continue
+		}
+
+		// Check each service for notification requirements
+		if err := um.notificationService.CheckAndNotifyService(service); err != nil {
+			// log.Printf("❌ [UPTIME-FAILED] Failed to process service %s: %v", service.Name, err)
+			_ = err
+			errorCount++
+		} else {
+			successCount++
+		}
+	}
+
+	// log.Printf("✅ [UPTIME-SUMMARY] Processed %d services (success: %d, errors: %d)", 
+	//	len(services), successCount, errorCount)
+	_ = successCount
+	_ = errorCount
+}
\ No newline at end of file
diff --git a/server/service-operation/uptime-monitoring/notification_service.go b/server/service-operation/uptime-monitoring/notification_service.go
new file mode 100644
index 0000000..112ad34
--- /dev/null
+++ b/server/service-operation/uptime-monitoring/notification_service.go
@@ -0,0 +1,272 @@
+
+package uptimemonitoring
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"service-operation/notification"
+	"service-operation/pocketbase"
+)
+
+// UptimeNotificationService handles notifications for uptime services
+type UptimeNotificationService struct {
+	client          *UptimeClient
+	notificationMgr *notification.NotificationManager
+	statusTracker   *ServiceStatusTracker
+	startupTime     time.Time
+	gracePeriod     time.Duration
+}
+
+// NewUptimeNotificationService creates a new uptime notification service
+func NewUptimeNotificationService(client *UptimeClient, pbClient *pocketbase.PocketBaseClient) *UptimeNotificationService {
+	return &UptimeNotificationService{
+		client:          client,
+		notificationMgr: notification.NewNotificationManager(pbClient),
+		statusTracker:   NewServiceStatusTracker(),
+		startupTime:     time.Now(),
+		gracePeriod:     2 * time.Minute, // 2 minute grace period after startup
+	}
+}
+
+// isInGracePeriod checks if we're still in the startup grace period
+func (uns *UptimeNotificationService) isInGracePeriod() bool {
+	return time.Since(uns.startupTime) < uns.gracePeriod
+}
+
+// CheckAndNotifyService checks a service and sends notifications for status changes
+func (uns *UptimeNotificationService) CheckAndNotifyService(service UptimeService) error {
+	// log.Printf("🔍 [UPTIME-CHECK] Checking service: %s (ID: %s, Type: %s)", service.Name, service.ID, service.ServiceType)
+
+	// Check if notifications are enabled for this service
+	if !uns.isNotificationEnabled(service) {
+		// log.Printf("⚠️ [SKIP] Notifications disabled for service %s", service.Name)
+		return nil
+	}
+
+	// Get ACTUAL current status from PocketBase metrics (including error message)
+	actualCurrentStatus, responseTime, errorMessage, err := uns.getActualServiceStatusWithError(service)
+	if err != nil {
+		// log.Printf("❌ [ERROR] Failed to get actual status for %s: %v", service.Name, err)
+		// If we can't get status, assume it's down
+		actualCurrentStatus = "down"
+		responseTime = 0
+		errorMessage = fmt.Sprintf("Failed to retrieve service metrics: %v", err)
+	}
+
+	// Get previously tracked status
+	previousStatus := uns.statusTracker.GetLastStatus(service.ID)
+	
+	// log.Printf("📊 [STATUS-COMPARE] Service %s: PREVIOUS='%s' -> ACTUAL_CURRENT='%s', Error: '%s'", service.Name, previousStatus, actualCurrentStatus, errorMessage)
+
+	// Initialize tracking for new services
+	if previousStatus == "" {
+		// log.Printf("🆕 [INIT] First time tracking service %s - setting initial status: %s", service.Name, actualCurrentStatus)
+		
+		// Check if we're in startup grace period
+		if uns.isInGracePeriod() {
+			// log.Printf("⏰ [GRACE-PERIOD] Service %s - within startup grace period, skipping initial notification", service.Name)
+			uns.statusTracker.UpdateStatus(service.ID, actualCurrentStatus)
+			return nil
+		}
+		
+		// Only send initial notification if service is DOWN (critical status)
+		if actualCurrentStatus == "down" {
+			// log.Printf("🚨 [CRITICAL-INIT] Service %s is DOWN on first check - sending notification", service.Name)
+			err := uns.sendImmediateNotification(service, actualCurrentStatus, responseTime, errorMessage, "INITIAL_DOWN_DETECTED")
+			if err != nil {
+				// log.Printf("❌ [FAILED] Initial DOWN notification failed for %s: %v", service.Name, err)
+				_ = err
+			} else {
+				// log.Printf("✅ [SUCCESS] Initial DOWN notification sent for %s", service.Name)
+				uns.statusTracker.SetLastNotificationTime(service.ID, time.Now())
+			}
+		} else {
+			// log.Printf("ℹ️ [INIT-SKIP] Service %s is %s on first check - skipping notification (not critical)", service.Name, actualCurrentStatus)
+		}
+		
+		uns.statusTracker.UpdateStatus(service.ID, actualCurrentStatus)
+		return nil
+	}
+
+	// Check if there's a REAL status change
+	if previousStatus != actualCurrentStatus {
+		// log.Printf("🚨 [REAL-CHANGE] STATUS CHANGE for %s: %s -> %s", service.Name, previousStatus, actualCurrentStatus)
+		
+		// Send notification immediately for real status change
+		err := uns.sendImmediateNotification(service, actualCurrentStatus, responseTime, errorMessage, fmt.Sprintf("STATUS_CHANGE_%s_TO_%s", previousStatus, actualCurrentStatus))
+		if err != nil {
+			// log.Printf("❌ [FAILED] Status change notification failed for %s: %v", service.Name, err)
+			return err
+		}
+
+		// log.Printf("✅ [SUCCESS] Status change notification sent for %s", service.Name)
+		uns.statusTracker.SetLastNotificationTime(service.ID, time.Now())
+		uns.statusTracker.UpdateStatus(service.ID, actualCurrentStatus)
+		
+	} else if actualCurrentStatus == "down" {
+		// For services that remain down, send periodic notifications (every 5 minutes)
+		lastNotified := uns.statusTracker.GetLastNotificationTime(service.ID)
+		if time.Since(lastNotified) >= 5*time.Minute {
+			// log.Printf("⏰ [PERIODIC] Service %s still down for 5+ minutes - sending reminder", service.Name)
+			
+			err := uns.sendImmediateNotification(service, actualCurrentStatus, responseTime, errorMessage, "PERIODIC_DOWN_REMINDER")
+			if err != nil {
+				// log.Printf("❌ [FAILED] Periodic down notification failed for %s: %v", service.Name, err)
+				return err
+			}
+
+			// log.Printf("✅ [SUCCESS] Periodic down notification sent for %s", service.Name)
+			uns.statusTracker.SetLastNotificationTime(service.ID, time.Now())
+		}
+	} else {
+		// log.Printf("ℹ️ [NO-CHANGE] No status change for %s (both %s) - no notification needed", service.Name, actualCurrentStatus)
+	}
+
+	return nil
+}
+
+// getActualServiceStatusWithError gets the real current status from PocketBase metrics including error message
+func (uns *UptimeNotificationService) getActualServiceStatusWithError(service UptimeService) (string, int64, string, error) {
+	// Get the appropriate collection based on service type
+	collection := uns.getCollectionForServiceType(service.ServiceType)
+	
+	// log.Printf("🔍 [METRICS-CHECK] Getting actual status for %s from collection: %s", service.Name, collection)
+	
+	// Get the latest metric record for this service
+	records, err := uns.client.GetLatestMetricRecord(service.ID, collection)
+	if err != nil {
+		// log.Printf("❌ [METRICS-ERROR] Failed to get metrics for %s: %v", service.Name, err)
+		return "unknown", 0, fmt.Sprintf("Failed to retrieve metrics: %v", err), err
+	}
+
+	if len(records) == 0 {
+		// log.Printf("⚠️ [NO-METRICS] No metrics found for service %s", service.Name)
+		return "down", 0, "No metrics data available", fmt.Errorf("no metrics found for service %s", service.Name)
+	}
+
+	// Get the latest record
+	latestRecord := records[0]
+	actualStatus := latestRecord.Status
+	responseTime := int64(latestRecord.ResponseTime)
+	errorMessage := latestRecord.ErrorMessage // Get the error message from the record
+	
+	// log.Printf("📈 [METRICS-RESULT] Latest metric for %s: Status=%s, ResponseTime=%dms, Error='%s', Timestamp=%s", 
+	//	service.Name, actualStatus, responseTime, errorMessage, latestRecord.Timestamp)
+
+	return actualStatus, responseTime, errorMessage, nil
+}
+
+// getCollectionForServiceType maps service types to their corresponding collections
+func (uns *UptimeNotificationService) getCollectionForServiceType(serviceType string) string {
+	switch strings.ToLower(serviceType) {
+	case "ping", "icmp":
+		return "ping_data"
+	case "dns":
+		return "dns_data"
+	case "tcp":
+		return "tcp_data"
+	case "http", "https":
+		return "uptime_data"
+	default:
+		return "uptime_data"
+	}
+}
+
+// sendImmediateNotification sends notification with zero delay for status changes
+func (uns *UptimeNotificationService) sendImmediateNotification(service UptimeService, status string, responseTime int64, errorMessage, reason string) error {
+	// log.Printf("⚡ [IMMEDIATE-SEND] Sending notification for %s (status: %s, error: '%s', reason: %s)", service.Name, status, errorMessage, reason)
+
+	// Build notification payload with actual current status and error message
+	payload := &notification.NotificationPayload{
+		ServiceName:  service.Name,
+		Status:       status,
+		Host:         service.Host,
+		Port:         service.Port,
+		ServiceType:  service.ServiceType,
+		ResponseTime: responseTime,
+		ErrorMessage: errorMessage, // Include the error message from metrics
+		Timestamp:    time.Now(),
+		Message:      uns.generateMessage(service, status, reason),
+	}
+
+	// Add optional fields
+	if service.Domain != "" {
+		payload.Domain = service.Domain
+	}
+	if service.URL != "" {
+		payload.URL = service.URL
+	}
+	if service.RegionName != "" {
+		payload.RegionName = service.RegionName
+	}
+	if service.AgentID != "" {
+		payload.AgentID = service.AgentID
+	}
+	payload.Uptime = service.Uptime
+
+	// log.Printf("⚡ [TELEGRAM-SEND] Sending uptime notification for %s via NotificationManager with error: '%s'", service.Name, errorMessage)
+
+	// Send notification using the uptime manager
+	return uns.notificationMgr.SendUptimeServiceNotification(payload, service.NotificationID, service.TemplateID)
+}
+
+// generateMessage creates a status message for notifications
+func (uns *UptimeNotificationService) generateMessage(service UptimeService, status, reason string) string {
+	statusEmoji := "✅"
+	action := "is operational"
+
+	switch strings.ToLower(status) {
+	case "down":
+		statusEmoji = "❌"
+		action = "is DOWN"
+	case "warning":
+		statusEmoji = "⚠️"
+		action = "has issues"
+	case "up":
+		statusEmoji = "✅"
+		previousStatus := uns.statusTracker.GetLastStatus(service.ID)
+		if previousStatus == "down" {
+			action = "has RECOVERED"
+			statusEmoji = "🔄"
+		} else {
+			action = "is operational"
+		}
+	}
+
+	message := fmt.Sprintf("%s [UPTIME] %s %s", statusEmoji, service.Name, action)
+
+	if service.Host != "" {
+		message += fmt.Sprintf(" | Host: %s", service.Host)
+	}
+
+	// Add reason for debugging (only in logs, not in user message)
+	// log.Printf("📝 [MSG-DEBUG] Generated uptime message for %s: %s [%s]", service.Name, message, reason)
+
+	return message
+}
+
+// isNotificationEnabled checks if notifications should be sent
+func (uns *UptimeNotificationService) isNotificationEnabled(service UptimeService) bool {
+	// Check notification_status boolean field
+	if !service.NotificationStatus {
+		// log.Printf("📵 Service %s notification_status: false", service.Name)
+		return false
+	}
+
+	// Check alerts field for muted status
+	if service.Alerts == "muted" {
+		// log.Printf("🔇 Service %s alerts muted", service.Name)
+		return false
+	}
+
+	// Check if notification_id is configured
+	if service.NotificationID == "" {
+		// log.Printf("📵 Service %s has no notification_id", service.Name)
+		return false
+	}
+
+	// log.Printf("✅ Service %s notifications enabled (ID: %s)", service.Name, service.NotificationID)
+	return true
+}
\ No newline at end of file
diff --git a/server/service-operation/uptime-monitoring/status_tracker.go b/server/service-operation/uptime-monitoring/status_tracker.go
new file mode 100644
index 0000000..e59e74a
--- /dev/null
+++ b/server/service-operation/uptime-monitoring/status_tracker.go
@@ -0,0 +1,73 @@
+
+package uptimemonitoring
+
+import (
+	"sync"
+	"time"
+)
+
+// ServiceStatusTracker tracks service status changes and notification timing
+type ServiceStatusTracker struct {
+	lastStatus           map[string]string
+	lastNotificationTime map[string]time.Time
+	mu                   sync.RWMutex
+}
+
+// NewServiceStatusTracker creates a new service status tracker
+func NewServiceStatusTracker() *ServiceStatusTracker {
+	return &ServiceStatusTracker{
+		lastStatus:           make(map[string]string),
+		lastNotificationTime: make(map[string]time.Time),
+	}
+}
+
+// GetLastStatus returns the last known status for a service
+func (sst *ServiceStatusTracker) GetLastStatus(serviceID string) string {
+	sst.mu.RLock()
+	defer sst.mu.RUnlock()
+	status := sst.lastStatus[serviceID]
+	// log.Printf("🔍 GetLastStatus for %s: %s", serviceID, status)
+	return status
+}
+
+// UpdateStatus updates the last known status for a service
+func (sst *ServiceStatusTracker) UpdateStatus(serviceID, status string) {
+	sst.mu.Lock()
+	defer sst.mu.Unlock()
+	
+	oldStatus := sst.lastStatus[serviceID]
+	sst.lastStatus[serviceID] = status
+	
+	// log.Printf("📝 UpdateStatus for %s: %s -> %s", serviceID, oldStatus, status)
+	_ = oldStatus
+}
+
+// GetLastNotificationTime returns the last time a notification was sent for a service
+func (sst *ServiceStatusTracker) GetLastNotificationTime(serviceID string) time.Time {
+	sst.mu.RLock()
+	defer sst.mu.RUnlock()
+	lastTime := sst.lastNotificationTime[serviceID]
+	// log.Printf("⏰ GetLastNotificationTime for %s: %v", serviceID, lastTime)
+	return lastTime
+}
+
+// SetLastNotificationTime sets the last notification time for a service
+func (sst *ServiceStatusTracker) SetLastNotificationTime(serviceID string, t time.Time) {
+	sst.mu.Lock()
+	defer sst.mu.Unlock()
+	sst.lastNotificationTime[serviceID] = t
+	// log.Printf("⏰ SetLastNotificationTime for %s: %v", serviceID, t)
+}
+
+// ShouldNotify determines if a notification should be sent (legacy method for compatibility)
+func (sst *ServiceStatusTracker) ShouldNotify(serviceID, currentStatus string) bool {
+	sst.mu.RLock()
+	lastStatus := sst.lastStatus[serviceID]
+	sst.mu.RUnlock()
+	
+	shouldNotify := lastStatus == "" || lastStatus != currentStatus
+	// log.Printf("🤔 ShouldNotify for %s: lastStatus='%s', currentStatus='%s', result=%t", serviceID, lastStatus, currentStatus, shouldNotify)
+	
+	// Send notification if status changed or if it's the first check
+	return shouldNotify
+}
\ No newline at end of file
diff --git a/server/service-operation/uptime-monitoring/types.go b/server/service-operation/uptime-monitoring/types.go
new file mode 100644
index 0000000..81d7064
--- /dev/null
+++ b/server/service-operation/uptime-monitoring/types.go
@@ -0,0 +1,41 @@
+
+package uptimemonitoring
+
+// UptimeService represents a service from PocketBase
+type UptimeService struct {
+	ID                 string `json:"id"`
+	Name               string `json:"name"`
+	Host               string `json:"host"`
+	Uptime             int    `json:"uptime"`
+	ResponseTime       int64  `json:"response_time"`
+	LastChecked        string `json:"last_checked"`
+	Port               int    `json:"port"`
+	Domain             string `json:"domain"`
+	HeartbeatInterval  int    `json:"heartbeat_interval"`
+	MaxRetries         int    `json:"max_retries"`
+	NotificationID     string `json:"notification_id"`
+	TemplateID         string `json:"template_id"`
+	ServiceType        string `json:"service_type"`
+	Status             string `json:"status"`
+	URL                string `json:"url"`
+	Alerts             string `json:"alerts"`
+	StatusCodes        string `json:"status_codes"`
+	Keyword            string `json:"keyword"`
+	RegionName         string `json:"region_name"`
+	AgentID            string `json:"agent_id"`
+	RegionalStatus     string `json:"regional_status"`
+	NotificationStatus bool   `json:"notification_status"` // Changed from string to bool
+	GroupID            string `json:"group_id"`
+	WebhookID          string `json:"webhook_id"`
+	Created            string `json:"created"`
+	Updated            string `json:"updated"`
+}
+
+// UptimeServicesResponse represents the response from PocketBase services API
+type UptimeServicesResponse struct {
+	Page       int             `json:"page"`
+	PerPage    int             `json:"perPage"`
+	TotalItems int             `json:"totalItems"`
+	TotalPages int             `json:"totalPages"`
+	Items      []UptimeService `json:"items"`
+}
\ No newline at end of file